xmrig | 5fe7256f31771e3987e9826fa9d184a575e0651d52024cb35c12ac95fd095cec

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Size

2.2MB
MD5

03c71b31d54c4af96341e395d350e66f
SHA1

7151a6d33878de441f5cf791469afd095ee94d01
SHA256

5fe7256f31771e3987e9826fa9d184a575e0651d52024cb35c12ac95fd095cec
SHA512

18035c37db45b76423a68a8e45e17c0769ea0cb944453f6faa2db62804a9e1a79564771acf6ece60122a27fff88ebf8e0e78ddfaf30cd1581049ab59511f3451
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMvwWBB:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/3472-335-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	xmrig
behavioral2/memory/2384-374-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	xmrig
behavioral2/memory/1800-414-0x00007FF621770000-0x00007FF621B62000-memory.dmp	xmrig
behavioral2/memory/4900-418-0x00007FF70AC00000-0x00007FF70AFF2000-memory.dmp	xmrig
behavioral2/memory/3408-422-0x00007FF651C10000-0x00007FF652002000-memory.dmp	xmrig
behavioral2/memory/4864-425-0x00007FF644460000-0x00007FF644852000-memory.dmp	xmrig
behavioral2/memory/1556-424-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp	xmrig
behavioral2/memory/1004-423-0x00007FF7175B0000-0x00007FF7179A2000-memory.dmp	xmrig
behavioral2/memory/1400-421-0x00007FF731940000-0x00007FF731D32000-memory.dmp	xmrig
behavioral2/memory/2120-420-0x00007FF6AD2D0000-0x00007FF6AD6C2000-memory.dmp	xmrig
behavioral2/memory/2524-419-0x00007FF60E480000-0x00007FF60E872000-memory.dmp	xmrig
behavioral2/memory/5016-417-0x00007FF6BE4B0000-0x00007FF6BE8A2000-memory.dmp	xmrig
behavioral2/memory/320-416-0x00007FF671120000-0x00007FF671512000-memory.dmp	xmrig
behavioral2/memory/3268-415-0x00007FF615BC0000-0x00007FF615FB2000-memory.dmp	xmrig
behavioral2/memory/900-413-0x00007FF7F90F0000-0x00007FF7F94E2000-memory.dmp	xmrig
behavioral2/memory/4852-412-0x00007FF7D09A0000-0x00007FF7D0D92000-memory.dmp	xmrig
behavioral2/memory/3584-411-0x00007FF6B3A80000-0x00007FF6B3E72000-memory.dmp	xmrig
behavioral2/memory/4524-312-0x00007FF6D0010000-0x00007FF6D0402000-memory.dmp	xmrig
behavioral2/memory/4592-292-0x00007FF754EE0000-0x00007FF7552D2000-memory.dmp	xmrig
behavioral2/memory/3524-261-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp	xmrig
behavioral2/memory/3992-260-0x00007FF7AFFE0000-0x00007FF7B03D2000-memory.dmp	xmrig
behavioral2/memory/1096-243-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp	xmrig
behavioral2/memory/4032-129-0x00007FF6EB4D0000-0x00007FF6EB8C2000-memory.dmp	xmrig
behavioral2/memory/1556-3685-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp	xmrig
behavioral2/memory/1096-3719-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp	xmrig
behavioral2/memory/3472-3722-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	xmrig
behavioral2/memory/1800-3736-0x00007FF621770000-0x00007FF621B62000-memory.dmp	xmrig
behavioral2/memory/2524-3739-0x00007FF60E480000-0x00007FF60E872000-memory.dmp	xmrig
behavioral2/memory/4852-3750-0x00007FF7D09A0000-0x00007FF7D0D92000-memory.dmp	xmrig
behavioral2/memory/900-3754-0x00007FF7F90F0000-0x00007FF7F94E2000-memory.dmp	xmrig
behavioral2/memory/4524-3765-0x00007FF6D0010000-0x00007FF6D0402000-memory.dmp	xmrig
behavioral2/memory/3584-3761-0x00007FF6B3A80000-0x00007FF6B3E72000-memory.dmp	xmrig
behavioral2/memory/320-3768-0x00007FF671120000-0x00007FF671512000-memory.dmp	xmrig
behavioral2/memory/2120-3757-0x00007FF6AD2D0000-0x00007FF6AD6C2000-memory.dmp	xmrig
behavioral2/memory/4592-3748-0x00007FF754EE0000-0x00007FF7552D2000-memory.dmp	xmrig
behavioral2/memory/3524-3747-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp	xmrig
behavioral2/memory/2384-3743-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	xmrig
behavioral2/memory/3268-3775-0x00007FF615BC0000-0x00007FF615FB2000-memory.dmp	xmrig
behavioral2/memory/4900-3780-0x00007FF70AC00000-0x00007FF70AFF2000-memory.dmp	xmrig
behavioral2/memory/1004-3788-0x00007FF7175B0000-0x00007FF7179A2000-memory.dmp	xmrig
behavioral2/memory/5016-3791-0x00007FF6BE4B0000-0x00007FF6BE8A2000-memory.dmp	xmrig
behavioral2/memory/4864-3807-0x00007FF644460000-0x00007FF644852000-memory.dmp	xmrig
behavioral2/memory/3408-3786-0x00007FF651C10000-0x00007FF652002000-memory.dmp	xmrig
behavioral2/memory/1400-3782-0x00007FF731940000-0x00007FF731D32000-memory.dmp	xmrig
behavioral2/memory/2648-3954-0x00007FF67FD70000-0x00007FF680162000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
548	gqUNQyC.exe
1556	pFLvQKV.exe
4032	pPOryYD.exe
1096	LFlsZqo.exe
3992	KDRpslz.exe
3524	JCaLXKq.exe
4592	LHVsThc.exe
4524	ctUQjnR.exe
3472	xfbvdOa.exe
2384	WmkEUjZ.exe
3584	melHWzT.exe
4852	KtIHvpn.exe
900	RzcldDO.exe
1800	fLmRzeu.exe
3268	PVpXbhW.exe
320	sghcuJB.exe
5016	uPliELP.exe
4900	Ruefmvq.exe
2524	fveVbaD.exe
4864	hCSoLPx.exe
2120	MpIRXyI.exe
1400	XLgbesA.exe
3408	jmASdWV.exe
1004	jvuCQzU.exe
4548	axAdnQE.exe
3852	ciEETxp.exe
380	AQgsgTb.exe
2848	yMnogkQ.exe
768	TFMfOjs.exe
760	fzKAEtP.exe
3252	lBGVBTR.exe
724	nYyGpmT.exe
4760	VUrpIXZ.exe
2876	kkUfkrY.exe
4340	YLMxIGX.exe
4068	jtvCUIR.exe
3372	hrVqiVo.exe
2964	tXpBQyW.exe
1016	evGtbjP.exe
3300	jGbNkVy.exe
1128	UAICVzT.exe
3416	eQpSAnp.exe
1724	PYRbZtv.exe
2056	oWqDWWf.exe
4356	oGBprVV.exe
2604	STBVZCT.exe
960	qHOkHhl.exe
2124	TORwMhp.exe
3932	pUcNErY.exe
1116	YHSSUYH.exe
1228	FJjrIZf.exe
436	PaQSKGN.exe
2208	KzwJggB.exe
4252	qbGEGCt.exe
4116	dLTJWaf.exe
1224	ifvYkFM.exe
3460	eoQbwkM.exe
1216	ngiEPGM.exe
3176	zXhUYpT.exe
2916	vySHmdr.exe
4532	doOqqjH.exe
64	HxjkPhp.exe
1260	FbnJdbz.exe
112	yzNJGpy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2648-0-0x00007FF67FD70000-0x00007FF680162000-memory.dmp	upx
behavioral2/files/0x0007000000023491-8.dat	upx
behavioral2/files/0x000800000002348c-9.dat	upx
behavioral2/files/0x0007000000023498-50.dat	upx
behavioral2/files/0x00070000000234a1-91.dat	upx
behavioral2/files/0x00070000000234aa-128.dat	upx
behavioral2/files/0x00070000000234b0-174.dat	upx
behavioral2/memory/3472-335-0x00007FF757A60000-0x00007FF757E52000-memory.dmp	upx
behavioral2/memory/2384-374-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp	upx
behavioral2/memory/1800-414-0x00007FF621770000-0x00007FF621B62000-memory.dmp	upx
behavioral2/memory/4900-418-0x00007FF70AC00000-0x00007FF70AFF2000-memory.dmp	upx
behavioral2/memory/3408-422-0x00007FF651C10000-0x00007FF652002000-memory.dmp	upx
behavioral2/memory/4864-425-0x00007FF644460000-0x00007FF644852000-memory.dmp	upx
behavioral2/memory/1556-424-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp	upx
behavioral2/memory/1004-423-0x00007FF7175B0000-0x00007FF7179A2000-memory.dmp	upx
behavioral2/memory/1400-421-0x00007FF731940000-0x00007FF731D32000-memory.dmp	upx
behavioral2/memory/2120-420-0x00007FF6AD2D0000-0x00007FF6AD6C2000-memory.dmp	upx
behavioral2/memory/2524-419-0x00007FF60E480000-0x00007FF60E872000-memory.dmp	upx
behavioral2/memory/5016-417-0x00007FF6BE4B0000-0x00007FF6BE8A2000-memory.dmp	upx
behavioral2/memory/320-416-0x00007FF671120000-0x00007FF671512000-memory.dmp	upx
behavioral2/memory/3268-415-0x00007FF615BC0000-0x00007FF615FB2000-memory.dmp	upx
behavioral2/memory/900-413-0x00007FF7F90F0000-0x00007FF7F94E2000-memory.dmp	upx
behavioral2/memory/4852-412-0x00007FF7D09A0000-0x00007FF7D0D92000-memory.dmp	upx
behavioral2/memory/3584-411-0x00007FF6B3A80000-0x00007FF6B3E72000-memory.dmp	upx
behavioral2/memory/4524-312-0x00007FF6D0010000-0x00007FF6D0402000-memory.dmp	upx
behavioral2/memory/4592-292-0x00007FF754EE0000-0x00007FF7552D2000-memory.dmp	upx
behavioral2/memory/3524-261-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp	upx
behavioral2/memory/3992-260-0x00007FF7AFFE0000-0x00007FF7B03D2000-memory.dmp	upx
behavioral2/memory/1096-243-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-190.dat	upx
behavioral2/files/0x00070000000234ad-187.dat	upx
behavioral2/files/0x00070000000234b1-185.dat	upx
behavioral2/files/0x00070000000234a4-182.dat	upx
behavioral2/files/0x000700000002349d-178.dat	upx
behavioral2/files/0x00070000000234a2-177.dat	upx
behavioral2/files/0x00070000000234a0-170.dat	upx
behavioral2/files/0x00070000000234af-165.dat	upx
behavioral2/files/0x000700000002349f-160.dat	upx
behavioral2/files/0x000700000002349e-156.dat	upx
behavioral2/files/0x000800000002348d-144.dat	upx
behavioral2/files/0x0007000000023496-143.dat	upx
behavioral2/files/0x00070000000234ac-134.dat	upx
behavioral2/files/0x00070000000234ab-133.dat	upx
behavioral2/memory/4032-129-0x00007FF6EB4D0000-0x00007FF6EB8C2000-memory.dmp	upx
behavioral2/files/0x00070000000234a9-127.dat	upx
behavioral2/files/0x00070000000234a7-166.dat	upx
behavioral2/files/0x000700000002349b-119.dat	upx
behavioral2/files/0x00070000000234ae-151.dat	upx
behavioral2/files/0x000700000002349a-113.dat	upx
behavioral2/files/0x0007000000023495-109.dat	upx
behavioral2/files/0x0007000000023499-136.dat	upx
behavioral2/files/0x00070000000234a3-106.dat	upx
behavioral2/files/0x00070000000234a8-126.dat	upx
behavioral2/files/0x00070000000234a6-118.dat	upx
behavioral2/files/0x000700000002349c-84.dat	upx
behavioral2/files/0x00070000000234a5-117.dat	upx
behavioral2/files/0x0007000000023493-75.dat	upx
behavioral2/files/0x0007000000023494-68.dat	upx
behavioral2/files/0x0007000000023497-49.dat	upx
behavioral2/files/0x0007000000023492-35.dat	upx
behavioral2/files/0x0007000000023490-18.dat	upx
behavioral2/memory/548-10-0x00007FF697E00000-0x00007FF6981F2000-memory.dmp	upx
behavioral2/memory/1556-3685-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp	upx
behavioral2/memory/1096-3719-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YHrdSwW.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\gERKZto.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\ITSgaLY.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\yzZSNGi.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\ggHKVCc.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\GAkJPLj.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\AjmXqEd.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\CPWERnQ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\LuAlhKh.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\LuWrOQy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\pZmHzEG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\MNDIKSn.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\xpiLFJG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\dIlCUFW.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\pIzEsEg.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\uLrxOSM.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\wwwLgMa.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\DCoFZrk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\wxvoWnq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\DgxWUlP.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\xYwMqSy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\SXSiOXS.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\EhyduBF.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cpQgVqN.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\aFkHQmH.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\qtIRKFp.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cjybyDG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\mtrIIcy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\rsxJzxN.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\pJQsPCC.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\lKiEVMT.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\qwnQncc.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\OJiwcql.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cyRrPHw.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\ImjKAlJ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\RXwUGfq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\qCLhcvk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\grIBthq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\bLoyCyc.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\cDUGWPM.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\nCTWwDW.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\PBhxoyX.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\jhFOKVy.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\AEcdpgr.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\JBLgKHJ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\MXSmspL.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\fIlzpkQ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\TnoORWG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\xZOsApk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\BTUbKSd.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\FbgRJHx.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\FbvPXmQ.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\iYebpwk.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\xBDWONt.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\FEIjEQq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\igQBFSG.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\kyNjPJO.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\aHPKLgn.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\FsOdqfq.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\vEdIeTR.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\mWiskhO.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\UblaRii.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\OWYgcuB.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
File created	C:\Windows\System\CUzeQkK.exe	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\MuiCache	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeCreateGlobalPrivilege	4708	Process not Found
Token: SeChangeNotifyPrivilege	4708	Process not Found
Token: 33	4708	Process not Found
Token: SeIncBasePriorityPrivilege	4708	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
15744	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 5112	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	83
PID 2648 wrote to memory of 5112	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	83
PID 2648 wrote to memory of 548	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	84
PID 2648 wrote to memory of 548	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	84
PID 2648 wrote to memory of 1556	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	85
PID 2648 wrote to memory of 1556	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	85
PID 2648 wrote to memory of 4032	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	86
PID 2648 wrote to memory of 4032	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	86
PID 2648 wrote to memory of 1096	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	87
PID 2648 wrote to memory of 1096	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	87
PID 2648 wrote to memory of 3992	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	88
PID 2648 wrote to memory of 3992	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	88
PID 2648 wrote to memory of 3524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	89
PID 2648 wrote to memory of 3524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	89
PID 2648 wrote to memory of 4592	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	90
PID 2648 wrote to memory of 4592	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	90
PID 2648 wrote to memory of 4524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	91
PID 2648 wrote to memory of 3472	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	92
PID 2648 wrote to memory of 3472	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	92
PID 2648 wrote to memory of 2384	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	93
PID 2648 wrote to memory of 2384	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	93
PID 2648 wrote to memory of 3584	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	94
PID 2648 wrote to memory of 3584	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	94
PID 2648 wrote to memory of 4852	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	95
PID 2648 wrote to memory of 4852	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	95
PID 2648 wrote to memory of 900	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	96
PID 2648 wrote to memory of 900	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	96
PID 2648 wrote to memory of 1800	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	97
PID 2648 wrote to memory of 1800	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	97
PID 2648 wrote to memory of 3268	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	98
PID 2648 wrote to memory of 3268	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	98
PID 2648 wrote to memory of 320	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	99
PID 2648 wrote to memory of 320	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	99
PID 2648 wrote to memory of 5016	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	100
PID 2648 wrote to memory of 5016	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	100
PID 2648 wrote to memory of 4900	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	101
PID 2648 wrote to memory of 4900	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	101
