xmrig | 3f73abce01fd4996f17671c8c4427f281818f9e890fca214a09bfd0176545d79

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00c159768dadac45afcc04f829277742_JaffaCakes118.exe
Size

1.8MB
MD5

00c159768dadac45afcc04f829277742
SHA1

87095e7e4bc26ebb7e1554f95b9eaf2ba6a97312
SHA256

3f73abce01fd4996f17671c8c4427f281818f9e890fca214a09bfd0176545d79
SHA512

c2c4a1931caf671e0182257729d9707cba8a9a9aee7f5c5ad17b443a60db090457b6f6d20f2340c88117717f5c652ff08bdce4c57050b28340d52ff095bdbbba
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pubHi:NAB5

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/4332-364-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp	xmrig
behavioral2/memory/4028-414-0x00007FF7E6D30000-0x00007FF7E7122000-memory.dmp	xmrig
behavioral2/memory/1476-419-0x00007FF65C8A0000-0x00007FF65CC92000-memory.dmp	xmrig
behavioral2/memory/3512-438-0x00007FF6A59B0000-0x00007FF6A5DA2000-memory.dmp	xmrig
behavioral2/memory/3636-443-0x00007FF71F250000-0x00007FF71F642000-memory.dmp	xmrig
behavioral2/memory/4864-448-0x00007FF7AB330000-0x00007FF7AB722000-memory.dmp	xmrig
behavioral2/memory/4216-511-0x00007FF685C10000-0x00007FF686002000-memory.dmp	xmrig
behavioral2/memory/1848-605-0x00007FF78FED0000-0x00007FF7902C2000-memory.dmp	xmrig
behavioral2/memory/3684-579-0x00007FF724C30000-0x00007FF725022000-memory.dmp	xmrig
behavioral2/memory/2552-475-0x00007FF6C43E0000-0x00007FF6C47D2000-memory.dmp	xmrig
behavioral2/memory/1556-449-0x00007FF66CE20000-0x00007FF66D212000-memory.dmp	xmrig
behavioral2/memory/3172-446-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/5040-445-0x00007FF649F30000-0x00007FF64A322000-memory.dmp	xmrig
behavioral2/memory/3060-444-0x00007FF731010000-0x00007FF731402000-memory.dmp	xmrig
behavioral2/memory/392-442-0x00007FF64F510000-0x00007FF64F902000-memory.dmp	xmrig
behavioral2/memory/1048-441-0x00007FF74AEA0000-0x00007FF74B292000-memory.dmp	xmrig
behavioral2/memory/1152-440-0x00007FF7B4D70000-0x00007FF7B5162000-memory.dmp	xmrig
behavioral2/memory/60-439-0x00007FF6C0E80000-0x00007FF6C1272000-memory.dmp	xmrig
behavioral2/memory/920-436-0x00007FF61AC70000-0x00007FF61B062000-memory.dmp	xmrig
behavioral2/memory/2744-432-0x00007FF7ABA20000-0x00007FF7ABE12000-memory.dmp	xmrig
behavioral2/memory/2476-282-0x00007FF606C30000-0x00007FF607022000-memory.dmp	xmrig
behavioral2/memory/3068-260-0x00007FF6743E0000-0x00007FF6747D2000-memory.dmp	xmrig
behavioral2/memory/752-23-0x00007FF6F44F0000-0x00007FF6F48E2000-memory.dmp	xmrig
behavioral2/memory/4216-3150-0x00007FF685C10000-0x00007FF686002000-memory.dmp	xmrig
behavioral2/memory/752-3151-0x00007FF6F44F0000-0x00007FF6F48E2000-memory.dmp	xmrig
behavioral2/memory/3056-3153-0x00007FF73DAB0000-0x00007FF73DEA2000-memory.dmp	xmrig
behavioral2/memory/3068-3158-0x00007FF6743E0000-0x00007FF6747D2000-memory.dmp	xmrig
behavioral2/memory/4028-3194-0x00007FF7E6D30000-0x00007FF7E7122000-memory.dmp	xmrig
behavioral2/memory/4332-3227-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp	xmrig
behavioral2/memory/3512-3249-0x00007FF6A59B0000-0x00007FF6A5DA2000-memory.dmp	xmrig
behavioral2/memory/60-3250-0x00007FF6C0E80000-0x00007FF6C1272000-memory.dmp	xmrig
behavioral2/memory/3172-3256-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/4864-3258-0x00007FF7AB330000-0x00007FF7AB722000-memory.dmp	xmrig
behavioral2/memory/5040-3255-0x00007FF649F30000-0x00007FF64A322000-memory.dmp	xmrig
behavioral2/memory/392-3252-0x00007FF64F510000-0x00007FF64F902000-memory.dmp	xmrig
behavioral2/memory/1848-3244-0x00007FF78FED0000-0x00007FF7902C2000-memory.dmp	xmrig
behavioral2/memory/920-3246-0x00007FF61AC70000-0x00007FF61B062000-memory.dmp	xmrig
behavioral2/memory/2744-3220-0x00007FF7ABA20000-0x00007FF7ABE12000-memory.dmp	xmrig
behavioral2/memory/2476-3218-0x00007FF606C30000-0x00007FF607022000-memory.dmp	xmrig
behavioral2/memory/1048-3271-0x00007FF74AEA0000-0x00007FF74B292000-memory.dmp	xmrig
behavioral2/memory/1556-3268-0x00007FF66CE20000-0x00007FF66D212000-memory.dmp	xmrig
behavioral2/memory/2552-3267-0x00007FF6C43E0000-0x00007FF6C47D2000-memory.dmp	xmrig
behavioral2/memory/3060-3263-0x00007FF731010000-0x00007FF731402000-memory.dmp	xmrig
behavioral2/memory/3636-3265-0x00007FF71F250000-0x00007FF71F642000-memory.dmp	xmrig
behavioral2/memory/1476-3216-0x00007FF65C8A0000-0x00007FF65CC92000-memory.dmp	xmrig
behavioral2/memory/1152-3214-0x00007FF7B4D70000-0x00007FF7B5162000-memory.dmp	xmrig
behavioral2/memory/3684-3188-0x00007FF724C30000-0x00007FF725022000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3112	powershell.exe
12	3112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
752	dPsUpnp.exe
4216	heXhYqm.exe
3056	zhsgUwp.exe
3684	FqWmNMS.exe
3068	DXcdJlY.exe
2476	AVeSpxQ.exe
4332	TOnLlXv.exe
4028	eWaDItg.exe
1848	YFSaTee.exe
1476	IZULHes.exe
2744	EnOSXWn.exe
920	xkqIXAA.exe
3512	ajKjWVz.exe
60	JTYcoaF.exe
1152	UHIGTRx.exe
1048	hmGvnok.exe
392	pMrLhgs.exe
3636	AKTlniP.exe
3060	uVXAWJI.exe
5040	vKghiFu.exe
3172	rVNzGNE.exe
4864	NMOtZyZ.exe
1556	sLyouEc.exe
2552	bLjipYW.exe
2900	VEdZHDn.exe
5004	lbupVRL.exe
5052	tOKqmef.exe
1512	lWYfcJy.exe
3544	ISySRnO.exe
4672	YKOcneD.exe
4624	AuZJpas.exe
1184	wufcXEM.exe
980	QAgQSLs.exe
3192	eRDSnum.exe
3624	WsTVRKX.exe
4832	kpzZAhC.exe
1752	qOSqIDV.exe
1652	efXTBeS.exe
2412	tlRYayA.exe
3408	dWzhXnH.exe
968	nXSlMgQ.exe
2432	WfilMhM.exe
3372	bnAmkNx.exe
4636	uTTVrcv.exe
4244	zIlMFXP.exe
4740	fvWGEmV.exe
4088	VtznqHl.exe
860	wGEBtuv.exe
220	QsDnBnS.exe
2164	OERIWUv.exe
212	UKjhRlq.exe
4836	oZYUpRJ.exe
4444	FhuBUap.exe
1232	ODhhgsW.exe
3456	gvNTdTW.exe
3616	INXyIgk.exe
552	jGGDXNl.exe
4468	uNtSvba.exe
3620	SPuwjoa.exe
4056	HrTwyVT.exe
4012	tstNbAZ.exe
884	vewypgu.exe
2120	vwCHnXz.exe
4276	sYCMZSV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3232-0-0x00007FF709800000-0x00007FF709BF2000-memory.dmp	upx
behavioral2/files/0x000700000002343b-8.dat	upx
behavioral2/files/0x0008000000023437-12.dat	upx
behavioral2/files/0x000700000002343c-25.dat	upx
behavioral2/files/0x000700000002343f-55.dat	upx
behavioral2/files/0x0007000000023448-75.dat	upx
behavioral2/memory/4332-364-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp	upx
behavioral2/memory/4028-414-0x00007FF7E6D30000-0x00007FF7E7122000-memory.dmp	upx
behavioral2/memory/1476-419-0x00007FF65C8A0000-0x00007FF65CC92000-memory.dmp	upx
behavioral2/memory/3512-438-0x00007FF6A59B0000-0x00007FF6A5DA2000-memory.dmp	upx
behavioral2/memory/3636-443-0x00007FF71F250000-0x00007FF71F642000-memory.dmp	upx
behavioral2/memory/4864-448-0x00007FF7AB330000-0x00007FF7AB722000-memory.dmp	upx
behavioral2/memory/4216-511-0x00007FF685C10000-0x00007FF686002000-memory.dmp	upx
behavioral2/memory/1848-605-0x00007FF78FED0000-0x00007FF7902C2000-memory.dmp	upx
behavioral2/memory/3684-579-0x00007FF724C30000-0x00007FF725022000-memory.dmp	upx
behavioral2/memory/2552-475-0x00007FF6C43E0000-0x00007FF6C47D2000-memory.dmp	upx
behavioral2/memory/1556-449-0x00007FF66CE20000-0x00007FF66D212000-memory.dmp	upx
behavioral2/memory/3172-446-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	upx
behavioral2/memory/5040-445-0x00007FF649F30000-0x00007FF64A322000-memory.dmp	upx
behavioral2/memory/3060-444-0x00007FF731010000-0x00007FF731402000-memory.dmp	upx
behavioral2/memory/392-442-0x00007FF64F510000-0x00007FF64F902000-memory.dmp	upx
behavioral2/memory/1048-441-0x00007FF74AEA0000-0x00007FF74B292000-memory.dmp	upx
behavioral2/memory/1152-440-0x00007FF7B4D70000-0x00007FF7B5162000-memory.dmp	upx
behavioral2/memory/60-439-0x00007FF6C0E80000-0x00007FF6C1272000-memory.dmp	upx
behavioral2/memory/920-436-0x00007FF61AC70000-0x00007FF61B062000-memory.dmp	upx
behavioral2/memory/2744-432-0x00007FF7ABA20000-0x00007FF7ABE12000-memory.dmp	upx
behavioral2/memory/2476-282-0x00007FF606C30000-0x00007FF607022000-memory.dmp	upx
behavioral2/memory/3068-260-0x00007FF6743E0000-0x00007FF6747D2000-memory.dmp	upx
behavioral2/files/0x0007000000023460-189.dat	upx
behavioral2/files/0x000700000002345e-188.dat	upx
behavioral2/files/0x000700000002345d-187.dat	upx
behavioral2/files/0x000700000002344b-183.dat	upx
behavioral2/files/0x000700000002345c-182.dat	upx
behavioral2/files/0x0007000000023450-175.dat	upx
behavioral2/files/0x000700000002345b-174.dat	upx
behavioral2/files/0x000700000002345a-173.dat	upx
behavioral2/files/0x0007000000023459-172.dat	upx
behavioral2/files/0x0007000000023454-167.dat	upx
behavioral2/files/0x000700000002344e-154.dat	upx
behavioral2/files/0x000700000002344d-149.dat	upx
behavioral2/files/0x000700000002344c-147.dat	upx
behavioral2/files/0x0007000000023446-144.dat	upx
behavioral2/files/0x0007000000023457-141.dat	upx
behavioral2/files/0x000700000002344a-139.dat	upx
behavioral2/files/0x0008000000023438-138.dat	upx
behavioral2/files/0x0007000000023456-135.dat	upx
behavioral2/files/0x0007000000023449-134.dat	upx
behavioral2/files/0x000700000002344f-129.dat	upx
behavioral2/files/0x0007000000023455-131.dat	upx
behavioral2/files/0x0007000000023453-127.dat	upx
behavioral2/files/0x0007000000023452-126.dat	upx
behavioral2/files/0x0007000000023458-145.dat	upx
behavioral2/files/0x0007000000023451-121.dat	upx
behavioral2/files/0x0007000000023444-106.dat	upx
behavioral2/files/0x0007000000023447-123.dat	upx
behavioral2/files/0x0007000000023443-91.dat	upx
behavioral2/files/0x0007000000023442-85.dat	upx
behavioral2/files/0x0007000000023445-111.dat	upx
behavioral2/files/0x0007000000023441-82.dat	upx
behavioral2/files/0x0007000000023440-63.dat	upx
behavioral2/files/0x000700000002343e-49.dat	upx
behavioral2/files/0x000700000002343d-43.dat	upx
behavioral2/memory/3056-40-0x00007FF73DAB0000-0x00007FF73DEA2000-memory.dmp	upx
behavioral2/memory/752-23-0x00007FF6F44F0000-0x00007FF6F48E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WsTVRKX.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ceuaHZN.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\iqAEyln.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\yrQTrKH.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\rBGEQer.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\CbLBqSl.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\wvPNaLA.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\xkEjgYD.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ceLnCWL.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\VBtvlaV.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\MMbkQWU.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\RvXhFit.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\dPsUpnp.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ujlMTAc.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\vGcLUhj.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\TAkoGRY.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\zXobvNF.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\zWfbnwT.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\pUWGUqg.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\zucHeDQ.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\IqxPgIt.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\OAkTLIe.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\eLkRaJn.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\utfezZs.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\iDYJnxi.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ZTELqcJ.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ZmjeTVy.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\CXqQHOG.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\LSicSQt.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\vaOlVVm.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\wXKCTVr.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\wRvIPdW.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\pOgUFfN.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ocfFhrL.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\yhvXFKk.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\YNTpXiB.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\enXggww.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\qPJjmpt.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\UCeMmhS.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\dwGfEWP.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ezeOXqc.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\YFSaTee.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\QqXxthB.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\vyRBCfS.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\AZFrkHX.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\VbFFrdE.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ikLbqXX.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\EpymPyg.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\pRSLkEx.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ElBycDT.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\cPOQJAW.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\KvpCsTY.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\xGYsWPy.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\hGaUXEe.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\jKSdfAi.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\zbpEgds.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\TaBPSML.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\iwJgQNZ.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\bdIAbwD.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\rVNzGNE.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\PYgGbsw.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\KaoUxmP.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\mRTmoMN.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
File created	C:\Windows\System\ufLNMJX.exe	00c159768dadac45afcc04f829277742_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeLockMemoryPrivilege	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3112	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	85
PID 3232 wrote to memory of 3112	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	85
PID 3232 wrote to memory of 752	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	86
PID 3232 wrote to memory of 752	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	86
PID 3232 wrote to memory of 4216	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	87
PID 3232 wrote to memory of 4216	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	87
PID 3232 wrote to memory of 3056	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	88
