xmrig | 33d6b1b8ca69c99fc11e88d04b6c7f4c7f5653ea27146bfd5a39796ac5ba3eb9

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Size

2.2MB
MD5

11b2228484c36d19f891243e61893785
SHA1

eabbc585f564ce3dc1781c67eac2ba2204d3760d
SHA256

33d6b1b8ca69c99fc11e88d04b6c7f4c7f5653ea27146bfd5a39796ac5ba3eb9
SHA512

4d7e35cecf81efa1f938351159df568ab58e386431ed01b07e29c0d2d8a88f2562b35033dc568aa3bd373ffecf17ed47d0059f802ac5a497813a45748b23f868
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbW:NABq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1236-244-0x00007FF704920000-0x00007FF704D12000-memory.dmp	xmrig
behavioral2/memory/1628-345-0x00007FF6A7880000-0x00007FF6A7C72000-memory.dmp	xmrig
behavioral2/memory/1844-381-0x00007FF7D7540000-0x00007FF7D7932000-memory.dmp	xmrig
behavioral2/memory/5048-385-0x00007FF7913C0000-0x00007FF7917B2000-memory.dmp	xmrig
behavioral2/memory/1436-384-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp	xmrig
behavioral2/memory/4348-383-0x00007FF637F80000-0x00007FF638372000-memory.dmp	xmrig
behavioral2/memory/772-382-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	xmrig
behavioral2/memory/4816-379-0x00007FF631380000-0x00007FF631772000-memory.dmp	xmrig
behavioral2/memory/3236-344-0x00007FF6D2380000-0x00007FF6D2772000-memory.dmp	xmrig
behavioral2/memory/2428-288-0x00007FF6DA530000-0x00007FF6DA922000-memory.dmp	xmrig
behavioral2/memory/4704-285-0x00007FF703A50000-0x00007FF703E42000-memory.dmp	xmrig
behavioral2/memory/3048-272-0x00007FF70F010000-0x00007FF70F402000-memory.dmp	xmrig
behavioral2/memory/1760-271-0x00007FF663470000-0x00007FF663862000-memory.dmp	xmrig
behavioral2/memory/3796-270-0x00007FF7E8320000-0x00007FF7E8712000-memory.dmp	xmrig
behavioral2/memory/3276-262-0x00007FF6352E0000-0x00007FF6356D2000-memory.dmp	xmrig
behavioral2/memory/2464-234-0x00007FF745500000-0x00007FF7458F2000-memory.dmp	xmrig
behavioral2/memory/884-220-0x00007FF733030000-0x00007FF733422000-memory.dmp	xmrig
behavioral2/memory/1936-197-0x00007FF63E9F0000-0x00007FF63EDE2000-memory.dmp	xmrig
behavioral2/memory/1128-187-0x00007FF6004C0000-0x00007FF6008B2000-memory.dmp	xmrig
behavioral2/memory/3832-162-0x00007FF78A1E0000-0x00007FF78A5D2000-memory.dmp	xmrig
behavioral2/memory/2424-20-0x00007FF781BE0000-0x00007FF781FD2000-memory.dmp	xmrig
behavioral2/memory/772-4243-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	xmrig
behavioral2/memory/1436-4257-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp	xmrig
behavioral2/memory/3796-4272-0x00007FF7E8320000-0x00007FF7E8712000-memory.dmp	xmrig
behavioral2/memory/1496-4277-0x00007FF7D33C0000-0x00007FF7D37B2000-memory.dmp	xmrig
behavioral2/memory/5048-4265-0x00007FF7913C0000-0x00007FF7917B2000-memory.dmp	xmrig
behavioral2/memory/1128-4255-0x00007FF6004C0000-0x00007FF6008B2000-memory.dmp	xmrig
behavioral2/memory/3124-4246-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp	xmrig
behavioral2/memory/2952-4250-0x00007FF7B61E0000-0x00007FF7B65D2000-memory.dmp	xmrig
behavioral2/memory/3276-4344-0x00007FF6352E0000-0x00007FF6356D2000-memory.dmp	xmrig
behavioral2/memory/1844-4324-0x00007FF7D7540000-0x00007FF7D7932000-memory.dmp	xmrig
behavioral2/memory/1760-4313-0x00007FF663470000-0x00007FF663862000-memory.dmp	xmrig
behavioral2/memory/4704-4311-0x00007FF703A50000-0x00007FF703E42000-memory.dmp	xmrig
behavioral2/memory/3048-4307-0x00007FF70F010000-0x00007FF70F402000-memory.dmp	xmrig
behavioral2/memory/3832-4299-0x00007FF78A1E0000-0x00007FF78A5D2000-memory.dmp	xmrig
behavioral2/memory/1236-4290-0x00007FF704920000-0x00007FF704D12000-memory.dmp	xmrig
behavioral2/memory/1936-4320-0x00007FF63E9F0000-0x00007FF63EDE2000-memory.dmp	xmrig
behavioral2/memory/2428-4317-0x00007FF6DA530000-0x00007FF6DA922000-memory.dmp	xmrig
behavioral2/memory/1628-4304-0x00007FF6A7880000-0x00007FF6A7C72000-memory.dmp	xmrig
behavioral2/memory/2464-4286-0x00007FF745500000-0x00007FF7458F2000-memory.dmp	xmrig
behavioral2/memory/884-4297-0x00007FF733030000-0x00007FF733422000-memory.dmp	xmrig
behavioral2/memory/3236-4294-0x00007FF6D2380000-0x00007FF6D2772000-memory.dmp	xmrig
behavioral2/memory/4772-5310-0x00007FF69E760000-0x00007FF69EB52000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
7	460	powershell.exe
9	460	powershell.exe
13	460	powershell.exe
14	460	powershell.exe
17	460	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
460	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2424	EQkIPeA.exe
772	vCmssrP.exe
3124	tnCNGyc.exe
1496	TjmqrGa.exe
4348	AeVJHcQ.exe
2952	LBlsyFH.exe
1436	FUULMxY.exe
3832	bVpnLWe.exe
1128	nvhWLmf.exe
1936	YcTkNnR.exe
5048	fDAzMKk.exe
884	HGkhOFl.exe
2464	vNAJZUs.exe
1236	dMKnJEB.exe
3276	sCTgIXO.exe
3796	mBobhjQ.exe
1760	gPuLYXT.exe
3048	sJDMgSL.exe
4704	VzZpeJX.exe
2428	xVrQhIg.exe
3236	qkyBEzQ.exe
1628	fCjAKRF.exe
4816	xDDtVra.exe
1844	vpzhiMm.exe
3724	ftnPDUQ.exe
532	xJudcQF.exe
1916	RYFiIFC.exe
1696	fEAnxyg.exe
1072	owPuFyL.exe
3492	DkjuSxa.exe
2420	FhOXRip.exe
3108	QbFVsrQ.exe
2984	hiCwSSz.exe
2340	XJKfJCf.exe
4876	wbQoYOC.exe
2476	KQfHFkj.exe
2068	dQUeeHc.exe
2268	PVVhFsO.exe
1992	ViOQBro.exe
4212	YcCKxJh.exe
2644	nxhPGkJ.exe
952	JQRjLYf.exe
3760	dhAejXQ.exe
2452	QImxSie.exe
4636	Fgppgxs.exe
4692	FdMgtqS.exe
3140	idSqNyl.exe
508	ShurGtA.exe
1924	RQnUVjw.exe
2816	zTNnslF.exe
4308	Weotrwi.exe
4264	fRxOjJG.exe
3932	QkiHZdD.exe
3788	YbrRFPe.exe
748	yQKkicY.exe
4280	cvOcwhr.exe
5016	DVaEReC.exe
1564	UxowEHQ.exe
1484	indFoxP.exe
4436	zUZHcqJ.exe
5088	mfWfcdd.exe
4328	gEGuPCI.exe
4920	MZFYmUG.exe
4688	IsHdEHc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4772-0-0x00007FF69E760000-0x00007FF69EB52000-memory.dmp	upx
behavioral2/files/0x000e000000023baf-4.dat	upx
behavioral2/memory/1496-34-0x00007FF7D33C0000-0x00007FF7D37B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-41.dat	upx
behavioral2/files/0x000a000000023bc6-67.dat	upx
behavioral2/files/0x000a000000023bca-83.dat	upx
behavioral2/files/0x000a000000023bd1-105.dat	upx
behavioral2/files/0x000a000000023bd4-139.dat	upx
behavioral2/files/0x000a000000023bd2-156.dat	upx
behavioral2/memory/1236-244-0x00007FF704920000-0x00007FF704D12000-memory.dmp	upx
behavioral2/memory/1628-345-0x00007FF6A7880000-0x00007FF6A7C72000-memory.dmp	upx
behavioral2/memory/1844-381-0x00007FF7D7540000-0x00007FF7D7932000-memory.dmp	upx
behavioral2/memory/5048-385-0x00007FF7913C0000-0x00007FF7917B2000-memory.dmp	upx
behavioral2/memory/1436-384-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp	upx
behavioral2/memory/4348-383-0x00007FF637F80000-0x00007FF638372000-memory.dmp	upx
behavioral2/memory/772-382-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	upx
behavioral2/memory/4816-379-0x00007FF631380000-0x00007FF631772000-memory.dmp	upx
behavioral2/memory/3236-344-0x00007FF6D2380000-0x00007FF6D2772000-memory.dmp	upx
behavioral2/memory/2428-288-0x00007FF6DA530000-0x00007FF6DA922000-memory.dmp	upx
behavioral2/memory/4704-285-0x00007FF703A50000-0x00007FF703E42000-memory.dmp	upx
behavioral2/memory/3048-272-0x00007FF70F010000-0x00007FF70F402000-memory.dmp	upx
behavioral2/memory/1760-271-0x00007FF663470000-0x00007FF663862000-memory.dmp	upx
behavioral2/memory/3796-270-0x00007FF7E8320000-0x00007FF7E8712000-memory.dmp	upx
behavioral2/memory/3276-262-0x00007FF6352E0000-0x00007FF6356D2000-memory.dmp	upx
behavioral2/memory/2464-234-0x00007FF745500000-0x00007FF7458F2000-memory.dmp	upx
behavioral2/memory/884-220-0x00007FF733030000-0x00007FF733422000-memory.dmp	upx
behavioral2/memory/1936-197-0x00007FF63E9F0000-0x00007FF63EDE2000-memory.dmp	upx
behavioral2/memory/1128-187-0x00007FF6004C0000-0x00007FF6008B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bde-174.dat	upx
behavioral2/files/0x000a000000023bd5-172.dat	upx
behavioral2/files/0x000a000000023bdc-167.dat	upx
behavioral2/files/0x000a000000023bda-166.dat	upx
behavioral2/files/0x000c000000023bb0-165.dat	upx
behavioral2/memory/3832-162-0x00007FF78A1E0000-0x00007FF78A5D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bdd-161.dat	upx
behavioral2/files/0x000a000000023bdb-155.dat	upx
behavioral2/files/0x000a000000023bd9-153.dat	upx
behavioral2/files/0x000a000000023bd8-150.dat	upx
behavioral2/files/0x000a000000023bd7-145.dat	upx
behavioral2/files/0x000a000000023bd3-144.dat	upx
behavioral2/files/0x000a000000023bd6-143.dat	upx
behavioral2/files/0x000a000000023bc9-141.dat	upx
behavioral2/files/0x000a000000023bcf-157.dat	upx
behavioral2/files/0x000a000000023bce-132.dat	upx
behavioral2/files/0x000a000000023bcd-129.dat	upx
behavioral2/files/0x000a000000023bcc-124.dat	upx
behavioral2/files/0x000a000000023bcb-122.dat	upx
behavioral2/files/0x000a000000023bc8-104.dat	upx
behavioral2/files/0x000a000000023bc7-103.dat	upx
behavioral2/files/0x000a000000023bd0-101.dat	upx
behavioral2/files/0x000a000000023bc2-98.dat	upx
behavioral2/files/0x000a000000023bbe-81.dat	upx
behavioral2/files/0x000a000000023bc3-63.dat	upx
behavioral2/files/0x000a000000023bc0-58.dat	upx
behavioral2/files/0x000a000000023bbd-56.dat	upx
behavioral2/files/0x000a000000023bc5-50.dat	upx
behavioral2/files/0x000a000000023bc1-46.dat	upx
behavioral2/memory/2952-44-0x00007FF7B61E0000-0x00007FF7B65D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-53.dat	upx
behavioral2/files/0x000a000000023bbf-22.dat	upx
behavioral2/memory/3124-30-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp	upx
behavioral2/memory/2424-20-0x00007FF781BE0000-0x00007FF781FD2000-memory.dmp	upx
behavioral2/memory/772-4243-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	upx
behavioral2/memory/1436-4257-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gBttJJH.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\HufeXkX.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\guxfKQw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\EhhFXnc.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\mJlKbfU.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XxBOFzK.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\HpbFzLl.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\NdoMobr.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\HZhSPoq.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\hUZJsKr.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\pcrHlOo.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\nnDROkE.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\WTaAEmm.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XhfvpGY.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ETFvnva.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\KJDikZk.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\dEYETar.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\FDVTegU.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\lYntpXx.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\obZJNRu.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\aYKTJRc.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\NlJtXKK.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\tAdJKFD.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\reIXlRU.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XTbdNfa.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\QPSCJAE.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JyyYjig.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\lKvawKZ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\wjAKQux.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JltXbcy.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\pxtaTuN.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\gHWgEdh.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\KlOtlKT.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\hUnsFQI.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\azmrofy.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\rbhauuR.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DNUncnF.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\QmzOXhJ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ZXCiyAb.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\txxDKSr.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\rwvOdUG.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\sOTaswL.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\mbYCtlW.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\STWLFlV.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\nNpjIlq.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DJRPRCo.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\QJCifXC.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XYOmxQr.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\PMQSuOE.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\qNkArgo.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\nsSUEDX.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JaoSPdY.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ONadCaw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XpiHsft.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DVjdZjd.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\WgBTNEd.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\pqAuWTp.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\npzFRhx.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\RriZXtL.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JdpikqK.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\oJRWoef.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\NanauLQ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\oqsUhUw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\vIEojlA.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
460	powershell.exe
460	powershell.exe
460	powershell.exe
460	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	powershell.exe
Token: SeLockMemoryPrivilege	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	10688	dwm.exe
Token: SeChangeNotifyPrivilege	10688	dwm.exe
Token: 33	10688	dwm.exe
Token: SeIncBasePriorityPrivilege	10688	dwm.exe
Token: SeCreateGlobalPrivilege	1220	dwm.exe
Token: SeChangeNotifyPrivilege	1220	dwm.exe
Token: 33	1220	dwm.exe
Token: SeIncBasePriorityPrivilege	1220	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 460	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	84
PID 4772 wrote to memory of 460	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	84
PID 4772 wrote to memory of 2424	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	85
PID 4772 wrote to memory of 2424	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	85
PID 4772 wrote to memory of 772	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	86
PID 4772 wrote to memory of 772	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	86
PID 4772 wrote to memory of 3124	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	87
PID 4772 wrote to memory of 3124	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	87
PID 4772 wrote to memory of 1496	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	88
PID 4772 wrote to memory of 1496	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	88
PID 4772 wrote to memory of 4348	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	89
PID 4772 wrote to memory of 4348	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	89
PID 4772 wrote to memory of 2952	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	90
PID 4772 wrote to memory of 2952	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	90
PID 4772 wrote to memory of 1436	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	91
PID 4772 wrote to memory of 1436	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	91
PID 4772 wrote to memory of 3832	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	92
PID 4772 wrote to memory of 3832	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	92
PID 4772 wrote to memory of 1128	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	93
PID 4772 wrote to memory of 1128	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	93
PID 4772 wrote to memory of 1936	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	94
PID 4772 wrote to memory of 1936	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	94
PID 4772 wrote to memory of 5048	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	95
PID 4772 wrote to memory of 5048	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	95
PID 4772 wrote to memory of 884	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	96
PID 4772 wrote to memory of 884	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	96
PID 4772 wrote to memory of 2464	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	97
PID 4772 wrote to memory of 2464	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	97
PID 4772 wrote to memory of 1236	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	98
PID 4772 wrote to memory of 1236	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	98
PID 4772 wrote to memory of 3276	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	99
PID 4772 wrote to memory of 3276	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	99
PID 4772 wrote to memory of 3796	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	100
PID 4772 wrote to memory of 3796	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	100
PID 4772 wrote to memory of 1760	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	101
