xmrig | 3487938be94288b78ff2d56c0e2e5f447ef41239db05b973f95db2bb9f89cfe7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
Size

2.3MB
MD5

0125dede717071d2b285402d0b4aed08
SHA1

6b996d38dde225498f8cc68202f69f7a2c7ddda4
SHA256

3487938be94288b78ff2d56c0e2e5f447ef41239db05b973f95db2bb9f89cfe7
SHA512

62f3307ee474c5a62ee249af793f6d36f22119ab183311e823ab0d356a5a5848a36c1ead1fb9b2ab53db343c55176594078c8b2590d7e132cffde2c923bd4142
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWa0:NABn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3644-190-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp	xmrig
behavioral2/memory/4460-194-0x00007FF778740000-0x00007FF778B32000-memory.dmp	xmrig
behavioral2/memory/4944-193-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp	xmrig
behavioral2/memory/3856-192-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp	xmrig
behavioral2/memory/1764-191-0x00007FF742140000-0x00007FF742532000-memory.dmp	xmrig
behavioral2/memory/4008-189-0x00007FF6FB5B0000-0x00007FF6FB9A2000-memory.dmp	xmrig
behavioral2/memory/1892-188-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp	xmrig
behavioral2/memory/2236-187-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp	xmrig
behavioral2/memory/3004-184-0x00007FF711B20000-0x00007FF711F12000-memory.dmp	xmrig
behavioral2/memory/4648-179-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp	xmrig
behavioral2/memory/1080-178-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp	xmrig
behavioral2/memory/2144-144-0x00007FF657890000-0x00007FF657C82000-memory.dmp	xmrig
behavioral2/memory/3736-130-0x00007FF79F010000-0x00007FF79F402000-memory.dmp	xmrig
behavioral2/memory/3888-121-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp	xmrig
behavioral2/memory/632-114-0x00007FF787450000-0x00007FF787842000-memory.dmp	xmrig
behavioral2/memory/4744-3044-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	xmrig
behavioral2/memory/3592-3510-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp	xmrig
behavioral2/memory/2012-3539-0x00007FF716B00000-0x00007FF716EF2000-memory.dmp	xmrig
behavioral2/memory/2176-3543-0x00007FF6F9260000-0x00007FF6F9652000-memory.dmp	xmrig
behavioral2/memory/2236-3579-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp	xmrig
behavioral2/memory/1856-3583-0x00007FF7B97F0000-0x00007FF7B9BE2000-memory.dmp	xmrig
behavioral2/memory/2740-3594-0x00007FF758770000-0x00007FF758B62000-memory.dmp	xmrig
behavioral2/memory/3888-3617-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp	xmrig
behavioral2/memory/3644-3621-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp	xmrig
behavioral2/memory/3736-3625-0x00007FF79F010000-0x00007FF79F402000-memory.dmp	xmrig
behavioral2/memory/3856-3632-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp	xmrig
behavioral2/memory/2144-3629-0x00007FF657890000-0x00007FF657C82000-memory.dmp	xmrig
behavioral2/memory/4744-3638-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	xmrig
behavioral2/memory/1764-3635-0x00007FF742140000-0x00007FF742532000-memory.dmp	xmrig
behavioral2/memory/1892-3613-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp	xmrig
behavioral2/memory/632-3605-0x00007FF787450000-0x00007FF787842000-memory.dmp	xmrig
behavioral2/memory/4648-3532-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp	xmrig
behavioral2/memory/452-3524-0x00007FF7BA280000-0x00007FF7BA672000-memory.dmp	xmrig
behavioral2/memory/1080-3515-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp	xmrig
behavioral2/memory/4944-3653-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp	xmrig
behavioral2/memory/3592-3649-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp	xmrig
behavioral2/memory/4460-3650-0x00007FF778740000-0x00007FF778B32000-memory.dmp	xmrig
behavioral2/memory/2740-106-0x00007FF758770000-0x00007FF758B62000-memory.dmp	xmrig
behavioral2/memory/1856-101-0x00007FF7B97F0000-0x00007FF7B9BE2000-memory.dmp	xmrig
behavioral2/memory/3164-92-0x00007FF61A1F0000-0x00007FF61A5E2000-memory.dmp	xmrig
behavioral2/memory/2176-84-0x00007FF6F9260000-0x00007FF6F9652000-memory.dmp	xmrig
behavioral2/memory/2012-75-0x00007FF716B00000-0x00007FF716EF2000-memory.dmp	xmrig
behavioral2/memory/452-60-0x00007FF7BA280000-0x00007FF7BA672000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4708	powershell.exe
11	4708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1272	UrOnBQO.exe
1080	jgMJJxI.exe
4648	IxljCTZ.exe
452	iRpCtBB.exe
2012	sxswyVy.exe
2176	XRBRGjw.exe
3164	kJGDmHd.exe
1856	NiaERbU.exe
3004	hLHOirc.exe
2236	tWhUIvD.exe
2740	dcMjNAk.exe
632	jRINeqC.exe
1892	nrEwBcZ.exe
3888	qVZQeZI.exe
4008	RZSAnyd.exe
3644	BQEOCjc.exe
3736	cUZuJqd.exe
1764	zbkcAXJ.exe
4744	xwCsOiU.exe
2144	aJilpFm.exe
3856	eNmRPyy.exe
4944	qBrTUSa.exe
3592	KDNlaUD.exe
4460	TrPptqK.exe
2156	qsFkrfC.exe
3956	RwPEgmT.exe
5004	RJUmoSY.exe
3184	UwrGKUB.exe
1540	kQpxRDO.exe
1468	nvLZvyU.exe
1164	USJGKVH.exe
2936	RKNxSnQ.exe
1224	wgmurps.exe
2648	anPiGdv.exe
4816	TyiPNEo.exe
2312	HkNTwMC.exe
3260	HMqANJy.exe
2920	RTsJJji.exe
4276	rUsionH.exe
2952	SIRAZIu.exe
1724	hSLGJaF.exe
4000	sHhzdfB.exe
1896	SdugZyE.exe
4740	JZXsOlA.exe
2028	yWxezqi.exe
4224	WzYCedI.exe
3668	etryrJb.exe
2100	ReYQUOB.exe
744	wRnZRLn.exe
3804	jRdGVNw.exe
1280	StrRmRA.exe
3060	LaFbTcr.exe
3916	mBKTeKm.exe
2272	HtIouFy.exe
944	ELsEckq.exe
4528	RzWkrrW.exe
3100	zptAJOg.exe
512	REJfFrw.exe
5032	eqnXABy.exe
4408	mZZsryF.exe
4088	ZOdLcOn.exe
5056	WVzlVIX.exe
2308	rnDMsvb.exe
4292	uNvQIVx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x00007FF642DA0000-0x00007FF643192000-memory.dmp	upx
behavioral2/files/0x00070000000234a4-10.dat	upx
behavioral2/files/0x00070000000234a5-20.dat	upx
behavioral2/files/0x00070000000234a6-26.dat	upx
behavioral2/files/0x00070000000234ab-58.dat	upx
behavioral2/files/0x00070000000234ae-95.dat	upx
behavioral2/files/0x00070000000234af-102.dat	upx
behavioral2/files/0x00070000000234b4-111.dat	upx
behavioral2/files/0x00080000000234a0-119.dat	upx
behavioral2/files/0x00070000000234b6-143.dat	upx
behavioral2/files/0x00070000000234b7-147.dat	upx
behavioral2/files/0x00070000000234b8-159.dat	upx
behavioral2/files/0x00070000000234b9-180.dat	upx
behavioral2/files/0x00070000000234bf-185.dat	upx
behavioral2/memory/3644-190-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp	upx
behavioral2/memory/4460-194-0x00007FF778740000-0x00007FF778B32000-memory.dmp	upx
behavioral2/memory/4944-193-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp	upx
behavioral2/memory/3856-192-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp	upx
behavioral2/memory/1764-191-0x00007FF742140000-0x00007FF742532000-memory.dmp	upx
behavioral2/memory/4008-189-0x00007FF6FB5B0000-0x00007FF6FB9A2000-memory.dmp	upx
behavioral2/memory/1892-188-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp	upx
behavioral2/memory/2236-187-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp	upx
behavioral2/memory/3004-184-0x00007FF711B20000-0x00007FF711F12000-memory.dmp	upx
behavioral2/files/0x00070000000234be-182.dat	upx
behavioral2/memory/4648-179-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp	upx
behavioral2/memory/1080-178-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp	upx
behavioral2/files/0x00070000000234bd-176.dat	upx
behavioral2/files/0x00070000000234bc-168.dat	upx
behavioral2/files/0x00070000000234bb-166.dat	upx
behavioral2/files/0x00070000000234ba-156.dat	upx
behavioral2/memory/3592-150-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp	upx
behavioral2/memory/2144-144-0x00007FF657890000-0x00007FF657C82000-memory.dmp	upx
behavioral2/memory/4744-139-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	upx
behavioral2/memory/3736-130-0x00007FF79F010000-0x00007FF79F402000-memory.dmp	upx
behavioral2/files/0x00070000000234b5-123.dat	upx
behavioral2/memory/3888-121-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp	upx
behavioral2/files/0x00070000000234b3-118.dat	upx
behavioral2/memory/632-114-0x00007FF787450000-0x00007FF787842000-memory.dmp	upx
behavioral2/files/0x00070000000234b1-108.dat	upx
behavioral2/files/0x00070000000234b2-112.dat	upx
behavioral2/files/0x00070000000234c0-197.dat	upx
behavioral2/memory/4744-3044-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	upx
behavioral2/memory/3592-3510-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp	upx
behavioral2/memory/2012-3539-0x00007FF716B00000-0x00007FF716EF2000-memory.dmp	upx
behavioral2/memory/2176-3543-0x00007FF6F9260000-0x00007FF6F9652000-memory.dmp	upx
behavioral2/memory/2236-3579-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp	upx
behavioral2/memory/1856-3583-0x00007FF7B97F0000-0x00007FF7B9BE2000-memory.dmp	upx
behavioral2/memory/2740-3594-0x00007FF758770000-0x00007FF758B62000-memory.dmp	upx
behavioral2/memory/3888-3617-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp	upx
behavioral2/memory/3644-3621-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp	upx
behavioral2/memory/3736-3625-0x00007FF79F010000-0x00007FF79F402000-memory.dmp	upx
behavioral2/memory/3856-3632-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp	upx
behavioral2/memory/2144-3629-0x00007FF657890000-0x00007FF657C82000-memory.dmp	upx
behavioral2/memory/4744-3638-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp	upx
behavioral2/memory/1764-3635-0x00007FF742140000-0x00007FF742532000-memory.dmp	upx
behavioral2/memory/1892-3613-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp	upx
behavioral2/memory/632-3605-0x00007FF787450000-0x00007FF787842000-memory.dmp	upx
behavioral2/memory/4648-3532-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp	upx
behavioral2/memory/452-3524-0x00007FF7BA280000-0x00007FF7BA672000-memory.dmp	upx
behavioral2/memory/1080-3515-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp	upx
behavioral2/memory/4944-3653-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp	upx
behavioral2/memory/3592-3649-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp	upx
behavioral2/memory/4460-3650-0x00007FF778740000-0x00007FF778B32000-memory.dmp	upx
behavioral2/files/0x00070000000234c1-200.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QVAnowy.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\AvbamDF.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\VTJqAps.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\NcwXQKL.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\QOLORJb.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\hQRQndC.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\IFieuFR.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\vWByTfR.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\UofstMU.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\CONimOS.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\pxvKKWp.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\VOzVBXo.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\mrWAPpJ.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\lkGrFZq.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\BLYviWf.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\wzdHwKM.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\FKMMIjj.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\wnXlTJi.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\zRdoHqR.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\kfXauFV.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\KjrbjYY.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\kmciPuw.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\ARBzsSl.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\UuRdPWp.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\SuyUDiu.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\KLpAlZK.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\qiXiOXQ.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\fKoJrQf.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\CCEgbOa.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\THhQNSx.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\CXQIfKV.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\jNUvRMF.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\kAyHPgT.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\kqTQhLO.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\VeOyCyL.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\WhNAfrQ.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\imCpyzt.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\ijDmtgb.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\AZrrPOV.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\CKSYyqP.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\RSYONZP.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\MzpwNeo.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\jCvAWpy.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\wOKcbZV.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\vIKplih.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\iXVxcoG.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\clmDmav.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\jqXDOiH.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\iFtJBXT.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\oZiCJQx.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\kvNpNZL.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\JnfzyUR.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\DzXOFdi.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\jVaDoiE.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\bZGzQwq.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\UPvlGtg.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\qhGPQuy.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\aLPRfwn.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\lcbGxwZ.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\GZofjWP.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\oZxpyAw.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\RZfJXuH.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\EgIIpXT.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
File created	C:\Windows\System\ALLipjl.exe	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
12388	WerFaultSecure.exe
12388	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
Token: SeDebugPrivilege	4708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4708	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	85
PID 4480 wrote to memory of 4708	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	85
PID 4480 wrote to memory of 1272	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	86
PID 4480 wrote to memory of 1272	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	86
PID 4480 wrote to memory of 1080	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	87
PID 4480 wrote to memory of 1080	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	87
PID 4480 wrote to memory of 4648	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	88
PID 4480 wrote to memory of 4648	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	88
PID 4480 wrote to memory of 452	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	89
PID 4480 wrote to memory of 452	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	89
PID 4480 wrote to memory of 2012	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	90
PID 4480 wrote to memory of 2012	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	90
PID 4480 wrote to memory of 2176	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	91
PID 4480 wrote to memory of 2176	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	91
PID 4480 wrote to memory of 3164	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	92
PID 4480 wrote to memory of 3164	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	92
PID 4480 wrote to memory of 1856	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	93
PID 4480 wrote to memory of 1856	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	93
PID 4480 wrote to memory of 3004	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	94
PID 4480 wrote to memory of 3004	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	94
PID 4480 wrote to memory of 2236	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	95
PID 4480 wrote to memory of 2236	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	95
PID 4480 wrote to memory of 2740	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	96
PID 4480 wrote to memory of 2740	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	96
PID 4480 wrote to memory of 632	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	97
PID 4480 wrote to memory of 632	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	97
PID 4480 wrote to memory of 1892	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	98
PID 4480 wrote to memory of 1892	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	98
PID 4480 wrote to memory of 3888	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	99
PID 4480 wrote to memory of 3888	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	99
PID 4480 wrote to memory of 4008	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	100
PID 4480 wrote to memory of 4008	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	100
PID 4480 wrote to memory of 3644	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	101
PID 4480 wrote to memory of 3644	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	101
PID 4480 wrote to memory of 3736	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	102
PID 4480 wrote to memory of 3736	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	102
PID 4480 wrote to memory of 1764	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	103
PID 4480 wrote to memory of 1764	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	103
PID 4480 wrote to memory of 4744	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	104
PID 4480 wrote to memory of 4744	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	104
PID 4480 wrote to memory of 2144	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	105
PID 4480 wrote to memory of 2144	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	105
PID 4480 wrote to memory of 3856	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	106
PID 4480 wrote to memory of 3856	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	106
PID 4480 wrote to memory of 4460	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	107
PID 4480 wrote to memory of 4460	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	107
PID 4480 wrote to memory of 4944	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	108
PID 4480 wrote to memory of 4944	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	108
PID 4480 wrote to memory of 3592	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	109
PID 4480 wrote to memory of 3592	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	109
PID 4480 wrote to memory of 2156	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	110
PID 4480 wrote to memory of 2156	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	110
PID 4480 wrote to memory of 3956	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	111
PID 4480 wrote to memory of 3956	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	111
PID 4480 wrote to memory of 5004	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	112
PID 4480 wrote to memory of 5004	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	112
PID 4480 wrote to memory of 3184	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	113
PID 4480 wrote to memory of 3184	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	113
PID 4480 wrote to memory of 1540	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	114
PID 4480 wrote to memory of 1540	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	114
PID 4480 wrote to memory of 1468	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	115
PID 4480 wrote to memory of 1468	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	115
PID 4480 wrote to memory of 1164	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	116
PID 4480 wrote to memory of 1164	4480	0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe	116

C:\Windows\System32\pd9v1t.exe
"C:\Windows\System32\pd9v1t.exe"
1⤵
PID:4260
- C:\Users\Admin\AppData\Local\Temp\2570283091\zmstage.exe
  C:\Users\Admin\AppData\Local\Temp\2570283091\zmstage.exe
  2⤵
  PID:2308

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4908
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4908 -s 2188
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:12388

