xmrig | 6b5497980e74e4f91680ef25c24951b708ced3d7c3c6fa438a63aee3ec6ebdb1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Size

1.7MB
MD5

0257a63158035ec4623f257cf62b0e6c
SHA1

c314c5c2482eed4ac47c7261508124766398f23a
SHA256

6b5497980e74e4f91680ef25c24951b708ced3d7c3c6fa438a63aee3ec6ebdb1
SHA512

bdd4f107fdff36b512318b0ba461c1f705a3661de60f3167207d3c6d33bf9d30454eae4c6ed01bfc3dce3227c3a1874cf3f2b821e6874d9fa840cbe07245dbd8
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXeuq2:NABL

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/3524-445-0x00007FF7CFCD0000-0x00007FF7D00C2000-memory.dmp	xmrig
behavioral2/memory/2472-514-0x00007FF6DAB30000-0x00007FF6DAF22000-memory.dmp	xmrig
behavioral2/memory/4784-608-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp	xmrig
behavioral2/memory/3496-625-0x00007FF7E18B0000-0x00007FF7E1CA2000-memory.dmp	xmrig
behavioral2/memory/3760-607-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	xmrig
behavioral2/memory/3588-662-0x00007FF7429D0000-0x00007FF742DC2000-memory.dmp	xmrig
behavioral2/memory/4468-698-0x00007FF7AF810000-0x00007FF7AFC02000-memory.dmp	xmrig
behavioral2/memory/3092-722-0x00007FF6CD180000-0x00007FF6CD572000-memory.dmp	xmrig
behavioral2/memory/4640-725-0x00007FF6EA230000-0x00007FF6EA622000-memory.dmp	xmrig
behavioral2/memory/2380-726-0x00007FF7BB520000-0x00007FF7BB912000-memory.dmp	xmrig
behavioral2/memory/4368-701-0x00007FF7A8F80000-0x00007FF7A9372000-memory.dmp	xmrig
behavioral2/memory/2160-663-0x00007FF6D2730000-0x00007FF6D2B22000-memory.dmp	xmrig
behavioral2/memory/1100-660-0x00007FF775D70000-0x00007FF776162000-memory.dmp	xmrig
behavioral2/memory/4960-658-0x00007FF7B53D0000-0x00007FF7B57C2000-memory.dmp	xmrig
behavioral2/memory/3188-657-0x00007FF679320000-0x00007FF679712000-memory.dmp	xmrig
behavioral2/memory/2276-601-0x00007FF6D40A0000-0x00007FF6D4492000-memory.dmp	xmrig
behavioral2/memory/2492-596-0x00007FF6EEF00000-0x00007FF6EF2F2000-memory.dmp	xmrig
behavioral2/memory/3684-328-0x00007FF7D94D0000-0x00007FF7D98C2000-memory.dmp	xmrig
behavioral2/memory/2904-326-0x00007FF6A62D0000-0x00007FF6A66C2000-memory.dmp	xmrig
behavioral2/memory/1440-240-0x00007FF650460000-0x00007FF650852000-memory.dmp	xmrig
behavioral2/memory/3140-275-0x00007FF7C2A90000-0x00007FF7C2E82000-memory.dmp	xmrig
behavioral2/memory/2496-190-0x00007FF62D1A0000-0x00007FF62D592000-memory.dmp	xmrig
behavioral2/memory/2308-112-0x00007FF6A09E0000-0x00007FF6A0DD2000-memory.dmp	xmrig
behavioral2/memory/1948-70-0x00007FF7CE3C0000-0x00007FF7CE7B2000-memory.dmp	xmrig
behavioral2/memory/1440-5633-0x00007FF650460000-0x00007FF650852000-memory.dmp	xmrig
behavioral2/memory/3140-5636-0x00007FF7C2A90000-0x00007FF7C2E82000-memory.dmp	xmrig
behavioral2/memory/2308-5640-0x00007FF6A09E0000-0x00007FF6A0DD2000-memory.dmp	xmrig
behavioral2/memory/2904-5657-0x00007FF6A62D0000-0x00007FF6A66C2000-memory.dmp	xmrig
behavioral2/memory/2496-5696-0x00007FF62D1A0000-0x00007FF62D592000-memory.dmp	xmrig
behavioral2/memory/2472-5774-0x00007FF6DAB30000-0x00007FF6DAF22000-memory.dmp	xmrig
behavioral2/memory/4784-5797-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp	xmrig
behavioral2/memory/3496-5796-0x00007FF7E18B0000-0x00007FF7E1CA2000-memory.dmp	xmrig
behavioral2/memory/3188-5803-0x00007FF679320000-0x00007FF679712000-memory.dmp	xmrig
behavioral2/memory/3588-5806-0x00007FF7429D0000-0x00007FF742DC2000-memory.dmp	xmrig
behavioral2/memory/3092-5811-0x00007FF6CD180000-0x00007FF6CD572000-memory.dmp	xmrig
behavioral2/memory/2380-5824-0x00007FF7BB520000-0x00007FF7BB912000-memory.dmp	xmrig
behavioral2/memory/4468-5830-0x00007FF7AF810000-0x00007FF7AFC02000-memory.dmp	xmrig
behavioral2/memory/4960-5842-0x00007FF7B53D0000-0x00007FF7B57C2000-memory.dmp	xmrig
behavioral2/memory/4368-5844-0x00007FF7A8F80000-0x00007FF7A9372000-memory.dmp	xmrig
behavioral2/memory/4640-5822-0x00007FF6EA230000-0x00007FF6EA622000-memory.dmp	xmrig
behavioral2/memory/1100-5789-0x00007FF775D70000-0x00007FF776162000-memory.dmp	xmrig
behavioral2/memory/2160-5778-0x00007FF6D2730000-0x00007FF6D2B22000-memory.dmp	xmrig
behavioral2/memory/3524-5785-0x00007FF7CFCD0000-0x00007FF7D00C2000-memory.dmp	xmrig
behavioral2/memory/3684-5767-0x00007FF7D94D0000-0x00007FF7D98C2000-memory.dmp	xmrig
behavioral2/memory/2276-5746-0x00007FF6D40A0000-0x00007FF6D4492000-memory.dmp	xmrig
behavioral2/memory/2492-5731-0x00007FF6EEF00000-0x00007FF6EF2F2000-memory.dmp	xmrig
behavioral2/memory/3760-5729-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	836	powershell.exe
13	836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
836	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1948	cNBGkUW.exe
2308	wvGHVWL.exe
2496	LuLeqlm.exe
1440	MmOUoSm.exe
3140	QLAZRTs.exe
2904	qoFiFiI.exe
3684	fblcbAW.exe
3524	DnnNCLE.exe
2472	kSwKvzS.exe
2492	LcjJvDP.exe
2276	ZWEQzvU.exe
3760	grMQcIu.exe
4784	JrucNEK.exe
3496	fDHcKpK.exe
3188	plBOKoq.exe
4640	AvLvRhl.exe
4960	VhNhubl.exe
1100	Jydxugg.exe
3588	iuXFYEj.exe
2160	rsanCOh.exe
2380	PPVOFjU.exe
4468	xAnmpDg.exe
4368	ylrCmGK.exe
3092	CVdfxUy.exe
3724	YARIxzM.exe
2316	dRVgDrb.exe
2796	hsFZPan.exe
2188	YBtCgpG.exe
4636	cRioVEW.exe
2320	pvppTzL.exe
3872	BApVnfA.exe
3000	jmynCxZ.exe
4284	AKcNEWy.exe
1164	PLDQcWM.exe
4600	OqMXmHZ.exe
3344	jIWOdWw.exe
4972	QfjpuAP.exe
4488	oBfQTDB.exe
3796	uIrgaBQ.exe
2852	nVNHkpc.exe
2816	AHkkDMz.exe
2028	mWXOEhw.exe
3636	AjSqhAn.exe
3784	faUzMJM.exe
4688	bWudRXZ.exe
3368	kDgHsKZ.exe
2880	hwritIg.exe
3664	zbeIyEj.exe
4408	wXabxAk.exe
2524	GXYVVzT.exe
3916	aSXQVal.exe
4516	DGWRtbB.exe
32	HGQbkiy.exe
1940	IHBzmnK.exe
3392	bBbcgNi.exe
1528	EEdrPuD.exe
3824	kTHByrG.exe
3456	FxuXsXU.exe
1760	CRUaaeo.exe
2892	yVrhsLY.exe
3236	JfAUdZw.exe
4176	FdqQEAQ.exe
2024	KfHLsTz.exe
3124	RFbjJbd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2912-0-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp	upx
behavioral2/files/0x00090000000233fe-6.dat	upx
behavioral2/files/0x000700000002346c-9.dat	upx
behavioral2/files/0x000700000002346d-16.dat	upx
behavioral2/files/0x000700000002346b-10.dat	upx
behavioral2/files/0x000700000002346f-24.dat	upx
behavioral2/files/0x0007000000023473-75.dat	upx
behavioral2/files/0x000700000002347e-115.dat	upx
behavioral2/memory/3524-445-0x00007FF7CFCD0000-0x00007FF7D00C2000-memory.dmp	upx
behavioral2/memory/2472-514-0x00007FF6DAB30000-0x00007FF6DAF22000-memory.dmp	upx
behavioral2/memory/4784-608-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp	upx
behavioral2/memory/3496-625-0x00007FF7E18B0000-0x00007FF7E1CA2000-memory.dmp	upx
behavioral2/memory/3760-607-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	upx
behavioral2/memory/3588-662-0x00007FF7429D0000-0x00007FF742DC2000-memory.dmp	upx
behavioral2/memory/4468-698-0x00007FF7AF810000-0x00007FF7AFC02000-memory.dmp	upx
behavioral2/memory/3092-722-0x00007FF6CD180000-0x00007FF6CD572000-memory.dmp	upx
behavioral2/memory/4640-725-0x00007FF6EA230000-0x00007FF6EA622000-memory.dmp	upx
behavioral2/memory/2380-726-0x00007FF7BB520000-0x00007FF7BB912000-memory.dmp	upx
behavioral2/memory/4368-701-0x00007FF7A8F80000-0x00007FF7A9372000-memory.dmp	upx
behavioral2/memory/2160-663-0x00007FF6D2730000-0x00007FF6D2B22000-memory.dmp	upx
behavioral2/memory/1100-660-0x00007FF775D70000-0x00007FF776162000-memory.dmp	upx
behavioral2/memory/4960-658-0x00007FF7B53D0000-0x00007FF7B57C2000-memory.dmp	upx
behavioral2/memory/3188-657-0x00007FF679320000-0x00007FF679712000-memory.dmp	upx
behavioral2/memory/2276-601-0x00007FF6D40A0000-0x00007FF6D4492000-memory.dmp	upx
behavioral2/memory/2492-596-0x00007FF6EEF00000-0x00007FF6EF2F2000-memory.dmp	upx
behavioral2/memory/3684-328-0x00007FF7D94D0000-0x00007FF7D98C2000-memory.dmp	upx
behavioral2/memory/2904-326-0x00007FF6A62D0000-0x00007FF6A66C2000-memory.dmp	upx
behavioral2/memory/1440-240-0x00007FF650460000-0x00007FF650852000-memory.dmp	upx
behavioral2/memory/3140-275-0x00007FF7C2A90000-0x00007FF7C2E82000-memory.dmp	upx
behavioral2/files/0x0007000000023494-218.dat	upx
behavioral2/files/0x0007000000023493-217.dat	upx
behavioral2/files/0x0007000000023492-216.dat	upx
behavioral2/files/0x0007000000023491-215.dat	upx
behavioral2/files/0x0007000000023490-212.dat	upx
behavioral2/files/0x000700000002348f-211.dat	upx
behavioral2/files/0x000700000002348d-206.dat	upx
behavioral2/files/0x000700000002348e-204.dat	upx
behavioral2/files/0x000700000002348c-197.dat	upx
behavioral2/files/0x000700000002348b-195.dat	upx
behavioral2/memory/2496-190-0x00007FF62D1A0000-0x00007FF62D592000-memory.dmp	upx
behavioral2/files/0x0007000000023489-183.dat	upx
behavioral2/files/0x0007000000023488-164.dat	upx
behavioral2/files/0x0007000000023487-163.dat	upx
behavioral2/files/0x0007000000023486-162.dat	upx
behavioral2/files/0x0007000000023485-160.dat	upx
behavioral2/files/0x000700000002347c-157.dat	upx
behavioral2/files/0x0007000000023484-148.dat	upx
behavioral2/files/0x0007000000023478-147.dat	upx
behavioral2/files/0x0007000000023483-137.dat	upx
behavioral2/files/0x0007000000023476-135.dat	upx
behavioral2/files/0x0007000000023482-124.dat	upx
behavioral2/files/0x0007000000023481-122.dat	upx
behavioral2/files/0x000700000002347b-118.dat	upx
behavioral2/files/0x0007000000023480-117.dat	upx
behavioral2/files/0x000700000002347f-116.dat	upx
behavioral2/memory/2308-112-0x00007FF6A09E0000-0x00007FF6A0DD2000-memory.dmp	upx
behavioral2/files/0x000700000002347d-105.dat	upx
behavioral2/files/0x0007000000023477-140.dat	upx
behavioral2/files/0x0007000000023470-90.dat	upx
behavioral2/files/0x0007000000023475-86.dat	upx
behavioral2/files/0x0007000000023474-78.dat	upx
behavioral2/files/0x000700000002347a-74.dat	upx
behavioral2/files/0x0007000000023472-97.dat	upx
behavioral2/files/0x0007000000023471-93.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CJAbyFY.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\IBojPbL.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\eTPaobQ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\rHhdSgk.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\FGexRvD.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\WVzbCPc.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\hIALtXZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\lywMEKU.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\DYeSzuH.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\CPqnPns.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\SEcnLCW.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\deygoNb.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\eQIhfdT.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\zJgslJg.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\KhZbnHn.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\zCnrMIa.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\xwtHtyq.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yLEZhTJ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\FXfkjmS.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\TQXsUcT.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\EkgeYmw.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\wbqIfnV.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\kJhCXVO.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\nhMZoAb.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\fWfrSiM.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\VCpECyO.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\WcuDBYW.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\XHObKNX.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\XhSJvle.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\FiMuLXh.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\mDFnJaG.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\bJVfqIc.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\NChStkc.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\OyuMQar.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\QiZeAXs.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\ihfRYVK.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\JupVVam.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\dbvEChZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\JwQKega.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\qpLthvk.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\GWOUAFZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\nxTnKhZ.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\wccpLuO.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\AGOfWDA.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\VgNxnZG.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\zMXhyNj.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\gcVysQY.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\gqeIdOT.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\HadHvAG.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\lbmEZgA.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\meMGCwS.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\dMUEuCX.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\dCneZPL.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\yYLWVyb.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\RxqGDcy.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\PPJeKlN.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\pZwkbkD.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\zKHcXQi.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\QPvhZjo.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\hskSKMp.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\aMxCIdt.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\YGukkLk.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\thJvbZf.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
File created	C:\Windows\System\dvSYIZw.exe	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
836	powershell.exe
836	powershell.exe
836	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
Token: SeDebugPrivilege	836	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 836	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	87
PID 2912 wrote to memory of 836	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	87
PID 2912 wrote to memory of 1948	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	88
PID 2912 wrote to memory of 1948	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	88
PID 2912 wrote to memory of 2308	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	89
PID 2912 wrote to memory of 2308	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	89
PID 2912 wrote to memory of 2496	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	90
PID 2912 wrote to memory of 2496	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	90
PID 2912 wrote to memory of 1440	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	91
PID 2912 wrote to memory of 1440	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	91
PID 2912 wrote to memory of 3140	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	92
PID 2912 wrote to memory of 3140	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	92
PID 2912 wrote to memory of 2904	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	93
PID 2912 wrote to memory of 2904	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	93
PID 2912 wrote to memory of 3684	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	94
PID 2912 wrote to memory of 3684	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	94
PID 2912 wrote to memory of 3524	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	95
PID 2912 wrote to memory of 3524	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	95
PID 2912 wrote to memory of 2472	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	96
PID 2912 wrote to memory of 2472	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	96
PID 2912 wrote to memory of 2492	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	97
PID 2912 wrote to memory of 2492	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	97
PID 2912 wrote to memory of 2276	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	98
PID 2912 wrote to memory of 2276	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	98
PID 2912 wrote to memory of 3760	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	99
PID 2912 wrote to memory of 3760	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	99
PID 2912 wrote to memory of 4784	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	100
PID 2912 wrote to memory of 4784	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	100
PID 2912 wrote to memory of 3496	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	101
PID 2912 wrote to memory of 3496	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	101
PID 2912 wrote to memory of 3188	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	102
PID 2912 wrote to memory of 3188	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	102
PID 2912 wrote to memory of 4640	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	103
PID 2912 wrote to memory of 4640	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	103
PID 2912 wrote to memory of 4960	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	104
PID 2912 wrote to memory of 4960	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	104
PID 2912 wrote to memory of 1100	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	105
