xmrig | ac63bb8cfb8b90a6bbdf1ccb42bf4930d2cf4fff088002f80e1fb62debf93ec3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Size

2.9MB
MD5

3d1b47880d95a91e8f6aa23b092e35ee
SHA1

13490fb6f8450179043f7865492a9bf44aeb3a16
SHA256

ac63bb8cfb8b90a6bbdf1ccb42bf4930d2cf4fff088002f80e1fb62debf93ec3
SHA512

3c5b4d01dfcc02bf3cfb6b536cd8006e75e561d93e04446fe65a4cb238d3998deaaf3305e11499fc52619a5df181861a981fdfa8be51571beb38035ec21db55c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/49Mw:NABJ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/116-87-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	xmrig
behavioral2/memory/872-92-0x00007FF66DED0000-0x00007FF66E2C2000-memory.dmp	xmrig
behavioral2/memory/1080-93-0x00007FF6130C0000-0x00007FF6134B2000-memory.dmp	xmrig
behavioral2/memory/4232-91-0x00007FF712030000-0x00007FF712422000-memory.dmp	xmrig
behavioral2/memory/4824-88-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp	xmrig
behavioral2/memory/1848-86-0x00007FF71E6E0000-0x00007FF71EAD2000-memory.dmp	xmrig
behavioral2/memory/3508-85-0x00007FF7BABD0000-0x00007FF7BAFC2000-memory.dmp	xmrig
behavioral2/memory/828-72-0x00007FF660870000-0x00007FF660C62000-memory.dmp	xmrig
behavioral2/memory/3240-67-0x00007FF615F60000-0x00007FF616352000-memory.dmp	xmrig
behavioral2/memory/2400-64-0x00007FF7EE080000-0x00007FF7EE472000-memory.dmp	xmrig
behavioral2/memory/4224-100-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp	xmrig
behavioral2/memory/3368-116-0x00007FF7C50C0000-0x00007FF7C54B2000-memory.dmp	xmrig
behavioral2/memory/1208-119-0x00007FF621130000-0x00007FF621522000-memory.dmp	xmrig
behavioral2/memory/1444-125-0x00007FF732C90000-0x00007FF733082000-memory.dmp	xmrig
behavioral2/memory/2868-132-0x00007FF7EB5D0000-0x00007FF7EB9C2000-memory.dmp	xmrig
behavioral2/memory/1620-140-0x00007FF6481A0000-0x00007FF648592000-memory.dmp	xmrig
behavioral2/memory/628-164-0x00007FF652660000-0x00007FF652A52000-memory.dmp	xmrig
behavioral2/memory/1868-162-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp	xmrig
behavioral2/memory/3888-154-0x00007FF6FC890000-0x00007FF6FCC82000-memory.dmp	xmrig
behavioral2/memory/4592-141-0x00007FF67F460000-0x00007FF67F852000-memory.dmp	xmrig
behavioral2/memory/2328-133-0x00007FF7DD210000-0x00007FF7DD602000-memory.dmp	xmrig
behavioral2/memory/4224-1246-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp	xmrig
behavioral2/memory/2064-2579-0x00007FF695160000-0x00007FF695552000-memory.dmp	xmrig
behavioral2/memory/3784-2586-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	xmrig
behavioral2/memory/2704-2588-0x00007FF650340000-0x00007FF650732000-memory.dmp	xmrig
behavioral2/memory/1620-2608-0x00007FF6481A0000-0x00007FF648592000-memory.dmp	xmrig
behavioral2/memory/3508-2614-0x00007FF7BABD0000-0x00007FF7BAFC2000-memory.dmp	xmrig
behavioral2/memory/1848-2626-0x00007FF71E6E0000-0x00007FF71EAD2000-memory.dmp	xmrig
behavioral2/memory/4592-2622-0x00007FF67F460000-0x00007FF67F852000-memory.dmp	xmrig
behavioral2/memory/2400-2630-0x00007FF7EE080000-0x00007FF7EE472000-memory.dmp	xmrig
behavioral2/memory/3240-2638-0x00007FF615F60000-0x00007FF616352000-memory.dmp	xmrig
behavioral2/memory/828-2642-0x00007FF660870000-0x00007FF660C62000-memory.dmp	xmrig
behavioral2/memory/116-2650-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	xmrig
behavioral2/memory/1868-2669-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp	xmrig
behavioral2/memory/4824-2672-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp	xmrig
behavioral2/memory/4232-2676-0x00007FF712030000-0x00007FF712422000-memory.dmp	xmrig
behavioral2/memory/1080-2686-0x00007FF6130C0000-0x00007FF6134B2000-memory.dmp	xmrig
behavioral2/memory/872-2665-0x00007FF66DED0000-0x00007FF66E2C2000-memory.dmp	xmrig
behavioral2/memory/4224-2821-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp	xmrig
behavioral2/memory/3368-2835-0x00007FF7C50C0000-0x00007FF7C54B2000-memory.dmp	xmrig
behavioral2/memory/1208-2839-0x00007FF621130000-0x00007FF621522000-memory.dmp	xmrig
behavioral2/memory/716-2831-0x00007FF67D790000-0x00007FF67DB82000-memory.dmp	xmrig
behavioral2/memory/1444-2844-0x00007FF732C90000-0x00007FF733082000-memory.dmp	xmrig
behavioral2/memory/2868-2897-0x00007FF7EB5D0000-0x00007FF7EB9C2000-memory.dmp	xmrig
behavioral2/memory/2064-2909-0x00007FF695160000-0x00007FF695552000-memory.dmp	xmrig
behavioral2/memory/3888-2915-0x00007FF6FC890000-0x00007FF6FCC82000-memory.dmp	xmrig
behavioral2/memory/3784-2919-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	xmrig
behavioral2/memory/628-2923-0x00007FF652660000-0x00007FF652A52000-memory.dmp	xmrig
behavioral2/memory/2704-2927-0x00007FF650340000-0x00007FF650732000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	5104	powershell.exe
10	5104	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1620	WcUbedR.exe
4592	yZKWSBr.exe
3508	AxQliqv.exe
1848	txOGFmx.exe
2400	LcwIHGl.exe
3240	gKOnWaY.exe
828	yTHgYhI.exe
116	AUgMZzk.exe
1868	gmqdUkt.exe
4824	iMfunoS.exe
4232	oeiATyr.exe
872	ngdqIyo.exe
1080	hugkoPk.exe
4224	IPUMBmB.exe
716	xAgurre.exe
3368	uiZOzSN.exe
1208	xgqCeVw.exe
1444	rgSitti.exe
2868	TTPCWGw.exe
2064	wnZysYW.exe
3888	IaRNyuo.exe
3784	PBVEGRx.exe
628	EUefcaq.exe
2704	CVWXVnV.exe
1488	ngiWKVz.exe
5032	pUZDkgk.exe
3840	NwkzJuf.exe
4236	fHeaWQo.exe
3996	ohLrnBw.exe
4952	eYcMshC.exe
2140	YoJrvwW.exe
4604	yPVnIuM.exe
3696	ZaACfQl.exe
4460	BLpIMkD.exe
4524	KMLQuKK.exe
2476	GGHZFoj.exe
5064	xqYkfIh.exe
3160	ZmXFqHL.exe
1836	ImImXkI.exe
2876	gTpCpeQ.exe
3724	HPXjMGO.exe
2524	QwGOBiA.exe
2792	XKeSdAh.exe
4472	PfjcldK.exe
3404	hDBOHWe.exe
3348	aSvAqRu.exe
4116	MtshLbl.exe
1952	cXCEWrk.exe
3568	Ugdgxrm.exe
1544	QZrZWxs.exe
220	UmSHzTi.exe
3312	iumsDuf.exe
2464	COdFDEE.exe
3760	QbcdTZa.exe
636	sKscvZf.exe
4352	XwhWxZX.exe
1124	dKKdRgm.exe
2108	pOLHyJR.exe
4048	qmTNfbn.exe
5036	jmGRFRB.exe
1680	itCKREZ.exe
1148	OGTLwsw.exe
2196	nbLAdrn.exe
3252	zzjOAHT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2328-0-0x00007FF7DD210000-0x00007FF7DD602000-memory.dmp	upx
behavioral2/files/0x000b0000000233c3-5.dat	upx
behavioral2/files/0x0007000000023404-14.dat	upx
behavioral2/files/0x0008000000023400-21.dat	upx
behavioral2/files/0x0007000000023406-25.dat	upx
behavioral2/files/0x0007000000023405-27.dat	upx
behavioral2/files/0x0007000000023407-33.dat	upx
behavioral2/memory/4592-19-0x00007FF67F460000-0x00007FF67F852000-memory.dmp	upx
behavioral2/memory/1620-9-0x00007FF6481A0000-0x00007FF648592000-memory.dmp	upx
behavioral2/files/0x0007000000023408-36.dat	upx
behavioral2/files/0x0007000000023409-45.dat	upx
behavioral2/files/0x000700000002340e-71.dat	upx
behavioral2/files/0x000700000002340b-75.dat	upx
behavioral2/files/0x000700000002340f-84.dat	upx
behavioral2/memory/116-87-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	upx
behavioral2/memory/872-92-0x00007FF66DED0000-0x00007FF66E2C2000-memory.dmp	upx
behavioral2/memory/1080-93-0x00007FF6130C0000-0x00007FF6134B2000-memory.dmp	upx
behavioral2/memory/4232-91-0x00007FF712030000-0x00007FF712422000-memory.dmp	upx
behavioral2/memory/4824-88-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp	upx
behavioral2/memory/1848-86-0x00007FF71E6E0000-0x00007FF71EAD2000-memory.dmp	upx
behavioral2/memory/3508-85-0x00007FF7BABD0000-0x00007FF7BAFC2000-memory.dmp	upx
behavioral2/memory/1868-79-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp	upx
behavioral2/files/0x000800000002340d-74.dat	upx
behavioral2/memory/828-72-0x00007FF660870000-0x00007FF660C62000-memory.dmp	upx
behavioral2/files/0x000700000002340a-70.dat	upx
behavioral2/memory/3240-67-0x00007FF615F60000-0x00007FF616352000-memory.dmp	upx
behavioral2/memory/2400-64-0x00007FF7EE080000-0x00007FF7EE472000-memory.dmp	upx
behavioral2/files/0x000800000002340c-97.dat	upx
behavioral2/memory/4224-100-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp	upx
behavioral2/files/0x0008000000023401-104.dat	upx
behavioral2/files/0x0007000000023411-110.dat	upx
behavioral2/memory/3368-116-0x00007FF7C50C0000-0x00007FF7C54B2000-memory.dmp	upx
behavioral2/files/0x0007000000023412-121.dat	upx
behavioral2/memory/1208-119-0x00007FF621130000-0x00007FF621522000-memory.dmp	upx
behavioral2/files/0x0007000000023410-111.dat	upx
behavioral2/memory/716-103-0x00007FF67D790000-0x00007FF67DB82000-memory.dmp	upx
behavioral2/memory/1444-125-0x00007FF732C90000-0x00007FF733082000-memory.dmp	upx
behavioral2/memory/2868-132-0x00007FF7EB5D0000-0x00007FF7EB9C2000-memory.dmp	upx
behavioral2/files/0x0007000000023415-138.dat	upx
behavioral2/files/0x0007000000023414-137.dat	upx
behavioral2/memory/1620-140-0x00007FF6481A0000-0x00007FF648592000-memory.dmp	upx
behavioral2/files/0x0007000000023416-145.dat	upx
behavioral2/files/0x0007000000023419-153.dat	upx
behavioral2/files/0x0007000000023417-157.dat	upx
behavioral2/files/0x000700000002341b-169.dat	upx
behavioral2/files/0x000700000002341a-171.dat	upx
behavioral2/files/0x000700000002341d-182.dat	upx
behavioral2/files/0x000700000002341e-190.dat	upx
behavioral2/files/0x000700000002341f-198.dat	upx
behavioral2/files/0x0007000000023422-205.dat	upx
behavioral2/files/0x0007000000023420-203.dat	upx
behavioral2/files/0x0007000000023421-200.dat	upx
behavioral2/files/0x000700000002341c-178.dat	upx
behavioral2/memory/2704-170-0x00007FF650340000-0x00007FF650732000-memory.dmp	upx
behavioral2/memory/628-164-0x00007FF652660000-0x00007FF652A52000-memory.dmp	upx
behavioral2/memory/1868-162-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp	upx
behavioral2/memory/3784-161-0x00007FF645A30000-0x00007FF645E22000-memory.dmp	upx
behavioral2/memory/3888-154-0x00007FF6FC890000-0x00007FF6FCC82000-memory.dmp	upx
behavioral2/memory/4592-141-0x00007FF67F460000-0x00007FF67F852000-memory.dmp	upx
behavioral2/memory/2064-136-0x00007FF695160000-0x00007FF695552000-memory.dmp	upx
behavioral2/memory/2328-133-0x00007FF7DD210000-0x00007FF7DD602000-memory.dmp	upx
behavioral2/files/0x0007000000023413-127.dat	upx
behavioral2/memory/4224-1246-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp	upx
behavioral2/memory/2064-2579-0x00007FF695160000-0x00007FF695552000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xUlKnyS.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fFGsEEH.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\dIpmMUX.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ImImXkI.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\jVsaVjB.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\AFvdwMz.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\SfcTOvW.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ilHInxO.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\jvpbZQA.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\tCvskMl.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\GloGqAQ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\WBSYEVG.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\LFdcxvL.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vpSBWSS.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\OLOZsdq.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\zazZBdR.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\VOCkjAG.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\NbCyqMi.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\qhVurCz.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vYMCJKI.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\rkJsyAs.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\idIkRDI.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ziCVcEy.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fMYflXU.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\gcUvosg.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\SsWHocZ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\BmwbCGZ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\sYdnYgi.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ZzxSeGg.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\HilbQJo.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vqQLEDx.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\kHMMODn.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QNuqsOk.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\lPfuDpz.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\eAimTyg.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vAOYzaM.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\bRJwodc.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ghFrWCY.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\cGAMNhv.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\hTLnEWc.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ukulVVW.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\HjHoKQr.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\GCKDYZp.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\czChFgA.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\itisfev.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fkwupob.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\DMFLqKh.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\mYDfAvr.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QPkiIvL.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ybSdaae.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\gsbBJFG.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\RHQTmZp.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vEQLuDy.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\mzhrrVS.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\Fbubpzj.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\dXEnzYO.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\kKvnkWH.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\CqgSrCK.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\eUEPQiz.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PRjoXfO.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ZaPcYeC.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\rfFBiID.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\AczqWZc.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\WHSOzgv.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Token: SeDebugPrivilege	5104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 5104	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	84
PID 2328 wrote to memory of 5104	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	84
PID 2328 wrote to memory of 1620	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	85
PID 2328 wrote to memory of 1620	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	85
PID 2328 wrote to memory of 4592	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	86
PID 2328 wrote to memory of 4592	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	86
PID 2328 wrote to memory of 3508	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	87
PID 2328 wrote to memory of 3508	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	87
PID 2328 wrote to memory of 1848	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	88
PID 2328 wrote to memory of 1848	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	88
PID 2328 wrote to memory of 2400	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	89
PID 2328 wrote to memory of 2400	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	89
PID 2328 wrote to memory of 3240	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	90
PID 2328 wrote to memory of 3240	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	90
PID 2328 wrote to memory of 828	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	91
PID 2328 wrote to memory of 828	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	91
PID 2328 wrote to memory of 116	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	92
PID 2328 wrote to memory of 116	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	92
PID 2328 wrote to memory of 1868	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	93
PID 2328 wrote to memory of 1868	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	93
PID 2328 wrote to memory of 4824	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	94
PID 2328 wrote to memory of 4824	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	94
PID 2328 wrote to memory of 4232	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	95
PID 2328 wrote to memory of 4232	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	95
PID 2328 wrote to memory of 872	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	96
PID 2328 wrote to memory of 872	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	96
PID 2328 wrote to memory of 1080	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	97
PID 2328 wrote to memory of 1080	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	97
PID 2328 wrote to memory of 4224	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	98
PID 2328 wrote to memory of 4224	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	98
PID 2328 wrote to memory of 716	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	99
PID 2328 wrote to memory of 716	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	99
PID 2328 wrote to memory of 3368	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	100
PID 2328 wrote to memory of 3368	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	100
PID 2328 wrote to memory of 1208	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	101
