xmrig | 8b03fa4ef380a1090dcdbc2f2bf7794916f32b53426cd05e31c747cac0c9a8ad

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
Size

2.3MB
MD5

02b12c1c2ac19e1a1df299a0fab3daa7
SHA1

e197b045283a1a1e21f4930c5014ae3e3010e93f
SHA256

8b03fa4ef380a1090dcdbc2f2bf7794916f32b53426cd05e31c747cac0c9a8ad
SHA512

976d97dd32cdaf3f9f81bccea4ae06c45f7a83ce6009d4c7c8a1a2389f7065ce4570bed723738f5cff9c4b316c8eabf92173078dc4bc045de418d8ead51d60a5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//T:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1084-589-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp	xmrig
behavioral2/memory/444-591-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp	xmrig
behavioral2/memory/960-592-0x00007FF728E20000-0x00007FF729212000-memory.dmp	xmrig
behavioral2/memory/5012-590-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp	xmrig
behavioral2/memory/436-556-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp	xmrig
behavioral2/memory/3052-4301-0x00007FF6A2170000-0x00007FF6A2562000-memory.dmp	xmrig
behavioral2/memory/2696-4353-0x00007FF745380000-0x00007FF745772000-memory.dmp	xmrig
behavioral2/memory/444-4390-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp	xmrig
behavioral2/memory/3468-4419-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp	xmrig
behavioral2/memory/4520-4416-0x00007FF73B170000-0x00007FF73B562000-memory.dmp	xmrig
behavioral2/memory/436-4413-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp	xmrig
behavioral2/memory/960-4406-0x00007FF728E20000-0x00007FF729212000-memory.dmp	xmrig
behavioral2/memory/1084-4402-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp	xmrig
behavioral2/memory/5012-4385-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp	xmrig
behavioral2/memory/3128-4382-0x00007FF73C850000-0x00007FF73CC42000-memory.dmp	xmrig
behavioral2/memory/3124-4374-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	xmrig
behavioral2/memory/2944-4379-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/2340-4370-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp	xmrig
behavioral2/memory/3188-4364-0x00007FF647650000-0x00007FF647A42000-memory.dmp	xmrig
behavioral2/memory/5088-4358-0x00007FF765010000-0x00007FF765402000-memory.dmp	xmrig
behavioral2/memory/2664-4348-0x00007FF6A8F10000-0x00007FF6A9302000-memory.dmp	xmrig
behavioral2/memory/2036-4349-0x00007FF793580000-0x00007FF793972000-memory.dmp	xmrig
behavioral2/memory/2068-4344-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp	xmrig
behavioral2/memory/2592-4333-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp	xmrig
behavioral2/memory/3272-4277-0x00007FF7AC1D0000-0x00007FF7AC5C2000-memory.dmp	xmrig
behavioral2/memory/4632-4268-0x00007FF772900000-0x00007FF772CF2000-memory.dmp	xmrig
behavioral2/memory/3180-4258-0x00007FF73EA20000-0x00007FF73EE12000-memory.dmp	xmrig
behavioral2/memory/4520-1018-0x00007FF73B170000-0x00007FF73B562000-memory.dmp	xmrig
behavioral2/memory/2340-886-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp	xmrig
behavioral2/memory/2068-883-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp	xmrig
behavioral2/memory/2696-755-0x00007FF745380000-0x00007FF745772000-memory.dmp	xmrig
behavioral2/memory/4972-594-0x00007FF729B70000-0x00007FF729F62000-memory.dmp	xmrig
behavioral2/memory/3468-468-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp	xmrig
behavioral2/memory/3124-391-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	xmrig
behavioral2/memory/3188-342-0x00007FF647650000-0x00007FF647A42000-memory.dmp	xmrig
behavioral2/memory/5088-314-0x00007FF765010000-0x00007FF765402000-memory.dmp	xmrig
behavioral2/memory/2592-268-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp	xmrig
behavioral2/memory/2036-230-0x00007FF793580000-0x00007FF793972000-memory.dmp	xmrig
behavioral2/memory/2944-203-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/3144-172-0x00007FF66D470000-0x00007FF66D862000-memory.dmp	xmrig
behavioral2/memory/2664-136-0x00007FF6A8F10000-0x00007FF6A9302000-memory.dmp	xmrig
behavioral2/memory/3052-119-0x00007FF6A2170000-0x00007FF6A2562000-memory.dmp	xmrig
behavioral2/memory/3272-97-0x00007FF7AC1D0000-0x00007FF7AC5C2000-memory.dmp	xmrig
behavioral2/memory/4632-89-0x00007FF772900000-0x00007FF772CF2000-memory.dmp	xmrig
behavioral2/memory/3180-58-0x00007FF73EA20000-0x00007FF73EE12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4972	LbhFSjM.exe
3180	YFnyEDG.exe
4632	CmMwELd.exe
3272	HEjgVxU.exe
3052	okDjNab.exe
2664	QPCsypy.exe
2696	qvdUUFV.exe
3144	teKkaRK.exe
2944	YVikrJV.exe
2036	VlAIbth.exe
2068	vzsgxDp.exe
2592	UcpJzOa.exe
5088	apRBpDb.exe
3188	wgNIkiO.exe
2340	muYcaZK.exe
3124	RREOhlm.exe
3468	vSsBlHJ.exe
436	qBhedTz.exe
3128	BFKaCYk.exe
1084	VmsBLSG.exe
5012	UmGncSU.exe
444	auvuYUe.exe
960	VonPvUU.exe
4520	AdHmRWP.exe
3056	UOyvPjK.exe
636	yblzUcE.exe
4376	RrTBbLq.exe
4424	EsmOgep.exe
4404	fepeEtW.exe
2368	aBdFabv.exe
4484	VJVkGdy.exe
2264	vnWZdlP.exe
2204	doYcMXS.exe
4048	YWQHFYg.exe
2872	HbDsxvJ.exe
2088	sAhaCAm.exe
3020	diaoVYv.exe
3540	tOqQizK.exe
1764	OWaDKZd.exe
1036	HIqUyqw.exe
2160	TXmGbBk.exe
808	AWkWuxb.exe
4136	nrCuPus.exe
3948	fNSPZHp.exe
2104	vZfgREt.exe
4128	fNbUoNR.exe
4564	nghnoty.exe
5044	kRaIphC.exe
2120	nHovAcE.exe
2668	TAFZMgA.exe
4184	IJfHdvs.exe
464	IrkPAbI.exe
3888	cXLIgng.exe
3572	rDeMCis.exe
2676	MNPhLNW.exe
3476	EMCkrkL.exe
4284	uDacrSO.exe
2376	MImjSKW.exe
4004	cdWGnYw.exe
3004	YOpBmeG.exe
3512	BduPfrF.exe
4488	HSrTnIy.exe
2760	sUNdkqc.exe
3972	oqmQJAW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4804-0-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	upx
behavioral2/files/0x00080000000234d0-6.dat	upx
behavioral2/files/0x00070000000234d5-19.dat	upx
behavioral2/files/0x00070000000234e0-81.dat	upx
behavioral2/files/0x00080000000234df-142.dat	upx
behavioral2/memory/3128-588-0x00007FF73C850000-0x00007FF73CC42000-memory.dmp	upx
behavioral2/memory/1084-589-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp	upx
behavioral2/memory/444-591-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp	upx
behavioral2/memory/960-592-0x00007FF728E20000-0x00007FF729212000-memory.dmp	upx
behavioral2/memory/5012-590-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp	upx
behavioral2/memory/436-556-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp	upx
behavioral2/memory/3052-4301-0x00007FF6A2170000-0x00007FF6A2562000-memory.dmp	upx
behavioral2/memory/2696-4353-0x00007FF745380000-0x00007FF745772000-memory.dmp	upx
behavioral2/memory/444-4390-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp	upx
behavioral2/memory/3468-4419-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp	upx
behavioral2/memory/4520-4416-0x00007FF73B170000-0x00007FF73B562000-memory.dmp	upx
behavioral2/memory/436-4413-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp	upx
behavioral2/memory/960-4406-0x00007FF728E20000-0x00007FF729212000-memory.dmp	upx
behavioral2/memory/1084-4402-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp	upx
behavioral2/memory/5012-4385-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp	upx
behavioral2/memory/3128-4382-0x00007FF73C850000-0x00007FF73CC42000-memory.dmp	upx
behavioral2/memory/3124-4374-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	upx
behavioral2/memory/2944-4379-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	upx
behavioral2/memory/2340-4370-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp	upx
behavioral2/memory/3188-4364-0x00007FF647650000-0x00007FF647A42000-memory.dmp	upx
behavioral2/memory/5088-4358-0x00007FF765010000-0x00007FF765402000-memory.dmp	upx
behavioral2/memory/2664-4348-0x00007FF6A8F10000-0x00007FF6A9302000-memory.dmp	upx
behavioral2/memory/2036-4349-0x00007FF793580000-0x00007FF793972000-memory.dmp	upx
behavioral2/memory/2068-4344-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp	upx
behavioral2/memory/2592-4333-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp	upx
behavioral2/memory/3272-4277-0x00007FF7AC1D0000-0x00007FF7AC5C2000-memory.dmp	upx
behavioral2/memory/4632-4268-0x00007FF772900000-0x00007FF772CF2000-memory.dmp	upx
behavioral2/memory/3180-4258-0x00007FF73EA20000-0x00007FF73EE12000-memory.dmp	upx
behavioral2/memory/4520-1018-0x00007FF73B170000-0x00007FF73B562000-memory.dmp	upx
behavioral2/memory/2340-886-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp	upx
behavioral2/memory/2068-883-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp	upx
behavioral2/memory/2696-755-0x00007FF745380000-0x00007FF745772000-memory.dmp	upx
behavioral2/memory/4972-594-0x00007FF729B70000-0x00007FF729F62000-memory.dmp	upx
behavioral2/memory/3468-468-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp	upx
behavioral2/memory/3124-391-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	upx
behavioral2/memory/3188-342-0x00007FF647650000-0x00007FF647A42000-memory.dmp	upx
behavioral2/memory/5088-314-0x00007FF765010000-0x00007FF765402000-memory.dmp	upx
behavioral2/memory/2592-268-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp	upx
behavioral2/memory/2036-230-0x00007FF793580000-0x00007FF793972000-memory.dmp	upx
behavioral2/memory/2944-203-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	upx
behavioral2/files/0x00070000000234f1-197.dat	upx
behavioral2/files/0x00070000000234ee-195.dat	upx
behavioral2/files/0x00070000000234e9-190.dat	upx
behavioral2/files/0x00070000000234f8-189.dat	upx
behavioral2/files/0x00070000000234f7-188.dat	upx
behavioral2/files/0x00070000000234f6-184.dat	upx
behavioral2/files/0x00070000000234ed-181.dat	upx
behavioral2/files/0x00070000000234ec-177.dat	upx
behavioral2/memory/3144-172-0x00007FF66D470000-0x00007FF66D862000-memory.dmp	upx
behavioral2/files/0x00070000000234f4-171.dat	upx
behavioral2/files/0x00070000000234f2-166.dat	upx
behavioral2/files/0x00070000000234ea-160.dat	upx
behavioral2/files/0x00070000000234e8-155.dat	upx
behavioral2/files/0x00070000000234e7-178.dat	upx
behavioral2/files/0x00070000000234e6-151.dat	upx
behavioral2/files/0x00070000000234f5-176.dat	upx
behavioral2/files/0x00070000000234e5-175.dat	upx
behavioral2/files/0x00070000000234e4-147.dat	upx
behavioral2/files/0x00070000000234f3-168.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GDUYhXY.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\HnPqmAe.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\YswdPAP.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\kRiiuBp.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\KwSEypL.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\ivQtauP.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\EJfAazr.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\AyWINJZ.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\FbDfxpO.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\mKSXtsz.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\vAvGRRa.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\SPHgDpn.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\PEsoSQp.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\bXPaPZE.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\QPldyGb.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\GZOGECL.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\qqtTeKw.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\azsgxwE.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\HSoSMcr.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\aaPfmCD.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\OxHIVgi.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\sCFGymg.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\xYjVmxJ.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\mpWinzo.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\THWloSs.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\rhXtyKR.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\TUFoWXZ.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\FYxyNDy.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\LVGADMn.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\YoxVlaH.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\nPQqTVL.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\DbpPAKx.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\gZjfICp.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\tjCGnVj.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\QXDoUud.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\XCueGET.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\gGGOczS.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\wCrtpXG.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\nnSINWb.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\CuJvktY.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\lxaNjMC.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\NTsUpYb.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\ETgiFFn.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\FmSXmib.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\tSlnfhe.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\tnBWwnu.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\acrSdLN.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\sRAObYm.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\nmFbVdF.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\nuUJFMA.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\XSDJgyc.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\BRdrRXN.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\uLTKapJ.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\jjdeiHs.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\fFSsahj.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\apYcWxd.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\VAmungy.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\qEPtgEe.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\ORLppdv.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\cIJfPLX.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\wxVaaYV.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\MrbHSFm.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\ZJfOvOF.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
File created	C:\Windows\System\avYYuhR.exe	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings\MuiCache	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeCreateGlobalPrivilege	10276	dwm.exe
Token: SeChangeNotifyPrivilege	10276	dwm.exe
Token: 33	10276	dwm.exe
Token: SeIncBasePriorityPrivilege	10276	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
13320	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2680	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	85
PID 4804 wrote to memory of 2680	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	85
PID 4804 wrote to memory of 4972	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	86
PID 4804 wrote to memory of 4972	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	86
PID 4804 wrote to memory of 3180	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	87
PID 4804 wrote to memory of 3180	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	87
PID 4804 wrote to memory of 4632	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	88
PID 4804 wrote to memory of 4632	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	88
PID 4804 wrote to memory of 3272	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	89
PID 4804 wrote to memory of 3272	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	89
PID 4804 wrote to memory of 3052	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	90
PID 4804 wrote to memory of 3052	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	90
PID 4804 wrote to memory of 2664	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	91
PID 4804 wrote to memory of 2664	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	91
PID 4804 wrote to memory of 2696	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	92
PID 4804 wrote to memory of 2696	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	92
PID 4804 wrote to memory of 2944	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	93
PID 4804 wrote to memory of 2944	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	93
PID 4804 wrote to memory of 3144	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	94
PID 4804 wrote to memory of 3144	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	94
PID 4804 wrote to memory of 2036	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	95
PID 4804 wrote to memory of 2036	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	95
PID 4804 wrote to memory of 2068	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	96
PID 4804 wrote to memory of 2068	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	96
PID 4804 wrote to memory of 2592	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	97
PID 4804 wrote to memory of 2592	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	97
PID 4804 wrote to memory of 5088	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	98
PID 4804 wrote to memory of 5088	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	98
PID 4804 wrote to memory of 3188	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	99
PID 4804 wrote to memory of 3188	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	99
PID 4804 wrote to memory of 2340	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	100
PID 4804 wrote to memory of 2340	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	100
PID 4804 wrote to memory of 3124	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	101
PID 4804 wrote to memory of 3124	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	101
PID 4804 wrote to memory of 3468	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	102
PID 4804 wrote to memory of 3468	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	102
PID 4804 wrote to memory of 436	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	103
PID 4804 wrote to memory of 436	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	103
PID 4804 wrote to memory of 3128	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	104
PID 4804 wrote to memory of 3128	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	104
PID 4804 wrote to memory of 1084	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	105
PID 4804 wrote to memory of 1084	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	105
PID 4804 wrote to memory of 5012	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	106
PID 4804 wrote to memory of 5012	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	106
PID 4804 wrote to memory of 960	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	107
PID 4804 wrote to memory of 960	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	107
PID 4804 wrote to memory of 444	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	108
PID 4804 wrote to memory of 444	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	108
PID 4804 wrote to memory of 4520	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	109
PID 4804 wrote to memory of 4520	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	109
PID 4804 wrote to memory of 3056	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	110
PID 4804 wrote to memory of 3056	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	110
PID 4804 wrote to memory of 636	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	111
PID 4804 wrote to memory of 636	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	111
PID 4804 wrote to memory of 4376	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	112
PID 4804 wrote to memory of 4376	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	112
PID 4804 wrote to memory of 4424	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	113
PID 4804 wrote to memory of 4424	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	113
PID 4804 wrote to memory of 4404	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	114
PID 4804 wrote to memory of 4404	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	114
PID 4804 wrote to memory of 3540	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	115
PID 4804 wrote to memory of 3540	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	115
PID 4804 wrote to memory of 2368	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	116
PID 4804 wrote to memory of 2368	4804	02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe	116

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv v0XAHuPNEU+NbX0/e7I7GA.0
1⤵
PID:3652