PID 4772 wrote to memory of 1760	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	101
PID 4772 wrote to memory of 3048	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	102
PID 4772 wrote to memory of 3048	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	102
PID 4772 wrote to memory of 4704	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	103
PID 4772 wrote to memory of 4704	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	103
PID 4772 wrote to memory of 2428	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	104
PID 4772 wrote to memory of 2428	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	104
PID 4772 wrote to memory of 3236	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	105
PID 4772 wrote to memory of 3236	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	105
PID 4772 wrote to memory of 1628	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	106
PID 4772 wrote to memory of 1628	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	106
PID 4772 wrote to memory of 4816	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	107
PID 4772 wrote to memory of 4816	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	107
PID 4772 wrote to memory of 1844	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	108
PID 4772 wrote to memory of 1844	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	108
PID 4772 wrote to memory of 3724	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	109
PID 4772 wrote to memory of 3724	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	109
PID 4772 wrote to memory of 532	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	110
PID 4772 wrote to memory of 532	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	110
PID 4772 wrote to memory of 1916	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	111
PID 4772 wrote to memory of 1916	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	111
PID 4772 wrote to memory of 1696	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	112
PID 4772 wrote to memory of 1696	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	112
PID 4772 wrote to memory of 1072	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	113
PID 4772 wrote to memory of 1072	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	113
PID 4772 wrote to memory of 3492	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	114
PID 4772 wrote to memory of 3492	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	114
PID 4772 wrote to memory of 2420	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	115
PID 4772 wrote to memory of 2420	4772	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\11b2228484c36d19f891243e61893785_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11b2228484c36d19f891243e61893785_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\System\EQkIPeA.exe
  C:\Windows\System\EQkIPeA.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\vCmssrP.exe
  C:\Windows\System\vCmssrP.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\tnCNGyc.exe
  C:\Windows\System\tnCNGyc.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\TjmqrGa.exe
  C:\Windows\System\TjmqrGa.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\AeVJHcQ.exe
  C:\Windows\System\AeVJHcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LBlsyFH.exe
  C:\Windows\System\LBlsyFH.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\FUULMxY.exe
  C:\Windows\System\FUULMxY.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\bVpnLWe.exe
  C:\Windows\System\bVpnLWe.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\nvhWLmf.exe
  C:\Windows\System\nvhWLmf.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\YcTkNnR.exe
  C:\Windows\System\YcTkNnR.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\fDAzMKk.exe
  C:\Windows\System\fDAzMKk.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\HGkhOFl.exe
  C:\Windows\System\HGkhOFl.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\vNAJZUs.exe
  C:\Windows\System\vNAJZUs.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\dMKnJEB.exe
  C:\Windows\System\dMKnJEB.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\sCTgIXO.exe
  C:\Windows\System\sCTgIXO.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\mBobhjQ.exe
  C:\Windows\System\mBobhjQ.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\gPuLYXT.exe
  C:\Windows\System\gPuLYXT.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\sJDMgSL.exe
  C:\Windows\System\sJDMgSL.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\VzZpeJX.exe
  C:\Windows\System\VzZpeJX.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\xVrQhIg.exe
  C:\Windows\System\xVrQhIg.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\qkyBEzQ.exe
  C:\Windows\System\qkyBEzQ.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\fCjAKRF.exe
  C:\Windows\System\fCjAKRF.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\xDDtVra.exe
  C:\Windows\System\xDDtVra.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\vpzhiMm.exe
  C:\Windows\System\vpzhiMm.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ftnPDUQ.exe
  C:\Windows\System\ftnPDUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\xJudcQF.exe
  C:\Windows\System\xJudcQF.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\RYFiIFC.exe
  C:\Windows\System\RYFiIFC.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\fEAnxyg.exe
  C:\Windows\System\fEAnxyg.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\owPuFyL.exe
  C:\Windows\System\owPuFyL.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\DkjuSxa.exe
  C:\Windows\System\DkjuSxa.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\FhOXRip.exe
  C:\Windows\System\FhOXRip.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\wbQoYOC.exe
  C:\Windows\System\wbQoYOC.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\QbFVsrQ.exe
  C:\Windows\System\QbFVsrQ.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\KQfHFkj.exe
  C:\Windows\System\KQfHFkj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\hiCwSSz.exe
  C:\Windows\System\hiCwSSz.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\XJKfJCf.exe
  C:\Windows\System\XJKfJCf.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\dQUeeHc.exe
  C:\Windows\System\dQUeeHc.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\PVVhFsO.exe
  C:\Windows\System\PVVhFsO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ViOQBro.exe
  C:\Windows\System\ViOQBro.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\YcCKxJh.exe
  C:\Windows\System\YcCKxJh.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\nxhPGkJ.exe
  C:\Windows\System\nxhPGkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\JQRjLYf.exe
  C:\Windows\System\JQRjLYf.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\dhAejXQ.exe
  C:\Windows\System\dhAejXQ.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\QImxSie.exe
  C:\Windows\System\QImxSie.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\Fgppgxs.exe
  C:\Windows\System\Fgppgxs.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\FdMgtqS.exe
  C:\Windows\System\FdMgtqS.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\idSqNyl.exe
  C:\Windows\System\idSqNyl.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\ShurGtA.exe
  C:\Windows\System\ShurGtA.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\RQnUVjw.exe
  C:\Windows\System\RQnUVjw.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\zTNnslF.exe
  C:\Windows\System\zTNnslF.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\Weotrwi.exe
  C:\Windows\System\Weotrwi.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\fRxOjJG.exe
  C:\Windows\System\fRxOjJG.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\QkiHZdD.exe
  C:\Windows\System\QkiHZdD.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\YbrRFPe.exe
  C:\Windows\System\YbrRFPe.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\yQKkicY.exe
  C:\Windows\System\yQKkicY.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\cvOcwhr.exe
  C:\Windows\System\cvOcwhr.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\DVaEReC.exe
  C:\Windows\System\DVaEReC.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\UxowEHQ.exe
  C:\Windows\System\UxowEHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\indFoxP.exe
  C:\Windows\System\indFoxP.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\zUZHcqJ.exe
  C:\Windows\System\zUZHcqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\mfWfcdd.exe
  C:\Windows\System\mfWfcdd.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\gEGuPCI.exe
  C:\Windows\System\gEGuPCI.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\MZFYmUG.exe
  C:\Windows\System\MZFYmUG.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\IsHdEHc.exe
  C:\Windows\System\IsHdEHc.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\DFQfyUg.exe
  C:\Windows\System\DFQfyUg.exe
  2⤵
  PID:4288
- C:\Windows\System\inHgdKN.exe
  C:\Windows\System\inHgdKN.exe
  2⤵
  PID:1412
- C:\Windows\System\VRapqzU.exe
  C:\Windows\System\VRapqzU.exe
  2⤵
  PID:4916
- C:\Windows\System\tKkNQLC.exe
  C:\Windows\System\tKkNQLC.exe
  2⤵
  PID:3836
- C:\Windows\System\zOCXziO.exe
  C:\Windows\System\zOCXziO.exe
  2⤵
  PID:4564
- C:\Windows\System\hgSPdzU.exe
  C:\Windows\System\hgSPdzU.exe
  2⤵
  PID:1224
- C:\Windows\System\aWAIydz.exe
  C:\Windows\System\aWAIydz.exe
  2⤵
  PID:2660
- C:\Windows\System\ARUVQkb.exe
  C:\Windows\System\ARUVQkb.exe
  2⤵
  PID:4492
- C:\Windows\System\ngbJjET.exe
  C:\Windows\System\ngbJjET.exe
  2⤵
  PID:5124
- C:\Windows\System\MGEMiSU.exe
  C:\Windows\System\MGEMiSU.exe
  2⤵
  PID:5144
- C:\Windows\System\sffxssJ.exe
  C:\Windows\System\sffxssJ.exe
  2⤵
  PID:5160
- C:\Windows\System\yaUBqBN.exe
  C:\Windows\System\yaUBqBN.exe
  2⤵
  PID:5176
- C:\Windows\System\BjyvIOF.exe
  C:\Windows\System\BjyvIOF.exe
  2⤵
  PID:5192
- C:\Windows\System\waUgwaO.exe
  C:\Windows\System\waUgwaO.exe
  2⤵
  PID:5208
- C:\Windows\System\FxkONHD.exe
  C:\Windows\System\FxkONHD.exe
  2⤵
  PID:5224
- C:\Windows\System\dqRlQkc.exe
  C:\Windows\System\dqRlQkc.exe
  2⤵
  PID:5240
- C:\Windows\System\vCDsptb.exe
  C:\Windows\System\vCDsptb.exe
  2⤵
  PID:5256
- C:\Windows\System\VXZdtLc.exe
  C:\Windows\System\VXZdtLc.exe
  2⤵
  PID:5272
- C:\Windows\System\OALBZWA.exe
  C:\Windows\System\OALBZWA.exe
  2⤵
  PID:5288
- C:\Windows\System\xOCCJcX.exe
  C:\Windows\System\xOCCJcX.exe
  2⤵
  PID:5304
- C:\Windows\System\bAicPNU.exe
  C:\Windows\System\bAicPNU.exe
  2⤵
  PID:5320
- C:\Windows\System\BuCdTYY.exe
  C:\Windows\System\BuCdTYY.exe
  2⤵
  PID:5336
- C:\Windows\System\PjXVyCL.exe
  C:\Windows\System\PjXVyCL.exe
  2⤵
  PID:5352
- C:\Windows\System\iKgBwIi.exe
  C:\Windows\System\iKgBwIi.exe
  2⤵
  PID:5368
- C:\Windows\System\EUtFGJO.exe
  C:\Windows\System\EUtFGJO.exe
  2⤵
  PID:5384
- C:\Windows\System\QhQYnyQ.exe
  C:\Windows\System\QhQYnyQ.exe
  2⤵
  PID:5400
- C:\Windows\System\NvmvNfz.exe
  C:\Windows\System\NvmvNfz.exe
  2⤵
  PID:5416
- C:\Windows\System\ndEeVoK.exe
  C:\Windows\System\ndEeVoK.exe
  2⤵
  PID:5432
- C:\Windows\System\RHiHZOX.exe
  C:\Windows\System\RHiHZOX.exe
  2⤵
  PID:5448
- C:\Windows\System\vjhnYew.exe
  C:\Windows\System\vjhnYew.exe
  2⤵
  PID:5540
- C:\Windows\System\KthLMjG.exe
  C:\Windows\System\KthLMjG.exe
  2⤵
  PID:5560
- C:\Windows\System\cINDjMM.exe
  C:\Windows\System\cINDjMM.exe
  2⤵
  PID:5580
- C:\Windows\System\hsTOOhP.exe
  C:\Windows\System\hsTOOhP.exe
  2⤵
  PID:5604
- C:\Windows\System\XizmRxR.exe
  C:\Windows\System\XizmRxR.exe
  2⤵
  PID:5624
- C:\Windows\System\DwRXSRz.exe
  C:\Windows\System\DwRXSRz.exe
  2⤵
  PID:5648
- C:\Windows\System\mTfzoAK.exe
  C:\Windows\System\mTfzoAK.exe
  2⤵
  PID:5664
- C:\Windows\System\JLmkgYE.exe
  C:\Windows\System\JLmkgYE.exe
  2⤵
  PID:5688
- C:\Windows\System\aMwyaWH.exe
  C:\Windows\System\aMwyaWH.exe
  2⤵
  PID:5712
- C:\Windows\System\uWPxjec.exe
  C:\Windows\System\uWPxjec.exe
  2⤵
  PID:5736
- C:\Windows\System\zchnZNi.exe
  C:\Windows\System\zchnZNi.exe
  2⤵
  PID:5860
- C:\Windows\System\vLnKzeq.exe
  C:\Windows\System\vLnKzeq.exe
  2⤵
  PID:5876
- C:\Windows\System\dlfTauE.exe
  C:\Windows\System\dlfTauE.exe
  2⤵
  PID:5892
- C:\Windows\System\qEQUIVD.exe
  C:\Windows\System\qEQUIVD.exe
  2⤵
  PID:5908
- C:\Windows\System\LRrongi.exe
  C:\Windows\System\LRrongi.exe
  2⤵
  PID:5924
- C:\Windows\System\TXDaXcx.exe
  C:\Windows\System\TXDaXcx.exe
  2⤵
  PID:5940
- C:\Windows\System\bgfaIPs.exe
  C:\Windows\System\bgfaIPs.exe
  2⤵
  PID:5956
- C:\Windows\System\gQZWkfB.exe
  C:\Windows\System\gQZWkfB.exe
  2⤵
  PID:5972
- C:\Windows\System\ucpdmRi.exe
  C:\Windows\System\ucpdmRi.exe
  2⤵
  PID:5988
- C:\Windows\System\ppzvhCM.exe
  C:\Windows\System\ppzvhCM.exe
  2⤵
  PID:6060
- C:\Windows\System\LxJwJPq.exe
  C:\Windows\System\LxJwJPq.exe
  2⤵
  PID:6080
- C:\Windows\System\VzdZBiD.exe
  C:\Windows\System\VzdZBiD.exe
  2⤵
  PID:6112
- C:\Windows\System\IOuOeiQ.exe
  C:\Windows\System\IOuOeiQ.exe
  2⤵
  PID:1904
- C:\Windows\System\FyznjPN.exe
  C:\Windows\System\FyznjPN.exe
  2⤵
  PID:4080
- C:\Windows\System\XiQMALn.exe
  C:\Windows\System\XiQMALn.exe
  2⤵
  PID:4092
- C:\Windows\System\AWavcJe.exe
  C:\Windows\System\AWavcJe.exe
  2⤵
  PID:1536
- C:\Windows\System\lFZPpCI.exe
  C:\Windows\System\lFZPpCI.exe
  2⤵
  PID:3576
- C:\Windows\System\UlQeMqw.exe
  C:\Windows\System\UlQeMqw.exe
  2⤵
  PID:3300
- C:\Windows\System\MszgssZ.exe
  C:\Windows\System\MszgssZ.exe
  2⤵
  PID:2536
- C:\Windows\System\bwbLUqK.exe
  C:\Windows\System\bwbLUqK.exe
  2⤵
  PID:684
- C:\Windows\System\evkqAXj.exe
  C:\Windows\System\evkqAXj.exe
  2⤵
  PID:5152
- C:\Windows\System\uiQWPeW.exe
  C:\Windows\System\uiQWPeW.exe
  2⤵
  PID:5184
- C:\Windows\System\LJobVtP.exe
  C:\Windows\System\LJobVtP.exe
  2⤵
  PID:5556
- C:\Windows\System\GpqvXGm.exe
  C:\Windows\System\GpqvXGm.exe
  2⤵
  PID:5620
- C:\Windows\System\ofplQYg.exe
  C:\Windows\System\ofplQYg.exe
  2⤵
  PID:5684
- C:\Windows\System\dpviKGW.exe
  C:\Windows\System\dpviKGW.exe
  2⤵
  PID:5704
- C:\Windows\System\CwydNcX.exe
  C:\Windows\System\CwydNcX.exe
  2⤵
  PID:5872
- C:\Windows\System\PrjjeHY.exe
  C:\Windows\System\PrjjeHY.exe
  2⤵
  PID:6160
- C:\Windows\System\msirpgJ.exe
  C:\Windows\System\msirpgJ.exe
  2⤵
  PID:6184
- C:\Windows\System\wvgKjLs.exe
  C:\Windows\System\wvgKjLs.exe
  2⤵
  PID:6200
- C:\Windows\System\GnfqUiU.exe
  C:\Windows\System\GnfqUiU.exe
  2⤵
  PID:6216
- C:\Windows\System\LAFtJqk.exe
  C:\Windows\System\LAFtJqk.exe
  2⤵
  PID:6240
- C:\Windows\System\CKOFNoV.exe
  C:\Windows\System\CKOFNoV.exe
  2⤵
  PID:6264
- C:\Windows\System\HPKIMgh.exe
  C:\Windows\System\HPKIMgh.exe
  2⤵
  PID:6288
- C:\Windows\System\kRqNOPj.exe
  C:\Windows\System\kRqNOPj.exe
  2⤵
  PID:6308
- C:\Windows\System\tAUMHGG.exe
  C:\Windows\System\tAUMHGG.exe
  2⤵
  PID:6332
- C:\Windows\System\tgRsEKr.exe
  C:\Windows\System\tgRsEKr.exe
  2⤵
  PID:6352
- C:\Windows\System\FaTDlXn.exe
  C:\Windows\System\FaTDlXn.exe
  2⤵
  PID:6372
- C:\Windows\System\GmjWDRZ.exe
  C:\Windows\System\GmjWDRZ.exe
  2⤵
  PID:6396
- C:\Windows\System\RUpBTEC.exe
  C:\Windows\System\RUpBTEC.exe
  2⤵
  PID:6696
- C:\Windows\System\ZstkmIg.exe
  C:\Windows\System\ZstkmIg.exe
  2⤵
  PID:6716
- C:\Windows\System\RTxdzBi.exe
  C:\Windows\System\RTxdzBi.exe
  2⤵
  PID:6736
- C:\Windows\System\AGIFCax.exe
  C:\Windows\System\AGIFCax.exe
  2⤵
  PID:6916
- C:\Windows\System\gNkLDBe.exe
  C:\Windows\System\gNkLDBe.exe
  2⤵
  PID:6932
- C:\Windows\System\kPIwfxv.exe
  C:\Windows\System\kPIwfxv.exe
  2⤵
  PID:6956
- C:\Windows\System\ZdExLzg.exe
  C:\Windows\System\ZdExLzg.exe
  2⤵
  PID:6972
- C:\Windows\System\yVNZNks.exe
  C:\Windows\System\yVNZNks.exe
  2⤵
  PID:6992
- C:\Windows\System\gWTMMJp.exe
  C:\Windows\System\gWTMMJp.exe
  2⤵
  PID:7008
- C:\Windows\System\awqzVaf.exe
  C:\Windows\System\awqzVaf.exe
  2⤵
  PID:7024
- C:\Windows\System\BJrWHyh.exe
  C:\Windows\System\BJrWHyh.exe
  2⤵
  PID:7040
- C:\Windows\System\oSlZRaP.exe
  C:\Windows\System\oSlZRaP.exe
  2⤵
  PID:7068
- C:\Windows\System\KqQFeaY.exe
  C:\Windows\System\KqQFeaY.exe
  2⤵
  PID:7112
- C:\Windows\System\WVbIGzp.exe
  C:\Windows\System\WVbIGzp.exe
  2⤵
  PID:7128
- C:\Windows\System\njURkZo.exe
  C:\Windows\System\njURkZo.exe
  2⤵
  PID:7152
- C:\Windows\System\hFbTGLZ.exe
  C:\Windows\System\hFbTGLZ.exe
  2⤵
  PID:5900
- C:\Windows\System\eYYvUBm.exe
  C:\Windows\System\eYYvUBm.exe
  2⤵
  PID:5984
- C:\Windows\System\lVYjMoy.exe
  C:\Windows\System\lVYjMoy.exe
  2⤵
  PID:6092
- C:\Windows\System\EfJmgvo.exe
  C:\Windows\System\EfJmgvo.exe
  2⤵
  PID:1972
- C:\Windows\System\qrgussD.exe
  C:\Windows\System\qrgussD.exe
  2⤵
  PID:3252
- C:\Windows\System\vLtQRuX.exe
  C:\Windows\System\vLtQRuX.exe
  2⤵
  PID:3848
- C:\Windows\System\RsPDDGf.exe
  C:\Windows\System\RsPDDGf.exe
  2⤵
  PID:1040
- C:\Windows\System\ratEYQA.exe
  C:\Windows\System\ratEYQA.exe
  2⤵
  PID:5132
- C:\Windows\System\xdrfIle.exe
  C:\Windows\System\xdrfIle.exe
  2⤵
  PID:5596
- C:\Windows\System\yILZvyG.exe
  C:\Windows\System\yILZvyG.exe
  2⤵
  PID:5492
- C:\Windows\System\fpqyxbI.exe
  C:\Windows\System\fpqyxbI.exe
  2⤵
  PID:5376