PID 2328 wrote to memory of 1208	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	101
PID 2328 wrote to memory of 1444	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	102
PID 2328 wrote to memory of 1444	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	102
PID 2328 wrote to memory of 2868	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	103
PID 2328 wrote to memory of 2868	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	103
PID 2328 wrote to memory of 2064	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	104
PID 2328 wrote to memory of 2064	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	104
PID 2328 wrote to memory of 3888	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	105
PID 2328 wrote to memory of 3888	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	105
PID 2328 wrote to memory of 3784	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	106
PID 2328 wrote to memory of 3784	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	106
PID 2328 wrote to memory of 628	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	107
PID 2328 wrote to memory of 628	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	107
PID 2328 wrote to memory of 2704	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	108
PID 2328 wrote to memory of 2704	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	108
PID 2328 wrote to memory of 1488	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	109
PID 2328 wrote to memory of 1488	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	109
PID 2328 wrote to memory of 5032	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	110
PID 2328 wrote to memory of 5032	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	110
PID 2328 wrote to memory of 3840	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	111
PID 2328 wrote to memory of 3840	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	111
PID 2328 wrote to memory of 4236	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	112
PID 2328 wrote to memory of 4236	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	112
PID 2328 wrote to memory of 3996	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	113
PID 2328 wrote to memory of 3996	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	113
PID 2328 wrote to memory of 4952	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	114
PID 2328 wrote to memory of 4952	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	114
PID 2328 wrote to memory of 2140	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	115
PID 2328 wrote to memory of 2140	2328	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5104" "2924" "2864" "2928" "0" "0" "2932" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13404
- C:\Windows\System\WcUbedR.exe
  C:\Windows\System\WcUbedR.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\yZKWSBr.exe
  C:\Windows\System\yZKWSBr.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\AxQliqv.exe
  C:\Windows\System\AxQliqv.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\txOGFmx.exe
  C:\Windows\System\txOGFmx.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\LcwIHGl.exe
  C:\Windows\System\LcwIHGl.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\gKOnWaY.exe
  C:\Windows\System\gKOnWaY.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\yTHgYhI.exe
  C:\Windows\System\yTHgYhI.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\AUgMZzk.exe
  C:\Windows\System\AUgMZzk.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\gmqdUkt.exe
  C:\Windows\System\gmqdUkt.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\iMfunoS.exe
  C:\Windows\System\iMfunoS.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\oeiATyr.exe
  C:\Windows\System\oeiATyr.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\ngdqIyo.exe
  C:\Windows\System\ngdqIyo.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\hugkoPk.exe
  C:\Windows\System\hugkoPk.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\IPUMBmB.exe
  C:\Windows\System\IPUMBmB.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\xAgurre.exe
  C:\Windows\System\xAgurre.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\uiZOzSN.exe
  C:\Windows\System\uiZOzSN.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\xgqCeVw.exe
  C:\Windows\System\xgqCeVw.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\rgSitti.exe
  C:\Windows\System\rgSitti.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\TTPCWGw.exe
  C:\Windows\System\TTPCWGw.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\wnZysYW.exe
  C:\Windows\System\wnZysYW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\IaRNyuo.exe
  C:\Windows\System\IaRNyuo.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\PBVEGRx.exe
  C:\Windows\System\PBVEGRx.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\EUefcaq.exe
  C:\Windows\System\EUefcaq.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\CVWXVnV.exe
  C:\Windows\System\CVWXVnV.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ngiWKVz.exe
  C:\Windows\System\ngiWKVz.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\pUZDkgk.exe
  C:\Windows\System\pUZDkgk.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\NwkzJuf.exe
  C:\Windows\System\NwkzJuf.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\fHeaWQo.exe
  C:\Windows\System\fHeaWQo.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\ohLrnBw.exe
  C:\Windows\System\ohLrnBw.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\eYcMshC.exe
  C:\Windows\System\eYcMshC.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\YoJrvwW.exe
  C:\Windows\System\YoJrvwW.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\yPVnIuM.exe
  C:\Windows\System\yPVnIuM.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\ZaACfQl.exe
  C:\Windows\System\ZaACfQl.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\BLpIMkD.exe
  C:\Windows\System\BLpIMkD.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\KMLQuKK.exe
  C:\Windows\System\KMLQuKK.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\GGHZFoj.exe
  C:\Windows\System\GGHZFoj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\xqYkfIh.exe
  C:\Windows\System\xqYkfIh.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ZmXFqHL.exe
  C:\Windows\System\ZmXFqHL.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ImImXkI.exe
  C:\Windows\System\ImImXkI.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\gTpCpeQ.exe
  C:\Windows\System\gTpCpeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\HPXjMGO.exe
  C:\Windows\System\HPXjMGO.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\QwGOBiA.exe
  C:\Windows\System\QwGOBiA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\XKeSdAh.exe
  C:\Windows\System\XKeSdAh.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\PfjcldK.exe
  C:\Windows\System\PfjcldK.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\hDBOHWe.exe
  C:\Windows\System\hDBOHWe.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\aSvAqRu.exe
  C:\Windows\System\aSvAqRu.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\MtshLbl.exe
  C:\Windows\System\MtshLbl.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\cXCEWrk.exe
  C:\Windows\System\cXCEWrk.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\Ugdgxrm.exe
  C:\Windows\System\Ugdgxrm.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\QZrZWxs.exe
  C:\Windows\System\QZrZWxs.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\UmSHzTi.exe
  C:\Windows\System\UmSHzTi.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\iumsDuf.exe
  C:\Windows\System\iumsDuf.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\COdFDEE.exe
  C:\Windows\System\COdFDEE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\QbcdTZa.exe
  C:\Windows\System\QbcdTZa.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\sKscvZf.exe
  C:\Windows\System\sKscvZf.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\XwhWxZX.exe
  C:\Windows\System\XwhWxZX.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\dKKdRgm.exe
  C:\Windows\System\dKKdRgm.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\pOLHyJR.exe
  C:\Windows\System\pOLHyJR.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\qmTNfbn.exe
  C:\Windows\System\qmTNfbn.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\jmGRFRB.exe
  C:\Windows\System\jmGRFRB.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\itCKREZ.exe
  C:\Windows\System\itCKREZ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\OGTLwsw.exe
  C:\Windows\System\OGTLwsw.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\nbLAdrn.exe
  C:\Windows\System\nbLAdrn.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\zzjOAHT.exe
  C:\Windows\System\zzjOAHT.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\oBqPRqr.exe
  C:\Windows\System\oBqPRqr.exe
  2⤵
  PID:2788
- C:\Windows\System\hwhxSZY.exe
  C:\Windows\System\hwhxSZY.exe
  2⤵
  PID:4904
- C:\Windows\System\MeBDmIn.exe
  C:\Windows\System\MeBDmIn.exe
  2⤵
  PID:2124
- C:\Windows\System\sXipdNC.exe
  C:\Windows\System\sXipdNC.exe
  2⤵
  PID:2652
- C:\Windows\System\vyVnvfe.exe
  C:\Windows\System\vyVnvfe.exe
  2⤵
  PID:1276
- C:\Windows\System\yrdBOPb.exe
  C:\Windows\System\yrdBOPb.exe
  2⤵
  PID:928
- C:\Windows\System\EKhlRmF.exe
  C:\Windows\System\EKhlRmF.exe
  2⤵
  PID:4244
- C:\Windows\System\iUpRIcv.exe
  C:\Windows\System\iUpRIcv.exe
  2⤵
  PID:808
- C:\Windows\System\ffpIeAu.exe
  C:\Windows\System\ffpIeAu.exe
  2⤵
  PID:4388
- C:\Windows\System\TJrnsYh.exe
  C:\Windows\System\TJrnsYh.exe
  2⤵
  PID:2832
- C:\Windows\System\NseXbjL.exe
  C:\Windows\System\NseXbjL.exe
  2⤵
  PID:2336
- C:\Windows\System\xqwjxft.exe
  C:\Windows\System\xqwjxft.exe
  2⤵
  PID:3484
- C:\Windows\System\pwDzymf.exe
  C:\Windows\System\pwDzymf.exe
  2⤵
  PID:3704
- C:\Windows\System\aLsAjAF.exe
  C:\Windows\System\aLsAjAF.exe
  2⤵
  PID:2872
- C:\Windows\System\eJzTxhL.exe
  C:\Windows\System\eJzTxhL.exe
  2⤵
  PID:3440
- C:\Windows\System\WVjfyLy.exe
  C:\Windows\System\WVjfyLy.exe
  2⤵
  PID:2632
- C:\Windows\System\oauImLB.exe
  C:\Windows\System\oauImLB.exe
  2⤵
  PID:4332
- C:\Windows\System\LEEaeEO.exe
  C:\Windows\System\LEEaeEO.exe
  2⤵
  PID:1456
- C:\Windows\System\yfIiiBE.exe
  C:\Windows\System\yfIiiBE.exe
  2⤵
  PID:5132
- C:\Windows\System\mIdZUNH.exe
  C:\Windows\System\mIdZUNH.exe
  2⤵
  PID:5156
- C:\Windows\System\ZnHLmVD.exe
  C:\Windows\System\ZnHLmVD.exe
  2⤵
  PID:5184
- C:\Windows\System\GwClWyC.exe
  C:\Windows\System\GwClWyC.exe
  2⤵
  PID:5212
- C:\Windows\System\kWgTXBm.exe
  C:\Windows\System\kWgTXBm.exe
  2⤵
  PID:5240
- C:\Windows\System\sitNxKj.exe
  C:\Windows\System\sitNxKj.exe
  2⤵
  PID:5260
- C:\Windows\System\nYFouuG.exe
  C:\Windows\System\nYFouuG.exe
  2⤵
  PID:5280
- C:\Windows\System\VLZaUfT.exe
  C:\Windows\System\VLZaUfT.exe
  2⤵
  PID:5312
- C:\Windows\System\IkUgXLm.exe
  C:\Windows\System\IkUgXLm.exe
  2⤵
  PID:5336
- C:\Windows\System\vYMCJKI.exe
  C:\Windows\System\vYMCJKI.exe
  2⤵
  PID:5364
- C:\Windows\System\qPhLXqu.exe
  C:\Windows\System\qPhLXqu.exe
  2⤵
  PID:5392
- C:\Windows\System\uEmHEte.exe
  C:\Windows\System\uEmHEte.exe
  2⤵
  PID:5420
- C:\Windows\System\ZriLyCF.exe
  C:\Windows\System\ZriLyCF.exe
  2⤵
  PID:5444
- C:\Windows\System\uqVoQhn.exe
  C:\Windows\System\uqVoQhn.exe
  2⤵
  PID:5488
- C:\Windows\System\qJQtGsK.exe
  C:\Windows\System\qJQtGsK.exe
  2⤵
  PID:5520
- C:\Windows\System\QtmCpQA.exe
  C:\Windows\System\QtmCpQA.exe
  2⤵
  PID:5544
- C:\Windows\System\fcfFAld.exe
  C:\Windows\System\fcfFAld.exe
  2⤵
  PID:5572
- C:\Windows\System\pNljhCT.exe
  C:\Windows\System\pNljhCT.exe
  2⤵
  PID:5612
- C:\Windows\System\tpSgamP.exe
  C:\Windows\System\tpSgamP.exe
  2⤵
  PID:5640
- C:\Windows\System\rpciKKd.exe
  C:\Windows\System\rpciKKd.exe
  2⤵
  PID:5668
- C:\Windows\System\TVrwyjy.exe
  C:\Windows\System\TVrwyjy.exe
  2⤵
  PID:5696
- C:\Windows\System\ZupuVem.exe
  C:\Windows\System\ZupuVem.exe
  2⤵
  PID:5720
- C:\Windows\System\fQCbwef.exe
  C:\Windows\System\fQCbwef.exe
  2⤵
  PID:5744
- C:\Windows\System\AvTdVAm.exe
  C:\Windows\System\AvTdVAm.exe
  2⤵
  PID:5768
- C:\Windows\System\yNHbJTi.exe
  C:\Windows\System\yNHbJTi.exe
  2⤵
  PID:5800
- C:\Windows\System\eNGqAPI.exe
  C:\Windows\System\eNGqAPI.exe
  2⤵
  PID:5828
- C:\Windows\System\aJHYqYi.exe
  C:\Windows\System\aJHYqYi.exe
  2⤵
  PID:5856
- C:\Windows\System\qmTduUb.exe
  C:\Windows\System\qmTduUb.exe
  2⤵
  PID:5884
- C:\Windows\System\RVwlpEd.exe
  C:\Windows\System\RVwlpEd.exe
  2⤵
  PID:5908
- C:\Windows\System\ucaesLf.exe
  C:\Windows\System\ucaesLf.exe
  2⤵
  PID:5924
- C:\Windows\System\BACchIC.exe
  C:\Windows\System\BACchIC.exe
  2⤵
  PID:5952
- C:\Windows\System\AArkFso.exe
  C:\Windows\System\AArkFso.exe
  2⤵
  PID:5972
- C:\Windows\System\PAWTAnr.exe
  C:\Windows\System\PAWTAnr.exe
  2⤵
  PID:5996
- C:\Windows\System\jqkxjmT.exe
  C:\Windows\System\jqkxjmT.exe
  2⤵
  PID:6020
- C:\Windows\System\upktXVg.exe
  C:\Windows\System\upktXVg.exe
  2⤵
  PID:6044
- C:\Windows\System\usPEkFG.exe
  C:\Windows\System\usPEkFG.exe
  2⤵
  PID:6080
- C:\Windows\System\dklMpSo.exe
  C:\Windows\System\dklMpSo.exe
  2⤵
  PID:6108
- C:\Windows\System\ZnHrKhN.exe
  C:\Windows\System\ZnHrKhN.exe
  2⤵
  PID:64
- C:\Windows\System\XbjQzOD.exe
  C:\Windows\System\XbjQzOD.exe
  2⤵
  PID:5128
- C:\Windows\System\oqMkaSL.exe
  C:\Windows\System\oqMkaSL.exe
  2⤵
  PID:5232
- C:\Windows\System\AXHcFSo.exe
  C:\Windows\System\AXHcFSo.exe
  2⤵
  PID:5276
- C:\Windows\System\IPYCnYC.exe
  C:\Windows\System\IPYCnYC.exe
  2⤵
  PID:5344
- C:\Windows\System\cLrJWRn.exe
  C:\Windows\System\cLrJWRn.exe
  2⤵
  PID:5408
- C:\Windows\System\YaavmIw.exe
  C:\Windows\System\YaavmIw.exe
  2⤵
  PID:5460
- C:\Windows\System\gkdDYJF.exe
  C:\Windows\System\gkdDYJF.exe
  2⤵
  PID:5536
- C:\Windows\System\JYcsXVc.exe
  C:\Windows\System\JYcsXVc.exe
  2⤵
  PID:5588
- C:\Windows\System\UxfIgeL.exe
  C:\Windows\System\UxfIgeL.exe
  2⤵
  PID:5652
- C:\Windows\System\ImNAAhm.exe
  C:\Windows\System\ImNAAhm.exe
  2⤵
  PID:5736
- C:\Windows\System\VJjwqbq.exe
  C:\Windows\System\VJjwqbq.exe
  2⤵
  PID:5836
- C:\Windows\System\iRGJmOh.exe
  C:\Windows\System\iRGJmOh.exe
  2⤵
  PID:5880
- C:\Windows\System\RGLManm.exe
  C:\Windows\System\RGLManm.exe
  2⤵
  PID:5896
- C:\Windows\System\PMUUeao.exe
  C:\Windows\System\PMUUeao.exe
  2⤵
  PID:5944
- C:\Windows\System\hcELOyb.exe
  C:\Windows\System\hcELOyb.exe
  2⤵
  PID:6068
- C:\Windows\System\jCvxYtu.exe
  C:\Windows\System\jCvxYtu.exe
  2⤵
  PID:6116
- C:\Windows\System\wIQAUFn.exe
  C:\Windows\System\wIQAUFn.exe
  2⤵
  PID:4988
- C:\Windows\System\qNeYULp.exe
  C:\Windows\System\qNeYULp.exe
  2⤵
  PID:5204
- C:\Windows\System\ScIiigG.exe
  C:\Windows\System\ScIiigG.exe
  2⤵
  PID:5472
- C:\Windows\System\lVrqiVj.exe
  C:\Windows\System\lVrqiVj.exe
  2⤵
  PID:5560
- C:\Windows\System\XVAtbEu.exe
  C:\Windows\System\XVAtbEu.exe
  2⤵
  PID:5784
- C:\Windows\System\voLwuAj.exe
  C:\Windows\System\voLwuAj.exe
  2⤵
  PID:5892
- C:\Windows\System\NLUqIRK.exe
  C:\Windows\System\NLUqIRK.exe
  2⤵
  PID:6072
- C:\Windows\System\fzbPglq.exe
  C:\Windows\System\fzbPglq.exe
  2⤵
  PID:4268
- C:\Windows\System\UZlAyPT.exe
  C:\Windows\System\UZlAyPT.exe
  2⤵
  PID:5320
- C:\Windows\System\PeeZGPC.exe
  C:\Windows\System\PeeZGPC.exe
  2⤵
  PID:5712
- C:\Windows\System\qArqhkR.exe
  C:\Windows\System\qArqhkR.exe
  2⤵
  PID:6060
- C:\Windows\System\emVZokj.exe
  C:\Windows\System\emVZokj.exe
  2⤵
  PID:5540
- C:\Windows\System\HXbECcF.exe
  C:\Windows\System\HXbECcF.exe
  2⤵
  PID:6148
- C:\Windows\System\LXTKECa.exe
  C:\Windows\System\LXTKECa.exe
  2⤵
  PID:6168
- C:\Windows\System\SglMrPw.exe
  C:\Windows\System\SglMrPw.exe
  2⤵
  PID:6212
- C:\Windows\System\ntmGkWJ.exe
  C:\Windows\System\ntmGkWJ.exe
  2⤵
  PID:6232
- C:\Windows\System\ZdGbDRE.exe
  C:\Windows\System\ZdGbDRE.exe
  2⤵
  PID:6256
- C:\Windows\System\qYPkzin.exe
  C:\Windows\System\qYPkzin.exe
  2⤵
  PID:6280
- C:\Windows\System\syRxQNB.exe
  C:\Windows\System\syRxQNB.exe
  2⤵
  PID:6308
- C:\Windows\System\JdOktmK.exe
  C:\Windows\System\JdOktmK.exe
  2⤵
  PID:6356
- C:\Windows\System\MRYGJAo.exe
  C:\Windows\System\MRYGJAo.exe
  2⤵
  PID:6376
- C:\Windows\System\sYxTMCv.exe
  C:\Windows\System\sYxTMCv.exe
  2⤵
  PID:6396
- C:\Windows\System\iiCgqXG.exe
  C:\Windows\System\iiCgqXG.exe
  2⤵
  PID:6420
- C:\Windows\System\rkWfutR.exe
  C:\Windows\System\rkWfutR.exe
  2⤵
  PID:6448
- C:\Windows\System\dLLsBPV.exe
  C:\Windows\System\dLLsBPV.exe
  2⤵
  PID:6476
- C:\Windows\System\QixwJEp.exe
  C:\Windows\System\QixwJEp.exe
  2⤵
  PID:6504
- C:\Windows\System\jVsaVjB.exe
  C:\Windows\System\jVsaVjB.exe
  2⤵
  PID:6524
- C:\Windows\System\GZjVWGV.exe
  C:\Windows\System\GZjVWGV.exe
  2⤵
  PID:6548
- C:\Windows\System\gylzAhV.exe
  C:\Windows\System\gylzAhV.exe
  2⤵
  PID:6580
- C:\Windows\System\rkJsyAs.exe
  C:\Windows\System\rkJsyAs.exe
  2⤵
  PID:6604
- C:\Windows\System\FUdGqIR.exe
  C:\Windows\System\FUdGqIR.exe
  2⤵
  PID:6628
- C:\Windows\System\zsaKrDd.exe
  C:\Windows\System\zsaKrDd.exe
  2⤵
  PID:6652
- C:\Windows\System\uuQfJFO.exe
  C:\Windows\System\uuQfJFO.exe
