xmrig | b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Size

2.3MB
MD5

014b97e09d26c7be9be9988d89aba96c
SHA1

7460dd6a8950b07a7ea16b2962cc6bbed3441aaa
SHA256

b22f05912ee290b6283675f2b94e9defbbb15f889e32108f18053beb97a2201d
SHA512

61b91097ede7bd7e9f6620711c28cb2dc4283e749ab34b3dd3c360c8bdddac48127e2e5a61b17c5adabac83d185406eae74c4131715455dfa7e82466b9899bb5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWac:NABp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	xmrig
behavioral2/memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	xmrig
behavioral2/memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	xmrig
behavioral2/memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp	xmrig
behavioral2/memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	xmrig
behavioral2/memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	xmrig
behavioral2/memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	xmrig
behavioral2/memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	xmrig
behavioral2/memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	xmrig
behavioral2/memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	xmrig
behavioral2/memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp	xmrig
behavioral2/memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp	xmrig
behavioral2/memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	xmrig
behavioral2/memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp	xmrig
behavioral2/memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	xmrig
behavioral2/memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp	xmrig
behavioral2/memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	xmrig
behavioral2/memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	xmrig
behavioral2/memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	xmrig
behavioral2/memory/5016-2256-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/2192-2258-0x00007FF678930000-0x00007FF678D22000-memory.dmp	xmrig
behavioral2/memory/1912-2262-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	xmrig
behavioral2/memory/3560-2261-0x00007FF751040000-0x00007FF751432000-memory.dmp	xmrig
behavioral2/memory/984-2266-0x00007FF621220000-0x00007FF621612000-memory.dmp	xmrig
behavioral2/memory/2364-2265-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	xmrig
behavioral2/memory/3068-2268-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	xmrig
behavioral2/memory/4284-2271-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	xmrig
behavioral2/memory/4984-2275-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	xmrig
behavioral2/memory/4056-2272-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	xmrig
behavioral2/memory/844-2276-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	xmrig
behavioral2/memory/3968-2280-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	xmrig
behavioral2/memory/348-2278-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	xmrig
behavioral2/memory/3672-2284-0x00007FF651F40000-0x00007FF652332000-memory.dmp	xmrig
behavioral2/memory/5016-2282-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	xmrig
behavioral2/memory/2656-2320-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	xmrig
behavioral2/memory/5024-2321-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	xmrig
behavioral2/memory/1592-2313-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	xmrig
behavioral2/memory/4952-2317-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	xmrig
behavioral2/memory/2268-2316-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	xmrig
behavioral2/memory/1452-2312-0x00007FF647450000-0x00007FF647842000-memory.dmp	xmrig
behavioral2/memory/3732-2308-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/368-2306-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	xmrig
behavioral2/memory/3532-2310-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	xmrig
behavioral2/memory/2188-2303-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	452	powershell.exe
12	452	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
452	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2192	tPJYoyi.exe
1912	QhkOCxs.exe
3560	nPafUPe.exe
984	suBmtWs.exe
2364	BwvzJRI.exe
4284	SbRXzNA.exe
3068	HaarroR.exe
4984	byHPNQb.exe
3968	FXiVwpo.exe
348	GbhYzjS.exe
844	wBUtXVi.exe
4056	MrRDQGI.exe
5016	GmFOyNi.exe
3672	NwGeluc.exe
5024	uvSkdKa.exe
2656	FWlUKqQ.exe
2268	BKATmdZ.exe
4952	xggIOEH.exe
1592	AZQCvPo.exe
1452	slxdFhT.exe
3532	VAQxTwL.exe
3732	SyUpoiI.exe
2188	drfDWmn.exe
368	gLfjFmc.exe
1564	QXOlsdp.exe
4288	CJPesOD.exe
2948	QdVtyLv.exe
3656	iBCaDrz.exe
4312	amfewAa.exe
1068	EPPzPko.exe
5008	uFYRlOb.exe
624	ZdwJaCU.exe
1540	CBbUkLI.exe
4344	PkxWiGn.exe
4496	DjQZSpa.exe
3048	AyfJUEw.exe
2804	UMucntZ.exe
2480	mkLxpqc.exe
4136	eHwTnfK.exe
1220	TDgrbiT.exe
2616	GYlORGZ.exe
3424	jjMKytS.exe
4028	cStXLkT.exe
2932	GmxhKcz.exe
5068	ssyvgyt.exe
3200	ZBFsDZW.exe
3500	TwWVtsT.exe
748	BhxZCGc.exe
3568	djcuDgM.exe
1232	RSGuzcF.exe
4764	VtQggtM.exe
2088	fgtYWbF.exe
2260	oMUaWII.exe
4112	JdZrehV.exe
1716	PgPWnWu.exe
3800	QDnhQzU.exe
2472	LahXpqh.exe
5132	trVSEDO.exe
5160	PIeVTRL.exe
5192	XKBUBsZ.exe
5220	IisWBjN.exe
5244	HgEXijC.exe
5276	qsSlZmJ.exe
5304	ZfNskqA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2644-0-0x00007FF734780000-0x00007FF734B72000-memory.dmp	upx
behavioral2/memory/2192-9-0x00007FF678930000-0x00007FF678D22000-memory.dmp	upx
behavioral2/files/0x000700000002344f-11.dat	upx
behavioral2/files/0x0007000000023450-16.dat	upx
behavioral2/files/0x000800000002344b-8.dat	upx
behavioral2/files/0x0007000000023451-24.dat	upx
behavioral2/files/0x0007000000023454-39.dat	upx
behavioral2/memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp	upx
behavioral2/memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp	upx
behavioral2/files/0x0007000000023458-61.dat	upx
behavioral2/memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp	upx
behavioral2/memory/348-77-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	upx
behavioral2/memory/844-83-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	upx
behavioral2/files/0x000800000002344c-92.dat	upx
behavioral2/files/0x000700000002345a-97.dat	upx
behavioral2/memory/3672-99-0x00007FF651F40000-0x00007FF652332000-memory.dmp	upx
behavioral2/memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp	upx
behavioral2/files/0x000700000002345d-112.dat	upx
behavioral2/files/0x0007000000023465-155.dat	upx
behavioral2/files/0x0007000000023468-171.dat	upx
behavioral2/memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp	upx
behavioral2/memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp	upx
behavioral2/memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp	upx
behavioral2/memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp	upx
behavioral2/memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp	upx
behavioral2/memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp	upx
behavioral2/memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp	upx
behavioral2/memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	upx
behavioral2/memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp	upx
behavioral2/memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp	upx
behavioral2/memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp	upx
behavioral2/memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp	upx
behavioral2/files/0x000700000002346d-190.dat	upx
behavioral2/files/0x000700000002346b-186.dat	upx
behavioral2/files/0x000700000002346c-185.dat	upx
behavioral2/files/0x000700000002346a-181.dat	upx
behavioral2/files/0x0007000000023469-176.dat	upx
behavioral2/files/0x0007000000023467-166.dat	upx
behavioral2/files/0x0007000000023466-161.dat	upx
behavioral2/files/0x0007000000023464-151.dat	upx
behavioral2/files/0x0007000000023463-146.dat	upx
behavioral2/files/0x0007000000023462-141.dat	upx
behavioral2/files/0x0007000000023461-136.dat	upx
behavioral2/files/0x0007000000023460-131.dat	upx
behavioral2/files/0x000700000002345f-126.dat	upx
behavioral2/files/0x000700000002345e-121.dat	upx
behavioral2/files/0x000700000002345c-110.dat	upx
behavioral2/files/0x000700000002345b-106.dat	upx
behavioral2/files/0x0008000000023456-94.dat	upx
behavioral2/memory/4056-90-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-84.dat	upx
behavioral2/files/0x0008000000023457-78.dat	upx
behavioral2/memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	upx
behavioral2/memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp	upx
behavioral2/memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp	upx
behavioral2/files/0x0007000000023455-62.dat	upx
behavioral2/memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp	upx
behavioral2/memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp	upx
behavioral2/files/0x0007000000023453-41.dat	upx
behavioral2/files/0x0007000000023452-27.dat	upx
behavioral2/memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp	upx
behavioral2/memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp	upx
behavioral2/memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp	upx
behavioral2/memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VHXEfvA.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GhaOpiI.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\WNSgqEF.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UWvicQJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ZBdgzOg.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KsnlPhj.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QCqcgtc.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VrIuRly.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UBeJYqS.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ObNzRnZ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XYWshsX.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\JzBrxkw.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\cDiXlaj.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KVylufe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ajseNBi.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QUanHja.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PhIAHEb.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\KBtAgql.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\WpSryhG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UTnATNy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\beyPzjT.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\GgtjroT.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\cddyqXL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dsLQCKy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\uhFSpKe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XLTAQLi.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\oTUKolR.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\dtSLcgF.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\TzFxknm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\pfLJpCV.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\aPmKNbM.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\tXLCFst.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\LsJTPXP.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\brkpkyy.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ItiGLml.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HCCEXvM.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vLVDADh.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\QVCOWSl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\azwglGl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\JGbKmjl.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\vgQYPQJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\YGScRJe.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PywOmsU.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\kqkpMLL.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\VKldjXB.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\fiOxedu.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\eAgqswr.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\OpYzgGq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ltLrObV.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\hDetThJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\IwXJpQK.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\TifbGGt.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\qNrFhTG.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\iRJYqJa.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\jTeZEiW.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\jyosYKn.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\oSupSJO.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\yyKxyNA.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\XxfxLxq.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\PxNzDrm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\ipMBhfP.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\HeCrdPm.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\UIbWhui.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
File created	C:\Windows\System\xXQQDrJ.exe	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
452	powershell.exe
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	powershell.exe
Token: SeLockMemoryPrivilege	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	85
PID 2644 wrote to memory of 452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	85
PID 2644 wrote to memory of 2192	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	86
PID 2644 wrote to memory of 2192	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	86
PID 2644 wrote to memory of 1912	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	87
PID 2644 wrote to memory of 1912	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	87
PID 2644 wrote to memory of 3560	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	88
PID 2644 wrote to memory of 3560	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	88
PID 2644 wrote to memory of 984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	89
PID 2644 wrote to memory of 984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	89
PID 2644 wrote to memory of 2364	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	90
PID 2644 wrote to memory of 2364	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	90
PID 2644 wrote to memory of 4284	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	91
PID 2644 wrote to memory of 4284	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	91
PID 2644 wrote to memory of 3068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	92
PID 2644 wrote to memory of 3068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	92
PID 2644 wrote to memory of 4984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	93
PID 2644 wrote to memory of 4984	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	93
PID 2644 wrote to memory of 3968	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	94
PID 2644 wrote to memory of 3968	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	94
PID 2644 wrote to memory of 348	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	95
PID 2644 wrote to memory of 348	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	95
PID 2644 wrote to memory of 844	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	96
PID 2644 wrote to memory of 844	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	96
PID 2644 wrote to memory of 4056	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	97
PID 2644 wrote to memory of 4056	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	97
PID 2644 wrote to memory of 5016	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	98
PID 2644 wrote to memory of 5016	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	98
PID 2644 wrote to memory of 3672	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	99
PID 2644 wrote to memory of 3672	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	99
PID 2644 wrote to memory of 5024	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	100
PID 2644 wrote to memory of 5024	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	100
PID 2644 wrote to memory of 2656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	101
PID 2644 wrote to memory of 2656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	101
PID 2644 wrote to memory of 2268	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	102
PID 2644 wrote to memory of 2268	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	102
PID 2644 wrote to memory of 4952	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	103
PID 2644 wrote to memory of 4952	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	103
PID 2644 wrote to memory of 1592	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	104
PID 2644 wrote to memory of 1592	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	104
PID 2644 wrote to memory of 1452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	105
PID 2644 wrote to memory of 1452	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	105
PID 2644 wrote to memory of 3532	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	106
