xmrig | e398bcf19b32e401d2aa1a2db5b72e1ca87d486f854dd75f0366e0cd6478f8c5

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Size

1.7MB
MD5

05322ddd930755aa1fd8024095bab90e
SHA1

a75e7a4cab4fc592cf6536743c41c2d3b7e9a76e
SHA256

e398bcf19b32e401d2aa1a2db5b72e1ca87d486f854dd75f0366e0cd6478f8c5
SHA512

905b09cb62434b73cb7026925909d2387905ab7d8cca125f9f20bd6dc1ff5e35534775de8a40ac018891b1860218f01d61e6ab557877d49fb19b35a1f9e8e505
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXeu+:NABm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/4848-221-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp	xmrig
behavioral2/memory/404-244-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp	xmrig
behavioral2/memory/3400-254-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp	xmrig
behavioral2/memory/2568-281-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp	xmrig
behavioral2/memory/1200-297-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp	xmrig
behavioral2/memory/208-334-0x00007FF660B30000-0x00007FF660F22000-memory.dmp	xmrig
behavioral2/memory/1616-336-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp	xmrig
behavioral2/memory/3404-338-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	xmrig
behavioral2/memory/3900-350-0x00007FF62E440000-0x00007FF62E832000-memory.dmp	xmrig
behavioral2/memory/1212-356-0x00007FF673030000-0x00007FF673422000-memory.dmp	xmrig
behavioral2/memory/4912-389-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp	xmrig
behavioral2/memory/2496-415-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp	xmrig
behavioral2/memory/4284-420-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp	xmrig
behavioral2/memory/4796-3621-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp	xmrig
behavioral2/memory/3400-3634-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp	xmrig
behavioral2/memory/208-3685-0x00007FF660B30000-0x00007FF660F22000-memory.dmp	xmrig
behavioral2/memory/1616-3705-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp	xmrig
behavioral2/memory/2428-4174-0x00007FF7C6590000-0x00007FF7C6982000-memory.dmp	xmrig
behavioral2/memory/1212-3729-0x00007FF673030000-0x00007FF673422000-memory.dmp	xmrig
behavioral2/memory/2624-3725-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp	xmrig
behavioral2/memory/3404-3719-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	xmrig
behavioral2/memory/3900-3715-0x00007FF62E440000-0x00007FF62E832000-memory.dmp	xmrig
behavioral2/memory/4156-3709-0x00007FF786E30000-0x00007FF787222000-memory.dmp	xmrig
behavioral2/memory/2496-3701-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp	xmrig
behavioral2/memory/4284-3697-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp	xmrig
behavioral2/memory/2568-3691-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp	xmrig
behavioral2/memory/1200-3679-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp	xmrig
behavioral2/memory/884-3668-0x00007FF639B80000-0x00007FF639F72000-memory.dmp	xmrig
behavioral2/memory/404-3661-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp	xmrig
behavioral2/memory/4768-3655-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	xmrig
behavioral2/memory/4848-3652-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp	xmrig
behavioral2/memory/4912-3647-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp	xmrig
behavioral2/memory/1860-3641-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp	xmrig
behavioral2/memory/3168-3629-0x00007FF6B4D30000-0x00007FF6B5122000-memory.dmp	xmrig
behavioral2/memory/4388-3616-0x00007FF6A5560000-0x00007FF6A5952000-memory.dmp	xmrig
behavioral2/memory/4796-386-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp	xmrig
behavioral2/memory/4156-337-0x00007FF786E30000-0x00007FF787222000-memory.dmp	xmrig
behavioral2/memory/2624-326-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp	xmrig
behavioral2/memory/884-302-0x00007FF639B80000-0x00007FF639F72000-memory.dmp	xmrig
behavioral2/memory/1860-208-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp	xmrig
behavioral2/memory/4768-187-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	xmrig
behavioral2/memory/4388-118-0x00007FF6A5560000-0x00007FF6A5952000-memory.dmp	xmrig
behavioral2/memory/4680-94-0x00007FF7DFDC0000-0x00007FF7E01B2000-memory.dmp	xmrig
behavioral2/memory/3744-73-0x00007FF6D54D0000-0x00007FF6D58C2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4992	powershell.exe
12	4992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4368	QuamXsE.exe
3168	pqzuKov.exe
3744	UFkgUtu.exe
4680	XcqltRr.exe
4388	aUDgIMY.exe
4796	MiNmYEJ.exe
4768	QuybopT.exe
1860	QuYNTQn.exe
4848	GulFOGJ.exe
404	cYYtOhN.exe
4912	MoEPCvy.exe
3400	rrRywDl.exe
2568	qrrfDBS.exe
2496	VAlNTvs.exe
1200	DWobBic.exe
884	sTFnJOG.exe
2624	HBgbvWi.exe
208	LRBHvTu.exe
4284	fKQQcxP.exe
1616	DkoyrbU.exe
4156	cgLPHTe.exe
3404	FpSfFqE.exe
3900	nOfIACs.exe
1212	KfLvSkE.exe
3732	CJOeppv.exe
232	nnBTQMv.exe
4076	urhsbXP.exe
1552	qFYRGgo.exe
4836	XaFStZC.exe
3136	OhadHgS.exe
4516	YxPmNHY.exe
3888	ajHbfCf.exe
408	qkZNucy.exe
4184	eSQlKkb.exe
4556	lBRAUhH.exe
4288	iNrSoAQ.exe
4520	lSjZKbR.exe
4620	WudVPWU.exe
1956	QRgYeSu.exe
2008	bQLkPkb.exe
3956	lKiqtMl.exe
2232	LMDQImQ.exe
920	IwfbiVg.exe
4988	jcRPAdd.exe
3964	wpkrWKN.exe
4376	qdrNiTJ.exe
388	OiwyEDK.exe
324	wnXTaen.exe
2392	isISzcX.exe
5048	YWRKFpD.exe
380	NMChuHl.exe
4572	UpStOEs.exe
4824	IoQMIZp.exe
1228	CPVZpDP.exe
880	gpElONf.exe
2276	MVSXclY.exe
2980	OVuijrr.exe
5128	jiiFJvl.exe
5144	KyHNBeL.exe
5196	QeVzPvc.exe
5256	BKYBrNR.exe
5272	RrpTlDJ.exe
5236	iqpGOiw.exe
5600	WWzqewz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2428-0-0x00007FF7C6590000-0x00007FF7C6982000-memory.dmp	upx
behavioral2/files/0x000900000001e600-8.dat	upx
behavioral2/files/0x0008000000023393-18.dat	upx
behavioral2/files/0x0008000000023396-27.dat	upx
behavioral2/files/0x00080000000233a6-44.dat	upx
behavioral2/files/0x00090000000233ab-52.dat	upx
behavioral2/files/0x00080000000233aa-64.dat	upx
behavioral2/files/0x0007000000023444-82.dat	upx
behavioral2/files/0x0007000000023447-154.dat	upx
behavioral2/memory/4848-221-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp	upx
behavioral2/memory/404-244-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp	upx
behavioral2/memory/3400-254-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp	upx
behavioral2/memory/2568-281-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp	upx
behavioral2/memory/1200-297-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp	upx
behavioral2/memory/208-334-0x00007FF660B30000-0x00007FF660F22000-memory.dmp	upx
behavioral2/memory/1616-336-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp	upx
behavioral2/memory/3404-338-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	upx
behavioral2/memory/3900-350-0x00007FF62E440000-0x00007FF62E832000-memory.dmp	upx
behavioral2/memory/1212-356-0x00007FF673030000-0x00007FF673422000-memory.dmp	upx
behavioral2/memory/4912-389-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp	upx
behavioral2/memory/2496-415-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp	upx
behavioral2/memory/4284-420-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp	upx
behavioral2/memory/4796-3621-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp	upx
behavioral2/memory/3400-3634-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp	upx
behavioral2/memory/208-3685-0x00007FF660B30000-0x00007FF660F22000-memory.dmp	upx
behavioral2/memory/1616-3705-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp	upx
behavioral2/memory/2428-4174-0x00007FF7C6590000-0x00007FF7C6982000-memory.dmp	upx
behavioral2/memory/1212-3729-0x00007FF673030000-0x00007FF673422000-memory.dmp	upx
behavioral2/memory/2624-3725-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp	upx
behavioral2/memory/3404-3719-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp	upx
behavioral2/memory/3900-3715-0x00007FF62E440000-0x00007FF62E832000-memory.dmp	upx
behavioral2/memory/4156-3709-0x00007FF786E30000-0x00007FF787222000-memory.dmp	upx
behavioral2/memory/2496-3701-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp	upx
behavioral2/memory/4284-3697-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp	upx
behavioral2/memory/2568-3691-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp	upx
behavioral2/memory/1200-3679-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp	upx
behavioral2/memory/884-3668-0x00007FF639B80000-0x00007FF639F72000-memory.dmp	upx
behavioral2/memory/404-3661-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp	upx
behavioral2/memory/4768-3655-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	upx
behavioral2/memory/4848-3652-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp	upx
behavioral2/memory/4912-3647-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp	upx
behavioral2/memory/1860-3641-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp	upx
behavioral2/memory/3168-3629-0x00007FF6B4D30000-0x00007FF6B5122000-memory.dmp	upx
behavioral2/memory/4388-3616-0x00007FF6A5560000-0x00007FF6A5952000-memory.dmp	upx
behavioral2/memory/4796-386-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp	upx
behavioral2/memory/4156-337-0x00007FF786E30000-0x00007FF787222000-memory.dmp	upx
behavioral2/memory/2624-326-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp	upx
behavioral2/memory/884-302-0x00007FF639B80000-0x00007FF639F72000-memory.dmp	upx
behavioral2/memory/1860-208-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp	upx
behavioral2/files/0x000700000002345b-206.dat	upx
behavioral2/files/0x000700000002345a-205.dat	upx
behavioral2/files/0x0007000000023455-190.dat	upx
behavioral2/memory/4768-187-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-186.dat	upx
behavioral2/files/0x000700000002344b-177.dat	upx
behavioral2/files/0x000700000002344a-175.dat	upx
behavioral2/files/0x0007000000023449-169.dat	upx
behavioral2/files/0x0007000000023448-165.dat	upx
behavioral2/files/0x0007000000023453-158.dat	upx
behavioral2/files/0x0007000000023459-204.dat	upx
behavioral2/files/0x0007000000023452-150.dat	upx
behavioral2/files/0x0007000000023446-144.dat	upx
behavioral2/files/0x0007000000023445-141.dat	upx
behavioral2/files/0x0007000000023458-199.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hzTdKYD.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\QWcWwAM.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\OooXWiN.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\hYyZrre.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\axuKkQE.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\mFrwnoS.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\UVecghT.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\oQpBtoC.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ykweDKB.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\SutaKYE.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\sxiYEyL.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\WdXFgDD.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\wQfFcAm.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\IifxlZZ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\OzpVwuG.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\INNCNWX.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\YdRsRmt.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\OlVorwV.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\NSZlAqu.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\KAYSTHJ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\UKePtxy.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\YBOuBGY.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\MVSXclY.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\hieXGtq.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\FfwVreK.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\RraZQqj.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\eiPvPEn.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\XqIEawd.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\EVaGmZf.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\VvHuiyM.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\mqZIDRo.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ZqltrCp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\nnyXxRx.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\QGYsmxE.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\CNqmyrP.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\JHNRtEs.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\RIJraeJ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\jjSVocW.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\fvZeImA.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\XZMdpzQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\yceTafS.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\defNSJc.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\FEnbHNm.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\xrwmPWE.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\JKIvEZO.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\CIzmlYv.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\zwFSkkp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\sPCgCDf.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\HrSOjhf.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\gGnqOCS.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\UxuerBr.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\IfXWdpa.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\caVjxUg.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ErQdKkv.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\CpVYXTa.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\LQRiXeG.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\qwDUaOv.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ykBaUJA.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\sJzjMvd.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\sLxLrzz.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\nImtHMD.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ZOjqOTO.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\jJEuzjK.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\mYqKpDQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Token: SeDebugPrivilege	4992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4992	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	87
PID 2428 wrote to memory of 4992	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	87
PID 2428 wrote to memory of 4368	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	88
PID 2428 wrote to memory of 4368	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	88
PID 2428 wrote to memory of 3168	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	89
PID 2428 wrote to memory of 3168	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	89
PID 2428 wrote to memory of 4680	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	90
PID 2428 wrote to memory of 4680	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	90
PID 2428 wrote to memory of 3744	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	91
PID 2428 wrote to memory of 3744	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	91
PID 2428 wrote to memory of 4388	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	92
PID 2428 wrote to memory of 4388	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	92
PID 2428 wrote to memory of 4796	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	93
PID 2428 wrote to memory of 4796	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	93
PID 2428 wrote to memory of 4768	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	94
PID 2428 wrote to memory of 4768	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	94
PID 2428 wrote to memory of 1860	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	95
PID 2428 wrote to memory of 1860	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	95
PID 2428 wrote to memory of 4848	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	96
PID 2428 wrote to memory of 4848	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	96
PID 2428 wrote to memory of 3400	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	97
PID 2428 wrote to memory of 3400	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	97
PID 2428 wrote to memory of 404	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	98
PID 2428 wrote to memory of 404	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	98
PID 2428 wrote to memory of 4912	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	99
PID 2428 wrote to memory of 4912	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	99
PID 2428 wrote to memory of 2568	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	100
PID 2428 wrote to memory of 2568	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	100
PID 2428 wrote to memory of 1200	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	101
PID 2428 wrote to memory of 1200	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	101
PID 2428 wrote to memory of 884	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	102
PID 2428 wrote to memory of 884	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	102
PID 2428 wrote to memory of 2496	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	103
PID 2428 wrote to memory of 2496	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	103
PID 2428 wrote to memory of 2624	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	104
PID 2428 wrote to memory of 2624	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	104
PID 2428 wrote to memory of 208	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	105
PID 2428 wrote to memory of 208	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	105
PID 2428 wrote to memory of 4284	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	106
PID 2428 wrote to memory of 4284	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	106
PID 2428 wrote to memory of 1616	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	107
PID 2428 wrote to memory of 1616	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	107
PID 2428 wrote to memory of 4156	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	108
PID 2428 wrote to memory of 4156	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	108
PID 2428 wrote to memory of 3404	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	109
PID 2428 wrote to memory of 3404	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	109
PID 2428 wrote to memory of 3900	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	110
PID 2428 wrote to memory of 3900	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	110
PID 2428 wrote to memory of 1212	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	111
PID 2428 wrote to memory of 1212	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	111
PID 2428 wrote to memory of 3136	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	112
PID 2428 wrote to memory of 3136	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	112
PID 2428 wrote to memory of 3732	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	113
PID 2428 wrote to memory of 3732	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	113
PID 2428 wrote to memory of 232	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	114
PID 2428 wrote to memory of 232	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	114
PID 2428 wrote to memory of 4076	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	115
PID 2428 wrote to memory of 4076	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	115
PID 2428 wrote to memory of 1552	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	116
PID 2428 wrote to memory of 1552	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	116
PID 2428 wrote to memory of 4836	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	117
PID 2428 wrote to memory of 4836	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	117
PID 2428 wrote to memory of 4516	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	118
PID 2428 wrote to memory of 4516	2428	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	118

