xmrig | 9dd6c34a29142519adc9e07c022125b3c2909e69d3e2662541400db5de385aca

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Size

2.2MB
MD5

ce68a7722aa136f070e0247a8d75417d
SHA1

6f07f4e98eccc4f3352d5a20b8b2d020936604bb
SHA256

9dd6c34a29142519adc9e07c022125b3c2909e69d3e2662541400db5de385aca
SHA512

862d454d8b08e12d2b7e516422cb7e7685e6e4107da8f8c7fbd8b2ae72848ffe4fe52af2dcd1ca1c7c77528a8f4b9d79812e39f7f3542c450371c3f7890b8014
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9g:NABp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/380-418-0x00007FF721060000-0x00007FF721452000-memory.dmp	xmrig
behavioral2/memory/2268-468-0x00007FF65F540000-0x00007FF65F932000-memory.dmp	xmrig
behavioral2/memory/4988-526-0x00007FF614CF0000-0x00007FF6150E2000-memory.dmp	xmrig
behavioral2/memory/1212-532-0x00007FF641790000-0x00007FF641B82000-memory.dmp	xmrig
behavioral2/memory/1892-2120-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp	xmrig
behavioral2/memory/3620-2097-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp	xmrig
behavioral2/memory/2044-1679-0x00007FF64AE00000-0x00007FF64B1F2000-memory.dmp	xmrig
behavioral2/memory/3020-1678-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	xmrig
behavioral2/memory/1640-2268-0x00007FF64AB10000-0x00007FF64AF02000-memory.dmp	xmrig
behavioral2/memory/732-534-0x00007FF746F40000-0x00007FF747332000-memory.dmp	xmrig
behavioral2/memory/5028-533-0x00007FF646D10000-0x00007FF647102000-memory.dmp	xmrig
behavioral2/memory/2888-531-0x00007FF62A0B0000-0x00007FF62A4A2000-memory.dmp	xmrig
behavioral2/memory/3008-530-0x00007FF7E2950000-0x00007FF7E2D42000-memory.dmp	xmrig
behavioral2/memory/1580-529-0x00007FF646090000-0x00007FF646482000-memory.dmp	xmrig
behavioral2/memory/4720-528-0x00007FF6F8670000-0x00007FF6F8A62000-memory.dmp	xmrig
behavioral2/memory/3412-527-0x00007FF7135B0000-0x00007FF7139A2000-memory.dmp	xmrig
behavioral2/memory/2596-525-0x00007FF7DFE20000-0x00007FF7E0212000-memory.dmp	xmrig
behavioral2/memory/5100-524-0x00007FF656960000-0x00007FF656D52000-memory.dmp	xmrig
behavioral2/memory/728-367-0x00007FF6024B0000-0x00007FF6028A2000-memory.dmp	xmrig
behavioral2/memory/376-364-0x00007FF7C15F0000-0x00007FF7C19E2000-memory.dmp	xmrig
behavioral2/memory/3648-284-0x00007FF7A8D00000-0x00007FF7A90F2000-memory.dmp	xmrig
behavioral2/memory/1484-234-0x00007FF7F8690000-0x00007FF7F8A82000-memory.dmp	xmrig
behavioral2/memory/1456-199-0x00007FF738D00000-0x00007FF7390F2000-memory.dmp	xmrig
behavioral2/memory/1892-136-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp	xmrig
behavioral2/memory/3620-100-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp	xmrig
behavioral2/memory/1724-74-0x00007FF65F810000-0x00007FF65FC02000-memory.dmp	xmrig
behavioral2/memory/436-39-0x00007FF7C96E0000-0x00007FF7C9AD2000-memory.dmp	xmrig
behavioral2/memory/5100-4388-0x00007FF656960000-0x00007FF656D52000-memory.dmp	xmrig
behavioral2/memory/2596-4392-0x00007FF7DFE20000-0x00007FF7E0212000-memory.dmp	xmrig
behavioral2/memory/3412-4395-0x00007FF7135B0000-0x00007FF7139A2000-memory.dmp	xmrig
behavioral2/memory/4720-4402-0x00007FF6F8670000-0x00007FF6F8A62000-memory.dmp	xmrig
behavioral2/memory/732-4407-0x00007FF746F40000-0x00007FF747332000-memory.dmp	xmrig
behavioral2/memory/5028-4488-0x00007FF646D10000-0x00007FF647102000-memory.dmp	xmrig
behavioral2/memory/2268-4410-0x00007FF65F540000-0x00007FF65F932000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4996	powershell.exe
12	4996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2044	yskYalh.exe
436	aMJzIaO.exe
1640	TLDEEfa.exe
1724	jQMZMoU.exe
2888	SRQQYGF.exe
3620	FONupTL.exe
1212	jJlHbKK.exe
1892	LguVgtS.exe
1456	MlzFRJy.exe
1484	wKLsVOV.exe
3648	HpYviWO.exe
376	iVCoDTe.exe
728	EuAJDdI.exe
380	rHjJamW.exe
5028	fABDShf.exe
2268	TVQUrLi.exe
5100	asrpSKs.exe
2596	UqGUUQJ.exe
4988	KKZPPev.exe
3412	bDbpNik.exe
4720	PXabxfH.exe
732	TdoNDfw.exe
1580	aHaDSqb.exe
3008	Eobztkl.exe
4112	zbpTosF.exe
3844	JzkDQNM.exe
244	HATOFAN.exe
1860	mPMmMEe.exe
4196	SPSeBIe.exe
2812	PPzNYrw.exe
5004	bIALLNL.exe
1812	gIbolzH.exe
1184	Rpaekxe.exe
2536	wsRYeOu.exe
540	AXlgnPk.exe
4076	YnCPwFl.exe
4392	aEiBCPY.exe
2448	azPyrBG.exe
640	fOIwUxU.exe
3812	VmKFSkz.exe
2592	KffPoHR.exe
1396	bUmyafw.exe
4676	RLBteGU.exe
4760	dGEVoli.exe
1440	MYfuuYK.exe
4172	Pwabuwq.exe
2752	kETESBN.exe
8	fAFjMFg.exe
852	WtmnWKC.exe
3572	rofrWKE.exe
2720	KoNqSwx.exe
4468	WBoMpkP.exe
1948	RxbkOEx.exe
1904	ZLHRYbn.exe
3048	vbUFBVN.exe
1600	IKpYYqZ.exe
4596	UfZnVsL.exe
780	RfVNkDa.exe
1624	xAykjql.exe