- C:\Windows\System\GsaIAXp.exe
  C:\Windows\System\GsaIAXp.exe
  2⤵
  PID:5284
- C:\Windows\System\CanpUKO.exe
  C:\Windows\System\CanpUKO.exe
  2⤵
  PID:5204
- C:\Windows\System\hEiApqO.exe
  C:\Windows\System\hEiApqO.exe
  2⤵
  PID:1900
- C:\Windows\System\xZrjdTh.exe
  C:\Windows\System\xZrjdTh.exe
  2⤵
  PID:6148
- C:\Windows\System\BNHIoLf.exe
  C:\Windows\System\BNHIoLf.exe
  2⤵
  PID:6192
- C:\Windows\System\gdBLRcU.exe
  C:\Windows\System\gdBLRcU.exe
  2⤵
  PID:6232
- C:\Windows\System\utVKtPT.exe
  C:\Windows\System\utVKtPT.exe
  2⤵
  PID:6272
- C:\Windows\System\GwlFqMN.exe
  C:\Windows\System\GwlFqMN.exe
  2⤵
  PID:6344
- C:\Windows\System\NVrhxtF.exe
  C:\Windows\System\NVrhxtF.exe
  2⤵
  PID:6388
- C:\Windows\System\UkEWBss.exe
  C:\Windows\System\UkEWBss.exe
  2⤵
  PID:3196
- C:\Windows\System\tpwWXDs.exe
  C:\Windows\System\tpwWXDs.exe
  2⤵
  PID:1624
- C:\Windows\System\RVqauvw.exe
  C:\Windows\System\RVqauvw.exe
  2⤵
  PID:6556
- C:\Windows\System\zReELgb.exe
  C:\Windows\System\zReELgb.exe
  2⤵
  PID:6632
- C:\Windows\System\GhdaRvz.exe
  C:\Windows\System\GhdaRvz.exe
  2⤵
  PID:6684
- C:\Windows\System\cGJbXbl.exe
  C:\Windows\System\cGJbXbl.exe
  2⤵
  PID:6724
- C:\Windows\System\MrLkWmU.exe
  C:\Windows\System\MrLkWmU.exe
  2⤵
  PID:2684
- C:\Windows\System\QfpXVqt.exe
  C:\Windows\System\QfpXVqt.exe
  2⤵
  PID:5464
- C:\Windows\System\UzVeojr.exe
  C:\Windows\System\UzVeojr.exe
  2⤵
  PID:5824
- C:\Windows\System\ISuKSRV.exe
  C:\Windows\System\ISuKSRV.exe
  2⤵
  PID:4252
- C:\Windows\System\hUsMKUz.exe
  C:\Windows\System\hUsMKUz.exe
  2⤵
  PID:364
- C:\Windows\System\vuFLyKf.exe
  C:\Windows\System\vuFLyKf.exe
  2⤵
  PID:1632
- C:\Windows\System\FwKfoAl.exe
  C:\Windows\System\FwKfoAl.exe
  2⤵
  PID:4000
- C:\Windows\System\YfYFyYx.exe
  C:\Windows\System\YfYFyYx.exe
  2⤵
  PID:3744
- C:\Windows\System\SfZiHgZ.exe
  C:\Windows\System\SfZiHgZ.exe
  2⤵
  PID:904
- C:\Windows\System\GUnsYtu.exe
  C:\Windows\System\GUnsYtu.exe
  2⤵
  PID:2404
- C:\Windows\System\DzTQYpq.exe
  C:\Windows\System\DzTQYpq.exe
  2⤵
  PID:4884
- C:\Windows\System\JmjeImE.exe
  C:\Windows\System\JmjeImE.exe
  2⤵
  PID:396
- C:\Windows\System\HctJTTJ.exe
  C:\Windows\System\HctJTTJ.exe
  2⤵
  PID:1912
- C:\Windows\System\mUFbxmu.exe
  C:\Windows\System\mUFbxmu.exe
  2⤵
  PID:4460
- C:\Windows\System\DrMchpW.exe
  C:\Windows\System\DrMchpW.exe
  2⤵
  PID:4644
- C:\Windows\System\abKBVwX.exe
  C:\Windows\System\abKBVwX.exe
  2⤵
  PID:6908
- C:\Windows\System\UTeWkgC.exe
  C:\Windows\System\UTeWkgC.exe
  2⤵
  PID:6984
- C:\Windows\System\WVtyekR.exe
  C:\Windows\System\WVtyekR.exe
  2⤵
  PID:6928
- C:\Windows\System\SgvcyrX.exe
  C:\Windows\System\SgvcyrX.exe
  2⤵
  PID:7036
- C:\Windows\System\YaPtZNn.exe
  C:\Windows\System\YaPtZNn.exe
  2⤵
  PID:7136
- C:\Windows\System\GtSvnnX.exe
  C:\Windows\System\GtSvnnX.exe
  2⤵
  PID:5948
- C:\Windows\System\bxOAezF.exe
  C:\Windows\System\bxOAezF.exe
  2⤵
  PID:5952
- C:\Windows\System\TlmXIgu.exe
  C:\Windows\System\TlmXIgu.exe
  2⤵
  PID:7100
- C:\Windows\System\cZHuGVL.exe
  C:\Windows\System\cZHuGVL.exe
  2⤵
  PID:3320
- C:\Windows\System\mGahryg.exe
  C:\Windows\System\mGahryg.exe
  2⤵
  PID:3752
- C:\Windows\System\GmXZnhW.exe
  C:\Windows\System\GmXZnhW.exe
  2⤵
  PID:6260
- C:\Windows\System\XZlCKQa.exe
  C:\Windows\System\XZlCKQa.exe
  2⤵
  PID:4300
- C:\Windows\System\CXafFMb.exe
  C:\Windows\System\CXafFMb.exe
  2⤵
  PID:6732
- C:\Windows\System\eOneBzb.exe
  C:\Windows\System\eOneBzb.exe
  2⤵
  PID:5468
- C:\Windows\System\kPYnlLd.exe
  C:\Windows\System\kPYnlLd.exe
  2⤵
  PID:2112
- C:\Windows\System\mqgVYAr.exe
  C:\Windows\System\mqgVYAr.exe
  2⤵
  PID:6212
- C:\Windows\System\VraPQNq.exe
  C:\Windows\System\VraPQNq.exe
  2⤵
  PID:6680
- C:\Windows\System\benfabE.exe
  C:\Windows\System\benfabE.exe
  2⤵
  PID:384
- C:\Windows\System\ZEEjshr.exe
  C:\Windows\System\ZEEjshr.exe
  2⤵
  PID:6404
- C:\Windows\System\NsnzqQn.exe
  C:\Windows\System\NsnzqQn.exe
  2⤵
  PID:6500
- C:\Windows\System\VSldKpJ.exe
  C:\Windows\System\VSldKpJ.exe
  2⤵
  PID:4500
- C:\Windows\System\gAPekqL.exe
  C:\Windows\System\gAPekqL.exe
  2⤵
  PID:392
- C:\Windows\System\WrvAxed.exe
  C:\Windows\System\WrvAxed.exe
  2⤵
  PID:5032
- C:\Windows\System\vNZrWcD.exe
  C:\Windows\System\vNZrWcD.exe
  2⤵
  PID:7180
- C:\Windows\System\QuoDuzH.exe
  C:\Windows\System\QuoDuzH.exe
  2⤵
  PID:7200
- C:\Windows\System\YzlxVLJ.exe
  C:\Windows\System\YzlxVLJ.exe
  2⤵
  PID:7220
- C:\Windows\System\rZbzwnf.exe
  C:\Windows\System\rZbzwnf.exe
  2⤵
  PID:7260
- C:\Windows\System\leswLWm.exe
  C:\Windows\System\leswLWm.exe
  2⤵
  PID:7292
- C:\Windows\System\wqEmfWw.exe
  C:\Windows\System\wqEmfWw.exe
  2⤵
  PID:7308
- C:\Windows\System\XoATAkr.exe
  C:\Windows\System\XoATAkr.exe
  2⤵
  PID:7336
- C:\Windows\System\tlDWYfh.exe
  C:\Windows\System\tlDWYfh.exe
  2⤵
  PID:7364
- C:\Windows\System\LZaDTEX.exe
  C:\Windows\System\LZaDTEX.exe
  2⤵
  PID:7384
- C:\Windows\System\FVANQqq.exe
  C:\Windows\System\FVANQqq.exe
  2⤵
  PID:7404
- C:\Windows\System\ZTJaoDh.exe
  C:\Windows\System\ZTJaoDh.exe
  2⤵
  PID:7428
- C:\Windows\System\NzZijqC.exe
  C:\Windows\System\NzZijqC.exe
  2⤵
  PID:7452
- C:\Windows\System\hUZJsKr.exe
  C:\Windows\System\hUZJsKr.exe
  2⤵
  PID:7476
- C:\Windows\System\wwnOdZZ.exe
  C:\Windows\System\wwnOdZZ.exe
  2⤵
  PID:7504
- C:\Windows\System\aHsiUer.exe
  C:\Windows\System\aHsiUer.exe
  2⤵
  PID:7524
- C:\Windows\System\NtdMhDG.exe
  C:\Windows\System\NtdMhDG.exe
  2⤵
  PID:7548
- C:\Windows\System\xmwkGyq.exe
  C:\Windows\System\xmwkGyq.exe
  2⤵
  PID:7568
- C:\Windows\System\TuISrJE.exe
  C:\Windows\System\TuISrJE.exe
  2⤵
  PID:7588
- C:\Windows\System\wUkXgKH.exe
  C:\Windows\System\wUkXgKH.exe
  2⤵
  PID:7612
- C:\Windows\System\HczEMOR.exe
  C:\Windows\System\HczEMOR.exe
  2⤵
  PID:7632
- C:\Windows\System\qIcmIvR.exe
  C:\Windows\System\qIcmIvR.exe
  2⤵
  PID:7656
- C:\Windows\System\bApscna.exe
  C:\Windows\System\bApscna.exe
  2⤵
  PID:7684
- C:\Windows\System\VIDRYtO.exe
  C:\Windows\System\VIDRYtO.exe
  2⤵
  PID:7712
- C:\Windows\System\XJrbfrh.exe
  C:\Windows\System\XJrbfrh.exe
  2⤵
  PID:7736
- C:\Windows\System\PpqYyDJ.exe
  C:\Windows\System\PpqYyDJ.exe
  2⤵
  PID:7760
- C:\Windows\System\UBpBvRD.exe
  C:\Windows\System\UBpBvRD.exe
  2⤵
  PID:7784
- C:\Windows\System\jtuvpIh.exe
  C:\Windows\System\jtuvpIh.exe
  2⤵
  PID:7804
- C:\Windows\System\DMrQDqU.exe
  C:\Windows\System\DMrQDqU.exe
  2⤵
  PID:7832
- C:\Windows\System\KzQZiBQ.exe
  C:\Windows\System\KzQZiBQ.exe
  2⤵
  PID:7848
- C:\Windows\System\bEEzMXE.exe
  C:\Windows\System\bEEzMXE.exe
  2⤵
  PID:7872
- C:\Windows\System\zEcZEpC.exe
  C:\Windows\System\zEcZEpC.exe
  2⤵
  PID:7904
- C:\Windows\System\FOXlDYg.exe
  C:\Windows\System\FOXlDYg.exe
  2⤵
  PID:7932
- C:\Windows\System\ueEWVQU.exe
  C:\Windows\System\ueEWVQU.exe
  2⤵
  PID:7952
- C:\Windows\System\cshOiyN.exe
  C:\Windows\System\cshOiyN.exe
  2⤵
  PID:7980
- C:\Windows\System\RPrBamx.exe
  C:\Windows\System\RPrBamx.exe
  2⤵
  PID:8000
- C:\Windows\System\zaYamIE.exe
  C:\Windows\System\zaYamIE.exe
  2⤵
  PID:8024
- C:\Windows\System\VxCkGAk.exe
  C:\Windows\System\VxCkGAk.exe
  2⤵
  PID:8044
- C:\Windows\System\huRXOTd.exe
  C:\Windows\System\huRXOTd.exe
  2⤵
  PID:8064
- C:\Windows\System\SjsePeQ.exe
  C:\Windows\System\SjsePeQ.exe
  2⤵
  PID:8084
- C:\Windows\System\caLpjAh.exe
  C:\Windows\System\caLpjAh.exe
  2⤵
  PID:8108
- C:\Windows\System\iPNKnIT.exe
  C:\Windows\System\iPNKnIT.exe
  2⤵
  PID:8132
- C:\Windows\System\hqLlTbA.exe
  C:\Windows\System\hqLlTbA.exe
  2⤵
  PID:8160
- C:\Windows\System\whlhOCQ.exe
  C:\Windows\System\whlhOCQ.exe
  2⤵
  PID:8188
- C:\Windows\System\omcEGlc.exe
  C:\Windows\System\omcEGlc.exe
  2⤵
  PID:5920
- C:\Windows\System\KJWogej.exe
  C:\Windows\System\KJWogej.exe
  2⤵
  PID:6836
- C:\Windows\System\MsVrTYp.exe
  C:\Windows\System\MsVrTYp.exe
  2⤵
  PID:5656
- C:\Windows\System\nELJzBl.exe
  C:\Windows\System\nELJzBl.exe
  2⤵
  PID:2968
- C:\Windows\System\pBAvThQ.exe
  C:\Windows\System\pBAvThQ.exe
  2⤵
  PID:6704
- C:\Windows\System\vzFbSEW.exe
  C:\Windows\System\vzFbSEW.exe
  2⤵
  PID:6648
- C:\Windows\System\CsNAenO.exe
  C:\Windows\System\CsNAenO.exe
  2⤵
  PID:1368
- C:\Windows\System\pkyLXPZ.exe
  C:\Windows\System\pkyLXPZ.exe
  2⤵
  PID:7016
- C:\Windows\System\ioCJgxR.exe
  C:\Windows\System\ioCJgxR.exe
  2⤵
  PID:7228
- C:\Windows\System\QxhxZVY.exe
  C:\Windows\System\QxhxZVY.exe
  2⤵
  PID:7092
- C:\Windows\System\mGKstlU.exe
  C:\Windows\System\mGKstlU.exe
  2⤵
  PID:7316
- C:\Windows\System\srmHBdo.exe
  C:\Windows\System\srmHBdo.exe
  2⤵
  PID:7376
- C:\Windows\System\oRTqypd.exe
  C:\Windows\System\oRTqypd.exe
  2⤵
  PID:7448
- C:\Windows\System\FGHZEhQ.exe
  C:\Windows\System\FGHZEhQ.exe
  2⤵
  PID:7484
- C:\Windows\System\EEGWgSA.exe
  C:\Windows\System\EEGWgSA.exe
  2⤵
  PID:7500
- C:\Windows\System\thhwhWQ.exe
  C:\Windows\System\thhwhWQ.exe
  2⤵
  PID:7556
- C:\Windows\System\zOeInLj.exe
  C:\Windows\System\zOeInLj.exe
  2⤵
  PID:7604
- C:\Windows\System\LaQPyaH.exe
  C:\Windows\System\LaQPyaH.exe
  2⤵
  PID:7748
- C:\Windows\System\oLMLuee.exe
  C:\Windows\System\oLMLuee.exe
  2⤵
  PID:3004
- C:\Windows\System\eVTHDqi.exe
  C:\Windows\System\eVTHDqi.exe
  2⤵
  PID:7960
- C:\Windows\System\bgJJWNb.exe
  C:\Windows\System\bgJJWNb.exe
  2⤵
  PID:7992
- C:\Windows\System\oZTCQvQ.exe
  C:\Windows\System\oZTCQvQ.exe
  2⤵
  PID:8056
- C:\Windows\System\rqECUaX.exe
  C:\Windows\System\rqECUaX.exe
  2⤵
  PID:7272
- C:\Windows\System\rGIRRVf.exe
  C:\Windows\System\rGIRRVf.exe
  2⤵
  PID:7328
- C:\Windows\System\BuJvROV.exe
  C:\Windows\System\BuJvROV.exe
  2⤵
  PID:7752
- C:\Windows\System\qxivtaE.exe
  C:\Windows\System\qxivtaE.exe
  2⤵
  PID:7436
- C:\Windows\System\HuFCdhw.exe
  C:\Windows\System\HuFCdhw.exe
  2⤵
  PID:7780
- C:\Windows\System\ImtyyDJ.exe
  C:\Windows\System\ImtyyDJ.exe
  2⤵
  PID:8196
- C:\Windows\System\YOnFjol.exe
  C:\Windows\System\YOnFjol.exe
  2⤵
  PID:8216
- C:\Windows\System\EsWaolO.exe
  C:\Windows\System\EsWaolO.exe
  2⤵
  PID:8248
- C:\Windows\System\jhdcyDh.exe
  C:\Windows\System\jhdcyDh.exe
  2⤵
  PID:8268
- C:\Windows\System\rlismqP.exe
  C:\Windows\System\rlismqP.exe
  2⤵
  PID:8292
- C:\Windows\System\OlojfFV.exe
  C:\Windows\System\OlojfFV.exe
  2⤵
  PID:8316
- C:\Windows\System\BWhiEvx.exe
  C:\Windows\System\BWhiEvx.exe
  2⤵
  PID:8332
- C:\Windows\System\lQBNsmd.exe
  C:\Windows\System\lQBNsmd.exe
  2⤵
  PID:8356
- C:\Windows\System\CQBkZaW.exe
  C:\Windows\System\CQBkZaW.exe
  2⤵
  PID:8384
- C:\Windows\System\WVKywLI.exe
  C:\Windows\System\WVKywLI.exe
  2⤵
  PID:8408
- C:\Windows\System\IAbAEsi.exe
  C:\Windows\System\IAbAEsi.exe
  2⤵
  PID:8428
- C:\Windows\System\nVMZZjC.exe
  C:\Windows\System\nVMZZjC.exe
  2⤵
  PID:8448
- C:\Windows\System\nFUmeKi.exe
  C:\Windows\System\nFUmeKi.exe
  2⤵
  PID:8480
- C:\Windows\System\JCvRznn.exe
  C:\Windows\System\JCvRznn.exe
  2⤵
  PID:8500
- C:\Windows\System\xQbMXhC.exe
  C:\Windows\System\xQbMXhC.exe
  2⤵
  PID:8528
- C:\Windows\System\xjtYAJn.exe
  C:\Windows\System\xjtYAJn.exe
  2⤵
  PID:8548
- C:\Windows\System\kBkkyPr.exe
  C:\Windows\System\kBkkyPr.exe
  2⤵
  PID:8572
- C:\Windows\System\EVOkCFg.exe
  C:\Windows\System\EVOkCFg.exe
  2⤵
  PID:8592
- C:\Windows\System\khbNJsM.exe
  C:\Windows\System\khbNJsM.exe
  2⤵
  PID:8616
- C:\Windows\System\zHVsUAH.exe
  C:\Windows\System\zHVsUAH.exe
  2⤵
  PID:8636
- C:\Windows\System\QwITctW.exe
  C:\Windows\System\QwITctW.exe
  2⤵
  PID:8664
- C:\Windows\System\lvlgusM.exe
  C:\Windows\System\lvlgusM.exe
  2⤵
  PID:8684
- C:\Windows\System\psGNcie.exe
  C:\Windows\System\psGNcie.exe
  2⤵
  PID:8704
- C:\Windows\System\DnYqUXj.exe
  C:\Windows\System\DnYqUXj.exe
  2⤵
  PID:8728
- C:\Windows\System\sasPUYj.exe
  C:\Windows\System\sasPUYj.exe
  2⤵
  PID:8756
- C:\Windows\System\QUEBTVB.exe
  C:\Windows\System\QUEBTVB.exe
  2⤵
  PID:8784
- C:\Windows\System\zeqemkW.exe
  C:\Windows\System\zeqemkW.exe
  2⤵
  PID:8812
- C:\Windows\System\IkjHTVA.exe
  C:\Windows\System\IkjHTVA.exe
  2⤵
  PID:8832
- C:\Windows\System\FkQefDu.exe
  C:\Windows\System\FkQefDu.exe
  2⤵
  PID:8856
- C:\Windows\System\mCUoBIB.exe
  C:\Windows\System\mCUoBIB.exe
  2⤵
  PID:8876
- C:\Windows\System\sNvvzhz.exe
  C:\Windows\System\sNvvzhz.exe
  2⤵
  PID:8896
- C:\Windows\System\OWxqHbp.exe
  C:\Windows\System\OWxqHbp.exe
  2⤵
  PID:8928
- C:\Windows\System\dxjnvBd.exe
  C:\Windows\System\dxjnvBd.exe
  2⤵
  PID:8952
- C:\Windows\System\AgwBPZf.exe
  C:\Windows\System\AgwBPZf.exe
  2⤵
  PID:8988
- C:\Windows\System\ENDfahp.exe
  C:\Windows\System\ENDfahp.exe
  2⤵
  PID:9008
- C:\Windows\System\rzYYhiI.exe
  C:\Windows\System\rzYYhiI.exe
  2⤵
  PID:9040
- C:\Windows\System\xHJGcWu.exe
  C:\Windows\System\xHJGcWu.exe
  2⤵
  PID:9060
- C:\Windows\System\dBrlKac.exe
  C:\Windows\System\dBrlKac.exe
  2⤵
  PID:9076
- C:\Windows\System\GVQeBzS.exe
  C:\Windows\System\GVQeBzS.exe
  2⤵
  PID:9096
- C:\Windows\System\mzUrvdK.exe
  C:\Windows\System\mzUrvdK.exe
  2⤵
  PID:9116
- C:\Windows\System\nWIvIvR.exe
  C:\Windows\System\nWIvIvR.exe
  2⤵
  PID:9136
- C:\Windows\System\ktffOVK.exe
  C:\Windows\System\ktffOVK.exe
  2⤵
  PID:9156
- C:\Windows\System\uzUjNRD.exe
  C:\Windows\System\uzUjNRD.exe
  2⤵
  PID:9184
- C:\Windows\System\oLKNIxP.exe
  C:\Windows\System\oLKNIxP.exe
  2⤵
  PID:9208
- C:\Windows\System\cbMvSHp.exe
  C:\Windows\System\cbMvSHp.exe
  2⤵
  PID:7088
- C:\Windows\System\lVgNNiW.exe
  C:\Windows\System\lVgNNiW.exe
  2⤵
  PID:7912
- C:\Windows\System\JSHmnkh.exe
  C:\Windows\System\JSHmnkh.exe
  2⤵
  PID:6844
- C:\Windows\System\LZRDpsK.exe
  C:\Windows\System\LZRDpsK.exe
  2⤵
  PID:8032
- C:\Windows\System\UoRAGwz.exe
  C:\Windows\System\UoRAGwz.exe
  2⤵
  PID:6068
- C:\Windows\System\pLrwenu.exe
  C:\Windows\System\pLrwenu.exe
  2⤵
  PID:7064
- C:\Windows\System\sNuJZOf.exe
  C:\Windows\System\sNuJZOf.exe
  2⤵
  PID:7596
- C:\Windows\System\fSyMuPt.exe
  C:\Windows\System\fSyMuPt.exe
  2⤵
  PID:7704
- C:\Windows\System\IQCbvVd.exe
  C:\Windows\System\IQCbvVd.exe
  2⤵
  PID:2676
- C:\Windows\System\RbgkyTd.exe
  C:\Windows\System\RbgkyTd.exe
  2⤵
  PID:7868
- C:\Windows\System\vdagVOT.exe
  C:\Windows\System\vdagVOT.exe
  2⤵
  PID:8236
- C:\Windows\System\IMZLQiQ.exe
  C:\Windows\System\IMZLQiQ.exe
  2⤵
  PID:3248
- C:\Windows\System\yhLsziY.exe
  C:\Windows\System\yhLsziY.exe
  2⤵
  PID:8340
- C:\Windows\System\hGpQKIA.exe
  C:\Windows\System\hGpQKIA.exe
  2⤵
  PID:8008
- C:\Windows\System\weFxWhL.exe
  C:\Windows\System\weFxWhL.exe
  2⤵
  PID:8400
- C:\Windows\System\wdYNElx.exe
  C:\Windows\System\wdYNElx.exe
  2⤵
  PID:7396
- C:\Windows\System\UOOvwVK.exe
  C:\Windows\System\UOOvwVK.exe
  2⤵
  PID:8540
- C:\Windows\System\ixIWrbk.exe
  C:\Windows\System\ixIWrbk.exe
  2⤵
  PID:7544
- C:\Windows\System\YBrkypv.exe
  C:\Windows\System\YBrkypv.exe
  2⤵
  PID:8624
- C:\Windows\System\uyEHFWh.exe
  C:\Windows\System\uyEHFWh.exe
  2⤵
  PID:8720
- C:\Windows\System\djOJCzR.exe
  C:\Windows\System\djOJCzR.exe
  2⤵
  PID:8776
- C:\Windows\System\tHlxOAG.exe
  C:\Windows\System\tHlxOAG.exe
  2⤵
  PID:8820
- C:\Windows\System\YxBaNpb.exe
  C:\Windows\System\YxBaNpb.exe
  2⤵
  PID:7772
- C:\Windows\System\MMejNMh.exe
  C:\Windows\System\MMejNMh.exe
  2⤵
  PID:8916
- C:\Windows\System\jcNnIEZ.exe
  C:\Windows\System\jcNnIEZ.exe
  2⤵
  PID:6828
- C:\Windows\System\XFjZolj.exe
  C:\Windows\System\XFjZolj.exe
  2⤵
  PID:3652
- C:\Windows\System\xJrJHcf.exe
  C:\Windows\System\xJrJHcf.exe
  2⤵
  PID:7304
- C:\Windows\System\byOiWXw.exe
  C:\Windows\System\byOiWXw.exe
  2⤵
  PID:9228
- C:\Windows\System\NPHmOPP.exe
  C:\Windows\System\NPHmOPP.exe
  2⤵
  PID:9252
- C:\Windows\System\sOclTlC.exe
  C:\Windows\System\sOclTlC.exe
  2⤵
  PID:9268
- C:\Windows\System\HOOEozk.exe
  C:\Windows\System\HOOEozk.exe
  2⤵
  PID:9288
- C:\Windows\System\KWAUluK.exe
  C:\Windows\System\KWAUluK.exe
  2⤵
  PID:9304
- C:\Windows\System\PXzXjpQ.exe
  C:\Windows\System\PXzXjpQ.exe
  2⤵
  PID:9332
- C:\Windows\System\iuQHfsP.exe
  C:\Windows\System\iuQHfsP.exe
  2⤵
  PID:9348
- C:\Windows\System\BdMDUWg.exe
  C:\Windows\System\BdMDUWg.exe
  2⤵
  PID:9372
- C:\Windows\System\ZayOTSB.exe
  C:\Windows\System\ZayOTSB.exe
  2⤵
  PID:9400
- C:\Windows\System\CAlfpmd.exe
  C:\Windows\System\CAlfpmd.exe
  2⤵
  PID:9420
- C:\Windows\System\BaACAiu.exe
  C:\Windows\System\BaACAiu.exe
  2⤵
  PID:9452
- C:\Windows\System\gjtDRqC.exe
  C:\Windows\System\gjtDRqC.exe
  2⤵
  PID:9472
- C:\Windows\System\dnBCKrt.exe
  C:\Windows\System\dnBCKrt.exe
  2⤵
  PID:9500
- C:\Windows\System\eMQtapb.exe
  C:\Windows\System\eMQtapb.exe
  2⤵
  PID:9524
- C:\Windows\System\TmHoztj.exe
  C:\Windows\System\TmHoztj.exe
  2⤵
  PID:9552
- C:\Windows\System\NJKXJxc.exe
  C:\Windows\System\NJKXJxc.exe
  2⤵
  PID:9572
- C:\Windows\System\gWmWAqz.exe
  C:\Windows\System\gWmWAqz.exe
  2⤵
  PID:9596
- C:\Windows\System\gkFQpWi.exe
  C:\Windows\System\gkFQpWi.exe
  2⤵
  PID:9616
- C:\Windows\System\kyTbPlL.exe
  C:\Windows\System\kyTbPlL.exe
  2⤵
  PID:9640
- C:\Windows\System\KlYBNKe.exe
  C:\Windows\System\KlYBNKe.exe
  2⤵
  PID:9664
