xmrig | 8d23bd90109bd282071c301ad6b7f924837b79dc1adf9dd3f84681246e9a2ea3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Size

1.9MB
MD5

0f2a1545b88142520eca05f0dd9cbc33
SHA1

f84bf628b74279785dfbf971388cd58b38258358
SHA256

8d23bd90109bd282071c301ad6b7f924837b79dc1adf9dd3f84681246e9a2ea3
SHA512

f8f982e47d87b818f0339d58a859b61ae91aca2b960a656c6b71776ba2e650f13e08ea001ac496488e73c08a94be40bfda6ba52d105a8b24d13aa43589c5579c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1p:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/3960-50-0x00007FF6B4120000-0x00007FF6B4512000-memory.dmp	xmrig
behavioral2/memory/4648-104-0x00007FF749930000-0x00007FF749D22000-memory.dmp	xmrig
behavioral2/memory/3040-176-0x00007FF71F9B0000-0x00007FF71FDA2000-memory.dmp	xmrig
behavioral2/memory/4200-170-0x00007FF6E8F10000-0x00007FF6E9302000-memory.dmp	xmrig
behavioral2/memory/3124-164-0x00007FF603160000-0x00007FF603552000-memory.dmp	xmrig
behavioral2/memory/3356-163-0x00007FF68BBD0000-0x00007FF68BFC2000-memory.dmp	xmrig
behavioral2/memory/1576-157-0x00007FF7F0A40000-0x00007FF7F0E32000-memory.dmp	xmrig
behavioral2/memory/2884-151-0x00007FF6FDFD0000-0x00007FF6FE3C2000-memory.dmp	xmrig
behavioral2/memory/2304-145-0x00007FF7F5590000-0x00007FF7F5982000-memory.dmp	xmrig
behavioral2/memory/4452-139-0x00007FF72A600000-0x00007FF72A9F2000-memory.dmp	xmrig
behavioral2/memory/3944-133-0x00007FF751820000-0x00007FF751C12000-memory.dmp	xmrig
behavioral2/memory/2780-132-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	xmrig
behavioral2/memory/3060-126-0x00007FF7B18D0000-0x00007FF7B1CC2000-memory.dmp	xmrig
behavioral2/memory/1360-120-0x00007FF772400000-0x00007FF7727F2000-memory.dmp	xmrig
behavioral2/memory/1240-116-0x00007FF7553A0000-0x00007FF755792000-memory.dmp	xmrig
behavioral2/memory/1124-115-0x00007FF6FC5E0000-0x00007FF6FC9D2000-memory.dmp	xmrig
behavioral2/memory/2164-109-0x00007FF73B6A0000-0x00007FF73BA92000-memory.dmp	xmrig
behavioral2/memory/3724-101-0x00007FF7E7970000-0x00007FF7E7D62000-memory.dmp	xmrig
behavioral2/memory/2460-95-0x00007FF68BF40000-0x00007FF68C332000-memory.dmp	xmrig
behavioral2/memory/964-44-0x00007FF6AB0A0000-0x00007FF6AB492000-memory.dmp	xmrig
behavioral2/memory/5100-3123-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp	xmrig
behavioral2/memory/2180-3124-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp	xmrig
behavioral2/memory/5064-3125-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp	xmrig
behavioral2/memory/2780-3482-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	xmrig
behavioral2/memory/4492-4199-0x00007FF714340000-0x00007FF714732000-memory.dmp	xmrig
behavioral2/memory/4648-4202-0x00007FF749930000-0x00007FF749D22000-memory.dmp	xmrig
behavioral2/memory/964-4212-0x00007FF6AB0A0000-0x00007FF6AB492000-memory.dmp	xmrig
behavioral2/memory/3960-4209-0x00007FF6B4120000-0x00007FF6B4512000-memory.dmp	xmrig
behavioral2/memory/2164-4208-0x00007FF73B6A0000-0x00007FF73BA92000-memory.dmp	xmrig
behavioral2/memory/5100-4217-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp	xmrig
behavioral2/memory/1240-4230-0x00007FF7553A0000-0x00007FF755792000-memory.dmp	xmrig
behavioral2/memory/1124-4233-0x00007FF6FC5E0000-0x00007FF6FC9D2000-memory.dmp	xmrig
behavioral2/memory/2460-4227-0x00007FF68BF40000-0x00007FF68C332000-memory.dmp	xmrig
behavioral2/memory/3724-4225-0x00007FF7E7970000-0x00007FF7E7D62000-memory.dmp	xmrig
behavioral2/memory/2180-4221-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp	xmrig
behavioral2/memory/1360-4242-0x00007FF772400000-0x00007FF7727F2000-memory.dmp	xmrig
behavioral2/memory/3944-4245-0x00007FF751820000-0x00007FF751C12000-memory.dmp	xmrig
behavioral2/memory/2884-4249-0x00007FF6FDFD0000-0x00007FF6FE3C2000-memory.dmp	xmrig
behavioral2/memory/4452-4244-0x00007FF72A600000-0x00007FF72A9F2000-memory.dmp	xmrig
behavioral2/memory/2304-4251-0x00007FF7F5590000-0x00007FF7F5982000-memory.dmp	xmrig
behavioral2/memory/5064-4239-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp	xmrig
behavioral2/memory/3060-4238-0x00007FF7B18D0000-0x00007FF7B1CC2000-memory.dmp	xmrig
behavioral2/memory/3356-4257-0x00007FF68BBD0000-0x00007FF68BFC2000-memory.dmp	xmrig
behavioral2/memory/1576-4255-0x00007FF7F0A40000-0x00007FF7F0E32000-memory.dmp	xmrig
behavioral2/memory/2780-4841-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	4304	powershell.exe
9	4304	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4304	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4492	VbdJWML.exe
4648	QnbxUAW.exe
964	trxfYos.exe
3960	IpYlIrr.exe
2164	aThzfXl.exe
5100	JWeoyxN.exe
2180	JvNZQkH.exe
1124	LIauSbu.exe
5064	ZwORssq.exe
2460	JuPFiYL.exe
3724	jgoUEWv.exe
1240	pFRwRjK.exe
1360	UCCWydB.exe
3060	csneonD.exe
2780	gdkdtok.exe
3944	nLafEGN.exe
4452	hBihKXp.exe
2304	eJHdPPw.exe
2884	fKDGIkx.exe
1576	RzpDZdT.exe
3356	bDRQOPH.exe
3124	tgNeTpv.exe
4200	tlWfFxR.exe
3040	fToajBo.exe
3648	BVUOAVj.exe
3588	cynvENc.exe
1152	wHEBfMw.exe
4208	SfbDgiU.exe
4016	EmdcvGL.exe
3232	gSMCwPC.exe
4728	khjjWiy.exe
1252	lCWNvnz.exe
3464	QecjbgL.exe
2912	SebVtgk.exe
1432	FyQBTrH.exe
824	ADssSYl.exe
3768	FaFANnj.exe
912	jznxrbg.exe
1064	mcHWZfr.exe
2000	CQjyYYV.exe
4316	ywRubcn.exe
2016	OJxfxAi.exe
3800	xZRaTgE.exe
3560	iRTjBwn.exe
1208	HGUAzAQ.exe
1928	AAAsbGw.exe
2280	VhBnfFw.exe
1348	xOXfkXP.exe
4804	fgSEGXN.exe
1068	EwfYicV.exe
4644	YJnAuvF.exe
2008	FuXIzXC.exe
4952	WFBPggk.exe
1912	WZWsTXz.exe
3044	VsGEiXy.exe
2548	zSSKWKG.exe
2892	oFPBCYv.exe
3320	bZLYuSx.exe
3436	UBArCjv.exe
1944	IbMsWLY.exe
1276	fRXxxRJ.exe
2096	PlabAls.exe
3196	DdhfYnC.exe
4692	nbTXHNA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3908-0-0x00007FF60A410000-0x00007FF60A802000-memory.dmp	upx
behavioral2/files/0x000d000000023b2a-5.dat	upx
behavioral2/files/0x000a000000023b96-9.dat	upx
behavioral2/memory/4492-7-0x00007FF714340000-0x00007FF714732000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-20.dat	upx
behavioral2/files/0x000a000000023b9a-36.dat	upx
behavioral2/memory/3960-50-0x00007FF6B4120000-0x00007FF6B4512000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-73.dat	upx
behavioral2/files/0x000a000000023b9c-80.dat	upx
behavioral2/files/0x000a000000023b9f-85.dat	upx
behavioral2/files/0x000a000000023ba2-91.dat	upx
behavioral2/memory/4648-104-0x00007FF749930000-0x00007FF749D22000-memory.dmp	upx
behavioral2/files/0x000b000000023ba0-110.dat	upx
behavioral2/files/0x000a000000023ba5-117.dat	upx
behavioral2/files/0x000a000000023ba8-136.dat	upx
behavioral2/files/0x000a000000023baa-148.dat	upx
behavioral2/files/0x000a000000023bac-171.dat	upx
behavioral2/files/0x000a000000023bb3-199.dat	upx
behavioral2/files/0x000a000000023bb1-197.dat	upx
behavioral2/files/0x000a000000023bb2-194.dat	upx
behavioral2/files/0x000a000000023bb0-192.dat	upx
behavioral2/files/0x000a000000023baf-187.dat	upx
behavioral2/files/0x000a000000023bae-182.dat	upx
behavioral2/files/0x000a000000023bad-177.dat	upx
behavioral2/memory/3040-176-0x00007FF71F9B0000-0x00007FF71FDA2000-memory.dmp	upx
behavioral2/memory/4200-170-0x00007FF6E8F10000-0x00007FF6E9302000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-165.dat	upx
behavioral2/memory/3124-164-0x00007FF603160000-0x00007FF603552000-memory.dmp	upx
behavioral2/memory/3356-163-0x00007FF68BBD0000-0x00007FF68BFC2000-memory.dmp	upx
behavioral2/memory/1576-157-0x00007FF7F0A40000-0x00007FF7F0E32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-152.dat	upx
behavioral2/memory/2884-151-0x00007FF6FDFD0000-0x00007FF6FE3C2000-memory.dmp	upx
behavioral2/memory/2304-145-0x00007FF7F5590000-0x00007FF7F5982000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-140.dat	upx
behavioral2/memory/4452-139-0x00007FF72A600000-0x00007FF72A9F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-134.dat	upx
behavioral2/memory/3944-133-0x00007FF751820000-0x00007FF751C12000-memory.dmp	upx
behavioral2/memory/2780-132-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	upx
behavioral2/memory/3060-126-0x00007FF7B18D0000-0x00007FF7B1CC2000-memory.dmp	upx
behavioral2/memory/1360-120-0x00007FF772400000-0x00007FF7727F2000-memory.dmp	upx
behavioral2/memory/1240-116-0x00007FF7553A0000-0x00007FF755792000-memory.dmp	upx
behavioral2/memory/1124-115-0x00007FF6FC5E0000-0x00007FF6FC9D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b8f-113.dat	upx
behavioral2/memory/2164-109-0x00007FF73B6A0000-0x00007FF73BA92000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-107.dat	upx
behavioral2/files/0x000b000000023ba1-102.dat	upx
behavioral2/memory/3724-101-0x00007FF7E7970000-0x00007FF7E7D62000-memory.dmp	upx
behavioral2/memory/2460-95-0x00007FF68BF40000-0x00007FF68C332000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-94.dat	upx
behavioral2/memory/5064-93-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp	upx
behavioral2/memory/2180-81-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-77.dat	upx
behavioral2/files/0x000a000000023b9b-72.dat	upx
behavioral2/memory/5100-69-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-51.dat	upx
behavioral2/memory/964-44-0x00007FF6AB0A0000-0x00007FF6AB492000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-34.dat	upx
behavioral2/files/0x000c000000023b7f-15.dat	upx
behavioral2/memory/5100-3123-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp	upx
behavioral2/memory/2180-3124-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp	upx
behavioral2/memory/5064-3125-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp	upx
behavioral2/memory/2780-3482-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp	upx
behavioral2/memory/4492-4199-0x00007FF714340000-0x00007FF714732000-memory.dmp	upx
behavioral2/memory/4648-4202-0x00007FF749930000-0x00007FF749D22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VrNgivW.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eUfOaib.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\tJlntHb.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\NOmvVYm.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\AwnLcXD.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\TjaciBJ.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\AeIANTS.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FSYyPSp.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eUbKpCz.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\NJjWkTB.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ifqQELV.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XfQGmwN.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\pQoylta.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\jWdahVv.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\urnJjZT.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FHcgeUz.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\hcrRklU.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\TVYPsJm.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\gGNMTAB.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\njIAgeE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\dCiHgGW.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\gJQCVcC.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\VbhwNOM.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\JMjjthm.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\wzbJdmP.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\zHrhzVn.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\iTnUmNf.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\cjEoFWP.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\fcNYaoX.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ZNylPZI.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\hhVbqIS.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ufaMmOH.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\uyfJuHW.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eUdXVMr.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eTDbhFa.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ckmcxaR.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ORQurUC.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ciurSEG.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ealXHeC.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\nrzBaUW.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ikOrRDG.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ZJAiijN.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\yRONUVA.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ULyhEdl.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\AvrtduD.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\JUdoaPL.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\DKNnsuw.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FNdnPxY.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\TirNmPA.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XKeRUdD.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\UMfycjS.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\DovgAon.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XoSkHVn.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\RFplBVg.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ZrQUQmi.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\Wzyjxyw.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\mxjBGzC.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\pZGUHEa.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ElVnIUS.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\QVuglLz.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\xrCDSpr.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\dISnlaZ.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\SYgDanj.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\lczPcei.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Token: SeDebugPrivilege	4304	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4304	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	84
PID 3908 wrote to memory of 4304	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	84
PID 3908 wrote to memory of 4492	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	85
PID 3908 wrote to memory of 4492	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	85
PID 3908 wrote to memory of 4648	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4648	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	86
PID 3908 wrote to memory of 964	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	87
PID 3908 wrote to memory of 964	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	87
PID 3908 wrote to memory of 3960	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	88
PID 3908 wrote to memory of 3960	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	88
PID 3908 wrote to memory of 2164	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	89
PID 3908 wrote to memory of 2164	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	89
PID 3908 wrote to memory of 5100	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	90
PID 3908 wrote to memory of 5100	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	90
PID 3908 wrote to memory of 2180	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	91
PID 3908 wrote to memory of 2180	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	91
PID 3908 wrote to memory of 1124	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	92
PID 3908 wrote to memory of 1124	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	92
PID 3908 wrote to memory of 5064	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	93
PID 3908 wrote to memory of 5064	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	93
PID 3908 wrote to memory of 2460	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	94
PID 3908 wrote to memory of 2460	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	94
PID 3908 wrote to memory of 3724	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	95
PID 3908 wrote to memory of 3724	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	95
PID 3908 wrote to memory of 1240	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	96
PID 3908 wrote to memory of 1240	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	96
PID 3908 wrote to memory of 1360	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	97
PID 3908 wrote to memory of 1360	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	97
PID 3908 wrote to memory of 3060	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	98
PID 3908 wrote to memory of 3060	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	98
PID 3908 wrote to memory of 2780	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	99
PID 3908 wrote to memory of 2780	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	99
PID 3908 wrote to memory of 3944	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	100
PID 3908 wrote to memory of 3944	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	100
PID 3908 wrote to memory of 4452	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	101
PID 3908 wrote to memory of 4452	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	101
PID 3908 wrote to memory of 2304	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	102
PID 3908 wrote to memory of 2304	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	102