PID 3232 wrote to memory of 3056	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	88
PID 3232 wrote to memory of 3684	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	89
PID 3232 wrote to memory of 3684	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	89
PID 3232 wrote to memory of 3068	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	90
PID 3232 wrote to memory of 3068	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	90
PID 3232 wrote to memory of 2476	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	91
PID 3232 wrote to memory of 2476	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	91
PID 3232 wrote to memory of 4332	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	92
PID 3232 wrote to memory of 4332	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	92
PID 3232 wrote to memory of 4028	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	93
PID 3232 wrote to memory of 4028	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	93
PID 3232 wrote to memory of 1848	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	94
PID 3232 wrote to memory of 1848	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	94
PID 3232 wrote to memory of 1476	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	95
PID 3232 wrote to memory of 1476	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	95
PID 3232 wrote to memory of 2744	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	96
PID 3232 wrote to memory of 2744	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	96
PID 3232 wrote to memory of 920	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	97
PID 3232 wrote to memory of 920	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	97
PID 3232 wrote to memory of 3512	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	98
PID 3232 wrote to memory of 3512	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	98
PID 3232 wrote to memory of 3636	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	99
PID 3232 wrote to memory of 3636	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	99
PID 3232 wrote to memory of 60	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	100
PID 3232 wrote to memory of 60	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	100
PID 3232 wrote to memory of 1152	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	101
PID 3232 wrote to memory of 1152	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	101
PID 3232 wrote to memory of 1048	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	102
PID 3232 wrote to memory of 1048	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	102
PID 3232 wrote to memory of 392	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	103
PID 3232 wrote to memory of 392	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	103
PID 3232 wrote to memory of 3060	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	104
PID 3232 wrote to memory of 3060	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	104
PID 3232 wrote to memory of 5040	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	105
PID 3232 wrote to memory of 5040	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	105
PID 3232 wrote to memory of 3172	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	106
PID 3232 wrote to memory of 3172	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	106
PID 3232 wrote to memory of 4864	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	107
PID 3232 wrote to memory of 4864	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	107
PID 3232 wrote to memory of 1556	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	108
PID 3232 wrote to memory of 1556	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	108
PID 3232 wrote to memory of 2552	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	109
PID 3232 wrote to memory of 2552	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	109
PID 3232 wrote to memory of 2900	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	110
PID 3232 wrote to memory of 2900	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	110
PID 3232 wrote to memory of 5004	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	111
PID 3232 wrote to memory of 5004	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	111
PID 3232 wrote to memory of 5052	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	112
PID 3232 wrote to memory of 5052	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	112
PID 3232 wrote to memory of 980	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	113
PID 3232 wrote to memory of 980	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	113
PID 3232 wrote to memory of 1512	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	114
PID 3232 wrote to memory of 1512	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	114
PID 3232 wrote to memory of 3544	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	115
PID 3232 wrote to memory of 3544	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	115
PID 3232 wrote to memory of 4672	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	116
PID 3232 wrote to memory of 4672	3232	00c159768dadac45afcc04f829277742_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\00c159768dadac45afcc04f829277742_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00c159768dadac45afcc04f829277742_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3112" "2980" "2896" "2984" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13480
- C:\Windows\System\dPsUpnp.exe
  C:\Windows\System\dPsUpnp.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\heXhYqm.exe
  C:\Windows\System\heXhYqm.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\zhsgUwp.exe
  C:\Windows\System\zhsgUwp.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\FqWmNMS.exe
  C:\Windows\System\FqWmNMS.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\DXcdJlY.exe
  C:\Windows\System\DXcdJlY.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\AVeSpxQ.exe
  C:\Windows\System\AVeSpxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\TOnLlXv.exe
  C:\Windows\System\TOnLlXv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\eWaDItg.exe
  C:\Windows\System\eWaDItg.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\YFSaTee.exe
  C:\Windows\System\YFSaTee.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\IZULHes.exe
  C:\Windows\System\IZULHes.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\EnOSXWn.exe
  C:\Windows\System\EnOSXWn.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\xkqIXAA.exe
  C:\Windows\System\xkqIXAA.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ajKjWVz.exe
  C:\Windows\System\ajKjWVz.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\AKTlniP.exe
  C:\Windows\System\AKTlniP.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\JTYcoaF.exe
  C:\Windows\System\JTYcoaF.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\UHIGTRx.exe
  C:\Windows\System\UHIGTRx.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\hmGvnok.exe
  C:\Windows\System\hmGvnok.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\pMrLhgs.exe
  C:\Windows\System\pMrLhgs.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\uVXAWJI.exe
  C:\Windows\System\uVXAWJI.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\vKghiFu.exe
  C:\Windows\System\vKghiFu.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\rVNzGNE.exe
  C:\Windows\System\rVNzGNE.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\NMOtZyZ.exe
  C:\Windows\System\NMOtZyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\sLyouEc.exe
  C:\Windows\System\sLyouEc.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\bLjipYW.exe
  C:\Windows\System\bLjipYW.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\VEdZHDn.exe
  C:\Windows\System\VEdZHDn.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\lbupVRL.exe
  C:\Windows\System\lbupVRL.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\tOKqmef.exe
  C:\Windows\System\tOKqmef.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\QAgQSLs.exe
  C:\Windows\System\QAgQSLs.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\lWYfcJy.exe
  C:\Windows\System\lWYfcJy.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\ISySRnO.exe
  C:\Windows\System\ISySRnO.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\YKOcneD.exe
  C:\Windows\System\YKOcneD.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\AuZJpas.exe
  C:\Windows\System\AuZJpas.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\wufcXEM.exe
  C:\Windows\System\wufcXEM.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\eRDSnum.exe
  C:\Windows\System\eRDSnum.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\WsTVRKX.exe
  C:\Windows\System\WsTVRKX.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\kpzZAhC.exe
  C:\Windows\System\kpzZAhC.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\qOSqIDV.exe
  C:\Windows\System\qOSqIDV.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\efXTBeS.exe
  C:\Windows\System\efXTBeS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\tlRYayA.exe
  C:\Windows\System\tlRYayA.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wGEBtuv.exe
  C:\Windows\System\wGEBtuv.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\dWzhXnH.exe
  C:\Windows\System\dWzhXnH.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\nXSlMgQ.exe
  C:\Windows\System\nXSlMgQ.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\WfilMhM.exe
  C:\Windows\System\WfilMhM.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\bnAmkNx.exe
  C:\Windows\System\bnAmkNx.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\uTTVrcv.exe
  C:\Windows\System\uTTVrcv.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\zIlMFXP.exe
  C:\Windows\System\zIlMFXP.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\fvWGEmV.exe
  C:\Windows\System\fvWGEmV.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\VtznqHl.exe
  C:\Windows\System\VtznqHl.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QsDnBnS.exe
  C:\Windows\System\QsDnBnS.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\OERIWUv.exe
  C:\Windows\System\OERIWUv.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\SPuwjoa.exe
  C:\Windows\System\SPuwjoa.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\UKjhRlq.exe
  C:\Windows\System\UKjhRlq.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\tstNbAZ.exe
  C:\Windows\System\tstNbAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\vewypgu.exe
  C:\Windows\System\vewypgu.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\vwCHnXz.exe
  C:\Windows\System\vwCHnXz.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\oZYUpRJ.exe
  C:\Windows\System\oZYUpRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\FhuBUap.exe
  C:\Windows\System\FhuBUap.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\ODhhgsW.exe
  C:\Windows\System\ODhhgsW.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\FJHrQtz.exe
  C:\Windows\System\FJHrQtz.exe
  2⤵
  PID:4512
- C:\Windows\System\gvNTdTW.exe
  C:\Windows\System\gvNTdTW.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\INXyIgk.exe
  C:\Windows\System\INXyIgk.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\jGGDXNl.exe
  C:\Windows\System\jGGDXNl.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\uNtSvba.exe
  C:\Windows\System\uNtSvba.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\HrTwyVT.exe
  C:\Windows\System\HrTwyVT.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\sYCMZSV.exe
  C:\Windows\System\sYCMZSV.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\EIVNTzv.exe
  C:\Windows\System\EIVNTzv.exe
  2⤵
  PID:2376
- C:\Windows\System\lAkhUZR.exe
  C:\Windows\System\lAkhUZR.exe
  2⤵
  PID:2404
- C:\Windows\System\FEwZSCs.exe
  C:\Windows\System\FEwZSCs.exe
  2⤵
  PID:1128
- C:\Windows\System\bwVfVxS.exe
  C:\Windows\System\bwVfVxS.exe
  2⤵
  PID:4492
- C:\Windows\System\ENHCyrG.exe
  C:\Windows\System\ENHCyrG.exe
  2⤵
  PID:1996
- C:\Windows\System\DgOANcl.exe
  C:\Windows\System\DgOANcl.exe
  2⤵
  PID:452
- C:\Windows\System\TNlHLmh.exe
  C:\Windows\System\TNlHLmh.exe
  2⤵
  PID:3212
- C:\Windows\System\AXcbXJP.exe
  C:\Windows\System\AXcbXJP.exe
  2⤵
  PID:1992
- C:\Windows\System\bbzTJoX.exe
  C:\Windows\System\bbzTJoX.exe
  2⤵
  PID:732
- C:\Windows\System\qvDpSbR.exe
  C:\Windows\System\qvDpSbR.exe
  2⤵
  PID:5080
- C:\Windows\System\OhAZoHT.exe
  C:\Windows\System\OhAZoHT.exe
  2⤵
  PID:4648
- C:\Windows\System\ZcilnLK.exe
  C:\Windows\System\ZcilnLK.exe
  2⤵
  PID:4640
- C:\Windows\System\wbDVniC.exe
  C:\Windows\System\wbDVniC.exe
  2⤵
  PID:5136
- C:\Windows\System\UANECxO.exe
  C:\Windows\System\UANECxO.exe
  2⤵
  PID:5160
- C:\Windows\System\XsKifQW.exe
  C:\Windows\System\XsKifQW.exe
  2⤵
  PID:5180
- C:\Windows\System\WUVWYYz.exe
  C:\Windows\System\WUVWYYz.exe
  2⤵
  PID:5200
- C:\Windows\System\UMsCDfu.exe
  C:\Windows\System\UMsCDfu.exe
  2⤵
  PID:5228
- C:\Windows\System\EIZfIbH.exe
  C:\Windows\System\EIZfIbH.exe
  2⤵
  PID:5244
- C:\Windows\System\wXgdCLl.exe
  C:\Windows\System\wXgdCLl.exe
  2⤵
  PID:5268
- C:\Windows\System\fTkLgqe.exe
  C:\Windows\System\fTkLgqe.exe
  2⤵
  PID:5392
- C:\Windows\System\cmUUflm.exe
  C:\Windows\System\cmUUflm.exe
  2⤵
  PID:5416
- C:\Windows\System\cPOQJAW.exe
  C:\Windows\System\cPOQJAW.exe
  2⤵
  PID:5432
- C:\Windows\System\lvGxXLo.exe
  C:\Windows\System\lvGxXLo.exe
  2⤵
  PID:5456
- C:\Windows\System\lslFcJQ.exe
  C:\Windows\System\lslFcJQ.exe
  2⤵
  PID:5476
- C:\Windows\System\KvpCsTY.exe
  C:\Windows\System\KvpCsTY.exe
  2⤵
  PID:5500
- C:\Windows\System\lZrxhGD.exe
  C:\Windows\System\lZrxhGD.exe
  2⤵
  PID:5528
- C:\Windows\System\PvzMYZP.exe
  C:\Windows\System\PvzMYZP.exe
  2⤵
  PID:5544
- C:\Windows\System\oabcQiS.exe
  C:\Windows\System\oabcQiS.exe
  2⤵
  PID:5580
- C:\Windows\System\vtABcSg.exe
  C:\Windows\System\vtABcSg.exe
  2⤵
  PID:5600
- C:\Windows\System\tEgSXqf.exe
  C:\Windows\System\tEgSXqf.exe
  2⤵
  PID:5620
- C:\Windows\System\OwpXLxq.exe
  C:\Windows\System\OwpXLxq.exe
  2⤵
  PID:5660
- C:\Windows\System\ivgrjtw.exe
  C:\Windows\System\ivgrjtw.exe
  2⤵
  PID:5680
- C:\Windows\System\kAlyOpk.exe
  C:\Windows\System\kAlyOpk.exe
  2⤵
  PID:5696
- C:\Windows\System\cEznmmU.exe
  C:\Windows\System\cEznmmU.exe
  2⤵
  PID:5716
- C:\Windows\System\zXgzEIw.exe
  C:\Windows\System\zXgzEIw.exe
  2⤵
  PID:5744
- C:\Windows\System\sigtjDG.exe