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3276

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0125dede717071d2b285402d0b4aed08_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4708" "2840" "3004" "3040" "0" "0" "3044" "0" "0" "0" "0" "0"
    3⤵
    PID:13284
- C:\Windows\System\UrOnBQO.exe
  C:\Windows\System\UrOnBQO.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\jgMJJxI.exe
  C:\Windows\System\jgMJJxI.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\IxljCTZ.exe
  C:\Windows\System\IxljCTZ.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\iRpCtBB.exe
  C:\Windows\System\iRpCtBB.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\sxswyVy.exe
  C:\Windows\System\sxswyVy.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\XRBRGjw.exe
  C:\Windows\System\XRBRGjw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\kJGDmHd.exe
  C:\Windows\System\kJGDmHd.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\NiaERbU.exe
  C:\Windows\System\NiaERbU.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\hLHOirc.exe
  C:\Windows\System\hLHOirc.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\tWhUIvD.exe
  C:\Windows\System\tWhUIvD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\dcMjNAk.exe
  C:\Windows\System\dcMjNAk.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jRINeqC.exe
  C:\Windows\System\jRINeqC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\nrEwBcZ.exe
  C:\Windows\System\nrEwBcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\qVZQeZI.exe
  C:\Windows\System\qVZQeZI.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\RZSAnyd.exe
  C:\Windows\System\RZSAnyd.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\BQEOCjc.exe
  C:\Windows\System\BQEOCjc.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\cUZuJqd.exe
  C:\Windows\System\cUZuJqd.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\zbkcAXJ.exe
  C:\Windows\System\zbkcAXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\xwCsOiU.exe
  C:\Windows\System\xwCsOiU.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\aJilpFm.exe
  C:\Windows\System\aJilpFm.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\eNmRPyy.exe
  C:\Windows\System\eNmRPyy.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\TrPptqK.exe
  C:\Windows\System\TrPptqK.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\qBrTUSa.exe
  C:\Windows\System\qBrTUSa.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\KDNlaUD.exe
  C:\Windows\System\KDNlaUD.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\qsFkrfC.exe
  C:\Windows\System\qsFkrfC.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\RwPEgmT.exe
  C:\Windows\System\RwPEgmT.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\RJUmoSY.exe
  C:\Windows\System\RJUmoSY.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\UwrGKUB.exe
  C:\Windows\System\UwrGKUB.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\kQpxRDO.exe
  C:\Windows\System\kQpxRDO.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\nvLZvyU.exe
  C:\Windows\System\nvLZvyU.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\USJGKVH.exe
  C:\Windows\System\USJGKVH.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\RKNxSnQ.exe
  C:\Windows\System\RKNxSnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\wgmurps.exe
  C:\Windows\System\wgmurps.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\anPiGdv.exe
  C:\Windows\System\anPiGdv.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\TyiPNEo.exe
  C:\Windows\System\TyiPNEo.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\HkNTwMC.exe
  C:\Windows\System\HkNTwMC.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\HMqANJy.exe
  C:\Windows\System\HMqANJy.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\RTsJJji.exe
  C:\Windows\System\RTsJJji.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\rUsionH.exe
  C:\Windows\System\rUsionH.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\SIRAZIu.exe
  C:\Windows\System\SIRAZIu.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\hSLGJaF.exe
  C:\Windows\System\hSLGJaF.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\sHhzdfB.exe
  C:\Windows\System\sHhzdfB.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\SdugZyE.exe
  C:\Windows\System\SdugZyE.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\JZXsOlA.exe
  C:\Windows\System\JZXsOlA.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\yWxezqi.exe
  C:\Windows\System\yWxezqi.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\WzYCedI.exe
  C:\Windows\System\WzYCedI.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\etryrJb.exe
  C:\Windows\System\etryrJb.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ReYQUOB.exe
  C:\Windows\System\ReYQUOB.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\wRnZRLn.exe
  C:\Windows\System\wRnZRLn.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\jRdGVNw.exe
  C:\Windows\System\jRdGVNw.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\StrRmRA.exe
  C:\Windows\System\StrRmRA.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\LaFbTcr.exe
  C:\Windows\System\LaFbTcr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\mBKTeKm.exe
  C:\Windows\System\mBKTeKm.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\HtIouFy.exe
  C:\Windows\System\HtIouFy.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ELsEckq.exe
  C:\Windows\System\ELsEckq.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\RzWkrrW.exe
  C:\Windows\System\RzWkrrW.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\zptAJOg.exe
  C:\Windows\System\zptAJOg.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\REJfFrw.exe
  C:\Windows\System\REJfFrw.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\eqnXABy.exe
  C:\Windows\System\eqnXABy.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\mZZsryF.exe
  C:\Windows\System\mZZsryF.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ZOdLcOn.exe
  C:\Windows\System\ZOdLcOn.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\WVzlVIX.exe
  C:\Windows\System\WVzlVIX.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\rnDMsvb.exe
  C:\Windows\System\rnDMsvb.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\uNvQIVx.exe
  C:\Windows\System\uNvQIVx.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\TnPhWBO.exe
  C:\Windows\System\TnPhWBO.exe
  2⤵
  PID:1784
- C:\Windows\System\xlzIWxU.exe
  C:\Windows\System\xlzIWxU.exe
  2⤵
  PID:2324
- C:\Windows\System\GedXaQj.exe
  C:\Windows\System\GedXaQj.exe
  2⤵
  PID:3284
- C:\Windows\System\ziVkvnN.exe
  C:\Windows\System\ziVkvnN.exe
  2⤵
  PID:2172
- C:\Windows\System\ZltMVUz.exe
  C:\Windows\System\ZltMVUz.exe
  2⤵
  PID:2396
- C:\Windows\System\kjTYFXe.exe
  C:\Windows\System\kjTYFXe.exe
  2⤵
  PID:4496
- C:\Windows\System\vtesBpR.exe
  C:\Windows\System\vtesBpR.exe
  2⤵
  PID:1160
- C:\Windows\System\qiXiOXQ.exe
  C:\Windows\System\qiXiOXQ.exe
  2⤵
  PID:4420
- C:\Windows\System\kZwEtJZ.exe
  C:\Windows\System\kZwEtJZ.exe
  2⤵
  PID:3664
- C:\Windows\System\wENHamG.exe
  C:\Windows\System\wENHamG.exe
  2⤵
  PID:4316
- C:\Windows\System\NAywTyd.exe
  C:\Windows\System\NAywTyd.exe
  2⤵
  PID:3932
- C:\Windows\System\vaZZKar.exe
  C:\Windows\System\vaZZKar.exe
  2⤵
  PID:4184
- C:\Windows\System\NoFAHoE.exe
  C:\Windows\System\NoFAHoE.exe
  2⤵
  PID:1508
- C:\Windows\System\tJnxfJH.exe
  C:\Windows\System\tJnxfJH.exe
  2⤵
  PID:320
- C:\Windows\System\mdNWCeZ.exe
  C:\Windows\System\mdNWCeZ.exe
  2⤵
  PID:2032
- C:\Windows\System\mgIotuY.exe
  C:\Windows\System\mgIotuY.exe
  2⤵
  PID:5112
- C:\Windows\System\nfDuLkN.exe
  C:\Windows\System\nfDuLkN.exe
  2⤵
  PID:3428
- C:\Windows\System\WFPlgsP.exe
  C:\Windows\System\WFPlgsP.exe
  2⤵
  PID:3772
- C:\Windows\System\yrlAAqm.exe
  C:\Windows\System\yrlAAqm.exe
  2⤵
  PID:5144
- C:\Windows\System\EASCUhk.exe
  C:\Windows\System\EASCUhk.exe
  2⤵
  PID:5160
- C:\Windows\System\fEhqYOg.exe
  C:\Windows\System\fEhqYOg.exe
  2⤵
  PID:5188
- C:\Windows\System\vwTFFeU.exe
  C:\Windows\System\vwTFFeU.exe
  2⤵
  PID:5216
- C:\Windows\System\BhRWlVO.exe
  C:\Windows\System\BhRWlVO.exe
  2⤵
  PID:5248
- C:\Windows\System\YbOwbNZ.exe
  C:\Windows\System\YbOwbNZ.exe
  2⤵
  PID:5288
- C:\Windows\System\QjVjoeI.exe
  C:\Windows\System\QjVjoeI.exe
  2⤵
  PID:5308
- C:\Windows\System\Dfwdfrs.exe
  C:\Windows\System\Dfwdfrs.exe
  2⤵
  PID:5332
- C:\Windows\System\ruapDtn.exe
  C:\Windows\System\ruapDtn.exe
  2⤵
  PID:5356
- C:\Windows\System\gltzhln.exe
  C:\Windows\System\gltzhln.exe
  2⤵
  PID:5396
- C:\Windows\System\IFdjXrD.exe
  C:\Windows\System\IFdjXrD.exe
  2⤵
  PID:5416
- C:\Windows\System\CbmkabI.exe
  C:\Windows\System\CbmkabI.exe
  2⤵
  PID:5460
- C:\Windows\System\cmlJDtB.exe
  C:\Windows\System\cmlJDtB.exe
  2⤵
  PID:5476
- C:\Windows\System\SZDrEdx.exe
  C:\Windows\System\SZDrEdx.exe
  2⤵
  PID:5500
- C:\Windows\System\UpjNsNB.exe
  C:\Windows\System\UpjNsNB.exe
  2⤵
  PID:5544
- C:\Windows\System\gXzHAkh.exe
  C:\Windows\System\gXzHAkh.exe
  2⤵
  PID:5572
- C:\Windows\System\xBAgjUg.exe
  C:\Windows\System\xBAgjUg.exe
  2⤵
  PID:5600
- C:\Windows\System\lSayPAT.exe
  C:\Windows\System\lSayPAT.exe
  2⤵
  PID:5620
- C:\Windows\System\nsSEXWT.exe
  C:\Windows\System\nsSEXWT.exe
  2⤵
  PID:5644
- C:\Windows\System\KOinVWl.exe
  C:\Windows\System\KOinVWl.exe
  2⤵
  PID:5668
- C:\Windows\System\gAbcNxt.exe
  C:\Windows\System\gAbcNxt.exe
  2⤵
  PID:5696
- C:\Windows\System\QxbTPcU.exe
  C:\Windows\System\QxbTPcU.exe
  2⤵
  PID:5724
- C:\Windows\System\NkHuuge.exe
  C:\Windows\System\NkHuuge.exe
  2⤵
  PID:5752
- C:\Windows\System\KmptHPU.exe
  C:\Windows\System\KmptHPU.exe
  2⤵
  PID:5772
- C:\Windows\System\wdrLzwR.exe
  C:\Windows\System\wdrLzwR.exe
  2⤵
  PID:5820
- C:\Windows\System\DtiJKpI.exe
  C:\Windows\System\DtiJKpI.exe
  2⤵
  PID:5848
- C:\Windows\System\MJXbnZC.exe
  C:\Windows\System\MJXbnZC.exe
  2⤵
  PID:5872
- C:\Windows\System\nmHlBue.exe
  C:\Windows\System\nmHlBue.exe
  2⤵
  PID:5904
- C:\Windows\System\OOigbsv.exe
  C:\Windows\System\OOigbsv.exe
  2⤵
  PID:5924
- C:\Windows\System\guzIfed.exe
  C:\Windows\System\guzIfed.exe
  2⤵
  PID:5968
- C:\Windows\System\WaloXSk.exe
  C:\Windows\System\WaloXSk.exe
  2⤵
  PID:5992
- C:\Windows\System\nxNEfUU.exe
  C:\Windows\System\nxNEfUU.exe
  2⤵
  PID:6008
- C:\Windows\System\UrflGAc.exe
  C:\Windows\System\UrflGAc.exe
  2⤵
  PID:6040
- C:\Windows\System\JeNoeul.exe
  C:\Windows\System\JeNoeul.exe
  2⤵
  PID:6080
- C:\Windows\System\CoYPauc.exe
  C:\Windows\System\CoYPauc.exe
  2⤵
  PID:6100
- C:\Windows\System\zADUzEx.exe
  C:\Windows\System\zADUzEx.exe
  2⤵
  PID:6120
- C:\Windows\System\RLUoPvx.exe
  C:\Windows\System\RLUoPvx.exe
  2⤵
  PID:5140
- C:\Windows\System\jBwxBTG.exe
  C:\Windows\System\jBwxBTG.exe
  2⤵
  PID:5184
- C:\Windows\System\DzXOFdi.exe
  C:\Windows\System\DzXOFdi.exe
  2⤵
  PID:5236
- C:\Windows\System\NMNDoRt.exe
  C:\Windows\System\NMNDoRt.exe
  2⤵
  PID:5320
- C:\Windows\System\uDFdulG.exe
  C:\Windows\System\uDFdulG.exe
  2⤵
  PID:5376
- C:\Windows\System\YOObwLJ.exe
  C:\Windows\System\YOObwLJ.exe
  2⤵
  PID:5440
- C:\Windows\System\oaaWHCp.exe
  C:\Windows\System\oaaWHCp.exe
  2⤵
  PID:5520
- C:\Windows\System\nkcOGFy.exe
  C:\Windows\System\nkcOGFy.exe
  2⤵
  PID:5580
- C:\Windows\System\SdrmZOX.exe
  C:\Windows\System\SdrmZOX.exe
  2⤵
  PID:5616
- C:\Windows\System\mANRakK.exe
  C:\Windows\System\mANRakK.exe
  2⤵
  PID:5680
- C:\Windows\System\itQkfXo.exe
  C:\Windows\System\itQkfXo.exe
  2⤵
  PID:5744
- C:\Windows\System\vzlCRbs.exe
  C:\Windows\System\vzlCRbs.exe
  2⤵
  PID:5808
- C:\Windows\System\ZYQpuHm.exe
  C:\Windows\System\ZYQpuHm.exe
  2⤵
  PID:5888
- C:\Windows\System\IdGHnQH.exe
  C:\Windows\System\IdGHnQH.exe
  2⤵
  PID:5956
- C:\Windows\System\vJYrmfc.exe
  C:\Windows\System\vJYrmfc.exe
  2⤵
  PID:6000
- C:\Windows\System\lfxrNsL.exe
  C:\Windows\System\lfxrNsL.exe
  2⤵
  PID:6088
- C:\Windows\System\SgvkxPT.exe
  C:\Windows\System\SgvkxPT.exe
  2⤵
  PID:5168
- C:\Windows\System\saziyuI.exe
  C:\Windows\System\saziyuI.exe
  2⤵
  PID:4332
- C:\Windows\System\GWONxcp.exe
  C:\Windows\System\GWONxcp.exe
  2⤵
  PID:5532
- C:\Windows\System\RrYcPsA.exe
  C:\Windows\System\RrYcPsA.exe
  2⤵
  PID:5564
- C:\Windows\System\qwmqoqB.exe
  C:\Windows\System\qwmqoqB.exe
  2⤵
  PID:5636
- C:\Windows\System\HVGEceW.exe
  C:\Windows\System\HVGEceW.exe
  2⤵
  PID:4772
- C:\Windows\System\IqUrRqu.exe
  C:\Windows\System\IqUrRqu.exe
  2⤵
  PID:6076
- C:\Windows\System\MTYSIOh.exe
  C:\Windows\System\MTYSIOh.exe
  2⤵
  PID:6112
- C:\Windows\System\SYkTSfS.exe
  C:\Windows\System\SYkTSfS.exe
  2⤵
  PID:5692
- C:\Windows\System\EQiHoPc.exe
  C:\Windows\System\EQiHoPc.exe
  2⤵
  PID:5792
- C:\Windows\System\wpdFZWb.exe
  C:\Windows\System\wpdFZWb.exe
  2⤵
  PID:6132
- C:\Windows\System\STEgXnF.exe
  C:\Windows\System\STEgXnF.exe
  2⤵
  PID:5880
- C:\Windows\System\YTBlpkd.exe
  C:\Windows\System\YTBlpkd.exe
  2⤵
  PID:4560
- C:\Windows\System\RpKsroI.exe
  C:\Windows\System\RpKsroI.exe
  2⤵
  PID:6156
- C:\Windows\System\xsXloEK.exe
  C:\Windows\System\xsXloEK.exe
  2⤵
  PID:6188
- C:\Windows\System\qQaozjY.exe
  C:\Windows\System\qQaozjY.exe
  2⤵
  PID:6204
- C:\Windows\System\gBcUTYY.exe
  C:\Windows\System\gBcUTYY.exe
  2⤵
  PID:6224
- C:\Windows\System\fzYqCYn.exe
  C:\Windows\System\fzYqCYn.exe
  2⤵
  PID:6256
- C:\Windows\System\yNELKiN.exe
  C:\Windows\System\yNELKiN.exe
  2⤵
  PID:6284
- C:\Windows\System\qDXcmqi.exe
  C:\Windows\System\qDXcmqi.exe
  2⤵
  PID:6356
- C:\Windows\System\eDjuNjP.exe
  C:\Windows\System\eDjuNjP.exe
  2⤵
  PID:6372
- C:\Windows\System\LewYtqn.exe
  C:\Windows\System\LewYtqn.exe
  2⤵
  PID:6388
- C:\Windows\System\cDzfReL.exe
  C:\Windows\System\cDzfReL.exe
  2⤵
  PID:6436
- C:\Windows\System\AmWyedV.exe
  C:\Windows\System\AmWyedV.exe
  2⤵
  PID:6476
- C:\Windows\System\iVJvISa.exe
  C:\Windows\System\iVJvISa.exe
  2⤵
  PID:6492
- C:\Windows\System\cFUSuau.exe
  C:\Windows\System\cFUSuau.exe
  2⤵
  PID:6584
- C:\Windows\System\yAtzelt.exe
  C:\Windows\System\yAtzelt.exe
  2⤵
  PID:6600
- C:\Windows\System\zjlxdOj.exe
  C:\Windows\System\zjlxdOj.exe
  2⤵
  PID:6616
- C:\Windows\System\ZywioiM.exe
  C:\Windows\System\ZywioiM.exe
  2⤵
  PID:6632
- C:\Windows\System\trrccwa.exe
  C:\Windows\System\trrccwa.exe
  2⤵
  PID:6648
- C:\Windows\System\XZvZjGA.exe
  C:\Windows\System\XZvZjGA.exe
  2⤵
  PID:6668
- C:\Windows\System\ebIeWFP.exe
  C:\Windows\System\ebIeWFP.exe
  2⤵
  PID:6688
- C:\Windows\System\kJCuoLe.exe
  C:\Windows\System\kJCuoLe.exe
  2⤵
  PID:6716
- C:\Windows\System\CYPHVlG.exe
  C:\Windows\System\CYPHVlG.exe
  2⤵
  PID:6740
- C:\Windows\System\twDVhcY.exe
  C:\Windows\System\twDVhcY.exe
  2⤵
  PID:6764
- C:\Windows\System\CFfonKT.exe
  C:\Windows\System\CFfonKT.exe
  2⤵
  PID:6836
- C:\Windows\System\DSqBLiK.exe
  C:\Windows\System\DSqBLiK.exe
  2⤵
  PID:6928
- C:\Windows\System\IQZSylO.exe
  C:\Windows\System\IQZSylO.exe
  2⤵
  PID:6960
- C:\Windows\System\jqXDOiH.exe
  C:\Windows\System\jqXDOiH.exe
  2⤵
  PID:6984
- C:\Windows\System\zHXDdPC.exe
  C:\Windows\System\zHXDdPC.exe
  2⤵
  PID:7000
- C:\Windows\System\dflRcnp.exe
  C:\Windows\System\dflRcnp.exe
  2⤵
  PID:7028
- C:\Windows\System\IapONYi.exe
  C:\Windows\System\IapONYi.exe
  2⤵
  PID:7056
- C:\Windows\System\XhksSbO.exe
  C:\Windows\System\XhksSbO.exe
  2⤵
  PID:7080
- C:\Windows\System\nubXQDg.exe
  C:\Windows\System\nubXQDg.exe
  2⤵
  PID:7100
- C:\Windows\System\ylgTVVo.exe
  C:\Windows\System\ylgTVVo.exe
  2⤵
  PID:7128
- C:\Windows\System\yMhtuUW.exe
  C:\Windows\System\yMhtuUW.exe
  2⤵
  PID:7156
- C:\Windows\System\LgcoemC.exe
  C:\Windows\System\LgcoemC.exe
  2⤵
  PID:6280
- C:\Windows\System\dhHnNfP.exe
  C:\Windows\System\dhHnNfP.exe
  2⤵
  PID:6212
- C:\Windows\System\BGZAIeL.exe
  C:\Windows\System\BGZAIeL.exe
  2⤵
  PID:6420
- C:\Windows\System\jYMXCpy.exe
  C:\Windows\System\jYMXCpy.exe
  2⤵
  PID:6264
- C:\Windows\System\iYRnKGF.exe
  C:\Windows\System\iYRnKGF.exe
  2⤵
  PID:6296
- C:\Windows\System\zcHpJaj.exe
  C:\Windows\System\zcHpJaj.exe
  2⤵
  PID:6352
- C:\Windows\System\Yokgzcm.exe
  C:\Windows\System\Yokgzcm.exe
  2⤵
  PID:6456
- C:\Windows\System\tNHObxM.exe
  C:\Windows\System\tNHObxM.exe
  2⤵
  PID:6488
- C:\Windows\System\xuFuWcc.exe
  C:\Windows\System\xuFuWcc.exe
  2⤵
  PID:6536
- C:\Windows\System\KGOSMoK.exe
  C:\Windows\System\KGOSMoK.exe
  2⤵
  PID:6660
- C:\Windows\System\ctIsAuN.exe
  C:\Windows\System\ctIsAuN.exe
  2⤵
  PID:6612
- C:\Windows\System\eQVfHmD.exe
  C:\Windows\System\eQVfHmD.exe