  2⤵
  PID:6672
- C:\Windows\System\tkqrRtj.exe
  C:\Windows\System\tkqrRtj.exe
  2⤵
  PID:6716
- C:\Windows\System\eWBHCGT.exe
  C:\Windows\System\eWBHCGT.exe
  2⤵
  PID:6736
- C:\Windows\System\AsNNkuD.exe
  C:\Windows\System\AsNNkuD.exe
  2⤵
  PID:6776
- C:\Windows\System\URzakzl.exe
  C:\Windows\System\URzakzl.exe
  2⤵
  PID:6832
- C:\Windows\System\QPaSjZh.exe
  C:\Windows\System\QPaSjZh.exe
  2⤵
  PID:6852
- C:\Windows\System\oYMSILW.exe
  C:\Windows\System\oYMSILW.exe
  2⤵
  PID:6872
- C:\Windows\System\VDSgNiZ.exe
  C:\Windows\System\VDSgNiZ.exe
  2⤵
  PID:6920
- C:\Windows\System\JpjOpPr.exe
  C:\Windows\System\JpjOpPr.exe
  2⤵
  PID:6940
- C:\Windows\System\ISJTGvQ.exe
  C:\Windows\System\ISJTGvQ.exe
  2⤵
  PID:6972
- C:\Windows\System\nVArpSn.exe
  C:\Windows\System\nVArpSn.exe
  2⤵
  PID:7004
- C:\Windows\System\jKNFXEm.exe
  C:\Windows\System\jKNFXEm.exe
  2⤵
  PID:7028
- C:\Windows\System\utBfCek.exe
  C:\Windows\System\utBfCek.exe
  2⤵
  PID:7052
- C:\Windows\System\fBSUuQU.exe
  C:\Windows\System\fBSUuQU.exe
  2⤵
  PID:7084
- C:\Windows\System\kGCmHcX.exe
  C:\Windows\System\kGCmHcX.exe
  2⤵
  PID:7108
- C:\Windows\System\EpOsepC.exe
  C:\Windows\System\EpOsepC.exe
  2⤵
  PID:7140
- C:\Windows\System\ffxMGKt.exe
  C:\Windows\System\ffxMGKt.exe
  2⤵
  PID:5812
- C:\Windows\System\vVakkkk.exe
  C:\Windows\System\vVakkkk.exe
  2⤵
  PID:6180
- C:\Windows\System\adqWJyx.exe
  C:\Windows\System\adqWJyx.exe
  2⤵
  PID:6248
- C:\Windows\System\jZudlBJ.exe
  C:\Windows\System\jZudlBJ.exe
  2⤵
  PID:6300
- C:\Windows\System\OHtEavt.exe
  C:\Windows\System\OHtEavt.exe
  2⤵
  PID:6364
- C:\Windows\System\PtQodPO.exe
  C:\Windows\System\PtQodPO.exe
  2⤵
  PID:6440
- C:\Windows\System\DqfGhoB.exe
  C:\Windows\System\DqfGhoB.exe
  2⤵
  PID:6500
- C:\Windows\System\AeyFtuw.exe
  C:\Windows\System\AeyFtuw.exe
  2⤵
  PID:6572
- C:\Windows\System\CCfGfIg.exe
  C:\Windows\System\CCfGfIg.exe
  2⤵
  PID:6644
- C:\Windows\System\ceDNuhf.exe
  C:\Windows\System\ceDNuhf.exe
  2⤵
  PID:6704
- C:\Windows\System\CNrEsJl.exe
  C:\Windows\System\CNrEsJl.exe
  2⤵
  PID:6712
- C:\Windows\System\mzhrrVS.exe
  C:\Windows\System\mzhrrVS.exe
  2⤵
  PID:6796
- C:\Windows\System\DAXYHoG.exe
  C:\Windows\System\DAXYHoG.exe
  2⤵
  PID:6864
- C:\Windows\System\fxWgvLW.exe
  C:\Windows\System\fxWgvLW.exe
  2⤵
  PID:6896
- C:\Windows\System\wLGlRVc.exe
  C:\Windows\System\wLGlRVc.exe
  2⤵
  PID:6984
- C:\Windows\System\yfEBUmE.exe
  C:\Windows\System\yfEBUmE.exe
  2⤵
  PID:7072
- C:\Windows\System\kZfhrBn.exe
  C:\Windows\System\kZfhrBn.exe
  2⤵
  PID:7132
- C:\Windows\System\RXibTyU.exe
  C:\Windows\System\RXibTyU.exe
  2⤵
  PID:6188
- C:\Windows\System\UXrYXSp.exe
  C:\Windows\System\UXrYXSp.exe
  2⤵
  PID:6340
- C:\Windows\System\ULOhdND.exe
  C:\Windows\System\ULOhdND.exe
  2⤵
  PID:6484
- C:\Windows\System\JAjqaHx.exe
  C:\Windows\System\JAjqaHx.exe
  2⤵
  PID:6680
- C:\Windows\System\ydbrNme.exe
  C:\Windows\System\ydbrNme.exe
  2⤵
  PID:6788
- C:\Windows\System\IZOSvza.exe
  C:\Windows\System\IZOSvza.exe
  2⤵
  PID:6840
- C:\Windows\System\IXsSRHu.exe
  C:\Windows\System\IXsSRHu.exe
  2⤵
  PID:6964
- C:\Windows\System\wvLwOJH.exe
  C:\Windows\System\wvLwOJH.exe
  2⤵
  PID:6316
- C:\Windows\System\cXnTBXK.exe
  C:\Windows\System\cXnTBXK.exe
  2⤵
  PID:6620
- C:\Windows\System\GTYdrkB.exe
  C:\Windows\System\GTYdrkB.exe
  2⤵
  PID:7064
- C:\Windows\System\JYIHkec.exe
  C:\Windows\System\JYIHkec.exe
  2⤵
  PID:7016
- C:\Windows\System\lkAsQXz.exe
  C:\Windows\System\lkAsQXz.exe
  2⤵
  PID:7048
- C:\Windows\System\sizhmrK.exe
  C:\Windows\System\sizhmrK.exe
  2⤵
  PID:7176
- C:\Windows\System\XCimPCU.exe
  C:\Windows\System\XCimPCU.exe
  2⤵
  PID:7200
- C:\Windows\System\SywyRum.exe
  C:\Windows\System\SywyRum.exe
  2⤵
  PID:7244
- C:\Windows\System\nBgkYaW.exe
  C:\Windows\System\nBgkYaW.exe
  2⤵
  PID:7268
- C:\Windows\System\PcCKECm.exe
  C:\Windows\System\PcCKECm.exe
  2⤵
  PID:7348
- C:\Windows\System\ABwIwOI.exe
  C:\Windows\System\ABwIwOI.exe
  2⤵
  PID:7364
- C:\Windows\System\uqbLysO.exe
  C:\Windows\System\uqbLysO.exe
  2⤵
  PID:7380
- C:\Windows\System\DMFLqKh.exe
  C:\Windows\System\DMFLqKh.exe
  2⤵
  PID:7396
- C:\Windows\System\BbLZuCu.exe
  C:\Windows\System\BbLZuCu.exe
  2⤵
  PID:7412
- C:\Windows\System\tiJSDlJ.exe
  C:\Windows\System\tiJSDlJ.exe
  2⤵
  PID:7428
- C:\Windows\System\gvherlv.exe
  C:\Windows\System\gvherlv.exe
  2⤵
  PID:7444
- C:\Windows\System\nCJtxAd.exe
  C:\Windows\System\nCJtxAd.exe
  2⤵
  PID:7460
- C:\Windows\System\QNiBrkC.exe
  C:\Windows\System\QNiBrkC.exe
  2⤵
  PID:7508
- C:\Windows\System\ttfisZg.exe
  C:\Windows\System\ttfisZg.exe
  2⤵
  PID:7524
- C:\Windows\System\qSwFsIo.exe
  C:\Windows\System\qSwFsIo.exe
  2⤵
  PID:7540
- C:\Windows\System\hJSttcP.exe
  C:\Windows\System\hJSttcP.exe
  2⤵
  PID:7588
- C:\Windows\System\WfBOLJF.exe
  C:\Windows\System\WfBOLJF.exe
  2⤵
  PID:7612
- C:\Windows\System\ZPGBOza.exe
  C:\Windows\System\ZPGBOza.exe
  2⤵
  PID:7636
- C:\Windows\System\yTFREUb.exe
  C:\Windows\System\yTFREUb.exe
  2⤵
  PID:7676
- C:\Windows\System\LzjNSWy.exe
  C:\Windows\System\LzjNSWy.exe
  2⤵
  PID:7700
- C:\Windows\System\LjfMPjs.exe
  C:\Windows\System\LjfMPjs.exe
  2⤵
  PID:7776
- C:\Windows\System\KmSbfyk.exe
  C:\Windows\System\KmSbfyk.exe
  2⤵
  PID:7852
- C:\Windows\System\YmXGFIM.exe
  C:\Windows\System\YmXGFIM.exe
  2⤵
  PID:7872
- C:\Windows\System\WGAyhdH.exe
  C:\Windows\System\WGAyhdH.exe
  2⤵
  PID:7900
- C:\Windows\System\dQFFMcF.exe
  C:\Windows\System\dQFFMcF.exe
  2⤵
  PID:7924
- C:\Windows\System\RMHcAsF.exe
  C:\Windows\System\RMHcAsF.exe
  2⤵
  PID:7948
- C:\Windows\System\QMxsdGb.exe
  C:\Windows\System\QMxsdGb.exe
  2⤵
  PID:7972
- C:\Windows\System\ABzaGkq.exe
  C:\Windows\System\ABzaGkq.exe
  2⤵
  PID:7992
- C:\Windows\System\ehEFOOg.exe
  C:\Windows\System\ehEFOOg.exe
  2⤵
  PID:8060
- C:\Windows\System\UHvNAyz.exe
  C:\Windows\System\UHvNAyz.exe
  2⤵
  PID:8088
- C:\Windows\System\NqKNUVB.exe
  C:\Windows\System\NqKNUVB.exe
  2⤵
  PID:8120
- C:\Windows\System\ycLlHHY.exe
  C:\Windows\System\ycLlHHY.exe
  2⤵
  PID:8140
- C:\Windows\System\yKAJIMA.exe
  C:\Windows\System\yKAJIMA.exe
  2⤵
  PID:8172
- C:\Windows\System\LELoJhz.exe
  C:\Windows\System\LELoJhz.exe
  2⤵
  PID:6636
- C:\Windows\System\stMMANY.exe
  C:\Windows\System\stMMANY.exe
  2⤵
  PID:7228
- C:\Windows\System\VPKdtwt.exe
  C:\Windows\System\VPKdtwt.exe
  2⤵
  PID:7296
- C:\Windows\System\fxrHkJF.exe
  C:\Windows\System\fxrHkJF.exe
  2⤵
  PID:7404
- C:\Windows\System\gSJvspK.exe
  C:\Windows\System\gSJvspK.exe
  2⤵
  PID:7500
- C:\Windows\System\tCvskMl.exe
  C:\Windows\System\tCvskMl.exe
  2⤵
  PID:7328
- C:\Windows\System\mqpJswu.exe
  C:\Windows\System\mqpJswu.exe
  2⤵
  PID:7476
- C:\Windows\System\mdymNjy.exe
  C:\Windows\System\mdymNjy.exe
  2⤵
  PID:7420
- C:\Windows\System\ScQHuGq.exe
  C:\Windows\System\ScQHuGq.exe
  2⤵
  PID:7504
- C:\Windows\System\UbluesI.exe
  C:\Windows\System\UbluesI.exe
  2⤵
  PID:7620
- C:\Windows\System\APEufXz.exe
  C:\Windows\System\APEufXz.exe
  2⤵
  PID:7724
- C:\Windows\System\oQTapBb.exe
  C:\Windows\System\oQTapBb.exe
  2⤵
  PID:7748
- C:\Windows\System\UsJbdwA.exe
  C:\Windows\System\UsJbdwA.exe
  2⤵
  PID:7864
- C:\Windows\System\lVwVNuU.exe
  C:\Windows\System\lVwVNuU.exe
  2⤵
  PID:7940
- C:\Windows\System\WIBgfpN.exe
  C:\Windows\System\WIBgfpN.exe
  2⤵
  PID:8004
- C:\Windows\System\xeUykCG.exe
  C:\Windows\System\xeUykCG.exe
  2⤵
  PID:8080
- C:\Windows\System\SKPRnZR.exe
  C:\Windows\System\SKPRnZR.exe
  2⤵
  PID:8132
- C:\Windows\System\VpZbKTW.exe
  C:\Windows\System\VpZbKTW.exe
  2⤵
  PID:7196
- C:\Windows\System\WzlHvzQ.exe
  C:\Windows\System\WzlHvzQ.exe
  2⤵
  PID:7392
- C:\Windows\System\JLDmsOj.exe
  C:\Windows\System\JLDmsOj.exe
  2⤵
  PID:7320
- C:\Windows\System\TDhhzrU.exe
  C:\Windows\System\TDhhzrU.exe
  2⤵
  PID:7336
- C:\Windows\System\KJYCQcx.exe
  C:\Windows\System\KJYCQcx.exe
  2⤵
  PID:7728
- C:\Windows\System\XMXCUiz.exe
  C:\Windows\System\XMXCUiz.exe
  2⤵
  PID:7784
- C:\Windows\System\xuVGZmb.exe
  C:\Windows\System\xuVGZmb.exe
  2⤵
  PID:7936
- C:\Windows\System\BKjGrbT.exe
  C:\Windows\System\BKjGrbT.exe
  2⤵
  PID:6692
- C:\Windows\System\KRrAcRu.exe
  C:\Windows\System\KRrAcRu.exe
  2⤵
  PID:7480
- C:\Windows\System\damSMtA.exe
  C:\Windows\System\damSMtA.exe
  2⤵
  PID:7684
- C:\Windows\System\mFJIOma.exe
  C:\Windows\System\mFJIOma.exe
  2⤵
  PID:8148
- C:\Windows\System\bdWLPrZ.exe
  C:\Windows\System\bdWLPrZ.exe
  2⤵
  PID:7240
- C:\Windows\System\nXLGSWq.exe
  C:\Windows\System\nXLGSWq.exe
  2⤵
  PID:7376
- C:\Windows\System\UcIzUeE.exe
  C:\Windows\System\UcIzUeE.exe
  2⤵
  PID:8204
- C:\Windows\System\SZfsYvx.exe
  C:\Windows\System\SZfsYvx.exe
  2⤵
  PID:8224
- C:\Windows\System\nQKZwYp.exe
  C:\Windows\System\nQKZwYp.exe
  2⤵
  PID:8264
- C:\Windows\System\WlARFvH.exe
  C:\Windows\System\WlARFvH.exe
  2⤵
  PID:8296
- C:\Windows\System\XipdhVz.exe
  C:\Windows\System\XipdhVz.exe
  2⤵
  PID:8320
- C:\Windows\System\tpHeMJk.exe
  C:\Windows\System\tpHeMJk.exe
  2⤵
  PID:8368
- C:\Windows\System\VLZvqvH.exe
  C:\Windows\System\VLZvqvH.exe
  2⤵
  PID:8388
- C:\Windows\System\ZUAzvEX.exe
  C:\Windows\System\ZUAzvEX.exe
  2⤵
  PID:8412
- C:\Windows\System\rdEodTf.exe
  C:\Windows\System\rdEodTf.exe
  2⤵
  PID:8436
- C:\Windows\System\BvQPIvG.exe
  C:\Windows\System\BvQPIvG.exe
  2⤵
  PID:8456
- C:\Windows\System\yeghgCh.exe
  C:\Windows\System\yeghgCh.exe
  2⤵
  PID:8476
- C:\Windows\System\iJOEzRZ.exe
  C:\Windows\System\iJOEzRZ.exe
  2⤵
  PID:8500
- C:\Windows\System\scjnCXf.exe
  C:\Windows\System\scjnCXf.exe
  2⤵
  PID:8520
- C:\Windows\System\JqViURa.exe
  C:\Windows\System\JqViURa.exe
  2⤵
  PID:8560
- C:\Windows\System\TDEcyQK.exe
  C:\Windows\System\TDEcyQK.exe
  2⤵
  PID:8604
- C:\Windows\System\cOhWfwl.exe
  C:\Windows\System\cOhWfwl.exe
  2⤵
  PID:8628
- C:\Windows\System\qygycLV.exe
  C:\Windows\System\qygycLV.exe
  2⤵
  PID:8656
- C:\Windows\System\ruRipjI.exe
  C:\Windows\System\ruRipjI.exe
  2⤵
  PID:8696
- C:\Windows\System\JysyXpd.exe
  C:\Windows\System\JysyXpd.exe
  2⤵
  PID:8724
- C:\Windows\System\lRRfnKt.exe
  C:\Windows\System\lRRfnKt.exe
  2⤵
  PID:8748
- C:\Windows\System\WBcosMw.exe
  C:\Windows\System\WBcosMw.exe
  2⤵
  PID:8772
- C:\Windows\System\BUaQjoI.exe
  C:\Windows\System\BUaQjoI.exe
  2⤵
  PID:8796
- C:\Windows\System\TncRKRA.exe
  C:\Windows\System\TncRKRA.exe
  2⤵
  PID:8828
- C:\Windows\System\TVxfGXr.exe
  C:\Windows\System\TVxfGXr.exe
  2⤵
  PID:8852
- C:\Windows\System\pmzmcAh.exe
  C:\Windows\System\pmzmcAh.exe
  2⤵
  PID:8876
- C:\Windows\System\RREpmVP.exe
  C:\Windows\System\RREpmVP.exe
  2⤵
  PID:8896
- C:\Windows\System\WMmowgt.exe
  C:\Windows\System\WMmowgt.exe
  2⤵
  PID:8920
- C:\Windows\System\gPVoEqY.exe
  C:\Windows\System\gPVoEqY.exe
  2⤵
  PID:8952
- C:\Windows\System\FSnOEEa.exe
  C:\Windows\System\FSnOEEa.exe
  2⤵
  PID:8972
- C:\Windows\System\UbVmBGX.exe
  C:\Windows\System\UbVmBGX.exe
  2⤵
  PID:9012
- C:\Windows\System\FwgbZZn.exe
  C:\Windows\System\FwgbZZn.exe
  2⤵
  PID:9052
- C:\Windows\System\TmjWqgD.exe
  C:\Windows\System\TmjWqgD.exe
  2⤵
  PID:9100
- C:\Windows\System\DpPKXIj.exe
  C:\Windows\System\DpPKXIj.exe
  2⤵
  PID:9124
- C:\Windows\System\QnWHrPx.exe
  C:\Windows\System\QnWHrPx.exe
  2⤵
  PID:9148
- C:\Windows\System\LunEQUF.exe
  C:\Windows\System\LunEQUF.exe
  2⤵
  PID:9180
- C:\Windows\System\psfWBqo.exe
  C:\Windows\System\psfWBqo.exe
  2⤵
  PID:9204
- C:\Windows\System\jgrTBZy.exe
  C:\Windows\System\jgrTBZy.exe
  2⤵
  PID:8196
- C:\Windows\System\fwkNUrh.exe
  C:\Windows\System\fwkNUrh.exe
  2⤵
  PID:8236
- C:\Windows\System\TZDTqgC.exe
  C:\Windows\System\TZDTqgC.exe
  2⤵
  PID:8312
- C:\Windows\System\SbUFTVb.exe
  C:\Windows\System\SbUFTVb.exe
  2⤵
  PID:8380
- C:\Windows\System\OiKuZeL.exe
  C:\Windows\System\OiKuZeL.exe
  2⤵
  PID:8424
- C:\Windows\System\nJrtdKP.exe
  C:\Windows\System\nJrtdKP.exe
  2⤵
  PID:8540
- C:\Windows\System\mlVQjuF.exe
  C:\Windows\System\mlVQjuF.exe
  2⤵
  PID:8544
- C:\Windows\System\IinxNKr.exe
  C:\Windows\System\IinxNKr.exe
  2⤵
  PID:8676
- C:\Windows\System\DfEOUBE.exe
  C:\Windows\System\DfEOUBE.exe
  2⤵
  PID:8716
- C:\Windows\System\BEMlACT.exe
  C:\Windows\System\BEMlACT.exe
  2⤵
  PID:8792
- C:\Windows\System\bdgqgyX.exe
  C:\Windows\System\bdgqgyX.exe
  2⤵
  PID:8836
- C:\Windows\System\TjfBAJI.exe
  C:\Windows\System\TjfBAJI.exe
  2⤵
  PID:8928
- C:\Windows\System\pHgTtOl.exe
  C:\Windows\System\pHgTtOl.exe
  2⤵
  PID:8996
- C:\Windows\System\Rfqwibg.exe
  C:\Windows\System\Rfqwibg.exe
  2⤵
  PID:9032
- C:\Windows\System\utYePXB.exe
  C:\Windows\System\utYePXB.exe
  2⤵
  PID:9132
- C:\Windows\System\QWQFncQ.exe
  C:\Windows\System\QWQFncQ.exe
  2⤵
  PID:9196
- C:\Windows\System\rUGnbzH.exe
  C:\Windows\System\rUGnbzH.exe
  2⤵
  PID:8280
- C:\Windows\System\OpaccyF.exe
  C:\Windows\System\OpaccyF.exe
  2⤵
  PID:8404
- C:\Windows\System\eGHZhMq.exe
  C:\Windows\System\eGHZhMq.exe
  2⤵
  PID:8636
- C:\Windows\System\iICQLhE.exe
  C:\Windows\System\iICQLhE.exe
  2⤵
  PID:8744
- C:\Windows\System\bLhmtVJ.exe
  C:\Windows\System\bLhmtVJ.exe
  2⤵
  PID:8912
- C:\Windows\System\xzgSlpC.exe
  C:\Windows\System\xzgSlpC.exe
  2⤵
  PID:8968
- C:\Windows\System\IcAoMOT.exe
  C:\Windows\System\IcAoMOT.exe
  2⤵
  PID:9172
- C:\Windows\System\wmUNeXh.exe
  C:\Windows\System\wmUNeXh.exe
  2⤵
  PID:8452
- C:\Windows\System\KJoZOQv.exe
  C:\Windows\System\KJoZOQv.exe
  2⤵
  PID:8860
- C:\Windows\System\AKMVGmJ.exe
  C:\Windows\System\AKMVGmJ.exe
  2⤵
  PID:8220
- C:\Windows\System\pUeoaXw.exe
  C:\Windows\System\pUeoaXw.exe
  2⤵
  PID:8648
- C:\Windows\System\wJKeQrj.exe
  C:\Windows\System\wJKeQrj.exe
  2⤵
  PID:8888
- C:\Windows\System\MyMSrxV.exe
  C:\Windows\System\MyMSrxV.exe
  2⤵
  PID:9260
- C:\Windows\System\khTtkph.exe
  C:\Windows\System\khTtkph.exe
  2⤵
  PID:9284
- C:\Windows\System\ZOixKwT.exe
  C:\Windows\System\ZOixKwT.exe
  2⤵
  PID:9308
- C:\Windows\System\jCqjfDH.exe
  C:\Windows\System\jCqjfDH.exe
  2⤵
  PID:9332
- C:\Windows\System\FOVQQrN.exe
  C:\Windows\System\FOVQQrN.exe
  2⤵
  PID:9364
- C:\Windows\System\sdOufVX.exe
  C:\Windows\System\sdOufVX.exe
  2⤵
  PID:9408
- C:\Windows\System\PgbhzxR.exe
  C:\Windows\System\PgbhzxR.exe
  2⤵
  PID:9428
- C:\Windows\System\vBhxMCR.exe
  C:\Windows\System\vBhxMCR.exe
  2⤵
  PID:9452
- C:\Windows\System\XVcYMlz.exe
  C:\Windows\System\XVcYMlz.exe
  2⤵
  PID:9484
- C:\Windows\System\EPmPGfQ.exe
  C:\Windows\System\EPmPGfQ.exe
  2⤵
  PID:9516
- C:\Windows\System\eWLlyNu.exe
  C:\Windows\System\eWLlyNu.exe
  2⤵
  PID:9540
- C:\Windows\System\ttUVedu.exe
  C:\Windows\System\ttUVedu.exe
  2⤵
  PID:9564
- C:\Windows\System\fHpCbkz.exe
  C:\Windows\System\fHpCbkz.exe
  2⤵
  PID:9588
- C:\Windows\System\mhFhYti.exe
  C:\Windows\System\mhFhYti.exe
  2⤵
  PID:9624
- C:\Windows\System\OfeGSPB.exe
  C:\Windows\System\OfeGSPB.exe
  2⤵
  PID:9652
- C:\Windows\System\RyJYqOA.exe
  C:\Windows\System\RyJYqOA.exe
  2⤵
  PID:9672
- C:\Windows\System\YeMSmui.exe
  C:\Windows\System\YeMSmui.exe
  2⤵
  PID:9700
- C:\Windows\System\bioToLd.exe
  C:\Windows\System\bioToLd.exe
  2⤵
  PID:9744
- C:\Windows\System\iZRrBIN.exe
  C:\Windows\System\iZRrBIN.exe
  2⤵
  PID:9788
- C:\Windows\System\dFrMhjz.exe
  C:\Windows\System\dFrMhjz.exe
  2⤵
  PID:9828
- C:\Windows\System\UiysbBw.exe
  C:\Windows\System\UiysbBw.exe
  2⤵
  PID:9844
- C:\Windows\System\QHKsmaZ.exe
  C:\Windows\System\QHKsmaZ.exe
  2⤵
  PID:9872
- C:\Windows\System\tnLLwVw.exe
  C:\Windows\System\tnLLwVw.exe
  2⤵
  PID:9892
- C:\Windows\System\FDvKAxv.exe
  C:\Windows\System\FDvKAxv.exe
  2⤵
  PID:9920
- C:\Windows\System\koINCDb.exe
  C:\Windows\System\koINCDb.exe
  2⤵
  PID:9964
- C:\Windows\System\Xueexwn.exe
  C:\Windows\System\Xueexwn.exe
  2⤵
  PID:9984
- C:\Windows\System\QUNwJZD.exe
  C:\Windows\System\QUNwJZD.exe
  2⤵
  PID:10092
- C:\Windows\System\JQqnhil.exe
  C:\Windows\System\JQqnhil.exe
  2⤵
  PID:10108
- C:\Windows\System\VzXrqtU.exe
  C:\Windows\System\VzXrqtU.exe
  2⤵
  PID:10124
- C:\Windows\System\CCbKyRi.exe
  C:\Windows\System\CCbKyRi.exe
  2⤵
  PID:10140
- C:\Windows\System\TKjQihO.exe
  C:\Windows\System\TKjQihO.exe
  2⤵
  PID:10176
- C:\Windows\System\KPvQIti.exe
  C:\Windows\System\KPvQIti.exe
  2⤵
  PID:10204
- C:\Windows\System\JgUGlVW.exe
  C:\Windows\System\JgUGlVW.exe
  2⤵
  PID:8580
- C:\Windows\System\VRPmzEg.exe
  C:\Windows\System\VRPmzEg.exe
  2⤵
  PID:9272
- C:\Windows\System\bwTJQFQ.exe
  C:\Windows\System\bwTJQFQ.exe
  2⤵
  PID:9328
- C:\Windows\System\mMfEJWV.exe
  C:\Windows\System\mMfEJWV.exe
  2⤵
  PID:9384
- C:\Windows\System\LpjmaTp.exe
  C:\Windows\System\LpjmaTp.exe
  2⤵
  PID:9512
- C:\Windows\System\AkgqWdJ.exe
  C:\Windows\System\AkgqWdJ.exe
  2⤵
  PID:9536
- C:\Windows\System\nGWnmcW.exe
  C:\Windows\System\nGWnmcW.exe
  2⤵
  PID:9640
- C:\Windows\System\ZNgzTQi.exe
  C:\Windows\System\ZNgzTQi.exe
  2⤵
  PID:9688
- C:\Windows\System\LJhZhAc.exe
  C:\Windows\System\LJhZhAc.exe
  2⤵
  PID:9728
- C:\Windows\System\PpYdCLO.exe
  C:\Windows\System\PpYdCLO.exe
  2⤵
  PID:9804
- C:\Windows\System\CzGntYB.exe
  C:\Windows\System\CzGntYB.exe
  2⤵
  PID:9840