- C:\Windows\System\TuFwOlJ.exe
  C:\Windows\System\TuFwOlJ.exe
  2⤵
  PID:9688
- C:\Windows\System\rCCUwTz.exe
  C:\Windows\System\rCCUwTz.exe
  2⤵
  PID:9716
- C:\Windows\System\pFctKJv.exe
  C:\Windows\System\pFctKJv.exe
  2⤵
  PID:9736
- C:\Windows\System\lpWmgiZ.exe
  C:\Windows\System\lpWmgiZ.exe
  2⤵
  PID:9760
- C:\Windows\System\EDryLKS.exe
  C:\Windows\System\EDryLKS.exe
  2⤵
  PID:9792
- C:\Windows\System\fZCftiA.exe
  C:\Windows\System\fZCftiA.exe
  2⤵
  PID:9808
- C:\Windows\System\iIjCLcu.exe
  C:\Windows\System\iIjCLcu.exe
  2⤵
  PID:9828
- C:\Windows\System\ipURqaZ.exe
  C:\Windows\System\ipURqaZ.exe
  2⤵
  PID:9852
- C:\Windows\System\wrRLlRN.exe
  C:\Windows\System\wrRLlRN.exe
  2⤵
  PID:9872
- C:\Windows\System\HeTsxtI.exe
  C:\Windows\System\HeTsxtI.exe
  2⤵
  PID:9892
- C:\Windows\System\Rreqwce.exe
  C:\Windows\System\Rreqwce.exe
  2⤵
  PID:9916
- C:\Windows\System\DTLCejq.exe
  C:\Windows\System\DTLCejq.exe
  2⤵
  PID:9944
- C:\Windows\System\ITyBjUn.exe
  C:\Windows\System\ITyBjUn.exe
  2⤵
  PID:9964
- C:\Windows\System\ybpJOiY.exe
  C:\Windows\System\ybpJOiY.exe
  2⤵
  PID:9984
- C:\Windows\System\FeNBglg.exe
  C:\Windows\System\FeNBglg.exe
  2⤵
  PID:10012
- C:\Windows\System\YynXZmK.exe
  C:\Windows\System\YynXZmK.exe
  2⤵
  PID:10048
- C:\Windows\System\gHYGqYP.exe
  C:\Windows\System\gHYGqYP.exe
  2⤵
  PID:10072
- C:\Windows\System\IfQhVdK.exe
  C:\Windows\System\IfQhVdK.exe
  2⤵
  PID:10100
- C:\Windows\System\MACIwYB.exe
  C:\Windows\System\MACIwYB.exe
  2⤵
  PID:10124
- C:\Windows\System\cDeEMiT.exe
  C:\Windows\System\cDeEMiT.exe
  2⤵
  PID:10144
- C:\Windows\System\WNJgnfU.exe
  C:\Windows\System\WNJgnfU.exe
  2⤵
  PID:10168
- C:\Windows\System\IOIEsnE.exe
  C:\Windows\System\IOIEsnE.exe
  2⤵
  PID:10196
- C:\Windows\System\cDFTOjm.exe
  C:\Windows\System\cDFTOjm.exe
  2⤵
  PID:10216
- C:\Windows\System\huqgMsc.exe
  C:\Windows\System\huqgMsc.exe
  2⤵
  PID:9000
- C:\Windows\System\YcnmpJw.exe
  C:\Windows\System\YcnmpJw.exe
  2⤵
  PID:2728
- C:\Windows\System\NcRMZxe.exe
  C:\Windows\System\NcRMZxe.exe
  2⤵
  PID:9132
- C:\Windows\System\uDrszfB.exe
  C:\Windows\System\uDrszfB.exe
  2⤵
  PID:7948
- C:\Windows\System\cFzHbUK.exe
  C:\Windows\System\cFzHbUK.exe
  2⤵
  PID:9196
- C:\Windows\System\GOkgdIV.exe
  C:\Windows\System\GOkgdIV.exe
  2⤵
  PID:7564
- C:\Windows\System\ujshxAs.exe
  C:\Windows\System\ujshxAs.exe
  2⤵
  PID:2264
- C:\Windows\System\vgvlFlO.exe
  C:\Windows\System\vgvlFlO.exe
  2⤵
  PID:6924
- C:\Windows\System\nDHIZFs.exe
  C:\Windows\System\nDHIZFs.exe
  2⤵
  PID:6548
- C:\Windows\System\EKwwFGJ.exe
  C:\Windows\System\EKwwFGJ.exe
  2⤵
  PID:9840
- C:\Windows\System\ueRKKcU.exe
  C:\Windows\System\ueRKKcU.exe
  2⤵
  PID:10056
- C:\Windows\System\WPmlyMi.exe
  C:\Windows\System\WPmlyMi.exe
  2⤵
  PID:10084
- C:\Windows\System\nBVKKrW.exe
  C:\Windows\System\nBVKKrW.exe
  2⤵
  PID:2504
- C:\Windows\System\yLpClKa.exe
  C:\Windows\System\yLpClKa.exe
  2⤵
  PID:9768
- C:\Windows\System\UqTjGsm.exe
  C:\Windows\System\UqTjGsm.exe
  2⤵
  PID:7256
- C:\Windows\System\DYdgHbP.exe
  C:\Windows\System\DYdgHbP.exe
  2⤵
  PID:3812
- C:\Windows\System\DZccMLL.exe
  C:\Windows\System\DZccMLL.exe
  2⤵
  PID:9532
- C:\Windows\System\hZQiByA.exe
  C:\Windows\System\hZQiByA.exe
  2⤵
  PID:8264
- C:\Windows\System\DTnAgxf.exe
  C:\Windows\System\DTnAgxf.exe
  2⤵
  PID:10252
- C:\Windows\System\XAeZqBa.exe
  C:\Windows\System\XAeZqBa.exe
  2⤵
  PID:10272
- C:\Windows\System\DVjdZjd.exe
  C:\Windows\System\DVjdZjd.exe
  2⤵
  PID:10296
- C:\Windows\System\xkcwHGE.exe
  C:\Windows\System\xkcwHGE.exe
  2⤵
  PID:10316
- C:\Windows\System\AlQUNUL.exe
  C:\Windows\System\AlQUNUL.exe
  2⤵
  PID:10344
- C:\Windows\System\XLtKdOJ.exe
  C:\Windows\System\XLtKdOJ.exe
  2⤵
  PID:10376
- C:\Windows\System\ZOuMIjx.exe
  C:\Windows\System\ZOuMIjx.exe
  2⤵
  PID:10404
- C:\Windows\System\sKsGapV.exe
  C:\Windows\System\sKsGapV.exe
  2⤵
  PID:10432
- C:\Windows\System\kBAqPvb.exe
  C:\Windows\System\kBAqPvb.exe
  2⤵
  PID:10456
- C:\Windows\System\OsYURuR.exe
  C:\Windows\System\OsYURuR.exe
  2⤵
  PID:10476
- C:\Windows\System\yXLIpxu.exe
  C:\Windows\System\yXLIpxu.exe
  2⤵
  PID:10508
- C:\Windows\System\ieWZyeb.exe
  C:\Windows\System\ieWZyeb.exe
  2⤵
  PID:10524
- C:\Windows\System\PeulaCx.exe
  C:\Windows\System\PeulaCx.exe
  2⤵
  PID:10552
- C:\Windows\System\wAnSVxZ.exe
  C:\Windows\System\wAnSVxZ.exe
  2⤵
  PID:10576
- C:\Windows\System\bvCAWFG.exe
  C:\Windows\System\bvCAWFG.exe
  2⤵
  PID:10596
- C:\Windows\System\jVicOMd.exe
  C:\Windows\System\jVicOMd.exe
  2⤵
  PID:10616
- C:\Windows\System\VNqYPLI.exe
  C:\Windows\System\VNqYPLI.exe
  2⤵
  PID:10640
- C:\Windows\System\EuWkccI.exe
  C:\Windows\System\EuWkccI.exe
  2⤵
  PID:10656
- C:\Windows\System\SbLrtjW.exe
  C:\Windows\System\SbLrtjW.exe
  2⤵
  PID:10676
- C:\Windows\System\yWSMTsb.exe
  C:\Windows\System\yWSMTsb.exe
  2⤵
  PID:10696
- C:\Windows\System\jvJQjOj.exe
  C:\Windows\System\jvJQjOj.exe
  2⤵
  PID:10712
- C:\Windows\System\iQkSOHM.exe
  C:\Windows\System\iQkSOHM.exe
  2⤵
  PID:10728
- C:\Windows\System\NPmPRLk.exe
  C:\Windows\System\NPmPRLk.exe
  2⤵
  PID:10744
- C:\Windows\System\UzrcxSQ.exe
  C:\Windows\System\UzrcxSQ.exe
  2⤵
  PID:10760
- C:\Windows\System\toDQAFf.exe
  C:\Windows\System\toDQAFf.exe
  2⤵
  PID:10776
- C:\Windows\System\faRmEqI.exe
  C:\Windows\System\faRmEqI.exe
  2⤵
  PID:10792
- C:\Windows\System\qaHMLQk.exe
  C:\Windows\System\qaHMLQk.exe
  2⤵
  PID:10820
- C:\Windows\System\XYvYqjf.exe
  C:\Windows\System\XYvYqjf.exe
  2⤵
  PID:10840
- C:\Windows\System\QoVgUqR.exe
  C:\Windows\System\QoVgUqR.exe
  2⤵
  PID:10868
- C:\Windows\System\ETwqCOd.exe
  C:\Windows\System\ETwqCOd.exe
  2⤵
  PID:10896
- C:\Windows\System\HpetjQI.exe
  C:\Windows\System\HpetjQI.exe
  2⤵
  PID:10916
- C:\Windows\System\wtCBhal.exe
  C:\Windows\System\wtCBhal.exe
  2⤵
  PID:10940
- C:\Windows\System\zekAlTq.exe
  C:\Windows\System\zekAlTq.exe
  2⤵
  PID:10964
- C:\Windows\System\ZzNzqHr.exe
  C:\Windows\System\ZzNzqHr.exe
  2⤵
  PID:10988
- C:\Windows\System\uRAnpFO.exe
  C:\Windows\System\uRAnpFO.exe
  2⤵
  PID:11008
- C:\Windows\System\rvWQGjx.exe
  C:\Windows\System\rvWQGjx.exe
  2⤵
  PID:11032
- C:\Windows\System\wyTzdaY.exe
  C:\Windows\System\wyTzdaY.exe
  2⤵
  PID:11056
- C:\Windows\System\GoUxSPP.exe
  C:\Windows\System\GoUxSPP.exe
  2⤵
  PID:11080
- C:\Windows\System\FDebWwg.exe
  C:\Windows\System\FDebWwg.exe
  2⤵
  PID:11108
- C:\Windows\System\YvmSekM.exe
  C:\Windows\System\YvmSekM.exe
  2⤵
  PID:11132
- C:\Windows\System\OYWhmuX.exe
  C:\Windows\System\OYWhmuX.exe
  2⤵
  PID:11152
- C:\Windows\System\FOVXkzu.exe
  C:\Windows\System\FOVXkzu.exe
  2⤵
  PID:11176
- C:\Windows\System\ghAPUnF.exe
  C:\Windows\System\ghAPUnF.exe
  2⤵
  PID:11208
- C:\Windows\System\hKMOVIe.exe
  C:\Windows\System\hKMOVIe.exe
  2⤵
  PID:11228
- C:\Windows\System\CoPkfvU.exe
  C:\Windows\System\CoPkfvU.exe
  2⤵
  PID:11260
- C:\Windows\System\vHyjgBL.exe
  C:\Windows\System\vHyjgBL.exe
  2⤵
  PID:7944
- C:\Windows\System\BqeSfnL.exe
  C:\Windows\System\BqeSfnL.exe
  2⤵
  PID:9240
- C:\Windows\System\FkznRTF.exe
  C:\Windows\System\FkznRTF.exe
  2⤵
  PID:10068
- C:\Windows\System\ehuqOZf.exe
  C:\Windows\System\ehuqOZf.exe
  2⤵
  PID:9284
- C:\Windows\System\OxJEhoz.exe
  C:\Windows\System\OxJEhoz.exe
  2⤵
  PID:9496
- C:\Windows\System\NJqwdFT.exe
  C:\Windows\System\NJqwdFT.exe
  2⤵
  PID:10440
- C:\Windows\System\dkxyeNX.exe
  C:\Windows\System\dkxyeNX.exe
  2⤵
  PID:10540
- C:\Windows\System\dAUFTFi.exe
  C:\Windows\System\dAUFTFi.exe
  2⤵
  PID:9924
- C:\Windows\System\rOznEYb.exe
  C:\Windows\System\rOznEYb.exe
  2⤵
  PID:10672
- C:\Windows\System\tWZGGZz.exe
  C:\Windows\System\tWZGGZz.exe
  2⤵
  PID:10740
- C:\Windows\System\wDQGbaD.exe
  C:\Windows\System\wDQGbaD.exe
  2⤵
  PID:10836
- C:\Windows\System\BGLvoqj.exe
  C:\Windows\System\BGLvoqj.exe
  2⤵
  PID:10936
- C:\Windows\System\ScpAmBh.exe
  C:\Windows\System\ScpAmBh.exe
  2⤵
  PID:11280
- C:\Windows\System\PWpGBzY.exe
  C:\Windows\System\PWpGBzY.exe
  2⤵
  PID:11304
- C:\Windows\System\MBQbnBX.exe
  C:\Windows\System\MBQbnBX.exe
  2⤵
  PID:11324
- C:\Windows\System\msEVzJb.exe
  C:\Windows\System\msEVzJb.exe
  2⤵
  PID:11340
- C:\Windows\System\NSfsroD.exe
  C:\Windows\System\NSfsroD.exe
  2⤵
  PID:11364
- C:\Windows\System\lwwDctJ.exe
  C:\Windows\System\lwwDctJ.exe
  2⤵
  PID:11604
- C:\Windows\System\IIpReZs.exe
  C:\Windows\System\IIpReZs.exe
  2⤵
  PID:11628
- C:\Windows\System\lbyProJ.exe
  C:\Windows\System\lbyProJ.exe
  2⤵
  PID:11656
- C:\Windows\System\aOSmVmE.exe
  C:\Windows\System\aOSmVmE.exe
  2⤵
  PID:11676
- C:\Windows\System\mJGXyhv.exe
  C:\Windows\System\mJGXyhv.exe
  2⤵
  PID:11696
- C:\Windows\System\JmNwbnv.exe
  C:\Windows\System\JmNwbnv.exe
  2⤵
  PID:11720
- C:\Windows\System\yqBZtWI.exe
  C:\Windows\System\yqBZtWI.exe
  2⤵
  PID:11740
- C:\Windows\System\DlbdCdT.exe
  C:\Windows\System\DlbdCdT.exe
  2⤵
  PID:11764
- C:\Windows\System\yddLebw.exe
  C:\Windows\System\yddLebw.exe
  2⤵
  PID:11792
- C:\Windows\System\ZVEsJRJ.exe
  C:\Windows\System\ZVEsJRJ.exe
  2⤵
  PID:11816
- C:\Windows\System\iIruGTG.exe
  C:\Windows\System\iIruGTG.exe
  2⤵
  PID:11840
- C:\Windows\System\lmZELJZ.exe
  C:\Windows\System\lmZELJZ.exe
  2⤵
  PID:11868
- C:\Windows\System\FRgipXM.exe
  C:\Windows\System\FRgipXM.exe
  2⤵
  PID:11892
- C:\Windows\System\bHAODAd.exe
  C:\Windows\System\bHAODAd.exe
  2⤵
  PID:11916
- C:\Windows\System\PbvrQSc.exe
  C:\Windows\System\PbvrQSc.exe
  2⤵
  PID:11944
- C:\Windows\System\gyhPNzU.exe
  C:\Windows\System\gyhPNzU.exe
  2⤵
  PID:11980
- C:\Windows\System\RnkwwoM.exe
  C:\Windows\System\RnkwwoM.exe
  2⤵
  PID:12004
- C:\Windows\System\PfCNGID.exe
  C:\Windows\System\PfCNGID.exe
  2⤵
  PID:12032
- C:\Windows\System\pGqmAsp.exe
  C:\Windows\System\pGqmAsp.exe
  2⤵
  PID:12064
- C:\Windows\System\fqgrino.exe
  C:\Windows\System\fqgrino.exe
  2⤵
  PID:12096
- C:\Windows\System\xSbpYfE.exe
  C:\Windows\System\xSbpYfE.exe
  2⤵
  PID:12136
- C:\Windows\System\BLhLlUi.exe
  C:\Windows\System\BLhLlUi.exe
  2⤵
  PID:12172
- C:\Windows\System\GqNYeqC.exe
  C:\Windows\System\GqNYeqC.exe
  2⤵
  PID:12200
- C:\Windows\System\IrXjUIK.exe
  C:\Windows\System\IrXjUIK.exe
  2⤵
  PID:12228
- C:\Windows\System\enZxSaI.exe
  C:\Windows\System\enZxSaI.exe
  2⤵
  PID:12284
- C:\Windows\System\NeRMZTB.exe
  C:\Windows\System\NeRMZTB.exe
  2⤵
  PID:8968
- C:\Windows\System\FDhujSQ.exe
  C:\Windows\System\FDhujSQ.exe
  2⤵
  PID:10284
- C:\Windows\System\DOdbTQi.exe
  C:\Windows\System\DOdbTQi.exe
  2⤵
  PID:11168
- C:\Windows\System\NHXeOGj.exe
  C:\Windows\System\NHXeOGj.exe
  2⤵
  PID:2776
- C:\Windows\System\XKdXsrs.exe
  C:\Windows\System\XKdXsrs.exe
  2⤵
  PID:10332
- C:\Windows\System\ctAfwUQ.exe
  C:\Windows\System\ctAfwUQ.exe
  2⤵
  PID:10452
- C:\Windows\System\bQIusyj.exe
  C:\Windows\System\bQIusyj.exe
  2⤵
  PID:10668
- C:\Windows\System\PHAaaal.exe
  C:\Windows\System\PHAaaal.exe
  2⤵
  PID:10832
- C:\Windows\System\XmosjHy.exe
  C:\Windows\System\XmosjHy.exe
  2⤵
  PID:10932
- C:\Windows\System\bmDBsfw.exe
  C:\Windows\System\bmDBsfw.exe
  2⤵
  PID:10080
- C:\Windows\System\biUXSqC.exe
  C:\Windows\System\biUXSqC.exe
  2⤵
  PID:11300
- C:\Windows\System\pzsaQOr.exe
  C:\Windows\System\pzsaQOr.exe
  2⤵
  PID:9632
- C:\Windows\System\oorlTEP.exe
  C:\Windows\System\oorlTEP.exe
  2⤵
  PID:11348
- C:\Windows\System\RQAAVmr.exe
  C:\Windows\System\RQAAVmr.exe
  2⤵
  PID:10392
- C:\Windows\System\RGKmeHe.exe
  C:\Windows\System\RGKmeHe.exe
  2⤵
  PID:11244
- C:\Windows\System\ubqOQHg.exe
  C:\Windows\System\ubqOQHg.exe
  2⤵
  PID:3204
- C:\Windows\System\zxNWLEM.exe
  C:\Windows\System\zxNWLEM.exe
  2⤵
  PID:10496
- C:\Windows\System\lBGFvOs.exe
  C:\Windows\System\lBGFvOs.exe
  2⤵
  PID:2680
- C:\Windows\System\qTDBxqJ.exe
  C:\Windows\System\qTDBxqJ.exe
  2⤵
  PID:10564
- C:\Windows\System\RPMxEWv.exe
  C:\Windows\System\RPMxEWv.exe
  2⤵
  PID:10908
- C:\Windows\System\VjNWyXI.exe
  C:\Windows\System\VjNWyXI.exe
  2⤵
  PID:11504
- C:\Windows\System\kcuMYkq.exe
  C:\Windows\System\kcuMYkq.exe
  2⤵
  PID:11568
- C:\Windows\System\MPROCaU.exe
  C:\Windows\System\MPROCaU.exe
  2⤵
  PID:11096
- C:\Windows\System\RltdEvE.exe
  C:\Windows\System\RltdEvE.exe
  2⤵
  PID:11388
- C:\Windows\System\pSPQGjl.exe
  C:\Windows\System\pSPQGjl.exe
  2⤵
  PID:11692
- C:\Windows\System\lPZeNzx.exe
  C:\Windows\System\lPZeNzx.exe
  2⤵
  PID:11756
- C:\Windows\System\OBHTElz.exe
  C:\Windows\System\OBHTElz.exe
  2⤵
  PID:11824
- C:\Windows\System\wmbqplb.exe
  C:\Windows\System\wmbqplb.exe
  2⤵
  PID:11904
- C:\Windows\System\YvNLBEx.exe
  C:\Windows\System\YvNLBEx.exe
  2⤵
  PID:11932
- C:\Windows\System\LcVFnUG.exe
  C:\Windows\System\LcVFnUG.exe
  2⤵
  PID:10664
- C:\Windows\System\EKRihTl.exe
  C:\Windows\System\EKRihTl.exe
  2⤵
  PID:12020
- C:\Windows\System\esEYnag.exe
  C:\Windows\System\esEYnag.exe
  2⤵
  PID:12308
- C:\Windows\System\KBkoOUT.exe
  C:\Windows\System\KBkoOUT.exe
  2⤵
  PID:12328
- C:\Windows\System\NkKtAOS.exe
  C:\Windows\System\NkKtAOS.exe
  2⤵
  PID:12348
- C:\Windows\System\gDfKcQr.exe
  C:\Windows\System\gDfKcQr.exe
  2⤵
  PID:12372
- C:\Windows\System\YQsEDqv.exe
  C:\Windows\System\YQsEDqv.exe
  2⤵
  PID:12396
- C:\Windows\System\bvKFRqk.exe
  C:\Windows\System\bvKFRqk.exe
  2⤵
  PID:12420
- C:\Windows\System\wpFzOjp.exe
  C:\Windows\System\wpFzOjp.exe
  2⤵
  PID:12444
- C:\Windows\System\BVHWPwQ.exe
  C:\Windows\System\BVHWPwQ.exe
  2⤵
  PID:12468
- C:\Windows\System\nZQdtXs.exe
  C:\Windows\System\nZQdtXs.exe
  2⤵
  PID:12488
- C:\Windows\System\fnnjVEP.exe
  C:\Windows\System\fnnjVEP.exe
  2⤵
  PID:12520
- C:\Windows\System\UHEPWWP.exe
  C:\Windows\System\UHEPWWP.exe
  2⤵
  PID:12748
- C:\Windows\System\sSledHw.exe
  C:\Windows\System\sSledHw.exe
  2⤵
  PID:12764
- C:\Windows\System\CWqbzVR.exe
  C:\Windows\System\CWqbzVR.exe
  2⤵
  PID:12780
- C:\Windows\System\nhcqagP.exe
  C:\Windows\System\nhcqagP.exe
  2⤵
  PID:12804
- C:\Windows\System\aFHOeho.exe
  C:\Windows\System\aFHOeho.exe
  2⤵
  PID:12828
- C:\Windows\System\gHgdWTC.exe
  C:\Windows\System\gHgdWTC.exe
  2⤵
  PID:12848
- C:\Windows\System\qmhaxMU.exe
  C:\Windows\System\qmhaxMU.exe
  2⤵
  PID:12868
- C:\Windows\System\JrsCgBI.exe
  C:\Windows\System\JrsCgBI.exe
  2⤵
  PID:12892
- C:\Windows\System\CLJcECB.exe
  C:\Windows\System\CLJcECB.exe
  2⤵
  PID:12920
- C:\Windows\System\bmhNjwr.exe
  C:\Windows\System\bmhNjwr.exe
  2⤵
  PID:12940
- C:\Windows\System\wInLEYq.exe
  C:\Windows\System\wInLEYq.exe
  2⤵
  PID:12960
- C:\Windows\System\OxYNoRP.exe
  C:\Windows\System\OxYNoRP.exe
  2⤵
  PID:12984
- C:\Windows\System\euMMXHp.exe
  C:\Windows\System\euMMXHp.exe
  2⤵
  PID:13008
- C:\Windows\System\elVOgQX.exe
  C:\Windows\System\elVOgQX.exe
  2⤵
  PID:13036
- C:\Windows\System\WtykXkl.exe
  C:\Windows\System\WtykXkl.exe
  2⤵
  PID:13060
- C:\Windows\System\XTjGQmP.exe
  C:\Windows\System\XTjGQmP.exe
  2⤵
  PID:13084
- C:\Windows\System\yEIYLDa.exe
  C:\Windows\System\yEIYLDa.exe
  2⤵
  PID:13104
- C:\Windows\System\eYLuyvh.exe
  C:\Windows\System\eYLuyvh.exe
  2⤵
  PID:13128
- C:\Windows\System\efsSqds.exe
  C:\Windows\System\efsSqds.exe
  2⤵
  PID:12364
- C:\Windows\System\diZoXYu.exe
  C:\Windows\System\diZoXYu.exe
  2⤵
  PID:10156
- C:\Windows\System\JLgfPFg.exe
  C:\Windows\System\JLgfPFg.exe
  2⤵
  PID:11224
- C:\Windows\System\DqouoVg.exe
  C:\Windows\System\DqouoVg.exe
  2⤵
  PID:10592
- C:\Windows\System\GDBxYHo.exe
  C:\Windows\System\GDBxYHo.exe
  2⤵
  PID:13272
- C:\Windows\System\ITOWykI.exe
  C:\Windows\System\ITOWykI.exe
  2⤵
  PID:9148
- C:\Windows\System\fgPlCOe.exe
  C:\Windows\System\fgPlCOe.exe
  2⤵
  PID:13144
- C:\Windows\System\AoOaTBs.exe
  C:\Windows\System\AoOaTBs.exe
  2⤵
  PID:13248
- C:\Windows\System\zPGKXXQ.exe
  C:\Windows\System\zPGKXXQ.exe
  2⤵
  PID:12740
- C:\Windows\System\PObPAvn.exe
  C:\Windows\System\PObPAvn.exe
  2⤵
  PID:13304
- C:\Windows\System\YDLSNss.exe
  C:\Windows\System\YDLSNss.exe
  2⤵
  PID:11492
- C:\Windows\System\ZHfPurj.exe
  C:\Windows\System\ZHfPurj.exe
  2⤵
  PID:11336
- C:\Windows\System\HvEuPUd.exe
  C:\Windows\System\HvEuPUd.exe
  2⤵
  PID:10356
- C:\Windows\System\FCdxMdO.exe
  C:\Windows\System\FCdxMdO.exe
  2⤵
  PID:1740
- C:\Windows\System\MNDIozk.exe
  C:\Windows\System\MNDIozk.exe
  2⤵
  PID:10784
- C:\Windows\System\EJETRyq.exe
  C:\Windows\System\EJETRyq.exe
  2⤵
  PID:13204
- C:\Windows\System\xjMqvEm.exe
  C:\Windows\System\xjMqvEm.exe
  2⤵
  PID:12000
- C:\Windows\System\NTVJVSs.exe
  C:\Windows\System\NTVJVSs.exe
  2⤵
  PID:11396
- C:\Windows\System\pPLMQwG.exe
  C:\Windows\System\pPLMQwG.exe
  2⤵
  PID:12088
- C:\Windows\System\PlnVeQf.exe
  C:\Windows\System\PlnVeQf.exe
  2⤵
  PID:11296
- C:\Windows\System\GqbZoVk.exe
  C:\Windows\System\GqbZoVk.exe
  2⤵
  PID:11848
- C:\Windows\System\CfzJlNM.exe
  C:\Windows\System\CfzJlNM.exe
  2⤵
  PID:12440
- C:\Windows\System\ExFefTP.exe
  C:\Windows\System\ExFefTP.exe
  2⤵
  PID:12152
- C:\Windows\System\QOscsrL.exe
  C:\Windows\System\QOscsrL.exe
  2⤵
  PID:11416
- C:\Windows\System\CmdWlZT.exe
  C:\Windows\System\CmdWlZT.exe
  2⤵