  C:\Windows\System\sigtjDG.exe
  2⤵
  PID:5772
- C:\Windows\System\MIYPmxA.exe
  C:\Windows\System\MIYPmxA.exe
  2⤵
  PID:5788
- C:\Windows\System\yxxSYOc.exe
  C:\Windows\System\yxxSYOc.exe
  2⤵
  PID:5804
- C:\Windows\System\QqXxthB.exe
  C:\Windows\System\QqXxthB.exe
  2⤵
  PID:5844
- C:\Windows\System\aGimQka.exe
  C:\Windows\System\aGimQka.exe
  2⤵
  PID:5868
- C:\Windows\System\vcUoxbX.exe
  C:\Windows\System\vcUoxbX.exe
  2⤵
  PID:5892
- C:\Windows\System\uydWCWR.exe
  C:\Windows\System\uydWCWR.exe
  2⤵
  PID:5916
- C:\Windows\System\YqCYWDW.exe
  C:\Windows\System\YqCYWDW.exe
  2⤵
  PID:5936
- C:\Windows\System\syLfCgm.exe
  C:\Windows\System\syLfCgm.exe
  2⤵
  PID:5964
- C:\Windows\System\PcOBDvf.exe
  C:\Windows\System\PcOBDvf.exe
  2⤵
  PID:5980
- C:\Windows\System\AYeoaaH.exe
  C:\Windows\System\AYeoaaH.exe
  2⤵
  PID:6000
- C:\Windows\System\ZOnFAqR.exe
  C:\Windows\System\ZOnFAqR.exe
  2⤵
  PID:6024
- C:\Windows\System\IioYRtU.exe
  C:\Windows\System\IioYRtU.exe
  2⤵
  PID:6044
- C:\Windows\System\JlePNFC.exe
  C:\Windows\System\JlePNFC.exe
  2⤵
  PID:6064
- C:\Windows\System\rDkCRUa.exe
  C:\Windows\System\rDkCRUa.exe
  2⤵
  PID:6080
- C:\Windows\System\zrPQlDd.exe
  C:\Windows\System\zrPQlDd.exe
  2⤵
  PID:6100
- C:\Windows\System\XdZvEBi.exe
  C:\Windows\System\XdZvEBi.exe
  2⤵
  PID:6128
- C:\Windows\System\sEpAeNv.exe
  C:\Windows\System\sEpAeNv.exe
  2⤵
  PID:3600
- C:\Windows\System\zLXMfyj.exe
  C:\Windows\System\zLXMfyj.exe
  2⤵
  PID:4416
- C:\Windows\System\imCjQCo.exe
  C:\Windows\System\imCjQCo.exe
  2⤵
  PID:3188
- C:\Windows\System\NzahTrk.exe
  C:\Windows\System\NzahTrk.exe
  2⤵
  PID:4408
- C:\Windows\System\MTOrJuO.exe
  C:\Windows\System\MTOrJuO.exe
  2⤵
  PID:5240
- C:\Windows\System\fCqHyhi.exe
  C:\Windows\System\fCqHyhi.exe
  2⤵
  PID:3136
- C:\Windows\System\cMFUZcP.exe
  C:\Windows\System\cMFUZcP.exe
  2⤵
  PID:5784
- C:\Windows\System\ztGLxSi.exe
  C:\Windows\System\ztGLxSi.exe
  2⤵
  PID:5828
- C:\Windows\System\rThjrnt.exe
  C:\Windows\System\rThjrnt.exe
  2⤵
  PID:5880
- C:\Windows\System\iwGjaVC.exe
  C:\Windows\System\iwGjaVC.exe
  2⤵
  PID:5932
- C:\Windows\System\DlJbGNA.exe
  C:\Windows\System\DlJbGNA.exe
  2⤵
  PID:5992
- C:\Windows\System\RBKmAwl.exe
  C:\Windows\System\RBKmAwl.exe
  2⤵
  PID:6040
- C:\Windows\System\ZFHxTRd.exe
  C:\Windows\System\ZFHxTRd.exe
  2⤵
  PID:6096
- C:\Windows\System\zlZuSkP.exe
  C:\Windows\System\zlZuSkP.exe
  2⤵
  PID:4792
- C:\Windows\System\eHYKyOX.exe
  C:\Windows\System\eHYKyOX.exe
  2⤵
  PID:4412
- C:\Windows\System\bgRkmxt.exe
  C:\Windows\System\bgRkmxt.exe
  2⤵
  PID:4304
- C:\Windows\System\mnfNafI.exe
  C:\Windows\System\mnfNafI.exe
  2⤵
  PID:5260
- C:\Windows\System\MODvpDf.exe
  C:\Windows\System\MODvpDf.exe
  2⤵
  PID:5596
- C:\Windows\System\rTMbLoc.exe
  C:\Windows\System\rTMbLoc.exe
  2⤵
  PID:2804
- C:\Windows\System\aWRciio.exe
  C:\Windows\System\aWRciio.exe
  2⤵
  PID:5484
- C:\Windows\System\wXjjYoQ.exe
  C:\Windows\System\wXjjYoQ.exe
  2⤵
  PID:6136
- C:\Windows\System\MVYMapF.exe
  C:\Windows\System\MVYMapF.exe
  2⤵
  PID:5308
- C:\Windows\System\HaYLIAu.exe
  C:\Windows\System\HaYLIAu.exe
  2⤵
  PID:6088
- C:\Windows\System\rUinyiL.exe
  C:\Windows\System\rUinyiL.exe
  2⤵
  PID:5188
- C:\Windows\System\BxmODhY.exe
  C:\Windows\System\BxmODhY.exe
  2⤵
  PID:6164
- C:\Windows\System\kKYMQWb.exe
  C:\Windows\System\kKYMQWb.exe
  2⤵
  PID:6184
- C:\Windows\System\RhgawSp.exe
  C:\Windows\System\RhgawSp.exe
  2⤵
  PID:6204
- C:\Windows\System\NryWIUC.exe
  C:\Windows\System\NryWIUC.exe
  2⤵
  PID:6228
- C:\Windows\System\vyRBCfS.exe
  C:\Windows\System\vyRBCfS.exe
  2⤵
  PID:6252
- C:\Windows\System\MlaZfFI.exe
  C:\Windows\System\MlaZfFI.exe
  2⤵
  PID:6280
- C:\Windows\System\llDmtDx.exe
  C:\Windows\System\llDmtDx.exe
  2⤵
  PID:6300
- C:\Windows\System\bMKmDHP.exe
  C:\Windows\System\bMKmDHP.exe
  2⤵
  PID:6324
- C:\Windows\System\QIARsQz.exe
  C:\Windows\System\QIARsQz.exe
  2⤵
  PID:6344
- C:\Windows\System\gHxrSOM.exe
  C:\Windows\System\gHxrSOM.exe
  2⤵
  PID:6364
- C:\Windows\System\KaQoPWt.exe
  C:\Windows\System\KaQoPWt.exe
  2⤵
  PID:6392
- C:\Windows\System\plumFsO.exe
  C:\Windows\System\plumFsO.exe
  2⤵
  PID:6408
- C:\Windows\System\VSBGcqI.exe
  C:\Windows\System\VSBGcqI.exe
  2⤵
  PID:6428
- C:\Windows\System\xGYsWPy.exe
  C:\Windows\System\xGYsWPy.exe
  2⤵
  PID:6452
- C:\Windows\System\kywemNn.exe
  C:\Windows\System\kywemNn.exe
  2⤵
  PID:6468
- C:\Windows\System\DHOFuOY.exe
  C:\Windows\System\DHOFuOY.exe
  2⤵
  PID:6492
- C:\Windows\System\oRgOdoX.exe
  C:\Windows\System\oRgOdoX.exe
  2⤵
  PID:6512
- C:\Windows\System\svrlhkP.exe
  C:\Windows\System\svrlhkP.exe
  2⤵
  PID:6536
- C:\Windows\System\TpNALVu.exe
  C:\Windows\System\TpNALVu.exe
  2⤵
  PID:6564
- C:\Windows\System\BMHXtDc.exe
  C:\Windows\System\BMHXtDc.exe
  2⤵
  PID:6624
- C:\Windows\System\yWTCbNs.exe
  C:\Windows\System\yWTCbNs.exe
  2⤵
  PID:6644
- C:\Windows\System\WvUrEiS.exe
  C:\Windows\System\WvUrEiS.exe
  2⤵
  PID:6668
- C:\Windows\System\naHzImn.exe
  C:\Windows\System\naHzImn.exe
  2⤵
  PID:6692
- C:\Windows\System\FWHgmUh.exe
  C:\Windows\System\FWHgmUh.exe
  2⤵
  PID:6712
- C:\Windows\System\kFWEerm.exe
  C:\Windows\System\kFWEerm.exe
  2⤵
  PID:6732
- C:\Windows\System\EyvBllA.exe
  C:\Windows\System\EyvBllA.exe
  2⤵
  PID:6760
- C:\Windows\System\MJyVhNB.exe
  C:\Windows\System\MJyVhNB.exe
  2⤵
  PID:6784
- C:\Windows\System\sjAdhNZ.exe
  C:\Windows\System\sjAdhNZ.exe
  2⤵
  PID:6808
- C:\Windows\System\nXhGXXb.exe
  C:\Windows\System\nXhGXXb.exe
  2⤵
  PID:6824
- C:\Windows\System\pktSgcE.exe
  C:\Windows\System\pktSgcE.exe
  2⤵
  PID:6848
- C:\Windows\System\WxrnAkD.exe
  C:\Windows\System\WxrnAkD.exe
  2⤵
  PID:6872
- C:\Windows\System\iHYpllk.exe
  C:\Windows\System\iHYpllk.exe
  2⤵
  PID:6900
- C:\Windows\System\FYGToJA.exe
  C:\Windows\System\FYGToJA.exe
  2⤵
  PID:6928
- C:\Windows\System\zmgsEEs.exe
  C:\Windows\System\zmgsEEs.exe
  2⤵
  PID:6944
- C:\Windows\System\VSHGjBL.exe
  C:\Windows\System\VSHGjBL.exe
  2⤵
  PID:6968
- C:\Windows\System\xlgLktT.exe
  C:\Windows\System\xlgLktT.exe
  2⤵
  PID:6992
- C:\Windows\System\rtvKUDk.exe
  C:\Windows\System\rtvKUDk.exe
  2⤵
  PID:7008
- C:\Windows\System\PtJQIpB.exe
  C:\Windows\System\PtJQIpB.exe
  2⤵
  PID:7036
- C:\Windows\System\SllQHFB.exe
  C:\Windows\System\SllQHFB.exe
  2⤵
  PID:7056
- C:\Windows\System\clqwRHV.exe
  C:\Windows\System\clqwRHV.exe
  2⤵
  PID:7076
- C:\Windows\System\afkMrdw.exe
  C:\Windows\System\afkMrdw.exe
  2⤵
  PID:5908
- C:\Windows\System\EhjjeLE.exe
  C:\Windows\System\EhjjeLE.exe
  2⤵
  PID:5336
- C:\Windows\System\qTouEki.exe
  C:\Windows\System\qTouEki.exe
  2⤵
  PID:6248
- C:\Windows\System\muJTiSk.exe
  C:\Windows\System\muJTiSk.exe
  2⤵
  PID:4140
- C:\Windows\System\xJYBHtd.exe
  C:\Windows\System\xJYBHtd.exe
  2⤵
  PID:6464
- C:\Windows\System\nDtkNaz.exe
  C:\Windows\System\nDtkNaz.exe
  2⤵
  PID:6500
- C:\Windows\System\GOgTATd.exe
  C:\Windows\System\GOgTATd.exe
  2⤵
  PID:6436
- C:\Windows\System\ZYWbwNh.exe
  C:\Windows\System\ZYWbwNh.exe
  2⤵
  PID:6572
- C:\Windows\System\QdeFGhh.exe
  C:\Windows\System\QdeFGhh.exe
  2⤵
  PID:6640
- C:\Windows\System\HPJBIpr.exe
  C:\Windows\System\HPJBIpr.exe
  2⤵
  PID:7048
- C:\Windows\System\axHWkpL.exe
  C:\Windows\System\axHWkpL.exe
  2⤵
  PID:7132
- C:\Windows\System\KHMKSwV.exe
  C:\Windows\System\KHMKSwV.exe
  2⤵
  PID:5860
- C:\Windows\System\qcpsILS.exe
  C:\Windows\System\qcpsILS.exe
  2⤵
  PID:6200
- C:\Windows\System\AZFrkHX.exe
  C:\Windows\System\AZFrkHX.exe
  2⤵
  PID:6276
- C:\Windows\System\cCOdOlR.exe
  C:\Windows\System\cCOdOlR.exe
  2⤵
  PID:7236
- C:\Windows\System\BrqtDCT.exe
  C:\Windows\System\BrqtDCT.exe
  2⤵
  PID:7252
- C:\Windows\System\kpBNaOn.exe
  C:\Windows\System\kpBNaOn.exe
  2⤵
  PID:7268
- C:\Windows\System\bluEAKF.exe
  C:\Windows\System\bluEAKF.exe
  2⤵
  PID:7292
- C:\Windows\System\ezsWQiJ.exe
  C:\Windows\System\ezsWQiJ.exe
  2⤵
  PID:7308
- C:\Windows\System\UJvYtqZ.exe
  C:\Windows\System\UJvYtqZ.exe
  2⤵
  PID:7332
- C:\Windows\System\lFCflcT.exe
  C:\Windows\System\lFCflcT.exe
  2⤵
  PID:7352
- C:\Windows\System\QTquAzn.exe
  C:\Windows\System\QTquAzn.exe
  2⤵
  PID:7368
- C:\Windows\System\qUxvroG.exe
  C:\Windows\System\qUxvroG.exe
  2⤵
  PID:7392
- C:\Windows\System\YrfFqdK.exe
  C:\Windows\System\YrfFqdK.exe
  2⤵
  PID:7416
- C:\Windows\System\EzTNlPG.exe
  C:\Windows\System\EzTNlPG.exe
  2⤵
  PID:7440
- C:\Windows\System\ytCTZpN.exe
  C:\Windows\System\ytCTZpN.exe
  2⤵
  PID:7476
- C:\Windows\System\tgWhSCe.exe
  C:\Windows\System\tgWhSCe.exe
  2⤵
  PID:7492
- C:\Windows\System\sKUcXZJ.exe
  C:\Windows\System\sKUcXZJ.exe
  2⤵
  PID:7508
- C:\Windows\System\AXOzTvU.exe
  C:\Windows\System\AXOzTvU.exe
  2⤵
  PID:7560
- C:\Windows\System\MkkCusQ.exe
  C:\Windows\System\MkkCusQ.exe
  2⤵
  PID:7584
- C:\Windows\System\DTQlzxI.exe
  C:\Windows\System\DTQlzxI.exe
  2⤵
  PID:7604
- C:\Windows\System\lrVcTZB.exe
  C:\Windows\System\lrVcTZB.exe
  2⤵
  PID:7640
- C:\Windows\System\NfCzgUZ.exe
  C:\Windows\System\NfCzgUZ.exe
  2⤵
  PID:7672
- C:\Windows\System\atWvLDe.exe
  C:\Windows\System\atWvLDe.exe
  2⤵
  PID:7692
- C:\Windows\System\eQmmrHI.exe
  C:\Windows\System\eQmmrHI.exe
  2⤵
  PID:7712
- C:\Windows\System\DnWhxTT.exe
  C:\Windows\System\DnWhxTT.exe
  2⤵
  PID:7736
- C:\Windows\System\kzYNwZu.exe
  C:\Windows\System\kzYNwZu.exe
  2⤵
  PID:7752
- C:\Windows\System\jlBmcky.exe
  C:\Windows\System\jlBmcky.exe
  2⤵
  PID:7768
- C:\Windows\System\SasWHQu.exe
  C:\Windows\System\SasWHQu.exe
  2⤵
  PID:7784
- C:\Windows\System\lYZmxUV.exe
  C:\Windows\System\lYZmxUV.exe
  2⤵
  PID:7808
- C:\Windows\System\tZrYpcJ.exe
  C:\Windows\System\tZrYpcJ.exe
  2⤵
  PID:7844
- C:\Windows\System\kvVGzSo.exe
  C:\Windows\System\kvVGzSo.exe
  2⤵
  PID:7868
- C:\Windows\System\QdBJnaI.exe
  C:\Windows\System\QdBJnaI.exe
  2⤵
  PID:7896
- C:\Windows\System\VbFFrdE.exe
  C:\Windows\System\VbFFrdE.exe
  2⤵
  PID:7920
- C:\Windows\System\abNRgCN.exe
  C:\Windows\System\abNRgCN.exe
  2⤵
  PID:7944
- C:\Windows\System\OolofQP.exe
  C:\Windows\System\OolofQP.exe
  2⤵
  PID:7968
- C:\Windows\System\XmJArmS.exe
  C:\Windows\System\XmJArmS.exe
  2⤵
  PID:7988
- C:\Windows\System\pkFfuxd.exe
  C:\Windows\System\pkFfuxd.exe
  2⤵
  PID:8004
- C:\Windows\System\SYPHBLp.exe
  C:\Windows\System\SYPHBLp.exe
  2⤵
  PID:8024
- C:\Windows\System\DjoTNyQ.exe
  C:\Windows\System\DjoTNyQ.exe
  2⤵
  PID:8044
- C:\Windows\System\nrlgfOv.exe
  C:\Windows\System\nrlgfOv.exe
  2⤵
  PID:8064
- C:\Windows\System\XZzNVQx.exe
  C:\Windows\System\XZzNVQx.exe
  2⤵
  PID:8124
- C:\Windows\System\RBuTqHd.exe
  C:\Windows\System\RBuTqHd.exe
  2⤵
  PID:8160
- C:\Windows\System\LtszoqF.exe
  C:\Windows\System\LtszoqF.exe
  2⤵
  PID:8180
- C:\Windows\System\NiOwZgZ.exe
  C:\Windows\System\NiOwZgZ.exe
  2⤵
  PID:3628
- C:\Windows\System\DrAftas.exe
  C:\Windows\System\DrAftas.exe
  2⤵
  PID:6684
- C:\Windows\System\wcYaQSM.exe
  C:\Windows\System\wcYaQSM.exe
  2⤵
  PID:6856
- C:\Windows\System\TJploRB.exe
  C:\Windows\System\TJploRB.exe
  2⤵
  PID:6416
- C:\Windows\System\joLngFf.exe
  C:\Windows\System\joLngFf.exe
  2⤵
  PID:6612
- C:\Windows\System\PBeszsn.exe
  C:\Windows\System\PBeszsn.exe
  2⤵
  PID:6796
- C:\Windows\System\MPsYxmH.exe
  C:\Windows\System\MPsYxmH.exe
  2⤵
  PID:2228
- C:\Windows\System\WGDFFCV.exe
  C:\Windows\System\WGDFFCV.exe
  2⤵
  PID:7408
- C:\Windows\System\HLlOdZU.exe
  C:\Windows\System\HLlOdZU.exe
  2⤵
  PID:1444
- C:\Windows\System\TkKIkav.exe
  C:\Windows\System\TkKIkav.exe
  2⤵
  PID:6908
- C:\Windows\System\ueGBPLx.exe
  C:\Windows\System\ueGBPLx.exe
  2⤵
  PID:7028
- C:\Windows\System\apxggvg.exe
  C:\Windows\System\apxggvg.exe
  2⤵
  PID:6936
- C:\Windows\System\KeiotqK.exe
  C:\Windows\System\KeiotqK.exe
  2⤵
  PID:7596
- C:\Windows\System\ASivcPf.exe
  C:\Windows\System\ASivcPf.exe
  2⤵
  PID:2364
- C:\Windows\System\hyFiPlW.exe
  C:\Windows\System\hyFiPlW.exe
  2⤵
  PID:6272
- C:\Windows\System\buVkRYX.exe
  C:\Windows\System\buVkRYX.exe
  2⤵
  PID:7700
- C:\Windows\System\MMwHrZO.exe
  C:\Windows\System\MMwHrZO.exe
  2⤵
  PID:7232
- C:\Windows\System\XuFcXZb.exe
  C:\Windows\System\XuFcXZb.exe
  2⤵
  PID:7276
- C:\Windows\System\LYmssoa.exe
  C:\Windows\System\LYmssoa.exe
  2⤵
  PID:7304
- C:\Windows\System\pzCpCbL.exe
  C:\Windows\System\pzCpCbL.exe
  2⤵
  PID:7600
- C:\Windows\System\IotdrGo.exe
  C:\Windows\System\IotdrGo.exe
  2⤵
  PID:7488
- C:\Windows\System\lOZrDvh.exe
  C:\Windows\System\lOZrDvh.exe
  2⤵
  PID:8020
- C:\Windows\System\uCbDbWZ.exe
  C:\Windows\System\uCbDbWZ.exe
  2⤵
  PID:8060
- C:\Windows\System\skerQGN.exe
  C:\Windows\System\skerQGN.exe
  2⤵
  PID:7976
- C:\Windows\System\fujNpjU.exe
  C:\Windows\System\fujNpjU.exe
  2⤵
  PID:4144
- C:\Windows\System\jUetuEf.exe
  C:\Windows\System\jUetuEf.exe
  2⤵
  PID:7432
- C:\Windows\System\ULJKwYd.exe
  C:\Windows\System\ULJKwYd.exe
  2⤵
  PID:7792
- C:\Windows\System\ztoSSyk.exe
  C:\Windows\System\ztoSSyk.exe
  2⤵
  PID:7860
- C:\Windows\System\hhfleIw.exe
  C:\Windows\System\hhfleIw.exe
  2⤵
  PID:8156
- C:\Windows\System\fJEdmUj.exe
  C:\Windows\System\fJEdmUj.exe
  2⤵
  PID:8032
- C:\Windows\System\JLdGbZk.exe
  C:\Windows\System\JLdGbZk.exe
  2⤵
  PID:8016
- C:\Windows\System\wqzgGuj.exe
  C:\Windows\System\wqzgGuj.exe
  2⤵
  PID:3648
- C:\Windows\System\BiJhtDt.exe
  C:\Windows\System\BiJhtDt.exe
  2⤵
  PID:8132
- C:\Windows\System\ZMTazRz.exe
  C:\Windows\System\ZMTazRz.exe
  2⤵
  PID:8224
- C:\Windows\System\HeGWjvR.exe
  C:\Windows\System\HeGWjvR.exe
  2⤵
  PID:8240
- C:\Windows\System\QAtfhEa.exe
  C:\Windows\System\QAtfhEa.exe
  2⤵
  PID:8276
- C:\Windows\System\JCgUNGS.exe
  C:\Windows\System\JCgUNGS.exe
  2⤵
  PID:8300
- C:\Windows\System\BaFQxGY.exe
  C:\Windows\System\BaFQxGY.exe
  2⤵
  PID:8316
- C:\Windows\System\daHdcIo.exe
  C:\Windows\System\daHdcIo.exe
  2⤵
  PID:8336
- C:\Windows\System\XmqXnsF.exe
  C:\Windows\System\XmqXnsF.exe
  2⤵
  PID:8352
- C:\Windows\System\nOzOFrU.exe
  C:\Windows\System\nOzOFrU.exe
  2⤵
  PID:8376
- C:\Windows\System\zNfnEYy.exe
  C:\Windows\System\zNfnEYy.exe
  2⤵
  PID:8404
- C:\Windows\System\KvTTnQq.exe
  C:\Windows\System\KvTTnQq.exe
  2⤵
  PID:8424
- C:\Windows\System\JWVkbCh.exe
  C:\Windows\System\JWVkbCh.exe
  2⤵
  PID:8448
- C:\Windows\System\xQdMVTF.exe
  C:\Windows\System\xQdMVTF.exe
  2⤵