PID 2644 wrote to memory of 3532	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	106
PID 2644 wrote to memory of 3732	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	107
PID 2644 wrote to memory of 3732	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	107
PID 2644 wrote to memory of 2188	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	108
PID 2644 wrote to memory of 2188	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	108
PID 2644 wrote to memory of 368	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	109
PID 2644 wrote to memory of 368	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	109
PID 2644 wrote to memory of 1564	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	110
PID 2644 wrote to memory of 1564	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	110
PID 2644 wrote to memory of 4288	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	111
PID 2644 wrote to memory of 4288	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	111
PID 2644 wrote to memory of 2948	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	112
PID 2644 wrote to memory of 2948	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	112
PID 2644 wrote to memory of 3656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	113
PID 2644 wrote to memory of 3656	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	113
PID 2644 wrote to memory of 4312	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	114
PID 2644 wrote to memory of 4312	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	114
PID 2644 wrote to memory of 1068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	115
PID 2644 wrote to memory of 1068	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	115
PID 2644 wrote to memory of 5008	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	116
PID 2644 wrote to memory of 5008	2644	014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\014b97e09d26c7be9be9988d89aba96c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "452" "2984" "2916" "2988" "0" "0" "2992" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4908
- C:\Windows\System\tPJYoyi.exe
  C:\Windows\System\tPJYoyi.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\QhkOCxs.exe
  C:\Windows\System\QhkOCxs.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\nPafUPe.exe
  C:\Windows\System\nPafUPe.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\suBmtWs.exe
  C:\Windows\System\suBmtWs.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\BwvzJRI.exe
  C:\Windows\System\BwvzJRI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SbRXzNA.exe
  C:\Windows\System\SbRXzNA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\HaarroR.exe
  C:\Windows\System\HaarroR.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\byHPNQb.exe
  C:\Windows\System\byHPNQb.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\FXiVwpo.exe
  C:\Windows\System\FXiVwpo.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\GbhYzjS.exe
  C:\Windows\System\GbhYzjS.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\wBUtXVi.exe
  C:\Windows\System\wBUtXVi.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\MrRDQGI.exe
  C:\Windows\System\MrRDQGI.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\GmFOyNi.exe
  C:\Windows\System\GmFOyNi.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\NwGeluc.exe
  C:\Windows\System\NwGeluc.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\uvSkdKa.exe
  C:\Windows\System\uvSkdKa.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\FWlUKqQ.exe
  C:\Windows\System\FWlUKqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BKATmdZ.exe
  C:\Windows\System\BKATmdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\xggIOEH.exe
  C:\Windows\System\xggIOEH.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\AZQCvPo.exe
  C:\Windows\System\AZQCvPo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\slxdFhT.exe
  C:\Windows\System\slxdFhT.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VAQxTwL.exe
  C:\Windows\System\VAQxTwL.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\SyUpoiI.exe
  C:\Windows\System\SyUpoiI.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\drfDWmn.exe
  C:\Windows\System\drfDWmn.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\gLfjFmc.exe
  C:\Windows\System\gLfjFmc.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\QXOlsdp.exe
  C:\Windows\System\QXOlsdp.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\CJPesOD.exe
  C:\Windows\System\CJPesOD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\QdVtyLv.exe
  C:\Windows\System\QdVtyLv.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\iBCaDrz.exe
  C:\Windows\System\iBCaDrz.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\amfewAa.exe
  C:\Windows\System\amfewAa.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\EPPzPko.exe
  C:\Windows\System\EPPzPko.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\uFYRlOb.exe
  C:\Windows\System\uFYRlOb.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\ZdwJaCU.exe
  C:\Windows\System\ZdwJaCU.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\CBbUkLI.exe
  C:\Windows\System\CBbUkLI.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\PkxWiGn.exe
  C:\Windows\System\PkxWiGn.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\DjQZSpa.exe
  C:\Windows\System\DjQZSpa.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\AyfJUEw.exe
  C:\Windows\System\AyfJUEw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UMucntZ.exe
  C:\Windows\System\UMucntZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\mkLxpqc.exe
  C:\Windows\System\mkLxpqc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\eHwTnfK.exe
  C:\Windows\System\eHwTnfK.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\TDgrbiT.exe
  C:\Windows\System\TDgrbiT.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\GYlORGZ.exe
  C:\Windows\System\GYlORGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\jjMKytS.exe
  C:\Windows\System\jjMKytS.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\cStXLkT.exe
  C:\Windows\System\cStXLkT.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\GmxhKcz.exe
  C:\Windows\System\GmxhKcz.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ssyvgyt.exe
  C:\Windows\System\ssyvgyt.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\ZBFsDZW.exe
  C:\Windows\System\ZBFsDZW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TwWVtsT.exe
  C:\Windows\System\TwWVtsT.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\BhxZCGc.exe
  C:\Windows\System\BhxZCGc.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\djcuDgM.exe
  C:\Windows\System\djcuDgM.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RSGuzcF.exe
  C:\Windows\System\RSGuzcF.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VtQggtM.exe
  C:\Windows\System\VtQggtM.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\fgtYWbF.exe
  C:\Windows\System\fgtYWbF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\oMUaWII.exe
  C:\Windows\System\oMUaWII.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\JdZrehV.exe
  C:\Windows\System\JdZrehV.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\PgPWnWu.exe
  C:\Windows\System\PgPWnWu.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\QDnhQzU.exe
  C:\Windows\System\QDnhQzU.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\LahXpqh.exe
  C:\Windows\System\LahXpqh.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\trVSEDO.exe
  C:\Windows\System\trVSEDO.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\PIeVTRL.exe
  C:\Windows\System\PIeVTRL.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\XKBUBsZ.exe
  C:\Windows\System\XKBUBsZ.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\IisWBjN.exe
  C:\Windows\System\IisWBjN.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\HgEXijC.exe
  C:\Windows\System\HgEXijC.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\qsSlZmJ.exe
  C:\Windows\System\qsSlZmJ.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\ZfNskqA.exe
  C:\Windows\System\ZfNskqA.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\PJWAaSt.exe
  C:\Windows\System\PJWAaSt.exe
  2⤵
  PID:5328
- C:\Windows\System\wNwriFW.exe
  C:\Windows\System\wNwriFW.exe
  2⤵
  PID:5356
- C:\Windows\System\pUtwwyi.exe
  C:\Windows\System\pUtwwyi.exe
  2⤵
  PID:5388
- C:\Windows\System\TYFolsr.exe
  C:\Windows\System\TYFolsr.exe
  2⤵
  PID:5416
- C:\Windows\System\IdnKlKm.exe
  C:\Windows\System\IdnKlKm.exe
  2⤵
  PID:5440
- C:\Windows\System\VSmzQIW.exe
  C:\Windows\System\VSmzQIW.exe
  2⤵
  PID:5468
- C:\Windows\System\bHJPsHI.exe
  C:\Windows\System\bHJPsHI.exe
  2⤵
  PID:5496
- C:\Windows\System\mBoSvVq.exe
  C:\Windows\System\mBoSvVq.exe
  2⤵
  PID:5524
- C:\Windows\System\wKxiiah.exe
  C:\Windows\System\wKxiiah.exe
  2⤵
  PID:5552
- C:\Windows\System\mtnRIOc.exe
  C:\Windows\System\mtnRIOc.exe
  2⤵
  PID:5580
- C:\Windows\System\MjIoaEB.exe
  C:\Windows\System\MjIoaEB.exe
  2⤵
  PID:5612
- C:\Windows\System\IFHveAg.exe
  C:\Windows\System\IFHveAg.exe
  2⤵
  PID:5640
- C:\Windows\System\vHdqQpE.exe
  C:\Windows\System\vHdqQpE.exe
  2⤵
  PID:5668
- C:\Windows\System\hgsAgTz.exe
  C:\Windows\System\hgsAgTz.exe
  2⤵
  PID:5696
- C:\Windows\System\egcIwdt.exe
  C:\Windows\System\egcIwdt.exe
  2⤵
  PID:5720
- C:\Windows\System\UCgDJat.exe
  C:\Windows\System\UCgDJat.exe
  2⤵
  PID:5740
- C:\Windows\System\TymsXfL.exe
  C:\Windows\System\TymsXfL.exe
  2⤵
  PID:5776
- C:\Windows\System\hXcbcMe.exe
  C:\Windows\System\hXcbcMe.exe
  2⤵
  PID:5804
- C:\Windows\System\uYokOon.exe
  C:\Windows\System\uYokOon.exe
  2⤵
  PID:5836
- C:\Windows\System\dwMiupc.exe
  C:\Windows\System\dwMiupc.exe
  2⤵
  PID:5860
- C:\Windows\System\CzPBbrT.exe
  C:\Windows\System\CzPBbrT.exe
  2⤵
  PID:5892
- C:\Windows\System\uofnkIl.exe
  C:\Windows\System\uofnkIl.exe
  2⤵
  PID:5920
- C:\Windows\System\uzTiXJz.exe
  C:\Windows\System\uzTiXJz.exe
  2⤵
  PID:5944
- C:\Windows\System\GwLdgHd.exe
  C:\Windows\System\GwLdgHd.exe
  2⤵
  PID:5976
- C:\Windows\System\pGrReDO.exe
  C:\Windows\System\pGrReDO.exe
  2⤵
  PID:6000
- C:\Windows\System\CHtufOd.exe
  C:\Windows\System\CHtufOd.exe
  2⤵
  PID:6028
- C:\Windows\System\sfWDJDB.exe
  C:\Windows\System\sfWDJDB.exe
  2⤵
  PID:6056
- C:\Windows\System\EqSJGpQ.exe
  C:\Windows\System\EqSJGpQ.exe
  2⤵
  PID:6088
- C:\Windows\System\OOOQszK.exe
  C:\Windows\System\OOOQszK.exe
  2⤵
  PID:6112
- C:\Windows\System\RuEHacW.exe
  C:\Windows\System\RuEHacW.exe
  2⤵
  PID:6140
- C:\Windows\System\iAnCbYd.exe
  C:\Windows\System\iAnCbYd.exe
  2⤵
  PID:2776
- C:\Windows\System\eqeguwu.exe
  C:\Windows\System\eqeguwu.exe
  2⤵
  PID:2236
- C:\Windows\System\zVckzqo.exe
  C:\Windows\System\zVckzqo.exe
  2⤵
  PID:4212
- C:\Windows\System\sTlxXHq.exe
  C:\Windows\System\sTlxXHq.exe
  2⤵
  PID:3964
- C:\Windows\System\xswBnpn.exe
  C:\Windows\System\xswBnpn.exe
  2⤵
  PID:5148
- C:\Windows\System\dIfDwTB.exe
  C:\Windows\System\dIfDwTB.exe
  2⤵
  PID:5208
- C:\Windows\System\hzhImcr.exe
  C:\Windows\System\hzhImcr.exe
  2⤵
  PID:5268
- C:\Windows\System\QaRPdBG.exe
  C:\Windows\System\QaRPdBG.exe
  2⤵
  PID:5324
- C:\Windows\System\KkEOGMI.exe
  C:\Windows\System\KkEOGMI.exe
  2⤵
  PID:5400
- C:\Windows\System\pqtBJIk.exe
  C:\Windows\System\pqtBJIk.exe
  2⤵
  PID:5464
- C:\Windows\System\jMayZdY.exe
  C:\Windows\System\jMayZdY.exe
  2⤵
  PID:5520
- C:\Windows\System\IaAXquE.exe
  C:\Windows\System\IaAXquE.exe
  2⤵
  PID:5596
- C:\Windows\System\Cxnieyi.exe
  C:\Windows\System\Cxnieyi.exe
  2⤵
  PID:5656
- C:\Windows\System\LlIFTpf.exe
  C:\Windows\System\LlIFTpf.exe
  2⤵
  PID:5732
- C:\Windows\System\kcWBUCY.exe
  C:\Windows\System\kcWBUCY.exe
  2⤵
  PID:5796
- C:\Windows\System\OKNFEDH.exe
  C:\Windows\System\OKNFEDH.exe
  2⤵
  PID:5852
- C:\Windows\System\CcYeTvy.exe
  C:\Windows\System\CcYeTvy.exe
  2⤵
  PID:5912
- C:\Windows\System\GfzkhkV.exe
  C:\Windows\System\GfzkhkV.exe
  2⤵
  PID:5988
- C:\Windows\System\DBJAQKj.exe
  C:\Windows\System\DBJAQKj.exe
  2⤵
  PID:6048
- C:\Windows\System\hQaAihu.exe
  C:\Windows\System\hQaAihu.exe
  2⤵
  PID:6108
- C:\Windows\System\MDNUEvd.exe
  C:\Windows\System\MDNUEvd.exe
  2⤵
  PID:936
- C:\Windows\System\TqUmifX.exe
  C:\Windows\System\TqUmifX.exe
  2⤵
  PID:1364
- C:\Windows\System\rGsOtKb.exe
  C:\Windows\System\rGsOtKb.exe
  2⤵
  PID:5180
- C:\Windows\System\MCSHSDa.exe
  C:\Windows\System\MCSHSDa.exe
  2⤵
  PID:5296
- C:\Windows\System\FZgEibo.exe
  C:\Windows\System\FZgEibo.exe
  2⤵
  PID:5456
- C:\Windows\System\RsElcJi.exe
  C:\Windows\System\RsElcJi.exe
  2⤵
  PID:5628
- C:\Windows\System\WqISkNM.exe
  C:\Windows\System\WqISkNM.exe
  2⤵
  PID:5760
- C:\Windows\System\DnmWWCH.exe
  C:\Windows\System\DnmWWCH.exe
  2⤵
  PID:5904
- C:\Windows\System\xAhDcvN.exe
  C:\Windows\System\xAhDcvN.exe
  2⤵
  PID:6020
- C:\Windows\System\JsnDBEp.exe
  C:\Windows\System\JsnDBEp.exe
  2⤵
  PID:6172
- C:\Windows\System\oNUmOrS.exe
  C:\Windows\System\oNUmOrS.exe
  2⤵
  PID:6200
- C:\Windows\System\KNOzPFL.exe
  C:\Windows\System\KNOzPFL.exe
  2⤵
  PID:6228
- C:\Windows\System\dqdbvcT.exe
  C:\Windows\System\dqdbvcT.exe
  2⤵
  PID:6252
- C:\Windows\System\hTxNDvN.exe
  C:\Windows\System\hTxNDvN.exe
  2⤵
  PID:6280
- C:\Windows\System\LvCNFEJ.exe
  C:\Windows\System\LvCNFEJ.exe
  2⤵
  PID:6308
- C:\Windows\System\JMFRljr.exe
  C:\Windows\System\JMFRljr.exe
  2⤵
  PID:6336
- C:\Windows\System\ietCaKg.exe
  C:\Windows\System\ietCaKg.exe
  2⤵
  PID:6368
- C:\Windows\System\PYpAJLw.exe
  C:\Windows\System\PYpAJLw.exe
  2⤵
  PID:6392
- C:\Windows\System\PywOmsU.exe
  C:\Windows\System\PywOmsU.exe
  2⤵
  PID:6424
- C:\Windows\System\LfrPtfV.exe
  C:\Windows\System\LfrPtfV.exe
  2⤵
  PID:6456
- C:\Windows\System\caGVBqc.exe
  C:\Windows\System\caGVBqc.exe
  2⤵
  PID:6480
- C:\Windows\System\QyKqyoE.exe
  C:\Windows\System\QyKqyoE.exe
  2⤵
  PID:6508
- C:\Windows\System\WbINkPn.exe
  C:\Windows\System\WbINkPn.exe
  2⤵
  PID:6536
- C:\Windows\System\SbFHbWu.exe
  C:\Windows\System\SbFHbWu.exe
  2⤵
  PID:6560
- C:\Windows\System\NYdwotg.exe
  C:\Windows\System\NYdwotg.exe
  2⤵
  PID:6588
- C:\Windows\System\ppcyRKi.exe
  C:\Windows\System\ppcyRKi.exe
  2⤵
  PID:6616
- C:\Windows\System\QiaSoOJ.exe
  C:\Windows\System\QiaSoOJ.exe
  2⤵
  PID:6648
- C:\Windows\System\UGGwTXu.exe
  C:\Windows\System\UGGwTXu.exe
  2⤵
  PID:6672
- C:\Windows\System\HaKamUY.exe
  C:\Windows\System\HaKamUY.exe
  2⤵
  PID:6704
- C:\Windows\System\neluWLa.exe
  C:\Windows\System\neluWLa.exe
  2⤵
  PID:6728
- C:\Windows\System\ozvnhwH.exe
  C:\Windows\System\ozvnhwH.exe
  2⤵
  PID:6756
- C:\Windows\System\JRgXEGB.exe
  C:\Windows\System\JRgXEGB.exe
  2⤵
  PID:6784
- C:\Windows\System\xCFmYyZ.exe
  C:\Windows\System\xCFmYyZ.exe
  2⤵
  PID:6812
- C:\Windows\System\EcelbIS.exe
  C:\Windows\System\EcelbIS.exe
  2⤵
  PID:6844
- C:\Windows\System\rjKGhMB.exe
  C:\Windows\System\rjKGhMB.exe
  2⤵
  PID:6872
- C:\Windows\System\EfAdAKs.exe
  C:\Windows\System\EfAdAKs.exe
  2⤵
  PID:6900
- C:\Windows\System\RlmDwwc.exe
  C:\Windows\System\RlmDwwc.exe
  2⤵
  PID:6924
- C:\Windows\System\rJwTdFo.exe
  C:\Windows\System\rJwTdFo.exe
  2⤵
  PID:6956
- C:\Windows\System\pSPfAnY.exe
  C:\Windows\System\pSPfAnY.exe
  2⤵
  PID:6980
- C:\Windows\System\egIPhTp.exe
  C:\Windows\System\egIPhTp.exe
  2⤵
  PID:7012
- C:\Windows\System\tQnFVwq.exe
  C:\Windows\System\tQnFVwq.exe
  2⤵
  PID:7036
- C:\Windows\System\zdoCkTq.exe
  C:\Windows\System\zdoCkTq.exe
  2⤵
  PID:7064
- C:\Windows\System\OAGaaTR.exe
  C:\Windows\System\OAGaaTR.exe
  2⤵
  PID:7096
- C:\Windows\System\CArWtwC.exe
  C:\Windows\System\CArWtwC.exe
  2⤵
  PID:7124
- C:\Windows\System\gJWpEOg.exe
  C:\Windows\System\gJWpEOg.exe
  2⤵
  PID:7148
- C:\Windows\System\UIdJkPs.exe
  C:\Windows\System\UIdJkPs.exe
  2⤵
  PID:6132
- C:\Windows\System\CTgXxYZ.exe
  C:\Windows\System\CTgXxYZ.exe
  2⤵
  PID:4308
- C:\Windows\System\lHDdHGd.exe
  C:\Windows\System\lHDdHGd.exe
  2⤵
  PID:2272
- C:\Windows\System\CiRBCOL.exe
  C:\Windows\System\CiRBCOL.exe
  2⤵
  PID:5572
- C:\Windows\System\pXqUYhC.exe
  C:\Windows\System\pXqUYhC.exe
  2⤵
  PID:5968
- C:\Windows\System\GKQkmhZ.exe
  C:\Windows\System\GKQkmhZ.exe
  2⤵
  PID:6184
- C:\Windows\System\FuBwyfW.exe
  C:\Windows\System\FuBwyfW.exe
  2⤵
  PID:3596
- C:\Windows\System\cznEJgy.exe
  C:\Windows\System\cznEJgy.exe
  2⤵
  PID:6276
- C:\Windows\System\QjjriUg.exe
  C:\Windows\System\QjjriUg.exe
  2⤵
  PID:6352
- C:\Windows\System\iROtpUN.exe
  C:\Windows\System\iROtpUN.exe
  2⤵
  PID:4236
- C:\Windows\System\aamtwmR.exe
  C:\Windows\System\aamtwmR.exe
  2⤵
  PID:6464
- C:\Windows\System\JkTODNF.exe
  C:\Windows\System\JkTODNF.exe
  2⤵
  PID:6520
- C:\Windows\System\atzTrof.exe
  C:\Windows\System\atzTrof.exe
  2⤵
  PID:6580
- C:\Windows\System\tDwXlwf.exe
  C:\Windows\System\tDwXlwf.exe
  2⤵
  PID:6640
- C:\Windows\System\KNYhRRl.exe
  C:\Windows\System\KNYhRRl.exe
  2⤵
  PID:6696
- C:\Windows\System\yhFdSSj.exe
  C:\Windows\System\yhFdSSj.exe
  2⤵
  PID:6748
- C:\Windows\System\QEeHpEw.exe