PID 2648 wrote to memory of 2524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	102
PID 2648 wrote to memory of 2524	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	102
PID 2648 wrote to memory of 4864	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	103
PID 2648 wrote to memory of 4864	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	103
PID 2648 wrote to memory of 2120	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	104
PID 2648 wrote to memory of 2120	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	104
PID 2648 wrote to memory of 1400	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	105
PID 2648 wrote to memory of 1400	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	105
PID 2648 wrote to memory of 3408	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	106
PID 2648 wrote to memory of 3408	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	106
PID 2648 wrote to memory of 1004	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	107
PID 2648 wrote to memory of 1004	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	107
PID 2648 wrote to memory of 4548	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	108
PID 2648 wrote to memory of 4548	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	108
PID 2648 wrote to memory of 3852	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	109
PID 2648 wrote to memory of 3852	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	109
PID 2648 wrote to memory of 380	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	110
PID 2648 wrote to memory of 380	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	110
PID 2648 wrote to memory of 2848	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	111
PID 2648 wrote to memory of 2848	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	111
PID 2648 wrote to memory of 768	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	112
PID 2648 wrote to memory of 768	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	112
PID 2648 wrote to memory of 760	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	113
PID 2648 wrote to memory of 760	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	113
PID 2648 wrote to memory of 3252	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	114
PID 2648 wrote to memory of 3252	2648	03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c71b31d54c4af96341e395d350e66f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\System\gqUNQyC.exe
  C:\Windows\System\gqUNQyC.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\pFLvQKV.exe
  C:\Windows\System\pFLvQKV.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\pPOryYD.exe
  C:\Windows\System\pPOryYD.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\LFlsZqo.exe
  C:\Windows\System\LFlsZqo.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KDRpslz.exe
  C:\Windows\System\KDRpslz.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\JCaLXKq.exe
  C:\Windows\System\JCaLXKq.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\LHVsThc.exe
  C:\Windows\System\LHVsThc.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\ctUQjnR.exe
  C:\Windows\System\ctUQjnR.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\xfbvdOa.exe
  C:\Windows\System\xfbvdOa.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\WmkEUjZ.exe
  C:\Windows\System\WmkEUjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\melHWzT.exe
  C:\Windows\System\melHWzT.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\KtIHvpn.exe
  C:\Windows\System\KtIHvpn.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\RzcldDO.exe
  C:\Windows\System\RzcldDO.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\fLmRzeu.exe
  C:\Windows\System\fLmRzeu.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\PVpXbhW.exe
  C:\Windows\System\PVpXbhW.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\sghcuJB.exe
  C:\Windows\System\sghcuJB.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\uPliELP.exe
  C:\Windows\System\uPliELP.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\Ruefmvq.exe
  C:\Windows\System\Ruefmvq.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\fveVbaD.exe
  C:\Windows\System\fveVbaD.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\hCSoLPx.exe
  C:\Windows\System\hCSoLPx.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\MpIRXyI.exe
  C:\Windows\System\MpIRXyI.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\XLgbesA.exe
  C:\Windows\System\XLgbesA.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\jmASdWV.exe
  C:\Windows\System\jmASdWV.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\jvuCQzU.exe
  C:\Windows\System\jvuCQzU.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\axAdnQE.exe
  C:\Windows\System\axAdnQE.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ciEETxp.exe
  C:\Windows\System\ciEETxp.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\AQgsgTb.exe
  C:\Windows\System\AQgsgTb.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\yMnogkQ.exe
  C:\Windows\System\yMnogkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\TFMfOjs.exe
  C:\Windows\System\TFMfOjs.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\fzKAEtP.exe
  C:\Windows\System\fzKAEtP.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\lBGVBTR.exe
  C:\Windows\System\lBGVBTR.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\nYyGpmT.exe
  C:\Windows\System\nYyGpmT.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\VUrpIXZ.exe
  C:\Windows\System\VUrpIXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\kkUfkrY.exe
  C:\Windows\System\kkUfkrY.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\YLMxIGX.exe
  C:\Windows\System\YLMxIGX.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\jtvCUIR.exe
  C:\Windows\System\jtvCUIR.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\hrVqiVo.exe
  C:\Windows\System\hrVqiVo.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\tXpBQyW.exe
  C:\Windows\System\tXpBQyW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\qHOkHhl.exe
  C:\Windows\System\qHOkHhl.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\TORwMhp.exe
  C:\Windows\System\TORwMhp.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\evGtbjP.exe
  C:\Windows\System\evGtbjP.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\jGbNkVy.exe
  C:\Windows\System\jGbNkVy.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\qbGEGCt.exe
  C:\Windows\System\qbGEGCt.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\UAICVzT.exe
  C:\Windows\System\UAICVzT.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\eQpSAnp.exe
  C:\Windows\System\eQpSAnp.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\PYRbZtv.exe
  C:\Windows\System\PYRbZtv.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\oWqDWWf.exe
  C:\Windows\System\oWqDWWf.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\oGBprVV.exe
  C:\Windows\System\oGBprVV.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\STBVZCT.exe
  C:\Windows\System\STBVZCT.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\pUcNErY.exe
  C:\Windows\System\pUcNErY.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\YHSSUYH.exe
  C:\Windows\System\YHSSUYH.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\FJjrIZf.exe
  C:\Windows\System\FJjrIZf.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\PaQSKGN.exe
  C:\Windows\System\PaQSKGN.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\KzwJggB.exe
  C:\Windows\System\KzwJggB.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\dLTJWaf.exe
  C:\Windows\System\dLTJWaf.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\ifvYkFM.exe
  C:\Windows\System\ifvYkFM.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\eoQbwkM.exe
  C:\Windows\System\eoQbwkM.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ngiEPGM.exe
  C:\Windows\System\ngiEPGM.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zXhUYpT.exe
  C:\Windows\System\zXhUYpT.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\vySHmdr.exe
  C:\Windows\System\vySHmdr.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\doOqqjH.exe
  C:\Windows\System\doOqqjH.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\HxjkPhp.exe
  C:\Windows\System\HxjkPhp.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\FbnJdbz.exe
  C:\Windows\System\FbnJdbz.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\TyXqbTr.exe
  C:\Windows\System\TyXqbTr.exe
  2⤵
  PID:1076
- C:\Windows\System\yzNJGpy.exe
  C:\Windows\System\yzNJGpy.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\iZQMFaH.exe
  C:\Windows\System\iZQMFaH.exe
  2⤵
  PID:4512
- C:\Windows\System\yZFJuzX.exe
  C:\Windows\System\yZFJuzX.exe
  2⤵
  PID:216
- C:\Windows\System\CLhNhgc.exe
  C:\Windows\System\CLhNhgc.exe
  2⤵
  PID:1848
- C:\Windows\System\hlVkjSx.exe
  C:\Windows\System\hlVkjSx.exe
  2⤵
  PID:736
- C:\Windows\System\kqHTAlk.exe
  C:\Windows\System\kqHTAlk.exe
  2⤵
  PID:1824
- C:\Windows\System\iEbIVNn.exe
  C:\Windows\System\iEbIVNn.exe
  2⤵
  PID:3180
- C:\Windows\System\GbxDkYM.exe
  C:\Windows\System\GbxDkYM.exe
  2⤵
  PID:1908
- C:\Windows\System\giecjTn.exe
  C:\Windows\System\giecjTn.exe
  2⤵
  PID:4504
- C:\Windows\System\egZRtyU.exe
  C:\Windows\System\egZRtyU.exe
  2⤵
  PID:4256
- C:\Windows\System\HcUWSSv.exe
  C:\Windows\System\HcUWSSv.exe
  2⤵
  PID:4216
- C:\Windows\System\iPGsdHI.exe
  C:\Windows\System\iPGsdHI.exe
  2⤵
  PID:4564
- C:\Windows\System\ergFvGs.exe
  C:\Windows\System\ergFvGs.exe
  2⤵
  PID:2012
- C:\Windows\System\Hvxziak.exe
  C:\Windows\System\Hvxziak.exe
  2⤵
  PID:560
- C:\Windows\System\iWgeSAt.exe
  C:\Windows\System\iWgeSAt.exe
  2⤵
  PID:2992
- C:\Windows\System\YwoHtQS.exe
  C:\Windows\System\YwoHtQS.exe
  2⤵
  PID:4452
- C:\Windows\System\EnfvCpy.exe
  C:\Windows\System\EnfvCpy.exe
  2⤵
  PID:3172
- C:\Windows\System\cddaAbB.exe
  C:\Windows\System\cddaAbB.exe
  2⤵
  PID:5128
- C:\Windows\System\ymerzHq.exe
  C:\Windows\System\ymerzHq.exe
  2⤵
  PID:5152
- C:\Windows\System\WIBRgny.exe
  C:\Windows\System\WIBRgny.exe
  2⤵
  PID:5172
- C:\Windows\System\lpbpjJM.exe
  C:\Windows\System\lpbpjJM.exe
  2⤵
  PID:5188
- C:\Windows\System\SZuBKvO.exe
  C:\Windows\System\SZuBKvO.exe
  2⤵
  PID:5204
- C:\Windows\System\EiAFyNA.exe
  C:\Windows\System\EiAFyNA.exe
  2⤵
  PID:5232
- C:\Windows\System\ARaTDYp.exe
  C:\Windows\System\ARaTDYp.exe
  2⤵
  PID:5248
- C:\Windows\System\bcxtNtN.exe
  C:\Windows\System\bcxtNtN.exe
  2⤵
  PID:5264
- C:\Windows\System\YQaYKIS.exe
  C:\Windows\System\YQaYKIS.exe
  2⤵
  PID:5284
- C:\Windows\System\tiUqeXZ.exe
  C:\Windows\System\tiUqeXZ.exe
  2⤵
  PID:5308
- C:\Windows\System\giyPPOl.exe
  C:\Windows\System\giyPPOl.exe
  2⤵
  PID:5332
- C:\Windows\System\nsfxCqQ.exe
  C:\Windows\System\nsfxCqQ.exe
  2⤵
  PID:5404
- C:\Windows\System\lDCkPBR.exe
  C:\Windows\System\lDCkPBR.exe
  2⤵
  PID:5428
- C:\Windows\System\FolCfpb.exe
  C:\Windows\System\FolCfpb.exe
  2⤵
  PID:5448
- C:\Windows\System\UWACxgJ.exe
  C:\Windows\System\UWACxgJ.exe
  2⤵
  PID:5472
- C:\Windows\System\GskFHax.exe
  C:\Windows\System\GskFHax.exe
  2⤵
  PID:5496
- C:\Windows\System\FHRWKov.exe
  C:\Windows\System\FHRWKov.exe
  2⤵
  PID:5516
- C:\Windows\System\OYYBZuD.exe
  C:\Windows\System\OYYBZuD.exe
  2⤵
  PID:5536
- C:\Windows\System\MbrhAiJ.exe
  C:\Windows\System\MbrhAiJ.exe
  2⤵
  PID:5560
- C:\Windows\System\ynbhgoX.exe
  C:\Windows\System\ynbhgoX.exe
  2⤵
  PID:5580
- C:\Windows\System\fNSzFxo.exe
  C:\Windows\System\fNSzFxo.exe
  2⤵
  PID:5600
- C:\Windows\System\CxGvHhD.exe
  C:\Windows\System\CxGvHhD.exe
  2⤵
  PID:5616
- C:\Windows\System\qYqJrkq.exe
  C:\Windows\System\qYqJrkq.exe
  2⤵
  PID:5636
- C:\Windows\System\bvnNqSy.exe
  C:\Windows\System\bvnNqSy.exe
  2⤵
  PID:5656
- C:\Windows\System\ZiHPUCg.exe
  C:\Windows\System\ZiHPUCg.exe
  2⤵
  PID:5672
- C:\Windows\System\AWEvJwc.exe
  C:\Windows\System\AWEvJwc.exe
  2⤵
  PID:5692
- C:\Windows\System\lDnZWjK.exe
  C:\Windows\System\lDnZWjK.exe
  2⤵
  PID:5712
- C:\Windows\System\bQtsPXo.exe
  C:\Windows\System\bQtsPXo.exe
  2⤵
  PID:5780
- C:\Windows\System\EdBgunA.exe
  C:\Windows\System\EdBgunA.exe
  2⤵
  PID:5796
- C:\Windows\System\qNsMBRX.exe
  C:\Windows\System\qNsMBRX.exe
  2⤵
  PID:5824
- C:\Windows\System\qoPQFbG.exe
  C:\Windows\System\qoPQFbG.exe
  2⤵
  PID:5848
- C:\Windows\System\UaLnmHu.exe
  C:\Windows\System\UaLnmHu.exe
  2⤵
  PID:5868
- C:\Windows\System\UKzWPYF.exe
  C:\Windows\System\UKzWPYF.exe
  2⤵
  PID:5892
- C:\Windows\System\bRyWgeX.exe
  C:\Windows\System\bRyWgeX.exe
  2⤵
  PID:5908
- C:\Windows\System\gThJokp.exe
  C:\Windows\System\gThJokp.exe
  2⤵
  PID:5932
- C:\Windows\System\yTRCVMY.exe
  C:\Windows\System\yTRCVMY.exe
  2⤵
  PID:5952
- C:\Windows\System\Rryhcdr.exe
  C:\Windows\System\Rryhcdr.exe
  2⤵
  PID:5976
- C:\Windows\System\zoJXZqJ.exe
  C:\Windows\System\zoJXZqJ.exe
  2⤵
  PID:5996
- C:\Windows\System\AobUkOy.exe
  C:\Windows\System\AobUkOy.exe
  2⤵
  PID:6088
- C:\Windows\System\IoOWLTk.exe
  C:\Windows\System\IoOWLTk.exe
  2⤵
  PID:4132
- C:\Windows\System\hEqodEd.exe
  C:\Windows\System\hEqodEd.exe
  2⤵
  PID:3476
- C:\Windows\System\tfvSGbZ.exe
  C:\Windows\System\tfvSGbZ.exe
  2⤵
  PID:4280
- C:\Windows\System\lALFGNT.exe
  C:\Windows\System\lALFGNT.exe
  2⤵
  PID:3412
- C:\Windows\System\lfhOfuU.exe
  C:\Windows\System\lfhOfuU.exe
  2⤵
  PID:1884
- C:\Windows\System\uxJMsLT.exe
  C:\Windows\System\uxJMsLT.exe
  2⤵
  PID:2348
- C:\Windows\System\AxSbSVZ.exe
  C:\Windows\System\AxSbSVZ.exe
  2⤵
  PID:5304
- C:\Windows\System\qWjCSTg.exe
  C:\Windows\System\qWjCSTg.exe
  2⤵
  PID:5340
- C:\Windows\System\aupvJIW.exe
  C:\Windows\System\aupvJIW.exe
  2⤵
  PID:1876
- C:\Windows\System\aMxVjwA.exe
  C:\Windows\System\aMxVjwA.exe
  2⤵
  PID:4668
- C:\Windows\System\UetLEvB.exe
  C:\Windows\System\UetLEvB.exe
  2⤵
  PID:4392
- C:\Windows\System\ivQpxCd.exe
  C:\Windows\System\ivQpxCd.exe
  2⤵
  PID:5260
- C:\Windows\System\gGGTVYz.exe
  C:\Windows\System\gGGTVYz.exe
  2⤵
  PID:5200
- C:\Windows\System\SHwvRoX.exe
  C:\Windows\System\SHwvRoX.exe
  2⤵
  PID:5388
- C:\Windows\System\ImcCGXk.exe
  C:\Windows\System\ImcCGXk.exe
  2⤵
  PID:5444
- C:\Windows\System\RpnPUPf.exe
  C:\Windows\System\RpnPUPf.exe
  2⤵
  PID:5504
- C:\Windows\System\KHsPZMs.exe
  C:\Windows\System\KHsPZMs.exe
  2⤵
  PID:5608
- C:\Windows\System\Oqsewal.exe
  C:\Windows\System\Oqsewal.exe
  2⤵
  PID:5668
- C:\Windows\System\fRtdszN.exe
  C:\Windows\System\fRtdszN.exe
  2⤵
  PID:5804
- C:\Windows\System\ErHTwpW.exe
  C:\Windows\System\ErHTwpW.exe
  2⤵
  PID:6004
- C:\Windows\System\ibZVoPl.exe
  C:\Windows\System\ibZVoPl.exe
  2⤵
  PID:5732
- C:\Windows\System\ONHDeuH.exe
  C:\Windows\System\ONHDeuH.exe
  2⤵
  PID:5832
- C:\Windows\System\QYRcArl.exe
  C:\Windows\System\QYRcArl.exe
  2⤵
  PID:5880
- C:\Windows\System\bHdibZD.exe
  C:\Windows\System\bHdibZD.exe
  2⤵
  PID:5928
- C:\Windows\System\lYcSHay.exe
  C:\Windows\System\lYcSHay.exe
  2⤵
  PID:5992
- C:\Windows\System\szCuotc.exe
  C:\Windows\System\szCuotc.exe
  2⤵
  PID:6152
- C:\Windows\System\sIvdgZo.exe
  C:\Windows\System\sIvdgZo.exe
  2⤵
  PID:6172
- C:\Windows\System\dlvwdOo.exe
  C:\Windows\System\dlvwdOo.exe
  2⤵
  PID:6196
- C:\Windows\System\mYGSNmy.exe
  C:\Windows\System\mYGSNmy.exe
  2⤵
  PID:6216
- C:\Windows\System\RxbPWYM.exe
  C:\Windows\System\RxbPWYM.exe
  2⤵
  PID:6232
- C:\Windows\System\jAvWLTN.exe
  C:\Windows\System\jAvWLTN.exe
  2⤵
  PID:6256
- C:\Windows\System\ipjWYTl.exe
  C:\Windows\System\ipjWYTl.exe
  2⤵
  PID:6276
- C:\Windows\System\XUGfjqY.exe
  C:\Windows\System\XUGfjqY.exe
  2⤵
  PID:6300
- C:\Windows\System\YJpssJX.exe
  C:\Windows\System\YJpssJX.exe
  2⤵
  PID:6320
- C:\Windows\System\tTGlzUW.exe
  C:\Windows\System\tTGlzUW.exe
  2⤵
  PID:6432
- C:\Windows\System\PthFBIf.exe
  C:\Windows\System\PthFBIf.exe
  2⤵
  PID:6448
- C:\Windows\System\DrXboLj.exe
  C:\Windows\System\DrXboLj.exe
  2⤵
  PID:6468
- C:\Windows\System\pYKPCdh.exe
  C:\Windows\System\pYKPCdh.exe
  2⤵
  PID:6488
- C:\Windows\System\DYrhYbu.exe
  C:\Windows\System\DYrhYbu.exe
  2⤵
  PID:6508
- C:\Windows\System\FXjHvAn.exe
  C:\Windows\System\FXjHvAn.exe
  2⤵
  PID:6536
- C:\Windows\System\JCvhBgy.exe
  C:\Windows\System\JCvhBgy.exe
  2⤵
  PID:6584
- C:\Windows\System\KbzGFjS.exe
  C:\Windows\System\KbzGFjS.exe
  2⤵
  PID:6616
- C:\Windows\System\cCwSMzT.exe
  C:\Windows\System\cCwSMzT.exe
  2⤵
  PID:6632
- C:\Windows\System\kFNeIAP.exe
  C:\Windows\System\kFNeIAP.exe
  2⤵
  PID:6664
- C:\Windows\System\vqCJtVs.exe
  C:\Windows\System\vqCJtVs.exe
  2⤵
  PID:6688
- C:\Windows\System\wZGYmAA.exe
  C:\Windows\System\wZGYmAA.exe
  2⤵
  PID:6712
- C:\Windows\System\cYxpaOe.exe
  C:\Windows\System\cYxpaOe.exe
  2⤵
  PID:6728
- C:\Windows\System\kiAAfQK.exe
  C:\Windows\System\kiAAfQK.exe
  2⤵
  PID:6744
- C:\Windows\System\OFrwaVu.exe
  C:\Windows\System\OFrwaVu.exe
  2⤵
  PID:6768
- C:\Windows\System\bBIUuSN.exe
  C:\Windows\System\bBIUuSN.exe
  2⤵
  PID:6792
- C:\Windows\System\LJwvejy.exe
  C:\Windows\System\LJwvejy.exe
  2⤵
  PID:6812
- C:\Windows\System\gHVsOzf.exe
  C:\Windows\System\gHVsOzf.exe
  2⤵
  PID:6840
- C:\Windows\System\IsXWdxn.exe
  C:\Windows\System\IsXWdxn.exe