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\3504731525\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\3504731525\zmstage.exe
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4992" "2972" "2908" "2976" "0" "0" "2980" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13692
- C:\Windows\System\QuamXsE.exe
  C:\Windows\System\QuamXsE.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\pqzuKov.exe
  C:\Windows\System\pqzuKov.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\XcqltRr.exe
  C:\Windows\System\XcqltRr.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\UFkgUtu.exe
  C:\Windows\System\UFkgUtu.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\aUDgIMY.exe
  C:\Windows\System\aUDgIMY.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\MiNmYEJ.exe
  C:\Windows\System\MiNmYEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\QuybopT.exe
  C:\Windows\System\QuybopT.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\QuYNTQn.exe
  C:\Windows\System\QuYNTQn.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\GulFOGJ.exe
  C:\Windows\System\GulFOGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\rrRywDl.exe
  C:\Windows\System\rrRywDl.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\cYYtOhN.exe
  C:\Windows\System\cYYtOhN.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\MoEPCvy.exe
  C:\Windows\System\MoEPCvy.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\qrrfDBS.exe
  C:\Windows\System\qrrfDBS.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\DWobBic.exe
  C:\Windows\System\DWobBic.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\sTFnJOG.exe
  C:\Windows\System\sTFnJOG.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\VAlNTvs.exe
  C:\Windows\System\VAlNTvs.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\HBgbvWi.exe
  C:\Windows\System\HBgbvWi.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\LRBHvTu.exe
  C:\Windows\System\LRBHvTu.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\fKQQcxP.exe
  C:\Windows\System\fKQQcxP.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\DkoyrbU.exe
  C:\Windows\System\DkoyrbU.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\cgLPHTe.exe
  C:\Windows\System\cgLPHTe.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\FpSfFqE.exe
  C:\Windows\System\FpSfFqE.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\nOfIACs.exe
  C:\Windows\System\nOfIACs.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\KfLvSkE.exe
  C:\Windows\System\KfLvSkE.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\OhadHgS.exe
  C:\Windows\System\OhadHgS.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\CJOeppv.exe
  C:\Windows\System\CJOeppv.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\nnBTQMv.exe
  C:\Windows\System\nnBTQMv.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\urhsbXP.exe
  C:\Windows\System\urhsbXP.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\qFYRGgo.exe
  C:\Windows\System\qFYRGgo.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\XaFStZC.exe
  C:\Windows\System\XaFStZC.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\YxPmNHY.exe
  C:\Windows\System\YxPmNHY.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ajHbfCf.exe
  C:\Windows\System\ajHbfCf.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\isISzcX.exe
  C:\Windows\System\isISzcX.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qkZNucy.exe
  C:\Windows\System\qkZNucy.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\eSQlKkb.exe
  C:\Windows\System\eSQlKkb.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\lBRAUhH.exe
  C:\Windows\System\lBRAUhH.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\iNrSoAQ.exe
  C:\Windows\System\iNrSoAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\lSjZKbR.exe
  C:\Windows\System\lSjZKbR.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\WudVPWU.exe
  C:\Windows\System\WudVPWU.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\QRgYeSu.exe
  C:\Windows\System\QRgYeSu.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\bQLkPkb.exe
  C:\Windows\System\bQLkPkb.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\lKiqtMl.exe
  C:\Windows\System\lKiqtMl.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\LMDQImQ.exe
  C:\Windows\System\LMDQImQ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\IwfbiVg.exe
  C:\Windows\System\IwfbiVg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\jcRPAdd.exe
  C:\Windows\System\jcRPAdd.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\wpkrWKN.exe
  C:\Windows\System\wpkrWKN.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\qdrNiTJ.exe
  C:\Windows\System\qdrNiTJ.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\OiwyEDK.exe
  C:\Windows\System\OiwyEDK.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\wnXTaen.exe
  C:\Windows\System\wnXTaen.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\YWRKFpD.exe
  C:\Windows\System\YWRKFpD.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\NMChuHl.exe
  C:\Windows\System\NMChuHl.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\UpStOEs.exe
  C:\Windows\System\UpStOEs.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\IoQMIZp.exe
  C:\Windows\System\IoQMIZp.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\gpElONf.exe
  C:\Windows\System\gpElONf.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\CPVZpDP.exe
  C:\Windows\System\CPVZpDP.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\MVSXclY.exe
  C:\Windows\System\MVSXclY.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\OVuijrr.exe
  C:\Windows\System\OVuijrr.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\jiiFJvl.exe
  C:\Windows\System\jiiFJvl.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\KyHNBeL.exe
  C:\Windows\System\KyHNBeL.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\QeVzPvc.exe
  C:\Windows\System\QeVzPvc.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\iqpGOiw.exe
  C:\Windows\System\iqpGOiw.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\BKYBrNR.exe
  C:\Windows\System\BKYBrNR.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\RrpTlDJ.exe
  C:\Windows\System\RrpTlDJ.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\rXurtZf.exe
  C:\Windows\System\rXurtZf.exe
  2⤵
  PID:5584
- C:\Windows\System\WWzqewz.exe
  C:\Windows\System\WWzqewz.exe
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Windows\System\iJpShNF.exe
  C:\Windows\System\iJpShNF.exe
  2⤵
  PID:5616
- C:\Windows\System\bAwBWxW.exe
  C:\Windows\System\bAwBWxW.exe
  2⤵
  PID:5632
- C:\Windows\System\xirGLYm.exe
  C:\Windows\System\xirGLYm.exe
  2⤵
  PID:5648
- C:\Windows\System\fMZUnwJ.exe
  C:\Windows\System\fMZUnwJ.exe
  2⤵
  PID:5664
- C:\Windows\System\sTaOjSb.exe
  C:\Windows\System\sTaOjSb.exe
  2⤵
  PID:5680
- C:\Windows\System\RfqYcuL.exe
  C:\Windows\System\RfqYcuL.exe
  2⤵
  PID:5696
- C:\Windows\System\vdZknQN.exe
  C:\Windows\System\vdZknQN.exe
  2⤵
  PID:5712
- C:\Windows\System\fTALYGh.exe
  C:\Windows\System\fTALYGh.exe
  2⤵
  PID:5728
- C:\Windows\System\LuvZurt.exe
  C:\Windows\System\LuvZurt.exe
  2⤵
  PID:5748
- C:\Windows\System\sHzPQgo.exe
  C:\Windows\System\sHzPQgo.exe
  2⤵
  PID:5764
- C:\Windows\System\lRSCItk.exe
  C:\Windows\System\lRSCItk.exe
  2⤵
  PID:5812
- C:\Windows\System\XtBAhnS.exe
  C:\Windows\System\XtBAhnS.exe
  2⤵
  PID:5836
- C:\Windows\System\wDvLynN.exe
  C:\Windows\System\wDvLynN.exe
  2⤵
  PID:5852
- C:\Windows\System\prVUZNc.exe
  C:\Windows\System\prVUZNc.exe
  2⤵
  PID:5988
- C:\Windows\System\mYSBhTk.exe
  C:\Windows\System\mYSBhTk.exe
  2⤵
  PID:6008
- C:\Windows\System\ZXpjWyd.exe
  C:\Windows\System\ZXpjWyd.exe
  2⤵
  PID:6036
- C:\Windows\System\xoNZxnc.exe
  C:\Windows\System\xoNZxnc.exe
  2⤵
  PID:6052
- C:\Windows\System\FUbFclf.exe
  C:\Windows\System\FUbFclf.exe
  2⤵
  PID:6068
- C:\Windows\System\lBEOftt.exe
  C:\Windows\System\lBEOftt.exe
  2⤵
  PID:6088
- C:\Windows\System\wEbolFi.exe
  C:\Windows\System\wEbolFi.exe
  2⤵
  PID:6108
- C:\Windows\System\UAavgBe.exe
  C:\Windows\System\UAavgBe.exe
  2⤵
  PID:2892
- C:\Windows\System\RuyyVgo.exe
  C:\Windows\System\RuyyVgo.exe
  2⤵
  PID:1604
- C:\Windows\System\dOkZqfy.exe
  C:\Windows\System\dOkZqfy.exe
  2⤵
  PID:4496
- C:\Windows\System\QZWoNhu.exe
  C:\Windows\System\QZWoNhu.exe
  2⤵
  PID:5180
- C:\Windows\System\DVrtchc.exe
  C:\Windows\System\DVrtchc.exe
  2⤵
  PID:5232
- C:\Windows\System\MEsODPG.exe
  C:\Windows\System\MEsODPG.exe
  2⤵
  PID:5268
- C:\Windows\System\zHwdDrE.exe
  C:\Windows\System\zHwdDrE.exe
  2⤵
  PID:5304
- C:\Windows\System\Xcadwdw.exe
  C:\Windows\System\Xcadwdw.exe
  2⤵
  PID:988
- C:\Windows\System\ASbfffI.exe
  C:\Windows\System\ASbfffI.exe
  2⤵
  PID:5408
- C:\Windows\System\pKZPdux.exe
  C:\Windows\System\pKZPdux.exe
  2⤵
  PID:5420
- C:\Windows\System\WWSQVYV.exe
  C:\Windows\System\WWSQVYV.exe
  2⤵
  PID:5496
- C:\Windows\System\NaNkIiO.exe
  C:\Windows\System\NaNkIiO.exe
  2⤵
  PID:5544
- C:\Windows\System\WteIHEa.exe
  C:\Windows\System\WteIHEa.exe
  2⤵
  PID:5804
- C:\Windows\System\zhWwmUP.exe
  C:\Windows\System\zhWwmUP.exe
  2⤵
  PID:5608
- C:\Windows\System\HUPExCX.exe
  C:\Windows\System\HUPExCX.exe
  2⤵
  PID:5656
- C:\Windows\System\vWDncqE.exe
  C:\Windows\System\vWDncqE.exe
  2⤵
  PID:2492
- C:\Windows\System\dhXqKYT.exe
  C:\Windows\System\dhXqKYT.exe
  2⤵
  PID:5032
- C:\Windows\System\GzfpnEu.exe
  C:\Windows\System\GzfpnEu.exe
  2⤵
  PID:6064
- C:\Windows\System\YCqPFmR.exe
  C:\Windows\System\YCqPFmR.exe
  2⤵
  PID:5880
- C:\Windows\System\nYASNkJ.exe
  C:\Windows\System\nYASNkJ.exe
  2⤵
  PID:5960
- C:\Windows\System\hBKavGt.exe
  C:\Windows\System\hBKavGt.exe
  2⤵
  PID:6020
- C:\Windows\System\LNcMHOO.exe
  C:\Windows\System\LNcMHOO.exe
  2⤵
  PID:6080
- C:\Windows\System\DpDLtsE.exe
  C:\Windows\System\DpDLtsE.exe
  2⤵
  PID:4100
- C:\Windows\System\FCrTFHG.exe
  C:\Windows\System\FCrTFHG.exe
  2⤵
  PID:1772
- C:\Windows\System\rKQzKYx.exe
  C:\Windows\System\rKQzKYx.exe
  2⤵
  PID:5076
- C:\Windows\System\Nbucpgz.exe
  C:\Windows\System\Nbucpgz.exe
  2⤵
  PID:516
- C:\Windows\System\bbPuXpq.exe
  C:\Windows\System\bbPuXpq.exe
  2⤵
  PID:4700
- C:\Windows\System\nOyJHYO.exe
  C:\Windows\System\nOyJHYO.exe
  2⤵
  PID:5140
- C:\Windows\System\nYabrlt.exe
  C:\Windows\System\nYabrlt.exe
  2⤵
  PID:5628
- C:\Windows\System\NiJJwre.exe
  C:\Windows\System\NiJJwre.exe
  2⤵
  PID:5692
- C:\Windows\System\bvFwVkB.exe
  C:\Windows\System\bvFwVkB.exe
  2⤵
  PID:5388
- C:\Windows\System\sAuPjoY.exe
  C:\Windows\System\sAuPjoY.exe
  2⤵
  PID:5564
- C:\Windows\System\IaHunGI.exe
  C:\Windows\System\IaHunGI.exe
  2⤵
  PID:5860
- C:\Windows\System\fTiTJiw.exe
  C:\Windows\System\fTiTJiw.exe
  2⤵
  PID:5948
- C:\Windows\System\tevsLrL.exe
  C:\Windows\System\tevsLrL.exe
  2⤵
  PID:6060
- C:\Windows\System\PxOoRpp.exe
  C:\Windows\System\PxOoRpp.exe
  2⤵
  PID:4144
- C:\Windows\System\wuupdpd.exe
  C:\Windows\System\wuupdpd.exe
  2⤵
  PID:1308
- C:\Windows\System\nnJVZep.exe
  C:\Windows\System\nnJVZep.exe
  2⤵
  PID:5596
- C:\Windows\System\RORXDsk.exe
  C:\Windows\System\RORXDsk.exe
  2⤵
  PID:6160
- C:\Windows\System\oEbVIzV.exe
  C:\Windows\System\oEbVIzV.exe
  2⤵
  PID:6184
- C:\Windows\System\tJDTAEw.exe
  C:\Windows\System\tJDTAEw.exe
  2⤵
  PID:6280
- C:\Windows\System\virxARi.exe
  C:\Windows\System\virxARi.exe
  2⤵
  PID:6300
- C:\Windows\System\TXsKMAx.exe
  C:\Windows\System\TXsKMAx.exe
  2⤵
  PID:6328
- C:\Windows\System\rqcGJFP.exe
  C:\Windows\System\rqcGJFP.exe
  2⤵
  PID:6440
- C:\Windows\System\EpOcMVR.exe
  C:\Windows\System\EpOcMVR.exe
  2⤵
  PID:6460
- C:\Windows\System\TaSkRcf.exe
  C:\Windows\System\TaSkRcf.exe
  2⤵
  PID:6476
- C:\Windows\System\HaFFVwa.exe
  C:\Windows\System\HaFFVwa.exe
  2⤵
  PID:6500
- C:\Windows\System\AezWDUd.exe
  C:\Windows\System\AezWDUd.exe
  2⤵
  PID:6516
- C:\Windows\System\VMSiBOG.exe
  C:\Windows\System\VMSiBOG.exe
  2⤵
  PID:6540
- C:\Windows\System\AvElswX.exe
  C:\Windows\System\AvElswX.exe
  2⤵
  PID:6560
- C:\Windows\System\aoXJEjm.exe
  C:\Windows\System\aoXJEjm.exe
  2⤵
  PID:6580
- C:\Windows\System\WDKthjp.exe
  C:\Windows\System\WDKthjp.exe
  2⤵
  PID:6600
- C:\Windows\System\vZdKYzI.exe
  C:\Windows\System\vZdKYzI.exe
  2⤵
  PID:6632
- C:\Windows\System\QwXQINJ.exe
  C:\Windows\System\QwXQINJ.exe
  2⤵
  PID:6656
- C:\Windows\System\XFcevdO.exe
  C:\Windows\System\XFcevdO.exe
  2⤵
  PID:6680
- C:\Windows\System\vxwMNsV.exe
  C:\Windows\System\vxwMNsV.exe
  2⤵
  PID:6712
- C:\Windows\System\KjIkKdP.exe
  C:\Windows\System\KjIkKdP.exe
  2⤵
  PID:6728
- C:\Windows\System\dtTdRlG.exe
  C:\Windows\System\dtTdRlG.exe
  2⤵
  PID:6756
- C:\Windows\System\LGsXpnj.exe
  C:\Windows\System\LGsXpnj.exe
  2⤵
  PID:6780
- C:\Windows\System\tELvMIf.exe
  C:\Windows\System\tELvMIf.exe
  2⤵
  PID:6796
- C:\Windows\System\CkWBauA.exe
  C:\Windows\System\CkWBauA.exe
  2⤵
  PID:6816
- C:\Windows\System\qsywqNu.exe
  C:\Windows\System\qsywqNu.exe
  2⤵
  PID:6832
- C:\Windows\System\RkmPHQm.exe
  C:\Windows\System\RkmPHQm.exe
  2⤵
  PID:6852
- C:\Windows\System\QxTMhiZ.exe
  C:\Windows\System\QxTMhiZ.exe
  2⤵
  PID:6884
- C:\Windows\System\oetnWNk.exe
  C:\Windows\System\oetnWNk.exe
  2⤵
  PID:6912
- C:\Windows\System\wZkMGIc.exe
  C:\Windows\System\wZkMGIc.exe
  2⤵
  PID:6928
- C:\Windows\System\ralMMou.exe
  C:\Windows\System\ralMMou.exe
  2⤵
  PID:6964
- C:\Windows\System\vsjDXnW.exe
  C:\Windows\System\vsjDXnW.exe
  2⤵
  PID:6980
- C:\Windows\System\sSWNkxI.exe
  C:\Windows\System\sSWNkxI.exe
  2⤵
  PID:7004
- C:\Windows\System\VLQWccc.exe
  C:\Windows\System\VLQWccc.exe
  2⤵
  PID:7020
- C:\Windows\System\aGpijUf.exe
  C:\Windows\System\aGpijUf.exe
  2⤵
  PID:7044
- C:\Windows\System\LVAYEtv.exe
  C:\Windows\System\LVAYEtv.exe
  2⤵
  PID:7060
- C:\Windows\System\jxghYLO.exe
  C:\Windows\System\jxghYLO.exe
  2⤵
  PID:7084
- C:\Windows\System\IyiDxTy.exe
  C:\Windows\System\IyiDxTy.exe
  2⤵
  PID:7100
- C:\Windows\System\WHWjcdr.exe
  C:\Windows\System\WHWjcdr.exe
  2⤵
  PID:7128
- C:\Windows\System\PnICYKK.exe
  C:\Windows\System\PnICYKK.exe
  2⤵
  PID:7148
- C:\Windows\System\JHNRtEs.exe
  C:\Windows\System\JHNRtEs.exe
  2⤵
  PID:4624
- C:\Windows\System\txoRASR.exe
  C:\Windows\System\txoRASR.exe
  2⤵
  PID:1908
- C:\Windows\System\SJQBJZT.exe
  C:\Windows\System\SJQBJZT.exe
  2⤵
  PID:4712
- C:\Windows\System\gcoepPv.exe
  C:\Windows\System\gcoepPv.exe
  2⤵
  PID:5220
- C:\Windows\System\DvToHau.exe
  C:\Windows\System\DvToHau.exe
  2⤵
  PID:5540
- C:\Windows\System\XueXaeM.exe
  C:\Windows\System\XueXaeM.exe
  2⤵
  PID:4876
- C:\Windows\System\BwInhcH.exe
  C:\Windows\System\BwInhcH.exe
  2⤵
  PID:5832
- C:\Windows\System\NQAYCCr.exe
  C:\Windows\System\NQAYCCr.exe
  2⤵
  PID:2416
- C:\Windows\System\NircCDD.exe
  C:\Windows\System\NircCDD.exe
  2⤵
  PID:1372
- C:\Windows\System\HqGCnNL.exe
  C:\Windows\System\HqGCnNL.exe
  2⤵
  PID:6176
- C:\Windows\System\hpRvDgc.exe
  C:\Windows\System\hpRvDgc.exe
  2⤵
  PID:540
- C:\Windows\System\kcbyEvf.exe
  C:\Windows\System\kcbyEvf.exe
  2⤵
  PID:1520
- C:\Windows\System\AdGcSHN.exe
  C:\Windows\System\AdGcSHN.exe
  2⤵
  PID:6272
- C:\Windows\System\dvYPnbV.exe
  C:\Windows\System\dvYPnbV.exe
  2⤵
  PID:3640
- C:\Windows\System\vdfhYeQ.exe
  C:\Windows\System\vdfhYeQ.exe
  2⤵
  PID:1968
- C:\Windows\System\zNQzjcx.exe
  C:\Windows\System\zNQzjcx.exe
  2⤵
  PID:6472
- C:\Windows\System\iCHTmLv.exe
  C:\Windows\System\iCHTmLv.exe
  2⤵
  PID:6528
- C:\Windows\System\cQgzFfD.exe
  C:\Windows\System\cQgzFfD.exe
  2⤵
  PID:4456
- C:\Windows\System\UsPCnZP.exe
  C:\Windows\System\UsPCnZP.exe
  2⤵
  PID:6532
- C:\Windows\System\syIMHzF.exe
  C:\Windows\System\syIMHzF.exe
  2⤵
  PID:6644
- C:\Windows\System\NSlozVH.exe
  C:\Windows\System\NSlozVH.exe
  2⤵
  PID:6672
- C:\Windows\System\FpmNiOX.exe
  C:\Windows\System\FpmNiOX.exe
  2⤵
  PID:6880
- C:\Windows\System\ZNdXgkV.exe
  C:\Windows\System\ZNdXgkV.exe
  2⤵
  PID:6804
- C:\Windows\System\dzxzjvM.exe
  C:\Windows\System\dzxzjvM.exe
  2⤵
  PID:6824
- C:\Windows\System\VcrmaeN.exe
  C:\Windows\System\VcrmaeN.exe
  2⤵
  PID:7040
- C:\Windows\System\AOzWjBP.exe
  C:\Windows\System\AOzWjBP.exe
  2⤵
  PID:7096
- C:\Windows\System\CgfYCJA.exe
  C:\Windows\System\CgfYCJA.exe
  2⤵
  PID:6972
- C:\Windows\System\KjBWDul.exe
  C:\Windows\System\KjBWDul.exe
  2⤵
  PID:896
- C:\Windows\System\fMJcFEl.exe
  C:\Windows\System\fMJcFEl.exe
  2⤵
  PID:6260
- C:\Windows\System\jggEBMc.exe
  C:\Windows\System\jggEBMc.exe
  2⤵
  PID:5808
- C:\Windows\System\OcKmkzq.exe