- C:\Windows\System\BieAqIS.exe
  C:\Windows\System\BieAqIS.exe
  2⤵
  PID:9940
- C:\Windows\System\OQXIChv.exe
  C:\Windows\System\OQXIChv.exe
  2⤵
  PID:10024
- C:\Windows\System\rarYJaf.exe
  C:\Windows\System\rarYJaf.exe
  2⤵
  PID:10064
- C:\Windows\System\ittjOtV.exe
  C:\Windows\System\ittjOtV.exe
  2⤵
  PID:10120
- C:\Windows\System\TiFBTSx.exe
  C:\Windows\System\TiFBTSx.exe
  2⤵
  PID:10192
- C:\Windows\System\FzFcCnv.exe
  C:\Windows\System\FzFcCnv.exe
  2⤵
  PID:9240
- C:\Windows\System\dVvUpvb.exe
  C:\Windows\System\dVvUpvb.exe
  2⤵
  PID:9352
- C:\Windows\System\pYdgvkS.exe
  C:\Windows\System\pYdgvkS.exe
  2⤵
  PID:9508
- C:\Windows\System\kNNdyKN.exe
  C:\Windows\System\kNNdyKN.exe
  2⤵
  PID:9644
- C:\Windows\System\LOMLgFv.exe
  C:\Windows\System\LOMLgFv.exe
  2⤵
  PID:9720
- C:\Windows\System\bNrRjaD.exe
  C:\Windows\System\bNrRjaD.exe
  2⤵
  PID:9932
- C:\Windows\System\mCYUaiw.exe
  C:\Windows\System\mCYUaiw.exe
  2⤵
  PID:10100
- C:\Windows\System\RnHzQYZ.exe
  C:\Windows\System\RnHzQYZ.exe
  2⤵
  PID:9400
- C:\Windows\System\WYUgAAy.exe
  C:\Windows\System\WYUgAAy.exe
  2⤵
  PID:9448
- C:\Windows\System\xoawSBi.exe
  C:\Windows\System\xoawSBi.exe
  2⤵
  PID:9824
- C:\Windows\System\CKBjtmc.exe
  C:\Windows\System\CKBjtmc.exe
  2⤵
  PID:9996
- C:\Windows\System\rUOtaRY.exe
  C:\Windows\System\rUOtaRY.exe
  2⤵
  PID:9560
- C:\Windows\System\pYFdJgA.exe
  C:\Windows\System\pYFdJgA.exe
  2⤵
  PID:10252
- C:\Windows\System\rMWIxNb.exe
  C:\Windows\System\rMWIxNb.exe
  2⤵
  PID:10280
- C:\Windows\System\bSrRoHj.exe
  C:\Windows\System\bSrRoHj.exe
  2⤵
  PID:10312
- C:\Windows\System\jXMDKLM.exe
  C:\Windows\System\jXMDKLM.exe
  2⤵
  PID:10340
- C:\Windows\System\AqvDFMG.exe
  C:\Windows\System\AqvDFMG.exe
  2⤵
  PID:10368
- C:\Windows\System\UoGXAZX.exe
  C:\Windows\System\UoGXAZX.exe
  2⤵
  PID:10396
- C:\Windows\System\xAKvkak.exe
  C:\Windows\System\xAKvkak.exe
  2⤵
  PID:10436
- C:\Windows\System\BFaVcbs.exe
  C:\Windows\System\BFaVcbs.exe
  2⤵
  PID:10460
- C:\Windows\System\PbZwfOR.exe
  C:\Windows\System\PbZwfOR.exe
  2⤵
  PID:10496
- C:\Windows\System\nyShchZ.exe
  C:\Windows\System\nyShchZ.exe
  2⤵
  PID:10544
- C:\Windows\System\VODWrmm.exe
  C:\Windows\System\VODWrmm.exe
  2⤵
  PID:10568
- C:\Windows\System\svujTHi.exe
  C:\Windows\System\svujTHi.exe
  2⤵
  PID:10592
- C:\Windows\System\MOFEYbs.exe
  C:\Windows\System\MOFEYbs.exe
  2⤵
  PID:10628
- C:\Windows\System\honwpxg.exe
  C:\Windows\System\honwpxg.exe
  2⤵
  PID:10648
- C:\Windows\System\xmJytGS.exe
  C:\Windows\System\xmJytGS.exe
  2⤵
  PID:10672
- C:\Windows\System\UjkhbVn.exe
  C:\Windows\System\UjkhbVn.exe
  2⤵
  PID:10712
- C:\Windows\System\VOfXZvE.exe
  C:\Windows\System\VOfXZvE.exe
  2⤵
  PID:10732
- C:\Windows\System\AqOLSGG.exe
  C:\Windows\System\AqOLSGG.exe
  2⤵
  PID:10764
- C:\Windows\System\hNaIaKn.exe
  C:\Windows\System\hNaIaKn.exe
  2⤵
  PID:10784
- C:\Windows\System\FnpYpqw.exe
  C:\Windows\System\FnpYpqw.exe
  2⤵
  PID:10812
- C:\Windows\System\ybSdaae.exe
  C:\Windows\System\ybSdaae.exe
  2⤵
  PID:10840
- C:\Windows\System\uBfujNr.exe
  C:\Windows\System\uBfujNr.exe
  2⤵
  PID:10872
- C:\Windows\System\fQtmnij.exe
  C:\Windows\System\fQtmnij.exe
  2⤵
  PID:10900
- C:\Windows\System\ubHUGYc.exe
  C:\Windows\System\ubHUGYc.exe
  2⤵
  PID:10928
- C:\Windows\System\dsXpiAh.exe
  C:\Windows\System\dsXpiAh.exe
  2⤵
  PID:10952
- C:\Windows\System\vUHOsIM.exe
  C:\Windows\System\vUHOsIM.exe
  2⤵
  PID:10992
- C:\Windows\System\fwlosUU.exe
  C:\Windows\System\fwlosUU.exe
  2⤵
  PID:11024
- C:\Windows\System\ZmIFWlM.exe
  C:\Windows\System\ZmIFWlM.exe
  2⤵
  PID:11044
- C:\Windows\System\YMunzCw.exe
  C:\Windows\System\YMunzCw.exe
  2⤵
  PID:11080
- C:\Windows\System\UPUcUeA.exe
  C:\Windows\System\UPUcUeA.exe
  2⤵
  PID:11104
- C:\Windows\System\WQPWLdz.exe
  C:\Windows\System\WQPWLdz.exe
  2⤵
  PID:11128
- C:\Windows\System\vMVVBXi.exe
  C:\Windows\System\vMVVBXi.exe
  2⤵
  PID:11160
- C:\Windows\System\PweONZY.exe
  C:\Windows\System\PweONZY.exe
  2⤵
  PID:11180
- C:\Windows\System\mgrVOBB.exe
  C:\Windows\System\mgrVOBB.exe
  2⤵
  PID:11220
- C:\Windows\System\iPbbtxZ.exe
  C:\Windows\System\iPbbtxZ.exe
  2⤵
  PID:11244
- C:\Windows\System\Zbrgrnb.exe
  C:\Windows\System\Zbrgrnb.exe
  2⤵
  PID:9712
- C:\Windows\System\clXRmyx.exe
  C:\Windows\System\clXRmyx.exe
  2⤵
  PID:9552
- C:\Windows\System\UCYnXDd.exe
  C:\Windows\System\UCYnXDd.exe
  2⤵
  PID:10324
- C:\Windows\System\hOzLlQm.exe
  C:\Windows\System\hOzLlQm.exe
  2⤵
  PID:10416
- C:\Windows\System\zeZJnfd.exe
  C:\Windows\System\zeZJnfd.exe
  2⤵
  PID:10428
- C:\Windows\System\tFvmbYB.exe
  C:\Windows\System\tFvmbYB.exe
  2⤵
  PID:10516
- C:\Windows\System\drhGiPp.exe
  C:\Windows\System\drhGiPp.exe
  2⤵
  PID:10580
- C:\Windows\System\neeBBve.exe
  C:\Windows\System\neeBBve.exe
  2⤵
  PID:10624
- C:\Windows\System\rfpaQqf.exe
  C:\Windows\System\rfpaQqf.exe
  2⤵
  PID:10724
- C:\Windows\System\sRhwLSk.exe
  C:\Windows\System\sRhwLSk.exe
  2⤵
  PID:10772
- C:\Windows\System\BiVrAae.exe
  C:\Windows\System\BiVrAae.exe
  2⤵
  PID:10836
- C:\Windows\System\UZynwQw.exe
  C:\Windows\System\UZynwQw.exe
  2⤵
  PID:10912
- C:\Windows\System\mpChnLN.exe
  C:\Windows\System\mpChnLN.exe
  2⤵
  PID:10972
- C:\Windows\System\ntnnwIb.exe
  C:\Windows\System\ntnnwIb.exe
  2⤵
  PID:11012
- C:\Windows\System\CiTqcne.exe
  C:\Windows\System\CiTqcne.exe
  2⤵
  PID:11068
- C:\Windows\System\tycYCYu.exe
  C:\Windows\System\tycYCYu.exe
  2⤵
  PID:11124
- C:\Windows\System\GMHbrmZ.exe
  C:\Windows\System\GMHbrmZ.exe
  2⤵
  PID:11196
- C:\Windows\System\iWvdCNS.exe
  C:\Windows\System\iWvdCNS.exe
  2⤵
  PID:11256
- C:\Windows\System\PuEhQYI.exe
  C:\Windows\System\PuEhQYI.exe
  2⤵
  PID:10244
- C:\Windows\System\vAOYzaM.exe
  C:\Windows\System\vAOYzaM.exe
  2⤵
  PID:10412
- C:\Windows\System\hWwNQvO.exe
  C:\Windows\System\hWwNQvO.exe
  2⤵
  PID:10556
- C:\Windows\System\BoNpdtp.exe
  C:\Windows\System\BoNpdtp.exe
  2⤵
  PID:10824
- C:\Windows\System\kIGBQRd.exe
  C:\Windows\System\kIGBQRd.exe
  2⤵
  PID:10880
- C:\Windows\System\zJSmRkh.exe
  C:\Windows\System\zJSmRkh.exe
  2⤵
  PID:11120
- C:\Windows\System\bRJwodc.exe
  C:\Windows\System\bRJwodc.exe
  2⤵
  PID:11168
- C:\Windows\System\bwZeevk.exe
  C:\Windows\System\bwZeevk.exe
  2⤵
  PID:10708
- C:\Windows\System\LVXqczg.exe
  C:\Windows\System\LVXqczg.exe
  2⤵
  PID:10948
- C:\Windows\System\TEhwHtO.exe
  C:\Windows\System\TEhwHtO.exe
  2⤵
  PID:10536
- C:\Windows\System\PUCtFrH.exe
  C:\Windows\System\PUCtFrH.exe
  2⤵
  PID:11268
- C:\Windows\System\zHSSAPH.exe
  C:\Windows\System\zHSSAPH.exe
  2⤵
  PID:11304
- C:\Windows\System\Khxfyha.exe
  C:\Windows\System\Khxfyha.exe
  2⤵
  PID:11332
- C:\Windows\System\uKKYczS.exe
  C:\Windows\System\uKKYczS.exe
  2⤵
  PID:11380
- C:\Windows\System\EqmNVtQ.exe
  C:\Windows\System\EqmNVtQ.exe
  2⤵
  PID:11400
- C:\Windows\System\BxukRXq.exe
  C:\Windows\System\BxukRXq.exe
  2⤵
  PID:11420
- C:\Windows\System\ucVSgPG.exe
  C:\Windows\System\ucVSgPG.exe
  2⤵
  PID:11444
- C:\Windows\System\NGVBnSy.exe
  C:\Windows\System\NGVBnSy.exe
  2⤵
  PID:11488
- C:\Windows\System\LriqYYL.exe
  C:\Windows\System\LriqYYL.exe
  2⤵
  PID:11536
- C:\Windows\System\PwNNyci.exe
  C:\Windows\System\PwNNyci.exe
  2⤵
  PID:11560
- C:\Windows\System\XyMXExy.exe
  C:\Windows\System\XyMXExy.exe
  2⤵
  PID:11580
- C:\Windows\System\rCISlAY.exe
  C:\Windows\System\rCISlAY.exe
  2⤵
  PID:11612
- C:\Windows\System\rhOHGhY.exe
  C:\Windows\System\rhOHGhY.exe
  2⤵
  PID:11636
- C:\Windows\System\eyNqsZY.exe
  C:\Windows\System\eyNqsZY.exe
  2⤵
  PID:11656
- C:\Windows\System\xEreFZl.exe
  C:\Windows\System\xEreFZl.exe
  2⤵
  PID:11680
- C:\Windows\System\jeDlYpv.exe
  C:\Windows\System\jeDlYpv.exe
  2⤵
  PID:11716
- C:\Windows\System\orJgjdc.exe
  C:\Windows\System\orJgjdc.exe
  2⤵
  PID:11740
- C:\Windows\System\hKEQfQP.exe
  C:\Windows\System\hKEQfQP.exe
  2⤵
  PID:11772
- C:\Windows\System\LOeBDfl.exe
  C:\Windows\System\LOeBDfl.exe
  2⤵
  PID:11796
- C:\Windows\System\VejQbNA.exe
  C:\Windows\System\VejQbNA.exe
  2⤵
  PID:11836
- C:\Windows\System\PrhYSxe.exe
  C:\Windows\System\PrhYSxe.exe
  2⤵
  PID:11856
- C:\Windows\System\NndEBhu.exe
  C:\Windows\System\NndEBhu.exe
  2⤵
  PID:11884
- C:\Windows\System\vVCRGOT.exe
  C:\Windows\System\vVCRGOT.exe
  2⤵
  PID:11916
- C:\Windows\System\SgauaRW.exe
  C:\Windows\System\SgauaRW.exe
  2⤵
  PID:11940
- C:\Windows\System\nzosdCA.exe
  C:\Windows\System\nzosdCA.exe
  2⤵
  PID:11984
- C:\Windows\System\deYHlaY.exe
  C:\Windows\System\deYHlaY.exe
  2⤵
  PID:12012
- C:\Windows\System\jwuIxqQ.exe
  C:\Windows\System\jwuIxqQ.exe
  2⤵
  PID:12032
- C:\Windows\System\KIYbvUr.exe
  C:\Windows\System\KIYbvUr.exe
  2⤵
  PID:12064
- C:\Windows\System\QRpqevk.exe
  C:\Windows\System\QRpqevk.exe
  2⤵
  PID:12096
- C:\Windows\System\dGKkOVF.exe
  C:\Windows\System\dGKkOVF.exe
  2⤵
  PID:12120
- C:\Windows\System\LdZnsyP.exe
  C:\Windows\System\LdZnsyP.exe
  2⤵
  PID:12152
- C:\Windows\System\WkppxfZ.exe
  C:\Windows\System\WkppxfZ.exe
  2⤵
  PID:12180
- C:\Windows\System\MpmijvH.exe
  C:\Windows\System\MpmijvH.exe
  2⤵
  PID:12200
- C:\Windows\System\INFRxDF.exe
  C:\Windows\System\INFRxDF.exe
  2⤵
  PID:12220
- C:\Windows\System\eENDFdv.exe
  C:\Windows\System\eENDFdv.exe
  2⤵
  PID:12260
- C:\Windows\System\VONKalX.exe
  C:\Windows\System\VONKalX.exe
  2⤵
  PID:11276
- C:\Windows\System\CQfluJN.exe
  C:\Windows\System\CQfluJN.exe
  2⤵
  PID:10760
- C:\Windows\System\LoUguYT.exe
  C:\Windows\System\LoUguYT.exe
  2⤵
  PID:11372
- C:\Windows\System\KIhwHgP.exe
  C:\Windows\System\KIhwHgP.exe
  2⤵
  PID:11416
- C:\Windows\System\RFyyqxt.exe
  C:\Windows\System\RFyyqxt.exe
  2⤵
  PID:11464
- C:\Windows\System\KXxKoHE.exe
  C:\Windows\System\KXxKoHE.exe
  2⤵
  PID:11516
- C:\Windows\System\yaPAhrw.exe
  C:\Windows\System\yaPAhrw.exe
  2⤵
  PID:11568
- C:\Windows\System\EIMWZVI.exe
  C:\Windows\System\EIMWZVI.exe
  2⤵
  PID:11632
- C:\Windows\System\wvNvDnF.exe
  C:\Windows\System\wvNvDnF.exe
  2⤵
  PID:11696
- C:\Windows\System\LtcKNpK.exe
  C:\Windows\System\LtcKNpK.exe
  2⤵
  PID:11756
- C:\Windows\System\OAEawJg.exe
  C:\Windows\System\OAEawJg.exe
  2⤵
  PID:11784
- C:\Windows\System\WedpqLE.exe
  C:\Windows\System\WedpqLE.exe
  2⤵
  PID:11876
- C:\Windows\System\dwKIvef.exe
  C:\Windows\System\dwKIvef.exe
  2⤵
  PID:11980
- C:\Windows\System\oWRGmFj.exe
  C:\Windows\System\oWRGmFj.exe
  2⤵
  PID:12020
- C:\Windows\System\XPBXDcs.exe
  C:\Windows\System\XPBXDcs.exe
  2⤵
  PID:12060
- C:\Windows\System\BxmvCMZ.exe
  C:\Windows\System\BxmvCMZ.exe
  2⤵
  PID:12112
- C:\Windows\System\idIkRDI.exe
  C:\Windows\System\idIkRDI.exe
  2⤵
  PID:12192
- C:\Windows\System\EzQegDx.exe
  C:\Windows\System\EzQegDx.exe
  2⤵
  PID:12240
- C:\Windows\System\HLbFsWo.exe
  C:\Windows\System\HLbFsWo.exe
  2⤵
  PID:10804
- C:\Windows\System\HUNOUcH.exe
  C:\Windows\System\HUNOUcH.exe
  2⤵
  PID:11456
- C:\Windows\System\zHSklnJ.exe
  C:\Windows\System\zHSklnJ.exe
  2⤵
  PID:10896
- C:\Windows\System\flUspJz.exe
  C:\Windows\System\flUspJz.exe
  2⤵
  PID:11712
- C:\Windows\System\KyhoLLF.exe
  C:\Windows\System\KyhoLLF.exe
  2⤵
  PID:4328
- C:\Windows\System\fwKEMei.exe
  C:\Windows\System\fwKEMei.exe
  2⤵
  PID:12076
- C:\Windows\System\cemcUJS.exe
  C:\Windows\System\cemcUJS.exe
  2⤵
  PID:12160
- C:\Windows\System\rktpmMk.exe
  C:\Windows\System\rktpmMk.exe
  2⤵
  PID:11816
- C:\Windows\System\YZAaOOk.exe
  C:\Windows\System\YZAaOOk.exe
  2⤵
  PID:12044
- C:\Windows\System\MmdSSoI.exe
  C:\Windows\System\MmdSSoI.exe
  2⤵
  PID:4816
- C:\Windows\System\njZZyya.exe
  C:\Windows\System\njZZyya.exe
  2⤵
  PID:12304
- C:\Windows\System\jTcjjil.exe
  C:\Windows\System\jTcjjil.exe
  2⤵
  PID:12320
- C:\Windows\System\TWLoIIL.exe
  C:\Windows\System\TWLoIIL.exe
  2⤵
  PID:12336
- C:\Windows\System\HUpFOhE.exe
  C:\Windows\System\HUpFOhE.exe
  2⤵
  PID:12352
- C:\Windows\System\SsPvzDE.exe
  C:\Windows\System\SsPvzDE.exe
  2⤵
  PID:12368
- C:\Windows\System\NdfUhtZ.exe
  C:\Windows\System\NdfUhtZ.exe
  2⤵
  PID:12384
- C:\Windows\System\idYMEHe.exe
  C:\Windows\System\idYMEHe.exe
  2⤵
  PID:12400
- C:\Windows\System\QLDiBHr.exe
  C:\Windows\System\QLDiBHr.exe
  2⤵
  PID:12428
- C:\Windows\System\TpIBqBO.exe
  C:\Windows\System\TpIBqBO.exe
  2⤵
  PID:12448
- C:\Windows\System\xTVpytr.exe
  C:\Windows\System\xTVpytr.exe
  2⤵
  PID:12508
- C:\Windows\System\dxhrLkN.exe
  C:\Windows\System\dxhrLkN.exe
  2⤵
  PID:12548
- C:\Windows\System\fYTgOJH.exe
  C:\Windows\System\fYTgOJH.exe
  2⤵
  PID:12576
- C:\Windows\System\vxklCmR.exe
  C:\Windows\System\vxklCmR.exe
  2⤵
  PID:12648
- C:\Windows\System\tnJfpab.exe
  C:\Windows\System\tnJfpab.exe
  2⤵
  PID:12676
- C:\Windows\System\sUaYGYX.exe
  C:\Windows\System\sUaYGYX.exe
  2⤵
  PID:12700
- C:\Windows\System\jEPRmzI.exe
  C:\Windows\System\jEPRmzI.exe
  2⤵
  PID:12748
- C:\Windows\System\zGpUTHZ.exe
  C:\Windows\System\zGpUTHZ.exe
  2⤵
  PID:12780
- C:\Windows\System\wVIXlmo.exe
  C:\Windows\System\wVIXlmo.exe
  2⤵
  PID:12808
- C:\Windows\System\QtoCCXn.exe
  C:\Windows\System\QtoCCXn.exe
  2⤵
  PID:12828
- C:\Windows\System\KbDBvHU.exe
  C:\Windows\System\KbDBvHU.exe
  2⤵
  PID:12884
- C:\Windows\System\SECzosZ.exe
  C:\Windows\System\SECzosZ.exe
  2⤵
  PID:12912
- C:\Windows\System\gMMerGK.exe
  C:\Windows\System\gMMerGK.exe
  2⤵
  PID:12964
- C:\Windows\System\gZiOPxW.exe
  C:\Windows\System\gZiOPxW.exe
  2⤵
  PID:12980
- C:\Windows\System\jABhipU.exe
  C:\Windows\System\jABhipU.exe
  2⤵
  PID:13000
- C:\Windows\System\vfZPezH.exe
  C:\Windows\System\vfZPezH.exe
  2⤵
  PID:13028
- C:\Windows\System\BtveXst.exe
  C:\Windows\System\BtveXst.exe
  2⤵
  PID:13052
- C:\Windows\System\fQInilQ.exe
  C:\Windows\System\fQInilQ.exe
  2⤵
  PID:13076
- C:\Windows\System\AFvdwMz.exe
  C:\Windows\System\AFvdwMz.exe
  2⤵
  PID:13120
- C:\Windows\System\eOImkES.exe
  C:\Windows\System\eOImkES.exe
  2⤵
  PID:13148
- C:\Windows\System\tsWwVPp.exe
  C:\Windows\System\tsWwVPp.exe
  2⤵
  PID:13164
- C:\Windows\System\vXbIrhG.exe
  C:\Windows\System\vXbIrhG.exe
  2⤵
  PID:13192
- C:\Windows\System\dmSflXb.exe
  C:\Windows\System\dmSflXb.exe
  2⤵
  PID:13216
- C:\Windows\System\lYTsUWs.exe
  C:\Windows\System\lYTsUWs.exe
  2⤵
  PID:13256
- C:\Windows\System\vhhigbP.exe
  C:\Windows\System\vhhigbP.exe
  2⤵
  PID:13276
- C:\Windows\System\QrgyNjE.exe
  C:\Windows\System\QrgyNjE.exe
  2⤵
  PID:13308
- C:\Windows\System\WWJlWxp.exe
  C:\Windows\System\WWJlWxp.exe
  2⤵
  PID:12280
- C:\Windows\System\xTQJidp.exe
  C:\Windows\System\xTQJidp.exe
  2⤵
  PID:11440
- C:\Windows\System\ZVeGSkJ.exe
  C:\Windows\System\ZVeGSkJ.exe
  2⤵
  PID:12332
- C:\Windows\System\KKmZcZd.exe
  C:\Windows\System\KKmZcZd.exe
  2⤵
  PID:11852
- C:\Windows\System\bmRzpjv.exe
  C:\Windows\System\bmRzpjv.exe
  2⤵
  PID:12344
- C:\Windows\System\BDFSjIR.exe
  C:\Windows\System\BDFSjIR.exe
  2⤵
  PID:12392
- C:\Windows\System\duWxoEP.exe
  C:\Windows\System\duWxoEP.exe
  2⤵
  PID:12488
- C:\Windows\System\WrOHHIn.exe
  C:\Windows\System\WrOHHIn.exe
  2⤵
  PID:12572
- C:\Windows\System\GzIgPvv.exe
  C:\Windows\System\GzIgPvv.exe
  2⤵
  PID:4896
- C:\Windows\System\yLtQLLD.exe
  C:\Windows\System\yLtQLLD.exe
  2⤵
  PID:12660
- C:\Windows\System\zrcfnbr.exe
  C:\Windows\System\zrcfnbr.exe
  2⤵
  PID:12732
- C:\Windows\System\MRbjXPn.exe
  C:\Windows\System\MRbjXPn.exe
  2⤵
  PID:12764
- C:\Windows\System\KfZFhmI.exe
  C:\Windows\System\KfZFhmI.exe
  2⤵
  PID:12796
- C:\Windows\System\MKBmQbN.exe
  C:\Windows\System\MKBmQbN.exe
  2⤵
  PID:12892
- C:\Windows\System\TiAuIgh.exe
  C:\Windows\System\TiAuIgh.exe
  2⤵
  PID:3732
- C:\Windows\System\dAQomSE.exe
  C:\Windows\System\dAQomSE.exe
  2⤵
  PID:996
- C:\Windows\System\QBhXvtc.exe
  C:\Windows\System\QBhXvtc.exe
  2⤵
  PID:13008
- C:\Windows\System\DTCOvOJ.exe
  C:\Windows\System\DTCOvOJ.exe
  2⤵
  PID:13036
- C:\Windows\System\UidGFLs.exe
  C:\Windows\System\UidGFLs.exe
  2⤵
  PID:13144
- C:\Windows\System\ROBMBsW.exe
  C:\Windows\System\ROBMBsW.exe
  2⤵
  PID:13176
- C:\Windows\System\bWZVpBX.exe
  C:\Windows\System\bWZVpBX.exe
  2⤵
  PID:13252
- C:\Windows\System\ertWqSu.exe
  C:\Windows\System\ertWqSu.exe
  2⤵
  PID:13288
- C:\Windows\System\dGeKQXz.exe
  C:\Windows\System\dGeKQXz.exe
  2⤵
  PID:12284
- C:\Windows\System\FQxEecK.exe
  C:\Windows\System\FQxEecK.exe
  2⤵
  PID:11468
- C:\Windows\System\afzCiev.exe
  C:\Windows\System\afzCiev.exe
  2⤵
  PID:12484
- C:\Windows\System\WZnwFrr.exe
  C:\Windows\System\WZnwFrr.exe
  2⤵
  PID:12560
- C:\Windows\System\unWzctG.exe
  C:\Windows\System\unWzctG.exe
  2⤵
  PID:12692
- C:\Windows\System\SEYqRNV.exe
  C:\Windows\System\SEYqRNV.exe
  2⤵
  PID:12824
- C:\Windows\System\jUJHhjJ.exe
  C:\Windows\System\jUJHhjJ.exe
  2⤵
  PID:3588
- C:\Windows\System\dxQbdlA.exe
  C:\Windows\System\dxQbdlA.exe
  2⤵
  PID:13044
- C:\Windows\System\IEvtXIf.exe
  C:\Windows\System\IEvtXIf.exe
  2⤵
  PID:13184
- C:\Windows\System\aifXYrs.exe
  C:\Windows\System\aifXYrs.exe
  2⤵
  PID:13272
- C:\Windows\System\fhLCxJR.exe
  C:\Windows\System\fhLCxJR.exe
  2⤵
  PID:1244
- C:\Windows\System\KAhQMba.exe
  C:\Windows\System\KAhQMba.exe
  2⤵
  PID:3572
- C:\Windows\System\rvIImco.exe
