xmrig | 8265a11272948d9c455c2deb2c5caac97af54eb903c497d45afa3a373cb3b7a7

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
Size

2.0MB
MD5

6394952f9ba72b042a4e170483c06940
SHA1

c752e52bc7aacb29a57676e05503775b855cd32f
SHA256

8265a11272948d9c455c2deb2c5caac97af54eb903c497d45afa3a373cb3b7a7
SHA512

193b66de5b7f21f7fecee22cdc22a806b3a4a5d35c28b36882d90bc2055d4228fdfc23e8f6d03d8d5735044ab2213167480f6fe1a4daca06aeba9a5c74e7b2de
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMK:NABi

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/716-44-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp	xmrig
behavioral2/memory/368-110-0x00007FF761EA0000-0x00007FF762292000-memory.dmp	xmrig
behavioral2/memory/3244-116-0x00007FF7EBD00000-0x00007FF7EC0F2000-memory.dmp	xmrig
behavioral2/memory/4864-122-0x00007FF64B720000-0x00007FF64BB12000-memory.dmp	xmrig
behavioral2/memory/2280-134-0x00007FF651EA0000-0x00007FF652292000-memory.dmp	xmrig
behavioral2/memory/2348-141-0x00007FF7BDE50000-0x00007FF7BE242000-memory.dmp	xmrig
behavioral2/memory/1992-383-0x00007FF79E200000-0x00007FF79E5F2000-memory.dmp	xmrig
behavioral2/memory/748-382-0x00007FF7104D0000-0x00007FF7108C2000-memory.dmp	xmrig
behavioral2/memory/2192-138-0x00007FF6E0490000-0x00007FF6E0882000-memory.dmp	xmrig
behavioral2/memory/1200-135-0x00007FF68D1B0000-0x00007FF68D5A2000-memory.dmp	xmrig
behavioral2/memory/944-129-0x00007FF6C4930000-0x00007FF6C4D22000-memory.dmp	xmrig
behavioral2/memory/2420-123-0x00007FF6B3790000-0x00007FF6B3B82000-memory.dmp	xmrig
behavioral2/memory/3744-106-0x00007FF6AB140000-0x00007FF6AB532000-memory.dmp	xmrig
behavioral2/memory/756-94-0x00007FF687260000-0x00007FF687652000-memory.dmp	xmrig
behavioral2/memory/3576-91-0x00007FF682F00000-0x00007FF6832F2000-memory.dmp	xmrig
behavioral2/memory/1032-79-0x00007FF729570000-0x00007FF729962000-memory.dmp	xmrig
behavioral2/memory/2496-77-0x00007FF609930000-0x00007FF609D22000-memory.dmp	xmrig
behavioral2/memory/3992-71-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp	xmrig
behavioral2/memory/5104-45-0x00007FF76B3A0000-0x00007FF76B792000-memory.dmp	xmrig
behavioral2/memory/1624-2328-0x00007FF61F140000-0x00007FF61F532000-memory.dmp	xmrig
behavioral2/memory/3120-3742-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp	xmrig
behavioral2/memory/3832-3935-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp	xmrig
behavioral2/memory/3992-3981-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp	xmrig
behavioral2/memory/1384-3986-0x00007FF74AAB0000-0x00007FF74AEA2000-memory.dmp	xmrig
behavioral2/memory/716-3979-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp	xmrig
behavioral2/memory/5104-3990-0x00007FF76B3A0000-0x00007FF76B792000-memory.dmp	xmrig
behavioral2/memory/1032-4004-0x00007FF729570000-0x00007FF729962000-memory.dmp	xmrig
behavioral2/memory/1624-3998-0x00007FF61F140000-0x00007FF61F532000-memory.dmp	xmrig
behavioral2/memory/368-4026-0x00007FF761EA0000-0x00007FF762292000-memory.dmp	xmrig
behavioral2/memory/756-4018-0x00007FF687260000-0x00007FF687652000-memory.dmp	xmrig
behavioral2/memory/2496-4013-0x00007FF609930000-0x00007FF609D22000-memory.dmp	xmrig
behavioral2/memory/3744-4010-0x00007FF6AB140000-0x00007FF6AB532000-memory.dmp	xmrig
behavioral2/memory/3576-4032-0x00007FF682F00000-0x00007FF6832F2000-memory.dmp	xmrig
behavioral2/memory/4816-4036-0x00007FF787CA0000-0x00007FF788092000-memory.dmp	xmrig
behavioral2/memory/3244-4040-0x00007FF7EBD00000-0x00007FF7EC0F2000-memory.dmp	xmrig
behavioral2/memory/2420-4072-0x00007FF6B3790000-0x00007FF6B3B82000-memory.dmp	xmrig
behavioral2/memory/748-4093-0x00007FF7104D0000-0x00007FF7108C2000-memory.dmp	xmrig
behavioral2/memory/1992-4084-0x00007FF79E200000-0x00007FF79E5F2000-memory.dmp	xmrig
behavioral2/memory/3832-4082-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp	xmrig
behavioral2/memory/3120-4078-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp	xmrig
behavioral2/memory/944-4064-0x00007FF6C4930000-0x00007FF6C4D22000-memory.dmp	xmrig
behavioral2/memory/2348-4044-0x00007FF7BDE50000-0x00007FF7BE242000-memory.dmp	xmrig
behavioral2/memory/2280-4053-0x00007FF651EA0000-0x00007FF652292000-memory.dmp	xmrig
behavioral2/memory/1200-4051-0x00007FF68D1B0000-0x00007FF68D5A2000-memory.dmp	xmrig
behavioral2/memory/2192-4047-0x00007FF6E0490000-0x00007FF6E0882000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

9 1768 powershell.exe
11 1768 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1768 powershell.exe

flow	pid	process
9	1768	powershell.exe
11	1768	powershell.exe

pid	process
1768	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

fOVpPDK.exeVPBCSPD.exeNwDFgmH.exeqTFVNHt.exelGAWjNB.exewYKCkxZ.exekzrIahX.exerrLuLBL.exeyJBPkkQ.exeMYfLOGj.exeEWMALey.exemNmdyms.exeEfTCYxG.exesqYadya.exeKKJpOtk.exemCyivTo.exeaSaEnPd.exeuyRKese.exeeXQjycG.exeTEVuHNz.exeLmGOpSP.exeflALiCF.exehyfNEMM.exeBtamxVV.exeymVVhtc.exeKIhtnjJ.exeMAQDPbd.exetXeMMdN.exepJJmdXe.exeKrCZmZJ.exeMmNJKVt.exeitayivz.exebYrTygp.exeqyYPJYZ.exeqaWgAhP.execeDDgzj.exeJJNOZjq.exeeryPRjS.exeWLYVtAN.exeucYsPqz.exewddhqyB.exeAvIYxge.exeMDeIQDx.exeoUFqsuB.exeArIrtZN.exempWbLIC.exehVyNzui.exekFshIlF.exexjbdQyE.exeRzUPnMO.exeTswLSVN.exeDSGVdLO.exeKMOGcol.exeffcWxOn.exechYqJBJ.exeHXbFnjY.exejXHNGDy.exekDSSuJI.exeqbYxCUC.exeDNNQPSA.exehwigajV.exeJgwacpQ.exeUbncREj.exeMNJpjFT.exe

pid	process
1384	fOVpPDK.exe
716	VPBCSPD.exe
5104	NwDFgmH.exe
3992	qTFVNHt.exe
1624	lGAWjNB.exe
2496	wYKCkxZ.exe
1032	kzrIahX.exe
756	rrLuLBL.exe
3744	yJBPkkQ.exe
368	MYfLOGj.exe
4816	EWMALey.exe
3576	mNmdyms.exe
3244	EfTCYxG.exe
2420	sqYadya.exe
4864	KKJpOtk.exe
944	mCyivTo.exe
2280	aSaEnPd.exe
1200	uyRKese.exe
2192	eXQjycG.exe
2348	TEVuHNz.exe
3832	LmGOpSP.exe
3120	flALiCF.exe
748	hyfNEMM.exe
1992	BtamxVV.exe
2352	ymVVhtc.exe
2228	KIhtnjJ.exe
4572	MAQDPbd.exe
3492	tXeMMdN.exe
3360	pJJmdXe.exe
3020	KrCZmZJ.exe
3588	MmNJKVt.exe
3284	itayivz.exe
4772	bYrTygp.exe
852	qyYPJYZ.exe
1364	qaWgAhP.exe
220	ceDDgzj.exe
1728	JJNOZjq.exe
1152	eryPRjS.exe
4840	WLYVtAN.exe
3632	ucYsPqz.exe
4296	wddhqyB.exe
2112	AvIYxge.exe
3732	MDeIQDx.exe
3192	oUFqsuB.exe
5100	ArIrtZN.exe
2872	mpWbLIC.exe
1396	hVyNzui.exe
4604	kFshIlF.exe
4128	xjbdQyE.exe
1572	RzUPnMO.exe
4908	TswLSVN.exe
2728	DSGVdLO.exe
3636	KMOGcol.exe
1004	ffcWxOn.exe
4984	chYqJBJ.exe
448	HXbFnjY.exe
2944	jXHNGDy.exe
3564	kDSSuJI.exe
2416	qbYxCUC.exe
3216	DNNQPSA.exe
4828	hwigajV.exe
5080	JgwacpQ.exe
548	UbncREj.exe
5148	MNJpjFT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5044-0-0x00007FF6C7D10000-0x00007FF6C8102000-memory.dmp	upx
C:\Windows\System\fOVpPDK.exe	upx
C:\Windows\System\NwDFgmH.exe	upx
C:\Windows\System\qTFVNHt.exe	upx
C:\Windows\System\lGAWjNB.exe	upx
behavioral2/memory/716-44-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp	upx
C:\Windows\System\EWMALey.exe	upx
C:\Windows\System\mNmdyms.exe	upx
C:\Windows\System\sqYadya.exe	upx
behavioral2/memory/368-110-0x00007FF761EA0000-0x00007FF762292000-memory.dmp	upx
behavioral2/memory/3244-116-0x00007FF7EBD00000-0x00007FF7EC0F2000-memory.dmp	upx
behavioral2/memory/4864-122-0x00007FF64B720000-0x00007FF64BB12000-memory.dmp	upx
C:\Windows\System\eXQjycG.exe	upx
behavioral2/memory/2280-134-0x00007FF651EA0000-0x00007FF652292000-memory.dmp	upx
behavioral2/memory/2348-141-0x00007FF7BDE50000-0x00007FF7BE242000-memory.dmp	upx
C:\Windows\System\flALiCF.exe	upx
behavioral2/memory/1992-383-0x00007FF79E200000-0x00007FF79E5F2000-memory.dmp	upx
behavioral2/memory/748-382-0x00007FF7104D0000-0x00007FF7108C2000-memory.dmp	upx
C:\Windows\System\bYrTygp.exe	upx
C:\Windows\System\MmNJKVt.exe	upx
C:\Windows\System\itayivz.exe	upx
C:\Windows\System\KrCZmZJ.exe	upx
C:\Windows\System\pJJmdXe.exe	upx
C:\Windows\System\tXeMMdN.exe	upx
C:\Windows\System\MAQDPbd.exe	upx
C:\Windows\System\KIhtnjJ.exe	upx
C:\Windows\System\ymVVhtc.exe	upx
C:\Windows\System\BtamxVV.exe	upx
C:\Windows\System\hyfNEMM.exe	upx
behavioral2/memory/3832-147-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp	upx
C:\Windows\System\LmGOpSP.exe	upx
behavioral2/memory/3120-142-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp	upx
behavioral2/memory/2192-138-0x00007FF6E0490000-0x00007FF6E0882000-memory.dmp	upx
behavioral2/memory/1200-135-0x00007FF68D1B0000-0x00007FF68D5A2000-memory.dmp	upx
C:\Windows\System\TEVuHNz.exe	upx
behavioral2/memory/944-129-0x00007FF6C4930000-0x00007FF6C4D22000-memory.dmp	upx
behavioral2/memory/2420-123-0x00007FF6B3790000-0x00007FF6B3B82000-memory.dmp	upx
C:\Windows\System\aSaEnPd.exe	upx
C:\Windows\System\uyRKese.exe	upx
C:\Windows\System\mCyivTo.exe	upx
behavioral2/memory/3744-106-0x00007FF6AB140000-0x00007FF6AB532000-memory.dmp	upx
C:\Windows\System\KKJpOtk.exe	upx
behavioral2/memory/756-94-0x00007FF687260000-0x00007FF687652000-memory.dmp	upx
C:\Windows\System\EfTCYxG.exe	upx
behavioral2/memory/3576-91-0x00007FF682F00000-0x00007FF6832F2000-memory.dmp	upx
behavioral2/memory/4816-87-0x00007FF787CA0000-0x00007FF788092000-memory.dmp	upx
behavioral2/memory/1032-79-0x00007FF729570000-0x00007FF729962000-memory.dmp	upx
C:\Windows\System\MYfLOGj.exe	upx
behavioral2/memory/2496-77-0x00007FF609930000-0x00007FF609D22000-memory.dmp	upx
behavioral2/memory/3992-71-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp	upx
C:\Windows\System\rrLuLBL.exe	upx
C:\Windows\System\yJBPkkQ.exe	upx
C:\Windows\System\kzrIahX.exe	upx
C:\Windows\System\wYKCkxZ.exe	upx
behavioral2/memory/1624-49-0x00007FF61F140000-0x00007FF61F532000-memory.dmp	upx
behavioral2/memory/5104-45-0x00007FF76B3A0000-0x00007FF76B792000-memory.dmp	upx
C:\Windows\System\VPBCSPD.exe	upx
behavioral2/memory/1384-15-0x00007FF74AAB0000-0x00007FF74AEA2000-memory.dmp	upx
behavioral2/memory/1624-2328-0x00007FF61F140000-0x00007FF61F532000-memory.dmp	upx
behavioral2/memory/3120-3742-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp	upx
behavioral2/memory/3832-3935-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp	upx
behavioral2/memory/3992-3981-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp	upx
behavioral2/memory/1384-3986-0x00007FF74AAB0000-0x00007FF74AEA2000-memory.dmp	upx
behavioral2/memory/716-3979-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

8 raw.githubusercontent.com
9 raw.githubusercontent.com

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\LqNDPXU.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\EzswNCI.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\nuBbgHu.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\HeicVia.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\zyYcRNA.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\LSNPkCS.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\QOcYkdq.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\PIEdcdK.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\PTUHijz.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\FnPiuGR.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\DIOiplk.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\pnxOcEc.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\mGyiWUL.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\EgPGKVy.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\hOMcuch.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\tkUdthW.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\PMTzYup.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\vBTPLmP.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\GZHAmmI.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\QlsmlZt.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\nWsfyap.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\qYoOIRP.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\jUnZCxs.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\DMoMAyR.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\RXPSTJe.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\iFrBnnX.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\FBWQuUr.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\NHyNRnU.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\gZgFsly.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\AISakqX.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\EXCwcHY.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\TXSnEbt.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\jZfCstS.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\xgjBwjj.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\pHeNMWA.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\HjkYLHr.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\jdAXcKg.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\gpfkxiL.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\BkmQwst.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\wfwfdkA.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\MNevzjH.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\KMttEAs.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\nINhkyp.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\uLfwUgp.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\XEypWpa.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\nWsNhvf.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\orekQbT.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\cUeZlON.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\VJFGlfs.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\hAPSoey.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\QBLhpLR.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\BLpdlID.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\aQfRqtj.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\HmBGeOy.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\FfUackI.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\JquSBEf.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\ZuBMJhu.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\NavHRFu.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\KCcJitw.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\CtBeSZD.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\IzaEWOi.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\lHMzzmw.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\TbNoYlY.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
File created	C:\Windows\System\AGonvSD.exe	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1768 powershell.exe
1768 powershell.exe
1768 powershell.exe

pid	process
1768	powershell.exe
1768	powershell.exe
1768	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6394952f9ba72b042a4e170483c06940_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
Token: SeDebugPrivilege	1768	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe

description	pid	process	target process
PID 5044 wrote to memory of 1768	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	powershell.exe
PID 5044 wrote to memory of 1768	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	powershell.exe
PID 5044 wrote to memory of 1384	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	fOVpPDK.exe
PID 5044 wrote to memory of 1384	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	fOVpPDK.exe
PID 5044 wrote to memory of 716	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	VPBCSPD.exe
PID 5044 wrote to memory of 716	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	VPBCSPD.exe
PID 5044 wrote to memory of 5104	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	NwDFgmH.exe
PID 5044 wrote to memory of 5104	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	NwDFgmH.exe
PID 5044 wrote to memory of 3992	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	qTFVNHt.exe
PID 5044 wrote to memory of 3992	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	qTFVNHt.exe
PID 5044 wrote to memory of 1624	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	lGAWjNB.exe
PID 5044 wrote to memory of 1624	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	lGAWjNB.exe
PID 5044 wrote to memory of 2496	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	wYKCkxZ.exe
PID 5044 wrote to memory of 2496	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	wYKCkxZ.exe
PID 5044 wrote to memory of 1032	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	kzrIahX.exe
PID 5044 wrote to memory of 1032	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	kzrIahX.exe
PID 5044 wrote to memory of 756	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	rrLuLBL.exe
PID 5044 wrote to memory of 756	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	rrLuLBL.exe
PID 5044 wrote to memory of 3744	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	yJBPkkQ.exe
PID 5044 wrote to memory of 3744	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	yJBPkkQ.exe
PID 5044 wrote to memory of 368	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MYfLOGj.exe
PID 5044 wrote to memory of 368	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MYfLOGj.exe
PID 5044 wrote to memory of 3244	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	EfTCYxG.exe
PID 5044 wrote to memory of 3244	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	EfTCYxG.exe
PID 5044 wrote to memory of 4816	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	EWMALey.exe
PID 5044 wrote to memory of 4816	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	EWMALey.exe
PID 5044 wrote to memory of 3576	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	mNmdyms.exe
PID 5044 wrote to memory of 3576	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	mNmdyms.exe
PID 5044 wrote to memory of 2420	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	sqYadya.exe
PID 5044 wrote to memory of 2420	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	sqYadya.exe
PID 5044 wrote to memory of 4864	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KKJpOtk.exe
PID 5044 wrote to memory of 4864	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KKJpOtk.exe
PID 5044 wrote to memory of 944	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	mCyivTo.exe
PID 5044 wrote to memory of 944	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	mCyivTo.exe
PID 5044 wrote to memory of 2280	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	aSaEnPd.exe
PID 5044 wrote to memory of 2280	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	aSaEnPd.exe
PID 5044 wrote to memory of 1200	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	uyRKese.exe
PID 5044 wrote to memory of 1200	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	uyRKese.exe
PID 5044 wrote to memory of 2192	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	eXQjycG.exe
PID 5044 wrote to memory of 2192	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	eXQjycG.exe
PID 5044 wrote to memory of 2348	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	TEVuHNz.exe
PID 5044 wrote to memory of 2348	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	TEVuHNz.exe
PID 5044 wrote to memory of 3120	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	flALiCF.exe
PID 5044 wrote to memory of 3120	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	flALiCF.exe
PID 5044 wrote to memory of 3832	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	LmGOpSP.exe
PID 5044 wrote to memory of 3832	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	LmGOpSP.exe
PID 5044 wrote to memory of 748	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	hyfNEMM.exe
PID 5044 wrote to memory of 748	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	hyfNEMM.exe
PID 5044 wrote to memory of 1992	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	BtamxVV.exe
PID 5044 wrote to memory of 1992	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	BtamxVV.exe
PID 5044 wrote to memory of 2352	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	ymVVhtc.exe
PID 5044 wrote to memory of 2352	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	ymVVhtc.exe
PID 5044 wrote to memory of 2228	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KIhtnjJ.exe
PID 5044 wrote to memory of 2228	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KIhtnjJ.exe
PID 5044 wrote to memory of 4572	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MAQDPbd.exe
PID 5044 wrote to memory of 4572	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MAQDPbd.exe
PID 5044 wrote to memory of 3492	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	tXeMMdN.exe
PID 5044 wrote to memory of 3492	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	tXeMMdN.exe
PID 5044 wrote to memory of 3360	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	pJJmdXe.exe
PID 5044 wrote to memory of 3360	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	pJJmdXe.exe
PID 5044 wrote to memory of 3020	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KrCZmZJ.exe
PID 5044 wrote to memory of 3020	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	KrCZmZJ.exe
PID 5044 wrote to memory of 3588	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MmNJKVt.exe
PID 5044 wrote to memory of 3588	5044	6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe	MmNJKVt.exe