3876	dxljCkJ.exe
872	FWWmPMr.exe
3592	NnQWaBQ.exe
4580	hKvFxWW.exe
1796	SiHLaQU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3020-0-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	upx
behavioral2/files/0x0009000000023492-5.dat	upx
behavioral2/files/0x00070000000234e7-16.dat	upx
behavioral2/files/0x00070000000234e9-19.dat	upx
behavioral2/files/0x00070000000234eb-53.dat	upx
behavioral2/files/0x00070000000234ef-105.dat	upx
behavioral2/files/0x00070000000234fc-142.dat	upx
behavioral2/files/0x00070000000234f5-205.dat	upx
behavioral2/memory/380-418-0x00007FF721060000-0x00007FF721452000-memory.dmp	upx
behavioral2/memory/2268-468-0x00007FF65F540000-0x00007FF65F932000-memory.dmp	upx
behavioral2/memory/4988-526-0x00007FF614CF0000-0x00007FF6150E2000-memory.dmp	upx
behavioral2/memory/1212-532-0x00007FF641790000-0x00007FF641B82000-memory.dmp	upx
behavioral2/memory/1892-2120-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp	upx
behavioral2/memory/3620-2097-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp	upx
behavioral2/memory/2044-1679-0x00007FF64AE00000-0x00007FF64B1F2000-memory.dmp	upx
behavioral2/memory/3020-1678-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	upx
behavioral2/memory/1640-2268-0x00007FF64AB10000-0x00007FF64AF02000-memory.dmp	upx
behavioral2/memory/732-534-0x00007FF746F40000-0x00007FF747332000-memory.dmp	upx
behavioral2/memory/5028-533-0x00007FF646D10000-0x00007FF647102000-memory.dmp	upx
behavioral2/memory/2888-531-0x00007FF62A0B0000-0x00007FF62A4A2000-memory.dmp	upx
behavioral2/memory/3008-530-0x00007FF7E2950000-0x00007FF7E2D42000-memory.dmp	upx
behavioral2/memory/1580-529-0x00007FF646090000-0x00007FF646482000-memory.dmp	upx
behavioral2/memory/4720-528-0x00007FF6F8670000-0x00007FF6F8A62000-memory.dmp	upx
behavioral2/memory/3412-527-0x00007FF7135B0000-0x00007FF7139A2000-memory.dmp	upx
behavioral2/memory/2596-525-0x00007FF7DFE20000-0x00007FF7E0212000-memory.dmp	upx
behavioral2/memory/5100-524-0x00007FF656960000-0x00007FF656D52000-memory.dmp	upx
behavioral2/memory/728-367-0x00007FF6024B0000-0x00007FF6028A2000-memory.dmp	upx
behavioral2/memory/376-364-0x00007FF7C15F0000-0x00007FF7C19E2000-memory.dmp	upx
behavioral2/memory/3648-284-0x00007FF7A8D00000-0x00007FF7A90F2000-memory.dmp	upx
behavioral2/files/0x00080000000234e4-204.dat	upx
behavioral2/files/0x000700000002350b-203.dat	upx
behavioral2/files/0x000700000002350a-202.dat	upx
behavioral2/memory/1484-234-0x00007FF7F8690000-0x00007FF7F8A82000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-194.dat	upx
behavioral2/files/0x0007000000023509-192.dat	upx
behavioral2/files/0x00070000000234fa-187.dat	upx
behavioral2/files/0x0007000000023507-180.dat	upx
behavioral2/files/0x00070000000234f9-179.dat	upx
behavioral2/files/0x0007000000023506-175.dat	upx
behavioral2/files/0x00070000000234f8-174.dat	upx
behavioral2/files/0x0007000000023505-171.dat	upx
behavioral2/files/0x00070000000234f6-161.dat	upx
behavioral2/files/0x0007000000023504-160.dat	upx
behavioral2/files/0x00070000000234fd-151.dat	upx
behavioral2/files/0x0007000000023503-150.dat	upx
behavioral2/files/0x0007000000023502-144.dat	upx
behavioral2/memory/1456-199-0x00007FF738D00000-0x00007FF7390F2000-memory.dmp	upx
behavioral2/memory/1892-136-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp	upx
behavioral2/files/0x0007000000023501-133.dat	upx
behavioral2/files/0x0007000000023508-191.dat	upx
behavioral2/files/0x00070000000234ff-129.dat	upx
behavioral2/files/0x00070000000234f3-122.dat	upx
behavioral2/files/0x00070000000234f7-164.dat	upx
behavioral2/files/0x00070000000234fe-121.dat	upx
behavioral2/files/0x00070000000234f1-115.dat	upx
behavioral2/files/0x00070000000234f2-113.dat	upx
behavioral2/files/0x00070000000234f0-110.dat	upx
behavioral2/files/0x00070000000234ec-103.dat	upx
behavioral2/memory/3620-100-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp	upx
behavioral2/files/0x0007000000023500-132.dat	upx
behavioral2/files/0x00070000000234ee-92.dat	upx
behavioral2/files/0x00070000000234f4-77.dat	upx
behavioral2/memory/1724-74-0x00007FF65F810000-0x00007FF65FC02000-memory.dmp	upx