  C:\Windows\System\rvIImco.exe
  2⤵
  PID:12856
- C:\Windows\System\cTPvyri.exe
  C:\Windows\System\cTPvyri.exe
  2⤵
  PID:13016
- C:\Windows\System\oDRLPhm.exe
  C:\Windows\System\oDRLPhm.exe
  2⤵
  PID:11648
- C:\Windows\System\TMXmudb.exe
  C:\Windows\System\TMXmudb.exe
  2⤵
  PID:12424
- C:\Windows\System\YApcvlW.exe
  C:\Windows\System\YApcvlW.exe
  2⤵
  PID:13324
- C:\Windows\System\CqgSrCK.exe
  C:\Windows\System\CqgSrCK.exe
  2⤵
  PID:13348
- C:\Windows\System\oIZsjJA.exe
  C:\Windows\System\oIZsjJA.exe
  2⤵
  PID:13380
- C:\Windows\System\TFkvucx.exe
  C:\Windows\System\TFkvucx.exe
  2⤵
  PID:13412
- C:\Windows\System\erOtdCJ.exe
  C:\Windows\System\erOtdCJ.exe
  2⤵
  PID:14016
- C:\Windows\System\lGBQXGS.exe
  C:\Windows\System\lGBQXGS.exe
  2⤵
  PID:14040
- C:\Windows\System\zVFCaaP.exe
  C:\Windows\System\zVFCaaP.exe
  2⤵
  PID:14056
- C:\Windows\System\TudJfMI.exe
  C:\Windows\System\TudJfMI.exe
  2⤵
  PID:14072
- C:\Windows\System\YHKWSXT.exe
  C:\Windows\System\YHKWSXT.exe
  2⤵
  PID:14088
- C:\Windows\System\CdXosVj.exe
  C:\Windows\System\CdXosVj.exe
  2⤵
  PID:14104
- C:\Windows\System\SHElvGp.exe
  C:\Windows\System\SHElvGp.exe
  2⤵
  PID:14132
- C:\Windows\System\Juahpqx.exe
  C:\Windows\System\Juahpqx.exe
  2⤵
  PID:14140
- C:\Windows\System\ZvAVnou.exe
  C:\Windows\System\ZvAVnou.exe
  2⤵
  PID:14156
- C:\Windows\System\nzVWdpT.exe
  C:\Windows\System\nzVWdpT.exe
  2⤵
  PID:14180
- C:\Windows\System\rAztOUT.exe
  C:\Windows\System\rAztOUT.exe
  2⤵
  PID:14196
- C:\Windows\System\VKWsIOt.exe
  C:\Windows\System\VKWsIOt.exe
  2⤵
  PID:14228
- C:\Windows\System\aIuxpRA.exe
  C:\Windows\System\aIuxpRA.exe
  2⤵
  PID:14240
- C:\Windows\System\bgjxhfF.exe
  C:\Windows\System\bgjxhfF.exe
  2⤵
  PID:14260
- C:\Windows\System\oyAcYQh.exe
  C:\Windows\System\oyAcYQh.exe
  2⤵
  PID:14280
- C:\Windows\System\AdwvTdc.exe
  C:\Windows\System\AdwvTdc.exe
  2⤵
  PID:14312
- C:\Windows\System\tsvopGv.exe
  C:\Windows\System\tsvopGv.exe
  2⤵
  PID:14332
- C:\Windows\System\LTYScYO.exe
  C:\Windows\System\LTYScYO.exe
  2⤵
  PID:13336
- C:\Windows\System\EAdyqHU.exe
  C:\Windows\System\EAdyqHU.exe
  2⤵
  PID:13368
- C:\Windows\System\tncXEjj.exe
  C:\Windows\System\tncXEjj.exe
  2⤵
  PID:13440
- C:\Windows\System\ccldEHf.exe
  C:\Windows\System\ccldEHf.exe
  2⤵
  PID:13468
- C:\Windows\System\ZRqsxio.exe
  C:\Windows\System\ZRqsxio.exe
  2⤵
  PID:13480
- C:\Windows\System\mtyzuEP.exe
  C:\Windows\System\mtyzuEP.exe
  2⤵
  PID:13504
- C:\Windows\System\CHnUtLw.exe
  C:\Windows\System\CHnUtLw.exe
  2⤵
  PID:13520
- C:\Windows\System\VeuRnEk.exe
  C:\Windows\System\VeuRnEk.exe
  2⤵
  PID:13536
- C:\Windows\System\dNqZDGT.exe
  C:\Windows\System\dNqZDGT.exe
  2⤵
  PID:13556
- C:\Windows\System\kdDhdaI.exe
  C:\Windows\System\kdDhdaI.exe
  2⤵
  PID:1864
- C:\Windows\System\esixmCD.exe
  C:\Windows\System\esixmCD.exe
  2⤵
  PID:13612
- C:\Windows\System\LedMAZb.exe
  C:\Windows\System\LedMAZb.exe
  2⤵
  PID:13636
- C:\Windows\System\uMMwtdb.exe
  C:\Windows\System\uMMwtdb.exe
  2⤵
  PID:10048
- C:\Windows\System\IDNEncR.exe
  C:\Windows\System\IDNEncR.exe
  2⤵
  PID:13720
- C:\Windows\System\reWTmlJ.exe
  C:\Windows\System\reWTmlJ.exe
  2⤵
  PID:13740
- C:\Windows\System\nyqDOYq.exe
  C:\Windows\System\nyqDOYq.exe
  2⤵
  PID:13760
- C:\Windows\System\wjXmgxX.exe
  C:\Windows\System\wjXmgxX.exe
  2⤵
  PID:13796
- C:\Windows\System\lhHWwci.exe
  C:\Windows\System\lhHWwci.exe
  2⤵
  PID:13848
- C:\Windows\System\lvZhRYF.exe
  C:\Windows\System\lvZhRYF.exe
  2⤵
  PID:4820
- C:\Windows\System\UPLhfkc.exe
  C:\Windows\System\UPLhfkc.exe
  2⤵
  PID:2168
- C:\Windows\System\fYtfHUp.exe
  C:\Windows\System\fYtfHUp.exe
  2⤵
  PID:13924
- C:\Windows\System\OoBixVy.exe
  C:\Windows\System\OoBixVy.exe
  2⤵
  PID:408
- C:\Windows\System\qYQkoez.exe
  C:\Windows\System\qYQkoez.exe
  2⤵
  PID:3052
- C:\Windows\System\izEfxvq.exe
  C:\Windows\System\izEfxvq.exe
  2⤵
  PID:2992
- C:\Windows\System\mCYIqwK.exe
  C:\Windows\System\mCYIqwK.exe
  2⤵
  PID:5224
- C:\Windows\System\HWeRNgu.exe
  C:\Windows\System\HWeRNgu.exe
  2⤵
  PID:5268
- C:\Windows\System\udHysdd.exe
  C:\Windows\System\udHysdd.exe
  2⤵
  PID:5932
- C:\Windows\System\AhKfozy.exe
  C:\Windows\System\AhKfozy.exe
  2⤵
  PID:13952
- C:\Windows\System\BHWpHjz.exe
  C:\Windows\System\BHWpHjz.exe
  2⤵
  PID:6040
- C:\Windows\System\kIuHQvK.exe
  C:\Windows\System\kIuHQvK.exe
  2⤵
  PID:5256
- C:\Windows\System\SsRBxnv.exe
  C:\Windows\System\SsRBxnv.exe
  2⤵
  PID:3944
- C:\Windows\System\EFuluMr.exe
  C:\Windows\System\EFuluMr.exe
  2⤵
  PID:14012
- C:\Windows\System\sVEGTfU.exe
  C:\Windows\System\sVEGTfU.exe
  2⤵
  PID:14036
- C:\Windows\System\VcdIYIA.exe
  C:\Windows\System\VcdIYIA.exe
  2⤵
  PID:6032
- C:\Windows\System\daRpvRG.exe
  C:\Windows\System\daRpvRG.exe
  2⤵
  PID:4572
- C:\Windows\System\ZmgXTmJ.exe
  C:\Windows\System\ZmgXTmJ.exe
  2⤵
  PID:14100
- C:\Windows\System\NHWzBZk.exe
  C:\Windows\System\NHWzBZk.exe
  2⤵
  PID:3356
- C:\Windows\System\pUJpwDu.exe
  C:\Windows\System\pUJpwDu.exe
  2⤵
  PID:4444
- C:\Windows\System\UEyNYQS.exe
  C:\Windows\System\UEyNYQS.exe
  2⤵
  PID:14164
- C:\Windows\System\OxfXJfI.exe
  C:\Windows\System\OxfXJfI.exe
  2⤵
  PID:14188
- C:\Windows\System\XVmvjPU.exe
  C:\Windows\System\XVmvjPU.exe
  2⤵
  PID:14204
- C:\Windows\System\ghFrWCY.exe
  C:\Windows\System\ghFrWCY.exe
  2⤵
  PID:14236
- C:\Windows\System\OxTtBXg.exe
  C:\Windows\System\OxTtBXg.exe
  2⤵
  PID:14252
- C:\Windows\System\GAHVEgA.exe
  C:\Windows\System\GAHVEgA.exe
  2⤵
  PID:5352
- C:\Windows\System\eFNmjrf.exe
  C:\Windows\System\eFNmjrf.exe
  2⤵
  PID:14272
- C:\Windows\System\yzHoGWM.exe
  C:\Windows\System\yzHoGWM.exe
  2⤵
  PID:1768
- C:\Windows\System\yxqeysq.exe
  C:\Windows\System\yxqeysq.exe
  2⤵
  PID:5916
- C:\Windows\System\ZzfWGva.exe
  C:\Windows\System\ZzfWGva.exe
  2⤵
  PID:14328
- C:\Windows\System\jpKOEwy.exe
  C:\Windows\System\jpKOEwy.exe
  2⤵
  PID:5504
- C:\Windows\System\mZtOlgq.exe
  C:\Windows\System\mZtOlgq.exe
  2⤵
  PID:6196
- C:\Windows\System\DNZXkDU.exe
  C:\Windows\System\DNZXkDU.exe
  2⤵
  PID:13496
- C:\Windows\System\cZiJQXh.exe
  C:\Windows\System\cZiJQXh.exe
  2⤵
  PID:2236
- C:\Windows\System\WBSYEVG.exe
  C:\Windows\System\WBSYEVG.exe
  2⤵
  PID:6348
- C:\Windows\System\kaFjGGN.exe
  C:\Windows\System\kaFjGGN.exe
  2⤵
  PID:13528
- C:\Windows\System\FLyaBEX.exe
  C:\Windows\System\FLyaBEX.exe
  2⤵
  PID:13532
- C:\Windows\System\HoNRNlp.exe
  C:\Windows\System\HoNRNlp.exe
  2⤵
  PID:6408
- C:\Windows\System\CrRJoQJ.exe
  C:\Windows\System\CrRJoQJ.exe
  2⤵
  PID:3680
- C:\Windows\System\JWOMbLT.exe
  C:\Windows\System\JWOMbLT.exe
  2⤵
  PID:1524
- C:\Windows\System\FMMdJNm.exe
  C:\Windows\System\FMMdJNm.exe
  2⤵
  PID:13620
- C:\Windows\System\gsAIQvH.exe
  C:\Windows\System\gsAIQvH.exe
  2⤵
  PID:3948
- C:\Windows\System\pNvRhBg.exe
  C:\Windows\System\pNvRhBg.exe
  2⤵
  PID:4660
- C:\Windows\System\PGrYTgZ.exe
  C:\Windows\System\PGrYTgZ.exe
  2⤵
  PID:10116
- C:\Windows\System\zVDpExz.exe
  C:\Windows\System\zVDpExz.exe
  2⤵
  PID:10068
- C:\Windows\System\lBrIYRs.exe
  C:\Windows\System\lBrIYRs.exe
  2⤵
  PID:6708
- C:\Windows\System\LgvjhGg.exe
  C:\Windows\System\LgvjhGg.exe
  2⤵
  PID:6760
- C:\Windows\System\xHBBqSt.exe
  C:\Windows\System\xHBBqSt.exe
  2⤵
  PID:13736
- C:\Windows\System\siMhSOb.exe
  C:\Windows\System\siMhSOb.exe
  2⤵
  PID:6784
- C:\Windows\System\cSUqwWP.exe
  C:\Windows\System\cSUqwWP.exe
  2⤵
  PID:13584
- C:\Windows\System\NBruqKe.exe
  C:\Windows\System\NBruqKe.exe
  2⤵
  PID:13492
- C:\Windows\System\GVxvXRB.exe
  C:\Windows\System\GVxvXRB.exe
  2⤵
  PID:13772
- C:\Windows\System\NQCLPCb.exe
  C:\Windows\System\NQCLPCb.exe
  2⤵
  PID:14116
- C:\Windows\System\qBEWzZL.exe
  C:\Windows\System\qBEWzZL.exe
  2⤵
  PID:6828
- C:\Windows\System\BKZvtdP.exe
  C:\Windows\System\BKZvtdP.exe
  2⤵
  PID:6860
- C:\Windows\System\tyuTNDX.exe
  C:\Windows\System\tyuTNDX.exe
  2⤵
  PID:13716
- C:\Windows\System\ioOyWkr.exe
  C:\Windows\System\ioOyWkr.exe
  2⤵
  PID:6992
- C:\Windows\System\OMsnWaA.exe
  C:\Windows\System\OMsnWaA.exe
  2⤵
  PID:7024
- C:\Windows\System\GoFLIHU.exe
  C:\Windows\System\GoFLIHU.exe
  2⤵
  PID:2708
- C:\Windows\System\XBHjKge.exe
  C:\Windows\System\XBHjKge.exe
  2⤵
  PID:7068
- C:\Windows\System\MGFDUvS.exe
  C:\Windows\System\MGFDUvS.exe
  2⤵
  PID:7152
- C:\Windows\System\QmWXABt.exe
  C:\Windows\System\QmWXABt.exe
  2⤵
  PID:1392
- C:\Windows\System\KfmhVzP.exe
  C:\Windows\System\KfmhVzP.exe
  2⤵
  PID:7096
- C:\Windows\System\RZzPqzp.exe
  C:\Windows\System\RZzPqzp.exe
  2⤵
  PID:13912
- C:\Windows\System\tuGPEPV.exe
  C:\Windows\System\tuGPEPV.exe
  2⤵
  PID:6160
- C:\Windows\System\HRtzcfC.exe
  C:\Windows\System\HRtzcfC.exe
  2⤵
  PID:6332
- C:\Windows\System\SqSSkiz.exe
  C:\Windows\System\SqSSkiz.exe
  2⤵
  PID:3620
- C:\Windows\System\UJXhqSr.exe
  C:\Windows\System\UJXhqSr.exe
  2⤵
  PID:3268
- C:\Windows\System\lLAUWJi.exe
  C:\Windows\System\lLAUWJi.exe
  2⤵
  PID:2900
- C:\Windows\System\DsfSmch.exe
  C:\Windows\System\DsfSmch.exe
  2⤵
  PID:2500
- C:\Windows\System\isbCeyi.exe
  C:\Windows\System\isbCeyi.exe
  2⤵
  PID:4364
- C:\Windows\System\fGXBSWe.exe
  C:\Windows\System\fGXBSWe.exe
  2⤵
  PID:6456
- C:\Windows\System\nONgSjB.exe
  C:\Windows\System\nONgSjB.exe
  2⤵
  PID:2528
- C:\Windows\System\FBRDRnr.exe
  C:\Windows\System\FBRDRnr.exe
  2⤵
  PID:14112
- C:\Windows\System\xFFLIYA.exe
  C:\Windows\System\xFFLIYA.exe
  2⤵
  PID:13940
- C:\Windows\System\pAZgavC.exe
  C:\Windows\System\pAZgavC.exe
  2⤵
  PID:6732
- C:\Windows\System\PnLiveI.exe
  C:\Windows\System\PnLiveI.exe
  2⤵
  PID:5140
- C:\Windows\System\vwNaORW.exe
  C:\Windows\System\vwNaORW.exe
  2⤵
  PID:5620
- C:\Windows\System\lxznXlx.exe
  C:\Windows\System\lxznXlx.exe
  2⤵
  PID:7020
- C:\Windows\System\LrcOMCC.exe
  C:\Windows\System\LrcOMCC.exe
  2⤵
  PID:7100
- C:\Windows\System\JuVmnWg.exe
  C:\Windows\System\JuVmnWg.exe
  2⤵
  PID:13956
- C:\Windows\System\gBSIHnA.exe
  C:\Windows\System\gBSIHnA.exe
  2⤵
  PID:444
- C:\Windows\System\MgVibKV.exe
  C:\Windows\System\MgVibKV.exe
  2⤵
  PID:13728
- C:\Windows\System\nBIoZLN.exe
  C:\Windows\System\nBIoZLN.exe
  2⤵
  PID:13992
- C:\Windows\System\PBHHfKS.exe
  C:\Windows\System\PBHHfKS.exe
  2⤵
  PID:5764
- C:\Windows\System\zKHSqKw.exe
  C:\Windows\System\zKHSqKw.exe
  2⤵
  PID:1820
- C:\Windows\System\GdodmOl.exe
  C:\Windows\System\GdodmOl.exe
  2⤵
  PID:13824
- C:\Windows\System\fhmnqKV.exe
  C:\Windows\System\fhmnqKV.exe
  2⤵
  PID:5852
- C:\Windows\System\MgwZRUr.exe
  C:\Windows\System\MgwZRUr.exe
  2⤵
  PID:14068
- C:\Windows\System\dkmNnmc.exe
  C:\Windows\System\dkmNnmc.exe
  2⤵
  PID:2636
- C:\Windows\System\VoFtsnB.exe
  C:\Windows\System\VoFtsnB.exe
  2⤵
  PID:4620
- C:\Windows\System\jhvUgDM.exe
  C:\Windows\System\jhvUgDM.exe
  2⤵
  PID:528
- C:\Windows\System\HuuWNsW.exe
  C:\Windows\System\HuuWNsW.exe
  2⤵
  PID:1492
- C:\Windows\System\RuBtwTY.exe
  C:\Windows\System\RuBtwTY.exe
  2⤵
  PID:13880
- C:\Windows\System\rqwBWer.exe
  C:\Windows\System\rqwBWer.exe
  2⤵
  PID:13896
- C:\Windows\System\NvjnIrL.exe
  C:\Windows\System\NvjnIrL.exe
  2⤵
  PID:3828
- C:\Windows\System\uWcyjsG.exe
  C:\Windows\System\uWcyjsG.exe
  2⤵
  PID:13812
- C:\Windows\System\Jtsvkio.exe
  C:\Windows\System\Jtsvkio.exe
  2⤵
  PID:14084
- C:\Windows\System\gupXSMr.exe
  C:\Windows\System\gupXSMr.exe
  2⤵
  PID:14096
- C:\Windows\System\FJrvqaR.exe
  C:\Windows\System\FJrvqaR.exe
  2⤵
  PID:6412
- C:\Windows\System\tvWuSMu.exe
  C:\Windows\System\tvWuSMu.exe
  2⤵
  PID:14176
- C:\Windows\System\muRSisB.exe
  C:\Windows\System\muRSisB.exe
  2⤵
  PID:5604
- C:\Windows\System\eAqDZOV.exe
  C:\Windows\System\eAqDZOV.exe
  2⤵
  PID:6908
- C:\Windows\System\sYdnYgi.exe
  C:\Windows\System\sYdnYgi.exe
  2⤵
  PID:14224
- C:\Windows\System\moEzYDq.exe
  C:\Windows\System\moEzYDq.exe
  2⤵
  PID:1976
- C:\Windows\System\ipkNTUF.exe
  C:\Windows\System\ipkNTUF.exe
  2⤵
  PID:1468
- C:\Windows\System\FIKsJvW.exe
  C:\Windows\System\FIKsJvW.exe
  2⤵
  PID:14300
- C:\Windows\System\cMJViZs.exe
  C:\Windows\System\cMJViZs.exe
  2⤵
  PID:13400
- C:\Windows\System\LVwpurL.exe
  C:\Windows\System\LVwpurL.exe
  2⤵
  PID:13564
- C:\Windows\System\AnRJeaL.exe
  C:\Windows\System\AnRJeaL.exe
  2⤵
  PID:13332
- C:\Windows\System\fduqASe.exe
  C:\Windows\System\fduqASe.exe
  2⤵
  PID:13372
- C:\Windows\System\bPUDNRE.exe
  C:\Windows\System\bPUDNRE.exe
  2⤵
  PID:2412
- C:\Windows\System\LqVrRiH.exe
  C:\Windows\System\LqVrRiH.exe
  2⤵
  PID:13436
- C:\Windows\System\tEAKZho.exe
  C:\Windows\System\tEAKZho.exe
  2⤵
  PID:13464
- C:\Windows\System\HtAjRxm.exe
  C:\Windows\System\HtAjRxm.exe
  2⤵
  PID:7564
- C:\Windows\System\bPMXfmy.exe
  C:\Windows\System\bPMXfmy.exe
  2⤵
  PID:6688
- C:\Windows\System\ZEfBLVk.exe
  C:\Windows\System\ZEfBLVk.exe
  2⤵
  PID:7932
- C:\Windows\System\BHtHAul.exe
  C:\Windows\System\BHtHAul.exe
  2⤵
  PID:4880
- C:\Windows\System\dlrUhwQ.exe
  C:\Windows\System\dlrUhwQ.exe
  2⤵
  PID:6764
- C:\Windows\System\aINfBXe.exe
  C:\Windows\System\aINfBXe.exe
  2⤵
  PID:8044
- C:\Windows\System\IdNdPVe.exe
  C:\Windows\System\IdNdPVe.exe
  2⤵
  PID:8076
- C:\Windows\System\eYPbzto.exe
  C:\Windows\System\eYPbzto.exe
  2⤵
  PID:8116
- C:\Windows\System\Hchbkpz.exe
  C:\Windows\System\Hchbkpz.exe
  2⤵
  PID:13804
- C:\Windows\System\AqqulyG.exe
  C:\Windows\System\AqqulyG.exe
  2⤵
  PID:8152
- C:\Windows\System\ZxPJnKZ.exe
  C:\Windows\System\ZxPJnKZ.exe
  2⤵
  PID:2384
- C:\Windows\System\oBftgNb.exe
  C:\Windows\System\oBftgNb.exe
  2⤵
  PID:6884
- C:\Windows\System\UalKWHu.exe
  C:\Windows\System\UalKWHu.exe
  2⤵
  PID:7224
- C:\Windows\System\evBdLwM.exe
  C:\Windows\System\evBdLwM.exe
  2⤵
  PID:7256
- C:\Windows\System\aQmLZjo.exe
  C:\Windows\System\aQmLZjo.exe
  2⤵
  PID:7492
- C:\Windows\System\vusfxlw.exe
  C:\Windows\System\vusfxlw.exe
  2⤵
  PID:13840
- C:\Windows\System\bFPruUP.exe
  C:\Windows\System\bFPruUP.exe
  2⤵
  PID:7764
- C:\Windows\System\yVaPRgU.exe
  C:\Windows\System\yVaPRgU.exe
  2⤵
  PID:7688
- C:\Windows\System\TvcptJz.exe
  C:\Windows\System\TvcptJz.exe
  2⤵
  PID:3708
- C:\Windows\System\trfURBn.exe
  C:\Windows\System\trfURBn.exe
  2⤵
  PID:13932
- C:\Windows\System\ybicIUx.exe
  C:\Windows\System\ybicIUx.exe
  2⤵
  PID:8048
- C:\Windows\System\pvIzLpM.exe
  C:\Windows\System\pvIzLpM.exe
  2⤵
  PID:6200
- C:\Windows\System\NSJCziV.exe
  C:\Windows\System\NSJCziV.exe
  2⤵
  PID:6352
- C:\Windows\System\cCBgOVl.exe
  C:\Windows\System\cCBgOVl.exe
  2⤵
  PID:4184
- C:\Windows\System\TYcuqvC.exe
  C:\Windows\System\TYcuqvC.exe
  2⤵
  PID:4504
- C:\Windows\System\btiFfQZ.exe
  C:\Windows\System\btiFfQZ.exe
  2⤵
  PID:8108
- C:\Windows\System\mpNBlXr.exe
  C:\Windows\System\mpNBlXr.exe
  2⤵
  PID:13808
- C:\Windows\System\ySyjSVN.exe
  C:\Windows\System\ySyjSVN.exe
  2⤵
  PID:2532
- C:\Windows\System\fnjjxPR.exe
  C:\Windows\System\fnjjxPR.exe
  2⤵
  PID:7472
- C:\Windows\System\bvTxFGW.exe
  C:\Windows\System\bvTxFGW.exe
  2⤵
  PID:13712
- C:\Windows\System\urvSFgp.exe
  C:\Windows\System\urvSFgp.exe
  2⤵
  PID:6768
- C:\Windows\System\ZxkDxCk.exe
  C:\Windows\System\ZxkDxCk.exe
  2⤵
  PID:8248
- C:\Windows\System\JagWeII.exe
  C:\Windows\System\JagWeII.exe
  2⤵
  PID:7076
- C:\Windows\System\aQNGFqg.exe
  C:\Windows\System\aQNGFqg.exe
  2⤵
  PID:8308
- C:\Windows\System\EFsJZqU.exe
  C:\Windows\System\EFsJZqU.exe
  2⤵
  PID:2068
- C:\Windows\System\JMFoHZE.exe
  C:\Windows\System\JMFoHZE.exe
  2⤵
  PID:8376
- C:\Windows\System\JbEdgpe.exe
  C:\Windows\System\JbEdgpe.exe
  2⤵
  PID:5820
- C:\Windows\System\UWXNGFP.exe
  C:\Windows\System\UWXNGFP.exe
  2⤵
  PID:6384
- C:\Windows\System\foSHDSt.exe
  C:\Windows\System\foSHDSt.exe
  2⤵
  PID:4476
- C:\Windows\System\GgElnOt.exe
  C:\Windows\System\GgElnOt.exe
  2⤵
  PID:8568
- C:\Windows\System\XTBFupl.exe
  C:\Windows\System\XTBFupl.exe
  2⤵
  PID:13820
- C:\Windows\System\IhsLpdE.exe
  C:\Windows\System\IhsLpdE.exe
  2⤵
  PID:8680
- C:\Windows\System\DruzQZH.exe
  C:\Windows\System\DruzQZH.exe
  2⤵
  PID:8684
- C:\Windows\System\eBYquHK.exe
  C:\Windows\System\eBYquHK.exe
  2⤵
  PID:2676
- C:\Windows\System\fOIPrYP.exe
  C:\Windows\System\fOIPrYP.exe
  2⤵
  PID:13748
- C:\Windows\System\buhBHZn.exe
  C:\Windows\System\buhBHZn.exe
  2⤵
  PID:2052
- C:\Windows\System\ZBFYYWc.exe
  C:\Windows\System\ZBFYYWc.exe
  2⤵
  PID:13944
- C:\Windows\System\JVBadkF.exe
  C:\Windows\System\JVBadkF.exe
  2⤵
  PID:4884
- C:\Windows\System\LrALUVG.exe
  C:\Windows\System\LrALUVG.exe
  2⤵
  PID:8908
- C:\Windows\System\yRHztFf.exe
  C:\Windows\System\yRHztFf.exe
  2⤵
  PID:5016
- C:\Windows\System\UfVcnFE.exe
  C:\Windows\System\UfVcnFE.exe
  2⤵
  PID:1500
- C:\Windows\System\CSCdsfl.exe
  C:\Windows\System\CSCdsfl.exe
  2⤵
  PID:9004
- C:\Windows\System\CiYsIEQ.exe
  C:\Windows\System\CiYsIEQ.exe
  2⤵
  PID:424
- C:\Windows\System\SOcTSnq.exe
  C:\Windows\System\SOcTSnq.exe
  2⤵
  PID:9068
- C:\Windows\System\kfvFKGt.exe
  C:\Windows\System\kfvFKGt.exe
  2⤵
  PID:9072
- C:\Windows\System\LlDuDrY.exe
  C:\Windows\System\LlDuDrY.exe
  2⤵
  PID:9108
- C:\Windows\System\ZuhvZXN.exe
  C:\Windows\System\ZuhvZXN.exe