PID 2912 wrote to memory of 1100	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	105
PID 2912 wrote to memory of 3588	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	106
PID 2912 wrote to memory of 3588	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	106
PID 2912 wrote to memory of 2160	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	107
PID 2912 wrote to memory of 2160	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	107
PID 2912 wrote to memory of 2380	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	108
PID 2912 wrote to memory of 2380	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	108
PID 2912 wrote to memory of 4468	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	109
PID 2912 wrote to memory of 4468	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	109
PID 2912 wrote to memory of 4368	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	110
PID 2912 wrote to memory of 4368	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	110
PID 2912 wrote to memory of 3092	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	111
PID 2912 wrote to memory of 3092	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	111
PID 2912 wrote to memory of 3724	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	112
PID 2912 wrote to memory of 3724	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	112
PID 2912 wrote to memory of 2316	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	113
PID 2912 wrote to memory of 2316	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	113
PID 2912 wrote to memory of 2796	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	114
PID 2912 wrote to memory of 2796	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	114
PID 2912 wrote to memory of 2188	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	115
PID 2912 wrote to memory of 2188	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	115
PID 2912 wrote to memory of 4636	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	116
PID 2912 wrote to memory of 4636	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	116
PID 2912 wrote to memory of 2320	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	117
PID 2912 wrote to memory of 2320	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	117
PID 2912 wrote to memory of 3872	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	118
PID 2912 wrote to memory of 3872	2912	0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0257a63158035ec4623f257cf62b0e6c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System\cNBGkUW.exe
  C:\Windows\System\cNBGkUW.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\wvGHVWL.exe
  C:\Windows\System\wvGHVWL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\LuLeqlm.exe
  C:\Windows\System\LuLeqlm.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\MmOUoSm.exe
  C:\Windows\System\MmOUoSm.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\QLAZRTs.exe
  C:\Windows\System\QLAZRTs.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\qoFiFiI.exe
  C:\Windows\System\qoFiFiI.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\fblcbAW.exe
  C:\Windows\System\fblcbAW.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\DnnNCLE.exe
  C:\Windows\System\DnnNCLE.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\kSwKvzS.exe
  C:\Windows\System\kSwKvzS.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\LcjJvDP.exe
  C:\Windows\System\LcjJvDP.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ZWEQzvU.exe
  C:\Windows\System\ZWEQzvU.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\grMQcIu.exe
  C:\Windows\System\grMQcIu.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\JrucNEK.exe
  C:\Windows\System\JrucNEK.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\fDHcKpK.exe
  C:\Windows\System\fDHcKpK.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\plBOKoq.exe
  C:\Windows\System\plBOKoq.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\AvLvRhl.exe
  C:\Windows\System\AvLvRhl.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\VhNhubl.exe
  C:\Windows\System\VhNhubl.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\Jydxugg.exe
  C:\Windows\System\Jydxugg.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\iuXFYEj.exe
  C:\Windows\System\iuXFYEj.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\rsanCOh.exe
  C:\Windows\System\rsanCOh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\PPVOFjU.exe
  C:\Windows\System\PPVOFjU.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\xAnmpDg.exe
  C:\Windows\System\xAnmpDg.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\ylrCmGK.exe
  C:\Windows\System\ylrCmGK.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\CVdfxUy.exe
  C:\Windows\System\CVdfxUy.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\YARIxzM.exe
  C:\Windows\System\YARIxzM.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\dRVgDrb.exe
  C:\Windows\System\dRVgDrb.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\hsFZPan.exe
  C:\Windows\System\hsFZPan.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\YBtCgpG.exe
  C:\Windows\System\YBtCgpG.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\cRioVEW.exe
  C:\Windows\System\cRioVEW.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\pvppTzL.exe
  C:\Windows\System\pvppTzL.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\BApVnfA.exe
  C:\Windows\System\BApVnfA.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\jmynCxZ.exe
  C:\Windows\System\jmynCxZ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\aSXQVal.exe
  C:\Windows\System\aSXQVal.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\AKcNEWy.exe
  C:\Windows\System\AKcNEWy.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\PLDQcWM.exe
  C:\Windows\System\PLDQcWM.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\OqMXmHZ.exe
  C:\Windows\System\OqMXmHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\jIWOdWw.exe
  C:\Windows\System\jIWOdWw.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\QfjpuAP.exe
  C:\Windows\System\QfjpuAP.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\oBfQTDB.exe
  C:\Windows\System\oBfQTDB.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\uIrgaBQ.exe
  C:\Windows\System\uIrgaBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\nVNHkpc.exe
  C:\Windows\System\nVNHkpc.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\AHkkDMz.exe
  C:\Windows\System\AHkkDMz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\mWXOEhw.exe
  C:\Windows\System\mWXOEhw.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\AjSqhAn.exe
  C:\Windows\System\AjSqhAn.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\faUzMJM.exe
  C:\Windows\System\faUzMJM.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\bWudRXZ.exe
  C:\Windows\System\bWudRXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\kDgHsKZ.exe
  C:\Windows\System\kDgHsKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\hwritIg.exe
  C:\Windows\System\hwritIg.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\zbeIyEj.exe
  C:\Windows\System\zbeIyEj.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\wXabxAk.exe
  C:\Windows\System\wXabxAk.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\GXYVVzT.exe
  C:\Windows\System\GXYVVzT.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\DGWRtbB.exe
  C:\Windows\System\DGWRtbB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\HGQbkiy.exe
  C:\Windows\System\HGQbkiy.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\IHBzmnK.exe
  C:\Windows\System\IHBzmnK.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\bBbcgNi.exe
  C:\Windows\System\bBbcgNi.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\EEdrPuD.exe
  C:\Windows\System\EEdrPuD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\kTHByrG.exe
  C:\Windows\System\kTHByrG.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\FxuXsXU.exe
  C:\Windows\System\FxuXsXU.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\CRUaaeo.exe
  C:\Windows\System\CRUaaeo.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\yVrhsLY.exe
  C:\Windows\System\yVrhsLY.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JfAUdZw.exe
  C:\Windows\System\JfAUdZw.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\FdqQEAQ.exe
  C:\Windows\System\FdqQEAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\KfHLsTz.exe
  C:\Windows\System\KfHLsTz.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RFbjJbd.exe
  C:\Windows\System\RFbjJbd.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\qrRqCHU.exe
  C:\Windows\System\qrRqCHU.exe
  2⤵
  PID:4256
- C:\Windows\System\ovehOYX.exe
  C:\Windows\System\ovehOYX.exe
  2⤵
  PID:5076
- C:\Windows\System\NCfVmJw.exe
  C:\Windows\System\NCfVmJw.exe
  2⤵
  PID:220
- C:\Windows\System\LaProfo.exe
  C:\Windows\System\LaProfo.exe
  2⤵
  PID:5196
- C:\Windows\System\YqopHZV.exe
  C:\Windows\System\YqopHZV.exe
  2⤵
  PID:5216
- C:\Windows\System\ZdFhMgS.exe
  C:\Windows\System\ZdFhMgS.exe
  2⤵
  PID:5232
- C:\Windows\System\SqwQmYu.exe
  C:\Windows\System\SqwQmYu.exe
  2⤵
  PID:5260
- C:\Windows\System\yqqgDaQ.exe
  C:\Windows\System\yqqgDaQ.exe
  2⤵
  PID:5288
- C:\Windows\System\BUvgVnH.exe
  C:\Windows\System\BUvgVnH.exe
  2⤵
  PID:5316
- C:\Windows\System\IBaYzUS.exe
  C:\Windows\System\IBaYzUS.exe
  2⤵
  PID:5336
- C:\Windows\System\GUKdYaY.exe
  C:\Windows\System\GUKdYaY.exe
  2⤵
  PID:5356
- C:\Windows\System\WzSwzqJ.exe
  C:\Windows\System\WzSwzqJ.exe
  2⤵
  PID:5376
- C:\Windows\System\rnChyfj.exe
  C:\Windows\System\rnChyfj.exe
  2⤵
  PID:5396
- C:\Windows\System\XuiEhAi.exe
  C:\Windows\System\XuiEhAi.exe
  2⤵
  PID:5416
- C:\Windows\System\cOFfwrT.exe
  C:\Windows\System\cOFfwrT.exe
  2⤵
  PID:5440
- C:\Windows\System\ThhBxwt.exe
  C:\Windows\System\ThhBxwt.exe
  2⤵
  PID:5460
- C:\Windows\System\SgWGUds.exe
  C:\Windows\System\SgWGUds.exe
  2⤵
  PID:5488
- C:\Windows\System\lleyHcm.exe
  C:\Windows\System\lleyHcm.exe
  2⤵
  PID:5504
- C:\Windows\System\fZrajop.exe
  C:\Windows\System\fZrajop.exe
  2⤵
  PID:5576
- C:\Windows\System\vvnmRZH.exe
  C:\Windows\System\vvnmRZH.exe
  2⤵
  PID:5596
- C:\Windows\System\nBFhDiN.exe
  C:\Windows\System\nBFhDiN.exe
  2⤵
  PID:5628
- C:\Windows\System\rFliIpz.exe
  C:\Windows\System\rFliIpz.exe
  2⤵
  PID:5660
- C:\Windows\System\mucYqaM.exe
  C:\Windows\System\mucYqaM.exe
  2⤵
  PID:5680
- C:\Windows\System\huKmzFA.exe
  C:\Windows\System\huKmzFA.exe
  2⤵
  PID:5704
- C:\Windows\System\JRjtpgk.exe
  C:\Windows\System\JRjtpgk.exe
  2⤵
  PID:5724
- C:\Windows\System\fCeggTh.exe
  C:\Windows\System\fCeggTh.exe
  2⤵
  PID:5748
- C:\Windows\System\DCluOUa.exe
  C:\Windows\System\DCluOUa.exe
  2⤵
  PID:5768
- C:\Windows\System\XvyBscD.exe
  C:\Windows\System\XvyBscD.exe
  2⤵
  PID:5796
- C:\Windows\System\ewwQHZJ.exe
  C:\Windows\System\ewwQHZJ.exe
  2⤵
  PID:5812
- C:\Windows\System\uNifbLx.exe
  C:\Windows\System\uNifbLx.exe
  2⤵
  PID:5836
- C:\Windows\System\FiGelxD.exe
  C:\Windows\System\FiGelxD.exe
  2⤵
  PID:5856
- C:\Windows\System\KNUkWFV.exe
  C:\Windows\System\KNUkWFV.exe
  2⤵
  PID:5876
- C:\Windows\System\uwvhuiP.exe
  C:\Windows\System\uwvhuiP.exe
  2⤵
  PID:5900
- C:\Windows\System\CCEwHKQ.exe
  C:\Windows\System\CCEwHKQ.exe
  2⤵
  PID:5920
- C:\Windows\System\fVgBzUQ.exe
  C:\Windows\System\fVgBzUQ.exe
  2⤵
  PID:5944
- C:\Windows\System\qCCuNJT.exe
  C:\Windows\System\qCCuNJT.exe
  2⤵
  PID:5960
- C:\Windows\System\TGJdQoB.exe
  C:\Windows\System\TGJdQoB.exe
  2⤵
  PID:5976
- C:\Windows\System\MTnEMvp.exe
  C:\Windows\System\MTnEMvp.exe
  2⤵
  PID:6000
- C:\Windows\System\yqELfiz.exe
  C:\Windows\System\yqELfiz.exe
  2⤵
  PID:6020
- C:\Windows\System\frDFbSr.exe
  C:\Windows\System\frDFbSr.exe
  2⤵
  PID:6044
- C:\Windows\System\DdGMvlM.exe
  C:\Windows\System\DdGMvlM.exe
  2⤵
  PID:6064
- C:\Windows\System\drhnnpu.exe
  C:\Windows\System\drhnnpu.exe
  2⤵
  PID:6092
- C:\Windows\System\zXnuqfP.exe
  C:\Windows\System\zXnuqfP.exe
  2⤵
  PID:6108
- C:\Windows\System\OpWWgxl.exe
  C:\Windows\System\OpWWgxl.exe
  2⤵
  PID:6128
- C:\Windows\System\TuhxRqD.exe
  C:\Windows\System\TuhxRqD.exe
  2⤵
  PID:4704
- C:\Windows\System\joOXMpA.exe
  C:\Windows\System\joOXMpA.exe
  2⤵
  PID:620
- C:\Windows\System\lcEQAGP.exe
  C:\Windows\System\lcEQAGP.exe
  2⤵
  PID:4164
- C:\Windows\System\hlcoevX.exe
  C:\Windows\System\hlcoevX.exe
  2⤵
  PID:4916
- C:\Windows\System\KvbOSvD.exe
  C:\Windows\System\KvbOSvD.exe
  2⤵
  PID:2744
- C:\Windows\System\bLvyifD.exe
  C:\Windows\System\bLvyifD.exe
  2⤵
  PID:2340
- C:\Windows\System\pewsDlP.exe
  C:\Windows\System\pewsDlP.exe
  2⤵
  PID:716
- C:\Windows\System\MJesGfj.exe
  C:\Windows\System\MJesGfj.exe
  2⤵
  PID:448
- C:\Windows\System\nXkeTxr.exe
  C:\Windows\System\nXkeTxr.exe
  2⤵
  PID:4448
- C:\Windows\System\XtCzrPK.exe
  C:\Windows\System\XtCzrPK.exe
  2⤵
  PID:5004
- C:\Windows\System\CjOBMMb.exe
  C:\Windows\System\CjOBMMb.exe
  2⤵
  PID:1492
- C:\Windows\System\FXyDYln.exe
  C:\Windows\System\FXyDYln.exe
  2⤵
  PID:4896
- C:\Windows\System\pZKtefN.exe
  C:\Windows\System\pZKtefN.exe
  2⤵
  PID:4024
- C:\Windows\System\HdCfTfa.exe
  C:\Windows\System\HdCfTfa.exe
  2⤵
  PID:1780
- C:\Windows\System\MqPPyXO.exe
  C:\Windows\System\MqPPyXO.exe
  2⤵
  PID:1360
- C:\Windows\System\UdRqIpA.exe
  C:\Windows\System\UdRqIpA.exe
  2⤵
  PID:5300
- C:\Windows\System\pDmNHNt.exe
  C:\Windows\System\pDmNHNt.exe
  2⤵
  PID:4296
- C:\Windows\System\tlgZVXu.exe
  C:\Windows\System\tlgZVXu.exe
  2⤵
  PID:2572
- C:\Windows\System\uVEFZyf.exe
  C:\Windows\System\uVEFZyf.exe
  2⤵
  PID:224
- C:\Windows\System\kksrGje.exe
  C:\Windows\System\kksrGje.exe
  2⤵
  PID:4132
- C:\Windows\System\jhpQUEH.exe
  C:\Windows\System\jhpQUEH.exe
  2⤵
  PID:5108
- C:\Windows\System\sgnmdOS.exe
  C:\Windows\System\sgnmdOS.exe
  2⤵
  PID:5468
- C:\Windows\System\dxJsYNW.exe
  C:\Windows\System\dxJsYNW.exe
  2⤵
  PID:4040
- C:\Windows\System\cyIzuGL.exe
  C:\Windows\System\cyIzuGL.exe
  2⤵
  PID:3820
- C:\Windows\System\BMSwkjZ.exe
  C:\Windows\System\BMSwkjZ.exe
  2⤵
  PID:3096
- C:\Windows\System\WJpsXRJ.exe
  C:\Windows\System\WJpsXRJ.exe
  2⤵
  PID:1548
- C:\Windows\System\IxCtalw.exe
  C:\Windows\System\IxCtalw.exe
  2⤵
  PID:4908
- C:\Windows\System\iWnaXJI.exe
  C:\Windows\System\iWnaXJI.exe
  2⤵
  PID:844
- C:\Windows\System\gHqINOS.exe
  C:\Windows\System\gHqINOS.exe
  2⤵
  PID:1840
- C:\Windows\System\SgKKZUZ.exe
  C:\Windows\System\SgKKZUZ.exe
  2⤵
  PID:5716
- C:\Windows\System\nvxBTEz.exe
  C:\Windows\System\nvxBTEz.exe
  2⤵
  PID:5776
- C:\Windows\System\IXAOTqp.exe
  C:\Windows\System\IXAOTqp.exe
  2⤵
  PID:5888
- C:\Windows\System\dkkwfnD.exe
  C:\Windows\System\dkkwfnD.exe
  2⤵
  PID:5928
- C:\Windows\System\GywsMeb.exe
  C:\Windows\System\GywsMeb.exe
  2⤵
  PID:6296
- C:\Windows\System\jHpUaxO.exe
  C:\Windows\System\jHpUaxO.exe
  2⤵
  PID:6312
- C:\Windows\System\bQkiQUo.exe
  C:\Windows\System\bQkiQUo.exe
  2⤵
  PID:6328
- C:\Windows\System\fvSxiKR.exe
  C:\Windows\System\fvSxiKR.exe
  2⤵
  PID:6344
- C:\Windows\System\imALjsT.exe
  C:\Windows\System\imALjsT.exe
  2⤵
  PID:6368
- C:\Windows\System\cVsmNcf.exe
  C:\Windows\System\cVsmNcf.exe
  2⤵
  PID:6388
- C:\Windows\System\yGrVlqG.exe
  C:\Windows\System\yGrVlqG.exe
  2⤵
  PID:6408
- C:\Windows\System\vZwfINT.exe
  C:\Windows\System\vZwfINT.exe
  2⤵
  PID:6424
- C:\Windows\System\EbqOMFP.exe
  C:\Windows\System\EbqOMFP.exe
  2⤵
  PID:6448
- C:\Windows\System\xuEnfBw.exe
  C:\Windows\System\xuEnfBw.exe
  2⤵
  PID:6472
- C:\Windows\System\lesjEuq.exe
  C:\Windows\System\lesjEuq.exe
  2⤵
  PID:6532
- C:\Windows\System\FVrnVrN.exe
  C:\Windows\System\FVrnVrN.exe
  2⤵
  PID:6548
- C:\Windows\System\GeFnwrK.exe
  C:\Windows\System\GeFnwrK.exe
  2⤵
  PID:6572
- C:\Windows\System\yOWzTpE.exe
  C:\Windows\System\yOWzTpE.exe
  2⤵
  PID:6588
- C:\Windows\System\xlJhlBq.exe
  C:\Windows\System\xlJhlBq.exe
  2⤵
  PID:6620
- C:\Windows\System\RuTjoTP.exe
  C:\Windows\System\RuTjoTP.exe
  2⤵
  PID:6636
- C:\Windows\System\pDyCwYm.exe
  C:\Windows\System\pDyCwYm.exe
  2⤵
  PID:6664
- C:\Windows\System\vcKFEiX.exe
  C:\Windows\System\vcKFEiX.exe
  2⤵
  PID:6684
- C:\Windows\System\hjEPUiy.exe
  C:\Windows\System\hjEPUiy.exe
  2⤵
  PID:6704
- C:\Windows\System\EOyrmZD.exe
  C:\Windows\System\EOyrmZD.exe
  2⤵
  PID:6728
- C:\Windows\System\FtCCCOF.exe
  C:\Windows\System\FtCCCOF.exe
  2⤵
  PID:6744
- C:\Windows\System\dlXhdnM.exe
  C:\Windows\System\dlXhdnM.exe
  2⤵
  PID:6776
- C:\Windows\System\USjbpiY.exe
  C:\Windows\System\USjbpiY.exe
  2⤵
  PID:6792
- C:\Windows\System\FnGoTGx.exe
  C:\Windows\System\FnGoTGx.exe
  2⤵
  PID:6808
- C:\Windows\System\ikbwGph.exe
  C:\Windows\System\ikbwGph.exe
  2⤵
  PID:6824
- C:\Windows\System\gKcKHTw.exe
  C:\Windows\System\gKcKHTw.exe
  2⤵
  PID:6852
- C:\Windows\System\altMmXB.exe
  C:\Windows\System\altMmXB.exe
  2⤵
  PID:6872
- C:\Windows\System\WKjuGnl.exe
  C:\Windows\System\WKjuGnl.exe
  2⤵
  PID:1732
- C:\Windows\System\fBFBDap.exe
  C:\Windows\System\fBFBDap.exe
  2⤵
  PID:5068
- C:\Windows\System\JmltXyO.exe
  C:\Windows\System\JmltXyO.exe
  2⤵
  PID:4992
- C:\Windows\System\bLGegwt.exe