  2⤵
  PID:6756
- C:\Windows\System\IeCySGs.exe
  C:\Windows\System\IeCySGs.exe
  2⤵
  PID:6792
- C:\Windows\System\jWQRQkY.exe
  C:\Windows\System\jWQRQkY.exe
  2⤵
  PID:6912
- C:\Windows\System\xeOYVxE.exe
  C:\Windows\System\xeOYVxE.exe
  2⤵
  PID:6972
- C:\Windows\System\oDINIHw.exe
  C:\Windows\System\oDINIHw.exe
  2⤵
  PID:7024
- C:\Windows\System\uKljjMd.exe
  C:\Windows\System\uKljjMd.exe
  2⤵
  PID:7064
- C:\Windows\System\sushTeB.exe
  C:\Windows\System\sushTeB.exe
  2⤵
  PID:7108
- C:\Windows\System\MdgsCOX.exe
  C:\Windows\System\MdgsCOX.exe
  2⤵
  PID:2616
- C:\Windows\System\DfULYjs.exe
  C:\Windows\System\DfULYjs.exe
  2⤵
  PID:6148
- C:\Windows\System\DCkmaLf.exe
  C:\Windows\System\DCkmaLf.exe
  2⤵
  PID:464
- C:\Windows\System\XvxWLAL.exe
  C:\Windows\System\XvxWLAL.exe
  2⤵
  PID:6316
- C:\Windows\System\QVAnowy.exe
  C:\Windows\System\QVAnowy.exe
  2⤵
  PID:6452
- C:\Windows\System\VsTnPTM.exe
  C:\Windows\System\VsTnPTM.exe
  2⤵
  PID:6528
- C:\Windows\System\jFxfZLF.exe
  C:\Windows\System\jFxfZLF.exe
  2⤵
  PID:6724
- C:\Windows\System\dzeKDkk.exe
  C:\Windows\System\dzeKDkk.exe
  2⤵
  PID:5000
- C:\Windows\System\difogdl.exe
  C:\Windows\System\difogdl.exe
  2⤵
  PID:6968
- C:\Windows\System\LBSLyTl.exe
  C:\Windows\System\LBSLyTl.exe
  2⤵
  PID:4032
- C:\Windows\System\peQQNRv.exe
  C:\Windows\System\peQQNRv.exe
  2⤵
  PID:4572
- C:\Windows\System\eebIKVX.exe
  C:\Windows\System\eebIKVX.exe
  2⤵
  PID:844
- C:\Windows\System\rsELGkr.exe
  C:\Windows\System\rsELGkr.exe
  2⤵
  PID:1940
- C:\Windows\System\mNqFnpd.exe
  C:\Windows\System\mNqFnpd.exe
  2⤵
  PID:6948
- C:\Windows\System\FAmdAhU.exe
  C:\Windows\System\FAmdAhU.exe
  2⤵
  PID:6656
- C:\Windows\System\QnenNdW.exe
  C:\Windows\System\QnenNdW.exe
  2⤵
  PID:6996
- C:\Windows\System\VPDJXlZ.exe
  C:\Windows\System\VPDJXlZ.exe
  2⤵
  PID:7092
- C:\Windows\System\jAhdNel.exe
  C:\Windows\System\jAhdNel.exe
  2⤵
  PID:7196
- C:\Windows\System\LRAeJrP.exe
  C:\Windows\System\LRAeJrP.exe
  2⤵
  PID:7216
- C:\Windows\System\jcJtXcQ.exe
  C:\Windows\System\jcJtXcQ.exe
  2⤵
  PID:7256
- C:\Windows\System\CFBwVbf.exe
  C:\Windows\System\CFBwVbf.exe
  2⤵
  PID:7280
- C:\Windows\System\dlfZeAN.exe
  C:\Windows\System\dlfZeAN.exe
  2⤵
  PID:7308
- C:\Windows\System\JSUAhLM.exe
  C:\Windows\System\JSUAhLM.exe
  2⤵
  PID:7332
- C:\Windows\System\ibWsnsJ.exe
  C:\Windows\System\ibWsnsJ.exe
  2⤵
  PID:7348
- C:\Windows\System\AbGNzgl.exe
  C:\Windows\System\AbGNzgl.exe
  2⤵
  PID:7376
- C:\Windows\System\LlbDLRA.exe
  C:\Windows\System\LlbDLRA.exe
  2⤵
  PID:7400
- C:\Windows\System\LvexpCO.exe
  C:\Windows\System\LvexpCO.exe
  2⤵
  PID:7424
- C:\Windows\System\zIWBWSa.exe
  C:\Windows\System\zIWBWSa.exe
  2⤵
  PID:7464
- C:\Windows\System\NeCmsct.exe
  C:\Windows\System\NeCmsct.exe
  2⤵
  PID:7484
- C:\Windows\System\ICgGFdD.exe
  C:\Windows\System\ICgGFdD.exe
  2⤵
  PID:7520
- C:\Windows\System\RWnUnAm.exe
  C:\Windows\System\RWnUnAm.exe
  2⤵
  PID:7536
- C:\Windows\System\pcvkgxD.exe
  C:\Windows\System\pcvkgxD.exe
  2⤵
  PID:7552
- C:\Windows\System\Yihcwap.exe
  C:\Windows\System\Yihcwap.exe
  2⤵
  PID:7596
- C:\Windows\System\xfVWZCQ.exe
  C:\Windows\System\xfVWZCQ.exe
  2⤵
  PID:7628
- C:\Windows\System\HjCoEfF.exe
  C:\Windows\System\HjCoEfF.exe
  2⤵
  PID:7656
- C:\Windows\System\utPJDvy.exe
  C:\Windows\System\utPJDvy.exe
  2⤵
  PID:7676
- C:\Windows\System\MDTsHZb.exe
  C:\Windows\System\MDTsHZb.exe
  2⤵
  PID:7704
- C:\Windows\System\sdYXcmD.exe
  C:\Windows\System\sdYXcmD.exe
  2⤵
  PID:7728
- C:\Windows\System\wzdHwKM.exe
  C:\Windows\System\wzdHwKM.exe
  2⤵
  PID:7780
- C:\Windows\System\GXbCaRF.exe
  C:\Windows\System\GXbCaRF.exe
  2⤵
  PID:7804
- C:\Windows\System\oekCyzW.exe
  C:\Windows\System\oekCyzW.exe
  2⤵
  PID:7836
- C:\Windows\System\msgRrxq.exe
  C:\Windows\System\msgRrxq.exe
  2⤵
  PID:7868
- C:\Windows\System\nfOSWAP.exe
  C:\Windows\System\nfOSWAP.exe
  2⤵
  PID:7900
- C:\Windows\System\kTjUEMA.exe
  C:\Windows\System\kTjUEMA.exe
  2⤵
  PID:7924
- C:\Windows\System\GkkCYdF.exe
  C:\Windows\System\GkkCYdF.exe
  2⤵
  PID:7968
- C:\Windows\System\GWhWXfF.exe
  C:\Windows\System\GWhWXfF.exe
  2⤵
  PID:7988
- C:\Windows\System\QRLrNwk.exe
  C:\Windows\System\QRLrNwk.exe
  2⤵
  PID:8016
- C:\Windows\System\LBOSsAq.exe
  C:\Windows\System\LBOSsAq.exe
  2⤵
  PID:8040
- C:\Windows\System\Anmfebm.exe
  C:\Windows\System\Anmfebm.exe
  2⤵
  PID:8060
- C:\Windows\System\PbRzqea.exe
  C:\Windows\System\PbRzqea.exe
  2⤵
  PID:8076
- C:\Windows\System\wrDoQHO.exe
  C:\Windows\System\wrDoQHO.exe
  2⤵
  PID:8116
- C:\Windows\System\yJwFehR.exe
  C:\Windows\System\yJwFehR.exe
  2⤵
  PID:8156
- C:\Windows\System\zGOCrWh.exe
  C:\Windows\System\zGOCrWh.exe
  2⤵
  PID:8188
- C:\Windows\System\YjolLzR.exe
  C:\Windows\System\YjolLzR.exe
  2⤵
  PID:7204
- C:\Windows\System\rnnlMoP.exe
  C:\Windows\System\rnnlMoP.exe
  2⤵
  PID:7248
- C:\Windows\System\pCQeMSx.exe
  C:\Windows\System\pCQeMSx.exe
  2⤵
  PID:7304
- C:\Windows\System\KXYKPWh.exe
  C:\Windows\System\KXYKPWh.exe
  2⤵
  PID:7384
- C:\Windows\System\cATqEXJ.exe
  C:\Windows\System\cATqEXJ.exe
  2⤵
  PID:7460
- C:\Windows\System\ZmDnNSH.exe
  C:\Windows\System\ZmDnNSH.exe
  2⤵
  PID:7528
- C:\Windows\System\LNKRyog.exe
  C:\Windows\System\LNKRyog.exe
  2⤵
  PID:7592
- C:\Windows\System\GiJZDyv.exe
  C:\Windows\System\GiJZDyv.exe
  2⤵
  PID:7572
- C:\Windows\System\nABrnSe.exe
  C:\Windows\System\nABrnSe.exe
  2⤵
  PID:7672
- C:\Windows\System\GkjUigj.exe
  C:\Windows\System\GkjUigj.exe
  2⤵
  PID:7816
- C:\Windows\System\LUaiZgW.exe
  C:\Windows\System\LUaiZgW.exe
  2⤵
  PID:3344
- C:\Windows\System\FZxncpt.exe
  C:\Windows\System\FZxncpt.exe
  2⤵
  PID:7880
- C:\Windows\System\nkDzenY.exe
  C:\Windows\System\nkDzenY.exe
  2⤵
  PID:7916
- C:\Windows\System\LoGHQEj.exe
  C:\Windows\System\LoGHQEj.exe
  2⤵
  PID:8024
- C:\Windows\System\KjQujje.exe
  C:\Windows\System\KjQujje.exe
  2⤵
  PID:8056
- C:\Windows\System\DacsvtT.exe
  C:\Windows\System\DacsvtT.exe
  2⤵
  PID:8144
- C:\Windows\System\bdIFXYT.exe
  C:\Windows\System\bdIFXYT.exe
  2⤵
  PID:7236
- C:\Windows\System\tIIkBeb.exe
  C:\Windows\System\tIIkBeb.exe
  2⤵
  PID:7340
- C:\Windows\System\eiwCzOp.exe
  C:\Windows\System\eiwCzOp.exe
  2⤵
  PID:7500
- C:\Windows\System\nLPlvfH.exe
  C:\Windows\System\nLPlvfH.exe
  2⤵
  PID:7548
- C:\Windows\System\qPllfxd.exe
  C:\Windows\System\qPllfxd.exe
  2⤵
  PID:7668
- C:\Windows\System\ttjiett.exe
  C:\Windows\System\ttjiett.exe
  2⤵
  PID:7828
- C:\Windows\System\xpUCotx.exe
  C:\Windows\System\xpUCotx.exe
  2⤵
  PID:7956
- C:\Windows\System\sdwkawa.exe
  C:\Windows\System\sdwkawa.exe
  2⤵
  PID:8096
- C:\Windows\System\KjuKsKJ.exe
  C:\Windows\System\KjuKsKJ.exe
  2⤵
  PID:7272
- C:\Windows\System\VVXjykL.exe
  C:\Windows\System\VVXjykL.exe
  2⤵
  PID:7580
- C:\Windows\System\ywpCVvS.exe
  C:\Windows\System\ywpCVvS.exe
  2⤵
  PID:8008
- C:\Windows\System\ujSPnRr.exe
  C:\Windows\System\ujSPnRr.exe
  2⤵
  PID:3144
- C:\Windows\System\EhstCag.exe
  C:\Windows\System\EhstCag.exe
  2⤵
  PID:8052
- C:\Windows\System\TIopBVD.exe
  C:\Windows\System\TIopBVD.exe
  2⤵
  PID:7960
- C:\Windows\System\wFNIDQq.exe
  C:\Windows\System\wFNIDQq.exe
  2⤵
  PID:8228
- C:\Windows\System\oEaFlSi.exe
  C:\Windows\System\oEaFlSi.exe
  2⤵
  PID:8248
- C:\Windows\System\SiGupup.exe
  C:\Windows\System\SiGupup.exe
  2⤵
  PID:8280
- C:\Windows\System\fxSTsTc.exe
  C:\Windows\System\fxSTsTc.exe
  2⤵
  PID:8300
- C:\Windows\System\ObVutDj.exe
  C:\Windows\System\ObVutDj.exe
  2⤵
  PID:8336
- C:\Windows\System\VjCSfDS.exe
  C:\Windows\System\VjCSfDS.exe
  2⤵
  PID:8360
- C:\Windows\System\XigZPDp.exe
  C:\Windows\System\XigZPDp.exe
  2⤵
  PID:8384
- C:\Windows\System\AcgKyUq.exe
  C:\Windows\System\AcgKyUq.exe
  2⤵
  PID:8412
- C:\Windows\System\MdZSBJM.exe
  C:\Windows\System\MdZSBJM.exe
  2⤵
  PID:8452
- C:\Windows\System\bYqMMsR.exe
  C:\Windows\System\bYqMMsR.exe
  2⤵
  PID:8476
- C:\Windows\System\HEJogCv.exe
  C:\Windows\System\HEJogCv.exe
  2⤵
  PID:8528
- C:\Windows\System\sUFUrFT.exe
  C:\Windows\System\sUFUrFT.exe
  2⤵
  PID:8552
- C:\Windows\System\XfGBDaR.exe
  C:\Windows\System\XfGBDaR.exe
  2⤵
  PID:8580
- C:\Windows\System\mtEJIKe.exe
  C:\Windows\System\mtEJIKe.exe
  2⤵
  PID:8600
- C:\Windows\System\eraCQJv.exe
  C:\Windows\System\eraCQJv.exe
  2⤵
  PID:8624
- C:\Windows\System\NdOzZws.exe
  C:\Windows\System\NdOzZws.exe
  2⤵
  PID:8648
- C:\Windows\System\EJNYvvh.exe
  C:\Windows\System\EJNYvvh.exe
  2⤵
  PID:8696
- C:\Windows\System\dkLIBcX.exe
  C:\Windows\System\dkLIBcX.exe
  2⤵
  PID:8720
- C:\Windows\System\DlTnSsx.exe
  C:\Windows\System\DlTnSsx.exe
  2⤵
  PID:8756
- C:\Windows\System\iwVmBps.exe
  C:\Windows\System\iwVmBps.exe
  2⤵
  PID:8776
- C:\Windows\System\kZLvYXF.exe
  C:\Windows\System\kZLvYXF.exe
  2⤵
  PID:8808
- C:\Windows\System\iEjaKEt.exe
  C:\Windows\System\iEjaKEt.exe
  2⤵
  PID:8832
- C:\Windows\System\ICxqzlf.exe
  C:\Windows\System\ICxqzlf.exe
  2⤵
  PID:8868
- C:\Windows\System\yUZVoeu.exe
  C:\Windows\System\yUZVoeu.exe
  2⤵
  PID:8896
- C:\Windows\System\PRxHUwF.exe
  C:\Windows\System\PRxHUwF.exe
  2⤵
  PID:8924
- C:\Windows\System\vnaPhoS.exe
  C:\Windows\System\vnaPhoS.exe
  2⤵
  PID:8956
- C:\Windows\System\JZGPVvK.exe
  C:\Windows\System\JZGPVvK.exe
  2⤵
  PID:8992
- C:\Windows\System\MinoXpf.exe
  C:\Windows\System\MinoXpf.exe
  2⤵
  PID:9024
- C:\Windows\System\UQuoIQP.exe
  C:\Windows\System\UQuoIQP.exe
  2⤵
  PID:9080
- C:\Windows\System\vnXPZoc.exe
  C:\Windows\System\vnXPZoc.exe
  2⤵
  PID:9096
- C:\Windows\System\xHxQdyO.exe
  C:\Windows\System\xHxQdyO.exe
  2⤵
  PID:9124
- C:\Windows\System\KapsrQO.exe
  C:\Windows\System\KapsrQO.exe
  2⤵
  PID:9144
- C:\Windows\System\CPXuumr.exe
  C:\Windows\System\CPXuumr.exe
  2⤵
  PID:9184
- C:\Windows\System\yNaNryV.exe
  C:\Windows\System\yNaNryV.exe
  2⤵
  PID:9212
- C:\Windows\System\bUxLoCw.exe
  C:\Windows\System\bUxLoCw.exe
  2⤵
  PID:8220
- C:\Windows\System\KhqchkJ.exe
  C:\Windows\System\KhqchkJ.exe
  2⤵
  PID:8256
- C:\Windows\System\YqeWluK.exe
  C:\Windows\System\YqeWluK.exe
  2⤵
  PID:8356
- C:\Windows\System\CdovIzz.exe
  C:\Windows\System\CdovIzz.exe
  2⤵
  PID:8408
- C:\Windows\System\zaPcvSq.exe
  C:\Windows\System\zaPcvSq.exe
  2⤵
  PID:8444
- C:\Windows\System\NYpxyFb.exe
  C:\Windows\System\NYpxyFb.exe
  2⤵
  PID:8520
- C:\Windows\System\FRenPuB.exe
  C:\Windows\System\FRenPuB.exe
  2⤵
  PID:8568
- C:\Windows\System\AZGncVF.exe
  C:\Windows\System\AZGncVF.exe
  2⤵
  PID:8680
- C:\Windows\System\VrqUONS.exe
  C:\Windows\System\VrqUONS.exe
  2⤵
  PID:8716
- C:\Windows\System\MzpwNeo.exe
  C:\Windows\System\MzpwNeo.exe
  2⤵
  PID:2872
- C:\Windows\System\ZAZsZbV.exe
  C:\Windows\System\ZAZsZbV.exe
  2⤵
  PID:8864
- C:\Windows\System\FTKKgJJ.exe
  C:\Windows\System\FTKKgJJ.exe
  2⤵
  PID:8932
- C:\Windows\System\IqJjDdw.exe
  C:\Windows\System\IqJjDdw.exe
  2⤵
  PID:8944
- C:\Windows\System\OdYQbQB.exe
  C:\Windows\System\OdYQbQB.exe
  2⤵
  PID:9036
- C:\Windows\System\DEKoyQK.exe
  C:\Windows\System\DEKoyQK.exe
  2⤵
  PID:9112
- C:\Windows\System\fQzEFdA.exe
  C:\Windows\System\fQzEFdA.exe
  2⤵
  PID:9160
- C:\Windows\System\jwhzcqp.exe
  C:\Windows\System\jwhzcqp.exe
  2⤵
  PID:8216
- C:\Windows\System\voVkAMC.exe
  C:\Windows\System\voVkAMC.exe
  2⤵
  PID:8372
- C:\Windows\System\WoKNYox.exe
  C:\Windows\System\WoKNYox.exe
  2⤵
  PID:8496
- C:\Windows\System\wOexvyD.exe
  C:\Windows\System\wOexvyD.exe
  2⤵
  PID:8632
- C:\Windows\System\MRaNfOW.exe
  C:\Windows\System\MRaNfOW.exe
  2⤵
  PID:8764
- C:\Windows\System\ADhBkpx.exe
  C:\Windows\System\ADhBkpx.exe
  2⤵
  PID:8852
- C:\Windows\System\sxvuYMc.exe
  C:\Windows\System\sxvuYMc.exe
  2⤵
  PID:8972
- C:\Windows\System\BbXKBVI.exe
  C:\Windows\System\BbXKBVI.exe
  2⤵
  PID:9092
- C:\Windows\System\AcnWXsf.exe
  C:\Windows\System\AcnWXsf.exe
  2⤵
  PID:8376
- C:\Windows\System\LzvTPWt.exe
  C:\Windows\System\LzvTPWt.exe
  2⤵
  PID:8796
- C:\Windows\System\OIhEyKJ.exe
  C:\Windows\System\OIhEyKJ.exe
  2⤵
  PID:8888
- C:\Windows\System\iSWnJmc.exe
  C:\Windows\System\iSWnJmc.exe
  2⤵
  PID:4632
- C:\Windows\System\fcVfXVy.exe
  C:\Windows\System\fcVfXVy.exe
  2⤵
  PID:3660
- C:\Windows\System\exMDLWy.exe
  C:\Windows\System\exMDLWy.exe
  2⤵
  PID:9252
- C:\Windows\System\HHnwjrQ.exe
  C:\Windows\System\HHnwjrQ.exe
  2⤵
  PID:9276
- C:\Windows\System\qvBrAXK.exe
  C:\Windows\System\qvBrAXK.exe
  2⤵
  PID:9320
- C:\Windows\System\rOpKstX.exe
  C:\Windows\System\rOpKstX.exe
  2⤵
  PID:9356
- C:\Windows\System\HxLgbCJ.exe
  C:\Windows\System\HxLgbCJ.exe
  2⤵
  PID:9388
- C:\Windows\System\ietYoTr.exe
  C:\Windows\System\ietYoTr.exe
  2⤵
  PID:9408
- C:\Windows\System\ltWUwyS.exe
  C:\Windows\System\ltWUwyS.exe
  2⤵
  PID:9436
- C:\Windows\System\VDjSFMj.exe
  C:\Windows\System\VDjSFMj.exe
  2⤵
  PID:9460
- C:\Windows\System\rPiTjCD.exe
  C:\Windows\System\rPiTjCD.exe
  2⤵
  PID:9476
- C:\Windows\System\DQddErG.exe
  C:\Windows\System\DQddErG.exe
  2⤵
  PID:9496
- C:\Windows\System\KOxPzma.exe
  C:\Windows\System\KOxPzma.exe
  2⤵
  PID:9520
- C:\Windows\System\QhnpkIJ.exe
  C:\Windows\System\QhnpkIJ.exe
  2⤵
  PID:9576
- C:\Windows\System\nHlmhxR.exe
  C:\Windows\System\nHlmhxR.exe
  2⤵
  PID:9612
- C:\Windows\System\QowSvbN.exe
  C:\Windows\System\QowSvbN.exe
  2⤵
  PID:9652
- C:\Windows\System\AvbamDF.exe
  C:\Windows\System\AvbamDF.exe
  2⤵
  PID:9672
- C:\Windows\System\kzYHnTZ.exe
  C:\Windows\System\kzYHnTZ.exe
  2⤵
  PID:9692
- C:\Windows\System\WZKdTpJ.exe
  C:\Windows\System\WZKdTpJ.exe
  2⤵
  PID:9724
- C:\Windows\System\nuaxRaY.exe
  C:\Windows\System\nuaxRaY.exe
  2⤵
  PID:9748
- C:\Windows\System\YHYjXtE.exe
  C:\Windows\System\YHYjXtE.exe
  2⤵
  PID:9768
- C:\Windows\System\dgWHSCi.exe
  C:\Windows\System\dgWHSCi.exe
  2⤵
  PID:9792
- C:\Windows\System\QGHeRul.exe
  C:\Windows\System\QGHeRul.exe
  2⤵
  PID:9808
- C:\Windows\System\abvBMec.exe
  C:\Windows\System\abvBMec.exe
  2⤵
  PID:9848
- C:\Windows\System\eUHiKZd.exe
  C:\Windows\System\eUHiKZd.exe
  2⤵
  PID:9868
- C:\Windows\System\UMVtvTT.exe
  C:\Windows\System\UMVtvTT.exe
  2⤵
  PID:9892
- C:\Windows\System\dXgGHBk.exe
  C:\Windows\System\dXgGHBk.exe
  2⤵
  PID:9948
- C:\Windows\System\fbWjKWB.exe
  C:\Windows\System\fbWjKWB.exe
  2⤵
  PID:9972
- C:\Windows\System\NMCWdti.exe
  C:\Windows\System\NMCWdti.exe
  2⤵
  PID:10032
- C:\Windows\System\cAyrwnl.exe
  C:\Windows\System\cAyrwnl.exe
  2⤵
  PID:10052
- C:\Windows\System\cQyDYAu.exe
  C:\Windows\System\cQyDYAu.exe
  2⤵
  PID:10076
- C:\Windows\System\QNiuWGL.exe
  C:\Windows\System\QNiuWGL.exe
  2⤵
  PID:10104
- C:\Windows\System\Qhtlyxb.exe
  C:\Windows\System\Qhtlyxb.exe
  2⤵
  PID:10132
- C:\Windows\System\QXgjgAb.exe
  C:\Windows\System\QXgjgAb.exe
  2⤵
  PID:10152
- C:\Windows\System\mOPhzjw.exe
  C:\Windows\System\mOPhzjw.exe
  2⤵
  PID:10192
- C:\Windows\System\vBcZxbq.exe
  C:\Windows\System\vBcZxbq.exe
  2⤵
  PID:10216
- C:\Windows\System\vlsSNhi.exe
  C:\Windows\System\vlsSNhi.exe
  2⤵
  PID:8432
- C:\Windows\System\VUSRyVF.exe
  C:\Windows\System\VUSRyVF.exe
  2⤵
  PID:8328
- C:\Windows\System\mXsmSBk.exe
  C:\Windows\System\mXsmSBk.exe
  2⤵
  PID:9288
- C:\Windows\System\pfkJmyR.exe
  C:\Windows\System\pfkJmyR.exe
  2⤵
  PID:9348
- C:\Windows\System\SZRIFUD.exe
  C:\Windows\System\SZRIFUD.exe
  2⤵
  PID:9376
- C:\Windows\System\SLJvSkY.exe
  C:\Windows\System\SLJvSkY.exe
  2⤵
  PID:9444
- C:\Windows\System\EVTlECu.exe
  C:\Windows\System\EVTlECu.exe
  2⤵
  PID:9492
- C:\Windows\System\Emgfbvx.exe
  C:\Windows\System\Emgfbvx.exe
  2⤵
  PID:9564
- C:\Windows\System\ISaswDw.exe
  C:\Windows\System\ISaswDw.exe
  2⤵
  PID:9592
- C:\Windows\System\KZwJuap.exe
  C:\Windows\System\KZwJuap.exe
  2⤵
  PID:9680
- C:\Windows\System\mmgIfLK.exe
  C:\Windows\System\mmgIfLK.exe
  2⤵
  PID:9716
- C:\Windows\System\xPIhROq.exe
  C:\Windows\System\xPIhROq.exe
  2⤵
  PID:9824
- C:\Windows\System\ssTpUKX.exe
  C:\Windows\System\ssTpUKX.exe
  2⤵
  PID:9904
- C:\Windows\System\mZxCLql.exe
  C:\Windows\System\mZxCLql.exe
  2⤵
  PID:9936
- C:\Windows\System\ooKYfeN.exe
  C:\Windows\System\ooKYfeN.exe
  2⤵
  PID:10048
- C:\Windows\System\kJhrwMp.exe
  C:\Windows\System\kJhrwMp.exe
  2⤵
  PID:10096
- C:\Windows\System\InzVrEZ.exe
  C:\Windows\System\InzVrEZ.exe
  2⤵
  PID:10148
- C:\Windows\System\TqeNHoQ.exe
  C:\Windows\System\TqeNHoQ.exe
  2⤵
  PID:732
- C:\Windows\System\iUwsiMJ.exe
  C:\Windows\System\iUwsiMJ.exe
  2⤵
  PID:9248
- C:\Windows\System\VhQFioS.exe
  C:\Windows\System\VhQFioS.exe
  2⤵