  2⤵
  PID:3400
- C:\Windows\System\DhRUcJr.exe
  C:\Windows\System\DhRUcJr.exe
  2⤵
  PID:3836
- C:\Windows\System\RyXmFLd.exe
  C:\Windows\System\RyXmFLd.exe
  2⤵
  PID:604
- C:\Windows\System\QkFVvPR.exe
  C:\Windows\System\QkFVvPR.exe
  2⤵
  PID:5876
- C:\Windows\System\vYvjtOJ.exe
  C:\Windows\System\vYvjtOJ.exe
  2⤵
  PID:8252
- C:\Windows\System\diXLEep.exe
  C:\Windows\System\diXLEep.exe
  2⤵
  PID:6772
- C:\Windows\System\ydzxLxC.exe
  C:\Windows\System\ydzxLxC.exe
  2⤵
  PID:8304
- C:\Windows\System\GKXzPLk.exe
  C:\Windows\System\GKXzPLk.exe
  2⤵
  PID:4692
- C:\Windows\System\XQhWwzz.exe
  C:\Windows\System\XQhWwzz.exe
  2⤵
  PID:3372
- C:\Windows\System\ITSnyoL.exe
  C:\Windows\System\ITSnyoL.exe
  2⤵
  PID:5752
- C:\Windows\System\zxHMJrW.exe
  C:\Windows\System\zxHMJrW.exe
  2⤵
  PID:8516
- C:\Windows\System\xCYmnrn.exe
  C:\Windows\System\xCYmnrn.exe
  2⤵
  PID:14220
- C:\Windows\System\wXJcdfg.exe
  C:\Windows\System\wXJcdfg.exe
  2⤵
  PID:8612
- C:\Windows\System\bybfaIv.exe
  C:\Windows\System\bybfaIv.exe
  2⤵
  PID:5356
- C:\Windows\System\fEiLGeo.exe
  C:\Windows\System\fEiLGeo.exe
  2⤵
  PID:8736
- C:\Windows\System\BIBcNOn.exe
  C:\Windows\System\BIBcNOn.exe
  2⤵
  PID:8840
- C:\Windows\System\ubRbIcQ.exe
  C:\Windows\System\ubRbIcQ.exe
  2⤵
  PID:8868
- C:\Windows\System\mdytvwO.exe
  C:\Windows\System\mdytvwO.exe
  2⤵
  PID:1756
- C:\Windows\System\EXxcLHd.exe
  C:\Windows\System\EXxcLHd.exe
  2⤵
  PID:13688
- C:\Windows\System\tGVSyFY.exe
  C:\Windows\System\tGVSyFY.exe
  2⤵
  PID:5112
- C:\Windows\System\DLVhGrI.exe
  C:\Windows\System\DLVhGrI.exe
  2⤵
  PID:6252
- C:\Windows\System\UeTjobw.exe
  C:\Windows\System\UeTjobw.exe
  2⤵
  PID:6240
- C:\Windows\System\HcUvKak.exe
  C:\Windows\System\HcUvKak.exe
  2⤵
  PID:4436
- C:\Windows\System\CBgVhaI.exe
  C:\Windows\System\CBgVhaI.exe
  2⤵
  PID:8068
- C:\Windows\System\OYgSlwM.exe
  C:\Windows\System\OYgSlwM.exe
  2⤵
  PID:3968
- C:\Windows\System\WmTIPFB.exe
  C:\Windows\System\WmTIPFB.exe
  2⤵
  PID:8468
- C:\Windows\System\TWjocMl.exe
  C:\Windows\System\TWjocMl.exe
  2⤵
  PID:6176
- C:\Windows\System\Tcaxbmp.exe
  C:\Windows\System\Tcaxbmp.exe
  2⤵
  PID:4856
- C:\Windows\System\XVYgNPt.exe
  C:\Windows\System\XVYgNPt.exe
  2⤵
  PID:6320
- C:\Windows\System\enslloz.exe
  C:\Windows\System\enslloz.exe
  2⤵
  PID:1800
- C:\Windows\System\LgifSgI.exe
  C:\Windows\System\LgifSgI.exe
  2⤵
  PID:8348
- C:\Windows\System\aPgbRSB.exe
  C:\Windows\System\aPgbRSB.exe
  2⤵
  PID:9048
- C:\Windows\System\nqDuZbu.exe
  C:\Windows\System\nqDuZbu.exe
  2⤵
  PID:9224
- C:\Windows\System\yFxETFs.exe
  C:\Windows\System\yFxETFs.exe
  2⤵
  PID:9244
- C:\Windows\System\QwzVsXI.exe
  C:\Windows\System\QwzVsXI.exe
  2⤵
  PID:9320
- C:\Windows\System\SZVXMCg.exe
  C:\Windows\System\SZVXMCg.exe
  2⤵
  PID:9380
- C:\Windows\System\erAuhxl.exe
  C:\Windows\System\erAuhxl.exe
  2⤵
  PID:9440
- C:\Windows\System\hmaRLBE.exe
  C:\Windows\System\hmaRLBE.exe
  2⤵
  PID:13516
- C:\Windows\System\bDGtyaC.exe
  C:\Windows\System\bDGtyaC.exe
  2⤵
  PID:13704
- C:\Windows\System\VlxLnPv.exe
  C:\Windows\System\VlxLnPv.exe
  2⤵
  PID:6428
- C:\Windows\System\NPqjuBE.exe
  C:\Windows\System\NPqjuBE.exe
  2⤵
  PID:13752
- C:\Windows\System\VZLvMCL.exe
  C:\Windows\System\VZLvMCL.exe
  2⤵
  PID:6564
- C:\Windows\System\wmQllQD.exe
  C:\Windows\System\wmQllQD.exe
  2⤵
  PID:13656
- C:\Windows\System\PJxZFgY.exe
  C:\Windows\System\PJxZFgY.exe
  2⤵
  PID:5008
- C:\Windows\System\hnaIwpC.exe
  C:\Windows\System\hnaIwpC.exe
  2⤵
  PID:7360
- C:\Windows\System\AunQDCS.exe
  C:\Windows\System\AunQDCS.exe
  2⤵
  PID:7880
- C:\Windows\System\KSlJEDD.exe
  C:\Windows\System\KSlJEDD.exe
  2⤵
  PID:7568
- C:\Windows\System\GkWHjgh.exe
  C:\Windows\System\GkWHjgh.exe
  2⤵
  PID:7408
- C:\Windows\System\LPxCxFf.exe
  C:\Windows\System\LPxCxFf.exe
  2⤵
  PID:7040
- C:\Windows\System\OzfxMfs.exe
  C:\Windows\System\OzfxMfs.exe
  2⤵
  PID:13732
- C:\Windows\System\ukulVVW.exe
  C:\Windows\System\ukulVVW.exe
  2⤵
  PID:1284
- C:\Windows\System\ftZrpDT.exe
  C:\Windows\System\ftZrpDT.exe
  2⤵
  PID:8020
- C:\Windows\System\AAJAbGU.exe
  C:\Windows\System\AAJAbGU.exe
  2⤵
  PID:13404
- C:\Windows\System\foDgHOw.exe
  C:\Windows\System\foDgHOw.exe
  2⤵
  PID:9604
- C:\Windows\System\xqHhHsV.exe
  C:\Windows\System\xqHhHsV.exe
  2⤵
  PID:4084
- C:\Windows\System\XpjWCjE.exe
  C:\Windows\System\XpjWCjE.exe
  2⤵
  PID:9724
- C:\Windows\System\eACcftS.exe
  C:\Windows\System\eACcftS.exe
  2⤵
  PID:7920
- C:\Windows\System\nIpmqlC.exe
  C:\Windows\System\nIpmqlC.exe
  2⤵
  PID:4404
- C:\Windows\System\tKArchr.exe
  C:\Windows\System\tKArchr.exe
  2⤵
  PID:4520
- C:\Windows\System\WoRUSSl.exe
  C:\Windows\System\WoRUSSl.exe
  2⤵
  PID:8168
- C:\Windows\System\orQoGXb.exe
  C:\Windows\System\orQoGXb.exe
  2⤵
  PID:1228
- C:\Windows\System\SpWYEQp.exe
  C:\Windows\System\SpWYEQp.exe
  2⤵
  PID:7644
- C:\Windows\System\WEHujkk.exe
  C:\Windows\System\WEHujkk.exe
  2⤵
  PID:14120
- C:\Windows\System\riqNEFI.exe
  C:\Windows\System\riqNEFI.exe
  2⤵
  PID:9780
- C:\Windows\System\PJQvGFy.exe
  C:\Windows\System\PJQvGFy.exe
  2⤵
  PID:2216
- C:\Windows\System\KAqTduC.exe
  C:\Windows\System\KAqTduC.exe
  2⤵
  PID:6888
- C:\Windows\System\avrUgRw.exe
  C:\Windows\System\avrUgRw.exe
  2⤵
  PID:6948
- C:\Windows\System\EiuQCks.exe
  C:\Windows\System\EiuQCks.exe
  2⤵
  PID:3512
- C:\Windows\System\ANGwlSX.exe
  C:\Windows\System\ANGwlSX.exe
  2⤵
  PID:13968
- C:\Windows\System\pypPcSs.exe
  C:\Windows\System\pypPcSs.exe
  2⤵
  PID:4980
- C:\Windows\System\CivufpZ.exe
  C:\Windows\System\CivufpZ.exe
  2⤵
  PID:400
- C:\Windows\System\VoeGVwV.exe
  C:\Windows\System\VoeGVwV.exe
  2⤵
  PID:8532
- C:\Windows\System\SLlJVXa.exe
  C:\Windows\System\SLlJVXa.exe
  2⤵
  PID:4480
- C:\Windows\System\ihxBQFr.exe
  C:\Windows\System\ihxBQFr.exe
  2⤵
  PID:13856
- C:\Windows\System\tODUqqf.exe
  C:\Windows\System\tODUqqf.exe
  2⤵
  PID:4968
- C:\Windows\System\KgsApkM.exe
  C:\Windows\System\KgsApkM.exe
  2⤵
  PID:4924
- C:\Windows\System\lairSXs.exe
  C:\Windows\System\lairSXs.exe
  2⤵
  PID:8712
- C:\Windows\System\KFhAzkR.exe
  C:\Windows\System\KFhAzkR.exe
  2⤵
  PID:2320
- C:\Windows\System\jZctJAK.exe
  C:\Windows\System\jZctJAK.exe
  2⤵
  PID:3584
- C:\Windows\System\yIneAxv.exe
  C:\Windows\System\yIneAxv.exe
  2⤵
  PID:1400
- C:\Windows\System\jjJhVtq.exe
  C:\Windows\System\jjJhVtq.exe
  2⤵
  PID:9060
- C:\Windows\System\YGETgam.exe
  C:\Windows\System\YGETgam.exe
  2⤵
  PID:9160
- C:\Windows\System\WbqFouD.exe
  C:\Windows\System\WbqFouD.exe
  2⤵
  PID:10224
- C:\Windows\System\jVBazRu.exe
  C:\Windows\System\jVBazRu.exe
  2⤵
  PID:9192
- C:\Windows\System\qJHwVoK.exe
  C:\Windows\System\qJHwVoK.exe
  2⤵
  PID:2300
- C:\Windows\System\adQHjwa.exe
  C:\Windows\System\adQHjwa.exe
  2⤵
  PID:8396
- C:\Windows\System\FjbJUOn.exe
  C:\Windows\System\FjbJUOn.exe
  2⤵
  PID:5372
- C:\Windows\System\QTHkfsZ.exe
  C:\Windows\System\QTHkfsZ.exe
  2⤵
  PID:9708
- C:\Windows\System\LLEBEfj.exe
  C:\Windows\System\LLEBEfj.exe
  2⤵
  PID:9760
- C:\Windows\System\WqloDjl.exe
  C:\Windows\System\WqloDjl.exe
  2⤵
  PID:9900
- C:\Windows\System\GCKDYZp.exe
  C:\Windows\System\GCKDYZp.exe
  2⤵
  PID:9856
- C:\Windows\System\FLlNIoq.exe
  C:\Windows\System\FLlNIoq.exe
  2⤵
  PID:9972
- C:\Windows\System\gJqEYFk.exe
  C:\Windows\System\gJqEYFk.exe
  2⤵
  PID:13500
- C:\Windows\System\iUINTAE.exe
  C:\Windows\System\iUINTAE.exe
  2⤵
  PID:4484
- C:\Windows\System\GcRwULi.exe
  C:\Windows\System\GcRwULi.exe
  2⤵
  PID:2712
- C:\Windows\System\PAmystK.exe
  C:\Windows\System\PAmystK.exe
  2⤵
  PID:9476
- C:\Windows\System\fxCLUqg.exe
  C:\Windows\System\fxCLUqg.exe
  2⤵
  PID:3100
- C:\Windows\System\peNedCK.exe
  C:\Windows\System\peNedCK.exe
  2⤵
  PID:2748
- C:\Windows\System\cLgikgK.exe
  C:\Windows\System\cLgikgK.exe
  2⤵
  PID:6156
- C:\Windows\System\LnFSJsq.exe
  C:\Windows\System\LnFSJsq.exe
  2⤵
  PID:8780
- C:\Windows\System\FWsZtsp.exe
  C:\Windows\System\FWsZtsp.exe
  2⤵
  PID:580
- C:\Windows\System\jmIShuv.exe
  C:\Windows\System\jmIShuv.exe
  2⤵
  PID:9360
- C:\Windows\System\mReTOEH.exe
  C:\Windows\System\mReTOEH.exe
  2⤵
  PID:9248
- C:\Windows\System\TCScmiX.exe
  C:\Windows\System\TCScmiX.exe
  2⤵
  PID:10356
- C:\Windows\System\PIsJzIh.exe
  C:\Windows\System\PIsJzIh.exe
  2⤵
  PID:10408
- C:\Windows\System\ZQbDxqF.exe
  C:\Windows\System\ZQbDxqF.exe
  2⤵
  PID:6324
- C:\Windows\System\afMSpBp.exe
  C:\Windows\System\afMSpBp.exe
  2⤵
  PID:10520
- C:\Windows\System\OoyVbrv.exe
  C:\Windows\System\OoyVbrv.exe
  2⤵
  PID:10552
- C:\Windows\System\yWZDnsK.exe
  C:\Windows\System\yWZDnsK.exe
  2⤵
  PID:13628
- C:\Windows\System\erTktQA.exe
  C:\Windows\System\erTktQA.exe
  2⤵
  PID:10636
- C:\Windows\System\CKyOkFF.exe
  C:\Windows\System\CKyOkFF.exe
  2⤵
  PID:13660
- C:\Windows\System\tIoKgsJ.exe
  C:\Windows\System\tIoKgsJ.exe
  2⤵
  PID:4744
- C:\Windows\System\yjslcgC.exe
  C:\Windows\System\yjslcgC.exe
  2⤵
  PID:7292
- C:\Windows\System\ADQGKpc.exe
  C:\Windows\System\ADQGKpc.exe
  2⤵
  PID:10792
- C:\Windows\System\LFdcxvL.exe
  C:\Windows\System\LFdcxvL.exe
  2⤵
  PID:6892
- C:\Windows\System\BDQeorU.exe
  C:\Windows\System\BDQeorU.exe
  2⤵
  PID:2152
- C:\Windows\System\GUQMZUv.exe
  C:\Windows\System\GUQMZUv.exe
  2⤵
  PID:9548
- C:\Windows\System\ibckTEL.exe
  C:\Windows\System\ibckTEL.exe
  2⤵
  PID:10964
- C:\Windows\System\paLBpGm.exe
  C:\Windows\System\paLBpGm.exe
  2⤵
  PID:9608
- C:\Windows\System\QJHjIZE.exe
  C:\Windows\System\QJHjIZE.exe
  2⤵
  PID:13700
- C:\Windows\System\PCwmraA.exe
  C:\Windows\System\PCwmraA.exe
  2⤵
  PID:4656
- C:\Windows\System\NIEcmNo.exe
  C:\Windows\System\NIEcmNo.exe
  2⤵
  PID:13860
- C:\Windows\System\aiPnObP.exe
  C:\Windows\System\aiPnObP.exe
  2⤵
  PID:10980
- C:\Windows\System\XwGaumk.exe
  C:\Windows\System\XwGaumk.exe
  2⤵
  PID:11060
- C:\Windows\System\RCicHVS.exe
  C:\Windows\System\RCicHVS.exe
  2⤵
  PID:11116
- C:\Windows\System\xnEzjrY.exe
  C:\Windows\System\xnEzjrY.exe
  2⤵
  PID:11188
- C:\Windows\System\eDwRmLv.exe
  C:\Windows\System\eDwRmLv.exe
  2⤵
  PID:2968
- C:\Windows\System\dLJtZZf.exe
  C:\Windows\System\dLJtZZf.exe
  2⤵
  PID:9660
- C:\Windows\System\vPmFzBh.exe
  C:\Windows\System\vPmFzBh.exe
  2⤵
  PID:7124
- C:\Windows\System\hwqZJPg.exe
  C:\Windows\System\hwqZJPg.exe
  2⤵
  PID:11228
- C:\Windows\System\yxyooyl.exe
  C:\Windows\System\yxyooyl.exe
  2⤵
  PID:9664
- C:\Windows\System\tvljcxW.exe
  C:\Windows\System\tvljcxW.exe
  2⤵
  PID:2188
- C:\Windows\System\SpCIEWA.exe
  C:\Windows\System\SpCIEWA.exe
  2⤵
  PID:2316
- C:\Windows\System\LmrRlAc.exe
  C:\Windows\System\LmrRlAc.exe
  2⤵
  PID:4644
- C:\Windows\System\GtYuWxw.exe
  C:\Windows\System\GtYuWxw.exe
  2⤵
  PID:8112
- C:\Windows\System\nyttoGE.exe
  C:\Windows\System\nyttoGE.exe
  2⤵
  PID:2848
- C:\Windows\System\sDhORJS.exe
  C:\Windows\System\sDhORJS.exe
  2⤵
  PID:6492
- C:\Windows\System\MKFDtLz.exe
  C:\Windows\System\MKFDtLz.exe
  2⤵
  PID:9852
- C:\Windows\System\FPbqFQp.exe
  C:\Windows\System\FPbqFQp.exe
  2⤵
  PID:9904
- C:\Windows\System\PoqKWup.exe
  C:\Windows\System\PoqKWup.exe
  2⤵
  PID:1304
- C:\Windows\System\unYtXKM.exe
  C:\Windows\System\unYtXKM.exe
  2⤵
  PID:9928
- C:\Windows\System\oLDLhCt.exe
  C:\Windows\System\oLDLhCt.exe
  2⤵
  PID:3256
- C:\Windows\System\rJUVaqH.exe
  C:\Windows\System\rJUVaqH.exe
  2⤵
  PID:10644
- C:\Windows\System\SMwOAmI.exe
  C:\Windows\System\SMwOAmI.exe
  2⤵
  PID:6536
- C:\Windows\System\ADQgzBO.exe
  C:\Windows\System\ADQgzBO.exe
  2⤵
  PID:10020
- C:\Windows\System\iOIzXod.exe
  C:\Windows\System\iOIzXod.exe
  2⤵
  PID:8212
- C:\Windows\System\OqbLhDK.exe
  C:\Windows\System\OqbLhDK.exe
  2⤵
  PID:8340
- C:\Windows\System\BaKFXFy.exe
  C:\Windows\System\BaKFXFy.exe
  2⤵
  PID:11004
- C:\Windows\System\uOvmqIf.exe
  C:\Windows\System\uOvmqIf.exe
  2⤵
  PID:4152
- C:\Windows\System\qEhgxYi.exe
  C:\Windows\System\qEhgxYi.exe
  2⤵
  PID:11156
- C:\Windows\System\IbYXaiZ.exe
  C:\Windows\System\IbYXaiZ.exe
  2⤵
  PID:8644
- C:\Windows\System\slRHBJE.exe
  C:\Windows\System\slRHBJE.exe
  2⤵
  PID:2248
- C:\Windows\System\cfomQbU.exe
  C:\Windows\System\cfomQbU.exe
  2⤵
  PID:10308
- C:\Windows\System\yQJsbFR.exe
  C:\Windows\System\yQJsbFR.exe
  2⤵
  PID:10660
- C:\Windows\System\sSoMAMe.exe
  C:\Windows\System\sSoMAMe.exe
  2⤵
  PID:5452
- C:\Windows\System\dULRblX.exe
  C:\Windows\System\dULRblX.exe
  2⤵
  PID:13836
- C:\Windows\System\rfrbCkv.exe
  C:\Windows\System\rfrbCkv.exe
  2⤵
  PID:10272
- C:\Windows\System\oYIqyCW.exe
  C:\Windows\System\oYIqyCW.exe
  2⤵
  PID:13884
- C:\Windows\System\BalDxxJ.exe
  C:\Windows\System\BalDxxJ.exe
  2⤵
  PID:11152
- C:\Windows\System\DlRznqB.exe
  C:\Windows\System\DlRznqB.exe
  2⤵
  PID:3580
- C:\Windows\System\IMYdoLs.exe
  C:\Windows\System\IMYdoLs.exe
  2⤵
  PID:11340
- C:\Windows\System\JSfAtzg.exe
  C:\Windows\System\JSfAtzg.exe
  2⤵
  PID:9636
- C:\Windows\System\jPRgYga.exe
  C:\Windows\System\jPRgYga.exe
  2⤵
  PID:8448
- C:\Windows\System\YLXcIZr.exe
  C:\Windows\System\YLXcIZr.exe
  2⤵
  PID:13428
- C:\Windows\System\FWdKLKM.exe
  C:\Windows\System\FWdKLKM.exe
  2⤵
  PID:11460
- C:\Windows\System\qemcstQ.exe
  C:\Windows\System\qemcstQ.exe
  2⤵
  PID:9768
- C:\Windows\System\wZNpEqE.exe
  C:\Windows\System\wZNpEqE.exe
  2⤵
  PID:5332
- C:\Windows\System\UunuVXo.exe
  C:\Windows\System\UunuVXo.exe
  2⤵
  PID:4136
- C:\Windows\System\QeSMUpU.exe
  C:\Windows\System\QeSMUpU.exe
  2⤵
  PID:8904
- C:\Windows\System\uSsiZOz.exe
  C:\Windows\System\uSsiZOz.exe
  2⤵
  PID:7716
- C:\Windows\System\fEYMJLn.exe
  C:\Windows\System\fEYMJLn.exe
  2⤵
  PID:9096
- C:\Windows\System\NkQwTDy.exe
  C:\Windows\System\NkQwTDy.exe
  2⤵
  PID:5868
- C:\Windows\System\jmCEFci.exe
  C:\Windows\System\jmCEFci.exe
  2⤵
  PID:8512
- C:\Windows\System\DjWVXxL.exe
  C:\Windows\System\DjWVXxL.exe
  2⤵
  PID:5872
- C:\Windows\System\npFeCfe.exe
  C:\Windows\System\npFeCfe.exe
  2⤵
  PID:10264
- C:\Windows\System\SkRGKPs.exe
  C:\Windows\System\SkRGKPs.exe
  2⤵
  PID:11824
- C:\Windows\System\ErroMcr.exe
  C:\Windows\System\ErroMcr.exe
  2⤵
  PID:13512
- C:\Windows\System\PSiWKTH.exe
  C:\Windows\System\PSiWKTH.exe
  2⤵
  PID:6076
- C:\Windows\System\rqopzXl.exe
  C:\Windows\System\rqopzXl.exe
  2⤵
  PID:6064
- C:\Windows\System\nDYFRDF.exe
  C:\Windows\System\nDYFRDF.exe
  2⤵
  PID:11948
- C:\Windows\System\gmcsFnO.exe
  C:\Windows\System\gmcsFnO.exe
  2⤵
  PID:10584
- C:\Windows\System\bKACwYn.exe
  C:\Windows\System\bKACwYn.exe
  2⤵
  PID:4092
- C:\Windows\System\CDNIWIC.exe
  C:\Windows\System\CDNIWIC.exe
  2⤵
  PID:7808
- C:\Windows\System\cSYpfBe.exe
  C:\Windows\System\cSYpfBe.exe
  2⤵
  PID:5148
- C:\Windows\System\aHWKXKQ.exe
  C:\Windows\System\aHWKXKQ.exe
  2⤵
  PID:10744
- C:\Windows\System\sLdpxRB.exe
  C:\Windows\System\sLdpxRB.exe
  2⤵
  PID:10752
- C:\Windows\System\EmyVtbN.exe
  C:\Windows\System\EmyVtbN.exe
  2⤵
  PID:5228
- C:\Windows\System\BbsvgtT.exe
  C:\Windows\System\BbsvgtT.exe
  2⤵
  PID:12144
- C:\Windows\System\gfROCoF.exe
  C:\Windows\System\gfROCoF.exe
  2⤵
  PID:6724
- C:\Windows\System\fipOaBW.exe
  C:\Windows\System\fipOaBW.exe
  2⤵
  PID:9492
- C:\Windows\System\JQbIIqJ.exe
  C:\Windows\System\JQbIIqJ.exe
  2⤵
  PID:8072
- C:\Windows\System\iATrbHa.exe
  C:\Windows\System\iATrbHa.exe
  2⤵
  PID:3812
- C:\Windows\System\eWkgSrp.exe
  C:\Windows\System\eWkgSrp.exe
  2⤵
  PID:5476
- C:\Windows\System\ljGizNy.exe
  C:\Windows\System\ljGizNy.exe
  2⤵
  PID:12276
- C:\Windows\System\guwhdlw.exe
  C:\Windows\System\guwhdlw.exe
  2⤵
  PID:13928
- C:\Windows\System\XuKctib.exe
  C:\Windows\System\XuKctib.exe
  2⤵
  PID:5636
- C:\Windows\System\geUvNfZ.exe
  C:\Windows\System\geUvNfZ.exe
  2⤵
  PID:9600
- C:\Windows\System\ciFjuoS.exe
  C:\Windows\System\ciFjuoS.exe
  2⤵
  PID:11436
- C:\Windows\System\MqMtvtC.exe
  C:\Windows\System\MqMtvtC.exe
  2⤵
  PID:5760
- C:\Windows\System\HpryIag.exe
  C:\Windows\System\HpryIag.exe
  2⤵
  PID:11208
- C:\Windows\System\gGVrDNU.exe
  C:\Windows\System\gGVrDNU.exe
  2⤵
  PID:11620
- C:\Windows\System\rsIEIZr.exe
  C:\Windows\System\rsIEIZr.exe
  2⤵
  PID:11676
- C:\Windows\System\TcasQTg.exe
  C:\Windows\System\TcasQTg.exe
  2⤵
  PID:7968
- C:\Windows\System\lWBztbK.exe
  C:\Windows\System\lWBztbK.exe
  2⤵
  PID:1084
- C:\Windows\System\LHUCliL.exe
  C:\Windows\System\LHUCliL.exe
  2⤵
  PID:11912
- C:\Windows\System\AuYKjKT.exe
  C:\Windows\System\AuYKjKT.exe
  2⤵
  PID:1564
- C:\Windows\System\czChFgA.exe
  C:\Windows\System\czChFgA.exe
  2⤵
  PID:5272
- C:\Windows\System\MAFOAaM.exe
  C:\Windows\System\MAFOAaM.exe
  2⤵
  PID:5252
- C:\Windows\System\qTHodSs.exe
  C:\Windows\System\qTHodSs.exe
  2⤵
  PID:4260
- C:\Windows\System\WbNDtew.exe
  C:\Windows\System\WbNDtew.exe
  2⤵
  PID:2724
- C:\Windows\System\ptHaXqL.exe
  C:\Windows\System\ptHaXqL.exe
  2⤵
  PID:9800
- C:\Windows\System\bGxbxpP.exe
  C:\Windows\System\bGxbxpP.exe
  2⤵
  PID:11408
- C:\Windows\System\musuqYA.exe
  C:\Windows\System\musuqYA.exe
  2⤵
  PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pmrvojxv.e0j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AUgMZzk.exe