  2⤵
  PID:6864
- C:\Windows\System\EcFowRW.exe
  C:\Windows\System\EcFowRW.exe
  2⤵
  PID:6880
- C:\Windows\System\bWZPYwr.exe
  C:\Windows\System\bWZPYwr.exe
  2⤵
  PID:6904
- C:\Windows\System\PxmzSPG.exe
  C:\Windows\System\PxmzSPG.exe
  2⤵
  PID:6924
- C:\Windows\System\XODMghe.exe
  C:\Windows\System\XODMghe.exe
  2⤵
  PID:6948
- C:\Windows\System\gkNUsad.exe
  C:\Windows\System\gkNUsad.exe
  2⤵
  PID:6968
- C:\Windows\System\SbsHnFf.exe
  C:\Windows\System\SbsHnFf.exe
  2⤵
  PID:6992
- C:\Windows\System\HWDOZzA.exe
  C:\Windows\System\HWDOZzA.exe
  2⤵
  PID:7016
- C:\Windows\System\uwSjmfG.exe
  C:\Windows\System\uwSjmfG.exe
  2⤵
  PID:7032
- C:\Windows\System\GFHvInJ.exe
  C:\Windows\System\GFHvInJ.exe
  2⤵
  PID:7052
- C:\Windows\System\TWBvIDI.exe
  C:\Windows\System\TWBvIDI.exe
  2⤵
  PID:7084
- C:\Windows\System\uBNICaA.exe
  C:\Windows\System\uBNICaA.exe
  2⤵
  PID:7100
- C:\Windows\System\IJMcbqR.exe
  C:\Windows\System\IJMcbqR.exe
  2⤵
  PID:7124
- C:\Windows\System\vHEJKUN.exe
  C:\Windows\System\vHEJKUN.exe
  2⤵
  PID:7148
- C:\Windows\System\gizldDO.exe
  C:\Windows\System\gizldDO.exe
  2⤵
  PID:4020
- C:\Windows\System\yYDCXhb.exe
  C:\Windows\System\yYDCXhb.exe
  2⤵
  PID:1452
- C:\Windows\System\VaOnqMo.exe
  C:\Windows\System\VaOnqMo.exe
  2⤵
  PID:6332
- C:\Windows\System\nLGqNBJ.exe
  C:\Windows\System\nLGqNBJ.exe
  2⤵
  PID:3260
- C:\Windows\System\RhAAQjl.exe
  C:\Windows\System\RhAAQjl.exe
  2⤵
  PID:1912
- C:\Windows\System\yBNPTpR.exe
  C:\Windows\System\yBNPTpR.exe
  2⤵
  PID:5148
- C:\Windows\System\czFLEOc.exe
  C:\Windows\System\czFLEOc.exe
  2⤵
  PID:5244
- C:\Windows\System\PrvswEU.exe
  C:\Windows\System\PrvswEU.exe
  2⤵
  PID:5412
- C:\Windows\System\CfqOwuX.exe
  C:\Windows\System\CfqOwuX.exe
  2⤵
  PID:5488
- C:\Windows\System\NdaPxkn.exe
  C:\Windows\System\NdaPxkn.exe
  2⤵
  PID:5644
- C:\Windows\System\wjIMggk.exe
  C:\Windows\System\wjIMggk.exe
  2⤵
  PID:1108
- C:\Windows\System\pFcBCiX.exe
  C:\Windows\System\pFcBCiX.exe
  2⤵
  PID:5860
- C:\Windows\System\HCtPPel.exe
  C:\Windows\System\HCtPPel.exe
  2⤵
  PID:5988
- C:\Windows\System\oiiIFwM.exe
  C:\Windows\System\oiiIFwM.exe
  2⤵
  PID:6240
- C:\Windows\System\mleOHoL.exe
  C:\Windows\System\mleOHoL.exe
  2⤵
  PID:6268
- C:\Windows\System\CTUlNJe.exe
  C:\Windows\System\CTUlNJe.exe
  2⤵
  PID:7172
- C:\Windows\System\MuIZMNL.exe
  C:\Windows\System\MuIZMNL.exe
  2⤵
  PID:7196
- C:\Windows\System\IsLsyWh.exe
  C:\Windows\System\IsLsyWh.exe
  2⤵
  PID:7220
- C:\Windows\System\PmLleSJ.exe
  C:\Windows\System\PmLleSJ.exe
  2⤵
  PID:7248
- C:\Windows\System\mcMaNeI.exe
  C:\Windows\System\mcMaNeI.exe
  2⤵
  PID:7272
- C:\Windows\System\HgOhLNV.exe
  C:\Windows\System\HgOhLNV.exe
  2⤵
  PID:7288
- C:\Windows\System\WvzmLQe.exe
  C:\Windows\System\WvzmLQe.exe
  2⤵
  PID:7312
- C:\Windows\System\fDUJhDr.exe
  C:\Windows\System\fDUJhDr.exe
  2⤵
  PID:7332
- C:\Windows\System\oZkamQC.exe
  C:\Windows\System\oZkamQC.exe
  2⤵
  PID:7360
- C:\Windows\System\LGaEIRh.exe
  C:\Windows\System\LGaEIRh.exe
  2⤵
  PID:7384
- C:\Windows\System\SvwnOFk.exe
  C:\Windows\System\SvwnOFk.exe
  2⤵
  PID:7404
- C:\Windows\System\ETuPhMM.exe
  C:\Windows\System\ETuPhMM.exe
  2⤵
  PID:7424
- C:\Windows\System\NiUuqyP.exe
  C:\Windows\System\NiUuqyP.exe
  2⤵
  PID:7444
- C:\Windows\System\MztmYWb.exe
  C:\Windows\System\MztmYWb.exe
  2⤵
  PID:7472
- C:\Windows\System\DSZEHnw.exe
  C:\Windows\System\DSZEHnw.exe
  2⤵
  PID:7496
- C:\Windows\System\xKtIBHT.exe
  C:\Windows\System\xKtIBHT.exe
  2⤵
  PID:7512
- C:\Windows\System\ciFOPkW.exe
  C:\Windows\System\ciFOPkW.exe
  2⤵
  PID:7536
- C:\Windows\System\ejkINWb.exe
  C:\Windows\System\ejkINWb.exe
  2⤵
  PID:7556
- C:\Windows\System\JFLhINm.exe
  C:\Windows\System\JFLhINm.exe
  2⤵
  PID:7648
- C:\Windows\System\nFFKkBs.exe
  C:\Windows\System\nFFKkBs.exe
  2⤵
  PID:7676
- C:\Windows\System\QHQAFZq.exe
  C:\Windows\System\QHQAFZq.exe
  2⤵
  PID:7692
- C:\Windows\System\vjEEaEm.exe
  C:\Windows\System\vjEEaEm.exe
  2⤵
  PID:7712
- C:\Windows\System\fQbIXtD.exe
  C:\Windows\System\fQbIXtD.exe
  2⤵
  PID:7740
- C:\Windows\System\mpazEyY.exe
  C:\Windows\System\mpazEyY.exe
  2⤵
  PID:7768
- C:\Windows\System\XlKTPUj.exe
  C:\Windows\System\XlKTPUj.exe
  2⤵
  PID:7796
- C:\Windows\System\ajqLhXi.exe
  C:\Windows\System\ajqLhXi.exe
  2⤵
  PID:7816
- C:\Windows\System\lCfGkON.exe
  C:\Windows\System\lCfGkON.exe
  2⤵
  PID:7836
- C:\Windows\System\RgjCPcU.exe
  C:\Windows\System\RgjCPcU.exe
  2⤵
  PID:7872
- C:\Windows\System\uXlznOw.exe
  C:\Windows\System\uXlznOw.exe
  2⤵
  PID:7944
- C:\Windows\System\VZfxdCC.exe
  C:\Windows\System\VZfxdCC.exe
  2⤵
  PID:7972
- C:\Windows\System\jzYTuBx.exe
  C:\Windows\System\jzYTuBx.exe
  2⤵
  PID:8040
- C:\Windows\System\LgWhqHs.exe
  C:\Windows\System\LgWhqHs.exe
  2⤵
  PID:8064
- C:\Windows\System\hAvjGPF.exe
  C:\Windows\System\hAvjGPF.exe
  2⤵
  PID:8088
- C:\Windows\System\pEJgdQk.exe
  C:\Windows\System\pEJgdQk.exe
  2⤵
  PID:8112
- C:\Windows\System\OVzNbWc.exe
  C:\Windows\System\OVzNbWc.exe
  2⤵
  PID:8136
- C:\Windows\System\tDxBAVY.exe
  C:\Windows\System\tDxBAVY.exe
  2⤵
  PID:8156
- C:\Windows\System\pcvGhKt.exe
  C:\Windows\System\pcvGhKt.exe
  2⤵
  PID:8180
- C:\Windows\System\hxltCnM.exe
  C:\Windows\System\hxltCnM.exe
  2⤵
  PID:7136
- C:\Windows\System\tTjfZgN.exe
  C:\Windows\System\tTjfZgN.exe
  2⤵
  PID:4876
- C:\Windows\System\hzboGib.exe
  C:\Windows\System\hzboGib.exe
  2⤵
  PID:6444
- C:\Windows\System\oafDPCV.exe
  C:\Windows\System\oafDPCV.exe
  2⤵
  PID:6476
- C:\Windows\System\FFbMvty.exe
  C:\Windows\System\FFbMvty.exe
  2⤵
  PID:6504
- C:\Windows\System\nXXiWSM.exe
  C:\Windows\System\nXXiWSM.exe
  2⤵
  PID:6572
- C:\Windows\System\lENhZAs.exe
  C:\Windows\System\lENhZAs.exe
  2⤵
  PID:6640
- C:\Windows\System\BVDcgkB.exe
  C:\Windows\System\BVDcgkB.exe
  2⤵
  PID:7048
- C:\Windows\System\ZGNiQvY.exe
  C:\Windows\System\ZGNiQvY.exe
  2⤵
  PID:7180
- C:\Windows\System\XBsqiLU.exe
  C:\Windows\System\XBsqiLU.exe
  2⤵
  PID:7436
- C:\Windows\System\nPdMUsm.exe
  C:\Windows\System\nPdMUsm.exe
  2⤵
  PID:6672
- C:\Windows\System\CWHDlJE.exe
  C:\Windows\System\CWHDlJE.exe
  2⤵
  PID:6708
- C:\Windows\System\uMwBbVi.exe
  C:\Windows\System\uMwBbVi.exe
  2⤵
  PID:6764
- C:\Windows\System\dtblcoJ.exe
  C:\Windows\System\dtblcoJ.exe
  2⤵
  PID:6820
- C:\Windows\System\lQkofDI.exe
  C:\Windows\System\lQkofDI.exe
  2⤵
  PID:6852
- C:\Windows\System\abiKGiU.exe
  C:\Windows\System\abiKGiU.exe
  2⤵
  PID:6900
- C:\Windows\System\wOdUKAp.exe
  C:\Windows\System\wOdUKAp.exe
  2⤵
  PID:6988
- C:\Windows\System\VoPFKpJ.exe
  C:\Windows\System\VoPFKpJ.exe
  2⤵
  PID:6940
- C:\Windows\System\gxnrjcu.exe
  C:\Windows\System\gxnrjcu.exe
  2⤵
  PID:7064
- C:\Windows\System\kKjnWev.exe
  C:\Windows\System\kKjnWev.exe
  2⤵
  PID:7348
- C:\Windows\System\MElRqGj.exe
  C:\Windows\System\MElRqGj.exe
  2⤵
  PID:6184
- C:\Windows\System\lkkNlWW.exe
  C:\Windows\System\lkkNlWW.exe
  2⤵
  PID:2864
- C:\Windows\System\HTbhWKI.exe
  C:\Windows\System\HTbhWKI.exe
  2⤵
  PID:5164
- C:\Windows\System\rNjeHMc.exe
  C:\Windows\System\rNjeHMc.exe
  2⤵
  PID:5440
- C:\Windows\System\ZgoLlkI.exe
  C:\Windows\System\ZgoLlkI.exe
  2⤵
  PID:5812
- C:\Windows\System\CfWJFGo.exe
  C:\Windows\System\CfWJFGo.exe
  2⤵
  PID:7024
- C:\Windows\System\pZqSxBb.exe
  C:\Windows\System\pZqSxBb.exe
  2⤵
  PID:7228
- C:\Windows\System\nQxbgVG.exe
  C:\Windows\System\nQxbgVG.exe
  2⤵
  PID:7296
- C:\Windows\System\cmPaipk.exe
  C:\Windows\System\cmPaipk.exe
  2⤵
  PID:7328
- C:\Windows\System\SzKZhHV.exe
  C:\Windows\System\SzKZhHV.exe
  2⤵
  PID:7504
- C:\Windows\System\lhayTGw.exe
  C:\Windows\System\lhayTGw.exe
  2⤵
  PID:7612
- C:\Windows\System\VGwzYFh.exe
  C:\Windows\System\VGwzYFh.exe
  2⤵
  PID:7708
- C:\Windows\System\RpawOkX.exe
  C:\Windows\System\RpawOkX.exe
  2⤵
  PID:7776
- C:\Windows\System\CNivAkZ.exe
  C:\Windows\System\CNivAkZ.exe
  2⤵
  PID:7916
- C:\Windows\System\MjzyHEh.exe
  C:\Windows\System\MjzyHEh.exe
  2⤵
  PID:2928
- C:\Windows\System\sruHWBv.exe
  C:\Windows\System\sruHWBv.exe
  2⤵
  PID:2852
- C:\Windows\System\mgpYuCO.exe
  C:\Windows\System\mgpYuCO.exe
  2⤵
  PID:4672
- C:\Windows\System\BDMLjrU.exe
  C:\Windows\System\BDMLjrU.exe
  2⤵
  PID:3036
- C:\Windows\System\hpAhHMJ.exe
  C:\Windows\System\hpAhHMJ.exe
  2⤵
  PID:7788
- C:\Windows\System\fQgtyvk.exe
  C:\Windows\System\fQgtyvk.exe
  2⤵
  PID:7936
- C:\Windows\System\zcqsuHx.exe
  C:\Windows\System\zcqsuHx.exe
  2⤵
  PID:8072
- C:\Windows\System\FqwEpRi.exe
  C:\Windows\System\FqwEpRi.exe
  2⤵
  PID:8132
- C:\Windows\System\IdvDLDj.exe
  C:\Windows\System\IdvDLDj.exe
  2⤵
  PID:7116
- C:\Windows\System\QDqUJkd.exe
  C:\Windows\System\QDqUJkd.exe
  2⤵
  PID:4120
- C:\Windows\System\yIgYmvy.exe
  C:\Windows\System\yIgYmvy.exe
  2⤵
  PID:8212
- C:\Windows\System\ZrrAvCD.exe
  C:\Windows\System\ZrrAvCD.exe
  2⤵
  PID:8236
- C:\Windows\System\DbPdKBJ.exe
  C:\Windows\System\DbPdKBJ.exe
  2⤵
  PID:8256
- C:\Windows\System\oUWchQM.exe
  C:\Windows\System\oUWchQM.exe
  2⤵
  PID:8276
- C:\Windows\System\RztMclD.exe
  C:\Windows\System\RztMclD.exe
  2⤵
  PID:8296
- C:\Windows\System\UNJuBje.exe
  C:\Windows\System\UNJuBje.exe
  2⤵
  PID:8312
- C:\Windows\System\laIXXcL.exe
  C:\Windows\System\laIXXcL.exe
  2⤵
  PID:8340
- C:\Windows\System\QIeELCM.exe
  C:\Windows\System\QIeELCM.exe
  2⤵
  PID:8360
- C:\Windows\System\UDJpsrp.exe
  C:\Windows\System\UDJpsrp.exe
  2⤵
  PID:8380
- C:\Windows\System\pMcYQnl.exe
  C:\Windows\System\pMcYQnl.exe
  2⤵
  PID:8400
- C:\Windows\System\uXRnUIA.exe
  C:\Windows\System\uXRnUIA.exe
  2⤵
  PID:8424
- C:\Windows\System\PWUlYwe.exe
  C:\Windows\System\PWUlYwe.exe
  2⤵
  PID:8444
- C:\Windows\System\ofcQxib.exe
  C:\Windows\System\ofcQxib.exe
  2⤵
  PID:8464
- C:\Windows\System\CUQijMX.exe
  C:\Windows\System\CUQijMX.exe
  2⤵
  PID:8488
- C:\Windows\System\KZIhvdW.exe
  C:\Windows\System\KZIhvdW.exe
  2⤵
  PID:8508
- C:\Windows\System\rrCuEyd.exe
  C:\Windows\System\rrCuEyd.exe
  2⤵
  PID:8528
- C:\Windows\System\YKeNGvo.exe
  C:\Windows\System\YKeNGvo.exe
  2⤵
  PID:8552
- C:\Windows\System\VNXIYpX.exe
  C:\Windows\System\VNXIYpX.exe
  2⤵
  PID:8576
- C:\Windows\System\uGZFuep.exe
  C:\Windows\System\uGZFuep.exe
  2⤵
  PID:8600
- C:\Windows\System\dmBKiHp.exe
  C:\Windows\System\dmBKiHp.exe
  2⤵
  PID:8624
- C:\Windows\System\KpkZBZX.exe
  C:\Windows\System\KpkZBZX.exe
  2⤵
  PID:8644
- C:\Windows\System\GPAglXf.exe
  C:\Windows\System\GPAglXf.exe
  2⤵
  PID:8660
- C:\Windows\System\xbSaImO.exe
  C:\Windows\System\xbSaImO.exe
  2⤵
  PID:8684
- C:\Windows\System\ozmDgoD.exe
  C:\Windows\System\ozmDgoD.exe
  2⤵
  PID:8708
- C:\Windows\System\ULUCWrE.exe
  C:\Windows\System\ULUCWrE.exe
  2⤵
  PID:8728
- C:\Windows\System\heLkLsR.exe
  C:\Windows\System\heLkLsR.exe
  2⤵
  PID:8752
- C:\Windows\System\IwJUrzY.exe
  C:\Windows\System\IwJUrzY.exe
  2⤵
  PID:8772
- C:\Windows\System\CvWkYxC.exe
  C:\Windows\System\CvWkYxC.exe
  2⤵
  PID:8796
- C:\Windows\System\xEoonva.exe
  C:\Windows\System\xEoonva.exe
  2⤵
  PID:8824
- C:\Windows\System\dNjPoJs.exe
  C:\Windows\System\dNjPoJs.exe
  2⤵
  PID:8848
- C:\Windows\System\kbgTwmd.exe
  C:\Windows\System\kbgTwmd.exe
  2⤵
  PID:8884
- C:\Windows\System\EpuZxMW.exe
  C:\Windows\System\EpuZxMW.exe
  2⤵
  PID:8904
- C:\Windows\System\RemhLIh.exe
  C:\Windows\System\RemhLIh.exe
  2⤵
  PID:8928
- C:\Windows\System\totEljs.exe
  C:\Windows\System\totEljs.exe
  2⤵
  PID:8952
- C:\Windows\System\NeayzLy.exe
  C:\Windows\System\NeayzLy.exe
  2⤵
  PID:8976
- C:\Windows\System\wRhaQnA.exe
  C:\Windows\System\wRhaQnA.exe
  2⤵
  PID:8992
- C:\Windows\System\JtZeYRL.exe
  C:\Windows\System\JtZeYRL.exe
  2⤵
  PID:9012
- C:\Windows\System\prfrPPA.exe
  C:\Windows\System\prfrPPA.exe
  2⤵
  PID:9028
- C:\Windows\System\CslMOOW.exe
  C:\Windows\System\CslMOOW.exe
  2⤵
  PID:9052
- C:\Windows\System\lgfSblm.exe
  C:\Windows\System\lgfSblm.exe
  2⤵
  PID:9076
- C:\Windows\System\mcMdvvf.exe
  C:\Windows\System\mcMdvvf.exe
  2⤵
  PID:9100
- C:\Windows\System\opYcpHL.exe
  C:\Windows\System\opYcpHL.exe
  2⤵
  PID:9120
- C:\Windows\System\CbgmWJU.exe
  C:\Windows\System\CbgmWJU.exe
  2⤵
  PID:9140
- C:\Windows\System\nrxhsaD.exe
  C:\Windows\System\nrxhsaD.exe
  2⤵
  PID:9168
- C:\Windows\System\NDfFuFz.exe
  C:\Windows\System\NDfFuFz.exe
  2⤵
  PID:9192
- C:\Windows\System\ZMvPXio.exe
  C:\Windows\System\ZMvPXio.exe
  2⤵
  PID:2180
- C:\Windows\System\pvKGnQh.exe
  C:\Windows\System\pvKGnQh.exe
  2⤵
  PID:8032
- C:\Windows\System\zULvqmB.exe
  C:\Windows\System\zULvqmB.exe
  2⤵
  PID:7684
- C:\Windows\System\FKvvSzE.exe
  C:\Windows\System\FKvvSzE.exe
  2⤵
  PID:7940
- C:\Windows\System\mToHwUK.exe
  C:\Windows\System\mToHwUK.exe
  2⤵
  PID:4808
- C:\Windows\System\ycyAORr.exe
  C:\Windows\System\ycyAORr.exe
  2⤵
  PID:4044
- C:\Windows\System\ionHUIs.exe
  C:\Windows\System\ionHUIs.exe
  2⤵
  PID:8096
- C:\Windows\System\lxdOZFu.exe
  C:\Windows\System\lxdOZFu.exe
  2⤵
  PID:3508
- C:\Windows\System\mgeEceC.exe
  C:\Windows\System\mgeEceC.exe
  2⤵
  PID:8204
- C:\Windows\System\PduZlJo.exe
  C:\Windows\System\PduZlJo.exe
  2⤵
  PID:8252
- C:\Windows\System\wsiNZbP.exe
  C:\Windows\System\wsiNZbP.exe
  2⤵
  PID:7352
- C:\Windows\System\xFqkFxN.exe
  C:\Windows\System\xFqkFxN.exe
  2⤵
  PID:8104
- C:\Windows\System\WIgPkpK.exe
  C:\Windows\System\WIgPkpK.exe
  2⤵
  PID:7664
- C:\Windows\System\nnSgoyB.exe
  C:\Windows\System\nnSgoyB.exe
  2⤵
  PID:8408
- C:\Windows\System\fkiaSzN.exe
  C:\Windows\System\fkiaSzN.exe
  2⤵
  PID:6420
- C:\Windows\System\InbtMJJ.exe
  C:\Windows\System\InbtMJJ.exe
  2⤵
  PID:7808
- C:\Windows\System\fiFwsoT.exe
  C:\Windows\System\fiFwsoT.exe
  2⤵
  PID:8584
- C:\Windows\System\aGRppqx.exe
  C:\Windows\System\aGRppqx.exe
  2⤵
  PID:8636
- C:\Windows\System\tQcuVmP.exe
  C:\Windows\System\tQcuVmP.exe
  2⤵
  PID:6528
- C:\Windows\System\bkAFhtV.exe
  C:\Windows\System\bkAFhtV.exe
  2⤵
  PID:6168
- C:\Windows\System\LDHNWbk.exe
  C:\Windows\System\LDHNWbk.exe
  2⤵
  PID:7412
- C:\Windows\System\PFKFuGm.exe
  C:\Windows\System\PFKFuGm.exe
  2⤵
  PID:6724
- C:\Windows\System\mGzzAXz.exe
  C:\Windows\System\mGzzAXz.exe
  2⤵
  PID:6808
- C:\Windows\System\NYNsaSS.exe
  C:\Windows\System\NYNsaSS.exe
  2⤵
  PID:6916
- C:\Windows\System\CirspMt.exe
  C:\Windows\System\CirspMt.exe
  2⤵
  PID:7012
- C:\Windows\System\jwlOCNr.exe
  C:\Windows\System\jwlOCNr.exe
  2⤵
  PID:7164
- C:\Windows\System\RenSwaA.exe
  C:\Windows\System\RenSwaA.exe
  2⤵
  PID:1600
- C:\Windows\System\STFveuy.exe
  C:\Windows\System\STFveuy.exe
  2⤵
  PID:5416
- C:\Windows\System\zsYFcgi.exe
  C:\Windows\System\zsYFcgi.exe
  2⤵
  PID:7192
- C:\Windows\System\sgcdDWn.exe
  C:\Windows\System\sgcdDWn.exe
  2⤵
  PID:7284
- C:\Windows\System\yWhSCiN.exe
  C:\Windows\System\yWhSCiN.exe
  2⤵
  PID:9228
- C:\Windows\System\oHNSlpl.exe
  C:\Windows\System\oHNSlpl.exe
  2⤵
  PID:9248
- C:\Windows\System\NYqKxFc.exe
  C:\Windows\System\NYqKxFc.exe
  2⤵
  PID:9268
- C:\Windows\System\YfFobfG.exe
  C:\Windows\System\YfFobfG.exe
  2⤵
  PID:9288
- C:\Windows\System\CxragKf.exe
  C:\Windows\System\CxragKf.exe
  2⤵
  PID:9316
- C:\Windows\System\vURayHA.exe
  C:\Windows\System\vURayHA.exe
  2⤵
  PID:9340
- C:\Windows\System\uWTaREy.exe
  C:\Windows\System\uWTaREy.exe
  2⤵
  PID:9360
- C:\Windows\System\PYCJGdh.exe
  C:\Windows\System\PYCJGdh.exe
  2⤵
  PID:9384
- C:\Windows\System\bFVmkYi.exe
  C:\Windows\System\bFVmkYi.exe
  2⤵
  PID:9408
- C:\Windows\System\VjnhIyq.exe
  C:\Windows\System\VjnhIyq.exe
  2⤵
  PID:9436
- C:\Windows\System\UTLukIs.exe
  C:\Windows\System\UTLukIs.exe
  2⤵
  PID:9460
- C:\Windows\System\fvQXGrm.exe
  C:\Windows\System\fvQXGrm.exe
  2⤵
  PID:9484
- C:\Windows\System\AYDrfHt.exe
  C:\Windows\System\AYDrfHt.exe
  2⤵
  PID:9508
- C:\Windows\System\PMlJvzN.exe
  C:\Windows\System\PMlJvzN.exe
  2⤵
  PID:9524
- C:\Windows\System\ZKmtleP.exe
  C:\Windows\System\ZKmtleP.exe
  2⤵
  PID:9548
- C:\Windows\System\wAaDCLo.exe
  C:\Windows\System\wAaDCLo.exe
  2⤵
  PID:9576
- C:\Windows\System\eWgGhlV.exe
  C:\Windows\System\eWgGhlV.exe
  2⤵
  PID:9604
- C:\Windows\System\HEqAHeo.exe
  C:\Windows\System\HEqAHeo.exe
  2⤵
  PID:9624
- C:\Windows\System\LANORZP.exe
  C:\Windows\System\LANORZP.exe
  2⤵
  PID:9640
- C:\Windows\System\jxsMcwN.exe
  C:\Windows\System\jxsMcwN.exe
  2⤵
  PID:9656
- C:\Windows\System\qbrooxr.exe
  C:\Windows\System\qbrooxr.exe
  2⤵
  PID:9672
- C:\Windows\System\EsGyNlP.exe
  C:\Windows\System\EsGyNlP.exe
  2⤵
  PID:9692
- C:\Windows\System\UZHwqlw.exe
  C:\Windows\System\UZHwqlw.exe
  2⤵
  PID:9712
- C:\Windows\System\hozIEmo.exe
  C:\Windows\System\hozIEmo.exe
  2⤵
  PID:9740
- C:\Windows\System\jMAImgq.exe
  C:\Windows\System\jMAImgq.exe
  2⤵
  PID:9764
- C:\Windows\System\lFEnate.exe
  C:\Windows\System\lFEnate.exe
  2⤵
  PID:9784
- C:\Windows\System\VNAprCC.exe
  C:\Windows\System\VNAprCC.exe
  2⤵
  PID:9808
- C:\Windows\System\vKVxVPf.exe
  C:\Windows\System\vKVxVPf.exe
  2⤵
  PID:9824
- C:\Windows\System\iKxOWFT.exe
  C:\Windows\System\iKxOWFT.exe
  2⤵
  PID:9844
- C:\Windows\System\QMFqRCy.exe
  C:\Windows\System\QMFqRCy.exe