  PID:9404
- C:\Windows\System\kvWxgig.exe
  C:\Windows\System\kvWxgig.exe
  2⤵
  PID:9368
- C:\Windows\System\SgAWjhf.exe
  C:\Windows\System\SgAWjhf.exe
  2⤵
  PID:9776
- C:\Windows\System\ecIWUZH.exe
  C:\Windows\System\ecIWUZH.exe
  2⤵
  PID:9888
- C:\Windows\System\AqhDIWO.exe
  C:\Windows\System\AqhDIWO.exe
  2⤵
  PID:9980
- C:\Windows\System\ElgVryT.exe
  C:\Windows\System\ElgVryT.exe
  2⤵
  PID:10092
- C:\Windows\System\aonGTCY.exe
  C:\Windows\System\aonGTCY.exe
  2⤵
  PID:9340
- C:\Windows\System\mRdUUSM.exe
  C:\Windows\System\mRdUUSM.exe
  2⤵
  PID:9532
- C:\Windows\System\mzFKIiu.exe
  C:\Windows\System\mzFKIiu.exe
  2⤵
  PID:9876
- C:\Windows\System\hMJoYIn.exe
  C:\Windows\System\hMJoYIn.exe
  2⤵
  PID:9992
- C:\Windows\System\OSNbTrl.exe
  C:\Windows\System\OSNbTrl.exe
  2⤵
  PID:9316
- C:\Windows\System\AlclCtX.exe
  C:\Windows\System\AlclCtX.exe
  2⤵
  PID:9924
- C:\Windows\System\SNmhJFX.exe
  C:\Windows\System\SNmhJFX.exe
  2⤵
  PID:10256
- C:\Windows\System\iTyyifz.exe
  C:\Windows\System\iTyyifz.exe
  2⤵
  PID:10280
- C:\Windows\System\KBURRJX.exe
  C:\Windows\System\KBURRJX.exe
  2⤵
  PID:10316
- C:\Windows\System\jOOyhXO.exe
  C:\Windows\System\jOOyhXO.exe
  2⤵
  PID:10340
- C:\Windows\System\BPWhYHZ.exe
  C:\Windows\System\BPWhYHZ.exe
  2⤵
  PID:10392
- C:\Windows\System\cvHojeH.exe
  C:\Windows\System\cvHojeH.exe
  2⤵
  PID:10420
- C:\Windows\System\rKkDwnB.exe
  C:\Windows\System\rKkDwnB.exe
  2⤵
  PID:10452
- C:\Windows\System\yBoINpf.exe
  C:\Windows\System\yBoINpf.exe
  2⤵
  PID:10480
- C:\Windows\System\GfsaivV.exe
  C:\Windows\System\GfsaivV.exe
  2⤵
  PID:10512
- C:\Windows\System\WVxIsDr.exe
  C:\Windows\System\WVxIsDr.exe
  2⤵
  PID:10540
- C:\Windows\System\FsQKpbU.exe
  C:\Windows\System\FsQKpbU.exe
  2⤵
  PID:10568
- C:\Windows\System\wPkqCPH.exe
  C:\Windows\System\wPkqCPH.exe
  2⤵
  PID:10596
- C:\Windows\System\pVbHsVL.exe
  C:\Windows\System\pVbHsVL.exe
  2⤵
  PID:10628
- C:\Windows\System\dDTmSgD.exe
  C:\Windows\System\dDTmSgD.exe
  2⤵
  PID:10644
- C:\Windows\System\HQpLNnA.exe
  C:\Windows\System\HQpLNnA.exe
  2⤵
  PID:10668
- C:\Windows\System\aArXyTJ.exe
  C:\Windows\System\aArXyTJ.exe
  2⤵
  PID:10696
- C:\Windows\System\PsQjGHk.exe
  C:\Windows\System\PsQjGHk.exe
  2⤵
  PID:10720
- C:\Windows\System\USwSYlK.exe
  C:\Windows\System\USwSYlK.exe
  2⤵
  PID:10752
- C:\Windows\System\yypirFA.exe
  C:\Windows\System\yypirFA.exe
  2⤵
  PID:10800
- C:\Windows\System\IdDDJyi.exe
  C:\Windows\System\IdDDJyi.exe
  2⤵
  PID:10824
- C:\Windows\System\zuLiRmM.exe
  C:\Windows\System\zuLiRmM.exe
  2⤵
  PID:10852
- C:\Windows\System\yvuGIvE.exe
  C:\Windows\System\yvuGIvE.exe
  2⤵
  PID:10876
- C:\Windows\System\hcXdGUU.exe
  C:\Windows\System\hcXdGUU.exe
  2⤵
  PID:10900
- C:\Windows\System\GtTUXIT.exe
  C:\Windows\System\GtTUXIT.exe
  2⤵
  PID:10920
- C:\Windows\System\DCwpEXO.exe
  C:\Windows\System\DCwpEXO.exe
  2⤵
  PID:10948
- C:\Windows\System\BwIGdtT.exe
  C:\Windows\System\BwIGdtT.exe
  2⤵
  PID:10972
- C:\Windows\System\dNvrUXr.exe
  C:\Windows\System\dNvrUXr.exe
  2⤵
  PID:10996
- C:\Windows\System\xjrvEyQ.exe
  C:\Windows\System\xjrvEyQ.exe
  2⤵
  PID:11016
- C:\Windows\System\MdCAQXN.exe
  C:\Windows\System\MdCAQXN.exe
  2⤵
  PID:11048
- C:\Windows\System\oeuQrHZ.exe
  C:\Windows\System\oeuQrHZ.exe
  2⤵
  PID:11076
- C:\Windows\System\RskYZBP.exe
  C:\Windows\System\RskYZBP.exe
  2⤵
  PID:11092
- C:\Windows\System\WudcISX.exe
  C:\Windows\System\WudcISX.exe
  2⤵
  PID:11124
- C:\Windows\System\BEbRHqs.exe
  C:\Windows\System\BEbRHqs.exe
  2⤵
  PID:11160
- C:\Windows\System\FhwQzCy.exe
  C:\Windows\System\FhwQzCy.exe
  2⤵
  PID:11180
- C:\Windows\System\SOgKxts.exe
  C:\Windows\System\SOgKxts.exe
  2⤵
  PID:11204
- C:\Windows\System\DKwVxyr.exe
  C:\Windows\System\DKwVxyr.exe
  2⤵
  PID:10272
- C:\Windows\System\JQiAdnP.exe
  C:\Windows\System\JQiAdnP.exe
  2⤵
  PID:10304
- C:\Windows\System\gHlNsGl.exe
  C:\Windows\System\gHlNsGl.exe
  2⤵
  PID:10336
- C:\Windows\System\DitbrNW.exe
  C:\Windows\System\DitbrNW.exe
  2⤵
  PID:10636
- C:\Windows\System\OgBefTP.exe
  C:\Windows\System\OgBefTP.exe
  2⤵
  PID:10664
- C:\Windows\System\gzYFfju.exe
  C:\Windows\System\gzYFfju.exe
  2⤵
  PID:10704
- C:\Windows\System\gvPJjjL.exe
  C:\Windows\System\gvPJjjL.exe
  2⤵
  PID:10816
- C:\Windows\System\WCpqwHy.exe
  C:\Windows\System\WCpqwHy.exe
  2⤵
  PID:10868
- C:\Windows\System\iuFHwOc.exe
  C:\Windows\System\iuFHwOc.exe
  2⤵
  PID:10940
- C:\Windows\System\FljpDqm.exe
  C:\Windows\System\FljpDqm.exe
  2⤵
  PID:11008
- C:\Windows\System\qgdzyzA.exe
  C:\Windows\System\qgdzyzA.exe
  2⤵
  PID:10988
- C:\Windows\System\NguOHee.exe
  C:\Windows\System\NguOHee.exe
  2⤵
  PID:11212
- C:\Windows\System\WqcDlkE.exe
  C:\Windows\System\WqcDlkE.exe
  2⤵
  PID:11260
- C:\Windows\System\CvLYEfE.exe
  C:\Windows\System\CvLYEfE.exe
  2⤵
  PID:10312
- C:\Windows\System\vWGYfZS.exe
  C:\Windows\System\vWGYfZS.exe
  2⤵
  PID:10472
- C:\Windows\System\STbjmUm.exe
  C:\Windows\System\STbjmUm.exe
  2⤵
  PID:10548
- C:\Windows\System\vVxrfjQ.exe
  C:\Windows\System\vVxrfjQ.exe
  2⤵
  PID:10584
- C:\Windows\System\vgWnBki.exe
  C:\Windows\System\vgWnBki.exe
  2⤵
  PID:10444
- C:\Windows\System\UjVYieM.exe
  C:\Windows\System\UjVYieM.exe
  2⤵
  PID:10792
- C:\Windows\System\JQdRdUc.exe
  C:\Windows\System\JQdRdUc.exe
  2⤵
  PID:10884
- C:\Windows\System\rnLEUjb.exe
  C:\Windows\System\rnLEUjb.exe
  2⤵
  PID:11100
- C:\Windows\System\ZHMufSt.exe
  C:\Windows\System\ZHMufSt.exe
  2⤵
  PID:10992
- C:\Windows\System\gBnGoRi.exe
  C:\Windows\System\gBnGoRi.exe
  2⤵
  PID:11256
- C:\Windows\System\HWEhQeC.exe
  C:\Windows\System\HWEhQeC.exe
  2⤵
  PID:10460
- C:\Windows\System\yYdHsWb.exe
  C:\Windows\System\yYdHsWb.exe
  2⤵
  PID:10784
- C:\Windows\System\pUdEHWs.exe
  C:\Windows\System\pUdEHWs.exe
  2⤵
  PID:11024
- C:\Windows\System\LAUwErc.exe
  C:\Windows\System\LAUwErc.exe
  2⤵
  PID:11148
- C:\Windows\System\nKaFazv.exe
  C:\Windows\System\nKaFazv.exe
  2⤵
  PID:10500
- C:\Windows\System\ZoVDZUC.exe
  C:\Windows\System\ZoVDZUC.exe
  2⤵
  PID:2004
- C:\Windows\System\DUpdfZV.exe
  C:\Windows\System\DUpdfZV.exe
  2⤵
  PID:11284
- C:\Windows\System\qTZrIGn.exe
  C:\Windows\System\qTZrIGn.exe
  2⤵
  PID:11304
- C:\Windows\System\laMQeqd.exe
  C:\Windows\System\laMQeqd.exe
  2⤵
  PID:11332
- C:\Windows\System\VXqyWLr.exe
  C:\Windows\System\VXqyWLr.exe
  2⤵
  PID:11360
- C:\Windows\System\uKWxmkR.exe
  C:\Windows\System\uKWxmkR.exe
  2⤵
  PID:11380
- C:\Windows\System\iHcNqCe.exe
  C:\Windows\System\iHcNqCe.exe
  2⤵
  PID:11404
- C:\Windows\System\XoMXdxv.exe
  C:\Windows\System\XoMXdxv.exe
  2⤵
  PID:11472
- C:\Windows\System\wmKwBJd.exe
  C:\Windows\System\wmKwBJd.exe
  2⤵
  PID:11492
- C:\Windows\System\Liqguaw.exe
  C:\Windows\System\Liqguaw.exe
  2⤵
  PID:11516
- C:\Windows\System\nMkrBTE.exe
  C:\Windows\System\nMkrBTE.exe
  2⤵
  PID:11556
- C:\Windows\System\duiKvae.exe
  C:\Windows\System\duiKvae.exe
  2⤵
  PID:11584
- C:\Windows\System\PTgXjgA.exe
  C:\Windows\System\PTgXjgA.exe
  2⤵
  PID:11612
- C:\Windows\System\cTqHqnr.exe
  C:\Windows\System\cTqHqnr.exe
  2⤵
  PID:11632
- C:\Windows\System\YOinitS.exe
  C:\Windows\System\YOinitS.exe
  2⤵
  PID:11652
- C:\Windows\System\DFgIKSm.exe
  C:\Windows\System\DFgIKSm.exe
  2⤵
  PID:11680
- C:\Windows\System\lpfFSNq.exe
  C:\Windows\System\lpfFSNq.exe
  2⤵
  PID:11700
- C:\Windows\System\ICRqzjj.exe
  C:\Windows\System\ICRqzjj.exe
  2⤵
  PID:11728
- C:\Windows\System\hBJgcbP.exe
  C:\Windows\System\hBJgcbP.exe
  2⤵
  PID:11784
- C:\Windows\System\vutGFpl.exe
  C:\Windows\System\vutGFpl.exe
  2⤵
  PID:11808
- C:\Windows\System\ZgSvIMn.exe
  C:\Windows\System\ZgSvIMn.exe
  2⤵
  PID:11832
- C:\Windows\System\SlzqOyn.exe
  C:\Windows\System\SlzqOyn.exe
  2⤵
  PID:11864
- C:\Windows\System\hxuJaSh.exe
  C:\Windows\System\hxuJaSh.exe
  2⤵
  PID:11896
- C:\Windows\System\rUvPYQt.exe
  C:\Windows\System\rUvPYQt.exe
  2⤵
  PID:11920
- C:\Windows\System\jdmNfbM.exe
  C:\Windows\System\jdmNfbM.exe
  2⤵
  PID:11956
- C:\Windows\System\VKhRgjf.exe
  C:\Windows\System\VKhRgjf.exe
  2⤵
  PID:11980
- C:\Windows\System\deoMkHc.exe
  C:\Windows\System\deoMkHc.exe
  2⤵
  PID:12008
- C:\Windows\System\akjOxpS.exe
  C:\Windows\System\akjOxpS.exe
  2⤵
  PID:12028
- C:\Windows\System\vSqlHOv.exe
  C:\Windows\System\vSqlHOv.exe
  2⤵
  PID:12052
- C:\Windows\System\yzCFImY.exe
  C:\Windows\System\yzCFImY.exe
  2⤵
  PID:12076
- C:\Windows\System\kGsWqKx.exe
  C:\Windows\System\kGsWqKx.exe
  2⤵
  PID:12104
- C:\Windows\System\iOuyCdc.exe
  C:\Windows\System\iOuyCdc.exe
  2⤵
  PID:12132
- C:\Windows\System\xwbIOVN.exe
  C:\Windows\System\xwbIOVN.exe
  2⤵
  PID:12156
- C:\Windows\System\UPQfUAK.exe
  C:\Windows\System\UPQfUAK.exe
  2⤵
  PID:12176
- C:\Windows\System\xeaEMaO.exe
  C:\Windows\System\xeaEMaO.exe
  2⤵
  PID:12204
- C:\Windows\System\XqpzJSO.exe
  C:\Windows\System\XqpzJSO.exe
  2⤵
  PID:12224
- C:\Windows\System\mtyiHdO.exe
  C:\Windows\System\mtyiHdO.exe
  2⤵
  PID:12252
- C:\Windows\System\ZztCJcC.exe
  C:\Windows\System\ZztCJcC.exe
  2⤵
  PID:11176
- C:\Windows\System\KlGtsli.exe
  C:\Windows\System\KlGtsli.exe
  2⤵
  PID:11296
- C:\Windows\System\GtwKgsk.exe
  C:\Windows\System\GtwKgsk.exe
  2⤵
  PID:11344
- C:\Windows\System\ALfazRW.exe
  C:\Windows\System\ALfazRW.exe
  2⤵
  PID:11452
- C:\Windows\System\OsuwZtf.exe
  C:\Windows\System\OsuwZtf.exe
  2⤵
  PID:11508
- C:\Windows\System\OETRava.exe
  C:\Windows\System\OETRava.exe
  2⤵
  PID:11576
- C:\Windows\System\NtzGqkV.exe
  C:\Windows\System\NtzGqkV.exe
  2⤵
  PID:11644
- C:\Windows\System\TCtjURh.exe
  C:\Windows\System\TCtjURh.exe
  2⤵
  PID:11672
- C:\Windows\System\thCpezX.exe
  C:\Windows\System\thCpezX.exe
  2⤵
  PID:11760
- C:\Windows\System\TOKFxBa.exe
  C:\Windows\System\TOKFxBa.exe
  2⤵
  PID:11852
- C:\Windows\System\mUWsRYy.exe
  C:\Windows\System\mUWsRYy.exe
  2⤵
  PID:11912
- C:\Windows\System\OrTPATw.exe
  C:\Windows\System\OrTPATw.exe
  2⤵
  PID:11972
- C:\Windows\System\WmmWpko.exe
  C:\Windows\System\WmmWpko.exe
  2⤵
  PID:12020
- C:\Windows\System\qGiEjVI.exe
  C:\Windows\System\qGiEjVI.exe
  2⤵
  PID:12100
- C:\Windows\System\MuVUfQm.exe
  C:\Windows\System\MuVUfQm.exe
  2⤵
  PID:12124
- C:\Windows\System\Qvdbvtz.exe
  C:\Windows\System\Qvdbvtz.exe
  2⤵
  PID:12272
- C:\Windows\System\stNSpwk.exe
  C:\Windows\System\stNSpwk.exe
  2⤵
  PID:9800
- C:\Windows\System\SiVrRPa.exe
  C:\Windows\System\SiVrRPa.exe
  2⤵
  PID:10896
- C:\Windows\System\xQQazVF.exe
  C:\Windows\System\xQQazVF.exe
  2⤵
  PID:1608
- C:\Windows\System\zsWFZJO.exe
  C:\Windows\System\zsWFZJO.exe
  2⤵
  PID:11488
- C:\Windows\System\odSeehY.exe
  C:\Windows\System\odSeehY.exe
  2⤵
  PID:11716
- C:\Windows\System\hMpBEPJ.exe
  C:\Windows\System\hMpBEPJ.exe
  2⤵
  PID:11824
- C:\Windows\System\wTppyZG.exe
  C:\Windows\System\wTppyZG.exe
  2⤵
  PID:11952
- C:\Windows\System\joLAfgq.exe
  C:\Windows\System\joLAfgq.exe
  2⤵
  PID:12064
- C:\Windows\System\bgptDnt.exe
  C:\Windows\System\bgptDnt.exe
  2⤵
  PID:12188
- C:\Windows\System\EXocVST.exe
  C:\Windows\System\EXocVST.exe
  2⤵
  PID:2268
- C:\Windows\System\xyZkICi.exe
  C:\Windows\System\xyZkICi.exe
  2⤵
  PID:11712
- C:\Windows\System\CVhIuAn.exe
  C:\Windows\System\CVhIuAn.exe
  2⤵
  PID:11888
- C:\Windows\System\xQtpYsY.exe
  C:\Windows\System\xQtpYsY.exe
  2⤵
  PID:11376
- C:\Windows\System\cMWqIHn.exe
  C:\Windows\System\cMWqIHn.exe
  2⤵
  PID:11276
- C:\Windows\System\PqnzJnu.exe
  C:\Windows\System\PqnzJnu.exe
  2⤵
  PID:12116
- C:\Windows\System\MBdouhs.exe
  C:\Windows\System\MBdouhs.exe
  2⤵
  PID:12316
- C:\Windows\System\ARGCYyI.exe
  C:\Windows\System\ARGCYyI.exe
  2⤵
  PID:12340
- C:\Windows\System\PJVpqPY.exe
  C:\Windows\System\PJVpqPY.exe
  2⤵
  PID:12372
- C:\Windows\System\AAxcpZV.exe
  C:\Windows\System\AAxcpZV.exe
  2⤵
  PID:12392
- C:\Windows\System\pukIGlR.exe
  C:\Windows\System\pukIGlR.exe
  2⤵
  PID:12436
- C:\Windows\System\pWJQqMi.exe
  C:\Windows\System\pWJQqMi.exe
  2⤵
  PID:12460
- C:\Windows\System\FAhvBaZ.exe
  C:\Windows\System\FAhvBaZ.exe
  2⤵
  PID:12492
- C:\Windows\System\wbweKqG.exe
  C:\Windows\System\wbweKqG.exe
  2⤵
  PID:12516
- C:\Windows\System\KnHinIS.exe
  C:\Windows\System\KnHinIS.exe
  2⤵
  PID:12536
- C:\Windows\System\nNVTeqV.exe
  C:\Windows\System\nNVTeqV.exe
  2⤵
  PID:12564
- C:\Windows\System\PkeOHUY.exe
  C:\Windows\System\PkeOHUY.exe
  2⤵
  PID:12604
- C:\Windows\System\ATVCmLJ.exe
  C:\Windows\System\ATVCmLJ.exe
  2⤵
  PID:12620
- C:\Windows\System\XRvCfUu.exe
  C:\Windows\System\XRvCfUu.exe
  2⤵
  PID:12660
- C:\Windows\System\qBgAWOn.exe
  C:\Windows\System\qBgAWOn.exe
  2⤵
  PID:12684
- C:\Windows\System\nepXTMU.exe
  C:\Windows\System\nepXTMU.exe
  2⤵
  PID:12704
- C:\Windows\System\yQgIYZY.exe
  C:\Windows\System\yQgIYZY.exe
  2⤵
  PID:12744
- C:\Windows\System\UwiMGqc.exe
  C:\Windows\System\UwiMGqc.exe
  2⤵
  PID:12768
- C:\Windows\System\JSgiFzc.exe
  C:\Windows\System\JSgiFzc.exe
  2⤵
  PID:12796
- C:\Windows\System\DtuIKJc.exe
  C:\Windows\System\DtuIKJc.exe
  2⤵
  PID:12824
- C:\Windows\System\GTiiPgF.exe
  C:\Windows\System\GTiiPgF.exe
  2⤵
  PID:12908
- C:\Windows\System\lnAzSDK.exe
  C:\Windows\System\lnAzSDK.exe
  2⤵
  PID:1376
- C:\Windows\System\BrRRNDq.exe
  C:\Windows\System\BrRRNDq.exe
  2⤵
  PID:12948
- C:\Windows\System\oTyUnBI.exe
  C:\Windows\System\oTyUnBI.exe
  2⤵
  PID:12968
- C:\Windows\System\SiGbQPa.exe
  C:\Windows\System\SiGbQPa.exe
  2⤵
  PID:12980
- C:\Windows\System\yExbAfE.exe
  C:\Windows\System\yExbAfE.exe
  2⤵
  PID:12988
- C:\Windows\System\FsNPyxs.exe
  C:\Windows\System\FsNPyxs.exe
  2⤵
  PID:13020
- C:\Windows\System\GNJbfrT.exe
  C:\Windows\System\GNJbfrT.exe
  2⤵
  PID:13036
- C:\Windows\System\ZfzHEOP.exe
  C:\Windows\System\ZfzHEOP.exe
  2⤵
  PID:13052
- C:\Windows\System\pLLZCQm.exe
  C:\Windows\System\pLLZCQm.exe
  2⤵
  PID:13068
- C:\Windows\System\Qwhmqdt.exe
  C:\Windows\System\Qwhmqdt.exe
  2⤵
  PID:13080
- C:\Windows\System\VOxgYQZ.exe
  C:\Windows\System\VOxgYQZ.exe
  2⤵
  PID:13084
- C:\Windows\System\FKsDbOI.exe
  C:\Windows\System\FKsDbOI.exe
  2⤵
  PID:13112
- C:\Windows\System\cTygSDO.exe
  C:\Windows\System\cTygSDO.exe
  2⤵
  PID:13120
- C:\Windows\System\HTVqHJQ.exe
  C:\Windows\System\HTVqHJQ.exe
  2⤵
  PID:13232
- C:\Windows\System\bXehNqo.exe
  C:\Windows\System\bXehNqo.exe
  2⤵
  PID:12888
- C:\Windows\System\AVwrRND.exe
  C:\Windows\System\AVwrRND.exe
  2⤵
  PID:4756
- C:\Windows\System\nclUxJs.exe
  C:\Windows\System\nclUxJs.exe
  2⤵
  PID:4792
- C:\Windows\System\IkFckxb.exe
  C:\Windows\System\IkFckxb.exe
  2⤵
  PID:3812
- C:\Windows\System\xJCOUvF.exe
  C:\Windows\System\xJCOUvF.exe
  2⤵
  PID:13148
- C:\Windows\System\iHGpXCQ.exe
  C:\Windows\System\iHGpXCQ.exe
  2⤵
  PID:12912
- C:\Windows\System\LWtcgFK.exe
  C:\Windows\System\LWtcgFK.exe
  2⤵
  PID:13216
- C:\Windows\System\zhrjuzK.exe
  C:\Windows\System\zhrjuzK.exe
  2⤵
  PID:11884
- C:\Windows\System\bUTpIRz.exe
  C:\Windows\System\bUTpIRz.exe
  2⤵
  PID:2164
- C:\Windows\System\uIDADOe.exe
  C:\Windows\System\uIDADOe.exe
  2⤵
  PID:2064
- C:\Windows\System\VoZgzyy.exe
  C:\Windows\System\VoZgzyy.exe
  2⤵
  PID:12636
- C:\Windows\System\nBibeZx.exe
  C:\Windows\System\nBibeZx.exe
  2⤵
  PID:12676
- C:\Windows\System\nwyPWFM.exe
  C:\Windows\System\nwyPWFM.exe
  2⤵
  PID:12740
- C:\Windows\System\jjEyOWd.exe
  C:\Windows\System\jjEyOWd.exe
  2⤵
  PID:12720
- C:\Windows\System\ZSSUWwe.exe
  C:\Windows\System\ZSSUWwe.exe
  2⤵
  PID:12616
- C:\Windows\System\vQCeocH.exe
  C:\Windows\System\vQCeocH.exe
  2⤵
  PID:12820
- C:\Windows\System\EPkrdkg.exe
  C:\Windows\System\EPkrdkg.exe
  2⤵
  PID:5176
- C:\Windows\System\PksQucY.exe
  C:\Windows\System\PksQucY.exe
  2⤵
  PID:12964
- C:\Windows\System\pkszVIg.exe
  C:\Windows\System\pkszVIg.exe
  2⤵
  PID:4652
- C:\Windows\System\aVbDBYC.exe
  C:\Windows\System\aVbDBYC.exe
  2⤵
  PID:13136
- C:\Windows\System\XrYJNGh.exe
  C:\Windows\System\XrYJNGh.exe
  2⤵
  PID:13160
- C:\Windows\System\clmDmav.exe
  C:\Windows\System\clmDmav.exe
  2⤵
  PID:13240
- C:\Windows\System\zxWGDoT.exe
  C:\Windows\System\zxWGDoT.exe
  2⤵
  PID:5508
- C:\Windows\System\OcyUYAw.exe
  C:\Windows\System\OcyUYAw.exe
  2⤵
  PID:13268
- C:\Windows\System\wCogdQA.exe
  C:\Windows\System\wCogdQA.exe
  2⤵
  PID:13244
- C:\Windows\System\YJiamNG.exe
  C:\Windows\System\YJiamNG.exe
  2⤵
  PID:13280
- C:\Windows\System\iTmhZBQ.exe
  C:\Windows\System\iTmhZBQ.exe
  2⤵
  PID:5628
- C:\Windows\System\WhLVqKj.exe
  C:\Windows\System\WhLVqKj.exe
  2⤵