  PID:8476
- C:\Windows\System\BhUVUwI.exe
  C:\Windows\System\BhUVUwI.exe
  2⤵
  PID:8496
- C:\Windows\System\KHrJSxK.exe
  C:\Windows\System\KHrJSxK.exe
  2⤵
  PID:8516
- C:\Windows\System\IAfoiOp.exe
  C:\Windows\System\IAfoiOp.exe
  2⤵
  PID:8540
- C:\Windows\System\NzJjDJt.exe
  C:\Windows\System\NzJjDJt.exe
  2⤵
  PID:8564
- C:\Windows\System\GDxWOav.exe
  C:\Windows\System\GDxWOav.exe
  2⤵
  PID:8580
- C:\Windows\System\MCXQpXs.exe
  C:\Windows\System\MCXQpXs.exe
  2⤵
  PID:8604
- C:\Windows\System\AvJlAuk.exe
  C:\Windows\System\AvJlAuk.exe
  2⤵
  PID:8632
- C:\Windows\System\YIqyQvD.exe
  C:\Windows\System\YIqyQvD.exe
  2⤵
  PID:8648
- C:\Windows\System\mKsJIxI.exe
  C:\Windows\System\mKsJIxI.exe
  2⤵
  PID:8664
- C:\Windows\System\JuvMfLB.exe
  C:\Windows\System\JuvMfLB.exe
  2⤵
  PID:8688
- C:\Windows\System\WAlMvNG.exe
  C:\Windows\System\WAlMvNG.exe
  2⤵
  PID:8708
- C:\Windows\System\xycPCJs.exe
  C:\Windows\System\xycPCJs.exe
  2⤵
  PID:8728
- C:\Windows\System\EIMpgjc.exe
  C:\Windows\System\EIMpgjc.exe
  2⤵
  PID:8748
- C:\Windows\System\cnaLHSX.exe
  C:\Windows\System\cnaLHSX.exe
  2⤵
  PID:8776
- C:\Windows\System\vpOKliw.exe
  C:\Windows\System\vpOKliw.exe
  2⤵
  PID:8796
- C:\Windows\System\APRfSzg.exe
  C:\Windows\System\APRfSzg.exe
  2⤵
  PID:8824
- C:\Windows\System\bLVLAqo.exe
  C:\Windows\System\bLVLAqo.exe
  2⤵
  PID:8840
- C:\Windows\System\nyEgaEt.exe
  C:\Windows\System\nyEgaEt.exe
  2⤵
  PID:8876
- C:\Windows\System\YkYihyQ.exe
  C:\Windows\System\YkYihyQ.exe
  2⤵
  PID:8896
- C:\Windows\System\pKjboOS.exe
  C:\Windows\System\pKjboOS.exe
  2⤵
  PID:8912
- C:\Windows\System\DaEEnEG.exe
  C:\Windows\System\DaEEnEG.exe
  2⤵
  PID:8944
- C:\Windows\System\MtYMDeh.exe
  C:\Windows\System\MtYMDeh.exe
  2⤵
  PID:8968
- C:\Windows\System\QAvgwJL.exe
  C:\Windows\System\QAvgwJL.exe
  2⤵
  PID:9000
- C:\Windows\System\ZhokCdC.exe
  C:\Windows\System\ZhokCdC.exe
  2⤵
  PID:9028
- C:\Windows\System\zJmuNaK.exe
  C:\Windows\System\zJmuNaK.exe
  2⤵
  PID:9056
- C:\Windows\System\IEhCbNY.exe
  C:\Windows\System\IEhCbNY.exe
  2⤵
  PID:9084
- C:\Windows\System\BCtCegM.exe
  C:\Windows\System\BCtCegM.exe
  2⤵
  PID:9104
- C:\Windows\System\OqXGmvk.exe
  C:\Windows\System\OqXGmvk.exe
  2⤵
  PID:9124
- C:\Windows\System\PVLQIZG.exe
  C:\Windows\System\PVLQIZG.exe
  2⤵
  PID:9144
- C:\Windows\System\qmNICXv.exe
  C:\Windows\System\qmNICXv.exe
  2⤵
  PID:9168
- C:\Windows\System\qVtbiyI.exe
  C:\Windows\System\qVtbiyI.exe
  2⤵
  PID:9188
- C:\Windows\System\wzJCLio.exe
  C:\Windows\System\wzJCLio.exe
  2⤵
  PID:9208
- C:\Windows\System\TXRoAUb.exe
  C:\Windows\System\TXRoAUb.exe
  2⤵
  PID:4560
- C:\Windows\System\xtnYHlR.exe
  C:\Windows\System\xtnYHlR.exe
  2⤵
  PID:7116
- C:\Windows\System\CvwMfKw.exe
  C:\Windows\System\CvwMfKw.exe
  2⤵
  PID:6404
- C:\Windows\System\brbFYWQ.exe
  C:\Windows\System\brbFYWQ.exe
  2⤵
  PID:7456
- C:\Windows\System\cKZcsdG.exe
  C:\Windows\System\cKZcsdG.exe
  2⤵
  PID:7424
- C:\Windows\System\uTbRJaz.exe
  C:\Windows\System\uTbRJaz.exe
  2⤵
  PID:7344
- C:\Windows\System\VTNCWpU.exe
  C:\Windows\System\VTNCWpU.exe
  2⤵
  PID:7224
- C:\Windows\System\aaPgDkf.exe
  C:\Windows\System\aaPgDkf.exe
  2⤵
  PID:7288
- C:\Windows\System\ghHdUEp.exe
  C:\Windows\System\ghHdUEp.exe
  2⤵
  PID:7328
- C:\Windows\System\FmNWCtC.exe
  C:\Windows\System\FmNWCtC.exe
  2⤵
  PID:4568
- C:\Windows\System\jtXLdqF.exe
  C:\Windows\System\jtXLdqF.exe
  2⤵
  PID:8080
- C:\Windows\System\gatvSLT.exe
  C:\Windows\System\gatvSLT.exe
  2⤵
  PID:7744
- C:\Windows\System\AcbqrWB.exe
  C:\Windows\System\AcbqrWB.exe
  2⤵
  PID:8368
- C:\Windows\System\piDGqtr.exe
  C:\Windows\System\piDGqtr.exe
  2⤵
  PID:8524
- C:\Windows\System\bRLWPea.exe
  C:\Windows\System\bRLWPea.exe
  2⤵
  PID:2372
- C:\Windows\System\ObzMmYK.exe
  C:\Windows\System\ObzMmYK.exe
  2⤵
  PID:8684
- C:\Windows\System\IauQqZo.exe
  C:\Windows\System\IauQqZo.exe
  2⤵
  PID:8744
- C:\Windows\System\lXptJOs.exe
  C:\Windows\System\lXptJOs.exe
  2⤵
  PID:2948
- C:\Windows\System\zspKeNJ.exe
  C:\Windows\System\zspKeNJ.exe
  2⤵
  PID:8768
- C:\Windows\System\eCnkawl.exe
  C:\Windows\System\eCnkawl.exe
  2⤵
  PID:4516
- C:\Windows\System\YkEDhlW.exe
  C:\Windows\System\YkEDhlW.exe
  2⤵
  PID:8308
- C:\Windows\System\YOfcoCE.exe
  C:\Windows\System\YOfcoCE.exe
  2⤵
  PID:8372
- C:\Windows\System\wLjNQZg.exe
  C:\Windows\System\wLjNQZg.exe
  2⤵
  PID:8456
- C:\Windows\System\oiuaJCz.exe
  C:\Windows\System\oiuaJCz.exe
  2⤵
  PID:7880
- C:\Windows\System\DaNFOto.exe
  C:\Windows\System\DaNFOto.exe
  2⤵
  PID:1928
- C:\Windows\System\tskPHaX.exe
  C:\Windows\System\tskPHaX.exe
  2⤵
  PID:4764
- C:\Windows\System\QrogWcN.exe
  C:\Windows\System\QrogWcN.exe
  2⤵
  PID:5084
- C:\Windows\System\UlIUBmw.exe
  C:\Windows\System\UlIUBmw.exe
  2⤵
  PID:3276
- C:\Windows\System\PGWNzLw.exe
  C:\Windows\System\PGWNzLw.exe
  2⤵
  PID:9232
- C:\Windows\System\iHJReez.exe
  C:\Windows\System\iHJReez.exe
  2⤵
  PID:9252
- C:\Windows\System\NxWbZUf.exe
  C:\Windows\System\NxWbZUf.exe
  2⤵
  PID:9272
- C:\Windows\System\nvvqDps.exe
  C:\Windows\System\nvvqDps.exe
  2⤵
  PID:9304
- C:\Windows\System\FUoLfbG.exe
  C:\Windows\System\FUoLfbG.exe
  2⤵
  PID:9324
- C:\Windows\System\zybvRVg.exe
  C:\Windows\System\zybvRVg.exe
  2⤵
  PID:9340
- C:\Windows\System\hBJmuhl.exe
  C:\Windows\System\hBJmuhl.exe
  2⤵
  PID:9364
- C:\Windows\System\xYRaCFN.exe
  C:\Windows\System\xYRaCFN.exe
  2⤵
  PID:9388
- C:\Windows\System\PYgGbsw.exe
  C:\Windows\System\PYgGbsw.exe
  2⤵
  PID:9404
- C:\Windows\System\QAGuzBb.exe
  C:\Windows\System\QAGuzBb.exe
  2⤵
  PID:9432
- C:\Windows\System\CAbZUMR.exe
  C:\Windows\System\CAbZUMR.exe
  2⤵
  PID:9452
- C:\Windows\System\adWefle.exe
  C:\Windows\System\adWefle.exe
  2⤵
  PID:9472
- C:\Windows\System\MpuzIsp.exe
  C:\Windows\System\MpuzIsp.exe
  2⤵
  PID:9488
- C:\Windows\System\wXKCTVr.exe
  C:\Windows\System\wXKCTVr.exe
  2⤵
  PID:9508
- C:\Windows\System\sCqsAkM.exe
  C:\Windows\System\sCqsAkM.exe
  2⤵
  PID:9536
- C:\Windows\System\keeILCb.exe
  C:\Windows\System\keeILCb.exe
  2⤵
  PID:9560
- C:\Windows\System\vffDXxm.exe
  C:\Windows\System\vffDXxm.exe
  2⤵
  PID:9588
- C:\Windows\System\PqfdIce.exe
  C:\Windows\System\PqfdIce.exe
  2⤵
  PID:9608
- C:\Windows\System\EwXLrBl.exe
  C:\Windows\System\EwXLrBl.exe
  2⤵
  PID:9636
- C:\Windows\System\FpVhGcr.exe
  C:\Windows\System\FpVhGcr.exe
  2⤵
  PID:9664
- C:\Windows\System\QKwSGOc.exe
  C:\Windows\System\QKwSGOc.exe
  2⤵
  PID:8292
- C:\Windows\System\zhVtUmM.exe
  C:\Windows\System\zhVtUmM.exe
  2⤵
  PID:4532
- C:\Windows\System\MpDeYRF.exe
  C:\Windows\System\MpDeYRF.exe
  2⤵
  PID:8040
- C:\Windows\System\fsGfHKI.exe
  C:\Windows\System\fsGfHKI.exe
  2⤵
  PID:8492
- C:\Windows\System\WjRYBDy.exe
  C:\Windows\System\WjRYBDy.exe
  2⤵
  PID:9080
- C:\Windows\System\aXqHmQm.exe
  C:\Windows\System\aXqHmQm.exe
  2⤵
  PID:4508
- C:\Windows\System\eMshfHh.exe
  C:\Windows\System\eMshfHh.exe
  2⤵
  PID:9204
- C:\Windows\System\RVUgVSX.exe
  C:\Windows\System\RVUgVSX.exe
  2⤵
  PID:4080
- C:\Windows\System\HqYOJaB.exe
  C:\Windows\System\HqYOJaB.exe
  2⤵
  PID:8816
- C:\Windows\System\LjXvzNg.exe
  C:\Windows\System\LjXvzNg.exe
  2⤵
  PID:7084
- C:\Windows\System\SIDiRXY.exe
  C:\Windows\System\SIDiRXY.exe
  2⤵
  PID:8884
- C:\Windows\System\tabLysA.exe
  C:\Windows\System\tabLysA.exe
  2⤵
  PID:8984
- C:\Windows\System\pJEsFco.exe
  C:\Windows\System\pJEsFco.exe
  2⤵
  PID:9036
- C:\Windows\System\MLjlQzk.exe
  C:\Windows\System\MLjlQzk.exe
  2⤵
  PID:9100
- C:\Windows\System\aePbKvp.exe
  C:\Windows\System\aePbKvp.exe
  2⤵
  PID:8700
- C:\Windows\System\agQLuBg.exe
  C:\Windows\System\agQLuBg.exe
  2⤵
  PID:9132
- C:\Windows\System\IEqfwXe.exe
  C:\Windows\System\IEqfwXe.exe
  2⤵
  PID:9200
- C:\Windows\System\rvMUNSK.exe
  C:\Windows\System\rvMUNSK.exe
  2⤵
  PID:8612
- C:\Windows\System\kkInxxI.exe
  C:\Windows\System\kkInxxI.exe
  2⤵
  PID:6912
- C:\Windows\System\oLLZRBV.exe
  C:\Windows\System\oLLZRBV.exe
  2⤵
  PID:9420
- C:\Windows\System\MBAfuGI.exe
  C:\Windows\System\MBAfuGI.exe
  2⤵
  PID:8196
- C:\Windows\System\DnbXFvz.exe
  C:\Windows\System\DnbXFvz.exe
  2⤵
  PID:8548
- C:\Windows\System\RwClONR.exe
  C:\Windows\System\RwClONR.exe
  2⤵
  PID:9440
- C:\Windows\System\ujKmECI.exe
  C:\Windows\System\ujKmECI.exe
  2⤵
  PID:9240
- C:\Windows\System\BZwmrgK.exe
  C:\Windows\System\BZwmrgK.exe
  2⤵
  PID:2660
- C:\Windows\System\LJwkWRJ.exe
  C:\Windows\System\LJwkWRJ.exe
  2⤵
  PID:7832
- C:\Windows\System\txIuDbb.exe
  C:\Windows\System\txIuDbb.exe
  2⤵
  PID:9280
- C:\Windows\System\dneqbuO.exe
  C:\Windows\System\dneqbuO.exe
  2⤵
  PID:9336
- C:\Windows\System\gCMBkdq.exe
  C:\Windows\System\gCMBkdq.exe
  2⤵
  PID:9412
- C:\Windows\System\vavjfDu.exe
  C:\Windows\System\vavjfDu.exe
  2⤵
  PID:9844
- C:\Windows\System\JClzLgF.exe
  C:\Windows\System\JClzLgF.exe
  2⤵
  PID:9528
- C:\Windows\System\meefyMu.exe
  C:\Windows\System\meefyMu.exe
  2⤵
  PID:9624
- C:\Windows\System\SLjEiwm.exe
  C:\Windows\System\SLjEiwm.exe
  2⤵
  PID:8416
- C:\Windows\System\TJwEVIG.exe
  C:\Windows\System\TJwEVIG.exe
  2⤵
  PID:9068
- C:\Windows\System\oNvzvWt.exe
  C:\Windows\System\oNvzvWt.exe
  2⤵
  PID:2656
- C:\Windows\System\wxDhbYI.exe
  C:\Windows\System\wxDhbYI.exe
  2⤵
  PID:10224
- C:\Windows\System\TjQfYmD.exe
  C:\Windows\System\TjQfYmD.exe
  2⤵
  PID:9464
- C:\Windows\System\SqWMksX.exe
  C:\Windows\System\SqWMksX.exe
  2⤵
  PID:8764
- C:\Windows\System\swrIrQe.exe
  C:\Windows\System\swrIrQe.exe
  2⤵
  PID:7300
- C:\Windows\System\XpxEDMf.exe
  C:\Windows\System\XpxEDMf.exe
  2⤵
  PID:4576
- C:\Windows\System\OrCbWrP.exe
  C:\Windows\System\OrCbWrP.exe
  2⤵
  PID:10036
- C:\Windows\System\UBBofUo.exe
  C:\Windows\System\UBBofUo.exe
  2⤵
  PID:10112
- C:\Windows\System\dXyVJtv.exe
  C:\Windows\System\dXyVJtv.exe
  2⤵
  PID:10212
- C:\Windows\System\VRHoJFI.exe
  C:\Windows\System\VRHoJFI.exe
  2⤵
  PID:8236
- C:\Windows\System\PVlfezp.exe
  C:\Windows\System\PVlfezp.exe
  2⤵
  PID:8392
- C:\Windows\System\SAOscKF.exe
  C:\Windows\System\SAOscKF.exe
  2⤵
  PID:7548
- C:\Windows\System\KEpcrtW.exe
  C:\Windows\System\KEpcrtW.exe
  2⤵
  PID:9268
- C:\Windows\System\EdyfrTl.exe
  C:\Windows\System\EdyfrTl.exe
  2⤵
  PID:8836
- C:\Windows\System\aPbPMag.exe
  C:\Windows\System\aPbPMag.exe
  2⤵
  PID:8512
- C:\Windows\System\zXrChXQ.exe
  C:\Windows\System\zXrChXQ.exe
  2⤵
  PID:10248
- C:\Windows\System\EYefAEM.exe
  C:\Windows\System\EYefAEM.exe
  2⤵
  PID:10276
- C:\Windows\System\GCGWZDJ.exe
  C:\Windows\System\GCGWZDJ.exe
  2⤵
  PID:10296
- C:\Windows\System\GVIBRom.exe
  C:\Windows\System\GVIBRom.exe
  2⤵
  PID:10316
- C:\Windows\System\JuHVltx.exe
  C:\Windows\System\JuHVltx.exe
  2⤵
  PID:10340
- C:\Windows\System\BtEfzGO.exe
  C:\Windows\System\BtEfzGO.exe
  2⤵
  PID:10356
- C:\Windows\System\cQXyTTy.exe
  C:\Windows\System\cQXyTTy.exe
  2⤵
  PID:10380
- C:\Windows\System\ceuaHZN.exe
  C:\Windows\System\ceuaHZN.exe
  2⤵
  PID:10404
- C:\Windows\System\SkUsUbc.exe
  C:\Windows\System\SkUsUbc.exe
  2⤵
  PID:10420
- C:\Windows\System\ywDXHXP.exe
  C:\Windows\System\ywDXHXP.exe
  2⤵
  PID:10440
- C:\Windows\System\MMqmrOq.exe
  C:\Windows\System\MMqmrOq.exe
  2⤵
  PID:10464
- C:\Windows\System\UROJSYV.exe
  C:\Windows\System\UROJSYV.exe
  2⤵
  PID:10492
- C:\Windows\System\EujhpUU.exe
  C:\Windows\System\EujhpUU.exe
  2⤵
  PID:10512
- C:\Windows\System\SniFBSd.exe
  C:\Windows\System\SniFBSd.exe
  2⤵
  PID:10532
- C:\Windows\System\dqUMLCH.exe
  C:\Windows\System\dqUMLCH.exe
  2⤵
  PID:10572
- C:\Windows\System\KeSsHdz.exe
  C:\Windows\System\KeSsHdz.exe
  2⤵
  PID:10588
- C:\Windows\System\fnfBiUB.exe
  C:\Windows\System\fnfBiUB.exe
  2⤵
  PID:10612
- C:\Windows\System\YNTpXiB.exe
  C:\Windows\System\YNTpXiB.exe
  2⤵
  PID:10636
- C:\Windows\System\RqHhJhO.exe
  C:\Windows\System\RqHhJhO.exe
  2⤵
  PID:10656
- C:\Windows\System\sfioZzB.exe
  C:\Windows\System\sfioZzB.exe
  2⤵
  PID:10680
- C:\Windows\System\wRvIPdW.exe
  C:\Windows\System\wRvIPdW.exe
  2⤵
  PID:10704
- C:\Windows\System\GpjjdkX.exe
  C:\Windows\System\GpjjdkX.exe
  2⤵
  PID:10724
- C:\Windows\System\xntAEEl.exe
  C:\Windows\System\xntAEEl.exe
  2⤵
  PID:10748
- C:\Windows\System\NHdQBBh.exe
  C:\Windows\System\NHdQBBh.exe
  2⤵
  PID:10776
- C:\Windows\System\OdcAjmW.exe
  C:\Windows\System\OdcAjmW.exe
  2⤵
  PID:10796
- C:\Windows\System\zcxzVGX.exe
  C:\Windows\System\zcxzVGX.exe
  2⤵
  PID:10812
- C:\Windows\System\dTZGCEQ.exe
  C:\Windows\System\dTZGCEQ.exe
  2⤵
  PID:10840
- C:\Windows\System\ujlMTAc.exe
  C:\Windows\System\ujlMTAc.exe
  2⤵
  PID:10864
- C:\Windows\System\nUTPFdK.exe
  C:\Windows\System\nUTPFdK.exe
  2⤵
  PID:10888
- C:\Windows\System\QXYoFTi.exe
  C:\Windows\System\QXYoFTi.exe
  2⤵
  PID:10904
- C:\Windows\System\PjvoPqq.exe
  C:\Windows\System\PjvoPqq.exe
  2⤵
  PID:10920
- C:\Windows\System\hGaUXEe.exe
  C:\Windows\System\hGaUXEe.exe
  2⤵
  PID:10936
- C:\Windows\System\lvKknnF.exe
  C:\Windows\System\lvKknnF.exe
  2⤵
  PID:10952
- C:\Windows\System\dWcqVVa.exe
  C:\Windows\System\dWcqVVa.exe
  2⤵
  PID:10968
- C:\Windows\System\erqGxXH.exe
  C:\Windows\System\erqGxXH.exe
  2⤵
  PID:10984
- C:\Windows\System\nLkytII.exe
  C:\Windows\System\nLkytII.exe
  2⤵
  PID:11000
- C:\Windows\System\kQZncrk.exe
  C:\Windows\System\kQZncrk.exe
  2⤵
  PID:11024
- C:\Windows\System\zmluEDW.exe
  C:\Windows\System\zmluEDW.exe
  2⤵
  PID:11056
- C:\Windows\System\iqAEyln.exe
  C:\Windows\System\iqAEyln.exe
  2⤵
  PID:11076
- C:\Windows\System\bifkize.exe
  C:\Windows\System\bifkize.exe
  2⤵
  PID:11096
- C:\Windows\System\cnCWoWC.exe
  C:\Windows\System\cnCWoWC.exe
  2⤵
  PID:11116
- C:\Windows\System\jPJBiMT.exe
  C:\Windows\System\jPJBiMT.exe
  2⤵
  PID:11136
- C:\Windows\System\YEdcbcV.exe
  C:\Windows\System\YEdcbcV.exe
  2⤵
  PID:11160
- C:\Windows\System\vgdFOQM.exe
  C:\Windows\System\vgdFOQM.exe
  2⤵
  PID:11180
- C:\Windows\System\SSilTRl.exe
  C:\Windows\System\SSilTRl.exe
  2⤵
  PID:11208
- C:\Windows\System\gsdnKwD.exe
  C:\Windows\System\gsdnKwD.exe
  2⤵
  PID:11236
- C:\Windows\System\ipmUcUT.exe
  C:\Windows\System\ipmUcUT.exe
  2⤵
  PID:11256
- C:\Windows\System\RRSqZnk.exe
  C:\Windows\System\RRSqZnk.exe
  2⤵
  PID:9400
- C:\Windows\System\AzASqTZ.exe
  C:\Windows\System\AzASqTZ.exe
  2⤵
  PID:9892
- C:\Windows\System\RhBoNyL.exe
  C:\Windows\System\RhBoNyL.exe