  C:\Windows\System\OcKmkzq.exe
  2⤵
  PID:7052
- C:\Windows\System\hkeCbrb.exe
  C:\Windows\System\hkeCbrb.exe
  2⤵
  PID:6156
- C:\Windows\System\NuRsCdd.exe
  C:\Windows\System\NuRsCdd.exe
  2⤵
  PID:2664
- C:\Windows\System\aMEdSiz.exe
  C:\Windows\System\aMEdSiz.exe
  2⤵
  PID:4196
- C:\Windows\System\HBVnzCv.exe
  C:\Windows\System\HBVnzCv.exe
  2⤵
  PID:5436
- C:\Windows\System\lcyzlnv.exe
  C:\Windows\System\lcyzlnv.exe
  2⤵
  PID:2360
- C:\Windows\System\nkBhMKV.exe
  C:\Windows\System\nkBhMKV.exe
  2⤵
  PID:4736
- C:\Windows\System\QWdufPD.exe
  C:\Windows\System\QWdufPD.exe
  2⤵
  PID:5068
- C:\Windows\System\QZCJjpF.exe
  C:\Windows\System\QZCJjpF.exe
  2⤵
  PID:6492
- C:\Windows\System\iaTeeBZ.exe
  C:\Windows\System\iaTeeBZ.exe
  2⤵
  PID:4308
- C:\Windows\System\WiQBgle.exe
  C:\Windows\System\WiQBgle.exe
  2⤵
  PID:220
- C:\Windows\System\YKjDBWl.exe
  C:\Windows\System\YKjDBWl.exe
  2⤵
  PID:6864
- C:\Windows\System\kcMytOQ.exe
  C:\Windows\System\kcMytOQ.exe
  2⤵
  PID:6592
- C:\Windows\System\nqPOCAX.exe
  C:\Windows\System\nqPOCAX.exe
  2⤵
  PID:1864
- C:\Windows\System\aaIkiNO.exe
  C:\Windows\System\aaIkiNO.exe
  2⤵
  PID:7176
- C:\Windows\System\pnMOdSN.exe
  C:\Windows\System\pnMOdSN.exe
  2⤵
  PID:7200
- C:\Windows\System\fUurrBx.exe
  C:\Windows\System\fUurrBx.exe
  2⤵
  PID:7224
- C:\Windows\System\qpVYeyv.exe
  C:\Windows\System\qpVYeyv.exe
  2⤵
  PID:7248
- C:\Windows\System\vWMgbQT.exe
  C:\Windows\System\vWMgbQT.exe
  2⤵
  PID:7268
- C:\Windows\System\rdKRZss.exe
  C:\Windows\System\rdKRZss.exe
  2⤵
  PID:7292
- C:\Windows\System\TDfrjEI.exe
  C:\Windows\System\TDfrjEI.exe
  2⤵
  PID:7312
- C:\Windows\System\XzYCeLe.exe
  C:\Windows\System\XzYCeLe.exe
  2⤵
  PID:7336
- C:\Windows\System\CgWmVKu.exe
  C:\Windows\System\CgWmVKu.exe
  2⤵
  PID:7356
- C:\Windows\System\hDpWxUR.exe
  C:\Windows\System\hDpWxUR.exe
  2⤵
  PID:7376
- C:\Windows\System\mLjyfhJ.exe
  C:\Windows\System\mLjyfhJ.exe
  2⤵
  PID:7396
- C:\Windows\System\giUCNGa.exe
  C:\Windows\System\giUCNGa.exe
  2⤵
  PID:7428
- C:\Windows\System\IgpwqnL.exe
  C:\Windows\System\IgpwqnL.exe
  2⤵
  PID:7452
- C:\Windows\System\KqBdvVt.exe
  C:\Windows\System\KqBdvVt.exe
  2⤵
  PID:7472
- C:\Windows\System\OooXWiN.exe
  C:\Windows\System\OooXWiN.exe
  2⤵
  PID:7600
- C:\Windows\System\uCykCMc.exe
  C:\Windows\System\uCykCMc.exe
  2⤵
  PID:7620
- C:\Windows\System\IDfitUp.exe
  C:\Windows\System\IDfitUp.exe
  2⤵
  PID:7644
- C:\Windows\System\QOawFco.exe
  C:\Windows\System\QOawFco.exe
  2⤵
  PID:7660
- C:\Windows\System\xAvppaD.exe
  C:\Windows\System\xAvppaD.exe
  2⤵
  PID:7684
- C:\Windows\System\VLewkvv.exe
  C:\Windows\System\VLewkvv.exe
  2⤵
  PID:7708
- C:\Windows\System\PLHQJbA.exe
  C:\Windows\System\PLHQJbA.exe
  2⤵
  PID:7728
- C:\Windows\System\KObxIQD.exe
  C:\Windows\System\KObxIQD.exe
  2⤵
  PID:7752
- C:\Windows\System\Dashduw.exe
  C:\Windows\System\Dashduw.exe
  2⤵
  PID:7776
- C:\Windows\System\ATlnQbZ.exe
  C:\Windows\System\ATlnQbZ.exe
  2⤵
  PID:7796
- C:\Windows\System\yBxejKC.exe
  C:\Windows\System\yBxejKC.exe
  2⤵
  PID:7820
- C:\Windows\System\XVVYFen.exe
  C:\Windows\System\XVVYFen.exe
  2⤵
  PID:7856
- C:\Windows\System\ZAbWvyA.exe
  C:\Windows\System\ZAbWvyA.exe
  2⤵
  PID:7884
- C:\Windows\System\cjCNWsu.exe
  C:\Windows\System\cjCNWsu.exe
  2⤵
  PID:7900
- C:\Windows\System\YnkMTTQ.exe
  C:\Windows\System\YnkMTTQ.exe
  2⤵
  PID:7932
- C:\Windows\System\KttOJIK.exe
  C:\Windows\System\KttOJIK.exe
  2⤵
  PID:7952
- C:\Windows\System\sLvKVOB.exe
  C:\Windows\System\sLvKVOB.exe
  2⤵
  PID:7976
- C:\Windows\System\FczHIvZ.exe
  C:\Windows\System\FczHIvZ.exe
  2⤵
  PID:8000
- C:\Windows\System\fQrEuXy.exe
  C:\Windows\System\fQrEuXy.exe
  2⤵
  PID:8020
- C:\Windows\System\bmVGEDF.exe
  C:\Windows\System\bmVGEDF.exe
  2⤵
  PID:8048
- C:\Windows\System\DbAKerd.exe
  C:\Windows\System\DbAKerd.exe
  2⤵
  PID:8068
- C:\Windows\System\dXtRzNt.exe
  C:\Windows\System\dXtRzNt.exe
  2⤵
  PID:8096
- C:\Windows\System\BOFAaVH.exe
  C:\Windows\System\BOFAaVH.exe
  2⤵
  PID:8116
- C:\Windows\System\rzEnnFd.exe
  C:\Windows\System\rzEnnFd.exe
  2⤵
  PID:8136
- C:\Windows\System\WJHdhjF.exe
  C:\Windows\System\WJHdhjF.exe
  2⤵
  PID:8160
- C:\Windows\System\zAYGVhy.exe
  C:\Windows\System\zAYGVhy.exe
  2⤵
  PID:8180
- C:\Windows\System\Epyuzwq.exe
  C:\Windows\System\Epyuzwq.exe
  2⤵
  PID:7056
- C:\Windows\System\xuAQhXu.exe
  C:\Windows\System\xuAQhXu.exe
  2⤵
  PID:6860
- C:\Windows\System\VJbwqQh.exe
  C:\Windows\System\VJbwqQh.exe
  2⤵
  PID:6764
- C:\Windows\System\UZPeFzn.exe
  C:\Windows\System\UZPeFzn.exe
  2⤵
  PID:6456
- C:\Windows\System\FDASQxK.exe
  C:\Windows\System\FDASQxK.exe
  2⤵
  PID:6000
- C:\Windows\System\UCOiKvT.exe
  C:\Windows\System\UCOiKvT.exe
  2⤵
  PID:7212
- C:\Windows\System\GiMJtEm.exe
  C:\Windows\System\GiMJtEm.exe
  2⤵
  PID:7280
- C:\Windows\System\kKQFvVr.exe
  C:\Windows\System\kKQFvVr.exe
  2⤵
  PID:7324
- C:\Windows\System\CVWqCOK.exe
  C:\Windows\System\CVWqCOK.exe
  2⤵
  PID:6236
- C:\Windows\System\IFfbrEm.exe
  C:\Windows\System\IFfbrEm.exe
  2⤵
  PID:6720
- C:\Windows\System\GzxpKpN.exe
  C:\Windows\System\GzxpKpN.exe
  2⤵
  PID:7188
- C:\Windows\System\MOgmYSU.exe
  C:\Windows\System\MOgmYSU.exe
  2⤵
  PID:7156
- C:\Windows\System\tQAypTq.exe
  C:\Windows\System\tQAypTq.exe
  2⤵
  PID:5592
- C:\Windows\System\VIInskt.exe
  C:\Windows\System\VIInskt.exe
  2⤵
  PID:4048
- C:\Windows\System\JvsWtNw.exe
  C:\Windows\System\JvsWtNw.exe
  2⤵
  PID:7540
- C:\Windows\System\BEhFpoo.exe
  C:\Windows\System\BEhFpoo.exe
  2⤵
  PID:6572
- C:\Windows\System\faKVhUp.exe
  C:\Windows\System\faKVhUp.exe
  2⤵
  PID:7696
- C:\Windows\System\ywZjNss.exe
  C:\Windows\System\ywZjNss.exe
  2⤵
  PID:7764
- C:\Windows\System\eDZWkWr.exe
  C:\Windows\System\eDZWkWr.exe
  2⤵
  PID:7528
- C:\Windows\System\ZxTJfMy.exe
  C:\Windows\System\ZxTJfMy.exe
  2⤵
  PID:1568
- C:\Windows\System\qMTaKry.exe
  C:\Windows\System\qMTaKry.exe
  2⤵
  PID:7584
- C:\Windows\System\ftkZUCQ.exe
  C:\Windows\System\ftkZUCQ.exe
  2⤵
  PID:8112
- C:\Windows\System\tOuJvAc.exe
  C:\Windows\System\tOuJvAc.exe
  2⤵
  PID:7736
- C:\Windows\System\GgQxZsv.exe
  C:\Windows\System\GgQxZsv.exe
  2⤵
  PID:8168
- C:\Windows\System\cEqJiie.exe
  C:\Windows\System\cEqJiie.exe
  2⤵
  PID:6848
- C:\Windows\System\UUILMBE.exe
  C:\Windows\System\UUILMBE.exe
  2⤵
  PID:7500
- C:\Windows\System\vTpluzJ.exe
  C:\Windows\System\vTpluzJ.exe
  2⤵
  PID:7832
- C:\Windows\System\xUFsMBb.exe
  C:\Windows\System\xUFsMBb.exe
  2⤵
  PID:7348
- C:\Windows\System\XMylPqk.exe
  C:\Windows\System\XMylPqk.exe
  2⤵
  PID:6612
- C:\Windows\System\gTeBSCs.exe
  C:\Windows\System\gTeBSCs.exe
  2⤵
  PID:7908
- C:\Windows\System\qBHAPML.exe
  C:\Windows\System\qBHAPML.exe
  2⤵
  PID:7140
- C:\Windows\System\DKeupbl.exe
  C:\Windows\System\DKeupbl.exe
  2⤵
  PID:7532
- C:\Windows\System\yEaKiQJ.exe
  C:\Windows\System\yEaKiQJ.exe
  2⤵
  PID:8216
- C:\Windows\System\jEdtpyy.exe
  C:\Windows\System\jEdtpyy.exe
  2⤵
  PID:8236
- C:\Windows\System\LNtzUZn.exe
  C:\Windows\System\LNtzUZn.exe
  2⤵
  PID:8256
- C:\Windows\System\ijvlqCA.exe
  C:\Windows\System\ijvlqCA.exe
  2⤵
  PID:8280
- C:\Windows\System\UEUJhtI.exe
  C:\Windows\System\UEUJhtI.exe
  2⤵
  PID:8304
- C:\Windows\System\yGCCDoQ.exe
  C:\Windows\System\yGCCDoQ.exe
  2⤵
  PID:8320
- C:\Windows\System\kpKPYuF.exe
  C:\Windows\System\kpKPYuF.exe
  2⤵
  PID:8348
- C:\Windows\System\igiGOqE.exe
  C:\Windows\System\igiGOqE.exe
  2⤵
  PID:8372
- C:\Windows\System\OoxghCd.exe
  C:\Windows\System\OoxghCd.exe
  2⤵
  PID:8388
- C:\Windows\System\udFlsDz.exe
  C:\Windows\System\udFlsDz.exe
  2⤵
  PID:8416
- C:\Windows\System\gvwNEBi.exe
  C:\Windows\System\gvwNEBi.exe
  2⤵
  PID:8432
- C:\Windows\System\uqTrQUM.exe
  C:\Windows\System\uqTrQUM.exe
  2⤵
  PID:8456
- C:\Windows\System\WsTNbpz.exe
  C:\Windows\System\WsTNbpz.exe
  2⤵
  PID:8484
- C:\Windows\System\ntiDNtb.exe
  C:\Windows\System\ntiDNtb.exe
  2⤵
  PID:8504
- C:\Windows\System\aiCCorW.exe
  C:\Windows\System\aiCCorW.exe
  2⤵
  PID:8528
- C:\Windows\System\gzGbYyt.exe
  C:\Windows\System\gzGbYyt.exe
  2⤵
  PID:8548
- C:\Windows\System\vRRYLKW.exe
  C:\Windows\System\vRRYLKW.exe
  2⤵
  PID:8576
- C:\Windows\System\ffGxUzT.exe
  C:\Windows\System\ffGxUzT.exe
  2⤵
  PID:8604
- C:\Windows\System\UYbiPvz.exe
  C:\Windows\System\UYbiPvz.exe
  2⤵
  PID:8632
- C:\Windows\System\VozgHQC.exe
  C:\Windows\System\VozgHQC.exe
  2⤵
  PID:8648
- C:\Windows\System\jeeKaWg.exe
  C:\Windows\System\jeeKaWg.exe
  2⤵
  PID:8672
- C:\Windows\System\FsNgJZQ.exe
  C:\Windows\System\FsNgJZQ.exe
  2⤵
  PID:8692
- C:\Windows\System\odSSfBH.exe
  C:\Windows\System\odSSfBH.exe
  2⤵
  PID:8720
- C:\Windows\System\icfSCCD.exe
  C:\Windows\System\icfSCCD.exe
  2⤵
  PID:8740
- C:\Windows\System\gWvxtYE.exe
  C:\Windows\System\gWvxtYE.exe
  2⤵
  PID:8756
- C:\Windows\System\eYQZJEc.exe
  C:\Windows\System\eYQZJEc.exe
  2⤵
  PID:8772
- C:\Windows\System\nzCOWiw.exe
  C:\Windows\System\nzCOWiw.exe
  2⤵
  PID:8788
- C:\Windows\System\xYgLOXd.exe
  C:\Windows\System\xYgLOXd.exe
  2⤵
  PID:8816
- C:\Windows\System\LLMwYKW.exe
  C:\Windows\System\LLMwYKW.exe
  2⤵
  PID:8836
- C:\Windows\System\ekpKCvX.exe
  C:\Windows\System\ekpKCvX.exe
  2⤵
  PID:8852
- C:\Windows\System\ucCIWTU.exe
  C:\Windows\System\ucCIWTU.exe
  2⤵
  PID:8868
- C:\Windows\System\CIHrBbh.exe
  C:\Windows\System\CIHrBbh.exe
  2⤵
  PID:8884
- C:\Windows\System\ADFknJV.exe
  C:\Windows\System\ADFknJV.exe
  2⤵
  PID:8904
- C:\Windows\System\KPYKNhx.exe
  C:\Windows\System\KPYKNhx.exe
  2⤵
  PID:8924
- C:\Windows\System\YOqjqYw.exe
  C:\Windows\System\YOqjqYw.exe
  2⤵
  PID:8944
- C:\Windows\System\iBkhWMO.exe
  C:\Windows\System\iBkhWMO.exe
  2⤵
  PID:8972
- C:\Windows\System\xrqQgYX.exe
  C:\Windows\System\xrqQgYX.exe
  2⤵
  PID:9004
- C:\Windows\System\cjlIYoV.exe
  C:\Windows\System\cjlIYoV.exe
  2⤵
  PID:9020
- C:\Windows\System\aCkuUkT.exe
  C:\Windows\System\aCkuUkT.exe
  2⤵
  PID:9048
- C:\Windows\System\tTYDuPE.exe
  C:\Windows\System\tTYDuPE.exe
  2⤵
  PID:9068
- C:\Windows\System\nyxgGMA.exe
  C:\Windows\System\nyxgGMA.exe
  2⤵
  PID:9084
- C:\Windows\System\DZIOMhF.exe
  C:\Windows\System\DZIOMhF.exe
  2⤵
  PID:9108
- C:\Windows\System\IKJppuL.exe
  C:\Windows\System\IKJppuL.exe
  2⤵
  PID:9124
- C:\Windows\System\WnkyGqu.exe
  C:\Windows\System\WnkyGqu.exe
  2⤵
  PID:9148
- C:\Windows\System\tvsuJxL.exe
  C:\Windows\System\tvsuJxL.exe
  2⤵
  PID:9168
- C:\Windows\System\PxToQMe.exe
  C:\Windows\System\PxToQMe.exe
  2⤵
  PID:9192
- C:\Windows\System\RlNZaIS.exe
  C:\Windows\System\RlNZaIS.exe
  2⤵
  PID:7968
- C:\Windows\System\dJZNqJo.exe
  C:\Windows\System\dJZNqJo.exe
  2⤵
  PID:7724
- C:\Windows\System\hYyZrre.exe
  C:\Windows\System\hYyZrre.exe
  2⤵
  PID:7652
- C:\Windows\System\iqHBwdS.exe
  C:\Windows\System\iqHBwdS.exe
  2⤵
  PID:8088
- C:\Windows\System\PHVGDrw.exe
  C:\Windows\System\PHVGDrw.exe
  2⤵
  PID:8188
- C:\Windows\System\MehrLEk.exe
  C:\Windows\System\MehrLEk.exe
  2⤵
  PID:8148
- C:\Windows\System\MjPRiIJ.exe
  C:\Windows\System\MjPRiIJ.exe
  2⤵
  PID:7892
- C:\Windows\System\GqCAYdd.exe
  C:\Windows\System\GqCAYdd.exe
  2⤵
  PID:7940
- C:\Windows\System\tgnJMDY.exe
  C:\Windows\System\tgnJMDY.exe
  2⤵
  PID:2888
- C:\Windows\System\RIJraeJ.exe
  C:\Windows\System\RIJraeJ.exe
  2⤵
  PID:7592
- C:\Windows\System\nWXaxjS.exe
  C:\Windows\System\nWXaxjS.exe
  2⤵
  PID:6920
- C:\Windows\System\UoLInsl.exe
  C:\Windows\System\UoLInsl.exe
  2⤵
  PID:9228
- C:\Windows\System\zwBFLIf.exe
  C:\Windows\System\zwBFLIf.exe
  2⤵
  PID:9248
- C:\Windows\System\OPUsJSY.exe
  C:\Windows\System\OPUsJSY.exe
  2⤵
  PID:9276
- C:\Windows\System\DUJvYGg.exe
  C:\Windows\System\DUJvYGg.exe
  2⤵
  PID:9292
- C:\Windows\System\xmLGEgr.exe
  C:\Windows\System\xmLGEgr.exe
  2⤵
  PID:9320
- C:\Windows\System\nmppWnq.exe
  C:\Windows\System\nmppWnq.exe
  2⤵
  PID:9344
- C:\Windows\System\husretE.exe
  C:\Windows\System\husretE.exe
  2⤵
  PID:9364
- C:\Windows\System\HIwKEnl.exe
  C:\Windows\System\HIwKEnl.exe
  2⤵
  PID:9388
- C:\Windows\System\IYjDsVY.exe
  C:\Windows\System\IYjDsVY.exe
  2⤵
  PID:9408
- C:\Windows\System\pNQdrUL.exe
  C:\Windows\System\pNQdrUL.exe
  2⤵
  PID:9428
- C:\Windows\System\ajxcfMm.exe
  C:\Windows\System\ajxcfMm.exe
  2⤵
  PID:9444
- C:\Windows\System\colDOFH.exe
  C:\Windows\System\colDOFH.exe
  2⤵
  PID:9464
- C:\Windows\System\ZYsAJzW.exe
  C:\Windows\System\ZYsAJzW.exe
  2⤵
  PID:9484
- C:\Windows\System\kJzNjGJ.exe
  C:\Windows\System\kJzNjGJ.exe
  2⤵
  PID:9500
- C:\Windows\System\lUyfjry.exe
  C:\Windows\System\lUyfjry.exe
  2⤵
  PID:9524
- C:\Windows\System\FwBaBJx.exe
  C:\Windows\System\FwBaBJx.exe
  2⤵
  PID:9548
- C:\Windows\System\KOOnvjq.exe
  C:\Windows\System\KOOnvjq.exe
  2⤵
  PID:9572
- C:\Windows\System\bXiCoQn.exe
  C:\Windows\System\bXiCoQn.exe
  2⤵
  PID:9588
- C:\Windows\System\IAaFPXS.exe
  C:\Windows\System\IAaFPXS.exe
  2⤵
  PID:9612
- C:\Windows\System\fSPRzbZ.exe
  C:\Windows\System\fSPRzbZ.exe
  2⤵
  PID:9632
- C:\Windows\System\bYfPQZN.exe
  C:\Windows\System\bYfPQZN.exe
  2⤵
  PID:9652
- C:\Windows\System\GEjXLZh.exe
  C:\Windows\System\GEjXLZh.exe
  2⤵
  PID:9672
- C:\Windows\System\QtVQqls.exe
  C:\Windows\System\QtVQqls.exe
  2⤵
  PID:9692
- C:\Windows\System\igEOycD.exe
  C:\Windows\System\igEOycD.exe
  2⤵
  PID:9716
- C:\Windows\System\SsWHCBb.exe
  C:\Windows\System\SsWHCBb.exe
  2⤵
  PID:9740
- C:\Windows\System\nKXlwDd.exe
  C:\Windows\System\nKXlwDd.exe
  2⤵
  PID:9760
- C:\Windows\System\HlOerMe.exe
  C:\Windows\System\HlOerMe.exe
  2⤵
  PID:9776
- C:\Windows\System\adgTCtS.exe
  C:\Windows\System\adgTCtS.exe
  2⤵
  PID:9796
- C:\Windows\System\gZJNGSA.exe
  C:\Windows\System\gZJNGSA.exe
  2⤵
  PID:9812
- C:\Windows\System\CGxzkgh.exe
  C:\Windows\System\CGxzkgh.exe
  2⤵
  PID:9828
- C:\Windows\System\zugjlQH.exe
  C:\Windows\System\zugjlQH.exe
  2⤵
  PID:9848
- C:\Windows\System\untaITK.exe
  C:\Windows\System\untaITK.exe
  2⤵
  PID:9872
- C:\Windows\System\LKdwOSd.exe
  C:\Windows\System\LKdwOSd.exe
  2⤵
  PID:9892
- C:\Windows\System\LdIboBS.exe
  C:\Windows\System\LdIboBS.exe
  2⤵
  PID:9912
- C:\Windows\System\zwuCJWu.exe
  C:\Windows\System\zwuCJWu.exe
  2⤵
  PID:9932
- C:\Windows\System\FlLCsef.exe
  C:\Windows\System\FlLCsef.exe
  2⤵
  PID:9960
- C:\Windows\System\QOGmEQj.exe
  C:\Windows\System\QOGmEQj.exe
  2⤵
  PID:9980
- C:\Windows\System\cDAGbQU.exe
  C:\Windows\System\cDAGbQU.exe
  2⤵
  PID:10000
- C:\Windows\System\FYIOXjq.exe
  C:\Windows\System\FYIOXjq.exe
  2⤵
  PID:10028
- C:\Windows\System\mUzSyvh.exe
  C:\Windows\System\mUzSyvh.exe
  2⤵
  PID:10052
- C:\Windows\System\xvEQgte.exe
  C:\Windows\System\xvEQgte.exe
  2⤵
  PID:10084
- C:\Windows\System\YApwoTZ.exe
  C:\Windows\System\YApwoTZ.exe
  2⤵
  PID:10100
- C:\Windows\System\FVPZjeL.exe
  C:\Windows\System\FVPZjeL.exe
  2⤵
  PID:10124
- C:\Windows\System\hoooWXO.exe
  C:\Windows\System\hoooWXO.exe
  2⤵
  PID:7632
- C:\Windows\System\vZKsuda.exe
  C:\Windows\System\vZKsuda.exe
  2⤵
  PID:6752
- C:\Windows\System\hieXGtq.exe
  C:\Windows\System\hieXGtq.exe
  2⤵
  PID:6668
- C:\Windows\System\ypoCxwU.exe
  C:\Windows\System\ypoCxwU.exe
  2⤵
  PID:9288
- C:\Windows\System\xuTpyob.exe
  C:\Windows\System\xuTpyob.exe
  2⤵
  PID:7872
- C:\Windows\System\foJupHN.exe
  C:\Windows\System\foJupHN.exe
  2⤵
  PID:7920
- C:\Windows\System\PGZoKbk.exe
  C:\Windows\System\PGZoKbk.exe
  2⤵
  PID:8268
- C:\Windows\System\YzLfvIo.exe
  C:\Windows\System\YzLfvIo.exe
  2⤵
  PID:8300
- C:\Windows\System\FfwVreK.exe
  C:\Windows\System\FfwVreK.exe
  2⤵
  PID:8344
- C:\Windows\System\iPQTOIO.exe
  C:\Windows\System\iPQTOIO.exe
  2⤵
  PID:9600
- C:\Windows\System\ehSoDxp.exe
  C:\Windows\System\ehSoDxp.exe
  2⤵
  PID:8796
- C:\Windows\System\lXCkRdK.exe
  C:\Windows\System\lXCkRdK.exe
  2⤵
  PID:9708
- C:\Windows\System\dNAxsrr.exe
  C:\Windows\System\dNAxsrr.exe
  2⤵
  PID:8440
- C:\Windows\System\neoieMs.exe
  C:\Windows\System\neoieMs.exe
  2⤵
  PID:9116
- C:\Windows\System\oDakPOX.exe
  C:\Windows\System\oDakPOX.exe
  2⤵
  PID:8596
- C:\Windows\System\KzaJipb.exe
  C:\Windows\System\KzaJipb.exe
  2⤵
  PID:8668
- C:\Windows\System\fgQrjcn.exe
  C:\Windows\System\fgQrjcn.exe
  2⤵
  PID:9992
- C:\Windows\System\IjMSOjd.exe
  C:\Windows\System\IjMSOjd.exe
  2⤵
  PID:8688
- C:\Windows\System\CcvyqYM.exe
  C:\Windows\System\CcvyqYM.exe
  2⤵
  PID:9356
- C:\Windows\System\AMqnQsT.exe
  C:\Windows\System\AMqnQsT.exe
  2⤵
  PID:9804
- C:\Windows\System\criKkyy.exe
  C:\Windows\System\criKkyy.exe
  2⤵