  PID:12360
- C:\Windows\System\cIhPlNk.exe
  C:\Windows\System\cIhPlNk.exe
  2⤵
  PID:3612
- C:\Windows\System\XaJDSgL.exe
  C:\Windows\System\XaJDSgL.exe
  2⤵
  PID:12420
- C:\Windows\System\eJsQIrD.exe
  C:\Windows\System\eJsQIrD.exe
  2⤵
  PID:12456
- C:\Windows\System\NMsJQTl.exe
  C:\Windows\System\NMsJQTl.exe
  2⤵
  PID:4296
- C:\Windows\System\DCUbKOS.exe
  C:\Windows\System\DCUbKOS.exe
  2⤵
  PID:5804
- C:\Windows\System\hIgwjyI.exe
  C:\Windows\System\hIgwjyI.exe
  2⤵
  PID:12488
- C:\Windows\System\ZISiHkn.exe
  C:\Windows\System\ZISiHkn.exe
  2⤵
  PID:12508
- C:\Windows\System\nwbNPby.exe
  C:\Windows\System\nwbNPby.exe
  2⤵
  PID:3140
- C:\Windows\System\FnMeqCP.exe
  C:\Windows\System\FnMeqCP.exe
  2⤵
  PID:3924
- C:\Windows\System\ppstIRl.exe
  C:\Windows\System\ppstIRl.exe
  2⤵
  PID:4704
- C:\Windows\System\oUpSKya.exe
  C:\Windows\System\oUpSKya.exe
  2⤵
  PID:1020
- C:\Windows\System\sSbLVGY.exe
  C:\Windows\System\sSbLVGY.exe
  2⤵
  PID:12776
- C:\Windows\System\dwsoXLM.exe
  C:\Windows\System\dwsoXLM.exe
  2⤵
  PID:6128
- C:\Windows\System\jphCQVr.exe
  C:\Windows\System\jphCQVr.exe
  2⤵
  PID:1952
- C:\Windows\System\kXEPHbf.exe
  C:\Windows\System\kXEPHbf.exe
  2⤵
  PID:5208
- C:\Windows\System\zgPYyyb.exe
  C:\Windows\System\zgPYyyb.exe
  2⤵
  PID:1792
- C:\Windows\System\ZCdaXhI.exe
  C:\Windows\System\ZCdaXhI.exe
  2⤵
  PID:5492
- C:\Windows\System\jSDHyQP.exe
  C:\Windows\System\jSDHyQP.exe
  2⤵
  PID:12552
- C:\Windows\System\gyawofT.exe
  C:\Windows\System\gyawofT.exe
  2⤵
  PID:5276
- C:\Windows\System\xoaYNDe.exe
  C:\Windows\System\xoaYNDe.exe
  2⤵
  PID:5664
- C:\Windows\System\vdWLzQW.exe
  C:\Windows\System\vdWLzQW.exe
  2⤵
  PID:12892
- C:\Windows\System\kDNEIFp.exe
  C:\Windows\System\kDNEIFp.exe
  2⤵
  PID:6048
- C:\Windows\System\GIfAUoa.exe
  C:\Windows\System\GIfAUoa.exe
  2⤵
  PID:5296
- C:\Windows\System\PqYLpEi.exe
  C:\Windows\System\PqYLpEi.exe
  2⤵
  PID:3000
- C:\Windows\System\WdgLYvw.exe
  C:\Windows\System\WdgLYvw.exe
  2⤵
  PID:5172
- C:\Windows\System\lEMfCnm.exe
  C:\Windows\System\lEMfCnm.exe
  2⤵
  PID:1912
- C:\Windows\System\bdcuiAI.exe
  C:\Windows\System\bdcuiAI.exe
  2⤵
  PID:868
- C:\Windows\System\BbPHrwr.exe
  C:\Windows\System\BbPHrwr.exe
  2⤵
  PID:8
- C:\Windows\System\VKftlEL.exe
  C:\Windows\System\VKftlEL.exe
  2⤵
  PID:2352
- C:\Windows\System\LLmrDYk.exe
  C:\Windows\System\LLmrDYk.exe
  2⤵
  PID:13048
- C:\Windows\System\ulGYAhR.exe
  C:\Windows\System\ulGYAhR.exe
  2⤵
  PID:624
- C:\Windows\System\iHwYdig.exe
  C:\Windows\System\iHwYdig.exe
  2⤵
  PID:3240
- C:\Windows\System\QcEXuPx.exe
  C:\Windows\System\QcEXuPx.exe
  2⤵
  PID:5344
- C:\Windows\System\VcFkguB.exe
  C:\Windows\System\VcFkguB.exe
  2⤵
  PID:13156
- C:\Windows\System\mtmGKEs.exe
  C:\Windows\System\mtmGKEs.exe
  2⤵
  PID:4724
- C:\Windows\System\EFTGIYY.exe
  C:\Windows\System\EFTGIYY.exe
  2⤵
  PID:13108
- C:\Windows\System\vDzgfQy.exe
  C:\Windows\System\vDzgfQy.exe
  2⤵
  PID:6904
- C:\Windows\System\GVcIwfx.exe
  C:\Windows\System\GVcIwfx.exe
  2⤵
  PID:6952
- C:\Windows\System\zsxwyoi.exe
  C:\Windows\System\zsxwyoi.exe
  2⤵
  PID:7040
- C:\Windows\System\tueaktx.exe
  C:\Windows\System\tueaktx.exe
  2⤵
  PID:13208
- C:\Windows\System\HFaZXYh.exe
  C:\Windows\System\HFaZXYh.exe
  2⤵
  PID:7088
- C:\Windows\System\njUeMwL.exe
  C:\Windows\System\njUeMwL.exe
  2⤵
  PID:6168
- C:\Windows\System\ELdBFqO.exe
  C:\Windows\System\ELdBFqO.exe
  2⤵
  PID:6200
- C:\Windows\System\byDzOxa.exe
  C:\Windows\System\byDzOxa.exe
  2⤵
  PID:6416
- C:\Windows\System\NsjloZs.exe
  C:\Windows\System\NsjloZs.exe
  2⤵
  PID:6328
- C:\Windows\System\wmCkbtI.exe
  C:\Windows\System\wmCkbtI.exe
  2⤵
  PID:1204
- C:\Windows\System\SONzjjD.exe
  C:\Windows\System\SONzjjD.exe
  2⤵
  PID:2060
- C:\Windows\System\qSoIrxJ.exe
  C:\Windows\System\qSoIrxJ.exe
  2⤵
  PID:4148
- C:\Windows\System\YHPaDHR.exe
  C:\Windows\System\YHPaDHR.exe
  2⤵
  PID:13260
- C:\Windows\System\yOwngPf.exe
  C:\Windows\System\yOwngPf.exe
  2⤵
  PID:840
- C:\Windows\System\MuuxSKb.exe
  C:\Windows\System\MuuxSKb.exe
  2⤵
  PID:456
- C:\Windows\System\LUfvftl.exe
  C:\Windows\System\LUfvftl.exe
  2⤵
  PID:6808
- C:\Windows\System\LOXSpdN.exe
  C:\Windows\System\LOXSpdN.exe
  2⤵
  PID:6732
- C:\Windows\System\BjxWRnM.exe
  C:\Windows\System\BjxWRnM.exe
  2⤵
  PID:4788
- C:\Windows\System\QFBniQV.exe
  C:\Windows\System\QFBniQV.exe
  2⤵
  PID:13276
- C:\Windows\System\hEYceMP.exe
  C:\Windows\System\hEYceMP.exe
  2⤵
  PID:12312
- C:\Windows\System\kvNpNZL.exe
  C:\Windows\System\kvNpNZL.exe
  2⤵
  PID:12416
- C:\Windows\System\UPvlGtg.exe
  C:\Windows\System\UPvlGtg.exe
  2⤵
  PID:6992
- C:\Windows\System\oZpOUsG.exe
  C:\Windows\System\oZpOUsG.exe
  2⤵
  PID:5800
- C:\Windows\System\uooyfSg.exe
  C:\Windows\System\uooyfSg.exe
  2⤵
  PID:7192
- C:\Windows\System\BmbLSRl.exe
  C:\Windows\System\BmbLSRl.exe
  2⤵
  PID:7276
- C:\Windows\System\OMhUbVI.exe
  C:\Windows\System\OMhUbVI.exe
  2⤵
  PID:5584
- C:\Windows\System\waoPIpy.exe
  C:\Windows\System\waoPIpy.exe
  2⤵
  PID:7412
- C:\Windows\System\CXQIfKV.exe
  C:\Windows\System\CXQIfKV.exe
  2⤵
  PID:1028
- C:\Windows\System\UApAjxT.exe
  C:\Windows\System\UApAjxT.exe
  2⤵
  PID:6068
- C:\Windows\System\CUZwOqt.exe
  C:\Windows\System\CUZwOqt.exe
  2⤵
  PID:7848
- C:\Windows\System\JAySzkV.exe
  C:\Windows\System\JAySzkV.exe
  2⤵
  PID:7936
- C:\Windows\System\PXSSTeq.exe
  C:\Windows\System\PXSSTeq.exe
  2⤵
  PID:12548
- C:\Windows\System\xKHwnRO.exe
  C:\Windows\System\xKHwnRO.exe
  2⤵
  PID:8184
- C:\Windows\System\QNAIlnx.exe
  C:\Windows\System\QNAIlnx.exe
  2⤵
  PID:7268
- C:\Windows\System\XBgudUr.exe
  C:\Windows\System\XBgudUr.exe
  2⤵
  PID:1016
- C:\Windows\System\fajGWig.exe
  C:\Windows\System\fajGWig.exe
  2⤵
  PID:12472
- C:\Windows\System\aYTowht.exe
  C:\Windows\System\aYTowht.exe
  2⤵
  PID:2880
- C:\Windows\System\zEaGJiF.exe
  C:\Windows\System\zEaGJiF.exe
  2⤵
  PID:3272
- C:\Windows\System\IHOGlIN.exe
  C:\Windows\System\IHOGlIN.exe
  2⤵
  PID:5936
- C:\Windows\System\NohwqqG.exe
  C:\Windows\System\NohwqqG.exe
  2⤵
  PID:6136
- C:\Windows\System\xvYKBzG.exe
  C:\Windows\System\xvYKBzG.exe
  2⤵
  PID:1992
- C:\Windows\System\fDLEyZw.exe
  C:\Windows\System\fDLEyZw.exe
  2⤵
  PID:7184
- C:\Windows\System\IEmRvuk.exe
  C:\Windows\System\IEmRvuk.exe
  2⤵
  PID:3252
- C:\Windows\System\iFtCcFB.exe
  C:\Windows\System\iFtCcFB.exe
  2⤵
  PID:2072
- C:\Windows\System\hcRaELw.exe
  C:\Windows\System\hcRaELw.exe
  2⤵
  PID:8436
- C:\Windows\System\tiNEUhM.exe
  C:\Windows\System\tiNEUhM.exe
  2⤵
  PID:6848
- C:\Windows\System\yXQosZI.exe
  C:\Windows\System\yXQosZI.exe
  2⤵
  PID:8484
- C:\Windows\System\PEFTTTb.exe
  C:\Windows\System\PEFTTTb.exe
  2⤵
  PID:4656
- C:\Windows\System\lUHNrzq.exe
  C:\Windows\System\lUHNrzq.exe
  2⤵
  PID:6896
- C:\Windows\System\mYHxXaf.exe
  C:\Windows\System\mYHxXaf.exe
  2⤵
  PID:8608
- C:\Windows\System\pykgGib.exe
  C:\Windows\System\pykgGib.exe
  2⤵
  PID:8676
- C:\Windows\System\xaYaqYr.exe
  C:\Windows\System\xaYaqYr.exe
  2⤵
  PID:12532
- C:\Windows\System\AEflLiC.exe
  C:\Windows\System\AEflLiC.exe
  2⤵
  PID:6908
- C:\Windows\System\IuccuII.exe
  C:\Windows\System\IuccuII.exe
  2⤵
  PID:8908
- C:\Windows\System\VwxjFnN.exe
  C:\Windows\System\VwxjFnN.exe
  2⤵
  PID:7112
- C:\Windows\System\JYmRuQA.exe
  C:\Windows\System\JYmRuQA.exe
  2⤵
  PID:6164
- C:\Windows\System\SJDcXIC.exe
  C:\Windows\System\SJDcXIC.exe
  2⤵
  PID:6384
- C:\Windows\System\zKuvPJC.exe
  C:\Windows\System\zKuvPJC.exe
  2⤵
  PID:4504
- C:\Windows\System\WqKnGcy.exe
  C:\Windows\System\WqKnGcy.exe
  2⤵
  PID:8240
- C:\Windows\System\efPwbRQ.exe
  C:\Windows\System\efPwbRQ.exe
  2⤵
  PID:4800
- C:\Windows\System\fRxctNq.exe
  C:\Windows\System\fRxctNq.exe
  2⤵
  PID:8596
- C:\Windows\System\mtyeVoE.exe
  C:\Windows\System\mtyeVoE.exe
  2⤵
  PID:12956
- C:\Windows\System\gBTqNCe.exe
  C:\Windows\System\gBTqNCe.exe
  2⤵
  PID:380
- C:\Windows\System\cbblyTc.exe
  C:\Windows\System\cbblyTc.exe
  2⤵
  PID:6152
- C:\Windows\System\XHNLwYN.exe
  C:\Windows\System\XHNLwYN.exe
  2⤵
  PID:6592
- C:\Windows\System\cXMgeWw.exe
  C:\Windows\System\cXMgeWw.exe
  2⤵
  PID:1360
- C:\Windows\System\xefJAHC.exe
  C:\Windows\System\xefJAHC.exe
  2⤵
  PID:7012
- C:\Windows\System\Dthmjdg.exe
  C:\Windows\System\Dthmjdg.exe
  2⤵
  PID:2504
- C:\Windows\System\OUnpoQn.exe
  C:\Windows\System\OUnpoQn.exe
  2⤵
  PID:12400
- C:\Windows\System\rXlRpWP.exe
  C:\Windows\System\rXlRpWP.exe
  2⤵
  PID:6580
- C:\Windows\System\FoXNdgr.exe
  C:\Windows\System\FoXNdgr.exe
  2⤵
  PID:7228
- C:\Windows\System\jNUvRMF.exe
  C:\Windows\System\jNUvRMF.exe
  2⤵
  PID:7244
- C:\Windows\System\tVwMsUo.exe
  C:\Windows\System\tVwMsUo.exe
  2⤵
  PID:1276
- C:\Windows\System\RnGIvog.exe
  C:\Windows\System\RnGIvog.exe
  2⤵
  PID:5084
- C:\Windows\System\gzRuiKf.exe
  C:\Windows\System\gzRuiKf.exe
  2⤵
  PID:9336
- C:\Windows\System\ZhfySjR.exe
  C:\Windows\System\ZhfySjR.exe
  2⤵
  PID:1672
- C:\Windows\System\cezKdsu.exe
  C:\Windows\System\cezKdsu.exe
  2⤵
  PID:4808
- C:\Windows\System\pxLpvrH.exe
  C:\Windows\System\pxLpvrH.exe
  2⤵
  PID:12300
- C:\Windows\System\VvPUqmj.exe
  C:\Windows\System\VvPUqmj.exe
  2⤵
  PID:4336
- C:\Windows\System\KcUMbah.exe
  C:\Windows\System\KcUMbah.exe
  2⤵
  PID:7588
- C:\Windows\System\QafaJpp.exe
  C:\Windows\System\QafaJpp.exe
  2⤵
  PID:1668
- C:\Windows\System\qhGPQuy.exe
  C:\Windows\System\qhGPQuy.exe
  2⤵
  PID:9636
- C:\Windows\System\ydSDElT.exe
  C:\Windows\System\ydSDElT.exe
  2⤵
  PID:2204
- C:\Windows\System\icUKZJx.exe
  C:\Windows\System\icUKZJx.exe
  2⤵
  PID:8112
- C:\Windows\System\AViBGzz.exe
  C:\Windows\System\AViBGzz.exe
  2⤵
  PID:5468
- C:\Windows\System\peSBWDO.exe
  C:\Windows\System\peSBWDO.exe
  2⤵
  PID:5028
- C:\Windows\System\aOTUIKM.exe
  C:\Windows\System\aOTUIKM.exe
  2⤵
  PID:10028
- C:\Windows\System\qnnXeVn.exe
  C:\Windows\System\qnnXeVn.exe
  2⤵
  PID:1744
- C:\Windows\System\qEQzdFH.exe
  C:\Windows\System\qEQzdFH.exe
  2⤵
  PID:3512
- C:\Windows\System\IlDJGKt.exe
  C:\Windows\System\IlDJGKt.exe
  2⤵
  PID:10128
- C:\Windows\System\uuCwdly.exe
  C:\Windows\System\uuCwdly.exe
  2⤵
  PID:5764
- C:\Windows\System\TSDAutw.exe
  C:\Windows\System\TSDAutw.exe
  2⤵
  PID:10200
- C:\Windows\System\SXyJiWp.exe
  C:\Windows\System\SXyJiWp.exe
  2⤵
  PID:10228
- C:\Windows\System\PHzrRnD.exe
  C:\Windows\System\PHzrRnD.exe
  2⤵
  PID:9300
- C:\Windows\System\qFdKBLX.exe
  C:\Windows\System\qFdKBLX.exe
  2⤵
  PID:2300
- C:\Windows\System\JBXrAzc.exe
  C:\Windows\System\JBXrAzc.exe
  2⤵
  PID:5300
- C:\Windows\System\wzozXPB.exe
  C:\Windows\System\wzozXPB.exe
  2⤵
  PID:6072
- C:\Windows\System\qktMvAh.exe
  C:\Windows\System\qktMvAh.exe
  2⤵
  PID:5768
- C:\Windows\System\UZKHstY.exe
  C:\Windows\System\UZKHstY.exe
  2⤵
  PID:3444
- C:\Windows\System\btFdpDn.exe
  C:\Windows\System\btFdpDn.exe
  2⤵
  PID:12900
- C:\Windows\System\enOxgNK.exe
  C:\Windows\System\enOxgNK.exe
  2⤵
  PID:4348
- C:\Windows\System\HMSwCWK.exe
  C:\Windows\System\HMSwCWK.exe
  2⤵
  PID:8148
- C:\Windows\System\Bqhnrhz.exe
  C:\Windows\System\Bqhnrhz.exe
  2⤵
  PID:5372
- C:\Windows\System\ZgeUdfq.exe
  C:\Windows\System\ZgeUdfq.exe
  2⤵
  PID:10208
- C:\Windows\System\mrmimBf.exe
  C:\Windows\System\mrmimBf.exe
  2⤵
  PID:7368
- C:\Windows\System\OvStNZk.exe
  C:\Windows\System\OvStNZk.exe
  2⤵
  PID:9400
- C:\Windows\System\UzDuMpX.exe
  C:\Windows\System\UzDuMpX.exe
  2⤵
  PID:7576
- C:\Windows\System\jGSxhvE.exe
  C:\Windows\System\jGSxhvE.exe
  2⤵
  PID:9736
- C:\Windows\System\YUNBSHL.exe
  C:\Windows\System\YUNBSHL.exe
  2⤵
  PID:4716
- C:\Windows\System\qAUuRUS.exe
  C:\Windows\System\qAUuRUS.exe
  2⤵
  PID:5428
- C:\Windows\System\lQRWPPp.exe
  C:\Windows\System\lQRWPPp.exe
  2⤵
  PID:10224
- C:\Windows\System\UPJqNJX.exe
  C:\Windows\System\UPJqNJX.exe
  2⤵
  PID:2076
- C:\Windows\System\FMPYqoC.exe
  C:\Windows\System\FMPYqoC.exe
  2⤵
  PID:1400
- C:\Windows\System\rLQPvnK.exe
  C:\Windows\System\rLQPvnK.exe
  2⤵
  PID:5640
- C:\Windows\System\HopXAVT.exe
  C:\Windows\System\HopXAVT.exe
  2⤵
  PID:13104
- C:\Windows\System\YGPkZTV.exe
  C:\Windows\System\YGPkZTV.exe
  2⤵
  PID:5712
- C:\Windows\System\KiKePNx.exe
  C:\Windows\System\KiKePNx.exe
  2⤵
  PID:10356
- C:\Windows\System\rBDbWjS.exe
  C:\Windows\System\rBDbWjS.exe
  2⤵
  PID:12972
- C:\Windows\System\nHfxeYV.exe
  C:\Windows\System\nHfxeYV.exe
  2⤵
  PID:2732
- C:\Windows\System\IsQaaOI.exe
  C:\Windows\System\IsQaaOI.exe
  2⤵
  PID:5856
- C:\Windows\System\ZsxxorW.exe
  C:\Windows\System\ZsxxorW.exe
  2⤵
  PID:10536
- C:\Windows\System\NaTKted.exe
  C:\Windows\System\NaTKted.exe
  2⤵
  PID:13128
- C:\Windows\System\taGGxxd.exe
  C:\Windows\System\taGGxxd.exe
  2⤵
  PID:6052
- C:\Windows\System\MQXwgwx.exe
  C:\Windows\System\MQXwgwx.exe
  2⤵
  PID:6832
- C:\Windows\System\BJZMJlc.exe
  C:\Windows\System\BJZMJlc.exe
  2⤵
  PID:8712
- C:\Windows\System\jjZKpcE.exe
  C:\Windows\System\jjZKpcE.exe
  2⤵
  PID:10728
- C:\Windows\System\jeGMjPw.exe
  C:\Windows\System\jeGMjPw.exe
  2⤵
  PID:6980
- C:\Windows\System\qpqkdwq.exe
  C:\Windows\System\qpqkdwq.exe
  2⤵
  PID:3264
- C:\Windows\System\dZdtQLN.exe
  C:\Windows\System\dZdtQLN.exe
  2⤵
  PID:5072
- C:\Windows\System\xgBsJqt.exe
  C:\Windows\System\xgBsJqt.exe
  2⤵
  PID:4908
- C:\Windows\System\lzNhUiZ.exe
  C:\Windows\System\lzNhUiZ.exe
  2⤵
  PID:6240
- C:\Windows\System\TcSghgD.exe
  C:\Windows\System\TcSghgD.exe
  2⤵
  PID:6016
- C:\Windows\System\HjEZuYP.exe
  C:\Windows\System\HjEZuYP.exe
  2⤵
  PID:3472
- C:\Windows\System\FzQehTw.exe
  C:\Windows\System\FzQehTw.exe
  2⤵
  PID:5716
- C:\Windows\System\LZrXtDP.exe
  C:\Windows\System\LZrXtDP.exe
  2⤵
  PID:6684
- C:\Windows\System\rnizIUH.exe
  C:\Windows\System\rnizIUH.exe
  2⤵
  PID:8660
- C:\Windows\System\XDHkbKc.exe
  C:\Windows\System\XDHkbKc.exe
  2⤵
  PID:9136
- C:\Windows\System\iyjTVJm.exe
  C:\Windows\System\iyjTVJm.exe
  2⤵
  PID:812
- C:\Windows\System\xpZFxul.exe
  C:\Windows\System\xpZFxul.exe
  2⤵
  PID:11232
- C:\Windows\System\ekNTlEe.exe
  C:\Windows\System\ekNTlEe.exe
  2⤵
  PID:920
- C:\Windows\System\DgntERO.exe
  C:\Windows\System\DgntERO.exe
  2⤵
  PID:10660
- C:\Windows\System\WRQoxRP.exe
  C:\Windows\System\WRQoxRP.exe
  2⤵
  PID:6460
- C:\Windows\System\GVaFRYg.exe
  C:\Windows\System\GVaFRYg.exe
  2⤵
  PID:4328
- C:\Windows\System\pWipFkr.exe
  C:\Windows\System\pWipFkr.exe
  2⤵
  PID:13164
- C:\Windows\System\ezegMQi.exe
  C:\Windows\System\ezegMQi.exe
  2⤵
  PID:6572
- C:\Windows\System\fmEUduO.exe
  C:\Windows\System\fmEUduO.exe
  2⤵
  PID:6700
- C:\Windows\System\PfvKHir.exe
  C:\Windows\System\PfvKHir.exe
  2⤵
  PID:11464
- C:\Windows\System\jVaDoiE.exe
  C:\Windows\System\jVaDoiE.exe
  2⤵
  PID:12788
- C:\Windows\System\LGHJxzm.exe
  C:\Windows\System\LGHJxzm.exe
  2⤵
  PID:11536
- C:\Windows\System\HJzOJnH.exe
  C:\Windows\System\HJzOJnH.exe
  2⤵
  PID:11568
- C:\Windows\System\honXbGr.exe
  C:\Windows\System\honXbGr.exe
  2⤵
  PID:6776
- C:\Windows\System\gRqoXBs.exe
  C:\Windows\System\gRqoXBs.exe
  2⤵
  PID:6796
- C:\Windows\System\xmrRoDt.exe
  C:\Windows\System\xmrRoDt.exe
  2⤵
  PID:6800
- C:\Windows\System\khGaKQH.exe
  C:\Windows\System\khGaKQH.exe
  2⤵
  PID:6772
- C:\Windows\System\HqHZDdk.exe
  C:\Windows\System\HqHZDdk.exe
  2⤵
  PID:11740
- C:\Windows\System\RWNxhiv.exe
  C:\Windows\System\RWNxhiv.exe
  2⤵
  PID:6900
- C:\Windows\System\woTNGAw.exe
  C:\Windows\System\woTNGAw.exe
  2⤵
  PID:11840
- C:\Windows\System\pXzIXGB.exe
  C:\Windows\System\pXzIXGB.exe
  2⤵
  PID:9820
- C:\Windows\System\ARDXuxd.exe
  C:\Windows\System\ARDXuxd.exe
  2⤵
  PID:12324
- C:\Windows\System\dqRYBEh.exe
  C:\Windows\System\dqRYBEh.exe
  2⤵
  PID:11964
- C:\Windows\System\RVvrmzp.exe
  C:\Windows\System\RVvrmzp.exe
  2⤵
  PID:10004
- C:\Windows\System\XbRQnKL.exe
  C:\Windows\System\XbRQnKL.exe
  2⤵
  PID:900
- C:\Windows\System\IrMHQDw.exe
  C:\Windows\System\IrMHQDw.exe
  2⤵
  PID:12060
- C:\Windows\System\hNJOLLH.exe
  C:\Windows\System\hNJOLLH.exe
  2⤵
  PID:12164
- C:\Windows\System\RJNHwVd.exe
  C:\Windows\System\RJNHwVd.exe
  2⤵
  PID:12640
- C:\Windows\System\nIjgOYK.exe
  C:\Windows\System\nIjgOYK.exe
  2⤵
  PID:12276
- C:\Windows\System\LaaVQka.exe
  C:\Windows\System\LaaVQka.exe
  2⤵
  PID:12848
- C:\Windows\System\tbUclZs.exe
  C:\Windows\System\tbUclZs.exe
  2⤵
  PID:1344
- C:\Windows\System\gfHTvWJ.exe
  C:\Windows\System\gfHTvWJ.exe
  2⤵
  PID:3096
- C:\Windows\System\IqxaqNJ.exe