PID 3908 wrote to memory of 2884	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	103
PID 3908 wrote to memory of 2884	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	103
PID 3908 wrote to memory of 1576	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	104
PID 3908 wrote to memory of 1576	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	104
PID 3908 wrote to memory of 3356	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	105
PID 3908 wrote to memory of 3356	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	105
PID 3908 wrote to memory of 3124	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	106
PID 3908 wrote to memory of 3124	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	106
PID 3908 wrote to memory of 4200	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	107
PID 3908 wrote to memory of 4200	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	107
PID 3908 wrote to memory of 3040	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	108
PID 3908 wrote to memory of 3040	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	108
PID 3908 wrote to memory of 3648	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	109
PID 3908 wrote to memory of 3648	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	109
PID 3908 wrote to memory of 3588	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	110
PID 3908 wrote to memory of 3588	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	110
PID 3908 wrote to memory of 1152	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	111
PID 3908 wrote to memory of 1152	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	111
PID 3908 wrote to memory of 4208	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	112
PID 3908 wrote to memory of 4208	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	112
PID 3908 wrote to memory of 4016	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	113
PID 3908 wrote to memory of 4016	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	113
PID 3908 wrote to memory of 3232	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	114
PID 3908 wrote to memory of 3232	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	114
PID 3908 wrote to memory of 4728	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	115
PID 3908 wrote to memory of 4728	3908	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4304" "2972" "2908" "2976" "0" "0" "2980" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13248
- C:\Windows\System\VbdJWML.exe
  C:\Windows\System\VbdJWML.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\QnbxUAW.exe
  C:\Windows\System\QnbxUAW.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\trxfYos.exe
  C:\Windows\System\trxfYos.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\IpYlIrr.exe
  C:\Windows\System\IpYlIrr.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\aThzfXl.exe
  C:\Windows\System\aThzfXl.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\JWeoyxN.exe
  C:\Windows\System\JWeoyxN.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\JvNZQkH.exe
  C:\Windows\System\JvNZQkH.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\LIauSbu.exe
  C:\Windows\System\LIauSbu.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ZwORssq.exe
  C:\Windows\System\ZwORssq.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\JuPFiYL.exe
  C:\Windows\System\JuPFiYL.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\jgoUEWv.exe
  C:\Windows\System\jgoUEWv.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\pFRwRjK.exe
  C:\Windows\System\pFRwRjK.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\UCCWydB.exe
  C:\Windows\System\UCCWydB.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\csneonD.exe
  C:\Windows\System\csneonD.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\gdkdtok.exe
  C:\Windows\System\gdkdtok.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\nLafEGN.exe
  C:\Windows\System\nLafEGN.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\hBihKXp.exe
  C:\Windows\System\hBihKXp.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\eJHdPPw.exe
  C:\Windows\System\eJHdPPw.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\fKDGIkx.exe
  C:\Windows\System\fKDGIkx.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\RzpDZdT.exe
  C:\Windows\System\RzpDZdT.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\bDRQOPH.exe
  C:\Windows\System\bDRQOPH.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\tgNeTpv.exe
  C:\Windows\System\tgNeTpv.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\tlWfFxR.exe
  C:\Windows\System\tlWfFxR.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\fToajBo.exe
  C:\Windows\System\fToajBo.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\BVUOAVj.exe
  C:\Windows\System\BVUOAVj.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\cynvENc.exe
  C:\Windows\System\cynvENc.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\wHEBfMw.exe
  C:\Windows\System\wHEBfMw.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\SfbDgiU.exe
  C:\Windows\System\SfbDgiU.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\EmdcvGL.exe
  C:\Windows\System\EmdcvGL.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\gSMCwPC.exe
  C:\Windows\System\gSMCwPC.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\khjjWiy.exe
  C:\Windows\System\khjjWiy.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\lCWNvnz.exe
  C:\Windows\System\lCWNvnz.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\QecjbgL.exe
  C:\Windows\System\QecjbgL.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\SebVtgk.exe
  C:\Windows\System\SebVtgk.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\FyQBTrH.exe
  C:\Windows\System\FyQBTrH.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\ADssSYl.exe
  C:\Windows\System\ADssSYl.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\FaFANnj.exe
  C:\Windows\System\FaFANnj.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\jznxrbg.exe
  C:\Windows\System\jznxrbg.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mcHWZfr.exe
  C:\Windows\System\mcHWZfr.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\CQjyYYV.exe
  C:\Windows\System\CQjyYYV.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ywRubcn.exe
  C:\Windows\System\ywRubcn.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\OJxfxAi.exe
  C:\Windows\System\OJxfxAi.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xZRaTgE.exe
  C:\Windows\System\xZRaTgE.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\iRTjBwn.exe
  C:\Windows\System\iRTjBwn.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\HGUAzAQ.exe
  C:\Windows\System\HGUAzAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\AAAsbGw.exe
  C:\Windows\System\AAAsbGw.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\VhBnfFw.exe
  C:\Windows\System\VhBnfFw.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\xOXfkXP.exe
  C:\Windows\System\xOXfkXP.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\fgSEGXN.exe
  C:\Windows\System\fgSEGXN.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\EwfYicV.exe
  C:\Windows\System\EwfYicV.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\YJnAuvF.exe
  C:\Windows\System\YJnAuvF.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\FuXIzXC.exe
  C:\Windows\System\FuXIzXC.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\WFBPggk.exe
  C:\Windows\System\WFBPggk.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\WZWsTXz.exe
  C:\Windows\System\WZWsTXz.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\VsGEiXy.exe
  C:\Windows\System\VsGEiXy.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\zSSKWKG.exe
  C:\Windows\System\zSSKWKG.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\oFPBCYv.exe
  C:\Windows\System\oFPBCYv.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\bZLYuSx.exe
  C:\Windows\System\bZLYuSx.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\UBArCjv.exe
  C:\Windows\System\UBArCjv.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\IbMsWLY.exe
  C:\Windows\System\IbMsWLY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\fRXxxRJ.exe
  C:\Windows\System\fRXxxRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\PlabAls.exe
  C:\Windows\System\PlabAls.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\DdhfYnC.exe
  C:\Windows\System\DdhfYnC.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\nbTXHNA.exe
  C:\Windows\System\nbTXHNA.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\OyuBcZA.exe
  C:\Windows\System\OyuBcZA.exe
  2⤵
  PID:3840
- C:\Windows\System\JWgMThR.exe
  C:\Windows\System\JWgMThR.exe
  2⤵
  PID:4928
- C:\Windows\System\XhfOlXy.exe
  C:\Windows\System\XhfOlXy.exe
  2⤵
  PID:3104
- C:\Windows\System\TWQOcrZ.exe
  C:\Windows\System\TWQOcrZ.exe
  2⤵
  PID:5140
- C:\Windows\System\wWKdmTH.exe
  C:\Windows\System\wWKdmTH.exe
  2⤵
  PID:5168
- C:\Windows\System\oFySJeR.exe
  C:\Windows\System\oFySJeR.exe
  2⤵
  PID:5196
- C:\Windows\System\wBkWSnP.exe
  C:\Windows\System\wBkWSnP.exe
  2⤵
  PID:5228
- C:\Windows\System\dascIzB.exe
  C:\Windows\System\dascIzB.exe
  2⤵
  PID:5256
- C:\Windows\System\YCVDdRg.exe
  C:\Windows\System\YCVDdRg.exe
  2⤵
  PID:5284
- C:\Windows\System\JdReYWl.exe
  C:\Windows\System\JdReYWl.exe
  2⤵
  PID:5312
- C:\Windows\System\nbjyNuB.exe
  C:\Windows\System\nbjyNuB.exe
  2⤵
  PID:5340
- C:\Windows\System\ErWyINZ.exe
  C:\Windows\System\ErWyINZ.exe
  2⤵
  PID:5368
- C:\Windows\System\DuPmvNC.exe
  C:\Windows\System\DuPmvNC.exe
  2⤵
  PID:5396
- C:\Windows\System\oCcWlbU.exe
  C:\Windows\System\oCcWlbU.exe
  2⤵
  PID:5424
- C:\Windows\System\zQPvRsH.exe
  C:\Windows\System\zQPvRsH.exe
  2⤵
  PID:5452
- C:\Windows\System\uAHlQCe.exe
  C:\Windows\System\uAHlQCe.exe
  2⤵
  PID:5480
- C:\Windows\System\aBLJNuU.exe
  C:\Windows\System\aBLJNuU.exe
  2⤵
  PID:5512
- C:\Windows\System\NWCprvg.exe
  C:\Windows\System\NWCprvg.exe
  2⤵
  PID:5540
- C:\Windows\System\sQmJgGK.exe
  C:\Windows\System\sQmJgGK.exe
  2⤵
  PID:5568
- C:\Windows\System\GUmXBNZ.exe
  C:\Windows\System\GUmXBNZ.exe
  2⤵
  PID:5592
- C:\Windows\System\ackCosx.exe
  C:\Windows\System\ackCosx.exe
  2⤵
  PID:5628
- C:\Windows\System\IRdIrUu.exe
  C:\Windows\System\IRdIrUu.exe
  2⤵
  PID:5652
- C:\Windows\System\kVuWeip.exe
  C:\Windows\System\kVuWeip.exe
  2⤵
  PID:5680
- C:\Windows\System\QiRFFsc.exe
  C:\Windows\System\QiRFFsc.exe
  2⤵
  PID:5708
- C:\Windows\System\xNTrgAU.exe
  C:\Windows\System\xNTrgAU.exe
  2⤵
  PID:5736
- C:\Windows\System\PoslQaU.exe
  C:\Windows\System\PoslQaU.exe
  2⤵
  PID:5764
- C:\Windows\System\eFKKVHI.exe
  C:\Windows\System\eFKKVHI.exe
  2⤵
  PID:5792
- C:\Windows\System\aYNOerG.exe
  C:\Windows\System\aYNOerG.exe
  2⤵
  PID:5820
- C:\Windows\System\dMUJwAR.exe
  C:\Windows\System\dMUJwAR.exe
  2⤵
  PID:5848
- C:\Windows\System\QLpjESO.exe
  C:\Windows\System\QLpjESO.exe
  2⤵
  PID:5876
- C:\Windows\System\ZlFSLxQ.exe
  C:\Windows\System\ZlFSLxQ.exe
  2⤵
  PID:5904
- C:\Windows\System\hksUmUw.exe
  C:\Windows\System\hksUmUw.exe
  2⤵
  PID:5932
- C:\Windows\System\DirSTni.exe
  C:\Windows\System\DirSTni.exe
  2⤵
  PID:5984
- C:\Windows\System\NrmkTYK.exe
  C:\Windows\System\NrmkTYK.exe
  2⤵
  PID:6012
- C:\Windows\System\duZhjAp.exe
  C:\Windows\System\duZhjAp.exe
  2⤵
  PID:6028
- C:\Windows\System\ctGMUfO.exe
  C:\Windows\System\ctGMUfO.exe
  2⤵
  PID:6044
- C:\Windows\System\zqwABff.exe
  C:\Windows\System\zqwABff.exe
  2⤵
  PID:6072
- C:\Windows\System\bIUuIaX.exe
  C:\Windows\System\bIUuIaX.exe
  2⤵
  PID:6100
- C:\Windows\System\gFqMkKU.exe
  C:\Windows\System\gFqMkKU.exe
  2⤵
  PID:6128
- C:\Windows\System\rroQlXA.exe
  C:\Windows\System\rroQlXA.exe
  2⤵
  PID:4536
- C:\Windows\System\gdcyQES.exe
  C:\Windows\System\gdcyQES.exe
  2⤵
  PID:4320
- C:\Windows\System\dEHmJGe.exe
  C:\Windows\System\dEHmJGe.exe
  2⤵
  PID:3556
- C:\Windows\System\lwcuKQs.exe
  C:\Windows\System\lwcuKQs.exe
  2⤵
  PID:376
- C:\Windows\System\xesSHqL.exe
  C:\Windows\System\xesSHqL.exe
  2⤵
  PID:5124
- C:\Windows\System\orkUnTc.exe
  C:\Windows\System\orkUnTc.exe
  2⤵
  PID:5160
- C:\Windows\System\zhoNIqB.exe
  C:\Windows\System\zhoNIqB.exe
  2⤵
  PID:5220
- C:\Windows\System\tduIJbN.exe
  C:\Windows\System\tduIJbN.exe
  2⤵
  PID:5296
- C:\Windows\System\sLIkULW.exe
  C:\Windows\System\sLIkULW.exe
  2⤵
  PID:5360
- C:\Windows\System\BhpoUIW.exe
  C:\Windows\System\BhpoUIW.exe
  2⤵
  PID:5444
- C:\Windows\System\pDBgReY.exe
  C:\Windows\System\pDBgReY.exe
  2⤵
  PID:5528
- C:\Windows\System\kNMntZq.exe
  C:\Windows\System\kNMntZq.exe
  2⤵
  PID:5580
- C:\Windows\System\DoTjWhb.exe
  C:\Windows\System\DoTjWhb.exe
  2⤵
  PID:5648
- C:\Windows\System\Rhkrfez.exe
  C:\Windows\System\Rhkrfez.exe
  2⤵
  PID:1524
- C:\Windows\System\STsFqEU.exe
  C:\Windows\System\STsFqEU.exe
  2⤵
  PID:5756
- C:\Windows\System\rfSIYgG.exe
  C:\Windows\System\rfSIYgG.exe
  2⤵
  PID:5812
- C:\Windows\System\BUNxsne.exe
  C:\Windows\System\BUNxsne.exe
  2⤵
  PID:5888
- C:\Windows\System\PoGLyox.exe
  C:\Windows\System\PoGLyox.exe
  2⤵
  PID:5944
- C:\Windows\System\yXNpAXr.exe
  C:\Windows\System\yXNpAXr.exe
  2⤵
  PID:6000
- C:\Windows\System\rjOuBWZ.exe
  C:\Windows\System\rjOuBWZ.exe
  2⤵
  PID:6060
- C:\Windows\System\wGasEIW.exe
  C:\Windows\System\wGasEIW.exe
  2⤵
  PID:3932
- C:\Windows\System\XdlDxWi.exe
  C:\Windows\System\XdlDxWi.exe
  2⤵
  PID:400
- C:\Windows\System\jxzGgLM.exe
  C:\Windows\System\jxzGgLM.exe
  2⤵
  PID:460
- C:\Windows\System\yuRYzzG.exe
  C:\Windows\System\yuRYzzG.exe
  2⤵
  PID:4716
- C:\Windows\System\fRGgfje.exe
  C:\Windows\System\fRGgfje.exe
  2⤵
  PID:5248
- C:\Windows\System\iGyTqOu.exe
  C:\Windows\System\iGyTqOu.exe
  2⤵
  PID:5356
- C:\Windows\System\xxmEzdT.exe
  C:\Windows\System\xxmEzdT.exe
  2⤵
  PID:5504
- C:\Windows\System\crHrRaY.exe
  C:\Windows\System\crHrRaY.exe
  2⤵
  PID:1204
- C:\Windows\System\EBfWdXc.exe
  C:\Windows\System\EBfWdXc.exe
  2⤵
  PID:5696
- C:\Windows\System\mGZLiMR.exe
  C:\Windows\System\mGZLiMR.exe
  2⤵
  PID:5808
- C:\Windows\System\tPhuYKT.exe
  C:\Windows\System\tPhuYKT.exe
  2⤵
  PID:5056
- C:\Windows\System\NwWlNNk.exe
  C:\Windows\System\NwWlNNk.exe
  2⤵
  PID:6088
- C:\Windows\System\IrILYlI.exe
  C:\Windows\System\IrILYlI.exe
  2⤵
  PID:232
- C:\Windows\System\lxuRVuP.exe
  C:\Windows\System\lxuRVuP.exe
  2⤵
  PID:5020
- C:\Windows\System\oUAbJRc.exe
  C:\Windows\System\oUAbJRc.exe
  2⤵
  PID:5332
- C:\Windows\System\PaGeYHK.exe
  C:\Windows\System\PaGeYHK.exe
  2⤵
  PID:1364
- C:\Windows\System\aXvWvGx.exe
  C:\Windows\System\aXvWvGx.exe
  2⤵
  PID:5784
- C:\Windows\System\HRJaKmG.exe
  C:\Windows\System\HRJaKmG.exe
  2⤵
  PID:6168
- C:\Windows\System\aaQoxCl.exe
  C:\Windows\System\aaQoxCl.exe
  2⤵
  PID:6196
- C:\Windows\System\rlpTIxH.exe
  C:\Windows\System\rlpTIxH.exe
  2⤵
  PID:6224
- C:\Windows\System\JgZxZTu.exe
  C:\Windows\System\JgZxZTu.exe
  2⤵
  PID:6252
- C:\Windows\System\BHHEJIU.exe
  C:\Windows\System\BHHEJIU.exe
  2⤵
  PID:6280
- C:\Windows\System\wjaqkFS.exe
  C:\Windows\System\wjaqkFS.exe
  2⤵
  PID:6308
- C:\Windows\System\KJVUfmP.exe
  C:\Windows\System\KJVUfmP.exe
  2⤵
  PID:6336
- C:\Windows\System\oqbNplZ.exe
  C:\Windows\System\oqbNplZ.exe
  2⤵
  PID:6364
- C:\Windows\System\qwwtkea.exe
  C:\Windows\System\qwwtkea.exe
  2⤵
  PID:6392
- C:\Windows\System\tonBQOG.exe
  C:\Windows\System\tonBQOG.exe
  2⤵
  PID:6420
- C:\Windows\System\WXpvkcl.exe
  C:\Windows\System\WXpvkcl.exe
  2⤵
  PID:6448
- C:\Windows\System\oOrxKYb.exe
  C:\Windows\System\oOrxKYb.exe
  2⤵
  PID:6476
- C:\Windows\System\qriKXIq.exe
  C:\Windows\System\qriKXIq.exe
  2⤵
  PID:6504
- C:\Windows\System\lSiEaBc.exe
  C:\Windows\System\lSiEaBc.exe
  2⤵
  PID:6532
- C:\Windows\System\dXxzCAr.exe
  C:\Windows\System\dXxzCAr.exe
  2⤵
  PID:6560
- C:\Windows\System\ZWqcQfd.exe
  C:\Windows\System\ZWqcQfd.exe
  2⤵
  PID:6588
- C:\Windows\System\PhoDwEO.exe
  C:\Windows\System\PhoDwEO.exe
  2⤵
  PID:6616
- C:\Windows\System\LhWXcsj.exe
  C:\Windows\System\LhWXcsj.exe
  2⤵
  PID:6644
- C:\Windows\System\CAnrFnW.exe
  C:\Windows\System\CAnrFnW.exe
  2⤵
  PID:6672
- C:\Windows\System\RdfHraX.exe
  C:\Windows\System\RdfHraX.exe
  2⤵
  PID:6700
- C:\Windows\System\HiYELOf.exe
  C:\Windows\System\HiYELOf.exe
  2⤵
  PID:6728
- C:\Windows\System\bsfELWP.exe
  C:\Windows\System\bsfELWP.exe
  2⤵
  PID:6756
- C:\Windows\System\xNvhKme.exe
  C:\Windows\System\xNvhKme.exe
  2⤵
  PID:6784
- C:\Windows\System\aVnbLQE.exe
  C:\Windows\System\aVnbLQE.exe
  2⤵
  PID:6812
- C:\Windows\System\SFLVeRd.exe
  C:\Windows\System\SFLVeRd.exe
  2⤵
  PID:6840
- C:\Windows\System\OuhyRUL.exe
  C:\Windows\System\OuhyRUL.exe
  2⤵
  PID:6864
- C:\Windows\System\MnENCUx.exe
  C:\Windows\System\MnENCUx.exe
  2⤵
  PID:6892
- C:\Windows\System\wCbrgPp.exe
  C:\Windows\System\wCbrgPp.exe
  2⤵
  PID:6924
- C:\Windows\System\IrFoxdd.exe
  C:\Windows\System\IrFoxdd.exe
  2⤵
  PID:6952
- C:\Windows\System\RSvVWWC.exe
  C:\Windows\System\RSvVWWC.exe
  2⤵
  PID:6980
- C:\Windows\System\VnFIuyy.exe
  C:\Windows\System\VnFIuyy.exe
  2⤵
  PID:7008
- C:\Windows\System\GEIcWfj.exe
  C:\Windows\System\GEIcWfj.exe
  2⤵
  PID:7036