  2⤵
  PID:7984
- C:\Windows\System\bmWkjjQ.exe
  C:\Windows\System\bmWkjjQ.exe
  2⤵
  PID:9248
- C:\Windows\System\ZsBzIEe.exe
  C:\Windows\System\ZsBzIEe.exe
  2⤵
  PID:4540
- C:\Windows\System\ZOXNvUR.exe
  C:\Windows\System\ZOXNvUR.exe
  2⤵
  PID:9812
- C:\Windows\System\CsERISA.exe
  C:\Windows\System\CsERISA.exe
  2⤵
  PID:4588
- C:\Windows\System\cjHilCF.exe
  C:\Windows\System\cjHilCF.exe
  2⤵
  PID:8956
- C:\Windows\System\zBRQuTP.exe
  C:\Windows\System\zBRQuTP.exe
  2⤵
  PID:10244
- C:\Windows\System\acrVwjm.exe
  C:\Windows\System\acrVwjm.exe
  2⤵
  PID:10304
- C:\Windows\System\udEdBHa.exe
  C:\Windows\System\udEdBHa.exe
  2⤵
  PID:10352
- C:\Windows\System\IuACoCk.exe
  C:\Windows\System\IuACoCk.exe
  2⤵
  PID:3200
- C:\Windows\System\abooTkM.exe
  C:\Windows\System\abooTkM.exe
  2⤵
  PID:8248
- C:\Windows\System\TGxZseD.exe
  C:\Windows\System\TGxZseD.exe
  2⤵
  PID:10604
- C:\Windows\System\MYqnUoM.exe
  C:\Windows\System\MYqnUoM.exe
  2⤵
  PID:10716
- C:\Windows\System\xVVwoSk.exe
  C:\Windows\System\xVVwoSk.exe
  2⤵
  PID:7592
- C:\Windows\System\JPPURPx.exe
  C:\Windows\System\JPPURPx.exe
  2⤵
  PID:10856
- C:\Windows\System\KPKQnEu.exe
  C:\Windows\System\KPKQnEu.exe
  2⤵
  PID:10928
- C:\Windows\System\LWYAiEV.exe
  C:\Windows\System\LWYAiEV.exe
  2⤵
  PID:10980
- C:\Windows\System\Qdycedd.exe
  C:\Windows\System\Qdycedd.exe
  2⤵
  PID:11088
- C:\Windows\System\JAckxLz.exe
  C:\Windows\System\JAckxLz.exe
  2⤵
  PID:8552
- C:\Windows\System\EtRquMI.exe
  C:\Windows\System\EtRquMI.exe
  2⤵
  PID:10476
- C:\Windows\System\iPyuVNb.exe
  C:\Windows\System\iPyuVNb.exe
  2⤵
  PID:10500
- C:\Windows\System\FKTijms.exe
  C:\Windows\System\FKTijms.exe
  2⤵
  PID:8904
- C:\Windows\System\MikzVNO.exe
  C:\Windows\System\MikzVNO.exe
  2⤵
  PID:11284
- C:\Windows\System\PLHyaum.exe
  C:\Windows\System\PLHyaum.exe
  2⤵
  PID:11308
- C:\Windows\System\LnZKvjY.exe
  C:\Windows\System\LnZKvjY.exe
  2⤵
  PID:11328
- C:\Windows\System\lRTyLhh.exe
  C:\Windows\System\lRTyLhh.exe
  2⤵
  PID:11344
- C:\Windows\System\JuZKncm.exe
  C:\Windows\System\JuZKncm.exe
  2⤵
  PID:11364
- C:\Windows\System\ZjQKIvL.exe
  C:\Windows\System\ZjQKIvL.exe
  2⤵
  PID:11384
- C:\Windows\System\yfyFiCy.exe
  C:\Windows\System\yfyFiCy.exe
  2⤵
  PID:11400
- C:\Windows\System\RSoNtNO.exe
  C:\Windows\System\RSoNtNO.exe
  2⤵
  PID:11416
- C:\Windows\System\GWCKXiT.exe
  C:\Windows\System\GWCKXiT.exe
  2⤵
  PID:11432
- C:\Windows\System\aUppFDg.exe
  C:\Windows\System\aUppFDg.exe
  2⤵
  PID:11456
- C:\Windows\System\mcLHYHC.exe
  C:\Windows\System\mcLHYHC.exe
  2⤵
  PID:11480
- C:\Windows\System\VxrIrnI.exe
  C:\Windows\System\VxrIrnI.exe
  2⤵
  PID:11500
- C:\Windows\System\hebAiDB.exe
  C:\Windows\System\hebAiDB.exe
  2⤵
  PID:11524
- C:\Windows\System\wUBWUoM.exe
  C:\Windows\System\wUBWUoM.exe
  2⤵
  PID:11544
- C:\Windows\System\Wqkjibh.exe
  C:\Windows\System\Wqkjibh.exe
  2⤵
  PID:11564
- C:\Windows\System\UEZPyGq.exe
  C:\Windows\System\UEZPyGq.exe
  2⤵
  PID:11592
- C:\Windows\System\YdLbkjI.exe
  C:\Windows\System\YdLbkjI.exe
  2⤵
  PID:11612
- C:\Windows\System\TSmREjm.exe
  C:\Windows\System\TSmREjm.exe
  2⤵
  PID:11628
- C:\Windows\System\qIfTeqw.exe
  C:\Windows\System\qIfTeqw.exe
  2⤵
  PID:11648
- C:\Windows\System\jgpGwbE.exe
  C:\Windows\System\jgpGwbE.exe
  2⤵
  PID:11672
- C:\Windows\System\jkKrmNG.exe
  C:\Windows\System\jkKrmNG.exe
  2⤵
  PID:11692
- C:\Windows\System\vGZiVVo.exe
  C:\Windows\System\vGZiVVo.exe
  2⤵
  PID:11716
- C:\Windows\System\jdOIceC.exe
  C:\Windows\System\jdOIceC.exe
  2⤵
  PID:11744
- C:\Windows\System\DwyJsvP.exe
  C:\Windows\System\DwyJsvP.exe
  2⤵
  PID:11768
- C:\Windows\System\kULaNwu.exe
  C:\Windows\System\kULaNwu.exe
  2⤵
  PID:11788
- C:\Windows\System\SnwUzFD.exe
  C:\Windows\System\SnwUzFD.exe
  2⤵
  PID:11808
- C:\Windows\System\yEkMqpe.exe
  C:\Windows\System\yEkMqpe.exe
  2⤵
  PID:11836
- C:\Windows\System\FYjtEsx.exe
  C:\Windows\System\FYjtEsx.exe
  2⤵
  PID:11864
- C:\Windows\System\VHAZVai.exe
  C:\Windows\System\VHAZVai.exe
  2⤵
  PID:11892
- C:\Windows\System\XxttXtx.exe
  C:\Windows\System\XxttXtx.exe
  2⤵
  PID:11908
- C:\Windows\System\apyQGQP.exe
  C:\Windows\System\apyQGQP.exe
  2⤵
  PID:11936
- C:\Windows\System\sLLVeAB.exe
  C:\Windows\System\sLLVeAB.exe
  2⤵
  PID:11964
- C:\Windows\System\uHIjwYr.exe
  C:\Windows\System\uHIjwYr.exe
  2⤵
  PID:11980
- C:\Windows\System\hrZMbgy.exe
  C:\Windows\System\hrZMbgy.exe
  2⤵
  PID:12000
- C:\Windows\System\LsucuiO.exe
  C:\Windows\System\LsucuiO.exe
  2⤵
  PID:12024
- C:\Windows\System\IPqqmIY.exe
  C:\Windows\System\IPqqmIY.exe
  2⤵
  PID:12044
- C:\Windows\System\tvaYGEI.exe
  C:\Windows\System\tvaYGEI.exe
  2⤵
  PID:12072
- C:\Windows\System\uXWhCxb.exe
  C:\Windows\System\uXWhCxb.exe
  2⤵
  PID:12092
- C:\Windows\System\YiXnNHm.exe
  C:\Windows\System\YiXnNHm.exe
  2⤵
  PID:12112
- C:\Windows\System\xCumTWX.exe
  C:\Windows\System\xCumTWX.exe
  2⤵
  PID:12140
- C:\Windows\System\FcvpbEW.exe
  C:\Windows\System\FcvpbEW.exe
  2⤵
  PID:12172
- C:\Windows\System\RDIosqv.exe
  C:\Windows\System\RDIosqv.exe
  2⤵
  PID:12200
- C:\Windows\System\enXggww.exe
  C:\Windows\System\enXggww.exe
  2⤵
  PID:12224
- C:\Windows\System\zXuYdcs.exe
  C:\Windows\System\zXuYdcs.exe
  2⤵
  PID:12248
- C:\Windows\System\mYiTFaU.exe
  C:\Windows\System\mYiTFaU.exe
  2⤵
  PID:12268
- C:\Windows\System\pIvxtrh.exe
  C:\Windows\System\pIvxtrh.exe
  2⤵
  PID:8140
- C:\Windows\System\RyYYNXq.exe
  C:\Windows\System\RyYYNXq.exe
  2⤵
  PID:9704
- C:\Windows\System\cTCnRYN.exe
  C:\Windows\System\cTCnRYN.exe
  2⤵
  PID:10900
- C:\Windows\System\QvTyYSq.exe
  C:\Windows\System\QvTyYSq.exe
  2⤵
  PID:10964
- C:\Windows\System\zqFJSSL.exe
  C:\Windows\System\zqFJSSL.exe
  2⤵
  PID:11044
- C:\Windows\System\lKWYKhR.exe
  C:\Windows\System\lKWYKhR.exe
  2⤵
  PID:2528
- C:\Windows\System\oDYhKmg.exe
  C:\Windows\System\oDYhKmg.exe
  2⤵
  PID:1720
- C:\Windows\System\UvHpdZZ.exe
  C:\Windows\System\UvHpdZZ.exe
  2⤵
  PID:10308
- C:\Windows\System\GAWngUt.exe
  C:\Windows\System\GAWngUt.exe
  2⤵
  PID:10172
- C:\Windows\System\oomrxmf.exe
  C:\Windows\System\oomrxmf.exe
  2⤵
  PID:460
- C:\Windows\System\EAEUOZq.exe
  C:\Windows\System\EAEUOZq.exe
  2⤵
  PID:10580
- C:\Windows\System\QImbMqL.exe
  C:\Windows\System\QImbMqL.exe
  2⤵
  PID:10652
- C:\Windows\System\AKOyJXq.exe
  C:\Windows\System\AKOyJXq.exe
  2⤵
  PID:10688
- C:\Windows\System\xrOYFog.exe
  C:\Windows\System\xrOYFog.exe
  2⤵
  PID:10736
- C:\Windows\System\gAcAXJd.exe
  C:\Windows\System\gAcAXJd.exe
  2⤵
  PID:3036
- C:\Windows\System\adoyhQG.exe
  C:\Windows\System\adoyhQG.exe
  2⤵
  PID:3896
- C:\Windows\System\jciJmOb.exe
  C:\Windows\System\jciJmOb.exe
  2⤵
  PID:10792
- C:\Windows\System\TievfMQ.exe
  C:\Windows\System\TievfMQ.exe
  2⤵
  PID:11396
- C:\Windows\System\qTgptKV.exe
  C:\Windows\System\qTgptKV.exe
  2⤵
  PID:10804
- C:\Windows\System\GUkJiIy.exe
  C:\Windows\System\GUkJiIy.exe
  2⤵
  PID:10836
- C:\Windows\System\zIZApGu.exe
  C:\Windows\System\zIZApGu.exe
  2⤵
  PID:4380
- C:\Windows\System\nWahXLM.exe
  C:\Windows\System\nWahXLM.exe
  2⤵
  PID:12300
- C:\Windows\System\ckjgqbl.exe
  C:\Windows\System\ckjgqbl.exe
  2⤵
  PID:12324
- C:\Windows\System\phALZYe.exe
  C:\Windows\System\phALZYe.exe
  2⤵
  PID:12348
- C:\Windows\System\ooUlfkS.exe
  C:\Windows\System\ooUlfkS.exe
  2⤵
  PID:12368
- C:\Windows\System\XkVuuxD.exe
  C:\Windows\System\XkVuuxD.exe
  2⤵
  PID:12392
- C:\Windows\System\vZUHoJL.exe
  C:\Windows\System\vZUHoJL.exe
  2⤵
  PID:12416
- C:\Windows\System\yrQTrKH.exe
  C:\Windows\System\yrQTrKH.exe
  2⤵
  PID:12440
- C:\Windows\System\snPFWDt.exe
  C:\Windows\System\snPFWDt.exe
  2⤵
  PID:12460
- C:\Windows\System\wODWRAq.exe
  C:\Windows\System\wODWRAq.exe
  2⤵
  PID:12484
- C:\Windows\System\CMcdTkm.exe
  C:\Windows\System\CMcdTkm.exe
  2⤵
  PID:12512
- C:\Windows\System\afkgADA.exe
  C:\Windows\System\afkgADA.exe
  2⤵
  PID:12536
- C:\Windows\System\AMBmwSh.exe
  C:\Windows\System\AMBmwSh.exe
  2⤵
  PID:12552
- C:\Windows\System\wwfEmaP.exe
  C:\Windows\System\wwfEmaP.exe
  2⤵
  PID:12576
- C:\Windows\System\aseeElh.exe
  C:\Windows\System\aseeElh.exe
  2⤵
  PID:12596
- C:\Windows\System\gwMAejk.exe
  C:\Windows\System\gwMAejk.exe
  2⤵
  PID:12624
- C:\Windows\System\IJMJbxs.exe
  C:\Windows\System\IJMJbxs.exe
  2⤵
  PID:12652
- C:\Windows\System\RCVqczr.exe
  C:\Windows\System\RCVqczr.exe
  2⤵
  PID:12668
- C:\Windows\System\qsPmuLm.exe
  C:\Windows\System\qsPmuLm.exe
  2⤵
  PID:12704
- C:\Windows\System\DfMMlcN.exe
  C:\Windows\System\DfMMlcN.exe
  2⤵
  PID:10328
- C:\Windows\System\aDYeLZd.exe
  C:\Windows\System\aDYeLZd.exe
  2⤵
  PID:11108
- C:\Windows\System\YjrRSJP.exe
  C:\Windows\System\YjrRSJP.exe
  2⤵
  PID:12052
- C:\Windows\System\yyXPOkm.exe
  C:\Windows\System\yyXPOkm.exe
  2⤵
  PID:11252
- C:\Windows\System\oQoBFOP.exe
  C:\Windows\System\oQoBFOP.exe
  2⤵
  PID:12236
- C:\Windows\System\pDnWWtT.exe
  C:\Windows\System\pDnWWtT.exe
  2⤵
  PID:11376
- C:\Windows\System\uXxkuBA.exe
  C:\Windows\System\uXxkuBA.exe
  2⤵
  PID:10564
- C:\Windows\System\GcAnRQl.exe
  C:\Windows\System\GcAnRQl.exe
  2⤵
  PID:10608
- C:\Windows\System\eLaAaHb.exe
  C:\Windows\System\eLaAaHb.exe
  2⤵
  PID:10700
- C:\Windows\System\BEORgOP.exe
  C:\Windows\System\BEORgOP.exe
  2⤵
  PID:11408
- C:\Windows\System\ZjQXXwZ.exe
  C:\Windows\System\ZjQXXwZ.exe
  2⤵
  PID:9808
- C:\Windows\System\aMotDuI.exe
  C:\Windows\System\aMotDuI.exe
  2⤵
  PID:12360
- C:\Windows\System\ybHzYXn.exe
  C:\Windows\System\ybHzYXn.exe
  2⤵
  PID:12424
- C:\Windows\System\iduHnBH.exe
  C:\Windows\System\iduHnBH.exe
  2⤵
  PID:12452
- C:\Windows\System\cbyXhBt.exe
  C:\Windows\System\cbyXhBt.exe
  2⤵
  PID:12496
- C:\Windows\System\crJVaPu.exe
  C:\Windows\System\crJVaPu.exe
  2⤵
  PID:12520
- C:\Windows\System\QcemdEN.exe
  C:\Windows\System\QcemdEN.exe
  2⤵
  PID:9480
- C:\Windows\System\ESBUkun.exe
  C:\Windows\System\ESBUkun.exe
  2⤵
  PID:8464
- C:\Windows\System\ulJdTQk.exe
  C:\Windows\System\ulJdTQk.exe
  2⤵
  PID:10284
- C:\Windows\System\leLOBit.exe
  C:\Windows\System\leLOBit.exe
  2⤵
  PID:10436
- C:\Windows\System\ltBqZUy.exe
  C:\Windows\System\ltBqZUy.exe
  2⤵
  PID:12216
- C:\Windows\System\KIXRvmg.exe
  C:\Windows\System\KIXRvmg.exe
  2⤵
  PID:11428
- C:\Windows\System\pcunHzg.exe
  C:\Windows\System\pcunHzg.exe
  2⤵
  PID:11464
- C:\Windows\System\WAUqJHk.exe
  C:\Windows\System\WAUqJHk.exe
  2⤵
  PID:12336
- C:\Windows\System\vRcDbZU.exe
  C:\Windows\System\vRcDbZU.exe
  2⤵
  PID:12592
- C:\Windows\System\vuQNjFX.exe
  C:\Windows\System\vuQNjFX.exe
  2⤵
  PID:11820
- C:\Windows\System\gHsRRak.exe
  C:\Windows\System\gHsRRak.exe
  2⤵
  PID:11876
- C:\Windows\System\fOnPCxR.exe
  C:\Windows\System\fOnPCxR.exe
  2⤵
  PID:11928
- C:\Windows\System\xgWmdfk.exe
  C:\Windows\System\xgWmdfk.exe
  2⤵
  PID:11996
- C:\Windows\System\nmEAJkH.exe
  C:\Windows\System\nmEAJkH.exe
  2⤵
  PID:12036
- C:\Windows\System\qlUqaNr.exe
  C:\Windows\System\qlUqaNr.exe
  2⤵
  PID:12804
- C:\Windows\System\gJbDKab.exe
  C:\Windows\System\gJbDKab.exe
  2⤵
  PID:12848
- C:\Windows\System\xUNKNBD.exe
  C:\Windows\System\xUNKNBD.exe
  2⤵
  PID:12880
- C:\Windows\System\lvgjxcf.exe
  C:\Windows\System\lvgjxcf.exe
  2⤵
  PID:12588
- C:\Windows\System\vjHtoIn.exe
  C:\Windows\System\vjHtoIn.exe
  2⤵
  PID:12680
- C:\Windows\System\rQnKTzb.exe
  C:\Windows\System\rQnKTzb.exe
  2⤵
  PID:12720
- C:\Windows\System\EOUqwbo.exe
  C:\Windows\System\EOUqwbo.exe
  2⤵
  PID:12772
- C:\Windows\System\lySsWLh.exe
  C:\Windows\System\lySsWLh.exe
  2⤵
  PID:12948
- C:\Windows\System\pWnUNTj.exe
  C:\Windows\System\pWnUNTj.exe
  2⤵
  PID:12988
- C:\Windows\System\ZTwweKy.exe
  C:\Windows\System\ZTwweKy.exe
  2⤵
  PID:12936
- C:\Windows\System\GGyQtCm.exe
  C:\Windows\System\GGyQtCm.exe
  2⤵
  PID:12752
- C:\Windows\System\LuzWkGK.exe
  C:\Windows\System\LuzWkGK.exe
  2⤵
  PID:12960
- C:\Windows\System\hMxXOOa.exe
  C:\Windows\System\hMxXOOa.exe
  2⤵
  PID:12916
- C:\Windows\System\fygypGv.exe
  C:\Windows\System\fygypGv.exe
  2⤵
  PID:13048
- C:\Windows\System\YQMDDqG.exe
  C:\Windows\System\YQMDDqG.exe
  2⤵
  PID:13184
- C:\Windows\System\uqGCAVk.exe
  C:\Windows\System\uqGCAVk.exe
  2⤵
  PID:13164
- C:\Windows\System\PNRnMWI.exe
  C:\Windows\System\PNRnMWI.exe
  2⤵
  PID:11176
- C:\Windows\System\UHvzsmF.exe
  C:\Windows\System\UHvzsmF.exe
  2⤵
  PID:7680
- C:\Windows\System\BPTgrbc.exe
  C:\Windows\System\BPTgrbc.exe
  2⤵
  PID:11248
- C:\Windows\System\ANSMOMN.exe
  C:\Windows\System\ANSMOMN.exe
  2⤵
  PID:11320
- C:\Windows\System\rtaYajG.exe
  C:\Windows\System\rtaYajG.exe
  2⤵
  PID:3472
- C:\Windows\System\TmFxdxI.exe
  C:\Windows\System\TmFxdxI.exe
  2⤵
  PID:12316
- C:\Windows\System\xRjGWNu.exe
  C:\Windows\System\xRjGWNu.exe
  2⤵
  PID:11604
- C:\Windows\System\xYCGpPa.exe
  C:\Windows\System\xYCGpPa.exe
  2⤵
  PID:11624
- C:\Windows\System\OhrLKba.exe
  C:\Windows\System\OhrLKba.exe
  2⤵
  PID:11972
- C:\Windows\System\KJIWTZN.exe
  C:\Windows\System\KJIWTZN.exe
  2⤵
  PID:12212
- C:\Windows\System\yYUdlGY.exe
  C:\Windows\System\yYUdlGY.exe
  2⤵
  PID:11740
- C:\Windows\System\DlCjQyD.exe
  C:\Windows\System\DlCjQyD.exe
  2⤵
  PID:11724
- C:\Windows\System\OZuefur.exe
  C:\Windows\System\OZuefur.exe
  2⤵
  PID:12020
- C:\Windows\System\oULSPCh.exe
  C:\Windows\System\oULSPCh.exe
  2⤵
  PID:11452
- C:\Windows\System\XrgxyPj.exe
  C:\Windows\System\XrgxyPj.exe
  2⤵
  PID:11852
- C:\Windows\System\qbbXNoF.exe
  C:\Windows\System\qbbXNoF.exe
  2⤵
  PID:12800
- C:\Windows\System\YLuOppD.exe
  C:\Windows\System\YLuOppD.exe
  2⤵
  PID:4960
- C:\Windows\System\CXqQHOG.exe
  C:\Windows\System\CXqQHOG.exe
  2⤵
  PID:10068
- C:\Windows\System\KFelBTY.exe
  C:\Windows\System\KFelBTY.exe
  2⤵
  PID:13400
- C:\Windows\System\LHcjpIa.exe
  C:\Windows\System\LHcjpIa.exe
  2⤵
  PID:13484
- C:\Windows\System\kguDSmC.exe
  C:\Windows\System\kguDSmC.exe
  2⤵
  PID:13512
- C:\Windows\System\KqtkqLa.exe
  C:\Windows\System\KqtkqLa.exe
  2⤵
  PID:13532
- C:\Windows\System\cIznuHN.exe
  C:\Windows\System\cIznuHN.exe
  2⤵
  PID:13552
- C:\Windows\System\HegxSWA.exe
  C:\Windows\System\HegxSWA.exe
  2⤵
  PID:13576
- C:\Windows\System\yRPyRtg.exe
  C:\Windows\System\yRPyRtg.exe
  2⤵
  PID:13596
- C:\Windows\System\AzljpHx.exe
  C:\Windows\System\AzljpHx.exe
  2⤵
  PID:13624
- C:\Windows\System\phmXXNr.exe