  C:\Windows\System\IqxaqNJ.exe
  2⤵
  PID:6516
- C:\Windows\System\LBBDeBM.exe
  C:\Windows\System\LBBDeBM.exe
  2⤵
  PID:11876
- C:\Windows\System\ArFOGHb.exe
  C:\Windows\System\ArFOGHb.exe
  2⤵
  PID:1736
- C:\Windows\System\XLMEyrw.exe
  C:\Windows\System\XLMEyrw.exe
  2⤵
  PID:12048
- C:\Windows\System\HFaiJOE.exe
  C:\Windows\System\HFaiJOE.exe
  2⤵
  PID:6872
- C:\Windows\System\JyjJSSm.exe
  C:\Windows\System\JyjJSSm.exe
  2⤵
  PID:6916
- C:\Windows\System\UgAZxfE.exe
  C:\Windows\System\UgAZxfE.exe
  2⤵
  PID:12148
- C:\Windows\System\FlRtlcP.exe
  C:\Windows\System\FlRtlcP.exe
  2⤵
  PID:6400
- C:\Windows\System\XNejtxL.exe
  C:\Windows\System\XNejtxL.exe
  2⤵
  PID:6628
- C:\Windows\System\EHKGYRg.exe
  C:\Windows\System\EHKGYRg.exe
  2⤵
  PID:9684
- C:\Windows\System\IncXgRg.exe
  C:\Windows\System\IncXgRg.exe
  2⤵
  PID:9764
- C:\Windows\System\TGxUMZy.exe
  C:\Windows\System\TGxUMZy.exe
  2⤵
  PID:6308
- C:\Windows\System\sZrnchb.exe
  C:\Windows\System\sZrnchb.exe
  2⤵
  PID:9964
- C:\Windows\System\HHodHIW.exe
  C:\Windows\System\HHodHIW.exe
  2⤵
  PID:6844
- C:\Windows\System\SzzuEHm.exe
  C:\Windows\System\SzzuEHm.exe
  2⤵
  PID:12936
- C:\Windows\System\YgFMdda.exe
  C:\Windows\System\YgFMdda.exe
  2⤵
  PID:6396
- C:\Windows\System\fKoJrQf.exe
  C:\Windows\System\fKoJrQf.exe
  2⤵
  PID:5264
- C:\Windows\System\AliBqKP.exe
  C:\Windows\System\AliBqKP.exe
  2⤵
  PID:8588
- C:\Windows\System\mmpjotG.exe
  C:\Windows\System\mmpjotG.exe
  2⤵
  PID:5364
- C:\Windows\System\iIqQyRU.exe
  C:\Windows\System\iIqQyRU.exe
  2⤵
  PID:11624
- C:\Windows\System\NVeflqY.exe
  C:\Windows\System\NVeflqY.exe
  2⤵
  PID:3952
- C:\Windows\System\wrCoQjS.exe
  C:\Windows\System\wrCoQjS.exe
  2⤵
  PID:12348
- C:\Windows\System\QkKPdNS.exe
  C:\Windows\System\QkKPdNS.exe
  2⤵
  PID:12444
- C:\Windows\System\InnMfpB.exe
  C:\Windows\System\InnMfpB.exe
  2⤵
  PID:7492
- C:\Windows\System\CsNAhaL.exe
  C:\Windows\System\CsNAhaL.exe
  2⤵
  PID:7616
- C:\Windows\System\tOfBBOa.exe
  C:\Windows\System\tOfBBOa.exe
  2⤵
  PID:7560
- C:\Windows\System\bwiDSVi.exe
  C:\Windows\System\bwiDSVi.exe
  2⤵
  PID:9268
- C:\Windows\System\XQBolVV.exe
  C:\Windows\System\XQBolVV.exe
  2⤵
  PID:12628
- C:\Windows\System\MEZNMXF.exe
  C:\Windows\System\MEZNMXF.exe
  2⤵
  PID:5080
- C:\Windows\System\JLGCvCA.exe
  C:\Windows\System\JLGCvCA.exe
  2⤵
  PID:7736
- C:\Windows\System\eUIPsYG.exe
  C:\Windows\System\eUIPsYG.exe
  2⤵
  PID:7756
- C:\Windows\System\eFhGhqg.exe
  C:\Windows\System\eFhGhqg.exe
  2⤵
  PID:7760
- C:\Windows\System\GtoGQyz.exe
  C:\Windows\System\GtoGQyz.exe
  2⤵
  PID:10268
- C:\Windows\System\FfxMeeB.exe
  C:\Windows\System\FfxMeeB.exe
  2⤵
  PID:12792
- C:\Windows\System\IwBYnwH.exe
  C:\Windows\System\IwBYnwH.exe
  2⤵
  PID:12840
- C:\Windows\System\RwSkIfY.exe
  C:\Windows\System\RwSkIfY.exe
  2⤵
  PID:10348
- C:\Windows\System\oZzEPLv.exe
  C:\Windows\System\oZzEPLv.exe
  2⤵
  PID:12880
- C:\Windows\System\lczPShl.exe
  C:\Windows\System\lczPShl.exe
  2⤵
  PID:8504
- C:\Windows\System\KqIZnqU.exe
  C:\Windows\System\KqIZnqU.exe
  2⤵
  PID:10464
- C:\Windows\System\xQTnpRG.exe
  C:\Windows\System\xQTnpRG.exe
  2⤵
  PID:5912
- C:\Windows\System\KhVhzqE.exe
  C:\Windows\System\KhVhzqE.exe
  2⤵
  PID:5932
- C:\Windows\System\MgUsjgu.exe
  C:\Windows\System\MgUsjgu.exe
  2⤵
  PID:6824
- C:\Windows\System\CCygPVa.exe
  C:\Windows\System\CCygPVa.exe
  2⤵
  PID:5988
- C:\Windows\System\FmIsAXu.exe
  C:\Windows\System\FmIsAXu.exe
  2⤵
  PID:8576
- C:\Windows\System\ixfZDnx.exe
  C:\Windows\System\ixfZDnx.exe
  2⤵
  PID:7584
- C:\Windows\System\FSpPilq.exe
  C:\Windows\System\FSpPilq.exe
  2⤵
  PID:8672
- C:\Windows\System\uVtxNhG.exe
  C:\Windows\System\uVtxNhG.exe
  2⤵
  PID:7796
- C:\Windows\System\tgcBiAG.exe
  C:\Windows\System\tgcBiAG.exe
  2⤵
  PID:10744
- C:\Windows\System\wkdDTyM.exe
  C:\Windows\System\wkdDTyM.exe
  2⤵
  PID:8964
- C:\Windows\System\DYdpqHB.exe
  C:\Windows\System\DYdpqHB.exe
  2⤵
  PID:10836
- C:\Windows\System\kCchTCS.exe
  C:\Windows\System\kCchTCS.exe
  2⤵
  PID:13220
- C:\Windows\System\RkMQfnp.exe
  C:\Windows\System\RkMQfnp.exe
  2⤵
  PID:6216
- C:\Windows\System\gLKikML.exe
  C:\Windows\System\gLKikML.exe
  2⤵
  PID:12388
- C:\Windows\System\LfnxHCz.exe
  C:\Windows\System\LfnxHCz.exe
  2⤵
  PID:4768
- C:\Windows\System\cZykchQ.exe
  C:\Windows\System\cZykchQ.exe
  2⤵
  PID:7912
- C:\Windows\System\ufxZduw.exe
  C:\Windows\System\ufxZduw.exe
  2⤵
  PID:5212
- C:\Windows\System\HcekEpf.exe
  C:\Windows\System\HcekEpf.exe
  2⤵
  PID:7416
- C:\Windows\System\jcSLale.exe
  C:\Windows\System\jcSLale.exe
  2⤵
  PID:8296
- C:\Windows\System\cqUAkmm.exe
  C:\Windows\System\cqUAkmm.exe
  2⤵
  PID:8824
- C:\Windows\System\rFoUmfy.exe
  C:\Windows\System\rFoUmfy.exe
  2⤵
  PID:5556
- C:\Windows\System\kBbBcNf.exe
  C:\Windows\System\kBbBcNf.exe
  2⤵
  PID:6184
- C:\Windows\System\WCutwuh.exe
  C:\Windows\System\WCutwuh.exe
  2⤵
  PID:8704
- C:\Windows\System\nZigebl.exe
  C:\Windows\System\nZigebl.exe
  2⤵
  PID:8740
- C:\Windows\System\zvVGrlb.exe
  C:\Windows\System\zvVGrlb.exe
  2⤵
  PID:9660
- C:\Windows\System\WvMzvTY.exe
  C:\Windows\System\WvMzvTY.exe
  2⤵
  PID:6276
- C:\Windows\System\RezPpRD.exe
  C:\Windows\System\RezPpRD.exe
  2⤵
  PID:8912
- C:\Windows\System\SlmpRKq.exe
  C:\Windows\System\SlmpRKq.exe
  2⤵
  PID:3212
- C:\Windows\System\RooHizH.exe
  C:\Windows\System\RooHizH.exe
  2⤵
  PID:3372
- C:\Windows\System\JMGDgDW.exe
  C:\Windows\System\JMGDgDW.exe
  2⤵
  PID:11552
- C:\Windows\System\yVjaDlr.exe
  C:\Windows\System\yVjaDlr.exe
  2⤵
  PID:13060
- C:\Windows\System\TAIrCKL.exe
  C:\Windows\System\TAIrCKL.exe
  2⤵
  PID:6760
- C:\Windows\System\zfpbymI.exe
  C:\Windows\System\zfpbymI.exe
  2⤵
  PID:1456
- C:\Windows\System\NanUzIK.exe
  C:\Windows\System\NanUzIK.exe
  2⤵
  PID:8668
- C:\Windows\System\MecphBM.exe
  C:\Windows\System\MecphBM.exe
  2⤵
  PID:4324
- C:\Windows\System\ZFvrFSK.exe
  C:\Windows\System\ZFvrFSK.exe
  2⤵
  PID:11880
- C:\Windows\System\iRwwqFm.exe
  C:\Windows\System\iRwwqFm.exe
  2⤵
  PID:5368
- C:\Windows\System\thKRuxB.exe
  C:\Windows\System\thKRuxB.exe
  2⤵
  PID:9052
- C:\Windows\System\jgTaDzD.exe
  C:\Windows\System\jgTaDzD.exe
  2⤵
  PID:10000
- C:\Windows\System\gtKTSeu.exe
  C:\Windows\System\gtKTSeu.exe
  2⤵
  PID:5536
- C:\Windows\System\lBPgQVu.exe
  C:\Windows\System\lBPgQVu.exe
  2⤵
  PID:12192
- C:\Windows\System\xoJwbqP.exe
  C:\Windows\System\xoJwbqP.exe
  2⤵
  PID:10068
- C:\Windows\System\FjerIYa.exe
  C:\Windows\System\FjerIYa.exe
  2⤵
  PID:3420
- C:\Windows\System\yQarMgT.exe
  C:\Windows\System\yQarMgT.exe
  2⤵
  PID:11140
- C:\Windows\System\TdHjIJr.exe
  C:\Windows\System\TdHjIJr.exe
  2⤵
  PID:3080
- C:\Windows\System\ZPmecvk.exe
  C:\Windows\System\ZPmecvk.exe
  2⤵
  PID:2800
- C:\Windows\System\htRioFU.exe
  C:\Windows\System\htRioFU.exe
  2⤵
  PID:5952
- C:\Windows\System\ZTOBaTU.exe
  C:\Windows\System\ZTOBaTU.exe
  2⤵
  PID:9224
- C:\Windows\System\kmYJJVg.exe
  C:\Windows\System\kmYJJVg.exe
  2⤵
  PID:11736
- C:\Windows\System\CuiPXro.exe
  C:\Windows\System\CuiPXro.exe
  2⤵
  PID:9264
- C:\Windows\System\IsBwLDZ.exe
  C:\Windows\System\IsBwLDZ.exe
  2⤵
  PID:11776
- C:\Windows\System\ZtbkfxV.exe
  C:\Windows\System\ZtbkfxV.exe
  2⤵
  PID:9432
- C:\Windows\System\TMzyuKp.exe
  C:\Windows\System\TMzyuKp.exe
  2⤵
  PID:11620
- C:\Windows\System\cFEdztK.exe
  C:\Windows\System\cFEdztK.exe
  2⤵
  PID:9536
- C:\Windows\System\FOebhHp.exe
  C:\Windows\System\FOebhHp.exe
  2⤵
  PID:3348
- C:\Windows\System\EvuKGsQ.exe
  C:\Windows\System\EvuKGsQ.exe
  2⤵
  PID:3108
- C:\Windows\System\lgEmbVo.exe
  C:\Windows\System\lgEmbVo.exe
  2⤵
  PID:6508
- C:\Windows\System\JWxhgQh.exe
  C:\Windows\System\JWxhgQh.exe
  2⤵
  PID:9596
- C:\Windows\System\NnxqEzn.exe
  C:\Windows\System\NnxqEzn.exe
  2⤵
  PID:2140
- C:\Windows\System\zAjsAek.exe
  C:\Windows\System\zAjsAek.exe
  2⤵
  PID:9788
- C:\Windows\System\KfyOpuI.exe
  C:\Windows\System\KfyOpuI.exe
  2⤵
  PID:2568
- C:\Windows\System\TWcHnOr.exe
  C:\Windows\System\TWcHnOr.exe
  2⤵
  PID:9668
- C:\Windows\System\NHHTDJP.exe
  C:\Windows\System\NHHTDJP.exe
  2⤵
  PID:9744
- C:\Windows\System\TRpBeJm.exe
  C:\Windows\System\TRpBeJm.exe
  2⤵
  PID:9844
- C:\Windows\System\qmCJGNn.exe
  C:\Windows\System\qmCJGNn.exe
  2⤵
  PID:7076
- C:\Windows\System\JTflBfF.exe
  C:\Windows\System\JTflBfF.exe
  2⤵
  PID:9916
- C:\Windows\System\vQivwvW.exe
  C:\Windows\System\vQivwvW.exe
  2⤵
  PID:6804
- C:\Windows\System\uAAkcTI.exe
  C:\Windows\System\uAAkcTI.exe
  2⤵
  PID:9928
- C:\Windows\System\LgtGNXF.exe
  C:\Windows\System\LgtGNXF.exe
  2⤵
  PID:1984
- C:\Windows\System\CqQqFtv.exe
  C:\Windows\System\CqQqFtv.exe
  2⤵
  PID:9984
- C:\Windows\System\GRByHzB.exe
  C:\Windows\System\GRByHzB.exe
  2⤵
  PID:9988
- C:\Windows\System\LfUhsuH.exe
  C:\Windows\System\LfUhsuH.exe
  2⤵
  PID:4508
- C:\Windows\System\CbbKDPN.exe
  C:\Windows\System\CbbKDPN.exe
  2⤵
  PID:4840
- C:\Windows\System\SeYoqJj.exe
  C:\Windows\System\SeYoqJj.exe
  2⤵
  PID:5048
- C:\Windows\System\mhchiBD.exe
  C:\Windows\System\mhchiBD.exe
  2⤵
  PID:9120
- C:\Windows\System\MCeijxZ.exe
  C:\Windows\System\MCeijxZ.exe
  2⤵
  PID:1112
- C:\Windows\System\JHRQmdx.exe
  C:\Windows\System\JHRQmdx.exe
  2⤵
  PID:7116
- C:\Windows\System\IAbNhgh.exe
  C:\Windows\System\IAbNhgh.exe
  2⤵
  PID:3448
- C:\Windows\System\XZpBHCl.exe
  C:\Windows\System\XZpBHCl.exe
  2⤵
  PID:3276
- C:\Windows\System\rTwIkzZ.exe
  C:\Windows\System\rTwIkzZ.exe
  2⤵
  PID:9452
- C:\Windows\System\FKJBDXI.exe
  C:\Windows\System\FKJBDXI.exe
  2⤵
  PID:9956
- C:\Windows\System\GfjLOwl.exe
  C:\Windows\System\GfjLOwl.exe
  2⤵
  PID:10008
- C:\Windows\System\mLgWgoP.exe
  C:\Windows\System\mLgWgoP.exe
  2⤵
  PID:9632
- C:\Windows\System\kTMggHt.exe
  C:\Windows\System\kTMggHt.exe
  2⤵
  PID:6696
- C:\Windows\System\osIghwN.exe
  C:\Windows\System\osIghwN.exe
  2⤵
  PID:620
- C:\Windows\System\ffOIKAc.exe
  C:\Windows\System\ffOIKAc.exe
  2⤵
  PID:9804
- C:\Windows\System\PbrznSE.exe
  C:\Windows\System\PbrznSE.exe
  2⤵
  PID:1592
- C:\Windows\System\hWUPcKr.exe
  C:\Windows\System\hWUPcKr.exe
  2⤵
  PID:5232
- C:\Windows\System\EwCfZgN.exe
  C:\Windows\System\EwCfZgN.exe
  2⤵
  PID:5244
- C:\Windows\System\OLDvxBW.exe
  C:\Windows\System\OLDvxBW.exe
  2⤵
  PID:11600
- C:\Windows\System\iSaLqSE.exe
  C:\Windows\System\iSaLqSE.exe
  2⤵
  PID:12000
- C:\Windows\System\ekZxAQB.exe
  C:\Windows\System\ekZxAQB.exe
  2⤵
  PID:3636
- C:\Windows\System\dwBpQsY.exe
  C:\Windows\System\dwBpQsY.exe
  2⤵
  PID:1056
- C:\Windows\System\VrISyWZ.exe
  C:\Windows\System\VrISyWZ.exe
  2⤵
  PID:7360
- C:\Windows\System\JUeVPWI.exe
  C:\Windows\System\JUeVPWI.exe
  2⤵
  PID:3520
- C:\Windows\System\KXYpMZh.exe
  C:\Windows\System\KXYpMZh.exe
  2⤵
  PID:7364
- C:\Windows\System\ixfnCQh.exe
  C:\Windows\System\ixfnCQh.exe
  2⤵
  PID:10084
- C:\Windows\System\UNdsarU.exe
  C:\Windows\System\UNdsarU.exe
  2⤵
  PID:10288
- C:\Windows\System\XLtvqit.exe
  C:\Windows\System\XLtvqit.exe
  2⤵
  PID:10236
- C:\Windows\System\IjsSOVU.exe
  C:\Windows\System\IjsSOVU.exe
  2⤵
  PID:10352
- C:\Windows\System\BLsVNyk.exe
  C:\Windows\System\BLsVNyk.exe
  2⤵
  PID:7472
- C:\Windows\System\EaqtzEj.exe
  C:\Windows\System\EaqtzEj.exe
  2⤵
  PID:2316
- C:\Windows\System\tRMaegk.exe
  C:\Windows\System\tRMaegk.exe
  2⤵
  PID:13024
- C:\Windows\System\AVtTVFM.exe
  C:\Windows\System\AVtTVFM.exe
  2⤵
  PID:5488
- C:\Windows\System\eTTKnoO.exe
  C:\Windows\System\eTTKnoO.exe
  2⤵
  PID:12500
- C:\Windows\System\Fxqewel.exe
  C:\Windows\System\Fxqewel.exe
  2⤵
  PID:10168
- C:\Windows\System\KHOVKyI.exe
  C:\Windows\System\KHOVKyI.exe
  2⤵
  PID:10676
- C:\Windows\System\PHQRCmQ.exe
  C:\Windows\System\PHQRCmQ.exe
  2⤵
  PID:12592
- C:\Windows\System\uFwmnnw.exe
  C:\Windows\System\uFwmnnw.exe
  2⤵
  PID:3292
- C:\Windows\System\ObgDyXJ.exe
  C:\Windows\System\ObgDyXJ.exe
  2⤵
  PID:8332
- C:\Windows\System\YHjxjNO.exe
  C:\Windows\System\YHjxjNO.exe
  2⤵
  PID:7700
- C:\Windows\System\VEymlmQ.exe
  C:\Windows\System\VEymlmQ.exe
  2⤵
  PID:12944
- C:\Windows\System\ZtjPWEs.exe
  C:\Windows\System\ZtjPWEs.exe
  2⤵
  PID:10888
- C:\Windows\System\FTDumwg.exe
  C:\Windows\System\FTDumwg.exe
  2⤵
  PID:8316
- C:\Windows\System\CNAfyQe.exe
  C:\Windows\System\CNAfyQe.exe
  2⤵
  PID:1084
- C:\Windows\System\TifDqcd.exe
  C:\Windows\System\TifDqcd.exe
  2⤵
  PID:12732
- C:\Windows\System\GmAxzgf.exe
  C:\Windows\System\GmAxzgf.exe
  2⤵
  PID:5684
- C:\Windows\System\ZbBPESb.exe
  C:\Windows\System\ZbBPESb.exe
  2⤵
  PID:11060
- C:\Windows\System\iBVlWLm.exe
  C:\Windows\System\iBVlWLm.exe
  2⤵
  PID:7820
- C:\Windows\System\qRIlVOD.exe
  C:\Windows\System\qRIlVOD.exe
  2⤵
  PID:11168
- C:\Windows\System\ucGPHaA.exe
  C:\Windows\System\ucGPHaA.exe
  2⤵
  PID:11132
- C:\Windows\System\HhKLdyi.exe
  C:\Windows\System\HhKLdyi.exe
  2⤵
  PID:11120
- C:\Windows\System\vihITYz.exe
  C:\Windows\System\vihITYz.exe
  2⤵
  PID:11192
- C:\Windows\System\jxnVlDB.exe
  C:\Windows\System\jxnVlDB.exe
  2⤵
  PID:11216
- C:\Windows\System\GMLkMFC.exe
  C:\Windows\System\GMLkMFC.exe
  2⤵
  PID:10604
- C:\Windows\System\fnbHjpz.exe
  C:\Windows\System\fnbHjpz.exe
  2⤵
  PID:10380
- C:\Windows\System\iSBMbHQ.exe
  C:\Windows\System\iSBMbHQ.exe
  2⤵
  PID:10624
- C:\Windows\System\brDVXhj.exe
  C:\Windows\System\brDVXhj.exe
  2⤵
  PID:5868
- C:\Windows\System\nIojmLU.exe
  C:\Windows\System\nIojmLU.exe
  2⤵
  PID:8048
- C:\Windows\System\OYBdNlA.exe
  C:\Windows\System\OYBdNlA.exe
  2⤵
  PID:10772
- C:\Windows\System\uWzljaJ.exe
  C:\Windows\System\uWzljaJ.exe
  2⤵
  PID:6892
- C:\Windows\System\DWgNMDD.exe
  C:\Windows\System\DWgNMDD.exe
  2⤵
  PID:10788
- C:\Windows\System\HFnMKha.exe
  C:\Windows\System\HFnMKha.exe
  2⤵
  PID:10580
- C:\Windows\System\gzUptVR.exe
  C:\Windows\System\gzUptVR.exe
  2⤵
  PID:13188
- C:\Windows\System\UYLqEsI.exe
  C:\Windows\System\UYLqEsI.exe
  2⤵
  PID:7448
- C:\Windows\System\zZzhIzz.exe
  C:\Windows\System\zZzhIzz.exe
  2⤵
  PID:10608
- C:\Windows\System\ZjMVLaX.exe
  C:\Windows\System\ZjMVLaX.exe
  2⤵
  PID:7720
- C:\Windows\System\oibsRkQ.exe
  C:\Windows\System\oibsRkQ.exe
  2⤵
  PID:7544
- C:\Windows\System\ZMedsrQ.exe
  C:\Windows\System\ZMedsrQ.exe
  2⤵
  PID:13172
- C:\Windows\System\enlUjvA.exe
  C:\Windows\System\enlUjvA.exe
  2⤵
  PID:8732
- C:\Windows\System\kkeneZL.exe
  C:\Windows\System\kkeneZL.exe
  2⤵
  PID:8816
- C:\Windows\System\eWdXUXT.exe
  C:\Windows\System\eWdXUXT.exe
  2⤵
  PID:10400
- C:\Windows\System\oUdrCgv.exe
  C:\Windows\System\oUdrCgv.exe
  2⤵
  PID:10120
- C:\Windows\System\JDCwFqc.exe
  C:\Windows\System\JDCwFqc.exe
  2⤵
  PID:7016
- C:\Windows\System\UyiKjwU.exe
  C:\Windows\System\UyiKjwU.exe
  2⤵
  PID:10488
- C:\Windows\System\FFkSpMF.exe
  C:\Windows\System\FFkSpMF.exe
  2⤵
  PID:10820
- C:\Windows\System\HtPZAjB.exe
  C:\Windows\System\HtPZAjB.exe
  2⤵
  PID:3700
- C:\Windows\System\mAfpbbF.exe
  C:\Windows\System\mAfpbbF.exe
  2⤵
  PID:6056
- C:\Windows\System\wmbcBjO.exe
  C:\Windows\System\wmbcBjO.exe
  2⤵
  PID:932
- C:\Windows\System\DmitsCN.exe
  C:\Windows\System\DmitsCN.exe
  2⤵
  PID:7752
- C:\Windows\System\UxzCqtX.exe
  C:\Windows\System\UxzCqtX.exe
  2⤵
  PID:7748
- C:\Windows\System\OVXVQiM.exe
  C:\Windows\System\OVXVQiM.exe
  2⤵
  PID:10916
- C:\Windows\System\FyZRncX.exe
  C:\Windows\System\FyZRncX.exe
  2⤵
  PID:5844
- C:\Windows\System\KmWzBnJ.exe
  C:\Windows\System\KmWzBnJ.exe
  2⤵
  PID:5568
- C:\Windows\System\SckjDcv.exe
  C:\Windows\System\SckjDcv.exe
  2⤵
  PID:11280
- C:\Windows\System\LISHaoY.exe
  C:\Windows\System\LISHaoY.exe
  2⤵
  PID:6444
- C:\Windows\System\pvdXLmb.exe
  C:\Windows\System\pvdXLmb.exe
  2⤵
  PID:12332
- C:\Windows\System\dHxfbrz.exe
  C:\Windows\System\dHxfbrz.exe
  2⤵
  PID:6116
- C:\Windows\System\IwrlDKS.exe
  C:\Windows\System\IwrlDKS.exe
  2⤵
  PID:8204
- C:\Windows\System\vYgWzhx.exe
  C:\Windows\System\vYgWzhx.exe
  2⤵
  PID:13236
- C:\Windows\System\mQktOAC.exe
  C:\Windows\System\mQktOAC.exe
  2⤵
  PID:8884
- C:\Windows\System\FfXQnDM.exe
  C:\Windows\System\FfXQnDM.exe
  2⤵
  PID:8772
- C:\Windows\System\FavJNMF.exe
  C:\Windows\System\FavJNMF.exe
  2⤵
  PID:11368
- C:\Windows\System\HivhuOL.exe
  C:\Windows\System\HivhuOL.exe
  2⤵
  PID:8224
- C:\Windows\System\fnXVlPr.exe
  C:\Windows\System\fnXVlPr.exe
  2⤵
  PID:5840
- C:\Windows\System\YQpWbid.exe
  C:\Windows\System\YQpWbid.exe
  2⤵
  PID:11580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2880 -ip 2880
1⤵
PID:5768