  PID:9968
- C:\Windows\System\SnEdKxF.exe
  C:\Windows\System\SnEdKxF.exe
  2⤵
  PID:9240
- C:\Windows\System\OqybmAt.exe
  C:\Windows\System\OqybmAt.exe
  2⤵
  PID:9472
- C:\Windows\System\YJhJaod.exe
  C:\Windows\System\YJhJaod.exe
  2⤵
  PID:9664
- C:\Windows\System\LwVQyiL.exe
  C:\Windows\System\LwVQyiL.exe
  2⤵
  PID:9596
- C:\Windows\System\xPhxIII.exe
  C:\Windows\System\xPhxIII.exe
  2⤵
  PID:8876
- C:\Windows\System\hqqxpia.exe
  C:\Windows\System\hqqxpia.exe
  2⤵
  PID:9012
- C:\Windows\System\knzQUvJ.exe
  C:\Windows\System\knzQUvJ.exe
  2⤵
  PID:9808
- C:\Windows\System\CXtiRYK.exe
  C:\Windows\System\CXtiRYK.exe
  2⤵
  PID:10252
- C:\Windows\System\FHPazFK.exe
  C:\Windows\System\FHPazFK.exe
  2⤵
  PID:10320
- C:\Windows\System\SCEBILC.exe
  C:\Windows\System\SCEBILC.exe
  2⤵
  PID:10344
- C:\Windows\System\kPpTsjZ.exe
  C:\Windows\System\kPpTsjZ.exe
  2⤵
  PID:10364
- C:\Windows\System\zSlsIlK.exe
  C:\Windows\System\zSlsIlK.exe
  2⤵
  PID:10384
- C:\Windows\System\BjupAlH.exe
  C:\Windows\System\BjupAlH.exe
  2⤵
  PID:10408
- C:\Windows\System\FhnKpIW.exe
  C:\Windows\System\FhnKpIW.exe
  2⤵
  PID:10436
- C:\Windows\System\PADRpYv.exe
  C:\Windows\System\PADRpYv.exe
  2⤵
  PID:10456
- C:\Windows\System\TUtzVpa.exe
  C:\Windows\System\TUtzVpa.exe
  2⤵
  PID:10476
- C:\Windows\System\bzSQxvW.exe
  C:\Windows\System\bzSQxvW.exe
  2⤵
  PID:10496
- C:\Windows\System\RAZSmqT.exe
  C:\Windows\System\RAZSmqT.exe
  2⤵
  PID:10524
- C:\Windows\System\vOgMmTI.exe
  C:\Windows\System\vOgMmTI.exe
  2⤵
  PID:10548
- C:\Windows\System\JUzOUrZ.exe
  C:\Windows\System\JUzOUrZ.exe
  2⤵
  PID:10816
- C:\Windows\System\rVPtwsC.exe
  C:\Windows\System\rVPtwsC.exe
  2⤵
  PID:10832
- C:\Windows\System\oGOgSZg.exe
  C:\Windows\System\oGOgSZg.exe
  2⤵
  PID:10848
- C:\Windows\System\TLsESny.exe
  C:\Windows\System\TLsESny.exe
  2⤵
  PID:10864
- C:\Windows\System\aDKsRiV.exe
  C:\Windows\System\aDKsRiV.exe
  2⤵
  PID:10880
- C:\Windows\System\KsoAQdj.exe
  C:\Windows\System\KsoAQdj.exe
  2⤵
  PID:10900
- C:\Windows\System\CFsqHRu.exe
  C:\Windows\System\CFsqHRu.exe
  2⤵
  PID:10920
- C:\Windows\System\XmkkyaP.exe
  C:\Windows\System\XmkkyaP.exe
  2⤵
  PID:10936
- C:\Windows\System\QuHxQyT.exe
  C:\Windows\System\QuHxQyT.exe
  2⤵
  PID:10952
- C:\Windows\System\OHxXhKE.exe
  C:\Windows\System\OHxXhKE.exe
  2⤵
  PID:10968
- C:\Windows\System\amaHBRw.exe
  C:\Windows\System\amaHBRw.exe
  2⤵
  PID:10984
- C:\Windows\System\khiOiit.exe
  C:\Windows\System\khiOiit.exe
  2⤵
  PID:11004
- C:\Windows\System\eMKjryB.exe
  C:\Windows\System\eMKjryB.exe
  2⤵
  PID:11028
- C:\Windows\System\driTHhS.exe
  C:\Windows\System\driTHhS.exe
  2⤵
  PID:11044
- C:\Windows\System\qPiizCz.exe
  C:\Windows\System\qPiizCz.exe
  2⤵
  PID:11060
- C:\Windows\System\mQXhsDI.exe
  C:\Windows\System\mQXhsDI.exe
  2⤵
  PID:11084
- C:\Windows\System\eRfWGxT.exe
  C:\Windows\System\eRfWGxT.exe
  2⤵
  PID:11108
- C:\Windows\System\aRAszYW.exe
  C:\Windows\System\aRAszYW.exe
  2⤵
  PID:11128
- C:\Windows\System\zNQdEVo.exe
  C:\Windows\System\zNQdEVo.exe
  2⤵
  PID:11156
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11156 -s 248
    3⤵
    PID:13576
- C:\Windows\System\bGxjyeu.exe
  C:\Windows\System\bGxjyeu.exe
  2⤵
  PID:11184
- C:\Windows\System\qYbURue.exe
  C:\Windows\System\qYbURue.exe
  2⤵
  PID:11204
- C:\Windows\System\xWaHSJy.exe
  C:\Windows\System\xWaHSJy.exe
  2⤵
  PID:11236
- C:\Windows\System\WHlwHgW.exe
  C:\Windows\System\WHlwHgW.exe
  2⤵
  PID:11252
- C:\Windows\System\hMNsnpM.exe
  C:\Windows\System\hMNsnpM.exe
  2⤵
  PID:7440
- C:\Windows\System\YKsCRIr.exe
  C:\Windows\System\YKsCRIr.exe
  2⤵
  PID:7928
- C:\Windows\System\ykuenUu.exe
  C:\Windows\System\ykuenUu.exe
  2⤵
  PID:8152
- C:\Windows\System\dBWIcnh.exe
  C:\Windows\System\dBWIcnh.exe
  2⤵
  PID:10152
- C:\Windows\System\SlNUfwK.exe
  C:\Windows\System\SlNUfwK.exe
  2⤵
  PID:9260
- C:\Windows\System\KJLfeNC.exe
  C:\Windows\System\KJLfeNC.exe
  2⤵
  PID:9440
- C:\Windows\System\BPINtrl.exe
  C:\Windows\System\BPINtrl.exe
  2⤵
  PID:9520
- C:\Windows\System\NoClVyT.exe
  C:\Windows\System\NoClVyT.exe
  2⤵
  PID:10136
- C:\Windows\System\hSAcrab.exe
  C:\Windows\System\hSAcrab.exe
  2⤵
  PID:8408
- C:\Windows\System\sVRNrOk.exe
  C:\Windows\System\sVRNrOk.exe
  2⤵
  PID:9648
- C:\Windows\System\DyhEtqp.exe
  C:\Windows\System\DyhEtqp.exe
  2⤵
  PID:8916
- C:\Windows\System\gxsLXLo.exe
  C:\Windows\System\gxsLXLo.exe
  2⤵
  PID:10444
- C:\Windows\System\kebdhRn.exe
  C:\Windows\System\kebdhRn.exe
  2⤵
  PID:10532
- C:\Windows\System\WVhixIl.exe
  C:\Windows\System\WVhixIl.exe
  2⤵
  PID:8200
- C:\Windows\System\aOUYzgv.exe
  C:\Windows\System\aOUYzgv.exe
  2⤵
  PID:8544
- C:\Windows\System\RAPAotB.exe
  C:\Windows\System\RAPAotB.exe
  2⤵
  PID:10060
- C:\Windows\System\YmBHOAy.exe
  C:\Windows\System\YmBHOAy.exe
  2⤵
  PID:6292
- C:\Windows\System\hNhWeXD.exe
  C:\Windows\System\hNhWeXD.exe
  2⤵
  PID:9584
- C:\Windows\System\qOrBmZo.exe
  C:\Windows\System\qOrBmZo.exe
  2⤵
  PID:8656
- C:\Windows\System\AUaqWtJ.exe
  C:\Windows\System\AUaqWtJ.exe
  2⤵
  PID:9536
- C:\Windows\System\bZUyQlD.exe
  C:\Windows\System\bZUyQlD.exe
  2⤵
  PID:9768
- C:\Windows\System\DKgnKLP.exe
  C:\Windows\System\DKgnKLP.exe
  2⤵
  PID:9904
- C:\Windows\System\RxrzYuD.exe
  C:\Windows\System\RxrzYuD.exe
  2⤵
  PID:9308
- C:\Windows\System\VATMyDY.exe
  C:\Windows\System\VATMyDY.exe
  2⤵
  PID:10248
- C:\Windows\System\QVlxHHX.exe
  C:\Windows\System\QVlxHHX.exe
  2⤵
  PID:10716
- C:\Windows\System\ymZfLpo.exe
  C:\Windows\System\ymZfLpo.exe
  2⤵
  PID:10308
- C:\Windows\System\McnfODg.exe
  C:\Windows\System\McnfODg.exe
  2⤵
  PID:10360
- C:\Windows\System\hGduPWy.exe
  C:\Windows\System\hGduPWy.exe
  2⤵
  PID:9080
- C:\Windows\System\axuKkQE.exe
  C:\Windows\System\axuKkQE.exe
  2⤵
  PID:9188
- C:\Windows\System\Gdlfqxf.exe
  C:\Windows\System\Gdlfqxf.exe
  2⤵
  PID:9236
- C:\Windows\System\JyHoOCu.exe
  C:\Windows\System\JyHoOCu.exe
  2⤵
  PID:8628
- C:\Windows\System\qnwUCAI.exe
  C:\Windows\System\qnwUCAI.exe
  2⤵
  PID:8292
- C:\Windows\System\oFELICA.exe
  C:\Windows\System\oFELICA.exe
  2⤵
  PID:8464
- C:\Windows\System\egnDNYX.exe
  C:\Windows\System\egnDNYX.exe
  2⤵
  PID:8764
- C:\Windows\System\kyqJFeq.exe
  C:\Windows\System\kyqJFeq.exe
  2⤵
  PID:9624
- C:\Windows\System\gjJPWvj.exe
  C:\Windows\System\gjJPWvj.exe
  2⤵
  PID:8952
- C:\Windows\System\OeQKCYX.exe
  C:\Windows\System\OeQKCYX.exe
  2⤵
  PID:11136
- C:\Windows\System\GWiBJKH.exe
  C:\Windows\System\GWiBJKH.exe
  2⤵
  PID:11276
- C:\Windows\System\unIFMRm.exe
  C:\Windows\System\unIFMRm.exe
  2⤵
  PID:11296
- C:\Windows\System\fSsIyLd.exe
  C:\Windows\System\fSsIyLd.exe
  2⤵
  PID:11316
- C:\Windows\System\dDpGEYf.exe
  C:\Windows\System\dDpGEYf.exe
  2⤵
  PID:11340
- C:\Windows\System\uxdCaOM.exe
  C:\Windows\System\uxdCaOM.exe
  2⤵
  PID:11368
- C:\Windows\System\TCBJymy.exe
  C:\Windows\System\TCBJymy.exe
  2⤵
  PID:11392
- C:\Windows\System\rwwhAhf.exe
  C:\Windows\System\rwwhAhf.exe
  2⤵
  PID:11416
- C:\Windows\System\WDPGTHm.exe
  C:\Windows\System\WDPGTHm.exe
  2⤵
  PID:11436
- C:\Windows\System\wtnGEir.exe
  C:\Windows\System\wtnGEir.exe
  2⤵
  PID:11460
- C:\Windows\System\cvdGdll.exe
  C:\Windows\System\cvdGdll.exe
  2⤵
  PID:11520
- C:\Windows\System\BlqJzIB.exe
  C:\Windows\System\BlqJzIB.exe
  2⤵
  PID:11536
- C:\Windows\System\VtZvlxw.exe
  C:\Windows\System\VtZvlxw.exe
  2⤵
  PID:11552
- C:\Windows\System\OgPyEHn.exe
  C:\Windows\System\OgPyEHn.exe
  2⤵
  PID:11568
- C:\Windows\System\cyvIOtF.exe
  C:\Windows\System\cyvIOtF.exe
  2⤵
  PID:11584
- C:\Windows\System\kuuzFnc.exe
  C:\Windows\System\kuuzFnc.exe
  2⤵
  PID:11604
- C:\Windows\System\YxUfhOL.exe
  C:\Windows\System\YxUfhOL.exe
  2⤵
  PID:11628
- C:\Windows\System\DXGoxnt.exe
  C:\Windows\System\DXGoxnt.exe
  2⤵
  PID:11648
- C:\Windows\System\qLhPrBE.exe
  C:\Windows\System\qLhPrBE.exe
  2⤵
  PID:11684
- C:\Windows\System\cSGowTS.exe
  C:\Windows\System\cSGowTS.exe
  2⤵
  PID:11700
- C:\Windows\System\yCCniAG.exe
  C:\Windows\System\yCCniAG.exe
  2⤵
  PID:11724
- C:\Windows\System\LxnEtMO.exe
  C:\Windows\System\LxnEtMO.exe
  2⤵
  PID:11748
- C:\Windows\System\Ehjxbnb.exe
  C:\Windows\System\Ehjxbnb.exe
  2⤵
  PID:11768
- C:\Windows\System\gCXhwQl.exe
  C:\Windows\System\gCXhwQl.exe
  2⤵
  PID:11788
- C:\Windows\System\tdvHiRR.exe
  C:\Windows\System\tdvHiRR.exe
  2⤵
  PID:11816
- C:\Windows\System\PQeWLqf.exe
  C:\Windows\System\PQeWLqf.exe
  2⤵
  PID:11840
- C:\Windows\System\IUqapbE.exe
  C:\Windows\System\IUqapbE.exe
  2⤵
  PID:11864
- C:\Windows\System\hbudshU.exe
  C:\Windows\System\hbudshU.exe
  2⤵
  PID:11884
- C:\Windows\System\zqZvHaJ.exe
  C:\Windows\System\zqZvHaJ.exe
  2⤵
  PID:11904
- C:\Windows\System\OpDCukr.exe
  C:\Windows\System\OpDCukr.exe
  2⤵
  PID:11928
- C:\Windows\System\dVUKAPp.exe
  C:\Windows\System\dVUKAPp.exe
  2⤵
  PID:11956
- C:\Windows\System\HraWxuQ.exe
  C:\Windows\System\HraWxuQ.exe
  2⤵
  PID:11972
- C:\Windows\System\Cdzkmbj.exe
  C:\Windows\System\Cdzkmbj.exe
  2⤵
  PID:12008
- C:\Windows\System\bXGqNDp.exe
  C:\Windows\System\bXGqNDp.exe
  2⤵
  PID:12028
- C:\Windows\System\VpiNBjG.exe
  C:\Windows\System\VpiNBjG.exe
  2⤵
  PID:12048
- C:\Windows\System\OLDYdRJ.exe
  C:\Windows\System\OLDYdRJ.exe
  2⤵
  PID:12068
- C:\Windows\System\zwEIAKi.exe
  C:\Windows\System\zwEIAKi.exe
  2⤵
  PID:12084
- C:\Windows\System\jYrcxxA.exe
  C:\Windows\System\jYrcxxA.exe
  2⤵
  PID:12100
- C:\Windows\System\tGDHCAy.exe
  C:\Windows\System\tGDHCAy.exe
  2⤵
  PID:12116
- C:\Windows\System\drGqYqs.exe
  C:\Windows\System\drGqYqs.exe
  2⤵
  PID:12132
- C:\Windows\System\KCdfLDL.exe
  C:\Windows\System\KCdfLDL.exe
  2⤵
  PID:12148
- C:\Windows\System\hdlmtnI.exe
  C:\Windows\System\hdlmtnI.exe
  2⤵
  PID:12164
- C:\Windows\System\PIuaIpb.exe
  C:\Windows\System\PIuaIpb.exe
  2⤵
  PID:12180
- C:\Windows\System\JLNKcma.exe
  C:\Windows\System\JLNKcma.exe
  2⤵
  PID:12196
- C:\Windows\System\ppXutHR.exe
  C:\Windows\System\ppXutHR.exe
  2⤵
  PID:12212
- C:\Windows\System\vALwmRq.exe
  C:\Windows\System\vALwmRq.exe
  2⤵
  PID:12268
- C:\Windows\System\EtLDjdh.exe
  C:\Windows\System\EtLDjdh.exe
  2⤵
  PID:11212
- C:\Windows\System\orbWjAD.exe
  C:\Windows\System\orbWjAD.exe
  2⤵
  PID:10120
- C:\Windows\System\EIXqpJp.exe
  C:\Windows\System\EIXqpJp.exe
  2⤵
  PID:10404
- C:\Windows\System\rZpBgoN.exe
  C:\Windows\System\rZpBgoN.exe
  2⤵
  PID:10808
- C:\Windows\System\eruYiVF.exe
  C:\Windows\System\eruYiVF.exe
  2⤵
  PID:10824
- C:\Windows\System\oAUCnSH.exe
  C:\Windows\System\oAUCnSH.exe
  2⤵
  PID:11164
- C:\Windows\System\FNEmDPt.exe
  C:\Windows\System\FNEmDPt.exe
  2⤵
  PID:12308
- C:\Windows\System\xRaJwyw.exe
  C:\Windows\System\xRaJwyw.exe
  2⤵
  PID:12324
- C:\Windows\System\cWSHVmz.exe
  C:\Windows\System\cWSHVmz.exe
  2⤵
  PID:12348
- C:\Windows\System\zwEUdkj.exe
  C:\Windows\System\zwEUdkj.exe
  2⤵
  PID:12372
- C:\Windows\System\IlCmtcy.exe
  C:\Windows\System\IlCmtcy.exe
  2⤵
  PID:12392
- C:\Windows\System\dCfjSYQ.exe
  C:\Windows\System\dCfjSYQ.exe
  2⤵
  PID:12408
- C:\Windows\System\GvsPEcl.exe
  C:\Windows\System\GvsPEcl.exe
  2⤵
  PID:12440
- C:\Windows\System\uqtohYo.exe
  C:\Windows\System\uqtohYo.exe
  2⤵
  PID:12460
- C:\Windows\System\tXOesvc.exe
  C:\Windows\System\tXOesvc.exe
  2⤵
  PID:12488
- C:\Windows\System\NQptbSW.exe
  C:\Windows\System\NQptbSW.exe
  2⤵
  PID:12504
- C:\Windows\System\CztSMTL.exe
  C:\Windows\System\CztSMTL.exe
  2⤵
  PID:12524
- C:\Windows\System\BdpAIGZ.exe
  C:\Windows\System\BdpAIGZ.exe
  2⤵
  PID:12544
- C:\Windows\System\ghqFcit.exe
  C:\Windows\System\ghqFcit.exe
  2⤵
  PID:12564
- C:\Windows\System\WsHEEJN.exe
  C:\Windows\System\WsHEEJN.exe
  2⤵
  PID:12592
- C:\Windows\System\mvtnVxn.exe
  C:\Windows\System\mvtnVxn.exe
  2⤵
  PID:12612
- C:\Windows\System\odwIvzH.exe
  C:\Windows\System\odwIvzH.exe
  2⤵
  PID:12632
- C:\Windows\System\caMxaDv.exe
  C:\Windows\System\caMxaDv.exe
  2⤵
  PID:12664
- C:\Windows\System\fOfzThW.exe
  C:\Windows\System\fOfzThW.exe
  2⤵
  PID:12684
- C:\Windows\System\ORPDmwg.exe
  C:\Windows\System\ORPDmwg.exe
  2⤵
  PID:12720
- C:\Windows\System\wQxymXo.exe
  C:\Windows\System\wQxymXo.exe
  2⤵
  PID:12740
- C:\Windows\System\VQACifx.exe
  C:\Windows\System\VQACifx.exe
  2⤵
  PID:12760
- C:\Windows\System\EWWVOXy.exe
  C:\Windows\System\EWWVOXy.exe
  2⤵
  PID:12784
- C:\Windows\System\PZUcurT.exe
  C:\Windows\System\PZUcurT.exe
  2⤵
  PID:12800
- C:\Windows\System\vigedFf.exe
  C:\Windows\System\vigedFf.exe
  2⤵
  PID:12824
- C:\Windows\System\IfsNgqu.exe
  C:\Windows\System\IfsNgqu.exe
  2⤵
  PID:12848
- C:\Windows\System\XbvNtOJ.exe
  C:\Windows\System\XbvNtOJ.exe
  2⤵
  PID:12876
- C:\Windows\System\xOhmIXe.exe
  C:\Windows\System\xOhmIXe.exe
  2⤵
  PID:12928
- C:\Windows\System\DEUQSaQ.exe
  C:\Windows\System\DEUQSaQ.exe
  2⤵
  PID:12952
- C:\Windows\System\seLGlGW.exe
  C:\Windows\System\seLGlGW.exe
  2⤵
  PID:12972
- C:\Windows\System\KxgZnxF.exe
  C:\Windows\System\KxgZnxF.exe
  2⤵
  PID:12996
- C:\Windows\System\vKqSGTq.exe
  C:\Windows\System\vKqSGTq.exe
  2⤵
  PID:13012
- C:\Windows\System\vrWbfrU.exe
  C:\Windows\System\vrWbfrU.exe
  2⤵
  PID:13036
- C:\Windows\System\VAUWUzd.exe
  C:\Windows\System\VAUWUzd.exe
  2⤵
  PID:13060
- C:\Windows\System\omEledb.exe
  C:\Windows\System\omEledb.exe
  2⤵
  PID:13080
- C:\Windows\System\ZemEVxr.exe
  C:\Windows\System\ZemEVxr.exe
  2⤵
  PID:13108
- C:\Windows\System\aaYEQYi.exe
  C:\Windows\System\aaYEQYi.exe
  2⤵
  PID:13124
- C:\Windows\System\OZNcxvX.exe
  C:\Windows\System\OZNcxvX.exe
  2⤵
  PID:13140
- C:\Windows\System\WaYxJLZ.exe
  C:\Windows\System\WaYxJLZ.exe
  2⤵
  PID:13156
- C:\Windows\System\rxFpvmy.exe
  C:\Windows\System\rxFpvmy.exe
  2⤵
  PID:13176
- C:\Windows\System\vMrpGNG.exe
  C:\Windows\System\vMrpGNG.exe
  2⤵
  PID:13192
- C:\Windows\System\LfwzjHr.exe
  C:\Windows\System\LfwzjHr.exe
  2⤵
  PID:13208
- C:\Windows\System\FRcsdAO.exe
  C:\Windows\System\FRcsdAO.exe
  2⤵
  PID:13232
- C:\Windows\System\HueIwBi.exe
  C:\Windows\System\HueIwBi.exe
  2⤵
  PID:13256
- C:\Windows\System\DAwTeHN.exe
  C:\Windows\System\DAwTeHN.exe
  2⤵
  PID:13276
- C:\Windows\System\SOVyfJv.exe
  C:\Windows\System\SOVyfJv.exe
  2⤵
  PID:13296
- C:\Windows\System\vYIMAKq.exe
  C:\Windows\System\vYIMAKq.exe
  2⤵
  PID:9380
- C:\Windows\System\JNvgBav.exe
  C:\Windows\System\JNvgBav.exe
  2⤵
  PID:11408
- C:\Windows\System\GriTaAI.exe
  C:\Windows\System\GriTaAI.exe
  2⤵
  PID:11660
- C:\Windows\System\tkRLBSq.exe
  C:\Windows\System\tkRLBSq.exe
  2⤵
  PID:13268
- C:\Windows\System\eZRbwuP.exe
  C:\Windows\System\eZRbwuP.exe
  2⤵
  PID:11248
- C:\Windows\System\okEDxBs.exe
  C:\Windows\System\okEDxBs.exe
  2⤵
  PID:13304
- C:\Windows\System\NDsRxvP.exe
  C:\Windows\System\NDsRxvP.exe
  2⤵
  PID:10944
- C:\Windows\System\WOKRDTP.exe
  C:\Windows\System\WOKRDTP.exe
  2⤵
  PID:8800
- C:\Windows\System\THDceQU.exe
  C:\Windows\System\THDceQU.exe
  2⤵
  PID:11452
- C:\Windows\System\YlCzvzt.exe
  C:\Windows\System\YlCzvzt.exe
  2⤵
  PID:11896
- C:\Windows\System\dvsWjOC.exe
  C:\Windows\System\dvsWjOC.exe
  2⤵
  PID:11940
- C:\Windows\System\UEybaIi.exe
  C:\Windows\System\UEybaIi.exe
  2⤵
  PID:5004
- C:\Windows\System\kVntmjX.exe
  C:\Windows\System\kVntmjX.exe
  2⤵
  PID:1132
- C:\Windows\System\BhfCdGY.exe
  C:\Windows\System\BhfCdGY.exe
  2⤵
  PID:11988
- C:\Windows\System\NBuBUlz.exe
  C:\Windows\System\NBuBUlz.exe
  2⤵
  PID:10928
- C:\Windows\System\qreBDcu.exe
  C:\Windows\System\qreBDcu.exe
  2⤵
  PID:11092
- C:\Windows\System\qAneuEV.exe
  C:\Windows\System\qAneuEV.exe
  2⤵
  PID:12096
- C:\Windows\System\nxNrKCb.exe
  C:\Windows\System\nxNrKCb.exe
  2⤵
  PID:11012
- C:\Windows\System\cnTtnoI.exe
  C:\Windows\System\cnTtnoI.exe
  2⤵
  PID:10520
- C:\Windows\System\JpHtQnM.exe
  C:\Windows\System\JpHtQnM.exe
  2⤵
  PID:10400
- C:\Windows\System\GjMUuZt.exe
  C:\Windows\System\GjMUuZt.exe
  2⤵
  PID:12176
- C:\Windows\System\dRtIGYp.exe
  C:\Windows\System\dRtIGYp.exe
  2⤵
  PID:12276
- C:\Windows\System\jHZyFwA.exe
  C:\Windows\System\jHZyFwA.exe
  2⤵
  PID:12304
- C:\Windows\System\XddCUOe.exe
  C:\Windows\System\XddCUOe.exe
  2⤵
  PID:12356
- C:\Windows\System\XqBRDyE.exe
  C:\Windows\System\XqBRDyE.exe
  2⤵
  PID:12452
- C:\Windows\System\zHLXBix.exe
  C:\Windows\System\zHLXBix.exe
  2⤵
  PID:12572
- C:\Windows\System\myTIxih.exe
  C:\Windows\System\myTIxih.exe
  2⤵
  PID:12840
- C:\Windows\System\QPnZLAV.exe
  C:\Windows\System\QPnZLAV.exe
  2⤵
  PID:10092