  2⤵
  PID:9872
- C:\Windows\System\RcAHZfU.exe
  C:\Windows\System\RcAHZfU.exe
  2⤵
  PID:9892
- C:\Windows\System\qXNcMBG.exe
  C:\Windows\System\qXNcMBG.exe
  2⤵
  PID:9916
- C:\Windows\System\FnGDyXW.exe
  C:\Windows\System\FnGDyXW.exe
  2⤵
  PID:9936
- C:\Windows\System\DkFqMWI.exe
  C:\Windows\System\DkFqMWI.exe
  2⤵
  PID:9964
- C:\Windows\System\MxVFDgr.exe
  C:\Windows\System\MxVFDgr.exe
  2⤵
  PID:10000
- C:\Windows\System\XahUewn.exe
  C:\Windows\System\XahUewn.exe
  2⤵
  PID:10024
- C:\Windows\System\TYyLBZT.exe
  C:\Windows\System\TYyLBZT.exe
  2⤵
  PID:10044
- C:\Windows\System\aylRNGn.exe
  C:\Windows\System\aylRNGn.exe
  2⤵
  PID:10068
- C:\Windows\System\hdhhPJY.exe
  C:\Windows\System\hdhhPJY.exe
  2⤵
  PID:10104
- C:\Windows\System\HbPLHMU.exe
  C:\Windows\System\HbPLHMU.exe
  2⤵
  PID:10124
- C:\Windows\System\xdtibHo.exe
  C:\Windows\System\xdtibHo.exe
  2⤵
  PID:10148
- C:\Windows\System\TqrmUnP.exe
  C:\Windows\System\TqrmUnP.exe
  2⤵
  PID:10172
- C:\Windows\System\ByDmupT.exe
  C:\Windows\System\ByDmupT.exe
  2⤵
  PID:10192
- C:\Windows\System\EpDzbtA.exe
  C:\Windows\System\EpDzbtA.exe
  2⤵
  PID:10220
- C:\Windows\System\oRPfRbC.exe
  C:\Windows\System\oRPfRbC.exe
  2⤵
  PID:8820
- C:\Windows\System\AOodvew.exe
  C:\Windows\System\AOodvew.exe
  2⤵
  PID:8876
- C:\Windows\System\aXuRhCZ.exe
  C:\Windows\System\aXuRhCZ.exe
  2⤵
  PID:7564
- C:\Windows\System\AIizadw.exe
  C:\Windows\System\AIizadw.exe
  2⤵
  PID:9136
- C:\Windows\System\aKQabII.exe
  C:\Windows\System\aKQabII.exe
  2⤵
  PID:9212
- C:\Windows\System\vbTpViq.exe
  C:\Windows\System\vbTpViq.exe
  2⤵
  PID:8480
- C:\Windows\System\VRaFCdI.exe
  C:\Windows\System\VRaFCdI.exe
  2⤵
  PID:7828
- C:\Windows\System\yNRacGb.exe
  C:\Windows\System\yNRacGb.exe
  2⤵
  PID:8268
- C:\Windows\System\dMgZTZf.exe
  C:\Windows\System\dMgZTZf.exe
  2⤵
  PID:8368
- C:\Windows\System\IjyKKYz.exe
  C:\Windows\System\IjyKKYz.exe
  2⤵
  PID:8716
- C:\Windows\System\HBrNRnP.exe
  C:\Windows\System\HBrNRnP.exe
  2⤵
  PID:6464
- C:\Windows\System\LGfatdB.exe
  C:\Windows\System\LGfatdB.exe
  2⤵
  PID:6704
- C:\Windows\System\TaXsAVT.exe
  C:\Windows\System\TaXsAVT.exe
  2⤵
  PID:6944
- C:\Windows\System\QoLSkKp.exe
  C:\Windows\System\QoLSkKp.exe
  2⤵
  PID:5948
- C:\Windows\System\wiqfUmS.exe
  C:\Windows\System\wiqfUmS.exe
  2⤵
  PID:7728
- C:\Windows\System\SUdkdep.exe
  C:\Windows\System\SUdkdep.exe
  2⤵
  PID:8896
- C:\Windows\System\mUGEkfD.exe
  C:\Windows\System\mUGEkfD.exe
  2⤵
  PID:10244
- C:\Windows\System\UHOWdur.exe
  C:\Windows\System\UHOWdur.exe
  2⤵
  PID:10268
- C:\Windows\System\XVQBoxk.exe
  C:\Windows\System\XVQBoxk.exe
  2⤵
  PID:10292
- C:\Windows\System\tCwwoqN.exe
  C:\Windows\System\tCwwoqN.exe
  2⤵
  PID:10312
- C:\Windows\System\HpatzPt.exe
  C:\Windows\System\HpatzPt.exe
  2⤵
  PID:10336
- C:\Windows\System\jloGwcY.exe
  C:\Windows\System\jloGwcY.exe
  2⤵
  PID:10360
- C:\Windows\System\YphPmnI.exe
  C:\Windows\System\YphPmnI.exe
  2⤵
  PID:10384
- C:\Windows\System\jPtBjsL.exe
  C:\Windows\System\jPtBjsL.exe
  2⤵
  PID:10404
- C:\Windows\System\sPlGDwF.exe
  C:\Windows\System\sPlGDwF.exe
  2⤵
  PID:10428
- C:\Windows\System\uVNJjpK.exe
  C:\Windows\System\uVNJjpK.exe
  2⤵
  PID:10456
- C:\Windows\System\KxObWGL.exe
  C:\Windows\System\KxObWGL.exe
  2⤵
  PID:10480
- C:\Windows\System\RTsSQCM.exe
  C:\Windows\System\RTsSQCM.exe
  2⤵
  PID:10508
- C:\Windows\System\DjVoyYV.exe
  C:\Windows\System\DjVoyYV.exe
  2⤵
  PID:10528
- C:\Windows\System\SXESnfn.exe
  C:\Windows\System\SXESnfn.exe
  2⤵
  PID:10556
- C:\Windows\System\OjDIReg.exe
  C:\Windows\System\OjDIReg.exe
  2⤵
  PID:10580
- C:\Windows\System\Hiduoby.exe
  C:\Windows\System\Hiduoby.exe
  2⤵
  PID:10616
- C:\Windows\System\AJsrtsK.exe
  C:\Windows\System\AJsrtsK.exe
  2⤵
  PID:10632
- C:\Windows\System\CAbEeoh.exe
  C:\Windows\System\CAbEeoh.exe
  2⤵
  PID:10656
- C:\Windows\System\ocMQibq.exe
  C:\Windows\System\ocMQibq.exe
  2⤵
  PID:10676
- C:\Windows\System\wQdusBO.exe
  C:\Windows\System\wQdusBO.exe
  2⤵
  PID:10692
- C:\Windows\System\MOqzNOU.exe
  C:\Windows\System\MOqzNOU.exe
  2⤵
  PID:10712
- C:\Windows\System\QBoPnRI.exe
  C:\Windows\System\QBoPnRI.exe
  2⤵
  PID:10732
- C:\Windows\System\pTfZLjN.exe
  C:\Windows\System\pTfZLjN.exe
  2⤵
  PID:10752
- C:\Windows\System\QlOoFNO.exe
  C:\Windows\System\QlOoFNO.exe
  2⤵
  PID:10776
- C:\Windows\System\xRxjxng.exe
  C:\Windows\System\xRxjxng.exe
  2⤵
  PID:10800
- C:\Windows\System\bFyMxjk.exe
  C:\Windows\System\bFyMxjk.exe
  2⤵
  PID:10824
- C:\Windows\System\ZHfAzzh.exe
  C:\Windows\System\ZHfAzzh.exe
  2⤵
  PID:10844
- C:\Windows\System\SJUvYSl.exe
  C:\Windows\System\SJUvYSl.exe
  2⤵
  PID:10872
- C:\Windows\System\BcSEPkt.exe
  C:\Windows\System\BcSEPkt.exe
  2⤵
  PID:10892
- C:\Windows\System\yrmGcVG.exe
  C:\Windows\System\yrmGcVG.exe
  2⤵
  PID:10912
- C:\Windows\System\czOJEfH.exe
  C:\Windows\System\czOJEfH.exe
  2⤵
  PID:10936
- C:\Windows\System\RoZUUsl.exe
  C:\Windows\System\RoZUUsl.exe
  2⤵
  PID:10968
- C:\Windows\System\IfAnbgo.exe
  C:\Windows\System\IfAnbgo.exe
  2⤵
  PID:10992
- C:\Windows\System\ismnubE.exe
  C:\Windows\System\ismnubE.exe
  2⤵
  PID:11012
- C:\Windows\System\oYPsKkz.exe
  C:\Windows\System\oYPsKkz.exe
  2⤵
  PID:11040
- C:\Windows\System\CikPAUT.exe
  C:\Windows\System\CikPAUT.exe
  2⤵
  PID:11064
- C:\Windows\System\FEGInYf.exe
  C:\Windows\System\FEGInYf.exe
  2⤵
  PID:11084
- C:\Windows\System\nqiiSrm.exe
  C:\Windows\System\nqiiSrm.exe
  2⤵
  PID:11108
- C:\Windows\System\nFhIdjQ.exe
  C:\Windows\System\nFhIdjQ.exe
  2⤵
  PID:11128
- C:\Windows\System\obfQojO.exe
  C:\Windows\System\obfQojO.exe
  2⤵
  PID:11152
- C:\Windows\System\IIKHrug.exe
  C:\Windows\System\IIKHrug.exe
  2⤵
  PID:11184
- C:\Windows\System\vBLYJWR.exe
  C:\Windows\System\vBLYJWR.exe
  2⤵
  PID:11212
- C:\Windows\System\FJSpeVU.exe
  C:\Windows\System\FJSpeVU.exe
  2⤵
  PID:11236
- C:\Windows\System\RZqKiqZ.exe
  C:\Windows\System\RZqKiqZ.exe
  2⤵
  PID:9108
- C:\Windows\System\eXCbrNN.exe
  C:\Windows\System\eXCbrNN.exe
  2⤵
  PID:9500
- C:\Windows\System\nAolnQI.exe
  C:\Windows\System\nAolnQI.exe
  2⤵
  PID:9516
- C:\Windows\System\JQakiLf.exe
  C:\Windows\System\JQakiLf.exe
  2⤵
  PID:8612
- C:\Windows\System\zSYYhEd.exe
  C:\Windows\System\zSYYhEd.exe
  2⤵
  PID:10160
- C:\Windows\System\JpmKwFc.exe
  C:\Windows\System\JpmKwFc.exe
  2⤵
  PID:4456
- C:\Windows\System\cfHCbwq.exe
  C:\Windows\System\cfHCbwq.exe
  2⤵
  PID:11148
- C:\Windows\System\UccmncE.exe
  C:\Windows\System\UccmncE.exe
  2⤵
  PID:8544
- C:\Windows\System\eGbfbRy.exe
  C:\Windows\System\eGbfbRy.exe
  2⤵
  PID:7464
- C:\Windows\System\XmpITfA.exe
  C:\Windows\System\XmpITfA.exe
  2⤵
  PID:9592
- C:\Windows\System\NhRvHDx.exe
  C:\Windows\System\NhRvHDx.exe
  2⤵
  PID:11268
- C:\Windows\System\DUxmJIH.exe
  C:\Windows\System\DUxmJIH.exe
  2⤵
  PID:11284
- C:\Windows\System\ottFqxj.exe
  C:\Windows\System\ottFqxj.exe
  2⤵
  PID:11304
- C:\Windows\System\yvUVfDf.exe
  C:\Windows\System\yvUVfDf.exe
  2⤵
  PID:11320
- C:\Windows\System\FmFwFRw.exe
  C:\Windows\System\FmFwFRw.exe
  2⤵
  PID:11336
- C:\Windows\System\NgJIoTr.exe
  C:\Windows\System\NgJIoTr.exe
  2⤵
  PID:11356
- C:\Windows\System\IbtzlSz.exe
  C:\Windows\System\IbtzlSz.exe
  2⤵
  PID:11384
- C:\Windows\System\qzToMYM.exe
  C:\Windows\System\qzToMYM.exe
  2⤵
  PID:11412
- C:\Windows\System\IgFHqui.exe
  C:\Windows\System\IgFHqui.exe
  2⤵
  PID:11448
- C:\Windows\System\ONTfotX.exe
  C:\Windows\System\ONTfotX.exe
  2⤵
  PID:11500
- C:\Windows\System\IONdxbb.exe
  C:\Windows\System\IONdxbb.exe
  2⤵
  PID:11520
- C:\Windows\System\cBBDvvt.exe
  C:\Windows\System\cBBDvvt.exe
  2⤵
  PID:11544
- C:\Windows\System\GSNCnTK.exe
  C:\Windows\System\GSNCnTK.exe
  2⤵
  PID:11564
- C:\Windows\System\NAWHVZr.exe
  C:\Windows\System\NAWHVZr.exe
  2⤵
  PID:11588
- C:\Windows\System\DrdrjTm.exe
  C:\Windows\System\DrdrjTm.exe
  2⤵
  PID:11612
- C:\Windows\System\fIOLFUS.exe
  C:\Windows\System\fIOLFUS.exe
  2⤵
  PID:11636
- C:\Windows\System\oILRwPx.exe
  C:\Windows\System\oILRwPx.exe
  2⤵
  PID:11664
- C:\Windows\System\zAtZeQz.exe
  C:\Windows\System\zAtZeQz.exe
  2⤵
  PID:11688
- C:\Windows\System\hdptsRJ.exe
  C:\Windows\System\hdptsRJ.exe
  2⤵
  PID:11728
- C:\Windows\System\jQbTYkG.exe
  C:\Windows\System\jQbTYkG.exe
  2⤵
  PID:11764
- C:\Windows\System\BGOgDVY.exe
  C:\Windows\System\BGOgDVY.exe
  2⤵
  PID:11800
- C:\Windows\System\zRsvjkl.exe
  C:\Windows\System\zRsvjkl.exe
  2⤵
  PID:11832
- C:\Windows\System\eBnDUcK.exe
  C:\Windows\System\eBnDUcK.exe
  2⤵
  PID:11888
- C:\Windows\System\qxoIEgM.exe
  C:\Windows\System\qxoIEgM.exe
  2⤵
  PID:11924
- C:\Windows\System\tgpHSoN.exe
  C:\Windows\System\tgpHSoN.exe
  2⤵
  PID:11952
- C:\Windows\System\oXcLFmQ.exe
  C:\Windows\System\oXcLFmQ.exe
  2⤵
  PID:11988
- C:\Windows\System\ZetwaKo.exe
  C:\Windows\System\ZetwaKo.exe
  2⤵
  PID:12016
- C:\Windows\System\hxPVhDG.exe
  C:\Windows\System\hxPVhDG.exe
  2⤵
  PID:12044
- C:\Windows\System\JhDgzvR.exe
  C:\Windows\System\JhDgzvR.exe
  2⤵
  PID:12064
- C:\Windows\System\VfhygwP.exe
  C:\Windows\System\VfhygwP.exe
  2⤵
  PID:12100
- C:\Windows\System\rHcaDtg.exe
  C:\Windows\System\rHcaDtg.exe
  2⤵
  PID:12140
- C:\Windows\System\rRPvCpg.exe
  C:\Windows\System\rRPvCpg.exe
  2⤵
  PID:12168
- C:\Windows\System\ukwEHMN.exe
  C:\Windows\System\ukwEHMN.exe
  2⤵
  PID:12204
- C:\Windows\System\IWuQMPS.exe
  C:\Windows\System\IWuQMPS.exe
  2⤵
  PID:12228
- C:\Windows\System\zajfZFp.exe
  C:\Windows\System\zajfZFp.exe
  2⤵
  PID:12248
- C:\Windows\System\YCYTMLn.exe
  C:\Windows\System\YCYTMLn.exe
  2⤵
  PID:12268
- C:\Windows\System\uCnKTPl.exe
  C:\Windows\System\uCnKTPl.exe
  2⤵
  PID:12284
- C:\Windows\System\ZHzegpb.exe
  C:\Windows\System\ZHzegpb.exe
  2⤵
  PID:9860
- C:\Windows\System\qBazpzt.exe
  C:\Windows\System\qBazpzt.exe
  2⤵
  PID:9852
- C:\Windows\System\dWSglId.exe
  C:\Windows\System\dWSglId.exe
  2⤵
  PID:10416
- C:\Windows\System\CfcUmtT.exe
  C:\Windows\System\CfcUmtT.exe
  2⤵
  PID:10064
- C:\Windows\System\ccpBUZv.exe
  C:\Windows\System\ccpBUZv.exe
  2⤵
  PID:10476
- C:\Windows\System\WtMaPUU.exe
  C:\Windows\System\WtMaPUU.exe
  2⤵
  PID:10516
- C:\Windows\System\dpgVisv.exe
  C:\Windows\System\dpgVisv.exe
  2⤵
  PID:10552
- C:\Windows\System\YrZNgOZ.exe
  C:\Windows\System\YrZNgOZ.exe
  2⤵
  PID:10588
- C:\Windows\System\eCZbKwO.exe
  C:\Windows\System\eCZbKwO.exe
  2⤵
  PID:10668
- C:\Windows\System\mFfXSYo.exe
  C:\Windows\System\mFfXSYo.exe
  2⤵
  PID:10708
- C:\Windows\System\vmafZNE.exe
  C:\Windows\System\vmafZNE.exe
  2⤵
  PID:10748
- C:\Windows\System\leaAwYF.exe
  C:\Windows\System\leaAwYF.exe
  2⤵
  PID:10808
- C:\Windows\System\vcmkBcF.exe
  C:\Windows\System\vcmkBcF.exe
  2⤵
  PID:10868
- C:\Windows\System\zdcsjVP.exe
  C:\Windows\System\zdcsjVP.exe
  2⤵
  PID:10988
- C:\Windows\System\tkYxKwR.exe
  C:\Windows\System\tkYxKwR.exe
  2⤵
  PID:11100
- C:\Windows\System\kgDfApi.exe
  C:\Windows\System\kgDfApi.exe
  2⤵
  PID:9796
- C:\Windows\System\IaFQGAU.exe
  C:\Windows\System\IaFQGAU.exe
  2⤵
  PID:11224
- C:\Windows\System\GGlOjgB.exe
  C:\Windows\System\GGlOjgB.exe
  2⤵
  PID:3512
- C:\Windows\System\xyLPffL.exe
  C:\Windows\System\xyLPffL.exe
  2⤵
  PID:9704
- C:\Windows\System\dIczCBa.exe
  C:\Windows\System\dIczCBa.exe
  2⤵
  PID:11292
- C:\Windows\System\VVRDYNi.exe
  C:\Windows\System\VVRDYNi.exe
  2⤵
  PID:11372
- C:\Windows\System\ApofoQE.exe
  C:\Windows\System\ApofoQE.exe
  2⤵
  PID:9880
- C:\Windows\System\BtlSwEG.exe
  C:\Windows\System\BtlSwEG.exe
  2⤵
  PID:10112
- C:\Windows\System\PfnYioH.exe
  C:\Windows\System\PfnYioH.exe
  2⤵
  PID:11556
- C:\Windows\System\LWNhkdl.exe
  C:\Windows\System\LWNhkdl.exe
  2⤵
  PID:11660
- C:\Windows\System\gHhIREA.exe
  C:\Windows\System\gHhIREA.exe
  2⤵
  PID:11720
- C:\Windows\System\VvqdEft.exe
  C:\Windows\System\VvqdEft.exe
  2⤵
  PID:11812
- C:\Windows\System\NlXEhbU.exe
  C:\Windows\System\NlXEhbU.exe
  2⤵
  PID:11844
- C:\Windows\System\GuxUroO.exe
  C:\Windows\System\GuxUroO.exe
  2⤵
  PID:9376
- C:\Windows\System\gXIrFDg.exe
  C:\Windows\System\gXIrFDg.exe
  2⤵
  PID:9456
- C:\Windows\System\SDqCVNv.exe
  C:\Windows\System\SDqCVNv.exe
  2⤵
  PID:9544
- C:\Windows\System\fFdOSYA.exe
  C:\Windows\System\fFdOSYA.exe
  2⤵
  PID:12004
- C:\Windows\System\BdmNTSo.exe
  C:\Windows\System\BdmNTSo.exe
  2⤵
  PID:10784
- C:\Windows\System\NUotUYR.exe
  C:\Windows\System\NUotUYR.exe
  2⤵
  PID:12312
- C:\Windows\System\OmxPwhS.exe
  C:\Windows\System\OmxPwhS.exe
  2⤵
  PID:12344
- C:\Windows\System\DTKiwif.exe
  C:\Windows\System\DTKiwif.exe
  2⤵
  PID:12364
- C:\Windows\System\IMZzzTz.exe
  C:\Windows\System\IMZzzTz.exe
  2⤵
  PID:12384
- C:\Windows\System\cZrAkXT.exe
  C:\Windows\System\cZrAkXT.exe
  2⤵
  PID:12404
- C:\Windows\System\tWqDjLW.exe
  C:\Windows\System\tWqDjLW.exe
  2⤵
  PID:12424
- C:\Windows\System\hNoWLbh.exe
  C:\Windows\System\hNoWLbh.exe
  2⤵
  PID:12440
- C:\Windows\System\NxgcREE.exe
  C:\Windows\System\NxgcREE.exe
  2⤵
  PID:12456
- C:\Windows\System\hoDTEKK.exe
  C:\Windows\System\hoDTEKK.exe
  2⤵
  PID:12472
- C:\Windows\System\YWlkbYV.exe
  C:\Windows\System\YWlkbYV.exe
  2⤵
  PID:12492
- C:\Windows\System\UxknNNv.exe
  C:\Windows\System\UxknNNv.exe
  2⤵
  PID:12524
- C:\Windows\System\aIKLPZq.exe
  C:\Windows\System\aIKLPZq.exe
  2⤵
  PID:12540
- C:\Windows\System\tgXEtNs.exe
  C:\Windows\System\tgXEtNs.exe
  2⤵
  PID:12564
- C:\Windows\System\SaTMmFF.exe
  C:\Windows\System\SaTMmFF.exe
  2⤵
  PID:12580
- C:\Windows\System\UrlnJeV.exe
  C:\Windows\System\UrlnJeV.exe
  2⤵
  PID:12600
- C:\Windows\System\fjJpFFV.exe
  C:\Windows\System\fjJpFFV.exe
  2⤵
  PID:12620
- C:\Windows\System\AWLJzUw.exe
  C:\Windows\System\AWLJzUw.exe
  2⤵
  PID:12640
- C:\Windows\System\CqebKwB.exe
  C:\Windows\System\CqebKwB.exe
  2⤵
  PID:12656
- C:\Windows\System\KwYrGpk.exe
  C:\Windows\System\KwYrGpk.exe
  2⤵
  PID:12892
- C:\Windows\System\ULMtCJf.exe
  C:\Windows\System\ULMtCJf.exe
  2⤵
  PID:12912
- C:\Windows\System\VApRSgF.exe
  C:\Windows\System\VApRSgF.exe
  2⤵
  PID:12940
- C:\Windows\System\ignBfjd.exe
  C:\Windows\System\ignBfjd.exe
  2⤵
  PID:12988
- C:\Windows\System\DaomBwt.exe
  C:\Windows\System\DaomBwt.exe
  2⤵
  PID:13064
- C:\Windows\System\Kryigcs.exe
  C:\Windows\System\Kryigcs.exe
  2⤵
  PID:13128
- C:\Windows\System\ynEfRNH.exe
  C:\Windows\System\ynEfRNH.exe
  2⤵
  PID:13188
- C:\Windows\System\VFYRNzK.exe
  C:\Windows\System\VFYRNzK.exe
  2⤵
  PID:13224
- C:\Windows\System\YQaqmVj.exe
  C:\Windows\System\YQaqmVj.exe
  2⤵
  PID:13252
- C:\Windows\System\jkXxTUG.exe
  C:\Windows\System\jkXxTUG.exe
  2⤵
  PID:13276
- C:\Windows\System\JmDDZxO.exe
  C:\Windows\System\JmDDZxO.exe
  2⤵
  PID:10624
- C:\Windows\System\aCaPheV.exe
  C:\Windows\System\aCaPheV.exe
  2⤵
  PID:7216
- C:\Windows\System\gfBQpMG.exe
  C:\Windows\System\gfBQpMG.exe
  2⤵
  PID:11676
- C:\Windows\System\RJntkth.exe
  C:\Windows\System\RJntkth.exe
  2⤵
  PID:11784
- C:\Windows\System\yMPFlgg.exe
  C:\Windows\System\yMPFlgg.exe
  2⤵
  PID:12008
- C:\Windows\System\tRFovQV.exe
  C:\Windows\System\tRFovQV.exe
  2⤵
  PID:11900
- C:\Windows\System\DFVSBRW.exe
  C:\Windows\System\DFVSBRW.exe
  2⤵
  PID:12360
- C:\Windows\System\YTqJdwZ.exe
  C:\Windows\System\YTqJdwZ.exe
  2⤵
  PID:12452
- C:\Windows\System\ujqasKZ.exe
  C:\Windows\System\ujqasKZ.exe
  2⤵
  PID:12856
- C:\Windows\System\zFtaAKo.exe
  C:\Windows\System\zFtaAKo.exe
  2⤵
  PID:12824
- C:\Windows\System\qLymwsk.exe
  C:\Windows\System\qLymwsk.exe
  2⤵
  PID:10864
- C:\Windows\System\OMzXfwt.exe
  C:\Windows\System\OMzXfwt.exe
  2⤵
  PID:13236
- C:\Windows\System\GHpIsOt.exe
  C:\Windows\System\GHpIsOt.exe
  2⤵
  PID:13112
- C:\Windows\System\LMAuPBg.exe
  C:\Windows\System\LMAuPBg.exe
  2⤵
  PID:10344
- C:\Windows\System\YuzILgz.exe
  C:\Windows\System\YuzILgz.exe
  2⤵
  PID:12088
- C:\Windows\System\RKdized.exe
  C:\Windows\System\RKdized.exe
  2⤵
  PID:12024
- C:\Windows\System\TZEjFvQ.exe
  C:\Windows\System\TZEjFvQ.exe
  2⤵
  PID:12240
- C:\Windows\System\pRStccX.exe
  C:\Windows\System\pRStccX.exe
  2⤵
  PID:12244
- C:\Windows\System\mrlMexX.exe
  C:\Windows\System\mrlMexX.exe
  2⤵
  PID:8844
- C:\Windows\System\gpPLORi.exe
  C:\Windows\System\gpPLORi.exe
  2⤵
  PID:10448
- C:\Windows\System\UWlnedA.exe
  C:\Windows\System\UWlnedA.exe
  2⤵
  PID:11996
- C:\Windows\System\TCQsGXD.exe
  C:\Windows\System\TCQsGXD.exe
  2⤵
  PID:12156
- C:\Windows\System\cvpXeam.exe
  C:\Windows\System\cvpXeam.exe
  2⤵
  PID:12192
- C:\Windows\System\vSktXlb.exe
  C:\Windows\System\vSktXlb.exe
  2⤵
  PID:12868
- C:\Windows\System\TqmEgYN.exe
  C:\Windows\System\TqmEgYN.exe
  2⤵
  PID:11296
- C:\Windows\System\pCaBNXJ.exe
  C:\Windows\System\pCaBNXJ.exe
  2⤵
  PID:11428
- C:\Windows\System\DcXUNYX.exe
  C:\Windows\System\DcXUNYX.exe
  2⤵
  PID:11512
- C:\Windows\System\YqhaHJm.exe
  C:\Windows\System\YqhaHJm.exe
  2⤵
  PID:12136
- C:\Windows\System\UTcifrb.exe
  C:\Windows\System\UTcifrb.exe
  2⤵
  PID:12212
- C:\Windows\System\TZdPRhi.exe
  C:\Windows\System\TZdPRhi.exe
  2⤵
  PID:1444
- C:\Windows\System\QuiclJz.exe