  C:\Windows\System\bLGegwt.exe
  2⤵
  PID:5712
- C:\Windows\System\HhMSIER.exe
  C:\Windows\System\HhMSIER.exe
  2⤵
  PID:5432
- C:\Windows\System\kdrjIWs.exe
  C:\Windows\System\kdrjIWs.exe
  2⤵
  PID:6228
- C:\Windows\System\BFUSVcf.exe
  C:\Windows\System\BFUSVcf.exe
  2⤵
  PID:6308
- C:\Windows\System\RTyEqie.exe
  C:\Windows\System\RTyEqie.exe
  2⤵
  PID:6804
- C:\Windows\System\wGHenVR.exe
  C:\Windows\System\wGHenVR.exe
  2⤵
  PID:6400
- C:\Windows\System\SpTEdxe.exe
  C:\Windows\System\SpTEdxe.exe
  2⤵
  PID:6540
- C:\Windows\System\VMjZsXu.exe
  C:\Windows\System\VMjZsXu.exe
  2⤵
  PID:6648
- C:\Windows\System\gZmAgxP.exe
  C:\Windows\System\gZmAgxP.exe
  2⤵
  PID:6784
- C:\Windows\System\LzpfNsI.exe
  C:\Windows\System\LzpfNsI.exe
  2⤵
  PID:4864
- C:\Windows\System\hSXARMz.exe
  C:\Windows\System\hSXARMz.exe
  2⤵
  PID:6860
- C:\Windows\System\IyQvdxe.exe
  C:\Windows\System\IyQvdxe.exe
  2⤵
  PID:6952
- C:\Windows\System\rctCwkD.exe
  C:\Windows\System\rctCwkD.exe
  2⤵
  PID:7144
- C:\Windows\System\cgslbtl.exe
  C:\Windows\System\cgslbtl.exe
  2⤵
  PID:7160
- C:\Windows\System\WorpobX.exe
  C:\Windows\System\WorpobX.exe
  2⤵
  PID:6080
- C:\Windows\System\jmHvIxE.exe
  C:\Windows\System\jmHvIxE.exe
  2⤵
  PID:5204
- C:\Windows\System\GVDBmBu.exe
  C:\Windows\System\GVDBmBu.exe
  2⤵
  PID:5688
- C:\Windows\System\uNeyrAh.exe
  C:\Windows\System\uNeyrAh.exe
  2⤵
  PID:5808
- C:\Windows\System\HkamZcd.exe
  C:\Windows\System\HkamZcd.exe
  2⤵
  PID:4860
- C:\Windows\System\WrNdGsk.exe
  C:\Windows\System\WrNdGsk.exe
  2⤵
  PID:2012
- C:\Windows\System\gwviOQi.exe
  C:\Windows\System\gwviOQi.exe
  2⤵
  PID:5496
- C:\Windows\System\PzwifvI.exe
  C:\Windows\System\PzwifvI.exe
  2⤵
  PID:5124
- C:\Windows\System\iYZqLUg.exe
  C:\Windows\System\iYZqLUg.exe
  2⤵
  PID:5332
- C:\Windows\System\pOVSGZP.exe
  C:\Windows\System\pOVSGZP.exe
  2⤵
  PID:4800
- C:\Windows\System\XORIkrh.exe
  C:\Windows\System\XORIkrh.exe
  2⤵
  PID:5392
- C:\Windows\System\GPhCktN.exe
  C:\Windows\System\GPhCktN.exe
  2⤵
  PID:6240
- C:\Windows\System\tSVkfwa.exe
  C:\Windows\System\tSVkfwa.exe
  2⤵
  PID:6404
- C:\Windows\System\lzsPixH.exe
  C:\Windows\System\lzsPixH.exe
  2⤵
  PID:6632
- C:\Windows\System\mQNbWJE.exe
  C:\Windows\System\mQNbWJE.exe
  2⤵
  PID:6456
- C:\Windows\System\GtBBkPG.exe
  C:\Windows\System\GtBBkPG.exe
  2⤵
  PID:6696
- C:\Windows\System\giUkiVX.exe
  C:\Windows\System\giUkiVX.exe
  2⤵
  PID:2484
- C:\Windows\System\ttpTpDF.exe
  C:\Windows\System\ttpTpDF.exe
  2⤵
  PID:6832
- C:\Windows\System\fDylTwf.exe
  C:\Windows\System\fDylTwf.exe
  2⤵
  PID:6432
- C:\Windows\System\kkLzqOk.exe
  C:\Windows\System\kkLzqOk.exe
  2⤵
  PID:2224
- C:\Windows\System\naOWUZv.exe
  C:\Windows\System\naOWUZv.exe
  2⤵
  PID:7156
- C:\Windows\System\YwkOlgS.exe
  C:\Windows\System\YwkOlgS.exe
  2⤵
  PID:7176
- C:\Windows\System\YdRGNrr.exe
  C:\Windows\System\YdRGNrr.exe
  2⤵
  PID:7192
- C:\Windows\System\KfWxJNz.exe
  C:\Windows\System\KfWxJNz.exe
  2⤵
  PID:7212
- C:\Windows\System\jhwbJAz.exe
  C:\Windows\System\jhwbJAz.exe
  2⤵
  PID:7236
- C:\Windows\System\aHXSppA.exe
  C:\Windows\System\aHXSppA.exe
  2⤵
  PID:7252
- C:\Windows\System\DxOppNe.exe
  C:\Windows\System\DxOppNe.exe
  2⤵
  PID:7276
- C:\Windows\System\TUHcLEw.exe
  C:\Windows\System\TUHcLEw.exe
  2⤵
  PID:7300
- C:\Windows\System\vciUEPi.exe
  C:\Windows\System\vciUEPi.exe
  2⤵
  PID:7316
- C:\Windows\System\WLZcQtV.exe
  C:\Windows\System\WLZcQtV.exe
  2⤵
  PID:7420
- C:\Windows\System\ZMHkQzI.exe
  C:\Windows\System\ZMHkQzI.exe
  2⤵
  PID:7444
- C:\Windows\System\QOguOMs.exe
  C:\Windows\System\QOguOMs.exe
  2⤵
  PID:7468
- C:\Windows\System\FLVNXLU.exe
  C:\Windows\System\FLVNXLU.exe
  2⤵
  PID:7488
- C:\Windows\System\FllCCjt.exe
  C:\Windows\System\FllCCjt.exe
  2⤵
  PID:7508
- C:\Windows\System\WfdWCkH.exe
  C:\Windows\System\WfdWCkH.exe
  2⤵
  PID:7532
- C:\Windows\System\IlQCsYt.exe
  C:\Windows\System\IlQCsYt.exe
  2⤵
  PID:7632
- C:\Windows\System\rFWqxcr.exe
  C:\Windows\System\rFWqxcr.exe
  2⤵
  PID:7660
- C:\Windows\System\ImTpbNp.exe
  C:\Windows\System\ImTpbNp.exe
  2⤵
  PID:7676
- C:\Windows\System\hTpWpyu.exe
  C:\Windows\System\hTpWpyu.exe
  2⤵
  PID:7696
- C:\Windows\System\YJFGQRt.exe
  C:\Windows\System\YJFGQRt.exe
  2⤵
  PID:7780
- C:\Windows\System\RBpsXHB.exe
  C:\Windows\System\RBpsXHB.exe
  2⤵
  PID:7804
- C:\Windows\System\brTRypL.exe
  C:\Windows\System\brTRypL.exe
  2⤵
  PID:7824
- C:\Windows\System\hqbxNcG.exe
  C:\Windows\System\hqbxNcG.exe
  2⤵
  PID:7960
- C:\Windows\System\OuIevgh.exe
  C:\Windows\System\OuIevgh.exe
  2⤵
  PID:7976
- C:\Windows\System\PcjdERf.exe
  C:\Windows\System\PcjdERf.exe
  2⤵
  PID:8016
- C:\Windows\System\ozcrPNd.exe
  C:\Windows\System\ozcrPNd.exe
  2⤵
  PID:8032
- C:\Windows\System\AwsWIFa.exe
  C:\Windows\System\AwsWIFa.exe
  2⤵
  PID:8048
- C:\Windows\System\XqIFTqw.exe
  C:\Windows\System\XqIFTqw.exe
  2⤵
  PID:8064
- C:\Windows\System\lNFmJPz.exe
  C:\Windows\System\lNFmJPz.exe
  2⤵
  PID:8080
- C:\Windows\System\ILkkuUd.exe
  C:\Windows\System\ILkkuUd.exe
  2⤵
  PID:8096
- C:\Windows\System\mRlEdSa.exe
  C:\Windows\System\mRlEdSa.exe
  2⤵
  PID:8112
- C:\Windows\System\FqwuDNj.exe
  C:\Windows\System\FqwuDNj.exe
  2⤵
  PID:8128
- C:\Windows\System\ZferNYH.exe
  C:\Windows\System\ZferNYH.exe
  2⤵
  PID:8144
- C:\Windows\System\wqHdacA.exe
  C:\Windows\System\wqHdacA.exe
  2⤵
  PID:8160
- C:\Windows\System\CvKwVSJ.exe
  C:\Windows\System\CvKwVSJ.exe
  2⤵
  PID:2684
- C:\Windows\System\QNfmpFs.exe
  C:\Windows\System\QNfmpFs.exe
  2⤵
  PID:1700
- C:\Windows\System\OqXenvk.exe
  C:\Windows\System\OqXenvk.exe
  2⤵
  PID:1424
- C:\Windows\System\pzifHGV.exe
  C:\Windows\System\pzifHGV.exe
  2⤵
  PID:4552
- C:\Windows\System\rothXxk.exe
  C:\Windows\System\rothXxk.exe
  2⤵
  PID:6580
- C:\Windows\System\EgDEdvN.exe
  C:\Windows\System\EgDEdvN.exe
  2⤵
  PID:6356
- C:\Windows\System\OkXOsXH.exe
  C:\Windows\System\OkXOsXH.exe
  2⤵
  PID:7140
- C:\Windows\System\wBmKnwW.exe
  C:\Windows\System\wBmKnwW.exe
  2⤵
  PID:7260
- C:\Windows\System\KDGEbnu.exe
  C:\Windows\System\KDGEbnu.exe
  2⤵
  PID:7296
- C:\Windows\System\KfCnYFS.exe
  C:\Windows\System\KfCnYFS.exe
  2⤵
  PID:7540
- C:\Windows\System\eUnvkjQ.exe
  C:\Windows\System\eUnvkjQ.exe
  2⤵
  PID:7548
- C:\Windows\System\vzlGdzx.exe
  C:\Windows\System\vzlGdzx.exe
  2⤵
  PID:7404
- C:\Windows\System\BJktfHh.exe
  C:\Windows\System\BJktfHh.exe
  2⤵
  PID:7436
- C:\Windows\System\LZMGqbh.exe
  C:\Windows\System\LZMGqbh.exe
  2⤵
  PID:7476
- C:\Windows\System\FscJDjF.exe
  C:\Windows\System\FscJDjF.exe
  2⤵
  PID:7524
- C:\Windows\System\EtxtHcz.exe
  C:\Windows\System\EtxtHcz.exe
  2⤵
  PID:7600
- C:\Windows\System\YbPUQUh.exe
  C:\Windows\System\YbPUQUh.exe
  2⤵
  PID:7644
- C:\Windows\System\xyjWPdG.exe
  C:\Windows\System\xyjWPdG.exe
  2⤵
  PID:7692
- C:\Windows\System\IOBVrqP.exe
  C:\Windows\System\IOBVrqP.exe
  2⤵
  PID:7748
- C:\Windows\System\BJynyCc.exe
  C:\Windows\System\BJynyCc.exe
  2⤵
  PID:7788
- C:\Windows\System\SyhaCHE.exe
  C:\Windows\System\SyhaCHE.exe
  2⤵
  PID:1092
- C:\Windows\System\JlWwKvd.exe
  C:\Windows\System\JlWwKvd.exe
  2⤵
  PID:4616
- C:\Windows\System\gjgCopt.exe
  C:\Windows\System\gjgCopt.exe
  2⤵
  PID:7888
- C:\Windows\System\IeaKrrg.exe
  C:\Windows\System\IeaKrrg.exe
  2⤵
  PID:7900
- C:\Windows\System\TVRjQoj.exe
  C:\Windows\System\TVRjQoj.exe
  2⤵
  PID:7984
- C:\Windows\System\PUnXtKA.exe
  C:\Windows\System\PUnXtKA.exe
  2⤵
  PID:8124
- C:\Windows\System\itYRdLp.exe
  C:\Windows\System\itYRdLp.exe
  2⤵
  PID:8028
- C:\Windows\System\EWflSiw.exe
  C:\Windows\System\EWflSiw.exe
  2⤵
  PID:8072
- C:\Windows\System\eHbpQlr.exe
  C:\Windows\System\eHbpQlr.exe
  2⤵
  PID:5760
- C:\Windows\System\cuYEzRX.exe
  C:\Windows\System\cuYEzRX.exe
  2⤵
  PID:8180
- C:\Windows\System\fqbhVSk.exe
  C:\Windows\System\fqbhVSk.exe
  2⤵
  PID:4684
- C:\Windows\System\EZzuNhJ.exe
  C:\Windows\System\EZzuNhJ.exe
  2⤵
  PID:5112
- C:\Windows\System\VVMNBnm.exe
  C:\Windows\System\VVMNBnm.exe
  2⤵
  PID:5428
- C:\Windows\System\UKWitpv.exe
  C:\Windows\System\UKWitpv.exe
  2⤵
  PID:6760
- C:\Windows\System\RyZWSxU.exe
  C:\Windows\System\RyZWSxU.exe
  2⤵
  PID:7428
- C:\Windows\System\BQIcDpB.exe
  C:\Windows\System\BQIcDpB.exe
  2⤵
  PID:7592
- C:\Windows\System\DZuPqex.exe
  C:\Windows\System\DZuPqex.exe
  2⤵
  PID:3672
- C:\Windows\System\hYVYZQA.exe
  C:\Windows\System\hYVYZQA.exe
  2⤵
  PID:7688
- C:\Windows\System\JuaTlMS.exe
  C:\Windows\System\JuaTlMS.exe
  2⤵
  PID:7736
- C:\Windows\System\ysQBmjJ.exe
  C:\Windows\System\ysQBmjJ.exe
  2⤵
  PID:7388
- C:\Windows\System\eAQkqIF.exe
  C:\Windows\System\eAQkqIF.exe
  2⤵
  PID:4148
- C:\Windows\System\RfQTYEw.exe
  C:\Windows\System\RfQTYEw.exe
  2⤵
  PID:3488
- C:\Windows\System\xDffgzx.exe
  C:\Windows\System\xDffgzx.exe
  2⤵
  PID:1412
- C:\Windows\System\xZOxZVS.exe
  C:\Windows\System\xZOxZVS.exe
  2⤵
  PID:8196
- C:\Windows\System\FJgZJpl.exe
  C:\Windows\System\FJgZJpl.exe
  2⤵
  PID:8228
- C:\Windows\System\MKyXWuX.exe
  C:\Windows\System\MKyXWuX.exe
  2⤵
  PID:8244
- C:\Windows\System\cDRnXGv.exe
  C:\Windows\System\cDRnXGv.exe
  2⤵
  PID:8264
- C:\Windows\System\zQPGXGJ.exe
  C:\Windows\System\zQPGXGJ.exe
  2⤵
  PID:8288
- C:\Windows\System\RRhsZHp.exe
  C:\Windows\System\RRhsZHp.exe
  2⤵
  PID:8312
- C:\Windows\System\QzkeCTc.exe
  C:\Windows\System\QzkeCTc.exe
  2⤵
  PID:8332
- C:\Windows\System\lcqVvHB.exe
  C:\Windows\System\lcqVvHB.exe
  2⤵
  PID:8352
- C:\Windows\System\ebRXlEK.exe
  C:\Windows\System\ebRXlEK.exe
  2⤵
  PID:8372
- C:\Windows\System\BHEAiNO.exe
  C:\Windows\System\BHEAiNO.exe
  2⤵
  PID:8400
- C:\Windows\System\FKUXXWY.exe
  C:\Windows\System\FKUXXWY.exe
  2⤵
  PID:8424
- C:\Windows\System\DpePXfO.exe
  C:\Windows\System\DpePXfO.exe
  2⤵
  PID:8448
- C:\Windows\System\OQHlQql.exe
  C:\Windows\System\OQHlQql.exe
  2⤵
  PID:8464
- C:\Windows\System\HyUAtWE.exe
  C:\Windows\System\HyUAtWE.exe
  2⤵
  PID:8488
- C:\Windows\System\bvYuYwJ.exe
  C:\Windows\System\bvYuYwJ.exe
  2⤵
  PID:8504
- C:\Windows\System\kkkDuoN.exe
  C:\Windows\System\kkkDuoN.exe
  2⤵
  PID:8524
- C:\Windows\System\PGdtwfX.exe
  C:\Windows\System\PGdtwfX.exe
  2⤵
  PID:8544
- C:\Windows\System\krUmqCY.exe
  C:\Windows\System\krUmqCY.exe
  2⤵
  PID:8564
- C:\Windows\System\uJhZsjZ.exe
  C:\Windows\System\uJhZsjZ.exe
  2⤵
  PID:8588
- C:\Windows\System\YJitGov.exe
  C:\Windows\System\YJitGov.exe
  2⤵
  PID:8604
- C:\Windows\System\hPaBUXP.exe
  C:\Windows\System\hPaBUXP.exe
  2⤵
  PID:8632
- C:\Windows\System\EiwLWKg.exe
  C:\Windows\System\EiwLWKg.exe
  2⤵
  PID:8652
- C:\Windows\System\zhXfzPV.exe
  C:\Windows\System\zhXfzPV.exe
  2⤵
  PID:8672
- C:\Windows\System\awKqbiG.exe
  C:\Windows\System\awKqbiG.exe
  2⤵
  PID:8696
- C:\Windows\System\apQLpoI.exe
  C:\Windows\System\apQLpoI.exe
  2⤵
  PID:8716
- C:\Windows\System\YfcPinr.exe
  C:\Windows\System\YfcPinr.exe
  2⤵
  PID:8732
- C:\Windows\System\efIAkCd.exe
  C:\Windows\System\efIAkCd.exe
  2⤵
  PID:8756
- C:\Windows\System\pCbKvhX.exe
  C:\Windows\System\pCbKvhX.exe
  2⤵
  PID:8772
- C:\Windows\System\rknKVew.exe
  C:\Windows\System\rknKVew.exe
  2⤵
  PID:8796
- C:\Windows\System\KwQGIzh.exe
  C:\Windows\System\KwQGIzh.exe
  2⤵
  PID:8824
- C:\Windows\System\mugieAN.exe
  C:\Windows\System\mugieAN.exe
  2⤵
  PID:8840
- C:\Windows\System\KffIeTd.exe
  C:\Windows\System\KffIeTd.exe
  2⤵
  PID:8860
- C:\Windows\System\PHsAJxe.exe
  C:\Windows\System\PHsAJxe.exe
  2⤵
  PID:8888
- C:\Windows\System\MJpSSjm.exe
  C:\Windows\System\MJpSSjm.exe
  2⤵
  PID:8908
- C:\Windows\System\hgzxwnU.exe
  C:\Windows\System\hgzxwnU.exe
  2⤵
  PID:8924
- C:\Windows\System\QkZddIk.exe
  C:\Windows\System\QkZddIk.exe
  2⤵
  PID:8944
- C:\Windows\System\ZvsiBaz.exe
  C:\Windows\System\ZvsiBaz.exe
  2⤵
  PID:8960
- C:\Windows\System\BBlahxd.exe
  C:\Windows\System\BBlahxd.exe
  2⤵
  PID:8976
- C:\Windows\System\NUJSEcP.exe
  C:\Windows\System\NUJSEcP.exe
  2⤵
  PID:8996
- C:\Windows\System\KuLbKdd.exe
  C:\Windows\System\KuLbKdd.exe
  2⤵
  PID:9012
- C:\Windows\System\aXtGgKF.exe
  C:\Windows\System\aXtGgKF.exe
  2⤵
  PID:9036
- C:\Windows\System\LThJihI.exe
  C:\Windows\System\LThJihI.exe
  2⤵
  PID:9060
- C:\Windows\System\wtFsCWI.exe
  C:\Windows\System\wtFsCWI.exe
  2⤵
  PID:9076
- C:\Windows\System\kfjtaAF.exe
  C:\Windows\System\kfjtaAF.exe
  2⤵
  PID:9104
- C:\Windows\System\KtIXAnq.exe
  C:\Windows\System\KtIXAnq.exe
  2⤵
  PID:9132
- C:\Windows\System\VEWmMXm.exe
  C:\Windows\System\VEWmMXm.exe
  2⤵
  PID:9148
- C:\Windows\System\qjRCqXE.exe
  C:\Windows\System\qjRCqXE.exe
  2⤵
  PID:9176
- C:\Windows\System\CqtQHAr.exe
  C:\Windows\System\CqtQHAr.exe
  2⤵
  PID:9196
- C:\Windows\System\IsrapQO.exe
  C:\Windows\System\IsrapQO.exe
  2⤵
  PID:7764
- C:\Windows\System\jbMXawp.exe
  C:\Windows\System\jbMXawp.exe
  2⤵
  PID:7504
- C:\Windows\System\QGvRgVn.exe
  C:\Windows\System\QGvRgVn.exe
  2⤵
  PID:7616
- C:\Windows\System\RSlhSyr.exe
  C:\Windows\System\RSlhSyr.exe
  2⤵
  PID:4996
- C:\Windows\System\aDWXlJM.exe
  C:\Windows\System\aDWXlJM.exe
  2⤵
  PID:464
- C:\Windows\System\HrNUczg.exe
  C:\Windows\System\HrNUczg.exe
  2⤵
  PID:8520
- C:\Windows\System\ASagWkV.exe
  C:\Windows\System\ASagWkV.exe
  2⤵
  PID:4584
- C:\Windows\System\QOwkeRb.exe
  C:\Windows\System\QOwkeRb.exe
  2⤵
  PID:8600
- C:\Windows\System\oPeqduG.exe
  C:\Windows\System\oPeqduG.exe
  2⤵
  PID:8276
- C:\Windows\System\yUhmHhx.exe
  C:\Windows\System\yUhmHhx.exe
  2⤵
  PID:8340
- C:\Windows\System\TqYnlDR.exe
  C:\Windows\System\TqYnlDR.exe
  2⤵
  PID:8804
- C:\Windows\System\ygyvTHH.exe
  C:\Windows\System\ygyvTHH.exe
  2⤵
  PID:8416
- C:\Windows\System\NtnwFQR.exe
  C:\Windows\System\NtnwFQR.exe
  2⤵
  PID:8480
- C:\Windows\System\sCnvWSS.exe
  C:\Windows\System\sCnvWSS.exe
  2⤵
  PID:9072
- C:\Windows\System\JEoESJa.exe
  C:\Windows\System\JEoESJa.exe
  2⤵
  PID:9212
- C:\Windows\System\SZrgvnV.exe
  C:\Windows\System\SZrgvnV.exe
  2⤵
  PID:5072
- C:\Windows\System\GEwLhaf.exe
  C:\Windows\System\GEwLhaf.exe
  2⤵
  PID:8872
- C:\Windows\System\SHeAboF.exe
  C:\Windows\System\SHeAboF.exe
  2⤵
  PID:8812
- C:\Windows\System\MGegzDl.exe
  C:\Windows\System\MGegzDl.exe
  2⤵
  PID:1660
- C:\Windows\System\vZURZOU.exe
  C:\Windows\System\vZURZOU.exe
  2⤵
  PID:8496
- C:\Windows\System\FzqsTle.exe
  C:\Windows\System\FzqsTle.exe
  2⤵
  PID:9128
- C:\Windows\System\GyxFbow.exe
  C:\Windows\System\GyxFbow.exe
  2⤵
  PID:9228
- C:\Windows\System\eCzXAkd.exe
  C:\Windows\System\eCzXAkd.exe
  2⤵
  PID:9248
- C:\Windows\System\OlRcxkZ.exe
  C:\Windows\System\OlRcxkZ.exe
  2⤵
  PID:9272
- C:\Windows\System\xVtxTyN.exe
  C:\Windows\System\xVtxTyN.exe
  2⤵
  PID:9348
- C:\Windows\System\nvXAkPD.exe
  C:\Windows\System\nvXAkPD.exe
  2⤵
  PID:9364
- C:\Windows\System\MxRnFlQ.exe
  C:\Windows\System\MxRnFlQ.exe
  2⤵
  PID:9396
- C:\Windows\System\hCRGXTA.exe
  C:\Windows\System\hCRGXTA.exe
  2⤵
  PID:9432
- C:\Windows\System\vtfYStG.exe
  C:\Windows\System\vtfYStG.exe
  2⤵
  PID:9448
- C:\Windows\System\HyuJYEw.exe
  C:\Windows\System\HyuJYEw.exe
  2⤵
  PID:9464
- C:\Windows\System\BsfMtsz.exe
  C:\Windows\System\BsfMtsz.exe
  2⤵
  PID:9488
- C:\Windows\System\IoYiNam.exe
  C:\Windows\System\IoYiNam.exe
  2⤵
  PID:9504
- C:\Windows\System\HPcqICg.exe
  C:\Windows\System\HPcqICg.exe
  2⤵
  PID:9528
- C:\Windows\System\YqKuwDA.exe
  C:\Windows\System\YqKuwDA.exe
  2⤵
  PID:9548
- C:\Windows\System\hqFjDZq.exe
  C:\Windows\System\hqFjDZq.exe
  2⤵
  PID:9572
- C:\Windows\System\CIpXXHw.exe
  C:\Windows\System\CIpXXHw.exe
  2⤵
  PID:9592
- C:\Windows\System\JMwGLEw.exe
  C:\Windows\System\JMwGLEw.exe
  2⤵
  PID:9616
- C:\Windows\System\ifPoCxy.exe
  C:\Windows\System\ifPoCxy.exe
  2⤵
  PID:9636
- C:\Windows\System\tJWOeTH.exe
  C:\Windows\System\tJWOeTH.exe
  2⤵
  PID:9660
- C:\Windows\System\fImGSoA.exe
  C:\Windows\System\fImGSoA.exe
  2⤵
  PID:9680
- C:\Windows\System\TBXSCPL.exe
  C:\Windows\System\TBXSCPL.exe
  2⤵
  PID:9700
- C:\Windows\System\oHjaGnY.exe
  C:\Windows\System\oHjaGnY.exe
  2⤵
  PID:9720
- C:\Windows\System\ktVziim.exe
  C:\Windows\System\ktVziim.exe
  2⤵
  PID:9744
- C:\Windows\System\fcnejdC.exe
  C:\Windows\System\fcnejdC.exe
  2⤵
  PID:9764
- C:\Windows\System\hngbkhc.exe
  C:\Windows\System\hngbkhc.exe
  2⤵
  PID:9788
- C:\Windows\System\qTvyQyI.exe
  C:\Windows\System\qTvyQyI.exe
  2⤵
  PID:9808
- C:\Windows\System\RBqeRQu.exe
  C:\Windows\System\RBqeRQu.exe
  2⤵
  PID:9828
- C:\Windows\System\DsmAnrF.exe
  C:\Windows\System\DsmAnrF.exe
  2⤵
  PID:9844
- C:\Windows\System\clRGXqf.exe
  C:\Windows\System\clRGXqf.exe
  2⤵
  PID:9868
- C:\Windows\System\VixYZVZ.exe
  C:\Windows\System\VixYZVZ.exe
  2⤵
  PID:9888
- C:\Windows\System\kYQnEHE.exe
  C:\Windows\System\kYQnEHE.exe
  2⤵
  PID:9912
- C:\Windows\System\bhOdUzo.exe
  C:\Windows\System\bhOdUzo.exe
  2⤵
  PID:9936
- C:\Windows\System\YukdAKV.exe
  C:\Windows\System\YukdAKV.exe
  2⤵
  PID:9960
- C:\Windows\System\eoVDIqk.exe
  C:\Windows\System\eoVDIqk.exe
  2⤵
  PID:9980
- C:\Windows\System\QLYUQSw.exe
  C:\Windows\System\QLYUQSw.exe
  2⤵
  PID:10008
- C:\Windows\System\xwaYgUm.exe
  C:\Windows\System\xwaYgUm.exe