- C:\Windows\System\iWFaZOM.exe
  C:\Windows\System\iWFaZOM.exe
  2⤵
  PID:9312
- C:\Windows\System\KZFqgpJ.exe
  C:\Windows\System\KZFqgpJ.exe
  2⤵
  PID:7788
- C:\Windows\System\AWSRHtO.exe
  C:\Windows\System\AWSRHtO.exe
  2⤵
  PID:10416
- C:\Windows\System\sVOSqJs.exe
  C:\Windows\System\sVOSqJs.exe
  2⤵
  PID:11424
- C:\Windows\System\epsCmTd.exe
  C:\Windows\System\epsCmTd.exe
  2⤵
  PID:12000
- C:\Windows\System\UOoSlot.exe
  C:\Windows\System\UOoSlot.exe
  2⤵
  PID:11560
- C:\Windows\System\eqlMRUO.exe
  C:\Windows\System\eqlMRUO.exe
  2⤵
  PID:12540
- C:\Windows\System\DrBOHFM.exe
  C:\Windows\System\DrBOHFM.exe
  2⤵
  PID:9336
- C:\Windows\System\QTesdVq.exe
  C:\Windows\System\QTesdVq.exe
  2⤵
  PID:10828
- C:\Windows\System\vnyRjur.exe
  C:\Windows\System\vnyRjur.exe
  2⤵
  PID:12692
- C:\Windows\System\dYDDTkK.exe
  C:\Windows\System\dYDDTkK.exe
  2⤵
  PID:11848
- C:\Windows\System\yRSRDCN.exe
  C:\Windows\System\yRSRDCN.exe
  2⤵
  PID:8396
- C:\Windows\System\aULHrDq.exe
  C:\Windows\System\aULHrDq.exe
  2⤵
  PID:12056
- C:\Windows\System\aUaqIgC.exe
  C:\Windows\System\aUaqIgC.exe
  2⤵
  PID:4540
- C:\Windows\System\WOwOAbA.exe
  C:\Windows\System\WOwOAbA.exe
  2⤵
  PID:13168
- C:\Windows\System\RGBGLPF.exe
  C:\Windows\System\RGBGLPF.exe
  2⤵
  PID:13164
- C:\Windows\System\hsPiIYv.exe
  C:\Windows\System\hsPiIYv.exe
  2⤵
  PID:11508
- C:\Windows\System\GDPldZl.exe
  C:\Windows\System\GDPldZl.exe
  2⤵
  PID:12092
- C:\Windows\System\SUkFPPs.exe
  C:\Windows\System\SUkFPPs.exe
  2⤵
  PID:11564
- C:\Windows\System\swctGYw.exe
  C:\Windows\System\swctGYw.exe
  2⤵
  PID:12732
- C:\Windows\System\YtTEMVn.exe
  C:\Windows\System\YtTEMVn.exe
  2⤵
  PID:11968
- C:\Windows\System\IvGgrOh.exe
  C:\Windows\System\IvGgrOh.exe
  2⤵
  PID:12600
- C:\Windows\System\klEPSLo.exe
  C:\Windows\System\klEPSLo.exe
  2⤵
  PID:11640
- C:\Windows\System\oRHqDIB.exe
  C:\Windows\System\oRHqDIB.exe
  2⤵
  PID:10844
- C:\Windows\System\UxuerBr.exe
  C:\Windows\System\UxuerBr.exe
  2⤵
  PID:3788
- C:\Windows\System\egWccUl.exe
  C:\Windows\System\egWccUl.exe
  2⤵
  PID:7760
- C:\Windows\System\EDoAVSL.exe
  C:\Windows\System\EDoAVSL.exe
  2⤵
  PID:11980
- C:\Windows\System\zDepcgG.exe
  C:\Windows\System\zDepcgG.exe
  2⤵
  PID:12776
- C:\Windows\System\FuWWeMp.exe
  C:\Windows\System\FuWWeMp.exe
  2⤵
  PID:8032
- C:\Windows\System\vQDUzWg.exe
  C:\Windows\System\vQDUzWg.exe
  2⤵
  PID:13284
- C:\Windows\System\HwvTmRT.exe
  C:\Windows\System\HwvTmRT.exe
  2⤵
  PID:13488
- C:\Windows\System\bfSRISy.exe
  C:\Windows\System\bfSRISy.exe
  2⤵
  PID:13592
- C:\Windows\System\jTXdCBM.exe
  C:\Windows\System\jTXdCBM.exe
  2⤵
  PID:13612
- C:\Windows\System\kIfqAQO.exe
  C:\Windows\System\kIfqAQO.exe
  2⤵
  PID:13768
- C:\Windows\System\bvjOoMa.exe
  C:\Windows\System\bvjOoMa.exe
  2⤵
  PID:13872
- C:\Windows\System\ckvwPmt.exe
  C:\Windows\System\ckvwPmt.exe
  2⤵
  PID:13932
- C:\Windows\System\AxxlPUq.exe
  C:\Windows\System\AxxlPUq.exe
  2⤵
  PID:13964
- C:\Windows\System\qdcwtip.exe
  C:\Windows\System\qdcwtip.exe
  2⤵
  PID:13992
- C:\Windows\System\rWXOJJl.exe
  C:\Windows\System\rWXOJJl.exe
  2⤵
  PID:14024
- C:\Windows\System\jyynAmS.exe
  C:\Windows\System\jyynAmS.exe
  2⤵
  PID:14044
- C:\Windows\System\TNIWMFk.exe
  C:\Windows\System\TNIWMFk.exe
  2⤵
  PID:14084
- C:\Windows\System\XwBGHbX.exe
  C:\Windows\System\XwBGHbX.exe
  2⤵
  PID:14112
- C:\Windows\System\EgsMrfg.exe
  C:\Windows\System\EgsMrfg.exe
  2⤵
  PID:14208
- C:\Windows\System\IhFKfyr.exe
  C:\Windows\System\IhFKfyr.exe
  2⤵
  PID:14252
- C:\Windows\System\wVZqdYx.exe
  C:\Windows\System\wVZqdYx.exe
  2⤵
  PID:14272
- C:\Windows\System\zcziJqf.exe
  C:\Windows\System\zcziJqf.exe
  2⤵
  PID:13440
- C:\Windows\System\sQyPgsM.exe
  C:\Windows\System\sQyPgsM.exe
  2⤵
  PID:3864
- C:\Windows\System\wuAZGnr.exe
  C:\Windows\System\wuAZGnr.exe
  2⤵
  PID:13348
- C:\Windows\System\ekJzYqb.exe
  C:\Windows\System\ekJzYqb.exe
  2⤵
  PID:13720
- C:\Windows\System\JCOycBk.exe
  C:\Windows\System\JCOycBk.exe
  2⤵
  PID:13776
- C:\Windows\System\uOhsfdL.exe
  C:\Windows\System\uOhsfdL.exe
  2⤵
  PID:13588
- C:\Windows\System\YgNfpUs.exe
  C:\Windows\System\YgNfpUs.exe
  2⤵
  PID:13888
- C:\Windows\System\ziZwZrd.exe
  C:\Windows\System\ziZwZrd.exe
  2⤵
  PID:14304
- C:\Windows\System\cnbOGEx.exe
  C:\Windows\System\cnbOGEx.exe
  2⤵
  PID:13372
- C:\Windows\System\kdhhIry.exe
  C:\Windows\System\kdhhIry.exe
  2⤵
  PID:11804
- C:\Windows\System\sDrIzZH.exe
  C:\Windows\System\sDrIzZH.exe
  2⤵
  PID:13500
- C:\Windows\System\DAjgTNB.exe
  C:\Windows\System\DAjgTNB.exe
  2⤵
  PID:13400
- C:\Windows\System\QhWLzYE.exe
  C:\Windows\System\QhWLzYE.exe
  2⤵
  PID:13736
- C:\Windows\System\qyYDiSl.exe
  C:\Windows\System\qyYDiSl.exe
  2⤵
  PID:13712
- C:\Windows\System\oQjCYHq.exe
  C:\Windows\System\oQjCYHq.exe
  2⤵
  PID:13644
- C:\Windows\System\LJrrQGf.exe
  C:\Windows\System\LJrrQGf.exe
  2⤵
  PID:13684
- C:\Windows\System\rOXBjmq.exe
  C:\Windows\System\rOXBjmq.exe
  2⤵
  PID:13696
- C:\Windows\System\jnVKaoT.exe
  C:\Windows\System\jnVKaoT.exe
  2⤵
  PID:1208
- C:\Windows\System\NSZlAqu.exe
  C:\Windows\System\NSZlAqu.exe
  2⤵
  PID:396
- C:\Windows\System\qOjZJFP.exe
  C:\Windows\System\qOjZJFP.exe
  2⤵
  PID:4724
- C:\Windows\System\JyuNENn.exe
  C:\Windows\System\JyuNENn.exe
  2⤵
  PID:13580
- C:\Windows\System\MqtdmuX.exe
  C:\Windows\System\MqtdmuX.exe
  2⤵
  PID:13432
- C:\Windows\System\oaNGeTu.exe
  C:\Windows\System\oaNGeTu.exe
  2⤵
  PID:13812
- C:\Windows\System\msnxZFP.exe
  C:\Windows\System\msnxZFP.exe
  2⤵
  PID:13880
- C:\Windows\System\zkWtUis.exe
  C:\Windows\System\zkWtUis.exe
  2⤵
  PID:13916
- C:\Windows\System\IAIizTf.exe
  C:\Windows\System\IAIizTf.exe
  2⤵
  PID:13940
- C:\Windows\System\yfHPaFP.exe
  C:\Windows\System\yfHPaFP.exe
  2⤵
  PID:13984
- C:\Windows\System\zrBdAmu.exe
  C:\Windows\System\zrBdAmu.exe
  2⤵
  PID:14012
- C:\Windows\System\bdZjkFf.exe
  C:\Windows\System\bdZjkFf.exe
  2⤵
  PID:14288
- C:\Windows\System\dUCjpEn.exe
  C:\Windows\System\dUCjpEn.exe
  2⤵
  PID:3040
- C:\Windows\System\pTHmrkJ.exe
  C:\Windows\System\pTHmrkJ.exe
  2⤵
  PID:14128
- C:\Windows\System\UlKAhqY.exe
  C:\Windows\System\UlKAhqY.exe
  2⤵
  PID:13944
- C:\Windows\System\pWZkcuc.exe
  C:\Windows\System\pWZkcuc.exe
  2⤵
  PID:14056
- C:\Windows\System\ekjDCDx.exe
  C:\Windows\System\ekjDCDx.exe
  2⤵
  PID:14248
- C:\Windows\System\YDHdhbM.exe
  C:\Windows\System\YDHdhbM.exe
  2⤵
  PID:3428
- C:\Windows\System\jppOXcU.exe
  C:\Windows\System\jppOXcU.exe
  2⤵
  PID:5508
- C:\Windows\System\ljZTPxA.exe
  C:\Windows\System\ljZTPxA.exe
  2⤵
  PID:5024
- C:\Windows\System\sCvOFNC.exe
  C:\Windows\System\sCvOFNC.exe
  2⤵
  PID:13828
- C:\Windows\System\DDEcRDp.exe
  C:\Windows\System\DDEcRDp.exe
  2⤵
  PID:13928
- C:\Windows\System\QSenlFi.exe
  C:\Windows\System\QSenlFi.exe
  2⤵
  PID:13884
- C:\Windows\System\WkAxLye.exe
  C:\Windows\System\WkAxLye.exe
  2⤵
  PID:13824
- C:\Windows\System\INvLFVp.exe
  C:\Windows\System\INvLFVp.exe
  2⤵
  PID:14200
- C:\Windows\System\SiPPiIu.exe
  C:\Windows\System\SiPPiIu.exe
  2⤵
  PID:14124
- C:\Windows\System\OBuIfOW.exe
  C:\Windows\System\OBuIfOW.exe
  2⤵
  PID:11232
- C:\Windows\System\dkjRmFk.exe
  C:\Windows\System\dkjRmFk.exe
  2⤵
  PID:6536
- C:\Windows\System\exUGTFx.exe
  C:\Windows\System\exUGTFx.exe
  2⤵
  PID:13356
- C:\Windows\System\UZDQxho.exe
  C:\Windows\System\UZDQxho.exe
  2⤵
  PID:12204
- C:\Windows\System\uFGqnIU.exe
  C:\Windows\System\uFGqnIU.exe
  2⤵
  PID:13360
- C:\Windows\System\jdMvCMl.exe
  C:\Windows\System\jdMvCMl.exe
  2⤵
  PID:13352
- C:\Windows\System\LEgqENF.exe
  C:\Windows\System\LEgqENF.exe
  2⤵
  PID:13292
- C:\Windows\System\ArZtkJG.exe
  C:\Windows\System\ArZtkJG.exe
  2⤵
  PID:2132
- C:\Windows\System\guvbLFs.exe
  C:\Windows\System\guvbLFs.exe
  2⤵
  PID:12424
- C:\Windows\System\qBOvAzj.exe
  C:\Windows\System\qBOvAzj.exe
  2⤵
  PID:13368
- C:\Windows\System\bVwVxZO.exe
  C:\Windows\System\bVwVxZO.exe
  2⤵
  PID:5708
- C:\Windows\System\HpNpoZi.exe
  C:\Windows\System\HpNpoZi.exe
  2⤵
  PID:13456
- C:\Windows\System\pvvdWqR.exe
  C:\Windows\System\pvvdWqR.exe
  2⤵
  PID:13532
- C:\Windows\System\QXIyTIb.exe
  C:\Windows\System\QXIyTIb.exe
  2⤵
  PID:4508
- C:\Windows\System\tieFuvV.exe
  C:\Windows\System\tieFuvV.exe
  2⤵
  PID:3028
- C:\Windows\System\BvOUony.exe
  C:\Windows\System\BvOUony.exe
  2⤵
  PID:13408
- C:\Windows\System\qVsgIWv.exe
  C:\Windows\System\qVsgIWv.exe
  2⤵
  PID:10680
- C:\Windows\System\YuAhUwj.exe
  C:\Windows\System\YuAhUwj.exe
  2⤵
  PID:4892
- C:\Windows\System\ZjiKsPp.exe
  C:\Windows\System\ZjiKsPp.exe
  2⤵
  PID:4084
- C:\Windows\System\salXEAY.exe
  C:\Windows\System\salXEAY.exe
  2⤵
  PID:2244
- C:\Windows\System\sbFltyx.exe
  C:\Windows\System\sbFltyx.exe
  2⤵
  PID:13628
- C:\Windows\System\zKcaPFt.exe
  C:\Windows\System\zKcaPFt.exe
  2⤵
  PID:13656
- C:\Windows\System\sciYmIl.exe
  C:\Windows\System\sciYmIl.exe
  2⤵
  PID:5092
- C:\Windows\System\gGZusUR.exe
  C:\Windows\System\gGZusUR.exe
  2⤵
  PID:13380
- C:\Windows\System\eWZarwd.exe
  C:\Windows\System\eWZarwd.exe
  2⤵
  PID:13780
- C:\Windows\System\GYlXfvI.exe
  C:\Windows\System\GYlXfvI.exe
  2⤵
  PID:1280
- C:\Windows\System\uHSPBaT.exe
  C:\Windows\System\uHSPBaT.exe
  2⤵
  PID:1248
- C:\Windows\System\kMMXSnc.exe
  C:\Windows\System\kMMXSnc.exe
  2⤵
  PID:2772
- C:\Windows\System\WZBZHaK.exe
  C:\Windows\System\WZBZHaK.exe
  2⤵
  PID:13436
- C:\Windows\System\frWJHxs.exe
  C:\Windows\System\frWJHxs.exe
  2⤵
  PID:13796
- C:\Windows\System\ELWIceL.exe
  C:\Windows\System\ELWIceL.exe
  2⤵
  PID:13704
- C:\Windows\System\UXJEMDT.exe
  C:\Windows\System\UXJEMDT.exe
  2⤵
  PID:13976
- C:\Windows\System\EKcACVP.exe
  C:\Windows\System\EKcACVP.exe
  2⤵
  PID:1156
- C:\Windows\System\wqqNmtw.exe
  C:\Windows\System\wqqNmtw.exe
  2⤵
  PID:13864
- C:\Windows\System\NPqjSrK.exe
  C:\Windows\System\NPqjSrK.exe
  2⤵
  PID:1000
- C:\Windows\System\jsUuEgR.exe
  C:\Windows\System\jsUuEgR.exe
  2⤵
  PID:13856
- C:\Windows\System\fbGCaQx.exe
  C:\Windows\System\fbGCaQx.exe
  2⤵
  PID:11100
- C:\Windows\System\wwRMEXL.exe
  C:\Windows\System\wwRMEXL.exe
  2⤵
  PID:14100
- C:\Windows\System\mTEwGGC.exe
  C:\Windows\System\mTEwGGC.exe
  2⤵
  PID:14240
- C:\Windows\System\UFmFXBu.exe
  C:\Windows\System\UFmFXBu.exe
  2⤵
  PID:4448
- C:\Windows\System\QkHaDGN.exe
  C:\Windows\System\QkHaDGN.exe
  2⤵
  PID:5432
- C:\Windows\System\JNGwIYq.exe
  C:\Windows\System\JNGwIYq.exe
  2⤵
  PID:5152
- C:\Windows\System\TWJqgDp.exe
  C:\Windows\System\TWJqgDp.exe
  2⤵
  PID:6364
- C:\Windows\System\ImNzhGP.exe
  C:\Windows\System\ImNzhGP.exe
  2⤵
  PID:10896
- C:\Windows\System\QuIhghC.exe
  C:\Windows\System\QuIhghC.exe
  2⤵
  PID:13536
- C:\Windows\System\uVCxmuO.exe
  C:\Windows\System\uVCxmuO.exe
  2⤵
  PID:13388
- C:\Windows\System\QcbosyB.exe
  C:\Windows\System\QcbosyB.exe
  2⤵
  PID:13724
- C:\Windows\System\LkQXREk.exe
  C:\Windows\System\LkQXREk.exe
  2⤵
  PID:13740
- C:\Windows\System\zcOdlGS.exe
  C:\Windows\System\zcOdlGS.exe
  2⤵
  PID:1164
- C:\Windows\System\bGrJZHI.exe
  C:\Windows\System\bGrJZHI.exe
  2⤵
  PID:4244
- C:\Windows\System\CBXIDtE.exe
  C:\Windows\System\CBXIDtE.exe
  2⤵
  PID:13792
- C:\Windows\System\JMlQjoF.exe
  C:\Windows\System\JMlQjoF.exe
  2⤵
  PID:13216
- C:\Windows\System\SQjLOoH.exe
  C:\Windows\System\SQjLOoH.exe
  2⤵
  PID:13844
- C:\Windows\System\kcaYdby.exe
  C:\Windows\System\kcaYdby.exe
  2⤵
  PID:13528
- C:\Windows\System\PCPnlDl.exe
  C:\Windows\System\PCPnlDl.exe
  2⤵
  PID:14224
- C:\Windows\System\NWCepla.exe
  C:\Windows\System\NWCepla.exe
  2⤵
  PID:5976
- C:\Windows\System\MWAqgLv.exe
  C:\Windows\System\MWAqgLv.exe
  2⤵
  PID:5428
- C:\Windows\System\jJsiGuc.exe
  C:\Windows\System\jJsiGuc.exe
  2⤵
  PID:228
- C:\Windows\System\FVJJNPr.exe
  C:\Windows\System\FVJJNPr.exe
  2⤵
  PID:12144
- C:\Windows\System\LNEjKdW.exe
  C:\Windows\System\LNEjKdW.exe
  2⤵
  PID:320
- C:\Windows\System\hleYWNI.exe
  C:\Windows\System\hleYWNI.exe
  2⤵
  PID:12500
- C:\Windows\System\fVZURaP.exe
  C:\Windows\System\fVZURaP.exe
  2⤵
  PID:6228
- C:\Windows\System\qaXtxDR.exe
  C:\Windows\System\qaXtxDR.exe
  2⤵
  PID:14204
- C:\Windows\System\byYqNGo.exe
  C:\Windows\System\byYqNGo.exe
  2⤵
  PID:14296
- C:\Windows\System\nirkpfG.exe
  C:\Windows\System\nirkpfG.exe
  2⤵
  PID:14060
- C:\Windows\System\vramNUt.exe
  C:\Windows\System\vramNUt.exe
  2⤵
  PID:12108
- C:\Windows\System\MAguhrl.exe
  C:\Windows\System\MAguhrl.exe
  2⤵
  PID:10560
- C:\Windows\System\YvYJlqo.exe
  C:\Windows\System\YvYJlqo.exe
  2⤵
  PID:12796
- C:\Windows\System\hXmzCCa.exe
  C:\Windows\System\hXmzCCa.exe
  2⤵
  PID:13472
- C:\Windows\System\eSqFOHv.exe
  C:\Windows\System\eSqFOHv.exe
  2⤵
  PID:13428
- C:\Windows\System\ETFamzn.exe
  C:\Windows\System\ETFamzn.exe
  2⤵
  PID:8472
- C:\Windows\System\eTqSAve.exe
  C:\Windows\System\eTqSAve.exe
  2⤵
  PID:13744
- C:\Windows\System\JOCuKbT.exe
  C:\Windows\System\JOCuKbT.exe
  2⤵
  PID:3084
- C:\Windows\System\xidKhGJ.exe
  C:\Windows\System\xidKhGJ.exe
  2⤵
  PID:13952
- C:\Windows\System\XxIDuDS.exe
  C:\Windows\System\XxIDuDS.exe
  2⤵
  PID:5440
- C:\Windows\System\mvKAtaK.exe
  C:\Windows\System\mvKAtaK.exe
  2⤵
  PID:11068
- C:\Windows\System\CRSQsSd.exe
  C:\Windows\System\CRSQsSd.exe
  2⤵
  PID:14092
- C:\Windows\System\JjPKMcm.exe
  C:\Windows\System\JjPKMcm.exe
  2⤵
  PID:14196
- C:\Windows\System\YoVgGKQ.exe
  C:\Windows\System\YoVgGKQ.exe
  2⤵
  PID:13676
- C:\Windows\System\QXbbkWw.exe
  C:\Windows\System\QXbbkWw.exe
  2⤵
  PID:13508
- C:\Windows\System\WheZVpk.exe
  C:\Windows\System\WheZVpk.exe
  2⤵
  PID:13648
- C:\Windows\System\bpFZuSM.exe
  C:\Windows\System\bpFZuSM.exe
  2⤵
  PID:13920
- C:\Windows\System\DbRPxmD.exe
  C:\Windows\System\DbRPxmD.exe
  2⤵
  PID:14236
- C:\Windows\System\qRAUKAS.exe
  C:\Windows\System\qRAUKAS.exe
  2⤵
  PID:14328
- C:\Windows\System\CnZlRKv.exe
  C:\Windows\System\CnZlRKv.exe
  2⤵
  PID:4632
- C:\Windows\System\AnxYlmM.exe
  C:\Windows\System\AnxYlmM.exe
  2⤵
  PID:13576
- C:\Windows\System\HqKEiVc.exe
  C:\Windows\System\HqKEiVc.exe
  2⤵
  PID:2808
- C:\Windows\System\nylhWCZ.exe
  C:\Windows\System\nylhWCZ.exe
  2⤵
  PID:12340
- C:\Windows\System\qzcJRrm.exe
  C:\Windows\System\qzcJRrm.exe
  2⤵
  PID:6432
- C:\Windows\System\KrOacTR.exe
  C:\Windows\System\KrOacTR.exe
  2⤵
  PID:13708
- C:\Windows\System\cCWXNnb.exe
  C:\Windows\System\cCWXNnb.exe
  2⤵
  PID:14340
- C:\Windows\System\jVYcirV.exe
  C:\Windows\System\jVYcirV.exe
  2⤵
  PID:14356
- C:\Windows\System\mmcLZFN.exe
  C:\Windows\System\mmcLZFN.exe
  2⤵
  PID:14372
- C:\Windows\System\KhOoRTW.exe
  C:\Windows\System\KhOoRTW.exe
  2⤵
  PID:14388
- C:\Windows\System\HmjeNMW.exe
  C:\Windows\System\HmjeNMW.exe
  2⤵
  PID:14404
- C:\Windows\System\YRMDimR.exe
  C:\Windows\System\YRMDimR.exe
  2⤵
  PID:14420
- C:\Windows\System\tAwkLRo.exe
  C:\Windows\System\tAwkLRo.exe
  2⤵
  PID:14436
- C:\Windows\System\fgGUvbA.exe
  C:\Windows\System\fgGUvbA.exe
  2⤵
  PID:14452
- C:\Windows\System\pJKdmFb.exe
  C:\Windows\System\pJKdmFb.exe
  2⤵
  PID:15072
- C:\Windows\System\eKNemyK.exe
  C:\Windows\System\eKNemyK.exe
  2⤵
  PID:15104
- C:\Windows\System\LSGklHj.exe
  C:\Windows\System\LSGklHj.exe
  2⤵
  PID:15128
- C:\Windows\System\nPWeAHn.exe
  C:\Windows\System\nPWeAHn.exe
  2⤵
  PID:15148
- C:\Windows\System\BVooYQQ.exe
  C:\Windows\System\BVooYQQ.exe
  2⤵
  PID:15168
- C:\Windows\System\ERjewfX.exe
  C:\Windows\System\ERjewfX.exe
  2⤵
  PID:15184
- C:\Windows\System\CyqnRiM.exe
  C:\Windows\System\CyqnRiM.exe
  2⤵
  PID:15204
- C:\Windows\System\rcWVeyi.exe
  C:\Windows\System\rcWVeyi.exe
  2⤵
  PID:15224
- C:\Windows\System\GxjnxDa.exe
  C:\Windows\System\GxjnxDa.exe
  2⤵
  PID:15248
- C:\Windows\System\GweftDO.exe
  C:\Windows\System\GweftDO.exe
  2⤵
  PID:1516
- C:\Windows\System\LBXrIaH.exe
  C:\Windows\System\LBXrIaH.exe
  2⤵
  PID:5528
- C:\Windows\System\goejHln.exe
  C:\Windows\System\goejHln.exe
  2⤵
  PID:15256
- C:\Windows\System\cHBBPgY.exe
  C:\Windows\System\cHBBPgY.exe
  2⤵
  PID:15280
- C:\Windows\System\CpiXvNe.exe
  C:\Windows\System\CpiXvNe.exe
  2⤵
  PID:15300
- C:\Windows\System\ZGTIxWu.exe
  C:\Windows\System\ZGTIxWu.exe
  2⤵
  PID:15324
- C:\Windows\System\qFrzRYD.exe
  C:\Windows\System\qFrzRYD.exe
  2⤵
  PID:15344
- C:\Windows\System\DCeFFFX.exe
  C:\Windows\System\DCeFFFX.exe
  2⤵
  PID:14348
- C:\Windows\System\JQgopTj.exe
  C:\Windows\System\JQgopTj.exe
  2⤵
  PID:14384
- C:\Windows\System\pscAjGb.exe
  C:\Windows\System\pscAjGb.exe