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:3380

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2688

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02b12c1c2ac19e1a1df299a0fab3daa7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System\LbhFSjM.exe
  C:\Windows\System\LbhFSjM.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\YFnyEDG.exe
  C:\Windows\System\YFnyEDG.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\CmMwELd.exe
  C:\Windows\System\CmMwELd.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\HEjgVxU.exe
  C:\Windows\System\HEjgVxU.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\okDjNab.exe
  C:\Windows\System\okDjNab.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\QPCsypy.exe
  C:\Windows\System\QPCsypy.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\qvdUUFV.exe
  C:\Windows\System\qvdUUFV.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\YVikrJV.exe
  C:\Windows\System\YVikrJV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\teKkaRK.exe
  C:\Windows\System\teKkaRK.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\VlAIbth.exe
  C:\Windows\System\VlAIbth.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\vzsgxDp.exe
  C:\Windows\System\vzsgxDp.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\UcpJzOa.exe
  C:\Windows\System\UcpJzOa.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\apRBpDb.exe
  C:\Windows\System\apRBpDb.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\wgNIkiO.exe
  C:\Windows\System\wgNIkiO.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\muYcaZK.exe
  C:\Windows\System\muYcaZK.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\RREOhlm.exe
  C:\Windows\System\RREOhlm.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\vSsBlHJ.exe
  C:\Windows\System\vSsBlHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\qBhedTz.exe
  C:\Windows\System\qBhedTz.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\BFKaCYk.exe
  C:\Windows\System\BFKaCYk.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\VmsBLSG.exe
  C:\Windows\System\VmsBLSG.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\UmGncSU.exe
  C:\Windows\System\UmGncSU.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\VonPvUU.exe
  C:\Windows\System\VonPvUU.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\auvuYUe.exe
  C:\Windows\System\auvuYUe.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\AdHmRWP.exe
  C:\Windows\System\AdHmRWP.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\UOyvPjK.exe
  C:\Windows\System\UOyvPjK.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\yblzUcE.exe
  C:\Windows\System\yblzUcE.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\RrTBbLq.exe
  C:\Windows\System\RrTBbLq.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\EsmOgep.exe
  C:\Windows\System\EsmOgep.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\fepeEtW.exe
  C:\Windows\System\fepeEtW.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\tOqQizK.exe
  C:\Windows\System\tOqQizK.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\aBdFabv.exe
  C:\Windows\System\aBdFabv.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\VJVkGdy.exe
  C:\Windows\System\VJVkGdy.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\vnWZdlP.exe
  C:\Windows\System\vnWZdlP.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\doYcMXS.exe
  C:\Windows\System\doYcMXS.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\YWQHFYg.exe
  C:\Windows\System\YWQHFYg.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\HbDsxvJ.exe
  C:\Windows\System\HbDsxvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\sAhaCAm.exe
  C:\Windows\System\sAhaCAm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\diaoVYv.exe
  C:\Windows\System\diaoVYv.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\OWaDKZd.exe
  C:\Windows\System\OWaDKZd.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\HIqUyqw.exe
  C:\Windows\System\HIqUyqw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\TXmGbBk.exe
  C:\Windows\System\TXmGbBk.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\AWkWuxb.exe
  C:\Windows\System\AWkWuxb.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\nrCuPus.exe
  C:\Windows\System\nrCuPus.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\fNSPZHp.exe
  C:\Windows\System\fNSPZHp.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\vZfgREt.exe
  C:\Windows\System\vZfgREt.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\fNbUoNR.exe
  C:\Windows\System\fNbUoNR.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\nghnoty.exe
  C:\Windows\System\nghnoty.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\kRaIphC.exe
  C:\Windows\System\kRaIphC.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\nHovAcE.exe
  C:\Windows\System\nHovAcE.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\TAFZMgA.exe
  C:\Windows\System\TAFZMgA.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\IJfHdvs.exe
  C:\Windows\System\IJfHdvs.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\IrkPAbI.exe
  C:\Windows\System\IrkPAbI.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\cXLIgng.exe
  C:\Windows\System\cXLIgng.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\rDeMCis.exe
  C:\Windows\System\rDeMCis.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\MNPhLNW.exe
  C:\Windows\System\MNPhLNW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\EMCkrkL.exe
  C:\Windows\System\EMCkrkL.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\uDacrSO.exe
  C:\Windows\System\uDacrSO.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\MImjSKW.exe
  C:\Windows\System\MImjSKW.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\cdWGnYw.exe
  C:\Windows\System\cdWGnYw.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\YOpBmeG.exe
  C:\Windows\System\YOpBmeG.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\BduPfrF.exe
  C:\Windows\System\BduPfrF.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\HSrTnIy.exe
  C:\Windows\System\HSrTnIy.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\sUNdkqc.exe
  C:\Windows\System\sUNdkqc.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\oqmQJAW.exe
  C:\Windows\System\oqmQJAW.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\qKONmev.exe
  C:\Windows\System\qKONmev.exe
  2⤵
  PID:2432
- C:\Windows\System\kSFqIey.exe
  C:\Windows\System\kSFqIey.exe
  2⤵
  PID:1556
- C:\Windows\System\YkINrnl.exe
  C:\Windows\System\YkINrnl.exe
  2⤵
  PID:2988
- C:\Windows\System\vgGnrjP.exe
  C:\Windows\System\vgGnrjP.exe
  2⤵
  PID:4584
- C:\Windows\System\AGjzJQw.exe
  C:\Windows\System\AGjzJQw.exe
  2⤵
  PID:3608
- C:\Windows\System\OnwDRqA.exe
  C:\Windows\System\OnwDRqA.exe
  2⤵
  PID:2536
- C:\Windows\System\hHcMFfI.exe
  C:\Windows\System\hHcMFfI.exe
  2⤵
  PID:1224
- C:\Windows\System\OUPiWkU.exe
  C:\Windows\System\OUPiWkU.exe
  2⤵
  PID:2656
- C:\Windows\System\xbIFeRL.exe
  C:\Windows\System\xbIFeRL.exe
  2⤵
  PID:4380
- C:\Windows\System\SXdFLqV.exe
  C:\Windows\System\SXdFLqV.exe
  2⤵
  PID:2352
- C:\Windows\System\BAeEJTw.exe
  C:\Windows\System\BAeEJTw.exe
  2⤵
  PID:4676
- C:\Windows\System\pYRDRGv.exe
  C:\Windows\System\pYRDRGv.exe
  2⤵
  PID:2500
- C:\Windows\System\CQdvQMy.exe
  C:\Windows\System\CQdvQMy.exe
  2⤵
  PID:4572
- C:\Windows\System\DVcfbrq.exe
  C:\Windows\System\DVcfbrq.exe
  2⤵
  PID:1496
- C:\Windows\System\tbCrBpJ.exe
  C:\Windows\System\tbCrBpJ.exe
  2⤵
  PID:3744
- C:\Windows\System\SgRWeGa.exe
  C:\Windows\System\SgRWeGa.exe
  2⤵
  PID:3264
- C:\Windows\System\OcYWLOR.exe
  C:\Windows\System\OcYWLOR.exe
  2⤵
  PID:4532
- C:\Windows\System\sDMKmGj.exe
  C:\Windows\System\sDMKmGj.exe
  2⤵
  PID:2860
- C:\Windows\System\fVZCFjx.exe
  C:\Windows\System\fVZCFjx.exe
  2⤵
  PID:4032
- C:\Windows\System\gsAypBA.exe
  C:\Windows\System\gsAypBA.exe
  2⤵
  PID:3036
- C:\Windows\System\OTundcE.exe
  C:\Windows\System\OTundcE.exe
  2⤵
  PID:5132
- C:\Windows\System\DiAHodz.exe
  C:\Windows\System\DiAHodz.exe
  2⤵
  PID:5152
- C:\Windows\System\HjCIwyL.exe
  C:\Windows\System\HjCIwyL.exe
  2⤵
  PID:5184
- C:\Windows\System\dBlmthh.exe
  C:\Windows\System\dBlmthh.exe
  2⤵
  PID:5204
- C:\Windows\System\yvXmQnF.exe
  C:\Windows\System\yvXmQnF.exe
  2⤵
  PID:5224
- C:\Windows\System\LSHCDbs.exe
  C:\Windows\System\LSHCDbs.exe
  2⤵
  PID:5244
- C:\Windows\System\fEfLYJd.exe
  C:\Windows\System\fEfLYJd.exe
  2⤵
  PID:5268
- C:\Windows\System\YwiJiCk.exe
  C:\Windows\System\YwiJiCk.exe
  2⤵
  PID:5300
- C:\Windows\System\ykOZcnh.exe
  C:\Windows\System\ykOZcnh.exe
  2⤵
  PID:5328
- C:\Windows\System\KDIgQdI.exe
  C:\Windows\System\KDIgQdI.exe
  2⤵
  PID:5368
- C:\Windows\System\iFKlADo.exe
  C:\Windows\System\iFKlADo.exe
  2⤵
  PID:5392
- C:\Windows\System\HECPDaU.exe
  C:\Windows\System\HECPDaU.exe
  2⤵
  PID:5424
- C:\Windows\System\kyKEoqG.exe
  C:\Windows\System\kyKEoqG.exe
  2⤵
  PID:5452
- C:\Windows\System\VfOYcgU.exe
  C:\Windows\System\VfOYcgU.exe
  2⤵
  PID:5472
- C:\Windows\System\liBMFCZ.exe
  C:\Windows\System\liBMFCZ.exe
  2⤵
  PID:5496
- C:\Windows\System\SnuqOak.exe
  C:\Windows\System\SnuqOak.exe
  2⤵
  PID:5524
- C:\Windows\System\RZDYMDr.exe
  C:\Windows\System\RZDYMDr.exe
  2⤵
  PID:5544
- C:\Windows\System\eBsyPXt.exe
  C:\Windows\System\eBsyPXt.exe
  2⤵
  PID:5564
- C:\Windows\System\ORLgAOa.exe
  C:\Windows\System\ORLgAOa.exe
  2⤵
  PID:5584
- C:\Windows\System\FJbbKvQ.exe
  C:\Windows\System\FJbbKvQ.exe
  2⤵
  PID:5608
- C:\Windows\System\AmkEJss.exe
  C:\Windows\System\AmkEJss.exe
  2⤵
  PID:5628
- C:\Windows\System\rwWdlXq.exe
  C:\Windows\System\rwWdlXq.exe
  2⤵
  PID:5652
- C:\Windows\System\jzKZVDm.exe
  C:\Windows\System\jzKZVDm.exe
  2⤵
  PID:5672
- C:\Windows\System\ujnFpOE.exe
  C:\Windows\System\ujnFpOE.exe
  2⤵
  PID:5692
- C:\Windows\System\vWPakwZ.exe
  C:\Windows\System\vWPakwZ.exe
  2⤵
  PID:5716
- C:\Windows\System\PsvrByn.exe
  C:\Windows\System\PsvrByn.exe
  2⤵
  PID:5740
- C:\Windows\System\sxvJbmZ.exe
  C:\Windows\System\sxvJbmZ.exe
  2⤵
  PID:5760
- C:\Windows\System\WcBdpPt.exe
  C:\Windows\System\WcBdpPt.exe
  2⤵
  PID:5784
- C:\Windows\System\dFqHewg.exe
  C:\Windows\System\dFqHewg.exe
  2⤵
  PID:5808
- C:\Windows\System\pbEmWBV.exe
  C:\Windows\System\pbEmWBV.exe
  2⤵
  PID:5840
- C:\Windows\System\dbSwoof.exe
  C:\Windows\System\dbSwoof.exe
  2⤵
  PID:5860
- C:\Windows\System\FEHjZPH.exe
  C:\Windows\System\FEHjZPH.exe
  2⤵
  PID:5880
- C:\Windows\System\AmdCbRf.exe
  C:\Windows\System\AmdCbRf.exe
  2⤵
  PID:5908
- C:\Windows\System\shmCfRL.exe
  C:\Windows\System\shmCfRL.exe
  2⤵
  PID:5928
- C:\Windows\System\NcrHBTN.exe
  C:\Windows\System\NcrHBTN.exe
  2⤵
  PID:5948
- C:\Windows\System\gYwIUFG.exe
  C:\Windows\System\gYwIUFG.exe
  2⤵
  PID:5992
- C:\Windows\System\sfknWKb.exe
  C:\Windows\System\sfknWKb.exe
  2⤵
  PID:6020
- C:\Windows\System\jmvUfFN.exe
  C:\Windows\System\jmvUfFN.exe
  2⤵
  PID:6036
- C:\Windows\System\EGwyXmi.exe
  C:\Windows\System\EGwyXmi.exe
  2⤵
  PID:6056
- C:\Windows\System\oQJRBib.exe
  C:\Windows\System\oQJRBib.exe
  2⤵
  PID:6076
- C:\Windows\System\bAstQAZ.exe
  C:\Windows\System\bAstQAZ.exe
  2⤵
  PID:6096
- C:\Windows\System\XVSYPBx.exe
  C:\Windows\System\XVSYPBx.exe
  2⤵
  PID:6116
- C:\Windows\System\CMFsSno.exe
  C:\Windows\System\CMFsSno.exe
  2⤵
  PID:2320
- C:\Windows\System\oHddxlT.exe
  C:\Windows\System\oHddxlT.exe
  2⤵
  PID:1504
- C:\Windows\System\BxdvdYC.exe
  C:\Windows\System\BxdvdYC.exe
  2⤵
  PID:2840
- C:\Windows\System\jbXSQNQ.exe
  C:\Windows\System\jbXSQNQ.exe
  2⤵
  PID:3312
- C:\Windows\System\MuJfoEr.exe
  C:\Windows\System\MuJfoEr.exe
  2⤵
  PID:2624
- C:\Windows\System\lNjkfXO.exe
  C:\Windows\System\lNjkfXO.exe
  2⤵
  PID:5048
- C:\Windows\System\ACqTebn.exe
  C:\Windows\System\ACqTebn.exe
  2⤵
  PID:3592
- C:\Windows\System\ZSYAjrm.exe
  C:\Windows\System\ZSYAjrm.exe
  2⤵
  PID:4076
- C:\Windows\System\KISWgnj.exe
  C:\Windows\System\KISWgnj.exe
  2⤵
  PID:4604
- C:\Windows\System\bWMFbXA.exe
  C:\Windows\System\bWMFbXA.exe
  2⤵
  PID:2876
- C:\Windows\System\nQkMTnl.exe
  C:\Windows\System\nQkMTnl.exe
  2⤵
  PID:4292
- C:\Windows\System\CoROQUO.exe
  C:\Windows\System\CoROQUO.exe
  2⤵
  PID:5416
- C:\Windows\System\ifZoxcW.exe
  C:\Windows\System\ifZoxcW.exe
  2⤵
  PID:5276
- C:\Windows\System\QcPuakg.exe
  C:\Windows\System\QcPuakg.exe
  2⤵
  PID:1608
- C:\Windows\System\lymIoPD.exe
  C:\Windows\System\lymIoPD.exe
  2⤵
  PID:3876
- C:\Windows\System\Dmgwxgl.exe
  C:\Windows\System\Dmgwxgl.exe
  2⤵
  PID:5748
- C:\Windows\System\FUPgokY.exe
  C:\Windows\System\FUPgokY.exe
  2⤵
  PID:5144
- C:\Windows\System\OOmxpsz.exe
  C:\Windows\System\OOmxpsz.exe
  2⤵
  PID:6172
- C:\Windows\System\emVoBbh.exe
  C:\Windows\System\emVoBbh.exe
  2⤵
  PID:6192
- C:\Windows\System\OrrfAdw.exe
  C:\Windows\System\OrrfAdw.exe
  2⤵
  PID:6212
- C:\Windows\System\kItDxqJ.exe
  C:\Windows\System\kItDxqJ.exe
  2⤵
  PID:6236
- C:\Windows\System\kdGyKyL.exe
  C:\Windows\System\kdGyKyL.exe
  2⤵
  PID:6252
- C:\Windows\System\EylWGeq.exe
  C:\Windows\System\EylWGeq.exe
  2⤵
  PID:6276
- C:\Windows\System\vpTAppW.exe
  C:\Windows\System\vpTAppW.exe
  2⤵
  PID:6292
- C:\Windows\System\UIrzjLk.exe
  C:\Windows\System\UIrzjLk.exe
  2⤵
  PID:6312
- C:\Windows\System\lynlPdR.exe
  C:\Windows\System\lynlPdR.exe
  2⤵
  PID:6332
- C:\Windows\System\NcuacKU.exe
  C:\Windows\System\NcuacKU.exe
  2⤵
  PID:6352
- C:\Windows\System\jMdRqWr.exe
  C:\Windows\System\jMdRqWr.exe
  2⤵
  PID:6376
- C:\Windows\System\cgvJzzL.exe
  C:\Windows\System\cgvJzzL.exe
  2⤵
  PID:6400
- C:\Windows\System\koHOHlT.exe
  C:\Windows\System\koHOHlT.exe
  2⤵
  PID:6424
- C:\Windows\System\cFDzJxe.exe
  C:\Windows\System\cFDzJxe.exe
  2⤵
  PID:6444
- C:\Windows\System\DAMWqeh.exe
  C:\Windows\System\DAMWqeh.exe
  2⤵
  PID:6468
- C:\Windows\System\epSOOWI.exe
  C:\Windows\System\epSOOWI.exe
  2⤵
  PID:6492
- C:\Windows\System\tFPyWfo.exe
  C:\Windows\System\tFPyWfo.exe
  2⤵
  PID:6516
- C:\Windows\System\CuAZbFN.exe
  C:\Windows\System\CuAZbFN.exe
  2⤵
  PID:6532
- C:\Windows\System\DBgPlVf.exe
  C:\Windows\System\DBgPlVf.exe
  2⤵
  PID:6556
- C:\Windows\System\ZcBBHhM.exe
  C:\Windows\System\ZcBBHhM.exe
  2⤵
  PID:6580
- C:\Windows\System\fsyCCHk.exe
  C:\Windows\System\fsyCCHk.exe
  2⤵
  PID:6596
- C:\Windows\System\ulhtUaB.exe
  C:\Windows\System\ulhtUaB.exe
  2⤵
  PID:6612
- C:\Windows\System\QdbdEtD.exe
  C:\Windows\System\QdbdEtD.exe
  2⤵
  PID:6636
- C:\Windows\System\rEBypqD.exe
  C:\Windows\System\rEBypqD.exe
  2⤵
  PID:6660
- C:\Windows\System\yUYpHZt.exe
  C:\Windows\System\yUYpHZt.exe
  2⤵
  PID:6680
- C:\Windows\System\iKdoXiX.exe
  C:\Windows\System\iKdoXiX.exe
  2⤵
  PID:6708
- C:\Windows\System\pwsottG.exe
  C:\Windows\System\pwsottG.exe
  2⤵
  PID:6736
- C:\Windows\System\hyCuQMG.exe
  C:\Windows\System\hyCuQMG.exe
  2⤵
  PID:6760
- C:\Windows\System\xWWaszH.exe
  C:\Windows\System\xWWaszH.exe
  2⤵
  PID:6784
- C:\Windows\System\ikYLdtc.exe
  C:\Windows\System\ikYLdtc.exe
  2⤵
  PID:6808
- C:\Windows\System\PLUBsxk.exe
  C:\Windows\System\PLUBsxk.exe
  2⤵
  PID:6848
- C:\Windows\System\jDnYtfF.exe
  C:\Windows\System\jDnYtfF.exe
  2⤵
  PID:6864
- C:\Windows\System\MlcuSZB.exe
  C:\Windows\System\MlcuSZB.exe
  2⤵
  PID:6908
- C:\Windows\System\YrrcbTs.exe
  C:\Windows\System\YrrcbTs.exe
  2⤵
  PID:6928
- C:\Windows\System\fwTWcyM.exe
  C:\Windows\System\fwTWcyM.exe
  2⤵
  PID:6952
- C:\Windows\System\aHRoIZA.exe
  C:\Windows\System\aHRoIZA.exe
  2⤵
  PID:6976
- C:\Windows\System\cnICOCB.exe
  C:\Windows\System\cnICOCB.exe
  2⤵
  PID:6996
- C:\Windows\System\OcHkrfg.exe
  C:\Windows\System\OcHkrfg.exe
  2⤵
  PID:7020
- C:\Windows\System\GsnajGv.exe
  C:\Windows\System\GsnajGv.exe
  2⤵
  PID:7044
- C:\Windows\System\MXaPpbo.exe
  C:\Windows\System\MXaPpbo.exe
  2⤵
  PID:7060
- C:\Windows\System\XDazDjH.exe
  C:\Windows\System\XDazDjH.exe
  2⤵
  PID:7088
- C:\Windows\System\kHtUvYx.exe
  C:\Windows\System\kHtUvYx.exe
  2⤵
  PID:7104
- C:\Windows\System\sDDpBgm.exe
  C:\Windows\System\sDDpBgm.exe
  2⤵
  PID:7128
- C:\Windows\System\yGuqgUz.exe
  C:\Windows\System\yGuqgUz.exe
  2⤵
  PID:7152
- C:\Windows\System\YPILPoo.exe
  C:\Windows\System\YPILPoo.exe
  2⤵
  PID:5848
- C:\Windows\System\NjxnZcD.exe
  C:\Windows\System\NjxnZcD.exe
  2⤵
  PID:5444
- C:\Windows\System\hILrShw.exe
  C:\Windows\System\hILrShw.exe
  2⤵
  PID:5212
- C:\Windows\System\GNvnXLM.exe
  C:\Windows\System\GNvnXLM.exe