- C:\Windows\System\qFodFDg.exe
  C:\Windows\System\qFodFDg.exe
  2⤵
  PID:7064
- C:\Windows\System\MAjENBn.exe
  C:\Windows\System\MAjENBn.exe
  2⤵
  PID:7092
- C:\Windows\System\OvxAyBQ.exe
  C:\Windows\System\OvxAyBQ.exe
  2⤵
  PID:7120
- C:\Windows\System\XPTWrFv.exe
  C:\Windows\System\XPTWrFv.exe
  2⤵
  PID:7148
- C:\Windows\System\VnWKmsd.exe
  C:\Windows\System\VnWKmsd.exe
  2⤵
  PID:5920
- C:\Windows\System\GqvtlTC.exe
  C:\Windows\System\GqvtlTC.exe
  2⤵
  PID:3928
- C:\Windows\System\zoCHKPd.exe
  C:\Windows\System\zoCHKPd.exe
  2⤵
  PID:5324
- C:\Windows\System\izFBQrF.exe
  C:\Windows\System\izFBQrF.exe
  2⤵
  PID:4188
- C:\Windows\System\sVVYkNm.exe
  C:\Windows\System\sVVYkNm.exe
  2⤵
  PID:4888
- C:\Windows\System\kvYihkD.exe
  C:\Windows\System\kvYihkD.exe
  2⤵
  PID:3360
- C:\Windows\System\QAdKSJn.exe
  C:\Windows\System\QAdKSJn.exe
  2⤵
  PID:6292
- C:\Windows\System\gZKZjao.exe
  C:\Windows\System\gZKZjao.exe
  2⤵
  PID:6348
- C:\Windows\System\XlcTxPs.exe
  C:\Windows\System\XlcTxPs.exe
  2⤵
  PID:6404
- C:\Windows\System\QVDbzzE.exe
  C:\Windows\System\QVDbzzE.exe
  2⤵
  PID:3808
- C:\Windows\System\OsGJfUR.exe
  C:\Windows\System\OsGJfUR.exe
  2⤵
  PID:4416
- C:\Windows\System\ZLbcSkm.exe
  C:\Windows\System\ZLbcSkm.exe
  2⤵
  PID:2380
- C:\Windows\System\TMTFYlL.exe
  C:\Windows\System\TMTFYlL.exe
  2⤵
  PID:6572
- C:\Windows\System\IKnvTJi.exe
  C:\Windows\System\IKnvTJi.exe
  2⤵
  PID:4712
- C:\Windows\System\LJcRffT.exe
  C:\Windows\System\LJcRffT.exe
  2⤵
  PID:6684
- C:\Windows\System\beVKFSz.exe
  C:\Windows\System\beVKFSz.exe
  2⤵
  PID:6716
- C:\Windows\System\HYJEwqZ.exe
  C:\Windows\System\HYJEwqZ.exe
  2⤵
  PID:6828
- C:\Windows\System\SIJkqhE.exe
  C:\Windows\System\SIJkqhE.exe
  2⤵
  PID:6916
- C:\Windows\System\WATkqIo.exe
  C:\Windows\System\WATkqIo.exe
  2⤵
  PID:6964
- C:\Windows\System\DxiEqnd.exe
  C:\Windows\System\DxiEqnd.exe
  2⤵
  PID:7076
- C:\Windows\System\hcVDRrR.exe
  C:\Windows\System\hcVDRrR.exe
  2⤵
  PID:7132
- C:\Windows\System\FejBXji.exe
  C:\Windows\System\FejBXji.exe
  2⤵
  PID:7164
- C:\Windows\System\IFETcvf.exe
  C:\Windows\System\IFETcvf.exe
  2⤵
  PID:5208
- C:\Windows\System\zAhGqZx.exe
  C:\Windows\System\zAhGqZx.exe
  2⤵
  PID:1988
- C:\Windows\System\YffViGL.exe
  C:\Windows\System\YffViGL.exe
  2⤵
  PID:6208
- C:\Windows\System\oXQcUhZ.exe
  C:\Windows\System\oXQcUhZ.exe
  2⤵
  PID:6268
- C:\Windows\System\vUnFiua.exe
  C:\Windows\System\vUnFiua.exe
  2⤵
  PID:6376
- C:\Windows\System\aIuVyvl.exe
  C:\Windows\System\aIuVyvl.exe
  2⤵
  PID:2320
- C:\Windows\System\jZwrnWp.exe
  C:\Windows\System\jZwrnWp.exe
  2⤵
  PID:4004
- C:\Windows\System\uvPVaZo.exe
  C:\Windows\System\uvPVaZo.exe
  2⤵
  PID:6576
- C:\Windows\System\WzaycoQ.exe
  C:\Windows\System\WzaycoQ.exe
  2⤵
  PID:1092
- C:\Windows\System\gIEVZaF.exe
  C:\Windows\System\gIEVZaF.exe
  2⤵
  PID:4388
- C:\Windows\System\aqqZRXq.exe
  C:\Windows\System\aqqZRXq.exe
  2⤵
  PID:6468
- C:\Windows\System\accHLoM.exe
  C:\Windows\System\accHLoM.exe
  2⤵
  PID:4396
- C:\Windows\System\IGugzoq.exe
  C:\Windows\System\IGugzoq.exe
  2⤵
  PID:6912
- C:\Windows\System\Bqciist.exe
  C:\Windows\System\Bqciist.exe
  2⤵
  PID:7140
- C:\Windows\System\JYJteuu.exe
  C:\Windows\System\JYJteuu.exe
  2⤵
  PID:6216
- C:\Windows\System\oItUOwT.exe
  C:\Windows\System\oItUOwT.exe
  2⤵
  PID:3412
- C:\Windows\System\qiIemRn.exe
  C:\Windows\System\qiIemRn.exe
  2⤵
  PID:868
- C:\Windows\System\JYCxoyN.exe
  C:\Windows\System\JYCxoyN.exe
  2⤵
  PID:4864
- C:\Windows\System\OiwLrvm.exe
  C:\Windows\System\OiwLrvm.exe
  2⤵
  PID:6808
- C:\Windows\System\QzVEKRr.exe
  C:\Windows\System\QzVEKRr.exe
  2⤵
  PID:1408
- C:\Windows\System\YUdNZWB.exe
  C:\Windows\System\YUdNZWB.exe
  2⤵
  PID:6328
- C:\Windows\System\VaDEmDZ.exe
  C:\Windows\System\VaDEmDZ.exe
  2⤵
  PID:3624
- C:\Windows\System\paGppBd.exe
  C:\Windows\System\paGppBd.exe
  2⤵
  PID:5276
- C:\Windows\System\TltSfCJ.exe
  C:\Windows\System\TltSfCJ.exe
  2⤵
  PID:7180
- C:\Windows\System\cXAmmwd.exe
  C:\Windows\System\cXAmmwd.exe
  2⤵
  PID:7196
- C:\Windows\System\VqULiWi.exe
  C:\Windows\System\VqULiWi.exe
  2⤵
  PID:7216
- C:\Windows\System\OVZMDIJ.exe
  C:\Windows\System\OVZMDIJ.exe
  2⤵
  PID:7240
- C:\Windows\System\WpswVSM.exe
  C:\Windows\System\WpswVSM.exe
  2⤵
  PID:7260
- C:\Windows\System\UQKmXei.exe
  C:\Windows\System\UQKmXei.exe
  2⤵
  PID:7304
- C:\Windows\System\meztRKT.exe
  C:\Windows\System\meztRKT.exe
  2⤵
  PID:7376
- C:\Windows\System\EgTvuBv.exe
  C:\Windows\System\EgTvuBv.exe
  2⤵
  PID:7408
- C:\Windows\System\CepMWKF.exe
  C:\Windows\System\CepMWKF.exe
  2⤵
  PID:7428
- C:\Windows\System\KjlYpiY.exe
  C:\Windows\System\KjlYpiY.exe
  2⤵
  PID:7448
- C:\Windows\System\RNKfpty.exe
  C:\Windows\System\RNKfpty.exe
  2⤵
  PID:7476
- C:\Windows\System\yHliBVS.exe
  C:\Windows\System\yHliBVS.exe
  2⤵
  PID:7520
- C:\Windows\System\pRbByzg.exe
  C:\Windows\System\pRbByzg.exe
  2⤵
  PID:7552
- C:\Windows\System\hlmyImQ.exe
  C:\Windows\System\hlmyImQ.exe
  2⤵
  PID:7568
- C:\Windows\System\ZkXgFPE.exe
  C:\Windows\System\ZkXgFPE.exe
  2⤵
  PID:7588
- C:\Windows\System\QOOmtVK.exe
  C:\Windows\System\QOOmtVK.exe
  2⤵
  PID:7616
- C:\Windows\System\roqiaAv.exe
  C:\Windows\System\roqiaAv.exe
  2⤵
  PID:7636
- C:\Windows\System\qOguEbU.exe
  C:\Windows\System\qOguEbU.exe
  2⤵
  PID:7656
- C:\Windows\System\qTfMHxU.exe
  C:\Windows\System\qTfMHxU.exe
  2⤵
  PID:7708
- C:\Windows\System\nbXfcAK.exe
  C:\Windows\System\nbXfcAK.exe
  2⤵
  PID:7724
- C:\Windows\System\bNnDnJw.exe
  C:\Windows\System\bNnDnJw.exe
  2⤵
  PID:7752
- C:\Windows\System\jTVsFIQ.exe
  C:\Windows\System\jTVsFIQ.exe
  2⤵
  PID:7776
- C:\Windows\System\AnzVzdZ.exe
  C:\Windows\System\AnzVzdZ.exe
  2⤵
  PID:7816
- C:\Windows\System\ktzmgab.exe
  C:\Windows\System\ktzmgab.exe
  2⤵
  PID:7848
- C:\Windows\System\EEcApoe.exe
  C:\Windows\System\EEcApoe.exe
  2⤵
  PID:7880
- C:\Windows\System\LKCPUat.exe
  C:\Windows\System\LKCPUat.exe
  2⤵
  PID:7904
- C:\Windows\System\vpfOdPu.exe
  C:\Windows\System\vpfOdPu.exe
  2⤵
  PID:7952
- C:\Windows\System\aTxytiA.exe
  C:\Windows\System\aTxytiA.exe
  2⤵
  PID:7976
- C:\Windows\System\DKXFhwV.exe
  C:\Windows\System\DKXFhwV.exe
  2⤵
  PID:8024
- C:\Windows\System\RKGijPR.exe
  C:\Windows\System\RKGijPR.exe
  2⤵
  PID:8048
- C:\Windows\System\ReqqMna.exe
  C:\Windows\System\ReqqMna.exe
  2⤵
  PID:8068
- C:\Windows\System\eTDbhFa.exe
  C:\Windows\System\eTDbhFa.exe
  2⤵
  PID:8108
- C:\Windows\System\YdeHzfw.exe
  C:\Windows\System\YdeHzfw.exe
  2⤵
  PID:8124
- C:\Windows\System\nivUTPh.exe
  C:\Windows\System\nivUTPh.exe
  2⤵
  PID:8164
- C:\Windows\System\cbmYFfA.exe
  C:\Windows\System\cbmYFfA.exe
  2⤵
  PID:8188
- C:\Windows\System\jfowSmp.exe
  C:\Windows\System\jfowSmp.exe
  2⤵
  PID:7172
- C:\Windows\System\rHZRzYc.exe
  C:\Windows\System\rHZRzYc.exe
  2⤵
  PID:7212
- C:\Windows\System\YltBCqo.exe
  C:\Windows\System\YltBCqo.exe
  2⤵
  PID:7288
- C:\Windows\System\wbnpeCe.exe
  C:\Windows\System\wbnpeCe.exe
  2⤵
  PID:7316
- C:\Windows\System\YTqLpjA.exe
  C:\Windows\System\YTqLpjA.exe
  2⤵
  PID:7364
- C:\Windows\System\OHpGHyJ.exe
  C:\Windows\System\OHpGHyJ.exe
  2⤵
  PID:7456
- C:\Windows\System\dkkXHFG.exe
  C:\Windows\System\dkkXHFG.exe
  2⤵
  PID:7488
- C:\Windows\System\CtrCCKK.exe
  C:\Windows\System\CtrCCKK.exe
  2⤵
  PID:7584
- C:\Windows\System\dxTDPKw.exe
  C:\Windows\System\dxTDPKw.exe
  2⤵
  PID:7672
- C:\Windows\System\kdVylEp.exe
  C:\Windows\System\kdVylEp.exe
  2⤵
  PID:7732
- C:\Windows\System\rqJaBed.exe
  C:\Windows\System\rqJaBed.exe
  2⤵
  PID:7784
- C:\Windows\System\JXVCFoj.exe
  C:\Windows\System\JXVCFoj.exe
  2⤵
  PID:7840
- C:\Windows\System\fjNtSGT.exe
  C:\Windows\System\fjNtSGT.exe
  2⤵
  PID:7948
- C:\Windows\System\Yrlsnsc.exe
  C:\Windows\System\Yrlsnsc.exe
  2⤵
  PID:7972
- C:\Windows\System\vTnXzoC.exe
  C:\Windows\System\vTnXzoC.exe
  2⤵
  PID:8064
- C:\Windows\System\fkwROuv.exe
  C:\Windows\System\fkwROuv.exe
  2⤵
  PID:8140
- C:\Windows\System\hXIJuNs.exe
  C:\Windows\System\hXIJuNs.exe
  2⤵
  PID:8176
- C:\Windows\System\eVapJpd.exe
  C:\Windows\System\eVapJpd.exe
  2⤵
  PID:4596
- C:\Windows\System\GjQVBDN.exe
  C:\Windows\System\GjQVBDN.exe
  2⤵
  PID:7280
- C:\Windows\System\rPHGDcb.exe
  C:\Windows\System\rPHGDcb.exe
  2⤵
  PID:7528
- C:\Windows\System\dzfRyEx.exe
  C:\Windows\System\dzfRyEx.exe
  2⤵
  PID:7628
- C:\Windows\System\JejGzil.exe
  C:\Windows\System\JejGzil.exe
  2⤵
  PID:7744
- C:\Windows\System\jndgYJF.exe
  C:\Windows\System\jndgYJF.exe
  2⤵
  PID:8008
- C:\Windows\System\ODOOFVD.exe
  C:\Windows\System\ODOOFVD.exe
  2⤵
  PID:8172
- C:\Windows\System\QkEDzlO.exe
  C:\Windows\System\QkEDzlO.exe
  2⤵
  PID:7248
- C:\Windows\System\rEFUNnJ.exe
  C:\Windows\System\rEFUNnJ.exe
  2⤵
  PID:7560
- C:\Windows\System\nhyHCSS.exe
  C:\Windows\System\nhyHCSS.exe
  2⤵
  PID:7420
- C:\Windows\System\MTKzkSG.exe
  C:\Windows\System\MTKzkSG.exe
  2⤵
  PID:4576
- C:\Windows\System\XjMwRtM.exe
  C:\Windows\System\XjMwRtM.exe
  2⤵
  PID:8204
- C:\Windows\System\OTwrzjI.exe
  C:\Windows\System\OTwrzjI.exe
  2⤵
  PID:8236
- C:\Windows\System\gVMhsme.exe
  C:\Windows\System\gVMhsme.exe
  2⤵
  PID:8276
- C:\Windows\System\SfVAjws.exe
  C:\Windows\System\SfVAjws.exe
  2⤵
  PID:8304
- C:\Windows\System\TlBbbqT.exe
  C:\Windows\System\TlBbbqT.exe
  2⤵
  PID:8320
- C:\Windows\System\hRraFXg.exe
  C:\Windows\System\hRraFXg.exe
  2⤵
  PID:8364
- C:\Windows\System\kDSUOUe.exe
  C:\Windows\System\kDSUOUe.exe
  2⤵
  PID:8388
- C:\Windows\System\lVCdEzL.exe
  C:\Windows\System\lVCdEzL.exe
  2⤵
  PID:8412
- C:\Windows\System\rSAVkSk.exe
  C:\Windows\System\rSAVkSk.exe
  2⤵
  PID:8428
- C:\Windows\System\lAgNUgz.exe
  C:\Windows\System\lAgNUgz.exe
  2⤵
  PID:8452
- C:\Windows\System\aQpKcQs.exe
  C:\Windows\System\aQpKcQs.exe
  2⤵
  PID:8492
- C:\Windows\System\mPLLkZe.exe
  C:\Windows\System\mPLLkZe.exe
  2⤵
  PID:8540
- C:\Windows\System\bFNhyQs.exe
  C:\Windows\System\bFNhyQs.exe
  2⤵
  PID:8572
- C:\Windows\System\ZjdxFzu.exe
  C:\Windows\System\ZjdxFzu.exe
  2⤵
  PID:8596
- C:\Windows\System\pzZZgLN.exe
  C:\Windows\System\pzZZgLN.exe
  2⤵
  PID:8620
- C:\Windows\System\uytvYgD.exe
  C:\Windows\System\uytvYgD.exe
  2⤵
  PID:8664
- C:\Windows\System\CmVgnpU.exe
  C:\Windows\System\CmVgnpU.exe
  2⤵
  PID:8680
- C:\Windows\System\wCznjar.exe
  C:\Windows\System\wCznjar.exe
  2⤵
  PID:8724
- C:\Windows\System\gTOfioI.exe
  C:\Windows\System\gTOfioI.exe
  2⤵
  PID:8744
- C:\Windows\System\GDgPKCD.exe
  C:\Windows\System\GDgPKCD.exe
  2⤵
  PID:8772
- C:\Windows\System\AZGqmoz.exe
  C:\Windows\System\AZGqmoz.exe
  2⤵
  PID:8788
- C:\Windows\System\gTstEVM.exe
  C:\Windows\System\gTstEVM.exe
  2⤵
  PID:8816
- C:\Windows\System\juWNzOe.exe
  C:\Windows\System\juWNzOe.exe
  2⤵
  PID:8844
- C:\Windows\System\vlIcSWZ.exe
  C:\Windows\System\vlIcSWZ.exe
  2⤵
  PID:8872
- C:\Windows\System\cUZdVgY.exe
  C:\Windows\System\cUZdVgY.exe
  2⤵
  PID:8896
- C:\Windows\System\SLCasXL.exe
  C:\Windows\System\SLCasXL.exe
  2⤵
  PID:8916
- C:\Windows\System\QeXqqrY.exe
  C:\Windows\System\QeXqqrY.exe
  2⤵
  PID:8944
- C:\Windows\System\idCHpdb.exe
  C:\Windows\System\idCHpdb.exe
  2⤵
  PID:8976
- C:\Windows\System\nzdIJBp.exe
  C:\Windows\System\nzdIJBp.exe
  2⤵
  PID:9028
- C:\Windows\System\OfEjAux.exe
  C:\Windows\System\OfEjAux.exe
  2⤵
  PID:9048
- C:\Windows\System\EnESxjb.exe
  C:\Windows\System\EnESxjb.exe
  2⤵
  PID:9088
- C:\Windows\System\jSxaOLI.exe
  C:\Windows\System\jSxaOLI.exe
  2⤵
  PID:9116
- C:\Windows\System\aGQfrbA.exe
  C:\Windows\System\aGQfrbA.exe
  2⤵
  PID:9132
- C:\Windows\System\axAGzIc.exe
  C:\Windows\System\axAGzIc.exe
  2⤵
  PID:9152
- C:\Windows\System\AUlRWOY.exe
  C:\Windows\System\AUlRWOY.exe
  2⤵
  PID:9176
- C:\Windows\System\sjhXEKz.exe
  C:\Windows\System\sjhXEKz.exe
  2⤵
  PID:9212
- C:\Windows\System\VEhiIur.exe
  C:\Windows\System\VEhiIur.exe
  2⤵
  PID:8196
- C:\Windows\System\ZNnKGgD.exe
  C:\Windows\System\ZNnKGgD.exe
  2⤵
  PID:8264
- C:\Windows\System\aWEbsTj.exe
  C:\Windows\System\aWEbsTj.exe
  2⤵
  PID:8312
- C:\Windows\System\HDoEblt.exe
  C:\Windows\System\HDoEblt.exe
  2⤵
  PID:8372
- C:\Windows\System\Cpgbcpj.exe
  C:\Windows\System\Cpgbcpj.exe
  2⤵
  PID:8484
- C:\Windows\System\yhxCKqK.exe
  C:\Windows\System\yhxCKqK.exe
  2⤵
  PID:8568
- C:\Windows\System\NIcqSCW.exe
  C:\Windows\System\NIcqSCW.exe
  2⤵
  PID:8604
- C:\Windows\System\JJKWckF.exe
  C:\Windows\System\JJKWckF.exe
  2⤵
  PID:8656
- C:\Windows\System\EWucwpy.exe
  C:\Windows\System\EWucwpy.exe
  2⤵
  PID:8676
- C:\Windows\System\MzTFUUg.exe
  C:\Windows\System\MzTFUUg.exe
  2⤵
  PID:8760
- C:\Windows\System\fAxryQU.exe
  C:\Windows\System\fAxryQU.exe
  2⤵
  PID:8840
- C:\Windows\System\RYXKAwS.exe
  C:\Windows\System\RYXKAwS.exe
  2⤵
  PID:8940
- C:\Windows\System\jiuogJU.exe
  C:\Windows\System\jiuogJU.exe
  2⤵
  PID:8996
- C:\Windows\System\InmfQyh.exe
  C:\Windows\System\InmfQyh.exe
  2⤵
  PID:9100
- C:\Windows\System\qFOUvTe.exe
  C:\Windows\System\qFOUvTe.exe
  2⤵
  PID:9128
- C:\Windows\System\ivObukM.exe
  C:\Windows\System\ivObukM.exe
  2⤵
  PID:8116
- C:\Windows\System\nFNouSU.exe
  C:\Windows\System\nFNouSU.exe
  2⤵
  PID:8260
- C:\Windows\System\xkSQZEt.exe
  C:\Windows\System\xkSQZEt.exe
  2⤵
  PID:8404
- C:\Windows\System\EkDyWUG.exe
  C:\Windows\System\EkDyWUG.exe
  2⤵
  PID:8560
- C:\Windows\System\geFckXG.exe
  C:\Windows\System\geFckXG.exe
  2⤵
  PID:8636
- C:\Windows\System\dqCqoHg.exe
  C:\Windows\System\dqCqoHg.exe
  2⤵
  PID:8864
- C:\Windows\System\wGDHMoU.exe
  C:\Windows\System\wGDHMoU.exe
  2⤵
  PID:9064
- C:\Windows\System\nmGNqWt.exe
  C:\Windows\System\nmGNqWt.exe
  2⤵
  PID:2760
- C:\Windows\System\TxHQIaP.exe
  C:\Windows\System\TxHQIaP.exe
  2⤵
  PID:8380
- C:\Windows\System\TDcivYw.exe
  C:\Windows\System\TDcivYw.exe
  2⤵
  PID:8928
- C:\Windows\System\aZHxyan.exe
  C:\Windows\System\aZHxyan.exe
  2⤵
  PID:8248
- C:\Windows\System\rqJDJDa.exe
  C:\Windows\System\rqJDJDa.exe
  2⤵
  PID:8852
- C:\Windows\System\RqpFGho.exe
  C:\Windows\System\RqpFGho.exe
  2⤵
  PID:9080
- C:\Windows\System\JnMrzeK.exe
  C:\Windows\System\JnMrzeK.exe
  2⤵
  PID:9236
- C:\Windows\System\PaOngls.exe
  C:\Windows\System\PaOngls.exe
  2⤵
  PID:9276
- C:\Windows\System\PsQqSbH.exe
  C:\Windows\System\PsQqSbH.exe
  2⤵
  PID:9316
- C:\Windows\System\erUpTox.exe
  C:\Windows\System\erUpTox.exe
  2⤵
  PID:9340
- C:\Windows\System\xrMEnjL.exe
  C:\Windows\System\xrMEnjL.exe
  2⤵
  PID:9360
- C:\Windows\System\BJDrDme.exe
  C:\Windows\System\BJDrDme.exe
  2⤵
  PID:9400
- C:\Windows\System\wOXHzTU.exe
  C:\Windows\System\wOXHzTU.exe
  2⤵
  PID:9416
- C:\Windows\System\xtssrIs.exe
  C:\Windows\System\xtssrIs.exe
  2⤵
  PID:9436
- C:\Windows\System\KgDkoQp.exe
  C:\Windows\System\KgDkoQp.exe
  2⤵
  PID:9460
- C:\Windows\System\KTKoRRb.exe
  C:\Windows\System\KTKoRRb.exe
  2⤵
  PID:9480
- C:\Windows\System\NrBqHZZ.exe
  C:\Windows\System\NrBqHZZ.exe
  2⤵
  PID:9508
- C:\Windows\System\PFMTqvq.exe
  C:\Windows\System\PFMTqvq.exe
  2⤵
  PID:9536
- C:\Windows\System\BAMAMrT.exe
  C:\Windows\System\BAMAMrT.exe
  2⤵
  PID:9584
- C:\Windows\System\FswWxID.exe
  C:\Windows\System\FswWxID.exe
  2⤵
  PID:9608
- C:\Windows\System\tZtUvel.exe
  C:\Windows\System\tZtUvel.exe
  2⤵
  PID:9628
- C:\Windows\System\pZGUHEa.exe
  C:\Windows\System\pZGUHEa.exe
  2⤵
  PID:9648
- C:\Windows\System\oaRvIOt.exe
  C:\Windows\System\oaRvIOt.exe
  2⤵
  PID:9680
- C:\Windows\System\waEbUQE.exe
  C:\Windows\System\waEbUQE.exe
  2⤵
  PID:9724
- C:\Windows\System\EZDectK.exe
  C:\Windows\System\EZDectK.exe
  2⤵
  PID:9744
- C:\Windows\System\xGyrzBO.exe
  C:\Windows\System\xGyrzBO.exe
  2⤵
  PID:9788
- C:\Windows\System\qMJAlzJ.exe
  C:\Windows\System\qMJAlzJ.exe
  2⤵
  PID:9808
- C:\Windows\System\JFnsvKU.exe
  C:\Windows\System\JFnsvKU.exe
  2⤵
  PID:9828
- C:\Windows\System\vwEeqGw.exe
  C:\Windows\System\vwEeqGw.exe
  2⤵
  PID:9872
- C:\Windows\System\ttYNdmi.exe
  C:\Windows\System\ttYNdmi.exe
  2⤵
  PID:9888
- C:\Windows\System\EvxwINA.exe
  C:\Windows\System\EvxwINA.exe
  2⤵
  PID:9924
- C:\Windows\System\uIAqrDh.exe
  C:\Windows\System\uIAqrDh.exe
  2⤵
  PID:9948
- C:\Windows\System\vHIlwLA.exe
  C:\Windows\System\vHIlwLA.exe
  2⤵
  PID:9968
- C:\Windows\System\mlaJzFb.exe
  C:\Windows\System\mlaJzFb.exe
  2⤵
  PID:9992
- C:\Windows\System\GxRANLf.exe
  C:\Windows\System\GxRANLf.exe
  2⤵
  PID:10024
- C:\Windows\System\pHKWSnP.exe
  C:\Windows\System\pHKWSnP.exe
  2⤵
  PID:10060
- C:\Windows\System\fbbwFBl.exe
  C:\Windows\System\fbbwFBl.exe
  2⤵
  PID:10080
- C:\Windows\System\iMIRglj.exe
  C:\Windows\System\iMIRglj.exe
  2⤵
  PID:10108
- C:\Windows\System\LwXKobO.exe
  C:\Windows\System\LwXKobO.exe
  2⤵
  PID:10124
- C:\Windows\System\lPeDIlF.exe
  C:\Windows\System\lPeDIlF.exe
  2⤵
  PID:10152
- C:\Windows\System\kQRNKxI.exe
  C:\Windows\System\kQRNKxI.exe
  2⤵
  PID:10180
- C:\Windows\System\svMTQaW.exe
  C:\Windows\System\svMTQaW.exe
  2⤵
  PID:10204
- C:\Windows\System\dzmazpN.exe
  C:\Windows\System\dzmazpN.exe
  2⤵
  PID:9220
- C:\Windows\System\CWxUsai.exe
  C:\Windows\System\CWxUsai.exe