behavioral2/files/0x00070000000234ea-63.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wVBWLtt.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\uMXNiJL.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\xHNqEzl.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\YWlPheN.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\qIwOnpr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\kImNOxn.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\vpzTboe.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\sNDcjbJ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\dbvBvGv.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\RXJVdha.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\tAuwXML.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\reVnnbR.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\XsdHhRO.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\pWwLPdr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BFZSlso.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\eKnFPAi.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\qWQOHvt.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\yYzOlXO.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BKgnyAZ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\jUTqzDq.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\WruEcaU.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\AjomKDI.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\TYDAxpZ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\mSVQgqO.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\spAuevS.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\jBPANzT.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\obVdSXW.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\KRSMegb.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ajdrJWZ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\vtSQOAW.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\OHrlPgv.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\wUYIGHj.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\TwxsRUO.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\qMvvGfu.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\xnuDQSj.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\dTIQwVx.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\nmIjvdm.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\LtocZWs.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\WzsnbDg.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\EsuDgKu.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\uwXGCoN.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\YXBuAwi.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BAFIJoP.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ELkYAVQ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\OfzxjxY.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BRRNFIj.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\YAjcKlL.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\GVzfeTY.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\OIZrRiV.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\AhZDjuh.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\rNbrEEe.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\GpYRQLo.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\DYeIKAI.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\edTGHKf.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\NPInDRb.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\mTPKYAj.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\qqUbjsr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\VxgIfJq.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\HPGHMrV.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BkghbBL.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\YJXOxlR.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\sweSHeR.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\UAQVCBU.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\zUwqIHl.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Token: SeDebugPrivilege	4996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4996	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	84
PID 3020 wrote to memory of 4996	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2044	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	85
PID 3020 wrote to memory of 2044	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	85
PID 3020 wrote to memory of 436	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	86
PID 3020 wrote to memory of 436	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	86
PID 3020 wrote to memory of 1640	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	87
PID 3020 wrote to memory of 1640	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	87
PID 3020 wrote to memory of 1724	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	88