  2⤵
  PID:5308
- C:\Windows\System\jMMyGrK.exe
  C:\Windows\System\jMMyGrK.exe
  2⤵
  PID:5624
- C:\Windows\System\eBOuzAl.exe
  C:\Windows\System\eBOuzAl.exe
  2⤵
  PID:5688
- C:\Windows\System\ZaBdWwY.exe
  C:\Windows\System\ZaBdWwY.exe
  2⤵
  PID:5536
- C:\Windows\System\YmFUues.exe
  C:\Windows\System\YmFUues.exe
  2⤵
  PID:6288
- C:\Windows\System\kqbfHqu.exe
  C:\Windows\System\kqbfHqu.exe
  2⤵
  PID:5660
- C:\Windows\System\OFCKdLd.exe
  C:\Windows\System\OFCKdLd.exe
  2⤵
  PID:6500
- C:\Windows\System\JbruLyk.exe
  C:\Windows\System\JbruLyk.exe
  2⤵
  PID:6548
- C:\Windows\System\rJmZCbK.exe
  C:\Windows\System\rJmZCbK.exe
  2⤵
  PID:6576
- C:\Windows\System\EPOvRYr.exe
  C:\Windows\System\EPOvRYr.exe
  2⤵
  PID:6628
- C:\Windows\System\OyiNmwG.exe
  C:\Windows\System\OyiNmwG.exe
  2⤵
  PID:1392
- C:\Windows\System\icNKfWq.exe
  C:\Windows\System\icNKfWq.exe
  2⤵
  PID:2092
- C:\Windows\System\mCbkPiB.exe
  C:\Windows\System\mCbkPiB.exe
  2⤵
  PID:1708
- C:\Windows\System\ptjfCBV.exe
  C:\Windows\System\ptjfCBV.exe
  2⤵
  PID:4476
- C:\Windows\System\oeClOeL.exe
  C:\Windows\System\oeClOeL.exe
  2⤵
  PID:4708
- C:\Windows\System\YbaiqCF.exe
  C:\Windows\System\YbaiqCF.exe
  2⤵
  PID:6180
- C:\Windows\System\fqKGxOr.exe
  C:\Windows\System\fqKGxOr.exe
  2⤵
  PID:6204
- C:\Windows\System\ErjnMrz.exe
  C:\Windows\System\ErjnMrz.exe
  2⤵
  PID:5940
- C:\Windows\System\DNUcCTp.exe
  C:\Windows\System\DNUcCTp.exe
  2⤵
  PID:6044
- C:\Windows\System\bGyXzxg.exe
  C:\Windows\System\bGyXzxg.exe
  2⤵
  PID:6108
- C:\Windows\System\AaUvutD.exe
  C:\Windows\System\AaUvutD.exe
  2⤵
  PID:1576
- C:\Windows\System\xcSjqfx.exe
  C:\Windows\System\xcSjqfx.exe
  2⤵
  PID:6248
- C:\Windows\System\gzJiIJa.exe
  C:\Windows\System\gzJiIJa.exe
  2⤵
  PID:6436
- C:\Windows\System\XcEWZMd.exe
  C:\Windows\System\XcEWZMd.exe
  2⤵
  PID:6564
- C:\Windows\System\LSfsGvh.exe
  C:\Windows\System\LSfsGvh.exe
  2⤵
  PID:6700
- C:\Windows\System\ATlIKJP.exe
  C:\Windows\System\ATlIKJP.exe
  2⤵
  PID:4344
- C:\Windows\System\tzwMTgI.exe
  C:\Windows\System\tzwMTgI.exe
  2⤵
  PID:5876
- C:\Windows\System\CIETrxD.exe
  C:\Windows\System\CIETrxD.exe
  2⤵
  PID:6856
- C:\Windows\System\LXvLrOT.exe
  C:\Windows\System\LXvLrOT.exe
  2⤵
  PID:5724
- C:\Windows\System\NeXYDbm.exe
  C:\Windows\System\NeXYDbm.exe
  2⤵
  PID:5592
- C:\Windows\System\VNplEZR.exe
  C:\Windows\System\VNplEZR.exe
  2⤵
  PID:7144
- C:\Windows\System\yOCunFP.exe
  C:\Windows\System\yOCunFP.exe
  2⤵
  PID:7056
- C:\Windows\System\omjBuDE.exe
  C:\Windows\System\omjBuDE.exe
  2⤵
  PID:7012
- C:\Windows\System\CAMBCly.exe
  C:\Windows\System\CAMBCly.exe
  2⤵
  PID:6924
- C:\Windows\System\amIbIKw.exe
  C:\Windows\System\amIbIKw.exe
  2⤵
  PID:6828
- C:\Windows\System\JuWiMrA.exe
  C:\Windows\System\JuWiMrA.exe
  2⤵
  PID:5732
- C:\Windows\System\UyOeFpO.exe
  C:\Windows\System\UyOeFpO.exe
  2⤵
  PID:7188
- C:\Windows\System\AGtjdXH.exe
  C:\Windows\System\AGtjdXH.exe
  2⤵
  PID:7212
- C:\Windows\System\vfaaBmu.exe
  C:\Windows\System\vfaaBmu.exe
  2⤵
  PID:7232
- C:\Windows\System\reMSVSh.exe
  C:\Windows\System\reMSVSh.exe
  2⤵
  PID:7248
- C:\Windows\System\tMSaZVI.exe
  C:\Windows\System\tMSaZVI.exe
  2⤵
  PID:7268
- C:\Windows\System\ludWdMN.exe
  C:\Windows\System\ludWdMN.exe
  2⤵
  PID:7292
- C:\Windows\System\OugpbCi.exe
  C:\Windows\System\OugpbCi.exe
  2⤵
  PID:7312
- C:\Windows\System\aPnWykp.exe
  C:\Windows\System\aPnWykp.exe
  2⤵
  PID:7336
- C:\Windows\System\vznkEmJ.exe
  C:\Windows\System\vznkEmJ.exe
  2⤵
  PID:7364
- C:\Windows\System\OyIIJnW.exe
  C:\Windows\System\OyIIJnW.exe
  2⤵
  PID:7388
- C:\Windows\System\riIkPyE.exe
  C:\Windows\System\riIkPyE.exe
  2⤵
  PID:7408
- C:\Windows\System\VTvQzbq.exe
  C:\Windows\System\VTvQzbq.exe
  2⤵
  PID:7428
- C:\Windows\System\vVYayyI.exe
  C:\Windows\System\vVYayyI.exe
  2⤵
  PID:7456
- C:\Windows\System\gpDyUUY.exe
  C:\Windows\System\gpDyUUY.exe
  2⤵
  PID:7472
- C:\Windows\System\brCGAsE.exe
  C:\Windows\System\brCGAsE.exe
  2⤵
  PID:7492
- C:\Windows\System\LwnCsdR.exe
  C:\Windows\System\LwnCsdR.exe
  2⤵
  PID:7516
- C:\Windows\System\KilbaLD.exe
  C:\Windows\System\KilbaLD.exe
  2⤵
  PID:7540
- C:\Windows\System\vVgeqEb.exe
  C:\Windows\System\vVgeqEb.exe
  2⤵
  PID:7564
- C:\Windows\System\MJEJgmX.exe
  C:\Windows\System\MJEJgmX.exe
  2⤵
  PID:7580
- C:\Windows\System\igfEuLK.exe
  C:\Windows\System\igfEuLK.exe
  2⤵
  PID:7604
- C:\Windows\System\zPiVNbX.exe
  C:\Windows\System\zPiVNbX.exe
  2⤵
  PID:7628
- C:\Windows\System\elEhGmy.exe
  C:\Windows\System\elEhGmy.exe
  2⤵
  PID:7656
- C:\Windows\System\MIUDslq.exe
  C:\Windows\System\MIUDslq.exe
  2⤵
  PID:7676
- C:\Windows\System\dHnNgMK.exe
  C:\Windows\System\dHnNgMK.exe
  2⤵
  PID:7696
- C:\Windows\System\wEphDQu.exe
  C:\Windows\System\wEphDQu.exe
  2⤵
  PID:7712
- C:\Windows\System\qvVmtRh.exe
  C:\Windows\System\qvVmtRh.exe
  2⤵
  PID:7732
- C:\Windows\System\dwjlIub.exe
  C:\Windows\System\dwjlIub.exe
  2⤵
  PID:7752
- C:\Windows\System\koazUXw.exe
  C:\Windows\System\koazUXw.exe
  2⤵
  PID:7768
- C:\Windows\System\yWoZzOV.exe
  C:\Windows\System\yWoZzOV.exe
  2⤵
  PID:7788
- C:\Windows\System\JavCtFD.exe
  C:\Windows\System\JavCtFD.exe
  2⤵
  PID:7808
- C:\Windows\System\IppgkTY.exe
  C:\Windows\System\IppgkTY.exe
  2⤵
  PID:7828
- C:\Windows\System\WwbMtZn.exe
  C:\Windows\System\WwbMtZn.exe
  2⤵
  PID:7848
- C:\Windows\System\WQGQkwW.exe
  C:\Windows\System\WQGQkwW.exe
  2⤵
  PID:7872
- C:\Windows\System\boNzxXJ.exe
  C:\Windows\System\boNzxXJ.exe
  2⤵
  PID:7896
- C:\Windows\System\gnWhMbk.exe
  C:\Windows\System\gnWhMbk.exe
  2⤵
  PID:7912
- C:\Windows\System\PMbWzYS.exe
  C:\Windows\System\PMbWzYS.exe
  2⤵
  PID:7936
- C:\Windows\System\mMrGwci.exe
  C:\Windows\System\mMrGwci.exe
  2⤵
  PID:7960
- C:\Windows\System\jSPIAVb.exe
  C:\Windows\System\jSPIAVb.exe
  2⤵
  PID:7984
- C:\Windows\System\SpyjwYg.exe
  C:\Windows\System\SpyjwYg.exe
  2⤵
  PID:8008
- C:\Windows\System\cWOiCSU.exe
  C:\Windows\System\cWOiCSU.exe
  2⤵
  PID:8032
- C:\Windows\System\liBnFoO.exe
  C:\Windows\System\liBnFoO.exe
  2⤵
  PID:8048
- C:\Windows\System\OzJCpAP.exe
  C:\Windows\System\OzJCpAP.exe
  2⤵
  PID:8072
- C:\Windows\System\ZEHqktc.exe
  C:\Windows\System\ZEHqktc.exe
  2⤵
  PID:8096
- C:\Windows\System\WGDuGzM.exe
  C:\Windows\System\WGDuGzM.exe
  2⤵
  PID:8124
- C:\Windows\System\JJnyqSf.exe
  C:\Windows\System\JJnyqSf.exe
  2⤵
  PID:8152
- C:\Windows\System\uToaZyh.exe
  C:\Windows\System\uToaZyh.exe
  2⤵
  PID:8176
- C:\Windows\System\ZZaOKSF.exe
  C:\Windows\System\ZZaOKSF.exe
  2⤵
  PID:6244
- C:\Windows\System\zjJbAqW.exe
  C:\Windows\System\zjJbAqW.exe
  2⤵
  PID:6480
- C:\Windows\System\IaAustf.exe
  C:\Windows\System\IaAustf.exe
  2⤵
  PID:6620
- C:\Windows\System\jjomCCk.exe
  C:\Windows\System\jjomCCk.exe
  2⤵
  PID:6688
- C:\Windows\System\zjZNMcw.exe
  C:\Windows\System\zjZNMcw.exe
  2⤵
  PID:1284
- C:\Windows\System\dcDqLix.exe
  C:\Windows\System\dcDqLix.exe
  2⤵
  PID:5220
- C:\Windows\System\bkYWTKK.exe
  C:\Windows\System\bkYWTKK.exe
  2⤵
  PID:6944
- C:\Windows\System\uqvGjiz.exe
  C:\Windows\System\uqvGjiz.exe
  2⤵
  PID:7240
- C:\Windows\System\CCEghcU.exe
  C:\Windows\System\CCEghcU.exe
  2⤵
  PID:7280
- C:\Windows\System\AXaVgae.exe
  C:\Windows\System\AXaVgae.exe
  2⤵
  PID:7380
- C:\Windows\System\SMUkYFt.exe
  C:\Windows\System\SMUkYFt.exe
  2⤵
  PID:8212
- C:\Windows\System\gLVRurG.exe
  C:\Windows\System\gLVRurG.exe
  2⤵
  PID:8244
- C:\Windows\System\druPnMq.exe
  C:\Windows\System\druPnMq.exe
  2⤵
  PID:8276
- C:\Windows\System\xYyjfPp.exe
  C:\Windows\System\xYyjfPp.exe
  2⤵
  PID:8296
- C:\Windows\System\HoOVdrB.exe
  C:\Windows\System\HoOVdrB.exe
  2⤵
  PID:8324
- C:\Windows\System\BWpzHTG.exe
  C:\Windows\System\BWpzHTG.exe
  2⤵
  PID:8340
- C:\Windows\System\eLePRjg.exe
  C:\Windows\System\eLePRjg.exe
  2⤵
  PID:8368
- C:\Windows\System\KtZxbWc.exe
  C:\Windows\System\KtZxbWc.exe
  2⤵
  PID:8384
- C:\Windows\System\mOGmsBF.exe
  C:\Windows\System\mOGmsBF.exe
  2⤵
  PID:8412
- C:\Windows\System\GImiPSH.exe
  C:\Windows\System\GImiPSH.exe
  2⤵
  PID:8436
- C:\Windows\System\KkIffqx.exe
  C:\Windows\System\KkIffqx.exe
  2⤵
  PID:8460
- C:\Windows\System\jvMhkVk.exe
  C:\Windows\System\jvMhkVk.exe
  2⤵
  PID:8480
- C:\Windows\System\ZwxoEOO.exe
  C:\Windows\System\ZwxoEOO.exe
  2⤵
  PID:8496
- C:\Windows\System\wHnAATv.exe
  C:\Windows\System\wHnAATv.exe
  2⤵
  PID:8520
- C:\Windows\System\eTOgTpm.exe
  C:\Windows\System\eTOgTpm.exe
  2⤵
  PID:8544
- C:\Windows\System\VNhUcLC.exe
  C:\Windows\System\VNhUcLC.exe
  2⤵
  PID:8568
- C:\Windows\System\cHXRiNR.exe
  C:\Windows\System\cHXRiNR.exe
  2⤵
  PID:8592
- C:\Windows\System\ICDjiqS.exe
  C:\Windows\System\ICDjiqS.exe
  2⤵
  PID:8612
- C:\Windows\System\MyRQNkv.exe
  C:\Windows\System\MyRQNkv.exe
  2⤵
  PID:8636
- C:\Windows\System\sgxgsMM.exe
  C:\Windows\System\sgxgsMM.exe
  2⤵
  PID:8652
- C:\Windows\System\JYIMOPg.exe
  C:\Windows\System\JYIMOPg.exe
  2⤵
  PID:8676
- C:\Windows\System\EkmGYwJ.exe
  C:\Windows\System\EkmGYwJ.exe
  2⤵
  PID:8692
- C:\Windows\System\UfmXzsE.exe
  C:\Windows\System\UfmXzsE.exe
  2⤵
  PID:8716
- C:\Windows\System\nTORNHs.exe
  C:\Windows\System\nTORNHs.exe
  2⤵
  PID:8740
- C:\Windows\System\pcxrhhw.exe
  C:\Windows\System\pcxrhhw.exe
  2⤵
  PID:8760
- C:\Windows\System\UZpnVge.exe
  C:\Windows\System\UZpnVge.exe
  2⤵
  PID:8792
- C:\Windows\System\ldmdKeA.exe
  C:\Windows\System\ldmdKeA.exe
  2⤵
  PID:8812
- C:\Windows\System\GpKvAFW.exe
  C:\Windows\System\GpKvAFW.exe
  2⤵
  PID:8836
- C:\Windows\System\kAwQccG.exe
  C:\Windows\System\kAwQccG.exe
  2⤵
  PID:8856
- C:\Windows\System\wpPUDir.exe
  C:\Windows\System\wpPUDir.exe
  2⤵
  PID:8880
- C:\Windows\System\SNEvvBk.exe
  C:\Windows\System\SNEvvBk.exe
  2⤵
  PID:8904
- C:\Windows\System\wxsxYVb.exe
  C:\Windows\System\wxsxYVb.exe
  2⤵
  PID:8928
- C:\Windows\System\kkzweXz.exe
  C:\Windows\System\kkzweXz.exe
  2⤵
  PID:8952
- C:\Windows\System\RzLjmcb.exe
  C:\Windows\System\RzLjmcb.exe
  2⤵
  PID:8972
- C:\Windows\System\FDYbdwm.exe
  C:\Windows\System\FDYbdwm.exe
  2⤵
  PID:9000
- C:\Windows\System\pxDxSBQ.exe
  C:\Windows\System\pxDxSBQ.exe
  2⤵
  PID:9024
- C:\Windows\System\UImkeDh.exe
  C:\Windows\System\UImkeDh.exe
  2⤵
  PID:9052
- C:\Windows\System\LIWOkcj.exe
  C:\Windows\System\LIWOkcj.exe
  2⤵
  PID:9076
- C:\Windows\System\jOmqkBw.exe
  C:\Windows\System\jOmqkBw.exe
  2⤵
  PID:9096
- C:\Windows\System\TcySWuv.exe
  C:\Windows\System\TcySWuv.exe
  2⤵
  PID:9120
- C:\Windows\System\IirkIaP.exe
  C:\Windows\System\IirkIaP.exe
  2⤵
  PID:9144
- C:\Windows\System\EmlhPjN.exe
  C:\Windows\System\EmlhPjN.exe
  2⤵
  PID:9168
- C:\Windows\System\VbaANAe.exe
  C:\Windows\System\VbaANAe.exe
  2⤵
  PID:9192
- C:\Windows\System\ilakaIl.exe
  C:\Windows\System\ilakaIl.exe
  2⤵
  PID:7420
- C:\Windows\System\KuLlxZR.exe
  C:\Windows\System\KuLlxZR.exe
  2⤵
  PID:7464
- C:\Windows\System\JsUdgKi.exe
  C:\Windows\System\JsUdgKi.exe
  2⤵
  PID:7500
- C:\Windows\System\rlAmtmh.exe
  C:\Windows\System\rlAmtmh.exe
  2⤵
  PID:7532
- C:\Windows\System\arKKTZA.exe
  C:\Windows\System\arKKTZA.exe
  2⤵
  PID:7636
- C:\Windows\System\zWgytTu.exe
  C:\Windows\System\zWgytTu.exe
  2⤵
  PID:4740
- C:\Windows\System\Ythuges.exe
  C:\Windows\System\Ythuges.exe
  2⤵
  PID:5508
- C:\Windows\System\NpDizKg.exe
  C:\Windows\System\NpDizKg.exe
  2⤵
  PID:6264
- C:\Windows\System\ylCzJLA.exe
  C:\Windows\System\ylCzJLA.exe
  2⤵
  PID:6524
- C:\Windows\System\ZEmMKtz.exe
  C:\Windows\System\ZEmMKtz.exe
  2⤵
  PID:6676
- C:\Windows\System\kRFjLyN.exe
  C:\Windows\System\kRFjLyN.exe
  2⤵
  PID:5252
- C:\Windows\System\xZOtdjy.exe
  C:\Windows\System\xZOtdjy.exe
  2⤵
  PID:6156
- C:\Windows\System\KzxKlLG.exe
  C:\Windows\System\KzxKlLG.exe
  2⤵
  PID:5920
- C:\Windows\System\WJcFniN.exe
  C:\Windows\System\WJcFniN.exe
  2⤵
  PID:7864
- C:\Windows\System\CLNmNXj.exe
  C:\Windows\System\CLNmNXj.exe
  2⤵
  PID:6756
- C:\Windows\System\mOlHpsA.exe
  C:\Windows\System\mOlHpsA.exe
  2⤵
  PID:8104
- C:\Windows\System\UtoURmQ.exe
  C:\Windows\System\UtoURmQ.exe
  2⤵
  PID:7120
- C:\Windows\System\BvzuorD.exe
  C:\Windows\System\BvzuorD.exe
  2⤵
  PID:8164
- C:\Windows\System\vQqlQEe.exe
  C:\Windows\System\vQqlQEe.exe
  2⤵
  PID:6796
- C:\Windows\System\ENhNmjr.exe
  C:\Windows\System\ENhNmjr.exe
  2⤵
  PID:6588
- C:\Windows\System\tFBzzXK.exe
  C:\Windows\System\tFBzzXK.exe
  2⤵
  PID:5776
- C:\Windows\System\pUsZWGV.exe
  C:\Windows\System\pUsZWGV.exe
  2⤵
  PID:7224
- C:\Windows\System\DaFagJV.exe
  C:\Windows\System\DaFagJV.exe
  2⤵
  PID:7552
- C:\Windows\System\EUcEclR.exe
  C:\Windows\System\EUcEclR.exe
  2⤵
  PID:8304
- C:\Windows\System\efoSOEC.exe
  C:\Windows\System\efoSOEC.exe
  2⤵
  PID:7704
- C:\Windows\System\nSYbIKl.exe
  C:\Windows\System\nSYbIKl.exe
  2⤵
  PID:7724
- C:\Windows\System\kvupFKp.exe
  C:\Windows\System\kvupFKp.exe
  2⤵
  PID:9232
- C:\Windows\System\UQzFxCD.exe
  C:\Windows\System\UQzFxCD.exe
  2⤵
  PID:9248
- C:\Windows\System\KarHkBF.exe
  C:\Windows\System\KarHkBF.exe
  2⤵
  PID:9268
- C:\Windows\System\DIHWNen.exe
  C:\Windows\System\DIHWNen.exe
  2⤵
  PID:9288
- C:\Windows\System\qvhnVTj.exe
  C:\Windows\System\qvhnVTj.exe
  2⤵
  PID:9308
- C:\Windows\System\kbekKoN.exe
  C:\Windows\System\kbekKoN.exe
  2⤵
  PID:9336
- C:\Windows\System\kJOdTiy.exe
  C:\Windows\System\kJOdTiy.exe
  2⤵
  PID:9356
- C:\Windows\System\JmyIOVT.exe
  C:\Windows\System\JmyIOVT.exe
  2⤵
  PID:9376
- C:\Windows\System\eigJxbX.exe
  C:\Windows\System\eigJxbX.exe
  2⤵
  PID:9400
- C:\Windows\System\UhRFuXi.exe
  C:\Windows\System\UhRFuXi.exe
  2⤵
  PID:9432
- C:\Windows\System\phEdzva.exe
  C:\Windows\System\phEdzva.exe
  2⤵
  PID:9452
- C:\Windows\System\AicKIYc.exe
  C:\Windows\System\AicKIYc.exe
  2⤵
  PID:9480
- C:\Windows\System\LmQMqMl.exe
  C:\Windows\System\LmQMqMl.exe
  2⤵
  PID:9496
- C:\Windows\System\ckewdmQ.exe
  C:\Windows\System\ckewdmQ.exe
  2⤵
  PID:9524
- C:\Windows\System\IZlapLR.exe
  C:\Windows\System\IZlapLR.exe
  2⤵
  PID:9548
- C:\Windows\System\LEuNusf.exe
  C:\Windows\System\LEuNusf.exe
  2⤵
  PID:9572
- C:\Windows\System\yVNaAsg.exe
  C:\Windows\System\yVNaAsg.exe
  2⤵
  PID:9596
- C:\Windows\System\OrBxCrl.exe
  C:\Windows\System\OrBxCrl.exe
  2⤵
  PID:9616
- C:\Windows\System\VoBJLrV.exe
  C:\Windows\System\VoBJLrV.exe
  2⤵
  PID:9640
- C:\Windows\System\PMhJEwL.exe
  C:\Windows\System\PMhJEwL.exe
  2⤵
  PID:9672
- C:\Windows\System\GRweMLl.exe
  C:\Windows\System\GRweMLl.exe
  2⤵
  PID:9688
- C:\Windows\System\FfEeZDE.exe
  C:\Windows\System\FfEeZDE.exe
  2⤵
  PID:9712
- C:\Windows\System\PGCPWiN.exe
  C:\Windows\System\PGCPWiN.exe
  2⤵
  PID:9732
- C:\Windows\System\GdZtWxC.exe
  C:\Windows\System\GdZtWxC.exe
  2⤵
  PID:9756
- C:\Windows\System\YoxVlaH.exe
  C:\Windows\System\YoxVlaH.exe
  2⤵
  PID:9776
- C:\Windows\System\VbfpSju.exe
  C:\Windows\System\VbfpSju.exe
  2⤵
  PID:9800
- C:\Windows\System\DahMKGz.exe
  C:\Windows\System\DahMKGz.exe
  2⤵
  PID:9824
- C:\Windows\System\IcuKnUi.exe
  C:\Windows\System\IcuKnUi.exe
  2⤵
  PID:9840
- C:\Windows\System\WkACCWs.exe
  C:\Windows\System\WkACCWs.exe
  2⤵
  PID:9864
- C:\Windows\System\LOSkajC.exe
  C:\Windows\System\LOSkajC.exe
  2⤵
  PID:9888
- C:\Windows\System\iaWFWpA.exe
  C:\Windows\System\iaWFWpA.exe
  2⤵
  PID:9912
- C:\Windows\System\mHrFQjK.exe
  C:\Windows\System\mHrFQjK.exe
  2⤵
  PID:9932
- C:\Windows\System\HcZGpbc.exe
  C:\Windows\System\HcZGpbc.exe
  2⤵
  PID:9952
- C:\Windows\System\sYRbsln.exe
  C:\Windows\System\sYRbsln.exe
  2⤵
  PID:9976
- C:\Windows\System\arwMLTS.exe
  C:\Windows\System\arwMLTS.exe
  2⤵
  PID:10000
- C:\Windows\System\tZAwdel.exe
  C:\Windows\System\tZAwdel.exe
  2⤵
  PID:10028
- C:\Windows\System\DObBUGd.exe
  C:\Windows\System\DObBUGd.exe
  2⤵
  PID:10048
- C:\Windows\System\oSKKOeO.exe
  C:\Windows\System\oSKKOeO.exe
  2⤵
  PID:10068
- C:\Windows\System\FjnLVzI.exe
  C:\Windows\System\FjnLVzI.exe
  2⤵
  PID:10084
- C:\Windows\System\zupRMsg.exe
  C:\Windows\System\zupRMsg.exe
  2⤵
  PID:10100
- C:\Windows\System\vNuGBkP.exe
  C:\Windows\System\vNuGBkP.exe
  2⤵
  PID:10116
- C:\Windows\System\Npcoazf.exe
  C:\Windows\System\Npcoazf.exe
  2⤵
  PID:10136
- C:\Windows\System\qHfpYyH.exe
  C:\Windows\System\qHfpYyH.exe
  2⤵
  PID:10160
- C:\Windows\System\hUbEOLz.exe
  C:\Windows\System\hUbEOLz.exe
  2⤵
  PID:10184
- C:\Windows\System\YsYwmPi.exe