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv QZ3G6KqkCUutaXNw+ySQgw.0.2
1⤵
PID:10264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2x0ceale.35u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BQEOCjc.exe

Filesize
2.4MB

MD5
0a0c282929b14fe762038a0a95ca13cf

SHA1
d917da13829a39f191aeba7771cb06c1ee4869b9

SHA256
9a98b60d306c8f9e22488b953b6927aab3c35fbd53aa5940a69c6a5a54164c92

SHA512
2f35affc0db1d6ccc6ed8a77acdf9c9f5ec0885e81f15885adf1f2e47748a000fa51a24e7d3d5d08a20d847c58041a463fd9acd8f52ac249e26883e41c099c1c

Download Submit
C:\Windows\System\IxljCTZ.exe

Filesize
2.3MB

MD5
a672707857b5137ae293d23d4afab492

SHA1
7483ee6c586822783c0050a8ccf7ce3a86719122

SHA256
6bae4f9013038dab33864a5573e7887b1b9b40480c4b052cc979d50c8812a34e

SHA512
94fc749d533c03918cfc20bc676393be0b52403b408e8b66fde1d76c239d4cb97a4a1e31bb75699239f866f8dddde6f236a4aeb02bf997949830d83e1792e242

Download Submit
C:\Windows\System\KDNlaUD.exe

Filesize
2.4MB

MD5
efee7224d053d857e1715db3cf7a884c

SHA1
d1e16c047e841d23ba793f25500ceabc551aa611

SHA256
f81ee29c86694ade5e6a5b8eec0ebc3b6d0f551bd92c9a47d0332e15d000e420

SHA512
204e6c045bf1de70cd3743a2d89ac38a6d4d9fdefc5533a0324fa25c8ddc1ed6c6ac6567961050c24b9dc5c037d7003fb9819a1a16c2557eff7d2f919ee4dfa8

Download Submit
C:\Windows\System\NiaERbU.exe

Filesize
2.4MB

MD5
641c1ac0498fae73c057050d263d8639

SHA1
c16e8a76a627d25bcc27e23f91832434c6c90210

SHA256
99b18496a9ec476d1f745edb42e7c2fc3bde7799d96639c9c11a8412cc7ebac7

SHA512
6be4e3fcda6881f6c8c4b194eca0b21422f1383beb6f86d65aee179b283983abeef8a4ade9d91fa70826beac742c3ddceed665d17dadca5218bd0c89e8a90a2d

Download Submit
C:\Windows\System\RJUmoSY.exe

Filesize
2.4MB

MD5
b32a51bb94b30c81391b9f330eb54192

SHA1
1d8d98b03b1d41994848a7e669d208a259a81895

SHA256
5d7a082223e96f7c7beaf77eaf7dad47aa35f89359c46d0afe746a1c2c2dfe20

SHA512
b7c62df33736e3f643d80da52a58dfad4de9b134bd6ef0cc828bf0818f7cea6d1727aa0d3f4807441e9d2e26f62dcf2e9758c6438b143d7a61a675edb989f05b