  2⤵
  PID:9292
- C:\Windows\System\sSISAxF.exe
  C:\Windows\System\sSISAxF.exe
  2⤵
  PID:9332
- C:\Windows\System\RYsPYAR.exe
  C:\Windows\System\RYsPYAR.exe
  2⤵
  PID:9408
- C:\Windows\System\hTLMJAt.exe
  C:\Windows\System\hTLMJAt.exe
  2⤵
  PID:9476
- C:\Windows\System\YNJJFdZ.exe
  C:\Windows\System\YNJJFdZ.exe
  2⤵
  PID:9500
- C:\Windows\System\CaPUdrQ.exe
  C:\Windows\System\CaPUdrQ.exe
  2⤵
  PID:9596
- C:\Windows\System\EdWjlcQ.exe
  C:\Windows\System\EdWjlcQ.exe
  2⤵
  PID:9756
- C:\Windows\System\WwdwdcW.exe
  C:\Windows\System\WwdwdcW.exe
  2⤵
  PID:9776
- C:\Windows\System\UUzwqqH.exe
  C:\Windows\System\UUzwqqH.exe
  2⤵
  PID:9760
- C:\Windows\System\EWVUiUZ.exe
  C:\Windows\System\EWVUiUZ.exe
  2⤵
  PID:9848
- C:\Windows\System\vmkZrQW.exe
  C:\Windows\System\vmkZrQW.exe
  2⤵
  PID:9884
- C:\Windows\System\TkdXrBt.exe
  C:\Windows\System\TkdXrBt.exe
  2⤵
  PID:10016
- C:\Windows\System\ziajScr.exe
  C:\Windows\System\ziajScr.exe
  2⤵
  PID:10172
- C:\Windows\System\LoJbPim.exe
  C:\Windows\System\LoJbPim.exe
  2⤵
  PID:9504
- C:\Windows\System\KqwEIkp.exe
  C:\Windows\System\KqwEIkp.exe
  2⤵
  PID:9644
- C:\Windows\System\mNuyKvZ.exe
  C:\Windows\System\mNuyKvZ.exe
  2⤵
  PID:9804
- C:\Windows\System\EsLTiAk.exe
  C:\Windows\System\EsLTiAk.exe
  2⤵
  PID:9624
- C:\Windows\System\aULsYfL.exe
  C:\Windows\System\aULsYfL.exe
  2⤵
  PID:9820
- C:\Windows\System\bLbBtRu.exe
  C:\Windows\System\bLbBtRu.exe
  2⤵
  PID:9920
- C:\Windows\System\ZVaDNId.exe
  C:\Windows\System\ZVaDNId.exe
  2⤵
  PID:10048
- C:\Windows\System\pceOyFN.exe
  C:\Windows\System\pceOyFN.exe
  2⤵
  PID:10088
- C:\Windows\System\pqBRgCu.exe
  C:\Windows\System\pqBRgCu.exe
  2⤵
  PID:10244
- C:\Windows\System\ZjSqtFz.exe
  C:\Windows\System\ZjSqtFz.exe
  2⤵
  PID:10260
- C:\Windows\System\lnLobSr.exe
  C:\Windows\System\lnLobSr.exe
  2⤵
  PID:10276
- C:\Windows\System\RVuPxnL.exe
  C:\Windows\System\RVuPxnL.exe
  2⤵
  PID:10292
- C:\Windows\System\uOcGyKt.exe
  C:\Windows\System\uOcGyKt.exe
  2⤵
  PID:10356
- C:\Windows\System\gzKeckE.exe
  C:\Windows\System\gzKeckE.exe
  2⤵
  PID:10372
- C:\Windows\System\TTFALEg.exe
  C:\Windows\System\TTFALEg.exe
  2⤵
  PID:10388
- C:\Windows\System\yvnlEtV.exe
  C:\Windows\System\yvnlEtV.exe
  2⤵
  PID:10404
- C:\Windows\System\nhaZcbu.exe
  C:\Windows\System\nhaZcbu.exe
  2⤵
  PID:10420
- C:\Windows\System\XXEnshp.exe
  C:\Windows\System\XXEnshp.exe
  2⤵
  PID:10436
- C:\Windows\System\SjiUEEl.exe
  C:\Windows\System\SjiUEEl.exe
  2⤵
  PID:10452
- C:\Windows\System\sdguMzk.exe
  C:\Windows\System\sdguMzk.exe
  2⤵
  PID:10468
- C:\Windows\System\QgmyaUF.exe
  C:\Windows\System\QgmyaUF.exe
  2⤵
  PID:10484
- C:\Windows\System\nvapeMC.exe
  C:\Windows\System\nvapeMC.exe
  2⤵
  PID:10504
- C:\Windows\System\ZCjIeNU.exe
  C:\Windows\System\ZCjIeNU.exe
  2⤵
  PID:10528
- C:\Windows\System\pQLKbCM.exe
  C:\Windows\System\pQLKbCM.exe
  2⤵
  PID:10548
- C:\Windows\System\JMTRHRT.exe
  C:\Windows\System\JMTRHRT.exe
  2⤵
  PID:10648
- C:\Windows\System\UfbZdCE.exe
  C:\Windows\System\UfbZdCE.exe
  2⤵
  PID:10764
- C:\Windows\System\iNJNdWL.exe
  C:\Windows\System\iNJNdWL.exe
  2⤵
  PID:10800
- C:\Windows\System\xxwkPan.exe
  C:\Windows\System\xxwkPan.exe
  2⤵
  PID:10832
- C:\Windows\System\euhMMGU.exe
  C:\Windows\System\euhMMGU.exe
  2⤵
  PID:10916
- C:\Windows\System\XOLAPjv.exe
  C:\Windows\System\XOLAPjv.exe
  2⤵
  PID:10940
- C:\Windows\System\yuGaWtV.exe
  C:\Windows\System\yuGaWtV.exe
  2⤵
  PID:10972
- C:\Windows\System\tDkdRSj.exe
  C:\Windows\System\tDkdRSj.exe
  2⤵
  PID:10988
- C:\Windows\System\yRPoqFJ.exe
  C:\Windows\System\yRPoqFJ.exe
  2⤵
  PID:11008
- C:\Windows\System\hhxvKhw.exe
  C:\Windows\System\hhxvKhw.exe
  2⤵
  PID:11032
- C:\Windows\System\zpXpvOR.exe
  C:\Windows\System\zpXpvOR.exe
  2⤵
  PID:11056
- C:\Windows\System\CyKUEpH.exe
  C:\Windows\System\CyKUEpH.exe
  2⤵
  PID:11080
- C:\Windows\System\LCCUEXg.exe
  C:\Windows\System\LCCUEXg.exe
  2⤵
  PID:11132
- C:\Windows\System\lfvCMDN.exe
  C:\Windows\System\lfvCMDN.exe
  2⤵
  PID:11156
- C:\Windows\System\UVOzOOL.exe
  C:\Windows\System\UVOzOOL.exe
  2⤵
  PID:11216
- C:\Windows\System\ZeRwHdk.exe
  C:\Windows\System\ZeRwHdk.exe
  2⤵
  PID:11236
- C:\Windows\System\EyTBGmm.exe
  C:\Windows\System\EyTBGmm.exe
  2⤵
  PID:11256
- C:\Windows\System\dFTHPyS.exe
  C:\Windows\System\dFTHPyS.exe
  2⤵
  PID:10148
- C:\Windows\System\XMPeesb.exe
  C:\Windows\System\XMPeesb.exe
  2⤵
  PID:10196
- C:\Windows\System\APliqwx.exe
  C:\Windows\System\APliqwx.exe
  2⤵
  PID:9880
- C:\Windows\System\fnsyPlm.exe
  C:\Windows\System\fnsyPlm.exe
  2⤵
  PID:9328
- C:\Windows\System\MzpvSwP.exe
  C:\Windows\System\MzpvSwP.exe
  2⤵
  PID:9268
- C:\Windows\System\ntibbEn.exe
  C:\Windows\System\ntibbEn.exe
  2⤵
  PID:10272
- C:\Windows\System\zDOaYpq.exe
  C:\Windows\System\zDOaYpq.exe
  2⤵
  PID:10300
- C:\Windows\System\lSBcuLZ.exe
  C:\Windows\System\lSBcuLZ.exe
  2⤵
  PID:10320
- C:\Windows\System\pbgrrEc.exe
  C:\Windows\System\pbgrrEc.exe
  2⤵
  PID:10624
- C:\Windows\System\rfxKdMN.exe
  C:\Windows\System\rfxKdMN.exe
  2⤵
  PID:10380
- C:\Windows\System\LoNzjVT.exe
  C:\Windows\System\LoNzjVT.exe
  2⤵
  PID:10416
- C:\Windows\System\GqhuPNC.exe
  C:\Windows\System\GqhuPNC.exe
  2⤵
  PID:10476
- C:\Windows\System\IrqrdKu.exe
  C:\Windows\System\IrqrdKu.exe
  2⤵
  PID:10824
- C:\Windows\System\ggLiQGC.exe
  C:\Windows\System\ggLiQGC.exe
  2⤵
  PID:10716
- C:\Windows\System\MbcSJEk.exe
  C:\Windows\System\MbcSJEk.exe
  2⤵
  PID:10852
- C:\Windows\System\alVlAUb.exe
  C:\Windows\System\alVlAUb.exe
  2⤵
  PID:10908
- C:\Windows\System\YMrdnCC.exe
  C:\Windows\System\YMrdnCC.exe
  2⤵
  PID:10980
- C:\Windows\System\ZYmKaDa.exe
  C:\Windows\System\ZYmKaDa.exe
  2⤵
  PID:11040
- C:\Windows\System\gVDoNhN.exe
  C:\Windows\System\gVDoNhN.exe
  2⤵
  PID:11072
- C:\Windows\System\cHmHEBa.exe
  C:\Windows\System\cHmHEBa.exe
  2⤵
  PID:9384
- C:\Windows\System\omIyGvQ.exe
  C:\Windows\System\omIyGvQ.exe
  2⤵
  PID:11244
- C:\Windows\System\PxkiReA.exe
  C:\Windows\System\PxkiReA.exe
  2⤵
  PID:9824
- C:\Windows\System\nuZfTNK.exe
  C:\Windows\System\nuZfTNK.exe
  2⤵
  PID:9256
- C:\Windows\System\eZGwPEk.exe
  C:\Windows\System\eZGwPEk.exe
  2⤵
  PID:10540
- C:\Windows\System\FtsXQFs.exe
  C:\Windows\System\FtsXQFs.exe
  2⤵
  PID:10364
- C:\Windows\System\EXFVfob.exe
  C:\Windows\System\EXFVfob.exe
  2⤵
  PID:10680
- C:\Windows\System\PzZDeJL.exe
  C:\Windows\System\PzZDeJL.exe
  2⤵
  PID:10560
- C:\Windows\System\kgFzhzr.exe
  C:\Windows\System\kgFzhzr.exe
  2⤵
  PID:10636
- C:\Windows\System\YdQMqTT.exe
  C:\Windows\System\YdQMqTT.exe
  2⤵
  PID:11024
- C:\Windows\System\xjclPLW.exe
  C:\Windows\System\xjclPLW.exe
  2⤵
  PID:11112
- C:\Windows\System\VfFQHxO.exe
  C:\Windows\System\VfFQHxO.exe
  2⤵
  PID:9456
- C:\Windows\System\qkAvOBI.exe
  C:\Windows\System\qkAvOBI.exe
  2⤵
  PID:10284
- C:\Windows\System\mwhVghJ.exe
  C:\Windows\System\mwhVghJ.exe
  2⤵
  PID:4256
- C:\Windows\System\ydtwkPP.exe
  C:\Windows\System\ydtwkPP.exe
  2⤵
  PID:10700
- C:\Windows\System\AtRBFei.exe
  C:\Windows\System\AtRBFei.exe
  2⤵
  PID:3084
- C:\Windows\System\GitXxvw.exe
  C:\Windows\System\GitXxvw.exe
  2⤵
  PID:11252
- C:\Windows\System\RdbBOOg.exe
  C:\Windows\System\RdbBOOg.exe
  2⤵
  PID:11268
- C:\Windows\System\pfHMJYM.exe
  C:\Windows\System\pfHMJYM.exe
  2⤵
  PID:11296
- C:\Windows\System\XBbywqs.exe
  C:\Windows\System\XBbywqs.exe
  2⤵
  PID:11320
- C:\Windows\System\GnXryje.exe
  C:\Windows\System\GnXryje.exe
  2⤵
  PID:11368
- C:\Windows\System\LzByIMB.exe
  C:\Windows\System\LzByIMB.exe
  2⤵
  PID:11388
- C:\Windows\System\yUPLINL.exe
  C:\Windows\System\yUPLINL.exe
  2⤵
  PID:11416
- C:\Windows\System\DQylOBu.exe
  C:\Windows\System\DQylOBu.exe
  2⤵
  PID:11456
- C:\Windows\System\tBtWfDm.exe
  C:\Windows\System\tBtWfDm.exe
  2⤵
  PID:11476
- C:\Windows\System\MzeNVgm.exe
  C:\Windows\System\MzeNVgm.exe
  2⤵
  PID:11500
- C:\Windows\System\QbnQWvK.exe
  C:\Windows\System\QbnQWvK.exe
  2⤵
  PID:11536
- C:\Windows\System\SmTHIzp.exe
  C:\Windows\System\SmTHIzp.exe
  2⤵
  PID:11564
- C:\Windows\System\YStPymj.exe
  C:\Windows\System\YStPymj.exe
  2⤵
  PID:11600
- C:\Windows\System\eQfzzWV.exe
  C:\Windows\System\eQfzzWV.exe
  2⤵
  PID:11632
- C:\Windows\System\gwSVGFc.exe
  C:\Windows\System\gwSVGFc.exe
  2⤵
  PID:11660
- C:\Windows\System\xGNSUir.exe
  C:\Windows\System\xGNSUir.exe
  2⤵
  PID:11688
- C:\Windows\System\ijrcrcH.exe
  C:\Windows\System\ijrcrcH.exe
  2⤵
  PID:11716
- C:\Windows\System\rlarSfd.exe
  C:\Windows\System\rlarSfd.exe
  2⤵
  PID:11740
- C:\Windows\System\xigWHlU.exe
  C:\Windows\System\xigWHlU.exe
  2⤵
  PID:11780
- C:\Windows\System\xynVnvD.exe
  C:\Windows\System\xynVnvD.exe
  2⤵
  PID:11800
- C:\Windows\System\GnmtwVu.exe
  C:\Windows\System\GnmtwVu.exe
  2⤵
  PID:11832
- C:\Windows\System\AfxUDXB.exe
  C:\Windows\System\AfxUDXB.exe
  2⤵
  PID:11876
- C:\Windows\System\troEWxR.exe
  C:\Windows\System\troEWxR.exe
  2⤵
  PID:11900
- C:\Windows\System\ofSAftg.exe
  C:\Windows\System\ofSAftg.exe
  2⤵
  PID:11920
- C:\Windows\System\IUWfEez.exe
  C:\Windows\System\IUWfEez.exe
  2⤵
  PID:11940
- C:\Windows\System\fiRoLHZ.exe
  C:\Windows\System\fiRoLHZ.exe
  2⤵
  PID:11968
- C:\Windows\System\ADkUKyN.exe
  C:\Windows\System\ADkUKyN.exe
  2⤵
  PID:11996
- C:\Windows\System\NShyTkk.exe
  C:\Windows\System\NShyTkk.exe
  2⤵
  PID:12032
- C:\Windows\System\DnNVZSk.exe
  C:\Windows\System\DnNVZSk.exe
  2⤵
  PID:12052
- C:\Windows\System\AchuBBc.exe
  C:\Windows\System\AchuBBc.exe
  2⤵
  PID:12076
- C:\Windows\System\itFYaef.exe
  C:\Windows\System\itFYaef.exe
  2⤵
  PID:12096
- C:\Windows\System\cPSDUse.exe
  C:\Windows\System\cPSDUse.exe
  2⤵
  PID:12136
- C:\Windows\System\KzJpIDi.exe
  C:\Windows\System\KzJpIDi.exe
  2⤵
  PID:12168
- C:\Windows\System\VwpjRyk.exe
  C:\Windows\System\VwpjRyk.exe
  2⤵
  PID:12192
- C:\Windows\System\DDOMhTb.exe
  C:\Windows\System\DDOMhTb.exe
  2⤵
  PID:12216
- C:\Windows\System\TsWlgGF.exe
  C:\Windows\System\TsWlgGF.exe
  2⤵
  PID:12236
- C:\Windows\System\VFgGaRM.exe
  C:\Windows\System\VFgGaRM.exe
  2⤵
  PID:12256
- C:\Windows\System\CGqkfoY.exe
  C:\Windows\System\CGqkfoY.exe
  2⤵
  PID:12280
- C:\Windows\System\rpokwLC.exe
  C:\Windows\System\rpokwLC.exe
  2⤵
  PID:11100
- C:\Windows\System\tlNWJWs.exe
  C:\Windows\System\tlNWJWs.exe
  2⤵
  PID:11308
- C:\Windows\System\MlPqvOe.exe
  C:\Windows\System\MlPqvOe.exe
  2⤵
  PID:11396
- C:\Windows\System\eHUbisI.exe
  C:\Windows\System\eHUbisI.exe
  2⤵
  PID:11448
- C:\Windows\System\bBAxWtO.exe
  C:\Windows\System\bBAxWtO.exe
  2⤵
  PID:11524
- C:\Windows\System\iWpSxes.exe
  C:\Windows\System\iWpSxes.exe
  2⤵
  PID:11612
- C:\Windows\System\EauUAgn.exe
  C:\Windows\System\EauUAgn.exe
  2⤵
  PID:11640
- C:\Windows\System\rvqbwyP.exe
  C:\Windows\System\rvqbwyP.exe
  2⤵
  PID:11680
- C:\Windows\System\btqcQtI.exe
  C:\Windows\System\btqcQtI.exe
  2⤵
  PID:11764
- C:\Windows\System\cmBZfqt.exe
  C:\Windows\System\cmBZfqt.exe
  2⤵
  PID:1132
- C:\Windows\System\hHxJIEm.exe
  C:\Windows\System\hHxJIEm.exe
  2⤵
  PID:544
- C:\Windows\System\TnDmmea.exe
  C:\Windows\System\TnDmmea.exe
  2⤵
  PID:11892
- C:\Windows\System\vjdGdWj.exe
  C:\Windows\System\vjdGdWj.exe
  2⤵
  PID:444
- C:\Windows\System\WcwVAaW.exe
  C:\Windows\System\WcwVAaW.exe
  2⤵
  PID:12012
- C:\Windows\System\fszEzGD.exe
  C:\Windows\System\fszEzGD.exe
  2⤵
  PID:12144
- C:\Windows\System\prtSKYz.exe
  C:\Windows\System\prtSKYz.exe
  2⤵
  PID:12228
- C:\Windows\System\buMAwdW.exe
  C:\Windows\System\buMAwdW.exe
  2⤵
  PID:10960
- C:\Windows\System\ruMDUJc.exe
  C:\Windows\System\ruMDUJc.exe
  2⤵
  PID:11284
- C:\Windows\System\KHLekNq.exe
  C:\Windows\System\KHLekNq.exe
  2⤵
  PID:4668
- C:\Windows\System\PpvujNa.exe
  C:\Windows\System\PpvujNa.exe
  2⤵
  PID:11656
- C:\Windows\System\pBzPkrW.exe
  C:\Windows\System\pBzPkrW.exe
  2⤵
  PID:11704
- C:\Windows\System\WDWhJmN.exe
  C:\Windows\System\WDWhJmN.exe
  2⤵
  PID:11824
- C:\Windows\System\gYCbVMX.exe
  C:\Windows\System\gYCbVMX.exe
  2⤵
  PID:4112
- C:\Windows\System\ABOQZff.exe
  C:\Windows\System\ABOQZff.exe
  2⤵
  PID:3524
- C:\Windows\System\IxPqAAA.exe
  C:\Windows\System\IxPqAAA.exe
  2⤵
  PID:12204
- C:\Windows\System\HRSUBad.exe
  C:\Windows\System\HRSUBad.exe
  2⤵
  PID:12272
- C:\Windows\System\ZKXkrZq.exe
  C:\Windows\System\ZKXkrZq.exe
  2⤵
  PID:1620
- C:\Windows\System\EhrCBEm.exe
  C:\Windows\System\EhrCBEm.exe
  2⤵
  PID:11808
- C:\Windows\System\cySqSGX.exe
  C:\Windows\System\cySqSGX.exe
  2⤵
  PID:12040
- C:\Windows\System\eSDqliL.exe
  C:\Windows\System\eSDqliL.exe
  2⤵
  PID:12176
- C:\Windows\System\DfMwkLX.exe
  C:\Windows\System\DfMwkLX.exe
  2⤵
  PID:11436
- C:\Windows\System\oObJNUP.exe
  C:\Windows\System\oObJNUP.exe
  2⤵
  PID:5052
- C:\Windows\System\nKkoRFe.exe
  C:\Windows\System\nKkoRFe.exe
  2⤵
  PID:12296
- C:\Windows\System\fCiovQO.exe
  C:\Windows\System\fCiovQO.exe
  2⤵
  PID:12312
- C:\Windows\System\dueCyTu.exe
  C:\Windows\System\dueCyTu.exe
  2⤵
  PID:12344
- C:\Windows\System\jgmMBQa.exe
  C:\Windows\System\jgmMBQa.exe
  2⤵
  PID:12368
- C:\Windows\System\joBhwTs.exe
  C:\Windows\System\joBhwTs.exe
  2⤵
  PID:12396
- C:\Windows\System\xGyaGTM.exe
  C:\Windows\System\xGyaGTM.exe
  2⤵
  PID:12420
- C:\Windows\System\RCWTpSz.exe
  C:\Windows\System\RCWTpSz.exe
  2⤵
  PID:12440
- C:\Windows\System\bpUBKpO.exe
  C:\Windows\System\bpUBKpO.exe
  2⤵
  PID:12468
- C:\Windows\System\pAyvADu.exe
  C:\Windows\System\pAyvADu.exe
  2⤵
  PID:12492
- C:\Windows\System\lPzheQh.exe
  C:\Windows\System\lPzheQh.exe
  2⤵
  PID:12528
- C:\Windows\System\vbGurIU.exe
  C:\Windows\System\vbGurIU.exe
  2⤵
  PID:12548
- C:\Windows\System\QtlMKBo.exe
  C:\Windows\System\QtlMKBo.exe
  2⤵
  PID:12564
- C:\Windows\System\PtnbCQO.exe
  C:\Windows\System\PtnbCQO.exe
  2⤵
  PID:12612
- C:\Windows\System\yGBdEQs.exe
  C:\Windows\System\yGBdEQs.exe
  2⤵
  PID:12632
- C:\Windows\System\FXRhuxv.exe
  C:\Windows\System\FXRhuxv.exe
  2⤵
  PID:12672
- C:\Windows\System\UVGxWPS.exe
  C:\Windows\System\UVGxWPS.exe
  2⤵
  PID:12712
- C:\Windows\System\GrkGUjP.exe
  C:\Windows\System\GrkGUjP.exe
  2⤵
  PID:12736
- C:\Windows\System\hkopoTl.exe
  C:\Windows\System\hkopoTl.exe
  2⤵
  PID:12756
- C:\Windows\System\IJTHCPG.exe
  C:\Windows\System\IJTHCPG.exe
  2⤵
  PID:12804
- C:\Windows\System\oSHWyOm.exe
  C:\Windows\System\oSHWyOm.exe
  2⤵
  PID:12820
- C:\Windows\System\IJHkzHn.exe
  C:\Windows\System\IJHkzHn.exe
  2⤵
  PID:12840
- C:\Windows\System\ojYuaWN.exe
  C:\Windows\System\ojYuaWN.exe
  2⤵
  PID:12856
- C:\Windows\System\Alznnpg.exe
  C:\Windows\System\Alznnpg.exe
  2⤵
  PID:12876
- C:\Windows\System\EbwiBiO.exe
  C:\Windows\System\EbwiBiO.exe
  2⤵
  PID:12900
- C:\Windows\System\zoaouvh.exe
  C:\Windows\System\zoaouvh.exe
  2⤵
  PID:12984
- C:\Windows\System\jefgkxW.exe
  C:\Windows\System\jefgkxW.exe
  2⤵
  PID:13012
- C:\Windows\System\myjsmGN.exe
  C:\Windows\System\myjsmGN.exe
  2⤵
  PID:13032
- C:\Windows\System\ghDOjly.exe
  C:\Windows\System\ghDOjly.exe
  2⤵
  PID:13100
- C:\Windows\System\lWoLzuf.exe
  C:\Windows\System\lWoLzuf.exe
  2⤵
  PID:12688
- C:\Windows\System\dSjdpmE.exe
  C:\Windows\System\dSjdpmE.exe
  2⤵
  PID:12588
- C:\Windows\System\NMqumxU.exe
  C:\Windows\System\NMqumxU.exe
  2⤵
  PID:12624
- C:\Windows\System\sRBdxkH.exe
  C:\Windows\System\sRBdxkH.exe
  2⤵
  PID:12652
- C:\Windows\System\VhOdTuo.exe
  C:\Windows\System\VhOdTuo.exe
  2⤵
  PID:12664
- C:\Windows\System\mKmQqbq.exe
  C:\Windows\System\mKmQqbq.exe
  2⤵
  PID:12700
- C:\Windows\System\NCEsxlU.exe
  C:\Windows\System\NCEsxlU.exe
  2⤵
  PID:12752
- C:\Windows\System\sfnhTkq.exe
  C:\Windows\System\sfnhTkq.exe
  2⤵
  PID:12812
- C:\Windows\System\vkkbNcX.exe
  C:\Windows\System\vkkbNcX.exe
  2⤵
  PID:12832
- C:\Windows\System\LZOLeZc.exe
  C:\Windows\System\LZOLeZc.exe
  2⤵
  PID:12872
- C:\Windows\System\iLBCVOQ.exe
  C:\Windows\System\iLBCVOQ.exe
  2⤵
  PID:12948
- C:\Windows\System\TNKjtdP.exe
  C:\Windows\System\TNKjtdP.exe
  2⤵
  PID:5088
- C:\Windows\System\dAKTdVO.exe
  C:\Windows\System\dAKTdVO.exe
  2⤵
  PID:4292
- C:\Windows\System\mJABCTm.exe
  C:\Windows\System\mJABCTm.exe
  2⤵
  PID:13060
- C:\Windows\System\syJPsZD.exe
  C:\Windows\System\syJPsZD.exe
  2⤵
  PID:13052
- C:\Windows\System\ElFTLTq.exe
  C:\Windows\System\ElFTLTq.exe
  2⤵
  PID:13088
- C:\Windows\System\HOtwLIX.exe
  C:\Windows\System\HOtwLIX.exe
  2⤵
  PID:2492
- C:\Windows\System\QZjzMiA.exe
  C:\Windows\System\QZjzMiA.exe
  2⤵
  PID:13160
- C:\Windows\System\KMBHEmQ.exe
  C:\Windows\System\KMBHEmQ.exe
  2⤵
  PID:13176
- C:\Windows\System\QeDpicL.exe
  C:\Windows\System\QeDpicL.exe
  2⤵
  PID:13188
- C:\Windows\System\BIAjrQc.exe
  C:\Windows\System\BIAjrQc.exe
  2⤵
  PID:13256
- C:\Windows\System\lNzKign.exe
  C:\Windows\System\lNzKign.exe
  2⤵
  PID:12572
- C:\Windows\System\dGYbUyp.exe
  C:\Windows\System\dGYbUyp.exe
  2⤵
  PID:12540
- C:\Windows\System\cfsCboR.exe
  C:\Windows\System\cfsCboR.exe
  2⤵
  PID:3032
- C:\Windows\System\RpsRNue.exe
  C:\Windows\System\RpsRNue.exe
  2⤵
  PID:12648
- C:\Windows\System\EWSMGgb.exe