  C:\Windows\System\YsYwmPi.exe
  2⤵
  PID:10204
- C:\Windows\System\FdYeQCy.exe
  C:\Windows\System\FdYeQCy.exe
  2⤵
  PID:10224
- C:\Windows\System\zsmCEOY.exe
  C:\Windows\System\zsmCEOY.exe
  2⤵
  PID:7744
- C:\Windows\System\mYnLxbC.exe
  C:\Windows\System\mYnLxbC.exe
  2⤵
  PID:7780
- C:\Windows\System\wWfBaCH.exe
  C:\Windows\System\wWfBaCH.exe
  2⤵
  PID:5420
- C:\Windows\System\BeQyfbi.exe
  C:\Windows\System\BeQyfbi.exe
  2⤵
  PID:7908
- C:\Windows\System\YqcxEMJ.exe
  C:\Windows\System\YqcxEMJ.exe
  2⤵
  PID:8808
- C:\Windows\System\UXAcoEh.exe
  C:\Windows\System\UXAcoEh.exe
  2⤵
  PID:8940
- C:\Windows\System\THbwaYl.exe
  C:\Windows\System\THbwaYl.exe
  2⤵
  PID:7136
- C:\Windows\System\YoFpTxT.exe
  C:\Windows\System\YoFpTxT.exe
  2⤵
  PID:8068
- C:\Windows\System\kjXcOEs.exe
  C:\Windows\System\kjXcOEs.exe
  2⤵
  PID:8080
- C:\Windows\System\TXhoDat.exe
  C:\Windows\System\TXhoDat.exe
  2⤵
  PID:9204
- C:\Windows\System\MMMeCCi.exe
  C:\Windows\System\MMMeCCi.exe
  2⤵
  PID:7096
- C:\Windows\System\wFtfnJL.exe
  C:\Windows\System\wFtfnJL.exe
  2⤵
  PID:8188
- C:\Windows\System\qpEcLkd.exe
  C:\Windows\System\qpEcLkd.exe
  2⤵
  PID:7308
- C:\Windows\System\GfthNCH.exe
  C:\Windows\System\GfthNCH.exe
  2⤵
  PID:7352
- C:\Windows\System\oFLaGvR.exe
  C:\Windows\System\oFLaGvR.exe
  2⤵
  PID:6528
- C:\Windows\System\bUuRGub.exe
  C:\Windows\System\bUuRGub.exe
  2⤵
  PID:8316
- C:\Windows\System\cPpeQXs.exe
  C:\Windows\System\cPpeQXs.exe
  2⤵
  PID:7624
- C:\Windows\System\Atvqqje.exe
  C:\Windows\System\Atvqqje.exe
  2⤵
  PID:7688
- C:\Windows\System\yiPekSh.exe
  C:\Windows\System\yiPekSh.exe
  2⤵
  PID:8476
- C:\Windows\System\XiVogHf.exe
  C:\Windows\System\XiVogHf.exe
  2⤵
  PID:8512
- C:\Windows\System\NTSRqJx.exe
  C:\Windows\System\NTSRqJx.exe
  2⤵
  PID:8536
- C:\Windows\System\AlgSKkq.exe
  C:\Windows\System\AlgSKkq.exe
  2⤵
  PID:8236
- C:\Windows\System\femxtDT.exe
  C:\Windows\System\femxtDT.exe
  2⤵
  PID:8584
- C:\Windows\System\OewwyOw.exe
  C:\Windows\System\OewwyOw.exe
  2⤵
  PID:10244
- C:\Windows\System\KYCfwSZ.exe
  C:\Windows\System\KYCfwSZ.exe
  2⤵
  PID:10268
- C:\Windows\System\HfNlkot.exe
  C:\Windows\System\HfNlkot.exe
  2⤵
  PID:10288
- C:\Windows\System\XAiFvTt.exe
  C:\Windows\System\XAiFvTt.exe
  2⤵
  PID:10400
- C:\Windows\System\yHuPAbi.exe
  C:\Windows\System\yHuPAbi.exe
  2⤵
  PID:10468
- C:\Windows\System\jULqDoH.exe
  C:\Windows\System\jULqDoH.exe
  2⤵
  PID:10484
- C:\Windows\System\rHwOAwR.exe
  C:\Windows\System\rHwOAwR.exe
  2⤵
  PID:10500
- C:\Windows\System\HYobCjx.exe
  C:\Windows\System\HYobCjx.exe
  2⤵
  PID:10516
- C:\Windows\System\TZbcnSD.exe
  C:\Windows\System\TZbcnSD.exe
  2⤵
  PID:10532
- C:\Windows\System\BXfmJND.exe
  C:\Windows\System\BXfmJND.exe
  2⤵
  PID:10552
- C:\Windows\System\HAbLkfb.exe
  C:\Windows\System\HAbLkfb.exe
  2⤵
  PID:10572
- C:\Windows\System\QJZROJh.exe
  C:\Windows\System\QJZROJh.exe
  2⤵
  PID:10588
- C:\Windows\System\ZUmwAIe.exe
  C:\Windows\System\ZUmwAIe.exe
  2⤵
  PID:10604
- C:\Windows\System\DUBfOjE.exe
  C:\Windows\System\DUBfOjE.exe
  2⤵
  PID:10664
- C:\Windows\System\EDJwhYs.exe
  C:\Windows\System\EDJwhYs.exe
  2⤵
  PID:10680
- C:\Windows\System\NFaPVlU.exe
  C:\Windows\System\NFaPVlU.exe
  2⤵
  PID:10696
- C:\Windows\System\NAOaSoF.exe
  C:\Windows\System\NAOaSoF.exe
  2⤵
  PID:10712
- C:\Windows\System\iAkeqOR.exe
  C:\Windows\System\iAkeqOR.exe
  2⤵
  PID:10728
- C:\Windows\System\Ivcnroh.exe
  C:\Windows\System\Ivcnroh.exe
  2⤵
  PID:10748
- C:\Windows\System\kqcnsWM.exe
  C:\Windows\System\kqcnsWM.exe
  2⤵
  PID:10776
- C:\Windows\System\NZoIckY.exe
  C:\Windows\System\NZoIckY.exe
  2⤵
  PID:10800
- C:\Windows\System\tamrokF.exe
  C:\Windows\System\tamrokF.exe
  2⤵
  PID:10828
- C:\Windows\System\PyRFZZz.exe
  C:\Windows\System\PyRFZZz.exe
  2⤵
  PID:10844
- C:\Windows\System\HhvuhHm.exe
  C:\Windows\System\HhvuhHm.exe
  2⤵
  PID:10868
- C:\Windows\System\FmYwwiA.exe
  C:\Windows\System\FmYwwiA.exe
  2⤵
  PID:10892
- C:\Windows\System\FkbyCzI.exe
  C:\Windows\System\FkbyCzI.exe
  2⤵
  PID:10920
- C:\Windows\System\uOWLdxb.exe
  C:\Windows\System\uOWLdxb.exe
  2⤵
  PID:10944
- C:\Windows\System\PXxhLrc.exe
  C:\Windows\System\PXxhLrc.exe
  2⤵
  PID:11092
- C:\Windows\System\dOnFakP.exe
  C:\Windows\System\dOnFakP.exe
  2⤵
  PID:11108
- C:\Windows\System\JNLexhP.exe
  C:\Windows\System\JNLexhP.exe
  2⤵
  PID:11128
- C:\Windows\System\JsBsQRK.exe
  C:\Windows\System\JsBsQRK.exe
  2⤵
  PID:11148
- C:\Windows\System\qVviIbR.exe
  C:\Windows\System\qVviIbR.exe
  2⤵
  PID:11164
- C:\Windows\System\PbWIpcs.exe
  C:\Windows\System\PbWIpcs.exe
  2⤵
  PID:11180
- C:\Windows\System\WCGnWpO.exe
  C:\Windows\System\WCGnWpO.exe
  2⤵
  PID:11204
- C:\Windows\System\RGmTXpY.exe
  C:\Windows\System\RGmTXpY.exe
  2⤵
  PID:11220
- C:\Windows\System\UMcXHvq.exe
  C:\Windows\System\UMcXHvq.exe
  2⤵
  PID:11244
- C:\Windows\System\IVzPWLF.exe
  C:\Windows\System\IVzPWLF.exe
  2⤵
  PID:9244
- C:\Windows\System\CdoIjzb.exe
  C:\Windows\System\CdoIjzb.exe
  2⤵
  PID:7920
- C:\Windows\System\FYFjUvv.exe
  C:\Windows\System\FYFjUvv.exe
  2⤵
  PID:8000
- C:\Windows\System\QkRQiGX.exe
  C:\Windows\System\QkRQiGX.exe
  2⤵
  PID:5644
- C:\Windows\System\nYxuCMq.exe
  C:\Windows\System\nYxuCMq.exe
  2⤵
  PID:8332
- C:\Windows\System\cYtrtnM.exe
  C:\Windows\System\cYtrtnM.exe
  2⤵
  PID:8380
- C:\Windows\System\sYikjDy.exe
  C:\Windows\System\sYikjDy.exe
  2⤵
  PID:8456
- C:\Windows\System\XdcSKzP.exe
  C:\Windows\System\XdcSKzP.exe
  2⤵
  PID:9344
- C:\Windows\System\TfkUwCX.exe
  C:\Windows\System\TfkUwCX.exe
  2⤵
  PID:8804
- C:\Windows\System\iPEkTrp.exe
  C:\Windows\System\iPEkTrp.exe
  2⤵
  PID:8896
- C:\Windows\System\xbkqFaz.exe
  C:\Windows\System\xbkqFaz.exe
  2⤵
  PID:8964
- C:\Windows\System\YYQbnGE.exe
  C:\Windows\System\YYQbnGE.exe
  2⤵
  PID:9140
- C:\Windows\System\cIVfOCX.exe
  C:\Windows\System\cIVfOCX.exe
  2⤵
  PID:7484
- C:\Windows\System\VBZBqFM.exe
  C:\Windows\System\VBZBqFM.exe
  2⤵
  PID:6412
- C:\Windows\System\uTdnatL.exe
  C:\Windows\System\uTdnatL.exe
  2⤵
  PID:6936
- C:\Windows\System\vvTgCdN.exe
  C:\Windows\System\vvTgCdN.exe
  2⤵
  PID:8016
- C:\Windows\System\sKDEuJP.exe
  C:\Windows\System\sKDEuJP.exe
  2⤵
  PID:8140
- C:\Windows\System\RMWpAiW.exe
  C:\Windows\System\RMWpAiW.exe
  2⤵
  PID:7572
- C:\Windows\System\qwWBGMj.exe
  C:\Windows\System\qwWBGMj.exe
  2⤵
  PID:9284
- C:\Windows\System\uVbPaHY.exe
  C:\Windows\System\uVbPaHY.exe
  2⤵
  PID:9384
- C:\Windows\System\wiEKZjq.exe
  C:\Windows\System\wiEKZjq.exe
  2⤵
  PID:9464
- C:\Windows\System\HnLhVtu.exe
  C:\Windows\System\HnLhVtu.exe
  2⤵
  PID:9520
- C:\Windows\System\LZJozfr.exe
  C:\Windows\System\LZJozfr.exe
  2⤵
  PID:9580
- C:\Windows\System\AAZbZKM.exe
  C:\Windows\System\AAZbZKM.exe
  2⤵
  PID:9628
- C:\Windows\System\TtOVyor.exe
  C:\Windows\System\TtOVyor.exe
  2⤵
  PID:9696
- C:\Windows\System\bisjtNv.exe
  C:\Windows\System\bisjtNv.exe
  2⤵
  PID:9740
- C:\Windows\System\HJtptWg.exe
  C:\Windows\System\HJtptWg.exe
  2⤵
  PID:9792
- C:\Windows\System\ADxhtlD.exe
  C:\Windows\System\ADxhtlD.exe
  2⤵
  PID:9832
- C:\Windows\System\ayDPHUt.exe
  C:\Windows\System\ayDPHUt.exe
  2⤵
  PID:9860
- C:\Windows\System\avEXNhg.exe
  C:\Windows\System\avEXNhg.exe
  2⤵
  PID:9896
- C:\Windows\System\ianjoBC.exe
  C:\Windows\System\ianjoBC.exe
  2⤵
  PID:9940
- C:\Windows\System\kJgetQR.exe
  C:\Windows\System\kJgetQR.exe
  2⤵
  PID:9968
- C:\Windows\System\GSybCKO.exe
  C:\Windows\System\GSybCKO.exe
  2⤵
  PID:10016
- C:\Windows\System\MBavgyi.exe
  C:\Windows\System\MBavgyi.exe
  2⤵
  PID:10056
- C:\Windows\System\FbRiwAD.exe
  C:\Windows\System\FbRiwAD.exe
  2⤵
  PID:10108
- C:\Windows\System\UKeHkKl.exe
  C:\Windows\System\UKeHkKl.exe
  2⤵
  PID:10152
- C:\Windows\System\pBogFFQ.exe
  C:\Windows\System\pBogFFQ.exe
  2⤵
  PID:11268
- C:\Windows\System\odfEwZe.exe
  C:\Windows\System\odfEwZe.exe
  2⤵
  PID:11292
- C:\Windows\System\PYlSmoX.exe
  C:\Windows\System\PYlSmoX.exe
  2⤵
  PID:11316
- C:\Windows\System\RMokkyc.exe
  C:\Windows\System\RMokkyc.exe
  2⤵
  PID:11340
- C:\Windows\System\qmppMMS.exe
  C:\Windows\System\qmppMMS.exe
  2⤵
  PID:11364
- C:\Windows\System\UfNKbgy.exe
  C:\Windows\System\UfNKbgy.exe
  2⤵
  PID:11388
- C:\Windows\System\hIxePwL.exe
  C:\Windows\System\hIxePwL.exe
  2⤵
  PID:11412
- C:\Windows\System\ZrehhFz.exe
  C:\Windows\System\ZrehhFz.exe
  2⤵
  PID:11436
- C:\Windows\System\vPJZLdd.exe
  C:\Windows\System\vPJZLdd.exe
  2⤵
  PID:11460
- C:\Windows\System\mupWCpx.exe
  C:\Windows\System\mupWCpx.exe
  2⤵
  PID:11484
- C:\Windows\System\cmITzJN.exe
  C:\Windows\System\cmITzJN.exe
  2⤵
  PID:11512
- C:\Windows\System\HGfcczE.exe
  C:\Windows\System\HGfcczE.exe
  2⤵
  PID:11532
- C:\Windows\System\GkLqVse.exe
  C:\Windows\System\GkLqVse.exe
  2⤵
  PID:11556
- C:\Windows\System\agSyYzB.exe
  C:\Windows\System\agSyYzB.exe
  2⤵
  PID:11588
- C:\Windows\System\dSgboXr.exe
  C:\Windows\System\dSgboXr.exe
  2⤵
  PID:11604
- C:\Windows\System\OnJITWY.exe
  C:\Windows\System\OnJITWY.exe
  2⤵
  PID:11628
- C:\Windows\System\qGqFUyt.exe
  C:\Windows\System\qGqFUyt.exe
  2⤵
  PID:11652
- C:\Windows\System\YbbxZwQ.exe
  C:\Windows\System\YbbxZwQ.exe
  2⤵
  PID:11676
- C:\Windows\System\jWePKjI.exe
  C:\Windows\System\jWePKjI.exe
  2⤵
  PID:11692
- C:\Windows\System\BAQEqnB.exe
  C:\Windows\System\BAQEqnB.exe
  2⤵
  PID:11716
- C:\Windows\System\wZugUiv.exe
  C:\Windows\System\wZugUiv.exe
  2⤵
  PID:11736
- C:\Windows\System\jFCjFEu.exe
  C:\Windows\System\jFCjFEu.exe
  2⤵
  PID:11760
- C:\Windows\System\wtejfeh.exe
  C:\Windows\System\wtejfeh.exe
  2⤵
  PID:11780
- C:\Windows\System\mSZgcPl.exe
  C:\Windows\System\mSZgcPl.exe
  2⤵
  PID:11804
- C:\Windows\System\ynGehmM.exe
  C:\Windows\System\ynGehmM.exe
  2⤵
  PID:11828
- C:\Windows\System\wSjeaJV.exe
  C:\Windows\System\wSjeaJV.exe
  2⤵
  PID:11852
- C:\Windows\System\obsmauQ.exe
  C:\Windows\System\obsmauQ.exe
  2⤵
  PID:11876
- C:\Windows\System\gCiHieI.exe
  C:\Windows\System\gCiHieI.exe
  2⤵
  PID:11896
- C:\Windows\System\pnYrMdL.exe
  C:\Windows\System\pnYrMdL.exe
  2⤵
  PID:11920
- C:\Windows\System\FSZHjYx.exe
  C:\Windows\System\FSZHjYx.exe
  2⤵
  PID:11944
- C:\Windows\System\NPMIzgt.exe
  C:\Windows\System\NPMIzgt.exe
  2⤵
  PID:11968
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11968 -s 28
    3⤵
    PID:7892
- C:\Windows\System\GQzdiMJ.exe
  C:\Windows\System\GQzdiMJ.exe
  2⤵
  PID:12008
- C:\Windows\System\VFqBkKk.exe
  C:\Windows\System\VFqBkKk.exe
  2⤵
  PID:12028
- C:\Windows\System\DNiVynI.exe
  C:\Windows\System\DNiVynI.exe
  2⤵
  PID:12044
- C:\Windows\System\rBjqIeO.exe
  C:\Windows\System\rBjqIeO.exe
  2⤵
  PID:12060
- C:\Windows\System\ebmPnpd.exe
  C:\Windows\System\ebmPnpd.exe
  2⤵
  PID:12076
- C:\Windows\System\OJCMBrA.exe
  C:\Windows\System\OJCMBrA.exe
  2⤵
  PID:12096
- C:\Windows\System\GnouQCj.exe
  C:\Windows\System\GnouQCj.exe
  2⤵
  PID:12120
- C:\Windows\System\NqUwsgA.exe
  C:\Windows\System\NqUwsgA.exe
  2⤵
  PID:12144
- C:\Windows\System\LiTAnkX.exe
  C:\Windows\System\LiTAnkX.exe
  2⤵
  PID:12168
- C:\Windows\System\ISVNegm.exe
  C:\Windows\System\ISVNegm.exe
  2⤵
  PID:12192
- C:\Windows\System\vfAEJVU.exe
  C:\Windows\System\vfAEJVU.exe
  2⤵
  PID:12228
- C:\Windows\System\TAXMgNY.exe
  C:\Windows\System\TAXMgNY.exe
  2⤵
  PID:12244
- C:\Windows\System\GgKVClS.exe
  C:\Windows\System\GgKVClS.exe
  2⤵
  PID:12260
- C:\Windows\System\KYAuVwX.exe
  C:\Windows\System\KYAuVwX.exe
  2⤵
  PID:12280
- C:\Windows\System\EFStfNt.exe
  C:\Windows\System\EFStfNt.exe
  2⤵
  PID:10220
- C:\Windows\System\OgHVHyy.exe
  C:\Windows\System\OgHVHyy.exe
  2⤵
  PID:8704
- C:\Windows\System\NBVVSxk.exe
  C:\Windows\System\NBVVSxk.exe
  2⤵
  PID:9116
- C:\Windows\System\VvqqBCU.exe
  C:\Windows\System\VvqqBCU.exe
  2⤵
  PID:8992
- C:\Windows\System\jgQAlBd.exe
  C:\Windows\System\jgQAlBd.exe
  2⤵
  PID:8828
- C:\Windows\System\KVVqfJw.exe
  C:\Windows\System\KVVqfJw.exe
  2⤵
  PID:7028
- C:\Windows\System\MpuwurF.exe
  C:\Windows\System\MpuwurF.exe
  2⤵
  PID:6792
- C:\Windows\System\cIJfPLX.exe
  C:\Windows\System\cIJfPLX.exe
  2⤵
  PID:6088
- C:\Windows\System\cfzodaz.exe
  C:\Windows\System\cfzodaz.exe
  2⤵
  PID:8400
- C:\Windows\System\CYygFtk.exe
  C:\Windows\System\CYygFtk.exe
  2⤵
  PID:12296
- C:\Windows\System\HPqPEiL.exe
  C:\Windows\System\HPqPEiL.exe
  2⤵
  PID:12320
- C:\Windows\System\yOhvOfJ.exe
  C:\Windows\System\yOhvOfJ.exe
  2⤵
  PID:12344
- C:\Windows\System\yDAEpnH.exe
  C:\Windows\System\yDAEpnH.exe
  2⤵
  PID:12368
- C:\Windows\System\JVeAoEM.exe
  C:\Windows\System\JVeAoEM.exe
  2⤵
  PID:12392
- C:\Windows\System\fYpRNyz.exe
  C:\Windows\System\fYpRNyz.exe
  2⤵
  PID:12412
- C:\Windows\System\ziAguvO.exe
  C:\Windows\System\ziAguvO.exe
  2⤵
  PID:12432
- C:\Windows\System\JSdLDIM.exe
  C:\Windows\System\JSdLDIM.exe
  2⤵
  PID:12456
- C:\Windows\System\WduSWOE.exe
  C:\Windows\System\WduSWOE.exe
  2⤵
  PID:12480
- C:\Windows\System\qMydBDp.exe
  C:\Windows\System\qMydBDp.exe
  2⤵
  PID:12504
- C:\Windows\System\XchTIuT.exe
  C:\Windows\System\XchTIuT.exe
  2⤵
  PID:12528
- C:\Windows\System\PstfCsU.exe
  C:\Windows\System\PstfCsU.exe
  2⤵
  PID:12552
- C:\Windows\System\lGVUzMj.exe
  C:\Windows\System\lGVUzMj.exe
  2⤵
  PID:12576
- C:\Windows\System\tVkHMQB.exe
  C:\Windows\System\tVkHMQB.exe
  2⤵
  PID:12600
- C:\Windows\System\ThuYAvL.exe
  C:\Windows\System\ThuYAvL.exe
  2⤵
  PID:12624
- C:\Windows\System\YgIUMNt.exe
  C:\Windows\System\YgIUMNt.exe
  2⤵
  PID:12644
- C:\Windows\System\wcFAmlB.exe
  C:\Windows\System\wcFAmlB.exe
  2⤵
  PID:12668
- C:\Windows\System\qVzhxIy.exe
  C:\Windows\System\qVzhxIy.exe
  2⤵
  PID:12692
- C:\Windows\System\MNXZGjv.exe
  C:\Windows\System\MNXZGjv.exe
  2⤵
  PID:12708
- C:\Windows\System\vRPzlqx.exe
  C:\Windows\System\vRPzlqx.exe
  2⤵
  PID:12732
- C:\Windows\System\ppTVfxp.exe
  C:\Windows\System\ppTVfxp.exe
  2⤵
  PID:12756
- C:\Windows\System\ORFNdNm.exe
  C:\Windows\System\ORFNdNm.exe
  2⤵
  PID:12780
- C:\Windows\System\DTAnXRs.exe
  C:\Windows\System\DTAnXRs.exe
  2⤵
  PID:12256
- C:\Windows\System\oVAcwHh.exe
  C:\Windows\System\oVAcwHh.exe
  2⤵
  PID:10876
- C:\Windows\System\kzjwEXP.exe
  C:\Windows\System\kzjwEXP.exe
  2⤵
  PID:10912
- C:\Windows\System\LIweAgE.exe
  C:\Windows\System\LIweAgE.exe
  2⤵
  PID:11032
- C:\Windows\System\rfoeJDl.exe
  C:\Windows\System\rfoeJDl.exe
  2⤵
  PID:12940
- C:\Windows\System\tFUlIfm.exe
  C:\Windows\System\tFUlIfm.exe
  2⤵
  PID:13012
- C:\Windows\System\xRBjDqj.exe
  C:\Windows\System\xRBjDqj.exe
  2⤵
  PID:13032
- C:\Windows\System\maajJtp.exe
  C:\Windows\System\maajJtp.exe
  2⤵
  PID:13052
- C:\Windows\System\artbLKM.exe
  C:\Windows\System\artbLKM.exe
  2⤵
  PID:13096
- C:\Windows\System\dDRIAvt.exe
  C:\Windows\System\dDRIAvt.exe
  2⤵
  PID:11084
- C:\Windows\System\QEiHUME.exe
  C:\Windows\System\QEiHUME.exe
  2⤵
  PID:11104
- C:\Windows\System\xVNRYhp.exe
  C:\Windows\System\xVNRYhp.exe
  2⤵
  PID:11140
- C:\Windows\System\GcLyHll.exe
  C:\Windows\System\GcLyHll.exe
  2⤵
  PID:11172
- C:\Windows\System\GChWjiG.exe
  C:\Windows\System\GChWjiG.exe
  2⤵
  PID:11216
- C:\Windows\System\dKMuPdL.exe
  C:\Windows\System\dKMuPdL.exe
  2⤵
  PID:7956
- C:\Windows\System\ytQEZSY.exe
  C:\Windows\System\ytQEZSY.exe
  2⤵
  PID:5124
- C:\Windows\System\dYzJkcR.exe
  C:\Windows\System\dYzJkcR.exe
  2⤵
  PID:8444
- C:\Windows\System\rMvFIOM.exe
  C:\Windows\System\rMvFIOM.exe
  2⤵
  PID:8844
- C:\Windows\System\RNUsjgd.exe
  C:\Windows\System\RNUsjgd.exe
  2⤵
  PID:7820
- C:\Windows\System\dpZkQbV.exe
  C:\Windows\System\dpZkQbV.exe
  2⤵
  PID:9544
- C:\Windows\System\xFAGjuV.exe
  C:\Windows\System\xFAGjuV.exe
  2⤵
  PID:9808
- C:\Windows\System\PTRixsH.exe
  C:\Windows\System\PTRixsH.exe
  2⤵
  PID:11544
- C:\Windows\System\VTbOWmN.exe
  C:\Windows\System\VTbOWmN.exe
  2⤵
  PID:11672
- C:\Windows\System\cNjcNnb.exe
  C:\Windows\System\cNjcNnb.exe
  2⤵
  PID:11836
- C:\Windows\System\noWkcuv.exe
  C:\Windows\System\noWkcuv.exe
  2⤵
  PID:11992
- C:\Windows\System\tFPtFJw.exe
  C:\Windows\System\tFPtFJw.exe
  2⤵
  PID:12072
- C:\Windows\System\RryCyZS.exe
  C:\Windows\System\RryCyZS.exe
  2⤵
  PID:8728
- C:\Windows\System\kMsgTcO.exe
  C:\Windows\System\kMsgTcO.exe
  2⤵
  PID:7260
- C:\Windows\System\QSloXVL.exe
  C:\Windows\System\QSloXVL.exe
  2⤵
  PID:12380
- C:\Windows\System\ppadBxu.exe