PID 3020 wrote to memory of 1724	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	88
PID 3020 wrote to memory of 2888	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	89
PID 3020 wrote to memory of 2888	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	89
PID 3020 wrote to memory of 3620	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	90
PID 3020 wrote to memory of 3620	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	90
PID 3020 wrote to memory of 1456	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	91
PID 3020 wrote to memory of 1456	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	91
PID 3020 wrote to memory of 1212	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	92
PID 3020 wrote to memory of 1212	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	92
PID 3020 wrote to memory of 1892	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	93
PID 3020 wrote to memory of 1892	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	93
PID 3020 wrote to memory of 1484	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	94
PID 3020 wrote to memory of 1484	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	94
PID 3020 wrote to memory of 3648	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	95
PID 3020 wrote to memory of 3648	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	95
PID 3020 wrote to memory of 376	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	96
PID 3020 wrote to memory of 376	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	96
PID 3020 wrote to memory of 728	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	97
PID 3020 wrote to memory of 728	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	97
PID 3020 wrote to memory of 380	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	98
PID 3020 wrote to memory of 380	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	98
PID 3020 wrote to memory of 5028	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	99
PID 3020 wrote to memory of 5028	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	99
PID 3020 wrote to memory of 2268	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	100
PID 3020 wrote to memory of 2268	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	100
PID 3020 wrote to memory of 5100	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	101
PID 3020 wrote to memory of 5100	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	101
PID 3020 wrote to memory of 2596	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	102
PID 3020 wrote to memory of 2596	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	102
PID 3020 wrote to memory of 4988	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	103
PID 3020 wrote to memory of 4988	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	103
PID 3020 wrote to memory of 3412	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	104
PID 3020 wrote to memory of 3412	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	104
PID 3020 wrote to memory of 4720	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	105
PID 3020 wrote to memory of 4720	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	105
PID 3020 wrote to memory of 732	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	106
PID 3020 wrote to memory of 732	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	106
PID 3020 wrote to memory of 1580	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	107
PID 3020 wrote to memory of 1580	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	107
PID 3020 wrote to memory of 3008	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	108
PID 3020 wrote to memory of 3008	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	108
PID 3020 wrote to memory of 4112	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	109
PID 3020 wrote to memory of 4112	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	109
PID 3020 wrote to memory of 3844	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	110
PID 3020 wrote to memory of 3844	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	110
PID 3020 wrote to memory of 244	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	111
PID 3020 wrote to memory of 244	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	111
PID 3020 wrote to memory of 1860	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	112
PID 3020 wrote to memory of 1860	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	112
PID 3020 wrote to memory of 4196	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	113