  C:\Windows\System\QuiclJz.exe
  2⤵
  PID:12796
- C:\Windows\System\IGRLhRe.exe
  C:\Windows\System\IGRLhRe.exe
  2⤵
  PID:12596
- C:\Windows\System\GZJISCU.exe
  C:\Windows\System\GZJISCU.exe
  2⤵
  PID:10664
- C:\Windows\System\VNffUwr.exe
  C:\Windows\System\VNffUwr.exe
  2⤵
  PID:12516
- C:\Windows\System\mHOgQKe.exe
  C:\Windows\System\mHOgQKe.exe
  2⤵
  PID:12636
- C:\Windows\System\GmWfOSE.exe
  C:\Windows\System\GmWfOSE.exe
  2⤵
  PID:12744
- C:\Windows\System\AvySjsB.exe
  C:\Windows\System\AvySjsB.exe
  2⤵
  PID:12860
- C:\Windows\System\PGSfrrt.exe
  C:\Windows\System\PGSfrrt.exe
  2⤵
  PID:12556
- C:\Windows\System\jXzKBxM.exe
  C:\Windows\System\jXzKBxM.exe
  2⤵
  PID:13300
- C:\Windows\System\AGatlTf.exe
  C:\Windows\System\AGatlTf.exe
  2⤵
  PID:12676
- C:\Windows\System\KuVAnnS.exe
  C:\Windows\System\KuVAnnS.exe
  2⤵
  PID:7704
- C:\Windows\System\kVqVrlN.exe
  C:\Windows\System\kVqVrlN.exe
  2⤵
  PID:12708
- C:\Windows\System\GqKpHYn.exe
  C:\Windows\System\GqKpHYn.exe
  2⤵
  PID:13108
- C:\Windows\System\rLnqDLE.exe
  C:\Windows\System\rLnqDLE.exe
  2⤵
  PID:9804
- C:\Windows\System\spVWzHp.exe
  C:\Windows\System\spVWzHp.exe
  2⤵
  PID:12740
- C:\Windows\System\JiFANjf.exe
  C:\Windows\System\JiFANjf.exe
  2⤵
  PID:12832
- C:\Windows\System\aYHBOqR.exe
  C:\Windows\System\aYHBOqR.exe
  2⤵
  PID:12924
- C:\Windows\System\YKsimuL.exe
  C:\Windows\System\YKsimuL.exe
  2⤵
  PID:11316
- C:\Windows\System\IxkikWj.exe
  C:\Windows\System\IxkikWj.exe
  2⤵
  PID:11600
- C:\Windows\System\ViJJQis.exe
  C:\Windows\System\ViJJQis.exe
  2⤵
  PID:13060
- C:\Windows\System\ObiPBmP.exe
  C:\Windows\System\ObiPBmP.exe
  2⤵
  PID:6120
- C:\Windows\System\kNBnYtw.exe
  C:\Windows\System\kNBnYtw.exe
  2⤵
  PID:11624
- C:\Windows\System\WEaHuAT.exe
  C:\Windows\System\WEaHuAT.exe
  2⤵
  PID:11632
- C:\Windows\System\sxUOuYy.exe
  C:\Windows\System\sxUOuYy.exe
  2⤵
  PID:12512
- C:\Windows\System\pbcZCqa.exe
  C:\Windows\System\pbcZCqa.exe
  2⤵
  PID:11980
- C:\Windows\System\MNDIKSn.exe
  C:\Windows\System\MNDIKSn.exe
  2⤵
  PID:2204
- C:\Windows\System\UNfNSQY.exe
  C:\Windows\System\UNfNSQY.exe
  2⤵
  PID:12696
- C:\Windows\System\WzhsjBL.exe
  C:\Windows\System\WzhsjBL.exe
  2⤵
  PID:12176
- C:\Windows\System\dBaFqYn.exe
  C:\Windows\System\dBaFqYn.exe
  2⤵
  PID:12296
- C:\Windows\System\xExcZsG.exe
  C:\Windows\System\xExcZsG.exe
  2⤵
  PID:9008
- C:\Windows\System\VhosMJD.exe
  C:\Windows\System\VhosMJD.exe
  2⤵
  PID:8016
- C:\Windows\System\pgQUmGL.exe
  C:\Windows\System\pgQUmGL.exe
  2⤵
  PID:12968
- C:\Windows\System\yXIKeis.exe
  C:\Windows\System\yXIKeis.exe
  2⤵
  PID:4108
- C:\Windows\System\cCRtBpL.exe
  C:\Windows\System\cCRtBpL.exe
  2⤵
  PID:12836
- C:\Windows\System\fsPAqpe.exe
  C:\Windows\System\fsPAqpe.exe
  2⤵
  PID:13048
- C:\Windows\System\Faafdaz.exe
  C:\Windows\System\Faafdaz.exe
  2⤵
  PID:12648
- C:\Windows\System\jPTxXtK.exe
  C:\Windows\System\jPTxXtK.exe
  2⤵
  PID:8152
- C:\Windows\System\dVLqFOp.exe
  C:\Windows\System\dVLqFOp.exe
  2⤵
  PID:13172
- C:\Windows\System\MJxolMn.exe
  C:\Windows\System\MJxolMn.exe
  2⤵
  PID:12396
- C:\Windows\System\RJuxCtC.exe
  C:\Windows\System\RJuxCtC.exe
  2⤵
  PID:3116
- C:\Windows\System\qUfLvcS.exe
  C:\Windows\System\qUfLvcS.exe
  2⤵
  PID:12320
- C:\Windows\System\JNNdarL.exe
  C:\Windows\System\JNNdarL.exe
  2⤵
  PID:12612
- C:\Windows\System\jTnnVdk.exe
  C:\Windows\System\jTnnVdk.exe
  2⤵
  PID:13332
- C:\Windows\System\tvKkmbf.exe
  C:\Windows\System\tvKkmbf.exe
  2⤵
  PID:13352
- C:\Windows\System\aZTkijs.exe
  C:\Windows\System\aZTkijs.exe
  2⤵
  PID:13372
- C:\Windows\System\WcKjVfH.exe
  C:\Windows\System\WcKjVfH.exe
  2⤵
  PID:13508
- C:\Windows\System\Ogayvef.exe
  C:\Windows\System\Ogayvef.exe
  2⤵
  PID:13716
- C:\Windows\System\HUPICqv.exe
  C:\Windows\System\HUPICqv.exe
  2⤵
  PID:13840
- C:\Windows\System\xTYOksX.exe
  C:\Windows\System\xTYOksX.exe
  2⤵
  PID:13876
- C:\Windows\System\LDMbfBu.exe
  C:\Windows\System\LDMbfBu.exe
  2⤵
  PID:13948
- C:\Windows\System\WiKCzIH.exe
  C:\Windows\System\WiKCzIH.exe
  2⤵
  PID:14000
- C:\Windows\System\snolCti.exe
  C:\Windows\System\snolCti.exe
  2⤵
  PID:14128
- C:\Windows\System\cEUiXgT.exe
  C:\Windows\System\cEUiXgT.exe
  2⤵
  PID:14200
- C:\Windows\System\SuxZGRj.exe
  C:\Windows\System\SuxZGRj.exe
  2⤵
  PID:14256
- C:\Windows\System\csXjrpb.exe
  C:\Windows\System\csXjrpb.exe
  2⤵
  PID:14308
- C:\Windows\System\pULyHbq.exe
  C:\Windows\System\pULyHbq.exe
  2⤵
  PID:14324
- C:\Windows\System\kKUqckz.exe
  C:\Windows\System\kKUqckz.exe
  2⤵
  PID:12808
- C:\Windows\System\oAemdZe.exe
  C:\Windows\System\oAemdZe.exe
  2⤵
  PID:7956
- C:\Windows\System\FJPDvgp.exe
  C:\Windows\System\FJPDvgp.exe
  2⤵
  PID:13364
- C:\Windows\System\zDauxAD.exe
  C:\Windows\System\zDauxAD.exe
  2⤵
  PID:1592
- C:\Windows\System\DIKYfZb.exe
  C:\Windows\System\DIKYfZb.exe
  2⤵
  PID:10496
- C:\Windows\System\XLKzVvQ.exe
  C:\Windows\System\XLKzVvQ.exe
  2⤵
  PID:13460
- C:\Windows\System\kwpebur.exe
  C:\Windows\System\kwpebur.exe
  2⤵
  PID:13520
- C:\Windows\System\QuAHRPp.exe
  C:\Windows\System\QuAHRPp.exe
  2⤵
  PID:13588
- C:\Windows\System\DlChycr.exe
  C:\Windows\System\DlChycr.exe
  2⤵
  PID:2160
- C:\Windows\System\aVjjmGf.exe
  C:\Windows\System\aVjjmGf.exe
  2⤵
  PID:13464
- C:\Windows\System\SZAcqxM.exe
  C:\Windows\System\SZAcqxM.exe
  2⤵
  PID:13748
- C:\Windows\System\qISUZwj.exe
  C:\Windows\System\qISUZwj.exe
  2⤵
  PID:13624
- C:\Windows\System\XjWSMJs.exe
  C:\Windows\System\XjWSMJs.exe
  2⤵
  PID:13784
- C:\Windows\System\jYMQKaf.exe
  C:\Windows\System\jYMQKaf.exe
  2⤵
  PID:13864
- C:\Windows\System\iIhxPoT.exe
  C:\Windows\System\iIhxPoT.exe
  2⤵
  PID:13892
- C:\Windows\System\vXdEdCi.exe
  C:\Windows\System\vXdEdCi.exe
  2⤵
  PID:13976
- C:\Windows\System\pnSxtqU.exe
  C:\Windows\System\pnSxtqU.exe
  2⤵
  PID:14052
- C:\Windows\System\TCjnPlX.exe
  C:\Windows\System\TCjnPlX.exe
  2⤵
  PID:4064
- C:\Windows\System\zFBszSI.exe
  C:\Windows\System\zFBszSI.exe
  2⤵
  PID:14088
- C:\Windows\System\UDnfzGe.exe
  C:\Windows\System\UDnfzGe.exe
  2⤵
  PID:14160
- C:\Windows\System\XPsWceR.exe
  C:\Windows\System\XPsWceR.exe
  2⤵
  PID:14192
- C:\Windows\System\XkWKFpU.exe
  C:\Windows\System\XkWKFpU.exe
  2⤵
  PID:14244
- C:\Windows\System\MPUeBOl.exe
  C:\Windows\System\MPUeBOl.exe
  2⤵
  PID:14292
- C:\Windows\System\tgVDyLF.exe
  C:\Windows\System\tgVDyLF.exe
  2⤵
  PID:3740
- C:\Windows\System\jExSADl.exe
  C:\Windows\System\jExSADl.exe
  2⤵
  PID:10772
- C:\Windows\System\HamPHFA.exe
  C:\Windows\System\HamPHFA.exe
  2⤵
  PID:12980
- C:\Windows\System\AsoHAhR.exe
  C:\Windows\System\AsoHAhR.exe
  2⤵
  PID:11628
- C:\Windows\System\ApcXCtq.exe
  C:\Windows\System\ApcXCtq.exe
  2⤵
  PID:4940
- C:\Windows\System\vOBGrOO.exe
  C:\Windows\System\vOBGrOO.exe
  2⤵
  PID:13584
- C:\Windows\System\sLfCyhK.exe
  C:\Windows\System\sLfCyhK.exe
  2⤵
  PID:13644
- C:\Windows\System\UzGAUiZ.exe
  C:\Windows\System\UzGAUiZ.exe
  2⤵
  PID:13084
- C:\Windows\System\fcwScSX.exe
  C:\Windows\System\fcwScSX.exe
  2⤵
  PID:208
- C:\Windows\System\XkTVGOc.exe
  C:\Windows\System\XkTVGOc.exe
  2⤵
  PID:13704
- C:\Windows\System\zZDjOhu.exe
  C:\Windows\System\zZDjOhu.exe
  2⤵
  PID:13600
- C:\Windows\System\clDXuCf.exe
  C:\Windows\System\clDXuCf.exe
  2⤵
  PID:3220
- C:\Windows\System\keVIimo.exe
  C:\Windows\System\keVIimo.exe
  2⤵
  PID:1160
- C:\Windows\System\YBNYadw.exe
  C:\Windows\System\YBNYadw.exe
  2⤵
  PID:13804
- C:\Windows\System\ZlEjzyQ.exe
  C:\Windows\System\ZlEjzyQ.exe
  2⤵
  PID:740
- C:\Windows\System\dsMKVCq.exe
  C:\Windows\System\dsMKVCq.exe
  2⤵
  PID:13912
- C:\Windows\System\aEOcmuP.exe
  C:\Windows\System\aEOcmuP.exe
  2⤵
  PID:3712
- C:\Windows\System\fNqletL.exe
  C:\Windows\System\fNqletL.exe
  2⤵
  PID:13996
- C:\Windows\System\XLJjpKu.exe
  C:\Windows\System\XLJjpKu.exe
  2⤵
  PID:1828
- C:\Windows\System\MxvSOHD.exe
  C:\Windows\System\MxvSOHD.exe
  2⤵
  PID:4552
- C:\Windows\System\yVbCLZl.exe
  C:\Windows\System\yVbCLZl.exe
  2⤵
  PID:3020
- C:\Windows\System\fqIqyxR.exe
  C:\Windows\System\fqIqyxR.exe
  2⤵
  PID:14180
- C:\Windows\System\KMsdykL.exe
  C:\Windows\System\KMsdykL.exe
  2⤵
  PID:1376
- C:\Windows\System\fZXrAtG.exe
  C:\Windows\System\fZXrAtG.exe
  2⤵
  PID:3812
- C:\Windows\System\yXdSCii.exe
  C:\Windows\System\yXdSCii.exe
  2⤵
  PID:2632
- C:\Windows\System\INXzBPW.exe
  C:\Windows\System\INXzBPW.exe
  2⤵
  PID:2328
- C:\Windows\System\nltsluo.exe
  C:\Windows\System\nltsluo.exe
  2⤵
  PID:11940
- C:\Windows\System\KSrMKPB.exe
  C:\Windows\System\KSrMKPB.exe
  2⤵
  PID:13440
- C:\Windows\System\uLrxOSM.exe
  C:\Windows\System\uLrxOSM.exe
  2⤵
  PID:5760
- C:\Windows\System\YTwZPff.exe
  C:\Windows\System\YTwZPff.exe
  2⤵
  PID:5372
- C:\Windows\System\LtlsGEu.exe
  C:\Windows\System\LtlsGEu.exe
  2⤵
  PID:5524
- C:\Windows\System\aOCtMEs.exe
  C:\Windows\System\aOCtMEs.exe
  2⤵
  PID:2280
- C:\Windows\System\ftjIZmm.exe
  C:\Windows\System\ftjIZmm.exe
  2⤵
  PID:5708
- C:\Windows\System\HVFcyeC.exe
  C:\Windows\System\HVFcyeC.exe
  2⤵
  PID:5808
- C:\Windows\System\kIQOkiw.exe
  C:\Windows\System\kIQOkiw.exe
  2⤵
  PID:5984
- C:\Windows\System\GuYccIH.exe
  C:\Windows\System\GuYccIH.exe
  2⤵
  PID:13620
- C:\Windows\System\hrRtHxu.exe
  C:\Windows\System\hrRtHxu.exe
  2⤵
  PID:13792
- C:\Windows\System\nqNWpyD.exe
  C:\Windows\System\nqNWpyD.exe
  2⤵
  PID:4868
- C:\Windows\System\qpwSJxG.exe
  C:\Windows\System\qpwSJxG.exe
  2⤵
  PID:4212
- C:\Windows\System\MeTJKgF.exe
  C:\Windows\System\MeTJKgF.exe
  2⤵
  PID:1796
- C:\Windows\System\fYXjeyY.exe
  C:\Windows\System\fYXjeyY.exe
  2⤵
  PID:13968
- C:\Windows\System\ilgePsY.exe
  C:\Windows\System\ilgePsY.exe
  2⤵
  PID:1952
- C:\Windows\System\DmfRUPH.exe
  C:\Windows\System\DmfRUPH.exe
  2⤵
  PID:13896
- C:\Windows\System\TzWTowH.exe
  C:\Windows\System\TzWTowH.exe
  2⤵
  PID:2440
- C:\Windows\System\yQNUUWc.exe
  C:\Windows\System\yQNUUWc.exe
  2⤵
  PID:14064
- C:\Windows\System\OCZskTw.exe
  C:\Windows\System\OCZskTw.exe
  2⤵
  PID:6376
- C:\Windows\System\tZrswPX.exe
  C:\Windows\System\tZrswPX.exe
  2⤵
  PID:3532
- C:\Windows\System\TLqLpYw.exe
  C:\Windows\System\TLqLpYw.exe
  2⤵
  PID:3420
- C:\Windows\System\TNHowIi.exe
  C:\Windows\System\TNHowIi.exe
  2⤵
  PID:5160
- C:\Windows\System\kbDVNQD.exe
  C:\Windows\System\kbDVNQD.exe
  2⤵
  PID:5436
- C:\Windows\System\JBaVoea.exe
  C:\Windows\System\JBaVoea.exe
  2⤵
  PID:5212
- C:\Windows\System\IlXBFsw.exe
  C:\Windows\System\IlXBFsw.exe
  2⤵
  PID:5592
- C:\Windows\System\uBXcEke.exe
  C:\Windows\System\uBXcEke.exe
  2⤵
  PID:14216
- C:\Windows\System\EoKbddP.exe
  C:\Windows\System\EoKbddP.exe
  2⤵
  PID:5728
- C:\Windows\System\DhkkrmI.exe
  C:\Windows\System\DhkkrmI.exe
  2⤵
  PID:14144
- C:\Windows\System\lJemoLm.exe
  C:\Windows\System\lJemoLm.exe
  2⤵
  PID:14220
- C:\Windows\System\ZPeupxs.exe
  C:\Windows\System\ZPeupxs.exe
  2⤵
  PID:1880
- C:\Windows\System\MRmaLMd.exe
  C:\Windows\System\MRmaLMd.exe
  2⤵
  PID:916
- C:\Windows\System\FYVgGSH.exe
  C:\Windows\System\FYVgGSH.exe
  2⤵
  PID:6352
- C:\Windows\System\EMizXUU.exe
  C:\Windows\System\EMizXUU.exe
  2⤵
  PID:6384
- C:\Windows\System\rWsLLys.exe
  C:\Windows\System\rWsLLys.exe
  2⤵
  PID:2492
- C:\Windows\System\ZKsyAUu.exe
  C:\Windows\System\ZKsyAUu.exe
  2⤵
  PID:2008
- C:\Windows\System\RNSOZER.exe
  C:\Windows\System\RNSOZER.exe
  2⤵
  PID:6652
- C:\Windows\System\kZIsgqo.exe
  C:\Windows\System\kZIsgqo.exe
  2⤵
  PID:11440
- C:\Windows\System\qNUSVaO.exe
  C:\Windows\System\qNUSVaO.exe
  2⤵
  PID:6312
- C:\Windows\System\ChncbYF.exe
  C:\Windows\System\ChncbYF.exe
  2⤵
  PID:13344
- C:\Windows\System\VERwuDP.exe
  C:\Windows\System\VERwuDP.exe
  2⤵
  PID:5628
- C:\Windows\System\hkIwhya.exe
  C:\Windows\System\hkIwhya.exe
  2⤵
  PID:5764
- C:\Windows\System\vlnmKBv.exe
  C:\Windows\System\vlnmKBv.exe
  2⤵
  PID:13388
- C:\Windows\System\OjWBVRd.exe
  C:\Windows\System\OjWBVRd.exe
  2⤵
  PID:5840
- C:\Windows\System\WygrGaF.exe
  C:\Windows\System\WygrGaF.exe
  2⤵
  PID:13636
- C:\Windows\System\ktgIQMo.exe
  C:\Windows\System\ktgIQMo.exe
  2⤵
  PID:13616
- C:\Windows\System\SPoMdrQ.exe
  C:\Windows\System\SPoMdrQ.exe
  2⤵
  PID:5752
- C:\Windows\System\YyhCMaX.exe
  C:\Windows\System\YyhCMaX.exe
  2⤵
  PID:5776
- C:\Windows\System\olwwkex.exe
  C:\Windows\System\olwwkex.exe
  2⤵
  PID:716
- C:\Windows\System\eUkQgrA.exe
  C:\Windows\System\eUkQgrA.exe
  2⤵
  PID:6056
- C:\Windows\System\PazrzFP.exe
  C:\Windows\System\PazrzFP.exe
  2⤵
  PID:5904
- C:\Windows\System\EpjbSGT.exe
  C:\Windows\System\EpjbSGT.exe
  2⤵
  PID:7668
- C:\Windows\System\uViDevW.exe
  C:\Windows\System\uViDevW.exe
  2⤵
  PID:7724
- C:\Windows\System\AibJZYd.exe
  C:\Windows\System\AibJZYd.exe
  2⤵
  PID:7260
- C:\Windows\System\LTrPZtz.exe
  C:\Windows\System\LTrPZtz.exe
  2⤵
  PID:13788
- C:\Windows\System\uDwKNwT.exe
  C:\Windows\System\uDwKNwT.exe
  2⤵
  PID:4248
- C:\Windows\System\trnFRtY.exe
  C:\Windows\System\trnFRtY.exe
  2⤵
  PID:3448
- C:\Windows\System\AILsoKo.exe
  C:\Windows\System\AILsoKo.exe
  2⤵
  PID:14024
- C:\Windows\System\BptvzkS.exe
  C:\Windows\System\BptvzkS.exe
  2⤵
  PID:5756
- C:\Windows\System\JJkIAbU.exe
  C:\Windows\System\JJkIAbU.exe
  2⤵
  PID:7700
- C:\Windows\System\IXQoqEm.exe
  C:\Windows\System\IXQoqEm.exe
  2⤵
  PID:7908
- C:\Windows\System\VCnEDZj.exe
  C:\Windows\System\VCnEDZj.exe
  2⤵
  PID:6576
- C:\Windows\System\XPjgOlO.exe
  C:\Windows\System\XPjgOlO.exe
  2⤵
  PID:6380
- C:\Windows\System\STlcsaK.exe
  C:\Windows\System\STlcsaK.exe
  2⤵
  PID:4444
- C:\Windows\System\BdqLlpM.exe
  C:\Windows\System\BdqLlpM.exe
  2⤵
  PID:4916
- C:\Windows\System\nTKKgkF.exe
  C:\Windows\System\nTKKgkF.exe
  2⤵
  PID:6392
- C:\Windows\System\BHnFXjm.exe
  C:\Windows\System\BHnFXjm.exe
  2⤵
  PID:5552
- C:\Windows\System\kWJaMeZ.exe
  C:\Windows\System\kWJaMeZ.exe
  2⤵
  PID:2884
- C:\Windows\System\pmMUPZJ.exe
  C:\Windows\System\pmMUPZJ.exe
  2⤵
  PID:6660
- C:\Windows\System\rPCZqkB.exe
  C:\Windows\System\rPCZqkB.exe
  2⤵
  PID:5380
- C:\Windows\System\BclZaPD.exe
  C:\Windows\System\BclZaPD.exe
  2⤵
  PID:14116
- C:\Windows\System\bhPuTnX.exe
  C:\Windows\System\bhPuTnX.exe
  2⤵
  PID:12520
- C:\Windows\System\JNYXvhZ.exe
  C:\Windows\System\JNYXvhZ.exe
  2⤵
  PID:7588
- C:\Windows\System\xNVxsfr.exe
  C:\Windows\System\xNVxsfr.exe
  2⤵
  PID:13468
- C:\Windows\System\qhAzWcx.exe
  C:\Windows\System\qhAzWcx.exe
  2⤵
  PID:13772
- C:\Windows\System\bkgHVDe.exe
  C:\Windows\System\bkgHVDe.exe
  2⤵
  PID:7396
- C:\Windows\System\hfWpzhL.exe
  C:\Windows\System\hfWpzhL.exe
  2⤵
  PID:8052
- C:\Windows\System\AYHNWgD.exe
  C:\Windows\System\AYHNWgD.exe
  2⤵
  PID:2308
- C:\Windows\System\AfNWPvQ.exe
  C:\Windows\System\AfNWPvQ.exe
  2⤵
  PID:7688
- C:\Windows\System\OflVlei.exe
  C:\Windows\System\OflVlei.exe
  2⤵
  PID:7532
- C:\Windows\System\NTQEwWj.exe
  C:\Windows\System\NTQEwWj.exe
  2⤵
  PID:4508
- C:\Windows\System\poiPtLw.exe
  C:\Windows\System\poiPtLw.exe
  2⤵
  PID:1312
- C:\Windows\System\BYEkaTW.exe
  C:\Windows\System\BYEkaTW.exe
  2⤵
  PID:3648
- C:\Windows\System\tOozztR.exe
  C:\Windows\System\tOozztR.exe
  2⤵
  PID:7204
- C:\Windows\System\PRculuR.exe
  C:\Windows\System\PRculuR.exe
  2⤵
  PID:6556
- C:\Windows\System\QgZtfOY.exe
  C:\Windows\System\QgZtfOY.exe
  2⤵
  PID:6012
- C:\Windows\System\AZQSUZf.exe
  C:\Windows\System\AZQSUZf.exe
  2⤵
  PID:936
- C:\Windows\System\EEEqXjE.exe
  C:\Windows\System\EEEqXjE.exe
  2⤵
  PID:8768
- C:\Windows\System\LRNCYSL.exe
  C:\Windows\System\LRNCYSL.exe
  2⤵
  PID:4908
- C:\Windows\System\kTgvXIE.exe
  C:\Windows\System\kTgvXIE.exe
  2⤵
  PID:7092
- C:\Windows\System\PkBpTyJ.exe
  C:\Windows\System\PkBpTyJ.exe
  2⤵
  PID:8272
- C:\Windows\System\HAVLknt.exe
  C:\Windows\System\HAVLknt.exe
  2⤵
  PID:4424
- C:\Windows\System\yvJHORo.exe
  C:\Windows\System\yvJHORo.exe
  2⤵
  PID:8000
- C:\Windows\System\PuAUMNX.exe
  C:\Windows\System\PuAUMNX.exe
  2⤵
  PID:8516
- C:\Windows\System\hnxstld.exe
  C:\Windows\System\hnxstld.exe
  2⤵
  PID:8616
- C:\Windows\System\ZgWkvxQ.exe
  C:\Windows\System\ZgWkvxQ.exe
  2⤵
  PID:3304
- C:\Windows\System\oCiOMzM.exe
  C:\Windows\System\oCiOMzM.exe
  2⤵
  PID:7592
- C:\Windows\System\WrRTAAA.exe
  C:\Windows\System\WrRTAAA.exe
  2⤵
  PID:7636
- C:\Windows\System\BKeQxVl.exe
  C:\Windows\System\BKeQxVl.exe
  2⤵
  PID:13756
- C:\Windows\System\IFbjtjn.exe
  C:\Windows\System\IFbjtjn.exe
  2⤵
  PID:9452
- C:\Windows\System\bujTvDX.exe
  C:\Windows\System\bujTvDX.exe
  2⤵
  PID:7520
- C:\Windows\System\nFcjxRG.exe
  C:\Windows\System\nFcjxRG.exe
  2⤵
  PID:7320
- C:\Windows\System\cVdyoWR.exe
  C:\Windows\System\cVdyoWR.exe
  2⤵
  PID:7644
- C:\Windows\System\QAKVjjA.exe
  C:\Windows\System\QAKVjjA.exe
  2⤵
  PID:6252
- C:\Windows\System\VMFpRrK.exe
  C:\Windows\System\VMFpRrK.exe
  2⤵
  PID:6740
- C:\Windows\System\jmXEmJE.exe
  C:\Windows\System\jmXEmJE.exe
  2⤵
  PID:7912
- C:\Windows\System\JqOsLcQ.exe
  C:\Windows\System\JqOsLcQ.exe
  2⤵
  PID:7608
- C:\Windows\System\SGdEjQV.exe
  C:\Windows\System\SGdEjQV.exe
  2⤵
  PID:1344