  2⤵
  PID:14416
- C:\Windows\System\DtROlym.exe
  C:\Windows\System\DtROlym.exe
  2⤵
  PID:14468
- C:\Windows\System\pLkFoSs.exe
  C:\Windows\System\pLkFoSs.exe
  2⤵
  PID:14484
- C:\Windows\System\jUdAeox.exe
  C:\Windows\System\jUdAeox.exe
  2⤵
  PID:14504
- C:\Windows\System\swTzfLD.exe
  C:\Windows\System\swTzfLD.exe
  2⤵
  PID:14528
- C:\Windows\System\FeLYrmC.exe
  C:\Windows\System\FeLYrmC.exe
  2⤵
  PID:14544
- C:\Windows\System\gjmSyxp.exe
  C:\Windows\System\gjmSyxp.exe
  2⤵
  PID:14568
- C:\Windows\System\AvXiToB.exe
  C:\Windows\System\AvXiToB.exe
  2⤵
  PID:2396
- C:\Windows\System\kPSIiIy.exe
  C:\Windows\System\kPSIiIy.exe
  2⤵
  PID:372
- C:\Windows\System\xXIwZZF.exe
  C:\Windows\System\xXIwZZF.exe
  2⤵
  PID:464
- C:\Windows\System\cBIopGa.exe
  C:\Windows\System\cBIopGa.exe
  2⤵
  PID:4884
- C:\Windows\System\lcNmcza.exe
  C:\Windows\System\lcNmcza.exe
  2⤵
  PID:5156
- C:\Windows\System\VezwjXa.exe
  C:\Windows\System\VezwjXa.exe
  2⤵
  PID:14612
- C:\Windows\System\SsKRMmt.exe
  C:\Windows\System\SsKRMmt.exe
  2⤵
  PID:14636
- C:\Windows\System\NmIydHx.exe
  C:\Windows\System\NmIydHx.exe
  2⤵
  PID:14656
- C:\Windows\System\lCVVOGW.exe
  C:\Windows\System\lCVVOGW.exe
  2⤵
  PID:14672
- C:\Windows\System\yDlIiME.exe
  C:\Windows\System\yDlIiME.exe
  2⤵
  PID:14704
- C:\Windows\System\DRrwAbs.exe
  C:\Windows\System\DRrwAbs.exe
  2⤵
  PID:14716
- C:\Windows\System\eSmMXmH.exe
  C:\Windows\System\eSmMXmH.exe
  2⤵
  PID:2356
- C:\Windows\System\JbcbXBy.exe
  C:\Windows\System\JbcbXBy.exe
  2⤵
  PID:14700
- C:\Windows\System\SOcjcRq.exe
  C:\Windows\System\SOcjcRq.exe
  2⤵
  PID:14752
- C:\Windows\System\ceIyGfs.exe
  C:\Windows\System\ceIyGfs.exe
  2⤵
  PID:14776
- C:\Windows\System\acZfMRT.exe
  C:\Windows\System\acZfMRT.exe
  2⤵
  PID:14800
- C:\Windows\System\hjVLSmo.exe
  C:\Windows\System\hjVLSmo.exe
  2⤵
  PID:14840
- C:\Windows\System\UYaVGjJ.exe
  C:\Windows\System\UYaVGjJ.exe
  2⤵
  PID:14860
- C:\Windows\System\iZOsNNJ.exe
  C:\Windows\System\iZOsNNJ.exe
  2⤵
  PID:14872
- C:\Windows\System\PTsqgQQ.exe
  C:\Windows\System\PTsqgQQ.exe
  2⤵
  PID:14892
- C:\Windows\System\tCNFfUo.exe
  C:\Windows\System\tCNFfUo.exe
  2⤵
  PID:14944
- C:\Windows\System\mvyimrm.exe
  C:\Windows\System\mvyimrm.exe
  2⤵
  PID:14968
- C:\Windows\System\RhYtCyk.exe
  C:\Windows\System\RhYtCyk.exe
  2⤵
  PID:14984
- C:\Windows\System\gFVgWDK.exe
  C:\Windows\System\gFVgWDK.exe
  2⤵
  PID:15000
- C:\Windows\System\WdPtfMv.exe
  C:\Windows\System\WdPtfMv.exe
  2⤵
  PID:15016
- C:\Windows\System\yyAlExR.exe
  C:\Windows\System\yyAlExR.exe
  2⤵
  PID:1392
- C:\Windows\System\EEXMniY.exe
  C:\Windows\System\EEXMniY.exe
  2⤵
  PID:15044
- C:\Windows\System\YIjFUdR.exe
  C:\Windows\System\YIjFUdR.exe
  2⤵
  PID:15088
- C:\Windows\System\XKnYKDe.exe
  C:\Windows\System\XKnYKDe.exe
  2⤵
  PID:3396
- C:\Windows\System\xyvvweq.exe
  C:\Windows\System\xyvvweq.exe
  2⤵
  PID:4492
- C:\Windows\System\ZiSOgNR.exe
  C:\Windows\System\ZiSOgNR.exe
  2⤵
  PID:15176
- C:\Windows\System\XvnUmIo.exe
  C:\Windows\System\XvnUmIo.exe
  2⤵
  PID:3928
- C:\Windows\System\jacTfAc.exe
  C:\Windows\System\jacTfAc.exe
  2⤵
  PID:15236
- C:\Windows\System\lCbDqmD.exe
  C:\Windows\System\lCbDqmD.exe
  2⤵
  PID:15244
- C:\Windows\System\wFRfyTV.exe
  C:\Windows\System\wFRfyTV.exe
  2⤵
  PID:3948
- C:\Windows\System\PHprQFI.exe
  C:\Windows\System\PHprQFI.exe
  2⤵
  PID:3360
- C:\Windows\System\GFtNZUY.exe
  C:\Windows\System\GFtNZUY.exe
  2⤵
  PID:15316
- C:\Windows\System\LHblyhM.exe
  C:\Windows\System\LHblyhM.exe
  2⤵
  PID:14380
- C:\Windows\System\vaaNsKW.exe
  C:\Windows\System\vaaNsKW.exe
  2⤵
  PID:14476
- C:\Windows\System\fKlQVzn.exe
  C:\Windows\System\fKlQVzn.exe
  2⤵
  PID:14512
- C:\Windows\System\IdKznkk.exe
  C:\Windows\System\IdKznkk.exe
  2⤵
  PID:3856
- C:\Windows\System\QKMFuYP.exe
  C:\Windows\System\QKMFuYP.exe
  2⤵
  PID:3228
- C:\Windows\System\dkQzmTU.exe
  C:\Windows\System\dkQzmTU.exe
  2⤵
  PID:3700
- C:\Windows\System\OncMZve.exe
  C:\Windows\System\OncMZve.exe
  2⤵
  PID:6576
- C:\Windows\System\aDuuvZL.exe
  C:\Windows\System\aDuuvZL.exe
  2⤵
  PID:14624
- C:\Windows\System\rSZynWi.exe
  C:\Windows\System\rSZynWi.exe
  2⤵
  PID:14648
- C:\Windows\System\THCOBuu.exe
  C:\Windows\System\THCOBuu.exe
  2⤵
  PID:2820
- C:\Windows\System\YJypjOn.exe
  C:\Windows\System\YJypjOn.exe
  2⤵
  PID:14652
- C:\Windows\System\LQttgyv.exe
  C:\Windows\System\LQttgyv.exe
  2⤵
  PID:14664
- C:\Windows\System\AOlIDRg.exe
  C:\Windows\System\AOlIDRg.exe
  2⤵
  PID:14712
- C:\Windows\System\DobfLin.exe
  C:\Windows\System\DobfLin.exe
  2⤵
  PID:1972
- C:\Windows\System\HBsgJMt.exe
  C:\Windows\System\HBsgJMt.exe
  2⤵
  PID:912
- C:\Windows\System\zLAArjS.exe
  C:\Windows\System\zLAArjS.exe
  2⤵
  PID:14748
- C:\Windows\System\jLNACxY.exe
  C:\Windows\System\jLNACxY.exe
  2⤵
  PID:4908
- C:\Windows\System\TlxHDWS.exe
  C:\Windows\System\TlxHDWS.exe
  2⤵
  PID:3932
- C:\Windows\System\zflCWJD.exe
  C:\Windows\System\zflCWJD.exe
  2⤵
  PID:14808
- C:\Windows\System\yyZteuq.exe
  C:\Windows\System\yyZteuq.exe
  2⤵
  PID:5392
- C:\Windows\System\YYOKbtL.exe
  C:\Windows\System\YYOKbtL.exe
  2⤵
  PID:14828
- C:\Windows\System\tszlOcb.exe
  C:\Windows\System\tszlOcb.exe
  2⤵
  PID:14888
- C:\Windows\System\FaQuaQz.exe
  C:\Windows\System\FaQuaQz.exe
  2⤵
  PID:14992
- C:\Windows\System\tPJdVyi.exe
  C:\Windows\System\tPJdVyi.exe
  2⤵
  PID:14956
- C:\Windows\System\VOGIAsa.exe
  C:\Windows\System\VOGIAsa.exe
  2⤵
  PID:5396
- C:\Windows\System\AenthMi.exe
  C:\Windows\System\AenthMi.exe
  2⤵
  PID:15008
- C:\Windows\System\qWOujpu.exe
  C:\Windows\System\qWOujpu.exe
  2⤵
  PID:14936
- C:\Windows\System\EoaKBfu.exe
  C:\Windows\System\EoaKBfu.exe
  2⤵
  PID:5400
- C:\Windows\System\aPbVDdm.exe
  C:\Windows\System\aPbVDdm.exe
  2⤵
  PID:2532
- C:\Windows\System\ISNvNsH.exe
  C:\Windows\System\ISNvNsH.exe
  2⤵
  PID:15100
- C:\Windows\System\IJdhpiq.exe
  C:\Windows\System\IJdhpiq.exe
  2⤵
  PID:15320
- C:\Windows\System\VxEvUkS.exe
  C:\Windows\System\VxEvUkS.exe
  2⤵
  PID:4628
- C:\Windows\System\pNZDKak.exe
  C:\Windows\System\pNZDKak.exe
  2⤵
  PID:5244
- C:\Windows\System\HloPyPl.exe
  C:\Windows\System\HloPyPl.exe
  2⤵
  PID:3968
- C:\Windows\System\hitLzFH.exe
  C:\Windows\System\hitLzFH.exe
  2⤵
  PID:5464
- C:\Windows\System\XMUGQTU.exe
  C:\Windows\System\XMUGQTU.exe
  2⤵
  PID:15012
- C:\Windows\System\adRIjrT.exe
  C:\Windows\System\adRIjrT.exe
  2⤵
  PID:15040
- C:\Windows\System\iQfASAU.exe
  C:\Windows\System\iQfASAU.exe
  2⤵
  PID:15064
- C:\Windows\System\IsmYnSl.exe
  C:\Windows\System\IsmYnSl.exe
  2⤵
  PID:5492
- C:\Windows\System\UKePtxy.exe
  C:\Windows\System\UKePtxy.exe
  2⤵
  PID:15340
- C:\Windows\System\otehydP.exe
  C:\Windows\System\otehydP.exe
  2⤵
  PID:3960
- C:\Windows\System\IEeBmWL.exe
  C:\Windows\System\IEeBmWL.exe
  2⤵
  PID:14460
- C:\Windows\System\YcDIDkP.exe
  C:\Windows\System\YcDIDkP.exe
  2⤵
  PID:15192
- C:\Windows\System\BEublff.exe
  C:\Windows\System\BEublff.exe
  2⤵
  PID:15196
- C:\Windows\System\ClwnvjL.exe
  C:\Windows\System\ClwnvjL.exe
  2⤵
  PID:1336
- C:\Windows\System\bJPJcEa.exe
  C:\Windows\System\bJPJcEa.exe
  2⤵
  PID:15352
- C:\Windows\System\SYpbeUQ.exe
  C:\Windows\System\SYpbeUQ.exe
  2⤵
  PID:2036
- C:\Windows\System\BJFQMFC.exe
  C:\Windows\System\BJFQMFC.exe
  2⤵
  PID:14680
- C:\Windows\System\zJlEVve.exe
  C:\Windows\System\zJlEVve.exe
  2⤵
  PID:4416
- C:\Windows\System\cppCzgw.exe
  C:\Windows\System\cppCzgw.exe
  2⤵
  PID:2060
- C:\Windows\System\mnJLiZR.exe
  C:\Windows\System\mnJLiZR.exe
  2⤵
  PID:14432
- C:\Windows\System\EVblhrO.exe
  C:\Windows\System\EVblhrO.exe
  2⤵
  PID:5416
- C:\Windows\System\BAcOZfo.exe
  C:\Windows\System\BAcOZfo.exe
  2⤵
  PID:5468
- C:\Windows\System\CCQfmrB.exe
  C:\Windows\System\CCQfmrB.exe
  2⤵
  PID:2564
- C:\Windows\System\eLoSAcd.exe
  C:\Windows\System\eLoSAcd.exe
  2⤵
  PID:632
- C:\Windows\System\GhfiMWg.exe
  C:\Windows\System\GhfiMWg.exe
  2⤵
  PID:14792
- C:\Windows\System\mrRoqvl.exe
  C:\Windows\System\mrRoqvl.exe
  2⤵
  PID:5356
- C:\Windows\System\PLgueWJ.exe
  C:\Windows\System\PLgueWJ.exe
  2⤵
  PID:5368
- C:\Windows\System\xZmMogJ.exe
  C:\Windows\System\xZmMogJ.exe
  2⤵
  PID:3916
- C:\Windows\System\toHtcVj.exe
  C:\Windows\System\toHtcVj.exe
  2⤵
  PID:5560
- C:\Windows\System\cCAwCkk.exe
  C:\Windows\System\cCAwCkk.exe
  2⤵
  PID:14744
- C:\Windows\System\eRgEKfU.exe
  C:\Windows\System\eRgEKfU.exe
  2⤵
  PID:4676
- C:\Windows\System\GuYKkdD.exe
  C:\Windows\System\GuYKkdD.exe
  2⤵
  PID:2960
- C:\Windows\System\dheslov.exe
  C:\Windows\System\dheslov.exe
  2⤵
  PID:4772
- C:\Windows\System\RDBFMGb.exe
  C:\Windows\System\RDBFMGb.exe
  2⤵
  PID:5796
- C:\Windows\System\FfwXFgW.exe
  C:\Windows\System\FfwXFgW.exe
  2⤵
  PID:1480
- C:\Windows\System\xjbfGLL.exe
  C:\Windows\System\xjbfGLL.exe
  2⤵
  PID:2196
- C:\Windows\System\anwkaBO.exe
  C:\Windows\System\anwkaBO.exe
  2⤵
  PID:5820
- C:\Windows\System\ceOEojw.exe
  C:\Windows\System\ceOEojw.exe
  2⤵
  PID:14796
- C:\Windows\System\dinGygk.exe
  C:\Windows\System\dinGygk.exe
  2⤵
  PID:14812
- C:\Windows\System\JFcBMLN.exe
  C:\Windows\System\JFcBMLN.exe
  2⤵
  PID:5900
- C:\Windows\System\zGZivVo.exe
  C:\Windows\System\zGZivVo.exe
  2⤵
  PID:14896
- C:\Windows\System\tsxAuGz.exe
  C:\Windows\System\tsxAuGz.exe
  2⤵
  PID:14908
- C:\Windows\System\urlcYLM.exe
  C:\Windows\System\urlcYLM.exe
  2⤵
  PID:3080
- C:\Windows\System\jgzxXKH.exe
  C:\Windows\System\jgzxXKH.exe
  2⤵
  PID:14924
- C:\Windows\System\VeqnmFE.exe
  C:\Windows\System\VeqnmFE.exe
  2⤵
  PID:14932
- C:\Windows\System\LYTGize.exe
  C:\Windows\System\LYTGize.exe
  2⤵
  PID:5932
- C:\Windows\System\HltZZnb.exe
  C:\Windows\System\HltZZnb.exe
  2⤵
  PID:4840
- C:\Windows\System\NrrDAyo.exe
  C:\Windows\System\NrrDAyo.exe
  2⤵
  PID:15232
- C:\Windows\System\jwPuFbX.exe
  C:\Windows\System\jwPuFbX.exe
  2⤵
  PID:3668
- C:\Windows\System\mCtYxnx.exe
  C:\Windows\System\mCtYxnx.exe
  2⤵
  PID:5208
- C:\Windows\System\rZawedu.exe
  C:\Windows\System\rZawedu.exe
  2⤵
  PID:5444
- C:\Windows\System\jNeHGeT.exe
  C:\Windows\System\jNeHGeT.exe
  2⤵
  PID:5300
- C:\Windows\System\fmcMWUl.exe
  C:\Windows\System\fmcMWUl.exe
  2⤵
  PID:6132
- C:\Windows\System\rIwlMHR.exe
  C:\Windows\System\rIwlMHR.exe
  2⤵
  PID:15140
- C:\Windows\System\MxOUSxd.exe
  C:\Windows\System\MxOUSxd.exe
  2⤵
  PID:1844
- C:\Windows\System\QhRFkhY.exe
  C:\Windows\System\QhRFkhY.exe
  2⤵
  PID:4272
- C:\Windows\System\Zvlfthd.exe
  C:\Windows\System\Zvlfthd.exe
  2⤵
  PID:5084
- C:\Windows\System\aWjRkNw.exe
  C:\Windows\System\aWjRkNw.exe
  2⤵
  PID:2712
- C:\Windows\System\qmOIowh.exe
  C:\Windows\System\qmOIowh.exe
  2⤵
  PID:15288
- C:\Windows\System\UADybSP.exe
  C:\Windows\System\UADybSP.exe
  2⤵
  PID:5348
- C:\Windows\System\IorpxbS.exe
  C:\Windows\System\IorpxbS.exe
  2⤵
  PID:5364
- C:\Windows\System\PHTOVkQ.exe
  C:\Windows\System\PHTOVkQ.exe
  2⤵
  PID:14500
- C:\Windows\System\EHNaobs.exe
  C:\Windows\System\EHNaobs.exe
  2⤵
  PID:1404
- C:\Windows\System\GpuvZVD.exe
  C:\Windows\System\GpuvZVD.exe
  2⤵
  PID:4380
- C:\Windows\System\fLGlsbc.exe
  C:\Windows\System\fLGlsbc.exe
  2⤵
  PID:1764
- C:\Windows\System\CSMIAcp.exe
  C:\Windows\System\CSMIAcp.exe
  2⤵
  PID:3720
- C:\Windows\System\zbqNRqS.exe
  C:\Windows\System\zbqNRqS.exe
  2⤵
  PID:14572
- C:\Windows\System\RgjIrAN.exe
  C:\Windows\System\RgjIrAN.exe
  2⤵
  PID:5568
- C:\Windows\System\qBqvtRC.exe
  C:\Windows\System\qBqvtRC.exe
  2⤵
  PID:14768
- C:\Windows\System\ZPcBdNP.exe
  C:\Windows\System\ZPcBdNP.exe
  2⤵
  PID:5516
- C:\Windows\System\ealvIIc.exe
  C:\Windows\System\ealvIIc.exe
  2⤵
  PID:5784
- C:\Windows\System\Iadqgkh.exe
  C:\Windows\System\Iadqgkh.exe
  2⤵
  PID:14628
- C:\Windows\System\WIpYnGk.exe
  C:\Windows\System\WIpYnGk.exe
  2⤵
  PID:5512
- C:\Windows\System\CSpnTVB.exe
  C:\Windows\System\CSpnTVB.exe
  2⤵
  PID:5176
- C:\Windows\System\uWzSuiE.exe
  C:\Windows\System\uWzSuiE.exe
  2⤵
  PID:14884
- C:\Windows\System\kynMlDC.exe
  C:\Windows\System\kynMlDC.exe
  2⤵
  PID:14836
- C:\Windows\System\tPziyoG.exe
  C:\Windows\System\tPziyoG.exe
  2⤵
  PID:5924
- C:\Windows\System\rqClFxt.exe
  C:\Windows\System\rqClFxt.exe
  2⤵
  PID:15080
- C:\Windows\System\BEyBeDk.exe
  C:\Windows\System\BEyBeDk.exe
  2⤵
  PID:5720
- C:\Windows\System\LsqdutW.exe
  C:\Windows\System\LsqdutW.exe
  2⤵
  PID:6104
- C:\Windows\System\YoxYuNO.exe
  C:\Windows\System\YoxYuNO.exe
  2⤵
  PID:15296
- C:\Windows\System\kdyVwAB.exe
  C:\Windows\System\kdyVwAB.exe
  2⤵
  PID:3684
- C:\Windows\System\RaqjEdk.exe
  C:\Windows\System\RaqjEdk.exe
  2⤵
  PID:1456
- C:\Windows\System\IXrFlvT.exe
  C:\Windows\System\IXrFlvT.exe
  2⤵
  PID:3884
- C:\Windows\System\Jwpptht.exe
  C:\Windows\System\Jwpptht.exe
  2⤵
  PID:3008
- C:\Windows\System\bWLLuEZ.exe
  C:\Windows\System\bWLLuEZ.exe
  2⤵
  PID:1876
- C:\Windows\System\JTKgWFa.exe
  C:\Windows\System\JTKgWFa.exe
  2⤵
  PID:1056
- C:\Windows\System\eOMxxtm.exe
  C:\Windows\System\eOMxxtm.exe
  2⤵
  PID:3356
- C:\Windows\System\TNCtSTn.exe
  C:\Windows\System\TNCtSTn.exe
  2⤵
  PID:4576
- C:\Windows\System\IWBYTob.exe
  C:\Windows\System\IWBYTob.exe
  2⤵
  PID:1400
- C:\Windows\System\YJZjeJW.exe
  C:\Windows\System\YJZjeJW.exe
  2⤵
  PID:4304
- C:\Windows\System\jSWHxlO.exe
  C:\Windows\System\jSWHxlO.exe
  2⤵
  PID:14552
- C:\Windows\System\gwwmwDN.exe
  C:\Windows\System\gwwmwDN.exe
  2⤵
  PID:4688
- C:\Windows\System\HihyCQy.exe
  C:\Windows\System\HihyCQy.exe
  2⤵
  PID:4788
- C:\Windows\System\ovQsABg.exe
  C:\Windows\System\ovQsABg.exe
  2⤵
  PID:2660
- C:\Windows\System\QQSWpnD.exe
  C:\Windows\System\QQSWpnD.exe
  2⤵
  PID:5164
- C:\Windows\System\XEKpySc.exe
  C:\Windows\System\XEKpySc.exe
  2⤵
  PID:5888
- C:\Windows\System\dRpUFeK.exe
  C:\Windows\System\dRpUFeK.exe
  2⤵
  PID:4972
- C:\Windows\System\iVeuDEE.exe
  C:\Windows\System\iVeuDEE.exe
  2⤵
  PID:14960
- C:\Windows\System\fOGViUr.exe
  C:\Windows\System\fOGViUr.exe
  2⤵
  PID:5640
- C:\Windows\System\picMNvc.exe
  C:\Windows\System\picMNvc.exe
  2⤵
  PID:3704
- C:\Windows\System\mmnEePv.exe
  C:\Windows\System\mmnEePv.exe
  2⤵
  PID:1588
- C:\Windows\System\ZDbRsdQ.exe
  C:\Windows\System\ZDbRsdQ.exe
  2⤵
  PID:15272
- C:\Windows\System\bjLDbuK.exe
  C:\Windows\System\bjLDbuK.exe
  2⤵
  PID:14760
- C:\Windows\System\SZbcMUT.exe
  C:\Windows\System\SZbcMUT.exe
  2⤵
  PID:6032
- C:\Windows\System\LDflJeB.exe
  C:\Windows\System\LDflJeB.exe
  2⤵
  PID:14692
- C:\Windows\System\sDUcBPD.exe
  C:\Windows\System\sDUcBPD.exe
  2⤵
  PID:5320
- C:\Windows\System\mJWFddi.exe
  C:\Windows\System\mJWFddi.exe
  2⤵
  PID:14952
- C:\Windows\System\AipDKos.exe
  C:\Windows\System\AipDKos.exe
  2⤵
  PID:5452
- C:\Windows\System\VtwtPKR.exe
  C:\Windows\System\VtwtPKR.exe
  2⤵
  PID:6200
- C:\Windows\System\jpcPmEq.exe
  C:\Windows\System\jpcPmEq.exe
  2⤵
  PID:6016
- C:\Windows\System\RCtwoLs.exe
  C:\Windows\System\RCtwoLs.exe
  2⤵
  PID:6100
- C:\Windows\System\lqlZzau.exe
  C:\Windows\System\lqlZzau.exe
  2⤵
  PID:4748
- C:\Windows\System\JTbqCqK.exe
  C:\Windows\System\JTbqCqK.exe
  2⤵
  PID:4800
- C:\Windows\System\eqybKvX.exe
  C:\Windows\System\eqybKvX.exe
  2⤵
  PID:6048
- C:\Windows\System\wqJSIOX.exe
  C:\Windows\System\wqJSIOX.exe
  2⤵
  PID:6224
- C:\Windows\System\eQdPDbw.exe
  C:\Windows\System\eQdPDbw.exe
  2⤵
  PID:5224
- C:\Windows\System\soRJOyJ.exe
  C:\Windows\System\soRJOyJ.exe
  2⤵
  PID:6324
- C:\Windows\System\nkfFYPu.exe
  C:\Windows\System\nkfFYPu.exe
  2⤵
  PID:6340
- C:\Windows\System\dUNgXHC.exe
  C:\Windows\System\dUNgXHC.exe
  2⤵
  PID:2436
- C:\Windows\System\ELYCawh.exe
  C:\Windows\System\ELYCawh.exe
  2⤵
  PID:2860
- C:\Windows\System\TcSBeSO.exe
  C:\Windows\System\TcSBeSO.exe
  2⤵
  PID:5372
- C:\Windows\System\qaZnjqp.exe
  C:\Windows\System\qaZnjqp.exe
  2⤵
  PID:6348
- C:\Windows\System\CTDwJSX.exe
  C:\Windows\System\CTDwJSX.exe
  2⤵
  PID:3392
- C:\Windows\System\FFlcoaH.exe
  C:\Windows\System\FFlcoaH.exe
  2⤵
  PID:5536
- C:\Windows\System\bocEHZP.exe
  C:\Windows\System\bocEHZP.exe
  2⤵
  PID:1380
- C:\Windows\System\pjSbSKu.exe
  C:\Windows\System\pjSbSKu.exe
  2⤵
  PID:15068
- C:\Windows\System\MSuBWem.exe
  C:\Windows\System\MSuBWem.exe
  2⤵
  PID:1340
- C:\Windows\System\YEwEmYv.exe
  C:\Windows\System\YEwEmYv.exe
  2⤵
  PID:3676
- C:\Windows\System\cZNcQDy.exe
  C:\Windows\System\cZNcQDy.exe
  2⤵
  PID:6204
- C:\Windows\System\xAExNLV.exe
  C:\Windows\System\xAExNLV.exe
  2⤵
  PID:4904