PID 3020 wrote to memory of 4196	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	113
PID 3020 wrote to memory of 2812	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	114
PID 3020 wrote to memory of 2812	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	114
PID 3020 wrote to memory of 5004	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	115
PID 3020 wrote to memory of 5004	3020	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4996" "2976" "2928" "2984" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13844
- C:\Windows\System\yskYalh.exe
  C:\Windows\System\yskYalh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\aMJzIaO.exe
  C:\Windows\System\aMJzIaO.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\TLDEEfa.exe
  C:\Windows\System\TLDEEfa.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\jQMZMoU.exe
  C:\Windows\System\jQMZMoU.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\SRQQYGF.exe
  C:\Windows\System\SRQQYGF.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\FONupTL.exe
  C:\Windows\System\FONupTL.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\MlzFRJy.exe
  C:\Windows\System\MlzFRJy.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\jJlHbKK.exe
  C:\Windows\System\jJlHbKK.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\LguVgtS.exe
  C:\Windows\System\LguVgtS.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\wKLsVOV.exe
  C:\Windows\System\wKLsVOV.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\HpYviWO.exe
  C:\Windows\System\HpYviWO.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\iVCoDTe.exe
  C:\Windows\System\iVCoDTe.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\EuAJDdI.exe
  C:\Windows\System\EuAJDdI.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\rHjJamW.exe
  C:\Windows\System\rHjJamW.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\fABDShf.exe
  C:\Windows\System\fABDShf.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\TVQUrLi.exe
  C:\Windows\System\TVQUrLi.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\asrpSKs.exe
  C:\Windows\System\asrpSKs.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\UqGUUQJ.exe
  C:\Windows\System\UqGUUQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\KKZPPev.exe
  C:\Windows\System\KKZPPev.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\bDbpNik.exe
  C:\Windows\System\bDbpNik.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\PXabxfH.exe
  C:\Windows\System\PXabxfH.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\TdoNDfw.exe
  C:\Windows\System\TdoNDfw.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\aHaDSqb.exe
  C:\Windows\System\aHaDSqb.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\Eobztkl.exe
  C:\Windows\System\Eobztkl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zbpTosF.exe
  C:\Windows\System\zbpTosF.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\JzkDQNM.exe
  C:\Windows\System\JzkDQNM.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\HATOFAN.exe
  C:\Windows\System\HATOFAN.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\mPMmMEe.exe
  C:\Windows\System\mPMmMEe.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\SPSeBIe.exe
  C:\Windows\System\SPSeBIe.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\PPzNYrw.exe
  C:\Windows\System\PPzNYrw.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\bIALLNL.exe
  C:\Windows\System\bIALLNL.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\gIbolzH.exe
  C:\Windows\System\gIbolzH.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\Rpaekxe.exe
  C:\Windows\System\Rpaekxe.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\wsRYeOu.exe
  C:\Windows\System\wsRYeOu.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\AXlgnPk.exe
  C:\Windows\System\AXlgnPk.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\YnCPwFl.exe
  C:\Windows\System\YnCPwFl.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\aEiBCPY.exe
  C:\Windows\System\aEiBCPY.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\azPyrBG.exe
  C:\Windows\System\azPyrBG.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\fOIwUxU.exe
  C:\Windows\System\fOIwUxU.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\VmKFSkz.exe
  C:\Windows\System\VmKFSkz.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\KffPoHR.exe
  C:\Windows\System\KffPoHR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bUmyafw.exe
  C:\Windows\System\bUmyafw.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\RLBteGU.exe