  PID:12132
- C:\Windows\System\NATyFRT.exe
  C:\Windows\System\NATyFRT.exe
  2⤵
  PID:12632
- C:\Windows\System\PhXFGVL.exe
  C:\Windows\System\PhXFGVL.exe
  2⤵
  PID:13228
- C:\Windows\System\jtYiKrL.exe
  C:\Windows\System\jtYiKrL.exe
  2⤵
  PID:12844
- C:\Windows\System\fHeEyYZ.exe
  C:\Windows\System\fHeEyYZ.exe
  2⤵
  PID:12388
- C:\Windows\System\ebfDNXW.exe
  C:\Windows\System\ebfDNXW.exe
  2⤵
  PID:13120
- C:\Windows\System\EqhypXP.exe
  C:\Windows\System\EqhypXP.exe
  2⤵
  PID:11040
- C:\Windows\System\VJnkYKN.exe
  C:\Windows\System\VJnkYKN.exe
  2⤵
  PID:13256
- C:\Windows\System\zcrozjj.exe
  C:\Windows\System\zcrozjj.exe
  2⤵
  PID:11508
- C:\Windows\System\vRpVzcR.exe
  C:\Windows\System\vRpVzcR.exe
  2⤵
  PID:12952
- C:\Windows\System\EZGKxBJ.exe
  C:\Windows\System\EZGKxBJ.exe
  2⤵
  PID:13176
- C:\Windows\System\uUhKrjj.exe
  C:\Windows\System\uUhKrjj.exe
  2⤵
  PID:12656
- C:\Windows\System\MQXNBOG.exe
  C:\Windows\System\MQXNBOG.exe
  2⤵
  PID:10420
- C:\Windows\System\CDBbyDx.exe
  C:\Windows\System\CDBbyDx.exe
  2⤵
  PID:13252
- C:\Windows\System\ugYVhYm.exe
  C:\Windows\System\ugYVhYm.exe
  2⤵
  PID:11524
- C:\Windows\System\dlkBKOq.exe
  C:\Windows\System\dlkBKOq.exe
  2⤵
  PID:12476
- C:\Windows\System\LEDQqwa.exe
  C:\Windows\System\LEDQqwa.exe
  2⤵
  PID:11884
- C:\Windows\System\LNRNORp.exe
  C:\Windows\System\LNRNORp.exe
  2⤵
  PID:10892
- C:\Windows\System\JxZTXxa.exe
  C:\Windows\System\JxZTXxa.exe
  2⤵
  PID:12080
- C:\Windows\System\WxbdtFM.exe
  C:\Windows\System\WxbdtFM.exe
  2⤵
  PID:11704
- C:\Windows\System\wxSNIla.exe
  C:\Windows\System\wxSNIla.exe
  2⤵
  PID:220
- C:\Windows\System\ePXkdkx.exe
  C:\Windows\System\ePXkdkx.exe
  2⤵
  PID:13000
- C:\Windows\System\IFkuoOD.exe
  C:\Windows\System\IFkuoOD.exe
  2⤵
  PID:12908
- C:\Windows\System\ZMPKIFI.exe
  C:\Windows\System\ZMPKIFI.exe
  2⤵
  PID:12208
- C:\Windows\System\RDZzttf.exe
  C:\Windows\System\RDZzttf.exe
  2⤵
  PID:3912
- C:\Windows\System\hfgALeD.exe
  C:\Windows\System\hfgALeD.exe
  2⤵
  PID:11772
- C:\Windows\System\cSeFkfk.exe
  C:\Windows\System\cSeFkfk.exe
  2⤵
  PID:13192
- C:\Windows\System\sGiVKlO.exe
  C:\Windows\System\sGiVKlO.exe
  2⤵
  PID:12788
- C:\Windows\System\MoYHYvU.exe
  C:\Windows\System\MoYHYvU.exe
  2⤵
  PID:11332
- C:\Windows\System\kbkeURL.exe
  C:\Windows\System\kbkeURL.exe
  2⤵
  PID:12072
- C:\Windows\System\RhJeyDO.exe
  C:\Windows\System\RhJeyDO.exe
  2⤵
  PID:12076
- C:\Windows\System\nyiBIvD.exe
  C:\Windows\System\nyiBIvD.exe
  2⤵
  PID:11788
- C:\Windows\System\VwbrEmr.exe
  C:\Windows\System\VwbrEmr.exe
  2⤵
  PID:13212
- C:\Windows\System\DrUloKB.exe
  C:\Windows\System\DrUloKB.exe
  2⤵
  PID:2964
- C:\Windows\System\vtHDOUN.exe
  C:\Windows\System\vtHDOUN.exe
  2⤵
  PID:1400
- C:\Windows\System\UcCMjQR.exe
  C:\Windows\System\UcCMjQR.exe
  2⤵
  PID:6876
- C:\Windows\System\Zkpfenu.exe
  C:\Windows\System\Zkpfenu.exe
  2⤵
  PID:5844
- C:\Windows\System\wUPUmze.exe
  C:\Windows\System\wUPUmze.exe
  2⤵
  PID:12540
- C:\Windows\System\zMGJnEc.exe
  C:\Windows\System\zMGJnEc.exe
  2⤵
  PID:10608
- C:\Windows\System\yUVfOel.exe
  C:\Windows\System\yUVfOel.exe
  2⤵
  PID:12212
- C:\Windows\System\PyjdldC.exe
  C:\Windows\System\PyjdldC.exe
  2⤵
  PID:12012
- C:\Windows\System\pjiCSXI.exe
  C:\Windows\System\pjiCSXI.exe
  2⤵
  PID:12280
- C:\Windows\System\qluoudK.exe
  C:\Windows\System\qluoudK.exe
  2⤵
  PID:4032
- C:\Windows\System\HTNEKrT.exe
  C:\Windows\System\HTNEKrT.exe
  2⤵
  PID:13560
- C:\Windows\System\anpNPBF.exe
  C:\Windows\System\anpNPBF.exe
  2⤵
  PID:13588
- C:\Windows\System\tpYKUGl.exe
  C:\Windows\System\tpYKUGl.exe
  2⤵
  PID:13608
- C:\Windows\System\zBsauZg.exe
  C:\Windows\System\zBsauZg.exe
  2⤵
  PID:13740
- C:\Windows\System\ElTZHyQ.exe
  C:\Windows\System\ElTZHyQ.exe
  2⤵
  PID:13764
- C:\Windows\System\eKXrGEQ.exe
  C:\Windows\System\eKXrGEQ.exe
  2⤵
  PID:4316
- C:\Windows\System\NqrtSTz.exe
  C:\Windows\System\NqrtSTz.exe
  2⤵
  PID:13848
- C:\Windows\System\bAoryyZ.exe
  C:\Windows\System\bAoryyZ.exe
  2⤵
  PID:13892
- C:\Windows\System\MCxEfre.exe
  C:\Windows\System\MCxEfre.exe
  2⤵
  PID:13904
- C:\Windows\System\dJjJTGY.exe
  C:\Windows\System\dJjJTGY.exe
  2⤵
  PID:13936
- C:\Windows\System\aUUxcSu.exe
  C:\Windows\System\aUUxcSu.exe
  2⤵
  PID:13980
- C:\Windows\System\KtZxhdJ.exe
  C:\Windows\System\KtZxhdJ.exe
  2⤵
  PID:14008
- C:\Windows\System\IucurhH.exe
  C:\Windows\System\IucurhH.exe
  2⤵
  PID:14028
- C:\Windows\System\UxjWGCL.exe
  C:\Windows\System\UxjWGCL.exe
  2⤵
  PID:14056
- C:\Windows\System\ecHkvNf.exe
  C:\Windows\System\ecHkvNf.exe
  2⤵
  PID:14088
- C:\Windows\System\FilalSG.exe
  C:\Windows\System\FilalSG.exe
  2⤵
  PID:3580
- C:\Windows\System\RxGqbZB.exe
  C:\Windows\System\RxGqbZB.exe
  2⤵
  PID:3584
- C:\Windows\System\JbACQmo.exe
  C:\Windows\System\JbACQmo.exe
  2⤵
  PID:14156
- C:\Windows\System\jTKQzdU.exe
  C:\Windows\System\jTKQzdU.exe
  2⤵
  PID:14192
- C:\Windows\System\SkJvlHz.exe
  C:\Windows\System\SkJvlHz.exe
  2⤵
  PID:14224
- C:\Windows\System\XXzRMMe.exe
  C:\Windows\System\XXzRMMe.exe
  2⤵
  PID:14256
- C:\Windows\System\dniAJyg.exe
  C:\Windows\System\dniAJyg.exe
  2⤵
  PID:3340
- C:\Windows\System\ueQuaxx.exe
  C:\Windows\System\ueQuaxx.exe
  2⤵
  PID:14292
- C:\Windows\System\WjOUziJ.exe
  C:\Windows\System\WjOUziJ.exe
  2⤵
  PID:13400
- C:\Windows\System\jEIOUeE.exe
  C:\Windows\System\jEIOUeE.exe
  2⤵
  PID:13408
- C:\Windows\System\INUIcvK.exe
  C:\Windows\System\INUIcvK.exe
  2⤵
  PID:13424
- C:\Windows\System\DxalNnf.exe
  C:\Windows\System\DxalNnf.exe
  2⤵
  PID:316
- C:\Windows\System\wQWvfJG.exe
  C:\Windows\System\wQWvfJG.exe
  2⤵
  PID:13464
- C:\Windows\System\dYtDKYP.exe
  C:\Windows\System\dYtDKYP.exe
  2⤵
  PID:7080
- C:\Windows\System\iOFEZBk.exe
  C:\Windows\System\iOFEZBk.exe
  2⤵
  PID:13476
- C:\Windows\System\UvgyUrk.exe
  C:\Windows\System\UvgyUrk.exe
  2⤵
  PID:4200
- C:\Windows\System\lnVqfNc.exe
  C:\Windows\System\lnVqfNc.exe
  2⤵
  PID:13504
- C:\Windows\System\wqvmcpt.exe
  C:\Windows\System\wqvmcpt.exe
  2⤵
  PID:13536
- C:\Windows\System\CGKtVKl.exe
  C:\Windows\System\CGKtVKl.exe
  2⤵
  PID:3956
- C:\Windows\System\jAWySyK.exe
  C:\Windows\System\jAWySyK.exe
  2⤵
  PID:13360
- C:\Windows\System\IBnkAbO.exe
  C:\Windows\System\IBnkAbO.exe
  2⤵
  PID:13024
- C:\Windows\System\wVCbzSG.exe
  C:\Windows\System\wVCbzSG.exe
  2⤵
  PID:13340
- C:\Windows\System\ctpMNQg.exe
  C:\Windows\System\ctpMNQg.exe
  2⤵
  PID:12412
- C:\Windows\System\wOWwKxL.exe
  C:\Windows\System\wOWwKxL.exe
  2⤵
  PID:13336
- C:\Windows\System\uoBAEVm.exe
  C:\Windows\System\uoBAEVm.exe
  2⤵
  PID:13604
- C:\Windows\System\XsNroZz.exe
  C:\Windows\System\XsNroZz.exe
  2⤵
  PID:13620
- C:\Windows\System\TXXQxme.exe
  C:\Windows\System\TXXQxme.exe
  2⤵
  PID:2076
- C:\Windows\System\RdwoYOq.exe
  C:\Windows\System\RdwoYOq.exe
  2⤵
  PID:13692
- C:\Windows\System\UvkHwWn.exe
  C:\Windows\System\UvkHwWn.exe
  2⤵
  PID:3448
- C:\Windows\System\XDfRaJS.exe
  C:\Windows\System\XDfRaJS.exe
  2⤵
  PID:13704
- C:\Windows\System\qWuYjlo.exe
  C:\Windows\System\qWuYjlo.exe
  2⤵
  PID:13736
- C:\Windows\System\fJtirxN.exe
  C:\Windows\System\fJtirxN.exe
  2⤵
  PID:13796
- C:\Windows\System\wWdrFRm.exe
  C:\Windows\System\wWdrFRm.exe
  2⤵
  PID:1988
- C:\Windows\System\JjvPgWk.exe
  C:\Windows\System\JjvPgWk.exe
  2⤵
  PID:13828
- C:\Windows\System\XhMwrXu.exe
  C:\Windows\System\XhMwrXu.exe
  2⤵
  PID:1384
- C:\Windows\System\ijGSStH.exe
  C:\Windows\System\ijGSStH.exe
  2⤵
  PID:13900
- C:\Windows\System\hHUbSap.exe
  C:\Windows\System\hHUbSap.exe
  2⤵
  PID:13940
- C:\Windows\System\aexWcUe.exe
  C:\Windows\System\aexWcUe.exe
  2⤵
  PID:14004
- C:\Windows\System\xZmNMzb.exe
  C:\Windows\System\xZmNMzb.exe
  2⤵
  PID:14020
- C:\Windows\System\EjjXods.exe
  C:\Windows\System\EjjXods.exe
  2⤵
  PID:13952
- C:\Windows\System\VltHdSd.exe
  C:\Windows\System\VltHdSd.exe
  2⤵
  PID:13260
- C:\Windows\System\aYKTJRc.exe
  C:\Windows\System\aYKTJRc.exe
  2⤵
  PID:3208
- C:\Windows\System\OyaKycr.exe
  C:\Windows\System\OyaKycr.exe
  2⤵
  PID:4088
- C:\Windows\System\egxIMzd.exe
  C:\Windows\System\egxIMzd.exe
  2⤵
  PID:14128
- C:\Windows\System\KtYABux.exe
  C:\Windows\System\KtYABux.exe
  2⤵
  PID:14140
- C:\Windows\System\DPhMwcl.exe
  C:\Windows\System\DPhMwcl.exe
  2⤵
  PID:14332
- C:\Windows\System\qIRHIIG.exe
  C:\Windows\System\qIRHIIG.exe
  2⤵
  PID:2400
- C:\Windows\System\DDLuhJC.exe
  C:\Windows\System\DDLuhJC.exe
  2⤵
  PID:728
- C:\Windows\System\bDxYVZf.exe
  C:\Windows\System\bDxYVZf.exe
  2⤵
  PID:14268
- C:\Windows\System\ghmXstc.exe
  C:\Windows\System\ghmXstc.exe
  2⤵
  PID:13472
- C:\Windows\System\dtMmLqz.exe
  C:\Windows\System\dtMmLqz.exe
  2⤵
  PID:2624
- C:\Windows\System\hJqtUnT.exe
  C:\Windows\System\hJqtUnT.exe
  2⤵
  PID:3368
- C:\Windows\System\mbuHpYL.exe
  C:\Windows\System\mbuHpYL.exe
  2⤵
  PID:2992
- C:\Windows\System\ctpDrPc.exe
  C:\Windows\System\ctpDrPc.exe
  2⤵
  PID:1268
- C:\Windows\System\FfVMSns.exe
  C:\Windows\System\FfVMSns.exe
  2⤵
  PID:2460
- C:\Windows\System\asmzJTy.exe
  C:\Windows\System\asmzJTy.exe
  2⤵
  PID:968
- C:\Windows\System\YllDmoR.exe
  C:\Windows\System\YllDmoR.exe
  2⤵
  PID:3060
- C:\Windows\System\XSsLcfi.exe
  C:\Windows\System\XSsLcfi.exe
  2⤵
  PID:528
- C:\Windows\System\fUJcbVR.exe
  C:\Windows\System\fUJcbVR.exe
  2⤵
  PID:13644
- C:\Windows\System\VaGnmzG.exe
  C:\Windows\System\VaGnmzG.exe
  2⤵
  PID:624
- C:\Windows\System\IVnfArN.exe
  C:\Windows\System\IVnfArN.exe
  2⤵
  PID:1396
- C:\Windows\System\gRgIbjv.exe
  C:\Windows\System\gRgIbjv.exe
  2⤵
  PID:1248
- C:\Windows\System\hBAbuqZ.exe
  C:\Windows\System\hBAbuqZ.exe
  2⤵
  PID:10816
- C:\Windows\System\BPjFlNF.exe
  C:\Windows\System\BPjFlNF.exe
  2⤵
  PID:13728
- C:\Windows\System\JBwtJQT.exe
  C:\Windows\System\JBwtJQT.exe
  2⤵
  PID:12936
- C:\Windows\System\etZSpCv.exe
  C:\Windows\System\etZSpCv.exe
  2⤵
  PID:4452
- C:\Windows\System\XsxhlnK.exe
  C:\Windows\System\XsxhlnK.exe
  2⤵
  PID:4544
- C:\Windows\System\IfExyzw.exe
  C:\Windows\System\IfExyzw.exe
  2⤵
  PID:13780
- C:\Windows\System\UUKyVDb.exe
  C:\Windows\System\UUKyVDb.exe
  2⤵
  PID:14044
- C:\Windows\System\bpcMYgp.exe
  C:\Windows\System\bpcMYgp.exe
  2⤵
  PID:4016
- C:\Windows\System\cyoPsfT.exe
  C:\Windows\System\cyoPsfT.exe
  2⤵
  PID:1588
- C:\Windows\System\XUFmaNw.exe
  C:\Windows\System\XUFmaNw.exe
  2⤵
  PID:14252
- C:\Windows\System\DILBcLx.exe
  C:\Windows\System\DILBcLx.exe
  2⤵
  PID:4192
- C:\Windows\System\qUNvpfs.exe
  C:\Windows\System\qUNvpfs.exe
  2⤵
  PID:13928
- C:\Windows\System\FTJZGFV.exe
  C:\Windows\System\FTJZGFV.exe
  2⤵
  PID:13532
- C:\Windows\System\MrpCcoG.exe
  C:\Windows\System\MrpCcoG.exe
  2⤵
  PID:2116
- C:\Windows\System\zmkTrzr.exe
  C:\Windows\System\zmkTrzr.exe
  2⤵
  PID:4284
- C:\Windows\System\iNbXofY.exe
  C:\Windows\System\iNbXofY.exe
  2⤵
  PID:14248
- C:\Windows\System\dUIceVb.exe
  C:\Windows\System\dUIceVb.exe
  2⤵
  PID:5724
- C:\Windows\System\pCnrISh.exe
  C:\Windows\System\pCnrISh.exe
  2⤵
  PID:1200
- C:\Windows\System\YNcIcYy.exe
  C:\Windows\System\YNcIcYy.exe
  2⤵
  PID:14308
- C:\Windows\System\OOqEvIy.exe
  C:\Windows\System\OOqEvIy.exe
  2⤵
  PID:2600
- C:\Windows\System\KkFeAOn.exe
  C:\Windows\System\KkFeAOn.exe
  2⤵
  PID:1036
- C:\Windows\System\stTaJQu.exe
  C:\Windows\System\stTaJQu.exe
  2⤵
  PID:4576
- C:\Windows\System\DqoPMMn.exe
  C:\Windows\System\DqoPMMn.exe
  2⤵
  PID:3232
- C:\Windows\System\tLKanwD.exe
  C:\Windows\System\tLKanwD.exe
  2⤵
  PID:5720
- C:\Windows\System\TjpVNzp.exe
  C:\Windows\System\TjpVNzp.exe
  2⤵
  PID:13996
- C:\Windows\System\JUjANTK.exe
  C:\Windows\System\JUjANTK.exe
  2⤵
  PID:13872
- C:\Windows\System\oxoZALO.exe
  C:\Windows\System\oxoZALO.exe
  2⤵
  PID:6120
- C:\Windows\System\UBmdKED.exe
  C:\Windows\System\UBmdKED.exe
  2⤵
  PID:5640
- C:\Windows\System\wOlvXLa.exe
  C:\Windows\System\wOlvXLa.exe
  2⤵
  PID:6016
- C:\Windows\System\FiCswlW.exe
  C:\Windows\System\FiCswlW.exe
  2⤵
  PID:4392
- C:\Windows\System\yIacxLz.exe
  C:\Windows\System\yIacxLz.exe
  2⤵
  PID:13508
- C:\Windows\System\qkSTZcL.exe
  C:\Windows\System\qkSTZcL.exe
  2⤵
  PID:5796
- C:\Windows\System\uzITOSu.exe
  C:\Windows\System\uzITOSu.exe
  2⤵
  PID:5316
- C:\Windows\System\XJnuvfc.exe
  C:\Windows\System\XJnuvfc.exe
  2⤵
  PID:3260
- C:\Windows\System\BxLHZMP.exe
  C:\Windows\System\BxLHZMP.exe
  2⤵
  PID:5328
- C:\Windows\System\yKJsoJK.exe
  C:\Windows\System\yKJsoJK.exe
  2⤵
  PID:13376
- C:\Windows\System\uuBrfpo.exe
  C:\Windows\System\uuBrfpo.exe
  2⤵
  PID:964
- C:\Windows\System\PmrBRzJ.exe
  C:\Windows\System\PmrBRzJ.exe
  2⤵
  PID:4136
- C:\Windows\System\phUQCaQ.exe
  C:\Windows\System\phUQCaQ.exe
  2⤵
  PID:12464
- C:\Windows\System\VfGHAcV.exe
  C:\Windows\System\VfGHAcV.exe
  2⤵
  PID:13332
- C:\Windows\System\KCDcJVa.exe
  C:\Windows\System\KCDcJVa.exe
  2⤵
  PID:14144
- C:\Windows\System\nNXcxtz.exe
  C:\Windows\System\nNXcxtz.exe
  2⤵
  PID:6416
- C:\Windows\System\OqnpYjM.exe
  C:\Windows\System\OqnpYjM.exe
  2⤵
  PID:6432
- C:\Windows\System\QWabnDy.exe
  C:\Windows\System\QWabnDy.exe
  2⤵
  PID:13844
- C:\Windows\System\MNQcfkc.exe
  C:\Windows\System\MNQcfkc.exe
  2⤵
  PID:5752
- C:\Windows\System\NrvucHc.exe
  C:\Windows\System\NrvucHc.exe
  2⤵
  PID:14064
- C:\Windows\System\OQdzzlZ.exe
  C:\Windows\System\OQdzzlZ.exe
  2⤵
  PID:5536
- C:\Windows\System\ZUEZAkR.exe
  C:\Windows\System\ZUEZAkR.exe
  2⤵
  PID:5068
- C:\Windows\System\nNsDVkc.exe
  C:\Windows\System\nNsDVkc.exe
  2⤵
  PID:1448
- C:\Windows\System\YlfbtVU.exe
  C:\Windows\System\YlfbtVU.exe
  2⤵
  PID:8224
- C:\Windows\System\XexOSSk.exe
  C:\Windows\System\XexOSSk.exe
  2⤵
  PID:14236
- C:\Windows\System\McRDxMe.exe
  C:\Windows\System\McRDxMe.exe
  2⤵
  PID:5632
- C:\Windows\System\isaWFEB.exe
  C:\Windows\System\isaWFEB.exe
  2⤵
  PID:5780
- C:\Windows\System\BxmsveD.exe
  C:\Windows\System\BxmsveD.exe
  2⤵
  PID:13876
- C:\Windows\System\TSRmgNO.exe
  C:\Windows\System\TSRmgNO.exe
  2⤵
  PID:6756
- C:\Windows\System\UJsJKLD.exe
  C:\Windows\System\UJsJKLD.exe
  2⤵
  PID:6044
- C:\Windows\System\xEaMhKq.exe
  C:\Windows\System\xEaMhKq.exe
  2⤵
  PID:6496
- C:\Windows\System\DWbOdlK.exe
  C:\Windows\System\DWbOdlK.exe
  2⤵
  PID:6760
- C:\Windows\System\sMhVAea.exe
  C:\Windows\System\sMhVAea.exe
  2⤵
  PID:6668
- C:\Windows\System\vmrMahM.exe
  C:\Windows\System\vmrMahM.exe
  2⤵
  PID:6660
- C:\Windows\System\xmnwJuO.exe
  C:\Windows\System\xmnwJuO.exe
  2⤵
  PID:13968
- C:\Windows\System\uEkglDJ.exe
  C:\Windows\System\uEkglDJ.exe
  2⤵
  PID:6020
- C:\Windows\System\llcctsb.exe
  C:\Windows\System\llcctsb.exe
  2⤵
  PID:4556
- C:\Windows\System\jdlhARL.exe
  C:\Windows\System\jdlhARL.exe
  2⤵
  PID:208
- C:\Windows\System\kaCDsyv.exe
  C:\Windows\System\kaCDsyv.exe
  2⤵
  PID:6440
- C:\Windows\System\DAAarTS.exe
  C:\Windows\System\DAAarTS.exe
  2⤵
  PID:6800
- C:\Windows\System\hosdCGz.exe
  C:\Windows\System\hosdCGz.exe
  2⤵
  PID:14148
- C:\Windows\System\SBwBIVC.exe
  C:\Windows\System\SBwBIVC.exe
  2⤵
  PID:13576
- C:\Windows\System\TxEfRJG.exe
  C:\Windows\System\TxEfRJG.exe
  2⤵
  PID:6324
- C:\Windows\System\fMixLqD.exe
  C:\Windows\System\fMixLqD.exe
  2⤵
  PID:6484
- C:\Windows\System\AMxnUFM.exe
  C:\Windows\System\AMxnUFM.exe
  2⤵
  PID:6180
- C:\Windows\System\tEfsEnq.exe
  C:\Windows\System\tEfsEnq.exe
  2⤵
  PID:5248
- C:\Windows\System\RzKHeCH.exe
  C:\Windows\System\RzKHeCH.exe
  2⤵
  PID:6228
- C:\Windows\System\MADeLTY.exe
  C:\Windows\System\MADeLTY.exe
  2⤵
  PID:5500
- C:\Windows\System\GUYhRAB.exe
  C:\Windows\System\GUYhRAB.exe
  2⤵
  PID:6848
- C:\Windows\System\wOwWwUx.exe
  C:\Windows\System\wOwWwUx.exe
  2⤵
  PID:2184
- C:\Windows\System\obStyzR.exe
  C:\Windows\System\obStyzR.exe
  2⤵
  PID:5792
- C:\Windows\System\qPulcvc.exe
  C:\Windows\System\qPulcvc.exe
  2⤵
  PID:12272
- C:\Windows\System\wzgJAjk.exe
  C:\Windows\System\wzgJAjk.exe
  2⤵
  PID:3600
- C:\Windows\System\DDNRMCn.exe
  C:\Windows\System\DDNRMCn.exe
  2⤵
  PID:6868
- C:\Windows\System\lkIQqLg.exe
  C:\Windows\System\lkIQqLg.exe
  2⤵
  PID:6480
- C:\Windows\System\cJKdIPL.exe
  C:\Windows\System\cJKdIPL.exe
  2⤵
  PID:13404
- C:\Windows\System\qcNQKtf.exe
  C:\Windows\System\qcNQKtf.exe
  2⤵
  PID:12184
- C:\Windows\System\gyzYdBG.exe
  C:\Windows\System\gyzYdBG.exe
  2⤵
  PID:6980
- C:\Windows\System\BTVVWNE.exe
  C:\Windows\System\BTVVWNE.exe
  2⤵
  PID:13520
- C:\Windows\System\ddJZNCN.exe
  C:\Windows\System\ddJZNCN.exe
  2⤵
  PID:7108
- C:\Windows\System\iQPecYB.exe
  C:\Windows\System\iQPecYB.exe
  2⤵
  PID:7104
- C:\Windows\System\RLdMYui.exe
  C:\Windows\System\RLdMYui.exe
  2⤵
  PID:5220
- C:\Windows\System\rVJKWaJ.exe
  C:\Windows\System\rVJKWaJ.exe
  2⤵
  PID:7084
- C:\Windows\System\RxyiBGf.exe
  C:\Windows\System\RxyiBGf.exe
  2⤵
  PID:5964
- C:\Windows\System\zJLMBkb.exe
  C:\Windows\System\zJLMBkb.exe
  2⤵
  PID:6364
- C:\Windows\System\JXORQCg.exe
  C:\Windows\System\JXORQCg.exe
  2⤵
  PID:12320
- C:\Windows\System\DmnRhOM.exe
  C:\Windows\System\DmnRhOM.exe
  2⤵
  PID:12756
- C:\Windows\System\yzrdWdm.exe