- C:\Windows\System\jeSePuv.exe
  C:\Windows\System\jeSePuv.exe
  2⤵
  PID:9348
- C:\Windows\System\DPiNNqC.exe
  C:\Windows\System\DPiNNqC.exe
  2⤵
  PID:14084
- C:\Windows\System\qprLeQm.exe
  C:\Windows\System\qprLeQm.exe
  2⤵
  PID:9900
- C:\Windows\System\BIoqHdV.exe
  C:\Windows\System\BIoqHdV.exe
  2⤵
  PID:8808
- C:\Windows\System\OkvhiMV.exe
  C:\Windows\System\OkvhiMV.exe
  2⤵
  PID:14280
- C:\Windows\System\xzoimFx.exe
  C:\Windows\System\xzoimFx.exe
  2⤵
  PID:8868
- C:\Windows\System\nnJgiQg.exe
  C:\Windows\System\nnJgiQg.exe
  2⤵
  PID:8560
- C:\Windows\System\OpXnZxm.exe
  C:\Windows\System\OpXnZxm.exe
  2⤵
  PID:6628
- C:\Windows\System\LlxeDzw.exe
  C:\Windows\System\LlxeDzw.exe
  2⤵
  PID:8564
- C:\Windows\System\zWGrmii.exe
  C:\Windows\System\zWGrmii.exe
  2⤵
  PID:5740
- C:\Windows\System\sxvTDtk.exe
  C:\Windows\System\sxvTDtk.exe
  2⤵
  PID:14060
- C:\Windows\System\YKJpOjm.exe
  C:\Windows\System\YKJpOjm.exe
  2⤵
  PID:6036
- C:\Windows\System\qmQSUiX.exe
  C:\Windows\System\qmQSUiX.exe
  2⤵
  PID:10548
- C:\Windows\System\nplyamS.exe
  C:\Windows\System\nplyamS.exe
  2⤵
  PID:13860
- C:\Windows\System\HacXtqe.exe
  C:\Windows\System\HacXtqe.exe
  2⤵
  PID:10764
- C:\Windows\System\dGdbqrn.exe
  C:\Windows\System\dGdbqrn.exe
  2⤵
  PID:10640
- C:\Windows\System\NsFRXKr.exe
  C:\Windows\System\NsFRXKr.exe
  2⤵
  PID:9084
- C:\Windows\System\LIDIjhk.exe
  C:\Windows\System\LIDIjhk.exe
  2⤵
  PID:9444
- C:\Windows\System\myvumKO.exe
  C:\Windows\System\myvumKO.exe
  2⤵
  PID:8376
- C:\Windows\System\vvBgcJg.exe
  C:\Windows\System\vvBgcJg.exe
  2⤵
  PID:6612
- C:\Windows\System\OoajNVZ.exe
  C:\Windows\System\OoajNVZ.exe
  2⤵
  PID:5180
- C:\Windows\System\SzhDaix.exe
  C:\Windows\System\SzhDaix.exe
  2⤵
  PID:8572
- C:\Windows\System\nTXjFUW.exe
  C:\Windows\System\nTXjFUW.exe
  2⤵
  PID:11260
- C:\Windows\System\CsteIGN.exe
  C:\Windows\System\CsteIGN.exe
  2⤵
  PID:8948
- C:\Windows\System\rVbuapr.exe
  C:\Windows\System\rVbuapr.exe
  2⤵
  PID:5968
- C:\Windows\System\gYPwlCs.exe
  C:\Windows\System\gYPwlCs.exe
  2⤵
  PID:4180
- C:\Windows\System\UlBnqRq.exe
  C:\Windows\System\UlBnqRq.exe
  2⤵
  PID:9596
- C:\Windows\System\HyOeeiA.exe
  C:\Windows\System\HyOeeiA.exe
  2⤵
  PID:6876
- C:\Windows\System\IJSkCxG.exe
  C:\Windows\System\IJSkCxG.exe
  2⤵
  PID:7900
- C:\Windows\System\ablmdiD.exe
  C:\Windows\System\ablmdiD.exe
  2⤵
  PID:10608
- C:\Windows\System\OcsYKnr.exe
  C:\Windows\System\OcsYKnr.exe
  2⤵
  PID:6964
- C:\Windows\System\MVPoQZz.exe
  C:\Windows\System\MVPoQZz.exe
  2⤵
  PID:7904
- C:\Windows\System\UhEPvFq.exe
  C:\Windows\System\UhEPvFq.exe
  2⤵
  PID:8504
- C:\Windows\System\XrIwMXs.exe
  C:\Windows\System\XrIwMXs.exe
  2⤵
  PID:10036
- C:\Windows\System\bppNUFs.exe
  C:\Windows\System\bppNUFs.exe
  2⤵
  PID:7756
- C:\Windows\System\biyWVOr.exe
  C:\Windows\System\biyWVOr.exe
  2⤵
  PID:11864
- C:\Windows\System\wQuzYzP.exe
  C:\Windows\System\wQuzYzP.exe
  2⤵
  PID:11776
- C:\Windows\System\iYFepMK.exe
  C:\Windows\System\iYFepMK.exe
  2⤵
  PID:11880
- C:\Windows\System\geZuCLL.exe
  C:\Windows\System\geZuCLL.exe
  2⤵
  PID:13516
- C:\Windows\System\SlRnfMT.exe
  C:\Windows\System\SlRnfMT.exe
  2⤵
  PID:11884
- C:\Windows\System\bihNfLy.exe
  C:\Windows\System\bihNfLy.exe
  2⤵
  PID:10368
- C:\Windows\System\xeFCXHT.exe
  C:\Windows\System\xeFCXHT.exe
  2⤵
  PID:11920
- C:\Windows\System\jZrvNwk.exe
  C:\Windows\System\jZrvNwk.exe
  2⤵
  PID:9304
- C:\Windows\System\UxmseWh.exe
  C:\Windows\System\UxmseWh.exe
  2⤵
  PID:11948
- C:\Windows\System\GTTRPkM.exe
  C:\Windows\System\GTTRPkM.exe
  2⤵
  PID:2508
- C:\Windows\System\ZoMUUBg.exe
  C:\Windows\System\ZoMUUBg.exe
  2⤵
  PID:12200
- C:\Windows\System\LjAkXva.exe
  C:\Windows\System\LjAkXva.exe
  2⤵
  PID:10060
- C:\Windows\System\LzaAQZh.exe
  C:\Windows\System\LzaAQZh.exe
  2⤵
  PID:8004
- C:\Windows\System\JqijWHH.exe
  C:\Windows\System\JqijWHH.exe
  2⤵
  PID:10856
- C:\Windows\System\JJTUNGn.exe
  C:\Windows\System\JJTUNGn.exe
  2⤵
  PID:12120
- C:\Windows\System\nBbmseM.exe
  C:\Windows\System\nBbmseM.exe
  2⤵
  PID:12164
- C:\Windows\System\vQAEwJS.exe
  C:\Windows\System\vQAEwJS.exe
  2⤵
  PID:10964
- C:\Windows\System\xrxjJiV.exe
  C:\Windows\System\xrxjJiV.exe
  2⤵
  PID:11404
- C:\Windows\System\NUGKwQV.exe
  C:\Windows\System\NUGKwQV.exe
  2⤵
  PID:13144
- C:\Windows\System\LDFXEbE.exe
  C:\Windows\System\LDFXEbE.exe
  2⤵
  PID:11644
- C:\Windows\System\hbMcxnk.exe
  C:\Windows\System\hbMcxnk.exe
  2⤵
  PID:11896
- C:\Windows\System\RZAyvcB.exe
  C:\Windows\System\RZAyvcB.exe
  2⤵
  PID:5320
- C:\Windows\System\qRBAfHe.exe
  C:\Windows\System\qRBAfHe.exe
  2⤵
  PID:9700
- C:\Windows\System\EYFJWOP.exe
  C:\Windows\System\EYFJWOP.exe
  2⤵
  PID:8760
- C:\Windows\System\dPdUpaW.exe
  C:\Windows\System\dPdUpaW.exe
  2⤵
  PID:10264
- C:\Windows\System\ajJmfLR.exe
  C:\Windows\System\ajJmfLR.exe
  2⤵
  PID:4056
- C:\Windows\System\GUIJepb.exe
  C:\Windows\System\GUIJepb.exe
  2⤵
  PID:9416
- C:\Windows\System\LkejmmL.exe
  C:\Windows\System\LkejmmL.exe
  2⤵
  PID:8460
- C:\Windows\System\UBfHsJS.exe
  C:\Windows\System\UBfHsJS.exe
  2⤵
  PID:7832
- C:\Windows\System\knQyydc.exe
  C:\Windows\System\knQyydc.exe
  2⤵
  PID:3956
- C:\Windows\System\yTFNvTO.exe
  C:\Windows\System\yTFNvTO.exe
  2⤵
  PID:7000
- C:\Windows\System\EaFaeip.exe
  C:\Windows\System\EaFaeip.exe
  2⤵
  PID:11584
- C:\Windows\System\xUAIQvJ.exe
  C:\Windows\System\xUAIQvJ.exe
  2⤵
  PID:4480
- C:\Windows\System\TbtibTp.exe
  C:\Windows\System\TbtibTp.exe
  2⤵
  PID:8668
- C:\Windows\System\eQqvgsH.exe
  C:\Windows\System\eQqvgsH.exe
  2⤵
  PID:8936
- C:\Windows\System\WZgrrGs.exe
  C:\Windows\System\WZgrrGs.exe
  2⤵
  PID:8832
- C:\Windows\System\ZrSXoQu.exe
  C:\Windows\System\ZrSXoQu.exe
  2⤵
  PID:12792
- C:\Windows\System\TXMTqCc.exe
  C:\Windows\System\TXMTqCc.exe
  2⤵
  PID:3952
- C:\Windows\System\qXOLcDy.exe
  C:\Windows\System\qXOLcDy.exe
  2⤵
  PID:6460
- C:\Windows\System\MuVHlWy.exe
  C:\Windows\System\MuVHlWy.exe
  2⤵
  PID:9308
- C:\Windows\System\tGIuEQM.exe
  C:\Windows\System\tGIuEQM.exe
  2⤵
  PID:9036
- C:\Windows\System\DQrxQgP.exe
  C:\Windows\System\DQrxQgP.exe
  2⤵
  PID:12908
- C:\Windows\System\Tdejnjl.exe
  C:\Windows\System\Tdejnjl.exe
  2⤵
  PID:10524
- C:\Windows\System\lETJtfp.exe
  C:\Windows\System\lETJtfp.exe
  2⤵
  PID:13004
- C:\Windows\System\eDujjIH.exe
  C:\Windows\System\eDujjIH.exe
  2⤵
  PID:11380
- C:\Windows\System\aBaEboI.exe
  C:\Windows\System\aBaEboI.exe
  2⤵
  PID:10084
- C:\Windows\System\hsMtlHb.exe
  C:\Windows\System\hsMtlHb.exe
  2⤵
  PID:3572
- C:\Windows\System\iMHsNwr.exe
  C:\Windows\System\iMHsNwr.exe
  2⤵
  PID:12236
- C:\Windows\System\McsFGPZ.exe
  C:\Windows\System\McsFGPZ.exe
  2⤵
  PID:13304
- C:\Windows\System\LONqAib.exe
  C:\Windows\System\LONqAib.exe
  2⤵
  PID:11696
- C:\Windows\System\vCyZEFj.exe
  C:\Windows\System\vCyZEFj.exe
  2⤵
  PID:5184
- C:\Windows\System\VgEotPY.exe
  C:\Windows\System\VgEotPY.exe
  2⤵
  PID:3468
- C:\Windows\System\GlojIrd.exe
  C:\Windows\System\GlojIrd.exe
  2⤵
  PID:11824
- C:\Windows\System\EAWjKgo.exe
  C:\Windows\System\EAWjKgo.exe
  2⤵
  PID:11096
- C:\Windows\System\gPUIuQl.exe
  C:\Windows\System\gPUIuQl.exe
  2⤵
  PID:12700
- C:\Windows\System\xWwNadt.exe
  C:\Windows\System\xWwNadt.exe
  2⤵
  PID:12780
- C:\Windows\System\mQCcTgz.exe
  C:\Windows\System\mQCcTgz.exe
  2⤵
  PID:11760
- C:\Windows\System\ILTRYyk.exe
  C:\Windows\System\ILTRYyk.exe
  2⤵
  PID:12436
- C:\Windows\System\UkfXBnM.exe
  C:\Windows\System\UkfXBnM.exe
  2⤵
  PID:14152
- C:\Windows\System\hEMactn.exe
  C:\Windows\System\hEMactn.exe
  2⤵
  PID:10944
- C:\Windows\System\rSAJnkP.exe
  C:\Windows\System\rSAJnkP.exe
  2⤵
  PID:8324
- C:\Windows\System\DtCfVjE.exe
  C:\Windows\System\DtCfVjE.exe
  2⤵
  PID:11472
- C:\Windows\System\tcZZTJw.exe
  C:\Windows\System\tcZZTJw.exe
  2⤵
  PID:11060
- C:\Windows\System\cKEQoQN.exe
  C:\Windows\System\cKEQoQN.exe
  2⤵
  PID:6308
- C:\Windows\System\LaQRTSP.exe
  C:\Windows\System\LaQRTSP.exe
  2⤵
  PID:11104
- C:\Windows\System\uIcjjgk.exe
  C:\Windows\System\uIcjjgk.exe
  2⤵
  PID:11460
- C:\Windows\System\MnLaVlo.exe
  C:\Windows\System\MnLaVlo.exe
  2⤵
  PID:11876
- C:\Windows\System\PwCSAra.exe
  C:\Windows\System\PwCSAra.exe
  2⤵
  PID:9428
- C:\Windows\System\YnhLtwh.exe
  C:\Windows\System\YnhLtwh.exe
  2⤵
  PID:11400
- C:\Windows\System\kFPjuMN.exe
  C:\Windows\System\kFPjuMN.exe
  2⤵
  PID:12432
- C:\Windows\System\ZyKdEkA.exe
  C:\Windows\System\ZyKdEkA.exe
  2⤵
  PID:12652
- C:\Windows\System\vfxRlEa.exe
  C:\Windows\System\vfxRlEa.exe
  2⤵
  PID:4204
- C:\Windows\System\PApMnXv.exe
  C:\Windows\System\PApMnXv.exe
  2⤵
  PID:9240
- C:\Windows\System\SJrrGaW.exe
  C:\Windows\System\SJrrGaW.exe
  2⤵
  PID:12028
- C:\Windows\System\EoGiZCV.exe
  C:\Windows\System\EoGiZCV.exe
  2⤵
  PID:13000
- C:\Windows\System\eQItmQO.exe
  C:\Windows\System\eQItmQO.exe
  2⤵
  PID:2688
- C:\Windows\System\yxuiHQF.exe
  C:\Windows\System\yxuiHQF.exe
  2⤵
  PID:13292
- C:\Windows\System\XKXhEtN.exe
  C:\Windows\System\XKXhEtN.exe
  2⤵
  PID:10204
- C:\Windows\System\zJKXwmZ.exe
  C:\Windows\System\zJKXwmZ.exe
  2⤵
  PID:7060
- C:\Windows\System\yPTUjIX.exe
  C:\Windows\System\yPTUjIX.exe
  2⤵
  PID:12716
- C:\Windows\System\EaGrrZi.exe
  C:\Windows\System\EaGrrZi.exe
  2⤵
  PID:10768
- C:\Windows\System\wCrkGmz.exe
  C:\Windows\System\wCrkGmz.exe
  2⤵
  PID:6756
- C:\Windows\System\KBzunKy.exe
  C:\Windows\System\KBzunKy.exe
  2⤵
  PID:2360
- C:\Windows\System\JJsNwMS.exe
  C:\Windows\System\JJsNwMS.exe
  2⤵
  PID:11492
- C:\Windows\System\cEYlVAn.exe
  C:\Windows\System\cEYlVAn.exe
  2⤵
  PID:8124
- C:\Windows\System\qBWkcVV.exe
  C:\Windows\System\qBWkcVV.exe
  2⤵
  PID:6140
- C:\Windows\System\UfjYvkZ.exe
  C:\Windows\System\UfjYvkZ.exe
  2⤵
  PID:12224
- C:\Windows\System\CnLJwRi.exe
  C:\Windows\System\CnLJwRi.exe
  2⤵
  PID:228
- C:\Windows\System\uwxtsMP.exe
  C:\Windows\System\uwxtsMP.exe
  2⤵
  PID:10728
- C:\Windows\System\BKDLhRZ.exe
  C:\Windows\System\BKDLhRZ.exe
  2⤵
  PID:9356
- C:\Windows\System\LlsWyue.exe
  C:\Windows\System\LlsWyue.exe
  2⤵
  PID:10096
- C:\Windows\System\RizVfvk.exe
  C:\Windows\System\RizVfvk.exe
  2⤵
  PID:13360
- C:\Windows\System\cbLeJXz.exe
  C:\Windows\System\cbLeJXz.exe
  2⤵
  PID:13852
- C:\Windows\System\wCjNGTT.exe
  C:\Windows\System\wCjNGTT.exe
  2⤵
  PID:4780
- C:\Windows\System\NUkIHSF.exe
  C:\Windows\System\NUkIHSF.exe
  2⤵
  PID:6872
- C:\Windows\System\czVhuWE.exe
  C:\Windows\System\czVhuWE.exe
  2⤵
  PID:13476
- C:\Windows\System\RVsYmAA.exe
  C:\Windows\System\RVsYmAA.exe
  2⤵
  PID:11480
- C:\Windows\System\hJmksXq.exe
  C:\Windows\System\hJmksXq.exe
  2⤵
  PID:12976
- C:\Windows\System\tEzVege.exe
  C:\Windows\System\tEzVege.exe
  2⤵
  PID:13288
- C:\Windows\System\pIToRPb.exe
  C:\Windows\System\pIToRPb.exe
  2⤵
  PID:12412
- C:\Windows\System\ydLXjBn.exe
  C:\Windows\System\ydLXjBn.exe
  2⤵
  PID:9960
- C:\Windows\System\YLUOnMq.exe
  C:\Windows\System\YLUOnMq.exe
  2⤵
  PID:10836
- C:\Windows\System\EYzhknN.exe
  C:\Windows\System\EYzhknN.exe
  2⤵
  PID:12760
- C:\Windows\System\hKLfTBd.exe
  C:\Windows\System\hKLfTBd.exe
  2⤵
  PID:10860
- C:\Windows\System\KvzaMhw.exe
  C:\Windows\System\KvzaMhw.exe
  2⤵
  PID:7040
- C:\Windows\System\DCsvyLn.exe
  C:\Windows\System\DCsvyLn.exe
  2⤵
  PID:10080
- C:\Windows\System\cxhRgiB.exe
  C:\Windows\System\cxhRgiB.exe
  2⤵
  PID:11704
- C:\Windows\System\innJGry.exe
  C:\Windows\System\innJGry.exe
  2⤵
  PID:11680
- C:\Windows\System\FbxqAWX.exe
  C:\Windows\System\FbxqAWX.exe
  2⤵
  PID:13272
- C:\Windows\System\OvQGvxS.exe
  C:\Windows\System\OvQGvxS.exe
  2⤵
  PID:8900
- C:\Windows\System\OUCpBph.exe
  C:\Windows\System\OUCpBph.exe
  2⤵
  PID:12148
- C:\Windows\System\wiEmAqY.exe
  C:\Windows\System\wiEmAqY.exe
  2⤵
  PID:11344
- C:\Windows\System\VSlVaQR.exe
  C:\Windows\System\VSlVaQR.exe
  2⤵
  PID:8872
- C:\Windows\System\vzKufVJ.exe
  C:\Windows\System\vzKufVJ.exe
  2⤵
  PID:8960
- C:\Windows\System\FtlmBSY.exe
  C:\Windows\System\FtlmBSY.exe
  2⤵
  PID:5276
- C:\Windows\System\LDWTuWi.exe
  C:\Windows\System\LDWTuWi.exe
  2⤵
  PID:9912
- C:\Windows\System\TuhUfkC.exe
  C:\Windows\System\TuhUfkC.exe
  2⤵
  PID:9948
- C:\Windows\System\BAntcaX.exe
  C:\Windows\System\BAntcaX.exe
  2⤵
  PID:13324
- C:\Windows\System\sUSzRFK.exe
  C:\Windows\System\sUSzRFK.exe
  2⤵
  PID:7968
- C:\Windows\System\kOWzeeU.exe
  C:\Windows\System\kOWzeeU.exe
  2⤵
  PID:14056
- C:\Windows\System\xAWYhOR.exe
  C:\Windows\System\xAWYhOR.exe
  2⤵
  PID:13664
- C:\Windows\System\OpeiqYe.exe
  C:\Windows\System\OpeiqYe.exe
  2⤵
  PID:11860
- C:\Windows\System\IZZMcwC.exe
  C:\Windows\System\IZZMcwC.exe
  2⤵
  PID:3788
- C:\Windows\System\VqRnUCG.exe
  C:\Windows\System\VqRnUCG.exe
  2⤵
  PID:14080
- C:\Windows\System\TewuOFt.exe
  C:\Windows\System\TewuOFt.exe
  2⤵
  PID:8596
- C:\Windows\System\tKpVYNo.exe
  C:\Windows\System\tKpVYNo.exe
  2⤵
  PID:4092
- C:\Windows\System\QVPowTK.exe
  C:\Windows\System\QVPowTK.exe
  2⤵
  PID:14252
- C:\Windows\System\neZvsMm.exe
  C:\Windows\System\neZvsMm.exe
  2⤵
  PID:12668
- C:\Windows\System\bDvCWlB.exe
  C:\Windows\System\bDvCWlB.exe
  2⤵
  PID:8704
- C:\Windows\System\cwkamPN.exe
  C:\Windows\System\cwkamPN.exe
  2⤵
  PID:7280
- C:\Windows\System\HtvJYzL.exe
  C:\Windows\System\HtvJYzL.exe
  2⤵
  PID:13100
- C:\Windows\System\ekAMDJo.exe
  C:\Windows\System\ekAMDJo.exe
  2⤵
  PID:1296
- C:\Windows\System\gMUzMaU.exe
  C:\Windows\System\gMUzMaU.exe
  2⤵
  PID:12752
- C:\Windows\System\jtdsDQD.exe
  C:\Windows\System\jtdsDQD.exe
  2⤵
  PID:12264
- C:\Windows\System\RenDfPc.exe
  C:\Windows\System\RenDfPc.exe
  2⤵
  PID:7324
- C:\Windows\System\lZmrsFR.exe
  C:\Windows\System\lZmrsFR.exe
  2⤵
  PID:2660
- C:\Windows\System\enYfGjZ.exe
  C:\Windows\System\enYfGjZ.exe
  2⤵
  PID:10020
- C:\Windows\System\hOKhdGJ.exe
  C:\Windows\System\hOKhdGJ.exe
  2⤵
  PID:6288
- C:\Windows\System\YoHISdr.exe
  C:\Windows\System\YoHISdr.exe
  2⤵
  PID:10472
- C:\Windows\System\tCEMSDh.exe
  C:\Windows\System\tCEMSDh.exe
  2⤵
  PID:9352
- C:\Windows\System\dbwLVll.exe
  C:\Windows\System\dbwLVll.exe
  2⤵
  PID:13296
- C:\Windows\System\WLGCcpJ.exe
  C:\Windows\System\WLGCcpJ.exe
  2⤵
  PID:11968
- C:\Windows\System\QRqgANe.exe
  C:\Windows\System\QRqgANe.exe
  2⤵
  PID:10400
- C:\Windows\System\XwGOCba.exe
  C:\Windows\System\XwGOCba.exe
  2⤵
  PID:4588
- C:\Windows\System\cVUjsDt.exe
  C:\Windows\System\cVUjsDt.exe
  2⤵
  PID:8356
- C:\Windows\System\EtMaHrZ.exe
  C:\Windows\System\EtMaHrZ.exe
  2⤵
  PID:3916
- C:\Windows\System\BRaOrNg.exe
  C:\Windows\System\BRaOrNg.exe
  2⤵
  PID:4608
- C:\Windows\System\LwgxTBT.exe
  C:\Windows\System\LwgxTBT.exe
  2⤵
  PID:13284
- C:\Windows\System\osSeAXe.exe
  C:\Windows\System\osSeAXe.exe
  2⤵
  PID:2952
- C:\Windows\System\HWNvSML.exe
  C:\Windows\System\HWNvSML.exe
  2⤵
  PID:13264
- C:\Windows\System\uKhmYpD.exe
  C:\Windows\System\uKhmYpD.exe
  2⤵
  PID:9504
- C:\Windows\System\RIVxVUW.exe
  C:\Windows\System\RIVxVUW.exe
  2⤵
  PID:12400
- C:\Windows\System\HmNIxJq.exe
  C:\Windows\System\HmNIxJq.exe
  2⤵
  PID:13140
- C:\Windows\System\SLcBGgq.exe
  C:\Windows\System\SLcBGgq.exe
  2⤵
  PID:8144
- C:\Windows\System\itmPlUm.exe
  C:\Windows\System\itmPlUm.exe
  2⤵
  PID:9040
- C:\Windows\System\iLsoJMg.exe
  C:\Windows\System\iLsoJMg.exe
  2⤵
  PID:3540
- C:\Windows\System\FtCqiCJ.exe
  C:\Windows\System\FtCqiCJ.exe
  2⤵
  PID:9180
- C:\Windows\System\ItaLpAk.exe
  C:\Windows\System\ItaLpAk.exe
  2⤵
  PID:11708
- C:\Windows\System\vCkQxdL.exe
  C:\Windows\System\vCkQxdL.exe
  2⤵
  PID:11796
- C:\Windows\System\JakdGWo.exe
  C:\Windows\System\JakdGWo.exe
  2⤵
  PID:14356
- C:\Windows\System\YqRCqsO.exe
  C:\Windows\System\YqRCqsO.exe
  2⤵
  PID:14384
- C:\Windows\System\YZtJlsc.exe
  C:\Windows\System\YZtJlsc.exe
  2⤵
  PID:14412
- C:\Windows\System\VwjTbtp.exe
  C:\Windows\System\VwjTbtp.exe
  2⤵
  PID:14440
- C:\Windows\System\rxsXFnY.exe
  C:\Windows\System\rxsXFnY.exe
  2⤵
  PID:14468
- C:\Windows\System\VagfpDg.exe
  C:\Windows\System\VagfpDg.exe
  2⤵
  PID:14484
- C:\Windows\System\bTVvVCo.exe
  C:\Windows\System\bTVvVCo.exe
  2⤵
  PID:14512
- C:\Windows\System\GXkpGeC.exe
  C:\Windows\System\GXkpGeC.exe
  2⤵
  PID:14556
- C:\Windows\System\QZGzksw.exe
  C:\Windows\System\QZGzksw.exe
  2⤵
  PID:14584
- C:\Windows\System\LlqkGdq.exe
  C:\Windows\System\LlqkGdq.exe
  2⤵
  PID:14612
- C:\Windows\System\YSFRlPI.exe
  C:\Windows\System\YSFRlPI.exe
  2⤵
  PID:14640
- C:\Windows\System\MwnbMZB.exe
  C:\Windows\System\MwnbMZB.exe
  2⤵
  PID:14668
- C:\Windows\System\PwrsVyO.exe
  C:\Windows\System\PwrsVyO.exe
  2⤵
  PID:14696
- C:\Windows\System\eeflsRI.exe
  C:\Windows\System\eeflsRI.exe
  2⤵
  PID:14724
- C:\Windows\System\WvbuyBM.exe
  C:\Windows\System\WvbuyBM.exe
  2⤵
  PID:14752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:12868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 12656 -ip 12656
1⤵
PID:13172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xt2poepd.kyg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQgsgTb.exe