  C:\Windows\System\RLBteGU.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\dGEVoli.exe
  C:\Windows\System\dGEVoli.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\MYfuuYK.exe
  C:\Windows\System\MYfuuYK.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\Pwabuwq.exe
  C:\Windows\System\Pwabuwq.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\kETESBN.exe
  C:\Windows\System\kETESBN.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\fAFjMFg.exe
  C:\Windows\System\fAFjMFg.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\WtmnWKC.exe
  C:\Windows\System\WtmnWKC.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\rofrWKE.exe
  C:\Windows\System\rofrWKE.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\KoNqSwx.exe
  C:\Windows\System\KoNqSwx.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\WBoMpkP.exe
  C:\Windows\System\WBoMpkP.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\RxbkOEx.exe
  C:\Windows\System\RxbkOEx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ZLHRYbn.exe
  C:\Windows\System\ZLHRYbn.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\vbUFBVN.exe
  C:\Windows\System\vbUFBVN.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\IKpYYqZ.exe
  C:\Windows\System\IKpYYqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\UfZnVsL.exe
  C:\Windows\System\UfZnVsL.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\RfVNkDa.exe
  C:\Windows\System\RfVNkDa.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\xAykjql.exe
  C:\Windows\System\xAykjql.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\dxljCkJ.exe
  C:\Windows\System\dxljCkJ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\FWWmPMr.exe
  C:\Windows\System\FWWmPMr.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\NnQWaBQ.exe
  C:\Windows\System\NnQWaBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\hKvFxWW.exe
  C:\Windows\System\hKvFxWW.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\SiHLaQU.exe
  C:\Windows\System\SiHLaQU.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\CcrpXIJ.exe
  C:\Windows\System\CcrpXIJ.exe
  2⤵
  PID:2968
- C:\Windows\System\nwovtbV.exe
  C:\Windows\System\nwovtbV.exe
  2⤵
  PID:1728
- C:\Windows\System\mahFlHC.exe
  C:\Windows\System\mahFlHC.exe
  2⤵
  PID:920
- C:\Windows\System\FFUGnRB.exe
  C:\Windows\System\FFUGnRB.exe
  2⤵
  PID:1176
- C:\Windows\System\TyZUEYe.exe
  C:\Windows\System\TyZUEYe.exe
  2⤵
  PID:4424
- C:\Windows\System\ikvPbfJ.exe
  C:\Windows\System\ikvPbfJ.exe
  2⤵
  PID:2112
- C:\Windows\System\pAjAlLr.exe
  C:\Windows\System\pAjAlLr.exe
  2⤵
  PID:2332
- C:\Windows\System\ekOQLPh.exe
  C:\Windows\System\ekOQLPh.exe
  2⤵
  PID:1808
- C:\Windows\System\oCDoGdb.exe
  C:\Windows\System\oCDoGdb.exe
  2⤵
  PID:880
- C:\Windows\System\hHzgZxB.exe
  C:\Windows\System\hHzgZxB.exe
  2⤵
  PID:1588
- C:\Windows\System\XrbyRht.exe
  C:\Windows\System\XrbyRht.exe
  2⤵
  PID:1804
- C:\Windows\System\etPaGav.exe
  C:\Windows\System\etPaGav.exe
  2⤵
  PID:1088
- C:\Windows\System\axMqsqE.exe
  C:\Windows\System\axMqsqE.exe
  2⤵
  PID:1636
- C:\Windows\System\XxyDoTZ.exe
  C:\Windows\System\XxyDoTZ.exe
  2⤵
  PID:3968
- C:\Windows\System\SxtOFTr.exe
  C:\Windows\System\SxtOFTr.exe
  2⤵
  PID:3172
- C:\Windows\System\hJoBDwj.exe
  C:\Windows\System\hJoBDwj.exe
  2⤵
  PID:3624
- C:\Windows\System\LMeOttr.exe
  C:\Windows\System\LMeOttr.exe
  2⤵
  PID:368
- C:\Windows\System\XzwnOnG.exe
  C:\Windows\System\XzwnOnG.exe
  2⤵
  PID:4716
- C:\Windows\System\eQIWrNq.exe
  C:\Windows\System\eQIWrNq.exe
  2⤵
  PID:5136
- C:\Windows\System\TTijBli.exe
  C:\Windows\System\TTijBli.exe
  2⤵
  PID:5156
- C:\Windows\System\WsoGRpU.exe
  C:\Windows\System\WsoGRpU.exe
  2⤵
  PID:5216
- C:\Windows\System\USaxYsd.exe
  C:\Windows\System\USaxYsd.exe
  2⤵
  PID:5252
- C:\Windows\System\YTPqyaX.exe
  C:\Windows\System\YTPqyaX.exe
  2⤵
  PID:5272
- C:\Windows\System\JEgwqlt.exe
  C:\Windows\System\JEgwqlt.exe
  2⤵
  PID:5296
- C:\Windows\System\ohDneJS.exe
  C:\Windows\System\ohDneJS.exe
  2⤵
  PID:5320
- C:\Windows\System\aywgqZC.exe
  C:\Windows\System\aywgqZC.exe
  2⤵
  PID:5344
- C:\Windows\System\asZqyxn.exe
  C:\Windows\System\asZqyxn.exe
  2⤵
  PID:5368
- C:\Windows\System\oXqnLRT.exe
  C:\Windows\System\oXqnLRT.exe
  2⤵
  PID:5388
- C:\Windows\System\aeRDblS.exe
  C:\Windows\System\aeRDblS.exe
  2⤵
  PID:5404
- C:\Windows\System\wWDjBhW.exe
  C:\Windows\System\wWDjBhW.exe
  2⤵
  PID:5424
- C:\Windows\System\OSwaAXO.exe