  C:\Windows\System\QEeHpEw.exe
  2⤵
  PID:6808
- C:\Windows\System\CRSRqPz.exe
  C:\Windows\System\CRSRqPz.exe
  2⤵
  PID:6884
- C:\Windows\System\RGDOzPD.exe
  C:\Windows\System\RGDOzPD.exe
  2⤵
  PID:6920
- C:\Windows\System\WdzsCRM.exe
  C:\Windows\System\WdzsCRM.exe
  2⤵
  PID:6996
- C:\Windows\System\lBtzXtR.exe
  C:\Windows\System\lBtzXtR.exe
  2⤵
  PID:7052
- C:\Windows\System\uqCMCRl.exe
  C:\Windows\System\uqCMCRl.exe
  2⤵
  PID:7136
- C:\Windows\System\lEvhOkl.exe
  C:\Windows\System\lEvhOkl.exe
  2⤵
  PID:2372
- C:\Windows\System\ZYlQxbv.exe
  C:\Windows\System\ZYlQxbv.exe
  2⤵
  PID:5240
- C:\Windows\System\bkKmecw.exe
  C:\Windows\System\bkKmecw.exe
  2⤵
  PID:5824
- C:\Windows\System\qjJbMfl.exe
  C:\Windows\System\qjJbMfl.exe
  2⤵
  PID:6192
- C:\Windows\System\NWjPvaD.exe
  C:\Windows\System\NWjPvaD.exe
  2⤵
  PID:6272
- C:\Windows\System\MDYCQXi.exe
  C:\Windows\System\MDYCQXi.exe
  2⤵
  PID:6436
- C:\Windows\System\GoPomQW.exe
  C:\Windows\System\GoPomQW.exe
  2⤵
  PID:6556
- C:\Windows\System\kMtWlMW.exe
  C:\Windows\System\kMtWlMW.exe
  2⤵
  PID:6856
- C:\Windows\System\zPnxknJ.exe
  C:\Windows\System\zPnxknJ.exe
  2⤵
  PID:6912
- C:\Windows\System\KlTAwCz.exe
  C:\Windows\System\KlTAwCz.exe
  2⤵
  PID:6976
- C:\Windows\System\EWjdMVG.exe
  C:\Windows\System\EWjdMVG.exe
  2⤵
  PID:528
- C:\Windows\System\VApSQDj.exe
  C:\Windows\System\VApSQDj.exe
  2⤵
  PID:2708
- C:\Windows\System\yDfPJjP.exe
  C:\Windows\System\yDfPJjP.exe
  2⤵
  PID:1656
- C:\Windows\System\UzeNSpy.exe
  C:\Windows\System\UzeNSpy.exe
  2⤵
  PID:2064
- C:\Windows\System\qubWFoe.exe
  C:\Windows\System\qubWFoe.exe
  2⤵
  PID:1124
- C:\Windows\System\KrqmKUF.exe
  C:\Windows\System\KrqmKUF.exe
  2⤵
  PID:6632
- C:\Windows\System\XyHNeCJ.exe
  C:\Windows\System\XyHNeCJ.exe
  2⤵
  PID:396
- C:\Windows\System\sqLGese.exe
  C:\Windows\System\sqLGese.exe
  2⤵
  PID:2764
- C:\Windows\System\fcVHcFK.exe
  C:\Windows\System\fcVHcFK.exe
  2⤵
  PID:4256
- C:\Windows\System\SNZzKoq.exe
  C:\Windows\System\SNZzKoq.exe
  2⤵
  PID:1608
- C:\Windows\System\ikJJwlO.exe
  C:\Windows\System\ikJJwlO.exe
  2⤵
  PID:1180
- C:\Windows\System\BBPwUnh.exe
  C:\Windows\System\BBPwUnh.exe
  2⤵
  PID:4940
- C:\Windows\System\mycwLbJ.exe
  C:\Windows\System\mycwLbJ.exe
  2⤵
  PID:244
- C:\Windows\System\tuAGzpl.exe
  C:\Windows\System\tuAGzpl.exe
  2⤵
  PID:952
- C:\Windows\System\xmHPiyu.exe
  C:\Windows\System\xmHPiyu.exe
  2⤵
  PID:4816
- C:\Windows\System\TavKljR.exe
  C:\Windows\System\TavKljR.exe
  2⤵
  PID:4980
- C:\Windows\System\nxHSalZ.exe
  C:\Windows\System\nxHSalZ.exe
  2⤵
  PID:3440
- C:\Windows\System\CKrFHGQ.exe
  C:\Windows\System\CKrFHGQ.exe
  2⤵
  PID:4576
- C:\Windows\System\hHmsGFH.exe
  C:\Windows\System\hHmsGFH.exe
  2⤵
  PID:1560
- C:\Windows\System\EQUpIqq.exe
  C:\Windows\System\EQUpIqq.exe
  2⤵
  PID:4564
- C:\Windows\System\BqXLszh.exe
  C:\Windows\System\BqXLszh.exe
  2⤵
  PID:848
- C:\Windows\System\ktqrJun.exe
  C:\Windows\System\ktqrJun.exe
  2⤵
  PID:3536
- C:\Windows\System\AIJowPf.exe
  C:\Windows\System\AIJowPf.exe
  2⤵
  PID:3112
- C:\Windows\System\CFtbKuh.exe
  C:\Windows\System\CFtbKuh.exe
  2⤵
  PID:6496
- C:\Windows\System\paymMmA.exe
  C:\Windows\System\paymMmA.exe
  2⤵
  PID:980
- C:\Windows\System\ykKoqAv.exe
  C:\Windows\System\ykKoqAv.exe
  2⤵
  PID:4364
- C:\Windows\System\qtsoEGo.exe
  C:\Windows\System\qtsoEGo.exe
  2⤵
  PID:6864
- C:\Windows\System\ZgpxICP.exe
  C:\Windows\System\ZgpxICP.exe
  2⤵
  PID:2544
- C:\Windows\System\tZquXIN.exe
  C:\Windows\System\tZquXIN.exe
  2⤵
  PID:4720
- C:\Windows\System\mLXlyKy.exe
  C:\Windows\System\mLXlyKy.exe
  2⤵
  PID:7172
- C:\Windows\System\gLOnAjK.exe
  C:\Windows\System\gLOnAjK.exe
  2⤵
  PID:7212
- C:\Windows\System\Erngewc.exe
  C:\Windows\System\Erngewc.exe
  2⤵
  PID:7240
- C:\Windows\System\VhNucQw.exe
  C:\Windows\System\VhNucQw.exe
  2⤵
  PID:7260
- C:\Windows\System\DKfxcbT.exe
  C:\Windows\System\DKfxcbT.exe
  2⤵
  PID:7300
- C:\Windows\System\JlSqkvm.exe
  C:\Windows\System\JlSqkvm.exe
  2⤵
  PID:7336
- C:\Windows\System\QiqivNS.exe
  C:\Windows\System\QiqivNS.exe
  2⤵
  PID:7376
- C:\Windows\System\CDgMQqZ.exe
  C:\Windows\System\CDgMQqZ.exe
  2⤵
  PID:7392
- C:\Windows\System\bRpgVUx.exe
  C:\Windows\System\bRpgVUx.exe
  2⤵
  PID:7428
- C:\Windows\System\IHUrLey.exe
  C:\Windows\System\IHUrLey.exe
  2⤵
  PID:7460
- C:\Windows\System\tExEBRO.exe
  C:\Windows\System\tExEBRO.exe
  2⤵
  PID:7476
- C:\Windows\System\StPOEmv.exe
  C:\Windows\System\StPOEmv.exe
  2⤵
  PID:7500
- C:\Windows\System\XwFDRKm.exe
  C:\Windows\System\XwFDRKm.exe
  2⤵
  PID:7536
- C:\Windows\System\dNsbVTp.exe
  C:\Windows\System\dNsbVTp.exe
  2⤵
  PID:7560
- C:\Windows\System\PnoamWa.exe
  C:\Windows\System\PnoamWa.exe
  2⤵
  PID:7596
- C:\Windows\System\PTcoQwc.exe
  C:\Windows\System\PTcoQwc.exe
  2⤵
  PID:7624
- C:\Windows\System\mPuGtwI.exe
  C:\Windows\System\mPuGtwI.exe
  2⤵
  PID:7644
- C:\Windows\System\QZrfuLA.exe
  C:\Windows\System\QZrfuLA.exe
  2⤵
  PID:7668
- C:\Windows\System\xLmPwQM.exe
  C:\Windows\System\xLmPwQM.exe
  2⤵
  PID:7688
- C:\Windows\System\JFLogKX.exe
  C:\Windows\System\JFLogKX.exe
  2⤵
  PID:7720
- C:\Windows\System\oehEkEN.exe
  C:\Windows\System\oehEkEN.exe
  2⤵
  PID:7748
- C:\Windows\System\VcVRGfG.exe
  C:\Windows\System\VcVRGfG.exe
  2⤵
  PID:7784
- C:\Windows\System\RPKyjKz.exe
  C:\Windows\System\RPKyjKz.exe
  2⤵
  PID:7816
- C:\Windows\System\iSCeEMx.exe
  C:\Windows\System\iSCeEMx.exe
  2⤵
  PID:7860
- C:\Windows\System\ZPZdVyj.exe
  C:\Windows\System\ZPZdVyj.exe
  2⤵
  PID:7880
- C:\Windows\System\wIEWiWF.exe
  C:\Windows\System\wIEWiWF.exe
  2⤵
  PID:7904
- C:\Windows\System\TotnRPD.exe
  C:\Windows\System\TotnRPD.exe
  2⤵
  PID:7944
- C:\Windows\System\BhsriVE.exe
  C:\Windows\System\BhsriVE.exe
  2⤵
  PID:7968
- C:\Windows\System\VVOTwlb.exe
  C:\Windows\System\VVOTwlb.exe
  2⤵
  PID:7992
- C:\Windows\System\DZqBtfa.exe
  C:\Windows\System\DZqBtfa.exe
  2⤵
  PID:8016
- C:\Windows\System\ipdStpK.exe
  C:\Windows\System\ipdStpK.exe
  2⤵
  PID:8056
- C:\Windows\System\txyPbHD.exe
  C:\Windows\System\txyPbHD.exe
  2⤵
  PID:8072
- C:\Windows\System\syqnSHC.exe
  C:\Windows\System\syqnSHC.exe
  2⤵
  PID:8092
- C:\Windows\System\PTMZKNx.exe
  C:\Windows\System\PTMZKNx.exe
  2⤵
  PID:8132
- C:\Windows\System\lvvIiXz.exe
  C:\Windows\System\lvvIiXz.exe
  2⤵
  PID:8160
- C:\Windows\System\gpVjrpa.exe
  C:\Windows\System\gpVjrpa.exe
  2⤵
  PID:8184
- C:\Windows\System\VGghrAO.exe
  C:\Windows\System\VGghrAO.exe
  2⤵
  PID:4360
- C:\Windows\System\zyPqUhe.exe
  C:\Windows\System\zyPqUhe.exe
  2⤵
  PID:4428
- C:\Windows\System\WkpdAhy.exe
  C:\Windows\System\WkpdAhy.exe
  2⤵
  PID:7228
- C:\Windows\System\qqwTVee.exe
  C:\Windows\System\qqwTVee.exe
  2⤵
  PID:7292
- C:\Windows\System\xktjbZN.exe
  C:\Windows\System\xktjbZN.exe
  2⤵
  PID:7388
- C:\Windows\System\sSpuPQm.exe
  C:\Windows\System\sSpuPQm.exe
  2⤵
  PID:7444
- C:\Windows\System\xbWWsuk.exe
  C:\Windows\System\xbWWsuk.exe
  2⤵
  PID:7028
- C:\Windows\System\SRJsHHu.exe
  C:\Windows\System\SRJsHHu.exe
  2⤵
  PID:7556
- C:\Windows\System\dJuEgwa.exe
  C:\Windows\System\dJuEgwa.exe
  2⤵
  PID:7584
- C:\Windows\System\iVyArlC.exe
  C:\Windows\System\iVyArlC.exe
  2⤵
  PID:7632
- C:\Windows\System\GteFzve.exe
  C:\Windows\System\GteFzve.exe
  2⤵
  PID:3380
- C:\Windows\System\MVHMaFx.exe
  C:\Windows\System\MVHMaFx.exe
  2⤵
  PID:7728
- C:\Windows\System\ipfwoJE.exe
  C:\Windows\System\ipfwoJE.exe
  2⤵
  PID:7780
- C:\Windows\System\XXPwFaw.exe
  C:\Windows\System\XXPwFaw.exe
  2⤵
  PID:7876
- C:\Windows\System\ssWCIVT.exe
  C:\Windows\System\ssWCIVT.exe
  2⤵
  PID:7940
- C:\Windows\System\uwizAqU.exe
  C:\Windows\System\uwizAqU.exe
  2⤵
  PID:1748
- C:\Windows\System\jOCSNCO.exe
  C:\Windows\System\jOCSNCO.exe
  2⤵
  PID:8112
- C:\Windows\System\BxhRqiA.exe
  C:\Windows\System\BxhRqiA.exe
  2⤵
  PID:8168
- C:\Windows\System\zGEhZjP.exe
  C:\Windows\System\zGEhZjP.exe
  2⤵
  PID:7208
- C:\Windows\System\QSXYRtm.exe
  C:\Windows\System\QSXYRtm.exe
  2⤵
  PID:7220
- C:\Windows\System\OgYJXuk.exe
  C:\Windows\System\OgYJXuk.exe
  2⤵
  PID:7328
- C:\Windows\System\qjUXUAL.exe
  C:\Windows\System\qjUXUAL.exe
  2⤵
  PID:7576
- C:\Windows\System\tKaBvco.exe
  C:\Windows\System\tKaBvco.exe
  2⤵
  PID:7776
- C:\Windows\System\zuRppbO.exe
  C:\Windows\System\zuRppbO.exe
  2⤵
  PID:7976
- C:\Windows\System\anhjEAY.exe
  C:\Windows\System\anhjEAY.exe
  2⤵
  PID:6080
- C:\Windows\System\iChCmaf.exe
  C:\Windows\System\iChCmaf.exe
  2⤵
  PID:1480
- C:\Windows\System\ONlltfi.exe
  C:\Windows\System\ONlltfi.exe
  2⤵
  PID:2176
- C:\Windows\System\hEXhWxN.exe
  C:\Windows\System\hEXhWxN.exe
  2⤵
  PID:7608
- C:\Windows\System\yluAYSP.exe
  C:\Windows\System\yluAYSP.exe
  2⤵
  PID:4492
- C:\Windows\System\EXMPUTA.exe
  C:\Windows\System\EXMPUTA.exe
  2⤵
  PID:7768
- C:\Windows\System\unIMspZ.exe
  C:\Windows\System\unIMspZ.exe
  2⤵
  PID:8180
- C:\Windows\System\bKWUCXv.exe
  C:\Windows\System\bKWUCXv.exe
  2⤵
  PID:2728
- C:\Windows\System\GzRyDwC.exe
  C:\Windows\System\GzRyDwC.exe
  2⤵
  PID:8208
- C:\Windows\System\Csafoxz.exe
  C:\Windows\System\Csafoxz.exe
  2⤵
  PID:8268
- C:\Windows\System\OXZEuSs.exe
  C:\Windows\System\OXZEuSs.exe
  2⤵
  PID:8308
- C:\Windows\System\yFdPcbp.exe
  C:\Windows\System\yFdPcbp.exe
  2⤵
  PID:8328
- C:\Windows\System\lXraaot.exe
  C:\Windows\System\lXraaot.exe
  2⤵
  PID:8348
- C:\Windows\System\MWTJpwo.exe
  C:\Windows\System\MWTJpwo.exe
  2⤵
  PID:8372
- C:\Windows\System\YPyjQAQ.exe
  C:\Windows\System\YPyjQAQ.exe
  2⤵
  PID:8404
- C:\Windows\System\lGzdptJ.exe
  C:\Windows\System\lGzdptJ.exe
  2⤵
  PID:8456
- C:\Windows\System\utvfFkV.exe
  C:\Windows\System\utvfFkV.exe
  2⤵
  PID:8480
- C:\Windows\System\XsvKLuF.exe
  C:\Windows\System\XsvKLuF.exe
  2⤵
  PID:8504
- C:\Windows\System\yBJvXlG.exe
  C:\Windows\System\yBJvXlG.exe
  2⤵
  PID:8528
- C:\Windows\System\LfNwFHP.exe
  C:\Windows\System\LfNwFHP.exe
  2⤵
  PID:8552
- C:\Windows\System\cSeKDpB.exe
  C:\Windows\System\cSeKDpB.exe
  2⤵
  PID:8588
- C:\Windows\System\DLITUIQ.exe
  C:\Windows\System\DLITUIQ.exe
  2⤵
  PID:8612
- C:\Windows\System\xIpHjaG.exe
  C:\Windows\System\xIpHjaG.exe
  2⤵
  PID:8660
- C:\Windows\System\TiEBBpm.exe
  C:\Windows\System\TiEBBpm.exe
  2⤵
  PID:8680
- C:\Windows\System\cqszWFr.exe
  C:\Windows\System\cqszWFr.exe
  2⤵
  PID:8700
- C:\Windows\System\NhUgoFt.exe
  C:\Windows\System\NhUgoFt.exe
  2⤵
  PID:8724
- C:\Windows\System\MBGAOUt.exe
  C:\Windows\System\MBGAOUt.exe
  2⤵
  PID:8748
- C:\Windows\System\gpOFRCy.exe
  C:\Windows\System\gpOFRCy.exe
  2⤵
  PID:8772
- C:\Windows\System\RXpoqBL.exe
  C:\Windows\System\RXpoqBL.exe
  2⤵
  PID:8820
- C:\Windows\System\uVLqCWK.exe
  C:\Windows\System\uVLqCWK.exe
  2⤵
  PID:8840
- C:\Windows\System\DSAxgTY.exe
  C:\Windows\System\DSAxgTY.exe
  2⤵
  PID:8864
- C:\Windows\System\jgYklsA.exe
  C:\Windows\System\jgYklsA.exe
  2⤵
  PID:8880
- C:\Windows\System\yOquxrW.exe
  C:\Windows\System\yOquxrW.exe
  2⤵
  PID:8904
- C:\Windows\System\OgaLKqY.exe
  C:\Windows\System\OgaLKqY.exe
  2⤵
  PID:8920
- C:\Windows\System\tXLCFst.exe
  C:\Windows\System\tXLCFst.exe
  2⤵
  PID:8964
- C:\Windows\System\xoElQCW.exe
  C:\Windows\System\xoElQCW.exe
  2⤵
  PID:8988
- C:\Windows\System\sYdJJUg.exe
  C:\Windows\System\sYdJJUg.exe
  2⤵
  PID:9044
- C:\Windows\System\sEzRXSx.exe
  C:\Windows\System\sEzRXSx.exe
  2⤵
  PID:9068
- C:\Windows\System\bJMSMAt.exe
  C:\Windows\System\bJMSMAt.exe
  2⤵
  PID:9084
- C:\Windows\System\bgFhJjl.exe
  C:\Windows\System\bgFhJjl.exe
  2⤵
  PID:9108
- C:\Windows\System\LJVHymd.exe
  C:\Windows\System\LJVHymd.exe
  2⤵
  PID:9124
- C:\Windows\System\UEsypEt.exe
  C:\Windows\System\UEsypEt.exe
  2⤵
  PID:9148
- C:\Windows\System\EkYNICK.exe
  C:\Windows\System\EkYNICK.exe
  2⤵
  PID:9176
- C:\Windows\System\JjZnZbS.exe
  C:\Windows\System\JjZnZbS.exe
  2⤵
  PID:5080
- C:\Windows\System\lICcrQk.exe
  C:\Windows\System\lICcrQk.exe
  2⤵
  PID:7544
- C:\Windows\System\oQPFMVM.exe
  C:\Windows\System\oQPFMVM.exe
  2⤵
  PID:7900
- C:\Windows\System\FGNEZUw.exe
  C:\Windows\System\FGNEZUw.exe
  2⤵
  PID:8244
- C:\Windows\System\ByKulbm.exe
  C:\Windows\System\ByKulbm.exe
  2⤵
  PID:8280
- C:\Windows\System\ZnFvSgb.exe
  C:\Windows\System\ZnFvSgb.exe
  2⤵
  PID:8324
- C:\Windows\System\rVAXIyl.exe
  C:\Windows\System\rVAXIyl.exe
  2⤵
  PID:8364
- C:\Windows\System\LpuuHsO.exe
  C:\Windows\System\LpuuHsO.exe
  2⤵
  PID:8384
- C:\Windows\System\cNtjtRO.exe
  C:\Windows\System\cNtjtRO.exe
  2⤵
  PID:8540
- C:\Windows\System\DAveGHP.exe
  C:\Windows\System\DAveGHP.exe
  2⤵
  PID:8604
- C:\Windows\System\seGYtlT.exe
  C:\Windows\System\seGYtlT.exe
  2⤵
  PID:8644
- C:\Windows\System\AHRQbHS.exe
  C:\Windows\System\AHRQbHS.exe
  2⤵
  PID:8812
- C:\Windows\System\uDqsIkh.exe
  C:\Windows\System\uDqsIkh.exe
  2⤵
  PID:8836
- C:\Windows\System\KEMmvDx.exe
  C:\Windows\System\KEMmvDx.exe
  2⤵
  PID:8916
- C:\Windows\System\JmFaQAM.exe
  C:\Windows\System\JmFaQAM.exe
  2⤵
  PID:8956
- C:\Windows\System\KDAlNCy.exe
  C:\Windows\System\KDAlNCy.exe
  2⤵
  PID:9056
- C:\Windows\System\FrucCzH.exe
  C:\Windows\System\FrucCzH.exe
  2⤵
  PID:9192
- C:\Windows\System\HCCEXvM.exe
  C:\Windows\System\HCCEXvM.exe
  2⤵
  PID:9212
- C:\Windows\System\DDzAltt.exe
  C:\Windows\System\DDzAltt.exe
  2⤵
  PID:8260
- C:\Windows\System\eMfiZhE.exe
  C:\Windows\System\eMfiZhE.exe
  2⤵
  PID:8492
- C:\Windows\System\VhyZEbL.exe
  C:\Windows\System\VhyZEbL.exe
  2⤵
  PID:8512
- C:\Windows\System\oAOJash.exe
  C:\Windows\System\oAOJash.exe
  2⤵
  PID:8764
- C:\Windows\System\mLzFSod.exe
  C:\Windows\System\mLzFSod.exe
  2⤵
  PID:8952
- C:\Windows\System\zFptXwl.exe
  C:\Windows\System\zFptXwl.exe
  2⤵
  PID:8104
- C:\Windows\System\XPPbpWX.exe
  C:\Windows\System\XPPbpWX.exe
  2⤵
  PID:2212
- C:\Windows\System\DblUxnU.exe
  C:\Windows\System\DblUxnU.exe
  2⤵
  PID:8848
- C:\Windows\System\bJJiDhz.exe
  C:\Windows\System\bJJiDhz.exe
  2⤵
  PID:8912
- C:\Windows\System\rBrUapT.exe
  C:\Windows\System\rBrUapT.exe
  2⤵
  PID:9220
- C:\Windows\System\FSRSjXS.exe
  C:\Windows\System\FSRSjXS.exe
  2⤵
  PID:9240
- C:\Windows\System\opaNeaH.exe
  C:\Windows\System\opaNeaH.exe
  2⤵
  PID:9268
- C:\Windows\System\cyHJOpr.exe
  C:\Windows\System\cyHJOpr.exe
  2⤵
  PID:9292
- C:\Windows\System\wPFGPNF.exe
  C:\Windows\System\wPFGPNF.exe
  2⤵
  PID:9324
- C:\Windows\System\gdtcQge.exe
  C:\Windows\System\gdtcQge.exe
  2⤵
  PID:9340
- C:\Windows\System\KFGjoqw.exe
  C:\Windows\System\KFGjoqw.exe
  2⤵
  PID:9360
- C:\Windows\System\LDgSyZP.exe
  C:\Windows\System\LDgSyZP.exe
  2⤵
  PID:9384
- C:\Windows\System\JDWBwMe.exe
  C:\Windows\System\JDWBwMe.exe
  2⤵
  PID:9408
- C:\Windows\System\UKlagiu.exe
  C:\Windows\System\UKlagiu.exe
  2⤵
  PID:9424
- C:\Windows\System\MLYaKyt.exe
  C:\Windows\System\MLYaKyt.exe
  2⤵
  PID:9484
- C:\Windows\System\huQaLOr.exe
  C:\Windows\System\huQaLOr.exe
  2⤵
  PID:9528
- C:\Windows\System\JbgBKpW.exe
  C:\Windows\System\JbgBKpW.exe
  2⤵
  PID:9556
- C:\Windows\System\wINeWdL.exe
  C:\Windows\System\wINeWdL.exe
  2⤵
  PID:9576
- C:\Windows\System\ZAzaDgp.exe
  C:\Windows\System\ZAzaDgp.exe
  2⤵
  PID:9596
- C:\Windows\System\hHZjZgN.exe
  C:\Windows\System\hHZjZgN.exe
  2⤵
  PID:9624
- C:\Windows\System\MOfeKQm.exe
  C:\Windows\System\MOfeKQm.exe
  2⤵
  PID:9656
- C:\Windows\System\QiTWwWf.exe
  C:\Windows\System\QiTWwWf.exe
  2⤵
  PID:9700
- C:\Windows\System\yvuPANj.exe
  C:\Windows\System\yvuPANj.exe
  2⤵
  PID:9720
- C:\Windows\System\hmxEbUO.exe
  C:\Windows\System\hmxEbUO.exe
  2⤵
  PID:9744
- C:\Windows\System\baLWfwa.exe
  C:\Windows\System\baLWfwa.exe
  2⤵
  PID:9784
- C:\Windows\System\ItphDwc.exe
  C:\Windows\System\ItphDwc.exe
  2⤵
  PID:9804
- C:\Windows\System\EHKzmpz.exe
  C:\Windows\System\EHKzmpz.exe
  2⤵
  PID:9828
- C:\Windows\System\pIlkTHQ.exe
  C:\Windows\System\pIlkTHQ.exe
  2⤵
  PID:9848
- C:\Windows\System\GNCBYOj.exe
  C:\Windows\System\GNCBYOj.exe
  2⤵
  PID:9876
- C:\Windows\System\RYJXFgX.exe
  C:\Windows\System\RYJXFgX.exe
  2⤵
  PID:9904
- C:\Windows\System\JXBUhNu.exe
  C:\Windows\System\JXBUhNu.exe
  2⤵
  PID:9936
- C:\Windows\System\wWCalzt.exe
  C:\Windows\System\wWCalzt.exe
  2⤵
  PID:9952
- C:\Windows\System\IBzbHlD.exe
  C:\Windows\System\IBzbHlD.exe
  2⤵
  PID:9968
- C:\Windows\System\AdqehFm.exe
  C:\Windows\System\AdqehFm.exe
  2⤵
  PID:9984
- C:\Windows\System\RtprLOu.exe
  C:\Windows\System\RtprLOu.exe
  2⤵
  PID:10004
- C:\Windows\System\cDiXlaj.exe
  C:\Windows\System\cDiXlaj.exe
  2⤵
  PID:10072
- C:\Windows\System\aODvSxc.exe
  C:\Windows\System\aODvSxc.exe
  2⤵
  PID:10112
- C:\Windows\System\PyeMkqr.exe
  C:\Windows\System\PyeMkqr.exe
  2⤵
  PID:10136
- C:\Windows\System\MziANnC.exe
  C:\Windows\System\MziANnC.exe
  2⤵
  PID:10164
- C:\Windows\System\JSZqowa.exe
  C:\Windows\System\JSZqowa.exe
  2⤵
  PID:10184
- C:\Windows\System\mEtBfFV.exe
  C:\Windows\System\mEtBfFV.exe
  2⤵
  PID:10216
- C:\Windows\System\aZRhxUv.exe
  C:\Windows\System\aZRhxUv.exe
  2⤵