C:\Users\Admin\AppData\Local\Temp\6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6394952f9ba72b042a4e170483c06940_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1768" "2916" "1672" "2920" "0" "0" "2924" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4120
- C:\Windows\System\fOVpPDK.exe
  C:\Windows\System\fOVpPDK.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\VPBCSPD.exe
  C:\Windows\System\VPBCSPD.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\NwDFgmH.exe
  C:\Windows\System\NwDFgmH.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\qTFVNHt.exe
  C:\Windows\System\qTFVNHt.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\lGAWjNB.exe
  C:\Windows\System\lGAWjNB.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\wYKCkxZ.exe
  C:\Windows\System\wYKCkxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\kzrIahX.exe
  C:\Windows\System\kzrIahX.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\rrLuLBL.exe
  C:\Windows\System\rrLuLBL.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\yJBPkkQ.exe
  C:\Windows\System\yJBPkkQ.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\MYfLOGj.exe
  C:\Windows\System\MYfLOGj.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\EfTCYxG.exe
  C:\Windows\System\EfTCYxG.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\EWMALey.exe
  C:\Windows\System\EWMALey.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\mNmdyms.exe
  C:\Windows\System\mNmdyms.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\sqYadya.exe
  C:\Windows\System\sqYadya.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\KKJpOtk.exe
  C:\Windows\System\KKJpOtk.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\mCyivTo.exe
  C:\Windows\System\mCyivTo.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\aSaEnPd.exe
  C:\Windows\System\aSaEnPd.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\uyRKese.exe
  C:\Windows\System\uyRKese.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\eXQjycG.exe
  C:\Windows\System\eXQjycG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\TEVuHNz.exe
  C:\Windows\System\TEVuHNz.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\flALiCF.exe
  C:\Windows\System\flALiCF.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\LmGOpSP.exe
  C:\Windows\System\LmGOpSP.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\hyfNEMM.exe
  C:\Windows\System\hyfNEMM.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\BtamxVV.exe
  C:\Windows\System\BtamxVV.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ymVVhtc.exe
  C:\Windows\System\ymVVhtc.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\KIhtnjJ.exe
  C:\Windows\System\KIhtnjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\MAQDPbd.exe
  C:\Windows\System\MAQDPbd.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\tXeMMdN.exe
  C:\Windows\System\tXeMMdN.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\pJJmdXe.exe
  C:\Windows\System\pJJmdXe.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\KrCZmZJ.exe
  C:\Windows\System\KrCZmZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\MmNJKVt.exe
  C:\Windows\System\MmNJKVt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\itayivz.exe
  C:\Windows\System\itayivz.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\bYrTygp.exe
  C:\Windows\System\bYrTygp.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\qyYPJYZ.exe
  C:\Windows\System\qyYPJYZ.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\qaWgAhP.exe
  C:\Windows\System\qaWgAhP.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ceDDgzj.exe
  C:\Windows\System\ceDDgzj.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\JJNOZjq.exe
  C:\Windows\System\JJNOZjq.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\eryPRjS.exe
  C:\Windows\System\eryPRjS.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\WLYVtAN.exe
  C:\Windows\System\WLYVtAN.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ucYsPqz.exe
  C:\Windows\System\ucYsPqz.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\wddhqyB.exe
  C:\Windows\System\wddhqyB.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\AvIYxge.exe
  C:\Windows\System\AvIYxge.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\MDeIQDx.exe
  C:\Windows\System\MDeIQDx.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\oUFqsuB.exe
  C:\Windows\System\oUFqsuB.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ArIrtZN.exe
  C:\Windows\System\ArIrtZN.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\mpWbLIC.exe
  C:\Windows\System\mpWbLIC.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\hVyNzui.exe
  C:\Windows\System\hVyNzui.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\kFshIlF.exe
  C:\Windows\System\kFshIlF.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\xjbdQyE.exe
  C:\Windows\System\xjbdQyE.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\RzUPnMO.exe
  C:\Windows\System\RzUPnMO.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TswLSVN.exe
  C:\Windows\System\TswLSVN.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\DSGVdLO.exe
  C:\Windows\System\DSGVdLO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\KMOGcol.exe
  C:\Windows\System\KMOGcol.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\ffcWxOn.exe
  C:\Windows\System\ffcWxOn.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\chYqJBJ.exe
  C:\Windows\System\chYqJBJ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\HXbFnjY.exe
  C:\Windows\System\HXbFnjY.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\jXHNGDy.exe
  C:\Windows\System\jXHNGDy.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\kDSSuJI.exe
  C:\Windows\System\kDSSuJI.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\qbYxCUC.exe
  C:\Windows\System\qbYxCUC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\DNNQPSA.exe
  C:\Windows\System\DNNQPSA.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\hwigajV.exe
  C:\Windows\System\hwigajV.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\JgwacpQ.exe
  C:\Windows\System\JgwacpQ.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\UbncREj.exe
  C:\Windows\System\UbncREj.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\MNJpjFT.exe
  C:\Windows\System\MNJpjFT.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\JRWBnpt.exe
  C:\Windows\System\JRWBnpt.exe
  2⤵
  PID:5176
- C:\Windows\System\lRvxaSg.exe
  C:\Windows\System\lRvxaSg.exe
  2⤵
  PID:5204
- C:\Windows\System\xgedNik.exe
  C:\Windows\System\xgedNik.exe
  2⤵
  PID:5232
- C:\Windows\System\ePaZQKi.exe
  C:\Windows\System\ePaZQKi.exe
  2⤵
  PID:5260
- C:\Windows\System\ZxxjQnb.exe
  C:\Windows\System\ZxxjQnb.exe
  2⤵
  PID:5288
- C:\Windows\System\ueZDYJj.exe
  C:\Windows\System\ueZDYJj.exe
  2⤵
  PID:5316
- C:\Windows\System\ckIQSRC.exe
  C:\Windows\System\ckIQSRC.exe
  2⤵
  PID:5344
- C:\Windows\System\BrkDyIf.exe
  C:\Windows\System\BrkDyIf.exe
  2⤵
  PID:5372
- C:\Windows\System\lHvsHIU.exe
  C:\Windows\System\lHvsHIU.exe
  2⤵
  PID:5400
- C:\Windows\System\xbqFYeY.exe
  C:\Windows\System\xbqFYeY.exe
  2⤵
  PID:5428
- C:\Windows\System\UFdwdWh.exe
  C:\Windows\System\UFdwdWh.exe
  2⤵
  PID:5456
- C:\Windows\System\HJOiKCH.exe
  C:\Windows\System\HJOiKCH.exe
  2⤵
  PID:5484
- C:\Windows\System\woqfmTP.exe
  C:\Windows\System\woqfmTP.exe
  2⤵
  PID:5512
- C:\Windows\System\jWVVazA.exe
  C:\Windows\System\jWVVazA.exe
  2⤵
  PID:5540
- C:\Windows\System\GfsyzpX.exe
  C:\Windows\System\GfsyzpX.exe
  2⤵
  PID:5568
- C:\Windows\System\xGAkTiI.exe
  C:\Windows\System\xGAkTiI.exe
  2⤵
  PID:5596
- C:\Windows\System\eLJLWuB.exe
  C:\Windows\System\eLJLWuB.exe
  2⤵
  PID:5624
- C:\Windows\System\YkkcZxW.exe
  C:\Windows\System\YkkcZxW.exe
  2⤵
  PID:5652
- C:\Windows\System\TmbTRez.exe
  C:\Windows\System\TmbTRez.exe
  2⤵
  PID:5680
- C:\Windows\System\OwFBXjw.exe
  C:\Windows\System\OwFBXjw.exe
  2⤵
  PID:5712
- C:\Windows\System\IAuRNNU.exe
  C:\Windows\System\IAuRNNU.exe
  2⤵
  PID:5736
- C:\Windows\System\fXHEPbC.exe
  C:\Windows\System\fXHEPbC.exe
  2⤵
  PID:5808
- C:\Windows\System\suiDIeq.exe
  C:\Windows\System\suiDIeq.exe
  2⤵
  PID:5824
- C:\Windows\System\OCNOjPr.exe
  C:\Windows\System\OCNOjPr.exe
  2⤵
  PID:5840
- C:\Windows\System\wDcAbPr.exe
  C:\Windows\System\wDcAbPr.exe
  2⤵
  PID:5860
- C:\Windows\System\bdmTism.exe
  C:\Windows\System\bdmTism.exe
  2⤵
  PID:5884
- C:\Windows\System\jrxNwYe.exe
  C:\Windows\System\jrxNwYe.exe
  2⤵
  PID:5916
- C:\Windows\System\XpWwZTs.exe
  C:\Windows\System\XpWwZTs.exe
  2⤵
  PID:5940
- C:\Windows\System\plmfYsP.exe
  C:\Windows\System\plmfYsP.exe
  2⤵
  PID:5972
- C:\Windows\System\ceKWqkq.exe
  C:\Windows\System\ceKWqkq.exe
  2⤵
  PID:6000
- C:\Windows\System\iStGtii.exe
  C:\Windows\System\iStGtii.exe
  2⤵
  PID:6064
- C:\Windows\System\XgUGdgT.exe
  C:\Windows\System\XgUGdgT.exe
  2⤵
  PID:6100
- C:\Windows\System\TaVqaaG.exe
  C:\Windows\System\TaVqaaG.exe
  2⤵
  PID:6140
- C:\Windows\System\ELnmlPN.exe
  C:\Windows\System\ELnmlPN.exe
  2⤵
  PID:1444
- C:\Windows\System\txzzZKn.exe
  C:\Windows\System\txzzZKn.exe
  2⤵
  PID:4476
- C:\Windows\System\FNYLWha.exe
  C:\Windows\System\FNYLWha.exe
  2⤵
  PID:3308
- C:\Windows\System\VZRMIvJ.exe
  C:\Windows\System\VZRMIvJ.exe
  2⤵
  PID:1948
- C:\Windows\System\mXZoQbU.exe
  C:\Windows\System\mXZoQbU.exe
  2⤵
  PID:5136
- C:\Windows\System\CcDzGpQ.exe
  C:\Windows\System\CcDzGpQ.exe
  2⤵
  PID:5220
- C:\Windows\System\cUeZlON.exe
  C:\Windows\System\cUeZlON.exe
  2⤵
  PID:5276
- C:\Windows\System\UvNYacB.exe
  C:\Windows\System\UvNYacB.exe
  2⤵
  PID:5332
- C:\Windows\System\mgiBqnY.exe
  C:\Windows\System\mgiBqnY.exe
  2⤵
  PID:5416
- C:\Windows\System\QWkwjvg.exe
  C:\Windows\System\QWkwjvg.exe
  2⤵
  PID:5476
- C:\Windows\System\LjGVwYN.exe
  C:\Windows\System\LjGVwYN.exe
  2⤵
  PID:5560
- C:\Windows\System\tCQtlTG.exe
  C:\Windows\System\tCQtlTG.exe
  2⤵
  PID:5644
- C:\Windows\System\dWSbkvr.exe
  C:\Windows\System\dWSbkvr.exe
  2⤵
  PID:5696
- C:\Windows\System\aZNZetm.exe
  C:\Windows\System\aZNZetm.exe
  2⤵
  PID:5752
- C:\Windows\System\FTGFGGl.exe
  C:\Windows\System\FTGFGGl.exe
  2⤵
  PID:1208
- C:\Windows\System\KGSoONR.exe
  C:\Windows\System\KGSoONR.exe
  2⤵
  PID:1712
- C:\Windows\System\ikQGWzU.exe
  C:\Windows\System\ikQGWzU.exe
  2⤵
  PID:5856
- C:\Windows\System\aCMjcLg.exe
  C:\Windows\System\aCMjcLg.exe
  2⤵
  PID:5904
- C:\Windows\System\BFCTjYd.exe
  C:\Windows\System\BFCTjYd.exe
  2⤵
  PID:624
- C:\Windows\System\YwsXBSV.exe
  C:\Windows\System\YwsXBSV.exe
  2⤵
  PID:5988
- C:\Windows\System\xWIIWKf.exe
  C:\Windows\System\xWIIWKf.exe
  2⤵
  PID:5952
- C:\Windows\System\yVmhJcO.exe
  C:\Windows\System\yVmhJcO.exe
  2⤵
  PID:3336
- C:\Windows\System\ycrFJqo.exe
  C:\Windows\System\ycrFJqo.exe
  2⤵
  PID:3708
- C:\Windows\System\SoAZBHI.exe
  C:\Windows\System\SoAZBHI.exe
  2⤵
  PID:3272
- C:\Windows\System\xSLuuQY.exe
  C:\Windows\System\xSLuuQY.exe
  2⤵
  PID:1716
- C:\Windows\System\mgcAZkM.exe
  C:\Windows\System\mgcAZkM.exe
  2⤵
  PID:2556
- C:\Windows\System\hPzJaBL.exe
  C:\Windows\System\hPzJaBL.exe
  2⤵
  PID:4028
- C:\Windows\System\EoxlZgh.exe
  C:\Windows\System\EoxlZgh.exe
  2⤵
  PID:3364
- C:\Windows\System\aIeMFCA.exe
  C:\Windows\System\aIeMFCA.exe
  2⤵
  PID:6060
- C:\Windows\System\YOXMysx.exe
  C:\Windows\System\YOXMysx.exe
  2⤵
  PID:3296
- C:\Windows\System\KWDfrkH.exe
  C:\Windows\System\KWDfrkH.exe
  2⤵
  PID:2288
- C:\Windows\System\WFZWqHP.exe
  C:\Windows\System\WFZWqHP.exe
  2⤵
  PID:5216
- C:\Windows\System\qhnAGGC.exe
  C:\Windows\System\qhnAGGC.exe
  2⤵
  PID:5328
- C:\Windows\System\PTgcucy.exe
  C:\Windows\System\PTgcucy.exe
  2⤵
  PID:5468
- C:\Windows\System\xYrchwj.exe
  C:\Windows\System\xYrchwj.exe
  2⤵
  PID:5676
- C:\Windows\System\dsxXtlG.exe
  C:\Windows\System\dsxXtlG.exe
  2⤵
  PID:3252
- C:\Windows\System\HidPNcj.exe
  C:\Windows\System\HidPNcj.exe
  2⤵
  PID:5816
- C:\Windows\System\YFyjccU.exe
  C:\Windows\System\YFyjccU.exe
  2⤵
  PID:5960
- C:\Windows\System\JvvYAAf.exe
  C:\Windows\System\JvvYAAf.exe
  2⤵
  PID:6036
- C:\Windows\System\YqAgDML.exe
  C:\Windows\System\YqAgDML.exe
  2⤵
  PID:712
- C:\Windows\System\omkzmvS.exe
  C:\Windows\System\omkzmvS.exe
  2⤵
  PID:3332
- C:\Windows\System\BpOmZdg.exe
  C:\Windows\System\BpOmZdg.exe
  2⤵
  PID:4848
- C:\Windows\System\eZIHmJH.exe
  C:\Windows\System\eZIHmJH.exe
  2⤵
  PID:3676
- C:\Windows\System\jLguhuf.exe
  C:\Windows\System\jLguhuf.exe
  2⤵
  PID:1748
- C:\Windows\System\hQQSBwM.exe
  C:\Windows\System\hQQSBwM.exe
  2⤵
  PID:6132
- C:\Windows\System\eWzBcsA.exe
  C:\Windows\System\eWzBcsA.exe
  2⤵
  PID:2104
- C:\Windows\System\TtBePpo.exe
  C:\Windows\System\TtBePpo.exe
  2⤵
  PID:3780
- C:\Windows\System\ZdpdSxc.exe
  C:\Windows\System\ZdpdSxc.exe
  2⤵
  PID:4336
- C:\Windows\System\nKuvIJK.exe
  C:\Windows\System\nKuvIJK.exe
  2⤵
  PID:3952
- C:\Windows\System\lwIPvRV.exe
  C:\Windows\System\lwIPvRV.exe
  2⤵
  PID:2628
- C:\Windows\System\uiJDMnc.exe
  C:\Windows\System\uiJDMnc.exe
  2⤵
  PID:2624
- C:\Windows\System\SGrYIml.exe
  C:\Windows\System\SGrYIml.exe
  2⤵
  PID:5524
- C:\Windows\System\qIwhvbP.exe
  C:\Windows\System\qIwhvbP.exe
  2⤵
  PID:5304
- C:\Windows\System\raafZyb.exe
  C:\Windows\System\raafZyb.exe
  2⤵
  PID:2904
- C:\Windows\System\wOKeAvy.exe
  C:\Windows\System\wOKeAvy.exe
  2⤵
  PID:6156
- C:\Windows\System\bJUNThZ.exe
  C:\Windows\System\bJUNThZ.exe
  2⤵
  PID:6196
- C:\Windows\System\xNXmApz.exe
  C:\Windows\System\xNXmApz.exe
  2⤵
  PID:6228
- C:\Windows\System\bVwzhfk.exe
  C:\Windows\System\bVwzhfk.exe
  2⤵
  PID:6244
- C:\Windows\System\cQiudgP.exe
  C:\Windows\System\cQiudgP.exe
  2⤵
  PID:6264
- C:\Windows\System\nZqEKVp.exe
  C:\Windows\System\nZqEKVp.exe
  2⤵
  PID:6288
- C:\Windows\System\NPeEomV.exe
  C:\Windows\System\NPeEomV.exe
  2⤵
  PID:6308
- C:\Windows\System\TbZpRSZ.exe
  C:\Windows\System\TbZpRSZ.exe
  2⤵
  PID:6352
- C:\Windows\System\mLCOndY.exe
  C:\Windows\System\mLCOndY.exe
  2⤵
  PID:6396
- C:\Windows\System\SZEiLnw.exe
  C:\Windows\System\SZEiLnw.exe
  2⤵
  PID:6416
- C:\Windows\System\YLcxZvx.exe
  C:\Windows\System\YLcxZvx.exe
  2⤵
  PID:6444
- C:\Windows\System\yMyKmET.exe
  C:\Windows\System\yMyKmET.exe
  2⤵
  PID:6468
- C:\Windows\System\LtyZpqs.exe
  C:\Windows\System\LtyZpqs.exe
  2⤵
  PID:6496
- C:\Windows\System\GplnCQw.exe
  C:\Windows\System\GplnCQw.exe
  2⤵
  PID:6524
- C:\Windows\System\ZhBzEZK.exe
  C:\Windows\System\ZhBzEZK.exe
  2⤵
  PID:6552
- C:\Windows\System\eqvPhVp.exe
  C:\Windows\System\eqvPhVp.exe
  2⤵
  PID:6572
- C:\Windows\System\uHPGnHY.exe
  C:\Windows\System\uHPGnHY.exe
  2⤵
  PID:6592
- C:\Windows\System\LHpQLlj.exe
  C:\Windows\System\LHpQLlj.exe
  2⤵
  PID:6612
- C:\Windows\System\hpjRKie.exe
  C:\Windows\System\hpjRKie.exe
  2⤵
  PID:6636
- C:\Windows\System\SUUwxcz.exe
  C:\Windows\System\SUUwxcz.exe
  2⤵
  PID:6656
- C:\Windows\System\pPCTdpQ.exe
  C:\Windows\System\pPCTdpQ.exe
  2⤵
  PID:6680
- C:\Windows\System\zoMwYuw.exe
  C:\Windows\System\zoMwYuw.exe
  2⤵
  PID:6708
- C:\Windows\System\XYaNDRL.exe
  C:\Windows\System\XYaNDRL.exe
  2⤵
  PID:6728
- C:\Windows\System\ECULuwZ.exe
  C:\Windows\System\ECULuwZ.exe
  2⤵
  PID:6816
- C:\Windows\System\XTSZwrl.exe
  C:\Windows\System\XTSZwrl.exe
  2⤵
  PID:6836
- C:\Windows\System\DfmVGjK.exe
  C:\Windows\System\DfmVGjK.exe
  2⤵
  PID:6880
- C:\Windows\System\wxHUdur.exe
  C:\Windows\System\wxHUdur.exe
  2⤵
  PID:6900
- C:\Windows\System\rbncdeF.exe
  C:\Windows\System\rbncdeF.exe
  2⤵
  PID:6924
- C:\Windows\System\WyXwzcW.exe
  C:\Windows\System\WyXwzcW.exe
  2⤵
  PID:6948
- C:\Windows\System\PoYUlRK.exe
  C:\Windows\System\PoYUlRK.exe
  2⤵
  PID:6972
- C:\Windows\System\uuWIYaG.exe
  C:\Windows\System\uuWIYaG.exe
  2⤵
  PID:7004
- C:\Windows\System\VCIuvKK.exe
  C:\Windows\System\VCIuvKK.exe
  2⤵
  PID:7048
- C:\Windows\System\IsOBGOd.exe
  C:\Windows\System\IsOBGOd.exe
  2⤵
  PID:7068
- C:\Windows\System\HHyHpqV.exe
  C:\Windows\System\HHyHpqV.exe
  2⤵
  PID:7088
- C:\Windows\System\toqriMO.exe
  C:\Windows\System\toqriMO.exe
  2⤵
  PID:7112
- C:\Windows\System\fEfdXGL.exe
  C:\Windows\System\fEfdXGL.exe
  2⤵
  PID:7132
- C:\Windows\System\KDWouwk.exe
  C:\Windows\System\KDWouwk.exe
  2⤵
  PID:5252
- C:\Windows\System\ZXaPjXZ.exe
  C:\Windows\System\ZXaPjXZ.exe
  2⤵
  PID:5616
- C:\Windows\System\LlBnMiu.exe
  C:\Windows\System\LlBnMiu.exe
  2⤵
  PID:6188
- C:\Windows\System\XZIeRrp.exe
  C:\Windows\System\XZIeRrp.exe
  2⤵
  PID:6256
- C:\Windows\System\CDoxPQN.exe
  C:\Windows\System\CDoxPQN.exe
  2⤵
  PID:6364
- C:\Windows\System\rCsieIr.exe
  C:\Windows\System\rCsieIr.exe
  2⤵
  PID:6432
- C:\Windows\System\AFuQqLd.exe
  C:\Windows\System\AFuQqLd.exe
  2⤵
  PID:6532
- C:\Windows\System\vRUDznw.exe