Download Submit
C:\Windows\System\RKNxSnQ.exe

Filesize
2.4MB

MD5
8722ac119425465cb1db0b7114cc4802

SHA1
3998b36558124ec765c7ed19701023618f16771d

SHA256
be577f9e1bbfc5975395c673e7027cd0465ef3047bbfcd83055af3ce9b45697b

SHA512
a90b75c0a80c87095d582c8da557bc15a113a62059ecfdc01c30f5eb979e1ff693d89bc0a52cf32d3fc721fa717c4fe53cc5d0fb4023c5b064b924032b2d2af3

Download Submit
C:\Windows\System\RZSAnyd.exe

Filesize
2.4MB

MD5
ee964c3595c264b26171d04fefa8db17

SHA1
8de585c6d0f0792a6b201b7177704dce9f86e643

SHA256
9213460022589189fc894a2c962ba1d652585575b68145c276453f91a0c1d927

SHA512
3de3d27d81711ddc94f95569d3fb1fc99aacf619e48f11b52067d2b9fdb41677a95659cf595f0ec4d5b4d31e96fbea5dd87250a097bb96cae8a4ff8df6a1f9d3

Download Submit
C:\Windows\System\RwPEgmT.exe

Filesize
2.4MB

MD5
365d2c61ca6a404fa170f091a78e4357

SHA1
cf9aa5e1f2554feff454ce7752e83f167517c525

SHA256
905c9df110a47b424a20f9d4d04d075739cb20c126bb44a58ce84f68c9f25a28

SHA512
72761f960b89c0fa2fc40b760199c0959698b2bebdf147233db359d82240ce8c999670288f9c4ba7f51096a502f91c962e8f6e48a2049f9ba09b12f031784f60

Download Submit
C:\Windows\System\TrPptqK.exe

Filesize
2.4MB

MD5
0a2632f717efbbb58aa09308be72b2a4

SHA1
0606658d23d94905e889bdd731bc3249d10ea4bc

SHA256
ed0451d195a4bc216481efcd8bdec8b26d1af73cf770caa94f16d307b62bd94d

SHA512
582a9fdd7b9d3cb11e88ab6aa06b1bf07a1446e596d5d22bea6da4e6cad1254f7cd9f3e980143244d65c5b4e40931823c0f59060f69380d08195865ad92852d3

Download Submit
C:\Windows\System\USJGKVH.exe

Filesize
2.4MB

MD5
a4be277586f48a9c09a7553f4efd9348

SHA1
59cd2579eb8f53249c9c56a6f555deec2d6fb16a

SHA256
79e253d455b91dc2ae598701ac98b399491c4876ff5714912967f743e3f0ca3a

SHA512
10e0107065bf280e824702e3dd772054c1e47f6083fbc8b02c82dddbb018458d76b7c7b1d6fa3f579673bb3558a72b6afe48e5c3a6b62ae11543ef78a5840624

Download Submit
C:\Windows\System\UrOnBQO.exe

Filesize
2.3MB

MD5
68a4301790478a9eac2e4503468d7e8e

SHA1
de25993710f524c814a7540f383e5ed4fb7cd76f

SHA256
a58fa64c201e541adb9b6670913b85919414ee49ed867b8878c915901cea18f0

SHA512
2702d231d1aaab650c3d7deadcc1b616a36f14d580bc4b7dfc0fb1bf2c26adedf8dc2fa08996821f19e259b1a8b6647772eabcd37fdcdbc9939c597877140b06

Download Submit
C:\Windows\System\UwrGKUB.exe

Filesize
2.4MB

MD5
9ad879a9f42ecea9276f3e09b2fe6830

SHA1
c08a46ac683523059be2d99d1d08f4708971fa7e

SHA256
29efc75087b8c042ddf1f90c084b655d1c8740fb50844799b6c47cca2d8988ea

SHA512
7806c6e1d92c392f745dd2e4d65c541d2d44acb78b313dfb08917d9455456f6ca0f4919db55d6d29c0057f4c5cadc0eed60bfb2a7b448d18728e3542d407b895

Download Submit
C:\Windows\System\XRBRGjw.exe

Filesize
2.3MB

MD5
cbe5a78a51c75ec6d152a39f4a04ca8e

SHA1
d623fee33060efbb1aa59b6b3e7dea8ffb1c4504

SHA256
3b9deb6e5b9e7b457ce4f0f72475d02c28a7c71f946b4aea14e5844a6d4ee99b

SHA512
1fe1ecefcd8202728bd2f6047f9a6586ba1fd9eac9627489f127c0dbee02fa59eb56c8fb99b8ef5aa6331e241dbe98a3fb27b784cbc8f1a9e6de02b6b6ff267a

Download Submit
C:\Windows\System\aJilpFm.exe

Filesize
2.4MB

MD5
abf23ad6ed2b1564e8248a1d0f3681ab

SHA1
fc6a02ac41769c56c476c72c2cfc11e9dda6d9af

SHA256
56a40e49a49169a314d1944c81ab2f6a94b452be229b1fca56f895e7d2d5374c

SHA512
e39fdb19896745e9cf9a909e101948aeecdb05dbbc62dd31bdff0049516fb62219aed5435f3fcd0b62e290527e9764287f62e3550a5f4f7419cdad80c27d1a9f

Download Submit
C:\Windows\System\cUZuJqd.exe

Filesize
2.4MB

MD5
14148cda1b99b48d4a9ef14089509f64

SHA1
4c8457adde4bf78a06700af6b6b31c0cb0dc430e

SHA256
b3ba29ffd884c2a40acc0893f7a377d265eff5fa2bca5874f32e2abd24da1bce

SHA512
3cb2a66bcede128b38879cbeaaf360b383bc029cca1aaada39a972795e97c0c2c9d25bee9cc26ea1fd246e0bc5c97fb48e5dd043fd9b2e50e8c701b5a3d68e84

Download Submit
C:\Windows\System\dcMjNAk.exe

Filesize
2.4MB

MD5
173574e14a227c00f8fc2d44f36fc4f7

SHA1
cfc617722e0417161982a1f217e9038ccfa9197d

SHA256
1e024ec13815d0f5bbafa7c292740a5b7d9d3927c480f761ec2d7866e2cf35fa

SHA512
e1fc85791576ee617e21fd54178a89ad7a68c112cc967974af56bc379fdc3be1ce021c6f7d655d116539dbd8d34bcb892b87ae9d79d673d84a9f9455c23e6fa4

Download Submit
C:\Windows\System\eNmRPyy.exe

Filesize
2.4MB

MD5
85a3ea1c9a2bb65a00decdfbc330e033

SHA1
1a3444d9612ea741644bfc48aa7bbb33098ffb4e

SHA256
bb1f4ae5753efc37700d2a792836473ee03700a69199c0424843ea96fc160e6a

SHA512
ccb9317e16c797a050d51afeed3540b5111c497ead77f2221407a63ce25a91b6f8f24d70c03b23d0e7318f3b0fc41c8e2fa9ee54cb8c434b1a85de69f76d8029

Download Submit
C:\Windows\System\hLHOirc.exe

Filesize
2.4MB

MD5
7ca4a0f4ba33e18242193f9971d95ebc

SHA1
23d0d6d742686bf858829a09f54a1519b4ed5402

SHA256
9a81c8640f6a607178a1757d7eafe6570f675fcc7dc147e3baf548e79ff500f6

SHA512
38445bf94643a5cdd0354ffa7bd12591747a0e12fea2723aea8d0af10d0f8d09fb9877d3a59c96c2dbfc16a39f049879021831b72ee2405b9c8b8ded3f3c4fbe

Download Submit
C:\Windows\System\iRpCtBB.exe

Filesize
2.3MB

MD5
902621abcc8915c82288c86d81b35a25

SHA1
8e0c64b8cff675d0ff60af75a5167eadd3d7bb74

SHA256
d58d2ae4b6d8b5f8ad183a58377791cfc25efe087c59dc51ce409ca42da88858

SHA512
fbd57ba7c3a4bbc1b79f1f67a4112fd2d21fbbec87368f98d44bb5e92722cfd8ffcf8d3e6ebbc1f2f9a4891477f2dbe69e53bf78f19d63a374bd77de1c19cf7e

Download Submit
C:\Windows\System\jRINeqC.exe

Filesize
2.4MB

MD5
8108b3cc044f31c4acc7b1d4f3d3d31c

SHA1
e52f92bbd6e81c983e34df9c3299d747b7ebd04f

SHA256
c2f60ae33313894302d85f337c7345924c5859a4f11eb07c34dcb87d0b703cb0

SHA512
436589270c131c20aeda25f72513c7a253a1445fe2dbe4c76d5e9cb1606177e56323499e5425d4f307b2cc328a1c2b9b7a6f1a9159ab036b6bff857f0937d786

Download Submit
C:\Windows\System\jgMJJxI.exe

Filesize
2.3MB

MD5
81d53118511fdfbcce557d7b92e17e31

SHA1
044520c3f3736db25888656eabe5fb4dbc12ee69

SHA256
0f9d6b178eca1e1dd3053e42c1d778af1b81a33b70e23daa6d6f7d1bd448e7b8

SHA512
75d9fc15d825bfdccf8e6b9085f965badab5f234003a4f4938daa24c2c5f98144067927b817657df10680b6f094207ab211b2849d963ac84985531be12495556

Download Submit
C:\Windows\System\kJGDmHd.exe

Filesize
2.3MB

MD5
c084ab414f60652ca664d10f85220224

SHA1
978868a8e2568a3bdc1f4e44cc974f6209ff183a

SHA256
17d788488ddaf06aa8e9d4825d35ac57b9c0116632089767cf4d505d68b6e6ef

SHA512
056af14be929ae13453074367cca035d11da4731072a89b63d2d7710493eb23fbb92f1bbeb43921d1a2cf0b0f85b047415afc4c839f9cdb6a8cb5ea19e722890

Download Submit
C:\Windows\System\kQpxRDO.exe

Filesize
2.4MB

MD5
cf430c2c72631cf23fd23e1598296893

SHA1
f316615e67b6945126d634a5879e87468bbf762e

SHA256
4b40f3d0ea71d42d39674b956977fc330000e8b78e5a35a129905174f3177b0c

SHA512
a242ed758166d0f2465b8d57a65751adf17abd1e7d7a707b77c8403b3b07fbdc8cc4fdbc276ba6661305dc69fe7d1358edd30b0e3dc716d3c0d9277c234c20bd

Download Submit
C:\Windows\System\nrEwBcZ.exe

Filesize
2.4MB

MD5
e2463883c2ef48f5cb64e2fa5af7f49b

SHA1
6b00a0e3a680ef9b6fabc1ec39119d8ac32cc18a

SHA256
0e8f42f1000bd3979159ad1f2d4cb6233312bc4cf7c566eef20bc591fcdbe050

SHA512
c6a1768932030eee732410b5999e5ebfef07542446cf8fe31d86c2086d54c591eeb0cfdd05ce20f38534157047191651b5908b36d099f067a65f18b3e4ec5f8b

Download Submit
C:\Windows\System\nvLZvyU.exe

Filesize
2.4MB

MD5
5b083677eaf764dc02fec7bbc70e5ff2

SHA1
c1ddb972c13927e3bb4045f06d20904f5c45c025

SHA256
80a8ff4b84c548987697032a166e2d75ab85dbeca1fedc2499b0989cb70974e2

SHA512
4837ba55c2e1dfa3cf8c74341e15cdf65227e91771b8d62323fd3228ebfaa648f2da27dc3d6b1c1f899c07c88ee93dee03e1530f5a27bfcaad55801779e5619e

Download Submit
C:\Windows\System\qBrTUSa.exe

Filesize
2.4MB

MD5
0324af42945f3f6eae044369fbc199d0

SHA1
d6e71e57ac016fbc9c9e6e58ee39f14e6530e9bd

SHA256
ae502c5f32815a7d2eacf43ee9180fe3c7715dd1785e273646e0f6311942e7ad

SHA512
b3d54e66e347b9a6f02b2908355c613b1c5674ed1d2ff02e41f8698e378f492ee9bdf595a30d6080257faa069354b7050eaaf8f9b5512748941d904e2b76966e

Download Submit
C:\Windows\System\qVZQeZI.exe

Filesize
2.4MB

MD5
6f53737e58ea77f2075d47a8601d0e33

SHA1
8b644fcf7547c06774132797537f3fea7cd7ca6d

SHA256
1408202c197082fe68751a68dfcee2de9f71f60c74d0d38bab9d761e6c8ad5af

SHA512
73e2cd74b139aa4631896dc40de219e56b3e008b184ef767d0e909d4fe249959e6da511769495459ea5ea3cd0ccd75bafc4bf587c900bc158f6446d558b53e39

Download Submit
C:\Windows\System\qsFkrfC.exe

Filesize
2.4MB

MD5
bfefbe8bab7aa365392f41a58dcc6285

SHA1
ccce830f443f90e8cf8aeb9ea22c938462de6912

SHA256
a808a4e8ee53789ff47521082ff3bf3b2f0a311b602a238a01cee58991ec3fe9

SHA512
07593c3dfdec86bd04c4cb3cf1026798012c94cb6daa4ac5c827230c43571cd611b22d77b1e7786e50ffca37dcbd93276880b403d509618c1032a2fefa5f5a74

Download Submit
C:\Windows\System\sxswyVy.exe

Filesize
2.3MB

MD5
1fbb7d7df2fa10303ad3adc4985fd4f1

SHA1
1acf4d60a91969cf7892e2c8061fced18a11f57d

SHA256
cc5e8bfb5419335bf5e12bca0f2111cbbe6e66cb507cd1b249764a62085496b1

SHA512
644d5d199194a88466e2bfa54a32b80c4b2dad4ea2aaf6b759189c4c1eb94b0e01fb57f8f9f56fd8fd9270995734d64584e89f48d38ad4ad75ff4da1773f2a99

Download Submit
C:\Windows\System\tWhUIvD.exe

Filesize
2.4MB

MD5
697b6ffe0e29e1fa5738481d90c8cf32

SHA1
7e5e98a91130b25d6ec6917a20c004ddd34e69e1

SHA256
40cbe757de73ede1072f5b89a5fcd3155cfe255a82e7110ff8dd179ba5cc0c70

SHA512
604a498c36a77acdca3f6c8343d0dca8740a8b388014c2bbf2995aaa31023bf57fbbcf3ed950fa99d03e559ab4b46e3e3f3b3d77d50b2910ccc35f1eea60ea99

Download Submit
C:\Windows\System\wgmurps.exe

Filesize
2.4MB

MD5
582e9d2a10f705e88b3ffdaa46a0f67d

SHA1
827b59c1419387719425b0fd0bc330296e3dc1d8

SHA256
47350d91b5249a345cda32445113e50bddeade7d49f44f42211c576a4a4d6ee2

SHA512
a958881f8ce5f108d8c4afe472a00a979bb67ab9318d259fd215b53badc7fa280980178adf83bebd178f25d4e8acfbb191c2b044020d590a5df19b625afc17b8

Download Submit
C:\Windows\System\xwCsOiU.exe

Filesize
2.4MB

MD5
91926b548634a01ab5c51838834874fe

SHA1
fde4a2a418a3c987d3e002ccdae1f38b7f871a2b

SHA256
542458ac3bed9f4fd9119c0e77382f3615e46f8f55c5b31ec7e11606be241b0a

SHA512
9f8c597d60719ba27cb424a470eb2de0dbd4c4d6f844a337fe08b7525dc16be8c1b4ab6cad6cfc0ce74d7562dca89e66a62be19ffc8c81fb920658a8c5d5589c

Download Submit
C:\Windows\System\zRdoHqR.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\zbkcAXJ.exe

Filesize
2.4MB

MD5
78d36dbce35c13ce69ccc3037de6e72f

SHA1
352fa7c99bfbfa0e981ccaf6904020eafa46fdef

SHA256
0673a2e48938c5de530e61182a1f4de4d44d25fe06be93bae02f3ffc6c8e885c

SHA512
cb66a20c4a5814517664ca197e211068198da7a593ebcb0c0f2cab042b98ac8a1e8a06e99329036ba6c94c0ae35a0d4c6d51b35e74c6c36df07833c8ac596a68

Download Submit
memory/452-60-0x00007FF7BA280000-0x00007FF7BA672000-memory.dmp

Filesize
3.9MB

Download
memory/452-3524-0x00007FF7BA280000-0x00007FF7BA672000-memory.dmp

Filesize
3.9MB

Download
memory/632-3605-0x00007FF787450000-0x00007FF787842000-memory.dmp

Filesize
3.9MB

Download
memory/632-114-0x00007FF787450000-0x00007FF787842000-memory.dmp

Filesize
3.9MB

Download
memory/1080-3515-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-178-0x00007FF617ED0000-0x00007FF6182C2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-15-0x00007FF62D580000-0x00007FF62D972000-memory.dmp

Filesize
3.9MB

Download
memory/1764-191-0x00007FF742140000-0x00007FF742532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-3635-0x00007FF742140000-0x00007FF742532000-memory.dmp

Filesize
3.9MB

Download
memory/1856-101-0x00007FF7B97F0000-0x00007FF7B9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-3583-0x00007FF7B97F0000-0x00007FF7B9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-188-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp

Filesize
3.9MB

Download
memory/1892-3613-0x00007FF6BAB70000-0x00007FF6BAF62000-memory.dmp

Filesize
3.9MB

Download
memory/2012-75-0x00007FF716B00000-0x00007FF716EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3539-0x00007FF716B00000-0x00007FF716EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-144-0x00007FF657890000-0x00007FF657C82000-memory.dmp

Filesize
3.9MB

Download
memory/2144-3629-0x00007FF657890000-0x00007FF657C82000-memory.dmp

Filesize
3.9MB

Download
memory/2176-84-0x00007FF6F9260000-0x00007FF6F9652000-memory.dmp

Filesize
3.9MB

Download
memory/2176-3543-0x00007FF6F9260000-0x00007FF6F9652000-memory.dmp

Filesize
3.9MB

Download
memory/2236-187-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp

Filesize
3.9MB

Download
memory/2236-3579-0x00007FF7E2670000-0x00007FF7E2A62000-memory.dmp

Filesize
3.9MB

Download
memory/2740-106-0x00007FF758770000-0x00007FF758B62000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3594-0x00007FF758770000-0x00007FF758B62000-memory.dmp

Filesize
3.9MB

Download
memory/3004-184-0x00007FF711B20000-0x00007FF711F12000-memory.dmp

Filesize
3.9MB

Download
memory/3164-92-0x00007FF61A1F0000-0x00007FF61A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-3649-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-150-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-3510-0x00007FF66FAD0000-0x00007FF66FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3644-3621-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp

Filesize
3.9MB

Download
memory/3644-190-0x00007FF7B1F20000-0x00007FF7B2312000-memory.dmp

Filesize
3.9MB

Download
memory/3736-130-0x00007FF79F010000-0x00007FF79F402000-memory.dmp

Filesize
3.9MB

Download
memory/3736-3625-0x00007FF79F010000-0x00007FF79F402000-memory.dmp

Filesize
3.9MB

Download
memory/3856-3632-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp

Filesize
3.9MB

Download
memory/3856-192-0x00007FF7CFA80000-0x00007FF7CFE72000-memory.dmp

Filesize
3.9MB

Download
memory/3888-3617-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp

Filesize
3.9MB

Download
memory/3888-121-0x00007FF7F3F00000-0x00007FF7F42F2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-189-0x00007FF6FB5B0000-0x00007FF6FB9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-3650-0x00007FF778740000-0x00007FF778B32000-memory.dmp

Filesize
3.9MB

Download
memory/4460-194-0x00007FF778740000-0x00007FF778B32000-memory.dmp

Filesize
3.9MB

Download
memory/4480-0-0x00007FF642DA0000-0x00007FF643192000-memory.dmp

Filesize
3.9MB

Download
memory/4480-1-0x000001E28B610000-0x000001E28B620000-memory.dmp

Filesize
64KB

Download
memory/4648-3532-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp

Filesize
3.9MB

Download
memory/4648-179-0x00007FF7C91C0000-0x00007FF7C95B2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-36-0x000002234A700000-0x000002234A722000-memory.dmp

Filesize
136KB

Download
memory/4708-3018-0x00007FFB38253000-0x00007FFB38255000-memory.dmp

Filesize
8KB

Download
memory/4708-207-0x000002234B320000-0x000002234BAC6000-memory.dmp

Filesize
7.6MB

Download
memory/4708-3693-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

Filesize
10.8MB

Download
memory/4708-174-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

Filesize
10.8MB

Download
memory/4708-53-0x00007FFB38250000-0x00007FFB38D11000-memory.dmp

Filesize
10.8MB

Download
memory/4708-3-0x00007FFB38253000-0x00007FFB38255000-memory.dmp

Filesize
8KB

Download
memory/4744-3044-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp

Filesize
3.9MB

Download
memory/4744-139-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp

Filesize
3.9MB

Download
memory/4744-3638-0x00007FF6B7CA0000-0x00007FF6B8092000-memory.dmp

Filesize
3.9MB

Download
memory/4944-193-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp

Filesize
3.9MB

Download
memory/4944-3653-0x00007FF6C4290000-0x00007FF6C4682000-memory.dmp

Filesize
3.9MB

Download