  C:\Windows\System\yzrdWdm.exe
  2⤵
  PID:6208
- C:\Windows\System\fbPEQsS.exe
  C:\Windows\System\fbPEQsS.exe
  2⤵
  PID:6304
- C:\Windows\System\uHvrwFq.exe
  C:\Windows\System\uHvrwFq.exe
  2⤵
  PID:11616
- C:\Windows\System\EBqyyOB.exe
  C:\Windows\System\EBqyyOB.exe
  2⤵
  PID:6776
- C:\Windows\System\KRPqxSg.exe
  C:\Windows\System\KRPqxSg.exe
  2⤵
  PID:4844
- C:\Windows\System\CjDIowl.exe
  C:\Windows\System\CjDIowl.exe
  2⤵
  PID:2136
- C:\Windows\System\VwoIdZL.exe
  C:\Windows\System\VwoIdZL.exe
  2⤵
  PID:4892
- C:\Windows\System\AeWAAmW.exe
  C:\Windows\System\AeWAAmW.exe
  2⤵
  PID:13004
- C:\Windows\System\EtSynRs.exe
  C:\Windows\System\EtSynRs.exe
  2⤵
  PID:3756
- C:\Windows\System\IuoObVx.exe
  C:\Windows\System\IuoObVx.exe
  2⤵
  PID:6944
- C:\Windows\System\sQlDUlc.exe
  C:\Windows\System\sQlDUlc.exe
  2⤵
  PID:11052
- C:\Windows\System\DjXsRIK.exe
  C:\Windows\System\DjXsRIK.exe
  2⤵
  PID:12956
- C:\Windows\System\tJDnfAy.exe
  C:\Windows\System\tJDnfAy.exe
  2⤵
  PID:6820
- C:\Windows\System\OxybFtY.exe
  C:\Windows\System\OxybFtY.exe
  2⤵
  PID:6896
- C:\Windows\System\CqZJuBl.exe
  C:\Windows\System\CqZJuBl.exe
  2⤵
  PID:2388
- C:\Windows\System\PuUNhIS.exe
  C:\Windows\System\PuUNhIS.exe
  2⤵
  PID:4528
- C:\Windows\System\lGIYxwE.exe
  C:\Windows\System\lGIYxwE.exe
  2⤵
  PID:5348
- C:\Windows\System\pbYuqtc.exe
  C:\Windows\System\pbYuqtc.exe
  2⤵
  PID:7608
- C:\Windows\System\WwrujEu.exe
  C:\Windows\System\WwrujEu.exe
  2⤵
  PID:7488
- C:\Windows\System\aOWMgUU.exe
  C:\Windows\System\aOWMgUU.exe
  2⤵
  PID:7732
- C:\Windows\System\KGaVUYR.exe
  C:\Windows\System\KGaVUYR.exe
  2⤵
  PID:5236
- C:\Windows\System\PbYPXww.exe
  C:\Windows\System\PbYPXww.exe
  2⤵
  PID:7700
- C:\Windows\System\kXlIucg.exe
  C:\Windows\System\kXlIucg.exe
  2⤵
  PID:7232
- C:\Windows\System\MVIuDaW.exe
  C:\Windows\System\MVIuDaW.exe
  2⤵
  PID:4588
- C:\Windows\System\eycndEB.exe
  C:\Windows\System\eycndEB.exe
  2⤵
  PID:10532
- C:\Windows\System\MaMeMnA.exe
  C:\Windows\System\MaMeMnA.exe
  2⤵
  PID:6124
- C:\Windows\System\dNcFXHM.exe
  C:\Windows\System\dNcFXHM.exe
  2⤵
  PID:7288
- C:\Windows\System\czYjXby.exe
  C:\Windows\System\czYjXby.exe
  2⤵
  PID:7792
- C:\Windows\System\LWYszYq.exe
  C:\Windows\System\LWYszYq.exe
  2⤵
  PID:2180
- C:\Windows\System\XexdRkt.exe
  C:\Windows\System\XexdRkt.exe
  2⤵
  PID:7668
- C:\Windows\System\eaPgWFw.exe
  C:\Windows\System\eaPgWFw.exe
  2⤵
  PID:8052
- C:\Windows\System\wlaqZow.exe
  C:\Windows\System\wlaqZow.exe
  2⤵
  PID:7928
- C:\Windows\System\HAERywN.exe
  C:\Windows\System\HAERywN.exe
  2⤵
  PID:7864
- C:\Windows\System\VUcKeMX.exe
  C:\Windows\System\VUcKeMX.exe
  2⤵
  PID:9204
- C:\Windows\System\AdyZfJQ.exe
  C:\Windows\System\AdyZfJQ.exe
  2⤵
  PID:13772
- C:\Windows\System\eGLQQDH.exe
  C:\Windows\System\eGLQQDH.exe
  2⤵
  PID:1712
- C:\Windows\System\HzndryG.exe
  C:\Windows\System\HzndryG.exe
  2⤵
  PID:1660
- C:\Windows\System\zplvrhd.exe
  C:\Windows\System\zplvrhd.exe
  2⤵
  PID:9448
- C:\Windows\System\kfdbywb.exe
  C:\Windows\System\kfdbywb.exe
  2⤵
  PID:8016
- C:\Windows\System\XOZIpzN.exe
  C:\Windows\System\XOZIpzN.exe
  2⤵
  PID:7800
- C:\Windows\System\VpumWhf.exe
  C:\Windows\System\VpumWhf.exe
  2⤵
  PID:2924
- C:\Windows\System\cQkTsXx.exe
  C:\Windows\System\cQkTsXx.exe
  2⤵
  PID:14348
- C:\Windows\System\puzidhC.exe
  C:\Windows\System\puzidhC.exe
  2⤵
  PID:14388
- C:\Windows\System\ryptxGB.exe
  C:\Windows\System\ryptxGB.exe
  2⤵
  PID:14404
- C:\Windows\System\DIynLAW.exe
  C:\Windows\System\DIynLAW.exe
  2⤵
  PID:14420
- C:\Windows\System\cFXgosX.exe
  C:\Windows\System\cFXgosX.exe
  2⤵
  PID:14436
- C:\Windows\System\BCJxluh.exe
  C:\Windows\System\BCJxluh.exe
  2⤵
  PID:14452
- C:\Windows\System\zaTxEYz.exe
  C:\Windows\System\zaTxEYz.exe
  2⤵
  PID:14468
- C:\Windows\System\tqpRmld.exe
  C:\Windows\System\tqpRmld.exe
  2⤵
  PID:14508
- C:\Windows\System\EmljimS.exe
  C:\Windows\System\EmljimS.exe
  2⤵
  PID:14540
- C:\Windows\System\ucrfyGM.exe
  C:\Windows\System\ucrfyGM.exe
  2⤵
  PID:14572
- C:\Windows\System\Rvjepya.exe
  C:\Windows\System\Rvjepya.exe
  2⤵
  PID:14592
- C:\Windows\System\lSFaqkO.exe
  C:\Windows\System\lSFaqkO.exe
  2⤵
  PID:14612
- C:\Windows\System\bmrWXjr.exe
  C:\Windows\System\bmrWXjr.exe
  2⤵
  PID:14744
- C:\Windows\System\LIdphza.exe
  C:\Windows\System\LIdphza.exe
  2⤵
  PID:14772
- C:\Windows\System\yeOUfZb.exe
  C:\Windows\System\yeOUfZb.exe
  2⤵
  PID:14968
- C:\Windows\System\wITTZIr.exe
  C:\Windows\System\wITTZIr.exe
  2⤵
  PID:14992
- C:\Windows\System\yBLfmzj.exe
  C:\Windows\System\yBLfmzj.exe
  2⤵
  PID:15112
- C:\Windows\System\WfndhJC.exe
  C:\Windows\System\WfndhJC.exe
  2⤵
  PID:15132
- C:\Windows\System\ehUlUIb.exe
  C:\Windows\System\ehUlUIb.exe
  2⤵
  PID:15172
- C:\Windows\System\koxPmbG.exe
  C:\Windows\System\koxPmbG.exe
  2⤵
  PID:15212
- C:\Windows\System\dxzmiEz.exe
  C:\Windows\System\dxzmiEz.exe
  2⤵
  PID:15236
- C:\Windows\System\iLrUJWH.exe
  C:\Windows\System\iLrUJWH.exe
  2⤵
  PID:15260
- C:\Windows\System\XFhnGlh.exe
  C:\Windows\System\XFhnGlh.exe
  2⤵
  PID:15276
- C:\Windows\System\fGqMGRh.exe
  C:\Windows\System\fGqMGRh.exe
  2⤵
  PID:15308
- C:\Windows\System\jpDmZxf.exe
  C:\Windows\System\jpDmZxf.exe
  2⤵
  PID:15340
- C:\Windows\System\qJdmgVY.exe
  C:\Windows\System\qJdmgVY.exe
  2⤵
  PID:5172
- C:\Windows\System\rdPHqJx.exe
  C:\Windows\System\rdPHqJx.exe
  2⤵
  PID:6460
- C:\Windows\System\pwPoYrt.exe
  C:\Windows\System\pwPoYrt.exe
  2⤵
  PID:8996
- C:\Windows\System\IiGSkiR.exe
  C:\Windows\System\IiGSkiR.exe
  2⤵
  PID:8152
- C:\Windows\System\xpdyKYQ.exe
  C:\Windows\System\xpdyKYQ.exe
  2⤵
  PID:8692
- C:\Windows\System\oCgnBCX.exe
  C:\Windows\System\oCgnBCX.exe
  2⤵
  PID:8172
- C:\Windows\System\OxDtltH.exe
  C:\Windows\System\OxDtltH.exe
  2⤵
  PID:13668
- C:\Windows\System\zukzpUn.exe
  C:\Windows\System\zukzpUn.exe
  2⤵
  PID:10280
- C:\Windows\System\nmgSLhd.exe
  C:\Windows\System\nmgSLhd.exe
  2⤵
  PID:7212
- C:\Windows\System\UaDxvTL.exe
  C:\Windows\System\UaDxvTL.exe
  2⤵
  PID:8884
- C:\Windows\System\eFTciTz.exe
  C:\Windows\System\eFTciTz.exe
  2⤵
  PID:8344
- C:\Windows\System\jPKGhlm.exe
  C:\Windows\System\jPKGhlm.exe
  2⤵
  PID:8972
- C:\Windows\System\OaxNCkE.exe
  C:\Windows\System\OaxNCkE.exe
  2⤵
  PID:8808
- C:\Windows\System\BaKfzKE.exe
  C:\Windows\System\BaKfzKE.exe
  2⤵
  PID:8524
- C:\Windows\System\lumwgmA.exe
  C:\Windows\System\lumwgmA.exe
  2⤵
  PID:14484
- C:\Windows\System\yDTWXYn.exe
  C:\Windows\System\yDTWXYn.exe
  2⤵
  PID:8444
- C:\Windows\System\CLIMAWo.exe
  C:\Windows\System\CLIMAWo.exe
  2⤵
  PID:14516
- C:\Windows\System\gWMjbjH.exe
  C:\Windows\System\gWMjbjH.exe
  2⤵
  PID:9580
- C:\Windows\System\gBwDcRH.exe
  C:\Windows\System\gBwDcRH.exe
  2⤵
  PID:14552
- C:\Windows\System\HPbgRSI.exe
  C:\Windows\System\HPbgRSI.exe
  2⤵
  PID:13568
- C:\Windows\System\xMwmaef.exe
  C:\Windows\System\xMwmaef.exe
  2⤵
  PID:14340
- C:\Windows\System\ccKyHRe.exe
  C:\Windows\System\ccKyHRe.exe
  2⤵
  PID:3680
- C:\Windows\System\PtrsWbm.exe
  C:\Windows\System\PtrsWbm.exe
  2⤵
  PID:4812
- C:\Windows\System\NGPgqzH.exe
  C:\Windows\System\NGPgqzH.exe
  2⤵
  PID:8568
- C:\Windows\System\FGJFRcc.exe
  C:\Windows\System\FGJFRcc.exe
  2⤵
  PID:8608
- C:\Windows\System\LjbFOsR.exe
  C:\Windows\System\LjbFOsR.exe
  2⤵
  PID:9744
- C:\Windows\System\wiNwrGT.exe
  C:\Windows\System\wiNwrGT.exe
  2⤵
  PID:7276
- C:\Windows\System\DSQdCrC.exe
  C:\Windows\System\DSQdCrC.exe
  2⤵
  PID:8944
- C:\Windows\System\FgPkMMU.exe
  C:\Windows\System\FgPkMMU.exe
  2⤵
  PID:10024
- C:\Windows\System\LNzfjXO.exe
  C:\Windows\System\LNzfjXO.exe
  2⤵
  PID:14500
- C:\Windows\System\sBsAWwb.exe
  C:\Windows\System\sBsAWwb.exe
  2⤵
  PID:9928
- C:\Windows\System\GCLULbW.exe
  C:\Windows\System\GCLULbW.exe
  2⤵
  PID:9300
- C:\Windows\System\axsYikm.exe
  C:\Windows\System\axsYikm.exe
  2⤵
  PID:14700
- C:\Windows\System\lJkxWWc.exe
  C:\Windows\System\lJkxWWc.exe
  2⤵
  PID:9732
- C:\Windows\System\DqOYAkg.exe
  C:\Windows\System\DqOYAkg.exe
  2⤵
  PID:14952
- C:\Windows\System\IxOgCCE.exe
  C:\Windows\System\IxOgCCE.exe
  2⤵
  PID:14988
- C:\Windows\System\ahpWTSX.exe
  C:\Windows\System\ahpWTSX.exe
  2⤵
  PID:14780
- C:\Windows\System\FzHZIwr.exe
  C:\Windows\System\FzHZIwr.exe
  2⤵
  PID:9276
- C:\Windows\System\ugYsckY.exe
  C:\Windows\System\ugYsckY.exe
  2⤵
  PID:15160
- C:\Windows\System\XROVixk.exe
  C:\Windows\System\XROVixk.exe
  2⤵
  PID:15188
- C:\Windows\System\guwwjgE.exe
  C:\Windows\System\guwwjgE.exe
  2⤵
  PID:15196
- C:\Windows\System\jZohmIZ.exe
  C:\Windows\System\jZohmIZ.exe
  2⤵
  PID:15224
- C:\Windows\System\yfVLcUI.exe
  C:\Windows\System\yfVLcUI.exe
  2⤵
  PID:9780
- C:\Windows\System\DOIcXls.exe
  C:\Windows\System\DOIcXls.exe
  2⤵
  PID:15156
- C:\Windows\System\DVnXJII.exe
  C:\Windows\System\DVnXJII.exe
  2⤵
  PID:2720
- C:\Windows\System\VoCWQQW.exe
  C:\Windows\System\VoCWQQW.exe
  2⤵
  PID:15168
- C:\Windows\System\OYNLoXU.exe
  C:\Windows\System\OYNLoXU.exe
  2⤵
  PID:15296
- C:\Windows\System\BQkqdVy.exe
  C:\Windows\System\BQkqdVy.exe
  2⤵
  PID:15332
- C:\Windows\System\XAYBuZR.exe
  C:\Windows\System\XAYBuZR.exe
  2⤵
  PID:9444
- C:\Windows\System\txqKSCc.exe
  C:\Windows\System\txqKSCc.exe
  2⤵
  PID:9936
- C:\Windows\System\DWOQOsM.exe
  C:\Windows\System\DWOQOsM.exe
  2⤵
  PID:7216
- C:\Windows\System\PzLwrww.exe
  C:\Windows\System\PzLwrww.exe
  2⤵
  PID:14384
- C:\Windows\System\aJRmDBx.exe
  C:\Windows\System\aJRmDBx.exe
  2⤵
  PID:8792
- C:\Windows\System\mtpBWLV.exe
  C:\Windows\System\mtpBWLV.exe
  2⤵
  PID:9932
- C:\Windows\System\SBrwRxt.exe
  C:\Windows\System\SBrwRxt.exe
  2⤵
  PID:9144
- C:\Windows\System\tmDiXlT.exe
  C:\Windows\System\tmDiXlT.exe
  2⤵
  PID:9512
- C:\Windows\System\qTJmscZ.exe
  C:\Windows\System\qTJmscZ.exe
  2⤵
  PID:14476
- C:\Windows\System\zZLoTQQ.exe
  C:\Windows\System\zZLoTQQ.exe
  2⤵
  PID:8912
- C:\Windows\System\QlfwQpU.exe
  C:\Windows\System\QlfwQpU.exe
  2⤵
  PID:14372
- C:\Windows\System\MKHkeQA.exe
  C:\Windows\System\MKHkeQA.exe
  2⤵
  PID:8556
- C:\Windows\System\XrrxwSJ.exe
  C:\Windows\System\XrrxwSJ.exe
  2⤵
  PID:7532
- C:\Windows\System\ryXFFHz.exe
  C:\Windows\System\ryXFFHz.exe
  2⤵
  PID:8256
- C:\Windows\System\tNmuivt.exe
  C:\Windows\System\tNmuivt.exe
  2⤵
  PID:8440
- C:\Windows\System\dJVqcFw.exe
  C:\Windows\System\dJVqcFw.exe
  2⤵
  PID:13600
- C:\Windows\System\hgHAfpq.exe
  C:\Windows\System\hgHAfpq.exe
  2⤵
  PID:8324
- C:\Windows\System\KsPSWQx.exe
  C:\Windows\System\KsPSWQx.exe
  2⤵
  PID:11100
- C:\Windows\System\LtvCwIK.exe
  C:\Windows\System\LtvCwIK.exe
  2⤵
  PID:8020
- C:\Windows\System\fqsSHcR.exe
  C:\Windows\System\fqsSHcR.exe
  2⤵
  PID:9700
- C:\Windows\System\kIoroaH.exe
  C:\Windows\System\kIoroaH.exe
  2⤵
  PID:1816
- C:\Windows\System\kuDfvSM.exe
  C:\Windows\System\kuDfvSM.exe
  2⤵
  PID:10032
- C:\Windows\System\hKWUuAE.exe
  C:\Windows\System\hKWUuAE.exe
  2⤵
  PID:9360
- C:\Windows\System\xVPmCyO.exe
  C:\Windows\System\xVPmCyO.exe
  2⤵
  PID:14536
- C:\Windows\System\KujNKub.exe
  C:\Windows\System\KujNKub.exe
  2⤵
  PID:10472
- C:\Windows\System\FzAjSHH.exe
  C:\Windows\System\FzAjSHH.exe
  2⤵
  PID:14696
- C:\Windows\System\YEnVkof.exe
  C:\Windows\System\YEnVkof.exe
  2⤵
  PID:10864
- C:\Windows\System\EbHwXOM.exe
  C:\Windows\System\EbHwXOM.exe
  2⤵
  PID:10692
- C:\Windows\System\KUFnyGN.exe
  C:\Windows\System\KUFnyGN.exe
  2⤵
  PID:14688
- C:\Windows\System\GQsRXkz.exe
  C:\Windows\System\GQsRXkz.exe
  2⤵
  PID:14788
- C:\Windows\System\tUZkDGH.exe
  C:\Windows\System\tUZkDGH.exe
  2⤵
  PID:11496
- C:\Windows\System\CRrgCMP.exe
  C:\Windows\System\CRrgCMP.exe
  2⤵
  PID:11192
- C:\Windows\System\ZeRVHlm.exe
  C:\Windows\System\ZeRVHlm.exe
  2⤵
  PID:11196
- C:\Windows\System\fokLInv.exe
  C:\Windows\System\fokLInv.exe
  2⤵
  PID:15064
- C:\Windows\System\GBIrlct.exe
  C:\Windows\System\GBIrlct.exe
  2⤵
  PID:10996
- C:\Windows\System\vEBHeUU.exe
  C:\Windows\System\vEBHeUU.exe
  2⤵
  PID:12028
- C:\Windows\System\euDBWbK.exe
  C:\Windows\System\euDBWbK.exe
  2⤵
  PID:14652
- C:\Windows\System\Cueqwep.exe
  C:\Windows\System\Cueqwep.exe
  2⤵
  PID:9972
- C:\Windows\System\HlXcZDg.exe
  C:\Windows\System\HlXcZDg.exe
  2⤵
  PID:4040
- C:\Windows\System\pKLhksj.exe
  C:\Windows\System\pKLhksj.exe
  2⤵
  PID:9412
- C:\Windows\System\QzxrJAX.exe
  C:\Windows\System\QzxrJAX.exe
  2⤵
  PID:15152
- C:\Windows\System\dwBJPTy.exe
  C:\Windows\System\dwBJPTy.exe
  2⤵
  PID:11384
- C:\Windows\System\HHAthQs.exe
  C:\Windows\System\HHAthQs.exe
  2⤵
  PID:4752
- C:\Windows\System\YClypTo.exe
  C:\Windows\System\YClypTo.exe
  2⤵
  PID:11572
- C:\Windows\System\YjcKDFc.exe
  C:\Windows\System\YjcKDFc.exe
  2⤵
  PID:9820
- C:\Windows\System\cvLaDbc.exe
  C:\Windows\System\cvLaDbc.exe
  2⤵
  PID:11780
- C:\Windows\System\FJHfSsf.exe
  C:\Windows\System\FJHfSsf.exe
  2⤵
  PID:11392
- C:\Windows\System\DjXziAB.exe
  C:\Windows\System\DjXziAB.exe
  2⤵
  PID:11684
- C:\Windows\System\bGHubkx.exe
  C:\Windows\System\bGHubkx.exe
  2⤵
  PID:9436
- C:\Windows\System\WgRMiCb.exe
  C:\Windows\System\WgRMiCb.exe
  2⤵
  PID:8260
- C:\Windows\System\RZhYSzu.exe
  C:\Windows\System\RZhYSzu.exe
  2⤵
  PID:12516
- C:\Windows\System\nmusqCD.exe
  C:\Windows\System\nmusqCD.exe
  2⤵
  PID:9356
- C:\Windows\System\mlmZzcC.exe
  C:\Windows\System\mlmZzcC.exe
  2⤵
  PID:10092
- C:\Windows\System\TCuUxAK.exe
  C:\Windows\System\TCuUxAK.exe
  2⤵
  PID:12600
- C:\Windows\System\CgLeLHC.exe
  C:\Windows\System\CgLeLHC.exe
  2⤵
  PID:11936
- C:\Windows\System\mWpCUmv.exe
  C:\Windows\System\mWpCUmv.exe
  2⤵
  PID:12252
- C:\Windows\System\fSCoeyF.exe
  C:\Windows\System\fSCoeyF.exe
  2⤵
  PID:11412
- C:\Windows\System\Uchaqbe.exe
  C:\Windows\System\Uchaqbe.exe
  2⤵
  PID:4260
- C:\Windows\System\boOYBui.exe
  C:\Windows\System\boOYBui.exe
  2⤵
  PID:8656
- C:\Windows\System\qRadMCU.exe
  C:\Windows\System\qRadMCU.exe
  2⤵
  PID:6256
- C:\Windows\System\PLsZFGo.exe
  C:\Windows\System\PLsZFGo.exe
  2⤵
  PID:10572
- C:\Windows\System\ujrINop.exe
  C:\Windows\System\ujrINop.exe
  2⤵
  PID:12652
- C:\Windows\System\mbSEsNj.exe
  C:\Windows\System\mbSEsNj.exe
  2⤵
  PID:7924
- C:\Windows\System\liewAFQ.exe
  C:\Windows\System\liewAFQ.exe
  2⤵
  PID:10336
- C:\Windows\System\IexdwAz.exe
  C:\Windows\System\IexdwAz.exe
  2⤵
  PID:8604
- C:\Windows\System\LDnSzbM.exe
  C:\Windows\System\LDnSzbM.exe
  2⤵
  PID:12336
- C:\Windows\System\CcCveBL.exe
  C:\Windows\System\CcCveBL.exe
  2⤵
  PID:8984
- C:\Windows\System\yZGYVzM.exe
  C:\Windows\System\yZGYVzM.exe
  2⤵
  PID:14648
- C:\Windows\System\ANvUAxJ.exe
  C:\Windows\System\ANvUAxJ.exe
  2⤵
  PID:9384
- C:\Windows\System\liVJxzR.exe
  C:\Windows\System\liVJxzR.exe
  2⤵
  PID:11148
- C:\Windows\System\UngnWAg.exe
  C:\Windows\System\UngnWAg.exe
  2⤵
  PID:9440
- C:\Windows\System\yrWpLMo.exe
  C:\Windows\System\yrWpLMo.exe
  2⤵
  PID:11272
- C:\Windows\System\tlStRpK.exe
  C:\Windows\System\tlStRpK.exe
  2⤵
  PID:14608
- C:\Windows\System\uXdWpdu.exe
  C:\Windows\System\uXdWpdu.exe
  2⤵
  PID:9072
- C:\Windows\System\FCYqizi.exe
  C:\Windows\System\FCYqizi.exe
  2⤵
  PID:13100
- C:\Windows\System\bhQoDEz.exe
  C:\Windows\System\bhQoDEz.exe
  2⤵
  PID:8168
- C:\Windows\System\FphiOAX.exe
  C:\Windows\System\FphiOAX.exe
  2⤵
  PID:9564
- C:\Windows\System\IkCZJdA.exe
  C:\Windows\System\IkCZJdA.exe
  2⤵
  PID:13048
- C:\Windows\System\OuYzHoI.exe
  C:\Windows\System\OuYzHoI.exe
  2⤵
  PID:9124
- C:\Windows\System\FuztUDN.exe
  C:\Windows\System\FuztUDN.exe
  2⤵
  PID:15140
- C:\Windows\System\kUFNbsm.exe
  C:\Windows\System\kUFNbsm.exe
  2⤵
  PID:13296
- C:\Windows\System\eSqmqgv.exe
  C:\Windows\System\eSqmqgv.exe
  2⤵
  PID:14732
- C:\Windows\System\tdZdQtQ.exe
  C:\Windows\System\tdZdQtQ.exe
  2⤵
  PID:15128
- C:\Windows\System\pfOTwND.exe
  C:\Windows\System\pfOTwND.exe
  2⤵
  PID:11600
- C:\Windows\System\VGVNmya.exe
  C:\Windows\System\VGVNmya.exe
  2⤵
  PID:11976
- C:\Windows\System\TPOZABk.exe
  C:\Windows\System\TPOZABk.exe
  2⤵
  PID:12220
- C:\Windows\System\PtOFYPc.exe
  C:\Windows\System\PtOFYPc.exe
  2⤵
  PID:10288
- C:\Windows\System\WEApyZi.exe
  C:\Windows\System\WEApyZi.exe
  2⤵
  PID:9784
- C:\Windows\System\QTDJaBf.exe
  C:\Windows\System\QTDJaBf.exe
  2⤵
  PID:11188
- C:\Windows\System\YsJJAMs.exe
  C:\Windows\System\YsJJAMs.exe
  2⤵
  PID:10708
- C:\Windows\System\ItGRZqL.exe
  C:\Windows\System\ItGRZqL.exe
  2⤵
  PID:12480
- C:\Windows\System\BIWVzaN.exe
  C:\Windows\System\BIWVzaN.exe
  2⤵
  PID:12392
- C:\Windows\System\dGTJVkD.exe
  C:\Windows\System\dGTJVkD.exe
  2⤵
  PID:7172
- C:\Windows\System\gIOlJdw.exe
  C:\Windows\System\gIOlJdw.exe
  2⤵
  PID:11120
- C:\Windows\System\iQtGLxA.exe
  C:\Windows\System\iQtGLxA.exe
  2⤵
  PID:7892
- C:\Windows\System\NmmeoEu.exe
  C:\Windows\System\NmmeoEu.exe
  2⤵
  PID:11220
- C:\Windows\System\YbWkjrS.exe
  C:\Windows\System\YbWkjrS.exe
  2⤵
  PID:11028
- C:\Windows\System\INesEUR.exe
  C:\Windows\System\INesEUR.exe
  2⤵
  PID:11320
- C:\Windows\System\KtDrngY.exe
  C:\Windows\System\KtDrngY.exe
  2⤵
  PID:13236