  C:\Windows\System\vRUDznw.exe
  2⤵
  PID:6588
- C:\Windows\System\RzllnEC.exe
  C:\Windows\System\RzllnEC.exe
  2⤵
  PID:6648
- C:\Windows\System\cFIcdlq.exe
  C:\Windows\System\cFIcdlq.exe
  2⤵
  PID:6696
- C:\Windows\System\AulOgeV.exe
  C:\Windows\System\AulOgeV.exe
  2⤵
  PID:6740
- C:\Windows\System\LUIMrqN.exe
  C:\Windows\System\LUIMrqN.exe
  2⤵
  PID:6768
- C:\Windows\System\LpRtaek.exe
  C:\Windows\System\LpRtaek.exe
  2⤵
  PID:6872
- C:\Windows\System\DKzpBzd.exe
  C:\Windows\System\DKzpBzd.exe
  2⤵
  PID:6956
- C:\Windows\System\tMUWkdJ.exe
  C:\Windows\System\tMUWkdJ.exe
  2⤵
  PID:7040
- C:\Windows\System\QhWkSIz.exe
  C:\Windows\System\QhWkSIz.exe
  2⤵
  PID:3372
- C:\Windows\System\wKzFMAF.exe
  C:\Windows\System\wKzFMAF.exe
  2⤵
  PID:7128
- C:\Windows\System\AZUocJr.exe
  C:\Windows\System\AZUocJr.exe
  2⤵
  PID:7164
- C:\Windows\System\uSCpVPX.exe
  C:\Windows\System\uSCpVPX.exe
  2⤵
  PID:6176
- C:\Windows\System\htPmcqM.exe
  C:\Windows\System\htPmcqM.exe
  2⤵
  PID:6348
- C:\Windows\System\qHorXxw.exe
  C:\Windows\System\qHorXxw.exe
  2⤵
  PID:6608
- C:\Windows\System\oNhZZOy.exe
  C:\Windows\System\oNhZZOy.exe
  2⤵
  PID:6752
- C:\Windows\System\UaTRWJj.exe
  C:\Windows\System\UaTRWJj.exe
  2⤵
  PID:6940
- C:\Windows\System\ZYkcwBH.exe
  C:\Windows\System\ZYkcwBH.exe
  2⤵
  PID:7108
- C:\Windows\System\lxDOuPH.exe
  C:\Windows\System\lxDOuPH.exe
  2⤵
  PID:7144
- C:\Windows\System\KTebmsi.exe
  C:\Windows\System\KTebmsi.exe
  2⤵
  PID:6236
- C:\Windows\System\RDpsJKs.exe
  C:\Windows\System\RDpsJKs.exe
  2⤵
  PID:6632
- C:\Windows\System\JMjSQmm.exe
  C:\Windows\System\JMjSQmm.exe
  2⤵
  PID:5852
- C:\Windows\System\QBWqhHV.exe
  C:\Windows\System\QBWqhHV.exe
  2⤵
  PID:6344
- C:\Windows\System\ItYAcOt.exe
  C:\Windows\System\ItYAcOt.exe
  2⤵
  PID:7172
- C:\Windows\System\FFiEBUh.exe
  C:\Windows\System\FFiEBUh.exe
  2⤵
  PID:7200
- C:\Windows\System\ubrxRzT.exe
  C:\Windows\System\ubrxRzT.exe
  2⤵
  PID:7220
- C:\Windows\System\lYHeaEz.exe
  C:\Windows\System\lYHeaEz.exe
  2⤵
  PID:7244
- C:\Windows\System\CMcqQIX.exe
  C:\Windows\System\CMcqQIX.exe
  2⤵
  PID:7276
- C:\Windows\System\loLxLgD.exe
  C:\Windows\System\loLxLgD.exe
  2⤵
  PID:7300
- C:\Windows\System\oMyTrNi.exe
  C:\Windows\System\oMyTrNi.exe
  2⤵
  PID:7364
- C:\Windows\System\bZeOkgC.exe
  C:\Windows\System\bZeOkgC.exe
  2⤵
  PID:7384
- C:\Windows\System\tkXNOUe.exe
  C:\Windows\System\tkXNOUe.exe
  2⤵
  PID:7408
- C:\Windows\System\SiwUNtq.exe
  C:\Windows\System\SiwUNtq.exe
  2⤵
  PID:7428
- C:\Windows\System\MBjSKQX.exe
  C:\Windows\System\MBjSKQX.exe
  2⤵
  PID:7452
- C:\Windows\System\XahVGuE.exe
  C:\Windows\System\XahVGuE.exe
  2⤵
  PID:7476
- C:\Windows\System\mYfqpec.exe
  C:\Windows\System\mYfqpec.exe
  2⤵
  PID:7500
- C:\Windows\System\coGsWLO.exe
  C:\Windows\System\coGsWLO.exe
  2⤵
  PID:7528
- C:\Windows\System\tVktCdh.exe
  C:\Windows\System\tVktCdh.exe
  2⤵
  PID:7548
- C:\Windows\System\bdGbBpY.exe
  C:\Windows\System\bdGbBpY.exe
  2⤵
  PID:7576
- C:\Windows\System\NIdnVWo.exe
  C:\Windows\System\NIdnVWo.exe
  2⤵
  PID:7600
- C:\Windows\System\vIjGlbt.exe
  C:\Windows\System\vIjGlbt.exe
  2⤵
  PID:7628
- C:\Windows\System\GZXEPKn.exe
  C:\Windows\System\GZXEPKn.exe
  2⤵
  PID:7684
- C:\Windows\System\nsLGnlR.exe
  C:\Windows\System\nsLGnlR.exe
  2⤵
  PID:7708
- C:\Windows\System\PyCSHKf.exe
  C:\Windows\System\PyCSHKf.exe
  2⤵
  PID:7740
- C:\Windows\System\YCXpYaS.exe
  C:\Windows\System\YCXpYaS.exe
  2⤵
  PID:7760
- C:\Windows\System\wggvhCT.exe
  C:\Windows\System\wggvhCT.exe
  2⤵
  PID:7796
- C:\Windows\System\XTsVlKl.exe
  C:\Windows\System\XTsVlKl.exe
  2⤵
  PID:7836
- C:\Windows\System\MxqkHIR.exe
  C:\Windows\System\MxqkHIR.exe
  2⤵
  PID:7856
- C:\Windows\System\UZxOvPK.exe
  C:\Windows\System\UZxOvPK.exe
  2⤵
  PID:7896
- C:\Windows\System\WXsMrTF.exe
  C:\Windows\System\WXsMrTF.exe
  2⤵
  PID:7932
- C:\Windows\System\OntuNzH.exe
  C:\Windows\System\OntuNzH.exe
  2⤵
  PID:7960
- C:\Windows\System\reuxlOX.exe
  C:\Windows\System\reuxlOX.exe
  2⤵
  PID:7980
- C:\Windows\System\DzHtdMk.exe
  C:\Windows\System\DzHtdMk.exe
  2⤵
  PID:8000
- C:\Windows\System\nRbKvXs.exe
  C:\Windows\System\nRbKvXs.exe
  2⤵
  PID:8028
- C:\Windows\System\ayjmGjX.exe
  C:\Windows\System\ayjmGjX.exe
  2⤵
  PID:8052
- C:\Windows\System\xLxLnYN.exe
  C:\Windows\System\xLxLnYN.exe
  2⤵
  PID:8076
- C:\Windows\System\hhZnqpI.exe
  C:\Windows\System\hhZnqpI.exe
  2⤵
  PID:8100
- C:\Windows\System\ifQFdkC.exe
  C:\Windows\System\ifQFdkC.exe
  2⤵
  PID:8144
- C:\Windows\System\PDZtQac.exe
  C:\Windows\System\PDZtQac.exe
  2⤵
  PID:8168
- C:\Windows\System\nKdNRqJ.exe
  C:\Windows\System\nKdNRqJ.exe
  2⤵
  PID:8188
- C:\Windows\System\YbUJAYX.exe
  C:\Windows\System\YbUJAYX.exe
  2⤵
  PID:7196
- C:\Windows\System\uhVPWec.exe
  C:\Windows\System\uhVPWec.exe
  2⤵
  PID:7216
- C:\Windows\System\MaHXuNr.exe
  C:\Windows\System\MaHXuNr.exe
  2⤵
  PID:7272
- C:\Windows\System\UYPvvYl.exe
  C:\Windows\System\UYPvvYl.exe
  2⤵
  PID:7348
- C:\Windows\System\EvXTpFV.exe
  C:\Windows\System\EvXTpFV.exe
  2⤵
  PID:7460
- C:\Windows\System\QKPOnnv.exe
  C:\Windows\System\QKPOnnv.exe
  2⤵
  PID:7508
- C:\Windows\System\vCEpvID.exe
  C:\Windows\System\vCEpvID.exe
  2⤵
  PID:7556
- C:\Windows\System\ohRdVtj.exe
  C:\Windows\System\ohRdVtj.exe
  2⤵
  PID:7644
- C:\Windows\System\RHnCpAD.exe
  C:\Windows\System\RHnCpAD.exe
  2⤵
  PID:7724
- C:\Windows\System\SAvHkHY.exe
  C:\Windows\System\SAvHkHY.exe
  2⤵
  PID:7780
- C:\Windows\System\mfqmwYW.exe
  C:\Windows\System\mfqmwYW.exe
  2⤵
  PID:7828
- C:\Windows\System\CrVhEJh.exe
  C:\Windows\System\CrVhEJh.exe
  2⤵
  PID:7876
- C:\Windows\System\HNvVplw.exe
  C:\Windows\System\HNvVplw.exe
  2⤵
  PID:7944
- C:\Windows\System\gEoKaRE.exe
  C:\Windows\System\gEoKaRE.exe
  2⤵
  PID:7972
- C:\Windows\System\yAruHRK.exe
  C:\Windows\System\yAruHRK.exe
  2⤵
  PID:8060
- C:\Windows\System\nWUjPGw.exe
  C:\Windows\System\nWUjPGw.exe
  2⤵
  PID:8088
- C:\Windows\System\wxiuyCR.exe
  C:\Windows\System\wxiuyCR.exe
  2⤵
  PID:2916
- C:\Windows\System\nyMdtXb.exe
  C:\Windows\System\nyMdtXb.exe
  2⤵
  PID:7524
- C:\Windows\System\jkWSffR.exe
  C:\Windows\System\jkWSffR.exe
  2⤵
  PID:7676
- C:\Windows\System\DNBEhnK.exe
  C:\Windows\System\DNBEhnK.exe
  2⤵
  PID:7888
- C:\Windows\System\PmyjUCY.exe
  C:\Windows\System\PmyjUCY.exe
  2⤵
  PID:7940
- C:\Windows\System\PUzYFGy.exe
  C:\Windows\System\PUzYFGy.exe
  2⤵
  PID:7340
- C:\Windows\System\jIFEmtQ.exe
  C:\Windows\System\jIFEmtQ.exe
  2⤵
  PID:8180
- C:\Windows\System\rroFYXD.exe
  C:\Windows\System\rroFYXD.exe
  2⤵
  PID:7448
- C:\Windows\System\vHQsYcL.exe
  C:\Windows\System\vHQsYcL.exe
  2⤵
  PID:8092
- C:\Windows\System\ffErtZQ.exe
  C:\Windows\System\ffErtZQ.exe
  2⤵
  PID:7324
- C:\Windows\System\iMkrWJB.exe
  C:\Windows\System\iMkrWJB.exe
  2⤵
  PID:8208
- C:\Windows\System\utZNres.exe
  C:\Windows\System\utZNres.exe
  2⤵
  PID:8240
- C:\Windows\System\bYjTvPr.exe
  C:\Windows\System\bYjTvPr.exe
  2⤵
  PID:8260
- C:\Windows\System\eYzHtwK.exe
  C:\Windows\System\eYzHtwK.exe
  2⤵
  PID:8300
- C:\Windows\System\aBJwxov.exe
  C:\Windows\System\aBJwxov.exe
  2⤵
  PID:8340
- C:\Windows\System\PCpjKQa.exe
  C:\Windows\System\PCpjKQa.exe
  2⤵
  PID:8368
- C:\Windows\System\CjBswAg.exe
  C:\Windows\System\CjBswAg.exe
  2⤵
  PID:8408
- C:\Windows\System\EHMjOPj.exe
  C:\Windows\System\EHMjOPj.exe
  2⤵
  PID:8440
- C:\Windows\System\VKUapMA.exe
  C:\Windows\System\VKUapMA.exe
  2⤵
  PID:8468
- C:\Windows\System\cpfBCvq.exe
  C:\Windows\System\cpfBCvq.exe
  2⤵
  PID:8488
- C:\Windows\System\RQrAkTE.exe
  C:\Windows\System\RQrAkTE.exe
  2⤵
  PID:8512
- C:\Windows\System\guQhmUI.exe
  C:\Windows\System\guQhmUI.exe
  2⤵
  PID:8536
- C:\Windows\System\MwcQZWX.exe
  C:\Windows\System\MwcQZWX.exe
  2⤵
  PID:8556
- C:\Windows\System\Syvpepl.exe
  C:\Windows\System\Syvpepl.exe
  2⤵
  PID:8584
- C:\Windows\System\TsTPaww.exe
  C:\Windows\System\TsTPaww.exe
  2⤵
  PID:8604
- C:\Windows\System\DKCBvcn.exe
  C:\Windows\System\DKCBvcn.exe
  2⤵
  PID:8620
- C:\Windows\System\VaURzUo.exe
  C:\Windows\System\VaURzUo.exe
  2⤵
  PID:8644
- C:\Windows\System\olngims.exe
  C:\Windows\System\olngims.exe
  2⤵
  PID:8664
- C:\Windows\System\KmRjoBN.exe
  C:\Windows\System\KmRjoBN.exe
  2⤵
  PID:8684
- C:\Windows\System\PxYFFxI.exe
  C:\Windows\System\PxYFFxI.exe
  2⤵
  PID:8704
- C:\Windows\System\drxIvMx.exe
  C:\Windows\System\drxIvMx.exe
  2⤵
  PID:8768
- C:\Windows\System\AuONBje.exe
  C:\Windows\System\AuONBje.exe
  2⤵
  PID:8808
- C:\Windows\System\JqpwvGf.exe
  C:\Windows\System\JqpwvGf.exe
  2⤵
  PID:8836
- C:\Windows\System\tTxVxSL.exe
  C:\Windows\System\tTxVxSL.exe
  2⤵
  PID:8860
- C:\Windows\System\xapZbeT.exe
  C:\Windows\System\xapZbeT.exe
  2⤵
  PID:8880
- C:\Windows\System\VkTxKYG.exe
  C:\Windows\System\VkTxKYG.exe
  2⤵
  PID:8904
- C:\Windows\System\xohttRO.exe
  C:\Windows\System\xohttRO.exe
  2⤵
  PID:8928
- C:\Windows\System\ejoNYxf.exe
  C:\Windows\System\ejoNYxf.exe
  2⤵
  PID:8948
- C:\Windows\System\HlrvwRZ.exe
  C:\Windows\System\HlrvwRZ.exe
  2⤵
  PID:9108
- C:\Windows\System\ekHZpfh.exe
  C:\Windows\System\ekHZpfh.exe
  2⤵
  PID:9124
- C:\Windows\System\vCyZHiY.exe
  C:\Windows\System\vCyZHiY.exe
  2⤵
  PID:9140
- C:\Windows\System\EInIwER.exe
  C:\Windows\System\EInIwER.exe
  2⤵
  PID:9160
- C:\Windows\System\vYeSbOh.exe
  C:\Windows\System\vYeSbOh.exe
  2⤵
  PID:9188
- C:\Windows\System\WckRPib.exe
  C:\Windows\System\WckRPib.exe
  2⤵
  PID:9208
- C:\Windows\System\gFqQBnD.exe
  C:\Windows\System\gFqQBnD.exe
  2⤵
  PID:7268
- C:\Windows\System\bxwNDYd.exe
  C:\Windows\System\bxwNDYd.exe
  2⤵
  PID:8228
- C:\Windows\System\TBeIILj.exe
  C:\Windows\System\TBeIILj.exe
  2⤵
  PID:8312
- C:\Windows\System\ObYCOmK.exe
  C:\Windows\System\ObYCOmK.exe
  2⤵
  PID:8332
- C:\Windows\System\UWExeSv.exe
  C:\Windows\System\UWExeSv.exe
  2⤵
  PID:8404
- C:\Windows\System\kDLmMce.exe
  C:\Windows\System\kDLmMce.exe
  2⤵
  PID:8504
- C:\Windows\System\LpVBFIp.exe
  C:\Windows\System\LpVBFIp.exe
  2⤵
  PID:8640
- C:\Windows\System\IsLjCzr.exe
  C:\Windows\System\IsLjCzr.exe
  2⤵
  PID:8700
- C:\Windows\System\ulXTMQh.exe
  C:\Windows\System\ulXTMQh.exe
  2⤵
  PID:8680
- C:\Windows\System\qmVyvcv.exe
  C:\Windows\System\qmVyvcv.exe
  2⤵
  PID:8800
- C:\Windows\System\tPXeknk.exe
  C:\Windows\System\tPXeknk.exe
  2⤵
  PID:8852
- C:\Windows\System\VJFGlfs.exe
  C:\Windows\System\VJFGlfs.exe
  2⤵
  PID:8888
- C:\Windows\System\NWgwzcS.exe
  C:\Windows\System\NWgwzcS.exe
  2⤵
  PID:8940
- C:\Windows\System\ZIHJDHq.exe
  C:\Windows\System\ZIHJDHq.exe
  2⤵
  PID:9000
- C:\Windows\System\zfdctkk.exe
  C:\Windows\System\zfdctkk.exe
  2⤵
  PID:9056
- C:\Windows\System\QWdDlvA.exe
  C:\Windows\System\QWdDlvA.exe
  2⤵
  PID:8972
- C:\Windows\System\HdwMilQ.exe
  C:\Windows\System\HdwMilQ.exe
  2⤵
  PID:9176
- C:\Windows\System\zqFEdrQ.exe
  C:\Windows\System\zqFEdrQ.exe
  2⤵
  PID:7292
- C:\Windows\System\kHTtwuR.exe
  C:\Windows\System\kHTtwuR.exe
  2⤵
  PID:8460
- C:\Windows\System\jSehhPd.exe
  C:\Windows\System\jSehhPd.exe
  2⤵
  PID:8520
- C:\Windows\System\diKuePS.exe
  C:\Windows\System\diKuePS.exe
  2⤵
  PID:8696
- C:\Windows\System\tkRCQIl.exe
  C:\Windows\System\tkRCQIl.exe
  2⤵
  PID:8784
- C:\Windows\System\NwaYVtv.exe
  C:\Windows\System\NwaYVtv.exe
  2⤵
  PID:8848
- C:\Windows\System\ZHvcaLt.exe
  C:\Windows\System\ZHvcaLt.exe
  2⤵
  PID:8920
- C:\Windows\System\fUryCMT.exe
  C:\Windows\System\fUryCMT.exe
  2⤵
  PID:9048
- C:\Windows\System\iLYxKQK.exe
  C:\Windows\System\iLYxKQK.exe
  2⤵
  PID:8656
- C:\Windows\System\xtXIobk.exe
  C:\Windows\System\xtXIobk.exe
  2⤵
  PID:8716
- C:\Windows\System\uqMlJfR.exe
  C:\Windows\System\uqMlJfR.exe
  2⤵
  PID:8236
- C:\Windows\System\uIPTBKQ.exe
  C:\Windows\System\uIPTBKQ.exe
  2⤵
  PID:9104
- C:\Windows\System\MwWxDPQ.exe
  C:\Windows\System\MwWxDPQ.exe
  2⤵
  PID:8248
- C:\Windows\System\JBJfqoa.exe
  C:\Windows\System\JBJfqoa.exe
  2⤵
  PID:8380
- C:\Windows\System\XrDcbFW.exe
  C:\Windows\System\XrDcbFW.exe
  2⤵
  PID:9236
- C:\Windows\System\ihASsAy.exe
  C:\Windows\System\ihASsAy.exe
  2⤵
  PID:9256
- C:\Windows\System\bfTCAeT.exe
  C:\Windows\System\bfTCAeT.exe
  2⤵
  PID:9312
- C:\Windows\System\DPbFtGV.exe
  C:\Windows\System\DPbFtGV.exe
  2⤵
  PID:9332
- C:\Windows\System\paZRHVy.exe
  C:\Windows\System\paZRHVy.exe
  2⤵
  PID:9360
- C:\Windows\System\OmLtTbz.exe
  C:\Windows\System\OmLtTbz.exe
  2⤵
  PID:9396
- C:\Windows\System\VjigfAS.exe
  C:\Windows\System\VjigfAS.exe
  2⤵
  PID:9448
- C:\Windows\System\tKNaepv.exe
  C:\Windows\System\tKNaepv.exe
  2⤵
  PID:9476
- C:\Windows\System\CfEIIKc.exe
  C:\Windows\System\CfEIIKc.exe
  2⤵
  PID:9512
- C:\Windows\System\RiYkWXq.exe
  C:\Windows\System\RiYkWXq.exe
  2⤵
  PID:9556
- C:\Windows\System\yGzFihK.exe
  C:\Windows\System\yGzFihK.exe
  2⤵
  PID:9576
- C:\Windows\System\gvDctpN.exe
  C:\Windows\System\gvDctpN.exe
  2⤵
  PID:9596
- C:\Windows\System\tjyMsKj.exe
  C:\Windows\System\tjyMsKj.exe
  2⤵
  PID:9628
- C:\Windows\System\pBtBXIV.exe
  C:\Windows\System\pBtBXIV.exe
  2⤵
  PID:9668
- C:\Windows\System\KPIXvFY.exe
  C:\Windows\System\KPIXvFY.exe
  2⤵
  PID:9688
- C:\Windows\System\BuxacAs.exe
  C:\Windows\System\BuxacAs.exe
  2⤵
  PID:9708
- C:\Windows\System\CAZGIMe.exe
  C:\Windows\System\CAZGIMe.exe
  2⤵
  PID:9732
- C:\Windows\System\bwaYbcR.exe
  C:\Windows\System\bwaYbcR.exe
  2⤵
  PID:9760
- C:\Windows\System\SxUNuqd.exe
  C:\Windows\System\SxUNuqd.exe
  2⤵
  PID:9784
- C:\Windows\System\CrsQxnE.exe
  C:\Windows\System\CrsQxnE.exe
  2⤵
  PID:9820
- C:\Windows\System\raBsfSd.exe
  C:\Windows\System\raBsfSd.exe
  2⤵
  PID:9844
- C:\Windows\System\KTogbJz.exe
  C:\Windows\System\KTogbJz.exe
  2⤵
  PID:9888
- C:\Windows\System\ZYOVaKJ.exe
  C:\Windows\System\ZYOVaKJ.exe
  2⤵
  PID:9912
- C:\Windows\System\ccxJDzR.exe
  C:\Windows\System\ccxJDzR.exe
  2⤵
  PID:9932
- C:\Windows\System\JtZwSEn.exe
  C:\Windows\System\JtZwSEn.exe
  2⤵
  PID:9948
- C:\Windows\System\saQLfwj.exe
  C:\Windows\System\saQLfwj.exe
  2⤵
  PID:9984
- C:\Windows\System\MqXRkYd.exe
  C:\Windows\System\MqXRkYd.exe
  2⤵
  PID:10008
- C:\Windows\System\vFqiMra.exe
  C:\Windows\System\vFqiMra.exe
  2⤵
  PID:10028
- C:\Windows\System\Fxnnomw.exe
  C:\Windows\System\Fxnnomw.exe
  2⤵
  PID:10068
- C:\Windows\System\nxdvCPT.exe
  C:\Windows\System\nxdvCPT.exe
  2⤵
  PID:10104
- C:\Windows\System\SpHQDXV.exe
  C:\Windows\System\SpHQDXV.exe
  2⤵
  PID:10124
- C:\Windows\System\NxhWvhc.exe
  C:\Windows\System\NxhWvhc.exe
  2⤵
  PID:10176
- C:\Windows\System\LypaYes.exe
  C:\Windows\System\LypaYes.exe
  2⤵
  PID:10196
- C:\Windows\System\MMplnum.exe
  C:\Windows\System\MMplnum.exe
  2⤵
  PID:10216
- C:\Windows\System\GWLRwEm.exe
  C:\Windows\System\GWLRwEm.exe
  2⤵
  PID:10236
- C:\Windows\System\EAaGlDg.exe
  C:\Windows\System\EAaGlDg.exe
  2⤵
  PID:8672
- C:\Windows\System\wcAYzEs.exe
  C:\Windows\System\wcAYzEs.exe
  2⤵
  PID:9292
- C:\Windows\System\zPxDlLu.exe
  C:\Windows\System\zPxDlLu.exe
  2⤵
  PID:9356
- C:\Windows\System\yxpjYQm.exe
  C:\Windows\System\yxpjYQm.exe
  2⤵
  PID:9488
- C:\Windows\System\nWBkczo.exe
  C:\Windows\System\nWBkczo.exe
  2⤵
  PID:9436
- C:\Windows\System\wAIBHJP.exe
  C:\Windows\System\wAIBHJP.exe
  2⤵
  PID:9568
- C:\Windows\System\CqmeuwR.exe
  C:\Windows\System\CqmeuwR.exe
  2⤵
  PID:9660
- C:\Windows\System\jepCain.exe
  C:\Windows\System\jepCain.exe
  2⤵
  PID:9704
- C:\Windows\System\LZbtzuz.exe
  C:\Windows\System\LZbtzuz.exe
  2⤵
  PID:9748
- C:\Windows\System\pgXrEmS.exe
  C:\Windows\System\pgXrEmS.exe
  2⤵
  PID:9812
- C:\Windows\System\huPJPsB.exe
  C:\Windows\System\huPJPsB.exe
  2⤵
  PID:9876
- C:\Windows\System\jOsMvey.exe
  C:\Windows\System\jOsMvey.exe
  2⤵
  PID:9864
- C:\Windows\System\aLDdmdz.exe
  C:\Windows\System\aLDdmdz.exe
  2⤵
  PID:10024
- C:\Windows\System\tZpPYnS.exe
  C:\Windows\System\tZpPYnS.exe
  2⤵
  PID:10092
- C:\Windows\System\oIRrrbs.exe
  C:\Windows\System\oIRrrbs.exe
  2⤵
  PID:10188
- C:\Windows\System\PDsjoSC.exe
  C:\Windows\System\PDsjoSC.exe
  2⤵
  PID:9252
- C:\Windows\System\xPQKqaX.exe
  C:\Windows\System\xPQKqaX.exe
  2⤵
  PID:9232
- C:\Windows\System\MyiwDOP.exe
  C:\Windows\System\MyiwDOP.exe
  2⤵
  PID:9392
- C:\Windows\System\FnSLTEB.exe
  C:\Windows\System\FnSLTEB.exe
  2⤵
  PID:9572
- C:\Windows\System\PjuWofd.exe
  C:\Windows\System\PjuWofd.exe
  2⤵
  PID:9676
- C:\Windows\System\JIpeopF.exe
  C:\Windows\System\JIpeopF.exe
  2⤵
  PID:9776
- C:\Windows\System\XmJKdCb.exe
  C:\Windows\System\XmJKdCb.exe
  2⤵
  PID:10000
- C:\Windows\System\xKjhrga.exe
  C:\Windows\System\xKjhrga.exe
  2⤵
  PID:10164
- C:\Windows\System\KOsyuzX.exe
  C:\Windows\System\KOsyuzX.exe
  2⤵