Filesize
2.9MB

MD5
e5293744b8fa94c8b6337da5c2c35690

SHA1
64eb0577f09d9af26e59f279580e6397c405114c

SHA256
ed49ad856a9c2c9ba88208872c7da59cbf85218fcb9c25aab68854f4b8eee393

SHA512
157ec2eb75584e326f0e9545a8af1635ee5cb8e70dac3bba5d6a77c93ebc897f02db411dfadf7a20846c08fc3a4302bc0bd3c0e2adc4f0282041af6a3f37da61

Download Submit
C:\Windows\System\AxQliqv.exe

Filesize
2.9MB

MD5
cc44110b902715300f9f0145b2f06a46

SHA1
b30c8a523b9785bd6af9089d13bd0d7bd0a20e79

SHA256
314eb0da248609101602ff665275087510c8f50c94f2fafaa1924f89c68dff18

SHA512
f642ed67f1955c42cd5f54af62020fc0ccca922489d4376b0e91133d9f2d2c586fe049716d2e49e73b2ae77258d60ed8e8ec3af8b8aad1b6d0a23fbf2036b336

Download Submit
C:\Windows\System\CVWXVnV.exe

Filesize
2.9MB

MD5
b3716a759f97aeefbcbacf6f2a85ad67

SHA1
fe44a88b2346c179f48f06a8d641b1d336494e06

SHA256
a2fa8d09c8d30836d0d2449f34962983bb4b203537d23465ed9f353aae812073

SHA512
d604ff68ff2b5c7b886d8fb5ae0738b1b86985b0fd56fa4e20e9fc2ff091b520b7e123e891c178f4f5134de876fdc59df4f4b44d22c0958e182b97ea28438e0f

Download Submit
C:\Windows\System\EUefcaq.exe

Filesize
2.9MB

MD5
3627a79a9f40fed2f73e3e4eec5c85c5

SHA1
22ad53781ed9460ef5279f3baaf9276f01a19473

SHA256
e31fc4d46f24772e88e7607d507ec27f05116f2f4bd8fd87333af3247c8843c7

SHA512
7e2ad4a23346e7b2494daf96f32354770e059426393252e890858564a6fb72ecf55541b7c10d888a6f3103dfb272e020ab6aa9c7b678538ffc28ecaacbc0a09e

Download Submit
C:\Windows\System\IPUMBmB.exe

Filesize
2.9MB

MD5
f9c3c20902d6dd3ada80b763594cfb20

SHA1
5fee9008e64b7d074e1b70b65480c079a28cd2b1

SHA256
0369765364ec7ac5e588880ed2a95406aa345213627f9f4948a59b830107d501

SHA512
e2c5454415bf048b1ec9416affde3ffb56175a989dd6360b1b25e95162b260e4eb10f5691b9397e0dc07a6f2baf036e566b5cfe3401a4c6ee4a75706b3f0a23f