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10688

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fimct4k.dqk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeVJHcQ.exe

Filesize
2.2MB

MD5
7eaaa93e90ed9181ce12f1db53650d24

SHA1
fc0796199450e94daa38b5625ce2b1cc8a601e2d

SHA256
f3c87e5f44003e30532b10d3fa2846388e2c928a539b45fc5da0090c36b1c79b

SHA512
79538e3efcc0069925cae7c08cdb18d519cd43d3b2f1d72ab7db6298127aeee87673866fdb4748d06588b420d1bf9d1cdcbf12fb27ab347e808fbc2ccad14962

Download Submit
C:\Windows\System\DkjuSxa.exe

Filesize
2.2MB

MD5
9a14f6f5be9c12152c7c90d6a2c54828

SHA1
dbdc7cc40ead09ba1604c98c512fa6cbda046b27

SHA256
870b3ae1e8222db784ace55c0ea445ff24247cb675afc40972df8ce40e0f8d21

SHA512
6af6f3f928528578f583d352d4f1fecfc15ea7f6bf5fe28a1977e9dbb7bf61ad71e5f8844c8c5e1043cbc719b4a4d3b7731971e1e9234a8076edfe8ed0f4f520

Download Submit
C:\Windows\System\EQkIPeA.exe

Filesize
2.2MB

MD5
bed0a5ed5a8ffd480e444069f23fd432

SHA1
2b38ad6e71fc952c1822cfdeaf919fe5e6c496c9

SHA256
83e1ec1633d9749d8ea20e176b01ba2a92372ab9530b1f794a79fc42ef68a431

SHA512
0ef5095df7c4e3c2d7fa996a022fb125fedb56586a0e8e5fffc3a96b51a685f59075e01ef66f116cb75adb15900b844638b8d11b77a82ef87b8844512281b3ca

Download Submit
C:\Windows\System\FUULMxY.exe

Filesize
2.2MB

MD5
4ba54d13252cc17fdf3700c347c258d0

SHA1
861d9493323bf18dab3724d1f41a42ebd0020d06

SHA256
d1ea8673888540427fd65d38051719ac1a994e2218f99b0ed05bc396da1436ab

SHA512
5da2892d359a142baf813a4d8cff59069cdc88afb47745a3e8dccaca339071bbc1d1634dfb486c8e434154194a12c12a9424c06a9af2d3e0a253c258cf8a0481

Download Submit
C:\Windows\System\FhOXRip.exe

Filesize
2.2MB

MD5
0ec2d587b6da8f1ae92a2342c72e11d6

SHA1
dcb91daf2e2acc666578ff99170846e95fdd86da

SHA256
5d955f1861946ef0b6f21dc13aff7f446ab03dd26390f9277a061bbdee06b6f1

SHA512
550a5fb8f523c76bac62815a9a6f37fd8c3299e6a46cf6407c93897929cf96e91390c4c839e4c17881eafddefb9d7ad453912ba65f2f34288c1fa2f22492e51f

Download Submit
C:\Windows\System\HGkhOFl.exe

Filesize
2.2MB

MD5
9f47a0a0261e6068525605d01f42c5e4

SHA1
3bc3115e932b55ef7ac0d120d8de33f42e85f74f

SHA256
8830cf2443b0d1d64acfac2ffb00acb44c9393487aed91a71bd57c8822c559ea

SHA512
98df1557a60dac228131aff1376ce36147de74a5b1cfbfee7f583624c8fdba439c42551f2b36a9bd7caf9b09478014fb2cabb1512ab8c68bb4fbfec50a8470ef

Download Submit
C:\Windows\System\KQfHFkj.exe

Filesize
2.2MB

MD5
40437e7603727012fd3525ccb8104149

SHA1
cd9422ebad90da66f102ad7f89897ad14f99010b

SHA256
93c3f1d6192e833da9a7333512669c4693721e8fb8492fc2706aa8e1e6594e1f

SHA512
34d7fd6b764db3c5fe0182ef66e8871bad6d71a2b598a4f2027241372068a6507dc4fa3468522506ab4a22c34f49c85a013a100f10664c4aa5866bf9fdc67110

Download Submit
C:\Windows\System\KqTZMcp.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\System\LBlsyFH.exe

Filesize
2.2MB

MD5
f39fe3ae87be3cc1c4cbf33b03fc15c9

SHA1
68a06e352b4206ef446827826c194a0a1dffbe7a

SHA256
f8c37a3a0bd7bf5eee18e22217df6d00f0905f07bea41b0ebe501d63f491adb9

SHA512
a97acec45aaeeef5e69eaca220005d4236e733a482a26451413e9fec81608701724ad1cec8ad651cacd43af119968a9622905664ab7b0bf154fbb83d28abef75