  PID:9432
- C:\Windows\System\DAOeEsr.exe
  C:\Windows\System\DAOeEsr.exe
  2⤵
  PID:9608
- C:\Windows\System\fFDEGAw.exe
  C:\Windows\System\fFDEGAw.exe
  2⤵
  PID:10184
- C:\Windows\System\jCqQfmM.exe
  C:\Windows\System\jCqQfmM.exe
  2⤵
  PID:10284
- C:\Windows\System\xhJCjUX.exe
  C:\Windows\System\xhJCjUX.exe
  2⤵
  PID:10304
- C:\Windows\System\eKFsewH.exe
  C:\Windows\System\eKFsewH.exe
  2⤵
  PID:10332
- C:\Windows\System\fKZuSvK.exe
  C:\Windows\System\fKZuSvK.exe
  2⤵
  PID:10360
- C:\Windows\System\LaeNcim.exe
  C:\Windows\System\LaeNcim.exe
  2⤵
  PID:10384
- C:\Windows\System\OCRUPKP.exe
  C:\Windows\System\OCRUPKP.exe
  2⤵
  PID:10424
- C:\Windows\System\TfGrbQJ.exe
  C:\Windows\System\TfGrbQJ.exe
  2⤵
  PID:10452
- C:\Windows\System\pfTTXbq.exe
  C:\Windows\System\pfTTXbq.exe
  2⤵
  PID:10468
- C:\Windows\System\RLegzit.exe
  C:\Windows\System\RLegzit.exe
  2⤵
  PID:10488
- C:\Windows\System\gVBsWMQ.exe
  C:\Windows\System\gVBsWMQ.exe
  2⤵
  PID:10512
- C:\Windows\System\OFhqnXG.exe
  C:\Windows\System\OFhqnXG.exe
  2⤵
  PID:10540
- C:\Windows\System\oONFEoS.exe
  C:\Windows\System\oONFEoS.exe
  2⤵
  PID:10576
- C:\Windows\System\kagHswx.exe
  C:\Windows\System\kagHswx.exe
  2⤵
  PID:10608
- C:\Windows\System\dJctJUd.exe
  C:\Windows\System\dJctJUd.exe
  2⤵
  PID:10644
- C:\Windows\System\MMcGHCh.exe
  C:\Windows\System\MMcGHCh.exe
  2⤵
  PID:10684
- C:\Windows\System\RfArVbt.exe
  C:\Windows\System\RfArVbt.exe
  2⤵
  PID:10708
- C:\Windows\System\bvMcNER.exe
  C:\Windows\System\bvMcNER.exe
  2⤵
  PID:10728
- C:\Windows\System\waKkIus.exe
  C:\Windows\System\waKkIus.exe
  2⤵
  PID:10756
- C:\Windows\System\WyAcMiu.exe
  C:\Windows\System\WyAcMiu.exe
  2⤵
  PID:10784
- C:\Windows\System\DwbrTmr.exe
  C:\Windows\System\DwbrTmr.exe
  2⤵
  PID:10816
- C:\Windows\System\xgtVKVW.exe
  C:\Windows\System\xgtVKVW.exe
  2⤵
  PID:10840
- C:\Windows\System\bfblnfT.exe
  C:\Windows\System\bfblnfT.exe
  2⤵
  PID:10860
- C:\Windows\System\XzHKkEp.exe
  C:\Windows\System\XzHKkEp.exe
  2⤵
  PID:10880
- C:\Windows\System\vpfLxFa.exe
  C:\Windows\System\vpfLxFa.exe
  2⤵
  PID:10908
- C:\Windows\System\nOiHJIV.exe
  C:\Windows\System\nOiHJIV.exe
  2⤵
  PID:10940
- C:\Windows\System\FpIcBhj.exe
  C:\Windows\System\FpIcBhj.exe
  2⤵
  PID:10984
- C:\Windows\System\lZLyYKc.exe
  C:\Windows\System\lZLyYKc.exe
  2⤵
  PID:11004
- C:\Windows\System\sqTiwmy.exe
  C:\Windows\System\sqTiwmy.exe
  2⤵
  PID:11036
- C:\Windows\System\doeCIkc.exe
  C:\Windows\System\doeCIkc.exe
  2⤵
  PID:11076
- C:\Windows\System\MfoCkDf.exe
  C:\Windows\System\MfoCkDf.exe
  2⤵
  PID:11096
- C:\Windows\System\uFFHXbq.exe
  C:\Windows\System\uFFHXbq.exe
  2⤵
  PID:11120
- C:\Windows\System\rZhobyT.exe
  C:\Windows\System\rZhobyT.exe
  2⤵
  PID:11140
- C:\Windows\System\LqNDPXU.exe
  C:\Windows\System\LqNDPXU.exe
  2⤵
  PID:11160
- C:\Windows\System\GvYlEGH.exe
  C:\Windows\System\GvYlEGH.exe
  2⤵
  PID:11184
- C:\Windows\System\BayzKuP.exe
  C:\Windows\System\BayzKuP.exe
  2⤵
  PID:11204
- C:\Windows\System\XdBAXKT.exe
  C:\Windows\System\XdBAXKT.exe
  2⤵
  PID:11228
- C:\Windows\System\qjvSWvS.exe
  C:\Windows\System\qjvSWvS.exe
  2⤵
  PID:10152
- C:\Windows\System\unkWVSD.exe
  C:\Windows\System\unkWVSD.exe
  2⤵
  PID:10212
- C:\Windows\System\ncoxIKU.exe
  C:\Windows\System\ncoxIKU.exe
  2⤵
  PID:10352
- C:\Windows\System\jXYqoiT.exe
  C:\Windows\System\jXYqoiT.exe
  2⤵
  PID:10436
- C:\Windows\System\HUufmzH.exe
  C:\Windows\System\HUufmzH.exe
  2⤵
  PID:10508
- C:\Windows\System\gVAGpkV.exe
  C:\Windows\System\gVAGpkV.exe
  2⤵
  PID:10536
- C:\Windows\System\dHkCWUg.exe
  C:\Windows\System\dHkCWUg.exe
  2⤵
  PID:10660
- C:\Windows\System\kyGxRat.exe
  C:\Windows\System\kyGxRat.exe
  2⤵
  PID:10672
- C:\Windows\System\DOzawOP.exe
  C:\Windows\System\DOzawOP.exe
  2⤵
  PID:10752
- C:\Windows\System\BMMBWlQ.exe
  C:\Windows\System\BMMBWlQ.exe
  2⤵
  PID:10808
- C:\Windows\System\tUgTArY.exe
  C:\Windows\System\tUgTArY.exe
  2⤵
  PID:10856
- C:\Windows\System\yZQkfKM.exe
  C:\Windows\System\yZQkfKM.exe
  2⤵
  PID:10928
- C:\Windows\System\RfOHpzq.exe
  C:\Windows\System\RfOHpzq.exe
  2⤵
  PID:11056
- C:\Windows\System\lChuldN.exe
  C:\Windows\System\lChuldN.exe
  2⤵
  PID:11104
- C:\Windows\System\eOIrnXr.exe
  C:\Windows\System\eOIrnXr.exe
  2⤵
  PID:11152
- C:\Windows\System\XWOZkKy.exe
  C:\Windows\System\XWOZkKy.exe
  2⤵
  PID:11220
- C:\Windows\System\QenOTGF.exe
  C:\Windows\System\QenOTGF.exe
  2⤵
  PID:11260
- C:\Windows\System\UHqVPWM.exe
  C:\Windows\System\UHqVPWM.exe
  2⤵
  PID:10444
- C:\Windows\System\ZUFxflD.exe
  C:\Windows\System\ZUFxflD.exe
  2⤵
  PID:10592
- C:\Windows\System\AUlPpim.exe
  C:\Windows\System\AUlPpim.exe
  2⤵
  PID:10724
- C:\Windows\System\GewTBAr.exe
  C:\Windows\System\GewTBAr.exe
  2⤵
  PID:10848
- C:\Windows\System\RrJHmGv.exe
  C:\Windows\System\RrJHmGv.exe
  2⤵
  PID:11016
- C:\Windows\System\LmfEqKo.exe
  C:\Windows\System\LmfEqKo.exe
  2⤵
  PID:11092
- C:\Windows\System\tGsnWoj.exe
  C:\Windows\System\tGsnWoj.exe
  2⤵
  PID:11192
- C:\Windows\System\QnSYYVZ.exe
  C:\Windows\System\QnSYYVZ.exe
  2⤵
  PID:11200
- C:\Windows\System\JryGigk.exe
  C:\Windows\System\JryGigk.exe
  2⤵
  PID:10460
- C:\Windows\System\FvaSVkE.exe
  C:\Windows\System\FvaSVkE.exe
  2⤵
  PID:10900
- C:\Windows\System\JatDDXI.exe
  C:\Windows\System\JatDDXI.exe
  2⤵
  PID:11256
- C:\Windows\System\ZJuAPen.exe
  C:\Windows\System\ZJuAPen.exe
  2⤵
  PID:11300
- C:\Windows\System\WTsFYgh.exe
  C:\Windows\System\WTsFYgh.exe
  2⤵
  PID:11344
- C:\Windows\System\JVTMxyF.exe
  C:\Windows\System\JVTMxyF.exe
  2⤵
  PID:11400
- C:\Windows\System\LFsJJwp.exe
  C:\Windows\System\LFsJJwp.exe
  2⤵
  PID:11420
- C:\Windows\System\BeoEwFi.exe
  C:\Windows\System\BeoEwFi.exe
  2⤵
  PID:11440
- C:\Windows\System\XMZPCKt.exe
  C:\Windows\System\XMZPCKt.exe
  2⤵
  PID:11464
- C:\Windows\System\qMSAbBN.exe
  C:\Windows\System\qMSAbBN.exe
  2⤵
  PID:11524
- C:\Windows\System\LOIFoKz.exe
  C:\Windows\System\LOIFoKz.exe
  2⤵
  PID:11548
- C:\Windows\System\IRZpFwt.exe
  C:\Windows\System\IRZpFwt.exe
  2⤵
  PID:11564
- C:\Windows\System\cTkuSIo.exe
  C:\Windows\System\cTkuSIo.exe
  2⤵
  PID:11588
- C:\Windows\System\BQvbnOO.exe
  C:\Windows\System\BQvbnOO.exe
  2⤵
  PID:11620
- C:\Windows\System\ZynEBAm.exe
  C:\Windows\System\ZynEBAm.exe
  2⤵
  PID:11636
- C:\Windows\System\IqmLOuN.exe
  C:\Windows\System\IqmLOuN.exe
  2⤵
  PID:11676
- C:\Windows\System\WzlkoAw.exe
  C:\Windows\System\WzlkoAw.exe
  2⤵
  PID:11700
- C:\Windows\System\nhxHvXc.exe
  C:\Windows\System\nhxHvXc.exe
  2⤵
  PID:11716
- C:\Windows\System\LiESdCz.exe
  C:\Windows\System\LiESdCz.exe
  2⤵
  PID:11740
- C:\Windows\System\MXLSqaQ.exe
  C:\Windows\System\MXLSqaQ.exe
  2⤵
  PID:11760
- C:\Windows\System\FemCreu.exe
  C:\Windows\System\FemCreu.exe
  2⤵
  PID:11828
- C:\Windows\System\VYSWZMM.exe
  C:\Windows\System\VYSWZMM.exe
  2⤵
  PID:11848
- C:\Windows\System\wRGjAjK.exe
  C:\Windows\System\wRGjAjK.exe
  2⤵
  PID:11880
- C:\Windows\System\ZsruwWP.exe
  C:\Windows\System\ZsruwWP.exe
  2⤵
  PID:11900
- C:\Windows\System\VtYOMOR.exe
  C:\Windows\System\VtYOMOR.exe
  2⤵
  PID:11920
- C:\Windows\System\UhTatYx.exe
  C:\Windows\System\UhTatYx.exe
  2⤵
  PID:11940
- C:\Windows\System\WTcGWxr.exe
  C:\Windows\System\WTcGWxr.exe
  2⤵
  PID:11980
- C:\Windows\System\fBOTcZe.exe
  C:\Windows\System\fBOTcZe.exe
  2⤵
  PID:12004
- C:\Windows\System\AYTESwj.exe
  C:\Windows\System\AYTESwj.exe
  2⤵
  PID:12036
- C:\Windows\System\jxIiwRf.exe
  C:\Windows\System\jxIiwRf.exe
  2⤵
  PID:12060
- C:\Windows\System\kxudwgT.exe
  C:\Windows\System\kxudwgT.exe
  2⤵
  PID:12088
- C:\Windows\System\HASRlZR.exe
  C:\Windows\System\HASRlZR.exe
  2⤵
  PID:12136
- C:\Windows\System\RYUDMtn.exe
  C:\Windows\System\RYUDMtn.exe
  2⤵
  PID:12160
- C:\Windows\System\ijpurjt.exe
  C:\Windows\System\ijpurjt.exe
  2⤵
  PID:12196
- C:\Windows\System\WkPFSDv.exe
  C:\Windows\System\WkPFSDv.exe
  2⤵
  PID:12212
- C:\Windows\System\GXdxuOR.exe
  C:\Windows\System\GXdxuOR.exe
  2⤵
  PID:12236
- C:\Windows\System\Talumws.exe
  C:\Windows\System\Talumws.exe
  2⤵
  PID:12256
- C:\Windows\System\uNxUiAn.exe
  C:\Windows\System\uNxUiAn.exe
  2⤵
  PID:12280
- C:\Windows\System\zmeVwla.exe
  C:\Windows\System\zmeVwla.exe
  2⤵
  PID:10256
- C:\Windows\System\ZUAbQBb.exe
  C:\Windows\System\ZUAbQBb.exe
  2⤵
  PID:11276
- C:\Windows\System\fysDKtI.exe
  C:\Windows\System\fysDKtI.exe
  2⤵
  PID:11296
- C:\Windows\System\TdhzAQH.exe
  C:\Windows\System\TdhzAQH.exe
  2⤵
  PID:11396
- C:\Windows\System\HKGksmi.exe
  C:\Windows\System\HKGksmi.exe
  2⤵
  PID:11672
- C:\Windows\System\ibvJpnz.exe
  C:\Windows\System\ibvJpnz.exe
  2⤵
  PID:11724
- C:\Windows\System\VWonpTH.exe
  C:\Windows\System\VWonpTH.exe
  2⤵
  PID:11752
- C:\Windows\System\tzGEABl.exe
  C:\Windows\System\tzGEABl.exe
  2⤵
  PID:11784
- C:\Windows\System\jtUbdfT.exe
  C:\Windows\System\jtUbdfT.exe
  2⤵
  PID:11868
- C:\Windows\System\OJDaqIV.exe
  C:\Windows\System\OJDaqIV.exe
  2⤵
  PID:11988
- C:\Windows\System\gqShElF.exe
  C:\Windows\System\gqShElF.exe
  2⤵
  PID:12056
- C:\Windows\System\OYBLbfI.exe
  C:\Windows\System\OYBLbfI.exe
  2⤵
  PID:12084
- C:\Windows\System\AOYChzP.exe
  C:\Windows\System\AOYChzP.exe
  2⤵
  PID:12156
- C:\Windows\System\sgJIEZO.exe
  C:\Windows\System\sgJIEZO.exe
  2⤵
  PID:12232
- C:\Windows\System\CeChheL.exe
  C:\Windows\System\CeChheL.exe
  2⤵
  PID:10556
- C:\Windows\System\UkbhDqf.exe
  C:\Windows\System\UkbhDqf.exe
  2⤵
  PID:12276
- C:\Windows\System\gPABmtZ.exe
  C:\Windows\System\gPABmtZ.exe
  2⤵
  PID:11336
- C:\Windows\System\QfhFTKP.exe
  C:\Windows\System\QfhFTKP.exe
  2⤵
  PID:11496
- C:\Windows\System\DCyUZbD.exe
  C:\Windows\System\DCyUZbD.exe
  2⤵
  PID:2188
- C:\Windows\System\ijTykfv.exe
  C:\Windows\System\ijTykfv.exe
  2⤵
  PID:11688
- C:\Windows\System\ZuLiibJ.exe
  C:\Windows\System\ZuLiibJ.exe
  2⤵
  PID:11708
- C:\Windows\System\eCGVVzr.exe
  C:\Windows\System\eCGVVzr.exe
  2⤵
  PID:11912
- C:\Windows\System\OcADqrM.exe
  C:\Windows\System\OcADqrM.exe
  2⤵
  PID:12072
- C:\Windows\System\mkXvAEs.exe
  C:\Windows\System\mkXvAEs.exe
  2⤵
  PID:12152
- C:\Windows\System\mHfuRhS.exe
  C:\Windows\System\mHfuRhS.exe
  2⤵
  PID:12252
- C:\Windows\System\SLUbVKR.exe
  C:\Windows\System\SLUbVKR.exe
  2⤵
  PID:11628
- C:\Windows\System\dHkLmKF.exe
  C:\Windows\System\dHkLmKF.exe
  2⤵
  PID:11692
- C:\Windows\System\KLLooEg.exe
  C:\Windows\System\KLLooEg.exe
  2⤵
  PID:11412
- C:\Windows\System\RriGbOM.exe
  C:\Windows\System\RriGbOM.exe
  2⤵
  PID:2908
- C:\Windows\System\OVHNBMp.exe
  C:\Windows\System\OVHNBMp.exe
  2⤵
  PID:11964
- C:\Windows\System\KroCLQF.exe
  C:\Windows\System\KroCLQF.exe
  2⤵
  PID:12312
- C:\Windows\System\xQARIkD.exe
  C:\Windows\System\xQARIkD.exe
  2⤵
  PID:12340
- C:\Windows\System\jCcXTUW.exe
  C:\Windows\System\jCcXTUW.exe
  2⤵
  PID:12372
- C:\Windows\System\Rhcjspr.exe
  C:\Windows\System\Rhcjspr.exe
  2⤵
  PID:12392
- C:\Windows\System\WtFdooC.exe
  C:\Windows\System\WtFdooC.exe
  2⤵
  PID:12412
- C:\Windows\System\BRCTsUD.exe
  C:\Windows\System\BRCTsUD.exe
  2⤵
  PID:12456
- C:\Windows\System\DoLrgDw.exe
  C:\Windows\System\DoLrgDw.exe
  2⤵
  PID:12480
- C:\Windows\System\bVxwBcU.exe
  C:\Windows\System\bVxwBcU.exe
  2⤵
  PID:12512
- C:\Windows\System\DCkHAKL.exe
  C:\Windows\System\DCkHAKL.exe
  2⤵
  PID:12532
- C:\Windows\System\yFIjTWT.exe
  C:\Windows\System\yFIjTWT.exe
  2⤵
  PID:12560
- C:\Windows\System\KMttEAs.exe
  C:\Windows\System\KMttEAs.exe
  2⤵
  PID:12584
- C:\Windows\System\lBoDwhZ.exe
  C:\Windows\System\lBoDwhZ.exe
  2⤵
  PID:12624
- C:\Windows\System\kgPcCNs.exe
  C:\Windows\System\kgPcCNs.exe
  2⤵
  PID:12644
- C:\Windows\System\WIKeovB.exe
  C:\Windows\System\WIKeovB.exe
  2⤵
  PID:12688
- C:\Windows\System\SBbSiCe.exe
  C:\Windows\System\SBbSiCe.exe
  2⤵
  PID:12712
- C:\Windows\System\ZzHmwjZ.exe
  C:\Windows\System\ZzHmwjZ.exe
  2⤵
  PID:12732
- C:\Windows\System\HuWbLlD.exe
  C:\Windows\System\HuWbLlD.exe
  2⤵
  PID:12752
- C:\Windows\System\qazHdYi.exe
  C:\Windows\System\qazHdYi.exe
  2⤵
  PID:12792
- C:\Windows\System\VkaIPTY.exe
  C:\Windows\System\VkaIPTY.exe
  2⤵
  PID:12828
- C:\Windows\System\CzMfhAx.exe
  C:\Windows\System\CzMfhAx.exe
  2⤵
  PID:12852
- C:\Windows\System\xiUHwGd.exe
  C:\Windows\System\xiUHwGd.exe
  2⤵
  PID:12880
- C:\Windows\System\sgTUUYc.exe
  C:\Windows\System\sgTUUYc.exe
  2⤵
  PID:12904
- C:\Windows\System\VELJnbU.exe
  C:\Windows\System\VELJnbU.exe
  2⤵
  PID:12920
- C:\Windows\System\KhCKReW.exe
  C:\Windows\System\KhCKReW.exe
  2⤵
  PID:12964
- C:\Windows\System\LzWPclV.exe
  C:\Windows\System\LzWPclV.exe
  2⤵
  PID:12996
- C:\Windows\System\zYYnPCL.exe
  C:\Windows\System\zYYnPCL.exe
  2⤵
  PID:13012
- C:\Windows\System\vgKblBL.exe
  C:\Windows\System\vgKblBL.exe
  2⤵
  PID:13032
- C:\Windows\System\foxUJkE.exe
  C:\Windows\System\foxUJkE.exe
  2⤵
  PID:13052
- C:\Windows\System\MoSUAnH.exe
  C:\Windows\System\MoSUAnH.exe
  2⤵
  PID:13080
- C:\Windows\System\UuGooKS.exe
  C:\Windows\System\UuGooKS.exe
  2⤵
  PID:13128
- C:\Windows\System\ffursRb.exe
  C:\Windows\System\ffursRb.exe
  2⤵
  PID:13152
- C:\Windows\System\hWayicr.exe
  C:\Windows\System\hWayicr.exe
  2⤵
  PID:13192
- C:\Windows\System\TKjYaJQ.exe
  C:\Windows\System\TKjYaJQ.exe
  2⤵
  PID:13212
- C:\Windows\System\VXbJwDA.exe
  C:\Windows\System\VXbJwDA.exe
  2⤵
  PID:13236
- C:\Windows\System\fbMAyvW.exe
  C:\Windows\System\fbMAyvW.exe
  2⤵
  PID:13256
- C:\Windows\System\OpvEZrU.exe
  C:\Windows\System\OpvEZrU.exe
  2⤵
  PID:12296
- C:\Windows\System\HdXfCJP.exe
  C:\Windows\System\HdXfCJP.exe
  2⤵
  PID:12348
- C:\Windows\System\SQUPmWY.exe
  C:\Windows\System\SQUPmWY.exe
  2⤵
  PID:12380
- C:\Windows\System\WzjhjqS.exe
  C:\Windows\System\WzjhjqS.exe
  2⤵
  PID:12840
- C:\Windows\System\LwuMXjl.exe
  C:\Windows\System\LwuMXjl.exe
  2⤵
  PID:2900
- C:\Windows\System\NSZCujf.exe
  C:\Windows\System\NSZCujf.exe
  2⤵
  PID:12816
- C:\Windows\System\uiohWwV.exe
  C:\Windows\System\uiohWwV.exe
  2⤵
  PID:12876
- C:\Windows\System\wdyUuWz.exe
  C:\Windows\System\wdyUuWz.exe
  2⤵
  PID:12948
- C:\Windows\System\BdZncNO.exe
  C:\Windows\System\BdZncNO.exe
  2⤵
  PID:13048
- C:\Windows\System\lugYwBr.exe
  C:\Windows\System\lugYwBr.exe
  2⤵
  PID:12988
- C:\Windows\System\qJtDHeg.exe
  C:\Windows\System\qJtDHeg.exe
  2⤵
  PID:13060
- C:\Windows\System\nBvVunz.exe
  C:\Windows\System\nBvVunz.exe
  2⤵
  PID:4396
- C:\Windows\System\FMDGRAf.exe
  C:\Windows\System\FMDGRAf.exe
  2⤵
  PID:5072
- C:\Windows\System\NNjwyFo.exe
  C:\Windows\System\NNjwyFo.exe
  2⤵
  PID:1276
- C:\Windows\System\RAvMlxw.exe
  C:\Windows\System\RAvMlxw.exe
  2⤵
  PID:13252
- C:\Windows\System\ViKtDJC.exe
  C:\Windows\System\ViKtDJC.exe
  2⤵
  PID:13300
- C:\Windows\System\AaJJidQ.exe
  C:\Windows\System\AaJJidQ.exe
  2⤵
  PID:4404
- C:\Windows\System\dHTeTdq.exe
  C:\Windows\System\dHTeTdq.exe
  2⤵
  PID:12468
- C:\Windows\System\gpzTRnc.exe
  C:\Windows\System\gpzTRnc.exe
  2⤵
  PID:12496
- C:\Windows\System\nNvCEPn.exe
  C:\Windows\System\nNvCEPn.exe
  2⤵
  PID:12724
- C:\Windows\System\mqhncLw.exe
  C:\Windows\System\mqhncLw.exe
  2⤵
  PID:12764
- C:\Windows\System\gpfkxiL.exe
  C:\Windows\System\gpfkxiL.exe
  2⤵
  PID:12804
- C:\Windows\System\pnbnzip.exe
  C:\Windows\System\pnbnzip.exe
  2⤵
  PID:3688
- C:\Windows\System\KXwGAdp.exe
  C:\Windows\System\KXwGAdp.exe
  2⤵
  PID:676
- C:\Windows\System\XFYYUZY.exe
  C:\Windows\System\XFYYUZY.exe
  2⤵
  PID:12952
- C:\Windows\System\fsZmwIS.exe
  C:\Windows\System\fsZmwIS.exe
  2⤵
  PID:13164
- C:\Windows\System\rINuIZV.exe
  C:\Windows\System\rINuIZV.exe
  2⤵
  PID:13172
- C:\Windows\System\gWnocsb.exe
  C:\Windows\System\gWnocsb.exe
  2⤵
  PID:5024
- C:\Windows\System\EbrwHpN.exe
  C:\Windows\System\EbrwHpN.exe
  2⤵
  PID:1848
- C:\Windows\System\fqDhUGu.exe
  C:\Windows\System\fqDhUGu.exe
  2⤵
  PID:3400
- C:\Windows\System\mDadYxF.exe
  C:\Windows\System\mDadYxF.exe
  2⤵
  PID:13008
- C:\Windows\System\xHQPkJT.exe
  C:\Windows\System\xHQPkJT.exe
  2⤵
  PID:13136
- C:\Windows\System\VpAtSUa.exe
  C:\Windows\System\VpAtSUa.exe
  2⤵
  PID:13204
- C:\Windows\System\pnytNra.exe
  C:\Windows\System\pnytNra.exe
  2⤵
  PID:3820
- C:\Windows\System\zbwqxNB.exe
  C:\Windows\System\zbwqxNB.exe
  2⤵
  PID:212
- C:\Windows\System\DCOXPMB.exe
  C:\Windows\System\DCOXPMB.exe
  2⤵
  PID:12632
- C:\Windows\System\vWQcbQd.exe
  C:\Windows\System\vWQcbQd.exe
  2⤵
  PID:13024
- C:\Windows\System\bPgGzfA.exe
  C:\Windows\System\bPgGzfA.exe
  2⤵
  PID:4312
- C:\Windows\System\cWEAPvg.exe
  C:\Windows\System\cWEAPvg.exe
  2⤵
  PID:12680
- C:\Windows\System\solUpBV.exe
  C:\Windows\System\solUpBV.exe
  2⤵
  PID:32
- C:\Windows\System\mrZrNKK.exe