  C:\Windows\System\EWSMGgb.exe
  2⤵
  PID:12828
- C:\Windows\System\OdJWDZP.exe
  C:\Windows\System\OdJWDZP.exe
  2⤵
  PID:12884
- C:\Windows\System\QKZGhxT.exe
  C:\Windows\System\QKZGhxT.exe
  2⤵
  PID:12892
- C:\Windows\System\gSRfmPn.exe
  C:\Windows\System\gSRfmPn.exe
  2⤵
  PID:13000
- C:\Windows\System\LpOTAQx.exe
  C:\Windows\System\LpOTAQx.exe
  2⤵
  PID:13076
- C:\Windows\System\jxoxbJp.exe
  C:\Windows\System\jxoxbJp.exe
  2⤵
  PID:13068
- C:\Windows\System\etaiGUn.exe
  C:\Windows\System\etaiGUn.exe
  2⤵
  PID:13104
- C:\Windows\System\pOnPsRb.exe
  C:\Windows\System\pOnPsRb.exe
  2⤵
  PID:13184
- C:\Windows\System\HwQWjqt.exe
  C:\Windows\System\HwQWjqt.exe
  2⤵
  PID:13212
- C:\Windows\System\wDVxkml.exe
  C:\Windows\System\wDVxkml.exe
  2⤵
  PID:13224
- C:\Windows\System\MgqdERF.exe
  C:\Windows\System\MgqdERF.exe
  2⤵
  PID:13244
- C:\Windows\System\VJLqPlh.exe
  C:\Windows\System\VJLqPlh.exe
  2⤵
  PID:13264
- C:\Windows\System\iyJopWK.exe
  C:\Windows\System\iyJopWK.exe
  2⤵
  PID:12628
- C:\Windows\System\UfdmCKF.exe
  C:\Windows\System\UfdmCKF.exe
  2⤵
  PID:4268
- C:\Windows\System\SLwmgkd.exe
  C:\Windows\System\SLwmgkd.exe
  2⤵
  PID:13296
- C:\Windows\System\fKYZWTS.exe
  C:\Windows\System\fKYZWTS.exe
  2⤵
  PID:12376
- C:\Windows\System\XAhIQgV.exe
  C:\Windows\System\XAhIQgV.exe
  2⤵
  PID:12412
- C:\Windows\System\DuSNhgM.exe
  C:\Windows\System\DuSNhgM.exe
  2⤵
  PID:3028
- C:\Windows\System\eupspwa.exe
  C:\Windows\System\eupspwa.exe
  2⤵
  PID:12480
- C:\Windows\System\VapnqEQ.exe
  C:\Windows\System\VapnqEQ.exe
  2⤵
  PID:12520
- C:\Windows\System\UUVwYZb.exe
  C:\Windows\System\UUVwYZb.exe
  2⤵
  PID:4260
- C:\Windows\System\agplimR.exe
  C:\Windows\System\agplimR.exe
  2⤵
  PID:12744
- C:\Windows\System\VNaPxrp.exe
  C:\Windows\System\VNaPxrp.exe
  2⤵
  PID:2652
- C:\Windows\System\RnhyaVn.exe
  C:\Windows\System\RnhyaVn.exe
  2⤵
  PID:13056
- C:\Windows\System\xmtsomy.exe
  C:\Windows\System\xmtsomy.exe
  2⤵
  PID:13168
- C:\Windows\System\SATVsWK.exe
  C:\Windows\System\SATVsWK.exe
  2⤵
  PID:13240
- C:\Windows\System\MoMNiXx.exe
  C:\Windows\System\MoMNiXx.exe
  2⤵
  PID:13272
- C:\Windows\System\tcZUDjD.exe
  C:\Windows\System\tcZUDjD.exe
  2⤵
  PID:3640
- C:\Windows\System\EKPMFev.exe
  C:\Windows\System\EKPMFev.exe
  2⤵
  PID:3148
- C:\Windows\System\JJBrdch.exe
  C:\Windows\System\JJBrdch.exe
  2⤵
  PID:12360
- C:\Windows\System\YYzLoTV.exe
  C:\Windows\System\YYzLoTV.exe
  2⤵
  PID:12436
- C:\Windows\System\ayetLHf.exe
  C:\Windows\System\ayetLHf.exe
  2⤵
  PID:13268
- C:\Windows\System\khEUJeL.exe
  C:\Windows\System\khEUJeL.exe
  2⤵
  PID:2056
- C:\Windows\System\XkJrzxY.exe
  C:\Windows\System\XkJrzxY.exe
  2⤵
  PID:3276
- C:\Windows\System\eIXXWDy.exe
  C:\Windows\System\eIXXWDy.exe
  2⤵
  PID:12428
- C:\Windows\System\ZEozJjc.exe
  C:\Windows\System\ZEozJjc.exe
  2⤵
  PID:12560
- C:\Windows\System\tMNEOlg.exe
  C:\Windows\System\tMNEOlg.exe
  2⤵
  PID:4780
- C:\Windows\System\YLXBCat.exe
  C:\Windows\System\YLXBCat.exe
  2⤵
  PID:5616
- C:\Windows\System\GmFcrNM.exe
  C:\Windows\System\GmFcrNM.exe
  2⤵
  PID:2568
- C:\Windows\System\RwyJGQw.exe
  C:\Windows\System\RwyJGQw.exe
  2⤵
  PID:5036
- C:\Windows\System\BnLxXGF.exe
  C:\Windows\System\BnLxXGF.exe
  2⤵
  PID:3732
- C:\Windows\System\fVsXiEa.exe
  C:\Windows\System\fVsXiEa.exe
  2⤵
  PID:3820
- C:\Windows\System\wBNqDWf.exe
  C:\Windows\System\wBNqDWf.exe
  2⤵
  PID:5212
- C:\Windows\System\ldBqHzv.exe
  C:\Windows\System\ldBqHzv.exe
  2⤵
  PID:13040
- C:\Windows\System\vhscmkS.exe
  C:\Windows\System\vhscmkS.exe
  2⤵
  PID:13260
- C:\Windows\System\cHEbUKS.exe
  C:\Windows\System\cHEbUKS.exe
  2⤵
  PID:13300
- C:\Windows\System\cMOfNlY.exe
  C:\Windows\System\cMOfNlY.exe
  2⤵
  PID:6232
- C:\Windows\System\vpzmYFa.exe
  C:\Windows\System\vpzmYFa.exe
  2⤵
  PID:3212
- C:\Windows\System\kZkZBbu.exe
  C:\Windows\System\kZkZBbu.exe
  2⤵
  PID:6332
- C:\Windows\System\bEdgzOw.exe
  C:\Windows\System\bEdgzOw.exe
  2⤵
  PID:6372
- C:\Windows\System\reDDRxT.exe
  C:\Windows\System\reDDRxT.exe
  2⤵
  PID:12728
- C:\Windows\System\IUZCuWi.exe
  C:\Windows\System\IUZCuWi.exe
  2⤵
  PID:12504
- C:\Windows\System\RDYOocD.exe
  C:\Windows\System\RDYOocD.exe
  2⤵
  PID:4580
- C:\Windows\System\mofgDdf.exe
  C:\Windows\System\mofgDdf.exe
  2⤵
  PID:4408
- C:\Windows\System\GYmyPRc.exe
  C:\Windows\System\GYmyPRc.exe
  2⤵
  PID:3036
- C:\Windows\System\SinZhnb.exe
  C:\Windows\System\SinZhnb.exe
  2⤵
  PID:5116
- C:\Windows\System\kcDZrPW.exe
  C:\Windows\System\kcDZrPW.exe
  2⤵
  PID:13220
- C:\Windows\System\dVSZeSt.exe
  C:\Windows\System\dVSZeSt.exe
  2⤵
  PID:12536
- C:\Windows\System\ZtBCBYK.exe
  C:\Windows\System\ZtBCBYK.exe
  2⤵
  PID:11584
- C:\Windows\System\enUhAJX.exe
  C:\Windows\System\enUhAJX.exe
  2⤵
  PID:13024
- C:\Windows\System\ZkqMvQM.exe
  C:\Windows\System\ZkqMvQM.exe
  2⤵
  PID:13232
- C:\Windows\System\UFoGgPb.exe
  C:\Windows\System\UFoGgPb.exe
  2⤵
  PID:3940
- C:\Windows\System\wiRqaOO.exe
  C:\Windows\System\wiRqaOO.exe
  2⤵
  PID:13228
- C:\Windows\System\GXSDQUC.exe
  C:\Windows\System\GXSDQUC.exe
  2⤵
  PID:6220
- C:\Windows\System\BSdGUdz.exe
  C:\Windows\System\BSdGUdz.exe
  2⤵
  PID:6288
- C:\Windows\System\lcVrFXe.exe
  C:\Windows\System\lcVrFXe.exe
  2⤵
  PID:2244
- C:\Windows\System\uMFqvXg.exe
  C:\Windows\System\uMFqvXg.exe
  2⤵
  PID:960
- C:\Windows\System\zHxFDli.exe
  C:\Windows\System\zHxFDli.exe
  2⤵
  PID:2604
- C:\Windows\System\mwIcdzm.exe
  C:\Windows\System\mwIcdzm.exe
  2⤵
  PID:5112
- C:\Windows\System\PVYaEkM.exe
  C:\Windows\System\PVYaEkM.exe
  2⤵
  PID:12792
- C:\Windows\System\kONzdvA.exe
  C:\Windows\System\kONzdvA.exe
  2⤵
  PID:1476
- C:\Windows\System\loEuziU.exe
  C:\Windows\System\loEuziU.exe
  2⤵
  PID:13196
- C:\Windows\System\esGJbFa.exe
  C:\Windows\System\esGJbFa.exe
  2⤵
  PID:4136
- C:\Windows\System\FcJwzoA.exe
  C:\Windows\System\FcJwzoA.exe
  2⤵
  PID:6304
- C:\Windows\System\lqkYRti.exe
  C:\Windows\System\lqkYRti.exe
  2⤵
  PID:3912
- C:\Windows\System\FjBJxyT.exe
  C:\Windows\System\FjBJxyT.exe
  2⤵
  PID:12604
- C:\Windows\System\kfsoUsh.exe
  C:\Windows\System\kfsoUsh.exe
  2⤵
  PID:1188
- C:\Windows\System\xrepIXB.exe
  C:\Windows\System\xrepIXB.exe
  2⤵
  PID:1884
- C:\Windows\System\kggcbVt.exe
  C:\Windows\System\kggcbVt.exe
  2⤵
  PID:12592
- C:\Windows\System\bEkrkjr.exe
  C:\Windows\System\bEkrkjr.exe
  2⤵
  PID:4584
- C:\Windows\System\JTnGONX.exe
  C:\Windows\System\JTnGONX.exe
  2⤵
  PID:2944
- C:\Windows\System\lNdUNrg.exe
  C:\Windows\System\lNdUNrg.exe
  2⤵
  PID:5496
- C:\Windows\System\dZpKsOJ.exe
  C:\Windows\System\dZpKsOJ.exe
  2⤵
  PID:7044
- C:\Windows\System\VtocbYM.exe
  C:\Windows\System\VtocbYM.exe
  2⤵
  PID:13324
- C:\Windows\System\DiQJzKv.exe
  C:\Windows\System\DiQJzKv.exe
  2⤵
  PID:13340
- C:\Windows\System\GLoPudJ.exe
  C:\Windows\System\GLoPudJ.exe
  2⤵
  PID:13356
- C:\Windows\System\lNlAdOp.exe
  C:\Windows\System\lNlAdOp.exe
  2⤵
  PID:13372
- C:\Windows\System\tVVGwuJ.exe
  C:\Windows\System\tVVGwuJ.exe
  2⤵
  PID:13388
- C:\Windows\System\TeYgJKO.exe
  C:\Windows\System\TeYgJKO.exe
  2⤵
  PID:13404
- C:\Windows\System\eUUVAUJ.exe
  C:\Windows\System\eUUVAUJ.exe
  2⤵
  PID:13420
- C:\Windows\System\FcJLSLr.exe
  C:\Windows\System\FcJLSLr.exe
  2⤵
  PID:13436
- C:\Windows\System\fpobKXs.exe
  C:\Windows\System\fpobKXs.exe
  2⤵
  PID:13452
- C:\Windows\System\uSApark.exe
  C:\Windows\System\uSApark.exe
  2⤵
  PID:13468
- C:\Windows\System\FXcCIsl.exe
  C:\Windows\System\FXcCIsl.exe
  2⤵
  PID:13484
- C:\Windows\System\XLeYqCz.exe
  C:\Windows\System\XLeYqCz.exe
  2⤵
  PID:13512
- C:\Windows\System\IhCwlbn.exe
  C:\Windows\System\IhCwlbn.exe
  2⤵
  PID:13528
- C:\Windows\System\WBYwVHi.exe
  C:\Windows\System\WBYwVHi.exe
  2⤵
  PID:13544
- C:\Windows\System\zBYizba.exe
  C:\Windows\System\zBYizba.exe
  2⤵
  PID:13560
- C:\Windows\System\FRgsaRN.exe
  C:\Windows\System\FRgsaRN.exe
  2⤵
  PID:13576
- C:\Windows\System\sPUpPQo.exe
  C:\Windows\System\sPUpPQo.exe
  2⤵
  PID:13592
- C:\Windows\System\ttMCduO.exe
  C:\Windows\System\ttMCduO.exe
  2⤵
  PID:13608
- C:\Windows\System\anKdmfQ.exe
  C:\Windows\System\anKdmfQ.exe
  2⤵
  PID:13624
- C:\Windows\System\KPKvRJU.exe
  C:\Windows\System\KPKvRJU.exe
  2⤵
  PID:13640
- C:\Windows\System\IbHzJOB.exe
  C:\Windows\System\IbHzJOB.exe
  2⤵
  PID:13656
- C:\Windows\System\IcFQvoH.exe
  C:\Windows\System\IcFQvoH.exe
  2⤵
  PID:13672
- C:\Windows\System\nbzqWgv.exe
  C:\Windows\System\nbzqWgv.exe
  2⤵
  PID:13688
- C:\Windows\System\MvnfDLP.exe
  C:\Windows\System\MvnfDLP.exe
  2⤵
  PID:13712
- C:\Windows\System\qmlUTcM.exe
  C:\Windows\System\qmlUTcM.exe
  2⤵
  PID:13740
- C:\Windows\System\ruWjguB.exe
  C:\Windows\System\ruWjguB.exe
  2⤵
  PID:13768
- C:\Windows\System\ClqYvHp.exe
  C:\Windows\System\ClqYvHp.exe
  2⤵
  PID:13796
- C:\Windows\System\OjPdxFV.exe
  C:\Windows\System\OjPdxFV.exe
  2⤵
  PID:13812
- C:\Windows\System\YnohTwq.exe
  C:\Windows\System\YnohTwq.exe
  2⤵
  PID:13836
- C:\Windows\System\QMoVlDc.exe
  C:\Windows\System\QMoVlDc.exe
  2⤵
  PID:13864
- C:\Windows\System\jKGgpxT.exe
  C:\Windows\System\jKGgpxT.exe
  2⤵
  PID:13908
- C:\Windows\System\DncxhfI.exe
  C:\Windows\System\DncxhfI.exe
  2⤵
  PID:13932
- C:\Windows\System\rNIvMBg.exe
  C:\Windows\System\rNIvMBg.exe
  2⤵
  PID:13988
- C:\Windows\System\MbQfNEt.exe
  C:\Windows\System\MbQfNEt.exe
  2⤵
  PID:14016
- C:\Windows\System\pIVhnRr.exe
  C:\Windows\System\pIVhnRr.exe
  2⤵
  PID:14048
- C:\Windows\System\YzjBWEv.exe
  C:\Windows\System\YzjBWEv.exe
  2⤵
  PID:14140
- C:\Windows\System\tQiTLFB.exe
  C:\Windows\System\tQiTLFB.exe
  2⤵
  PID:14172
- C:\Windows\System\yBnwRJP.exe
  C:\Windows\System\yBnwRJP.exe
  2⤵
  PID:14192
- C:\Windows\System\smOhTOt.exe
  C:\Windows\System\smOhTOt.exe
  2⤵
  PID:14212
- C:\Windows\System\FytYAgU.exe
  C:\Windows\System\FytYAgU.exe
  2⤵
  PID:14232
- C:\Windows\System\GDgmZpf.exe
  C:\Windows\System\GDgmZpf.exe
  2⤵
  PID:14248
- C:\Windows\System\dAnTlap.exe
  C:\Windows\System\dAnTlap.exe
  2⤵
  PID:14264
- C:\Windows\System\pqsZdbq.exe
  C:\Windows\System\pqsZdbq.exe
  2⤵
  PID:14284
- C:\Windows\System\fyMbhsE.exe
  C:\Windows\System\fyMbhsE.exe
  2⤵
  PID:14300
- C:\Windows\System\IUzYbkb.exe
  C:\Windows\System\IUzYbkb.exe
  2⤵
  PID:14320
- C:\Windows\System\kxDIODJ.exe
  C:\Windows\System\kxDIODJ.exe
  2⤵
  PID:13320
- C:\Windows\System\TBWoMev.exe
  C:\Windows\System\TBWoMev.exe
  2⤵
  PID:13352
- C:\Windows\System\dXkABwC.exe
  C:\Windows\System\dXkABwC.exe
  2⤵
  PID:13396
- C:\Windows\System\ZzVnGfq.exe
  C:\Windows\System\ZzVnGfq.exe
  2⤵
  PID:13428
- C:\Windows\System\nIAaFvS.exe
  C:\Windows\System\nIAaFvS.exe
  2⤵
  PID:13464
- C:\Windows\System\PFTFwGq.exe
  C:\Windows\System\PFTFwGq.exe
  2⤵
  PID:13520
- C:\Windows\System\urEYZrI.exe
  C:\Windows\System\urEYZrI.exe
  2⤵
  PID:3224
- C:\Windows\System\CjfbRpK.exe
  C:\Windows\System\CjfbRpK.exe
  2⤵
  PID:13588
- C:\Windows\System\gjRzztl.exe
  C:\Windows\System\gjRzztl.exe
  2⤵
  PID:13632
- C:\Windows\System\VKsTLCS.exe
  C:\Windows\System\VKsTLCS.exe
  2⤵
  PID:13664
- C:\Windows\System\IElTdbj.exe
  C:\Windows\System\IElTdbj.exe
  2⤵
  PID:3480
- C:\Windows\System\cbQJoTf.exe
  C:\Windows\System\cbQJoTf.exe
  2⤵
  PID:6800
- C:\Windows\System\mzxqCUB.exe
  C:\Windows\System\mzxqCUB.exe
  2⤵
  PID:13736
- C:\Windows\System\jrFjFjC.exe
  C:\Windows\System\jrFjFjC.exe
  2⤵
  PID:13760
- C:\Windows\System\SEhlTbP.exe
  C:\Windows\System\SEhlTbP.exe
  2⤵
  PID:13784
- C:\Windows\System\MsufdRV.exe
  C:\Windows\System\MsufdRV.exe
  2⤵
  PID:13804
- C:\Windows\System\yMicROw.exe
  C:\Windows\System\yMicROw.exe
  2⤵
  PID:13820
- C:\Windows\System\vbgyuvO.exe
  C:\Windows\System\vbgyuvO.exe
  2⤵
  PID:13844
- C:\Windows\System\KcfRFER.exe
  C:\Windows\System\KcfRFER.exe
  2⤵
  PID:6992
- C:\Windows\System\DbnBVBy.exe
  C:\Windows\System\DbnBVBy.exe
  2⤵
  PID:2152
- C:\Windows\System\aYmjdhY.exe
  C:\Windows\System\aYmjdhY.exe
  2⤵
  PID:3128
- C:\Windows\System\fHZmBLt.exe
  C:\Windows\System\fHZmBLt.exe
  2⤵
  PID:13884
- C:\Windows\System\NcIdCFb.exe
  C:\Windows\System\NcIdCFb.exe
  2⤵
  PID:13776
- C:\Windows\System\CbunRlX.exe
  C:\Windows\System\CbunRlX.exe
  2⤵
  PID:5044
- C:\Windows\System\IdnbziF.exe
  C:\Windows\System\IdnbziF.exe
  2⤵
  PID:4280
- C:\Windows\System\JuZhVLj.exe
  C:\Windows\System\JuZhVLj.exe
  2⤵
  PID:6940
- C:\Windows\System\EGgEEBo.exe
  C:\Windows\System\EGgEEBo.exe
  2⤵
  PID:7104
- C:\Windows\System\wAiSFDC.exe
  C:\Windows\System\wAiSFDC.exe
  2⤵
  PID:5068
- C:\Windows\System\BmoTbao.exe
  C:\Windows\System\BmoTbao.exe
  2⤵
  PID:3988
- C:\Windows\System\qaAbrfy.exe
  C:\Windows\System\qaAbrfy.exe
  2⤵
  PID:1060
- C:\Windows\System\mJpwdie.exe
  C:\Windows\System\mJpwdie.exe
  2⤵
  PID:3812
- C:\Windows\System\SQsBmCj.exe
  C:\Windows\System\SQsBmCj.exe
  2⤵
  PID:6496
- C:\Windows\System\fXVHuRj.exe
  C:\Windows\System\fXVHuRj.exe
  2⤵
  PID:7320
- C:\Windows\System\vifdEaa.exe
  C:\Windows\System\vifdEaa.exe
  2⤵
  PID:7336
- C:\Windows\System\NeMOlMV.exe
  C:\Windows\System\NeMOlMV.exe
  2⤵
  PID:7356
- C:\Windows\System\CstbfNl.exe
  C:\Windows\System\CstbfNl.exe
  2⤵
  PID:7404
- C:\Windows\System\SUExbiJ.exe
  C:\Windows\System\SUExbiJ.exe
  2⤵
  PID:4380
- C:\Windows\System\NcsXCez.exe
  C:\Windows\System\NcsXCez.exe
  2⤵
  PID:7436
- C:\Windows\System\JmPCURz.exe
  C:\Windows\System\JmPCURz.exe
  2⤵
  PID:1292
- C:\Windows\System\TqJafrj.exe
  C:\Windows\System\TqJafrj.exe
  2⤵
  PID:624
- C:\Windows\System\ydsWkKX.exe
  C:\Windows\System\ydsWkKX.exe
  2⤵
  PID:7576
- C:\Windows\System\HzPJmZa.exe
  C:\Windows\System\HzPJmZa.exe
  2⤵
  PID:13976
- C:\Windows\System\FxSmuvM.exe
  C:\Windows\System\FxSmuvM.exe
  2⤵
  PID:1540
- C:\Windows\System\HGCFVBU.exe
  C:\Windows\System\HGCFVBU.exe
  2⤵
  PID:1972
- C:\Windows\System\tLeshId.exe
  C:\Windows\System\tLeshId.exe
  2⤵
  PID:14044
- C:\Windows\System\AoLSROP.exe
  C:\Windows\System\AoLSROP.exe
  2⤵
  PID:13880
- C:\Windows\System\IsrqdNY.exe
  C:\Windows\System\IsrqdNY.exe
  2⤵
  PID:13948
- C:\Windows\System\lgXViFF.exe
  C:\Windows\System\lgXViFF.exe
  2⤵
  PID:7828
- C:\Windows\System\nttAeAH.exe
  C:\Windows\System\nttAeAH.exe
  2⤵
  PID:7932
- C:\Windows\System\mQCFdFI.exe
  C:\Windows\System\mQCFdFI.exe
  2⤵
  PID:7868
- C:\Windows\System\ZMflUou.exe
  C:\Windows\System\ZMflUou.exe
  2⤵
  PID:7988
- C:\Windows\System\mUfgOkT.exe
  C:\Windows\System\mUfgOkT.exe
  2⤵
  PID:8020
- C:\Windows\System\FcKqYjI.exe
  C:\Windows\System\FcKqYjI.exe
  2⤵
  PID:8076
- C:\Windows\System\sESztwr.exe
  C:\Windows\System\sESztwr.exe
  2⤵
  PID:8152
- C:\Windows\System\iqQIBQs.exe
  C:\Windows\System\iqQIBQs.exe
  2⤵
  PID:5692
- C:\Windows\System\lfbPnyA.exe
  C:\Windows\System\lfbPnyA.exe
  2⤵
  PID:7300
- C:\Windows\System\SxiLfYn.exe
  C:\Windows\System\SxiLfYn.exe
  2⤵
  PID:7540
- C:\Windows\System\XandsLP.exe
  C:\Windows\System\XandsLP.exe
  2⤵
  PID:7748
- C:\Windows\System\yQEvajN.exe
  C:\Windows\System\yQEvajN.exe
  2⤵
  PID:7920
- C:\Windows\System\pORjDyx.exe
  C:\Windows\System\pORjDyx.exe
  2⤵
  PID:7896
- C:\Windows\System\fwtslrF.exe
  C:\Windows\System\fwtslrF.exe
  2⤵
  PID:3692
- C:\Windows\System\uvFryFk.exe
  C:\Windows\System\uvFryFk.exe
  2⤵
  PID:7392
- C:\Windows\System\VAvPcax.exe
  C:\Windows\System\VAvPcax.exe
  2⤵
  PID:7644
- C:\Windows\System\aSBROKR.exe
  C:\Windows\System\aSBROKR.exe
  2⤵
  PID:7876
- C:\Windows\System\bXGlWGi.exe
  C:\Windows\System\bXGlWGi.exe
  2⤵
  PID:7252
- C:\Windows\System\LJrgcRW.exe
  C:\Windows\System\LJrgcRW.exe
  2⤵
  PID:8220
- C:\Windows\System\KfhXKbz.exe
  C:\Windows\System\KfhXKbz.exe
  2⤵
  PID:8244
- C:\Windows\System\uWOEurF.exe
  C:\Windows\System\uWOEurF.exe
  2⤵
  PID:8336
- C:\Windows\System\YgRSRTP.exe
  C:\Windows\System\YgRSRTP.exe
  2⤵
  PID:8468
- C:\Windows\System\NTMukHZ.exe
  C:\Windows\System\NTMukHZ.exe
  2⤵
  PID:8460
- C:\Windows\System\PNTRfYh.exe
  C:\Windows\System\PNTRfYh.exe
  2⤵
  PID:8524
- C:\Windows\System\cTIxugr.exe
  C:\Windows\System\cTIxugr.exe
  2⤵
  PID:8592
- C:\Windows\System\dxnRZSz.exe
  C:\Windows\System\dxnRZSz.exe
  2⤵
  PID:8632
- C:\Windows\System\MwMtMhe.exe
  C:\Windows\System\MwMtMhe.exe
  2⤵
  PID:8692
- C:\Windows\System\HPTVkMI.exe
  C:\Windows\System\HPTVkMI.exe
  2⤵
  PID:8800
- C:\Windows\System\Lfynhhl.exe
  C:\Windows\System\Lfynhhl.exe
  2⤵
  PID:8884
- C:\Windows\System\aBcxPGt.exe
  C:\Windows\System\aBcxPGt.exe
  2⤵
  PID:14036
- C:\Windows\System\aUatlWW.exe
  C:\Windows\System\aUatlWW.exe
  2⤵
  PID:14064
- C:\Windows\System\XOJmImz.exe
  C:\Windows\System\XOJmImz.exe
  2⤵
  PID:8984
- C:\Windows\System\eQPoWCH.exe
  C:\Windows\System\eQPoWCH.exe
  2⤵
  PID:4992
- C:\Windows\System\zZhNFPG.exe
  C:\Windows\System\zZhNFPG.exe
  2⤵
  PID:14092
- C:\Windows\System\XUOkcrd.exe
  C:\Windows\System\XUOkcrd.exe
  2⤵
  PID:9072
- C:\Windows\System\cMHSdsE.exe
  C:\Windows\System\cMHSdsE.exe
  2⤵
  PID:2188
- C:\Windows\System\VPvycqi.exe
  C:\Windows\System\VPvycqi.exe
  2⤵
  PID:3968
- C:\Windows\System\bjpKycp.exe