  2⤵
  PID:10028
- C:\Windows\System\IyZGufx.exe
  C:\Windows\System\IyZGufx.exe
  2⤵
  PID:10052
- C:\Windows\System\SLxuise.exe
  C:\Windows\System\SLxuise.exe
  2⤵
  PID:10072
- C:\Windows\System\jXZIWoz.exe
  C:\Windows\System\jXZIWoz.exe
  2⤵
  PID:10092
- C:\Windows\System\IcqgUdP.exe
  C:\Windows\System\IcqgUdP.exe
  2⤵
  PID:10112
- C:\Windows\System\iwxcSti.exe
  C:\Windows\System\iwxcSti.exe
  2⤵
  PID:10132
- C:\Windows\System\nUREOLp.exe
  C:\Windows\System\nUREOLp.exe
  2⤵
  PID:10156
- C:\Windows\System\EaWmEGh.exe
  C:\Windows\System\EaWmEGh.exe
  2⤵
  PID:10184
- C:\Windows\System\GukHQZw.exe
  C:\Windows\System\GukHQZw.exe
  2⤵
  PID:10204
- C:\Windows\System\UMkXfTv.exe
  C:\Windows\System\UMkXfTv.exe
  2⤵
  PID:10224
- C:\Windows\System\HTItAZQ.exe
  C:\Windows\System\HTItAZQ.exe
  2⤵
  PID:8640
- C:\Windows\System\pEzljZG.exe
  C:\Windows\System\pEzljZG.exe
  2⤵
  PID:1088
- C:\Windows\System\KSpSUkD.exe
  C:\Windows\System\KSpSUkD.exe
  2⤵
  PID:8956
- C:\Windows\System\LEkJqfO.exe
  C:\Windows\System\LEkJqfO.exe
  2⤵
  PID:9020
- C:\Windows\System\aqTthKG.exe
  C:\Windows\System\aqTthKG.exe
  2⤵
  PID:1368
- C:\Windows\System\TeJLTmY.exe
  C:\Windows\System\TeJLTmY.exe
  2⤵
  PID:8572
- C:\Windows\System\jbNhUmL.exe
  C:\Windows\System\jbNhUmL.exe
  2⤵
  PID:9264
- C:\Windows\System\QYqzlHq.exe
  C:\Windows\System\QYqzlHq.exe
  2⤵
  PID:4308
- C:\Windows\System\vgLJZuu.exe
  C:\Windows\System\vgLJZuu.exe
  2⤵
  PID:9140
- C:\Windows\System\hbAOgTA.exe
  C:\Windows\System\hbAOgTA.exe
  2⤵
  PID:9004
- C:\Windows\System\NSiAdXL.exe
  C:\Windows\System\NSiAdXL.exe
  2⤵
  PID:8060
- C:\Windows\System\WKawczw.exe
  C:\Windows\System\WKawczw.exe
  2⤵
  PID:8788
- C:\Windows\System\jbgpOIn.exe
  C:\Windows\System\jbgpOIn.exe
  2⤵
  PID:3520
- C:\Windows\System\IpvqZha.exe
  C:\Windows\System\IpvqZha.exe
  2⤵
  PID:8596
- C:\Windows\System\jBAbiwN.exe
  C:\Windows\System\jBAbiwN.exe
  2⤵
  PID:9388
- C:\Windows\System\ndEYtBg.exe
  C:\Windows\System\ndEYtBg.exe
  2⤵
  PID:9440
- C:\Windows\System\LGhFLVC.exe
  C:\Windows\System\LGhFLVC.exe
  2⤵
  PID:9516
- C:\Windows\System\NbAPTxG.exe
  C:\Windows\System\NbAPTxG.exe
  2⤵
  PID:8532
- C:\Windows\System\JHXJpxX.exe
  C:\Windows\System\JHXJpxX.exe
  2⤵
  PID:9624
- C:\Windows\System\aVZnEmp.exe
  C:\Windows\System\aVZnEmp.exe
  2⤵
  PID:9716
- C:\Windows\System\EYoyMEz.exe
  C:\Windows\System\EYoyMEz.exe
  2⤵
  PID:9796
- C:\Windows\System\WdFSYGM.exe
  C:\Windows\System\WdFSYGM.exe
  2⤵
  PID:9836
- C:\Windows\System\sAZHyYI.exe
  C:\Windows\System\sAZHyYI.exe
  2⤵
  PID:8256
- C:\Windows\System\ddmxQZj.exe
  C:\Windows\System\ddmxQZj.exe
  2⤵
  PID:9928
- C:\Windows\System\MsvRyom.exe
  C:\Windows\System\MsvRyom.exe
  2⤵
  PID:9968
- C:\Windows\System\QrsbFYO.exe
  C:\Windows\System\QrsbFYO.exe
  2⤵
  PID:10248
- C:\Windows\System\inHjwSS.exe
  C:\Windows\System\inHjwSS.exe
  2⤵
  PID:10268
- C:\Windows\System\bnpsJTF.exe
  C:\Windows\System\bnpsJTF.exe
  2⤵
  PID:10292
- C:\Windows\System\ggihytR.exe
  C:\Windows\System\ggihytR.exe
  2⤵
  PID:10316
- C:\Windows\System\ypqqTHX.exe
  C:\Windows\System\ypqqTHX.exe
  2⤵
  PID:10336
- C:\Windows\System\MHFhDXv.exe
  C:\Windows\System\MHFhDXv.exe
  2⤵
  PID:10352
- C:\Windows\System\vfQxDBy.exe
  C:\Windows\System\vfQxDBy.exe
  2⤵
  PID:10368
- C:\Windows\System\XwFbKHm.exe
  C:\Windows\System\XwFbKHm.exe
  2⤵
  PID:10388
- C:\Windows\System\gRypCqr.exe
  C:\Windows\System\gRypCqr.exe
  2⤵
  PID:10404
- C:\Windows\System\iWnHtQr.exe
  C:\Windows\System\iWnHtQr.exe
  2⤵
  PID:10420
- C:\Windows\System\XKeVmiK.exe
  C:\Windows\System\XKeVmiK.exe
  2⤵
  PID:10436
- C:\Windows\System\VWoVNVv.exe
  C:\Windows\System\VWoVNVv.exe
  2⤵
  PID:10460
- C:\Windows\System\ZBlWdZn.exe
  C:\Windows\System\ZBlWdZn.exe
  2⤵
  PID:10480
- C:\Windows\System\pTfQsDd.exe
  C:\Windows\System\pTfQsDd.exe
  2⤵
  PID:10508
- C:\Windows\System\iTkcNiV.exe
  C:\Windows\System\iTkcNiV.exe
  2⤵
  PID:10544
- C:\Windows\System\XnFTiyX.exe
  C:\Windows\System\XnFTiyX.exe
  2⤵
  PID:10564
- C:\Windows\System\PRNFORN.exe
  C:\Windows\System\PRNFORN.exe
  2⤵
  PID:10580
- C:\Windows\System\HyWwkaW.exe
  C:\Windows\System\HyWwkaW.exe
  2⤵
  PID:10604
- C:\Windows\System\SjFVEHx.exe
  C:\Windows\System\SjFVEHx.exe
  2⤵
  PID:10624
- C:\Windows\System\rRJOraP.exe
  C:\Windows\System\rRJOraP.exe
  2⤵
  PID:10644
- C:\Windows\System\PgjDYHF.exe
  C:\Windows\System\PgjDYHF.exe
  2⤵
  PID:10664
- C:\Windows\System\IwaQTQx.exe
  C:\Windows\System\IwaQTQx.exe
  2⤵
  PID:10684
- C:\Windows\System\eJUGwhb.exe
  C:\Windows\System\eJUGwhb.exe
  2⤵
  PID:10708
- C:\Windows\System\UWBTRtx.exe
  C:\Windows\System\UWBTRtx.exe
  2⤵
  PID:10732
- C:\Windows\System\HnGwDHH.exe
  C:\Windows\System\HnGwDHH.exe
  2⤵
  PID:10752
- C:\Windows\System\IpjMjcR.exe
  C:\Windows\System\IpjMjcR.exe
  2⤵
  PID:10772
- C:\Windows\System\iorNDBR.exe
  C:\Windows\System\iorNDBR.exe
  2⤵
  PID:10796
- C:\Windows\System\kJaunry.exe
  C:\Windows\System\kJaunry.exe
  2⤵
  PID:10812
- C:\Windows\System\aqOfWZU.exe
  C:\Windows\System\aqOfWZU.exe
  2⤵
  PID:10836
- C:\Windows\System\pAfJMaX.exe
  C:\Windows\System\pAfJMaX.exe
  2⤵
  PID:10864
- C:\Windows\System\CzjUeYd.exe
  C:\Windows\System\CzjUeYd.exe
  2⤵
  PID:10884
- C:\Windows\System\dAcoiqm.exe
  C:\Windows\System\dAcoiqm.exe
  2⤵
  PID:10908
- C:\Windows\System\HbfzEfV.exe
  C:\Windows\System\HbfzEfV.exe
  2⤵
  PID:10928
- C:\Windows\System\KdwFqBy.exe
  C:\Windows\System\KdwFqBy.exe
  2⤵
  PID:10952
- C:\Windows\System\FUlzNKY.exe
  C:\Windows\System\FUlzNKY.exe
  2⤵
  PID:10968
- C:\Windows\System\ePOSLTb.exe
  C:\Windows\System\ePOSLTb.exe
  2⤵
  PID:10988
- C:\Windows\System\cVPQqTU.exe
  C:\Windows\System\cVPQqTU.exe
  2⤵
  PID:11008
- C:\Windows\System\eEMRbbN.exe
  C:\Windows\System\eEMRbbN.exe
  2⤵
  PID:11028
- C:\Windows\System\wrkuLXc.exe
  C:\Windows\System\wrkuLXc.exe
  2⤵
  PID:11044
- C:\Windows\System\pootnzw.exe
  C:\Windows\System\pootnzw.exe
  2⤵
  PID:11064
- C:\Windows\System\GgxIcVV.exe
  C:\Windows\System\GgxIcVV.exe
  2⤵
  PID:11080
- C:\Windows\System\mXKdfwJ.exe
  C:\Windows\System\mXKdfwJ.exe
  2⤵
  PID:11100
- C:\Windows\System\PmOMkqR.exe
  C:\Windows\System\PmOMkqR.exe
  2⤵
  PID:11124
- C:\Windows\System\tMaulOz.exe
  C:\Windows\System\tMaulOz.exe
  2⤵
  PID:11144
- C:\Windows\System\wKUrtNZ.exe
  C:\Windows\System\wKUrtNZ.exe
  2⤵
  PID:11164
- C:\Windows\System\jDEhJHG.exe
  C:\Windows\System\jDEhJHG.exe
  2⤵
  PID:11188
- C:\Windows\System\srPPjYW.exe
  C:\Windows\System\srPPjYW.exe
  2⤵
  PID:11208
- C:\Windows\System\HAVCAuJ.exe
  C:\Windows\System\HAVCAuJ.exe
  2⤵
  PID:11224
- C:\Windows\System\pKXEuuc.exe
  C:\Windows\System\pKXEuuc.exe
  2⤵
  PID:11244
- C:\Windows\System\igJOMCz.exe
  C:\Windows\System\igJOMCz.exe
  2⤵
  PID:10060
- C:\Windows\System\tstRQfE.exe
  C:\Windows\System\tstRQfE.exe
  2⤵
  PID:9500
- C:\Windows\System\qFuOwJn.exe
  C:\Windows\System\qFuOwJn.exe
  2⤵
  PID:9580
- C:\Windows\System\BmSCtHb.exe
  C:\Windows\System\BmSCtHb.exe
  2⤵
  PID:10172
- C:\Windows\System\YjryzsB.exe
  C:\Windows\System\YjryzsB.exe
  2⤵
  PID:9628
- C:\Windows\System\RQlcrDQ.exe
  C:\Windows\System\RQlcrDQ.exe
  2⤵
  PID:9032
- C:\Windows\System\agXjfBd.exe
  C:\Windows\System\agXjfBd.exe
  2⤵
  PID:8752
- C:\Windows\System\mnTChjG.exe
  C:\Windows\System\mnTChjG.exe
  2⤵
  PID:9008
- C:\Windows\System\RKBZEhD.exe
  C:\Windows\System\RKBZEhD.exe
  2⤵
  PID:9144
- C:\Windows\System\FUsjGVF.exe
  C:\Windows\System\FUsjGVF.exe
  2⤵
  PID:8952
- C:\Windows\System\KUEpYVx.exe
  C:\Windows\System\KUEpYVx.exe
  2⤵
  PID:4780
- C:\Windows\System\pkuRUfM.exe
  C:\Windows\System\pkuRUfM.exe
  2⤵
  PID:9924
- C:\Windows\System\qabxJpP.exe
  C:\Windows\System\qabxJpP.exe
  2⤵
  PID:9608
- C:\Windows\System\KcJJfol.exe
  C:\Windows\System\KcJJfol.exe
  2⤵
  PID:8896
- C:\Windows\System\YNKPNTa.exe
  C:\Windows\System\YNKPNTa.exe
  2⤵
  PID:9864
- C:\Windows\System\omVFFat.exe
  C:\Windows\System\omVFFat.exe
  2⤵
  PID:9412
- C:\Windows\System\RYFIpmK.exe
  C:\Windows\System\RYFIpmK.exe
  2⤵
  PID:10048
- C:\Windows\System\VMsdgCV.exe
  C:\Windows\System\VMsdgCV.exe
  2⤵
  PID:9456
- C:\Windows\System\dEsofHV.exe
  C:\Windows\System\dEsofHV.exe
  2⤵
  PID:10360
- C:\Windows\System\iitSCTt.exe
  C:\Windows\System\iitSCTt.exe
  2⤵
  PID:10400
- C:\Windows\System\VANeoRY.exe
  C:\Windows\System\VANeoRY.exe
  2⤵
  PID:10180
- C:\Windows\System\AYiIxor.exe
  C:\Windows\System\AYiIxor.exe
  2⤵
  PID:11272
- C:\Windows\System\ZzuRqJi.exe
  C:\Windows\System\ZzuRqJi.exe
  2⤵
  PID:11296
- C:\Windows\System\saVJKkc.exe
  C:\Windows\System\saVJKkc.exe
  2⤵
  PID:11316
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11316 -s 240
    3⤵
    PID:12792
- C:\Windows\System\VoJUgzU.exe
  C:\Windows\System\VoJUgzU.exe
  2⤵
  PID:11332
- C:\Windows\System\IoIsyze.exe
  C:\Windows\System\IoIsyze.exe
  2⤵
  PID:11348
- C:\Windows\System\ZzyqyJp.exe
  C:\Windows\System\ZzyqyJp.exe
  2⤵
  PID:11368
- C:\Windows\System\chAydVt.exe
  C:\Windows\System\chAydVt.exe
  2⤵
  PID:11384
- C:\Windows\System\PQziACG.exe
  C:\Windows\System\PQziACG.exe
  2⤵
  PID:11400
- C:\Windows\System\kzuujJq.exe
  C:\Windows\System\kzuujJq.exe
  2⤵
  PID:11420
- C:\Windows\System\YnrUfOr.exe
  C:\Windows\System\YnrUfOr.exe
  2⤵
  PID:11436
- C:\Windows\System\feiyZBk.exe
  C:\Windows\System\feiyZBk.exe
  2⤵
  PID:11456
- C:\Windows\System\aEJbFCk.exe
  C:\Windows\System\aEJbFCk.exe
  2⤵
  PID:11472
- C:\Windows\System\dyOVwPQ.exe
  C:\Windows\System\dyOVwPQ.exe
  2⤵
  PID:11500
- C:\Windows\System\kkYlgup.exe
  C:\Windows\System\kkYlgup.exe
  2⤵
  PID:11520
- C:\Windows\System\knUhcoF.exe
  C:\Windows\System\knUhcoF.exe
  2⤵
  PID:11544
- C:\Windows\System\zJUedht.exe
  C:\Windows\System\zJUedht.exe
  2⤵
  PID:11560
- C:\Windows\System\wroaXHb.exe
  C:\Windows\System\wroaXHb.exe
  2⤵
  PID:11584
- C:\Windows\System\zXdoRUL.exe
  C:\Windows\System\zXdoRUL.exe
  2⤵
  PID:11608
- C:\Windows\System\zsqRdbJ.exe
  C:\Windows\System\zsqRdbJ.exe
  2⤵
  PID:11628
- C:\Windows\System\gJPrbIk.exe
  C:\Windows\System\gJPrbIk.exe
  2⤵
  PID:11648
- C:\Windows\System\fHxFfBG.exe
  C:\Windows\System\fHxFfBG.exe
  2⤵
  PID:11668
- C:\Windows\System\HhZpDcY.exe
  C:\Windows\System\HhZpDcY.exe
  2⤵
  PID:11688
- C:\Windows\System\zpLfUzd.exe
  C:\Windows\System\zpLfUzd.exe
  2⤵
  PID:11708
- C:\Windows\System\lSGMjBk.exe
  C:\Windows\System\lSGMjBk.exe
  2⤵
  PID:11728
- C:\Windows\System\pLTRIJh.exe
  C:\Windows\System\pLTRIJh.exe
  2⤵
  PID:11756
- C:\Windows\System\mJrKfuD.exe
  C:\Windows\System\mJrKfuD.exe
  2⤵
  PID:11784
- C:\Windows\System\wSCZQqI.exe
  C:\Windows\System\wSCZQqI.exe
  2⤵
  PID:11808
- C:\Windows\System\bHGbWWD.exe
  C:\Windows\System\bHGbWWD.exe
  2⤵
  PID:11828
- C:\Windows\System\LbRCIwT.exe
  C:\Windows\System\LbRCIwT.exe
  2⤵
  PID:11848
- C:\Windows\System\tcouDvp.exe
  C:\Windows\System\tcouDvp.exe
  2⤵
  PID:11872
- C:\Windows\System\cBEKJOU.exe
  C:\Windows\System\cBEKJOU.exe
  2⤵
  PID:11892
- C:\Windows\System\UrGPdNt.exe
  C:\Windows\System\UrGPdNt.exe
  2⤵
  PID:11912
- C:\Windows\System\qHARGmp.exe
  C:\Windows\System\qHARGmp.exe
  2⤵
  PID:11928
- C:\Windows\System\aAYJmVP.exe
  C:\Windows\System\aAYJmVP.exe
  2⤵
  PID:11948
- C:\Windows\System\kHAasRL.exe
  C:\Windows\System\kHAasRL.exe
  2⤵
  PID:11972
- C:\Windows\System\UDWgqyY.exe
  C:\Windows\System\UDWgqyY.exe
  2⤵
  PID:11992
- C:\Windows\System\BTkgeQq.exe
  C:\Windows\System\BTkgeQq.exe
  2⤵
  PID:12016
- C:\Windows\System\JhYZsnY.exe
  C:\Windows\System\JhYZsnY.exe
  2⤵
  PID:12032
- C:\Windows\System\geOcjCn.exe
  C:\Windows\System\geOcjCn.exe
  2⤵
  PID:12056
- C:\Windows\System\cxEwAQl.exe
  C:\Windows\System\cxEwAQl.exe
  2⤵
  PID:12080
- C:\Windows\System\qkHagda.exe
  C:\Windows\System\qkHagda.exe
  2⤵
  PID:12096
- C:\Windows\System\OrbcPDC.exe
  C:\Windows\System\OrbcPDC.exe
  2⤵
  PID:12116
- C:\Windows\System\hXvcGib.exe
  C:\Windows\System\hXvcGib.exe
  2⤵
  PID:12136
- C:\Windows\System\niARnXS.exe
  C:\Windows\System\niARnXS.exe
  2⤵
  PID:12156
- C:\Windows\System\wBLDUKR.exe
  C:\Windows\System\wBLDUKR.exe
  2⤵
  PID:12172
- C:\Windows\System\Fiaawnj.exe
  C:\Windows\System\Fiaawnj.exe
  2⤵
  PID:12200
- C:\Windows\System\AbhjFfe.exe
  C:\Windows\System\AbhjFfe.exe
  2⤵
  PID:12216
- C:\Windows\System\jMEwCds.exe
  C:\Windows\System\jMEwCds.exe
  2⤵
  PID:12236
- C:\Windows\System\rtYHUlL.exe
  C:\Windows\System\rtYHUlL.exe
  2⤵
  PID:12256
- C:\Windows\System\HrEKLCS.exe
  C:\Windows\System\HrEKLCS.exe
  2⤵
  PID:12280
- C:\Windows\System\dVIgOtj.exe
  C:\Windows\System\dVIgOtj.exe
  2⤵
  PID:2812
- C:\Windows\System\IArjxEN.exe
  C:\Windows\System\IArjxEN.exe
  2⤵
  PID:8728
- C:\Windows\System\DCWQMbb.exe
  C:\Windows\System\DCWQMbb.exe
  2⤵
  PID:10744
- C:\Windows\System\RjifObH.exe
  C:\Windows\System\RjifObH.exe
  2⤵
  PID:9780
- C:\Windows\System\XLgmoia.exe
  C:\Windows\System\XLgmoia.exe
  2⤵
  PID:10916
- C:\Windows\System\AVGGsOK.exe
  C:\Windows\System\AVGGsOK.exe
  2⤵
  PID:10964
- C:\Windows\System\XRyUhfK.exe
  C:\Windows\System\XRyUhfK.exe
  2⤵
  PID:11036
- C:\Windows\System\mRZyhcl.exe
  C:\Windows\System\mRZyhcl.exe
  2⤵
  PID:11096
- C:\Windows\System\RvnLSVz.exe
  C:\Windows\System\RvnLSVz.exe
  2⤵
  PID:11136
- C:\Windows\System\PVzrCRA.exe
  C:\Windows\System\PVzrCRA.exe
  2⤵
  PID:11196
- C:\Windows\System\GJKHfoD.exe
  C:\Windows\System\GJKHfoD.exe
  2⤵
  PID:9956
- C:\Windows\System\bKTyGdZ.exe
  C:\Windows\System\bKTyGdZ.exe
  2⤵
  PID:9560
- C:\Windows\System\tgMDdxE.exe
  C:\Windows\System\tgMDdxE.exe
  2⤵
  PID:7668
- C:\Windows\System\rvGTzus.exe
  C:\Windows\System\rvGTzus.exe
  2⤵
  PID:9712
- C:\Windows\System\KsGiyUL.exe
  C:\Windows\System\KsGiyUL.exe
  2⤵
  PID:12300
- C:\Windows\System\dZIJpVz.exe
  C:\Windows\System\dZIJpVz.exe
  2⤵
  PID:12316
- C:\Windows\System\UaJJaqU.exe
  C:\Windows\System\UaJJaqU.exe
  2⤵
  PID:12336
- C:\Windows\System\XnbiAMu.exe
  C:\Windows\System\XnbiAMu.exe
  2⤵
  PID:12360
- C:\Windows\System\DxhNbmE.exe
  C:\Windows\System\DxhNbmE.exe
  2⤵
  PID:12376
- C:\Windows\System\VqGVium.exe
  C:\Windows\System\VqGVium.exe
  2⤵
  PID:12396
- C:\Windows\System\tBSQuYM.exe
  C:\Windows\System\tBSQuYM.exe
  2⤵
  PID:12412
- C:\Windows\System\uvDvzNO.exe
  C:\Windows\System\uvDvzNO.exe
  2⤵
  PID:12428
- C:\Windows\System\YRijTgs.exe
  C:\Windows\System\YRijTgs.exe
  2⤵
  PID:12444
- C:\Windows\System\IupTlNM.exe
  C:\Windows\System\IupTlNM.exe
  2⤵
  PID:12460
- C:\Windows\System\DOpivRv.exe
  C:\Windows\System\DOpivRv.exe
  2⤵
  PID:12480
- C:\Windows\System\eHuDwPj.exe
  C:\Windows\System\eHuDwPj.exe
  2⤵
  PID:12996
- C:\Windows\System\pfoXQyi.exe
  C:\Windows\System\pfoXQyi.exe
  2⤵
  PID:13016
- C:\Windows\System\WZwTvwN.exe
  C:\Windows\System\WZwTvwN.exe
  2⤵
  PID:13044
- C:\Windows\System\pcmDosK.exe
  C:\Windows\System\pcmDosK.exe
  2⤵
  PID:13068
- C:\Windows\System\QRTWWDV.exe
  C:\Windows\System\QRTWWDV.exe
  2⤵
  PID:13092
- C:\Windows\System\yDGbLyz.exe
  C:\Windows\System\yDGbLyz.exe
  2⤵
  PID:13112
- C:\Windows\System\UsNKTta.exe
  C:\Windows\System\UsNKTta.exe
  2⤵
  PID:13132
- C:\Windows\System\oBybVFI.exe
  C:\Windows\System\oBybVFI.exe
  2⤵
  PID:13160
- C:\Windows\System\LtxLWBS.exe
  C:\Windows\System\LtxLWBS.exe
  2⤵
  PID:13188
- C:\Windows\System\kTeyAHs.exe
  C:\Windows\System\kTeyAHs.exe
  2⤵
  PID:11380
- C:\Windows\System\lECyrXs.exe
  C:\Windows\System\lECyrXs.exe
  2⤵
  PID:10616
- C:\Windows\System\oVuZoZh.exe
  C:\Windows\System\oVuZoZh.exe
  2⤵
  PID:10764
- C:\Windows\System\fRyhbGu.exe
  C:\Windows\System\fRyhbGu.exe
  2⤵
  PID:10860
- C:\Windows\System\JRkXlsw.exe
  C:\Windows\System\JRkXlsw.exe
  2⤵
  PID:11000
- C:\Windows\System\MTnpZBF.exe
  C:\Windows\System\MTnpZBF.exe
  2⤵
  PID:11176
- C:\Windows\System\RVOYfVv.exe
  C:\Windows\System\RVOYfVv.exe
  2⤵
  PID:11260
- C:\Windows\System\WsKXHof.exe
  C:\Windows\System\WsKXHof.exe
  2⤵
  PID:9756
- C:\Windows\System\ecULkrO.exe
  C:\Windows\System\ecULkrO.exe
  2⤵
  PID:9880
- C:\Windows\System\EHoXEDV.exe
  C:\Windows\System\EHoXEDV.exe
  2⤵
  PID:10264
- C:\Windows\System\IOJvhFb.exe
  C:\Windows\System\IOJvhFb.exe
  2⤵
  PID:10492
- C:\Windows\System\ERQZpQZ.exe
  C:\Windows\System\ERQZpQZ.exe
  2⤵
  PID:11408
- C:\Windows\System\bGFNXii.exe
  C:\Windows\System\bGFNXii.exe
  2⤵
  PID:12648
- C:\Windows\System\CggfHAD.exe
  C:\Windows\System\CggfHAD.exe
  2⤵
  PID:11624
- C:\Windows\System\QUdyzQK.exe
  C:\Windows\System\QUdyzQK.exe
  2⤵
  PID:12804
- C:\Windows\System\XgiZQAf.exe
  C:\Windows\System\XgiZQAf.exe
  2⤵
  PID:12828
- C:\Windows\System\uJtrjqe.exe
  C:\Windows\System\uJtrjqe.exe
  2⤵
  PID:12912
- C:\Windows\System\wWJKBvX.exe
  C:\Windows\System\wWJKBvX.exe
  2⤵
  PID:12868
- C:\Windows\System\XrUjrHj.exe
  C:\Windows\System\XrUjrHj.exe
  2⤵
  PID:12848
- C:\Windows\System\enIaOeP.exe
  C:\Windows\System\enIaOeP.exe
  2⤵
  PID:12752
- C:\Windows\System\vVqfcQl.exe
  C:\Windows\System\vVqfcQl.exe
  2⤵
  PID:12708
- C:\Windows\System\RwxLWXc.exe
  C:\Windows\System\RwxLWXc.exe
  2⤵
  PID:12672
- C:\Windows\System\DwkhoHb.exe
  C:\Windows\System\DwkhoHb.exe