  C:\Windows\System\mrZrNKK.exe
  2⤵
  PID:2976
- C:\Windows\System\GjyAtrv.exe
  C:\Windows\System\GjyAtrv.exe
  2⤵
  PID:4412
- C:\Windows\System\wLrVNgY.exe
  C:\Windows\System\wLrVNgY.exe
  2⤵
  PID:13184
- C:\Windows\System\jaeGtMs.exe
  C:\Windows\System\jaeGtMs.exe
  2⤵
  PID:12308
- C:\Windows\System\XhtQzBK.exe
  C:\Windows\System\XhtQzBK.exe
  2⤵
  PID:12664
- C:\Windows\System\ZQzMmdu.exe
  C:\Windows\System\ZQzMmdu.exe
  2⤵
  PID:1936
- C:\Windows\System\BZDcrgq.exe
  C:\Windows\System\BZDcrgq.exe
  2⤵
  PID:1112
- C:\Windows\System\uilMjej.exe
  C:\Windows\System\uilMjej.exe
  2⤵
  PID:12472
- C:\Windows\System\poHUQSm.exe
  C:\Windows\System\poHUQSm.exe
  2⤵
  PID:2164
- C:\Windows\System\rAevfMg.exe
  C:\Windows\System\rAevfMg.exe
  2⤵
  PID:3784
- C:\Windows\System\vdlUyLf.exe
  C:\Windows\System\vdlUyLf.exe
  2⤵
  PID:2692
- C:\Windows\System\agFuovF.exe
  C:\Windows\System\agFuovF.exe
  2⤵
  PID:12728
- C:\Windows\System\bjqlfbE.exe
  C:\Windows\System\bjqlfbE.exe
  2⤵
  PID:12388
- C:\Windows\System\xDBALKF.exe
  C:\Windows\System\xDBALKF.exe
  2⤵
  PID:13124
- C:\Windows\System\UwySgNN.exe
  C:\Windows\System\UwySgNN.exe
  2⤵
  PID:5804
- C:\Windows\System\LlMnQBW.exe
  C:\Windows\System\LlMnQBW.exe
  2⤵
  PID:12772
- C:\Windows\System\IkfqQnD.exe
  C:\Windows\System\IkfqQnD.exe
  2⤵
  PID:13304
- C:\Windows\System\YoDnmRK.exe
  C:\Windows\System\YoDnmRK.exe
  2⤵
  PID:12720
- C:\Windows\System\vXpohvF.exe
  C:\Windows\System\vXpohvF.exe
  2⤵
  PID:4568
- C:\Windows\System\dcEXUsA.exe
  C:\Windows\System\dcEXUsA.exe
  2⤵
  PID:4392
- C:\Windows\System\SKOidRl.exe
  C:\Windows\System\SKOidRl.exe
  2⤵
  PID:13092
- C:\Windows\System\ZCyOVXQ.exe
  C:\Windows\System\ZCyOVXQ.exe
  2⤵
  PID:1800
- C:\Windows\System\myvSszw.exe
  C:\Windows\System\myvSszw.exe
  2⤵
  PID:4120
- C:\Windows\System\WBLoezw.exe
  C:\Windows\System\WBLoezw.exe
  2⤵
  PID:1860
- C:\Windows\System\VheHCNt.exe
  C:\Windows\System\VheHCNt.exe
  2⤵
  PID:744
- C:\Windows\System\xQhmtMP.exe
  C:\Windows\System\xQhmtMP.exe
  2⤵
  PID:2060
- C:\Windows\System\dWIcDHU.exe
  C:\Windows\System\dWIcDHU.exe
  2⤵
  PID:5028
- C:\Windows\System\AHXDIZU.exe
  C:\Windows\System\AHXDIZU.exe
  2⤵
  PID:3860
- C:\Windows\System\rKowPgO.exe
  C:\Windows\System\rKowPgO.exe
  2⤵
  PID:2368
- C:\Windows\System\NjxIiRh.exe
  C:\Windows\System\NjxIiRh.exe
  2⤵
  PID:532
- C:\Windows\System\RGtqCTv.exe
  C:\Windows\System\RGtqCTv.exe
  2⤵
  PID:3024
- C:\Windows\System\HXWNvrz.exe
  C:\Windows\System\HXWNvrz.exe
  2⤵
  PID:4744
- C:\Windows\System\aTKAKky.exe
  C:\Windows\System\aTKAKky.exe
  2⤵
  PID:4124
- C:\Windows\System\iZcibMA.exe
  C:\Windows\System\iZcibMA.exe
  2⤵
  PID:3160
- C:\Windows\System\stiSdmQ.exe
  C:\Windows\System\stiSdmQ.exe
  2⤵
  PID:3516
- C:\Windows\System\QjkWwBn.exe
  C:\Windows\System\QjkWwBn.exe
  2⤵
  PID:3200
- C:\Windows\System\FPbSwJV.exe
  C:\Windows\System\FPbSwJV.exe
  2⤵
  PID:5060
- C:\Windows\System\OWbhNQU.exe
  C:\Windows\System\OWbhNQU.exe
  2⤵
  PID:1924
- C:\Windows\System\PbtQCSG.exe
  C:\Windows\System\PbtQCSG.exe
  2⤵
  PID:13328
- C:\Windows\System\TgCcTQt.exe
  C:\Windows\System\TgCcTQt.exe
  2⤵
  PID:13344
- C:\Windows\System\mPKXDLu.exe
  C:\Windows\System\mPKXDLu.exe
  2⤵
  PID:13360
- C:\Windows\System\rDzedRH.exe
  C:\Windows\System\rDzedRH.exe
  2⤵
  PID:13376
- C:\Windows\System\hllFyDH.exe
  C:\Windows\System\hllFyDH.exe
  2⤵
  PID:13392
- C:\Windows\System\aHIOJWH.exe
  C:\Windows\System\aHIOJWH.exe
  2⤵
  PID:13408
- C:\Windows\System\upeQyyZ.exe
  C:\Windows\System\upeQyyZ.exe
  2⤵
  PID:13464
- C:\Windows\System\nCKrcMP.exe
  C:\Windows\System\nCKrcMP.exe
  2⤵
  PID:13508
- C:\Windows\System\wJdukDV.exe
  C:\Windows\System\wJdukDV.exe
  2⤵
  PID:13524
- C:\Windows\System\oyOBTJB.exe
  C:\Windows\System\oyOBTJB.exe
  2⤵
  PID:13544
- C:\Windows\System\FokRsqA.exe
  C:\Windows\System\FokRsqA.exe
  2⤵
  PID:13604
- C:\Windows\System\ulmrtaI.exe
  C:\Windows\System\ulmrtaI.exe
  2⤵
  PID:13640
- C:\Windows\System\FrnoCMI.exe
  C:\Windows\System\FrnoCMI.exe
  2⤵
  PID:13656
- C:\Windows\System\CdSGZXL.exe
  C:\Windows\System\CdSGZXL.exe
  2⤵
  PID:13672
- C:\Windows\System\odOtDQC.exe
  C:\Windows\System\odOtDQC.exe
  2⤵
  PID:13688
- C:\Windows\System\LSDoAaP.exe
  C:\Windows\System\LSDoAaP.exe
  2⤵
  PID:13704
- C:\Windows\System\nYjSAJm.exe
  C:\Windows\System\nYjSAJm.exe
  2⤵
  PID:13720
- C:\Windows\System\FmwoamQ.exe
  C:\Windows\System\FmwoamQ.exe
  2⤵
  PID:13736
- C:\Windows\System\WhdKXMS.exe
  C:\Windows\System\WhdKXMS.exe
  2⤵
  PID:13752
- C:\Windows\System\eacoGNp.exe
  C:\Windows\System\eacoGNp.exe
  2⤵
  PID:13768
- C:\Windows\System\XxNZGTt.exe
  C:\Windows\System\XxNZGTt.exe
  2⤵
  PID:13784
- C:\Windows\System\AqIJOOU.exe
  C:\Windows\System\AqIJOOU.exe
  2⤵
  PID:13800
- C:\Windows\System\zioBduH.exe
  C:\Windows\System\zioBduH.exe
  2⤵
  PID:13816
- C:\Windows\System\wYoWHZN.exe
  C:\Windows\System\wYoWHZN.exe
  2⤵
  PID:13832
- C:\Windows\System\UNhEQZi.exe
  C:\Windows\System\UNhEQZi.exe
  2⤵
  PID:13848
- C:\Windows\System\aArjOgb.exe
  C:\Windows\System\aArjOgb.exe
  2⤵
  PID:13864
- C:\Windows\System\qjPoPHz.exe
  C:\Windows\System\qjPoPHz.exe
  2⤵
  PID:13880
- C:\Windows\System\iFgJsSz.exe
  C:\Windows\System\iFgJsSz.exe
  2⤵
  PID:13896
- C:\Windows\System\MPIfIuA.exe
  C:\Windows\System\MPIfIuA.exe
  2⤵
  PID:13912
- C:\Windows\System\gNSjNZB.exe
  C:\Windows\System\gNSjNZB.exe
  2⤵
  PID:13928
- C:\Windows\System\absSbPg.exe
  C:\Windows\System\absSbPg.exe
  2⤵
  PID:13944
- C:\Windows\System\WBusjEy.exe
  C:\Windows\System\WBusjEy.exe
  2⤵
  PID:13960
- C:\Windows\System\runsBiC.exe
  C:\Windows\System\runsBiC.exe
  2⤵
  PID:13976
- C:\Windows\System\KOChtyM.exe
  C:\Windows\System\KOChtyM.exe
  2⤵
  PID:13992
- C:\Windows\System\yzgcFMa.exe
  C:\Windows\System\yzgcFMa.exe
  2⤵
  PID:14008
- C:\Windows\System\ZNqlpPW.exe
  C:\Windows\System\ZNqlpPW.exe
  2⤵
  PID:14024
- C:\Windows\System\MbVLcUz.exe
  C:\Windows\System\MbVLcUz.exe
  2⤵
  PID:14044
- C:\Windows\System\KiWrJMI.exe
  C:\Windows\System\KiWrJMI.exe
  2⤵
  PID:14060
- C:\Windows\System\FhMtbhB.exe
  C:\Windows\System\FhMtbhB.exe
  2⤵
  PID:14076
- C:\Windows\System\pVFdtkG.exe
  C:\Windows\System\pVFdtkG.exe
  2⤵
  PID:14092
- C:\Windows\System\PHUaJCv.exe
  C:\Windows\System\PHUaJCv.exe
  2⤵
  PID:14108
- C:\Windows\System\XZGzQGs.exe
  C:\Windows\System\XZGzQGs.exe
  2⤵
  PID:14124
- C:\Windows\System\WBcNpMg.exe
  C:\Windows\System\WBcNpMg.exe
  2⤵
  PID:14140
- C:\Windows\System\OxwTTKS.exe
  C:\Windows\System\OxwTTKS.exe
  2⤵
  PID:14156
- C:\Windows\System\VJFsjJo.exe
  C:\Windows\System\VJFsjJo.exe
  2⤵
  PID:14172
- C:\Windows\System\nemhWII.exe
  C:\Windows\System\nemhWII.exe
  2⤵
  PID:14188
- C:\Windows\System\SeTGiXp.exe
  C:\Windows\System\SeTGiXp.exe
  2⤵
  PID:14204
- C:\Windows\System\pydVnDJ.exe
  C:\Windows\System\pydVnDJ.exe
  2⤵
  PID:14220
- C:\Windows\System\MAMsqIe.exe
  C:\Windows\System\MAMsqIe.exe
  2⤵
  PID:14236
- C:\Windows\System\ohGROtl.exe
  C:\Windows\System\ohGROtl.exe
  2⤵
  PID:14252
- C:\Windows\System\nINhkyp.exe
  C:\Windows\System\nINhkyp.exe
  2⤵
  PID:14268
- C:\Windows\System\FJUUKiF.exe
  C:\Windows\System\FJUUKiF.exe
  2⤵
  PID:14284
- C:\Windows\System\NnoWlBM.exe
  C:\Windows\System\NnoWlBM.exe
  2⤵
  PID:14300
- C:\Windows\System\LUyvyAp.exe
  C:\Windows\System\LUyvyAp.exe
  2⤵
  PID:14316
- C:\Windows\System\NKLSTyo.exe
  C:\Windows\System\NKLSTyo.exe
  2⤵
  PID:14332
- C:\Windows\System\QRyBhcM.exe
  C:\Windows\System\QRyBhcM.exe
  2⤵
  PID:13320
- C:\Windows\System\FXkdotb.exe
  C:\Windows\System\FXkdotb.exe
  2⤵
  PID:13352
- C:\Windows\System\QeZTQMo.exe
  C:\Windows\System\QeZTQMo.exe
  2⤵
  PID:13384
- C:\Windows\System\cAxuYQl.exe
  C:\Windows\System\cAxuYQl.exe
  2⤵
  PID:13400
- C:\Windows\System\LYzPBwN.exe
  C:\Windows\System\LYzPBwN.exe
  2⤵
  PID:13452
- C:\Windows\System\WeURoqS.exe
  C:\Windows\System\WeURoqS.exe
  2⤵
  PID:13432
- C:\Windows\System\JgXyNNI.exe
  C:\Windows\System\JgXyNNI.exe
  2⤵
  PID:13472
- C:\Windows\System\wjoWQyy.exe
  C:\Windows\System\wjoWQyy.exe
  2⤵
  PID:13480
- C:\Windows\System\oCIhkoY.exe
  C:\Windows\System\oCIhkoY.exe
  2⤵
  PID:13488
- C:\Windows\System\ngVZmlP.exe
  C:\Windows\System\ngVZmlP.exe
  2⤵
  PID:13424
- C:\Windows\System\EJefCSE.exe
  C:\Windows\System\EJefCSE.exe
  2⤵
  PID:13628
- C:\Windows\System\bNSHBlz.exe
  C:\Windows\System\bNSHBlz.exe
  2⤵
  PID:13540
- C:\Windows\System\IGAXrHk.exe
  C:\Windows\System\IGAXrHk.exe
  2⤵
  PID:13560
- C:\Windows\System\mmgItcu.exe
  C:\Windows\System\mmgItcu.exe
  2⤵
  PID:2664
- C:\Windows\System\gdqIapM.exe
  C:\Windows\System\gdqIapM.exe
  2⤵
  PID:13632
- C:\Windows\System\Rkctdqz.exe
  C:\Windows\System\Rkctdqz.exe
  2⤵
  PID:13600
- C:\Windows\System\divqqoC.exe
  C:\Windows\System\divqqoC.exe
  2⤵
  PID:13668
- C:\Windows\System\maPgNUW.exe
  C:\Windows\System\maPgNUW.exe
  2⤵
  PID:13700
- C:\Windows\System\PQlrTRj.exe
  C:\Windows\System\PQlrTRj.exe
  2⤵
  PID:13732
- C:\Windows\System\JnrREhb.exe
  C:\Windows\System\JnrREhb.exe
  2⤵
  PID:13764
- C:\Windows\System\OejcJEN.exe
  C:\Windows\System\OejcJEN.exe
  2⤵
  PID:13796
- C:\Windows\System\ZOMGbYl.exe
  C:\Windows\System\ZOMGbYl.exe
  2⤵
  PID:4496
- C:\Windows\System\MHbLsiX.exe
  C:\Windows\System\MHbLsiX.exe
  2⤵
  PID:13844
- C:\Windows\System\nAtUgJV.exe
  C:\Windows\System\nAtUgJV.exe
  2⤵
  PID:13876
- C:\Windows\System\vZNHCeA.exe
  C:\Windows\System\vZNHCeA.exe
  2⤵
  PID:13908
- C:\Windows\System\myfoNYI.exe
  C:\Windows\System\myfoNYI.exe
  2⤵
  PID:13940
- C:\Windows\System\AOPNzYh.exe
  C:\Windows\System\AOPNzYh.exe
  2⤵
  PID:13972
- C:\Windows\System\AbfrGZl.exe
  C:\Windows\System\AbfrGZl.exe
  2⤵
  PID:12636
- C:\Windows\System\BxConRn.exe
  C:\Windows\System\BxConRn.exe
  2⤵
  PID:14040
- C:\Windows\System\bEEjNtB.exe
  C:\Windows\System\bEEjNtB.exe
  2⤵
  PID:14072
- C:\Windows\System\SIwvDrX.exe
  C:\Windows\System\SIwvDrX.exe
  2⤵
  PID:14104
- C:\Windows\System\NxnfwFK.exe
  C:\Windows\System\NxnfwFK.exe
  2⤵
  PID:14136
- C:\Windows\System\aXadVLO.exe
  C:\Windows\System\aXadVLO.exe
  2⤵
  PID:14168
- C:\Windows\System\PsOlWuI.exe
  C:\Windows\System\PsOlWuI.exe
  2⤵
  PID:14200
- C:\Windows\System\iogYDZz.exe
  C:\Windows\System\iogYDZz.exe
  2⤵
  PID:14232
- C:\Windows\System\mZrcYZY.exe
  C:\Windows\System\mZrcYZY.exe
  2⤵
  PID:14264
- C:\Windows\System\NYzUXzC.exe
  C:\Windows\System\NYzUXzC.exe
  2⤵
  PID:14296
- C:\Windows\System\YuOoWcP.exe
  C:\Windows\System\YuOoWcP.exe
  2⤵
  PID:14328
- C:\Windows\System\BZTLAJC.exe
  C:\Windows\System\BZTLAJC.exe
  2⤵
  PID:13340
- C:\Windows\System\LyXRPGb.exe
  C:\Windows\System\LyXRPGb.exe
  2⤵
  PID:4948
- C:\Windows\System\vAGboEC.exe
  C:\Windows\System\vAGboEC.exe
  2⤵
  PID:13428
- C:\Windows\System\IOqBLOA.exe
  C:\Windows\System\IOqBLOA.exe
  2⤵
  PID:13476
- C:\Windows\System\FPjETwg.exe
  C:\Windows\System\FPjETwg.exe
  2⤵
  PID:13536
- C:\Windows\System\ygfgMOP.exe
  C:\Windows\System\ygfgMOP.exe
  2⤵
  PID:13616
- C:\Windows\System\wmRMHwS.exe
  C:\Windows\System\wmRMHwS.exe
  2⤵
  PID:13556
- C:\Windows\System\lHSitNu.exe
  C:\Windows\System\lHSitNu.exe
  2⤵
  PID:13624
- C:\Windows\System\qmhWUND.exe
  C:\Windows\System\qmhWUND.exe
  2⤵
  PID:13588
- C:\Windows\System\qwynguE.exe
  C:\Windows\System\qwynguE.exe
  2⤵
  PID:13716
- C:\Windows\System\hdiZGuH.exe
  C:\Windows\System\hdiZGuH.exe
  2⤵
  PID:13780
- C:\Windows\System\tyAgKRu.exe
  C:\Windows\System\tyAgKRu.exe
  2⤵
  PID:13828
- C:\Windows\System\dGTbkKp.exe
  C:\Windows\System\dGTbkKp.exe
  2⤵
  PID:13892
- C:\Windows\System\JBfzMiB.exe
  C:\Windows\System\JBfzMiB.exe
  2⤵
  PID:13956
- C:\Windows\System\bXpNRBk.exe
  C:\Windows\System\bXpNRBk.exe
  2⤵
  PID:14020
- C:\Windows\System\sdvbXDb.exe
  C:\Windows\System\sdvbXDb.exe
  2⤵
  PID:14088
- C:\Windows\System\hbyCOHg.exe
  C:\Windows\System\hbyCOHg.exe
  2⤵
  PID:5788
- C:\Windows\System\UWgoDjL.exe
  C:\Windows\System\UWgoDjL.exe
  2⤵
  PID:14196
- C:\Windows\System\aYeIrMu.exe
  C:\Windows\System\aYeIrMu.exe
  2⤵
  PID:14260
- C:\Windows\System\BmkGwoR.exe
  C:\Windows\System\BmkGwoR.exe
  2⤵
  PID:14324
- C:\Windows\System\cIaLaRY.exe
  C:\Windows\System\cIaLaRY.exe
  2⤵
  PID:13372
- C:\Windows\System\BaKtxeI.exe
  C:\Windows\System\BaKtxeI.exe
  2⤵
  PID:13460
- C:\Windows\System\EmIqQha.exe
  C:\Windows\System\EmIqQha.exe
  2⤵
  PID:13592
- C:\Windows\System\VpuUabw.exe
  C:\Windows\System\VpuUabw.exe
  2⤵
  PID:13584
- C:\Windows\System\sPaKrLq.exe
  C:\Windows\System\sPaKrLq.exe
  2⤵
  PID:13696
- C:\Windows\System\hdqxQzE.exe
  C:\Windows\System\hdqxQzE.exe
  2⤵
  PID:4264
- C:\Windows\System\clJFjYT.exe
  C:\Windows\System\clJFjYT.exe
  2⤵
  PID:13860
- C:\Windows\System\TcGFbBt.exe
  C:\Windows\System\TcGFbBt.exe
  2⤵
  PID:14000
- C:\Windows\System\PUsKyUn.exe
  C:\Windows\System\PUsKyUn.exe
  2⤵
  PID:14132
- C:\Windows\System\rPeAEzs.exe
  C:\Windows\System\rPeAEzs.exe
  2⤵
  PID:14248
- C:\Windows\System\sfMKbfp.exe
  C:\Windows\System\sfMKbfp.exe
  2⤵
  PID:13368
- C:\Windows\System\USbsZCL.exe
  C:\Windows\System\USbsZCL.exe
  2⤵
  PID:13496
- C:\Windows\System\fDbJxul.exe
  C:\Windows\System\fDbJxul.exe
  2⤵
  PID:13684
- C:\Windows\System\tHkAkoc.exe
  C:\Windows\System\tHkAkoc.exe
  2⤵
  PID:13812
- C:\Windows\System\WAzEWTj.exe
  C:\Windows\System\WAzEWTj.exe
  2⤵
  PID:14068
- C:\Windows\System\ZhYOrSd.exe
  C:\Windows\System\ZhYOrSd.exe
  2⤵
  PID:14312
- C:\Windows\System\AtnSnxs.exe
  C:\Windows\System\AtnSnxs.exe
  2⤵
  PID:14032
- C:\Windows\System\URvumzH.exe
  C:\Windows\System\URvumzH.exe
  2⤵
  PID:13988
- C:\Windows\System\npFEOfb.exe
  C:\Windows\System\npFEOfb.exe
  2⤵
  PID:13576
- C:\Windows\System\LZMqsdF.exe
  C:\Windows\System\LZMqsdF.exe
  2⤵
  PID:13520
- C:\Windows\System\aOWtpBo.exe
  C:\Windows\System\aOWtpBo.exe
  2⤵
  PID:14228
- C:\Windows\System\zaiTcQz.exe
  C:\Windows\System\zaiTcQz.exe
  2⤵
  PID:14352
- C:\Windows\System\bjlYGgt.exe
  C:\Windows\System\bjlYGgt.exe
  2⤵
  PID:14368
- C:\Windows\System\HPOcnuU.exe
  C:\Windows\System\HPOcnuU.exe
  2⤵
  PID:14384
- C:\Windows\System\xaYTwYu.exe
  C:\Windows\System\xaYTwYu.exe
  2⤵
  PID:14400
- C:\Windows\System\mLbhLlu.exe
  C:\Windows\System\mLbhLlu.exe
  2⤵
  PID:14416
- C:\Windows\System\MkcmBkE.exe
  C:\Windows\System\MkcmBkE.exe
  2⤵
  PID:14432
- C:\Windows\System\GTWWbMq.exe
  C:\Windows\System\GTWWbMq.exe
  2⤵
  PID:14448
- C:\Windows\System\njqsRWL.exe
  C:\Windows\System\njqsRWL.exe
  2⤵
  PID:14464
- C:\Windows\System\NGMsOwR.exe
  C:\Windows\System\NGMsOwR.exe
  2⤵
  PID:14480
- C:\Windows\System\ZmJAzXd.exe
  C:\Windows\System\ZmJAzXd.exe
  2⤵
  PID:14496
- C:\Windows\System\cAfWKwo.exe
  C:\Windows\System\cAfWKwo.exe
  2⤵
  PID:14512
- C:\Windows\System\VFvkyNF.exe
  C:\Windows\System\VFvkyNF.exe
  2⤵
  PID:14528
- C:\Windows\System\CkvDgGw.exe
  C:\Windows\System\CkvDgGw.exe
  2⤵
  PID:14544
- C:\Windows\System\WkLOdoC.exe
  C:\Windows\System\WkLOdoC.exe
  2⤵
  PID:14560
- C:\Windows\System\XWhQvbx.exe
  C:\Windows\System\XWhQvbx.exe
  2⤵
  PID:14576
- C:\Windows\System\RlpgSgi.exe
  C:\Windows\System\RlpgSgi.exe
  2⤵
  PID:14592
- C:\Windows\System\DtuCLnH.exe
  C:\Windows\System\DtuCLnH.exe
  2⤵
  PID:14608
- C:\Windows\System\wYSCuFf.exe
  C:\Windows\System\wYSCuFf.exe
  2⤵
  PID:14624
- C:\Windows\System\sDWzRRd.exe
  C:\Windows\System\sDWzRRd.exe
  2⤵
  PID:14640
- C:\Windows\System\JJFRZQo.exe
  C:\Windows\System\JJFRZQo.exe
  2⤵
  PID:14656
- C:\Windows\System\LNYnTXN.exe
  C:\Windows\System\LNYnTXN.exe
  2⤵
  PID:14672
- C:\Windows\System\HvQfcPS.exe
  C:\Windows\System\HvQfcPS.exe
  2⤵
  PID:14688
- C:\Windows\System\tOOZCDu.exe
  C:\Windows\System\tOOZCDu.exe
  2⤵
  PID:14704
- C:\Windows\System\rnHedeT.exe
  C:\Windows\System\rnHedeT.exe
  2⤵
  PID:14720
- C:\Windows\System\YARWPcU.exe
  C:\Windows\System\YARWPcU.exe
  2⤵
  PID:14736
- C:\Windows\System\OSwqSvh.exe
  C:\Windows\System\OSwqSvh.exe
  2⤵
  PID:14752
- C:\Windows\System\kPdXSIX.exe
  C:\Windows\System\kPdXSIX.exe
  2⤵
  PID:14768
- C:\Windows\System\mAjIOZR.exe
  C:\Windows\System\mAjIOZR.exe
  2⤵
  PID:14784
- C:\Windows\System\UTLuqsP.exe
  C:\Windows\System\UTLuqsP.exe
  2⤵
  PID:14800
- C:\Windows\System\nXUjGLf.exe
  C:\Windows\System\nXUjGLf.exe
  2⤵
  PID:14816
- C:\Windows\System\vFhYduQ.exe
  C:\Windows\System\vFhYduQ.exe
  2⤵
  PID:14832
- C:\Windows\System\LkuJfDF.exe
  C:\Windows\System\LkuJfDF.exe
  2⤵
  PID:14848
- C:\Windows\System\sfkhFNk.exe
  C:\Windows\System\sfkhFNk.exe
  2⤵
  PID:14864
- C:\Windows\System\VopxarE.exe
  C:\Windows\System\VopxarE.exe
  2⤵
  PID:14880
- C:\Windows\System\BBZWErX.exe
  C:\Windows\System\BBZWErX.exe
  2⤵