  PID:10236
- C:\Windows\System\MrnLVBT.exe
  C:\Windows\System\MrnLVBT.exe
  2⤵
  PID:9332
- C:\Windows\System\mvFfKLI.exe
  C:\Windows\System\mvFfKLI.exe
  2⤵
  PID:9368
- C:\Windows\System\DDPZDxB.exe
  C:\Windows\System\DDPZDxB.exe
  2⤵
  PID:9456
- C:\Windows\System\gqwcBZI.exe
  C:\Windows\System\gqwcBZI.exe
  2⤵
  PID:9520
- C:\Windows\System\TioZsXN.exe
  C:\Windows\System\TioZsXN.exe
  2⤵
  PID:9572
- C:\Windows\System\ndDvIpb.exe
  C:\Windows\System\ndDvIpb.exe
  2⤵
  PID:9664
- C:\Windows\System\YtEgNEp.exe
  C:\Windows\System\YtEgNEp.exe
  2⤵
  PID:9780
- C:\Windows\System\HvnJEGh.exe
  C:\Windows\System\HvnJEGh.exe
  2⤵
  PID:9812
- C:\Windows\System\BGoYLzk.exe
  C:\Windows\System\BGoYLzk.exe
  2⤵
  PID:9868
- C:\Windows\System\LGFHZrL.exe
  C:\Windows\System\LGFHZrL.exe
  2⤵
  PID:9920
- C:\Windows\System\CQHgCUq.exe
  C:\Windows\System\CQHgCUq.exe
  2⤵
  PID:10016
- C:\Windows\System\GJDOmvS.exe
  C:\Windows\System\GJDOmvS.exe
  2⤵
  PID:10032
- C:\Windows\System\LEOIdrd.exe
  C:\Windows\System\LEOIdrd.exe
  2⤵
  PID:10104
- C:\Windows\System\dzitNAT.exe
  C:\Windows\System\dzitNAT.exe
  2⤵
  PID:10108
- C:\Windows\System\tAWSDyt.exe
  C:\Windows\System\tAWSDyt.exe
  2⤵
  PID:10160
- C:\Windows\System\RiFaXlu.exe
  C:\Windows\System\RiFaXlu.exe
  2⤵
  PID:9480
- C:\Windows\System\hDGfSyb.exe
  C:\Windows\System\hDGfSyb.exe
  2⤵
  PID:9544
- C:\Windows\System\hllAVxU.exe
  C:\Windows\System\hllAVxU.exe
  2⤵
  PID:9716
- C:\Windows\System\itaxTSh.exe
  C:\Windows\System\itaxTSh.exe
  2⤵
  PID:9796
- C:\Windows\System\fdbuOkw.exe
  C:\Windows\System\fdbuOkw.exe
  2⤵
  PID:9932
- C:\Windows\System\ozDudjk.exe
  C:\Windows\System\ozDudjk.exe
  2⤵
  PID:9228
- C:\Windows\System\XLTAQLi.exe
  C:\Windows\System\XLTAQLi.exe
  2⤵
  PID:9300
- C:\Windows\System\UczmQwX.exe
  C:\Windows\System\UczmQwX.exe
  2⤵
  PID:9376
- C:\Windows\System\TVSLIqF.exe
  C:\Windows\System\TVSLIqF.exe
  2⤵
  PID:9896
- C:\Windows\System\PwWBPiD.exe
  C:\Windows\System\PwWBPiD.exe
  2⤵
  PID:9392
- C:\Windows\System\TltjPwz.exe
  C:\Windows\System\TltjPwz.exe
  2⤵
  PID:9996
- C:\Windows\System\RMqaACr.exe
  C:\Windows\System\RMqaACr.exe
  2⤵
  PID:10256
- C:\Windows\System\aGMJddj.exe
  C:\Windows\System\aGMJddj.exe
  2⤵
  PID:10276
- C:\Windows\System\vhiThHU.exe
  C:\Windows\System\vhiThHU.exe
  2⤵
  PID:10324
- C:\Windows\System\JgaQOei.exe
  C:\Windows\System\JgaQOei.exe
  2⤵
  PID:10364
- C:\Windows\System\PnrpfNm.exe
  C:\Windows\System\PnrpfNm.exe
  2⤵
  PID:10396
- C:\Windows\System\IPEQcZA.exe
  C:\Windows\System\IPEQcZA.exe
  2⤵
  PID:10412
- C:\Windows\System\EHGadFG.exe
  C:\Windows\System\EHGadFG.exe
  2⤵
  PID:10436
- C:\Windows\System\RBBhHGP.exe
  C:\Windows\System\RBBhHGP.exe
  2⤵
  PID:10456
- C:\Windows\System\TAOBgLF.exe
  C:\Windows\System\TAOBgLF.exe
  2⤵
  PID:10480
- C:\Windows\System\rigKVUq.exe
  C:\Windows\System\rigKVUq.exe
  2⤵
  PID:10500
- C:\Windows\System\HYVXWfV.exe
  C:\Windows\System\HYVXWfV.exe
  2⤵
  PID:10528
- C:\Windows\System\UYSuuAd.exe
  C:\Windows\System\UYSuuAd.exe
  2⤵
  PID:10560
- C:\Windows\System\cAgnYXE.exe
  C:\Windows\System\cAgnYXE.exe
  2⤵
  PID:10580
- C:\Windows\System\UTvHfnc.exe
  C:\Windows\System\UTvHfnc.exe
  2⤵
  PID:10620
- C:\Windows\System\aKIzpwA.exe
  C:\Windows\System\aKIzpwA.exe
  2⤵
  PID:10648
- C:\Windows\System\eMFlfxg.exe
  C:\Windows\System\eMFlfxg.exe
  2⤵
  PID:10668
- C:\Windows\System\tWNApVf.exe
  C:\Windows\System\tWNApVf.exe
  2⤵
  PID:10708
- C:\Windows\System\SuzExwb.exe
  C:\Windows\System\SuzExwb.exe
  2⤵
  PID:10732
- C:\Windows\System\ChvLmBA.exe
  C:\Windows\System\ChvLmBA.exe
  2⤵
  PID:10756
- C:\Windows\System\VLrlJJn.exe
  C:\Windows\System\VLrlJJn.exe
  2⤵
  PID:10776
- C:\Windows\System\HCSdeNv.exe
  C:\Windows\System\HCSdeNv.exe
  2⤵
  PID:10796
- C:\Windows\System\frrlkRM.exe
  C:\Windows\System\frrlkRM.exe
  2⤵
  PID:10820
- C:\Windows\System\kCtWrzh.exe
  C:\Windows\System\kCtWrzh.exe
  2⤵
  PID:10840
- C:\Windows\System\fNvFnng.exe
  C:\Windows\System\fNvFnng.exe
  2⤵
  PID:10872
- C:\Windows\System\uGzcINr.exe
  C:\Windows\System\uGzcINr.exe
  2⤵
  PID:10904
- C:\Windows\System\rDcKQWx.exe
  C:\Windows\System\rDcKQWx.exe
  2⤵
  PID:10960
- C:\Windows\System\iPzQtyD.exe
  C:\Windows\System\iPzQtyD.exe
  2⤵
  PID:10984
- C:\Windows\System\XQQaKdK.exe
  C:\Windows\System\XQQaKdK.exe
  2⤵
  PID:11004
- C:\Windows\System\feDAfHV.exe
  C:\Windows\System\feDAfHV.exe
  2⤵
  PID:11032
- C:\Windows\System\NPPuajc.exe
  C:\Windows\System\NPPuajc.exe
  2⤵
  PID:11052
- C:\Windows\System\liTOOWr.exe
  C:\Windows\System\liTOOWr.exe
  2⤵
  PID:11088
- C:\Windows\System\NgzLfuR.exe
  C:\Windows\System\NgzLfuR.exe
  2⤵
  PID:11124
- C:\Windows\System\bARWwJw.exe
  C:\Windows\System\bARWwJw.exe
  2⤵
  PID:11144
- C:\Windows\System\TgQHmDU.exe
  C:\Windows\System\TgQHmDU.exe
  2⤵
  PID:11196
- C:\Windows\System\OCqjAYQ.exe
  C:\Windows\System\OCqjAYQ.exe
  2⤵
  PID:11224
- C:\Windows\System\OnUHVLX.exe
  C:\Windows\System\OnUHVLX.exe
  2⤵
  PID:11248
- C:\Windows\System\hUvffiv.exe
  C:\Windows\System\hUvffiv.exe
  2⤵
  PID:9800
- C:\Windows\System\RhnmCAm.exe
  C:\Windows\System\RhnmCAm.exe
  2⤵
  PID:10296
- C:\Windows\System\kbitlTM.exe
  C:\Windows\System\kbitlTM.exe
  2⤵
  PID:10348
- C:\Windows\System\ywdAXUk.exe
  C:\Windows\System\ywdAXUk.exe
  2⤵
  PID:10408
- C:\Windows\System\TawVleD.exe
  C:\Windows\System\TawVleD.exe
  2⤵
  PID:10452
- C:\Windows\System\fGwkHce.exe
  C:\Windows\System\fGwkHce.exe
  2⤵
  PID:10496
- C:\Windows\System\kPqybex.exe
  C:\Windows\System\kPqybex.exe
  2⤵
  PID:10608
- C:\Windows\System\cRPMZOo.exe
  C:\Windows\System\cRPMZOo.exe
  2⤵
  PID:10660
- C:\Windows\System\hUaXCQn.exe
  C:\Windows\System\hUaXCQn.exe
  2⤵
  PID:10716
- C:\Windows\System\vHrNriY.exe
  C:\Windows\System\vHrNriY.exe
  2⤵
  PID:10812
- C:\Windows\System\WcbTmYR.exe
  C:\Windows\System\WcbTmYR.exe
  2⤵
  PID:10864
- C:\Windows\System\UgicsNQ.exe
  C:\Windows\System\UgicsNQ.exe
  2⤵
  PID:10956
- C:\Windows\System\OGIjpVQ.exe
  C:\Windows\System\OGIjpVQ.exe
  2⤵
  PID:10996
- C:\Windows\System\qeGFSYi.exe
  C:\Windows\System\qeGFSYi.exe
  2⤵
  PID:11044
- C:\Windows\System\ydKhHPD.exe
  C:\Windows\System\ydKhHPD.exe
  2⤵
  PID:11176
- C:\Windows\System\FTskruq.exe
  C:\Windows\System\FTskruq.exe
  2⤵
  PID:11220
- C:\Windows\System\gExsPpr.exe
  C:\Windows\System\gExsPpr.exe
  2⤵
  PID:3400
- C:\Windows\System\jXCCZii.exe
  C:\Windows\System\jXCCZii.exe
  2⤵
  PID:10388
- C:\Windows\System\CgXfyLZ.exe
  C:\Windows\System\CgXfyLZ.exe
  2⤵
  PID:10520
- C:\Windows\System\KUymOhU.exe
  C:\Windows\System\KUymOhU.exe
  2⤵
  PID:10740
- C:\Windows\System\vqxsdHL.exe
  C:\Windows\System\vqxsdHL.exe
  2⤵
  PID:10832
- C:\Windows\System\VjirCGT.exe
  C:\Windows\System\VjirCGT.exe
  2⤵
  PID:11016
- C:\Windows\System\mnKlvuz.exe
  C:\Windows\System\mnKlvuz.exe
  2⤵
  PID:11100
- C:\Windows\System\nGHgIZO.exe
  C:\Windows\System\nGHgIZO.exe
  2⤵
  PID:10556
- C:\Windows\System\dDCQQRM.exe
  C:\Windows\System\dDCQQRM.exe
  2⤵
  PID:10916
- C:\Windows\System\pAYujed.exe
  C:\Windows\System\pAYujed.exe
  2⤵
  PID:10360
- C:\Windows\System\PlsaIvx.exe
  C:\Windows\System\PlsaIvx.exe
  2⤵
  PID:11180
- C:\Windows\System\abczLOR.exe
  C:\Windows\System\abczLOR.exe
  2⤵
  PID:11288
- C:\Windows\System\WBMPCeL.exe
  C:\Windows\System\WBMPCeL.exe
  2⤵
  PID:11316
- C:\Windows\System\AqNRuRI.exe
  C:\Windows\System\AqNRuRI.exe
  2⤵
  PID:11336
- C:\Windows\System\hDJHBLz.exe
  C:\Windows\System\hDJHBLz.exe
  2⤵
  PID:11356
- C:\Windows\System\qFFvYdw.exe
  C:\Windows\System\qFFvYdw.exe
  2⤵
  PID:11384
- C:\Windows\System\xqthUmV.exe
  C:\Windows\System\xqthUmV.exe
  2⤵
  PID:11404
- C:\Windows\System\qCzaxVv.exe
  C:\Windows\System\qCzaxVv.exe
  2⤵
  PID:11424
- C:\Windows\System\ukLpRfr.exe
  C:\Windows\System\ukLpRfr.exe
  2⤵
  PID:11464
- C:\Windows\System\YJBzFTA.exe
  C:\Windows\System\YJBzFTA.exe
  2⤵
  PID:11484
- C:\Windows\System\dAskkRu.exe
  C:\Windows\System\dAskkRu.exe
  2⤵
  PID:11524
- C:\Windows\System\CKYoIIZ.exe
  C:\Windows\System\CKYoIIZ.exe
  2⤵
  PID:11572
- C:\Windows\System\VNILPYL.exe
  C:\Windows\System\VNILPYL.exe
  2⤵
  PID:11588
- C:\Windows\System\edBzyva.exe
  C:\Windows\System\edBzyva.exe
  2⤵
  PID:11612
- C:\Windows\System\bJWSADi.exe
  C:\Windows\System\bJWSADi.exe
  2⤵
  PID:11640
- C:\Windows\System\pghGkhi.exe
  C:\Windows\System\pghGkhi.exe
  2⤵
  PID:11660
- C:\Windows\System\UYzFBeO.exe
  C:\Windows\System\UYzFBeO.exe
  2⤵
  PID:11684
- C:\Windows\System\ITYJJVn.exe
  C:\Windows\System\ITYJJVn.exe
  2⤵
  PID:11700
- C:\Windows\System\kHyNBKl.exe
  C:\Windows\System\kHyNBKl.exe
  2⤵
  PID:11728
- C:\Windows\System\gmofsYD.exe
  C:\Windows\System\gmofsYD.exe
  2⤵
  PID:11748
- C:\Windows\System\clTpIEW.exe
  C:\Windows\System\clTpIEW.exe
  2⤵
  PID:11768
- C:\Windows\System\eDlyEgb.exe
  C:\Windows\System\eDlyEgb.exe
  2⤵
  PID:11848
- C:\Windows\System\uXtdnwO.exe
  C:\Windows\System\uXtdnwO.exe
  2⤵
  PID:11868
- C:\Windows\System\QigDpSc.exe
  C:\Windows\System\QigDpSc.exe
  2⤵
  PID:11896
- C:\Windows\System\sZADHTj.exe
  C:\Windows\System\sZADHTj.exe
  2⤵
  PID:11924
- C:\Windows\System\yTvpETA.exe
  C:\Windows\System\yTvpETA.exe
  2⤵
  PID:11968
- C:\Windows\System\dlUZMcD.exe
  C:\Windows\System\dlUZMcD.exe
  2⤵
  PID:11984
- C:\Windows\System\VaLxEpO.exe
  C:\Windows\System\VaLxEpO.exe
  2⤵
  PID:12008
- C:\Windows\System\hIoueTV.exe
  C:\Windows\System\hIoueTV.exe
  2⤵
  PID:12056
- C:\Windows\System\FVcSVpl.exe
  C:\Windows\System\FVcSVpl.exe
  2⤵
  PID:12076
- C:\Windows\System\ePRWNTJ.exe
  C:\Windows\System\ePRWNTJ.exe
  2⤵
  PID:12100
- C:\Windows\System\BbSoXgu.exe
  C:\Windows\System\BbSoXgu.exe
  2⤵
  PID:12120
- C:\Windows\System\aDZyEgq.exe
  C:\Windows\System\aDZyEgq.exe
  2⤵
  PID:12140
- C:\Windows\System\xuUiEiJ.exe
  C:\Windows\System\xuUiEiJ.exe
  2⤵
  PID:12176
- C:\Windows\System\HnfEWRl.exe
  C:\Windows\System\HnfEWRl.exe
  2⤵
  PID:12212
- C:\Windows\System\nFPvGhQ.exe
  C:\Windows\System\nFPvGhQ.exe
  2⤵
  PID:12240
- C:\Windows\System\fmJMPQc.exe
  C:\Windows\System\fmJMPQc.exe
  2⤵
  PID:12260
- C:\Windows\System\oxUssDq.exe
  C:\Windows\System\oxUssDq.exe
  2⤵
  PID:11296
- C:\Windows\System\fLdpWZc.exe
  C:\Windows\System\fLdpWZc.exe
  2⤵
  PID:11332
- C:\Windows\System\PXhuCgq.exe
  C:\Windows\System\PXhuCgq.exe
  2⤵
  PID:11392
- C:\Windows\System\UudJLfh.exe
  C:\Windows\System\UudJLfh.exe
  2⤵
  PID:11452
- C:\Windows\System\pPwzNYG.exe
  C:\Windows\System\pPwzNYG.exe
  2⤵
  PID:11520
- C:\Windows\System\dukvfme.exe
  C:\Windows\System\dukvfme.exe
  2⤵
  PID:11564
- C:\Windows\System\quYLbtH.exe
  C:\Windows\System\quYLbtH.exe
  2⤵
  PID:11620
- C:\Windows\System\ayTxStp.exe
  C:\Windows\System\ayTxStp.exe
  2⤵
  PID:11712
- C:\Windows\System\ANVZBcJ.exe
  C:\Windows\System\ANVZBcJ.exe
  2⤵
  PID:11696
- C:\Windows\System\inyKRnJ.exe
  C:\Windows\System\inyKRnJ.exe
  2⤵
  PID:11844
- C:\Windows\System\uMrvWlx.exe
  C:\Windows\System\uMrvWlx.exe
  2⤵
  PID:11916
- C:\Windows\System\UqSXMbw.exe
  C:\Windows\System\UqSXMbw.exe
  2⤵
  PID:11980
- C:\Windows\System\wwnwILO.exe
  C:\Windows\System\wwnwILO.exe
  2⤵
  PID:12040
- C:\Windows\System\svlNwuG.exe
  C:\Windows\System\svlNwuG.exe
  2⤵
  PID:12068
- C:\Windows\System\CoFcYrR.exe
  C:\Windows\System\CoFcYrR.exe
  2⤵
  PID:12168
- C:\Windows\System\XMesSuB.exe
  C:\Windows\System\XMesSuB.exe
  2⤵
  PID:12208
- C:\Windows\System\mTPPIJH.exe
  C:\Windows\System\mTPPIJH.exe
  2⤵
  PID:11348
- C:\Windows\System\MtdKpVg.exe
  C:\Windows\System\MtdKpVg.exe
  2⤵
  PID:11420
- C:\Windows\System\uJvSGHj.exe
  C:\Windows\System\uJvSGHj.exe
  2⤵
  PID:11584
- C:\Windows\System\kVdYBdz.exe
  C:\Windows\System\kVdYBdz.exe
  2⤵
  PID:11604
- C:\Windows\System\FtOXmkx.exe
  C:\Windows\System\FtOXmkx.exe
  2⤵
  PID:11992
- C:\Windows\System\PCLszIj.exe
  C:\Windows\System\PCLszIj.exe
  2⤵
  PID:12132
- C:\Windows\System\DmCtvXa.exe
  C:\Windows\System\DmCtvXa.exe
  2⤵
  PID:12200
- C:\Windows\System\SRZnmkg.exe
  C:\Windows\System\SRZnmkg.exe
  2⤵
  PID:11328
- C:\Windows\System\cZNIKTl.exe
  C:\Windows\System\cZNIKTl.exe
  2⤵
  PID:11632
- C:\Windows\System\CKyeFIA.exe
  C:\Windows\System\CKyeFIA.exe
  2⤵
  PID:12036
- C:\Windows\System\hViryCq.exe
  C:\Windows\System\hViryCq.exe
  2⤵
  PID:11504
- C:\Windows\System\ENWoWhn.exe
  C:\Windows\System\ENWoWhn.exe
  2⤵
  PID:12304
- C:\Windows\System\PefqLwf.exe
  C:\Windows\System\PefqLwf.exe
  2⤵
  PID:12324
- C:\Windows\System\IrVmstd.exe
  C:\Windows\System\IrVmstd.exe
  2⤵
  PID:12360
- C:\Windows\System\iBTxhmo.exe
  C:\Windows\System\iBTxhmo.exe
  2⤵
  PID:12380
- C:\Windows\System\dyQeUYD.exe
  C:\Windows\System\dyQeUYD.exe
  2⤵
  PID:12404
- C:\Windows\System\oaGeseh.exe
  C:\Windows\System\oaGeseh.exe
  2⤵
  PID:12424
- C:\Windows\System\zdIRUCs.exe
  C:\Windows\System\zdIRUCs.exe
  2⤵
  PID:12476
- C:\Windows\System\GOgvFln.exe
  C:\Windows\System\GOgvFln.exe
  2⤵
  PID:12536
- C:\Windows\System\jVVFKZL.exe
  C:\Windows\System\jVVFKZL.exe
  2⤵
  PID:12556
- C:\Windows\System\ZKMUrnq.exe
  C:\Windows\System\ZKMUrnq.exe
  2⤵
  PID:12572
- C:\Windows\System\kRupksr.exe
  C:\Windows\System\kRupksr.exe
  2⤵
  PID:12676
- C:\Windows\System\uqFONms.exe
  C:\Windows\System\uqFONms.exe
  2⤵
  PID:12716
- C:\Windows\System\dATWXEf.exe
  C:\Windows\System\dATWXEf.exe
  2⤵
  PID:12736
- C:\Windows\System\NHdxlhy.exe
  C:\Windows\System\NHdxlhy.exe
  2⤵
  PID:12772
- C:\Windows\System\iiIeBUf.exe
  C:\Windows\System\iiIeBUf.exe
  2⤵
  PID:12824
- C:\Windows\System\hqzkWbZ.exe
  C:\Windows\System\hqzkWbZ.exe
  2⤵
  PID:12864
- C:\Windows\System\CSEjTer.exe
  C:\Windows\System\CSEjTer.exe
  2⤵
  PID:12888
- C:\Windows\System\ADGkDIc.exe
  C:\Windows\System\ADGkDIc.exe
  2⤵
  PID:12912
- C:\Windows\System\VqVcgmM.exe
  C:\Windows\System\VqVcgmM.exe
  2⤵
  PID:12940
- C:\Windows\System\OJSiFah.exe
  C:\Windows\System\OJSiFah.exe
  2⤵
  PID:12968
- C:\Windows\System\ATnOfUt.exe
  C:\Windows\System\ATnOfUt.exe
  2⤵
  PID:12992
- C:\Windows\System\evJAiMe.exe
  C:\Windows\System\evJAiMe.exe
  2⤵
  PID:13012
- C:\Windows\System\qbedGdV.exe
  C:\Windows\System\qbedGdV.exe
  2⤵
  PID:13052
- C:\Windows\System\GMoDzvK.exe
  C:\Windows\System\GMoDzvK.exe
  2⤵
  PID:13080
- C:\Windows\System\QMZkJkI.exe
  C:\Windows\System\QMZkJkI.exe
  2⤵
  PID:13108
- C:\Windows\System\gjjPFCW.exe
  C:\Windows\System\gjjPFCW.exe
  2⤵
  PID:13132
- C:\Windows\System\FhrxgSZ.exe
  C:\Windows\System\FhrxgSZ.exe
  2⤵
  PID:13152
- C:\Windows\System\vofqLKb.exe
  C:\Windows\System\vofqLKb.exe
  2⤵
  PID:13176
- C:\Windows\System\mPJcfnx.exe
  C:\Windows\System\mPJcfnx.exe
  2⤵
  PID:13196
- C:\Windows\System\wqQSezU.exe
  C:\Windows\System\wqQSezU.exe
  2⤵
  PID:13220
- C:\Windows\System\pYvlSch.exe
  C:\Windows\System\pYvlSch.exe
  2⤵
  PID:13240
- C:\Windows\System\KBtAgql.exe
  C:\Windows\System\KBtAgql.exe
  2⤵
  PID:13280
- C:\Windows\System\iPASATu.exe
  C:\Windows\System\iPASATu.exe
  2⤵
  PID:13300
- C:\Windows\System\PukUOGK.exe
  C:\Windows\System\PukUOGK.exe
  2⤵
  PID:1572
- C:\Windows\System\NxTZkQn.exe
  C:\Windows\System\NxTZkQn.exe
  2⤵
  PID:12300
- C:\Windows\System\nWczzJP.exe
  C:\Windows\System\nWczzJP.exe
  2⤵
  PID:12396
- C:\Windows\System\ukDpHJs.exe
  C:\Windows\System\ukDpHJs.exe
  2⤵
  PID:12440
- C:\Windows\System\CVdWFQR.exe
  C:\Windows\System\CVdWFQR.exe
  2⤵
  PID:12420
- C:\Windows\System\yONHfVF.exe
  C:\Windows\System\yONHfVF.exe
  2⤵
  PID:12612
- C:\Windows\System\eLyUDHy.exe
  C:\Windows\System\eLyUDHy.exe
  2⤵
  PID:12692
- C:\Windows\System\QYOxoFU.exe
  C:\Windows\System\QYOxoFU.exe
  2⤵
  PID:12652
- C:\Windows\System\lnTtjlF.exe
  C:\Windows\System\lnTtjlF.exe
  2⤵
  PID:12580
- C:\Windows\System\NwPQFWW.exe
  C:\Windows\System\NwPQFWW.exe
  2⤵
  PID:12544
- C:\Windows\System\GdiwyXv.exe
  C:\Windows\System\GdiwyXv.exe
  2⤵
  PID:12664
- C:\Windows\System\zavTULv.exe
  C:\Windows\System\zavTULv.exe
  2⤵
  PID:12820
- C:\Windows\System\lgHvDcE.exe
  C:\Windows\System\lgHvDcE.exe
  2⤵
  PID:12880
- C:\Windows\System\UFbkQrp.exe
  C:\Windows\System\UFbkQrp.exe
  2⤵
  PID:13068
- C:\Windows\System\cmkHVWS.exe
  C:\Windows\System\cmkHVWS.exe
  2⤵
  PID:12964
- C:\Windows\System\JLtStMi.exe
  C:\Windows\System\JLtStMi.exe
  2⤵
  PID:13188
- C:\Windows\System\leFcjxn.exe
  C:\Windows\System\leFcjxn.exe
  2⤵
  PID:4480
- C:\Windows\System\LLnFLhM.exe
  C:\Windows\System\LLnFLhM.exe
  2⤵
  PID:1424
- C:\Windows\System\vMrnRMN.exe
  C:\Windows\System\vMrnRMN.exe
  2⤵
  PID:12344
- C:\Windows\System\kUFLemM.exe
  C:\Windows\System\kUFLemM.exe
  2⤵
  PID:3984
- C:\Windows\System\kpOagjm.exe
  C:\Windows\System\kpOagjm.exe
  2⤵
  PID:2620
- C:\Windows\System\cbruHZo.exe
  C:\Windows\System\cbruHZo.exe
  2⤵
  PID:12564
- C:\Windows\System\RfOsUcF.exe
  C:\Windows\System\RfOsUcF.exe
  2⤵
  PID:6072
- C:\Windows\System\LjQgKct.exe
  C:\Windows\System\LjQgKct.exe
  2⤵
  PID:6612
- C:\Windows\System\WyCNoBA.exe
  C:\Windows\System\WyCNoBA.exe
  2⤵
  PID:2680
- C:\Windows\System\WpPhGWD.exe