  C:\Windows\System\phmXXNr.exe
  2⤵
  PID:13644
- C:\Windows\System\WrYYmKl.exe
  C:\Windows\System\WrYYmKl.exe
  2⤵
  PID:13776
- C:\Windows\System\qaRoHgA.exe
  C:\Windows\System\qaRoHgA.exe
  2⤵
  PID:13864
- C:\Windows\System\SDbBQez.exe
  C:\Windows\System\SDbBQez.exe
  2⤵
  PID:13976
- C:\Windows\System\cVdPpwB.exe
  C:\Windows\System\cVdPpwB.exe
  2⤵
  PID:14004
- C:\Windows\System\cfKaMFv.exe
  C:\Windows\System\cfKaMFv.exe
  2⤵
  PID:14036
- C:\Windows\System\EkdEwXP.exe
  C:\Windows\System\EkdEwXP.exe
  2⤵
  PID:14064
- C:\Windows\System\xkEjgYD.exe
  C:\Windows\System\xkEjgYD.exe
  2⤵
  PID:14092
- C:\Windows\System\pMxgKSA.exe
  C:\Windows\System\pMxgKSA.exe
  2⤵
  PID:14108
- C:\Windows\System\tmQdkkt.exe
  C:\Windows\System\tmQdkkt.exe
  2⤵
  PID:14128
- C:\Windows\System\SvjHVkH.exe
  C:\Windows\System\SvjHVkH.exe
  2⤵
  PID:14144
- C:\Windows\System\ceLnCWL.exe
  C:\Windows\System\ceLnCWL.exe
  2⤵
  PID:14164
- C:\Windows\System\ZGJBYoD.exe
  C:\Windows\System\ZGJBYoD.exe
  2⤵
  PID:14192
- C:\Windows\System\UCeMmhS.exe
  C:\Windows\System\UCeMmhS.exe
  2⤵
  PID:14208
- C:\Windows\System\eDvZjcT.exe
  C:\Windows\System\eDvZjcT.exe
  2⤵
  PID:14236
- C:\Windows\System\mNcmdxX.exe
  C:\Windows\System\mNcmdxX.exe
  2⤵
  PID:14284
- C:\Windows\System\qOqBCQC.exe
  C:\Windows\System\qOqBCQC.exe
  2⤵
  PID:12892
- C:\Windows\System\eYmzfLZ.exe
  C:\Windows\System\eYmzfLZ.exe
  2⤵
  PID:8672
- C:\Windows\System\AAvVeAA.exe
  C:\Windows\System\AAvVeAA.exe
  2⤵
  PID:10872
- C:\Windows\System\zWfbnwT.exe
  C:\Windows\System\zWfbnwT.exe
  2⤵
  PID:13344
- C:\Windows\System\rbbjemW.exe
  C:\Windows\System\rbbjemW.exe
  2⤵
  PID:11532
- C:\Windows\System\zsGOSmi.exe
  C:\Windows\System\zsGOSmi.exe
  2⤵
  PID:13200
- C:\Windows\System\rmSWXeY.exe
  C:\Windows\System\rmSWXeY.exe
  2⤵
  PID:12148
- C:\Windows\System\niCUMfE.exe
  C:\Windows\System\niCUMfE.exe
  2⤵
  PID:13716
- C:\Windows\System\gKdqoSv.exe
  C:\Windows\System\gKdqoSv.exe
  2⤵
  PID:13652
- C:\Windows\System\lagPBVJ.exe
  C:\Windows\System\lagPBVJ.exe
  2⤵
  PID:13180
- C:\Windows\System\hRwaapi.exe
  C:\Windows\System\hRwaapi.exe
  2⤵
  PID:11200
- C:\Windows\System\jsGUpzn.exe
  C:\Windows\System\jsGUpzn.exe
  2⤵
  PID:12280
- C:\Windows\System\xrkwOvy.exe
  C:\Windows\System\xrkwOvy.exe
  2⤵
  PID:5900
- C:\Windows\System\FCgoZwX.exe
  C:\Windows\System\FCgoZwX.exe
  2⤵
  PID:14280
- C:\Windows\System\CLgXRJy.exe
  C:\Windows\System\CLgXRJy.exe
  2⤵
  PID:4952
- C:\Windows\System\IMuJoWs.exe
  C:\Windows\System\IMuJoWs.exe
  2⤵
  PID:9556
- C:\Windows\System\gWgmvoP.exe
  C:\Windows\System\gWgmvoP.exe
  2⤵
  PID:13084
- C:\Windows\System\Zjfwtbx.exe
  C:\Windows\System\Zjfwtbx.exe
  2⤵
  PID:12964
- C:\Windows\System\yUsRFBf.exe
  C:\Windows\System\yUsRFBf.exe
  2⤵
  PID:9976
- C:\Windows\System\NqhsyYA.exe
  C:\Windows\System\NqhsyYA.exe
  2⤵
  PID:13420
- C:\Windows\System\NCErlxN.exe
  C:\Windows\System\NCErlxN.exe
  2⤵
  PID:12568
- C:\Windows\System\kajcMhw.exe
  C:\Windows\System\kajcMhw.exe
  2⤵
  PID:11300
- C:\Windows\System\UzhJXvo.exe
  C:\Windows\System\UzhJXvo.exe
  2⤵
  PID:13440
- C:\Windows\System\bdIAbwD.exe
  C:\Windows\System\bdIAbwD.exe
  2⤵
  PID:12456
- C:\Windows\System\eLDeEEw.exe
  C:\Windows\System\eLDeEEw.exe
  2⤵
  PID:11944
- C:\Windows\System\SVzKWZo.exe
  C:\Windows\System\SVzKWZo.exe
  2⤵
  PID:10376
- C:\Windows\System\AVcSmLG.exe
  C:\Windows\System\AVcSmLG.exe
  2⤵
  PID:11132
- C:\Windows\System\ltfVJCt.exe
  C:\Windows\System\ltfVJCt.exe
  2⤵
  PID:5612
- C:\Windows\System\uVxVFhr.exe
  C:\Windows\System\uVxVFhr.exe
  2⤵
  PID:13348
- C:\Windows\System\xynMrxK.exe
  C:\Windows\System\xynMrxK.exe
  2⤵
  PID:13372
- C:\Windows\System\ElamiYh.exe
  C:\Windows\System\ElamiYh.exe
  2⤵
  PID:13380
- C:\Windows\System\ogsJwLZ.exe
  C:\Windows\System\ogsJwLZ.exe
  2⤵
  PID:13500
- C:\Windows\System\mtMPevE.exe
  C:\Windows\System\mtMPevE.exe
  2⤵
  PID:13460
- C:\Windows\System\PYoRWGD.exe
  C:\Windows\System\PYoRWGD.exe
  2⤵
  PID:13616
- C:\Windows\System\XjuirMT.exe
  C:\Windows\System\XjuirMT.exe
  2⤵
  PID:13520
- C:\Windows\System\dLuekDZ.exe
  C:\Windows\System\dLuekDZ.exe
  2⤵
  PID:13528
- C:\Windows\System\nBrRGWj.exe
  C:\Windows\System\nBrRGWj.exe
  2⤵
  PID:5236
- C:\Windows\System\qtICsGJ.exe
  C:\Windows\System\qtICsGJ.exe
  2⤵
  PID:13636
- C:\Windows\System\Aetbfky.exe
  C:\Windows\System\Aetbfky.exe
  2⤵
  PID:13808
- C:\Windows\System\hyxhYyw.exe
  C:\Windows\System\hyxhYyw.exe
  2⤵
  PID:2168
- C:\Windows\System\rVeuzaB.exe
  C:\Windows\System\rVeuzaB.exe
  2⤵
  PID:11800
- C:\Windows\System\AryuTfX.exe
  C:\Windows\System\AryuTfX.exe
  2⤵
  PID:13736
- C:\Windows\System\KgrxaGL.exe
  C:\Windows\System\KgrxaGL.exe
  2⤵
  PID:13708
- C:\Windows\System\PMgzQdI.exe
  C:\Windows\System\PMgzQdI.exe
  2⤵
  PID:13656
- C:\Windows\System\QJWPQwE.exe
  C:\Windows\System\QJWPQwE.exe
  2⤵
  PID:13016
- C:\Windows\System\Ayuugdk.exe
  C:\Windows\System\Ayuugdk.exe
  2⤵
  PID:13900
- C:\Windows\System\qCkKNjQ.exe
  C:\Windows\System\qCkKNjQ.exe
  2⤵
  PID:13988
- C:\Windows\System\DmMJqPf.exe
  C:\Windows\System\DmMJqPf.exe
  2⤵
  PID:14012
- C:\Windows\System\AMuWZka.exe
  C:\Windows\System\AMuWZka.exe
  2⤵
  PID:14024
- C:\Windows\System\xLZZJGN.exe
  C:\Windows\System\xLZZJGN.exe
  2⤵
  PID:14120
- C:\Windows\System\bvFuhel.exe
  C:\Windows\System\bvFuhel.exe
  2⤵
  PID:14032
- C:\Windows\System\GyQuVmE.exe
  C:\Windows\System\GyQuVmE.exe
  2⤵
  PID:14180
- C:\Windows\System\hpdVBVM.exe
  C:\Windows\System\hpdVBVM.exe
  2⤵
  PID:14172
- C:\Windows\System\rHcDgDz.exe
  C:\Windows\System\rHcDgDz.exe
  2⤵
  PID:14216
- C:\Windows\System\VTysskJ.exe
  C:\Windows\System\VTysskJ.exe
  2⤵
  PID:13920
- C:\Windows\System\HFbQfoU.exe
  C:\Windows\System\HFbQfoU.exe
  2⤵
  PID:13476
- C:\Windows\System\qnDDMaR.exe
  C:\Windows\System\qnDDMaR.exe
  2⤵
  PID:14156
- C:\Windows\System\azUOTDZ.exe
  C:\Windows\System\azUOTDZ.exe
  2⤵
  PID:14224
- C:\Windows\System\XcVyiMR.exe
  C:\Windows\System\XcVyiMR.exe
  2⤵
  PID:3476
- C:\Windows\System\jlgkkZn.exe
  C:\Windows\System\jlgkkZn.exe
  2⤵
  PID:1744
- C:\Windows\System\qLmiOWw.exe
  C:\Windows\System\qLmiOWw.exe
  2⤵
  PID:4132
- C:\Windows\System\gZaCfGX.exe
  C:\Windows\System\gZaCfGX.exe
  2⤵
  PID:4756
- C:\Windows\System\GnccGqo.exe
  C:\Windows\System\GnccGqo.exe
  2⤵
  PID:14300
- C:\Windows\System\dmzKOpw.exe
  C:\Windows\System\dmzKOpw.exe
  2⤵
  PID:14312
- C:\Windows\System\etBndJq.exe
  C:\Windows\System\etBndJq.exe
  2⤵
  PID:11392
- C:\Windows\System\aMsweuk.exe
  C:\Windows\System\aMsweuk.exe
  2⤵
  PID:12192
- C:\Windows\System\qsqvoWO.exe
  C:\Windows\System\qsqvoWO.exe
  2⤵
  PID:13060
- C:\Windows\System\JAojjMB.exe
  C:\Windows\System\JAojjMB.exe
  2⤵
  PID:11172
- C:\Windows\System\sBJdiCq.exe
  C:\Windows\System\sBJdiCq.exe
  2⤵
  PID:10880
- C:\Windows\System\zgKyVfL.exe
  C:\Windows\System\zgKyVfL.exe
  2⤵
  PID:13116
- C:\Windows\System\BTHFvcz.exe
  C:\Windows\System\BTHFvcz.exe
  2⤵
  PID:11356
- C:\Windows\System\fTIWQDu.exe
  C:\Windows\System\fTIWQDu.exe
  2⤵
  PID:4572
- C:\Windows\System\ePjeVfm.exe
  C:\Windows\System\ePjeVfm.exe
  2⤵
  PID:4204
- C:\Windows\System\BBArJPo.exe
  C:\Windows\System\BBArJPo.exe
  2⤵
  PID:9448
- C:\Windows\System\ewzwvfX.exe
  C:\Windows\System\ewzwvfX.exe
  2⤵
  PID:13772
- C:\Windows\System\AhnrISH.exe
  C:\Windows\System\AhnrISH.exe
  2⤵
  PID:13548
- C:\Windows\System\CQLavCF.exe
  C:\Windows\System\CQLavCF.exe
  2⤵
  PID:5408
- C:\Windows\System\IgtQghl.exe
  C:\Windows\System\IgtQghl.exe
  2⤵
  PID:2312
- C:\Windows\System\vINEGvG.exe
  C:\Windows\System\vINEGvG.exe
  2⤵
  PID:13720
- C:\Windows\System\twYsUdj.exe
  C:\Windows\System\twYsUdj.exe
  2⤵
  PID:13696
- C:\Windows\System\LdNuAby.exe
  C:\Windows\System\LdNuAby.exe
  2⤵
  PID:7552
- C:\Windows\System\zXCGmqC.exe
  C:\Windows\System\zXCGmqC.exe
  2⤵
  PID:2180
- C:\Windows\System\fugCtIi.exe
  C:\Windows\System\fugCtIi.exe
  2⤵
  PID:12376
- C:\Windows\System\gpUpadS.exe
  C:\Windows\System\gpUpadS.exe
  2⤵
  PID:11924
- C:\Windows\System\pyqVMRi.exe
  C:\Windows\System\pyqVMRi.exe
  2⤵
  PID:5760
- C:\Windows\System\ugBeiGd.exe
  C:\Windows\System\ugBeiGd.exe
  2⤵
  PID:2200
- C:\Windows\System\aDHIIcu.exe
  C:\Windows\System\aDHIIcu.exe
  2⤵
  PID:4748
- C:\Windows\System\aHEsgbf.exe
  C:\Windows\System\aHEsgbf.exe
  2⤵
  PID:14268
- C:\Windows\System\uNAqGSW.exe
  C:\Windows\System\uNAqGSW.exe
  2⤵
  PID:13436
- C:\Windows\System\fvSMoKK.exe
  C:\Windows\System\fvSMoKK.exe
  2⤵
  PID:14304
- C:\Windows\System\iBUNHnX.exe
  C:\Windows\System\iBUNHnX.exe
  2⤵
  PID:12616
- C:\Windows\System\lFEPdwb.exe
  C:\Windows\System\lFEPdwb.exe
  2⤵
  PID:14232
- C:\Windows\System\cKgPxuY.exe
  C:\Windows\System\cKgPxuY.exe
  2⤵
  PID:13744
- C:\Windows\System\mKLQfwX.exe
  C:\Windows\System\mKLQfwX.exe
  2⤵
  PID:6296
- C:\Windows\System\aQVqhyQ.exe
  C:\Windows\System\aQVqhyQ.exe
  2⤵
  PID:13680
- C:\Windows\System\DDapwgZ.exe
  C:\Windows\System\DDapwgZ.exe
  2⤵
  PID:13896
- C:\Windows\System\OfDInNH.exe
  C:\Windows\System\OfDInNH.exe
  2⤵
  PID:14028
- C:\Windows\System\pFsucCK.exe
  C:\Windows\System\pFsucCK.exe
  2⤵
  PID:14136
- C:\Windows\System\AJnAvKn.exe
  C:\Windows\System\AJnAvKn.exe
  2⤵
  PID:14020
- C:\Windows\System\jnALNcH.exe
  C:\Windows\System\jnALNcH.exe
  2⤵
  PID:13912
- C:\Windows\System\SisDeDm.exe
  C:\Windows\System\SisDeDm.exe
  2⤵
  PID:14256
- C:\Windows\System\uYkhLxi.exe
  C:\Windows\System\uYkhLxi.exe
  2⤵
  PID:11152
- C:\Windows\System\tkUMRtt.exe
  C:\Windows\System\tkUMRtt.exe
  2⤵
  PID:2356
- C:\Windows\System\kweRnvz.exe
  C:\Windows\System\kweRnvz.exe
  2⤵
  PID:11468
- C:\Windows\System\EwAWFEd.exe
  C:\Windows\System\EwAWFEd.exe
  2⤵
  PID:14316
- C:\Windows\System\AEprBOh.exe
  C:\Windows\System\AEprBOh.exe
  2⤵
  PID:4596
- C:\Windows\System\OLcjPuj.exe
  C:\Windows\System\OLcjPuj.exe
  2⤵
  PID:11148
- C:\Windows\System\cuoqKMP.exe
  C:\Windows\System\cuoqKMP.exe
  2⤵
  PID:12784
- C:\Windows\System\zyHMAPz.exe
  C:\Windows\System\zyHMAPz.exe
  2⤵
  PID:1872
- C:\Windows\System\LxqaHZc.exe
  C:\Windows\System\LxqaHZc.exe
  2⤵
  PID:12836
- C:\Windows\System\CEouXGU.exe
  C:\Windows\System\CEouXGU.exe
  2⤵
  PID:3096
- C:\Windows\System\UXDvHfE.exe
  C:\Windows\System\UXDvHfE.exe
  2⤵
  PID:4008
- C:\Windows\System\QGmQMHW.exe
  C:\Windows\System\QGmQMHW.exe
  2⤵
  PID:13544
- C:\Windows\System\gXtCdXs.exe
  C:\Windows\System\gXtCdXs.exe
  2⤵
  PID:13492
- C:\Windows\System\kWCdNka.exe
  C:\Windows\System\kWCdNka.exe
  2⤵
  PID:13816
- C:\Windows\System\tnZimRK.exe
  C:\Windows\System\tnZimRK.exe
  2⤵
  PID:14080
- C:\Windows\System\UbXwqpl.exe
  C:\Windows\System\UbXwqpl.exe
  2⤵
  PID:628
- C:\Windows\System\aLsHRRW.exe
  C:\Windows\System\aLsHRRW.exe
  2⤵
  PID:13800
- C:\Windows\System\eDrabMp.exe
  C:\Windows\System\eDrabMp.exe
  2⤵
  PID:1368
- C:\Windows\System\AAjHpIQ.exe
  C:\Windows\System\AAjHpIQ.exe
  2⤵
  PID:6264
- C:\Windows\System\Aczeznq.exe
  C:\Windows\System\Aczeznq.exe
  2⤵
  PID:12164
- C:\Windows\System\TVuxLwr.exe
  C:\Windows\System\TVuxLwr.exe
  2⤵
  PID:10764
- C:\Windows\System\RxFgrnF.exe
  C:\Windows\System\RxFgrnF.exe
  2⤵
  PID:12740
- C:\Windows\System\SnMJJEd.exe
  C:\Windows\System\SnMJJEd.exe
  2⤵
  PID:5800
- C:\Windows\System\fiarKFr.exe
  C:\Windows\System\fiarKFr.exe
  2⤵
  PID:14052
- C:\Windows\System\MfXYjsx.exe
  C:\Windows\System\MfXYjsx.exe
  2⤵
  PID:14072
- C:\Windows\System\LihVFXp.exe
  C:\Windows\System\LihVFXp.exe
  2⤵
  PID:14308
- C:\Windows\System\cdWbqyf.exe
  C:\Windows\System\cdWbqyf.exe
  2⤵
  PID:13012
- C:\Windows\System\MXWJJfd.exe
  C:\Windows\System\MXWJJfd.exe
  2⤵
  PID:5692
- C:\Windows\System\YAeRWMy.exe
  C:\Windows\System\YAeRWMy.exe
  2⤵
  PID:14276
- C:\Windows\System\bwvluJQ.exe
  C:\Windows\System\bwvluJQ.exe
  2⤵
  PID:404
- C:\Windows\System\zGGQauo.exe
  C:\Windows\System\zGGQauo.exe
  2⤵
  PID:1428
- C:\Windows\System\NohFROR.exe
  C:\Windows\System\NohFROR.exe
  2⤵
  PID:7820
- C:\Windows\System\OiIQzjL.exe
  C:\Windows\System\OiIQzjL.exe
  2⤵
  PID:14348
- C:\Windows\System\QmNLAoZ.exe
  C:\Windows\System\QmNLAoZ.exe
  2⤵
  PID:14364
- C:\Windows\System\pYHhoqJ.exe
  C:\Windows\System\pYHhoqJ.exe
  2⤵
  PID:14380
- C:\Windows\System\LTTchtc.exe
  C:\Windows\System\LTTchtc.exe
  2⤵
  PID:14396
- C:\Windows\System\lEESqBc.exe
  C:\Windows\System\lEESqBc.exe
  2⤵
  PID:14416
- C:\Windows\System\yDTZptq.exe
  C:\Windows\System\yDTZptq.exe
  2⤵
  PID:14432
- C:\Windows\System\ffJIWCo.exe
  C:\Windows\System\ffJIWCo.exe
  2⤵
  PID:14448
- C:\Windows\System\JVVqRFZ.exe
  C:\Windows\System\JVVqRFZ.exe
  2⤵
  PID:14468
- C:\Windows\System\vQJMiIU.exe
  C:\Windows\System\vQJMiIU.exe
  2⤵
  PID:14484
- C:\Windows\System\sBCJikv.exe
  C:\Windows\System\sBCJikv.exe
  2⤵
  PID:14500
- C:\Windows\System\syiSySc.exe
  C:\Windows\System\syiSySc.exe
  2⤵
  PID:14516
- C:\Windows\System\bkdBGNf.exe
  C:\Windows\System\bkdBGNf.exe
  2⤵
  PID:14532
- C:\Windows\System\vaOlVVm.exe
  C:\Windows\System\vaOlVVm.exe
  2⤵
  PID:14552
- C:\Windows\System\PKnfuQr.exe
  C:\Windows\System\PKnfuQr.exe
  2⤵
  PID:14568
- C:\Windows\System\upWflvZ.exe
  C:\Windows\System\upWflvZ.exe
  2⤵
  PID:14588
- C:\Windows\System\tdvEIjN.exe
  C:\Windows\System\tdvEIjN.exe
  2⤵
  PID:14604
- C:\Windows\System\qPbfaRp.exe
  C:\Windows\System\qPbfaRp.exe
  2⤵
  PID:14620
- C:\Windows\System\LmUXdQp.exe
  C:\Windows\System\LmUXdQp.exe
  2⤵
  PID:14636
- C:\Windows\System\gfTeyKd.exe
  C:\Windows\System\gfTeyKd.exe
  2⤵
  PID:14652
- C:\Windows\System\upewTFR.exe
  C:\Windows\System\upewTFR.exe
  2⤵
  PID:14668
- C:\Windows\System\EBvjNFi.exe
  C:\Windows\System\EBvjNFi.exe
  2⤵
  PID:14684
- C:\Windows\System\BnTFLsP.exe
  C:\Windows\System\BnTFLsP.exe
  2⤵
  PID:14708
- C:\Windows\System\vMqVpaG.exe
  C:\Windows\System\vMqVpaG.exe
  2⤵
  PID:14724
- C:\Windows\System\FhsxIcJ.exe
  C:\Windows\System\FhsxIcJ.exe
  2⤵
  PID:14740
- C:\Windows\System\dOPiEvg.exe
  C:\Windows\System\dOPiEvg.exe
  2⤵
  PID:14756
- C:\Windows\System\dUpyxjd.exe
  C:\Windows\System\dUpyxjd.exe
  2⤵
  PID:14772
- C:\Windows\System\nKgTVXy.exe
  C:\Windows\System\nKgTVXy.exe
  2⤵
  PID:14788
- C:\Windows\System\bUabitP.exe
  C:\Windows\System\bUabitP.exe
  2⤵
  PID:14804
- C:\Windows\System\ayMxZgu.exe
  C:\Windows\System\ayMxZgu.exe
  2⤵
  PID:15156