  C:\Windows\System\ppadBxu.exe
  2⤵
  PID:12536
- C:\Windows\System\UmtEOAh.exe
  C:\Windows\System\UmtEOAh.exe
  2⤵
  PID:12716
- C:\Windows\System\YmzGVee.exe
  C:\Windows\System\YmzGVee.exe
  2⤵
  PID:1248
- C:\Windows\System\KlHfRnC.exe
  C:\Windows\System\KlHfRnC.exe
  2⤵
  PID:4036
- C:\Windows\System\GEujRZG.exe
  C:\Windows\System\GEujRZG.exe
  2⤵
  PID:10260
- C:\Windows\System\GtSyoqM.exe
  C:\Windows\System\GtSyoqM.exe
  2⤵
  PID:12948
- C:\Windows\System\KHDcKZA.exe
  C:\Windows\System\KHDcKZA.exe
  2⤵
  PID:11564
- C:\Windows\System\nGMKwQA.exe
  C:\Windows\System\nGMKwQA.exe
  2⤵
  PID:11504
- C:\Windows\System\VFtFOYX.exe
  C:\Windows\System\VFtFOYX.exe
  2⤵
  PID:11732
- C:\Windows\System\xoArcJe.exe
  C:\Windows\System\xoArcJe.exe
  2⤵
  PID:11792
- C:\Windows\System\ZdDRTDq.exe
  C:\Windows\System\ZdDRTDq.exe
  2⤵
  PID:11664
- C:\Windows\System\aLOqVns.exe
  C:\Windows\System\aLOqVns.exe
  2⤵
  PID:11704
- C:\Windows\System\HHXEBhw.exe
  C:\Windows\System\HHXEBhw.exe
  2⤵
  PID:11552
- C:\Windows\System\uEBQVSx.exe
  C:\Windows\System\uEBQVSx.exe
  2⤵
  PID:7856
- C:\Windows\System\lsaYWen.exe
  C:\Windows\System\lsaYWen.exe
  2⤵
  PID:12204
- C:\Windows\System\YQJgFsT.exe
  C:\Windows\System\YQJgFsT.exe
  2⤵
  PID:7256
- C:\Windows\System\uuUIKfc.exe
  C:\Windows\System\uuUIKfc.exe
  2⤵
  PID:8872
- C:\Windows\System\ztRdROV.exe
  C:\Windows\System\ztRdROV.exe
  2⤵
  PID:7620
- C:\Windows\System\EmXPDUH.exe
  C:\Windows\System\EmXPDUH.exe
  2⤵
  PID:9448
- C:\Windows\System\VuKSaoL.exe
  C:\Windows\System\VuKSaoL.exe
  2⤵
  PID:9608
- C:\Windows\System\hqclDbL.exe
  C:\Windows\System\hqclDbL.exe
  2⤵
  PID:9724
- C:\Windows\System\zBPmjNt.exe
  C:\Windows\System\zBPmjNt.exe
  2⤵
  PID:12376
- C:\Windows\System\DvrJKHH.exe
  C:\Windows\System\DvrJKHH.exe
  2⤵
  PID:12452
- C:\Windows\System\hWGknol.exe
  C:\Windows\System\hWGknol.exe
  2⤵
  PID:12612
- C:\Windows\System\oDearKq.exe
  C:\Windows\System\oDearKq.exe
  2⤵
  PID:12676
- C:\Windows\System\nnSINWb.exe
  C:\Windows\System\nnSINWb.exe
  2⤵
  PID:12748
- C:\Windows\System\frLndJh.exe
  C:\Windows\System\frLndJh.exe
  2⤵
  PID:12804
- C:\Windows\System\mGqGzia.exe
  C:\Windows\System\mGqGzia.exe
  2⤵
  PID:12808
- C:\Windows\System\krcxMVd.exe
  C:\Windows\System\krcxMVd.exe
  2⤵
  PID:10512
- C:\Windows\System\KKIOocO.exe
  C:\Windows\System\KKIOocO.exe
  2⤵
  PID:5800
- C:\Windows\System\ULrIODD.exe
  C:\Windows\System\ULrIODD.exe
  2⤵
  PID:11812
- C:\Windows\System\dRpszup.exe
  C:\Windows\System\dRpszup.exe
  2⤵
  PID:12788
- C:\Windows\System\HJfYUfv.exe
  C:\Windows\System\HJfYUfv.exe
  2⤵
  PID:13284
- C:\Windows\System\yebUgaZ.exe
  C:\Windows\System\yebUgaZ.exe
  2⤵
  PID:11476
- C:\Windows\System\ghgdEKg.exe
  C:\Windows\System\ghgdEKg.exe
  2⤵
  PID:10200
- C:\Windows\System\IsZRqKH.exe
  C:\Windows\System\IsZRqKH.exe
  2⤵
  PID:1984
- C:\Windows\System\LkGeyIZ.exe
  C:\Windows\System\LkGeyIZ.exe
  2⤵
  PID:11052
- C:\Windows\System\OMgpEch.exe
  C:\Windows\System\OMgpEch.exe
  2⤵
  PID:12996
- C:\Windows\System\PltBXTp.exe
  C:\Windows\System\PltBXTp.exe
  2⤵
  PID:13044
- C:\Windows\System\czLmdOP.exe
  C:\Windows\System\czLmdOP.exe
  2⤵
  PID:11136
- C:\Windows\System\zALdXzi.exe
  C:\Windows\System\zALdXzi.exe
  2⤵
  PID:12328
- C:\Windows\System\rcuvDuw.exe
  C:\Windows\System\rcuvDuw.exe
  2⤵
  PID:8428
- C:\Windows\System\QCHqbiY.exe
  C:\Windows\System\QCHqbiY.exe
  2⤵
  PID:10064
- C:\Windows\System\xPtHVpj.exe
  C:\Windows\System\xPtHVpj.exe
  2⤵
  PID:11904
- C:\Windows\System\UuZLnno.exe
  C:\Windows\System\UuZLnno.exe
  2⤵
  PID:10660
- C:\Windows\System\aTKlanC.exe
  C:\Windows\System\aTKlanC.exe
  2⤵
  PID:3560
- C:\Windows\System\UAYFBFb.exe
  C:\Windows\System\UAYFBFb.exe
  2⤵
  PID:11260
- C:\Windows\System\wwhpoOy.exe
  C:\Windows\System\wwhpoOy.exe
  2⤵
  PID:12588
- C:\Windows\System\qcomprd.exe
  C:\Windows\System\qcomprd.exe
  2⤵
  PID:9304
- C:\Windows\System\pPFQKsk.exe
  C:\Windows\System\pPFQKsk.exe
  2⤵
  PID:10612
- C:\Windows\System\QwsZNQd.exe
  C:\Windows\System\QwsZNQd.exe
  2⤵
  PID:11840
- C:\Windows\System\DRpbBTs.exe
  C:\Windows\System\DRpbBTs.exe
  2⤵
  PID:12880
- C:\Windows\System\rYBTvDO.exe
  C:\Windows\System\rYBTvDO.exe
  2⤵
  PID:10232
- C:\Windows\System\WiBATiA.exe
  C:\Windows\System\WiBATiA.exe
  2⤵
  PID:2164
- C:\Windows\System\upynlmm.exe
  C:\Windows\System\upynlmm.exe
  2⤵
  PID:13040
- C:\Windows\System\uEXWbls.exe
  C:\Windows\System\uEXWbls.exe
  2⤵
  PID:11212
- C:\Windows\System\NkXJIOG.exe
  C:\Windows\System\NkXJIOG.exe
  2⤵
  PID:12652
- C:\Windows\System\ixYBwTF.exe
  C:\Windows\System\ixYBwTF.exe
  2⤵
  PID:11524
- C:\Windows\System\tLiKKFc.exe
  C:\Windows\System\tLiKKFc.exe
  2⤵
  PID:2688
- C:\Windows\System\ExakAaK.exe
  C:\Windows\System\ExakAaK.exe
  2⤵
  PID:12424
- C:\Windows\System\WZrlmPy.exe
  C:\Windows\System\WZrlmPy.exe
  2⤵
  PID:11572
- C:\Windows\System\ZUKqkLp.exe
  C:\Windows\System\ZUKqkLp.exe
  2⤵
  PID:7932
- C:\Windows\System\rHiLEuD.exe
  C:\Windows\System\rHiLEuD.exe
  2⤵
  PID:12052
- C:\Windows\System\eYucPEC.exe
  C:\Windows\System\eYucPEC.exe
  2⤵
  PID:12388
- C:\Windows\System\SAOUXlO.exe
  C:\Windows\System\SAOUXlO.exe
  2⤵
  PID:7892
- C:\Windows\System\KhAzIke.exe
  C:\Windows\System\KhAzIke.exe
  2⤵
  PID:12364
- C:\Windows\System\JSwnXDQ.exe
  C:\Windows\System\JSwnXDQ.exe
  2⤵
  PID:12680
- C:\Windows\System\tNxncMJ.exe
  C:\Windows\System\tNxncMJ.exe
  2⤵
  PID:1388
- C:\Windows\System\ZtTCHGo.exe
  C:\Windows\System\ZtTCHGo.exe
  2⤵
  PID:12304
- C:\Windows\System\bBoqaCm.exe
  C:\Windows\System\bBoqaCm.exe
  2⤵
  PID:10704
- C:\Windows\System\YsPKvJs.exe
  C:\Windows\System\YsPKvJs.exe
  2⤵
  PID:9180
- C:\Windows\System\qEkVJsk.exe
  C:\Windows\System\qEkVJsk.exe
  2⤵
  PID:11620
- C:\Windows\System\WaExYHW.exe
  C:\Windows\System\WaExYHW.exe
  2⤵
  PID:4728
- C:\Windows\System\SZIASrH.exe
  C:\Windows\System\SZIASrH.exe
  2⤵
  PID:11928
- C:\Windows\System\vhfsdkR.exe
  C:\Windows\System\vhfsdkR.exe
  2⤵
  PID:10744
- C:\Windows\System\XekYQdY.exe
  C:\Windows\System\XekYQdY.exe
  2⤵
  PID:1636
- C:\Windows\System\IWetVzS.exe
  C:\Windows\System\IWetVzS.exe
  2⤵
  PID:11072
- C:\Windows\System\ZPXftgO.exe
  C:\Windows\System\ZPXftgO.exe
  2⤵
  PID:12184
- C:\Windows\System\kJyaisZ.exe
  C:\Windows\System\kJyaisZ.exe
  2⤵
  PID:13324
- C:\Windows\System\sMRLPDg.exe
  C:\Windows\System\sMRLPDg.exe
  2⤵
  PID:13348
- C:\Windows\System\AkVcwME.exe
  C:\Windows\System\AkVcwME.exe
  2⤵
  PID:13456
- C:\Windows\System\vQpBJDT.exe
  C:\Windows\System\vQpBJDT.exe
  2⤵
  PID:13476
- C:\Windows\System\TBhWpSt.exe
  C:\Windows\System\TBhWpSt.exe
  2⤵
  PID:13496
- C:\Windows\System\xeVMamC.exe
  C:\Windows\System\xeVMamC.exe
  2⤵
  PID:13732
- C:\Windows\System\fWPuqrS.exe
  C:\Windows\System\fWPuqrS.exe
  2⤵
  PID:13772
- C:\Windows\System\hxRctxL.exe
  C:\Windows\System\hxRctxL.exe
  2⤵
  PID:13808
- C:\Windows\System\VBlcFMq.exe
  C:\Windows\System\VBlcFMq.exe
  2⤵
  PID:13828
- C:\Windows\System\aMZvDVK.exe
  C:\Windows\System\aMZvDVK.exe
  2⤵
  PID:13848
- C:\Windows\System\mUVLnuR.exe
  C:\Windows\System\mUVLnuR.exe
  2⤵
  PID:13864
- C:\Windows\System\geBifYe.exe
  C:\Windows\System\geBifYe.exe
  2⤵
  PID:13888
- C:\Windows\System\OCOsCaI.exe
  C:\Windows\System\OCOsCaI.exe
  2⤵
  PID:14032
- C:\Windows\System\JQAtBBV.exe
  C:\Windows\System\JQAtBBV.exe
  2⤵
  PID:14056
- C:\Windows\System\xEJizJX.exe
  C:\Windows\System\xEJizJX.exe
  2⤵
  PID:14104
- C:\Windows\System\rHBHbZK.exe
  C:\Windows\System\rHBHbZK.exe
  2⤵
  PID:14132
- C:\Windows\System\ECBtjDR.exe
  C:\Windows\System\ECBtjDR.exe
  2⤵
  PID:14152
- C:\Windows\System\xbeqhgl.exe
  C:\Windows\System\xbeqhgl.exe
  2⤵
  PID:14180
- C:\Windows\System\KFmBJqn.exe
  C:\Windows\System\KFmBJqn.exe
  2⤵
  PID:13760
- C:\Windows\System\DmqIMoD.exe
  C:\Windows\System\DmqIMoD.exe
  2⤵
  PID:14212
- C:\Windows\System\wbNzufm.exe
  C:\Windows\System\wbNzufm.exe
  2⤵
  PID:2136
- C:\Windows\System\nDbuQqa.exe
  C:\Windows\System\nDbuQqa.exe
  2⤵
  PID:692
- C:\Windows\System\EslPeuV.exe
  C:\Windows\System\EslPeuV.exe
  2⤵
  PID:13316
- C:\Windows\System\NAxvvmm.exe
  C:\Windows\System\NAxvvmm.exe
  2⤵
  PID:13572
- C:\Windows\System\wuJXeme.exe
  C:\Windows\System\wuJXeme.exe
  2⤵
  PID:13704
- C:\Windows\System\GCfKPHM.exe
  C:\Windows\System\GCfKPHM.exe
  2⤵
  PID:13724
- C:\Windows\System\LQHAiYc.exe
  C:\Windows\System\LQHAiYc.exe
  2⤵
  PID:880
- C:\Windows\System\utMkXlJ.exe
  C:\Windows\System\utMkXlJ.exe
  2⤵
  PID:13816
- C:\Windows\System\rZCjNRM.exe
  C:\Windows\System\rZCjNRM.exe
  2⤵
  PID:408
- C:\Windows\System\jZDEuhe.exe
  C:\Windows\System\jZDEuhe.exe
  2⤵
  PID:13584
- C:\Windows\System\MLUppno.exe
  C:\Windows\System\MLUppno.exe
  2⤵
  PID:13616
- C:\Windows\System\lZgbLKG.exe
  C:\Windows\System\lZgbLKG.exe
  2⤵
  PID:2684
- C:\Windows\System\IPyobHP.exe
  C:\Windows\System\IPyobHP.exe
  2⤵
  PID:1164
- C:\Windows\System\byeeBhb.exe
  C:\Windows\System\byeeBhb.exe
  2⤵
  PID:1784
- C:\Windows\System\dEghYPL.exe
  C:\Windows\System\dEghYPL.exe
  2⤵
  PID:13492
- C:\Windows\System\cUQXPFN.exe
  C:\Windows\System\cUQXPFN.exe
  2⤵
  PID:13556
- C:\Windows\System\lpsgkzo.exe
  C:\Windows\System\lpsgkzo.exe
  2⤵
  PID:3580
- C:\Windows\System\TuhWOQr.exe
  C:\Windows\System\TuhWOQr.exe
  2⤵
  PID:13640
- C:\Windows\System\yQOHjGo.exe
  C:\Windows\System\yQOHjGo.exe
  2⤵
  PID:13768
- C:\Windows\System\YqlMCsM.exe
  C:\Windows\System\YqlMCsM.exe
  2⤵
  PID:13856
- C:\Windows\System\OJSZAyh.exe
  C:\Windows\System\OJSZAyh.exe
  2⤵
  PID:3152
- C:\Windows\System\Ahkndnb.exe
  C:\Windows\System\Ahkndnb.exe
  2⤵
  PID:13908
- C:\Windows\System\JdVuOMt.exe
  C:\Windows\System\JdVuOMt.exe
  2⤵
  PID:13836
- C:\Windows\System\mRtyHmX.exe
  C:\Windows\System\mRtyHmX.exe
  2⤵
  PID:3652
- C:\Windows\System\UFRhCbC.exe
  C:\Windows\System\UFRhCbC.exe
  2⤵
  PID:4712
- C:\Windows\System\JIoqBeP.exe
  C:\Windows\System\JIoqBeP.exe
  2⤵
  PID:3712
- C:\Windows\System\FNLOCpo.exe
  C:\Windows\System\FNLOCpo.exe
  2⤵
  PID:11768
- C:\Windows\System\KnFcrEn.exe
  C:\Windows\System\KnFcrEn.exe
  2⤵
  PID:220
- C:\Windows\System\VEJpNlG.exe
  C:\Windows\System\VEJpNlG.exe
  2⤵
  PID:4908
- C:\Windows\System\sIdcoze.exe
  C:\Windows\System\sIdcoze.exe
  2⤵
  PID:3704
- C:\Windows\System\JsFXgMn.exe
  C:\Windows\System\JsFXgMn.exe
  2⤵
  PID:2244
- C:\Windows\System\VGhReDm.exe
  C:\Windows\System\VGhReDm.exe
  2⤵
  PID:14084
- C:\Windows\System\iSMGzNx.exe
  C:\Windows\System\iSMGzNx.exe
  2⤵
  PID:14092
- C:\Windows\System\hJZarmV.exe
  C:\Windows\System\hJZarmV.exe
  2⤵
  PID:14188
- C:\Windows\System\nZeJvKb.exe
  C:\Windows\System\nZeJvKb.exe
  2⤵
  PID:14224
- C:\Windows\System\KZPTUaY.exe
  C:\Windows\System\KZPTUaY.exe
  2⤵
  PID:14280
- C:\Windows\System\wzmjWdx.exe
  C:\Windows\System\wzmjWdx.exe
  2⤵
  PID:14320
- C:\Windows\System\tNHpBZy.exe
  C:\Windows\System\tNHpBZy.exe
  2⤵
  PID:14324
- C:\Windows\System\hLewAMJ.exe
  C:\Windows\System\hLewAMJ.exe
  2⤵
  PID:1168
- C:\Windows\System\JQwEztC.exe
  C:\Windows\System\JQwEztC.exe
  2⤵
  PID:64
- C:\Windows\System\eiTEshk.exe
  C:\Windows\System\eiTEshk.exe
  2⤵
  PID:3456
- C:\Windows\System\fCvZjJq.exe
  C:\Windows\System\fCvZjJq.exe
  2⤵
  PID:4464
- C:\Windows\System\jiVmDGB.exe
  C:\Windows\System\jiVmDGB.exe
  2⤵
  PID:13444
- C:\Windows\System\AxNRDtJ.exe
  C:\Windows\System\AxNRDtJ.exe
  2⤵
  PID:13988
- C:\Windows\System\iXMLNAS.exe
  C:\Windows\System\iXMLNAS.exe
  2⤵
  PID:13676
- C:\Windows\System\DksUlvr.exe
  C:\Windows\System\DksUlvr.exe
  2⤵
  PID:13740
- C:\Windows\System\GfFtfJJ.exe
  C:\Windows\System\GfFtfJJ.exe
  2⤵
  PID:13720
- C:\Windows\System\mxYvvzd.exe
  C:\Windows\System\mxYvvzd.exe
  2⤵
  PID:13632
- C:\Windows\System\FTLZAja.exe
  C:\Windows\System\FTLZAja.exe
  2⤵
  PID:4324
- C:\Windows\System\NMFeREy.exe
  C:\Windows\System\NMFeREy.exe
  2⤵
  PID:13824
- C:\Windows\System\NdpHrwU.exe
  C:\Windows\System\NdpHrwU.exe
  2⤵
  PID:3544
- C:\Windows\System\ixYzBqN.exe
  C:\Windows\System\ixYzBqN.exe
  2⤵
  PID:4012
- C:\Windows\System\dZqioho.exe
  C:\Windows\System\dZqioho.exe
  2⤵
  PID:844
- C:\Windows\System\JrHFwrL.exe
  C:\Windows\System\JrHFwrL.exe
  2⤵
  PID:13956
- C:\Windows\System\sgDvCEg.exe
  C:\Windows\System\sgDvCEg.exe
  2⤵
  PID:14004
- C:\Windows\System\dAygQWA.exe
  C:\Windows\System\dAygQWA.exe
  2⤵
  PID:1648
- C:\Windows\System\SGQVpxm.exe
  C:\Windows\System\SGQVpxm.exe
  2⤵
  PID:552
- C:\Windows\System\xjVnbQI.exe
  C:\Windows\System\xjVnbQI.exe
  2⤵
  PID:4580
- C:\Windows\System\oiOYYZQ.exe
  C:\Windows\System\oiOYYZQ.exe
  2⤵
  PID:312
- C:\Windows\System\VNqGqlj.exe
  C:\Windows\System\VNqGqlj.exe
  2⤵
  PID:14052
- C:\Windows\System\LzIrnws.exe
  C:\Windows\System\LzIrnws.exe
  2⤵
  PID:14228
- C:\Windows\System\vYLdzdd.exe
  C:\Windows\System\vYLdzdd.exe
  2⤵
  PID:14148
- C:\Windows\System\lEyMqUz.exe
  C:\Windows\System\lEyMqUz.exe
  2⤵
  PID:3332
- C:\Windows\System\IVbaPZB.exe
  C:\Windows\System\IVbaPZB.exe
  2⤵
  PID:14312
- C:\Windows\System\pIskGLE.exe
  C:\Windows\System\pIskGLE.exe
  2⤵
  PID:5128
- C:\Windows\System\NlXMPQt.exe
  C:\Windows\System\NlXMPQt.exe
  2⤵
  PID:5160
- C:\Windows\System\fQrOEsF.exe
  C:\Windows\System\fQrOEsF.exe
  2⤵
  PID:11724
- C:\Windows\System\ZsBjhAQ.exe
  C:\Windows\System\ZsBjhAQ.exe
  2⤵
  PID:1048
- C:\Windows\System\uGtNlHM.exe
  C:\Windows\System\uGtNlHM.exe
  2⤵
  PID:13448
- C:\Windows\System\LpOKyIi.exe
  C:\Windows\System\LpOKyIi.exe
  2⤵
  PID:3364
- C:\Windows\System\CgsJPOX.exe
  C:\Windows\System\CgsJPOX.exe
  2⤵
  PID:5256
- C:\Windows\System\zMLvlyE.exe
  C:\Windows\System\zMLvlyE.exe
  2⤵
  PID:3940
- C:\Windows\System\ngdXnUN.exe
  C:\Windows\System\ngdXnUN.exe
  2⤵
  PID:4680
- C:\Windows\System\JLpPqSQ.exe
  C:\Windows\System\JLpPqSQ.exe
  2⤵
  PID:13664
- C:\Windows\System\UHiQgPA.exe
  C:\Windows\System\UHiQgPA.exe
  2⤵
  PID:4160
- C:\Windows\System\nTCzmmF.exe
  C:\Windows\System\nTCzmmF.exe
  2⤵
  PID:5320
- C:\Windows\System\sUiNFRe.exe
  C:\Windows\System\sUiNFRe.exe
  2⤵
  PID:5640
- C:\Windows\System\BqRTJUJ.exe
  C:\Windows\System\BqRTJUJ.exe
  2⤵
  PID:5704
- C:\Windows\System\LCMmCXG.exe
  C:\Windows\System\LCMmCXG.exe
  2⤵
  PID:13992
- C:\Windows\System\yARevqz.exe
  C:\Windows\System\yARevqz.exe
  2⤵
  PID:2300
- C:\Windows\System\NJvPJhd.exe
  C:\Windows\System\NJvPJhd.exe
  2⤵
  PID:13972
- C:\Windows\System\RwNCqOL.exe
  C:\Windows\System\RwNCqOL.exe
  2⤵
  PID:5820
- C:\Windows\System\PHVukSZ.exe
  C:\Windows\System\PHVukSZ.exe
  2⤵
  PID:6780
- C:\Windows\System\hNGAGmp.exe
  C:\Windows\System\hNGAGmp.exe
  2⤵
  PID:1320
- C:\Windows\System\DPkZJWN.exe
  C:\Windows\System\DPkZJWN.exe
  2⤵
  PID:3964
- C:\Windows\System\kKpBfpE.exe
  C:\Windows\System\kKpBfpE.exe
  2⤵
  PID:1616
- C:\Windows\System\UptyiyT.exe
  C:\Windows\System\UptyiyT.exe
  2⤵
  PID:1956
- C:\Windows\System\PoWUObW.exe
  C:\Windows\System\PoWUObW.exe
  2⤵
  PID:13072
- C:\Windows\System\gMLcWXI.exe
  C:\Windows\System\gMLcWXI.exe
  2⤵
  PID:3728
- C:\Windows\System\gLCpQUk.exe
  C:\Windows\System\gLCpQUk.exe
  2⤵
  PID:11984
- C:\Windows\System\lxbwSkK.exe
  C:\Windows\System\lxbwSkK.exe
  2⤵
  PID:4976
- C:\Windows\System\vqyzRll.exe
  C:\Windows\System\vqyzRll.exe
  2⤵
  PID:13464
- C:\Windows\System\FcYrtfx.exe
  C:\Windows\System\FcYrtfx.exe
  2⤵
  PID:13648
- C:\Windows\System\tOsYluG.exe
  C:\Windows\System\tOsYluG.exe
  2⤵
  PID:6624
- C:\Windows\System\fAQHUnr.exe
  C:\Windows\System\fAQHUnr.exe
  2⤵
  PID:7072
- C:\Windows\System\ljuKhcs.exe
  C:\Windows\System\ljuKhcs.exe
  2⤵
  PID:7008
- C:\Windows\System\vALljDR.exe
  C:\Windows\System\vALljDR.exe
  2⤵
  PID:3692
- C:\Windows\System\DfxEmoE.exe
  C:\Windows\System\DfxEmoE.exe
  2⤵
  PID:3280
- C:\Windows\System\pOTleuN.exe
  C:\Windows\System\pOTleuN.exe
  2⤵
  PID:2484
- C:\Windows\System\WZFomkd.exe
  C:\Windows\System\WZFomkd.exe
  2⤵
  PID:1360
- C:\Windows\System\HqwkSuC.exe
  C:\Windows\System\HqwkSuC.exe
  2⤵
  PID:5596
- C:\Windows\System\phWhxTo.exe
  C:\Windows\System\phWhxTo.exe
  2⤵
  PID:5792
- C:\Windows\System\GicqPdP.exe
  C:\Windows\System\GicqPdP.exe
  2⤵
  PID:4452
- C:\Windows\System\iyTISua.exe
  C:\Windows\System\iyTISua.exe
  2⤵
  PID:14016
- C:\Windows\System\tkJsWcz.exe
  C:\Windows\System\tkJsWcz.exe
  2⤵
  PID:5576
- C:\Windows\System\WHlOsji.exe
  C:\Windows\System\WHlOsji.exe