  C:\Windows\System\OSwaAXO.exe
  2⤵
  PID:5444
- C:\Windows\System\cTtMpwd.exe
  C:\Windows\System\cTtMpwd.exe
  2⤵
  PID:5464
- C:\Windows\System\vXgnAri.exe
  C:\Windows\System\vXgnAri.exe
  2⤵
  PID:5488
- C:\Windows\System\nPUcgMN.exe
  C:\Windows\System\nPUcgMN.exe
  2⤵
  PID:5504
- C:\Windows\System\qJSCcPs.exe
  C:\Windows\System\qJSCcPs.exe
  2⤵
  PID:5524
- C:\Windows\System\kypZmti.exe
  C:\Windows\System\kypZmti.exe
  2⤵
  PID:5548
- C:\Windows\System\ZiYtEQv.exe
  C:\Windows\System\ZiYtEQv.exe
  2⤵
  PID:5568
- C:\Windows\System\mnDCstv.exe
  C:\Windows\System\mnDCstv.exe
  2⤵
  PID:5588
- C:\Windows\System\NwlVBkP.exe
  C:\Windows\System\NwlVBkP.exe
  2⤵
  PID:5612
- C:\Windows\System\XgDQXAK.exe
  C:\Windows\System\XgDQXAK.exe
  2⤵
  PID:5632
- C:\Windows\System\KcMFnUM.exe
  C:\Windows\System\KcMFnUM.exe
  2⤵
  PID:5660
- C:\Windows\System\mKcKQPG.exe
  C:\Windows\System\mKcKQPG.exe
  2⤵
  PID:5676
- C:\Windows\System\yqtUnDK.exe
  C:\Windows\System\yqtUnDK.exe
  2⤵
  PID:5712
- C:\Windows\System\OxxYBdh.exe
  C:\Windows\System\OxxYBdh.exe
  2⤵
  PID:5732
- C:\Windows\System\lObEbMS.exe
  C:\Windows\System\lObEbMS.exe
  2⤵
  PID:5752
- C:\Windows\System\jCFPsem.exe
  C:\Windows\System\jCFPsem.exe
  2⤵
  PID:5772
- C:\Windows\System\ZvBQESx.exe
  C:\Windows\System\ZvBQESx.exe
  2⤵
  PID:5792
- C:\Windows\System\mJWvzoz.exe
  C:\Windows\System\mJWvzoz.exe
  2⤵
  PID:5812
- C:\Windows\System\dwUohQZ.exe
  C:\Windows\System\dwUohQZ.exe
  2⤵
  PID:5896
- C:\Windows\System\VTREVBl.exe
  C:\Windows\System\VTREVBl.exe
  2⤵
  PID:5920
- C:\Windows\System\OJXTKnt.exe
  C:\Windows\System\OJXTKnt.exe
  2⤵
  PID:5940
- C:\Windows\System\sRxTgHk.exe
  C:\Windows\System\sRxTgHk.exe
  2⤵
  PID:5956
- C:\Windows\System\eTUagAV.exe
  C:\Windows\System\eTUagAV.exe
  2⤵
  PID:5980
- C:\Windows\System\gHvJLCz.exe
  C:\Windows\System\gHvJLCz.exe
  2⤵
  PID:6012
- C:\Windows\System\dPiehSj.exe
  C:\Windows\System\dPiehSj.exe
  2⤵
  PID:6028
- C:\Windows\System\hBMKFru.exe
  C:\Windows\System\hBMKFru.exe
  2⤵
  PID:6056
- C:\Windows\System\eNolMSu.exe
  C:\Windows\System\eNolMSu.exe
  2⤵
  PID:6080
- C:\Windows\System\UzjtrWC.exe
  C:\Windows\System\UzjtrWC.exe
  2⤵
  PID:6104
- C:\Windows\System\GoiLSNO.exe
  C:\Windows\System\GoiLSNO.exe
  2⤵
  PID:6128
- C:\Windows\System\bVAfOaU.exe
  C:\Windows\System\bVAfOaU.exe
  2⤵
  PID:3636
- C:\Windows\System\fUdMdlI.exe
  C:\Windows\System\fUdMdlI.exe
  2⤵
  PID:3064
- C:\Windows\System\GqECggg.exe
  C:\Windows\System\GqECggg.exe
  2⤵
  PID:1452
- C:\Windows\System\eNxoinw.exe
  C:\Windows\System\eNxoinw.exe
  2⤵
  PID:2432
- C:\Windows\System\OWPGMDQ.exe
  C:\Windows\System\OWPGMDQ.exe
  2⤵
  PID:3460
- C:\Windows\System\fkbDToM.exe
  C:\Windows\System\fkbDToM.exe
  2⤵
  PID:3464
- C:\Windows\System\RlCZyYK.exe
  C:\Windows\System\RlCZyYK.exe
  2⤵
  PID:1932
- C:\Windows\System\ckZFqTH.exe
  C:\Windows\System\ckZFqTH.exe
  2⤵
  PID:4380
- C:\Windows\System\SCRtcEF.exe
  C:\Windows\System\SCRtcEF.exe
  2⤵
  PID:4184
- C:\Windows\System\PtdvsXP.exe
  C:\Windows\System\PtdvsXP.exe
  2⤵
  PID:320
- C:\Windows\System\wpiozJP.exe
  C:\Windows\System\wpiozJP.exe
  2⤵
  PID:848
- C:\Windows\System\WeoIPfr.exe
  C:\Windows\System\WeoIPfr.exe
  2⤵
  PID:4736
- C:\Windows\System\YRvQIeS.exe
  C:\Windows\System\YRvQIeS.exe
  2⤵
  PID:5648
- C:\Windows\System\QyScrSM.exe
  C:\Windows\System\QyScrSM.exe
  2⤵
  PID:5672
- C:\Windows\System\lKTnMLJ.exe
  C:\Windows\System\lKTnMLJ.exe
  2⤵
  PID:4200
- C:\Windows\System\FDkkngy.exe
  C:\Windows\System\FDkkngy.exe
  2⤵
  PID:4812
- C:\Windows\System\HoikkfE.exe
  C:\Windows\System\HoikkfE.exe
  2⤵
  PID:5128
- C:\Windows\System\BSgWtCE.exe
  C:\Windows\System\BSgWtCE.exe
  2⤵
  PID:620
- C:\Windows\System\riRKoFO.exe
  C:\Windows\System\riRKoFO.exe
  2⤵
  PID:3508
- C:\Windows\System\RqOyCqC.exe
  C:\Windows\System\RqOyCqC.exe
  2⤵
  PID:5564
- C:\Windows\System\JKwljJJ.exe
  C:\Windows\System\JKwljJJ.exe
  2⤵
  PID:6024
- C:\Windows\System\sMfqXdm.exe
  C:\Windows\System\sMfqXdm.exe
  2⤵
  PID:3444
- C:\Windows\System\AZlBNBn.exe
  C:\Windows\System\AZlBNBn.exe
  2⤵
  PID:3336
- C:\Windows\System\pTCcXki.exe
  C:\Windows\System\pTCcXki.exe
  2⤵
  PID:3792
- C:\Windows\System\WxljKGy.exe
  C:\Windows\System\WxljKGy.exe
  2⤵
  PID:3588
- C:\Windows\System\MGiXxoS.exe
  C:\Windows\System\MGiXxoS.exe
  2⤵
  PID:6156
- C:\Windows\System\KkhROOl.exe
  C:\Windows\System\KkhROOl.exe
  2⤵
  PID:6172
- C:\Windows\System\eeRBnbP.exe