  2⤵
  PID:12636
- C:\Windows\System\RLsDRVf.exe
  C:\Windows\System\RLsDRVf.exe
  2⤵
  PID:12604
- C:\Windows\System\cAxBiya.exe
  C:\Windows\System\cAxBiya.exe
  2⤵
  PID:12564
- C:\Windows\System\FSHRNuL.exe
  C:\Windows\System\FSHRNuL.exe
  2⤵
  PID:12532
- C:\Windows\System\BeDbnId.exe
  C:\Windows\System\BeDbnId.exe
  2⤵
  PID:12492
- C:\Windows\System\exauOtu.exe
  C:\Windows\System\exauOtu.exe
  2⤵
  PID:12436
- C:\Windows\System\vEWuSLc.exe
  C:\Windows\System\vEWuSLc.exe
  2⤵
  PID:12372
- C:\Windows\System\CKbZiuu.exe
  C:\Windows\System\CKbZiuu.exe
  2⤵
  PID:12324
- C:\Windows\System\hGBJrDx.exe
  C:\Windows\System\hGBJrDx.exe
  2⤵
  PID:10124
- C:\Windows\System\UNDDbsz.exe
  C:\Windows\System\UNDDbsz.exe
  2⤵
  PID:8624
- C:\Windows\System\JTRJyns.exe
  C:\Windows\System\JTRJyns.exe
  2⤵
  PID:12064
- C:\Windows\System\CEMUJPv.exe
  C:\Windows\System\CEMUJPv.exe
  2⤵
  PID:11936
- C:\Windows\System\jRHBWBO.exe
  C:\Windows\System\jRHBWBO.exe
  2⤵
  PID:11864
- C:\Windows\System\MHWQrJU.exe
  C:\Windows\System\MHWQrJU.exe
  2⤵
  PID:11816
- C:\Windows\System\wCuyiSq.exe
  C:\Windows\System\wCuyiSq.exe
  2⤵
  PID:11736
- C:\Windows\System\FShrGNY.exe
  C:\Windows\System\FShrGNY.exe
  2⤵
  PID:11664
- C:\Windows\System\hCaUStx.exe
  C:\Windows\System\hCaUStx.exe
  2⤵
  PID:13304
- C:\Windows\System\GnNHpqT.exe
  C:\Windows\System\GnNHpqT.exe
  2⤵
  PID:4464
- C:\Windows\System\mZfnVuY.exe
  C:\Windows\System\mZfnVuY.exe
  2⤵
  PID:13184
- C:\Windows\System\OZPimhd.exe
  C:\Windows\System\OZPimhd.exe
  2⤵
  PID:13252
- C:\Windows\System\bnkstLj.exe
  C:\Windows\System\bnkstLj.exe
  2⤵
  PID:13268
- C:\Windows\System\SJgncty.exe
  C:\Windows\System\SJgncty.exe
  2⤵
  PID:13296
- C:\Windows\System\kSzDulZ.exe
  C:\Windows\System\kSzDulZ.exe
  2⤵
  PID:10432
- C:\Windows\System\yzwXMgO.exe
  C:\Windows\System\yzwXMgO.exe
  2⤵
  PID:10220
- C:\Windows\System\zkEYZXo.exe
  C:\Windows\System\zkEYZXo.exe
  2⤵
  PID:9360
- C:\Windows\System\dCYzMYk.exe
  C:\Windows\System\dCYzMYk.exe
  2⤵
  PID:9496
- C:\Windows\System\RmyMQYM.exe
  C:\Windows\System\RmyMQYM.exe
  2⤵
  PID:13232
- C:\Windows\System\jXUtUSX.exe
  C:\Windows\System\jXUtUSX.exe
  2⤵
  PID:13224
- C:\Windows\System\JwIDKmv.exe
  C:\Windows\System\JwIDKmv.exe
  2⤵
  PID:8936
- C:\Windows\System\KLsxhOd.exe
  C:\Windows\System\KLsxhOd.exe
  2⤵
  PID:11312
- C:\Windows\System\RAbejqT.exe
  C:\Windows\System\RAbejqT.exe
  2⤵
  PID:9172
- C:\Windows\System\VflWPyk.exe
  C:\Windows\System\VflWPyk.exe
  2⤵
  PID:12664
- C:\Windows\System\ppxqeRy.exe
  C:\Windows\System\ppxqeRy.exe
  2⤵
  PID:10716
- C:\Windows\System\ojDOtKP.exe
  C:\Windows\System\ojDOtKP.exe
  2⤵
  PID:9604
- C:\Windows\System\YvoTbbq.exe
  C:\Windows\System\YvoTbbq.exe
  2⤵
  PID:10880
- C:\Windows\System\CGWkzna.exe
  C:\Windows\System\CGWkzna.exe
  2⤵
  PID:13040
- C:\Windows\System\jhRicPQ.exe
  C:\Windows\System\jhRicPQ.exe
  2⤵
  PID:11576
- C:\Windows\System\Hhckpsn.exe
  C:\Windows\System\Hhckpsn.exe
  2⤵
  PID:7244
- C:\Windows\System\usvFxNX.exe
  C:\Windows\System\usvFxNX.exe
  2⤵
  PID:12408
- C:\Windows\System\ojZpGvG.exe
  C:\Windows\System\ojZpGvG.exe
  2⤵
  PID:1972
- C:\Windows\System\dqEPdiH.exe
  C:\Windows\System\dqEPdiH.exe
  2⤵
  PID:12092
- C:\Windows\System\FfDVJyP.exe
  C:\Windows\System\FfDVJyP.exe
  2⤵
  PID:9288
- C:\Windows\System\xjlyHnk.exe
  C:\Windows\System\xjlyHnk.exe
  2⤵
  PID:12760
- C:\Windows\System\zTciIIp.exe
  C:\Windows\System\zTciIIp.exe
  2⤵
  PID:11680
- C:\Windows\System\ZKGRWWy.exe
  C:\Windows\System\ZKGRWWy.exe
  2⤵
  PID:10140
- C:\Windows\System\lXcilFU.exe
  C:\Windows\System\lXcilFU.exe
  2⤵
  PID:12592
- C:\Windows\System\ENBLEpv.exe
  C:\Windows\System\ENBLEpv.exe
  2⤵
  PID:2432
- C:\Windows\System\PYwKvfg.exe
  C:\Windows\System\PYwKvfg.exe
  2⤵
  PID:12880
- C:\Windows\System\rWBcCiZ.exe
  C:\Windows\System\rWBcCiZ.exe
  2⤵
  PID:13264
- C:\Windows\System\ziJfZoj.exe
  C:\Windows\System\ziJfZoj.exe
  2⤵
  PID:3376
- C:\Windows\System\FlUdDsg.exe
  C:\Windows\System\FlUdDsg.exe
  2⤵
  PID:13248
- C:\Windows\System\hCNwICz.exe
  C:\Windows\System\hCNwICz.exe
  2⤵
  PID:13152
- C:\Windows\System\RXuRsFQ.exe
  C:\Windows\System\RXuRsFQ.exe
  2⤵
  PID:12652
- C:\Windows\System\fStoXKf.exe
  C:\Windows\System\fStoXKf.exe
  2⤵
  PID:12624
- C:\Windows\System\qHhjWoX.exe
  C:\Windows\System\qHhjWoX.exe
  2⤵
  PID:12352
- C:\Windows\System\isEYFSx.exe
  C:\Windows\System\isEYFSx.exe
  2⤵
  PID:10804
- C:\Windows\System\SkPVUVX.exe
  C:\Windows\System\SkPVUVX.exe
  2⤵
  PID:9564
- C:\Windows\System\GtGSzsA.exe
  C:\Windows\System\GtGSzsA.exe
  2⤵
  PID:11432
- C:\Windows\System\IUReHiQ.exe
  C:\Windows\System\IUReHiQ.exe
  2⤵
  PID:13108
- C:\Windows\System\viETvOd.exe
  C:\Windows\System\viETvOd.exe
  2⤵
  PID:12884
- C:\Windows\System\ZXrBKhw.exe
  C:\Windows\System\ZXrBKhw.exe
  2⤵
  PID:11860
- C:\Windows\System\kCXowBg.exe
  C:\Windows\System\kCXowBg.exe
  2⤵
  PID:11308
- C:\Windows\System\KbSCrjg.exe
  C:\Windows\System\KbSCrjg.exe
  2⤵
  PID:13104
- C:\Windows\System\PlXMxtA.exe
  C:\Windows\System\PlXMxtA.exe
  2⤵
  PID:12608
- C:\Windows\System\IXiwWCO.exe
  C:\Windows\System\IXiwWCO.exe
  2⤵
  PID:12612
- C:\Windows\System\EZtcUXs.exe
  C:\Windows\System\EZtcUXs.exe
  2⤵
  PID:11752
- C:\Windows\System\xMSYAwt.exe
  C:\Windows\System\xMSYAwt.exe
  2⤵
  PID:12792
- C:\Windows\System\ktjqOfr.exe
  C:\Windows\System\ktjqOfr.exe
  2⤵
  PID:11508
- C:\Windows\System\jBhoeMb.exe
  C:\Windows\System\jBhoeMb.exe
  2⤵
  PID:6288
- C:\Windows\System\fUMSZpd.exe
  C:\Windows\System\fUMSZpd.exe
  2⤵
  PID:12940
- C:\Windows\System\JkhcQUS.exe
  C:\Windows\System\JkhcQUS.exe
  2⤵
  PID:4968
- C:\Windows\System\qyXYlPY.exe
  C:\Windows\System\qyXYlPY.exe
  2⤵
  PID:6324
- C:\Windows\System\nWWKamp.exe
  C:\Windows\System\nWWKamp.exe
  2⤵
  PID:9164
- C:\Windows\System\XdUcRpJ.exe
  C:\Windows\System\XdUcRpJ.exe
  2⤵
  PID:13260
- C:\Windows\System\XSBbDvf.exe
  C:\Windows\System\XSBbDvf.exe
  2⤵
  PID:7336
- C:\Windows\System\uDKaqQm.exe
  C:\Windows\System\uDKaqQm.exe
  2⤵
  PID:2032
- C:\Windows\System\ZjpOkzU.exe
  C:\Windows\System\ZjpOkzU.exe
  2⤵
  PID:5136
- C:\Windows\System\hDPZzpe.exe
  C:\Windows\System\hDPZzpe.exe
  2⤵
  PID:4312
- C:\Windows\System\gNojdlS.exe
  C:\Windows\System\gNojdlS.exe
  2⤵
  PID:11988
- C:\Windows\System\vlRcEnm.exe
  C:\Windows\System\vlRcEnm.exe
  2⤵
  PID:10784
- C:\Windows\System\aSFcTmo.exe
  C:\Windows\System\aSFcTmo.exe
  2⤵
  PID:12796
- C:\Windows\System\CutUYGQ.exe
  C:\Windows\System\CutUYGQ.exe
  2⤵
  PID:12504
- C:\Windows\System\gbbvVPH.exe
  C:\Windows\System\gbbvVPH.exe
  2⤵
  PID:1916
- C:\Windows\System\mKhcGUF.exe
  C:\Windows\System\mKhcGUF.exe
  2⤵
  PID:4436
- C:\Windows\System\UTwnZkX.exe
  C:\Windows\System\UTwnZkX.exe
  2⤵
  PID:4292
- C:\Windows\System\wmqTREf.exe
  C:\Windows\System\wmqTREf.exe
  2⤵
  PID:10088
- C:\Windows\System\idDWWuX.exe
  C:\Windows\System\idDWWuX.exe
  2⤵
  PID:5472
- C:\Windows\System\PeeWtmZ.exe
  C:\Windows\System\PeeWtmZ.exe
  2⤵
  PID:5080
- C:\Windows\System\bGBITRX.exe
  C:\Windows\System\bGBITRX.exe
  2⤵
  PID:13328
- C:\Windows\System\wIGaokZ.exe
  C:\Windows\System\wIGaokZ.exe
  2⤵
  PID:13348
- C:\Windows\System\YcuyQIT.exe
  C:\Windows\System\YcuyQIT.exe
  2⤵
  PID:13372
- C:\Windows\System\nHdCzxi.exe
  C:\Windows\System\nHdCzxi.exe
  2⤵
  PID:13396
- C:\Windows\System\VWAoipm.exe
  C:\Windows\System\VWAoipm.exe
  2⤵
  PID:13412
- C:\Windows\System\KynSJxy.exe
  C:\Windows\System\KynSJxy.exe
  2⤵
  PID:13436
- C:\Windows\System\GfHPDXo.exe
  C:\Windows\System\GfHPDXo.exe
  2⤵
  PID:13596
- C:\Windows\System\YdWrmcf.exe
  C:\Windows\System\YdWrmcf.exe
  2⤵
  PID:13612
- C:\Windows\System\NWSGuzl.exe
  C:\Windows\System\NWSGuzl.exe
  2⤵
  PID:13392
- C:\Windows\System\jriqCre.exe
  C:\Windows\System\jriqCre.exe
  2⤵
  PID:13800
- C:\Windows\System\qyKqqtA.exe
  C:\Windows\System\qyKqqtA.exe
  2⤵
  PID:13640
- C:\Windows\System\dBNSCvx.exe
  C:\Windows\System\dBNSCvx.exe
  2⤵
  PID:13648
- C:\Windows\System\QZEtKhB.exe
  C:\Windows\System\QZEtKhB.exe
  2⤵
  PID:13840
- C:\Windows\System\aVhvKMk.exe
  C:\Windows\System\aVhvKMk.exe
  2⤵
  PID:13880
- C:\Windows\System\MAPrYLt.exe
  C:\Windows\System\MAPrYLt.exe
  2⤵
  PID:13920
- C:\Windows\System\fkhPlsR.exe
  C:\Windows\System\fkhPlsR.exe
  2⤵
  PID:4732
- C:\Windows\System\yHxSfll.exe
  C:\Windows\System\yHxSfll.exe
  2⤵
  PID:13984
- C:\Windows\System\StImnGV.exe
  C:\Windows\System\StImnGV.exe
  2⤵
  PID:4920
- C:\Windows\System\UnTAPkw.exe
  C:\Windows\System\UnTAPkw.exe
  2⤵
  PID:13480
- C:\Windows\System\SxKPVuF.exe
  C:\Windows\System\SxKPVuF.exe
  2⤵
  PID:13476
- C:\Windows\System\jqgGpcP.exe
  C:\Windows\System\jqgGpcP.exe
  2⤵
  PID:13536
- C:\Windows\System\YKVBgwB.exe
  C:\Windows\System\YKVBgwB.exe
  2⤵
  PID:13556
- C:\Windows\System\lKyHilw.exe
  C:\Windows\System\lKyHilw.exe
  2⤵
  PID:13552
- C:\Windows\System\YFyDNQF.exe
  C:\Windows\System\YFyDNQF.exe
  2⤵
  PID:13764
- C:\Windows\System\wctSUYg.exe
  C:\Windows\System\wctSUYg.exe
  2⤵
  PID:13748
- C:\Windows\System\eJWUMng.exe
  C:\Windows\System\eJWUMng.exe
  2⤵
  PID:3304
- C:\Windows\System\hzuOUdd.exe
  C:\Windows\System\hzuOUdd.exe
  2⤵
  PID:13824
- C:\Windows\System\QONeEGT.exe
  C:\Windows\System\QONeEGT.exe
  2⤵
  PID:8012
- C:\Windows\System\qhKLKoy.exe
  C:\Windows\System\qhKLKoy.exe
  2⤵
  PID:13896
- C:\Windows\System\RBZlLzl.exe
  C:\Windows\System\RBZlLzl.exe
  2⤵
  PID:13936
- C:\Windows\System\dPITMOu.exe
  C:\Windows\System\dPITMOu.exe
  2⤵
  PID:13948
- C:\Windows\System\hWWJtdm.exe
  C:\Windows\System\hWWJtdm.exe
  2⤵
  PID:14128
- C:\Windows\System\BAhAKpT.exe
  C:\Windows\System\BAhAKpT.exe
  2⤵
  PID:14288
- C:\Windows\System\zWToMTL.exe
  C:\Windows\System\zWToMTL.exe
  2⤵
  PID:3132
- C:\Windows\System\rFwTbxY.exe
  C:\Windows\System\rFwTbxY.exe
  2⤵
  PID:14164
- C:\Windows\System\qUMRrss.exe
  C:\Windows\System\qUMRrss.exe
  2⤵
  PID:14200
- C:\Windows\System\QwJkDzc.exe
  C:\Windows\System\QwJkDzc.exe
  2⤵
  PID:14252
- C:\Windows\System\WgEXzwl.exe
  C:\Windows\System\WgEXzwl.exe
  2⤵
  PID:4236
- C:\Windows\System\oxFLzzx.exe
  C:\Windows\System\oxFLzzx.exe
  2⤵
  PID:13356
- C:\Windows\System\iKeUfXL.exe
  C:\Windows\System\iKeUfXL.exe
  2⤵
  PID:13360
- C:\Windows\System\HZFnUoH.exe
  C:\Windows\System\HZFnUoH.exe
  2⤵
  PID:3172
- C:\Windows\System\PmIdrZD.exe
  C:\Windows\System\PmIdrZD.exe
  2⤵
  PID:13784
- C:\Windows\System\kZgGLVP.exe
  C:\Windows\System\kZgGLVP.exe
  2⤵
  PID:13820
- C:\Windows\System\FJhjJWM.exe
  C:\Windows\System\FJhjJWM.exe
  2⤵
  PID:4720
- C:\Windows\System\arJmCzg.exe
  C:\Windows\System\arJmCzg.exe
  2⤵
  PID:13960
- C:\Windows\System\nXjqzAh.exe
  C:\Windows\System\nXjqzAh.exe
  2⤵
  PID:5208
- C:\Windows\System\NOEfEmV.exe
  C:\Windows\System\NOEfEmV.exe
  2⤵
  PID:14064
- C:\Windows\System\kEksZXq.exe
  C:\Windows\System\kEksZXq.exe
  2⤵
  PID:13608
- C:\Windows\System\CtlxorU.exe
  C:\Windows\System\CtlxorU.exe
  2⤵
  PID:5528
- C:\Windows\System\eIRFRWJ.exe
  C:\Windows\System\eIRFRWJ.exe
  2⤵
  PID:2216
- C:\Windows\System\ZHhajlb.exe
  C:\Windows\System\ZHhajlb.exe
  2⤵
  PID:5668
- C:\Windows\System\bdBkIJc.exe
  C:\Windows\System\bdBkIJc.exe
  2⤵
  PID:2192
- C:\Windows\System\LvCDLqz.exe
  C:\Windows\System\LvCDLqz.exe
  2⤵
  PID:5832
- C:\Windows\System\yVcDMmu.exe
  C:\Windows\System\yVcDMmu.exe
  2⤵
  PID:14180
- C:\Windows\System\QdBQENm.exe
  C:\Windows\System\QdBQENm.exe
  2⤵
  PID:2720
- C:\Windows\System\cgFoFdK.exe
  C:\Windows\System\cgFoFdK.exe
  2⤵
  PID:5252
- C:\Windows\System\edoVXKx.exe
  C:\Windows\System\edoVXKx.exe
  2⤵
  PID:14292
- C:\Windows\System\MOPzmaj.exe
  C:\Windows\System\MOPzmaj.exe
  2⤵
  PID:6260
- C:\Windows\System\lPDgdHa.exe
  C:\Windows\System\lPDgdHa.exe
  2⤵
  PID:14016
- C:\Windows\System\FqXgzdF.exe
  C:\Windows\System\FqXgzdF.exe
  2⤵
  PID:6084
- C:\Windows\System\MwFzDee.exe
  C:\Windows\System\MwFzDee.exe
  2⤵
  PID:14044
- C:\Windows\System\TbgLjUQ.exe
  C:\Windows\System\TbgLjUQ.exe
  2⤵
  PID:536
- C:\Windows\System\HXTPQfZ.exe
  C:\Windows\System\HXTPQfZ.exe
  2⤵
  PID:13696
- C:\Windows\System\cpsBhNZ.exe
  C:\Windows\System\cpsBhNZ.exe
  2⤵
  PID:6928
- C:\Windows\System\zodVNUr.exe
  C:\Windows\System\zodVNUr.exe
  2⤵
  PID:13796
- C:\Windows\System\xdqKpRJ.exe
  C:\Windows\System\xdqKpRJ.exe
  2⤵
  PID:6564
- C:\Windows\System\hkGUsQV.exe
  C:\Windows\System\hkGUsQV.exe
  2⤵
  PID:6608
- C:\Windows\System\tEclAtU.exe
  C:\Windows\System\tEclAtU.exe
  2⤵
  PID:3252
- C:\Windows\System\LLNHnyI.exe
  C:\Windows\System\LLNHnyI.exe
  2⤵
  PID:4332
- C:\Windows\System\zDeFHyd.exe
  C:\Windows\System\zDeFHyd.exe
  2⤵
  PID:5144
- C:\Windows\System\VqYFqCY.exe
  C:\Windows\System\VqYFqCY.exe
  2⤵
  PID:13944
- C:\Windows\System\SWPStsA.exe
  C:\Windows\System\SWPStsA.exe
  2⤵
  PID:13972
- C:\Windows\System\AWviQwe.exe
  C:\Windows\System\AWviQwe.exe
  2⤵
  PID:5940
- C:\Windows\System\yFardBJ.exe
  C:\Windows\System\yFardBJ.exe
  2⤵
  PID:13684
- C:\Windows\System\igefEwe.exe
  C:\Windows\System\igefEwe.exe
  2⤵
  PID:5564
- C:\Windows\System\qUhVPjE.exe
  C:\Windows\System\qUhVPjE.exe
  2⤵
  PID:6988
- C:\Windows\System\tKsNkXK.exe
  C:\Windows\System\tKsNkXK.exe
  2⤵
  PID:14048
- C:\Windows\System\poMGZuT.exe
  C:\Windows\System\poMGZuT.exe
  2⤵
  PID:5792
- C:\Windows\System\QJKDlAA.exe
  C:\Windows\System\QJKDlAA.exe
  2⤵
  PID:5952
- C:\Windows\System\NNHBCYP.exe
  C:\Windows\System\NNHBCYP.exe
  2⤵
  PID:5972
- C:\Windows\System\FVYzrVj.exe
  C:\Windows\System\FVYzrVj.exe
  2⤵
  PID:6992
- C:\Windows\System\yAzAzcY.exe
  C:\Windows\System\yAzAzcY.exe
  2⤵
  PID:14136
- C:\Windows\System\CdJdtxa.exe
  C:\Windows\System\CdJdtxa.exe
  2⤵
  PID:13836
- C:\Windows\System\jIrupiP.exe
  C:\Windows\System\jIrupiP.exe
  2⤵
  PID:7124
- C:\Windows\System\IRUXJtW.exe
  C:\Windows\System\IRUXJtW.exe
  2⤵
  PID:640
- C:\Windows\System\wprwBLk.exe
  C:\Windows\System\wprwBLk.exe
  2⤵
  PID:14280
- C:\Windows\System\XzmwjTM.exe
  C:\Windows\System\XzmwjTM.exe
  2⤵
  PID:1692
- C:\Windows\System\srhAmOv.exe
  C:\Windows\System\srhAmOv.exe
  2⤵
  PID:5404
- C:\Windows\System\amSJzGO.exe
  C:\Windows\System\amSJzGO.exe
  2⤵
  PID:14184
- C:\Windows\System\fyVeSJb.exe
  C:\Windows\System\fyVeSJb.exe
  2⤵
  PID:14308
- C:\Windows\System\feZrPnC.exe
  C:\Windows\System\feZrPnC.exe
  2⤵
  PID:7000
- C:\Windows\System\IWhDxJU.exe
  C:\Windows\System\IWhDxJU.exe
  2⤵
  PID:6996
- C:\Windows\System\NEWFfab.exe
  C:\Windows\System\NEWFfab.exe
  2⤵
  PID:5480
- C:\Windows\System\WmuAWSg.exe
  C:\Windows\System\WmuAWSg.exe
  2⤵
  PID:6232
- C:\Windows\System\HfXCZCg.exe
  C:\Windows\System\HfXCZCg.exe
  2⤵
  PID:6364
- C:\Windows\System\kdhUAHd.exe
  C:\Windows\System\kdhUAHd.exe
  2⤵
  PID:6012
- C:\Windows\System\MmOaFJL.exe
  C:\Windows\System\MmOaFJL.exe
  2⤵
  PID:2236
- C:\Windows\System\XSDrQxI.exe
  C:\Windows\System\XSDrQxI.exe
  2⤵
  PID:6032
- C:\Windows\System\AMSgDCr.exe
  C:\Windows\System\AMSgDCr.exe
  2⤵
  PID:5908
- C:\Windows\System\zelHFvQ.exe
  C:\Windows\System\zelHFvQ.exe
  2⤵
  PID:5248
- C:\Windows\System\KFdNnmW.exe
  C:\Windows\System\KFdNnmW.exe
  2⤵
  PID:6488
- C:\Windows\System\bfKNdkF.exe
  C:\Windows\System\bfKNdkF.exe
  2⤵
  PID:3816
- C:\Windows\System\wHmCBvJ.exe
  C:\Windows\System\wHmCBvJ.exe
  2⤵
  PID:6740
- C:\Windows\System\vtQAETv.exe
  C:\Windows\System\vtQAETv.exe
  2⤵
  PID:6444
- C:\Windows\System\RFTJEQW.exe
  C:\Windows\System\RFTJEQW.exe
  2⤵
  PID:5516
- C:\Windows\System\rWYjUam.exe
  C:\Windows\System\rWYjUam.exe
  2⤵
  PID:6512
- C:\Windows\System\HxqxgJe.exe
  C:\Windows\System\HxqxgJe.exe
  2⤵
  PID:6692
- C:\Windows\System\DSGHnWg.exe
  C:\Windows\System\DSGHnWg.exe
  2⤵
  PID:5736
- C:\Windows\System\VjorbLG.exe
  C:\Windows\System\VjorbLG.exe
  2⤵
  PID:5008
- C:\Windows\System\dlPbxsQ.exe
  C:\Windows\System\dlPbxsQ.exe
  2⤵
  PID:13532
- C:\Windows\System\ceHHlKB.exe
  C:\Windows\System\ceHHlKB.exe
  2⤵
  PID:5024
- C:\Windows\System\UKfvwEY.exe
  C:\Windows\System\UKfvwEY.exe
  2⤵
  PID:7040
- C:\Windows\System\aydLOTJ.exe
  C:\Windows\System\aydLOTJ.exe
  2⤵
  PID:5868
- C:\Windows\System\HVpOdSp.exe
  C:\Windows\System\HVpOdSp.exe
  2⤵
  PID:7092
- C:\Windows\System\uzuptmB.exe
  C:\Windows\System\uzuptmB.exe
  2⤵
  PID:3680
- C:\Windows\System\UOQVsuM.exe
  C:\Windows\System\UOQVsuM.exe
  2⤵
  PID:7344
- C:\Windows\System\vXWIvIM.exe
  C:\Windows\System\vXWIvIM.exe
  2⤵
  PID:7224
- C:\Windows\System\toiiLWp.exe
  C:\Windows\System\toiiLWp.exe
  2⤵
  PID:7360
- C:\Windows\System\kiQfEYj.exe
  C:\Windows\System\kiQfEYj.exe
  2⤵
  PID:5028
- C:\Windows\System\cDAZztR.exe
  C:\Windows\System\cDAZztR.exe
  2⤵
  PID:5652
- C:\Windows\System\NJiAgfG.exe
  C:\Windows\System\NJiAgfG.exe
  2⤵
  PID:1444
- C:\Windows\System\qaqWiDD.exe
  C:\Windows\System\qaqWiDD.exe
  2⤵
  PID:7408
- C:\Windows\System\nfuZlbx.exe
  C:\Windows\System\nfuZlbx.exe
  2⤵
  PID:5140
- C:\Windows\System\TrjMgdi.exe
  C:\Windows\System\TrjMgdi.exe
  2⤵
  PID:13364
- C:\Windows\System\pshtpzh.exe
  C:\Windows\System\pshtpzh.exe
  2⤵
  PID:7728
- C:\Windows\System\GrLQdPO.exe