  2⤵
  PID:4900
- C:\Windows\System\ZlEhYkR.exe
  C:\Windows\System\ZlEhYkR.exe
  2⤵
  PID:3300
- C:\Windows\System\fBwllYI.exe
  C:\Windows\System\fBwllYI.exe
  2⤵
  PID:2912
- C:\Windows\System\JgQSrwY.exe
  C:\Windows\System\JgQSrwY.exe
  2⤵
  PID:6884
- C:\Windows\System\EtsTsim.exe
  C:\Windows\System\EtsTsim.exe
  2⤵
  PID:2220
- C:\Windows\System\XvHhwcS.exe
  C:\Windows\System\XvHhwcS.exe
  2⤵
  PID:14096
- C:\Windows\System\WBJWVzD.exe
  C:\Windows\System\WBJWVzD.exe
  2⤵
  PID:3912
- C:\Windows\System\ZbgskQD.exe
  C:\Windows\System\ZbgskQD.exe
  2⤵
  PID:10144
- C:\Windows\System\wNTuciy.exe
  C:\Windows\System\wNTuciy.exe
  2⤵
  PID:13364
- C:\Windows\System\yJiedJF.exe
  C:\Windows\System\yJiedJF.exe
  2⤵
  PID:14288
- C:\Windows\System\rSPIqmb.exe
  C:\Windows\System\rSPIqmb.exe
  2⤵
  PID:3784
- C:\Windows\System\uxQvFTi.exe
  C:\Windows\System\uxQvFTi.exe
  2⤵
  PID:6384
- C:\Windows\System\tYQOgWy.exe
  C:\Windows\System\tYQOgWy.exe
  2⤵
  PID:6348
- C:\Windows\System\AJFSMzB.exe
  C:\Windows\System\AJFSMzB.exe
  2⤵
  PID:5664
- C:\Windows\System\acRBFRu.exe
  C:\Windows\System\acRBFRu.exe
  2⤵
  PID:7068
- C:\Windows\System\GVjCvBw.exe
  C:\Windows\System\GVjCvBw.exe
  2⤵
  PID:8172
- C:\Windows\System\GYigWmx.exe
  C:\Windows\System\GYigWmx.exe
  2⤵
  PID:5448
- C:\Windows\System\vWHswVQ.exe
  C:\Windows\System\vWHswVQ.exe
  2⤵
  PID:13728
- C:\Windows\System\hdilKhw.exe
  C:\Windows\System\hdilKhw.exe
  2⤵
  PID:7180
- C:\Windows\System\PcRZFUJ.exe
  C:\Windows\System\PcRZFUJ.exe
  2⤵
  PID:5836
- C:\Windows\System\jrtRUOY.exe
  C:\Windows\System\jrtRUOY.exe
  2⤵
  PID:3696
- C:\Windows\System\WrstiGn.exe
  C:\Windows\System\WrstiGn.exe
  2⤵
  PID:5980
- C:\Windows\System\eVHoHSf.exe
  C:\Windows\System\eVHoHSf.exe
  2⤵
  PID:5736
- C:\Windows\System\IzhzRcY.exe
  C:\Windows\System\IzhzRcY.exe
  2⤵
  PID:7384
- C:\Windows\System\gjlWELe.exe
  C:\Windows\System\gjlWELe.exe
  2⤵
  PID:8224
- C:\Windows\System\imuaKUH.exe
  C:\Windows\System\imuaKUH.exe
  2⤵
  PID:7528
- C:\Windows\System\hjnujjz.exe
  C:\Windows\System\hjnujjz.exe
  2⤵
  PID:5856
- C:\Windows\System\PjQsdvu.exe
  C:\Windows\System\PjQsdvu.exe
  2⤵
  PID:5828
- C:\Windows\System\StTgrGe.exe
  C:\Windows\System\StTgrGe.exe
  2⤵
  PID:7616
- C:\Windows\System\kIwDdGU.exe
  C:\Windows\System\kIwDdGU.exe
  2⤵
  PID:4992
- C:\Windows\System\iCsneSa.exe
  C:\Windows\System\iCsneSa.exe
  2⤵
  PID:7884
- C:\Windows\System\NyzSSnK.exe
  C:\Windows\System\NyzSSnK.exe
  2⤵
  PID:2640
- C:\Windows\System\QjDxjfk.exe
  C:\Windows\System\QjDxjfk.exe
  2⤵
  PID:13608
- C:\Windows\System\WCKNOuF.exe
  C:\Windows\System\WCKNOuF.exe
  2⤵
  PID:1364
- C:\Windows\System\RZIHbgf.exe
  C:\Windows\System\RZIHbgf.exe
  2⤵
  PID:4916
- C:\Windows\System\AuXvlLq.exe
  C:\Windows\System\AuXvlLq.exe
  2⤵
  PID:8144
- C:\Windows\System\NGYqrCv.exe
  C:\Windows\System\NGYqrCv.exe
  2⤵
  PID:5976
- C:\Windows\System\iGVHDjE.exe
  C:\Windows\System\iGVHDjE.exe
  2⤵
  PID:10460
- C:\Windows\System\BvOCBCd.exe
  C:\Windows\System\BvOCBCd.exe
  2⤵
  PID:8408
- C:\Windows\System\yCyTsUd.exe
  C:\Windows\System\yCyTsUd.exe
  2⤵
  PID:7376
- C:\Windows\System\NyIeXix.exe
  C:\Windows\System\NyIeXix.exe
  2⤵
  PID:13672
- C:\Windows\System\DtouNGJ.exe
  C:\Windows\System\DtouNGJ.exe
  2⤵
  PID:8252
- C:\Windows\System\RmdEwas.exe
  C:\Windows\System\RmdEwas.exe
  2⤵
  PID:5388
- C:\Windows\System\PJVHyvA.exe
  C:\Windows\System\PJVHyvA.exe
  2⤵
  PID:9420
- C:\Windows\System\kouwgxx.exe
  C:\Windows\System\kouwgxx.exe
  2⤵
  PID:8984
- C:\Windows\System\dyFkWXC.exe
  C:\Windows\System\dyFkWXC.exe
  2⤵
  PID:6844
- C:\Windows\System\RwHJlsb.exe
  C:\Windows\System\RwHJlsb.exe
  2⤵
  PID:5712
- C:\Windows\System\bOqvRMw.exe
  C:\Windows\System\bOqvRMw.exe
  2⤵
  PID:8748
- C:\Windows\System\oPuvnDt.exe
  C:\Windows\System\oPuvnDt.exe
  2⤵
  PID:8768
- C:\Windows\System\QlJeXQT.exe
  C:\Windows\System\QlJeXQT.exe
  2⤵
  PID:6964
- C:\Windows\System\xoZhJYG.exe
  C:\Windows\System\xoZhJYG.exe
  2⤵
  PID:6604
- C:\Windows\System\OmjMxcB.exe
  C:\Windows\System\OmjMxcB.exe
  2⤵
  PID:5552
- C:\Windows\System\XntRYep.exe
  C:\Windows\System\XntRYep.exe
  2⤵
  PID:8588
- C:\Windows\System\zOuqsRg.exe
  C:\Windows\System\zOuqsRg.exe
  2⤵
  PID:7996
- C:\Windows\System\yKGhEsb.exe
  C:\Windows\System\yKGhEsb.exe
  2⤵
  PID:6372
- C:\Windows\System\hdGUhIg.exe
  C:\Windows\System\hdGUhIg.exe
  2⤵
  PID:10304
- C:\Windows\System\qGJFBew.exe
  C:\Windows\System\qGJFBew.exe
  2⤵
  PID:13932
- C:\Windows\System\GyECrty.exe
  C:\Windows\System\GyECrty.exe
  2⤵
  PID:9748
- C:\Windows\System\GkgVxYe.exe
  C:\Windows\System\GkgVxYe.exe
  2⤵
  PID:10316
- C:\Windows\System\jiyciCV.exe
  C:\Windows\System\jiyciCV.exe
  2⤵
  PID:12476
- C:\Windows\System\kJbCsOa.exe
  C:\Windows\System\kJbCsOa.exe
  2⤵
  PID:9988
- C:\Windows\System\hKGfgDP.exe
  C:\Windows\System\hKGfgDP.exe
  2⤵
  PID:9876
- C:\Windows\System\ipqzRcn.exe
  C:\Windows\System\ipqzRcn.exe
  2⤵
  PID:9904
- C:\Windows\System\glUFbhp.exe
  C:\Windows\System\glUFbhp.exe
  2⤵
  PID:7276
- C:\Windows\System\XqWqGgX.exe
  C:\Windows\System\XqWqGgX.exe
  2⤵
  PID:4212
- C:\Windows\System\PnVtroU.exe
  C:\Windows\System\PnVtroU.exe
  2⤵
  PID:10380
- C:\Windows\System\bBNpZtq.exe
  C:\Windows\System\bBNpZtq.exe
  2⤵
  PID:8632
- C:\Windows\System\SHmUdHG.exe
  C:\Windows\System\SHmUdHG.exe
  2⤵
  PID:8320
- C:\Windows\System\CvxOCDv.exe
  C:\Windows\System\CvxOCDv.exe
  2⤵
  PID:10408
- C:\Windows\System\liknIbI.exe
  C:\Windows\System\liknIbI.exe
  2⤵
  PID:5924
- C:\Windows\System\YKmWfbN.exe
  C:\Windows\System\YKmWfbN.exe
  2⤵
  PID:9512
- C:\Windows\System\QelFXOn.exe
  C:\Windows\System\QelFXOn.exe
  2⤵
  PID:10420
- C:\Windows\System\RHQyLza.exe
  C:\Windows\System\RHQyLza.exe
  2⤵
  PID:8832
- C:\Windows\System\AWwCAEB.exe
  C:\Windows\System\AWwCAEB.exe
  2⤵
  PID:10456
- C:\Windows\System\wicylfz.exe
  C:\Windows\System\wicylfz.exe
  2⤵
  PID:5352
- C:\Windows\System\NeMePsC.exe
  C:\Windows\System\NeMePsC.exe
  2⤵
  PID:8672
- C:\Windows\System\mJubRjg.exe
  C:\Windows\System\mJubRjg.exe
  2⤵
  PID:7836
- C:\Windows\System\XTKgSGr.exe
  C:\Windows\System\XTKgSGr.exe
  2⤵
  PID:12796
- C:\Windows\System\CYTNuYZ.exe
  C:\Windows\System\CYTNuYZ.exe
  2⤵
  PID:5668
- C:\Windows\System\JknLifi.exe
  C:\Windows\System\JknLifi.exe
  2⤵
  PID:9468
- C:\Windows\System\mjqXJFk.exe
  C:\Windows\System\mjqXJFk.exe
  2⤵
  PID:10968
- C:\Windows\System\rBNUvOX.exe
  C:\Windows\System\rBNUvOX.exe
  2⤵
  PID:10640
- C:\Windows\System\sJPkGyx.exe
  C:\Windows\System\sJPkGyx.exe
  2⤵
  PID:9328
- C:\Windows\System\RqiZXrY.exe
  C:\Windows\System\RqiZXrY.exe
  2⤵
  PID:9920
- C:\Windows\System\GisGSmb.exe
  C:\Windows\System\GisGSmb.exe
  2⤵
  PID:10980
- C:\Windows\System\NEGNiwt.exe
  C:\Windows\System\NEGNiwt.exe
  2⤵
  PID:10824
- C:\Windows\System\zzykaev.exe
  C:\Windows\System\zzykaev.exe
  2⤵
  PID:11004
- C:\Windows\System\oGTfiXD.exe
  C:\Windows\System\oGTfiXD.exe
  2⤵
  PID:10544
- C:\Windows\System\NXmhxfV.exe
  C:\Windows\System\NXmhxfV.exe
  2⤵
  PID:8644
- C:\Windows\System\KtKjOtr.exe
  C:\Windows\System\KtKjOtr.exe
  2⤵
  PID:10916
- C:\Windows\System\BGXCcLB.exe
  C:\Windows\System\BGXCcLB.exe
  2⤵
  PID:5412
- C:\Windows\System\CvpZRHt.exe
  C:\Windows\System\CvpZRHt.exe
  2⤵
  PID:10648
- C:\Windows\System\CVMjDfO.exe
  C:\Windows\System\CVMjDfO.exe
  2⤵
  PID:10452
- C:\Windows\System\UlfsXlG.exe
  C:\Windows\System\UlfsXlG.exe
  2⤵
  PID:7844
- C:\Windows\System\buwtTpy.exe
  C:\Windows\System\buwtTpy.exe
  2⤵
  PID:7824
- C:\Windows\System\YbDJApZ.exe
  C:\Windows\System\YbDJApZ.exe
  2⤵
  PID:12952
- C:\Windows\System\gMbSVMq.exe
  C:\Windows\System\gMbSVMq.exe
  2⤵
  PID:13976
- C:\Windows\System\UUjUmDe.exe
  C:\Windows\System\UUjUmDe.exe
  2⤵
  PID:7016
- C:\Windows\System\CTXPnbA.exe
  C:\Windows\System\CTXPnbA.exe
  2⤵
  PID:10656
- C:\Windows\System\WxkIycL.exe
  C:\Windows\System\WxkIycL.exe
  2⤵
  PID:7328
- C:\Windows\System\kpLCUBE.exe
  C:\Windows\System\kpLCUBE.exe
  2⤵
  PID:10360
- C:\Windows\System\gHCHEyb.exe
  C:\Windows\System\gHCHEyb.exe
  2⤵
  PID:3680
- C:\Windows\System\ijysoFM.exe
  C:\Windows\System\ijysoFM.exe
  2⤵
  PID:968
- C:\Windows\System\vTKTdGF.exe
  C:\Windows\System\vTKTdGF.exe
  2⤵
  PID:11016
- C:\Windows\System\wNTRgJc.exe
  C:\Windows\System\wNTRgJc.exe
  2⤵
  PID:9612
- C:\Windows\System\SkpWzbk.exe
  C:\Windows\System\SkpWzbk.exe
  2⤵
  PID:8732
- C:\Windows\System\CSisMIG.exe
  C:\Windows\System\CSisMIG.exe
  2⤵
  PID:9928
- C:\Windows\System\pVRgIAg.exe
  C:\Windows\System\pVRgIAg.exe
  2⤵
  PID:10076
- C:\Windows\System\pQUHDjQ.exe
  C:\Windows\System\pQUHDjQ.exe
  2⤵
  PID:8864
- C:\Windows\System\JVYBeUD.exe
  C:\Windows\System\JVYBeUD.exe
  2⤵
  PID:11188
- C:\Windows\System\ZhXMIZd.exe
  C:\Windows\System\ZhXMIZd.exe
  2⤵
  PID:9536
- C:\Windows\System\LJzOGPz.exe
  C:\Windows\System\LJzOGPz.exe
  2⤵
  PID:9324
- C:\Windows\System\ntJPFgo.exe
  C:\Windows\System\ntJPFgo.exe
  2⤵
  PID:8240
- C:\Windows\System\LQTwTDQ.exe
  C:\Windows\System\LQTwTDQ.exe
  2⤵
  PID:10320
- C:\Windows\System\DlUlnQO.exe
  C:\Windows\System\DlUlnQO.exe
  2⤵
  PID:12976
- C:\Windows\System\xllsdRm.exe
  C:\Windows\System\xllsdRm.exe
  2⤵
  PID:11788
- C:\Windows\System\JsruNtH.exe
  C:\Windows\System\JsruNtH.exe
  2⤵
  PID:11800
- C:\Windows\System\xdorQby.exe
  C:\Windows\System\xdorQby.exe
  2⤵
  PID:13176
- C:\Windows\System\RfdaYYb.exe
  C:\Windows\System\RfdaYYb.exe
  2⤵
  PID:10012
- C:\Windows\System\Smzgxtj.exe
  C:\Windows\System\Smzgxtj.exe
  2⤵
  PID:12864
- C:\Windows\System\AuDYMXN.exe
  C:\Windows\System\AuDYMXN.exe
  2⤵
  PID:9460
- C:\Windows\System\IHLrvIW.exe
  C:\Windows\System\IHLrvIW.exe
  2⤵
  PID:11012
- C:\Windows\System\OHsobRC.exe
  C:\Windows\System\OHsobRC.exe
  2⤵
  PID:13208
- C:\Windows\System\NQrGDKE.exe
  C:\Windows\System\NQrGDKE.exe
  2⤵
  PID:13212
- C:\Windows\System\cNxsAXD.exe
  C:\Windows\System\cNxsAXD.exe
  2⤵
  PID:12212
- C:\Windows\System\qdqHYgX.exe
  C:\Windows\System\qdqHYgX.exe
  2⤵
  PID:11408
- C:\Windows\System\MCPlYYx.exe
  C:\Windows\System\MCPlYYx.exe
  2⤵
  PID:7840
- C:\Windows\System\mCUbZvi.exe
  C:\Windows\System\mCUbZvi.exe
  2⤵
  PID:7980
- C:\Windows\System\zmqQkdF.exe
  C:\Windows\System\zmqQkdF.exe
  2⤵
  PID:10568
- C:\Windows\System\GteGEqP.exe
  C:\Windows\System\GteGEqP.exe
  2⤵
  PID:13256
- C:\Windows\System\ntbFczT.exe
  C:\Windows\System\ntbFczT.exe
  2⤵
  PID:12444
- C:\Windows\System\VoUYfph.exe
  C:\Windows\System\VoUYfph.exe
  2⤵
  PID:12540
- C:\Windows\System\wHPemBA.exe
  C:\Windows\System\wHPemBA.exe
  2⤵
  PID:9176
- C:\Windows\System\qRoYxSE.exe
  C:\Windows\System\qRoYxSE.exe
  2⤵
  PID:10392
- C:\Windows\System\kZqOySY.exe
  C:\Windows\System\kZqOySY.exe
  2⤵
  PID:12656
- C:\Windows\System\MxkOzjz.exe
  C:\Windows\System\MxkOzjz.exe
  2⤵
  PID:7372
- C:\Windows\System\JrZnCcn.exe
  C:\Windows\System\JrZnCcn.exe
  2⤵
  PID:10816
- C:\Windows\System\eGPLiUk.exe
  C:\Windows\System\eGPLiUk.exe
  2⤵
  PID:12972
- C:\Windows\System\FpVBeWz.exe
  C:\Windows\System\FpVBeWz.exe
  2⤵
  PID:6872
- C:\Windows\System\CsQckxb.exe
  C:\Windows\System\CsQckxb.exe
  2⤵
  PID:13236
- C:\Windows\System\uhJwBaN.exe
  C:\Windows\System\uhJwBaN.exe
  2⤵
  PID:10008
- C:\Windows\System\HiaANtC.exe
  C:\Windows\System\HiaANtC.exe
  2⤵
  PID:7184
- C:\Windows\System\zXJnbrB.exe
  C:\Windows\System\zXJnbrB.exe
  2⤵
  PID:12356
- C:\Windows\System\ReQVETL.exe
  C:\Windows\System\ReQVETL.exe
  2⤵
  PID:13308
- C:\Windows\System\wIQlAmb.exe
  C:\Windows\System\wIQlAmb.exe
  2⤵
  PID:12744
- C:\Windows\System\SQodYRB.exe
  C:\Windows\System\SQodYRB.exe
  2⤵
  PID:9632
- C:\Windows\System\oRpwvRN.exe
  C:\Windows\System\oRpwvRN.exe
  2⤵
  PID:12792
- C:\Windows\System\CCFMaVT.exe
  C:\Windows\System\CCFMaVT.exe
  2⤵
  PID:13200
- C:\Windows\System\CRNXLjI.exe
  C:\Windows\System\CRNXLjI.exe
  2⤵
  PID:11584
- C:\Windows\System\emTkuho.exe
  C:\Windows\System\emTkuho.exe
  2⤵
  PID:12768
- C:\Windows\System\xOFvWGP.exe
  C:\Windows\System\xOFvWGP.exe
  2⤵
  PID:12872
- C:\Windows\System\fNuHFzA.exe
  C:\Windows\System\fNuHFzA.exe
  2⤵
  PID:9684
- C:\Windows\System\UQOMSeV.exe
  C:\Windows\System\UQOMSeV.exe
  2⤵
  PID:10176
- C:\Windows\System\KLbdoHT.exe
  C:\Windows\System\KLbdoHT.exe
  2⤵
  PID:6188
- C:\Windows\System\JxzPOCr.exe
  C:\Windows\System\JxzPOCr.exe
  2⤵
  PID:14364
- C:\Windows\System\EgqkmPx.exe
  C:\Windows\System\EgqkmPx.exe
  2⤵
  PID:14392
- C:\Windows\System\mhCnkMQ.exe
  C:\Windows\System\mhCnkMQ.exe
  2⤵
  PID:14420
- C:\Windows\System\GhZbFci.exe
  C:\Windows\System\GhZbFci.exe
  2⤵
  PID:14452
- C:\Windows\System\mwPXYjH.exe
  C:\Windows\System\mwPXYjH.exe
  2⤵
  PID:14488
- C:\Windows\System\rQTBTwc.exe
  C:\Windows\System\rQTBTwc.exe
  2⤵
  PID:14504
- C:\Windows\System\DrfZDpp.exe
  C:\Windows\System\DrfZDpp.exe
  2⤵
  PID:14520
- C:\Windows\System\rmBjsuq.exe
  C:\Windows\System\rmBjsuq.exe
  2⤵
  PID:14536
- C:\Windows\System\MocchRx.exe
  C:\Windows\System\MocchRx.exe
  2⤵
  PID:14564
- C:\Windows\System\ubnkekN.exe
  C:\Windows\System\ubnkekN.exe
  2⤵
  PID:14616
- C:\Windows\System\sPEbbHw.exe
  C:\Windows\System\sPEbbHw.exe
  2⤵
  PID:14656
- C:\Windows\System\flWBZsT.exe
  C:\Windows\System\flWBZsT.exe
  2⤵
  PID:14688
- C:\Windows\System\Rkxkicw.exe
  C:\Windows\System\Rkxkicw.exe
  2⤵
  PID:14720
- C:\Windows\System\tILVpNY.exe
  C:\Windows\System\tILVpNY.exe
  2⤵
  PID:14748
- C:\Windows\System\kuFGNsw.exe
  C:\Windows\System\kuFGNsw.exe
  2⤵
  PID:14776
- C:\Windows\System\SeGnomL.exe
  C:\Windows\System\SeGnomL.exe
  2⤵
  PID:14808
- C:\Windows\System\nxslasD.exe
  C:\Windows\System\nxslasD.exe
  2⤵
  PID:14840
- C:\Windows\System\ZjRDVBy.exe
  C:\Windows\System\ZjRDVBy.exe
  2⤵
  PID:14868
- C:\Windows\System\KdUrQaO.exe
  C:\Windows\System\KdUrQaO.exe
  2⤵
  PID:14896
- C:\Windows\System\HSOVWlU.exe
  C:\Windows\System\HSOVWlU.exe
  2⤵
  PID:14924
- C:\Windows\System\zkKuXGf.exe
  C:\Windows\System\zkKuXGf.exe
  2⤵
  PID:14956
- C:\Windows\System\jLpSdvJ.exe
  C:\Windows\System\jLpSdvJ.exe
  2⤵
  PID:15008
- C:\Windows\System\YAIfIiw.exe
  C:\Windows\System\YAIfIiw.exe
  2⤵
  PID:15036
- C:\Windows\System\zqyDpzX.exe
  C:\Windows\System\zqyDpzX.exe
  2⤵
  PID:15072
- C:\Windows\System\sfRVAhp.exe
  C:\Windows\System\sfRVAhp.exe
  2⤵
  PID:15088
- C:\Windows\System\TmGehRU.exe
  C:\Windows\System\TmGehRU.exe
  2⤵
  PID:15104
- C:\Windows\System\HtiTxAU.exe
  C:\Windows\System\HtiTxAU.exe
  2⤵
  PID:15120
- C:\Windows\System\JuMzMYy.exe
  C:\Windows\System\JuMzMYy.exe
  2⤵
  PID:15136
- C:\Windows\System\nVHDzok.exe
  C:\Windows\System\nVHDzok.exe
  2⤵
  PID:15164
- C:\Windows\System\czQYHJU.exe
  C:\Windows\System\czQYHJU.exe
  2⤵
  PID:15216
- C:\Windows\System\cthCTXY.exe
  C:\Windows\System\cthCTXY.exe
  2⤵
  PID:15256
- C:\Windows\System\aWPlMOa.exe
  C:\Windows\System\aWPlMOa.exe
  2⤵
  PID:15296
- C:\Windows\System\OpFHjlx.exe
  C:\Windows\System\OpFHjlx.exe
  2⤵
  PID:15328
- C:\Windows\System\WAAPjGF.exe
  C:\Windows\System\WAAPjGF.exe
  2⤵
  PID:14352
- C:\Windows\System\zwgijSY.exe
  C:\Windows\System\zwgijSY.exe
  2⤵
  PID:14444
- C:\Windows\System\txSeIMF.exe
  C:\Windows\System\txSeIMF.exe
  2⤵
  PID:14496
- C:\Windows\System\IZgaPhg.exe
  C:\Windows\System\IZgaPhg.exe
  2⤵
  PID:14608
- C:\Windows\System\dLVNSnO.exe
  C:\Windows\System\dLVNSnO.exe
  2⤵
  PID:14716
- C:\Windows\System\kDdlGZQ.exe
  C:\Windows\System\kDdlGZQ.exe
  2⤵
  PID:14796
- C:\Windows\System\cipjzdQ.exe
  C:\Windows\System\cipjzdQ.exe
  2⤵
  PID:14892
- C:\Windows\System\KkCypnb.exe
  C:\Windows\System\KkCypnb.exe
  2⤵
  PID:14964
- C:\Windows\System\yWRzqwy.exe
  C:\Windows\System\yWRzqwy.exe
  2⤵
  PID:15004
- C:\Windows\System\aIaLsaQ.exe
  C:\Windows\System\aIaLsaQ.exe
  2⤵
  PID:15024
- C:\Windows\System\crTzmkc.exe
  C:\Windows\System\crTzmkc.exe
  2⤵
  PID:15080
- C:\Windows\System\eFZkEoN.exe
  C:\Windows\System\eFZkEoN.exe
  2⤵
  PID:15100
- C:\Windows\System\PEsoSQp.exe
  C:\Windows\System\PEsoSQp.exe
  2⤵
  PID:15204
- C:\Windows\System\Gdscldq.exe
  C:\Windows\System\Gdscldq.exe
  2⤵
  PID:15324
- C:\Windows\System\IWXAKCi.exe
  C:\Windows\System\IWXAKCi.exe
  2⤵
  PID:9924
- C:\Windows\System\CdQsxDi.exe
  C:\Windows\System\CdQsxDi.exe
  2⤵
  PID:11284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 6088 -ip 6088
1⤵
PID:11420