Filesize
2.2MB

MD5
be9b12e58f5b3690cba4dc793c343295

SHA1
b65a57f41d074029cc2d20be4c196dc8c1d30ac0

SHA256
b8c2458fbcb9a57f8c2174b702a5e32b9ebd93fde61bb996836320fdd51b8411

SHA512
0dfe3caed89cdf8f960950b3196f230bfea851ee6c027bf15b5063238562376077fea546e68b1df7319a0083e7aa119387b0ed35334ea38c8efb4e3290d48047

Download Submit
C:\Windows\System\IJbahES.exe

Filesize
8B

MD5
d6349613f683bded6d69a7d02ace4275

SHA1
1627fabfdfae3cac338500241f4e9e969ee50ac5

SHA256
4a54b14258d08729a6205b09d8643680d1fcbeb6eaed5e636cae813e537ac662

SHA512
d83aa606a1ca4c9ad32d8a91f5b2cf833fc395e62b938477a618ca3509fa52443c5e33121c0988fd90e65d2855a59276136a584d3f8258054273372e5fbf3292

Download Submit
C:\Windows\System\JCaLXKq.exe

Filesize
2.2MB

MD5
dd9912aa187b2427350a11ebee1b6f38

SHA1
88cf31f4da9a27c272b52ffbaa69ecaf7752d40e

SHA256
a15c074159c9d724527cff79c778489940bfc47ebc511a6becc1373cf2104edd

SHA512
c4daf6901e3edb091a74dcf7ec1bd213d73d805acb99cb9203106047103bd85f4ffd7047bb2f67b1808c53ecd6bb89b4f1f0546cec2f5d395cddec116bb0b75b

Download Submit
C:\Windows\System\KDRpslz.exe

Filesize
2.2MB

MD5
1c47c60f89e06aa846bd2223afa76bef

SHA1
952b64921ec84e0a3b044e11d5a743b0cf66a1c8

SHA256
6a647a80762d0cb348057ed81e835c4bf5a113b258c2f6adda3bdd32788557a4

SHA512
e7b9a13d955131483705eb09849223cdb0e32533bf22f83ae857bcf98dc3f28e1a6795f7b9a454aeb5be01e51be47bbfaf31171cfa91014b4ea3d20ce1705334

Download Submit
C:\Windows\System\KtIHvpn.exe

Filesize
2.2MB

MD5
33e7cbdfdc1ebdacbff3071cca3848dd

SHA1
99374d5d3934f26373e2a89a5e3ea45ef5ce0902

SHA256
a07aa93b1929720b6248e733d66d9298c9558c1e31bc6ec55e2dd519548bfbfa

SHA512
7d13785bb6a79a671c5cf6c326fa4de7ae7196ef3f0d5109332fb965cff398ff01ed9f947e9ecccf80e6eb949d607c33953c98d5824780bdf8b72cb2b29a4868

Download Submit
C:\Windows\System\LFlsZqo.exe

Filesize
2.2MB

MD5
1e730358ac2b7003820271090005f91f

SHA1
50e162a6dfff94f1566f8b8db9d0631c17b57b74

SHA256
d5882a3415267933bbb64c1a3be552fea565a165a572b13dc4bb1fd4dad1ee15

SHA512
b897d3ef7c986d352bac4e2ef8765e53a350bca7c05eefada999468226e85a5703d91f953ef14814147811955e7283d1a4614370389f80cf9929d280a8c628b2

Download Submit
C:\Windows\System\LHVsThc.exe

Filesize
2.2MB

MD5
a47839072aeb5901c062071982c0059e

SHA1
105f7dff8c8c043f968ce2e2c61b1fa99ee07812

SHA256
3e048dce9817c93c427271a5424ef545753e691ade79dde68bc84dcb3295ce37

SHA512
3d0e133acf34087001b7e9ffaa9e80c094dff73efc5c483f5ea5078d1a0f0a97e6d8a18f1d9516c998c25b8af31fc80571630a30462954952bf20b57b18aaf1e

Download Submit
C:\Windows\System\MpIRXyI.exe

Filesize
2.2MB

MD5
04db75c542fd48cc6d1865e75c5f6d94

SHA1
f7fd1499d65ebfa37947fbb4eb47c80314ccfc02

SHA256
325429c8550c04e65c0375e51bda1efba3cc1d221626bab70b19b26916127673

SHA512
b982808dd3e4f3d260427393141bd6a79e81316fbaaee50b1a8d087220a664a151630ef83b105d2ce8f46178deae55ee4ef6c2023df31f2073b260330c4360d7

Download Submit
C:\Windows\System\PVpXbhW.exe

Filesize
2.2MB

MD5
6f1faa3128affa5c9d578784c28669f7

SHA1
d65ec15eac73536fb5c308c843c230da10eb6c76

SHA256
a1a02b77034b0d795857ebbe86e8df93b1eff08748e7a950120d176c00f8d560

SHA512
378206f5da908e227eb128ed185ee5a960be5019497d773d8f2c1e71c3852f92b5409fbc00c1bc40f171f12b9a8238ce6f735431c2b3783c7b25d1a06f7a37b1