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 13208 -ip 13208
1⤵
PID:6576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 13156 -ip 13156
1⤵
PID:3864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 12876 -ip 12876
1⤵
PID:8860

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 724 -p 12760 -ip 12760
1⤵
PID:12128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 11904 -ip 11904
1⤵
PID:13432

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yzzxx1cq.lip.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CJOeppv.exe

Filesize
1.7MB

MD5
eff841c6cac2e07071462bed78cb7a67

SHA1
db30747533f05a9dc3c1102b32a662b23717a1b8

SHA256
d35b2544ca830830a91bb5766a89fa90be5bb8e762bbcefa7bd9df0d7e6e1842

SHA512
683dd9e70571d88f3e1440e5cac54d6f593481eee0bfe7b8b538523ffe01128a88e927aaa1db81d122645587afa1b1511d17f1454553edee842af027e72f95c7

Download Submit
C:\Windows\System\DWobBic.exe

Filesize
1.7MB

MD5
710aecf95d16d881a365201b0775f434

SHA1
74b83c0dec0d3ce5def9aaa3f3d4b4a7f061855e

SHA256
7f683a6fac9fc053d555bb53cd60a7fff4abf2930fc236c1d536e7702834fdef

SHA512
b7b85e815d6a5fdfb0939fb440c96051a77fd37c5b45c14185cfde378103e5a3fd1ccea2e01ae1d296a4ecdcb321eadf47aca4dcacbda2f8b11fc3dd8778e127

Download Submit
C:\Windows\System\DkoyrbU.exe

Filesize
1.7MB

MD5
a5fac07a7f69abf78e7c4dde93fb5400

SHA1
4d21ffbc282a148723be72ba817c11d80e438c0a

SHA256
f507df9db1c22f85e943413ac7e732a83fe5e4fcbdb18a482420637df90f0a7d

SHA512
7001ce94721533fe302a283407df5a96787054b6eb03cf34e5e1ec657985a215d64f6e7d099de06c71d0c87c5f8cc375296aa3fcaa2736f1864e2f1cbbae4d42

Download Submit
C:\Windows\System\FpSfFqE.exe

Filesize
1.7MB

MD5
ed6edcaf3fb94caabb7c741dd5043c91

SHA1
b0cb7e464281fc73a99059ad5103c35eeead9904

SHA256
3968019d292565a90746c29d34749524a4d27593b398f6c6df8f45cb1971aa47

SHA512
665f98e5f227a3bb18e9d3e748982df9b0ee8b9fc87053a08024cd68736bd969afdc452be1cb50bc2bf94710b463796526a009804101f0325e2dabd9ed620209

Download Submit
C:\Windows\System\GulFOGJ.exe

Filesize
1.7MB

MD5
a0a3cc4ba82b56b0079d68e4f7733104

SHA1
3940cb08475ecdc8bc7d54017dc28b565adac1a4

SHA256
a935ceba42aca102653ec69fbda9cb0bfd19565370191ec4ff953e22da8e554b

SHA512
bff2cc4bb3a3871f10052bb05f2874712be2fc5f7cd56d29bb443c656d883275ceaa988070daaaefeca5c9172413a315984af5e95c815cf9a4dbfd904d196849

Download Submit
C:\Windows\System\HBgbvWi.exe

Filesize
1.7MB

MD5
182d6e1f9562a19b67767b02f51b4950

SHA1
0f34d144a1346cd1a176780aaa4a456fc838c9f7

SHA256
56cbcd276cd98d83758cd20456001311a5ac3dac58fb204848b3ca005f404b39

SHA512
e155b76e988b8178e444188d00f65422fd78d0774f3ad124868009db1dcd8465676050e89b5547fee2194d4c116b6ae4190977a8ebca00e2fb2a7022820557a0

Download Submit
C:\Windows\System\KfLvSkE.exe

Filesize
1.7MB

MD5
db1ce55ff24594961de1d8cb02942440

SHA1
944910015d8985aafa807a1c040a4348608bb707

SHA256
82ef5aadbda42424996d0e915ad96deb3407743dba1cb98b93d3371a3089a40b

SHA512
1d34bd2db5c56406d98e31f207b438c65a523734c5cb336f732978de21252f283e8631c871fe9e600aba7098b057a860351ffb16cc7c35ed6f58a4d38f319d53

Download Submit
C:\Windows\System\LRBHvTu.exe

Filesize
1.7MB

MD5
bfcc9eef74b16a895785fb4aaaebca05

SHA1
025c67dc89bcaa75d19e7954d443c0feae53705e

SHA256
c6b88d09983df11120de7d75add2a85f864f4a3c318409cd5565ac501e764df9

SHA512
3c2312730a973f3ed4674ebca1d0420e1832bd21bb97b2f0b53065ce12310e20b902ccfa17b37bb42e26dc1feac956ecf86d1f67addabb84422055e20be6325f

Download Submit
C:\Windows\System\MiNmYEJ.exe

Filesize
1.7MB

MD5
5221a03e63625981b608f1ab1614c134

SHA1
fc26dc4a74153bdc93439fcb8848bf6253b99bbf

SHA256
a41131da053848462f454bc17efccea1dd6524db102274863f31443c980117e4

SHA512
db4fd399820fea862e24602e93466ce1868eba4979bbcbfaedaa12a47acdcac5dcb65608697cb2b647e9405aac9aaed28b2e3b5a224b39d9d989f8bd3796f10f