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 11968 -ip 11968
1⤵
PID:11468

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 740 -p 11876 -ip 11876
1⤵
PID:11704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 628 -p 11692 -ip 11692
1⤵
PID:12204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 736 -p 11652 -ip 11652
1⤵
PID:10200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 11604 -ip 11604
1⤵
PID:8872

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 8000 -ip 8000
1⤵
PID:7620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 644 -p 12624 -ip 12624
1⤵
PID:12376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 656 -p 9140 -ip 9140
1⤵
PID:12588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 684 -p 7572 -ip 7572
1⤵
PID:12680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 672 -p 9628 -ip 9628
1⤵
PID:12808

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugizwvps.vrh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AdHmRWP.exe

Filesize
2.3MB

MD5
d3caa861c6f290d61309d38600697594

SHA1
b1c0e23287177d099f20eab362f8982707327070

SHA256
426d02087af4f1bd4af4a616b535e3bbc4e821ae70ebe974f6677352efd49899

SHA512
298a433c62f208f0c55fee964b093d103e94ee73f5583ca866053f7a6af907fa4ef82a816d23e79e62e5c9b64f1c769b040ef040b0bfeb5082295c32672cfec2

Download Submit
C:\Windows\System\BFKaCYk.exe

Filesize
2.3MB

MD5
7b38bacaaf385d754678f52086e30bf1

SHA1
44b5175c6b925c4ac425d599afbf6e29b86c8b34

SHA256
2b52f1072cc6bc3279be81e78e13a5e5121786977c7c78b1531f4b465d9c43b3

SHA512
f5401ee95b63e8dcfde25d284b6d6a3c668f628b49f8d5ec763b863ad1dddce3205853d5b5b4ee0aa393a034486fbaf9799424f400bc3e1b57b5ed8de67b70a5

Download Submit
C:\Windows\System\CmMwELd.exe

Filesize
2.3MB

MD5
67de64deb802e525a644ccdafa14bdd0

SHA1
9e84d66ecfec300e265e5e57eb8d6133ce7913a2

SHA256
a632b4622b0652e6d0921b93aee324dab513aa362de0d61ba07e3f6ecfb69e9e

SHA512
bec637ed97b7687739b989c11b3f92a72742f664f6e10803ed6a1950500548d75d497bad2c2c071a659c775e6be532648d67a18145c7925c18e5c37685fc479a

Download Submit
C:\Windows\System\EsmOgep.exe

Filesize
2.3MB

MD5
ed345389c60db0ab3626d17dd1f47c1d

SHA1
dc2f4d8c784576a22dde0016db90f48eec4e03e5

SHA256
99151d98e74786872ce61acc611693e449407f3da8204ccc2b6be04fc3917ad0

SHA512
73be12c163f25e175de0891c026cd3cab37e3dcf4e3141cf19056c0603f92555a3f53209d4f7b5f3a60fef8680953fd67fe2b46bef029aff7f5b0b3e1cbf8f97

Download Submit
C:\Windows\System\HEjgVxU.exe

Filesize
2.3MB

MD5
8e452d52801583e3eecf83d4ffa927e9

SHA1
411c0f259524f2b986fc78540abd5d948960da5b

SHA256
52c3d8b1f5a43d4a8b2662051ef14a39001f23ac6d95adb7713fae8a6484e1ae

SHA512
4653b664d611a5883c8c16054ee57f44dc512a82d8bf0a3a5df6279d5f8244dfa5c245505961bd6e2ae4a05b8c199897aefacb759c6a2734de053c3d86f4da0e

Download Submit
C:\Windows\System\HbDsxvJ.exe

Filesize
2.3MB

MD5
83f462ce0e88e347d4bcf5aaca55d418

SHA1
1fcae49d17cbe44ac6116b6e725e18f16ae2484e

SHA256
4196833fd01489bb30be2c67e8716c44abea1739ff0187e6533e2cb21e2f9bcf

SHA512
1d5854b9ebebe7cc01a7e08aaeb7e262b4a0d8c8d390dd1c8e80428955c1eae79e03241a5fdfe81b09df9e35b9019776a217c9526f4a4d5011b6ace650667230

Download Submit
C:\Windows\System\LVMlsbF.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\LbhFSjM.exe

Filesize
2.3MB

MD5
0b44f5a6d44afd9ca614cdcace4a0a60

SHA1
c31a6ef701a02415d99ebd08a84de833b385c597

SHA256
2e33e28461e3b15255d863d2b931e6a6a26ccf5f83023335dddff71e41fa06ad

SHA512
92f390ddf4c8ee09c43bcb46a9de7ba760e12ea8ca3b75dbbce3a44d4f0bc39751d7325195c9bc9e65561730f7931bd1cd14c1b25c78dc474ee75bf146c07555

Download Submit
C:\Windows\System\QPCsypy.exe

Filesize
2.3MB

MD5
4a1f115422220c7a11e48773eeaaba73

SHA1
08f3a87e305508515c9d99e53135ae59151bc9ad

SHA256
f277ccde7e502726fd1c55b6a32a994cbd6d5a942c22b62074bfaee7926fdde3

SHA512
b085d606c48812e9c3d147ea369897069b8d64992288058f6d4724ed8ac44e2ef51d2743f08de8cb8aec19b5a9c4b25789e856e0f2c41e5f8188fce47c080a4b

Download Submit
C:\Windows\System\RREOhlm.exe

Filesize
2.3MB

MD5
c72dc5041cf78b5b40dcbaadd1ff8cf8

SHA1
58d2bd567d5cc6673274520eacec434b991605fe

SHA256
4e24c5f600ebfe6128d05a8779586def95af2ba61d3910f582b0ef6e4b8f76db

SHA512
608ab2f5e51c8ea3d24b003ded258f6ccb5113f388a15b64a2c7eab43d8b1915a5be842ea88f36ccef776430ce0517ade4139b9de920e79c824c6783af6e3d94

Download Submit
C:\Windows\System\RrTBbLq.exe

Filesize
2.3MB

MD5
1e76e2bdd19969ea6e2d5992bf49cb69

SHA1
4ec23960f915ce0d821edbb0745ccd7250fc1392

SHA256
1c32c85681a40a90801270e92029f531f84528cdb8b546a651a2b5d66f60da2d

SHA512
9f89290bdbfac55e89d81f724add7b4dd19be2b0834394962f9076637943b7e27a2ed5bffb766d47b7eebdfdd70860c406be034b33ef0eb6dd6e4ed278ed55fb