  C:\Windows\System\bjpKycp.exe
  2⤵
  PID:14080
- C:\Windows\System\ZLgLDnF.exe
  C:\Windows\System\ZLgLDnF.exe
  2⤵
  PID:9192
- C:\Windows\System\vdrpcRX.exe
  C:\Windows\System\vdrpcRX.exe
  2⤵
  PID:14120
- C:\Windows\System\pqqVpPm.exe
  C:\Windows\System\pqqVpPm.exe
  2⤵
  PID:4920
- C:\Windows\System\cezqlPy.exe
  C:\Windows\System\cezqlPy.exe
  2⤵
  PID:4884
- C:\Windows\System\OviosKO.exe
  C:\Windows\System\OviosKO.exe
  2⤵
  PID:4376
- C:\Windows\System\EQxaalK.exe
  C:\Windows\System\EQxaalK.exe
  2⤵
  PID:14128
- C:\Windows\System\oelRxZv.exe
  C:\Windows\System\oelRxZv.exe
  2⤵
  PID:744
- C:\Windows\System\SmOXadJ.exe
  C:\Windows\System\SmOXadJ.exe
  2⤵
  PID:14156
- C:\Windows\System\NRfdhwK.exe
  C:\Windows\System\NRfdhwK.exe
  2⤵
  PID:14168
- C:\Windows\System\AJYHOHA.exe
  C:\Windows\System\AJYHOHA.exe
  2⤵
  PID:1128
- C:\Windows\System\BFownPn.exe
  C:\Windows\System\BFownPn.exe
  2⤵
  PID:3384
- C:\Windows\System\XwCeBAG.exe
  C:\Windows\System\XwCeBAG.exe
  2⤵
  PID:8588
- C:\Windows\System\tJdjyao.exe
  C:\Windows\System\tJdjyao.exe
  2⤵
  PID:14204
- C:\Windows\System\WsCDTTF.exe
  C:\Windows\System\WsCDTTF.exe
  2⤵
  PID:2032
- C:\Windows\System\KApEbax.exe
  C:\Windows\System\KApEbax.exe
  2⤵
  PID:14244
- C:\Windows\System\BWveoBs.exe
  C:\Windows\System\BWveoBs.exe
  2⤵
  PID:2592
- C:\Windows\System\atfitcq.exe
  C:\Windows\System\atfitcq.exe
  2⤵
  PID:9016
- C:\Windows\System\IYYZMmv.exe
  C:\Windows\System\IYYZMmv.exe
  2⤵
  PID:14296
- C:\Windows\System\AWVHEzA.exe
  C:\Windows\System\AWVHEzA.exe
  2⤵
  PID:14316
- C:\Windows\System\LIOQWdB.exe
  C:\Windows\System\LIOQWdB.exe
  2⤵
  PID:9160
- C:\Windows\System\lSkjQqn.exe
  C:\Windows\System\lSkjQqn.exe
  2⤵
  PID:13316
- C:\Windows\System\TpUCpVx.exe
  C:\Windows\System\TpUCpVx.exe
  2⤵
  PID:13380
- C:\Windows\System\fBWFosF.exe
  C:\Windows\System\fBWFosF.exe
  2⤵
  PID:13384
- C:\Windows\System\XpYqqjZ.exe
  C:\Windows\System\XpYqqjZ.exe
  2⤵
  PID:13444
- C:\Windows\System\kQhJDQa.exe
  C:\Windows\System\kQhJDQa.exe
  2⤵
  PID:13460
- C:\Windows\System\cXLKflN.exe
  C:\Windows\System\cXLKflN.exe
  2⤵
  PID:4324
- C:\Windows\System\ErZLwWF.exe
  C:\Windows\System\ErZLwWF.exe
  2⤵
  PID:8508
- C:\Windows\System\dISnlaZ.exe
  C:\Windows\System\dISnlaZ.exe
  2⤵
  PID:2396
- C:\Windows\System\wzbJdmP.exe
  C:\Windows\System\wzbJdmP.exe
  2⤵
  PID:13584
- C:\Windows\System\HyVXynQ.exe
  C:\Windows\System\HyVXynQ.exe
  2⤵
  PID:13604
- C:\Windows\System\bRbkWHM.exe
  C:\Windows\System\bRbkWHM.exe
  2⤵
  PID:9248
- C:\Windows\System\WBiOHYr.exe
  C:\Windows\System\WBiOHYr.exe
  2⤵
  PID:9288
- C:\Windows\System\VdsaDpi.exe
  C:\Windows\System\VdsaDpi.exe
  2⤵
  PID:13696
- C:\Windows\System\aOpqpkn.exe
  C:\Windows\System\aOpqpkn.exe
  2⤵
  PID:13708
- C:\Windows\System\uGSdzBG.exe
  C:\Windows\System\uGSdzBG.exe
  2⤵
  PID:13728
- C:\Windows\System\CUieeDV.exe
  C:\Windows\System\CUieeDV.exe
  2⤵
  PID:13732
- C:\Windows\System\MoxQUMH.exe
  C:\Windows\System\MoxQUMH.exe
  2⤵
  PID:1384
- C:\Windows\System\xqAAsFw.exe
  C:\Windows\System\xqAAsFw.exe
  2⤵
  PID:3704
- C:\Windows\System\ajeMOfx.exe
  C:\Windows\System\ajeMOfx.exe
  2⤵
  PID:13780
- C:\Windows\System\ShyzIHK.exe
  C:\Windows\System\ShyzIHK.exe
  2⤵
  PID:5204
- C:\Windows\System\ZwFixhb.exe
  C:\Windows\System\ZwFixhb.exe
  2⤵
  PID:4412
- C:\Windows\System\OaXSpxg.exe
  C:\Windows\System\OaXSpxg.exe
  2⤵
  PID:6972
- C:\Windows\System\OkSBgvn.exe
  C:\Windows\System\OkSBgvn.exe
  2⤵
  PID:7048
- C:\Windows\System\cfxSrlk.exe
  C:\Windows\System\cfxSrlk.exe
  2⤵
  PID:6040
- C:\Windows\System\zLHsYRQ.exe
  C:\Windows\System\zLHsYRQ.exe
  2⤵
  PID:5292
- C:\Windows\System\IDjZhlp.exe
  C:\Windows\System\IDjZhlp.exe
  2⤵
  PID:9772
- C:\Windows\System\KDCiezu.exe
  C:\Windows\System\KDCiezu.exe
  2⤵
  PID:5320
- C:\Windows\System\feNoLRc.exe
  C:\Windows\System\feNoLRc.exe
  2⤵
  PID:9852
- C:\Windows\System\sQvYmKA.exe
  C:\Windows\System\sQvYmKA.exe
  2⤵
  PID:5364
- C:\Windows\System\PviVyxJ.exe
  C:\Windows\System\PviVyxJ.exe
  2⤵
  PID:6744
- C:\Windows\System\zbERjFB.exe
  C:\Windows\System\zbERjFB.exe
  2⤵
  PID:5376
- C:\Windows\System\ytmHzXu.exe
  C:\Windows\System\ytmHzXu.exe
  2⤵
  PID:5420
- C:\Windows\System\KkxHuVE.exe
  C:\Windows\System\KkxHuVE.exe
  2⤵
  PID:9980
- C:\Windows\System\grIsifR.exe
  C:\Windows\System\grIsifR.exe
  2⤵
  PID:5432
- C:\Windows\System\AxZemUO.exe
  C:\Windows\System\AxZemUO.exe
  2⤵
  PID:7176
- C:\Windows\System\cHGiHTl.exe
  C:\Windows\System\cHGiHTl.exe
  2⤵
  PID:7284
- C:\Windows\System\qSCKwbP.exe
  C:\Windows\System\qSCKwbP.exe
  2⤵
  PID:7332
- C:\Windows\System\DHJqGJl.exe
  C:\Windows\System\DHJqGJl.exe
  2⤵
  PID:7372
- C:\Windows\System\iJJDSpB.exe
  C:\Windows\System\iJJDSpB.exe
  2⤵
  PID:5520
- C:\Windows\System\eLsCGir.exe
  C:\Windows\System\eLsCGir.exe
  2⤵
  PID:7360
- C:\Windows\System\jLFWXwj.exe
  C:\Windows\System\jLFWXwj.exe
  2⤵
  PID:4892
- C:\Windows\System\jQFBdOc.exe
  C:\Windows\System\jQFBdOc.exe
  2⤵
  PID:5600
- C:\Windows\System\TOyqooR.exe
  C:\Windows\System\TOyqooR.exe
  2⤵
  PID:9432
- C:\Windows\System\ZGOnOom.exe
  C:\Windows\System\ZGOnOom.exe
  2⤵
  PID:5604
- C:\Windows\System\ogZFMeh.exe
  C:\Windows\System\ogZFMeh.exe
  2⤵
  PID:7600
- C:\Windows\System\lZmKrRN.exe
  C:\Windows\System\lZmKrRN.exe
  2⤵
  PID:4472
- C:\Windows\System\tGYmIQp.exe
  C:\Windows\System\tGYmIQp.exe
  2⤵
  PID:13968
- C:\Windows\System\rWPMlEt.exe
  C:\Windows\System\rWPMlEt.exe
  2⤵
  PID:1628
- C:\Windows\System\XjTfHpD.exe
  C:\Windows\System\XjTfHpD.exe
  2⤵
  PID:14040
- C:\Windows\System\ljgtLEN.exe
  C:\Windows\System\ljgtLEN.exe
  2⤵
  PID:10160
- C:\Windows\System\jfkbHay.exe
  C:\Windows\System\jfkbHay.exe
  2⤵
  PID:14004
- C:\Windows\System\jbCJlKe.exe
  C:\Windows\System\jbCJlKe.exe
  2⤵
  PID:10096
- C:\Windows\System\IlkJWor.exe
  C:\Windows\System\IlkJWor.exe
  2⤵
  PID:14028
- C:\Windows\System\VfvPnoY.exe
  C:\Windows\System\VfvPnoY.exe
  2⤵
  PID:5772
- C:\Windows\System\qhCQmkv.exe
  C:\Windows\System\qhCQmkv.exe
  2⤵
  PID:7916
- C:\Windows\System\CIHlMPA.exe
  C:\Windows\System\CIHlMPA.exe
  2⤵
  PID:8004
- C:\Windows\System\PTkwuqp.exe
  C:\Windows\System\PTkwuqp.exe
  2⤵
  PID:8032
- C:\Windows\System\YbSRhMF.exe
  C:\Windows\System\YbSRhMF.exe
  2⤵
  PID:5856
- C:\Windows\System\WLZxgoz.exe
  C:\Windows\System\WLZxgoz.exe
  2⤵
  PID:5884
- C:\Windows\System\USYocHn.exe
  C:\Windows\System\USYocHn.exe
  2⤵
  PID:5912
- C:\Windows\System\HsFjfZp.exe
  C:\Windows\System\HsFjfZp.exe
  2⤵
  PID:7504
- C:\Windows\System\ZdNDBUW.exe
  C:\Windows\System\ZdNDBUW.exe
  2⤵
  PID:7696
- C:\Windows\System\eXoigJG.exe
  C:\Windows\System\eXoigJG.exe
  2⤵
  PID:8012
- C:\Windows\System\TVRVNBW.exe
  C:\Windows\System\TVRVNBW.exe
  2⤵
  PID:5972
- C:\Windows\System\DfwFbwC.exe
  C:\Windows\System\DfwFbwC.exe
  2⤵
  PID:5992
- C:\Windows\System\WZgQaqm.exe
  C:\Windows\System\WZgQaqm.exe
  2⤵
  PID:7856
- C:\Windows\System\OOTtvXd.exe
  C:\Windows\System\OOTtvXd.exe
  2⤵
  PID:6052
- C:\Windows\System\rjtSGmk.exe
  C:\Windows\System\rjtSGmk.exe
  2⤵
  PID:6096
- C:\Windows\System\xctHEld.exe
  C:\Windows\System\xctHEld.exe
  2⤵
  PID:8284
- C:\Windows\System\EyPDunE.exe
  C:\Windows\System\EyPDunE.exe
  2⤵
  PID:8332
- C:\Windows\System\EqkzSUh.exe
  C:\Windows\System\EqkzSUh.exe
  2⤵
  PID:8440
- C:\Windows\System\qmnutJB.exe
  C:\Windows\System\qmnutJB.exe
  2⤵
  PID:208
- C:\Windows\System\lmIIHro.exe
  C:\Windows\System\lmIIHro.exe
  2⤵
  PID:8536
- C:\Windows\System\PlIXHhi.exe
  C:\Windows\System\PlIXHhi.exe
  2⤵
  PID:8628
- C:\Windows\System\UuysiEw.exe
  C:\Windows\System\UuysiEw.exe
  2⤵
  PID:2352
- C:\Windows\System\JipUlka.exe
  C:\Windows\System\JipUlka.exe
  2⤵
  PID:3216
- C:\Windows\System\jaIwEtH.exe
  C:\Windows\System\jaIwEtH.exe
  2⤵
  PID:8832
- C:\Windows\System\RKqQvJV.exe
  C:\Windows\System\RKqQvJV.exe
  2⤵
  PID:116
- C:\Windows\System\gynUyrN.exe
  C:\Windows\System\gynUyrN.exe
  2⤵
  PID:5012
- C:\Windows\System\opecfLJ.exe
  C:\Windows\System\opecfLJ.exe
  2⤵
  PID:14116
- C:\Windows\System\UxeTYmO.exe
  C:\Windows\System\UxeTYmO.exe
  2⤵
  PID:4768
- C:\Windows\System\kVmWgSC.exe
  C:\Windows\System\kVmWgSC.exe
  2⤵
  PID:4572
- C:\Windows\System\fHOgKWD.exe
  C:\Windows\System\fHOgKWD.exe
  2⤵
  PID:14076
- C:\Windows\System\CelguZX.exe
  C:\Windows\System\CelguZX.exe
  2⤵
  PID:9228
- C:\Windows\System\yCvvndG.exe
  C:\Windows\System\yCvvndG.exe
  2⤵
  PID:10188
- C:\Windows\System\DauZbUB.exe
  C:\Windows\System\DauZbUB.exe
  2⤵
  PID:5468
- C:\Windows\System\MIumFyd.exe
  C:\Windows\System\MIumFyd.exe
  2⤵
  PID:4440
- C:\Windows\System\FCEXtsh.exe
  C:\Windows\System\FCEXtsh.exe
  2⤵
  PID:10076
- C:\Windows\System\PtYHDBn.exe
  C:\Windows\System\PtYHDBn.exe
  2⤵
  PID:10524
- C:\Windows\System\PwMfQVr.exe
  C:\Windows\System\PwMfQVr.exe
  2⤵
  PID:10304
- C:\Windows\System\ubHWEDt.exe
  C:\Windows\System\ubHWEDt.exe
  2⤵
  PID:5668
- C:\Windows\System\PjnrFma.exe
  C:\Windows\System\PjnrFma.exe
  2⤵
  PID:10432
- C:\Windows\System\EzYjYsT.exe
  C:\Windows\System\EzYjYsT.exe
  2⤵
  PID:8420
- C:\Windows\System\CHBBibv.exe
  C:\Windows\System\CHBBibv.exe
  2⤵
  PID:8436
- C:\Windows\System\sQBnLkv.exe
  C:\Windows\System\sQBnLkv.exe
  2⤵
  PID:10820
- C:\Windows\System\tkBkLVk.exe
  C:\Windows\System\tkBkLVk.exe
  2⤵
  PID:3372
- C:\Windows\System\fvRZyVY.exe
  C:\Windows\System\fvRZyVY.exe
  2⤵
  PID:5844
- C:\Windows\System\KHXVbJC.exe
  C:\Windows\System\KHXVbJC.exe
  2⤵
  PID:14240
- C:\Windows\System\ZJIwwDZ.exe
  C:\Windows\System\ZJIwwDZ.exe
  2⤵
  PID:5896
- C:\Windows\System\OtStmLI.exe
  C:\Windows\System\OtStmLI.exe
  2⤵
  PID:14276
- C:\Windows\System\gQjASbU.exe
  C:\Windows\System\gQjASbU.exe
  2⤵
  PID:5948
- C:\Windows\System\DHeLVsa.exe
  C:\Windows\System\DHeLVsa.exe
  2⤵
  PID:9036
- C:\Windows\System\quaUsDb.exe
  C:\Windows\System\quaUsDb.exe
  2⤵
  PID:14312
- C:\Windows\System\VtDewwy.exe
  C:\Windows\System\VtDewwy.exe
  2⤵
  PID:9200
- C:\Windows\System\KlQTMeD.exe
  C:\Windows\System\KlQTMeD.exe
  2⤵
  PID:10400
- C:\Windows\System\jBWZwDk.exe
  C:\Windows\System\jBWZwDk.exe
  2⤵
  PID:10144
- C:\Windows\System\nMGqlfq.exe
  C:\Windows\System\nMGqlfq.exe
  2⤵
  PID:6120
- C:\Windows\System\xSOiuwT.exe
  C:\Windows\System\xSOiuwT.exe
  2⤵
  PID:8296
- C:\Windows\System\YudFRPp.exe
  C:\Windows\System\YudFRPp.exe
  2⤵
  PID:5152
- C:\Windows\System\ekVRnmG.exe
  C:\Windows\System\ekVRnmG.exe
  2⤵
  PID:13416
- C:\Windows\System\leFIbnQ.exe
  C:\Windows\System\leFIbnQ.exe
  2⤵
  PID:8756
- C:\Windows\System\BVqCOvq.exe
  C:\Windows\System\BVqCOvq.exe
  2⤵
  PID:13448
- C:\Windows\System\vGUqUSP.exe
  C:\Windows\System\vGUqUSP.exe
  2⤵
  PID:5416
- C:\Windows\System\fieaTCP.exe
  C:\Windows\System\fieaTCP.exe
  2⤵
  PID:1948
- C:\Windows\System\WSaJqBY.exe
  C:\Windows\System\WSaJqBY.exe
  2⤵
  PID:5636
- C:\Windows\System\SRUcHtL.exe
  C:\Windows\System\SRUcHtL.exe
  2⤵
  PID:9020
- C:\Windows\System\NhfSSzI.exe
  C:\Windows\System\NhfSSzI.exe
  2⤵
  PID:5748
- C:\Windows\System\tNrqqOW.exe
  C:\Windows\System\tNrqqOW.exe
  2⤵
  PID:13556
- C:\Windows\System\ojymBWT.exe
  C:\Windows\System\ojymBWT.exe
  2⤵
  PID:5860
- C:\Windows\System\FyQnsvL.exe
  C:\Windows\System\FyQnsvL.exe
  2⤵
  PID:13616
- C:\Windows\System\XcfCGCv.exe
  C:\Windows\System\XcfCGCv.exe
  2⤵
  PID:9284
- C:\Windows\System\gGDRRsF.exe
  C:\Windows\System\gGDRRsF.exe
  2⤵
  PID:4960
- C:\Windows\System\BQOSTjM.exe
  C:\Windows\System\BQOSTjM.exe
  2⤵
  PID:14164
- C:\Windows\System\wifAbTL.exe
  C:\Windows\System\wifAbTL.exe
  2⤵
  PID:4636
- C:\Windows\System\WeRZEAw.exe
  C:\Windows\System\WeRZEAw.exe
  2⤵
  PID:9448
- C:\Windows\System\GBuUkCH.exe
  C:\Windows\System\GBuUkCH.exe
  2⤵
  PID:5176
- C:\Windows\System\pEVDDuA.exe
  C:\Windows\System\pEVDDuA.exe
  2⤵
  PID:11860
- C:\Windows\System\qdQedNE.exe
  C:\Windows\System\qdQedNE.exe
  2⤵
  PID:9524
- C:\Windows\System\gzcPrHX.exe
  C:\Windows\System\gzcPrHX.exe
  2⤵
  PID:4488
- C:\Windows\System\HNCHzhY.exe
  C:\Windows\System\HNCHzhY.exe
  2⤵
  PID:11976
- C:\Windows\System\gGQZMqC.exe
  C:\Windows\System\gGQZMqC.exe
  2⤵
  PID:12016
- C:\Windows\System\UWcoALc.exe
  C:\Windows\System\UWcoALc.exe
  2⤵
  PID:6192
- C:\Windows\System\fgoKLQk.exe
  C:\Windows\System\fgoKLQk.exe
  2⤵
  PID:9784
- C:\Windows\System\zbwalFO.exe
  C:\Windows\System\zbwalFO.exe
  2⤵
  PID:9816
- C:\Windows\System\ZlOZCeV.exe
  C:\Windows\System\ZlOZCeV.exe
  2⤵
  PID:6548
- C:\Windows\System\yjwMlIH.exe
  C:\Windows\System\yjwMlIH.exe
  2⤵
  PID:7108
- C:\Windows\System\yzdvixb.exe
  C:\Windows\System\yzdvixb.exe
  2⤵
  PID:6244
- C:\Windows\System\ccuMzRc.exe
  C:\Windows\System\ccuMzRc.exe
  2⤵
  PID:11668
- C:\Windows\System\sJajMxW.exe
  C:\Windows\System\sJajMxW.exe
  2⤵
  PID:6908
- C:\Windows\System\ZxuwiTC.exe
  C:\Windows\System\ZxuwiTC.exe
  2⤵
  PID:6400
- C:\Windows\System\tgDmYYL.exe
  C:\Windows\System\tgDmYYL.exe
  2⤵
  PID:7292
- C:\Windows\System\UkDmeKc.exe
  C:\Windows\System\UkDmeKc.exe
  2⤵
  PID:10192
- C:\Windows\System\wamBMsE.exe
  C:\Windows\System\wamBMsE.exe
  2⤵
  PID:5548
- C:\Windows\System\SptSQbf.exe
  C:\Windows\System\SptSQbf.exe
  2⤵
  PID:9300
- C:\Windows\System\ohfhtxe.exe
  C:\Windows\System\ohfhtxe.exe
  2⤵
  PID:11468
- C:\Windows\System\hhrWzxM.exe
  C:\Windows\System\hhrWzxM.exe
  2⤵
  PID:3364
- C:\Windows\System\zdLEDgX.exe
  C:\Windows\System\zdLEDgX.exe
  2⤵
  PID:5640
- C:\Windows\System\vYitweg.exe
  C:\Windows\System\vYitweg.exe
  2⤵
  PID:3112
- C:\Windows\System\jhrZhyt.exe
  C:\Windows\System\jhrZhyt.exe
  2⤵
  PID:9676
- C:\Windows\System\DICkyJw.exe
  C:\Windows\System\DICkyJw.exe
  2⤵
  PID:6596
- C:\Windows\System\yjHthIv.exe
  C:\Windows\System\yjHthIv.exe
  2⤵
  PID:6640
- C:\Windows\System\JrzTIFD.exe
  C:\Windows\System\JrzTIFD.exe
  2⤵
  PID:11352
- C:\Windows\System\dQGbSWd.exe
  C:\Windows\System\dQGbSWd.exe
  2⤵
  PID:6652
- C:\Windows\System\bZfEPBx.exe
  C:\Windows\System\bZfEPBx.exe
  2⤵
  PID:13944
- C:\Windows\System\RKXnIEz.exe
  C:\Windows\System\RKXnIEz.exe
  2⤵
  PID:6680
- C:\Windows\System\kucYlFv.exe
  C:\Windows\System\kucYlFv.exe
  2⤵
  PID:6724
- C:\Windows\System\dirtsEj.exe
  C:\Windows\System\dirtsEj.exe
  2⤵
  PID:7836
- C:\Windows\System\gCtZXFj.exe
  C:\Windows\System\gCtZXFj.exe
  2⤵
  PID:5800
- C:\Windows\System\mahOhaJ.exe
  C:\Windows\System\mahOhaJ.exe
  2⤵
  PID:8044
- C:\Windows\System\gKTFMkn.exe
  C:\Windows\System\gKTFMkn.exe
  2⤵
  PID:6804
- C:\Windows\System\sExGueK.exe
  C:\Windows\System\sExGueK.exe
  2⤵
  PID:6836
- C:\Windows\System\JcsHDiL.exe
  C:\Windows\System\JcsHDiL.exe
  2⤵
  PID:7536
- C:\Windows\System\dIfJILV.exe
  C:\Windows\System\dIfJILV.exe
  2⤵
  PID:7688
- C:\Windows\System\JFfetqN.exe
  C:\Windows\System\JFfetqN.exe
  2⤵
  PID:7888
- C:\Windows\System\CTXwjxB.exe
  C:\Windows\System\CTXwjxB.exe
  2⤵
  PID:5980
- C:\Windows\System\JpyWyBg.exe
  C:\Windows\System\JpyWyBg.exe
  2⤵
  PID:7256
- C:\Windows\System\IMxuCgZ.exe
  C:\Windows\System\IMxuCgZ.exe
  2⤵
  PID:8096
- C:\Windows\System\fNqSAAo.exe
  C:\Windows\System\fNqSAAo.exe
  2⤵
  PID:7984
- C:\Windows\System\MFTkJwi.exe
  C:\Windows\System\MFTkJwi.exe
  2⤵
  PID:6124
- C:\Windows\System\QvQrirY.exe
  C:\Windows\System\QvQrirY.exe
  2⤵
  PID:220
- C:\Windows\System\SkaRoqw.exe
  C:\Windows\System\SkaRoqw.exe
  2⤵
  PID:8500
- C:\Windows\System\tuYCoOR.exe
  C:\Windows\System\tuYCoOR.exe
  2⤵
  PID:12992
- C:\Windows\System\SsSvAYN.exe
  C:\Windows\System\SsSvAYN.exe
  2⤵
  PID:8644
- C:\Windows\System\Sxkhwcc.exe
  C:\Windows\System\Sxkhwcc.exe
  2⤵
  PID:7100
- C:\Windows\System\rzrMENv.exe
  C:\Windows\System\rzrMENv.exe
  2⤵
  PID:7144
- C:\Windows\System\DGCMplV.exe
  C:\Windows\System\DGCMplV.exe
  2⤵
  PID:5916
- C:\Windows\System\qHysSjZ.exe
  C:\Windows\System\qHysSjZ.exe
  2⤵
  PID:9024
- C:\Windows\System\CuxVOqR.exe
  C:\Windows\System\CuxVOqR.exe
  2⤵
  PID:9056
- C:\Windows\System\LsxrtEX.exe
  C:\Windows\System\LsxrtEX.exe
  2⤵
  PID:432
- C:\Windows\System\pAoVErE.exe
  C:\Windows\System\pAoVErE.exe
  2⤵
  PID:5388
- C:\Windows\System\DmoGlQJ.exe
  C:\Windows\System\DmoGlQJ.exe
  2⤵
  PID:6272
- C:\Windows\System\UFDYxAi.exe
  C:\Windows\System\UFDYxAi.exe
  2⤵
  PID:4860
- C:\Windows\System\KpgamcX.exe
  C:\Windows\System\KpgamcX.exe
  2⤵
  PID:4332
- C:\Windows\System\PvxBOcl.exe
  C:\Windows\System\PvxBOcl.exe
  2⤵
  PID:14136
- C:\Windows\System\TzjmsEM.exe
  C:\Windows\System\TzjmsEM.exe
  2⤵
  PID:8352
- C:\Windows\System\EqoyRHt.exe
  C:\Windows\System\EqoyRHt.exe
  2⤵
  PID:8376
- C:\Windows\System\gsHGziu.exe
  C:\Windows\System\gsHGziu.exe
  2⤵
  PID:5724
- C:\Windows\System\GTlGVBO.exe
  C:\Windows\System\GTlGVBO.exe
  2⤵
  PID:14188
- C:\Windows\System\BmjFIxr.exe
  C:\Windows\System\BmjFIxr.exe
  2⤵
  PID:14200
- C:\Windows\System\OjYyDJG.exe
  C:\Windows\System\OjYyDJG.exe
  2⤵
  PID:14224
- C:\Windows\System\tCvBxJW.exe
  C:\Windows\System\tCvBxJW.exe
  2⤵
  PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nhmuxk2q.uiu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BVUOAVj.exe