Download Submit
C:\Windows\System\Ruefmvq.exe

Filesize
2.2MB

MD5
413186f90e3a7356d57a3754d1f14edc

SHA1
79873b33afd84c38cb8698acd261621ffe0d75e5

SHA256
65674449b107aaaeb4703fedfc1567b2bc5b2aad7bcd6f66d4ded8cd15f6140f

SHA512
74664a9e8c4a5579a4577c00d0e5690c61d5541777f79bc975005d12eb09d7441f113ecc1a8a4eaf477ee72fad1c908a68b3b60eaa40225f89770d3613ee61a1

Download Submit
C:\Windows\System\RzcldDO.exe

Filesize
2.2MB

MD5
221b6aacbca1ea74be34a9c3cb13f259

SHA1
a43323e1d2059c874d064dd5c5565b7fd6d99c78

SHA256
6cd6b30ffdf9e51a286149ca7dac82acacbc723fb7fe63ed38e9584da777af07

SHA512
07a56e19898dbae62799aaff4588e2aec4158c1511b980432882969f8afbfca70423d7e7b928e421fa804cdc280afd18b85608dd94be51c1d601978257868bcf

Download Submit
C:\Windows\System\TFMfOjs.exe

Filesize
2.2MB

MD5
3760937ee845b7ac3bd5166a9988cb56

SHA1
695e7b93c1a113d201ba8f5b62565707e9059e6c

SHA256
49b3756fc34b727624696f0146edd5b27af0bd74d0b32f64b06742591f8c8b66

SHA512
06039d3ff32114aeb516c44372c9a5cd761e228c67bbe5e140a3ec69e01514d871ac9e5a38229565383f106d1855ad6ee9e7be959b2dcb78bade0d1dc1f81c3d

Download Submit
C:\Windows\System\VUrpIXZ.exe

Filesize
2.2MB

MD5
4d78940bb100198d8cef2a515b9232fd

SHA1
20b45a18967d620570e2793b1e9610a49964bd6c

SHA256
f5bf5737f823b9498d28035ac96317dd61270ea01e4ed402ec6251d99ec4c836

SHA512
4c6cfe1dcb2c105a7c2bc41b6d7cb0843d798b3438dcb1ad028637d902973febeffb02f8a6cf87db30d52508939b151ff118a9a80bf73b509ae38061d40fc98b

Download Submit
C:\Windows\System\WmkEUjZ.exe

Filesize
2.2MB

MD5
28e4269870ed92ef62d04f486905d1b7

SHA1
0366af0124fa5e496865452bc0d763d98ed7e3dd

SHA256
7189bef20713f333b0aeb76e38317883b7d8c8584ba58f3410c95f59c80b0d70

SHA512
c1025a7cffde8b9e031876639c53a8f634bbb1460028bce539e118ebe3ebe591e1b65f006f8539152503864814ce986d9dd277fa5040b08481ccdad6b3878be5

Download Submit
C:\Windows\System\XLgbesA.exe

Filesize
2.2MB

MD5
3be927f588a1855fce95ed0e6be584a9

SHA1
2a63f177133aa8283da4d7347a25aaa58f8d4f87

SHA256
32f4f6a03026ae4d35b441f616dbeb17de23f5c166210dd4bec9113fa2da3c85

SHA512
0786fd7ad9b7804fb037c7eae4b132a0524cea21bd25e529cba78f0e082e836f2b5349cbda75ec8027e9989861a0b8aa54954695a2c362a4e60e6903eab5a5ad

Download Submit
C:\Windows\System\YLMxIGX.exe

Filesize
2.2MB

MD5
70e65963046dcfae5fce88717d68e0be

SHA1
57a930d70b9cd678c78e4c45e50a5351b3b1cf3d

SHA256
174ae52360117313eea5fdc69b944812880101094020250a5819c6b051557b6b

SHA512
c921354a560dba3f2b17b1f7ff4e2105d7be5a277f421604b5d06bcf48198b5aa34872d42d227a2f167d89d59eb1b91ea004e453b161a8ca1e2555fd1cefdcbb

Download Submit
C:\Windows\System\axAdnQE.exe

Filesize
2.2MB

MD5
0e8dae34fc96545e335fd44dbb232301

SHA1
40460dc75a2492e6971dd9e5c08188be4fe750de

SHA256
4f7c9a2d7a6087b18016714f983bb76ba5a65e74f5fdcea415797a1783c8962b

SHA512
a8097cdbec44c997dfdb670f5cc21a1cfa5eebba2888e32964805157ba9e41c8588aa5de9490c6e5621dd47ff8e67188a322c888a742a8d14da8d65839acde2b

Download Submit
C:\Windows\System\ciEETxp.exe

Filesize
2.2MB

MD5
7517cefb45ed7b9311e2df7c3623ecc6

SHA1
91838915c93c6b9449ff50d4f22d187cf033dea8

SHA256
5b75c978f22d6e87593423932d9fe4c7b16372e4ed8607a9e8de81ca85ddb6fb

SHA512
a8ab9d149341ecb6e6e37662667d2dd981325d647f02bf227d79438b2dcc75963942d11fa0e27aba8da8a558d81d325966f9b9e9dc197058f470b0e7576ecba8

Download Submit
C:\Windows\System\ctUQjnR.exe

Filesize
2.2MB

MD5
64da1a6a196299b7d02a798fa247ca39

SHA1
4be4945f9b78113d32e88062dcaf8857b44dc07d

SHA256
b25001e3f9c2d7186434902f192b5e257ede8da7fb6249c6b66694d41e6c4f37

SHA512
22c0e4e2d4cfa123a54a3ebd486da59ba7f28e6714b726229a1023471f57d9b88a495421fae13b65664756e6960e72c9f67d8474220651d0bd600d341c2cad0b

Download Submit
C:\Windows\System\fLmRzeu.exe

Filesize
2.2MB

MD5
9513c7a2687d5960cbea49fe601ddc67

SHA1
1a2aedafa8903a72bb75734256adb10dd5c0b9f9

SHA256
6c81d60f93264aad2bce3748e4b1ee62668327fac43c3285297c2185ab1f884f

SHA512
79d89cc2168bc8d8cd341fa0f473ba2c45c11129119578d835991ff97ccbec32eddc31892524ad10852103c2b5588be4377a750f7ff2e6c5d96225d2bd75c7f9

Download Submit
C:\Windows\System\fveVbaD.exe

Filesize
2.2MB

MD5
48506c65a1054b75a8feb6a2446b0580

SHA1
778f3c101b6f853d96e443e5bb7d10dc90f790cc

SHA256
bf1ce9ca129bbff89d85c29f4e9b6a32c1a3bf94735870f077645964936b16bd

SHA512
0de852570c6138fa3724112da830cac9c80aa623efceef880d57704e2d8122e27bf16ad918fb2ba1d8e214b612c631f818e31758268a86da67faadbf3aecc104

Download Submit
C:\Windows\System\fzKAEtP.exe

Filesize
2.2MB

MD5
73179880a8f40f14806c3a16c7ad614e

SHA1
28142214e412a93cc994a048a36851bcaaf79bc5

SHA256
da6836543f120c3297dd3029e2a5eb816b69f61123d4bac732fd0e163fa0e9aa

SHA512
ac0c42f71d0e89c908c5293e419e3ec58120a87ca98685584621dd69c8512316655e2b7fb8d6ff6dcd310ee1407c39b944a97448a45c421aea17e638e8517610

Download Submit
C:\Windows\System\gqUNQyC.exe

Filesize
2.2MB

MD5
1b35327c84da71f613a60f3b9af2ebeb

SHA1
ef196d5a5bba4ed1aa35a69819ec146797afcd10

SHA256
cb52f65bafe9c2123930ae023ea85475d70b7b2ab59bcf74e1b258aaa6a9e4d7

SHA512
16e26a61e1351df814d0b7fa6c65fbc0b8c831c51611aa10a1b177cabb00cae99a1e54cafb7c760cf7960baba4e066cf3a25c1763d3f517ea84dadc16d132e2d

Download Submit
C:\Windows\System\hCSoLPx.exe

Filesize
2.2MB

MD5
3028387114b242382c276c4579fadcd6

SHA1
314f47a7f8cd10d8524ce4afb0e753352d71a134

SHA256
6c5e0808ff2dffe0fd9802d3c847240bc6b8af7dd869e289c9918665e1c48b76

SHA512
4543e416b740434e67ae380f5a01d548ba58d74b35fb1b591aa6cbb599f0d65a41af87cc19f1c2c78ae948cc6d525aedcc4fd1eddea5719f88fa4c585ecb9267

Download Submit
C:\Windows\System\hrVqiVo.exe

Filesize
2.2MB

MD5
244b9d04cad2c772cebb15ac22401c3a

SHA1
282fcac0dcd579bcd3dba368bdf8d5f5c8c550c5

SHA256
9da8b0aa843ae72f382ec1fbcaa6065914c4ff6930346068a6fc5cfe83da7c76

SHA512
170d0c7926549720844265c34fda8109e5b4e59631b555aa26b645b737440b359926006aaa7a23c6bf922912326dd7e0d844e1fb6b53cf3179933050d871570c

Download Submit
C:\Windows\System\jmASdWV.exe

Filesize
2.2MB

MD5
44c7f595164e0b3be840d5e091d78616

SHA1
72d6f39a7eeba0b269fc5e424619573e404ce3a5

SHA256
ba72c517b17aa36ed72042fd70ba6039ace22975ff5bcb8dbac44763bc99ee9a

SHA512
3a559014959c3d34b3a0eddb9f406a06799078a844d39c5d043f4d0b8dbc7c985de097cae4954014f69861cdf7be8d37fade591ca0f7dc4251c276a142e138ce

Download Submit
C:\Windows\System\jtvCUIR.exe

Filesize
2.2MB

MD5
08a8a67f8b4699ebf1ae4e18ac1a3526

SHA1
7ece63188b863789b92feed01bda334dc58b64c8

SHA256
bac87fac56734af1a8d4881345a8b703fdcec329550255538378a68606ef5be3

SHA512
97f346adb605166378dec0bf4314bae31b1a5d8a4bfb35de4c3b75c6098cb9e225e47ac6ecc7b3232f9797599925b0c5b778573c368a93d887c94f491a44525c

Download Submit
C:\Windows\System\jvuCQzU.exe

Filesize
2.2MB

MD5
84fc2ca93a7cdf68852dd6274f608e36

SHA1
63236eb7dddcce1f7a53dfb4502979e04d841ff1

SHA256
45ef38176902b64ed0fbe76df210547dab0e6e70a3cf3ea335914ccc592a3e8d

SHA512
8d5200ee5f20b2e0391eaa5982fe8f79cf89448fc583c82c4df55e6458a0ab6d098ceded871d2917858c2966d2036ddfc516cfc6ff43601b83d63a90ef489f86

Download Submit
C:\Windows\System\kkUfkrY.exe

Filesize
2.2MB

MD5
5f01cbdccaa2bd32d48113cf3972ade1

SHA1
c0a032e2163770589912631a85a6e5805f1adad9

SHA256
359ff196b3aae8990bc59d66b5aa999d7ad5c28c30ca0976942bfa455484f514

SHA512
cb9ed2f4beff729f3ea670431cbe052244b5190d3424282bd817e2d62ef6426f2e6e47cc6ffc0a63de3b7e45d257bf2ce5101e8648295844d9b8ef643d937bbd

Download Submit
C:\Windows\System\lBGVBTR.exe

Filesize
2.2MB

MD5
a068d1bbf0f903bfa55407def684597d

SHA1
783921486eedebb95bf48138738b68c22bf4f15c

SHA256
d5512d8ed011551e9089ad039431571ebfa9069958bb09d28a9b395adae45061

SHA512
3b23e680cf5d0c7baf13731c5b0ca1b49f7310b4e16b22bf8fd845225f638562a1e1be018c04c6869571c02a954a3ae63a949d6f4750413fbcb55b9a9dd2d5d2

Download Submit
C:\Windows\System\melHWzT.exe

Filesize
2.2MB

MD5
633313d61f50e519d84ad4c0f7334bb9

SHA1
1034fffce617d60a6f7108c4710dd701f34dd8ac

SHA256
82a130904419c91d1d27157853b31e12c2db546adf170455c94490dba77fce88

SHA512
4198c3709cb1c00dbf69616a35aaac50f3b1fe5c6a4f89bf99cf83c02efe8ee02b2dc5dd1f2f34a97c9cc363dcab5cd771f13138c2eb2d1fbf9d8fac22029709

Download Submit
C:\Windows\System\nYyGpmT.exe

Filesize
2.2MB

MD5
875ab3a6da299259b865279f49f8bf3d

SHA1
f3963fc95518e714c9561c2d6012381c3964b8d5

SHA256
609f17fd332d91a224da3223b8b31d766a809c8d5f38787782629ad82a7a973e

SHA512
44611e98d11f74fd1627e8ee9dab29ecfaef44371d38fc30794746cd5b3b0e68fa1daae2eef592908b84c08f94dc3d640c7a9f98bcae24af1a32d92d4de56b9d

Download Submit
C:\Windows\System\pFLvQKV.exe

Filesize
2.2MB

MD5
0979124dc75f5d0154d2bc020e240301

SHA1
17aa54a5ee69f399af869238e13163bf7dd77650

SHA256
6ff3de3a7f7e4ad2501a9141d64ac35d5735fdb31ff4593174a7712e883a7e18

SHA512
cf64e5ba99393dd06fd33431a370313334494cd819c8c3d44c98a7bb6b3a372471506dfc586a111610ebe6341a9b47aa835700ebf03c3efc7cfec5828d069d78

Download Submit
C:\Windows\System\pPOryYD.exe

Filesize
2.2MB

MD5
adca794fda55ddb33eb2c9c03e182b47

SHA1
c4210e9f66b478aa70e346687e1702f216cd3e64

SHA256
e155d0395d0b134bc6f68f38b3fea737335ab1c8f2b75cfd9782b68dc0625ed6

SHA512
0a414ae6b2f267ac4de635d90b45aab7c4ea52235e13ebf2b5f3d58d1c1b0cca244ce1f92cb1edf6541bfc4d3019986cc99506b27c2713a10eb4c06017cbe97f

Download Submit
C:\Windows\System\sghcuJB.exe

Filesize
2.2MB

MD5
5fca31ece550f08376037fe7f7d7eccc

SHA1
7faf4bee1c2646102a64ec3da1245cd958099f12

SHA256
dca5ae26a1c420683327ed39594fbbabf8f540f02c3d83a98efcb60fc5cb259d

SHA512
dd4649a50d979d3748781d377ee85e7d7ab32a85d5d2cda48cc57338f2c305716d15fed7d03f778f32b595baad905f0a155f33fe64938ed06ec5f990bc99b7ef

Download Submit
C:\Windows\System\uPliELP.exe

Filesize
2.2MB

MD5
925d69e59a361bd6c16580192c9e0446

SHA1
a031de3683a2cabc22d1c8b945a035efdb130874

SHA256
5b38333c73a1a473e7aba6f44140e253181a44bd951ade1258ce66b833e9fcd4

SHA512
f50171259c2fa81c1abbc83f01f74914b3e530db1b7341e9c08e96fd3cf9aa78e9a27533af29eaba83e57c3b0d22675e8c1b7f1eb764c562f007fba0de15d90e

Download Submit
C:\Windows\System\xfbvdOa.exe

Filesize
2.2MB

MD5
09640591a8373e343bb52c0ae18800b1

SHA1
8636d47076dd7e600b998c61cdac832d67fa84db

SHA256
2da7ae0594a357d7ce89219996b8652fd99be318ba8a93b99eeac2c623de57ef

SHA512
99886f1b8746b0b583227c32b09f3606165aef7e1d8bde08a6ffa8822c2cacad357ffe06d7d9becb8b5ac734d63abeb6223c8ea52d55840cf3669d099c8c82f4

Download Submit
C:\Windows\System\yMnogkQ.exe

Filesize
2.2MB

MD5
5658e327c8db8feff95d453a1cabc27e

SHA1
9c909b8f056010d4bd5526540b19a1ee3b563410

SHA256
db1cacb6d92b83f8f472d4112c265ad3096d76da15e9dc5c8bf46a52aaf73174

SHA512
988890aed8b9086073e8a4d9c855fa430c0f8c1e29838ee56c1cbf5fef2d5b0d20abafd8f3225850db1771bbaf2cce873d892c6ea66d215d2ba124e05f92c989

Download Submit
C:\Windows\System\yVxaukn.exe

Filesize
18B

MD5
9fa2f2bc2c83847fc483e3e7b126834c

SHA1
8b6462d325e2f1ce3be472e3b52dd110ec77edc6

SHA256
2cfeba3b82f25cdebb02f8d4e5a1f9c8b06dd44b398a3a1e6c4b2e3889cd64d2

SHA512
cdf8d08cfa397a3c63f4ef05a58f2b05a8fdc5e71478c30ce0b29540695413920edc291f08e9c0e713496591adc5707c1c01f6e7f0baaad502181c860050f52f

Download Submit
memory/320-416-0x00007FF671120000-0x00007FF671512000-memory.dmp

Filesize
3.9MB

Download
memory/320-3768-0x00007FF671120000-0x00007FF671512000-memory.dmp

Filesize
3.9MB

Download
memory/548-10-0x00007FF697E00000-0x00007FF6981F2000-memory.dmp

Filesize
3.9MB

Download
memory/900-3754-0x00007FF7F90F0000-0x00007FF7F94E2000-memory.dmp

Filesize
3.9MB

Download
memory/900-413-0x00007FF7F90F0000-0x00007FF7F94E2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-3788-0x00007FF7175B0000-0x00007FF7179A2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-423-0x00007FF7175B0000-0x00007FF7179A2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-3719-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp

Filesize
3.9MB

Download
memory/1096-243-0x00007FF66C980000-0x00007FF66CD72000-memory.dmp

Filesize
3.9MB

Download
memory/1400-3782-0x00007FF731940000-0x00007FF731D32000-memory.dmp

Filesize
3.9MB

Download
memory/1400-421-0x00007FF731940000-0x00007FF731D32000-memory.dmp

Filesize
3.9MB

Download
memory/1556-3685-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp

Filesize
3.9MB

Download
memory/1556-424-0x00007FF6D4B80000-0x00007FF6D4F72000-memory.dmp

Filesize
3.9MB

Download
memory/1800-3736-0x00007FF621770000-0x00007FF621B62000-memory.dmp

Filesize
3.9MB

Download
memory/1800-414-0x00007FF621770000-0x00007FF621B62000-memory.dmp

Filesize
3.9MB

Download
memory/2120-420-0x00007FF6AD2D0000-0x00007FF6AD6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-3757-0x00007FF6AD2D0000-0x00007FF6AD6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-3743-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-374-0x00007FF6065C0000-0x00007FF6069B2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-419-0x00007FF60E480000-0x00007FF60E872000-memory.dmp

Filesize
3.9MB

Download
memory/2524-3739-0x00007FF60E480000-0x00007FF60E872000-memory.dmp

Filesize
3.9MB

Download
memory/2648-3954-0x00007FF67FD70000-0x00007FF680162000-memory.dmp

Filesize
3.9MB

Download
memory/2648-1-0x00000277B7E20000-0x00000277B7E30000-memory.dmp

Filesize
64KB

Download
memory/2648-0-0x00007FF67FD70000-0x00007FF680162000-memory.dmp

Filesize
3.9MB

Download
memory/3268-415-0x00007FF615BC0000-0x00007FF615FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-3775-0x00007FF615BC0000-0x00007FF615FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-3786-0x00007FF651C10000-0x00007FF652002000-memory.dmp

Filesize
3.9MB

Download
memory/3408-422-0x00007FF651C10000-0x00007FF652002000-memory.dmp

Filesize
3.9MB

Download
memory/3472-335-0x00007FF757A60000-0x00007FF757E52000-memory.dmp

Filesize
3.9MB

Download
memory/3472-3722-0x00007FF757A60000-0x00007FF757E52000-memory.dmp

Filesize
3.9MB

Download
memory/3524-3747-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-261-0x00007FF6E5EF0000-0x00007FF6E62E2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-3761-0x00007FF6B3A80000-0x00007FF6B3E72000-memory.dmp

Filesize
3.9MB

Download
memory/3584-411-0x00007FF6B3A80000-0x00007FF6B3E72000-memory.dmp

Filesize
3.9MB

Download
memory/3992-260-0x00007FF7AFFE0000-0x00007FF7B03D2000-memory.dmp

Filesize
3.9MB

Download
memory/4032-129-0x00007FF6EB4D0000-0x00007FF6EB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-312-0x00007FF6D0010000-0x00007FF6D0402000-memory.dmp

Filesize
3.9MB

Download
memory/4524-3765-0x00007FF6D0010000-0x00007FF6D0402000-memory.dmp

Filesize
3.9MB

Download
memory/4592-292-0x00007FF754EE0000-0x00007FF7552D2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-3748-0x00007FF754EE0000-0x00007FF7552D2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-412-0x00007FF7D09A0000-0x00007FF7D0D92000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3750-0x00007FF7D09A0000-0x00007FF7D0D92000-memory.dmp

Filesize
3.9MB

Download
memory/4864-3807-0x00007FF644460000-0x00007FF644852000-memory.dmp

Filesize
3.9MB

Download
memory/4864-425-0x00007FF644460000-0x00007FF644852000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3780-0x00007FF70AC00000-0x00007FF70AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-418-0x00007FF70AC00000-0x00007FF70AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-417-0x00007FF6BE4B0000-0x00007FF6BE8A2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-3791-0x00007FF6BE4B0000-0x00007FF6BE8A2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-217-0x00007FFE87C00000-0x00007FFE886C1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-4-0x00007FFE87C03000-0x00007FFE87C05000-memory.dmp

Filesize
8KB

Download
memory/5112-65-0x00007FFE87C00000-0x00007FFE886C1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-1982-0x00007FFE87C00000-0x00007FFE886C1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-226-0x000002A12E5F0000-0x000002A12E612000-memory.dmp

Filesize
136KB

Download