  C:\Windows\System\WpPhGWD.exe
  2⤵
  PID:1652
- C:\Windows\System\hexIVJh.exe
  C:\Windows\System\hexIVJh.exe
  2⤵
  PID:3668
- C:\Windows\System\wYKQcPj.exe
  C:\Windows\System\wYKQcPj.exe
  2⤵
  PID:1700
- C:\Windows\System\RAhOQfX.exe
  C:\Windows\System\RAhOQfX.exe
  2⤵
  PID:7660
- C:\Windows\System\mXjqFhB.exe
  C:\Windows\System\mXjqFhB.exe
  2⤵
  PID:1936
- C:\Windows\System\VBIZegs.exe
  C:\Windows\System\VBIZegs.exe
  2⤵
  PID:6248
- C:\Windows\System\HShZbFW.exe
  C:\Windows\System\HShZbFW.exe
  2⤵
  PID:3368
- C:\Windows\System\kUUlEuZ.exe
  C:\Windows\System\kUUlEuZ.exe
  2⤵
  PID:3252
- C:\Windows\System\ASNCJYP.exe
  C:\Windows\System\ASNCJYP.exe
  2⤵
  PID:1356
- C:\Windows\System\eHuBwAv.exe
  C:\Windows\System\eHuBwAv.exe
  2⤵
  PID:1784
- C:\Windows\System\wVcEJne.exe
  C:\Windows\System\wVcEJne.exe
  2⤵
  PID:1616
- C:\Windows\System\WsrjDjY.exe
  C:\Windows\System\WsrjDjY.exe
  2⤵
  PID:4912
- C:\Windows\System\tshNkOp.exe
  C:\Windows\System\tshNkOp.exe
  2⤵
  PID:3340
- C:\Windows\System\OpdpXtg.exe
  C:\Windows\System\OpdpXtg.exe
  2⤵
  PID:7804
- C:\Windows\System\lSnBCoc.exe
  C:\Windows\System\lSnBCoc.exe
  2⤵
  PID:1552
- C:\Windows\System\HoMgBQm.exe
  C:\Windows\System\HoMgBQm.exe
  2⤵
  PID:3220
- C:\Windows\System\QhsgKfm.exe
  C:\Windows\System\QhsgKfm.exe
  2⤵
  PID:4624
- C:\Windows\System\JygmjoI.exe
  C:\Windows\System\JygmjoI.exe
  2⤵
  PID:13232
- C:\Windows\System\WplwlCD.exe
  C:\Windows\System\WplwlCD.exe
  2⤵
  PID:13276
- C:\Windows\System\PwKeyLx.exe
  C:\Windows\System\PwKeyLx.exe
  2⤵
  PID:4100
- C:\Windows\System\NLsGqBO.exe
  C:\Windows\System\NLsGqBO.exe
  2⤵
  PID:2284
- C:\Windows\System\mUFZTnI.exe
  C:\Windows\System\mUFZTnI.exe
  2⤵
  PID:2324
- C:\Windows\System\ryVSAjP.exe
  C:\Windows\System\ryVSAjP.exe
  2⤵
  PID:4828
- C:\Windows\System\UWlQIMU.exe
  C:\Windows\System\UWlQIMU.exe
  2⤵
  PID:13296
- C:\Windows\System\OjPdZQE.exe
  C:\Windows\System\OjPdZQE.exe
  2⤵
  PID:13264
- C:\Windows\System\yyGejod.exe
  C:\Windows\System\yyGejod.exe
  2⤵
  PID:3600
- C:\Windows\System\dTlqCzn.exe
  C:\Windows\System\dTlqCzn.exe
  2⤵
  PID:3936
- C:\Windows\System\yURXlbo.exe
  C:\Windows\System\yURXlbo.exe
  2⤵
  PID:3880
- C:\Windows\System\ptCBuKe.exe
  C:\Windows\System\ptCBuKe.exe
  2⤵
  PID:744
- C:\Windows\System\JJcexPd.exe
  C:\Windows\System\JJcexPd.exe
  2⤵
  PID:12620
- C:\Windows\System\KVroPDg.exe
  C:\Windows\System\KVroPDg.exe
  2⤵
  PID:1196
- C:\Windows\System\TYmztNa.exe
  C:\Windows\System\TYmztNa.exe
  2⤵
  PID:12752
- C:\Windows\System\ePjLCAH.exe
  C:\Windows\System\ePjLCAH.exe
  2⤵
  PID:4388
- C:\Windows\System\atqRhGl.exe
  C:\Windows\System\atqRhGl.exe
  2⤵
  PID:2772
- C:\Windows\System\ySgPssg.exe
  C:\Windows\System\ySgPssg.exe
  2⤵
  PID:2256
- C:\Windows\System\inwAmPk.exe
  C:\Windows\System\inwAmPk.exe
  2⤵
  PID:1064
- C:\Windows\System\zkBZITw.exe
  C:\Windows\System\zkBZITw.exe
  2⤵
  PID:768
- C:\Windows\System\oFtnNxp.exe
  C:\Windows\System\oFtnNxp.exe
  2⤵
  PID:7192
- C:\Windows\System\QmGfjVV.exe
  C:\Windows\System\QmGfjVV.exe
  2⤵
  PID:5216
- C:\Windows\System\AqkZAgB.exe
  C:\Windows\System\AqkZAgB.exe
  2⤵
  PID:2672
- C:\Windows\System\MkGAtJE.exe
  C:\Windows\System\MkGAtJE.exe
  2⤵
  PID:3828
- C:\Windows\System\VJAyQxR.exe
  C:\Windows\System\VJAyQxR.exe
  2⤵
  PID:1604
- C:\Windows\System\FvxhGLJ.exe
  C:\Windows\System\FvxhGLJ.exe
  2⤵
  PID:220
- C:\Windows\System\lsUmXWs.exe
  C:\Windows\System\lsUmXWs.exe
  2⤵
  PID:4376
- C:\Windows\System\yxRufST.exe
  C:\Windows\System\yxRufST.exe
  2⤵
  PID:3908
- C:\Windows\System\esosCek.exe
  C:\Windows\System\esosCek.exe
  2⤵
  PID:13040
- C:\Windows\System\XSyszhf.exe
  C:\Windows\System\XSyszhf.exe
  2⤵
  PID:4772
- C:\Windows\System\oFNrbjI.exe
  C:\Windows\System\oFNrbjI.exe
  2⤵
  PID:4640
- C:\Windows\System\iSSQuur.exe
  C:\Windows\System\iSSQuur.exe
  2⤵
  PID:13104
- C:\Windows\System\LsJTPXP.exe
  C:\Windows\System\LsJTPXP.exe
  2⤵
  PID:2768
- C:\Windows\System\xMxTPUo.exe
  C:\Windows\System\xMxTPUo.exe
  2⤵
  PID:228
- C:\Windows\System\IXaXDjQ.exe
  C:\Windows\System\IXaXDjQ.exe
  2⤵
  PID:1096
- C:\Windows\System\kdqnlcI.exe
  C:\Windows\System\kdqnlcI.exe
  2⤵
  PID:5072
- C:\Windows\System\VOBJziY.exe
  C:\Windows\System\VOBJziY.exe
  2⤵
  PID:7508
- C:\Windows\System\SsNgilE.exe
  C:\Windows\System\SsNgilE.exe
  2⤵
  PID:5340
- C:\Windows\System\tdhfbAa.exe
  C:\Windows\System\tdhfbAa.exe
  2⤵
  PID:588
- C:\Windows\System\WXQFlqQ.exe
  C:\Windows\System\WXQFlqQ.exe
  2⤵
  PID:4348
- C:\Windows\System\odkZPWP.exe
  C:\Windows\System\odkZPWP.exe
  2⤵
  PID:1208
- C:\Windows\System\PADamTm.exe
  C:\Windows\System\PADamTm.exe
  2⤵
  PID:636
- C:\Windows\System\uVjWEXc.exe
  C:\Windows\System\uVjWEXc.exe
  2⤵
  PID:232
- C:\Windows\System\gtKaUNf.exe
  C:\Windows\System\gtKaUNf.exe
  2⤵
  PID:5532
- C:\Windows\System\XChCfZV.exe
  C:\Windows\System\XChCfZV.exe
  2⤵
  PID:752
- C:\Windows\System\TPMItfs.exe
  C:\Windows\System\TPMItfs.exe
  2⤵
  PID:5608
- C:\Windows\System\bFHYOJo.exe
  C:\Windows\System\bFHYOJo.exe
  2⤵
  PID:5588
- C:\Windows\System\ZBuXosx.exe
  C:\Windows\System\ZBuXosx.exe
  2⤵
  PID:1764
- C:\Windows\System\rMHDhtY.exe
  C:\Windows\System\rMHDhtY.exe
  2⤵
  PID:5636
- C:\Windows\System\TXWrOka.exe
  C:\Windows\System\TXWrOka.exe
  2⤵
  PID:3464
- C:\Windows\System\YPYDFmv.exe
  C:\Windows\System\YPYDFmv.exe
  2⤵
  PID:4188
- C:\Windows\System\zafzlKN.exe
  C:\Windows\System\zafzlKN.exe
  2⤵
  PID:916
- C:\Windows\System\PhBNGPF.exe
  C:\Windows\System\PhBNGPF.exe
  2⤵
  PID:5048
- C:\Windows\System\UvixJFF.exe
  C:\Windows\System\UvixJFF.exe
  2⤵
  PID:8
- C:\Windows\System\VKaLDxI.exe
  C:\Windows\System\VKaLDxI.exe
  2⤵
  PID:12296
- C:\Windows\System\vltwotp.exe
  C:\Windows\System\vltwotp.exe
  2⤵
  PID:5692
- C:\Windows\System\jOMdENM.exe
  C:\Windows\System\jOMdENM.exe
  2⤵
  PID:3244
- C:\Windows\System\WoeZnfa.exe
  C:\Windows\System\WoeZnfa.exe
  2⤵
  PID:3516
- C:\Windows\System\OOuUHNn.exe
  C:\Windows\System\OOuUHNn.exe
  2⤵
  PID:8004
- C:\Windows\System\pfziHgW.exe
  C:\Windows\System\pfziHgW.exe
  2⤵
  PID:4208
- C:\Windows\System\cgMKljb.exe
  C:\Windows\System\cgMKljb.exe
  2⤵
  PID:3520
- C:\Windows\System\cvOBOMQ.exe
  C:\Windows\System\cvOBOMQ.exe
  2⤵
  PID:8024
- C:\Windows\System\gfWyysc.exe
  C:\Windows\System\gfWyysc.exe
  2⤵
  PID:8080
- C:\Windows\System\lbxXFfI.exe
  C:\Windows\System\lbxXFfI.exe
  2⤵
  PID:8172
- C:\Windows\System\YPwoDLn.exe
  C:\Windows\System\YPwoDLn.exe
  2⤵
  PID:7204
- C:\Windows\System\BQyDxbp.exe
  C:\Windows\System\BQyDxbp.exe
  2⤵
  PID:7256
- C:\Windows\System\GUubGzN.exe
  C:\Windows\System\GUubGzN.exe
  2⤵
  PID:7384
- C:\Windows\System\ZSqaTfr.exe
  C:\Windows\System\ZSqaTfr.exe
  2⤵
  PID:6388
- C:\Windows\System\uNPefTd.exe
  C:\Windows\System\uNPefTd.exe
  2⤵
  PID:7680
- C:\Windows\System\coavsZk.exe
  C:\Windows\System\coavsZk.exe
  2⤵
  PID:12936
- C:\Windows\System\UNXaqNG.exe
  C:\Windows\System\UNXaqNG.exe
  2⤵
  PID:5812
- C:\Windows\System\eDNHLJO.exe
  C:\Windows\System\eDNHLJO.exe
  2⤵
  PID:12976
- C:\Windows\System\BuTVEGv.exe
  C:\Windows\System\BuTVEGv.exe
  2⤵
  PID:5900
- C:\Windows\System\MLYbbUS.exe
  C:\Windows\System\MLYbbUS.exe
  2⤵
  PID:5956
- C:\Windows\System\OeQcEle.exe
  C:\Windows\System\OeQcEle.exe
  2⤵
  PID:2264
- C:\Windows\System\vTrNisP.exe
  C:\Windows\System\vTrNisP.exe
  2⤵
  PID:4120
- C:\Windows\System\RSVUvTQ.exe
  C:\Windows\System\RSVUvTQ.exe
  2⤵
  PID:6036
- C:\Windows\System\GYPiTyT.exe
  C:\Windows\System\GYPiTyT.exe
  2⤵
  PID:8124
- C:\Windows\System\riqkTdW.exe
  C:\Windows\System\riqkTdW.exe
  2⤵
  PID:12908
- C:\Windows\System\vKwhwhs.exe
  C:\Windows\System\vKwhwhs.exe
  2⤵
  PID:12812
- C:\Windows\System\UIGPLXa.exe
  C:\Windows\System\UIGPLXa.exe
  2⤵
  PID:1728
- C:\Windows\System\nDceZjr.exe
  C:\Windows\System\nDceZjr.exe
  2⤵
  PID:2720
- C:\Windows\System\UWLzALm.exe
  C:\Windows\System\UWLzALm.exe
  2⤵
  PID:7112
- C:\Windows\System\zJNHcgs.exe
  C:\Windows\System\zJNHcgs.exe
  2⤵
  PID:6120
- C:\Windows\System\GduqSNE.exe
  C:\Windows\System\GduqSNE.exe
  2⤵
  PID:7612
- C:\Windows\System\XIJDrrK.exe
  C:\Windows\System\XIJDrrK.exe
  2⤵
  PID:3836
- C:\Windows\System\rtAaqRi.exe
  C:\Windows\System\rtAaqRi.exe
  2⤵
  PID:3992
- C:\Windows\System\bTGIhCr.exe
  C:\Windows\System\bTGIhCr.exe
  2⤵
  PID:13008
- C:\Windows\System\eTGHFmn.exe
  C:\Windows\System\eTGHFmn.exe
  2⤵
  PID:6668
- C:\Windows\System\HezsRot.exe
  C:\Windows\System\HezsRot.exe
  2⤵
  PID:4416
- C:\Windows\System\AwuTHiG.exe
  C:\Windows\System\AwuTHiG.exe
  2⤵
  PID:12932
- C:\Windows\System\mxVWdSr.exe
  C:\Windows\System\mxVWdSr.exe
  2⤵
  PID:5228
- C:\Windows\System\LFmJHmW.exe
  C:\Windows\System\LFmJHmW.exe
  2⤵
  PID:2308
- C:\Windows\System\NNZtkRz.exe
  C:\Windows\System\NNZtkRz.exe
  2⤵
  PID:7440
- C:\Windows\System\QWbJAGP.exe
  C:\Windows\System\QWbJAGP.exe
  2⤵
  PID:4252
- C:\Windows\System\duqDAqB.exe
  C:\Windows\System\duqDAqB.exe
  2⤵
  PID:2376
- C:\Windows\System\XTCEUwI.exe
  C:\Windows\System\XTCEUwI.exe
  2⤵
  PID:5368
- C:\Windows\System\CFNqnvy.exe
  C:\Windows\System\CFNqnvy.exe
  2⤵
  PID:8232
- C:\Windows\System\wGrnJsF.exe
  C:\Windows\System\wGrnJsF.exe
  2⤵
  PID:5264
- C:\Windows\System\vXtFCGS.exe
  C:\Windows\System\vXtFCGS.exe
  2⤵
  PID:4560
- C:\Windows\System\IWbMvCH.exe
  C:\Windows\System\IWbMvCH.exe
  2⤵
  PID:5364
- C:\Windows\System\kTswwRg.exe
  C:\Windows\System\kTswwRg.exe
  2⤵
  PID:1800
- C:\Windows\System\LykZaju.exe
  C:\Windows\System\LykZaju.exe
  2⤵
  PID:416
- C:\Windows\System\FqmFIxf.exe
  C:\Windows\System\FqmFIxf.exe
  2⤵
  PID:8488
- C:\Windows\System\OEJywgC.exe
  C:\Windows\System\OEJywgC.exe
  2⤵
  PID:8548
- C:\Windows\System\jkHVIpP.exe
  C:\Windows\System\jkHVIpP.exe
  2⤵
  PID:3612
- C:\Windows\System\JFtTZcl.exe
  C:\Windows\System\JFtTZcl.exe
  2⤵
  PID:5256
- C:\Windows\System\GsgNCdv.exe
  C:\Windows\System\GsgNCdv.exe
  2⤵
  PID:2852
- C:\Windows\System\mdRcwwt.exe
  C:\Windows\System\mdRcwwt.exe
  2⤵
  PID:1864
- C:\Windows\System\uQsqxWD.exe
  C:\Windows\System\uQsqxWD.exe
  2⤵
  PID:8576
- C:\Windows\System\aDXakRk.exe
  C:\Windows\System\aDXakRk.exe
  2⤵
  PID:5452
- C:\Windows\System\AVOlhIN.exe
  C:\Windows\System\AVOlhIN.exe
  2⤵
  PID:8656
- C:\Windows\System\XvhEFcb.exe
  C:\Windows\System\XvhEFcb.exe
  2⤵
  PID:3904
- C:\Windows\System\qCAnihd.exe
  C:\Windows\System\qCAnihd.exe
  2⤵
  PID:8676
- C:\Windows\System\amdNgeK.exe
  C:\Windows\System\amdNgeK.exe
  2⤵
  PID:7588
- C:\Windows\System\iODrpHV.exe
  C:\Windows\System\iODrpHV.exe
  2⤵
  PID:13088
- C:\Windows\System\BoPGULF.exe
  C:\Windows\System\BoPGULF.exe
  2⤵
  PID:5504
- C:\Windows\System\spDRHpR.exe
  C:\Windows\System\spDRHpR.exe
  2⤵
  PID:2528
- C:\Windows\System\pKWbDIM.exe
  C:\Windows\System\pKWbDIM.exe
  2⤵
  PID:5292
- C:\Windows\System\VnuaBvK.exe
  C:\Windows\System\VnuaBvK.exe
  2⤵
  PID:5428
- C:\Windows\System\mLdnViu.exe
  C:\Windows\System\mLdnViu.exe
  2⤵
  PID:5548
- C:\Windows\System\cbROTZc.exe
  C:\Windows\System\cbROTZc.exe
  2⤵
  PID:4184
- C:\Windows\System\mnvyOlV.exe
  C:\Windows\System\mnvyOlV.exe
  2⤵
  PID:7656
- C:\Windows\System\yvFmTpF.exe
  C:\Windows\System\yvFmTpF.exe
  2⤵
  PID:7952
- C:\Windows\System\fnIUkjN.exe
  C:\Windows\System\fnIUkjN.exe
  2⤵
  PID:8928
- C:\Windows\System\xsEHrjg.exe
  C:\Windows\System\xsEHrjg.exe
  2⤵
  PID:5684
- C:\Windows\System\knjVTrY.exe
  C:\Windows\System\knjVTrY.exe
  2⤵
  PID:5820
- C:\Windows\System\uNnXiJx.exe
  C:\Windows\System\uNnXiJx.exe
  2⤵
  PID:4572
- C:\Windows\System\FOkgHye.exe
  C:\Windows\System\FOkgHye.exe
  2⤵
  PID:12236
- C:\Windows\System\RXxqQVi.exe
  C:\Windows\System\RXxqQVi.exe
  2⤵
  PID:8040
- C:\Windows\System\eYrppJo.exe
  C:\Windows\System\eYrppJo.exe
  2⤵
  PID:2600
- C:\Windows\System\rnoCkFF.exe
  C:\Windows\System\rnoCkFF.exe
  2⤵
  PID:5784
- C:\Windows\System\dtSLcgF.exe
  C:\Windows\System\dtSLcgF.exe
  2⤵
  PID:2536
- C:\Windows\System\QkbjYHu.exe
  C:\Windows\System\QkbjYHu.exe
  2⤵
  PID:7248
- C:\Windows\System\IHbDQeg.exe
  C:\Windows\System\IHbDQeg.exe
  2⤵
  PID:5756
- C:\Windows\System\FKzBwlj.exe
  C:\Windows\System\FKzBwlj.exe
  2⤵
  PID:8100
- C:\Windows\System\TDLwagD.exe
  C:\Windows\System\TDLwagD.exe
  2⤵
  PID:2868
- C:\Windows\System\XjYkasg.exe
  C:\Windows\System\XjYkasg.exe
  2⤵
  PID:3952
- C:\Windows\System\ivVNdRf.exe
  C:\Windows\System\ivVNdRf.exe
  2⤵
  PID:6916
- C:\Windows\System\CXyDCdq.exe
  C:\Windows\System\CXyDCdq.exe
  2⤵
  PID:7636
- C:\Windows\System\WjYDvdr.exe
  C:\Windows\System\WjYDvdr.exe
  2⤵
  PID:7764
- C:\Windows\System\kgPqjRb.exe
  C:\Windows\System\kgPqjRb.exe
  2⤵
  PID:5832
- C:\Windows\System\RXuLJFm.exe
  C:\Windows\System\RXuLJFm.exe
  2⤵
  PID:5372
- C:\Windows\System\EPaokzo.exe
  C:\Windows\System\EPaokzo.exe
  2⤵
  PID:5512
- C:\Windows\System\FFxgNEc.exe
  C:\Windows\System\FFxgNEc.exe
  2⤵
  PID:5764
- C:\Windows\System\dsEeUzY.exe
  C:\Windows\System\dsEeUzY.exe
  2⤵
  PID:8052
- C:\Windows\System\bckPBQy.exe
  C:\Windows\System\bckPBQy.exe
  2⤵
  PID:5996
- C:\Windows\System\ZcwwEEJ.exe
  C:\Windows\System\ZcwwEEJ.exe
  2⤵
  PID:6148
- C:\Windows\System\AcxVNSO.exe
  C:\Windows\System\AcxVNSO.exe
  2⤵
  PID:13160
- C:\Windows\System\EXMqDsJ.exe
  C:\Windows\System\EXMqDsJ.exe
  2⤵
  PID:6168
- C:\Windows\System\bOqSceV.exe
  C:\Windows\System\bOqSceV.exe
  2⤵
  PID:4660
- C:\Windows\System\BdgxLJe.exe
  C:\Windows\System\BdgxLJe.exe
  2⤵
  PID:3024
- C:\Windows\System\EbHPJWW.exe
  C:\Windows\System\EbHPJWW.exe
  2⤵
  PID:7424
- C:\Windows\System\aorveOZ.exe
  C:\Windows\System\aorveOZ.exe
  2⤵
  PID:6260
- C:\Windows\System\yjFGgkg.exe
  C:\Windows\System\yjFGgkg.exe
  2⤵
  PID:7592
- C:\Windows\System\heQJTlY.exe
  C:\Windows\System\heQJTlY.exe
  2⤵
  PID:6288
- C:\Windows\System\feMvBlz.exe
  C:\Windows\System\feMvBlz.exe
  2⤵
  PID:1916
- C:\Windows\System\pBPNEww.exe
  C:\Windows\System\pBPNEww.exe
  2⤵
  PID:8940
- C:\Windows\System\fpbaJFL.exe
  C:\Windows\System\fpbaJFL.exe
  2⤵
  PID:960
- C:\Windows\System\NBKrsSG.exe
  C:\Windows\System\NBKrsSG.exe
  2⤵
  PID:7676
- C:\Windows\System\VvPwupe.exe
  C:\Windows\System\VvPwupe.exe
  2⤵
  PID:6320
- C:\Windows\System\oaeZUsS.exe
  C:\Windows\System\oaeZUsS.exe
  2⤵
  PID:1328
- C:\Windows\System\IaFLRvq.exe
  C:\Windows\System\IaFLRvq.exe
  2⤵
  PID:5156
- C:\Windows\System\oKypLYY.exe
  C:\Windows\System\oKypLYY.exe
  2⤵
  PID:4020
- C:\Windows\System\AufjeJg.exe
  C:\Windows\System\AufjeJg.exe
  2⤵
  PID:8420
- C:\Windows\System\wPijqEg.exe
  C:\Windows\System\wPijqEg.exe
  2⤵
  PID:2428
- C:\Windows\System\PAaVKCr.exe
  C:\Windows\System\PAaVKCr.exe
  2⤵
  PID:8500
- C:\Windows\System\ZhxdatC.exe
  C:\Windows\System\ZhxdatC.exe
  2⤵
  PID:3760
- C:\Windows\System\DIgSqmW.exe
  C:\Windows\System\DIgSqmW.exe
  2⤵
  PID:6504
- C:\Windows\System\iMPJplu.exe
  C:\Windows\System\iMPJplu.exe
  2⤵
  PID:9492
- C:\Windows\System\DkQppqS.exe
  C:\Windows\System\DkQppqS.exe
  2⤵
  PID:9536
- C:\Windows\System\ScBLkVZ.exe
  C:\Windows\System\ScBLkVZ.exe
  2⤵
  PID:6532
- C:\Windows\System\tTCPDRT.exe
  C:\Windows\System\tTCPDRT.exe
  2⤵
  PID:2092
- C:\Windows\System\jzPApoA.exe
  C:\Windows\System\jzPApoA.exe
  2⤵
  PID:6568
- C:\Windows\System\rumfatt.exe
  C:\Windows\System\rumfatt.exe
  2⤵
  PID:9612
- C:\Windows\System\nhKwoFF.exe
  C:\Windows\System\nhKwoFF.exe
  2⤵
  PID:8652
- C:\Windows\System\gFyVRek.exe
  C:\Windows\System\gFyVRek.exe
  2⤵
  PID:4148
- C:\Windows\System\GtbMANy.exe
  C:\Windows\System\GtbMANy.exe
  2⤵
  PID:7568
- C:\Windows\System\RQGnSIs.exe
  C:\Windows\System\RQGnSIs.exe
  2⤵
  PID:9752
- C:\Windows\System\IoFuyon.exe
  C:\Windows\System\IoFuyon.exe
  2⤵
  PID:460
- C:\Windows\System\sbCroxx.exe
  C:\Windows\System\sbCroxx.exe
  2⤵
  PID:9792
- C:\Windows\System\mNHbNdG.exe
  C:\Windows\System\mNHbNdG.exe
  2⤵
  PID:2872
- C:\Windows\System\qPuuHTO.exe
  C:\Windows\System\qPuuHTO.exe
  2⤵
  PID:2156
- C:\Windows\System\EIUFVKj.exe
  C:\Windows\System\EIUFVKj.exe
  2⤵
  PID:6684
- C:\Windows\System\XeKxuuO.exe
  C:\Windows\System\XeKxuuO.exe
  2⤵
  PID:5604
- C:\Windows\System\bGVkdEO.exe
  C:\Windows\System\bGVkdEO.exe
  2⤵
  PID:6712
- C:\Windows\System\HAsFaiv.exe
  C:\Windows\System\HAsFaiv.exe
  2⤵
  PID:5624
- C:\Windows\System\OVGIEmJ.exe
  C:\Windows\System\OVGIEmJ.exe
  2⤵
  PID:6792
- C:\Windows\System\pimiKwy.exe
  C:\Windows\System\pimiKwy.exe
  2⤵
  PID:7824
- C:\Windows\System\REuswPu.exe
  C:\Windows\System\REuswPu.exe
  2⤵
  PID:5752
- C:\Windows\System\JUTQRlF.exe
  C:\Windows\System\JUTQRlF.exe
  2⤵
  PID:6824
- C:\Windows\System\Uaibqha.exe
  C:\Windows\System\Uaibqha.exe
  2⤵
  PID:8028
- C:\Windows\System\krGzHtD.exe
  C:\Windows\System\krGzHtD.exe
  2⤵
  PID:8140
- C:\Windows\System\IGAtoBG.exe
  C:\Windows\System\IGAtoBG.exe
  2⤵
  PID:780
- C:\Windows\System\RnCUWVC.exe
  C:\Windows\System\RnCUWVC.exe
  2⤵
  PID:6908
- C:\Windows\System\aNCUGDc.exe
  C:\Windows\System\aNCUGDc.exe
  2⤵
  PID:6936