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 12324 -ip 12324
1⤵
PID:11740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_thqsnokk.w50.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AKTlniP.exe

Filesize
1.8MB

MD5
1eb47aad56ad5fe408a963dd47d4c4b8

SHA1
fa86a1fadd51c41c7ff0bd97060137e233dcf0ff

SHA256
2606ffec3d74ef28ff1c2e13a770b8bbe34479dc1500298f7667d768b5435ab9

SHA512
74ca5c6f35ff758ff549cc0276022cbfc45dd300a6b40b43acc1e5a84953a42d52016ba5a17b396f5a8ff21ec9251b5e9e6b864517d02fd259ecb56ece31acaa

Download Submit
C:\Windows\System\AVeSpxQ.exe

Filesize
1.8MB

MD5
f9b752cbb8bc81f76fe1979eaed91c38

SHA1
f8064150674bb739571cb21d9ccb24607a0a08c3

SHA256
9f1753e86a12221d9bec90f289d62213fccf0c7e5aadb6264a25a203e6dc6c90

SHA512
a878657dadf388ea63f432088fdff6442ed9400f49c1ab060f5a6e7b278d192e306b94bbc40bd47cc178231ff03134c623cef224acdf1cac74a2957e81aeeef7

Download Submit
C:\Windows\System\AuZJpas.exe

Filesize
1.8MB

MD5
7bd70719aee122df4c9f29c533c66c8e

SHA1
7704394a3acfba0183017d8d9c0f4c3b8760a1a9

SHA256
49f97c90838016b9c3bbad7a1574ab331c15b64795d41d264337afa731a5c675

SHA512
f258e69b73f9912e2271f446a58aa6093921cfd12f0f61806c1cc85db4c1e08bba02630e61b802057518354acee18b85c727e28da61bfecd45597ee458d0fef8

Download Submit
C:\Windows\System\DXcdJlY.exe

Filesize
1.8MB

MD5
133a1176dd2944142a60a85b2401a395

SHA1
14203481684830f91506e6ddf1f60ab579f9bb0e

SHA256
89b4a7212422e6d6a45cb979bafc2d9bbda7110562e9acda2da33222cb1c8b37

SHA512
4c283b8f71918fdf467c35375ba00db0a4024cded7d46d29787a304000a55ca858db0f8cc56edfc4257e1786492ea386770e6e0cd9533edb87dd5e37fc0c5d2f

Download Submit
C:\Windows\System\EnOSXWn.exe

Filesize
1.8MB

MD5
c8ce996a7ef02a82ab742b43e25d778a

SHA1
dada8082ba9e48b722c25d2994c178806f07e8ce

SHA256
a6d932ae3c66df6ba580977b2818a46e9b908d7b1368fe2292b1ecaae9669f4f

SHA512
fdbdb198275432e04cd583371276c78b76dbc5b8c1c664868462760d8885540390ba5a27ef91676bfa9079c20d1e78158f0bfec38c9b58777e190592dda8083f

Download Submit
C:\Windows\System\FqWmNMS.exe

Filesize
1.8MB

MD5
9a583e441f7676cc9a0b9644527d3fc2

SHA1
4288787641d01f0be7ee394f6901ff013a46b9ac

SHA256
916ed1b4230808a44f4270a7a629c2edf54903ca366d7495d27ecfbe55e8266d

SHA512
a50fd5fcb7188afbb0fc67ebd43939520fc9d0da14dd3ab819f0901cdd01502ee77f909ed37173c173b14c5caeca688269f277c3d265f6e3d1cb80ceec031f38

Download Submit
C:\Windows\System\ISySRnO.exe

Filesize
1.8MB

MD5
af9a2fde81e63c24722929896af772bd

SHA1
d21b3a0a89a9aa06da9167aaba0df023e1acb679

SHA256
edb002badb1e90b89422b26a95fb4e75357439191f567b100d0a711ea2a996fe

SHA512
b2517e65a7d7fd93fef73a04ac67636d0a08806b41c4145dceb7487e3dcb72b79682b4b6c55fb0f847ac16ab8676186fe91e28963b66e9a8bab451e74c5417cb

Download Submit
C:\Windows\System\IZULHes.exe

Filesize
1.8MB

MD5
76d38a642d84a53445c42b4220c6e03f

SHA1
19153c0f09fa4e6be837973f8bc2a98590a9c48d

SHA256
bb9ef6372c51ae3a1f115ff66cd8828a5f71f29842eacd8460d278e2538cdf29

SHA512
349f8914e4f825507e82982d7cc962d4e58dbbcdb3af0e972fe0ac7d8482a72d2e6cdf84063b3141ff44488865c52fc0271cc197e64a84d6a917c719e9058542

Download Submit
C:\Windows\System\JTYcoaF.exe

Filesize
1.8MB

MD5
ea3ca9aa43f431bd3f1157531bc37a08

SHA1
a681545fb0488f6229ad891847788120e1b39f74

SHA256
3dbbb8ddb44fca853ec53be0781dc41496ec235d0767540e6245490de3653213

SHA512
70b0101268e97d481a7e295b86e67091996e120349e75d5815a9f85b54f86c070c5c238f0ac859413dacd6e791a9efeb45c2f74a69dc43d69e44d225a7c1ca54

Download Submit
C:\Windows\System\NMOtZyZ.exe

Filesize
1.8MB

MD5
60e7bbd42474d26061f0b40ddabc0bb9

SHA1
b745b3a8ce1e3868be06c27c4de3714438144e9e

SHA256
25781a75c218c88910e66316b20ab0c54f456d125831573eef360797d9973b00

SHA512
5dd27753ca1c3836a9de86241334b832aff37ca9b77feff3eb36e27137ad923e96ecbcc8ea19654562369a71c7c1d6913c84d33335468fe5e9794e91c57a8eb0

Download Submit
C:\Windows\System\QAgQSLs.exe

Filesize
1.8MB

MD5
4751d59ae55cdbe647b9ffd853b76017

SHA1
f67860a82482366a12aa8904b414c32eecdbfd7e

SHA256
a58e4ff25a455744784f4ff0c42fe9521dce37ff64749087c61c5a9aa577030d

SHA512
91456a71d64571e9b3e6e23c5d64f47e3206482380f56613125720fc950d68c6c74b0c146f2703c8063b669f9e4bfc3c3ebd3372c5417bb727dd06d44f6a822b

Download Submit
C:\Windows\System\TOnLlXv.exe

Filesize
1.8MB

MD5
a15e36d9930b4cc43a08b4cdc4b4696d

SHA1
c51a15c6318c2353c410e9debeaaf7457034f598

SHA256
f4072e466cc993c873e8c0de76e6b6467eb304964cbaf5884f2b4c3bbb2f5c83

SHA512
b06a4d8f3508580e15f2733e5cb97cde99ac7dec584aca80e4631370e08f9589ea7e62d3a4d1b2849015cbbd3a8d36b7305e9428038ba0dd5b7045460b7064e5

Download Submit
C:\Windows\System\UHIGTRx.exe

Filesize
1.8MB

MD5
95f58495ab4075aaf4c0a12552cc2769

SHA1
189baf7b86a1ab97773d5edbd157356c06fc923a

SHA256
b782456a096213ce8bcfa603e58a6b130962696bfcdf6d98e1c8ac5d91ec949c

SHA512
6b50bdd8c76e0af907acc2f92384554fea3ed1d140695f87335c55918f1fe01e6ffe74869f3c2c9072d789ded790944bac13dd8477ef5b8ce6f1d7c5412b68f7

Download Submit
C:\Windows\System\VEdZHDn.exe

Filesize
1.8MB

MD5
27556519c1393e9c79b80e4108f437fb

SHA1
268a7eccdaa3a75bf061192f6a419fd7ee6f0e32

SHA256
3014666e959b46d7d7a58f47fc2ea184336c02966e8ef716dbd2ea039573779d

SHA512
0e693148148b14d72ce7dfa1369eab8d159317037ab68f5ad5af325c274757e2beaab6e2f2a538d2eedf6b01df51877fb92723ba6d32747ec4056f825daa391e

Download Submit
C:\Windows\System\WsTVRKX.exe

Filesize
1.8MB

MD5
9972275ce38f4dee734f57eb3740d47c

SHA1
d800299f49cca05fb4a62aa5b765b25e74533fb4

SHA256
058b1ff09cba38016f9f7d21d423061581476124e3d39bdbb07b5622e2cf377d

SHA512
8c7dc4cc92ee8177b04674923e1d9144bdfc63efa422fcb22b5ac8e01892f4b3fd61c123bdabbee2c9b1c1025374039b6389ec933286fc8464b8b7f860058ca7

Download Submit
C:\Windows\System\YFSaTee.exe

Filesize
1.8MB

MD5
3de9b358c980360de07c16dc6f107240

SHA1
148c13f39b21f7fbf2124174dc8e74c27d9cafcd

SHA256
048a3b69dd55821f5c0c4635349ee52cc9df4fd88b4a444b4d8777e3121c9504

SHA512
77430e21af4d02d01ef306e1e65ac48a05ae209c43c82b2bc5c417ce504cc87a3b39e1c985e6fb3e27d4bc9fa06466f96fc7277e9f76d4deab457c1a1b76cd02

Download Submit
C:\Windows\System\YKOcneD.exe

Filesize
1.8MB

MD5
c1bf8000970634a1af1b14e457b36ec2

SHA1
083e0b589cf02d2cce52c3fc0f683fc73792c7b6

SHA256
a4a4139c11201f240770abcb468e0cd6209ca2143aefab94f60510dbf6d01dfe

SHA512
d778411fac81af9919d183c1118f0e965d23d025c198e1d031064df9b3fe59c2fb3c3124018416fad4f3018211eea0ab78ea98061ac1a54fae1791a9e2c45f7b