Filesize
1.9MB

MD5
1a60b38563a15f21853d2dc9673e0140

SHA1
e8ef6825b09e8129b886eab7fa914a347637530a

SHA256
c3d38a39858ab110cbb29df10f7e6230cdd8c0c0d7ed56a888cdc632fe2d21e8

SHA512
85c621076716742a0a314e9f8566f4c5115333ce930a3b81fe296d75d0d5be37487ff31c572411fa92576f1eb30dec8ee883052d1d196be8da75694fc1d9b148

Download Submit
C:\Windows\System\EmdcvGL.exe

Filesize
1.9MB

MD5
28f13653527100e7e069233cf8766f30

SHA1
b7ef438e8a62c3bb7650d590421c1dda4696810d

SHA256
4485474d0f08d3e95ce95ea23620a758cc0b3a0516ffb815800b87ab74f5faa1

SHA512
ac4a312eff2b38b38ffa86167692294d241a4cde9ba71b088fd626d052e44e8af6772a67b93ff2482e4153e8f3fec34a288631a218f787b8cfd05911d5ade4bd

Download Submit
C:\Windows\System\IpYlIrr.exe

Filesize
1.9MB

MD5
c426da08d0abf5568d2eecbec030913b

SHA1
5e4459893b3c9b5bdd9899182482410988af9726

SHA256
745efd769b13039f773d7c262e0081cd999905d5b83fdffed8629527d7a947d4

SHA512
892f8f04589ac885ce8422a4b0512f216e7db9fc9f247f78fd291d3fba08ff54ba8f55409e52f7e089061e3b6e102da32ed4de64c44ab24436a7ba4f6291ad0e

Download Submit
C:\Windows\System\JWeoyxN.exe

Filesize
1.9MB

MD5
6d1be584a4fc0ad9c9af2c3206fa1d87

SHA1
7da70237e3a2d9307194e192bef925b67868c3d9

SHA256
562bba0f5670c4261d9427c54ff3434579ec434ee2fd1f02b164233325cd31a7

SHA512
35fdd2efe26b0d752cc6b812068104f532471323921e2e84380baaaf566896bd39fd99cb791199f765377de273f54b3812da0fedf213e5c975fabf9044d5d273

Download Submit
C:\Windows\System\JuPFiYL.exe

Filesize
1.9MB

MD5
8b487db4211d6420aaa3edc168dffe21

SHA1
812f186395cf5e120e8f5539a87dfb4846d3ec5d

SHA256
c972a2ae1a9025892a6761519293f59080891e626f0a45e6d5ca9f2960696908

SHA512
9c276317d8c5538425ee0674e21350299f4f21f35b86d07893eb1110cfbc1bfe6bde69acb90a9bd1438c0556aecdf62a4717c6027861f4bece06071717b9492f