  PID:14896
- C:\Windows\System\nWsNhvf.exe
  C:\Windows\System\nWsNhvf.exe
  2⤵
  PID:14912
- C:\Windows\System\oGAoWTy.exe
  C:\Windows\System\oGAoWTy.exe
  2⤵
  PID:14928
- C:\Windows\System\bZKfwmv.exe
  C:\Windows\System\bZKfwmv.exe
  2⤵
  PID:14944
- C:\Windows\System\vfmpONe.exe
  C:\Windows\System\vfmpONe.exe
  2⤵
  PID:14960
- C:\Windows\System\AOUxpHM.exe
  C:\Windows\System\AOUxpHM.exe
  2⤵
  PID:14976
- C:\Windows\System\NjQWdVW.exe
  C:\Windows\System\NjQWdVW.exe
  2⤵
  PID:14992
- C:\Windows\System\bYxBRJu.exe
  C:\Windows\System\bYxBRJu.exe
  2⤵
  PID:15008
- C:\Windows\System\cbMVUVG.exe
  C:\Windows\System\cbMVUVG.exe
  2⤵
  PID:15028
- C:\Windows\System\foxHLDw.exe
  C:\Windows\System\foxHLDw.exe
  2⤵
  PID:15044
- C:\Windows\System\PNBwFHv.exe
  C:\Windows\System\PNBwFHv.exe
  2⤵
  PID:15060
- C:\Windows\System\JLunKes.exe
  C:\Windows\System\JLunKes.exe
  2⤵
  PID:15076
- C:\Windows\System\aOKlFtb.exe
  C:\Windows\System\aOKlFtb.exe
  2⤵
  PID:15092
- C:\Windows\System\VFINeSy.exe
  C:\Windows\System\VFINeSy.exe
  2⤵
  PID:15108
- C:\Windows\System\LVRJehy.exe
  C:\Windows\System\LVRJehy.exe
  2⤵
  PID:15124
- C:\Windows\System\BTlhHMO.exe
  C:\Windows\System\BTlhHMO.exe
  2⤵
  PID:15140
- C:\Windows\System\gVdRCXw.exe
  C:\Windows\System\gVdRCXw.exe
  2⤵
  PID:15156
- C:\Windows\System\hPnKwCL.exe
  C:\Windows\System\hPnKwCL.exe
  2⤵
  PID:15172
- C:\Windows\System\vkghaTz.exe
  C:\Windows\System\vkghaTz.exe
  2⤵
  PID:15188
- C:\Windows\System\beaeuPN.exe
  C:\Windows\System\beaeuPN.exe
  2⤵
  PID:15204
- C:\Windows\System\fTzmFWD.exe
  C:\Windows\System\fTzmFWD.exe
  2⤵
  PID:15220
- C:\Windows\System\tVhAgul.exe
  C:\Windows\System\tVhAgul.exe
  2⤵
  PID:15236
- C:\Windows\System\JQVTtRL.exe
  C:\Windows\System\JQVTtRL.exe
  2⤵
  PID:15252
- C:\Windows\System\Apweazu.exe
  C:\Windows\System\Apweazu.exe
  2⤵
  PID:15268
- C:\Windows\System\GdTJtNG.exe
  C:\Windows\System\GdTJtNG.exe
  2⤵
  PID:15284
- C:\Windows\System\TOLTUPW.exe
  C:\Windows\System\TOLTUPW.exe
  2⤵
  PID:15300
- C:\Windows\System\CHuYhBu.exe
  C:\Windows\System\CHuYhBu.exe
  2⤵
  PID:15316
- C:\Windows\System\tBeCppr.exe
  C:\Windows\System\tBeCppr.exe
  2⤵
  PID:15332
- C:\Windows\System\RKOcEOv.exe
  C:\Windows\System\RKOcEOv.exe
  2⤵
  PID:15348
- C:\Windows\System\ZBsJmsd.exe
  C:\Windows\System\ZBsJmsd.exe
  2⤵
  PID:14360
- C:\Windows\System\TtEiAoI.exe
  C:\Windows\System\TtEiAoI.exe
  2⤵
  PID:14392
- C:\Windows\System\izxhpMU.exe
  C:\Windows\System\izxhpMU.exe
  2⤵
  PID:14424
- C:\Windows\System\KAQVhDz.exe
  C:\Windows\System\KAQVhDz.exe
  2⤵
  PID:14456
- C:\Windows\System\WVLPVQj.exe
  C:\Windows\System\WVLPVQj.exe
  2⤵
  PID:14488
- C:\Windows\System\wiQIQxY.exe
  C:\Windows\System\wiQIQxY.exe
  2⤵
  PID:14520
- C:\Windows\System\VmgBeKU.exe
  C:\Windows\System\VmgBeKU.exe
  2⤵
  PID:14552
- C:\Windows\System\HemCloX.exe
  C:\Windows\System\HemCloX.exe
  2⤵
  PID:14584
- C:\Windows\System\mFvLOqj.exe
  C:\Windows\System\mFvLOqj.exe
  2⤵
  PID:14616
- C:\Windows\System\tMuVUhQ.exe
  C:\Windows\System\tMuVUhQ.exe
  2⤵
  PID:14648
- C:\Windows\System\GlytXYB.exe
  C:\Windows\System\GlytXYB.exe
  2⤵
  PID:14680
- C:\Windows\System\sZDSjDm.exe
  C:\Windows\System\sZDSjDm.exe
  2⤵
  PID:14712
- C:\Windows\System\OhxcJpy.exe
  C:\Windows\System\OhxcJpy.exe
  2⤵
  PID:14744
- C:\Windows\System\pGZtxvj.exe
  C:\Windows\System\pGZtxvj.exe
  2⤵
  PID:14776
- C:\Windows\System\rnXkQpb.exe
  C:\Windows\System\rnXkQpb.exe
  2⤵
  PID:14808
- C:\Windows\System\VhcpvlU.exe
  C:\Windows\System\VhcpvlU.exe
  2⤵
  PID:13448
- C:\Windows\System\EzswNCI.exe
  C:\Windows\System\EzswNCI.exe
  2⤵
  PID:14860
- C:\Windows\System\fJoTLWq.exe
  C:\Windows\System\fJoTLWq.exe
  2⤵
  PID:14892
- C:\Windows\System\TvLXqPH.exe
  C:\Windows\System\TvLXqPH.exe
  2⤵
  PID:14940
- C:\Windows\System\cSKHNin.exe
  C:\Windows\System\cSKHNin.exe
  2⤵
  PID:14972
- C:\Windows\System\GRmIjxL.exe
  C:\Windows\System\GRmIjxL.exe
  2⤵
  PID:15004
- C:\Windows\System\BHbuRAJ.exe
  C:\Windows\System\BHbuRAJ.exe
  2⤵
  PID:15052
- C:\Windows\System\EOqfhMr.exe
  C:\Windows\System\EOqfhMr.exe
  2⤵
  PID:15084
- C:\Windows\System\fhvExxk.exe
  C:\Windows\System\fhvExxk.exe
  2⤵
  PID:15116
- C:\Windows\System\eQbElHX.exe
  C:\Windows\System\eQbElHX.exe
  2⤵
  PID:15148
- C:\Windows\System\zCzLFDW.exe
  C:\Windows\System\zCzLFDW.exe
  2⤵
  PID:15180
- C:\Windows\System\VdMwQTE.exe
  C:\Windows\System\VdMwQTE.exe
  2⤵
  PID:15212
- C:\Windows\System\OswDGYY.exe
  C:\Windows\System\OswDGYY.exe
  2⤵
  PID:6092
- C:\Windows\System\qBvhpDH.exe
  C:\Windows\System\qBvhpDH.exe
  2⤵
  PID:15264
- C:\Windows\System\CUVUruy.exe
  C:\Windows\System\CUVUruy.exe
  2⤵
  PID:15280
- C:\Windows\System\QtLEOMm.exe
  C:\Windows\System\QtLEOMm.exe
  2⤵
  PID:15312
- C:\Windows\System\xRKZnLO.exe
  C:\Windows\System\xRKZnLO.exe
  2⤵
  PID:15344
- C:\Windows\System\ZwkzsUX.exe
  C:\Windows\System\ZwkzsUX.exe
  2⤵
  PID:14380
- C:\Windows\System\mxBhvXi.exe
  C:\Windows\System\mxBhvXi.exe
  2⤵
  PID:5472
- C:\Windows\System\TgFEIOU.exe
  C:\Windows\System\TgFEIOU.exe
  2⤵
  PID:14444
- C:\Windows\System\IEtyLSB.exe
  C:\Windows\System\IEtyLSB.exe
  2⤵
  PID:14504
- C:\Windows\System\rvhcHre.exe
  C:\Windows\System\rvhcHre.exe
  2⤵
  PID:14540
- C:\Windows\System\gmvsnli.exe
  C:\Windows\System\gmvsnli.exe
  2⤵
  PID:5612
- C:\Windows\System\hXyXzps.exe
  C:\Windows\System\hXyXzps.exe
  2⤵
  PID:14632
- C:\Windows\System\bzayEkI.exe
  C:\Windows\System\bzayEkI.exe
  2⤵
  PID:14664
- C:\Windows\System\sXfUvbb.exe
  C:\Windows\System\sXfUvbb.exe
  2⤵
  PID:15016
- C:\Windows\System\NrgWPdL.exe
  C:\Windows\System\NrgWPdL.exe
  2⤵
  PID:5928
- C:\Windows\System\OyxVORe.exe
  C:\Windows\System\OyxVORe.exe
  2⤵
  PID:14796
- C:\Windows\System\mtkislQ.exe
  C:\Windows\System\mtkislQ.exe
  2⤵
  PID:14856
- C:\Windows\System\pcIHsLy.exe
  C:\Windows\System\pcIHsLy.exe
  2⤵
  PID:14908
- C:\Windows\System\PzNvDIR.exe
  C:\Windows\System\PzNvDIR.exe
  2⤵
  PID:4620
- C:\Windows\System\xAFMlmf.exe
  C:\Windows\System\xAFMlmf.exe
  2⤵
  PID:15024
- C:\Windows\System\EdjszTL.exe
  C:\Windows\System\EdjszTL.exe
  2⤵
  PID:15100
- C:\Windows\System\qgQiTSK.exe
  C:\Windows\System\qgQiTSK.exe
  2⤵
  PID:15164
- C:\Windows\System\BobGYaJ.exe
  C:\Windows\System\BobGYaJ.exe
  2⤵
  PID:15200
- C:\Windows\System\rHHXWEs.exe
  C:\Windows\System\rHHXWEs.exe
  2⤵
  PID:5272
- C:\Windows\System\PamDaDx.exe
  C:\Windows\System\PamDaDx.exe
  2⤵
  PID:15276
- C:\Windows\System\uVRvXPx.exe
  C:\Windows\System\uVRvXPx.exe
  2⤵
  PID:15328
- C:\Windows\System\XkYdjHZ.exe
  C:\Windows\System\XkYdjHZ.exe
  2⤵
  PID:14408
- C:\Windows\System\hNLvJis.exe
  C:\Windows\System\hNLvJis.exe
  2⤵
  PID:14344
- C:\Windows\System\TzNbnTE.exe
  C:\Windows\System\TzNbnTE.exe
  2⤵
  PID:5532
- C:\Windows\System\wNJGFLh.exe
  C:\Windows\System\wNJGFLh.exe
  2⤵
  PID:4060
- C:\Windows\System\fQcvGPV.exe
  C:\Windows\System\fQcvGPV.exe
  2⤵
  PID:2448
- C:\Windows\System\PYfPdjh.exe
  C:\Windows\System\PYfPdjh.exe
  2⤵
  PID:14732
- C:\Windows\System\NOhtvub.exe
  C:\Windows\System\NOhtvub.exe
  2⤵
  PID:14844
- C:\Windows\System\oTOkJHx.exe
  C:\Windows\System\oTOkJHx.exe
  2⤵
  PID:14956
- C:\Windows\System\gLvFjnq.exe
  C:\Windows\System\gLvFjnq.exe
  2⤵
  PID:15068
- C:\Windows\System\lQuyBZZ.exe
  C:\Windows\System\lQuyBZZ.exe
  2⤵
  PID:4424
- C:\Windows\System\YimpwvR.exe
  C:\Windows\System\YimpwvR.exe
  2⤵
  PID:15232
- C:\Windows\System\xrnBHoF.exe
  C:\Windows\System\xrnBHoF.exe
  2⤵
  PID:4108
- C:\Windows\System\mEFKUOT.exe
  C:\Windows\System\mEFKUOT.exe
  2⤵
  PID:15308
- C:\Windows\System\WgqRqIe.exe
  C:\Windows\System\WgqRqIe.exe
  2⤵
  PID:14476
- C:\Windows\System\BtuwEGB.exe
  C:\Windows\System\BtuwEGB.exe
  2⤵
  PID:6360
- C:\Windows\System\toNtnrZ.exe
  C:\Windows\System\toNtnrZ.exe
  2⤵
  PID:14604
- C:\Windows\System\qDfZgtK.exe
  C:\Windows\System\qDfZgtK.exe
  2⤵
  PID:6452
- C:\Windows\System\wogyTOO.exe
  C:\Windows\System\wogyTOO.exe
  2⤵
  PID:14888
- C:\Windows\System\FjTVWsv.exe
  C:\Windows\System\FjTVWsv.exe
  2⤵
  PID:6580
- C:\Windows\System\uNJmJhK.exe
  C:\Windows\System\uNJmJhK.exe
  2⤵
  PID:15196
- C:\Windows\System\YTTACMT.exe
  C:\Windows\System\YTTACMT.exe
  2⤵
  PID:6216
- C:\Windows\System\NihJadV.exe
  C:\Windows\System\NihJadV.exe
  2⤵
  PID:6736
- C:\Windows\System\UrzLdEx.exe
  C:\Windows\System\UrzLdEx.exe
  2⤵
  PID:5636
- C:\Windows\System\QBQgNSJ.exe
  C:\Windows\System\QBQgNSJ.exe
  2⤵
  PID:6808
- C:\Windows\System\EnUXpcl.exe
  C:\Windows\System\EnUXpcl.exe
  2⤵
  PID:14696
- C:\Windows\System\eOHIXfZ.exe
  C:\Windows\System\eOHIXfZ.exe
  2⤵
  PID:6860
- C:\Windows\System\HjkYLHr.exe
  C:\Windows\System\HjkYLHr.exe
  2⤵
  PID:14988
- C:\Windows\System\cgYPejG.exe
  C:\Windows\System\cgYPejG.exe
  2⤵
  PID:15136
- C:\Windows\System\VwSRgES.exe
  C:\Windows\System\VwSRgES.exe
  2⤵
  PID:6960
- C:\Windows\System\HkOQIFT.exe
  C:\Windows\System\HkOQIFT.exe
  2⤵
  PID:15036
- C:\Windows\System\HSOPlKP.exe
  C:\Windows\System\HSOPlKP.exe
  2⤵
  PID:6812
- C:\Windows\System\COKQSUA.exe
  C:\Windows\System\COKQSUA.exe
  2⤵
  PID:3736
- C:\Windows\System\wjAMlGh.exe
  C:\Windows\System\wjAMlGh.exe
  2⤵
  PID:6984
- C:\Windows\System\LFSFaMf.exe
  C:\Windows\System\LFSFaMf.exe
  2⤵
  PID:7044
- C:\Windows\System\wBJmOFS.exe
  C:\Windows\System\wBJmOFS.exe
  2⤵
  PID:7100
- C:\Windows\System\XJfHeyT.exe
  C:\Windows\System\XJfHeyT.exe
  2⤵
  PID:15372
- C:\Windows\System\sWOntgP.exe
  C:\Windows\System\sWOntgP.exe
  2⤵
  PID:15388
- C:\Windows\System\VfNFeQJ.exe
  C:\Windows\System\VfNFeQJ.exe
  2⤵
  PID:15404
- C:\Windows\System\MyZajPf.exe
  C:\Windows\System\MyZajPf.exe
  2⤵
  PID:15428
- C:\Windows\System\EgpyoEw.exe
  C:\Windows\System\EgpyoEw.exe
  2⤵
  PID:15444
- C:\Windows\System\zSoMPyF.exe
  C:\Windows\System\zSoMPyF.exe
  2⤵
  PID:15460
- C:\Windows\System\GgWeuyC.exe
  C:\Windows\System\GgWeuyC.exe
  2⤵
  PID:15476
- C:\Windows\System\tboeVMY.exe
  C:\Windows\System\tboeVMY.exe
  2⤵
  PID:15492
- C:\Windows\System\lUQDqwt.exe
  C:\Windows\System\lUQDqwt.exe
  2⤵
  PID:15508
- C:\Windows\System\hQVAJdz.exe
  C:\Windows\System\hQVAJdz.exe
  2⤵
  PID:15524
- C:\Windows\System\tsPjuvu.exe
  C:\Windows\System\tsPjuvu.exe
  2⤵
  PID:15540
- C:\Windows\System\yeesnyr.exe
  C:\Windows\System\yeesnyr.exe
  2⤵
  PID:15556
- C:\Windows\System\TqhzsiK.exe
  C:\Windows\System\TqhzsiK.exe
  2⤵
  PID:15572
- C:\Windows\System\wnMPPui.exe
  C:\Windows\System\wnMPPui.exe
  2⤵
  PID:15588
- C:\Windows\System\LsgPODp.exe
  C:\Windows\System\LsgPODp.exe
  2⤵
  PID:15604
- C:\Windows\System\UeGNqat.exe
  C:\Windows\System\UeGNqat.exe
  2⤵
  PID:15620
- C:\Windows\System\CojrcvU.exe
  C:\Windows\System\CojrcvU.exe
  2⤵
  PID:15636
- C:\Windows\System\ZcesCFS.exe
  C:\Windows\System\ZcesCFS.exe
  2⤵
  PID:15652
- C:\Windows\System\ijrkThX.exe
  C:\Windows\System\ijrkThX.exe
  2⤵
  PID:15668
- C:\Windows\System\XKbihIM.exe
  C:\Windows\System\XKbihIM.exe
  2⤵
  PID:15684
- C:\Windows\System\umugjtl.exe
  C:\Windows\System\umugjtl.exe
  2⤵
  PID:15700
- C:\Windows\System\JulLgpe.exe
  C:\Windows\System\JulLgpe.exe
  2⤵
  PID:15716
- C:\Windows\System\sYhwTFG.exe
  C:\Windows\System\sYhwTFG.exe
  2⤵
  PID:15748
- C:\Windows\System\xwbeyZw.exe
  C:\Windows\System\xwbeyZw.exe
  2⤵
  PID:15788
- C:\Windows\System\QVdhjPO.exe
  C:\Windows\System\QVdhjPO.exe
  2⤵
  PID:15808
- C:\Windows\System\xYYNtzk.exe
  C:\Windows\System\xYYNtzk.exe
  2⤵
  PID:15832
- C:\Windows\System\EtxrkPU.exe
  C:\Windows\System\EtxrkPU.exe
  2⤵
  PID:15848
- C:\Windows\System\wCiDloh.exe
  C:\Windows\System\wCiDloh.exe
  2⤵
  PID:15864
- C:\Windows\System\AtAolEf.exe
  C:\Windows\System\AtAolEf.exe
  2⤵
  PID:15888
- C:\Windows\System\jIzjWzc.exe
  C:\Windows\System\jIzjWzc.exe
  2⤵
  PID:15908
- C:\Windows\System\TkwyBJb.exe
  C:\Windows\System\TkwyBJb.exe
  2⤵
  PID:15928
- C:\Windows\System\kQCjLcK.exe
  C:\Windows\System\kQCjLcK.exe
  2⤵
  PID:15948
- C:\Windows\System\fReeTRB.exe
  C:\Windows\System\fReeTRB.exe
  2⤵
  PID:15976
- C:\Windows\System\YYqCazZ.exe
  C:\Windows\System\YYqCazZ.exe
  2⤵
  PID:15996
- C:\Windows\System\TrPYWFT.exe
  C:\Windows\System\TrPYWFT.exe
  2⤵
  PID:16016
- C:\Windows\System\BSbLCPQ.exe
  C:\Windows\System\BSbLCPQ.exe
  2⤵
  PID:16032
- C:\Windows\System\jvpMNyL.exe
  C:\Windows\System\jvpMNyL.exe
  2⤵
  PID:16052
- C:\Windows\System\WAxNqMj.exe
  C:\Windows\System\WAxNqMj.exe
  2⤵
  PID:16072
- C:\Windows\System\ZPjPUOY.exe
  C:\Windows\System\ZPjPUOY.exe
  2⤵
  PID:16092
- C:\Windows\System\jbjLmkJ.exe
  C:\Windows\System\jbjLmkJ.exe
  2⤵
  PID:16120
- C:\Windows\System\JmUmGMk.exe
  C:\Windows\System\JmUmGMk.exe
  2⤵
  PID:16136
- C:\Windows\System\qDQrBRN.exe
  C:\Windows\System\qDQrBRN.exe
  2⤵
  PID:16172
- C:\Windows\System\kDHPKRL.exe
  C:\Windows\System\kDHPKRL.exe
  2⤵
  PID:16204
- C:\Windows\System\mitfmix.exe
  C:\Windows\System\mitfmix.exe
  2⤵
  PID:16236
- C:\Windows\System\suloryc.exe
  C:\Windows\System\suloryc.exe
  2⤵
  PID:16252
- C:\Windows\System\ReeaEKe.exe
  C:\Windows\System\ReeaEKe.exe
  2⤵
  PID:16272
- C:\Windows\System\xOdZDRj.exe
  C:\Windows\System\xOdZDRj.exe
  2⤵
  PID:16300
- C:\Windows\System\IOPFTQd.exe
  C:\Windows\System\IOPFTQd.exe
  2⤵
  PID:16316
- C:\Windows\System\pHlrwpe.exe
  C:\Windows\System\pHlrwpe.exe
  2⤵
  PID:16336
- C:\Windows\System\lTOGxdb.exe
  C:\Windows\System\lTOGxdb.exe
  2⤵
  PID:16352
- C:\Windows\System\aMPPhAD.exe
  C:\Windows\System\aMPPhAD.exe
  2⤵
  PID:16372
- C:\Windows\System\QwCjEvj.exe
  C:\Windows\System\QwCjEvj.exe
  2⤵
  PID:6676
- C:\Windows\System\hNdtZLQ.exe
  C:\Windows\System\hNdtZLQ.exe
  2⤵
  PID:6988
- C:\Windows\System\sXqlSVO.exe
  C:\Windows\System\sXqlSVO.exe
  2⤵
  PID:6300
- C:\Windows\System\HBGwhYV.exe
  C:\Windows\System\HBGwhYV.exe
  2⤵
  PID:7000
- C:\Windows\System\xNvAQqX.exe
  C:\Windows\System\xNvAQqX.exe
  2⤵
  PID:15132
- C:\Windows\System\YBOcbOE.exe
  C:\Windows\System\YBOcbOE.exe
  2⤵
  PID:15400
- C:\Windows\System\pDaWZwb.exe
  C:\Windows\System\pDaWZwb.exe
  2⤵
  PID:15436
- C:\Windows\System\RIGNRJs.exe
  C:\Windows\System\RIGNRJs.exe
  2⤵
  PID:6388
- C:\Windows\System\xTMsbTN.exe
  C:\Windows\System\xTMsbTN.exe
  2⤵
  PID:6564
- C:\Windows\System\WWpMbfb.exe
  C:\Windows\System\WWpMbfb.exe
  2⤵
  PID:15488
- C:\Windows\System\VfRndTN.exe
  C:\Windows\System\VfRndTN.exe
  2⤵
  PID:6968
- C:\Windows\System\wJWscmI.exe
  C:\Windows\System\wJWscmI.exe
  2⤵
  PID:15516
- C:\Windows\System\aoDhwRZ.exe
  C:\Windows\System\aoDhwRZ.exe
  2⤵
  PID:15584
- C:\Windows\System\YYtZXty.exe
  C:\Windows\System\YYtZXty.exe
  2⤵
  PID:15616
- C:\Windows\System\ZORgmYK.exe
  C:\Windows\System\ZORgmYK.exe
  2⤵
  PID:15664
- C:\Windows\System\NnyctTj.exe
  C:\Windows\System\NnyctTj.exe
  2⤵
  PID:7372
- C:\Windows\System\DYHHIGb.exe
  C:\Windows\System\DYHHIGb.exe
  2⤵
  PID:7536
- C:\Windows\System\xnvRyYH.exe
  C:\Windows\System\xnvRyYH.exe
  2⤵
  PID:3140
- C:\Windows\System\fdpyYlq.exe
  C:\Windows\System\fdpyYlq.exe
  2⤵
  PID:7748
- C:\Windows\System\qMwCchh.exe
  C:\Windows\System\qMwCchh.exe
  2⤵
  PID:4956
- C:\Windows\System\hwySjef.exe
  C:\Windows\System\hwySjef.exe
  2⤵
  PID:15884
- C:\Windows\System\wKBeTlw.exe
  C:\Windows\System\wKBeTlw.exe
  2⤵
  PID:15872
- C:\Windows\System\ikOkmel.exe
  C:\Windows\System\ikOkmel.exe
  2⤵
  PID:1536
- C:\Windows\System\wZTZWsV.exe
  C:\Windows\System\wZTZWsV.exe
  2⤵
  PID:15924
- C:\Windows\System\MRNElbN.exe
  C:\Windows\System\MRNElbN.exe
  2⤵
  PID:8040
- C:\Windows\System\pWeiZju.exe
  C:\Windows\System\pWeiZju.exe
  2⤵
  PID:3504
- C:\Windows\System\MIoHFqX.exe
  C:\Windows\System\MIoHFqX.exe
  2⤵
  PID:15936
- C:\Windows\System\vtTFXbt.exe
  C:\Windows\System\vtTFXbt.exe
  2⤵
  PID:2128
- C:\Windows\System\ATNxNMb.exe
  C:\Windows\System\ATNxNMb.exe
  2⤵
  PID:15960
- C:\Windows\System\lpaKCfM.exe
  C:\Windows\System\lpaKCfM.exe
  2⤵
  PID:7400
- C:\Windows\System\EqYHPFJ.exe
  C:\Windows\System\EqYHPFJ.exe
  2⤵
  PID:16048
- C:\Windows\System\rcazKGh.exe
  C:\Windows\System\rcazKGh.exe
  2⤵
  PID:16080
- C:\Windows\System\XmkuDpb.exe
  C:\Windows\System\XmkuDpb.exe
  2⤵
  PID:2004
- C:\Windows\System\atxDPmI.exe
  C:\Windows\System\atxDPmI.exe
  2⤵
  PID:16108
- C:\Windows\System\DnJZmRF.exe
  C:\Windows\System\DnJZmRF.exe
  2⤵
  PID:16144
- C:\Windows\System\xYEPSLA.exe
  C:\Windows\System\xYEPSLA.exe
  2⤵
  PID:7240
- C:\Windows\System\Ynghput.exe
  C:\Windows\System\Ynghput.exe
  2⤵
  PID:7808
- C:\Windows\System\BViGocr.exe
  C:\Windows\System\BViGocr.exe
  2⤵
  PID:7716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jpfwbkye.5ug.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BtamxVV.exe