Download Submit
C:\Windows\System\ajKjWVz.exe

Filesize
1.8MB

MD5
ea10efe9d51a9fbb5fe7f63d40eddcd8

SHA1
ade6deafb795278d8b4f4d651ccfd77e730cc9b9

SHA256
cd14d8579f816776b24d205c8daffbfac82889e49bf88d6d0d6e506739540e6d

SHA512
1b7c29d2b602aa777b13eb3fcd9b4c1a98468e4b8f0b5d36fe15c77f4c937d6e544928f05d1c61579b0907252cd5113a9a592a3df85a3cda226f21ced449e275

Download Submit
C:\Windows\System\bLjipYW.exe

Filesize
1.8MB

MD5
676cf8070c06a20b91afcf67f9b0eeeb

SHA1
01f8efc050bf0539819cb58bec9451e510e122eb

SHA256
9cc119bb987b1841e28d624046cd654603474917cdf8e0b56210259d22b86d6c

SHA512
8912dbd4d8476846f8aea2ef6d72067f6b2cd6a3ac720fa3f89fb66ffd617ad53a50aa7aeb990f5b758def808898e310475606bf2e2f81156a3ea6e99342e89a

Download Submit
C:\Windows\System\dPsUpnp.exe

Filesize
1.8MB

MD5
0696e12cc3ab1ea3559131d108616bdc

SHA1
727fad0a121edd9c83d73bc19aff2810d317f9b8

SHA256
c430f75b768453b2cc2a480d7db1570740138ae186650cb7dd5872071a54a3c7

SHA512
d0acb7a1f83566edfa8f05b2b9e7eea5728be5a3d5f6f29ec1a1265b2974ff7893158724803b8490c1f135f49b1a29ae35563c6d1d6f023ca3542e00cc8f83c3

Download Submit
C:\Windows\System\dWzhXnH.exe

Filesize
1.8MB

MD5
56b2bf048d3a659d7313331dd822e096

SHA1
021dc66b1701f0b6598dc2a9f7b99b969a801abd

SHA256
8cbb841d4fd82f1503134ec64698d6e489f1f161d090086d216d7fe7b728f340

SHA512
da4e53601473f666e940b702b69295079a2901eef52e5fa2576fcd5bbac7fbc47d482722d26603a4ef9ca91171697c08aefb07036639f42681a9bdc367c01fca

Download Submit
C:\Windows\System\eRDSnum.exe

Filesize
1.8MB

MD5
b9de83cc3010fd087706634de2adf3dd

SHA1
8e276cd5c63360d82f464018d90da799b76b12db

SHA256
f23a9dc83596398a4899afe7825aa94b4e7e0fc4ae9d24cd4cbe191248a99300

SHA512
ece96276b89fe5a9683594ab51de8158193f865f83bb636ff0d5c998cd7820d165c2597b6b6c5bedd3223ad61363faa6fa96242fb9127c70c4bd35ec145b36ae

Download Submit
C:\Windows\System\eWaDItg.exe

Filesize
1.8MB

MD5
a7d021bf6cd698a576a6f8e2056c57df

SHA1
3f6d938bad3204ba11db99e5cf02c3cb6c170d8c

SHA256
4c3daf64ae2215a3a58e16be723b911a07dbc0251df2f65c2c699d08d9756636

SHA512
525f0fcb95b172fd4452fd68bf37c92ccfb835891483e4fe07f29d6ff543eacc9c30bb978dbe889f9fa5eaad9efc5877d22a15a72b44e1be651463b83d7cb374

Download Submit
C:\Windows\System\efXTBeS.exe

Filesize
1.8MB

MD5
efe1c8bf265f05c0580d3771440be35e

SHA1
5e69019a92f9200c9b5f19336da9994ada4b405e

SHA256
375649d0fb5ab725b90501dfb5b5b4ef50988e53001df48e371b3d69a16a410c

SHA512
399c55cfeb6dd83b8abc0b2f2a38407da5a85d551585f8de14c5da80a5499d46fefde708662ed467be8cf43c30e5eca1c37579611a0f2f7867d148981528a12c

Download Submit
C:\Windows\System\heXhYqm.exe

Filesize
1.8MB

MD5
e97095870481b15ef494494713083600

SHA1
86c2cf528bf479a0c812a8e40670ba428ec09a91

SHA256
2428f003e7e93b362455cb978d76e629544c25980d1fbec857f23bcc3d04aa80

SHA512
d35803efbfa83acd8457445e13a5c03904aa549fa4ed5ba4662caba43c6235fa6eda590fac1891f7cb31a528fe7e72d90d1d8719445a4f1404e7c99824e0b087

Download Submit
C:\Windows\System\hmGvnok.exe

Filesize
1.8MB

MD5
834bf657d0d3acef060770993af4b0c3

SHA1
78ca0a11d94c4fe8642e0d3f732e916189d4de95

SHA256
90f75ef69bbbf4d4a0eee8cdce95723cfac890b356eeb4d93d40756b7b09d314

SHA512
28f3e2fee659089856e52a825fb6a916f864eb4297ec6a865a4aace062d8407373c2391b19c22ee9c3ed799e4a3f56b62f17bef87c6bbc88a812fd1d7f5d55a7

Download Submit
C:\Windows\System\kpzZAhC.exe

Filesize
1.8MB

MD5
a24a235de6a5e3f83c2b308624d0d601

SHA1
c7c0962218c9f3a11fe8274e5607792ce101dba3

SHA256
27851d24eb32f2f9ad1a95eecb39d405f826a09cecf77bf2c5fb55d48e142f3c

SHA512
4e493a9673e960949d9681acb4c375ec616c1a3eb5d4d7993efe829d0f2a57d10e9cd844a0ab9d62d9f9f26b408b0b0e8b2f3d118abf2c53f7f43a46534d4df7

Download Submit
C:\Windows\System\lWYfcJy.exe

Filesize
1.8MB

MD5
b117584592c7c0e644783c42604d8c85

SHA1
fd185b8cda2a41defee452aed5fd095d24a85164

SHA256
5a916a527ade754a82e3a4ae0aa3b70aed90daccac6ef2b49530d142358e93d9

SHA512
8d700706a14cff476dba2d21a56dbe976fe1dca706152c4e51ea68b31e79fb187f9cb09352910e9663c0dee393328ba6e7f99fe3a951a637f921b1b6068d4d20

Download Submit
C:\Windows\System\lbupVRL.exe

Filesize
1.8MB

MD5
0311cd7d8ec17926f27869dc258663ba

SHA1
8b0efc900d9fae6abcff84f300a277e0171b5f49

SHA256
d1874db4149d104786b077f35c565db7fcdefc1a1e1a953920620e05042ca7c4

SHA512
fd98272c9357d06d6d60936ccf1707317919b17cf390bf83bc8c52365460b0d6a5690fe2155a157755db01194c064f5a5978867abb6920fd944eaf9b994a7dbc

Download Submit
C:\Windows\System\nIapOrt.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\pMrLhgs.exe

Filesize
1.8MB

MD5
c6a874ba6957d2f21c4ae0dccf22c2dc

SHA1
597e97ee628b678e1a3664b935b7ddded50f2eee

SHA256
a3b604b71757abb34f3f6961cf4e9150c51cc6d564faf07458ec74ebfe82c648

SHA512
5e68859bb94212981d95555fa4ca80ca61300455a37029aacedff3e047fb590efa5af5473ab01a4e36716e7071da84cea5fe4c7f59286077e6a85dae2693e2d9

Download Submit
C:\Windows\System\qOSqIDV.exe

Filesize
1.8MB

MD5
714781b64fd22865251d812016bff3b8

SHA1
1b35b20b7fa4933a53c3a2b2b5e122127e422a79

SHA256
6482a6dfd4fb3fd8f6830b8c661fe9e0cd783b164727be1da8ef36291cc67ff7

SHA512
ff061c469715509f73df194d77b7173df4dce877cccba8555512aee3a993413aa03ea6b12d082767f3b8142c81501d757b9086e559bcbd5bb3bb62f268ac83ef

Download Submit
C:\Windows\System\rVNzGNE.exe

Filesize
1.8MB

MD5
ba49471f6920a30ba7520728fae1920b

SHA1
45cad22b5c2fa729c22886e5db77cb09db660f37

SHA256
cfb631b41cd2c8e433e17a401f78847692610ebe89278bd85e50233c40b0242e

SHA512
b8c61e919facc788d4cbc55de1864b92e32fa5bd5bcd96b413b213758b3ac9d56eafce233b16d5f099895eb65b77c6fbcf252c8e1baf876c156cd54c743b7402

Download Submit
C:\Windows\System\sLyouEc.exe

Filesize
1.8MB

MD5
a278b4c3e2f1099d036e01fb31ff6cd5

SHA1
08f8e544eeec13138d98aa0e0bc41eb54b975769

SHA256
5782bb50953e58a2ee31ca105a4fb7fe94cae8e72d078bb48c22a8c164510b54

SHA512
0d5a9c76d6c7538508bf6d0c1c62f12149e9789e30c2cb23541c740a47dfb5eb76d07a6b72198b69c855f27e4846047ccc46f6d725883c6759d7a2360c1153ce

Download Submit
C:\Windows\System\tOKqmef.exe

Filesize
1.8MB

MD5
bc03ea28b4c90a06352ff1e094af8468

SHA1
1391bce0b21c85b1fe6282a72e421ffc57f98894

SHA256
5ffd8acb3f80e6a68ec5f89724103dfdce37a39808843a535f5500293ee2f4a1

SHA512
24751ae7256dd030e01cf6e2b6ad9b3c89f49f016e6cb19fddfa1998a39bf2544b9cfe83b9cf0d4dcfd1ae16ecd42a8da6137de66c31975ddeccae296f9a2721

Download Submit
C:\Windows\System\tlRYayA.exe

Filesize
1.8MB

MD5
19d24a34da05ffaff354d4dafa429adc

SHA1
cd0f1497f06960d38a9144b31c81b74390248b52

SHA256
b754b4f097405f2d47ad797c4c5a582094f53682868670c13066b6ed95fafb54

SHA512
d6f3edead4b2687d68ecd8e0ca7af2a4ea615533534b4e49026389d575b4783132f8ab88cf8f217dcce5f3863953c2ccd56efe13eac220e8019f3f09b5efa213

Download Submit
C:\Windows\System\uVXAWJI.exe

Filesize
1.8MB

MD5
ea285a01ffb55433428ef60e64a6de1c

SHA1
d52e66f09216b1c9e27aa4932da0fca697dec1cb

SHA256
178c55d7b31b79c42f64cfcdfab79913142d71116aa64ccba757554e223a9e5b

SHA512
babf396f4f23e9f04e6697f7a84f2fcb9d7245a3adccfbf97efd9ef8df7c2259be9269460be72de7feee5947dc94f7afaf1d8fbeb14e132c53a23f1ebd87d2f7

Download Submit
C:\Windows\System\vKghiFu.exe

Filesize
1.8MB

MD5
2b4d6c2f027577f00edde398dd4149ca

SHA1
bc696b3cc5c78b2464d6390c0b83d16a319d1f7e

SHA256
18035a4eb4dff5f8df1c721e48287962d99b1bb4f503a6f7ca97f5613da7890d

SHA512
a2a8a6e7caea3c5b4ae75a6e5225c6ed5f4f9cdc5525388d2d50155870302374e0cadbf41b271dbb8a5d5715c44e00293d6b0efdc18b6c1edd5a1e6460dbcc44

Download Submit
C:\Windows\System\wufcXEM.exe

Filesize
1.8MB

MD5
c13992e43f855a2f029ddbea624cd30f

SHA1
ede0d8e73cdda808fe7bb4cb07f790274366e5c6

SHA256
d9e25e85b578238b016f6638e84ab7e487dcfb9b2601cfd564c6e7e906c6407a

SHA512
75154179ac1d21035800321429b20c75e87a4ab52dc9ad94a8728dacd490d87d320ac1ed9f68b77b06f73b1584e86b9cd1af01d0afc813b2dfd2b3ec0ef7b54a

Download Submit
C:\Windows\System\xkqIXAA.exe

Filesize
1.8MB

MD5
c06816f79a714ef35cf87034aa033ac2

SHA1
9e3511d6360c65e5ac947fe17ce6720d576ca199

SHA256
1342d2ecbb4984c864bec9341ac71fb387f18db494eb184f682d774fa482fb6d

SHA512
13cccf6b4164c8f9c0c9222bf61d6e3f917b7d541d71cee4fa5c7970c3b8e45f0a70cbdfd60667f6547af1a208e575da41e6a70d7ac45745d10c3607c51dd32f

Download Submit
C:\Windows\System\zhsgUwp.exe

Filesize
1.8MB

MD5
63153a4aaf6e13ec00a86358187ce493

SHA1
dd7b20d3bc947748db50144365e411a2d97891f0

SHA256
594be45be4c52730d086752e3a07a7b6b108b16ca6347de467d3974227b8e537

SHA512
101b09cdc3dbc8ab1c2850d940dc0de8e8dc6be9303f12fd175dd6920df522ed19e54c893e910588783605c3c3f940bf5d9e7ec57df7ef9d6487686621e2f03a

Download Submit
memory/60-3250-0x00007FF6C0E80000-0x00007FF6C1272000-memory.dmp

Filesize
3.9MB

Download
memory/60-439-0x00007FF6C0E80000-0x00007FF6C1272000-memory.dmp

Filesize
3.9MB

Download
memory/392-442-0x00007FF64F510000-0x00007FF64F902000-memory.dmp

Filesize
3.9MB

Download
memory/392-3252-0x00007FF64F510000-0x00007FF64F902000-memory.dmp

Filesize
3.9MB

Download
memory/752-3151-0x00007FF6F44F0000-0x00007FF6F48E2000-memory.dmp

Filesize
3.9MB

Download
memory/752-23-0x00007FF6F44F0000-0x00007FF6F48E2000-memory.dmp

Filesize
3.9MB

Download
memory/920-3246-0x00007FF61AC70000-0x00007FF61B062000-memory.dmp

Filesize
3.9MB

Download
memory/920-436-0x00007FF61AC70000-0x00007FF61B062000-memory.dmp

Filesize
3.9MB

Download
memory/1048-3271-0x00007FF74AEA0000-0x00007FF74B292000-memory.dmp

Filesize
3.9MB

Download
memory/1048-441-0x00007FF74AEA0000-0x00007FF74B292000-memory.dmp

Filesize
3.9MB

Download
memory/1152-440-0x00007FF7B4D70000-0x00007FF7B5162000-memory.dmp

Filesize
3.9MB

Download
memory/1152-3214-0x00007FF7B4D70000-0x00007FF7B5162000-memory.dmp

Filesize
3.9MB

Download
memory/1476-3216-0x00007FF65C8A0000-0x00007FF65CC92000-memory.dmp

Filesize
3.9MB

Download
memory/1476-419-0x00007FF65C8A0000-0x00007FF65CC92000-memory.dmp

Filesize
3.9MB

Download
memory/1556-3268-0x00007FF66CE20000-0x00007FF66D212000-memory.dmp

Filesize
3.9MB

Download
memory/1556-449-0x00007FF66CE20000-0x00007FF66D212000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3244-0x00007FF78FED0000-0x00007FF7902C2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-605-0x00007FF78FED0000-0x00007FF7902C2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-3218-0x00007FF606C30000-0x00007FF607022000-memory.dmp

Filesize
3.9MB

Download
memory/2476-282-0x00007FF606C30000-0x00007FF607022000-memory.dmp

Filesize
3.9MB

Download
memory/2552-3267-0x00007FF6C43E0000-0x00007FF6C47D2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-475-0x00007FF6C43E0000-0x00007FF6C47D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-3220-0x00007FF7ABA20000-0x00007FF7ABE12000-memory.dmp

Filesize
3.9MB

Download
memory/2744-432-0x00007FF7ABA20000-0x00007FF7ABE12000-memory.dmp

Filesize
3.9MB

Download
memory/3056-40-0x00007FF73DAB0000-0x00007FF73DEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-3153-0x00007FF73DAB0000-0x00007FF73DEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-3263-0x00007FF731010000-0x00007FF731402000-memory.dmp

Filesize
3.9MB

Download
memory/3060-444-0x00007FF731010000-0x00007FF731402000-memory.dmp

Filesize
3.9MB

Download
memory/3068-260-0x00007FF6743E0000-0x00007FF6747D2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-3158-0x00007FF6743E0000-0x00007FF6747D2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-128-0x00007FF97E910000-0x00007FF97F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-304-0x000001F4B0B90000-0x000001F4B0BB2000-memory.dmp

Filesize
136KB

Download
memory/3112-41-0x00007FF97E913000-0x00007FF97E915000-memory.dmp

Filesize
8KB

Download
memory/3112-223-0x00007FF97E910000-0x00007FF97F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/3172-3256-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-446-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-1-0x0000019DA2830000-0x0000019DA2840000-memory.dmp

Filesize
64KB

Download
memory/3232-0-0x00007FF709800000-0x00007FF709BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-438-0x00007FF6A59B0000-0x00007FF6A5DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-3249-0x00007FF6A59B0000-0x00007FF6A5DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-3265-0x00007FF71F250000-0x00007FF71F642000-memory.dmp

Filesize
3.9MB

Download
memory/3636-443-0x00007FF71F250000-0x00007FF71F642000-memory.dmp

Filesize
3.9MB

Download
memory/3684-3188-0x00007FF724C30000-0x00007FF725022000-memory.dmp

Filesize
3.9MB

Download
memory/3684-579-0x00007FF724C30000-0x00007FF725022000-memory.dmp

Filesize
3.9MB

Download
memory/4028-3194-0x00007FF7E6D30000-0x00007FF7E7122000-memory.dmp

Filesize
3.9MB

Download
memory/4028-414-0x00007FF7E6D30000-0x00007FF7E7122000-memory.dmp

Filesize
3.9MB

Download
memory/4216-511-0x00007FF685C10000-0x00007FF686002000-memory.dmp

Filesize
3.9MB

Download
memory/4216-3150-0x00007FF685C10000-0x00007FF686002000-memory.dmp

Filesize
3.9MB

Download
memory/4332-364-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-3227-0x00007FF69ECC0000-0x00007FF69F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-448-0x00007FF7AB330000-0x00007FF7AB722000-memory.dmp

Filesize
3.9MB

Download
memory/4864-3258-0x00007FF7AB330000-0x00007FF7AB722000-memory.dmp

Filesize
3.9MB

Download
memory/5040-3255-0x00007FF649F30000-0x00007FF64A322000-memory.dmp

Filesize
3.9MB

Download
memory/5040-445-0x00007FF649F30000-0x00007FF64A322000-memory.dmp

Filesize
3.9MB

Download