- C:\Windows\System\oJyUUoQ.exe
  C:\Windows\System\oJyUUoQ.exe
  2⤵
  PID:2744
- C:\Windows\System\JNnCIIV.exe
  C:\Windows\System\JNnCIIV.exe
  2⤵
  PID:7736
- C:\Windows\System\dejSiic.exe
  C:\Windows\System\dejSiic.exe
  2⤵
  PID:7008
- C:\Windows\System\ZMLwbaM.exe
  C:\Windows\System\ZMLwbaM.exe
  2⤵
  PID:9588
- C:\Windows\System\jyasYBI.exe
  C:\Windows\System\jyasYBI.exe
  2⤵
  PID:9680
- C:\Windows\System\XeNKcYe.exe
  C:\Windows\System\XeNKcYe.exe
  2⤵
  PID:9760
- C:\Windows\System\PEKzgHz.exe
  C:\Windows\System\PEKzgHz.exe
  2⤵
  PID:7072
- C:\Windows\System\bIhdefK.exe
  C:\Windows\System\bIhdefK.exe
  2⤵
  PID:3892
- C:\Windows\System\WHUalAN.exe
  C:\Windows\System\WHUalAN.exe
  2⤵
  PID:5652
- C:\Windows\System\QaZoaLs.exe
  C:\Windows\System\QaZoaLs.exe
  2⤵
  PID:9960
- C:\Windows\System\KFldkkY.exe
  C:\Windows\System\KFldkkY.exe
  2⤵
  PID:7120
- C:\Windows\System\CNeLxrE.exe
  C:\Windows\System\CNeLxrE.exe
  2⤵
  PID:8156
- C:\Windows\System\oPTPjwb.exe
  C:\Windows\System\oPTPjwb.exe
  2⤵
  PID:12592
- C:\Windows\System\OtCTtJx.exe
  C:\Windows\System\OtCTtJx.exe
  2⤵
  PID:9352
- C:\Windows\System\OmSQPvq.exe
  C:\Windows\System\OmSQPvq.exe
  2⤵
  PID:6180
- C:\Windows\System\ilesdxk.exe
  C:\Windows\System\ilesdxk.exe
  2⤵
  PID:6100
- C:\Windows\System\vrAtycf.exe
  C:\Windows\System\vrAtycf.exe
  2⤵
  PID:6208
- C:\Windows\System\zPJnLGA.exe
  C:\Windows\System\zPJnLGA.exe
  2⤵
  PID:5124
- C:\Windows\System\KwfEeKh.exe
  C:\Windows\System\KwfEeKh.exe
  2⤵
  PID:5376
- C:\Windows\System\UiDCbqo.exe
  C:\Windows\System\UiDCbqo.exe
  2⤵
  PID:6688
- C:\Windows\System\ARjROuq.exe
  C:\Windows\System\ARjROuq.exe
  2⤵
  PID:9040
- C:\Windows\System\wnrUByV.exe
  C:\Windows\System\wnrUByV.exe
  2⤵
  PID:3860
- C:\Windows\System\VuAZkUl.exe
  C:\Windows\System\VuAZkUl.exe
  2⤵
  PID:5964
- C:\Windows\System\SpvLhor.exe
  C:\Windows\System\SpvLhor.exe
  2⤵
  PID:6344
- C:\Windows\System\oiMiepI.exe
  C:\Windows\System\oiMiepI.exe
  2⤵
  PID:8888
- C:\Windows\System\gnYbhLP.exe
  C:\Windows\System\gnYbhLP.exe
  2⤵
  PID:8284
- C:\Windows\System\DtTSacQ.exe
  C:\Windows\System\DtTSacQ.exe
  2⤵
  PID:5312
- C:\Windows\System\cFYjLlG.exe
  C:\Windows\System\cFYjLlG.exe
  2⤵
  PID:3844
- C:\Windows\System\WccOUxx.exe
  C:\Windows\System\WccOUxx.exe
  2⤵
  PID:6364
- C:\Windows\System\OTHhofK.exe
  C:\Windows\System\OTHhofK.exe
  2⤵
  PID:6420
- C:\Windows\System\bFcQnXd.exe
  C:\Windows\System\bFcQnXd.exe
  2⤵
  PID:10372
- C:\Windows\System\XnDRUVs.exe
  C:\Windows\System\XnDRUVs.exe
  2⤵
  PID:8708
- C:\Windows\System\nmIXfBp.exe
  C:\Windows\System\nmIXfBp.exe
  2⤵
  PID:7604
- C:\Windows\System\vhIFQDi.exe
  C:\Windows\System\vhIFQDi.exe
  2⤵
  PID:1756
- C:\Windows\System\VcDovoF.exe
  C:\Windows\System\VcDovoF.exe
  2⤵
  PID:6348
- C:\Windows\System\dQBGObk.exe
  C:\Windows\System\dQBGObk.exe
  2⤵
  PID:6400
- C:\Windows\System\CyDIYHH.exe
  C:\Windows\System\CyDIYHH.exe
  2⤵
  PID:8624
- C:\Windows\System\hvZhYGt.exe
  C:\Windows\System\hvZhYGt.exe
  2⤵
  PID:6804
- C:\Windows\System\KDwvHay.exe
  C:\Windows\System\KDwvHay.exe
  2⤵
  PID:6572
- C:\Windows\System\RLWAHgr.exe
  C:\Windows\System\RLWAHgr.exe
  2⤵
  PID:9888
- C:\Windows\System\zdQblDA.exe
  C:\Windows\System\zdQblDA.exe
  2⤵
  PID:6244
- C:\Windows\System\GIdHgCR.exe
  C:\Windows\System\GIdHgCR.exe
  2⤵
  PID:5284
- C:\Windows\System\yfRzBkY.exe
  C:\Windows\System\yfRzBkY.exe
  2⤵
  PID:1084
- C:\Windows\System\PEsABIU.exe
  C:\Windows\System\PEsABIU.exe
  2⤵
  PID:6360
- C:\Windows\System\wLyrlBN.exe
  C:\Windows\System\wLyrlBN.exe
  2⤵
  PID:8560
- C:\Windows\System\RwDlIiL.exe
  C:\Windows\System\RwDlIiL.exe
  2⤵
  PID:7488
- C:\Windows\System\ceVmVwd.exe
  C:\Windows\System\ceVmVwd.exe
  2⤵
  PID:10512
- C:\Windows\System\rjWPaku.exe
  C:\Windows\System\rjWPaku.exe
  2⤵
  PID:6528
- C:\Windows\System\WKupfMH.exe
  C:\Windows\System\WKupfMH.exe
  2⤵
  PID:6736
- C:\Windows\System\COmHTUI.exe
  C:\Windows\System\COmHTUI.exe
  2⤵
  PID:6764
- C:\Windows\System\aLFnAhA.exe
  C:\Windows\System\aLFnAhA.exe
  2⤵
  PID:5880
- C:\Windows\System\SuQoWgq.exe
  C:\Windows\System\SuQoWgq.exe
  2⤵
  PID:2896
- C:\Windows\System\TelJbyS.exe
  C:\Windows\System\TelJbyS.exe
  2⤵
  PID:5560
- C:\Windows\System\pAOOFhS.exe
  C:\Windows\System\pAOOFhS.exe
  2⤵
  PID:6664
- C:\Windows\System\rxaMZUb.exe
  C:\Windows\System\rxaMZUb.exe
  2⤵
  PID:6776
- C:\Windows\System\EBHmory.exe
  C:\Windows\System\EBHmory.exe
  2⤵
  PID:6840
- C:\Windows\System\IAkpGHi.exe
  C:\Windows\System\IAkpGHi.exe
  2⤵
  PID:6932
- C:\Windows\System\adfTNVV.exe
  C:\Windows\System\adfTNVV.exe
  2⤵
  PID:6780
- C:\Windows\System\VnGxawe.exe
  C:\Windows\System\VnGxawe.exe
  2⤵
  PID:8444
- C:\Windows\System\JcPnrad.exe
  C:\Windows\System\JcPnrad.exe
  2⤵
  PID:6952
- C:\Windows\System\eBsgXnR.exe
  C:\Windows\System\eBsgXnR.exe
  2⤵
  PID:6944
- C:\Windows\System\gEsiXya.exe
  C:\Windows\System\gEsiXya.exe
  2⤵
  PID:7456
- C:\Windows\System\hmqvBWj.exe
  C:\Windows\System\hmqvBWj.exe
  2⤵
  PID:7004
- C:\Windows\System\wAWxPok.exe
  C:\Windows\System\wAWxPok.exe
  2⤵
  PID:5176
- C:\Windows\System\oNIOKsu.exe
  C:\Windows\System\oNIOKsu.exe
  2⤵
  PID:5816
- C:\Windows\System\xkBDclC.exe
  C:\Windows\System\xkBDclC.exe
  2⤵
  PID:5436
- C:\Windows\System\kmqwsmQ.exe
  C:\Windows\System\kmqwsmQ.exe
  2⤵
  PID:5972
- C:\Windows\System\MPLkXxj.exe
  C:\Windows\System\MPLkXxj.exe
  2⤵
  PID:7076
- C:\Windows\System\pHkcaKm.exe
  C:\Windows\System\pHkcaKm.exe
  2⤵
  PID:2396
- C:\Windows\System\OCrRwza.exe
  C:\Windows\System\OCrRwza.exe
  2⤵
  PID:1052
- C:\Windows\System\jppppWa.exe
  C:\Windows\System\jppppWa.exe
  2⤵
  PID:5432
- C:\Windows\System\aUDkizP.exe
  C:\Windows\System\aUDkizP.exe
  2⤵
  PID:12628
- C:\Windows\System\zHlGmGm.exe
  C:\Windows\System\zHlGmGm.exe
  2⤵
  PID:10228
- C:\Windows\System\Shedihz.exe
  C:\Windows\System\Shedihz.exe
  2⤵
  PID:11076
- C:\Windows\System\gIHueoM.exe
  C:\Windows\System\gIHueoM.exe
  2⤵
  PID:3392
- C:\Windows\System\DCmnhJW.exe
  C:\Windows\System\DCmnhJW.exe
  2⤵
  PID:8792
- C:\Windows\System\xahNZgj.exe
  C:\Windows\System\xahNZgj.exe
  2⤵
  PID:2492
- C:\Windows\System\gVoNQpq.exe
  C:\Windows\System\gVoNQpq.exe
  2⤵
  PID:5144
- C:\Windows\System\MYphIsF.exe
  C:\Windows\System\MYphIsF.exe
  2⤵
  PID:11236
- C:\Windows\System\ovLGFxn.exe
  C:\Windows\System\ovLGFxn.exe
  2⤵
  PID:9248
- C:\Windows\System\CVNRGcz.exe
  C:\Windows\System\CVNRGcz.exe
  2⤵
  PID:4908
- C:\Windows\System\MCSTXPx.exe
  C:\Windows\System\MCSTXPx.exe
  2⤵
  PID:6404
- C:\Windows\System\nAwIwai.exe
  C:\Windows\System\nAwIwai.exe
  2⤵
  PID:1016
- C:\Windows\System\XPHPWcd.exe
  C:\Windows\System\XPHPWcd.exe
  2⤵
  PID:6300
- C:\Windows\System\jEyPjOX.exe
  C:\Windows\System\jEyPjOX.exe
  2⤵
  PID:4936
- C:\Windows\System\mBJwbUv.exe
  C:\Windows\System\mBJwbUv.exe
  2⤵
  PID:11112
- C:\Windows\System\XxVARqV.exe
  C:\Windows\System\XxVARqV.exe
  2⤵
  PID:9584
- C:\Windows\System\dyZArzq.exe
  C:\Windows\System\dyZArzq.exe
  2⤵
  PID:6628
- C:\Windows\System\BSyZViI.exe
  C:\Windows\System\BSyZViI.exe
  2⤵
  PID:4484
- C:\Windows\System\AHFcqmO.exe
  C:\Windows\System\AHFcqmO.exe
  2⤵
  PID:5936
- C:\Windows\System\CPSYoGT.exe
  C:\Windows\System\CPSYoGT.exe
  2⤵
  PID:6548
- C:\Windows\System\UvbAXNl.exe
  C:\Windows\System\UvbAXNl.exe
  2⤵
  PID:10476
- C:\Windows\System\obnfKRS.exe
  C:\Windows\System\obnfKRS.exe
  2⤵
  PID:5396
- C:\Windows\System\bXyCijR.exe
  C:\Windows\System\bXyCijR.exe
  2⤵
  PID:5748
- C:\Windows\System\jYkFvpA.exe
  C:\Windows\System\jYkFvpA.exe
  2⤵
  PID:6832
- C:\Windows\System\MZPrOWF.exe
  C:\Windows\System\MZPrOWF.exe
  2⤵
  PID:11212
- C:\Windows\System\nOqDaGB.exe
  C:\Windows\System\nOqDaGB.exe
  2⤵
  PID:10640
- C:\Windows\System\fFEWayt.exe
  C:\Windows\System\fFEWayt.exe
  2⤵
  PID:6988
- C:\Windows\System\lRDpnxd.exe
  C:\Windows\System\lRDpnxd.exe
  2⤵
  PID:7532
- C:\Windows\System\UKCAETB.exe
  C:\Windows\System\UKCAETB.exe
  2⤵
  PID:1588
- C:\Windows\System\jxlROrq.exe
  C:\Windows\System\jxlROrq.exe
  2⤵
  PID:5236
- C:\Windows\System\FKguctr.exe
  C:\Windows\System\FKguctr.exe
  2⤵
  PID:7044
- C:\Windows\System\klxBwAl.exe
  C:\Windows\System\klxBwAl.exe
  2⤵
  PID:7080
- C:\Windows\System\ZbdHhqH.exe
  C:\Windows\System\ZbdHhqH.exe
  2⤵
  PID:1260
- C:\Windows\System\izcvwLt.exe
  C:\Windows\System\izcvwLt.exe
  2⤵
  PID:9976
- C:\Windows\System\vCWKgbA.exe
  C:\Windows\System\vCWKgbA.exe
  2⤵
  PID:12960
- C:\Windows\System\zpukzLI.exe
  C:\Windows\System\zpukzLI.exe
  2⤵
  PID:10924
- C:\Windows\System\KKjkItC.exe
  C:\Windows\System\KKjkItC.exe
  2⤵
  PID:10200
- C:\Windows\System\KUBtZrg.exe
  C:\Windows\System\KUBtZrg.exe
  2⤵
  PID:12516
- C:\Windows\System\ViBuSYu.exe
  C:\Windows\System\ViBuSYu.exe
  2⤵
  PID:11472
- C:\Windows\System\PoEqvWS.exe
  C:\Windows\System\PoEqvWS.exe
  2⤵
  PID:9548
- C:\Windows\System\pgzKvAW.exe
  C:\Windows\System\pgzKvAW.exe
  2⤵
  PID:11512
- C:\Windows\System\dRwUDlR.exe
  C:\Windows\System\dRwUDlR.exe
  2⤵
  PID:11132
- C:\Windows\System\UpwihjD.exe
  C:\Windows\System\UpwihjD.exe
  2⤵
  PID:11600
- C:\Windows\System\QTDDoGo.exe
  C:\Windows\System\QTDDoGo.exe
  2⤵
  PID:10664
- C:\Windows\System\RTsgGTh.exe
  C:\Windows\System\RTsgGTh.exe
  2⤵
  PID:8732
- C:\Windows\System\IgALQCo.exe
  C:\Windows\System\IgALQCo.exe
  2⤵
  PID:11164
- C:\Windows\System\MiQhPTG.exe
  C:\Windows\System\MiQhPTG.exe
  2⤵
  PID:2028
- C:\Windows\System\EZioBdb.exe
  C:\Windows\System\EZioBdb.exe
  2⤵
  PID:10804
- C:\Windows\System\MHqVAgM.exe
  C:\Windows\System\MHqVAgM.exe
  2⤵
  PID:9732
- C:\Windows\System\nlQREjR.exe
  C:\Windows\System\nlQREjR.exe
  2⤵
  PID:10628
- C:\Windows\System\qbqKioR.exe
  C:\Windows\System\qbqKioR.exe
  2⤵
  PID:5252
- C:\Windows\System\HsxIoVZ.exe
  C:\Windows\System\HsxIoVZ.exe
  2⤵
  PID:9756
- C:\Windows\System\jgcBjBE.exe
  C:\Windows\System\jgcBjBE.exe
  2⤵
  PID:10352
- C:\Windows\System\ddFsXpo.exe
  C:\Windows\System\ddFsXpo.exe
  2⤵
  PID:9708
- C:\Windows\System\IGaawls.exe
  C:\Windows\System\IGaawls.exe
  2⤵
  PID:1872
- C:\Windows\System\FBLLjdH.exe
  C:\Windows\System\FBLLjdH.exe
  2⤵
  PID:7524
- C:\Windows\System\QaxYFsu.exe
  C:\Windows\System\QaxYFsu.exe
  2⤵
  PID:11912
- C:\Windows\System\cEmpyvc.exe
  C:\Windows\System\cEmpyvc.exe
  2⤵
  PID:9452
- C:\Windows\System\GNHycSD.exe
  C:\Windows\System\GNHycSD.exe
  2⤵
  PID:11000
- C:\Windows\System\NsMdryS.exe
  C:\Windows\System\NsMdryS.exe
  2⤵
  PID:9476
- C:\Windows\System\sFtoTVp.exe
  C:\Windows\System\sFtoTVp.exe
  2⤵
  PID:11168
- C:\Windows\System\phSSsGg.exe
  C:\Windows\System\phSSsGg.exe
  2⤵
  PID:12032
- C:\Windows\System\yMLQGDS.exe
  C:\Windows\System\yMLQGDS.exe
  2⤵
  PID:4076
- C:\Windows\System\gddEgSd.exe
  C:\Windows\System\gddEgSd.exe
  2⤵
  PID:12108
- C:\Windows\System\sokDzgu.exe
  C:\Windows\System\sokDzgu.exe
  2⤵
  PID:7932
- C:\Windows\System\omivcYy.exe
  C:\Windows\System\omivcYy.exe
  2⤵
  PID:2316
- C:\Windows\System\aSLlSKe.exe
  C:\Windows\System\aSLlSKe.exe
  2⤵
  PID:12220
- C:\Windows\System\chkZtyY.exe
  C:\Windows\System\chkZtyY.exe
  2⤵
  PID:6836
- C:\Windows\System\pmInTUs.exe
  C:\Windows\System\pmInTUs.exe
  2⤵
  PID:11268
- C:\Windows\System\YkZOIsk.exe
  C:\Windows\System\YkZOIsk.exe
  2⤵
  PID:11324
- C:\Windows\System\yZAHiDB.exe
  C:\Windows\System\yZAHiDB.exe
  2⤵
  PID:11364
- C:\Windows\System\AKxTvGP.exe
  C:\Windows\System\AKxTvGP.exe
  2⤵
  PID:7108
- C:\Windows\System\BiDLSYQ.exe
  C:\Windows\System\BiDLSYQ.exe
  2⤵
  PID:5576
- C:\Windows\System\ssDuTGa.exe
  C:\Windows\System\ssDuTGa.exe
  2⤵
  PID:11628
- C:\Windows\System\bKtNMjm.exe
  C:\Windows\System\bKtNMjm.exe
  2⤵
  PID:4352
- C:\Windows\System\KVAUvBo.exe
  C:\Windows\System\KVAUvBo.exe
  2⤵
  PID:7132
- C:\Windows\System\ygsKaMF.exe
  C:\Windows\System\ygsKaMF.exe
  2⤵
  PID:11800
- C:\Windows\System\jUISwKZ.exe
  C:\Windows\System\jUISwKZ.exe
  2⤵
  PID:11060
- C:\Windows\System\ZqzGqfY.exe
  C:\Windows\System\ZqzGqfY.exe
  2⤵
  PID:11552
- C:\Windows\System\GfMoNRs.exe
  C:\Windows\System\GfMoNRs.exe
  2⤵
  PID:10572
- C:\Windows\System\iQWbeFr.exe
  C:\Windows\System\iQWbeFr.exe
  2⤵
  PID:7924
- C:\Windows\System\mZAoSVf.exe
  C:\Windows\System\mZAoSVf.exe
  2⤵
  PID:7828
- C:\Windows\System\PhIAHEb.exe
  C:\Windows\System\PhIAHEb.exe
  2⤵
  PID:9288
- C:\Windows\System\XWzxCXi.exe
  C:\Windows\System\XWzxCXi.exe
  2⤵
  PID:6212
- C:\Windows\System\XWzqCfv.exe
  C:\Windows\System\XWzqCfv.exe
  2⤵
  PID:10552
- C:\Windows\System\RsluRZA.exe
  C:\Windows\System\RsluRZA.exe
  2⤵
  PID:11864
- C:\Windows\System\ZLLfSRX.exe
  C:\Windows\System\ZLLfSRX.exe
  2⤵
  PID:11960
- C:\Windows\System\DqmnpVm.exe
  C:\Windows\System\DqmnpVm.exe
  2⤵
  PID:6332
- C:\Windows\System\PGejsHL.exe
  C:\Windows\System\PGejsHL.exe
  2⤵
  PID:11996
- C:\Windows\System\bZRUfNs.exe
  C:\Windows\System\bZRUfNs.exe
  2⤵
  PID:3816
- C:\Windows\System\GajNRdV.exe
  C:\Windows\System\GajNRdV.exe
  2⤵
  PID:7916
- C:\Windows\System\QMXlrrN.exe
  C:\Windows\System\QMXlrrN.exe
  2⤵
  PID:10312
- C:\Windows\System\sPwfQMx.exe
  C:\Windows\System\sPwfQMx.exe
  2⤵
  PID:10896
- C:\Windows\System\WXOsosx.exe
  C:\Windows\System\WXOsosx.exe
  2⤵
  PID:11272
- C:\Windows\System\tEEXzal.exe
  C:\Windows\System\tEEXzal.exe
  2⤵
  PID:11596
- C:\Windows\System\PDMxKke.exe
  C:\Windows\System\PDMxKke.exe
  2⤵
  PID:2808
- C:\Windows\System\UokIrEw.exe
  C:\Windows\System\UokIrEw.exe
  2⤵
  PID:11436
- C:\Windows\System\lZMYmVc.exe
  C:\Windows\System\lZMYmVc.exe
  2⤵
  PID:10180
- C:\Windows\System\uRifwRY.exe
  C:\Windows\System\uRifwRY.exe
  2⤵
  PID:7236
- C:\Windows\System\XJTlyeI.exe
  C:\Windows\System\XJTlyeI.exe
  2⤵
  PID:9052
- C:\Windows\System\eBAltfr.exe
  C:\Windows\System\eBAltfr.exe
  2⤵
  PID:6596
- C:\Windows\System\yyjFloE.exe
  C:\Windows\System\yyjFloE.exe
  2⤵
  PID:11480
- C:\Windows\System\BwbVLsV.exe
  C:\Windows\System\BwbVLsV.exe
  2⤵
  PID:6896
- C:\Windows\System\OVJGvgp.exe
  C:\Windows\System\OVJGvgp.exe
  2⤵
  PID:11948
- C:\Windows\System\EaHlXvs.exe
  C:\Windows\System\EaHlXvs.exe
  2⤵
  PID:7332
- C:\Windows\System\wXmnavm.exe
  C:\Windows\System\wXmnavm.exe
  2⤵
  PID:12928
- C:\Windows\System\MqJszxP.exe
  C:\Windows\System\MqJszxP.exe
  2⤵
  PID:12980
- C:\Windows\System\ISFOgXE.exe
  C:\Windows\System\ISFOgXE.exe
  2⤵
  PID:11400
- C:\Windows\System\AHaJjDH.exe
  C:\Windows\System\AHaJjDH.exe
  2⤵
  PID:1432
- C:\Windows\System\MMiMpJb.exe
  C:\Windows\System\MMiMpJb.exe
  2⤵
  PID:13020
- C:\Windows\System\KDvJscJ.exe
  C:\Windows\System\KDvJscJ.exe
  2⤵
  PID:13072
- C:\Windows\System\JtatUHN.exe
  C:\Windows\System\JtatUHN.exe
  2⤵
  PID:10020
- C:\Windows\System\GeUEBEP.exe
  C:\Windows\System\GeUEBEP.exe
  2⤵
  PID:7436
- C:\Windows\System\WORpsZc.exe
  C:\Windows\System\WORpsZc.exe
  2⤵
  PID:8696
- C:\Windows\System\APNmXem.exe
  C:\Windows\System\APNmXem.exe
  2⤵
  PID:11368
- C:\Windows\System\HeCrdPm.exe
  C:\Windows\System\HeCrdPm.exe
  2⤵
  PID:11884
- C:\Windows\System\BZDHIaa.exe
  C:\Windows\System\BZDHIaa.exe
  2⤵
  PID:6700
- C:\Windows\System\zXtTDuw.exe
  C:\Windows\System\zXtTDuw.exe
  2⤵
  PID:7320
- C:\Windows\System\YcUcDWW.exe
  C:\Windows\System\YcUcDWW.exe
  2⤵
  PID:13352
- C:\Windows\System\VnBfqFr.exe
  C:\Windows\System\VnBfqFr.exe
  2⤵
  PID:13384
- C:\Windows\System\fhYGSFQ.exe
  C:\Windows\System\fhYGSFQ.exe
  2⤵
  PID:13400
- C:\Windows\System\sDOtQfQ.exe
  C:\Windows\System\sDOtQfQ.exe
  2⤵
  PID:13416
- C:\Windows\System\mrUVMCC.exe
  C:\Windows\System\mrUVMCC.exe
  2⤵
  PID:13432
- C:\Windows\System\FMRgZNl.exe
  C:\Windows\System\FMRgZNl.exe
  2⤵
  PID:13448
- C:\Windows\System\kqkpMLL.exe
  C:\Windows\System\kqkpMLL.exe
  2⤵
  PID:13464
- C:\Windows\System\bhubuHx.exe
  C:\Windows\System\bhubuHx.exe
  2⤵
  PID:13480
- C:\Windows\System\RfzQacY.exe
  C:\Windows\System\RfzQacY.exe
  2⤵
  PID:13496
- C:\Windows\System\NhSYlVS.exe
  C:\Windows\System\NhSYlVS.exe
  2⤵
  PID:13516
- C:\Windows\System\krYcnYx.exe
  C:\Windows\System\krYcnYx.exe
  2⤵
  PID:13536
- C:\Windows\System\lGaIVFh.exe
  C:\Windows\System\lGaIVFh.exe
  2⤵
  PID:13552
- C:\Windows\System\MIjwjfm.exe
  C:\Windows\System\MIjwjfm.exe
  2⤵
  PID:13576
- C:\Windows\System\roAvzFB.exe
  C:\Windows\System\roAvzFB.exe
  2⤵
  PID:13600
- C:\Windows\System\SGzoENs.exe
  C:\Windows\System\SGzoENs.exe
  2⤵
  PID:13620
- C:\Windows\System\VjBRaPT.exe
  C:\Windows\System\VjBRaPT.exe
  2⤵
  PID:13636
- C:\Windows\System\wNdJJSv.exe
  C:\Windows\System\wNdJJSv.exe
  2⤵
  PID:13656
- C:\Windows\System\DDDyoeA.exe
  C:\Windows\System\DDDyoeA.exe
  2⤵
  PID:13688
- C:\Windows\System\TAOHzwW.exe
  C:\Windows\System\TAOHzwW.exe
  2⤵
  PID:13712
- C:\Windows\System\HmGQTBE.exe
  C:\Windows\System\HmGQTBE.exe
  2⤵
  PID:13740
- C:\Windows\System\cDsugrF.exe
  C:\Windows\System\cDsugrF.exe
  2⤵
  PID:13764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x4wgid4l.2un.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AZQCvPo.exe