Download Submit
C:\Windows\System\MWlxLgM.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\QbFVsrQ.exe

Filesize
2.2MB

MD5
cbad0af48dc8f463c3e21b9dba4cf03f

SHA1
676c7606aab9d4f2536226fbaee3db1836b3a175

SHA256
45a4aca363582efa0ab4b8601d21ed0d4cebaa8210a949dac0822e22da704fe9

SHA512
c307373057bd8611b99baae08072849ba684b24edf9560ce29e5abb571415cec83081eafd613d3d06c48ad61c37b7b96092df00ddf357ce4823dde58ad24b633

Download Submit
C:\Windows\System\RYFiIFC.exe

Filesize
2.2MB

MD5
b664db444bd04334465b78d3a6fa6f74

SHA1
c979e3f0f23afb5b7840dce0f94e196aecb7a19a

SHA256
d328477603e3c18f419bfbc76e2a70f4efdbd6a248a728c6a14e4d043f970b38

SHA512
ebb79f734e2ea6424f1e3fa5ae374d340e2229d8e5878824b0e62055bf9ee2e0788c7f399af03667890fb3f02014acaf51ac6117eee905c47d4632ed7ccc8d08

Download Submit
C:\Windows\System\TjmqrGa.exe

Filesize
2.2MB

MD5
e65e6dc46c69d9035be0dce52fc85123

SHA1
478b54aaf04b9cff9f42b48bc0eff22402b3f786

SHA256
d4f9d49913f60ae2ac93ca9930c288d52fc6bac4f96a471a948576692a8d4a15

SHA512
3477f919e296ab22e823180d60e82b9abc110a780d3acca5ed941155459c3e3e35100b8bb9e5cb2d77e77df9ccad3aecba07f00488002f2f11b33ed883ea57ed

Download Submit
C:\Windows\System\VzZpeJX.exe

Filesize
2.2MB

MD5
b14fc166d3da688df9f37d67bcc5dcdf

SHA1
7ac841163836ceaf335b47719f27793ed22869fe

SHA256
69acebb5a4c6aa66913c31f16104c1e30972a53fd5717fb6072602bf85b70fde

SHA512
429279b85e310ce34334442763d679f1074bcfe7aee7c4eab706680c3208f065ce27f53cec7e5efce02bb83cb8da48595d95d70d04335f36990ec48db06cb3be

Download Submit
C:\Windows\System\XJKfJCf.exe

Filesize
2.2MB

MD5
ce19339c44128f8b6b3cb8640659af51

SHA1
18452de3af00433f6ec30619d3cbc9306663e881

SHA256
61df7174e5eb7ec6ba626ccd9fce3adc1b78a2e55bb83dade084a7268df8bebc

SHA512
e57fba2d9fd4d1a235ec22a7e72d0d22a47cfabdc901faa6c368c281375a85d5f083a9feb248d1d158281ed57dbd4be8f64ea823c12448f4c945be86d59d8a15

Download Submit
C:\Windows\System\YcTkNnR.exe

Filesize
2.2MB

MD5
4941df05dc04a6b01e28edab02272223

SHA1
a02f38b9eb2b6e8faa801a778889c89f1f4e0161

SHA256
46a7041976c47fd8b28062d8b45a4d5a82c9116df365bf5637f908882156dacd

SHA512
0495cbd0c59a02dbbdc5733d8a1fd7c98a84afe59e33b0b536d3992704dde0eb578c40172d9957715b9ae5ff2e282e136a7ad061ad65c09aefef37469bfa2cbe

Download Submit
C:\Windows\System\bVpnLWe.exe

Filesize
2.2MB

MD5
2646bb0328da406c8f2e0808b0caa3b4

SHA1
129557577886ad286340c178537e421e3bad4ae1

SHA256
af897e59329e0ac6f77990934d6664d4109663f4fda498e0a90279043248aee4

SHA512
448809f65375047c0444eaf5c536226f4930025cc8fac266d66633fb7704dbbf23bb0d8c5a3be59474e191cf4a1cb611cc6bbd189432ae00de620ebdb47d0410

Download Submit
C:\Windows\System\dMKnJEB.exe

Filesize
2.2MB

MD5
dfc10fcd3b0bcd2ac30ee2c3819b6661

SHA1
5a3e44d3ca6570f52908e6f8b814f04773b198a5

SHA256
ffd2a53bd30ca7a15273c9e3c6c9a1ed58d478912da5bd83e49d60ebd4d5b0a9

SHA512
6176e4f5d2fbb1056ea7e5ac608b1982c993d7e38c0fffe7cdce54cf7742467d418f1372a9a80a12493b8637e4c0234fee22065ee5d9de973de4c7a298421fc8

Download Submit
C:\Windows\System\dQUeeHc.exe

Filesize
2.2MB

MD5
57a153a42bb9776eb8b70ac23503ce46

SHA1
c8e3001a2bc896aa70a25a6008ad15957059adfb

SHA256
d3d89c78e2c4497a739beca0da3a376812b145605ebc11457b7ac05005f435f0

SHA512
f75da68f21f515ce88910a1102dc218fd0c54d80a02365a28aeb1efaee43e82136db633bf996ca06a7b305ff1605d93a820aa7863e253c64f0c94e737fec55bd

Download Submit
C:\Windows\System\fCjAKRF.exe

Filesize
2.2MB

MD5
4cec2d4ab30d602d4ef5df9b82e830b2

SHA1
58574a782bbd1f3d89bd3197384532de2e0f9d34

SHA256
65a72fff9ffd3d301d78ebc0cd8f4a0665880e1e9454eebb97746737998fb490

SHA512
8a8e404d6c81f6f5038c29759bfa57a933af5484c47e82b13d541d1d01418a8bf35eee5d006e2263bf25a14980c17e377d1bd15290f617f48b5144d860d2b9b3

Download Submit
C:\Windows\System\fDAzMKk.exe

Filesize
2.2MB

MD5
9d30c462ab7fc869d6762a1fcd49c1f0

SHA1
6742b8e68c75c2fb783ba17e8789ab3746a12f3c

SHA256
d25084ece46e5eb7e5aed1f249487caff1450cde21f4c5926b5d997ffdc33541

SHA512
25ec63ea2a87400e013c0cf007b9627f3b7524fce807108160341edc73f0a580f4940c2d5084d0bc864b0b35e7ac6ee5874ce40dfaece2c02cc38f292f22c477

Download Submit
C:\Windows\System\fEAnxyg.exe

Filesize
2.2MB

MD5
5111494362884978c4f6fdf62d4fbfe5

SHA1
84cd0c79efd9ceb246ab944c2cfdfc8b7c4d05b4

SHA256
aeec51d99ac3a9f5a344f408cd99eaf43ab83117b8999ba6ab254bc5db99a56a

SHA512
a9c2bc4c558a26055222b4924153305dd0adf77654420cb75e3571bff2f0c7c43116b24cf56a865a8dafd7cf09d2e914230246e60e4b10c2438cf880d27da338

Download Submit
C:\Windows\System\ftnPDUQ.exe

Filesize
2.2MB

MD5
7dce8fdae0f5cc42032be86ed88c4039

SHA1
357eaf9cbe989372d0d8191cf276a9017c8671b8

SHA256
25646bb408b585642aa08573190f63ae4d2b0c910828e2c9e45815597bd2c1d3

SHA512
a1de3a5863a7f9d0bf30f1c243207728bc1d73c076922d444ac001a66d7156a805eb7d014fbcc3c7de0d175d9ba938afa0147c16df2c08f3fdb94df676495eb8

Download Submit
C:\Windows\System\gPuLYXT.exe

Filesize
2.2MB

MD5
6873b880810ccd1dc358208a878b8166

SHA1
c3b6dd2c9114f08431f3a39ab65326facb8721be

SHA256
71cfccbf8381d1efff2c3737ebab3dac94b9392f6038ae5d0bca4df78663d08a

SHA512
410320cdbc74a933869fd2ab9d0a0cba6dcf7645593a8f26677f118a73733ebd5eb04139622780d87122d7e86d09d95b704142fcf4dd355fb67ca46726499897

Download Submit
C:\Windows\System\hiCwSSz.exe

Filesize
2.2MB

MD5
9c95d531b6bcc76f7a1bc9714e6ffa30

SHA1
9d21cfcc235aed8ba14f5f4cccf3103e2f1f9f49

SHA256
771f464a17808e7cce2dabe28e10de8e26722a1b51387743e25023cafe667c9d

SHA512
4f87dd48c91f7a31fe5e32617f84b36ba435cb39e98fd76e8de6e8e99e9009fcb311b9571025e9085d519a47a98d64218c5ced6c56f4013999cf5f4c42cdc138

Download Submit
C:\Windows\System\mBobhjQ.exe

Filesize
2.2MB

MD5
e693056eb95f1a2dda69717094c8566c

SHA1
6de3de8222b6b6b7eb3556963efae478459b7a1d

SHA256
999fe7a64500be156cd96af1654b744a6dd41a31e1d87829c36bb378195936b5

SHA512
39db1aa274b1ad5a8424298581e7eba2109b12ee7a8f6c8139b520fffc19524333774ef217ed5f7f1a2e725d2c3fc2e52d03457df685639d7edc3537ed26ef42

Download Submit
C:\Windows\System\nvhWLmf.exe

Filesize
2.2MB

MD5
21f8682bd0cc021b35bce82c4e11a177

SHA1
1a6a1aa6e36e029b05de95974fc81d576773b3ed

SHA256
c992c1c29ed890346736ec31f72874946ec7ebf0750d424a258dccb2dc89fc0d

SHA512
3aebff7383345a87a425cdc0cbff46fc279ba64a6e7003f78e1949679b5eaa5437a5698615a3926d11e12dfda0ad5fba31a6dc878590935c8cb781f36afe670f

Download Submit
C:\Windows\System\owPuFyL.exe

Filesize
2.2MB

MD5
f32013a8bca12e30b74a8b7b3d9099a7

SHA1
b3fc793062417689b2a4867f5100c6b6d17ae30b

SHA256
7f6d73903b2e5612f96a45c021f7519813ea12c1d98afaddd06e877193656116

SHA512
342c134bd4874146b1efa481438bc6138c046f54c90678a5397a0a9983f7df9ddd8bb375ace23ab19721d906c314fc96ea81d076f0f116f52b16a8c11b1974ce

Download Submit
C:\Windows\System\qkyBEzQ.exe

Filesize
2.2MB

MD5
a19b1b31669d8525fc9ed290caf74d38

SHA1
997c292ef94045f496a51093f00b38decc30db22

SHA256
ae8ec4309ce683e0a03a919b4121e0128536bb0ea17313fd07d0fbbac07b3697

SHA512
ce655aa60fed226304efb07458d41f21ff500f2970e8bcc00787661d80e6d1da4626c9fe026e209d4d7b30b8b2b249ab3082e6419f747b258752848037f90dcc

Download Submit
C:\Windows\System\sCTgIXO.exe

Filesize
2.2MB

MD5
2946f14420dae0b0773449fd6a82051d

SHA1
83947e9a083300ad9658381917324d2cb21d9fa0

SHA256
b788b726f76842045fba45253748446cbce9c7b6e40b8d1b4edff7a522e0e1c7

SHA512
9c9d98bfacf76a6b88ccc7e186e030759baa3cf56f274f919006a351708cfee537f2017d43888be68b338398330d94ea60f4ef407bc778ce6fbbe153a16475fc

Download Submit
C:\Windows\System\sJDMgSL.exe

Filesize
2.2MB

MD5
d52cc9b830a92b7ce8429e7d802be7f3

SHA1
b641039f12fe661d25fae5be1b551d42d2b44753

SHA256
8efc691bc6ff5a77fecf5d0db0bc342c98f647aac04e7d15b5d06ac023b67a2f

SHA512
0d85fdee9503e9a7468b6313eae3318f84d2b9f6a330ad9e0c26f4a049e16d4fcf1e99eeacb00f7d0563353333c762ab6609f83886d5a23edc403b9dd0dcaeba

Download Submit
C:\Windows\System\tnCNGyc.exe

Filesize
2.2MB

MD5
2b8bc8cb0a6b464b772faab795212ef4

SHA1
7d56adfd6dc0fd3890dbd36dbb047630b09857f0

SHA256
56cc86d3d8d3d4ecdbb1b287a6200cd2b923a15bd9c161e471d63a97215d19ac

SHA512
9adb684516d238beb54186d5b175a84ad5499d99db728dd7c8bb0d4ee35f70b6b742523d9e6dd87d85b620ff22009a3cb9ddf5e6200489f98dfdbea3d2e6e2d3

Download Submit
C:\Windows\System\vCmssrP.exe

Filesize
2.2MB

MD5
647bbf10e0dc70085c9f94e357139622

SHA1
68a32cd3556b0634bc4ac4da2e659e5af41333f4

SHA256
4512887f67676c60b56a727392ad6902f9341e6877139dd55bdb5268856eeebb

SHA512
19b6b547ee1c3ef8621accf4204d4b6004e8873de297cad2f02f449d1fd3cb16b6ba82a0546f3368ef23f1f45200094fc566c3fb848b7c52902763e18b326fc3

Download Submit
C:\Windows\System\vNAJZUs.exe

Filesize
2.2MB

MD5
bcd68c9a9de7a8967dca409af58d8507

SHA1
f3b37a7417a79276a8b968add87bbcce815addc0

SHA256
04939e29c68365b4756b5e66d344b6ae7e99d90b9fb8c5a0737c2640eef8ac9c

SHA512
0d6a8b45b284410cf78b1c5c78a976d96ebb3c845aa513dd6811639c1f2f32632cf919fa1c5889eb12c97ed6991b3d5f97fb18145cdef2032cb834697772017b

Download Submit
C:\Windows\System\vpzhiMm.exe

Filesize
2.2MB

MD5
b69ef4ace84d9d848f0fc3fbd8deefa8

SHA1
63b905d517dce5491c3450c071f552f17f2506ca

SHA256
b78921b0870cbc5da450df65426ef1a9019c406c32fc27c18578112779ac5468

SHA512
7210a42c51835d358370ef0952511afefd6452806e205cc3f6c455d9580aeff5ab40b6d600d2e93ebda7b3fc30151dcda5202e2f3674498caf69fc2449692cb1

Download Submit
C:\Windows\System\wbQoYOC.exe

Filesize
2.2MB

MD5
9c3cd610fd4b3b0e9e2b6eb5ad531aa7

SHA1
e950a49036188bf7ec613afd7be03bf38df5a0f8

SHA256
d3cfcc460db521517051a8b7eaffe0de581be9c7e76a63d6b1149592a9a6d5cb

SHA512
db52f6fb6d4b1ebed6dbd8d36e2788e3a8dc83b9a99ff21837645dba5794483d32f4c81973cf41ef59892a1099035614b7c4247528fe5b28fb84b7d49bb593b2

Download Submit
C:\Windows\System\xDDtVra.exe

Filesize
2.2MB

MD5
b79848c8578fe8b635f894b087014b3e

SHA1
df633232a399286a1d941d6dbd7d12e985504a19

SHA256
39546e9cf4f133a66979377a3665e6ec7227614cce397e527fccee51ced9d2c0

SHA512
c47d444da318935db17e1d96a7285140b273a33e9bc9a228abd1098b684c9cb5c369f1a946d01d5011d759de97b750577e0f00a5b8fb6798f917f7243857b038

Download Submit
C:\Windows\System\xJudcQF.exe

Filesize
2.2MB

MD5
04496832998729868fd98c3f61b198bd

SHA1
1d8fb61c58718f0091552ea826e131790871698e

SHA256
812e43dec7bd82f522f000116e7e3f003e400f7479e2300ace14d62c22b28461

SHA512
86858a9eba3d1721cfb73fd5bcb929bc087781ab8211c9ceb011be38de06b88126e5f07e9c98661fa0a67f3477e35f576572d9c9b7ff82b2d1e57b9355bedfc5

Download Submit
C:\Windows\System\xVrQhIg.exe

Filesize
2.2MB

MD5
59da994d9d36759e6f55a847f361530f

SHA1
7a1c2599cc1a1b74427b702bc472c3f3827ab06b

SHA256
423007d2d17ed7559d85f340d68ce67eb87c4402b179fdc31c03813488d168f5

SHA512
93afa389ce4fbddb24e1b212807306e7a538dc95a1974a936525474c441ef0696ee91c09ecb7df5bf1258aa5260a25bc000dd504cd6f9633bd21d26109a87a65

Download Submit
memory/460-149-0x00007FFFCCFE0000-0x00007FFFCDAA1000-memory.dmp

Filesize
10.8MB

Download
memory/460-96-0x00007FFFCCFE0000-0x00007FFFCDAA1000-memory.dmp

Filesize
10.8MB

Download
memory/460-210-0x0000021BF2270000-0x0000021BF2292000-memory.dmp

Filesize
136KB

Download
memory/460-535-0x0000021BF33A0000-0x0000021BF3B46000-memory.dmp

Filesize
7.6MB

Download
memory/460-45-0x00007FFFCCFE3000-0x00007FFFCCFE5000-memory.dmp

Filesize
8KB

Download
memory/772-382-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp

Filesize
3.9MB

Download
memory/772-4243-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp

Filesize
3.9MB

Download
memory/884-220-0x00007FF733030000-0x00007FF733422000-memory.dmp

Filesize
3.9MB

Download
memory/884-4297-0x00007FF733030000-0x00007FF733422000-memory.dmp

Filesize
3.9MB

Download
memory/1128-4255-0x00007FF6004C0000-0x00007FF6008B2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-187-0x00007FF6004C0000-0x00007FF6008B2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-4290-0x00007FF704920000-0x00007FF704D12000-memory.dmp

Filesize
3.9MB

Download
memory/1236-244-0x00007FF704920000-0x00007FF704D12000-memory.dmp

Filesize
3.9MB

Download
memory/1436-4257-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp

Filesize
3.9MB

Download
memory/1436-384-0x00007FF7E0110000-0x00007FF7E0502000-memory.dmp

Filesize
3.9MB

Download
memory/1496-34-0x00007FF7D33C0000-0x00007FF7D37B2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-4277-0x00007FF7D33C0000-0x00007FF7D37B2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-345-0x00007FF6A7880000-0x00007FF6A7C72000-memory.dmp

Filesize
3.9MB

Download
memory/1628-4304-0x00007FF6A7880000-0x00007FF6A7C72000-memory.dmp

Filesize
3.9MB

Download
memory/1760-4313-0x00007FF663470000-0x00007FF663862000-memory.dmp

Filesize
3.9MB

Download
memory/1760-271-0x00007FF663470000-0x00007FF663862000-memory.dmp

Filesize
3.9MB

Download
memory/1844-4324-0x00007FF7D7540000-0x00007FF7D7932000-memory.dmp

Filesize
3.9MB

Download
memory/1844-381-0x00007FF7D7540000-0x00007FF7D7932000-memory.dmp

Filesize
3.9MB

Download
memory/1936-197-0x00007FF63E9F0000-0x00007FF63EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-4320-0x00007FF63E9F0000-0x00007FF63EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-20-0x00007FF781BE0000-0x00007FF781FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4317-0x00007FF6DA530000-0x00007FF6DA922000-memory.dmp

Filesize
3.9MB

Download
memory/2428-288-0x00007FF6DA530000-0x00007FF6DA922000-memory.dmp

Filesize
3.9MB

Download
memory/2464-4286-0x00007FF745500000-0x00007FF7458F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-234-0x00007FF745500000-0x00007FF7458F2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-4250-0x00007FF7B61E0000-0x00007FF7B65D2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-44-0x00007FF7B61E0000-0x00007FF7B65D2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-4307-0x00007FF70F010000-0x00007FF70F402000-memory.dmp

Filesize
3.9MB

Download
memory/3048-272-0x00007FF70F010000-0x00007FF70F402000-memory.dmp

Filesize
3.9MB

Download
memory/3124-4246-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-30-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-344-0x00007FF6D2380000-0x00007FF6D2772000-memory.dmp

Filesize
3.9MB

Download
memory/3236-4294-0x00007FF6D2380000-0x00007FF6D2772000-memory.dmp

Filesize
3.9MB

Download
memory/3276-4344-0x00007FF6352E0000-0x00007FF6356D2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-262-0x00007FF6352E0000-0x00007FF6356D2000-memory.dmp

Filesize
3.9MB

Download
memory/3796-4272-0x00007FF7E8320000-0x00007FF7E8712000-memory.dmp

Filesize
3.9MB

Download
memory/3796-270-0x00007FF7E8320000-0x00007FF7E8712000-memory.dmp

Filesize
3.9MB

Download
memory/3832-4299-0x00007FF78A1E0000-0x00007FF78A5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-162-0x00007FF78A1E0000-0x00007FF78A5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-383-0x00007FF637F80000-0x00007FF638372000-memory.dmp

Filesize
3.9MB

Download
memory/4704-285-0x00007FF703A50000-0x00007FF703E42000-memory.dmp

Filesize
3.9MB

Download
memory/4704-4311-0x00007FF703A50000-0x00007FF703E42000-memory.dmp

Filesize
3.9MB

Download
memory/4772-0-0x00007FF69E760000-0x00007FF69EB52000-memory.dmp

Filesize
3.9MB

Download
memory/4772-5310-0x00007FF69E760000-0x00007FF69EB52000-memory.dmp

Filesize
3.9MB

Download
memory/4772-1-0x000002E95B110000-0x000002E95B120000-memory.dmp

Filesize
64KB

Download
memory/4816-379-0x00007FF631380000-0x00007FF631772000-memory.dmp

Filesize
3.9MB

Download
memory/5048-4265-0x00007FF7913C0000-0x00007FF7917B2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-385-0x00007FF7913C0000-0x00007FF7917B2000-memory.dmp

Filesize
3.9MB

Download