Filesize
2.0MB

MD5
599d5594dd6a0b83c4ececaa5fe25086

SHA1
16f5eb3da43747f014da1195b1d09b16fbad126b

SHA256
7d8a1dc66a6f9804ce00364f2736d596e2abf78faff3599dc48d3f84c8e76351

SHA512
26707405b6fe0c5338bbd4f4fbe7982cd93a090f3acb313d32fb720dfaf984250eb53959f3a389aba406a819f11e9054da327e281a5834743308390c2421954f

Download Submit
C:\Windows\System\EWMALey.exe

Filesize
2.0MB

MD5
878bd1e6da3a7c7aa28bda16763671a2

SHA1
fe6e5205152ba16ece61df2d74fd5317d8428638

SHA256
c8f38cacda5aa9117e75a99c7359824737c4bde9475b7b2be38dc4018a5f370a

SHA512
32a0691407a8526b3fb5c1f3e353b64d105a6512833a7d78bf4859f9375337deeac05ab369a5000aa380f534db8346ca6a8af9a3c09d8a463ac53a07211d5389

Download Submit
C:\Windows\System\EfTCYxG.exe

Filesize
2.0MB

MD5
a7db250cbbb1fbd678b3595c4561b322

SHA1
5bdbf16f9e4ce671445cc008e8ae19ecc09c818b

SHA256
72fdd3c5d569133174ca6e93a846f080f1b33469548049a34de8450ce2414108

SHA512
ffc5a408821bf3c72187487559ad5ddf945c546f69a716b429b76f029f87144b92795117908b31dd56ca6dcd98016b19b8922a895a6b19b3809efd1470e7de2f

Download Submit
C:\Windows\System\JgkiLZA.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\KIhtnjJ.exe

Filesize
2.0MB

MD5
450ca1bca623f01d0ae18891d4b8306e

SHA1
b68dcedfc0df8be3b07c10b1d3768c5e54492c91

SHA256
abc50e7c7cdd5c24cb2fcebf38e3701b1da0919381705e83f286a1edc79a47f5

SHA512
ad431adb564efab0e5f2a9e122d7e44c67b778a3979be87a9e9219d90e172452222bac61f31f0f930190c62e7fa500f08303f9c85f77bddd8cc4b86e9324804c

Download Submit
C:\Windows\System\KKJpOtk.exe

Filesize
2.0MB

MD5
83a932d6037c2e5368e734bb8bc9f79d

SHA1
bac5681f0c86543629556f38c0e43859034f827e

SHA256
33c350af3d474cb695e37ccf75f6a1ac805aae32024bba867ab93f39d7778b49

SHA512
5d1fa747d4900412df00c241235a7716985ab4e95a3c0ef9caaf4fba9e9a9c2c1d894763e6b3d20d84e8237091db82103d77f65f2a9c494db0991fda7d7f4f45