  C:\Windows\System\GrLQdPO.exe
  2⤵
  PID:7836
- C:\Windows\System\VVYiKmd.exe
  C:\Windows\System\VVYiKmd.exe
  2⤵
  PID:5932
- C:\Windows\System\IzRObDT.exe
  C:\Windows\System\IzRObDT.exe
  2⤵
  PID:7768
- C:\Windows\System\JbpinJX.exe
  C:\Windows\System\JbpinJX.exe
  2⤵
  PID:6156
- C:\Windows\System\XyhHsgm.exe
  C:\Windows\System\XyhHsgm.exe
  2⤵
  PID:13320
- C:\Windows\System\omCnbVq.exe
  C:\Windows\System\omCnbVq.exe
  2⤵
  PID:7044
- C:\Windows\System\rVPkojq.exe
  C:\Windows\System\rVPkojq.exe
  2⤵
  PID:11720
- C:\Windows\System\WIzqddm.exe
  C:\Windows\System\WIzqddm.exe
  2⤵
  PID:5912
- C:\Windows\System\kIPDJkG.exe
  C:\Windows\System\kIPDJkG.exe
  2⤵
  PID:7568
- C:\Windows\System\LonQTMY.exe
  C:\Windows\System\LonQTMY.exe
  2⤵
  PID:5164
- C:\Windows\System\SjFGfCF.exe
  C:\Windows\System\SjFGfCF.exe
  2⤵
  PID:6524
- C:\Windows\System\eAChWYj.exe
  C:\Windows\System\eAChWYj.exe
  2⤵
  PID:7228
- C:\Windows\System\bYHxYpy.exe
  C:\Windows\System\bYHxYpy.exe
  2⤵
  PID:4740
- C:\Windows\System\pCgSffS.exe
  C:\Windows\System\pCgSffS.exe
  2⤵
  PID:6380
- C:\Windows\System\fydYZwE.exe
  C:\Windows\System\fydYZwE.exe
  2⤵
  PID:8308
- C:\Windows\System\wnbCZCJ.exe
  C:\Windows\System\wnbCZCJ.exe
  2⤵
  PID:1268
- C:\Windows\System\AhOEyfF.exe
  C:\Windows\System\AhOEyfF.exe
  2⤵
  PID:5620
- C:\Windows\System\wLTjLAm.exe
  C:\Windows\System\wLTjLAm.exe
  2⤵
  PID:8880
- C:\Windows\System\PDvaoRU.exe
  C:\Windows\System\PDvaoRU.exe
  2⤵
  PID:8904
- C:\Windows\System\APnENiR.exe
  C:\Windows\System\APnENiR.exe
  2⤵
  PID:9100
- C:\Windows\System\yOXpEhg.exe
  C:\Windows\System\yOXpEhg.exe
  2⤵
  PID:5824
- C:\Windows\System\wsoGvLA.exe
  C:\Windows\System\wsoGvLA.exe
  2⤵
  PID:6628
- C:\Windows\System\gfIsabJ.exe
  C:\Windows\System\gfIsabJ.exe
  2⤵
  PID:5244
- C:\Windows\System\ZsaqHzy.exe
  C:\Windows\System\ZsaqHzy.exe
  2⤵
  PID:8992
- C:\Windows\System\wSOfFlJ.exe
  C:\Windows\System\wSOfFlJ.exe
  2⤵
  PID:7292
- C:\Windows\System\tIAOLsJ.exe
  C:\Windows\System\tIAOLsJ.exe
  2⤵
  PID:9184
- C:\Windows\System\DcccdVk.exe
  C:\Windows\System\DcccdVk.exe
  2⤵
  PID:6140
- C:\Windows\System\aFFOROZ.exe
  C:\Windows\System\aFFOROZ.exe
  2⤵
  PID:5016
- C:\Windows\System\aZWGQFJ.exe
  C:\Windows\System\aZWGQFJ.exe
  2⤵
  PID:4092
- C:\Windows\System\EvwTKam.exe
  C:\Windows\System\EvwTKam.exe
  2⤵
  PID:7392
- C:\Windows\System\QvAuaCi.exe
  C:\Windows\System\QvAuaCi.exe
  2⤵
  PID:9304
- C:\Windows\System\OJGOlNi.exe
  C:\Windows\System\OJGOlNi.exe
  2⤵
  PID:7648
- C:\Windows\System\TSnjrmZ.exe
  C:\Windows\System\TSnjrmZ.exe
  2⤵
  PID:7456
- C:\Windows\System\GsVptjN.exe
  C:\Windows\System\GsVptjN.exe
  2⤵
  PID:9324
- C:\Windows\System\hvHDkRW.exe
  C:\Windows\System\hvHDkRW.exe
  2⤵
  PID:8540
- C:\Windows\System\NlypkTj.exe
  C:\Windows\System\NlypkTj.exe
  2⤵
  PID:14192
- C:\Windows\System\zfBLLut.exe
  C:\Windows\System\zfBLLut.exe
  2⤵
  PID:7020
- C:\Windows\System\YqVMNzb.exe
  C:\Windows\System\YqVMNzb.exe
  2⤵
  PID:9612
- C:\Windows\System\KRRrPdf.exe
  C:\Windows\System\KRRrPdf.exe
  2⤵
  PID:9472
- C:\Windows\System\egVujOH.exe
  C:\Windows\System\egVujOH.exe
  2⤵
  PID:10200
- C:\Windows\System\TqreIJk.exe
  C:\Windows\System\TqreIJk.exe
  2⤵
  PID:9188
- C:\Windows\System\EepzGth.exe
  C:\Windows\System\EepzGth.exe
  2⤵
  PID:7944
- C:\Windows\System\DbSUuQW.exe
  C:\Windows\System\DbSUuQW.exe
  2⤵
  PID:13528
- C:\Windows\System\oGINLvl.exe
  C:\Windows\System\oGINLvl.exe
  2⤵
  PID:13620
- C:\Windows\System\pDPuEdJ.exe
  C:\Windows\System\pDPuEdJ.exe
  2⤵
  PID:10080
- C:\Windows\System\usAojiL.exe
  C:\Windows\System\usAojiL.exe
  2⤵
  PID:10536
- C:\Windows\System\KoZgMFZ.exe
  C:\Windows\System\KoZgMFZ.exe
  2⤵
  PID:6124
- C:\Windows\System\YOrUwYf.exe
  C:\Windows\System\YOrUwYf.exe
  2⤵
  PID:4580
- C:\Windows\System\GVaXQRW.exe
  C:\Windows\System\GVaXQRW.exe
  2⤵
  PID:4540
- C:\Windows\System\IztMUFs.exe
  C:\Windows\System\IztMUFs.exe
  2⤵
  PID:14224
- C:\Windows\System\YTpeZeX.exe
  C:\Windows\System\YTpeZeX.exe
  2⤵
  PID:9240
- C:\Windows\System\zAjartG.exe
  C:\Windows\System\zAjartG.exe
  2⤵
  PID:8832
- C:\Windows\System\qzwthlN.exe
  C:\Windows\System\qzwthlN.exe
  2⤵
  PID:6892
- C:\Windows\System\eZbUJEG.exe
  C:\Windows\System\eZbUJEG.exe
  2⤵
  PID:8024
- C:\Windows\System\djRwUbk.exe
  C:\Windows\System\djRwUbk.exe
  2⤵
  PID:6272
- C:\Windows\System\dVnhAuH.exe
  C:\Windows\System\dVnhAuH.exe
  2⤵
  PID:6644
- C:\Windows\System\MuBQcTn.exe
  C:\Windows\System\MuBQcTn.exe
  2⤵
  PID:6060
- C:\Windows\System\OQakQuU.exe
  C:\Windows\System\OQakQuU.exe
  2⤵
  PID:11772
- C:\Windows\System\nlLmSyb.exe
  C:\Windows\System\nlLmSyb.exe
  2⤵
  PID:11112
- C:\Windows\System\JmGWPOz.exe
  C:\Windows\System\JmGWPOz.exe
  2⤵
  PID:9556
- C:\Windows\System\RrBOqLM.exe
  C:\Windows\System\RrBOqLM.exe
  2⤵
  PID:14020
- C:\Windows\System\cCxYtEN.exe
  C:\Windows\System\cCxYtEN.exe
  2⤵
  PID:10000
- C:\Windows\System\GEguMvk.exe
  C:\Windows\System\GEguMvk.exe
  2⤵
  PID:8412
- C:\Windows\System\eTRaMgR.exe
  C:\Windows\System\eTRaMgR.exe
  2⤵
  PID:2444
- C:\Windows\System\hCnAtXB.exe
  C:\Windows\System\hCnAtXB.exe
  2⤵
  PID:11284
- C:\Windows\System\RALDwrF.exe
  C:\Windows\System\RALDwrF.exe
  2⤵
  PID:4560
- C:\Windows\System\zFNCZZb.exe
  C:\Windows\System\zFNCZZb.exe
  2⤵
  PID:11484
- C:\Windows\System\NdEXpZH.exe
  C:\Windows\System\NdEXpZH.exe
  2⤵
  PID:8808
- C:\Windows\System\nzmDfXM.exe
  C:\Windows\System\nzmDfXM.exe
  2⤵
  PID:8140
- C:\Windows\System\hDbRDiS.exe
  C:\Windows\System\hDbRDiS.exe
  2⤵
  PID:11868
- C:\Windows\System\mWPsDYY.exe
  C:\Windows\System\mWPsDYY.exe
  2⤵
  PID:12780
- C:\Windows\System\obidMNF.exe
  C:\Windows\System\obidMNF.exe
  2⤵
  PID:12072
- C:\Windows\System\roFElva.exe
  C:\Windows\System\roFElva.exe
  2⤵
  PID:3576
- C:\Windows\System\XgBzkHw.exe
  C:\Windows\System\XgBzkHw.exe
  2⤵
  PID:9736
- C:\Windows\System\WGDVRVY.exe
  C:\Windows\System\WGDVRVY.exe
  2⤵
  PID:5388
- C:\Windows\System\icoGbKD.exe
  C:\Windows\System\icoGbKD.exe
  2⤵
  PID:7712
- C:\Windows\System\CbXpljn.exe
  C:\Windows\System\CbXpljn.exe
  2⤵
  PID:8820
- C:\Windows\System\OvugauY.exe
  C:\Windows\System\OvugauY.exe
  2⤵
  PID:13080
- C:\Windows\System\sEvAiMZ.exe
  C:\Windows\System\sEvAiMZ.exe
  2⤵
  PID:11844
- C:\Windows\System\hsOKrJz.exe
  C:\Windows\System\hsOKrJz.exe
  2⤵
  PID:8940
- C:\Windows\System\aFPnTcW.exe
  C:\Windows\System\aFPnTcW.exe
  2⤵
  PID:10516
- C:\Windows\System\FqNxsOw.exe
  C:\Windows\System\FqNxsOw.exe
  2⤵
  PID:7072
- C:\Windows\System\bzEjPXC.exe
  C:\Windows\System\bzEjPXC.exe
  2⤵
  PID:13216
- C:\Windows\System\npIuexG.exe
  C:\Windows\System\npIuexG.exe
  2⤵
  PID:10236
- C:\Windows\System\kEsizJE.exe
  C:\Windows\System\kEsizJE.exe
  2⤵
  PID:8620
- C:\Windows\System\ClXCduM.exe
  C:\Windows\System\ClXCduM.exe
  2⤵
  PID:9900
- C:\Windows\System\nWKkTmb.exe
  C:\Windows\System\nWKkTmb.exe
  2⤵
  PID:10924
- C:\Windows\System\MmQRHWA.exe
  C:\Windows\System\MmQRHWA.exe
  2⤵
  PID:5884
- C:\Windows\System\GNQhKQc.exe
  C:\Windows\System\GNQhKQc.exe
  2⤵
  PID:10040
- C:\Windows\System\VftGHQS.exe
  C:\Windows\System\VftGHQS.exe
  2⤵
  PID:12192
- C:\Windows\System\qvolhcv.exe
  C:\Windows\System\qvolhcv.exe
  2⤵
  PID:7896
- C:\Windows\System\SdewGdf.exe
  C:\Windows\System\SdewGdf.exe
  2⤵
  PID:12496
- C:\Windows\System\WEJXFkQ.exe
  C:\Windows\System\WEJXFkQ.exe
  2⤵
  PID:12488
- C:\Windows\System\VfzWbVD.exe
  C:\Windows\System\VfzWbVD.exe
  2⤵
  PID:10328
- C:\Windows\System\aAEyllU.exe
  C:\Windows\System\aAEyllU.exe
  2⤵
  PID:5644
- C:\Windows\System\XpOoNkI.exe
  C:\Windows\System\XpOoNkI.exe
  2⤵
  PID:9760
- C:\Windows\System\fIVRBHg.exe
  C:\Windows\System\fIVRBHg.exe
  2⤵
  PID:1416
- C:\Windows\System\ClxXscT.exe
  C:\Windows\System\ClxXscT.exe
  2⤵
  PID:13488
- C:\Windows\System\eIGtJQJ.exe
  C:\Windows\System\eIGtJQJ.exe
  2⤵
  PID:13280
- C:\Windows\System\nEjVdQM.exe
  C:\Windows\System\nEjVdQM.exe
  2⤵
  PID:4832
- C:\Windows\System\xhtBNCS.exe
  C:\Windows\System\xhtBNCS.exe
  2⤵
  PID:9676
- C:\Windows\System\fOcZAUa.exe
  C:\Windows\System\fOcZAUa.exe
  2⤵
  PID:11092
- C:\Windows\System\RUPwUFr.exe
  C:\Windows\System\RUPwUFr.exe
  2⤵
  PID:13036
- C:\Windows\System\ijlfdCO.exe
  C:\Windows\System\ijlfdCO.exe
  2⤵
  PID:12644
- C:\Windows\System\LaRokPI.exe
  C:\Windows\System\LaRokPI.exe
  2⤵
  PID:9512
- C:\Windows\System\eVeJKCd.exe
  C:\Windows\System\eVeJKCd.exe
  2⤵
  PID:13148
- C:\Windows\System\GYVHhOC.exe
  C:\Windows\System\GYVHhOC.exe
  2⤵
  PID:9204
- C:\Windows\System\ooCrWJf.exe
  C:\Windows\System\ooCrWJf.exe
  2⤵
  PID:10216
- C:\Windows\System\sAXKjvM.exe
  C:\Windows\System\sAXKjvM.exe
  2⤵
  PID:4440
- C:\Windows\System\HGHTLfK.exe
  C:\Windows\System\HGHTLfK.exe
  2⤵
  PID:13084
- C:\Windows\System\uCzjNWZ.exe
  C:\Windows\System\uCzjNWZ.exe
  2⤵
  PID:10332
- C:\Windows\System\ZwOcrNO.exe
  C:\Windows\System\ZwOcrNO.exe
  2⤵
  PID:11940
- C:\Windows\System\KUlXMzV.exe
  C:\Windows\System\KUlXMzV.exe
  2⤵
  PID:12616
- C:\Windows\System\JwcTHCw.exe
  C:\Windows\System\JwcTHCw.exe
  2⤵
  PID:3640
- C:\Windows\System\OmAIeQl.exe
  C:\Windows\System\OmAIeQl.exe
  2⤵
  PID:11452
- C:\Windows\System\ROjzIys.exe
  C:\Windows\System\ROjzIys.exe
  2⤵
  PID:11764
- C:\Windows\System\OWUtsWx.exe
  C:\Windows\System\OWUtsWx.exe
  2⤵
  PID:3276
- C:\Windows\System\VKguWzl.exe
  C:\Windows\System\VKguWzl.exe
  2⤵
  PID:11340
- C:\Windows\System\wdNNKlk.exe
  C:\Windows\System\wdNNKlk.exe
  2⤵
  PID:8440
- C:\Windows\System\zerGyqc.exe
  C:\Windows\System\zerGyqc.exe
  2⤵
  PID:6556
- C:\Windows\System\qfUzBNz.exe
  C:\Windows\System\qfUzBNz.exe
  2⤵
  PID:11968
- C:\Windows\System\YflXLnp.exe
  C:\Windows\System\YflXLnp.exe
  2⤵
  PID:12800
- C:\Windows\System\VNrCuEj.exe
  C:\Windows\System\VNrCuEj.exe
  2⤵
  PID:14172
- C:\Windows\System\yMANZRn.exe
  C:\Windows\System\yMANZRn.exe
  2⤵
  PID:12700
- C:\Windows\System\ikhgoxm.exe
  C:\Windows\System\ikhgoxm.exe
  2⤵
  PID:7972
- C:\Windows\System\cDdAqKM.exe
  C:\Windows\System\cDdAqKM.exe
  2⤵
  PID:13124
- C:\Windows\System\PVkVPsF.exe
  C:\Windows\System\PVkVPsF.exe
  2⤵
  PID:4264
- C:\Windows\System\HAdjAqL.exe
  C:\Windows\System\HAdjAqL.exe
  2⤵
  PID:7432
- C:\Windows\System\fEWoREH.exe
  C:\Windows\System\fEWoREH.exe
  2⤵
  PID:12916
- C:\Windows\System\ljclwvV.exe
  C:\Windows\System\ljclwvV.exe
  2⤵
  PID:7684
- C:\Windows\System\JJyzFBB.exe
  C:\Windows\System\JJyzFBB.exe
  2⤵
  PID:9320
- C:\Windows\System\xxcTirQ.exe
  C:\Windows\System\xxcTirQ.exe
  2⤵
  PID:3532
- C:\Windows\System\fxKLVkB.exe
  C:\Windows\System\fxKLVkB.exe
  2⤵
  PID:8556
- C:\Windows\System\WapHAcr.exe
  C:\Windows\System\WapHAcr.exe
  2⤵
  PID:10120
- C:\Windows\System\ysqeNES.exe
  C:\Windows\System\ysqeNES.exe
  2⤵
  PID:9776
- C:\Windows\System\phsTFCX.exe
  C:\Windows\System\phsTFCX.exe
  2⤵
  PID:14144
- C:\Windows\System\aCfNSzz.exe
  C:\Windows\System\aCfNSzz.exe
  2⤵
  PID:11568
- C:\Windows\System\vzBwACw.exe
  C:\Windows\System\vzBwACw.exe
  2⤵
  PID:7048
- C:\Windows\System\VwWIhRm.exe
  C:\Windows\System\VwWIhRm.exe
  2⤵
  PID:4000
- C:\Windows\System\KjDEInc.exe
  C:\Windows\System\KjDEInc.exe
  2⤵
  PID:6284
- C:\Windows\System\luZqBMc.exe
  C:\Windows\System\luZqBMc.exe
  2⤵
  PID:10128
- C:\Windows\System\LOtfPyM.exe
  C:\Windows\System\LOtfPyM.exe
  2⤵
  PID:11984
- C:\Windows\System\DSrxuTy.exe
  C:\Windows\System\DSrxuTy.exe
  2⤵
  PID:10452
- C:\Windows\System\uyBaLBD.exe
  C:\Windows\System\uyBaLBD.exe
  2⤵
  PID:5916
- C:\Windows\System\IDhoSCg.exe
  C:\Windows\System\IDhoSCg.exe
  2⤵
  PID:9896
- C:\Windows\System\rSaxByq.exe
  C:\Windows\System\rSaxByq.exe
  2⤵
  PID:6752
- C:\Windows\System\PVNXjRn.exe
  C:\Windows\System\PVNXjRn.exe
  2⤵
  PID:10748
- C:\Windows\System\kEXyKbg.exe
  C:\Windows\System\kEXyKbg.exe
  2⤵
  PID:8684
- C:\Windows\System\GXcmCQR.exe
  C:\Windows\System\GXcmCQR.exe
  2⤵
  PID:12296
- C:\Windows\System\mNCCUBS.exe
  C:\Windows\System\mNCCUBS.exe
  2⤵
  PID:13852
- C:\Windows\System\SCyOEUR.exe
  C:\Windows\System\SCyOEUR.exe
  2⤵
  PID:4548
- C:\Windows\System\DCHfDKM.exe
  C:\Windows\System\DCHfDKM.exe
  2⤵
  PID:12596
- C:\Windows\System\gfnEksF.exe
  C:\Windows\System\gfnEksF.exe
  2⤵
  PID:13388
- C:\Windows\System\KKbcBmU.exe
  C:\Windows\System\KKbcBmU.exe
  2⤵
  PID:11592
- C:\Windows\System\HgnNWsf.exe
  C:\Windows\System\HgnNWsf.exe
  2⤵
  PID:13196
- C:\Windows\System\kRmEGKm.exe
  C:\Windows\System\kRmEGKm.exe
  2⤵
  PID:12768
- C:\Windows\System\msrGyqM.exe
  C:\Windows\System\msrGyqM.exe
  2⤵
  PID:12148
- C:\Windows\System\IWSpVNP.exe
  C:\Windows\System\IWSpVNP.exe
  2⤵
  PID:12264
- C:\Windows\System\ZmDUMnp.exe
  C:\Windows\System\ZmDUMnp.exe
  2⤵
  PID:7936
- C:\Windows\System\OjOllQz.exe
  C:\Windows\System\OjOllQz.exe
  2⤵
  PID:13484
- C:\Windows\System\KdyzwYN.exe
  C:\Windows\System\KdyzwYN.exe
  2⤵
  PID:7416
- C:\Windows\System\THriOHJ.exe
  C:\Windows\System\THriOHJ.exe
  2⤵
  PID:3428
- C:\Windows\System\tvhvkcn.exe
  C:\Windows\System\tvhvkcn.exe
  2⤵
  PID:12764
- C:\Windows\System\XknIOIQ.exe
  C:\Windows\System\XknIOIQ.exe
  2⤵
  PID:7876
- C:\Windows\System\QvLZaMM.exe
  C:\Windows\System\QvLZaMM.exe
  2⤵
  PID:10808
- C:\Windows\System\BdAhTvy.exe
  C:\Windows\System\BdAhTvy.exe
  2⤵
  PID:7052
- C:\Windows\System\eFGzAML.exe
  C:\Windows\System\eFGzAML.exe
  2⤵
  PID:7460
- C:\Windows\System\lsuLcPy.exe
  C:\Windows\System\lsuLcPy.exe
  2⤵
  PID:7928
- C:\Windows\System\dWzxecf.exe
  C:\Windows\System\dWzxecf.exe
  2⤵
  PID:6884
- C:\Windows\System\GBxhZyJ.exe
  C:\Windows\System\GBxhZyJ.exe
  2⤵
  PID:10164
- C:\Windows\System\FHfJxcU.exe
  C:\Windows\System\FHfJxcU.exe
  2⤵
  PID:4604
- C:\Windows\System\tyXakNK.exe
  C:\Windows\System\tyXakNK.exe
  2⤵
  PID:10588
- C:\Windows\System\xaeIZMP.exe
  C:\Windows\System\xaeIZMP.exe
  2⤵
  PID:5500
- C:\Windows\System\jGRdgxX.exe
  C:\Windows\System\jGRdgxX.exe
  2⤵
  PID:1936
- C:\Windows\System\rhGnAGa.exe
  C:\Windows\System\rhGnAGa.exe
  2⤵
  PID:984
- C:\Windows\System\pcJALET.exe
  C:\Windows\System\pcJALET.exe
  2⤵
  PID:12772
- C:\Windows\System\tulLaZj.exe
  C:\Windows\System\tulLaZj.exe
  2⤵
  PID:7792
- C:\Windows\System\oeaoduk.exe
  C:\Windows\System\oeaoduk.exe
  2⤵
  PID:4336
- C:\Windows\System\oYziRnN.exe
  C:\Windows\System\oYziRnN.exe
  2⤵
  PID:6136
- C:\Windows\System\hFqWPpq.exe
  C:\Windows\System\hFqWPpq.exe
  2⤵
  PID:8236
- C:\Windows\System\rlzvvym.exe
  C:\Windows\System\rlzvvym.exe
  2⤵
  PID:12132
- C:\Windows\System\TVtYsbb.exe
  C:\Windows\System\TVtYsbb.exe
  2⤵
  PID:8184
- C:\Windows\System\MnmbEXY.exe
  C:\Windows\System\MnmbEXY.exe
  2⤵
  PID:10524
- C:\Windows\System\rinClGs.exe
  C:\Windows\System\rinClGs.exe
  2⤵
  PID:10672
- C:\Windows\System\jKDAgTV.exe
  C:\Windows\System\jKDAgTV.exe
  2⤵
  PID:4568
- C:\Windows\System\XOjItTS.exe
  C:\Windows\System\XOjItTS.exe
  2⤵
  PID:10304
- C:\Windows\System\CASRQOR.exe
  C:\Windows\System\CASRQOR.exe
  2⤵
  PID:12860
- C:\Windows\System\hqgtTaQ.exe
  C:\Windows\System\hqgtTaQ.exe
  2⤵
  PID:2352
- C:\Windows\System\HGLYeGP.exe
  C:\Windows\System\HGLYeGP.exe
  2⤵
  PID:404
- C:\Windows\System\vfETIQc.exe
  C:\Windows\System\vfETIQc.exe
  2⤵
  PID:11172
- C:\Windows\System\AbyFBkP.exe
  C:\Windows\System\AbyFBkP.exe
  2⤵
  PID:2204
- C:\Windows\System\ewdgBQM.exe
  C:\Windows\System\ewdgBQM.exe
  2⤵
  PID:7576
- C:\Windows\System\PouoLqc.exe
  C:\Windows\System\PouoLqc.exe
  2⤵
  PID:12728
- C:\Windows\System\TzDRAZh.exe
  C:\Windows\System\TzDRAZh.exe
  2⤵
  PID:10488
- C:\Windows\System\CfzPGpC.exe
  C:\Windows\System\CfzPGpC.exe
  2⤵
  PID:12232
- C:\Windows\System\PZjMfYp.exe
  C:\Windows\System\PZjMfYp.exe
  2⤵
  PID:12420
- C:\Windows\System\wPfWiAy.exe
  C:\Windows\System\wPfWiAy.exe
  2⤵
  PID:4008
- C:\Windows\System\qMCpyPL.exe
  C:\Windows\System\qMCpyPL.exe
  2⤵
  PID:5568
- C:\Windows\System\IObubmY.exe
  C:\Windows\System\IObubmY.exe
  2⤵
  PID:9392
- C:\Windows\System\tteFOjP.exe
  C:\Windows\System\tteFOjP.exe
  2⤵
  PID:12716
- C:\Windows\System\kXRqUnf.exe
  C:\Windows\System\kXRqUnf.exe
  2⤵
  PID:11292
- C:\Windows\System\tIsjGDk.exe
  C:\Windows\System\tIsjGDk.exe
  2⤵
  PID:11116
- C:\Windows\System\zBtjCtF.exe
  C:\Windows\System\zBtjCtF.exe
  2⤵
  PID:8744
- C:\Windows\System\YoNwfPR.exe
  C:\Windows\System\YoNwfPR.exe
  2⤵
  PID:8208
- C:\Windows\System\CfotBst.exe
  C:\Windows\System\CfotBst.exe
  2⤵
  PID:14352
- C:\Windows\System\TbnVciK.exe
  C:\Windows\System\TbnVciK.exe
  2⤵
  PID:14384
- C:\Windows\System\nqisRYL.exe
  C:\Windows\System\nqisRYL.exe
  2⤵
  PID:14480
- C:\Windows\System\WwFCrBx.exe
  C:\Windows\System\WwFCrBx.exe
  2⤵
  PID:14516
- C:\Windows\System\MwiCSph.exe
  C:\Windows\System\MwiCSph.exe
  2⤵
  PID:14548
- C:\Windows\System\OeFukxg.exe
  C:\Windows\System\OeFukxg.exe
  2⤵
  PID:14576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 8532 -ip 8532
1⤵
PID:13248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 11936 -ip 11936
1⤵
PID:11752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rgopfgkj.rfc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHkkDMz.exe