Download Submit
C:\Windows\System\IaRNyuo.exe

Filesize
2.9MB

MD5
6e08dec1c028761e667fda9e5156bb67

SHA1
39d52c64d087bf140b1bfbb43950c2b441abe0a7

SHA256
fdca1477661224671cb0fb26bf4f5bb4ac55de581888333a586cfb03a801eae3

SHA512
ccaca1df9ce4e5b4d45a4aea8ee61e26150688e12750e2f1f1e305adad76b0c109a0ed57700e481b01fbd3c946366e279b4aac169bae0d01bc28516bc7f812c9

Download Submit
C:\Windows\System\LcwIHGl.exe

Filesize
2.9MB

MD5
d529167c597abc12df9fd2b08702ee80

SHA1
73afd4c329314ce6d47bbf0a8d125e3d1541db22

SHA256
b910eaaad8d3ebfb7ff6ba0cac9cd0f3b231469a24adbf0bfd0371da58786626

SHA512
17984119b62fb6f41d9d7e982803c0689b4fd72caec3e6af35f0c7d3989b9dad6b17d80a7960a4435e7d60157fe97c057a3bb937ee6870b654d6f48bf9db3234

Download Submit
C:\Windows\System\NwkzJuf.exe

Filesize
2.9MB

MD5
80d22d5f30a66eab7fa2aa0458df39a8

SHA1
5cdeae52da7a8f9f2d48eca50ffb9421fb8d66ed

SHA256
9025b3bd06799a854fa4cf1c8860785e02c41eee9986091614a75c1c13ba4621

SHA512
b1ff7176760abc24fb94fc0a6c80325453c6136a9b8c175b067cc1081a2e97c34823d3963d46c921b6192286c53c96a7c0363852130caf9819557ac4bd719793

Download Submit
C:\Windows\System\PBVEGRx.exe

Filesize
2.9MB

MD5
14c28ca182ffdb09ee9271316b39f79e

SHA1
87fd4b5cb8d2994a3972da051565c8f0be31da79

SHA256
f46b8c17407198e5db42ff957c855d8f8743e958ef12b1a5c2785207fdf59f63

SHA512
d73b7a4ce5a4efbb1a188df764654ed2c616b10af37355d8348b6d2b11df8bc6a438dc6ba003c3d0f3f8d3e3c14f0d582ba8bbef62d41c961f2e9a32285d9065

Download Submit
C:\Windows\System\TTPCWGw.exe

Filesize
2.9MB

MD5
11c82c5ce9f107f66e263911f39930ec

SHA1
e95d60c8d798caaa812dbb28f961864c802efdd5

SHA256
f810623700f8257077da99250ad48210a01edf9541f91e2953ed5af26497d190

SHA512
0e2e8ca6fc54a778a149a75be2fb7a0fd188a03448c177c18182156c05d49d0138dc4d61e67048ffadbe510498075df1ca6042c4d2f20be490ba580355e93c14

Download Submit
C:\Windows\System\WcUbedR.exe

Filesize
2.9MB

MD5
7f18d98fd18c6ccf2429115bfda35206

SHA1
641c67282334c581673c8359ddf4b4972ceffff4

SHA256
1d0e68f659398782ecd23e2b2371cb2ea723046cdedcfde10cfb3a81b424a597

SHA512
efd8d00f2e249ab52f7c603cbe4ef7037d95046a0c1ff37cf56503f773045494073d7b8fae9bcac875c380716991f90d8f1a8a2a3f6a470890509a206a33fcd7

Download Submit
C:\Windows\System\YoJrvwW.exe

Filesize
2.9MB

MD5
b7a8d1d3bc378af86e4c15f4a67b603e

SHA1
e41961ba00d3e28f28f498c6fb08f445d6ddc4bf

SHA256
7ba1b2ad476231a91e8f7e9a919e85450770a06eecf034dd0955d796c8cb4b66

SHA512
6aeb947ff3cc13799446ff8cc6d2e823821a3b041a87579770ecd56f8fb26b38baff2057678d27ff3f4a88741e8605303694a8c8a1eb1c1cea02421c0dd76a1a

Download Submit
C:\Windows\System\ZaACfQl.exe

Filesize
2.9MB

MD5
25913ecc4bb651816e6aa2f3e79bad6b

SHA1
799e69c857cac189554a032afa66f146f9929f8c

SHA256
3af0535e4ce3c301b2e5e71fcdb869f7a107582fab3badc6db99deb208d2a52d

SHA512
0905a7c4a12a50dee2337aeb633cf7e7dd56e444103c2d733ebc6e0395b0cc0088b48740394932b98d758f1fd0443cce7d7017807a29e7af1880e3b42755a0f4

Download Submit
C:\Windows\System\eYcMshC.exe

Filesize
2.9MB

MD5
a92d04ea17ed95cd6b466f0e7c58a998

SHA1
ffd26e7f2a22f48df65a4d44ed51426d258002a5

SHA256
85493ad862b23c7c2ecd91b666fe40ebc6f5f171172265188e7063bd318d5dd7

SHA512
1f05f07d36247ce82aa476d64ad0f3adf155b8d1a9aa8b46a049f9130c7aaeac67c5fb2d8235b1d4007a9bb6e9f714aee2b9b32546f7c2a0704a2307d05cd75d

Download Submit
C:\Windows\System\fHeaWQo.exe

Filesize
2.9MB

MD5
5eee67e87901cc161dd129bd2a83e00b

SHA1
fa885927b4fb102ec5e06ef22095d5a7dd507592

SHA256
4954eccf6aff5094262d27c20cf66381fe5f6b3f103d45a2808e8954542a2bbe

SHA512
661089e74ed56f7bd7754e353e84d7d2847f81fd805501d36c39beeb7fdf6a849f6ca65f66bf02e0918e287161a2270ff51a00993508a42c5904398683e9688a

Download Submit
C:\Windows\System\gKOnWaY.exe

Filesize
2.9MB

MD5
60b7cf0e23b674bf9e538a80bdb67df9

SHA1
60675287cf36229ac02ec02aa6df0a22432e85ac

SHA256
9b43928fb623075d2e2276b16f26866633d1cc47a273bb21edce42c903613d2c

SHA512
6a89350d493c50eaf15c304b3a0f82112473c06263c7ab3f15e31e3488f16b9b4d1356577c3ed2fbe33743b02394c9333c9eadda50b0d1277202764dab60c570

Download Submit
C:\Windows\System\gmqdUkt.exe

Filesize
2.9MB

MD5
dae0d6dca24304ff200dd3b4aea35505

SHA1
43fe3897815360d37a291fcfe36e9ea0540e0759

SHA256
6af547b238834fa1631778f0b9ec813839d26892a4d9a1b07d3de00d808f175b

SHA512
3daaf4f6c674b435956bd478a23bf8728752cd4cf926326d51ff8b0222349003385e3e04b69d34409eec5a88d403583e850e9d598fd90c5ff91a9301d4ee6d62

Download Submit
C:\Windows\System\hugkoPk.exe

Filesize
2.9MB

MD5
a000193b64e3e2fd1ef2cce027730837

SHA1
0717c49a094cb2427c5c57b1ba41cd1046c79a9a

SHA256
e31975b01eb8be73bbfabb0b3b8dcf3c0d438dbb2f5ac6b47f59c913135a0365

SHA512
7c81aed5c92445e804fb977dc4635dfd7bee5be26ef2a9cf4ad0276a5976879a03bfb02f7eeb087a249dde2a626bb8a77363b86e422848afc8ac795769bde399

Download Submit
C:\Windows\System\iMfunoS.exe

Filesize
2.9MB

MD5
cb2eafb93fc54384450973c5f789ff5d

SHA1
1777c8b7bc31c920e13a4c1d84e9a4941650276e

SHA256
53efca77f78823541c44ee781b7e64f7ad073e0295268ee070866026359dcdf4

SHA512
aab2fa28403ec210b38859a5f26945828c92cfba50d0580aab4badd00f7e0ea12beb6e3e6c0f2b9020999a6ad84d1c5edb63c468d455d162e3edbe07cfb5456c

Download Submit
C:\Windows\System\ngdqIyo.exe

Filesize
2.9MB

MD5
2b8aafb5f72974a6ea85cdc5e1272aae

SHA1
6103f77f01f1d4e94494603957788720ca0993f4

SHA256
0ba939ab28ab30efb8d0c40cf532d4be239ff962205adfc76095317b05082461

SHA512
dfb7bc8cfab202cf34002bdc367a21e32997a96c29ad11fc0240de186934f1f755814dbeeaa2e43c11e83a58e4604440dbc092dd5bbe92a845abe0ef98613042

Download Submit
C:\Windows\System\ngiWKVz.exe

Filesize
2.9MB

MD5
f6bec3fcf1bdc26de069b540c953fa1b

SHA1
48d38181363d4d495dbb140bd034bfef4b54e017

SHA256
4b06cc53d939b13f55fb7e73eb1763d5f05d770164fa62d8b93021280261a939

SHA512
5dbb95d5e2bf02c702d7d9cbfc864095f3dc0cf803e6fe660b6c4efb826170065083c82da7bd33ae37ba3231ef9167084566ccf02fbbf3fd1f6b8c5a6f5a3bd0

Download Submit
C:\Windows\System\oeiATyr.exe

Filesize
2.9MB

MD5
e8ea36972af8bca3e2edfc7561b42152

SHA1
ae26f31ace22ea9afd4c0c61ff368710c674dfad

SHA256
a1601ff34acc47c6a5bd84323da36a672415077fcbeca61ff77f1797ff30fd2b

SHA512
36c10fb5cc079bbfd87988ba1da59cb552b84a5361d04425b5859b42c50c61b02fd7ccda60320289b56012f9d20d54952c3ef076ac470d42a91390dbff490432

Download Submit
C:\Windows\System\ohLrnBw.exe

Filesize
2.9MB

MD5
18b2a78ea4c2c89f8f2feec2efa009f7

SHA1
5616ce0ed0df59512bd305892624360718098b08

SHA256
b66aabff0900472a7833bf7516faa05ffc118a07c3d7901dc6e681f2d60da435

SHA512
8a47279932c782e69018507e8b16215376eb9eba8c4baaa28aa2b6f644a72685fa59c23ee1bb31964e8e771c17c7cf03df9eeae5d54eac6be9e0de903dc3c938

Download Submit
C:\Windows\System\pUZDkgk.exe

Filesize
2.9MB

MD5
b64d5727408e8939027b9bf3a9322b15

SHA1
eb644199d79df9b0f463038e69ecb1bd84dc7f63

SHA256
04aee3f3878f978242a49fe0ab89322e5b31215b6fb6e281475117c1f55d9fa3

SHA512
0376775d740bb352dd364dc3695a7ecc4eb6b52250c6823314eff3f21eaed5da0dc5575a6fd561274c1f2c2b2318c99cb4fc08340519bde69c8ca030eb36e98e

Download Submit
C:\Windows\System\rgSitti.exe

Filesize
2.9MB

MD5
f87fd5c7d57712cd75325c191488bded

SHA1
b525f944697a5f058c9e88828189ac84e839c8fd

SHA256
cb352ab2d9dc6927141453bc373189880dbaf53319273a58fedcbdb4ab3e0056

SHA512
beaa9ee24483e0dee190053d6f17f8272cbc0ba4fd2ec0f95f406ffe725056b6e4ad0003bb3bbebda1d7278653f6452e13ba2a7a6ae622279e1df27144c9fb34

Download Submit
C:\Windows\System\tKRKTfS.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\txOGFmx.exe

Filesize
2.9MB

MD5
bcd891a02161103c55edb32ef4e35153

SHA1
185737fa9553902ade44fa548f03c21927119b4e

SHA256
c3b8b93c93c96a57f97f70750d04cab9756944123b708284e8c5e66d717f37db

SHA512
3ab9d1411c7580fe5ef430d465d53ab039bce67f5d9c66ba6df5d126ee987f697c05b2c75319db0fbfd47a6b68ad42cfcfd2cf280b1e539e57545f8cdcaed92e

Download Submit
C:\Windows\System\uiZOzSN.exe

Filesize
2.9MB

MD5
d4e3f2d9821f42ba0156e08e08f10717

SHA1
7133aa6ae0470ae588df9a7496d910546b2a240b

SHA256
8f3618e57fbb54e8d33dd50b99442a8a2bb9d37261f6fc57e375b6664a273eb7

SHA512
f7e6bfcb1c3f9ea64e1564cb7879c9689728cfc66eb28ef009b2dc5458387eec4f91d43464efb8e576fe797c9e942eb372e07ed5e31edfd4937d20e1ba11a90c

Download Submit
C:\Windows\System\wnZysYW.exe

Filesize
2.9MB

MD5
db098343dd82c383eaea143160df2abb

SHA1
7a8632c02d07c7f4420533c0243e7323659dca80

SHA256
9ca84a08d5a0f10efb3182a3de6e72f9694e33b2040ed677c38155688979d790

SHA512
622eabf26ad14103afb49ec914bffe57a067dfcef2b82c433f351223b92b821953f9db3a9b699590989ee3b7f411ed0410de47feb1272760b981a8bc89893a36

Download Submit
C:\Windows\System\xAgurre.exe

Filesize
2.9MB

MD5
9fabe01c6b7fac5bc9a3b75543657a98

SHA1
784add484e32d884823d34a72bdb9665e4df5f0b

SHA256
1d977325b342e135b163f8a903f43b45c0510b925583b0a6962e79a413f96b38

SHA512
b14cc94119351e754a0cad690184b4d08607e1a11de9dd017ee0ca6b6199c14eeefcad98372fe6c59fd899841e0091f5df4d10984261ad4cd28957bfa130526d

Download Submit
C:\Windows\System\xgqCeVw.exe

Filesize
2.9MB

MD5
d8bf210b155675fdde19ef4fedd04711

SHA1
8b9b6261eec47c79b0be4ddb1bf7e43556b16fc7

SHA256
f87892878c2b43416478c4e26210687108d706c7195b179fdb467d035be4aafb

SHA512
0bb225d54365aeab097cfa8da15c4f44a9e1306480f26c84c47424b5ce10c6ce1788269ec0c2cb5e7e72184374e496a8257658d3ff0e951171b61e03498e91f5

Download Submit
C:\Windows\System\yPVnIuM.exe

Filesize
2.9MB

MD5
c46393dd43667f9ea859d7511df18055

SHA1
0461fca09a4de4f86f9391a9883f7cc443b723c9

SHA256
f10356f3c9ee0f9b92997c4d032770f1c6b23da600465cadd6a0ab16df760e38

SHA512
835ed6f3cab42ee141b6cf9aa7c1f8fe8931d709e70e9257531b0d70bee10538d2fd1b90309b920db43ffd2d519037651efc280b21240801679e957b4d2e97c5

Download Submit
C:\Windows\System\yTHgYhI.exe

Filesize
2.9MB

MD5
fceaca588eac1d69c98813c548edb57e

SHA1
c7d7140b3d69d826ae12f06908ea4a8b02f1d9ea

SHA256
eb34edf8234793edf549aea662499bb1d60a4bdfb65a735c2249ec86051e078d

SHA512
5c96d91c4467913de9c65191aacded86a38dab43cd976e681ac35bc040cd401b6580b01e16d140d823ce4dbefb7e376217f57f4fca4cbc8c3636f3ef20afc8b6

Download Submit
C:\Windows\System\yZKWSBr.exe

Filesize
2.9MB

MD5
138897eb40d6eb1240c9ac1188f5bde1

SHA1
cfe175a6c103fc6bebaa6264d97d6ad8a568ccf2

SHA256
a6f4d84d6a203a787aaf479ccd9a1098d0d5b8a62c3aafa79199ad832d078c6d

SHA512
6832b8a2ab9712e8469912bc84b1c4c56ae2617227d9ef6feb2febfd27e7aa9ae97fdc655591f9741c6231c4d9bbb1206a96dbd6ef3996534c7d1099ff460a26

Download Submit
memory/116-2650-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp

Filesize
3.9MB

Download
memory/116-87-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp

Filesize
3.9MB

Download
memory/628-164-0x00007FF652660000-0x00007FF652A52000-memory.dmp

Filesize
3.9MB

Download
memory/628-2923-0x00007FF652660000-0x00007FF652A52000-memory.dmp

Filesize
3.9MB

Download
memory/716-103-0x00007FF67D790000-0x00007FF67DB82000-memory.dmp

Filesize
3.9MB

Download
memory/716-2831-0x00007FF67D790000-0x00007FF67DB82000-memory.dmp

Filesize
3.9MB

Download
memory/828-72-0x00007FF660870000-0x00007FF660C62000-memory.dmp

Filesize
3.9MB

Download
memory/828-2642-0x00007FF660870000-0x00007FF660C62000-memory.dmp

Filesize
3.9MB

Download
memory/872-2665-0x00007FF66DED0000-0x00007FF66E2C2000-memory.dmp

Filesize
3.9MB

Download
memory/872-92-0x00007FF66DED0000-0x00007FF66E2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2686-0x00007FF6130C0000-0x00007FF6134B2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-93-0x00007FF6130C0000-0x00007FF6134B2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-2839-0x00007FF621130000-0x00007FF621522000-memory.dmp

Filesize
3.9MB

Download
memory/1208-119-0x00007FF621130000-0x00007FF621522000-memory.dmp

Filesize
3.9MB

Download
memory/1444-125-0x00007FF732C90000-0x00007FF733082000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2844-0x00007FF732C90000-0x00007FF733082000-memory.dmp

Filesize
3.9MB

Download
memory/1620-140-0x00007FF6481A0000-0x00007FF648592000-memory.dmp

Filesize
3.9MB

Download
memory/1620-9-0x00007FF6481A0000-0x00007FF648592000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2608-0x00007FF6481A0000-0x00007FF648592000-memory.dmp

Filesize
3.9MB

Download
memory/1848-86-0x00007FF71E6E0000-0x00007FF71EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-2626-0x00007FF71E6E0000-0x00007FF71EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-79-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-2669-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-162-0x00007FF60FEC0000-0x00007FF6102B2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-136-0x00007FF695160000-0x00007FF695552000-memory.dmp

Filesize
3.9MB

Download
memory/2064-2909-0x00007FF695160000-0x00007FF695552000-memory.dmp

Filesize
3.9MB

Download
memory/2064-2579-0x00007FF695160000-0x00007FF695552000-memory.dmp

Filesize
3.9MB

Download
memory/2328-0-0x00007FF7DD210000-0x00007FF7DD602000-memory.dmp

Filesize
3.9MB

Download
memory/2328-1-0x0000023AA17C0000-0x0000023AA17D0000-memory.dmp

Filesize
64KB

Download
memory/2328-133-0x00007FF7DD210000-0x00007FF7DD602000-memory.dmp

Filesize
3.9MB

Download
memory/2400-64-0x00007FF7EE080000-0x00007FF7EE472000-memory.dmp

Filesize
3.9MB

Download
memory/2400-2630-0x00007FF7EE080000-0x00007FF7EE472000-memory.dmp

Filesize
3.9MB

Download
memory/2704-2588-0x00007FF650340000-0x00007FF650732000-memory.dmp

Filesize
3.9MB

Download
memory/2704-2927-0x00007FF650340000-0x00007FF650732000-memory.dmp

Filesize
3.9MB

Download
memory/2704-170-0x00007FF650340000-0x00007FF650732000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2897-0x00007FF7EB5D0000-0x00007FF7EB9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-132-0x00007FF7EB5D0000-0x00007FF7EB9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-67-0x00007FF615F60000-0x00007FF616352000-memory.dmp

Filesize
3.9MB

Download
memory/3240-2638-0x00007FF615F60000-0x00007FF616352000-memory.dmp

Filesize
3.9MB

Download
memory/3368-2835-0x00007FF7C50C0000-0x00007FF7C54B2000-memory.dmp

Filesize
3.9MB

Download
memory/3368-116-0x00007FF7C50C0000-0x00007FF7C54B2000-memory.dmp

Filesize
3.9MB

Download
memory/3508-2614-0x00007FF7BABD0000-0x00007FF7BAFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3508-85-0x00007FF7BABD0000-0x00007FF7BAFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-2919-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/3784-2586-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/3784-161-0x00007FF645A30000-0x00007FF645E22000-memory.dmp

Filesize
3.9MB

Download
memory/3888-154-0x00007FF6FC890000-0x00007FF6FCC82000-memory.dmp

Filesize
3.9MB

Download
memory/3888-2915-0x00007FF6FC890000-0x00007FF6FCC82000-memory.dmp

Filesize
3.9MB

Download
memory/4224-100-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4224-2821-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4224-1246-0x00007FF78BAF0000-0x00007FF78BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2676-0x00007FF712030000-0x00007FF712422000-memory.dmp

Filesize
3.9MB

Download
memory/4232-91-0x00007FF712030000-0x00007FF712422000-memory.dmp

Filesize
3.9MB

Download
memory/4592-2622-0x00007FF67F460000-0x00007FF67F852000-memory.dmp

Filesize
3.9MB

Download
memory/4592-141-0x00007FF67F460000-0x00007FF67F852000-memory.dmp

Filesize
3.9MB

Download
memory/4592-19-0x00007FF67F460000-0x00007FF67F852000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2672-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-88-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp

Filesize
3.9MB

Download
memory/5104-58-0x00007FFB74970000-0x00007FFB75431000-memory.dmp

Filesize
10.8MB

Download
memory/5104-20-0x00007FFB74973000-0x00007FFB74975000-memory.dmp

Filesize
8KB

Download
memory/5104-316-0x0000016E7AF20000-0x0000016E7B6C6000-memory.dmp

Filesize
7.6MB

Download
memory/5104-43-0x0000016E7A230000-0x0000016E7A252000-memory.dmp

Filesize
136KB

Download
memory/5104-37-0x00007FFB74970000-0x00007FFB75431000-memory.dmp

Filesize
10.8MB

Download
memory/5104-146-0x00007FFB74970000-0x00007FFB75431000-memory.dmp

Filesize
10.8MB

Download