Download Submit
C:\Windows\System\JvNZQkH.exe

Filesize
1.9MB

MD5
ebc58ff768e9b5d23676e3fc3461f1c0

SHA1
e454cb60a90ac533e60eaadda2ab45cf08d9aa7e

SHA256
03038481e7f9b9f73d16d71853cbf53c4e9beb901d8678a7259795e2655a762f

SHA512
d75dc649330c780188810411de4fc7e813c050f7d9f87b1c81ed607c79e6e77461336a556efd4c8f387705e76f9734587ed7a251855694d11b358798c70bbbdd

Download Submit
C:\Windows\System\LIauSbu.exe

Filesize
1.9MB

MD5
282c0941c1c945935b0dbc89ab653afe

SHA1
20415465f592a44efec318421b1b937891a5c33e

SHA256
201c297746f5c274dfc4417962341a091ec603d82b2f3bae7d471d05aac93187

SHA512
a7502d470b0ebab890bb8c9e9e320500219c38875789013cd4cf6dd09e3585a8eb03a69a02e9d1c45deac7a9b41fa6ab08de38ab7792e4e647ccd0b4861063eb

Download Submit
C:\Windows\System\QecjbgL.exe

Filesize
1.9MB

MD5
a51d77c1138b79284c2572bef893f62d

SHA1
a887595adf4efbf73fb3e1505227d74ed066adb3

SHA256
a4c71a075ec99ea37cc924081c84b99b40823217e07c9dd5abf7a8283e62e11e

SHA512
e3e596514dd3c20ac665a682fb557d25e8399d2bf2e571c3e37ea7577fe1be7caa90dd1ddad7f6520f202c9a06f4caef901a51b75ec42e254940a018cda17bcd

Download Submit
C:\Windows\System\QnbxUAW.exe

Filesize
1.9MB

MD5
3c5e8669756e0b5b3300463cf18fc088

SHA1
5b46babeae8f5a87891b5f2be4e4430f2fe8d1aa

SHA256
e96694ab433da1950e11f8c46b4a7af168c5edf05c7137977693fbe4ac96e77f

SHA512
804c856d3629ac04bee2beac80e19896a90bfbb500a4ddb92cb91b58d3fe0de4e6032c9b1f9c3e8a0550d5057631f0050bd1db4806c35568053642a673c273f2

Download Submit
C:\Windows\System\RzpDZdT.exe

Filesize
1.9MB

MD5
6c808118c599f56fae091f3d5a582134

SHA1
2bfef87f28d83bf627ed4df55e07a06fb634381e

SHA256
c14cf5c737d8f1b769e35a0e9438be3b991db0fb12b4eda9ecaa100a6cb349e2

SHA512
88d6792dd5707c83d55263886dcc581ea93982bd322223743b10005c17b928acac23da55bc76f8f445c7712b8fb94f25d600a12b61f147b0d2df18748b3c95c6

Download Submit
C:\Windows\System\SfbDgiU.exe

Filesize
1.9MB

MD5
a0130ee4e15700ae9d4eb48460585601

SHA1
15eeb65b829b68b96567ee392d8e17a0d67b39af

SHA256
59a0b11e884d0549f367bbc0d20f53543f77c11d68fab0f31c0a07e9c06e2b26

SHA512
7cbfa4729505ba1dd2baf272af0b46861ec7f589e171f9aadeca91b3a286ff0635ad84f99e262c14df395e3b9d0fb935c14153d61d0d263f838fb059c7b7aa2d

Download Submit
C:\Windows\System\UCCWydB.exe

Filesize
1.9MB

MD5
316dbe10d1c17791761959f13486c32e

SHA1
cee7aebf7c9c2bd1c529b70feb38317c62a4eb35

SHA256
099047b223364778ca2f6e4faf645206de1c6b5ff2087eb969d8179a88104d8f

SHA512
af3056d1497c0536ce67a0b1c534a56eaa5bf209bf04ffc9cdb26314cbb6a305201b08e02fc33a6ea106344115c6a6633d6ebb6bc7c9fd3d22e5ab6c0f92a3d8

Download Submit
C:\Windows\System\VbdJWML.exe

Filesize
1.9MB

MD5
08e64687c97d01c58c127a4af6cf1233

SHA1
9fec613d09fa8b8629690a6bd6d5fba133a8f758

SHA256
4331db7d1d28a6e523cfb7577a000138129cc17bf2bf6a5b2e1643d43607fac0

SHA512
82acaab8c9c6a0f88fc82de0bd7c5dfd4008ff69feaaaf6a82752929a402097871afbe849554ef72e0a0e36b8ccf71c1112f3232e245a0275578a12688f491c0

Download Submit
C:\Windows\System\ZwORssq.exe

Filesize
1.9MB

MD5
f0019be2352a07a68135199823f4494b

SHA1
8e2c1de468cdef10b4fe3d807177c520903a4127

SHA256
83076e408cfc3a6296bc79260a5b9b8475b458d48e1228c22abeb9de3fd92950

SHA512
2ca5cd7d2ec93c1175241aca9ae1e7720ab9635a6b259c660f27e2437f79213033c53520376526b8a53a5f1d13967d00b9ca02787d3b741e76bb848d1fd4ff00

Download Submit
C:\Windows\System\aThzfXl.exe

Filesize
1.9MB

MD5
f2565c0b1c1399521660821328239513

SHA1
07c3a138490126019d9f32210a32425b976c22a7

SHA256
dd67400d21ca990f9a66c6316414c56f4881a14607826c3e9e303766dbf6d10d

SHA512
5753b706d7ae60ab93c51e33ab6d4027c5a6e335ad417fd3009b8deb6f244796d9a6e7cae6760ce273cbb46d135d006debaf23c98b3d90c3c341989b7f6ef2fe

Download Submit
C:\Windows\System\bDRQOPH.exe

Filesize
1.9MB

MD5
ff74345f9849b4912657b19b8a117536

SHA1
e74aab020b9b95de46cb269554251e94ab64ee8c

SHA256
80d36937b5909fc8574f8a0eaa45d279c52d1926ad8fa1b7b44d6b30672d3b64

SHA512
5378c9d6f53002f6ffd2d5aa5907221e47c93e8afb6662609e0448a9cea5a6637d78e42cdc340468a6519732fd3a695d0ef669c48f3799229b82a2f7c097129b

Download Submit
C:\Windows\System\csneonD.exe

Filesize
1.9MB

MD5
e93d8d34299ce802269a979d923b8c5e

SHA1
2a1b12dcfefd591bf07b82906923845b39fabc99

SHA256
cab3e63abe6a249c6d1d50389c55d629ecb1231c8530b0ca9e30d81865ee006d

SHA512
1d0a2e15f8f2bbac59778f82161a48cd6423747b968cc2ae58703d4822578c6bba1f23937ca3a0c656bfa91fdce4f2a23dd88b095e4235d54713bf5d9f4b4abc

Download Submit
C:\Windows\System\cynvENc.exe

Filesize
1.9MB

MD5
b1d5741adec9a1ed77ab490b162e9374

SHA1
c84b8b327c938872e4a2be4040269dae17f7a668

SHA256
c51635c25f868f810e75d4827ccd67348a9ad7e6b48ae1844da46b684db884fd

SHA512
f237f896dcbc40ad4ad956f3192fb66b5718f4c34ff9043afb333a1c004050afd5a6423758eeb7fb3ef3dce1d2b65568bfddb3f6d9a8fcdb5c103e8f1565e6e2

Download Submit
C:\Windows\System\eJHdPPw.exe

Filesize
1.9MB

MD5
e0e5be5807814d45b0864c579c87ef8f

SHA1
43360752fc25ca542af86736044487e65634a1aa

SHA256
7caae03aba6addf25078796c50ed16adfe77bfc19285b24a601936de731df059

SHA512
0683dfde3fd8a18a7907ead19354525739d02c0686687d577d6ab0fd13259d600d0f8cd6d5fcd2284724f4971e57ee46371202ee0930549b51106ea1851427d2

Download Submit
C:\Windows\System\eKRrtsy.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\fKDGIkx.exe

Filesize
1.9MB

MD5
f91b833b09683d61e722c6bb8c3021b5

SHA1
a8a428181cbc10eae3329bb78c5102d9f3b4f40f

SHA256
d0f27629e3259e143e7cfb6d256a9a16c1e2921d097fb12aee1e54c24a541217

SHA512
8b12de4167a47daadd6ab5de8f18f9cbc2e807d23767a7901cc3817584655393922adc60f0243805c35bcf6257bfb81dcde4b52cad970b61cab272817b00e85a

Download Submit
C:\Windows\System\fToajBo.exe

Filesize
1.9MB

MD5
764237d2a50d29ea31ef3f97bf5274fa

SHA1
36216e3b918b7783499eb8441203a7facce5bcd7

SHA256
a8278d5e1afa44cb30a8c5980ad8b9c12b9296b6f0a0d4f0bfdc9244aa2c76c8

SHA512
fca72a7e4ef333d127a6ab626c087cc5d2658e76204200560fb665c5e13d2a53aa69d8f28662b22504a616ac1c6901869b98ce39359d4eb214ecddd80c11adc6

Download Submit
C:\Windows\System\gSMCwPC.exe

Filesize
1.9MB

MD5
eaf7622e7f2fd0c998cf2021cdf5f61c

SHA1
2b5c1b061b3846307eee92d0c35c3d1c968d5f6a

SHA256
d4de244692447957bbdc1ed3784a7d731c2d4b5018983ca62a6cca0c6f3f9b0d

SHA512
b87105373e5a57cd7c7f4ec5f7bdda4b0069902e2ff6c5dd9ceef4a0b0ac8a8e969e404441a50fa4b1a417c2d30a3b6928f7d53b2c75c00fedab3d5eecf59c1e

Download Submit
C:\Windows\System\gdkdtok.exe

Filesize
1.9MB

MD5
a8b756cade20b99cacc21eac9c5e7e17

SHA1
de4d7beff52194fa5bc5c30628515e1c38fd13bd

SHA256
fff9b3f0f1d8847197550bcaf2038515553b92d17d0f4271c013ab1a734aa1eb

SHA512
f148dcb80c52678711f4e638b6305655d83cf00e9811d94e18ef1ce0bcb5c5b45abcc63645b17bd4f9e4cfd37d4d77014a674c2255c6f88bda81e4383c4ab238

Download Submit
C:\Windows\System\hBihKXp.exe

Filesize
1.9MB

MD5
abdb202dda860b3278758741fd775340

SHA1
5e62059af44d77a51c811fee0f034dbe1caf458d

SHA256
e8fae041661a0426594949ccf41b2c83fd268ba6be5540920690ce85ff8eb2b5

SHA512
5e6c142faf8515f18ff4964d501d022405a752b5db0ee78a830dede37b5a65404c09f96e0f2df6d9ccb5aa3955bdb9cbe5570b709fe354594bc8a786fb721aae

Download Submit
C:\Windows\System\jgoUEWv.exe

Filesize
1.9MB

MD5
23b28648820577bbbfde3152a66d954e

SHA1
b004a60210953259ea67adc720d689d98ed1f2aa

SHA256
5bf2f43ca47600c5c31721b9b0f397401daa572b78e66b2d1b9c34284fad015f

SHA512
90f7574980a01ec06c3e9b5f0d962063062a202d828c7373064756147b2b4dc548085670ee051b9e25eeeabea6d8c1f710f6d81e44f87c8b588d0834feebf53a

Download Submit
C:\Windows\System\khjjWiy.exe

Filesize
1.9MB

MD5
75c1c89033ddfebc64f80bf06856d9b7

SHA1
a71a8a4eaa0e3a68a79e516de2f76b74272d0c71

SHA256
83d742045189c02e44ab77266c3ed920a6cd24115e9db03ec4164f0caa8776a3

SHA512
b464c486221f460f9cca6c90889a8de90fc604710601dc0c477575897e56c018669f5c2ef2c0489888b3c28f1477e63e62b0de6e63fab23f2db0362efc455907

Download Submit
C:\Windows\System\lCWNvnz.exe

Filesize
1.9MB

MD5
5462df9a196a2cc0e304ff246a14a5de

SHA1
591f06bab5bfee8d99cc760a4f7883a59fcdf758

SHA256
cba08db474d1a22ce28452b443cf8690bfd499e434b09fa5742d65b30643ee61

SHA512
1872279489b9075fe06351f6083ff7992d980b0e97072c0e7bd83016e015ba222fb98163ff4d87c0d5177aced7dde91ddd2a71cc349cfb349754421a96688f71

Download Submit
C:\Windows\System\nLafEGN.exe

Filesize
1.9MB

MD5
4cba31b507bf03adc0d1b172879dabb7

SHA1
bd8959d55e2db779646357223b8060cc5ef0055a

SHA256
e509c092ce372722347d3f95b197fbb780593698663fdf62dd8082a08c928145

SHA512
1f270ce0202ea2118a8421baaf559596d00590312812504a84f51d456c7669b4f0ef1bbf6ce0641990e7b4d2b547193b588a3d5e1f8d296f698c02921a9bde07

Download Submit
C:\Windows\System\pFRwRjK.exe

Filesize
1.9MB

MD5
06b1b9adacc3e285ee585f574ce643b2

SHA1
27bc66b168f2424417f66785e1b9ceebe87dc110

SHA256
4922b204167d65bb349f8da17fe2a6c2100e019be3366ba80b29b8a5c6e55ebb

SHA512
9678721f26b83b6e5e45962e0dcb5a1b623a8fe96e67b5b81d10a74a46d641c60123ee8b8c43b504a1624806724ed6c03961fa7666e45ee69e22cfe1a5dc0b05

Download Submit
C:\Windows\System\tgNeTpv.exe

Filesize
1.9MB

MD5
72b85a7f7179f2105240b2108804e378

SHA1
0a447e7ff1dca4c96cf234bc4f44cfcb63bb944e

SHA256
4a7443f18105946f4372da68c0e8df91f658701a810d56d00c77661802a9a138

SHA512
5ce2fe0d35e60218d018dd36674996334ddeb4da3e21cd8e4b391b66f0a6fd25117b7ad2ff609a783611cedd16e17882b1abd9ca1646dec08c5611c5f3d16dbb

Download Submit
C:\Windows\System\tlWfFxR.exe

Filesize
1.9MB

MD5
5f5d1f174481967db95edcfa1c4fe497

SHA1
2e71df03fa1c38657caca0e4961367aea9251ba8

SHA256
b8bdd7e507dac1277056a0efeba3c576571e4616664fd6d5016a15e90b7f7508

SHA512
3a49377b9ecfea586ed4ad500286ca8a92a580152d0165bf096da5c2f43ff2882e52f99f78b165857febece606444b239690510f74d50150e8f382e1d42a958a

Download Submit
C:\Windows\System\trxfYos.exe

Filesize
1.9MB

MD5
86bd458dbe4fbce4c3a10e1265e4a676

SHA1
2431d1de69230fbadbd34c560cb87266602a85e5

SHA256
9c03dadf37b1655198136e349048374224cc169870d3a50fa41ae454d3285ad2

SHA512
747e2b9912009ddf80d29c1b5b067bb1153b6066b9bbc3fb4610d249e29bdbbff4cfcdb1c1742bab656e0b89e42a8e936c3441dd41ef6b0c89fe88ca9b6a2f91

Download Submit
C:\Windows\System\wHEBfMw.exe

Filesize
1.9MB

MD5
13d0b9b05f1fd367775877ffafa558c5

SHA1
a51782f22a71cb66b3c256d408740f876d0a7fa8

SHA256
ae70597006aaa909c3b96d59ae5e5ac9b3491ad711a91bfd6d72a095d7095ade

SHA512
74e56389809e3d25f899986e3156f16851aca09fa62250e37bfb755d0f9a3fd42213c22a0b5bdbf45816fedea559b58ea8db71470163f500c9c61c9973d53f8c

Download Submit
memory/964-44-0x00007FF6AB0A0000-0x00007FF6AB492000-memory.dmp

Filesize
3.9MB

Download
memory/964-4212-0x00007FF6AB0A0000-0x00007FF6AB492000-memory.dmp

Filesize
3.9MB

Download
memory/1124-4233-0x00007FF6FC5E0000-0x00007FF6FC9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-115-0x00007FF6FC5E0000-0x00007FF6FC9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1240-4230-0x00007FF7553A0000-0x00007FF755792000-memory.dmp

Filesize
3.9MB

Download
memory/1240-116-0x00007FF7553A0000-0x00007FF755792000-memory.dmp

Filesize
3.9MB

Download
memory/1360-4242-0x00007FF772400000-0x00007FF7727F2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-120-0x00007FF772400000-0x00007FF7727F2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-4255-0x00007FF7F0A40000-0x00007FF7F0E32000-memory.dmp

Filesize
3.9MB

Download
memory/1576-157-0x00007FF7F0A40000-0x00007FF7F0E32000-memory.dmp

Filesize
3.9MB

Download
memory/2164-4208-0x00007FF73B6A0000-0x00007FF73BA92000-memory.dmp

Filesize
3.9MB

Download
memory/2164-109-0x00007FF73B6A0000-0x00007FF73BA92000-memory.dmp

Filesize
3.9MB

Download
memory/2180-81-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-4221-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-3124-0x00007FF60E5E0000-0x00007FF60E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-4251-0x00007FF7F5590000-0x00007FF7F5982000-memory.dmp

Filesize
3.9MB

Download
memory/2304-145-0x00007FF7F5590000-0x00007FF7F5982000-memory.dmp

Filesize
3.9MB

Download
memory/2460-95-0x00007FF68BF40000-0x00007FF68C332000-memory.dmp

Filesize
3.9MB

Download
memory/2460-4227-0x00007FF68BF40000-0x00007FF68C332000-memory.dmp

Filesize
3.9MB

Download
memory/2780-132-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-4841-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-3482-0x00007FF6E1E00000-0x00007FF6E21F2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-4249-0x00007FF6FDFD0000-0x00007FF6FE3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-151-0x00007FF6FDFD0000-0x00007FF6FE3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-176-0x00007FF71F9B0000-0x00007FF71FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-126-0x00007FF7B18D0000-0x00007FF7B1CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-4238-0x00007FF7B18D0000-0x00007FF7B1CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-164-0x00007FF603160000-0x00007FF603552000-memory.dmp

Filesize
3.9MB

Download
memory/3356-4257-0x00007FF68BBD0000-0x00007FF68BFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-163-0x00007FF68BBD0000-0x00007FF68BFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-4225-0x00007FF7E7970000-0x00007FF7E7D62000-memory.dmp

Filesize
3.9MB

Download
memory/3724-101-0x00007FF7E7970000-0x00007FF7E7D62000-memory.dmp

Filesize
3.9MB

Download
memory/3908-1-0x0000013AF1B10000-0x0000013AF1B20000-memory.dmp

Filesize
64KB

Download
memory/3908-0-0x00007FF60A410000-0x00007FF60A802000-memory.dmp

Filesize
3.9MB

Download
memory/3944-4245-0x00007FF751820000-0x00007FF751C12000-memory.dmp

Filesize
3.9MB

Download
memory/3944-133-0x00007FF751820000-0x00007FF751C12000-memory.dmp

Filesize
3.9MB

Download
memory/3960-4209-0x00007FF6B4120000-0x00007FF6B4512000-memory.dmp

Filesize
3.9MB

Download
memory/3960-50-0x00007FF6B4120000-0x00007FF6B4512000-memory.dmp

Filesize
3.9MB

Download
memory/4200-170-0x00007FF6E8F10000-0x00007FF6E9302000-memory.dmp

Filesize
3.9MB

Download
memory/4304-32-0x00007FFDE99C0000-0x00007FFDEA481000-memory.dmp

Filesize
10.8MB

Download
memory/4304-60-0x000001E222F80000-0x000001E222FA2000-memory.dmp

Filesize
136KB

Download
memory/4304-4026-0x00007FFDE99C0000-0x00007FFDEA481000-memory.dmp

Filesize
10.8MB

Download
memory/4304-426-0x000001E223CD0000-0x000001E224476000-memory.dmp

Filesize
7.6MB

Download
memory/4304-6-0x00007FFDE99C3000-0x00007FFDE99C5000-memory.dmp

Filesize
8KB

Download
memory/4304-22-0x00007FFDE99C0000-0x00007FFDEA481000-memory.dmp

Filesize
10.8MB

Download
memory/4452-139-0x00007FF72A600000-0x00007FF72A9F2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-4244-0x00007FF72A600000-0x00007FF72A9F2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-7-0x00007FF714340000-0x00007FF714732000-memory.dmp

Filesize
3.9MB

Download
memory/4492-4199-0x00007FF714340000-0x00007FF714732000-memory.dmp

Filesize
3.9MB

Download
memory/4648-104-0x00007FF749930000-0x00007FF749D22000-memory.dmp

Filesize
3.9MB

Download
memory/4648-4202-0x00007FF749930000-0x00007FF749D22000-memory.dmp

Filesize
3.9MB

Download
memory/5064-4239-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-93-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3125-0x00007FF7E77E0000-0x00007FF7E7BD2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-69-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp

Filesize
3.9MB

Download
memory/5100-3123-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp

Filesize
3.9MB

Download
memory/5100-4217-0x00007FF61C690000-0x00007FF61CA82000-memory.dmp

Filesize
3.9MB

Download