Download Submit
C:\Windows\System\MoEPCvy.exe

Filesize
1.7MB

MD5
1e8a0dccde98b6fafc82bf374c74d699

SHA1
a028406a343c4c83b0b8d03f15f27b7c3d452019

SHA256
899a97da85d1d3f80e56534115471696bbbc55d95f948c3b60785eda86ff092f

SHA512
b40148e0d630d67372d607e8a8a666b2539245f49292d1d8108e673b0f152244c72aec78d10392d1e75ccda1489c6ed9fc7e8a5f94273f2438c7f3a9436f316e

Download Submit
C:\Windows\System\OhadHgS.exe

Filesize
1.7MB

MD5
83573af0efeec609e7587d96e96af254

SHA1
a8e45e06506d4ff8985d3b1ef0373806edbaafb8

SHA256
1967cc902e42555f822b52e078e697e3570d630679d43c09ea115cc1ccb3accf

SHA512
64919bc3d88d29eb3882e94632af46d28f7267527af58f3b0db4e2432cede67d1ab2eb7d555974aea431923a47aae73df999126ae7c0e35b6c1a6581c327a7c0

Download Submit
C:\Windows\System\QRgYeSu.exe

Filesize
1.7MB

MD5
6f3cf4fe88994f0b5db070deef415e1c

SHA1
9c7decd41d01abae24c10abac97957fb6131dccc

SHA256
c9aab0b6d0829771a365befc8a02b2b344c23fcab70d83b9f0e10947c2c108f7

SHA512
9f0f15acac0eeed4b15537489195fedafd95bc908c90513a50b66fe2972cc48cbc4e6f412a3dd327cf87985bf2298bcdf6c431262f18ac0e89da05ab79fd7415

Download Submit
C:\Windows\System\QuYNTQn.exe

Filesize
1.7MB

MD5
bd2bb13da3bf6e758e06b11c7a182b7f

SHA1
b1da749860f3618abaded9ff848e4a49f2d8f4e0

SHA256
1ad4d9517af68958a6ff722419cdcf6464f820c811767f1a408bdb763c89c4c3

SHA512
772d44bf074b99e00c12fda6172ab2707b9e4c719faf9be4efd2c3002162aefcc1b65c7a283c04e50302f071bff6112210fd40ef1433248133b269a62f3b1bf4

Download Submit
C:\Windows\System\QuamXsE.exe

Filesize
1.7MB

MD5
16f7583337ce0443afc2037b0ad41c36

SHA1
83f5ea5318c95787a2696370f1c8c61abd0d934c

SHA256
a896fcf0be48f14375e950eb73bd77ed7aaaddfcbc6ee252b1c5dd97d0b15063

SHA512
df73f6a2f3a08a22a4025703d475a28115e87e445be0c8a59bc7301c6dbf220fe010927ad631c5daee43bd53f91797ec31de126e030847753fa89397d8e0f941

Download Submit
C:\Windows\System\QuybopT.exe

Filesize
1.7MB

MD5
417060c559a3e99c927e5980536e2fe6

SHA1
b49bd20de23bc3c470e55042eb5cfb16ea78fa2b

SHA256
6e6601fba8090c3c520e1394b3d5ac651ad05e1fb8823b004cf3690c98de114c

SHA512
c8718b6af3fd0cd5362d50eb1bde44558662eccfcb4815a038345222405662f93588fea5cf77dffa28b39652019db04af3ec2510b38ef0d68082fa71a7c49d40

Download Submit
C:\Windows\System\UFkgUtu.exe

Filesize
1.7MB

MD5
4d240d5fc0821073c370e5ff7517dc29

SHA1
47216580fd6e8dc1200342550d4ec42cb9c2a0a4

SHA256
08f015b290eb15dd96cdbf8b72594673e136adb8d0227eff7085dcf5bd49c19d

SHA512
eb51e5cd0b5456afef77b3eefb5f0d70c426295b42cc804f1ac6e307dbfc86e4256a888bbe8acd47ca35d38abc84c40bf82e8194169054634d2a2935a2efc7fe

Download Submit
C:\Windows\System\VAlNTvs.exe

Filesize
1.7MB

MD5
bdbf5e3fc540429b08df72085924eec1

SHA1
28e162ac0e664b01f21727c80ec4e0f0e238691f

SHA256
4bad552c3c65f0caac384aaeffa56ac34dbbd7e79837d9412436e2d2aca51dbb

SHA512
39375b450b0a1ca339d982f2cde3e0dcde4f5b4ad466533da8b6f22dda1c2171c80b50b80035ee418467d9bb81509edf78f03dcda7853d1659c5b268fd58c8e1

Download Submit
C:\Windows\System\WudVPWU.exe

Filesize
1.7MB

MD5
d34d66a07a75a0b561f74718034efef3

SHA1
127aa0de7587a7cd768d54f54abfa6fb63ce620d

SHA256
13d1f27e473c8f24f9564b67a587c35fc659de1d1bfcecd1645d7bb51f736ef9

SHA512
a5febd8adf3c707ffce6fab2da0a27e692a965763e711914b5a0921c82cc7d6d461200bb7939cb7a7473478bdba0d2ba0838487c539af44e26da94c1c5855758

Download Submit
C:\Windows\System\XaFStZC.exe

Filesize
1.7MB

MD5
85a4f7bb5e9c84f03fd666dc67b97da2

SHA1
2816356e174a7703631759c038cd8aa63036fb72

SHA256
3937e838c3f2fd9a2834d4a92f3a570149dd18ef13805774747503698e39c06a

SHA512
4abc6f25a1887d963c41d9b0c8e642796719b82f4107fa592aff10dbb0360b9f0de788cf509f52c28eb2fdc4914930d6f260c76dc249e4a8fca18f5969f8178a

Download Submit
C:\Windows\System\XcqltRr.exe

Filesize
1.7MB

MD5
98a45c8770bc6822067b2531b17727a0

SHA1
a3acb307624b6253ae7729daba8a380fbed5525b

SHA256
255388c489f0a59fed99b0a6b63e2517ce6dc957393e2900b9f86a941f306bba

SHA512
9954c3eb0bf321a84bb37762bd5a99c8536b618a8eeda9e70eeb42c0856d15ee5a210071167f08c74aa81e5367c4f9e118669770e6c564650c6fc2763b77ef26

Download Submit
C:\Windows\System\YxPmNHY.exe

Filesize
1.7MB

MD5
d460685185fe42e518baec603283cd25

SHA1
ce2797ef161c9de1bcf61023b763bcb82e5e2ffc

SHA256
53d9757ac1078e2f95b3ebb5ecc622f572d6bd781490c7a27f63b0aee67e009a

SHA512
1a90985c03bf70da3ffd20a3e078342501ccebe2b5719bb76f1d227ae91b4dacfb4e9e5f32757e22638fa2e5a79e02e92023a04bd85a79947f52c815f319f449

Download Submit
C:\Windows\System\aUDgIMY.exe

Filesize
1.7MB

MD5
070dfb74d7d1e88d407799ed544bc354

SHA1
7ab025bd016030adddedac888756e3f6bf7e07f4

SHA256
4020d3ce87ede89b10e7d29407fca34d5b6a581e35cb4f89f13b541ebd67521a

SHA512
66e0e469382ab5a9250c3c146b32fbd20a1a01bca64bb8fa3346cb74f34840d475f34a322636f14c2d851ff75845ed10e8a7e23effc0ae392b6de3925b65c863

Download Submit
C:\Windows\System\ajHbfCf.exe

Filesize
1.7MB

MD5
9c378b7383c5829a7821de259cb5b849

SHA1
95cb9b2c6df30d6e65abead550714fbf786b6b9f

SHA256
a20684acb3bfb64bdb8334d5efcb04a99318a60bb1d45422ba597b48cd76a4e6

SHA512
8359b0da4e5e86078e54f28bd23d19c36b01181438ad6642cfb669eca17f96b77efda5d02938dbea9104e6a6e0a6ab4957b3522b93f2864b1c7c69c24ac163d7

Download Submit
C:\Windows\System\cYYtOhN.exe

Filesize
1.7MB

MD5
baa3cbc964aac3611f9b854beab299e5

SHA1
a12088c9fd14f9b5662843cb57551f6bf26203c6

SHA256
ae05524d393606f1c2a64a3c2aff0ea5caeb585b825aeb588e7aed19d89d5e7c

SHA512
e8c5fc2c54d869b9f47ef8a89f7190873855b61cf9b61df97ad9d0c50a5446bded307994038a763e81e7f0d08f70e67be3893ef9a5fa482f1ce83f714e7e960a

Download Submit
C:\Windows\System\cgLPHTe.exe

Filesize
1.7MB

MD5
321ed22357db1f5cb3e3d5c87a0bad49

SHA1
3ab53ed72aa43629ecaa611c948fb67a35ba82a5

SHA256
66895072b4f1263caad6d6d0a960172c3ccd13382c0c8b218fbe07beabf4bc5f

SHA512
89acf43afdff401255b10a436fa695bb750732c1c4397f377c0abad484e2fea59a7a60dc55b8a62ec144daf32e201fc3e8d740c82cbd40d9b2ddc6d87c7ee8dd

Download Submit
C:\Windows\System\eSQlKkb.exe

Filesize
1.7MB

MD5
ae1454c3a9919f7da6a8f6a6e35c3019

SHA1
b9d0467d4144af92c464a1f6e069373439683e4d

SHA256
5096958ffe9a9d2eb31c47899317ad4e253f83848247b7b51172b4f53f9c4e7c

SHA512
75fea09817c3b41cd4d959c3ddae550feeb4e3a75b100806da279035be1bce6c18e515ae508ad46b9960b5f4212f14a449fe8e3e914b554f8bac4140414e666d

Download Submit
C:\Windows\System\fKQQcxP.exe

Filesize
1.7MB

MD5
c3245be5c2a500ea660a5c33a3960376

SHA1
12475f5c4f8c9c7e9439dfbb271e5645a9b21c4d

SHA256
dceaa36d3390d3477b72899ac021985160f52d5da65045ed8725faefdd8cb5f4

SHA512
20baaecfcec1710f6a78a87b01cea0e2b779d492870a4a75915a1b59d6247cf8c3e1e6f0ba625f65002b66b57d10f3b4855b004f1436875c504ad041aa9e2f94

Download Submit
C:\Windows\System\iNrSoAQ.exe

Filesize
1.7MB

MD5
fd79a4f95a71e8cb741e8676e4fa9e9b

SHA1
38355c410bd1f77ea54e66aca81151210f9e5819

SHA256
42d28904bea863d4e186a56c9725696913a61405b93453fa316286a8752494ab

SHA512
3e1db523c8ababb0127afadc9fbc4de3e4eeeeef2d84642d11c81845fa1f971292c4df4473aa000985bfcd5526c35d5b1ffeba39bd2bd64e09ef64e80c7f7657

Download Submit
C:\Windows\System\lBRAUhH.exe

Filesize
1.7MB

MD5
b204f847edc9d367a278219325842b67

SHA1
5dd559c8af654753abaefc02723a293bb9204b63

SHA256
75d991da31d0237731f397f296f6eba598b45f242a0f34df5a74aca4ecc6f7ad

SHA512
08f74e1269847599afc05aff042245c2dda4870df63d14148a4aaa2955a295a6b7cc8e359e4bcec8a71c193c3dd0bc14084ea3281a04afb8cf6adf3c096581fc

Download Submit
C:\Windows\System\lSjZKbR.exe

Filesize
1.7MB

MD5
b96b2e5b74b10f797f544a04450cbb7d

SHA1
aecde096f6b980d34bec1d125e24584f90616d45

SHA256
d4adcd8be837306b6404a8d80f926434018d59ef9d5edbf47dbcb05b8e0d3f2d

SHA512
0f314c381b43111afb765d3e8b3fd72a8631519ac0ed9208e3dc973b261235971674a8a82ea66a4caa912e2bd40afc4f30ed7258ad9a525d8e7bf895e8f30840

Download Submit
C:\Windows\System\nOfIACs.exe

Filesize
1.7MB

MD5
bb987936839bdf692aba8b152c25056d

SHA1
b30a45ffc5fc73a487713a6a4d547a8ec6261206

SHA256
29bd8e4476deb9769fb2853f348bcc8e614b67e364a159d9f3edacdffc6b731e

SHA512
c9f4b2605594ca5767a601736974d548a34112f9455e421ecd9c60b911e926e3fc0d75914124afd6dc1cbbb0daaa0e3c50ecde983494750047515fc2ebffec4f

Download Submit
C:\Windows\System\nnBTQMv.exe

Filesize
1.7MB

MD5
6058a9664c598763a6e6fbd1f989df43

SHA1
50f0edc38d5a1f510b7536f38ca4bb0020e79b70

SHA256
3008a0972512cb6a9b96d85961a245b14e53bc0a5a733f608c89f3b71fe5afd7

SHA512
edf4ee8fc92cfb94bd91e9c13b6b728f6c85e0206540c1628e0e4c73ca11c86f180a3a2161e0a167a1cfa2d903d3d323bbaa83068b81701222e05f282121f4d7

Download Submit
C:\Windows\System\pqzuKov.exe

Filesize
1.7MB

MD5
613ecb86887dc20e54d17ab106d87c77

SHA1
8ab9862cab04e6c07c04fcbeb925ec8dcfd2294a

SHA256
c6a25e136df2287c69584200257ad534a6e10c04c21c772d3f338d41efcb684a

SHA512
81adbbb5e2484b8bfb8e4215da8f472634358908b7616f5e64e0c7b84beb70cfebcd1b7ffa1b4eee4671c4f02a1f7aa057ca410ead4b6d2411bb16deb83f5065

Download Submit
C:\Windows\System\qFYRGgo.exe

Filesize
1.7MB

MD5
babb517996384ef9cbc686bb7e79ffdf

SHA1
b170c05b458cc440464a753328e35a40ba27da87

SHA256
48cb49b400cbe6185e93fbfb0efad3b45d14145a6b48f18f629934b2a5a1b188

SHA512
9e5df83d6ad3ee69d9f253e4257cd9f981f2f6dc996a1afe804da4af335f628f997b72ee5648ffcfae2630fed5da7ba8bc5fdbef2365fa0f79c65102a8b4d6b7

Download Submit
C:\Windows\System\qkZNucy.exe

Filesize
1.7MB

MD5
e1d896bc6eb5bf3e384f39ea83f1ea31

SHA1
721ea0325e4d3ccaaa165575c1e092ae1fca016f

SHA256
f54f7b455634d1658b7ed3bfeec164e1ff7c39b01a98194a9c2d3287bec1b01c

SHA512
c4e5843af638d9acca27da6d6a64bc81a9a079ead0bdc3bf2110ecfb328ca5bb605e463c2fcfa389521d0451cac8ff4e04d159118acc28ae166ae974b8e84aee

Download Submit
C:\Windows\System\qrrfDBS.exe

Filesize
1.7MB

MD5
cba2e9df9abd2071bfd7b7b5c696fcf9

SHA1
38d87021b49dad7ed61c1ca5f4a72a1a20b6fa2f

SHA256
95441035cd119bdcd95ec64d453661620796eb932e99ea4a832a5d7d71a47bc1

SHA512
67cd6f62011a46556c9e97fcd7c8e74be0ef400552997d96124d7899caaec414621daed0f3eba9745c6fecd4e85c115ee29794b73dc15a6dc495a2feb9747d84

Download Submit
C:\Windows\System\rrRywDl.exe

Filesize
1.7MB

MD5
96f383c5dce52fc7f2b28814269d7f77

SHA1
92715af358fcf5f25c2707c17e8318d260b7292f

SHA256
7d7e4fd110c4f95e1714c33c89d4ceef2474b268379421d13bba0af63804c17a

SHA512
f4a64d7c3109186a5274976faf79e1d7eaae14d64506fd1cc9683ce0887c29089f81e1c7dba9d50b866520527cb9d6fc0d53a70e8104744ad2a2b4625984b01e

Download Submit
C:\Windows\System\sTFnJOG.exe

Filesize
1.7MB

MD5
c129af875ee33f54c80af0fb9e3cc044

SHA1
f87fdb1695c0ef4ca0010a9f8e49c16e19736d44

SHA256
ebba1a96159fac8573b3b53e8498404b2939dcba914f5bbf892d8007f34bea27

SHA512
d899bfd846c6a3a22f454a69b2f96ff5323af0982d29eaddf65d5f9b41fa2da5343dc65616b10f267094d7b8c94bfe1d487ee354007801f0294ad2927ef66e48

Download Submit
C:\Windows\System\urhsbXP.exe

Filesize
1.7MB

MD5
26df7513fc66e68d78312cca1d507783

SHA1
b9963d0de0d1f04c9113226e1ec8c89fb9bb3b41

SHA256
d6b7cb1102ad61022679b44730320b4e03dbd31d7f007600d80bb2ed7ab33398

SHA512
af180bba3b219bd2d34cff54579e91cf5cc59613da0fa9f346be6721bc53af475d2c1a58b229ff797da6714bbfc431de99d1f343a508e8bc185ca8870fba8394

Download Submit
C:\Windows\System\wMZDtLR.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
memory/208-334-0x00007FF660B30000-0x00007FF660F22000-memory.dmp

Filesize
3.9MB

Download
memory/208-3685-0x00007FF660B30000-0x00007FF660F22000-memory.dmp

Filesize
3.9MB

Download
memory/404-3661-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp

Filesize
3.9MB

Download
memory/404-244-0x00007FF7831B0000-0x00007FF7835A2000-memory.dmp

Filesize
3.9MB

Download
memory/884-302-0x00007FF639B80000-0x00007FF639F72000-memory.dmp

Filesize
3.9MB

Download
memory/884-3668-0x00007FF639B80000-0x00007FF639F72000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3679-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-297-0x00007FF655BC0000-0x00007FF655FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1212-356-0x00007FF673030000-0x00007FF673422000-memory.dmp

Filesize
3.9MB

Download
memory/1212-3729-0x00007FF673030000-0x00007FF673422000-memory.dmp

Filesize
3.9MB

Download
memory/1616-3705-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1616-336-0x00007FF6876D0000-0x00007FF687AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-3641-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-208-0x00007FF7AA2E0000-0x00007FF7AA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-0-0x00007FF7C6590000-0x00007FF7C6982000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4174-0x00007FF7C6590000-0x00007FF7C6982000-memory.dmp

Filesize
3.9MB

Download
memory/2428-1-0x00000231DE460000-0x00000231DE470000-memory.dmp

Filesize
64KB

Download
memory/2496-415-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp

Filesize
3.9MB

Download
memory/2496-3701-0x00007FF64A5A0000-0x00007FF64A992000-memory.dmp

Filesize
3.9MB

Download
memory/2568-281-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp

Filesize
3.9MB

Download
memory/2568-3691-0x00007FF61C950000-0x00007FF61CD42000-memory.dmp

Filesize
3.9MB

Download
memory/2624-3725-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-326-0x00007FF6C79B0000-0x00007FF6C7DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-3629-0x00007FF6B4D30000-0x00007FF6B5122000-memory.dmp

Filesize
3.9MB

Download
memory/3168-49-0x00007FF6B4D30000-0x00007FF6B5122000-memory.dmp

Filesize
3.9MB

Download
memory/3400-3634-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp

Filesize
3.9MB

Download
memory/3400-254-0x00007FF6EAF10000-0x00007FF6EB302000-memory.dmp

Filesize
3.9MB

Download
memory/3404-338-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp

Filesize
3.9MB

Download
memory/3404-3719-0x00007FF72EE60000-0x00007FF72F252000-memory.dmp

Filesize
3.9MB

Download
memory/3744-73-0x00007FF6D54D0000-0x00007FF6D58C2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-350-0x00007FF62E440000-0x00007FF62E832000-memory.dmp

Filesize
3.9MB

Download
memory/3900-3715-0x00007FF62E440000-0x00007FF62E832000-memory.dmp

Filesize
3.9MB

Download
memory/4156-3709-0x00007FF786E30000-0x00007FF787222000-memory.dmp

Filesize
3.9MB

Download
memory/4156-337-0x00007FF786E30000-0x00007FF787222000-memory.dmp

Filesize
3.9MB

Download
memory/4284-3697-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-420-0x00007FF7CE0B0000-0x00007FF7CE4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-12-0x00007FF7066B0000-0x00007FF706AA2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-118-0x00007FF6A5560000-0x00007FF6A5952000-memory.dmp

Filesize
3.9MB

Download
memory/4388-3616-0x00007FF6A5560000-0x00007FF6A5952000-memory.dmp

Filesize
3.9MB

Download
memory/4680-94-0x00007FF7DFDC0000-0x00007FF7E01B2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-3655-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-187-0x00007FF75D3C0000-0x00007FF75D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-3621-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp

Filesize
3.9MB

Download
memory/4796-386-0x00007FF63F620000-0x00007FF63FA12000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3652-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-221-0x00007FF6E4E00000-0x00007FF6E51F2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-389-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp

Filesize
3.9MB

Download
memory/4912-3647-0x00007FF60EC90000-0x00007FF60F082000-memory.dmp

Filesize
3.9MB

Download
memory/4992-306-0x0000015874310000-0x0000015874332000-memory.dmp

Filesize
136KB

Download
memory/4992-809-0x0000015875700000-0x0000015875EA6000-memory.dmp

Filesize
7.6MB

Download