Filesize
2.3MB

MD5
22c6b2d1e57aacbaff14552b1ef60a53

SHA1
25ea7431b5c222828876d787a51c1b61990396af

SHA256
554b27c77d9aa43c5bd551381c6c736e7a747a53e101e9edfb8498031457d0e6

SHA512
eb817f28a7faaedb86f3dd9012e4684dd5aad885bf36db2e2762330951957ea057cc27918e9626d994f704805bfe619a65b171d08388896b09027879995ce9b7

Download Submit
C:\Windows\System\BKATmdZ.exe

Filesize
2.3MB

MD5
f5b2b91c9c975ffeeb5e1d243cc6b4f2

SHA1
a449f3e3d77b835a85937c6eb68f00cd83de8a94

SHA256
847a2bd4bad23a04c46d6fc87fb1322a84db20abd572891d238cb6e7c690652a

SHA512
1f5ee7901bcb59139087d2b7535b8bb4409c85a62bcc30cb7bc65c32e8edb5e19d269d38568e69d13e0225ba1f79db202c00780d0a7fb4d264ac80f45f074855

Download Submit
C:\Windows\System\BwvzJRI.exe

Filesize
2.3MB

MD5
ba46c3761f7c4f3dbd90c43c486ae160

SHA1
3b50b1e148be996a290db3fbd1708a548f284d46

SHA256
0fa0731cb9a1ce0c7440e621bb92da327e5b9c599173a00b9afec98870cac99a

SHA512
30302082df8eb7b33bec01b1a7c854e68ad35457431d7e140823c89ecdc702d6ad8c4a0006b38939e3a92c35c6148be8ad6ac6882d7ecfcecb3664453877a743

Download Submit
C:\Windows\System\CBbUkLI.exe

Filesize
2.4MB

MD5
1ff8adb42fb86110e58d78a8f7e8f07b

SHA1
9e98b8c0069769c1ed7d419c5cefcfcb633056c3

SHA256
352288a66f4c5fa1504f5eb55da476f6975112e223a6c1037637165ad2c68571

SHA512
90530377753e5f31bae8d89d5864b65b1f03bdd62d87165b98d870a76215f15305d60c7e387e8df794d6f4eaeb40dfc56aea50f770e0dbb2d51eb4ad66921fe5

Download Submit
C:\Windows\System\CJPesOD.exe

Filesize
2.3MB

MD5
bff2a39836fa634a8c07d82d98eef203

SHA1
75a625921893f850490db745c36a5af77e734c0e

SHA256
73372c94709e6cd995e6fa29795362b6cb9f2639db25b579e1eab8f0995dcd40

SHA512
3f12659e596ae311161939334d22bcecdaba6b1ea0105b96510551c229bf933e2542d09de23bd0bd3c26f38f9d48c5ee671b56a0fe7524e19c800f78c06b9f01