Filesize
1.7MB

MD5
e175a26dc16d233ae5038ff22638fa5f

SHA1
d648723540818f1958a2f3b10a1a9619e15cd060

SHA256
904bcb7b14c736f3b35b89bbf9e12f8d65dea8bdb17b54a1bfeb1ffb67628e97

SHA512
a4b19be287ccc6ca3b695a50422c38b1294ff22c623313300f96acc5742e4480552965a365d09bceb3c1079f7dbe4b68459ccfb3868e82d749f9c0d8afacc02e

Download Submit
C:\Windows\System\AKcNEWy.exe

Filesize
1.7MB

MD5
bdbd63497b9844c2f4e28d3825f8b8b5

SHA1
17b7acba71e939e8e94aab3319c06bdd7586a728

SHA256
1963eaf3257a55ea932c16754ce649320cf9cdc6c3e24eb43d729405620ade5b

SHA512
fb97ca22c6d46405f2d048fbb46eafc46bf6991e541083f19b63c2b2e4eadc199054d777c5737932ef033d811585718510df6caf815598aeb5a91c04bad42a2f

Download Submit
C:\Windows\System\AvLvRhl.exe

Filesize
1.7MB

MD5
fca864e1449cac38b87e9c86b09424af

SHA1
3f0faae59eaec23a3ee8f52471e5c01deebf5552

SHA256
20447f13073b83239792d6bc87adc0aee8370565bb0179a2a61c5c63b4f48cf6

SHA512
886921fa258035f9b0bdad3d227eab655c894f163254a4de1093140e529e495e1ea6799934c0b7a7eae2b86ea3be32c6b0233012f7a7ff1487e669756a1c169f

Download Submit
C:\Windows\System\BApVnfA.exe

Filesize
1.7MB

MD5
31dbc9401f80f463d39d94aa7d71f5a2

SHA1
15171b807656e0e4e0117171f7762f3f8a428aaf

SHA256
262de88c1a69f8666869cc06ccc8c0cddae3e2bf5232d0a8ec4074f3025ca3f5

SHA512
860c773ce3a0fa795c4fb695605f118011b2b9e23c3e155989e9cf35fb50c03b37571f52294bb1cadda6ea65a3ef366be7a20b14aaa18827a99cb3451fec9342

Download Submit
C:\Windows\System\CVdfxUy.exe

Filesize
1.7MB

MD5
d6f80d0822a07739cdb0fb20ff15cf15

SHA1
84451f23512bfb88d8a310ccdbc52199007f12de

SHA256
84934378e85d5ec99104177f9201ce4144b4cf043d111846238204698d123873

SHA512
dcd65ab9f4aa5d75e6c5cb257677d9f3fd298950e38c174d9e47b26d05b76f064a722698cb2e3ec3b0ff3e80ce409a6de943c748aa6a128ff7274e3bf62d806d

Download Submit
C:\Windows\System\DnnNCLE.exe

Filesize
1.7MB

MD5
c52bcec8524dd59873bf2cdc2ef44e32

SHA1
c5e773980c831c0d7e913f718edf05ceb0be49f9

SHA256
9b3a87ca70f707bc7679d280293f061d6bd90cdf8de76a98a8a09d3f0c718a52

SHA512
df85cc7f859a79fd2f893ae6f15d4104fab1ec0d26fed670238a8f6ec36f336ef377a06b82f08838803b91622bef88d3a69989ea86a751dbb7dc32c302639b45

Download Submit
C:\Windows\System\Fhdbova.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\JrucNEK.exe

Filesize
1.7MB

MD5
3f36166fd38a7a9d65857af96815fc5b

SHA1
05bbb0e5908ee12136f125c74a128761cf3fd548

SHA256
1fad4f5b278f62dd95266a8c6e1b719f53987b8f3dcebfa7827e5e80bb4c7139

SHA512
131e895dda15115ec75853d92b80b0440c5140f217167826a2fc6b1489736fc70705a473cae52e65410f61b390d942edec1acfb64bbf4ba9c4521770ab8b8c49

Download Submit
C:\Windows\System\Jydxugg.exe

Filesize
1.7MB

MD5
bbcf71f0cfa0d5477741344332711696

SHA1
07a3deaf1d0e7aff1e0d717b8106791e8e1d8836

SHA256
ab12884507380eb603c99c7ebfbe7de8851e42ae38fb599e807e26c7ac94da48

SHA512
2b440b0fdffe3b701154be55f49e5f3407e5c3135f5c893ebdf7d63af5bf6d22eb4c15e6d3e48bc2acfb2904f4750de8280a771c1ba1ea8d5f0b122d6b959b14

Download Submit
C:\Windows\System\LcjJvDP.exe

Filesize
1.7MB

MD5
81843ed52acb7fb6f9d517ba90119662

SHA1
239ea1cf7a074d7ab7994a2267dee4185e815e43

SHA256
06f365b0679dbee235daf87653be7ec2f5d8d6cb28c01b00a8c43fd7040e74e2

SHA512
98dd4362185ac8510f7bf0102c676738486f3fa88051ad2316ea267bdbe4cf2a58c8e23b11a92d3767ad81e7f90db095e5a39ce364e27cb2b287cdc6db11a348

Download Submit
C:\Windows\System\LuLeqlm.exe

Filesize
1.7MB

MD5
b230a5152da7358d7839b963ecf7aa09

SHA1
c5b8579a01887cffd3389abac6cb717c1a29864a

SHA256
afdba3c59f23c4655d12b6ed4148cf6041b2fadf4831226fdf8475a995f68cb4

SHA512
ff3f93d2d2d9bae6bb453599a3f18b5e0bb65b41aaefaf82d3e616bfe99789b1ff437c707dc5cbfb4197dee5ec848fe83ec51b8b72060fe5111b67e8d41f9b47

Download Submit
C:\Windows\System\MmOUoSm.exe

Filesize
1.7MB

MD5
55a95a826e31df2917a5e3e44c03eb8e

SHA1
3b21a489d0240bb398abf2298da7033fe41c699e

SHA256
aeee601b48bcf579bfa14f07755b6c196757f14bd42538bf723e880975b6ce41

SHA512
dd698fd64e1ff54a2a659c6dbc48db747e8d270d59557d2f1818d01d2953b94a54bc8c01f38b90b64ec5b25a50e0b3522fefabb8251f7976eb3dc20e03185f44

Download Submit
C:\Windows\System\OqMXmHZ.exe

Filesize
1.7MB

MD5
33a3485cd75a46e69647c206dd98e0d6

SHA1
6cfe1664d5e6995e76175653088a239200bd99ed

SHA256
f441ba81a5719825d5a5c8d38a748c3edaa52a1d4f7c9c58ba986e838ef36d3b

SHA512
f0bc9ee75c7f297f9daedf0e9ad3bc4d2282deccd29b1045593c0c12eb5f46b8301d2786a1b12215fefda5366f994fc56e7e293764a4ea09719ed89b5bfc0262

Download Submit
C:\Windows\System\PLDQcWM.exe

Filesize
1.7MB

MD5
0138c86e6764f3db4f35984e769ffa27

SHA1
064c865f36ba2f96079c93541729b97bd661ff04

SHA256
42188f74946997849835a0ba68b9e458dd8eaa049446b7d6f548f4594f56b27f

SHA512
8be52be405f8c2a9268294909b4eaf27a92201d0b0730ce49ffc3336ada5f0c663a5af04215a0be95bae7e8c55c69d01079ee569bf8ff7016239f2c8f91e9c0a