Download Submit
C:\Windows\System\UOyvPjK.exe

Filesize
2.3MB

MD5
2fe2a953aba20de65f8efc45a159782d

SHA1
2a9717460c44ef4745ba85a0b7562b7e586bad4b

SHA256
3d075920670569e65919eb144ac1dddec421ae648d8477e6b68f9205ec6fed48

SHA512
1758e3d8f04b9a534d2a4531e4aae9cafbe4816d728e0f467a87bcb115ef763fff6d08f63025d5a1bbd5282ea44923cba6661b701699d4f96862134bfcdfa52d

Download Submit
C:\Windows\System\UcpJzOa.exe

Filesize
2.3MB

MD5
b50527c53232cd411ea87ed5cbdbd0d5

SHA1
f41d48f4814c7a6c793e75f65294c5699e74f1b7

SHA256
6a7022aa326e30e76aa0c644b0a69919fbce73596251dec1e14a210bbbff7838

SHA512
a6aa63e353e08076a82632b814ae8386d4b2fac4fde191b3660a45551c696f4f8e979a00607d57265d1a94686e879fe63adc6fbb17766b6cd3f12e330bedd27d

Download Submit
C:\Windows\System\UmGncSU.exe

Filesize
2.3MB

MD5
0f9b8d26f381dcd70106f6975fce851f

SHA1
5ec407222f331976b0a7433a54d0b2a1e7ac118c

SHA256
3b28c65a877c7185e0b48aed9ad3a074635f87042a89722c3bad7c11a32d632f

SHA512
aabdc79e6ff73f194413ad8e4cfb23e43bf7e2a72032e9db1fcf4eeffe59990ca0e58380e881ad01fe72b8840fbca918fd7886140f8322201f0d4609fa6ab1e6

Download Submit
C:\Windows\System\VJVkGdy.exe

Filesize
2.3MB

MD5
b612f0e57fc1a0c689c49d1b34a8ef36

SHA1
cb5b2e94234b7a711bce559d7284f68acf5fd52e

SHA256
eb8e03b4cdb3b93f4827c962a5dc441f7baef9096eeff25719b23f8152f97a0d

SHA512
0c499c50a5ea94cad5dc57eea3cb1e8437886c5f470f245412c308366ee6e9c5dc7644757dad30234cf0f020cf0f5230dbd045956b424b7741373b698f4f5970

Download Submit
C:\Windows\System\VlAIbth.exe

Filesize
2.3MB

MD5
5667cf7f1c2bf87353f3d1343ec5e88b

SHA1
51b1fde4e257fc40435ef931ae5336cf495cdfea

SHA256
b1bd075d27e6364f1fb1124731722d3fb886f9083e02fc3114d3be5952475598

SHA512
d683a084233a7b3e4fc5e0eec3895168801216239538fd3d4ef8d227d0c3a47a6109136b3821e7db8e5428f6a416fc7576d182d5d314d800560ae82151d19d61

Download Submit
C:\Windows\System\VmsBLSG.exe

Filesize
2.3MB

MD5
01042da835789df704d90d586a56ab54

SHA1
2af54bc319373afbefdb62dd5b4409207ad022e3

SHA256
a511a4ee233e2a4a39a703d758bd0fefe5327ef7b840d8b7dd02f137119cadd7

SHA512
e211d3e3cc80a84d41b1850af2f0702eb8adaee84b6a0bea8f6725cf544bc180ace4a8e486cb0b20a348248073fe00a46a634c169b08c98c53665e3767c0e90f

Download Submit
C:\Windows\System\VonPvUU.exe

Filesize
2.3MB

MD5
195dda517281f5a657ddcf1b06cd7576

SHA1
c763e8d2955941598158a6e825059f7c6fec19e0

SHA256
3b85ceec5f82ce4e61c47744207dcb1d437d79e3b02896e2aa087178ad64b1c3

SHA512
7b39a56545b3215420aebcf4729cbccbe9e11e3d5573a93dd7044f5d22eabd59c6993fa52cb29c9b97a9f5fdaac6cff44c79bea8228fc26776260e9266a818e4

Download Submit
C:\Windows\System\YFnyEDG.exe

Filesize
2.3MB

MD5
5207891a4becb71bfca599eee83ab892

SHA1
3ac3a60d4f50d532cf691fd3b73962e741bbb288

SHA256
a41f76a68b4af427fb0c38c512da105689c9e85ceb674974aace91bd50dd72b5

SHA512
ab67a68d35f5cae627e25d21b314d4183224bd8dd81cc08593675b99b119e506c8e28dd722d9cd380562b06552aa83d7d63f51f8c1de44bbcf2f3c3bc373bb9a

Download Submit
C:\Windows\System\YVikrJV.exe

Filesize
2.3MB

MD5
8d48fe0a620aaeff8d6e4f8352bcfb1e

SHA1
19bd0f8d9452573762a279cf2dbf83027dcf4008

SHA256
01333bfa89952a96ab4c07aae7847ff1534c8a421933ca01651f9547c2c4c7ed

SHA512
0a9cb521f1ecebaf4a66a769374e161ac2b18bc215c10152283ef520b3eb4166ae37738753079b34daa89e6c28df072eaa50af97a2e3fc611a60a7d6c089b9ba

Download Submit
C:\Windows\System\YWQHFYg.exe

Filesize
2.3MB

MD5
3f9e07c98e9cebbdd6bc0a19b748a046

SHA1
f2e34e543708057a8cb5879f1b03801c1ecb7986

SHA256
fed461cb69a5542194af7b6e2879c01104e50a1c30d9746bfa953c1fd83b0383

SHA512
d377c74d2d4f0a015813fd94c56abb1b3afe899d340007d3f267291f399b2d795860be52b6f0625bd70b5f6bac29afe5c95d10e0409b03812c3eb5041302370d

Download Submit
C:\Windows\System\aBdFabv.exe

Filesize
2.3MB

MD5
1c0069a119121dcc915449ef2f0ab8cb

SHA1
781004a98e0c603727195112d72ff57cad79ff85

SHA256
3d7ee83e5c102d9b45d70d7bc959e8b796bc3634ade2f817e4282b5afd4b5c28

SHA512
c03085fec340abfebf57f1cf39674f655d5149baf0d4bdab9246dc7d92ee571fbaa8df8bf81e9b172c0da790228e354de8774336259bd76a34a2d3f2019e526c

Download Submit
C:\Windows\System\apRBpDb.exe

Filesize
2.3MB

MD5
044e81b23df2590911d8757ed0e0d342

SHA1
da40e0d2a63cc3a5e883dd813aff08c40ecedce0

SHA256
da49c409ae4f15d6b0f3b88e741d6bd1320510824a28ff4e53a7777523179112

SHA512
878480c67150ddf31fc89f97090000cbdb7888f2b56ee5d3da72fbd5dbb95f9db3bee92cc0490a399464014e5264b05cb09e54ae2850e3bc192b05bdcaa56675

Download Submit
C:\Windows\System\auvuYUe.exe

Filesize
2.3MB

MD5
ce641d6f97b03b20e118791f84cbfab3

SHA1
1c3feb827d6e50e40ce96d8b99d5fe1636e8d179

SHA256
b0fd0a05f3af2adf00103a199c8bdb4b05b1fa620a7a7747224d10625fc57a3b

SHA512
6773e58808fd0abdcf3b72c59903c605f31691d4188da7d57edc124fb520f93b5f795324a2306a2f603d6f0f937b4ba4208a4679cee0f02b2eae70a259fe3a96

Download Submit
C:\Windows\System\diaoVYv.exe

Filesize
2.3MB

MD5
6b07478620353e54b549af5a1415fc07

SHA1
9d6286e9afc5cdc0f0bdaf521ce6d745aa9a7646

SHA256
4a378fc43e3ba58bfd0de212c530878b0f5032b4c3cbf39e90d63a3cff3a1086

SHA512
c14cbd0758e5437306485e25932bf80a22adf9c23c9afa2aa24f6897d0140e26a39c17f3ed76212e9adee2a70e694b85f55a876997846881d0bf42712fd91a08

Download Submit
C:\Windows\System\doYcMXS.exe

Filesize
2.3MB

MD5
8b9cd5dab70f7b95c60884646a419f25

SHA1
1cb63bfb8bd3fbdf327e5056994cba7a8e81b211

SHA256
8e1413a4127f94ebaf9b99da8df6063a7b24525065b01ce5a5c9db7cb4db87d6

SHA512
d6a78999cb3398eb9e30d55cd225bd04dcb7f3606aeb3bae6bdf32f8c30088fcb5319e89f494291e79a2f85f50b0f7cb6a74e1526bf99fe5a9b9b71d0a1f9479

Download Submit
C:\Windows\System\fepeEtW.exe

Filesize
2.3MB

MD5
69f5e841ad5562c3ebf48ce5ba09f188

SHA1
f094dcf2b03042f7e7313de72905b21a0a7466d1

SHA256
222b6f620676c62c97750323bf60480dd35c685d7927b4272d4846933b2a6c1d

SHA512
3d57983b5adce6543f78ab622c06a8736832941075b03a794c4b023cd1179cac295b77f0b23685b7702bafc14e8d91fbfd14f3b9545bdd5e33e75ca00bf09bde

Download Submit
C:\Windows\System\muYcaZK.exe

Filesize
2.3MB

MD5
92b8cdb09aed2d7961e3b7ebd92d80c8

SHA1
945af5dff3c5117a259316ec081d73dbb009d7d4

SHA256
c011fb2a0fa08d56f3a7b6317c7c835ca44ac50addcb4304c92be307767583b5

SHA512
c13e38ff9dca72a782c6df1290652c37506aa25097172b4c2d57185a43089fcb84d0ea50fa95e7a468e8859a047ef44b29f12104f164b1f22df18501e7d3639f

Download Submit
C:\Windows\System\okDjNab.exe

Filesize
2.3MB

MD5
3a6103cef2a83591e38b934ee448623e

SHA1
d7b21609d3dc36f995010ce5b6da9d87be806485

SHA256
a24e48c96d7c16c09866c5ebb2b90629283347e53c3a9244b9c81b6b1459aa59

SHA512
caa77a10de4a4935f293bdc5756ecd598b965263f79ac191025e0a01f1f219c4fc0658455560ca7988b2bc1042f3a3d094a5502a8e5ffde083fd708fce5f0374

Download Submit
C:\Windows\System\qBhedTz.exe

Filesize
2.3MB

MD5
132742394557b9484294868b14fdbca9

SHA1
2567b806bd6d4696d0bfcd3971b9b2724f1d9f4c

SHA256
40d54191fbd489d95da671841d1c07b66c902de58d6a705d7e9409a4ccb6435f

SHA512
fb8032bf8bfeb65b43f496ea6bedf7d0dd00370ca6c9b30ddabd79afeebeb32ae64106c96237e745b34bf54f5122acc8b8b9b3db47b0372ea87c3f41ccce50ce

Download Submit
C:\Windows\System\qBhedTz.exe

Filesize
448KB

MD5
2264ad6cf2c3feda241e32c18cc63613

SHA1
6cf1d5079287ae747430510102276a5d8553f195

SHA256
aab1acd918f567ff34b418fd2971ffb7ad7f9284ea4d62c517c015f2e4f1d70f

SHA512
51d3f07b3e2d80ac627998a5fc071e41f8cd34e52e9d27ee547393019213fb2b53ce77d281d07d4df20e449416034194d3a784391c6fc788a552c1cba010098f

Download Submit
C:\Windows\System\qvdUUFV.exe

Filesize
2.3MB

MD5
30fda663c2795d76066d5b044d5f5dec

SHA1
6bedd7244134ee1b7d121bcd547df6f13fff5efa

SHA256
fd29c348a8935002f3c576e799dee1ce3f7f52f057270d77aaa86ee53db3c0b7

SHA512
ac99ec83bd9fa6a2966fd014b5260a53236dee67678a61ebf3a7a3860b192e5c1c8a7fbe2b2f52351dbb6dbb4d6f18504bc4eb349834a05cd57e622a5c522c00

Download Submit
C:\Windows\System\sAhaCAm.exe

Filesize
2.3MB

MD5
6b815a35721360d3ffdb9b673e05e46a

SHA1
2988d36ba63f929cbea209e4383a35cd716f8dc7

SHA256
c1268c1d25354604a06bfdefafd97b7dd9354d9b50f14d52b66b4526d9d97906

SHA512
5c9dfbb1609f8c992f06ba73486c55ab2c833be7f486c480c6321c942e72055035a220d6e3df272f9e98ea6c9c6d33debf92ffe6885d3ee664eba3cd95cb4696

Download Submit
C:\Windows\System\sUhtRZn.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\tOqQizK.exe

Filesize
2.3MB

MD5
823c5ab026e59438aa9b856e87def63b

SHA1
5161e2992b4a785af303211a2e14002b14526776

SHA256
8d95a47c034448965e1123b439d1d1c6934ee922fc690a0363d5a4f29305730b

SHA512
3713dd1f19ccdd087f7c71cd84a90d0171a690c45a0cc306e12ff401d405b8ac9ddc8508ef9712b38c9013164d780a3990ac3057928304b1e08456bedbc317ee

Download Submit
C:\Windows\System\teKkaRK.exe

Filesize
2.3MB

MD5
eb6f9c42ecd912908b63287a682a8c91

SHA1
58f979325401fe02bcc8aac35863b0fdbc8116bb

SHA256
d436012850b9825ee835a9f6d3bccaecd8d6566a217db76a1a5310138a27cfc9

SHA512
9368a8388b3e0b5fda267187ac364a8abab2d2807c7fadd9592e60892b769652de03e3967b7af5cfbaf6906c0743054d5bd3a8a14f8da48fdd9bb19d75ceeb2b

Download Submit
C:\Windows\System\vSsBlHJ.exe

Filesize
2.3MB

MD5
ee30b1d7919b22626f3ea32d4bda23f7

SHA1
a6a2f2130b0df6c90a637c70594c78d8a7ad37cf

SHA256
6db00a0ee204eeaf145fe991b4417712b798d0c2921d1f3f35ba05953944321a

SHA512
cc2005fff0ae0bea36724b8552a83392b67353a077b877677ef1b17819bbce7cef7f58348d5af7dda13b5a283ea8805f73de6bc29376c8b16f166a30a1a7f2ad

Download Submit
C:\Windows\System\vnWZdlP.exe

Filesize
2.3MB

MD5
a28ca0e2e799114670f3ad6a1acc77be

SHA1
b4f53446f9b7df970c3208823abb73a4f7d31c0e

SHA256
d6ec10ccb84826187f85bd43dc1201376d9e5acba0df52333dea2696434ed7d8

SHA512
87ee04a311bfc9a29b9d6fc51aaf53d986534c645e7bcde91dac971af96c2872917760c34a81720cc3ec6a6f0dde6854984128f97d64e2d9cd13cc808d5636e7

Download Submit
C:\Windows\System\vzsgxDp.exe

Filesize
2.3MB

MD5
b0e13f087ff05614e4e2da3decd46b01

SHA1
56b1062c0059a93722845bec61840c1679c5a4d3

SHA256
84cc08fb408fd79a9ac171be6fb711ebc2040b96686945b088c12b854e675c6c

SHA512
43743019114ce36b908c5c64b5db71f82ce264e157aa11dd71542dc151ecf5ea7344b2439f22a42895c9f26d7eebc2448ab98be46594404b498aadab9fe84cfc

Download Submit
C:\Windows\System\wgNIkiO.exe

Filesize
2.3MB

MD5
f0dc5600c12181066d35b3ca8e870a4b

SHA1
746fd6617b798f5d72add1caf49bb641b8d4f742

SHA256
cc9c21e2d96e23781711d2c7776df4ba22a94c2fb08b872a5e253974934317fe

SHA512
2452d9269e6c76416566376d9d7113444a5baf5ea3e6dd5b3b4052ef82a1b4734390e81e9507b3d44ec7502b314716c80860d245a704f8d7e1de0a8ac6b145b4

Download Submit
C:\Windows\System\yblzUcE.exe

Filesize
2.3MB

MD5
2e80cdb6ad4725d73f5982a066105fd7

SHA1
eeb2c6dfa11eaffcee2fcb67d794459d177d247b

SHA256
62d78d1e47fe74ec2e3bc000d866c8c0f74d06f04ebce08f4d72614bcf898e62

SHA512
30ee0d7d2af437427c30b347ef6f2e53f2e568190479008d9fd386752582c5953bd87c1ac5e3eb713fde5453cdddc75d80ea4a6b715f67471e84e97575c28211

Download Submit
memory/436-556-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp

Filesize
3.9MB

Download
memory/436-4413-0x00007FF7B9BA0000-0x00007FF7B9F92000-memory.dmp

Filesize
3.9MB

Download
memory/444-591-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp

Filesize
3.9MB

Download
memory/444-4390-0x00007FF7062B0000-0x00007FF7066A2000-memory.dmp

Filesize
3.9MB

Download
memory/960-592-0x00007FF728E20000-0x00007FF729212000-memory.dmp

Filesize
3.9MB

Download
memory/960-4406-0x00007FF728E20000-0x00007FF729212000-memory.dmp

Filesize
3.9MB

Download
memory/1084-4402-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp

Filesize
3.9MB

Download
memory/1084-589-0x00007FF641BA0000-0x00007FF641F92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-230-0x00007FF793580000-0x00007FF793972000-memory.dmp

Filesize
3.9MB

Download
memory/2036-4349-0x00007FF793580000-0x00007FF793972000-memory.dmp

Filesize
3.9MB

Download
memory/2068-883-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-4344-0x00007FF723FF0000-0x00007FF7243E2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-4370-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-886-0x00007FF7A6100000-0x00007FF7A64F2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-268-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp

Filesize
3.9MB

Download
memory/2592-4333-0x00007FF6CBA40000-0x00007FF6CBE32000-memory.dmp

Filesize
3.9MB

Download
memory/2664-136-0x00007FF6A8F10000-0x00007FF6A9302000-memory.dmp

Filesize
3.9MB

Download
memory/2664-4348-0x00007FF6A8F10000-0x00007FF6A9302000-memory.dmp

Filesize
3.9MB

Download
memory/2680-593-0x00007FFE0CA90000-0x00007FFE0D551000-memory.dmp

Filesize
10.8MB

Download
memory/2680-1855-0x00007FFE0CA90000-0x00007FFE0D551000-memory.dmp

Filesize
10.8MB

Download
memory/2680-71-0x00000229A7260000-0x00000229A7282000-memory.dmp

Filesize
136KB

Download
memory/2680-5-0x00007FFE0CA93000-0x00007FFE0CA95000-memory.dmp

Filesize
8KB

Download
memory/2680-34-0x00007FFE0CA90000-0x00007FFE0D551000-memory.dmp

Filesize
10.8MB

Download
memory/2696-4353-0x00007FF745380000-0x00007FF745772000-memory.dmp

Filesize
3.9MB

Download
memory/2696-755-0x00007FF745380000-0x00007FF745772000-memory.dmp

Filesize
3.9MB

Download
memory/2944-203-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-4379-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-119-0x00007FF6A2170000-0x00007FF6A2562000-memory.dmp

Filesize
3.9MB

Download
memory/3052-4301-0x00007FF6A2170000-0x00007FF6A2562000-memory.dmp

Filesize
3.9MB

Download
memory/3124-391-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-4374-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-588-0x00007FF73C850000-0x00007FF73CC42000-memory.dmp

Filesize
3.9MB

Download
memory/3128-4382-0x00007FF73C850000-0x00007FF73CC42000-memory.dmp

Filesize
3.9MB

Download
memory/3144-172-0x00007FF66D470000-0x00007FF66D862000-memory.dmp

Filesize
3.9MB

Download
memory/3180-4258-0x00007FF73EA20000-0x00007FF73EE12000-memory.dmp

Filesize
3.9MB

Download
memory/3180-58-0x00007FF73EA20000-0x00007FF73EE12000-memory.dmp

Filesize
3.9MB

Download
memory/3188-4364-0x00007FF647650000-0x00007FF647A42000-memory.dmp

Filesize
3.9MB

Download
memory/3188-342-0x00007FF647650000-0x00007FF647A42000-memory.dmp

Filesize
3.9MB

Download
memory/3272-4277-0x00007FF7AC1D0000-0x00007FF7AC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-97-0x00007FF7AC1D0000-0x00007FF7AC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-4419-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp

Filesize
3.9MB

Download
memory/3468-468-0x00007FF6806A0000-0x00007FF680A92000-memory.dmp

Filesize
3.9MB

Download
memory/4520-4416-0x00007FF73B170000-0x00007FF73B562000-memory.dmp

Filesize
3.9MB

Download
memory/4520-1018-0x00007FF73B170000-0x00007FF73B562000-memory.dmp

Filesize
3.9MB

Download
memory/4632-4268-0x00007FF772900000-0x00007FF772CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-89-0x00007FF772900000-0x00007FF772CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-0-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-1-0x000001FE240D0000-0x000001FE240E0000-memory.dmp

Filesize
64KB

Download
memory/4972-594-0x00007FF729B70000-0x00007FF729F62000-memory.dmp

Filesize
3.9MB

Download
memory/5012-590-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp

Filesize
3.9MB

Download
memory/5012-4385-0x00007FF7C9070000-0x00007FF7C9462000-memory.dmp

Filesize
3.9MB

Download
memory/5088-314-0x00007FF765010000-0x00007FF765402000-memory.dmp

Filesize
3.9MB

Download
memory/5088-4358-0x00007FF765010000-0x00007FF765402000-memory.dmp

Filesize
3.9MB

Download