Download Submit
C:\Windows\System\EPPzPko.exe

Filesize
2.3MB

MD5
dfd0c76d8190ca5ebaf2be9419bb5522

SHA1
27c3652b64ebaf056140fa25ecae89e335d5fb61

SHA256
a451de73eda3d0b5b84b3234d072d5a68d148f6f4d6c318c98ed45e4626a0f6e

SHA512
a14f17100f5192f82dae86b4ed11706326b5c032732fc56878ed5d9a9f20fd475e85a783cda75622fdc72b9bbdc69fe1e9b9a5e8729f65f2a534f578c7d13d1a

Download Submit
C:\Windows\System\FWlUKqQ.exe

Filesize
2.3MB

MD5
6b135ef64136dbf5f6b84123aa855669

SHA1
b7e96bf9f31263f1d10351fc130e8c81183e4d78

SHA256
1f25293fc06f392bb06df074e2499289ac5ab2c647a9461db4d4b6f4cf6cd1d4

SHA512
d3f9b1c81f9fc3c1333e726be594e00dd789f8d269690e0a67d748a9ca4c0e976aacf3f8ef690bbcee6dd780c1c7d67fbc690944cee8ee0333b1a5d1f478b527

Download Submit
C:\Windows\System\FXiVwpo.exe

Filesize
2.3MB

MD5
00976b03391eee8b630837366f3c5097

SHA1
9db72fec64a02517eed932eca768d3aa4c83fd47

SHA256
2a74a5e55bab8b75a1cca6beffca2ec9f3eca626e34aa02a40c67524ae41bc91

SHA512
ca242c32376987bda5629b861a2889bfb71eff10ea166141d9cf85300d6d873fbba9e54588dbb0df1cd4ab957cd23602847998e2ad7a36b972ac590fb82c756c

Download Submit
C:\Windows\System\GbhYzjS.exe

Filesize
2.3MB

MD5
e7941ed00789bbc18119c5aeffc2ec7c

SHA1
45c4146facec654acbb741f57b44fa6670175c1c

SHA256
bd4498feba04492a6be6e372eeb202f26f9a875c5bcf0af9781f556e35a20e52

SHA512
c5eaa015f21c583b3b85903a625417866dc23814bf5b8896294a4215156847bf2638287dd1e5175d8e4b9ababc2e68fb43b61b076f234cd1cc8f1e41cae3baae

Download Submit
C:\Windows\System\GmFOyNi.exe

Filesize
2.3MB

MD5
0d7a7d814e65c0c2deb8e9367a83236a

SHA1
99ecae0a6479eef178c0661cb1e9d47ae2634630

SHA256
d187eff774f544cd8b842e8984270ecba1f0644a2b49b31c1437168a3e6e9f50

SHA512
766f0b78e59e7226acf9ce6fc089c12f4ace67bcfd1f22f13b3452274c712a1d0fc81cde3c9cf3fd7fb97ddfb2e36d1fa73abd68c9f4888d9e9b23a0cfb61df9

Download Submit
C:\Windows\System\HaarroR.exe

Filesize
2.3MB

MD5
c9fad8d33ddc1dc63af5aea2dcdafbf9

SHA1
68582dfdaf18161f0c1f56a33d87a883ead8b061

SHA256
7933cf7725813829315d61e6d1bb6b81b7212b23d4839943750be99f01a5121f

SHA512
f0308a89d2ca7e39c58f08dc65d5d6870efe7093eb0c8c5ce6e01a61226f253a35d746b5f14c106aa9474a3a0b34bb687931a4bc6edad8253f03403b22495d2a

Download Submit
C:\Windows\System\MrRDQGI.exe

Filesize
2.3MB

MD5
ac692ab6f7c863544e029d12d8a9a275

SHA1
0f6d006b37aaa0e19d530d77e7c2157473fa5ee4

SHA256
4d5d4088e6945a86ae01568af8dd4fb647faee8c09cb31273e7cd378b9d7f836

SHA512
c6c05d5c283972bfbecec7b5d63f3590eb42ddf00cb912dfbfba254961af37a06cce905eb9f2d4a624534bc72f74dfec8269b9d7ee2b560f360708960fc84203

Download Submit
C:\Windows\System\NwGeluc.exe

Filesize
2.3MB

MD5
105ff76a21ad60b183f0a7afee439776

SHA1
c2b47905f2eced06fc44cc08f6aa964ae97cee98

SHA256
098f668539e945fa7357c9f74a3773a83bc1d79e37f5198be4dd0bf92fd51014

SHA512
0c592c1e228d4e0c30ea10ae189e169edc8b2e543e062f46f0dc479f834d3c80a4420dd6a8730e35434a58d477dd7c6205fabc4dd92a6a73a62ba3db4d3bcbdd

Download Submit
C:\Windows\System\QXOlsdp.exe

Filesize
2.3MB

MD5
eb6770b0ee9d3b92afa53cebbb937693

SHA1
c38b4eedd121c370c3165cb6da35cea2392ecde5

SHA256
876ddcd7e86658b71833d03e36d6b171d1b3920b18dad66f73de68863ddfd3dd

SHA512
090f7603a42ab05574fd11e4a8e069dfd5b22115578dcb30cdd7ab9444a34867ac16229ec809a8534210e42dc55a4fa60f132cbd6fb7c1a6f64c1cf0468479dd

Download Submit
C:\Windows\System\QdVtyLv.exe

Filesize
2.3MB

MD5
6850759b1f4ba1f87d7e7c236c06d8bf

SHA1
4918beea3c5af4c8662aa4520243ef1ff9d43921

SHA256
21046958a6729a2b018564c786b00fa7e9a5d60e168d17c5a5ced63bdfe98580

SHA512
eeb554e577b4340b53097d10d65cf70f2e4e8cf9e1378c0cee7e6dcbaeaa046cb00168cb5dcbae0f238af624b1ced8d2e72ceda6f6006fa7822f827d2aaca6f6

Download Submit
C:\Windows\System\QhkOCxs.exe

Filesize
2.3MB

MD5
5ec95113d1881a5a9f361349b8a4d2c2

SHA1
ce1a20796a658835c1fd7de1c70fff57f1003b9f

SHA256
f3c191c261edab24bcf3e67da8f9f625bfe43576c84bee310430de4715eb4f8b

SHA512
9a896797017e181e621bfb214eea5b31431dbc0ace54d20f07379ed4685d115cddaccbc638443ff303f1f0fb06bff24ebcd99b4761bf6be9684a2c3c246a5be3

Download Submit
C:\Windows\System\SbRXzNA.exe

Filesize
2.3MB

MD5
075ac6009fd40385b747986a1a59b41a

SHA1
965ae0f38df262c93fed5f5a9863e6fbe11d61f9

SHA256
6d00b947125b095e54918a5db76feec66f87a30a6698dcc87d26aac8c3d1f152

SHA512
a3e081477b980c4e0011ab086602052d227d35dff6f8c63302db50deee2fd27a1651f6a613b288f17df7548b344a5074b503a8ea0496c444724234b02f221ffd

Download Submit
C:\Windows\System\SyUpoiI.exe

Filesize
2.3MB

MD5
316c0c65b7346824587ec86948f712a4

SHA1
b889406baa72bd966cc2c4ebb6cd7557ffeba208

SHA256
d9392edb20940698ec39b4df6df8c4f53af0215bbe2e3f2753d9c25c8b0c97bd

SHA512
3fd076f4afc6b317a9445d60ab92514be5631d4f4610a19f3c6a1cd0595ddaf2893ab68bdf930ec5a2d242a7b7dbaf0c0daf96d3d88e9fe81a225f86a8e43ad0

Download Submit
C:\Windows\System\VAQxTwL.exe

Filesize
2.3MB

MD5
e115e2e500a59dc94998f57b68b911ba

SHA1
2b261b349c2265e8a103c21cb20c0f31b24c93a2

SHA256
0d03b4d1da4421dae36ff031c86b3acdcc9bd5a3befcd26979632b457970c6a1

SHA512
f8497dcdf5c9fc32d74c9d9309c8079aea64f1430078527f997d4b3c7a286b4a05fea0098f7d34c13ad35327725317b29d4eece0c2aad8a9f8f8be8abff9ac4e

Download Submit
C:\Windows\System\ZdwJaCU.exe

Filesize
2.4MB

MD5
d830b6fb2e4cfa84aa51dc08981de560

SHA1
0cb2661aeb6a06db578ce0c35097685690eea298

SHA256
1a00291883c30da09d1a428f98be8b8a02d883854f0c03e770f83bb5c996db11

SHA512
c59f8c1e25d95b06a53e796c0a48defba9928a661e2f4f144c215a7e5544297fc394a0719604cc73a412089d6227105210a9ea19086332f44809c7b9912640f7

Download Submit
C:\Windows\System\amfewAa.exe

Filesize
2.3MB

MD5
5567474aee2b8f7e83eac56150595b94

SHA1
6d84bc941075860899b7801d5813270ae014bfb5

SHA256
144f1842d79cca9f2f81ba64874da189a74e41bf2e51a2d0d563350aca38f92d

SHA512
3b79bf6cc0b40f288073b2a65976e8c0496d7eda4ecca1c5ce8c87d4e005038c6fabccbe8aa7b7a4cf32e947d6a81a02ac905d740761f5200b510a778e1035d1

Download Submit
C:\Windows\System\byHPNQb.exe

Filesize
2.3MB

MD5
052dfc9d58c633a53d164570392a2bbd

SHA1
01a62a89875e7c1a67f3de2251fb599492dbc53a

SHA256
0d9e58f7eb4f83d1dc2bdc865a4db7cf8632766a5fd1dcf602d5db67ebe102f0

SHA512
2f9777582b137aaefa8098f91cf63bd8dc8c618e0ed19265b6f65130aef730fe2d43b994f12a31b2bd7de721bafae3a94716fc4136326c0fc3217ab3eae4eb38

Download Submit
C:\Windows\System\drfDWmn.exe

Filesize
2.3MB

MD5
7f6acbe0bb5f283ef8025abf76c2e35f

SHA1
12d6d4d19612adf23679ff51efb37b4a81e70dc0

SHA256
66a38f9ea1bc16e4c78418d08a4653da2df3d4d7e462c3e9410f9b1d66cace42

SHA512
ba33a0b411442e69200add0b76246d9300283e67fe65ee38e98213a4c8bce874a1104046d87387a186da7c0283766112e9ccb505ab05f8a84556208f1ce33bfa

Download Submit
C:\Windows\System\gLfjFmc.exe

Filesize
2.3MB

MD5
48808495937365781e36d11be08849ff

SHA1
5f21665e5b37d17b3b7aeb684cdcf2021609b232

SHA256
59073be44fe7379574f5a255d1417635c9fca81d5b6eee0a6876be40b40c08b7

SHA512
e3b8feac348e3003d7dac2072e8e0bfa55d2993f57b2fcdd5be605b34df28e7c5699bcb5cbd86824ec8ad004ae50a5038fbd45e330d0f6dcf20c59461680d2f6

Download Submit
C:\Windows\System\iBCaDrz.exe

Filesize
2.3MB

MD5
91b4a180004121bfcf9f5be0f35a2915

SHA1
05b55a14d6d8a26fd42477407e661db2dab194bd

SHA256
604a2dbadb424019154168af1c70ede2ee7a9297c055db53cf81c36ba0440efe

SHA512
b36ebcdb94842a4abc9ff9d1378dc4fde3e597ed46924bb3acc8bfe7eaa91bf6caa6e2cec5ec775a2dfd56c280cde5ef1cfa246bfe17f0c7d15542117a87d1b6

Download Submit
C:\Windows\System\lTGqnqr.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\nPafUPe.exe

Filesize
2.3MB

MD5
ae619e7bcf738f8b788d2742e9a431d0

SHA1
bd20709f747d0db54dcdbda6be0f9a1f3404433f

SHA256
8f9f1bb049f220c15f81b94b10357846477453a82ce77354291394350c4f74aa

SHA512
f81a68599786f35dad0634de0182cbb5f7b6510384b890c2d64ed7bd2e5b167c080675434da7a4b9be4284f779c0c3b70e2ddf4ce258ad9f6ee238497850b418

Download Submit
C:\Windows\System\slxdFhT.exe

Filesize
2.3MB

MD5
baeb314636015c5d83bfdedc53b7e6f9

SHA1
233ce8290932de29a988910ae46e89de32552206

SHA256
5eb3ef8ce5e736a2879f7fd037b84b8c53c86262e26dbffa6b390858f2f40c2c

SHA512
a659c6765c82b57fd62ca5f8012965910b8a656aac59e52d8a483b2bef1db670f2cd38e87c0614bd6bb911d0c4fcaab5d7811ebe7b09d6bf28fc2107cae9f889

Download Submit
C:\Windows\System\suBmtWs.exe

Filesize
2.3MB

MD5
226c38e1fbbba058fd82052d943c2fa6

SHA1
a4bbf2ea312109b6688c2a921ed7db66304503ff

SHA256
e2448b0298785fb69ac7b02c55feb1385835a96f8ce5e3c4d67d2b6d711982a6

SHA512
a4e12e4ecc690a35aa3986c362f18327d33747e335c4de13f806a630915750d0b1217fb29b6d4d43b0dc019ff95feadb4b85522c027e160c74f460e2fa363126

Download Submit
C:\Windows\System\tPJYoyi.exe

Filesize
2.3MB

MD5
afcdbe5692be406d61af062b8d84a586

SHA1
08be0ed9cb39ca94d0e7847f2276406ba552b4d3

SHA256
019cc7aeb4469c85c3ff9b4ac3f573205420c3bbc4f2436d9c659303af23d955

SHA512
3475d6dd29e3cac88bef80995e12683a536d5ef217973a3e81e08e60915f9c692177ec6d247e410608cd7d92e5a516e6605d665a15aba8539b389f623d56a86a

Download Submit
C:\Windows\System\uFYRlOb.exe

Filesize
2.4MB

MD5
4ffce8df9b598bc1455e1b43e811059e

SHA1
443c6b72b4ee5650113098d0eb0719e506dfcf3d

SHA256
a6068bc0df3848fcaa1c7f497cd60d6d66eff0c6f279904ed4aeec7efd20a0bd

SHA512
4a455fa158e37f643e3ca51ef65da37d4e21f3f6aed30a50f4aace555fef1dec0893363d0af5a51dab2b0b14b1aade2459959564bd1211e9482f24052eda0867

Download Submit
C:\Windows\System\uvSkdKa.exe

Filesize
2.3MB

MD5
81e1452e46ae9da23f7e8313f96ca634

SHA1
5ea759175434f2532414fe2920f2b5b59ad2bb3f

SHA256
1137a08ad141f92d617172f8c5b672731882150d71710b8c749302aa35fa1ff0

SHA512
2010e4fdd2f816ee33758c32ab76d68ecbf07f27b00b55cd315753b23f55fb2d3054ad7cf4c85a9e6ea806145c153c68ae7590d131222c2c37d4471565b6287d

Download Submit
C:\Windows\System\wBUtXVi.exe

Filesize
2.3MB

MD5
f7a1f4cf6eb656ab0e1f3fe0baa951c3

SHA1
1c1f753b2f054f624a907ff60a66fff0ca2f7f88

SHA256
826d7bd1f18daf04910db98485cd6ad14c90567709edea276e7787283b72cde5

SHA512
31928c0804d49fe910b23abb382f6812ccc17c18603b959b714989b8383765a07bfa12959e91ddf38ec02b7562bfc3b50297ee4b1abb098eca8978058cafc571

Download Submit
C:\Windows\System\xggIOEH.exe

Filesize
2.3MB

MD5
e016c448b057cdb8f44765524a114439

SHA1
d3c22a4b33b6574428b6e2904af50da2c49599af

SHA256
e6a558c3c78ee70d4f95c6fda0710c021e837a89629971621ad43f96539f3dee

SHA512
870c3b28d6b1b5af2f5a0621ac2f36c9a25e581bd822135e4463e2a3b4edeead25c5963d9c285e2887fd7bf6baf224f2ef486eb893c21750c0fae9b0dc4aaafd

Download Submit
memory/348-2278-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Filesize
3.9MB

Download
memory/348-2254-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Filesize
3.9MB

Download
memory/348-77-0x00007FF6274C0000-0x00007FF6278B2000-memory.dmp

Filesize
3.9MB

Download
memory/368-758-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp

Filesize
3.9MB

Download
memory/368-2306-0x00007FF7FE080000-0x00007FF7FE472000-memory.dmp

Filesize
3.9MB

Download
memory/452-53-0x000001B83E4B0000-0x000001B83E4D2000-memory.dmp

Filesize
136KB

Download
memory/452-31-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/452-767-0x000001B83F100000-0x000001B83F8A6000-memory.dmp

Filesize
7.6MB

Download
memory/452-1277-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/452-1816-0x000001B83E010000-0x000001B83E020000-memory.dmp

Filesize
64KB

Download
memory/452-2066-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Filesize
8KB

Download
memory/452-2429-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/452-15-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Filesize
8KB

Download
memory/452-10-0x000001B83E010000-0x000001B83E020000-memory.dmp

Filesize
64KB

Download
memory/844-2276-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Filesize
3.9MB

Download
memory/844-83-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Filesize
3.9MB

Download
memory/844-2253-0x00007FF69B510000-0x00007FF69B902000-memory.dmp

Filesize
3.9MB

Download
memory/984-48-0x00007FF621220000-0x00007FF621612000-memory.dmp

Filesize
3.9MB

Download
memory/984-2266-0x00007FF621220000-0x00007FF621612000-memory.dmp

Filesize
3.9MB

Download
memory/1452-745-0x00007FF647450000-0x00007FF647842000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2312-0x00007FF647450000-0x00007FF647842000-memory.dmp

Filesize
3.9MB

Download
memory/1592-2313-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp

Filesize
3.9MB

Download
memory/1592-742-0x00007FF7C6C10000-0x00007FF7C7002000-memory.dmp

Filesize
3.9MB

Download
memory/1912-33-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2262-0x00007FF6B0720000-0x00007FF6B0B12000-memory.dmp

Filesize
3.9MB

Download
memory/2188-757-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2303-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-712-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Filesize
3.9MB

Download
memory/2192-9-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Filesize
3.9MB

Download
memory/2192-2258-0x00007FF678930000-0x00007FF678D22000-memory.dmp

Filesize
3.9MB

Download
memory/2268-735-0x00007FF68C080000-0x00007FF68C472000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2316-0x00007FF68C080000-0x00007FF68C472000-memory.dmp

Filesize
3.9MB

Download
memory/2364-56-0x00007FF66E370000-0x00007FF66E762000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2265-0x00007FF66E370000-0x00007FF66E762000-memory.dmp

Filesize
3.9MB

Download
memory/2644-1-0x000001E5AF670000-0x000001E5AF680000-memory.dmp

Filesize
64KB

Download
memory/2644-0-0x00007FF734780000-0x00007FF734B72000-memory.dmp

Filesize
3.9MB

Download
memory/2644-710-0x00007FF734780000-0x00007FF734B72000-memory.dmp

Filesize
3.9MB

Download
memory/2656-728-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-2320-0x00007FF70D300000-0x00007FF70D6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2268-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp

Filesize
3.9MB

Download
memory/3068-60-0x00007FF60E760000-0x00007FF60EB52000-memory.dmp

Filesize
3.9MB

Download
memory/3532-749-0x00007FF76C290000-0x00007FF76C682000-memory.dmp

Filesize
3.9MB

Download
memory/3532-2310-0x00007FF76C290000-0x00007FF76C682000-memory.dmp

Filesize
3.9MB

Download
memory/3560-2261-0x00007FF751040000-0x00007FF751432000-memory.dmp

Filesize
3.9MB

Download
memory/3560-63-0x00007FF751040000-0x00007FF751432000-memory.dmp

Filesize
3.9MB

Download
memory/3672-99-0x00007FF651F40000-0x00007FF652332000-memory.dmp

Filesize
3.9MB

Download
memory/3672-2284-0x00007FF651F40000-0x00007FF652332000-memory.dmp

Filesize
3.9MB

Download
memory/3732-2308-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-755-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-73-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2241-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2280-0x00007FF78AAE0000-0x00007FF78AED2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2255-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2272-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-90-0x00007FF747FD0000-0x00007FF7483C2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-66-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-2271-0x00007FF77C300000-0x00007FF77C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-2317-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-736-0x00007FF7D5EF0000-0x00007FF7D62E2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-2275-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Filesize
3.9MB

Download
memory/4984-67-0x00007FF76F270000-0x00007FF76F662000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2256-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2282-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-96-0x00007FF66A3D0000-0x00007FF66A7C2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-2321-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-727-0x00007FF601BD0000-0x00007FF601FC2000-memory.dmp

Filesize
3.9MB

Download