Download Submit
C:\Windows\System\KrCZmZJ.exe

Filesize
2.0MB

MD5
cc7610ebcfe754d2a654c1016d0b56ae

SHA1
33f25bcea4c77efb4cf7fa8e7587a96ea8d23b01

SHA256
8c010bb1b9be75a993924885b085127b2ada1af8c1d1379149a9c187f927f1d7

SHA512
a6711bb4c2a2d63470aab8e0db119bb782da277409161772402e65a799f74f3ab80d717fc95da1d014fd09d90e5f619f017d65726a2896da9af1f55e0a03b36f

Download Submit
C:\Windows\System\LmGOpSP.exe

Filesize
2.0MB

MD5
2cae4a672e9f121528db4d95a355eb37

SHA1
54464d1c26eb7a7c48d01e71b0c66b8a37ab9bf0

SHA256
1739187413b89ac019d1a0a3d581deb05f3fb719d5d6e156bf0fa4ea19d1c497

SHA512
52b75dcab2bc148b9f5f050c70c64bd81023dd9ea378a9e9e2efbffe2efb4c2afdf8dbbd564bd6e9dc6753d3442b94eff98e7326c1c07679b342645d352596a8

Download Submit
C:\Windows\System\MAQDPbd.exe

Filesize
2.0MB

MD5
16618f3682ae07e96cb71fc4b6d52a01

SHA1
603af24bdc5c5d2ca34f26529f6cf49fddb7f860

SHA256
162f35448a187580c18f662cc6db0a61d5bdd88c70c83bf797077841f7148dc0

SHA512
4c2ca91c3a1f37228ecba71d643c786f54c5de662dd5db1a440d975042108efbc47642be5f218751714bca8e0d9199b6a96bb6f1351d920da78b80c4d7237ea9

Download Submit
C:\Windows\System\MYfLOGj.exe

Filesize
2.0MB

MD5
8690d458d13599d44302038859b4a0c1

SHA1
95d985585140cb1d0258981716e6663adb8e1621

SHA256
bf574f2d59714242a844417666f73bdb38f76703880dd24b896d78b196a17d7f

SHA512
e1de219657dca00b513a900513b364d575acfca1a39a7b2462f676df297d2f7eed4942d5b4320a6e0696b6e213d5f5e6a4d8f76dbf413cc010d0e23f4e712ff0

Download Submit
C:\Windows\System\MmNJKVt.exe

Filesize
2.0MB

MD5
757a31e60c5ddc4436764a782d57ca58

SHA1
3ffaf584727e6ada9cf695717d40613a0622e51f

SHA256
0dbbb88796efd3b2465b23b7901baa2ac0c7c7a346cd7e8d61e7b25bd27bbcd6

SHA512
feefca30cc7440f7ba5012a7c58a410e1dd1a68887d3e56458e9a09d3f3a854f11502c099906449f94a7abe6774b3bf6e300f613d0b9ff39a7b84d9b8b93bc32

Download Submit
C:\Windows\System\NwDFgmH.exe

Filesize
2.0MB

MD5
6994933ecc5db0906402cefe6f5bdfda

SHA1
aad891d73015acd073e571036614b6dbadd770a1

SHA256
f0a6bb40d7faab055b333756ed75c8ebd4efe28b211fd7e196c5790680d73d32

SHA512
0529469c7fcf63d52b44adc8e0e983701037a83a3524de783275eac9db321159c08d6bf44577fa03f17732bed3d7d6a4c067dff6023c7cb87bd23abe42f9213a

Download Submit
C:\Windows\System\TEVuHNz.exe

Filesize
2.0MB

MD5
b401e45eaea4916bd662f7b8ed3a8db1

SHA1
1c125fcf2bf4a491cf4f8ffead84bd144139415d

SHA256
e05526dbd2b313fe1d7c517b14ec856ee66713a8bc3fd4dffca411b755d294d1

SHA512
156f7da64fc9dc38efad78ea34235ec08e3a2a704c5ad1148fc10d77d91bb15caf3e2a9aac383bdd6df23a484fe30a477ee8699a93dec632db74e7de7e45526f

Download Submit
C:\Windows\System\VPBCSPD.exe

Filesize
2.0MB

MD5
9e525b93379971bc473cabed43cd55eb

SHA1
d47ab1ef0b7a515cde72096f00620db62477abd0

SHA256
cae69ee9a5f0cb742cf301ebfba2c4cab5daafbe71503d6483eeea8a810d0c91

SHA512
9295f3eaaf0939ba8033211f843806ebe5d09ad3c819c5d46d91e69e8738191c292365e833f3f7eed1af748521a2879b0af4a548d79d423704255b9195c38a4f

Download Submit
C:\Windows\System\aSaEnPd.exe

Filesize
2.0MB

MD5
b5e003ef0f48c82fb10d9fa8f43e9e7e

SHA1
1f31b9211e1ac408ae4bef6061476b053132ed38

SHA256
045eee565b35f868dc99ddcf9b883e7943298a3ddf60a18efe93feb1ba62e7df

SHA512
914b2e9ff7e0c97a455bacace11f7e02808ec1ab53f44b25d010631fc170d3438ff5ff284e38c1290925068b9cd507675b7a8c5b16936c1bfab7631488646f4e

Download Submit
C:\Windows\System\bYrTygp.exe

Filesize
2.0MB

MD5
08e964b8f1ff19c8d22f98f7076eedb9

SHA1
a7eb7bcbf8978770590f2e7adaeff23cf39d7f19

SHA256
bfbb6e52a7ce3bc96ca577f04bb9e798bf1674e446f54225e84754255ba6f4aa

SHA512
5ec987196726c404393dc8570a6f6aa47ace8c1a2c7847afb49996933981d2f4b29c90cca1ff66bf331d31bf9d0abddb1258369ab82f37cb3211cfc1712cf7f9

Download Submit
C:\Windows\System\eXQjycG.exe

Filesize
2.0MB

MD5
43fa1e6f1e022c6bb10fc098d17df674

SHA1
0d928b78379b460094f7f1563dc4b22120b1a4e6

SHA256
4017ee75d740677bc7aac2959e81402579de4cdaa9708dca3d76c51ca92f80bf

SHA512
3796cd5def190e1c435e6746a267ea7af3e41e05d07728bc9d0c9d2855e697c8d76e800c3a21e9225f1c53dcabbaddd9658cb84e50ac0a4c92f1c5e2d5b75d91

Download Submit
C:\Windows\System\fOVpPDK.exe

Filesize
2.0MB

MD5
b236726a73a9dec757d1337616bacb63

SHA1
d16215b0b023200e3875d82ec62bf0f5d9e3caac

SHA256
e4cc813012972766c136b46cf2a0c217e236b529137dae7eb2588ec3fe9f40f2

SHA512
ccb18944d27aec1d7dcb1a6aeb34366488c498d20627044025c6d521b5637cb479baca816263349aadc6f22f0617d884ba622529c1473da19fed18399b206617

Download Submit
C:\Windows\System\flALiCF.exe

Filesize
2.0MB

MD5
e7999ab11e70662d85762548d3d7ce95

SHA1
de92bc7c0b8da7cf3ec31e50f78302240d30f548

SHA256
76458b8ad78ca9e35b7775e5ac3bd43442999296b133919a6f623dd8267966fd

SHA512
1184ee3f67bd09906032d88924c1f017a963fc1f9bb513913b4766d7aa49118dcf765a475482713a7454df050a15d9f40324fda88a3b6ef2d0a2449b568cd5ae

Download Submit
C:\Windows\System\hyfNEMM.exe

Filesize
2.0MB

MD5
55acb7e64687d86ea5170a9654268cb8

SHA1
38556ed71889c054334ea06856acd34c91c6823f

SHA256
f39e5b28bec347c3648acbacb6ea8a15ddc7dad8298fab55148a2d961cdec01f

SHA512
278f776f2ee74ba5cecf45b02e6215158c6ab0357ab93ca79b96fddbc36f195641cf6356482d91e33ebed501fa86cfec16b108b3a995157ccf435975185a1fdf

Download Submit
C:\Windows\System\itayivz.exe

Filesize
2.0MB

MD5
4ce7becc12d70480feb56bda45e99617

SHA1
a31da593b098cc74ab1c90b282d2e7db27c98707

SHA256
369a9507648a8ed7585a6537b6c6ee96f442a3481c4695a1152596bb2925270a

SHA512
5d139e4be1acbb62b3c1804d155b9046aa422c52118509fcc716157f3dd8025ae3f9c0cf5a07fed70b2c42d38cd26f3c0ed75f197f77ae37feb4a5ed929fc32d

Download Submit
C:\Windows\System\kzrIahX.exe

Filesize
2.0MB

MD5
b737977499dbe07bbc4abf0666f4dd89

SHA1
ec1f7895c76a08a95ed832fbb7b3df3b017c6e17

SHA256
47fbb5e0c510f0071b98a510bb124000dcb157f9f55f9cd173f2a74b4cc7dd5f

SHA512
a5b97c5fd47722b0e95fa2101f55f46afec56485820e01af710df25cf83867c67591812500c5152f1a38542974ed41d330bf4f55196bc75c3869e1ca2fd112ad

Download Submit
C:\Windows\System\lGAWjNB.exe

Filesize
2.0MB

MD5
6e4786856106bfb3b63626c95d20e933

SHA1
295a8a22b4444a814d033400fc9ffd2b656f70e9

SHA256
ba778a1ce81a13a9637ac6928e8e2018372b9ba6ac1c87c4d026860f802b8602

SHA512
90661a10b7560fb1682e573ce2fce5b378886ff1517c25eed9ae4a11e7011f25942e6e5cc741f98e3b0b15e778fcedc31a76bb59c7fed67c8a8b532efe6b4e56

Download Submit
C:\Windows\System\mCyivTo.exe

Filesize
2.0MB

MD5
0fe115f22a463cb68f83b91024706f84

SHA1
9b68a46e9647d709625dd254456a5fe714838b99

SHA256
f296ec18fd06d0e0f0da37eb198ba020508cb9fa896ed28b80487b96e36c915d

SHA512
1ac267cb5c4165ea8793ee409a89980dee573fcc4456c4284175207f31f1cffdbeffe53668d2c6aed785d30fe5815b387b6c0e82be318dd97f7cdcf5ce13fddd

Download Submit
C:\Windows\System\mNmdyms.exe

Filesize
2.0MB

MD5
d73abaf3a06ce373b9e0e8dbb7129450

SHA1
6f4d8ee658b14a03f75aca49a888ce4e33e78ee4

SHA256
b38f8037ba53379b7c03941d36ae1326bd15eaf1acce8f73413222d2ba702d83

SHA512
bd15b52d75fc333d2d158439fabe855d956d51f907f0830800a4dcc0400045fad0381152e2dea10bae2caf76dbb31d10a1b0e9600f8ae3db95b704b54d0330ba

Download Submit
C:\Windows\System\pJJmdXe.exe

Filesize
2.0MB

MD5
987be0ce9eb95286607912dd002f447f

SHA1
c8d533f9034e302468b7a54c2a46b47134dd0d20

SHA256
1b8d630173ae5a063b726b12721d68583cd694cbedb0c22c5721c899771f31f4

SHA512
e91536c41d6a35ff6ad3e4e9014776f10c7cb554ebd8132e8369307b325a1e1719fe1640ec7dfd01802877e121b72ceabbd74509e11fcbbbda06d4dc6860c934

Download Submit
C:\Windows\System\qTFVNHt.exe

Filesize
2.0MB

MD5
cca979c509bafe81c3a0377128b39ca8

SHA1
a4ef6f7281dba4237337ab3b9b7548ef97d9535c

SHA256
50478bc133c70f071c44080a35abd70edb9ccaadfcb44b4c8d142986a1818806

SHA512
bb1a56db32dacda5f514bb78d6d1f1333045b095ec9d1304ce690b67bc89d9ce21429dfbc5a2e7fa60411436430e295a3f728d764fac7e8800f0f3480d9dd014

Download Submit
C:\Windows\System\rrLuLBL.exe

Filesize
2.0MB

MD5
7ba4b78bfe5dac63158e8a3d2c9c2d83

SHA1
568a04bf9c83943c9925409bd27f8ed6bcdf64f5

SHA256
e9adf00f6b4ef689a4f484480c2c7c2d039437eddd7c73a399f5b1bbbf7ac4dc

SHA512
64228b5d7aa95c00dbced25c95d3da53054aebe7c2dc77515b047edcceec34996a82928ba414379155e0e0f1cbc140f4b72294909ad04a3bb834de5dd0c24fb4

Download Submit
C:\Windows\System\sqYadya.exe

Filesize
2.0MB

MD5
89b5d980bdb2a2d68bb864f42813abc6

SHA1
9ef778df2200e87ed69107906464ea9d166426c3

SHA256
8ecb69f467b301ab5c9a54174e336aff35206c2cbeb035f759e6c956f7eb7f9d

SHA512
e0cd3cc96292814e8ec1361d9d66ccfde30c431f4a6a27f9fbbc927b73a0d03b98a41a139ca0e082fe5d40a175f370f0f8f17c49996a417d1598137bcabd5220

Download Submit
C:\Windows\System\tXeMMdN.exe

Filesize
2.0MB

MD5
bd474d29a4954a72744e7cf0fe1cbd46

SHA1
0689de1fca0bf8de0418d1812c3c4587a4ad07cb

SHA256
d9484ed24cd790cf725525918d917049e999730409232356661533adcf5a00a4

SHA512
da2dd3ed3b6dd6498d72c6e97548038a485cbe7205eee59f9adf7b0c10953e1e9bbb2a6e89aceb1edd2892a64a264a8f0ab37d2317fb90795b5b0189626cbb4e

Download Submit
C:\Windows\System\uyRKese.exe

Filesize
2.0MB

MD5
05e4fbb41a9a383ff1b7239f603386fa

SHA1
0edc997fb4f73f91b9cd3a74a70c8ab54ad6bdca

SHA256
f7c38f2415b8f19c73f2f69b685be91aeef74d17945e3a8a439acd0b83a860bb

SHA512
76251d4e19f3c4f57012342e93462db547a2e63fcbe03074ccbd7231a609cb3c253b907ba829b14c37039bb606a2feca6ae678c1df2f7ad02b65601a5de1b0b6

Download Submit
C:\Windows\System\wYKCkxZ.exe

Filesize
2.0MB

MD5
15b0ba149c38ca978cdf2d3e92fd298c

SHA1
d722b142c0a5f4ed3c8c3ef03ae51a02b2e9d72f

SHA256
1a063568a9c1ea4cac43719e3196257583891cbfc9dd80191fa8f2ecd96284e3

SHA512
b52e4c5b9a3e58bdfc1daae76b1127f0f4716c15f0800229a76b32a8fd9b7dda93a4773136a4221bb66a81571c1fd2a0238b5f35498c7a24300cafae2bba49ae

Download Submit
C:\Windows\System\yJBPkkQ.exe

Filesize
2.0MB

MD5
ab43793578de5f32828d35aeb5fae3b7

SHA1
e02aeb3838b4ed96cbbba75384812e91b5b88963

SHA256
25db80004d92d35d845a6760133396395f681d8eff49ee6ff4d13a2ef107c329

SHA512
5c5fe665b1cd7874c9f2fb1e963b9990b35557cb00cf7a980fc46751fec1b0589e2e3e00334b98d4e2e3881bb7881b1590bbbb4fd831028c7411f592907e5171

Download Submit
C:\Windows\System\ymVVhtc.exe

Filesize
2.0MB

MD5
1cf48b8f162e4b63ca5af73a9f1c1832

SHA1
eece055326eb8e9b6baa741c31de9400eaa9066d

SHA256
5ddcd830adc3d4e4bef3de516390effb684bd415055683a49c3d58f5aeb22b97

SHA512
b1f3c99161cd5c27b7c905afedb2093edad1d83ef4b8ac7a08c55463fc80b0daddf15adb527839440fc4510f2e8fe47179f46db5e594147740072f214a3f12a0

Download Submit
memory/368-110-0x00007FF761EA0000-0x00007FF762292000-memory.dmp

Filesize
3.9MB

Download
memory/368-4026-0x00007FF761EA0000-0x00007FF762292000-memory.dmp

Filesize
3.9MB

Download
memory/716-3979-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp

Filesize
3.9MB

Download
memory/716-44-0x00007FF75EC30000-0x00007FF75F022000-memory.dmp

Filesize
3.9MB

Download
memory/748-382-0x00007FF7104D0000-0x00007FF7108C2000-memory.dmp

Filesize
3.9MB

Download
memory/748-4093-0x00007FF7104D0000-0x00007FF7108C2000-memory.dmp

Filesize
3.9MB

Download
memory/756-94-0x00007FF687260000-0x00007FF687652000-memory.dmp

Filesize
3.9MB

Download
memory/756-4018-0x00007FF687260000-0x00007FF687652000-memory.dmp

Filesize
3.9MB

Download
memory/944-129-0x00007FF6C4930000-0x00007FF6C4D22000-memory.dmp

Filesize
3.9MB

Download
memory/944-4064-0x00007FF6C4930000-0x00007FF6C4D22000-memory.dmp

Filesize
3.9MB

Download
memory/1032-4004-0x00007FF729570000-0x00007FF729962000-memory.dmp

Filesize
3.9MB

Download
memory/1032-79-0x00007FF729570000-0x00007FF729962000-memory.dmp

Filesize
3.9MB

Download
memory/1200-4051-0x00007FF68D1B0000-0x00007FF68D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-135-0x00007FF68D1B0000-0x00007FF68D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1384-3986-0x00007FF74AAB0000-0x00007FF74AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1384-15-0x00007FF74AAB0000-0x00007FF74AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-3998-0x00007FF61F140000-0x00007FF61F532000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2328-0x00007FF61F140000-0x00007FF61F532000-memory.dmp

Filesize
3.9MB

Download
memory/1624-49-0x00007FF61F140000-0x00007FF61F532000-memory.dmp

Filesize
3.9MB

Download
memory/1768-37-0x000001C4ED980000-0x000001C4ED9A2000-memory.dmp

Filesize
136KB

Download
memory/1768-3278-0x00007FFB54760000-0x00007FFB55221000-memory.dmp

Filesize
10.8MB

Download
memory/1768-59-0x00007FFB54760000-0x00007FFB55221000-memory.dmp

Filesize
10.8MB

Download
memory/1768-2682-0x00007FFB54763000-0x00007FFB54765000-memory.dmp

Filesize
8KB

Download
memory/1768-367-0x000001C4EE4A0000-0x000001C4EEC46000-memory.dmp

Filesize
7.6MB

Download
memory/1768-6-0x00007FFB54763000-0x00007FFB54765000-memory.dmp

Filesize
8KB

Download
memory/1768-38-0x00007FFB54760000-0x00007FFB55221000-memory.dmp

Filesize
10.8MB

Download
memory/1992-383-0x00007FF79E200000-0x00007FF79E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-4084-0x00007FF79E200000-0x00007FF79E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-4047-0x00007FF6E0490000-0x00007FF6E0882000-memory.dmp

Filesize
3.9MB

Download
memory/2192-138-0x00007FF6E0490000-0x00007FF6E0882000-memory.dmp

Filesize
3.9MB

Download
memory/2280-4053-0x00007FF651EA0000-0x00007FF652292000-memory.dmp

Filesize
3.9MB

Download
memory/2280-134-0x00007FF651EA0000-0x00007FF652292000-memory.dmp

Filesize
3.9MB

Download
memory/2348-141-0x00007FF7BDE50000-0x00007FF7BE242000-memory.dmp

Filesize
3.9MB

Download
memory/2348-4044-0x00007FF7BDE50000-0x00007FF7BE242000-memory.dmp

Filesize
3.9MB

Download
memory/2420-123-0x00007FF6B3790000-0x00007FF6B3B82000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4072-0x00007FF6B3790000-0x00007FF6B3B82000-memory.dmp

Filesize
3.9MB

Download
memory/2496-77-0x00007FF609930000-0x00007FF609D22000-memory.dmp

Filesize
3.9MB

Download
memory/2496-4013-0x00007FF609930000-0x00007FF609D22000-memory.dmp

Filesize
3.9MB

Download
memory/3120-4078-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp

Filesize
3.9MB

Download
memory/3120-3742-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp

Filesize
3.9MB

Download
memory/3120-142-0x00007FF792EF0000-0x00007FF7932E2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-4040-0x00007FF7EBD00000-0x00007FF7EC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-116-0x00007FF7EBD00000-0x00007FF7EC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3576-91-0x00007FF682F00000-0x00007FF6832F2000-memory.dmp

Filesize
3.9MB

Download
memory/3576-4032-0x00007FF682F00000-0x00007FF6832F2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-4010-0x00007FF6AB140000-0x00007FF6AB532000-memory.dmp

Filesize
3.9MB

Download
memory/3744-106-0x00007FF6AB140000-0x00007FF6AB532000-memory.dmp

Filesize
3.9MB

Download
memory/3832-4082-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-147-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-3935-0x00007FF61D5D0000-0x00007FF61D9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-71-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-3981-0x00007FF6D1FE0000-0x00007FF6D23D2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-4036-0x00007FF787CA0000-0x00007FF788092000-memory.dmp

Filesize
3.9MB

Download
memory/4816-87-0x00007FF787CA0000-0x00007FF788092000-memory.dmp

Filesize
3.9MB

Download
memory/4864-122-0x00007FF64B720000-0x00007FF64BB12000-memory.dmp

Filesize
3.9MB

Download
memory/5044-1-0x00000250046D0000-0x00000250046E0000-memory.dmp

Filesize
64KB

Download
memory/5044-0-0x00007FF6C7D10000-0x00007FF6C8102000-memory.dmp

Filesize
3.9MB

Download
memory/5104-3990-0x00007FF76B3A0000-0x00007FF76B792000-memory.dmp

Filesize
3.9MB

Download
memory/5104-45-0x00007FF76B3A0000-0x00007FF76B792000-memory.dmp

Filesize
3.9MB

Download