Download Submit
C:\Windows\System\PPVOFjU.exe

Filesize
1.7MB

MD5
66bc8e9784283cc369abc237bddc699a

SHA1
59d50787795b37c572aab5c4e61714e194ab9907

SHA256
50bbffa84eb22004aad6a628253ef022b630eae2b68b4b019cade45836d5c7da

SHA512
67c8adbbf0f1b2b4371368adbff11295cbf11be43327db391837bf389523ac7ca37dfc6d429d76fc0e4b41eec872485b69ac0af635ab626805d127980b09422e

Download Submit
C:\Windows\System\QLAZRTs.exe

Filesize
1.7MB

MD5
c491715880bb551bec0f0161a7cc5e9b

SHA1
3555f65ed85d66f07c9a3f4606de7e130664a132

SHA256
f94928762b2de5e7a5724fd40aee156075658b3763fb87950310b35d0a942553

SHA512
673f85ab8069198911e27d0d9568ca46a8ae1ac7607d451ef56fa0f270b561ea7c11be13866b6319b48e4ed6e9ceeeb0c298d09cdf6d39636e7f1dfe14416074

Download Submit
C:\Windows\System\QfjpuAP.exe

Filesize
1.7MB

MD5
3e8f51d0358dd00b000d1909005e5dea

SHA1
25385eeb01e9e668876902f1216c06d2b1ac4058

SHA256
874b887abe9179749620b2cd1e0cd58c12642a121c40d06d901d9a16b11acf4f

SHA512
72e71a58f8c4b32a2e137ed07be6f316a4a7b4855cecca3ffff8ea980b3125b823bcbabacb26a71a1e3b17d9ce710401038c5187eec50c626268c410d35fe0d7

Download Submit
C:\Windows\System\VhNhubl.exe

Filesize
1.7MB

MD5
bbd977129d98546ffd0a3c11d9bb3f69

SHA1
39492d0f57899ebc568eb90444f6c3d6f8565f2d

SHA256
8ca48396068cbad64fb53815fef9b8bb16c7ddca83c9ef7ff1fc6e6fb2e08a72

SHA512
6df07ac15d2aee56a28c9f792e9ae1a61453fc75d127c62a8be5c87f5e33a24b8310749a866aba7a07c42a7a66e75bc7214bf74897fdc4a823f06b8c84a4382d

Download Submit
C:\Windows\System\YARIxzM.exe

Filesize
1.7MB

MD5
f952aad6cc0912d84d2fe55aea3ad4c4

SHA1
c7351d9354cf961f8dcd2d338cb79babb37eb7fd

SHA256
ef3d3a6275c71d814e17eef1cc6234e0162586e5a6990846a30caab582b2f81c

SHA512
1abff245977adf70851b1908e36c9c1cd397b970024dfca16bb88db71ee815d2ed5c72b0256e0b8f9d01787f3924662a12230a9b9b379633927a223baee5e190

Download Submit
C:\Windows\System\YBtCgpG.exe

Filesize
1.7MB

MD5
534c4a4f4a798f49919a93072cff8e8c

SHA1
92babbaea05ca77d2e3f0e32ec0f2590859196f0

SHA256
ae2acd971928d4c64cbbae2d4fffdd93d259edad480ea300fab22748ed1576b7

SHA512
efd1fb9d5ccd4992acad6e8c8ea8632d0b24f9a30e26c07761533a1a97d2a3dec4221c6901f488a2de47033cf171d3c898787af4bfb937530c2b044d36d2904d

Download Submit
C:\Windows\System\ZWEQzvU.exe

Filesize
1.7MB

MD5
3c6d481fb3fde58cae2f78f56139c2bd

SHA1
77e9f133f025b0cdb028886673e1b3d35ebf97f2

SHA256
fbd77f74f3bd336b093ad8c4cbb1f550b9ac7d2e1ac18b55a0257e0a9d04cb1b

SHA512
5574b8927c242e7d37e92b6b405051c4aa968426edb13c9bd024baa4962b5988af0497623a3f79f8afbfe594d98c5875134ebe8b8eb11b5326b06e4aa0991579

Download Submit
C:\Windows\System\cNBGkUW.exe

Filesize
1.7MB

MD5
567f535e43b837310f1d5e46bea2c52f

SHA1
c3457f2ec42f5815136a4465673bb2b51d046228

SHA256
070510a6196d60daa2722af4d4866992d7c1ecc083555f3b79faf65906fd3ee9

SHA512
ba0bb4f3615115a161ff33a9cf6582395883331e32928577999e58fee7dafd1756a9103fddc4f4ab0bf062e7b2160f8f429d06e0e1952d8be99937737ae0d7fd

Download Submit
C:\Windows\System\cRioVEW.exe

Filesize
1.7MB

MD5
7cdd7412122b5763288bdc37a67deee1

SHA1
353409ac547006f3a13887f64755c6bfd15fee66

SHA256
4d24fbf6bec2db26e132ecf2859d5dee9c33a8e9e5b551f0cba601044cfe8a43

SHA512
0d2b88fd14eefaba23ab05c3f469850c7832667a75cdc39393c646d0f5af47afc8a21001b857804012653962c13b81added52ddd21eebaa4a290bf33c6632016

Download Submit
C:\Windows\System\dRVgDrb.exe

Filesize
1.7MB

MD5
e6eea3ea40a1e42d1295728e5afb771e

SHA1
052f4dee2a4de0f14660acd9c3fbcc458992303b

SHA256
0752acdc46f626651812e35df5cf3b4407576c7721522e4dbeb18307559352cc

SHA512
3df1974d7777f579091ac0d2d3eae170acd15efcf81c3ed8f641cc90693afc8666a8de8f8be54e278906abc2bfbbbe94db4df7de50fd0ba1befc71957e901834

Download Submit
C:\Windows\System\fDHcKpK.exe

Filesize
1.7MB

MD5
1f9876bcc53e03ddeb40cfe7db4cc966

SHA1
5ee66eb8a953f2122b9a989a129694f09354b4cd

SHA256
13597cebd6b8d3aa1e05b90b11f81e1d751ed65dc4729cb4a3d42783adabbbfe

SHA512
f64462469f7a6dbff4eea97d584505615778ecebc49df0f29f0b0b147d920ccd67fe63552d968418662610c8b01e234d5bee2a560dddbe08c42c2bc3cfa396a8

Download Submit
C:\Windows\System\fblcbAW.exe

Filesize
1.7MB

MD5
7e187b796d10e400983be62543cad141

SHA1
d5d6700811b3018fffb141caade6cca1742663fd

SHA256
4ff91a85a91c117f1ab63cf31dca06eca02b082b700cad7da8ef1b5b37235c12

SHA512
ae33154fc2820f0dcb9d5e142ee46daf9de91a71d47bcb7e7d15d2bd4bc41bb9f345b7f271830f3c7b54f2a7e1dce13783e50f5a400058aa45a815d700512336

Download Submit
C:\Windows\System\grMQcIu.exe

Filesize
1.7MB

MD5
d4a5edea9c18e577c2b376397c548c8b

SHA1
45357dfe1524c41a0ca12cbed72689dfed454df4

SHA256
75f8f95f9ff99534754e2df1b4979b701a3743407eaa4c9cd049dedcc6cd23c6

SHA512
decbdcd71e14e2f11c456b0a4cf8126507b73640247126c15d92853692b6abc2902596adf2a92001b6ea0ab5c799a05e9c145bc84993332ee671e2b40df30da3

Download Submit
C:\Windows\System\hsFZPan.exe

Filesize
1.7MB

MD5
07722b5a433ab63f66687fca939e3d29

SHA1
de82f1fd1e27c1a4c482c47731070fe702ae5944

SHA256
1d2a2998014aed5d31b79831d2bd07601666337d3b850def70e92651b23697b1

SHA512
f88ec0095f0a38a54f87e2a9a20b734ef3793ad43c21b748dd2734303450d1cc54958703578d69056eef930c97b54b6280300afa80086b0c0b9fb0bf02add95b

Download Submit
C:\Windows\System\iuXFYEj.exe

Filesize
1.7MB

MD5
be6069f817b5ff76ab5fa6bcebbbd79b

SHA1
eca053d874bc44270791571d1998b6ef13c6768d

SHA256
0da04d21766fe1170065056320a176e731dd6bc0d98f5add58c0d3cb38954be4

SHA512
c1e24d60ed75f9b0349fab313b6fdb8082ce446a257becd9d6f70393dde83b6fd77048cc65ff1d2aef8986d8dcfa8f9fe611ef774b18e5b13a0fab9c975a5cac

Download Submit
C:\Windows\System\jIWOdWw.exe

Filesize
1.7MB

MD5
ac198f5a6c812fac16f388528887ecac

SHA1
7ae3db64213ad322c33a0adb716d6724f558788f

SHA256
43c7487097428e2cbc73abf962ca8c488b4ea01ec581124193f8353e08affe6a

SHA512
9e174ee79ff7861f486aa68a91b3d9b9b6d3b56c3eab8f9b38c736e8278d19f3ad31bf68afb85228a38c54c29b1c16bf2d4f26ef68166efab8be66d9c44196ee

Download Submit
C:\Windows\System\jmynCxZ.exe

Filesize
1.7MB

MD5
624bae2e413f190409c0813126c04eea

SHA1
95a924798a9567ad39551f9561d37a2fe91dd6bd

SHA256
9992bdb7cb02f3eae7e43d35f0df65722497effaffe03206623d94670fae886a

SHA512
fc420e4ed9585bc5df4fd1a639eaa461eaf91b259eac12e5ea36586ba86fde23daab7b2ea0badd00a5af713ed0cfb7d1226700a3962a811c6c92ffbfc45cef09

Download Submit
C:\Windows\System\kSwKvzS.exe

Filesize
1.7MB

MD5
45e29462a4e162ae3715834cd8648814

SHA1
ec638a70a99dc033865d3028a18ce098d6b3da00

SHA256
9b80310dfe1329d773a05c573fe71385cb705dccb92d9d079f7f5fb260d3a726

SHA512
610ac30514e989ab240147a3690663d30acc781df0e1f70c3f28bb124ebd398094e9453429e61b922f85237fa4883827b2e23ca345c64d84b7c6bf349c0ccbf7

Download Submit
C:\Windows\System\lHZBPae.exe

Filesize
18B

MD5
a308bab96af0d8b0405ced0df2e422de

SHA1
d1952ddc6ffadb32bc26dbd87f63673fe488019c

SHA256
8b1e86aaa211a5c5f8f89e89db4748f4041ce6a7eadabf706546f1da8a4c933b

SHA512
febe4ebe7f32e7b2ee0bea8360d9cfbd617f1e619f185f40ee924ced488e4b9c2a3a234ad49a740a246b10397b83d94709c1498bb18d2a41eaa09bad38561ccc

Download Submit
C:\Windows\System\mWXOEhw.exe

Filesize
1.7MB

MD5
1a79d1633660a239249b5c2a84d603a2

SHA1
019f8791686216e37c8e7aee8ed9053f4149797f

SHA256
abefa899e944944aaab24adb786194c8d2467a552776af577bc98fc3c31695d4

SHA512
af7f2c14cc43868aea0752bc9053b60324b2dedf0f8ea29d30911408d83188ca5f7b6e062113c9c3d1b413de990406ede94d40f5bb9b23e4a55e6b1fb6b6db1a

Download Submit
C:\Windows\System\nVNHkpc.exe

Filesize
1.7MB

MD5
a98c163d61d6ec2cb722271a99af47bf

SHA1
a038bfcf6c0e1700f81a23b65aece1aa50920a43

SHA256
dabec412e2d9e00341cc50e894f9933347cdf47e5f164bffe1935bf765ebed07

SHA512
65f4432485b3c8b41381f3886f9c2559b80fe2d456638a75fae8fef673b9420731017cb4cb29466d8995cfa7f5d490a7e20e060036fae89190da6a90fbcb733e

Download Submit
C:\Windows\System\oBfQTDB.exe

Filesize
1.7MB

MD5
1ff8f2790a856c154f1c82149d878c7f

SHA1
21059661b51b92b2a12f095becfd185a885f72b3

SHA256
acfe0ed358f1ef5223d001d9272487bdbdd7a280531f011626c4a1580961634c

SHA512
74a77bc32ebf972f5ddd5e9b54e7acdcf12d89a946cacefbbf791580d24287a4ffab5942e6ca91fb92ca4b611fbca3e0647396d505786e679a8c147309827813

Download Submit
C:\Windows\System\plBOKoq.exe

Filesize
1.7MB

MD5
3f9d9b0320a5f54b9359bb8cc1d3ed34

SHA1
2e0915e8edc251fb73a51c7746db671e0c634cd2

SHA256
644ef8a8a88a4e42fabbd42c42f1ce2978b9d1ac63fed2c158e34673f3e5f4f8

SHA512
7b1ee08e3e9e83d65e941a0a9e02d2ff7451eeac8213f9946f9b5bc31dc7666d8325132d8a51f3dc360fb649077c16dfa23e746d6da2e94e3f4546e82c765de8

Download Submit
C:\Windows\System\pvppTzL.exe

Filesize
1.7MB

MD5
5b441fce46a716aabc0be62ff670e87a

SHA1
debf72c829f862b8e6ca463d75ae036bc08fdeef

SHA256
acbcd473c95e14eb3c525ceb444ccf564a84b3b70f51273a3b4c926d209042c5

SHA512
b1d80fca7b74eb948fd51eef421d5bb6d7945a5d62aae2200ca462c2a3d58d8c9f0a1103ff629d0445a89f908d97d633f60998134704fddba1f37681aeb74c91

Download Submit
C:\Windows\System\qoFiFiI.exe

Filesize
1.7MB

MD5
1af85f2385de535b87edc2e0b5ab9428

SHA1
4cee12a8bd23ca36bf1287a721288888edf4414f

SHA256
dab2375b2422c065e6f3b201e76eb39c6118f156c2aa673b5f09a64eee37d8aa

SHA512
31657d8ec7a38f5bb7c8b806f528635e7035a287ef9310c56ae0268f6ad6fd6fadb9775de9bd16b3027ba17d6a21e7610bc421305d88fc5302d6ac408c01ecf8

Download Submit
C:\Windows\System\rsanCOh.exe

Filesize
1.7MB

MD5
a4aad2759adf8fdd047b3a66ce952e0b

SHA1
a2696be31dfa1461450d11a077567bfd677cd4e2

SHA256
5bd87e867e645032b84ae7676d0985873e5e2fc569d03c7c2206c8887b659e38

SHA512
adcd7e51662993d925924464cbcb3e8f3fd191e7ba2bea97767b854643a2b984074510cb5681cdb6dad599b0cada6a7ff580ba449f0ee4458f492a8f93096d57

Download Submit
C:\Windows\System\uIrgaBQ.exe

Filesize
1.7MB

MD5
4e72699cf95e77261b06737f07adecb5

SHA1
bf41b2f6e27061c55de65ff78106b7a86f75ca0e

SHA256
910449adea642f8be5d52cb91cf7ead7a63ad59dad902f6556783bf6c8077caa

SHA512
cb9831cb6e482ac4e3ab154046c09786abc315c4e819b2adf4b7ab7ce969cbabc18321bfefb4eaeb0969033e2ba7d4bfc9bc858f10e5dc5ee7d04cc69ee8ea99

Download Submit
C:\Windows\System\wvGHVWL.exe

Filesize
1.7MB

MD5
80d0f4470d079bb51dd33c28456c3b30

SHA1
8b98c4c70a13a4483c4598386413931074e1597f

SHA256
8c9a952b6b846431be3c282cfd9140762a7c9061535d485d0f56b39b1da8d43a

SHA512
0eafb1217dcd59500b777f42f08e394ef4822406d82c2829cd227437eda204268b64e331b452a6e1ca28d388d78f1e0213baa2ce3ba73e283b9365ad45b70936

Download Submit
C:\Windows\System\xAnmpDg.exe

Filesize
1.7MB

MD5
395ff45d7688179dffa5fa21ade74891

SHA1
97bda00ec3de95628dbec48129945817d6d5a78f

SHA256
36542c5e72e19ecf6991573bac38ba1f5210f661ce2f46936f14a1f81c350923

SHA512
c01e88cf676867ab961ea115c6ad32990e1ccdccf701327b3231cd003925ebf64a2ee471a6fb9d064a2c0ad4d5ee0ef07cd5c9463241930534c5f3bfb6a5718a

Download Submit
C:\Windows\System\ylrCmGK.exe

Filesize
1.7MB

MD5
3ee8af8250fd5788c302500f02f53cf1

SHA1
b13eca5da6cbaa3ed5a4ea03171a048a37ae5b50

SHA256
9218398139c07dfdc27af4bdd6ecd2627498071a07e415552407b9a9341c6451

SHA512
a6e71a5121bb6a8afb744c5330194a261cff89e1915b8ff2175d1d3c5a09501adbf12574d726f6a520e0825aa86cf8cea57855a8f0a8e34c6f3f34b746b654a2

Download Submit
memory/836-49-0x00007FFF00E70000-0x00007FFF01931000-memory.dmp

Filesize
10.8MB

Download
memory/836-5-0x00007FFF00E73000-0x00007FFF00E75000-memory.dmp

Filesize
8KB

Download
memory/836-180-0x0000015F74A90000-0x0000015F74AB2000-memory.dmp

Filesize
136KB

Download
memory/836-724-0x00007FFF00E70000-0x00007FFF01931000-memory.dmp

Filesize
10.8MB

Download
memory/1100-660-0x00007FF775D70000-0x00007FF776162000-memory.dmp

Filesize
3.9MB

Download
memory/1100-5789-0x00007FF775D70000-0x00007FF776162000-memory.dmp

Filesize
3.9MB

Download
memory/1440-240-0x00007FF650460000-0x00007FF650852000-memory.dmp

Filesize
3.9MB

Download
memory/1440-5633-0x00007FF650460000-0x00007FF650852000-memory.dmp

Filesize
3.9MB

Download
memory/1948-70-0x00007FF7CE3C0000-0x00007FF7CE7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-663-0x00007FF6D2730000-0x00007FF6D2B22000-memory.dmp

Filesize
3.9MB

Download
memory/2160-5778-0x00007FF6D2730000-0x00007FF6D2B22000-memory.dmp

Filesize
3.9MB

Download
memory/2276-5746-0x00007FF6D40A0000-0x00007FF6D4492000-memory.dmp

Filesize
3.9MB

Download
memory/2276-601-0x00007FF6D40A0000-0x00007FF6D4492000-memory.dmp

Filesize
3.9MB

Download
memory/2308-5640-0x00007FF6A09E0000-0x00007FF6A0DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-112-0x00007FF6A09E0000-0x00007FF6A0DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-5824-0x00007FF7BB520000-0x00007FF7BB912000-memory.dmp

Filesize
3.9MB

Download
memory/2380-726-0x00007FF7BB520000-0x00007FF7BB912000-memory.dmp

Filesize
3.9MB

Download
memory/2472-514-0x00007FF6DAB30000-0x00007FF6DAF22000-memory.dmp

Filesize
3.9MB

Download
memory/2472-5774-0x00007FF6DAB30000-0x00007FF6DAF22000-memory.dmp

Filesize
3.9MB

Download
memory/2492-5731-0x00007FF6EEF00000-0x00007FF6EF2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-596-0x00007FF6EEF00000-0x00007FF6EF2F2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-5696-0x00007FF62D1A0000-0x00007FF62D592000-memory.dmp

Filesize
3.9MB

Download
memory/2496-190-0x00007FF62D1A0000-0x00007FF62D592000-memory.dmp

Filesize
3.9MB

Download
memory/2904-5657-0x00007FF6A62D0000-0x00007FF6A66C2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-326-0x00007FF6A62D0000-0x00007FF6A66C2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x00000262E8DD0000-0x00000262E8DE0000-memory.dmp

Filesize
64KB

Download
memory/2912-0-0x00007FF64BEC0000-0x00007FF64C2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-722-0x00007FF6CD180000-0x00007FF6CD572000-memory.dmp

Filesize
3.9MB

Download
memory/3092-5811-0x00007FF6CD180000-0x00007FF6CD572000-memory.dmp

Filesize
3.9MB

Download
memory/3140-275-0x00007FF7C2A90000-0x00007FF7C2E82000-memory.dmp

Filesize
3.9MB

Download
memory/3140-5636-0x00007FF7C2A90000-0x00007FF7C2E82000-memory.dmp

Filesize
3.9MB

Download
memory/3188-5803-0x00007FF679320000-0x00007FF679712000-memory.dmp

Filesize
3.9MB

Download
memory/3188-657-0x00007FF679320000-0x00007FF679712000-memory.dmp

Filesize
3.9MB

Download
memory/3496-625-0x00007FF7E18B0000-0x00007FF7E1CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-5796-0x00007FF7E18B0000-0x00007FF7E1CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-445-0x00007FF7CFCD0000-0x00007FF7D00C2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-5785-0x00007FF7CFCD0000-0x00007FF7D00C2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-662-0x00007FF7429D0000-0x00007FF742DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-5806-0x00007FF7429D0000-0x00007FF742DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-5767-0x00007FF7D94D0000-0x00007FF7D98C2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-328-0x00007FF7D94D0000-0x00007FF7D98C2000-memory.dmp

Filesize
3.9MB

Download
memory/3760-5729-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp

Filesize
3.9MB

Download
memory/3760-607-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp

Filesize
3.9MB

Download
memory/4368-701-0x00007FF7A8F80000-0x00007FF7A9372000-memory.dmp

Filesize
3.9MB

Download
memory/4368-5844-0x00007FF7A8F80000-0x00007FF7A9372000-memory.dmp

Filesize
3.9MB

Download
memory/4468-5830-0x00007FF7AF810000-0x00007FF7AFC02000-memory.dmp

Filesize
3.9MB

Download
memory/4468-698-0x00007FF7AF810000-0x00007FF7AFC02000-memory.dmp

Filesize
3.9MB

Download
memory/4640-5822-0x00007FF6EA230000-0x00007FF6EA622000-memory.dmp

Filesize
3.9MB

Download
memory/4640-725-0x00007FF6EA230000-0x00007FF6EA622000-memory.dmp

Filesize
3.9MB

Download
memory/4784-608-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-5797-0x00007FF66FFB0000-0x00007FF6703A2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-658-0x00007FF7B53D0000-0x00007FF7B57C2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-5842-0x00007FF7B53D0000-0x00007FF7B57C2000-memory.dmp

Filesize
3.9MB

Download