  C:\Windows\System\eeRBnbP.exe
  2⤵
  PID:6196
- C:\Windows\System\SNLroFP.exe
  C:\Windows\System\SNLroFP.exe
  2⤵
  PID:6212
- C:\Windows\System\yDqLicK.exe
  C:\Windows\System\yDqLicK.exe
  2⤵
  PID:6236
- C:\Windows\System\JefLsVZ.exe
  C:\Windows\System\JefLsVZ.exe
  2⤵
  PID:6260
- C:\Windows\System\chSYXxC.exe
  C:\Windows\System\chSYXxC.exe
  2⤵
  PID:6284
- C:\Windows\System\uzmJgTU.exe
  C:\Windows\System\uzmJgTU.exe
  2⤵
  PID:6300
- C:\Windows\System\UnEuZuQ.exe
  C:\Windows\System\UnEuZuQ.exe
  2⤵
  PID:6328
- C:\Windows\System\NUgioBH.exe
  C:\Windows\System\NUgioBH.exe
  2⤵
  PID:6348
- C:\Windows\System\lHdMQOA.exe
  C:\Windows\System\lHdMQOA.exe
  2⤵
  PID:6364
- C:\Windows\System\xomyClD.exe
  C:\Windows\System\xomyClD.exe
  2⤵
  PID:6384
- C:\Windows\System\mBqVfOV.exe
  C:\Windows\System\mBqVfOV.exe
  2⤵
  PID:6408
- C:\Windows\System\xnGEpky.exe
  C:\Windows\System\xnGEpky.exe
  2⤵
  PID:6432
- C:\Windows\System\nNbHNXa.exe
  C:\Windows\System\nNbHNXa.exe
  2⤵
  PID:6448
- C:\Windows\System\zdMXuiB.exe
  C:\Windows\System\zdMXuiB.exe
  2⤵
  PID:6484
- C:\Windows\System\Keefycz.exe
  C:\Windows\System\Keefycz.exe
  2⤵
  PID:6512
- C:\Windows\System\NXQILqk.exe
  C:\Windows\System\NXQILqk.exe
  2⤵
  PID:6544
- C:\Windows\System\yHezwtU.exe
  C:\Windows\System\yHezwtU.exe
  2⤵
  PID:6568
- C:\Windows\System\AoLNnfz.exe
  C:\Windows\System\AoLNnfz.exe
  2⤵
  PID:6752
- C:\Windows\System\bBbjZaa.exe
  C:\Windows\System\bBbjZaa.exe
  2⤵
  PID:6768
- C:\Windows\System\qeNYubm.exe
  C:\Windows\System\qeNYubm.exe
  2⤵
  PID:6784
- C:\Windows\System\duAtPfK.exe
  C:\Windows\System\duAtPfK.exe
  2⤵
  PID:6800
- C:\Windows\System\PwdEzvn.exe
  C:\Windows\System\PwdEzvn.exe
  2⤵
  PID:6816
- C:\Windows\System\nZOWHUT.exe
  C:\Windows\System\nZOWHUT.exe
  2⤵
  PID:6832
- C:\Windows\System\bTagFMt.exe
  C:\Windows\System\bTagFMt.exe
  2⤵
  PID:6848
- C:\Windows\System\eygwQcf.exe
  C:\Windows\System\eygwQcf.exe
  2⤵
  PID:6864
- C:\Windows\System\XDjeBmM.exe
  C:\Windows\System\XDjeBmM.exe
  2⤵
  PID:6884
- C:\Windows\System\shTtNwG.exe
  C:\Windows\System\shTtNwG.exe
  2⤵
  PID:6900
- C:\Windows\System\OwGXzWH.exe
  C:\Windows\System\OwGXzWH.exe
  2⤵
  PID:6916
- C:\Windows\System\nPghSem.exe
  C:\Windows\System\nPghSem.exe
  2⤵
  PID:6936
- C:\Windows\System\danHAeB.exe
  C:\Windows\System\danHAeB.exe
  2⤵
  PID:6996
- C:\Windows\System\MmHjOsZ.exe
  C:\Windows\System\MmHjOsZ.exe
  2⤵
  PID:7024
- C:\Windows\System\kSVKUYS.exe
  C:\Windows\System\kSVKUYS.exe
  2⤵
  PID:7100
- C:\Windows\System\zWNUQhh.exe
  C:\Windows\System\zWNUQhh.exe
  2⤵
  PID:5184
- C:\Windows\System\cVrzDkI.exe
  C:\Windows\System\cVrzDkI.exe
  2⤵
  PID:5208
- C:\Windows\System\kqwHdFw.exe
  C:\Windows\System\kqwHdFw.exe
  2⤵
  PID:5236
- C:\Windows\System\QrIHnQU.exe
  C:\Windows\System\QrIHnQU.exe
  2⤵
  PID:5268
- C:\Windows\System\BadhhDg.exe
  C:\Windows\System\BadhhDg.exe
  2⤵
  PID:5304
- C:\Windows\System\ZlNXBNO.exe
  C:\Windows\System\ZlNXBNO.exe
  2⤵
  PID:5332
- C:\Windows\System\AjTVDmn.exe
  C:\Windows\System\AjTVDmn.exe
  2⤵
  PID:5364
- C:\Windows\System\rIubhIn.exe
  C:\Windows\System\rIubhIn.exe
  2⤵
  PID:5412
- C:\Windows\System\jQlbMhl.exe
  C:\Windows\System\jQlbMhl.exe
  2⤵
  PID:5460
- C:\Windows\System\hcikfhF.exe
  C:\Windows\System\hcikfhF.exe
  2⤵
  PID:5520
- C:\Windows\System\YgJhcOr.exe
  C:\Windows\System\YgJhcOr.exe
  2⤵
  PID:5952
- C:\Windows\System\WZUhspH.exe
  C:\Windows\System\WZUhspH.exe
  2⤵
  PID:5608
- C:\Windows\System\AbtATep.exe
  C:\Windows\System\AbtATep.exe
  2⤵
  PID:5708
- C:\Windows\System\EODbnYI.exe
  C:\Windows\System\EODbnYI.exe
  2⤵
  PID:5836
- C:\Windows\System\ldUoYsS.exe
  C:\Windows\System\ldUoYsS.exe
  2⤵
  PID:2124
- C:\Windows\System\JDOmRRn.exe
  C:\Windows\System\JDOmRRn.exe
  2⤵
  PID:5908
- C:\Windows\System\whyQrtC.exe
  C:\Windows\System\whyQrtC.exe
  2⤵
  PID:6040
- C:\Windows\System\DwXGNSj.exe
  C:\Windows\System\DwXGNSj.exe
  2⤵
  PID:6100
- C:\Windows\System\JTtttVL.exe
  C:\Windows\System\JTtttVL.exe
  2⤵
  PID:4796
- C:\Windows\System\qOawQZb.exe
  C:\Windows\System\qOawQZb.exe
  2⤵
  PID:636
- C:\Windows\System\KYZQGqM.exe
  C:\Windows\System\KYZQGqM.exe
  2⤵
  PID:1776
- C:\Windows\System\QCqGTeE.exe
  C:\Windows\System\QCqGTeE.exe
  2⤵
  PID:5912
- C:\Windows\System\LjTsiBu.exe
  C:\Windows\System\LjTsiBu.exe
  2⤵
  PID:6272
- C:\Windows\System\vjiZioK.exe
  C:\Windows\System\vjiZioK.exe
  2⤵
  PID:6476
- C:\Windows\System\AjomKDI.exe
  C:\Windows\System\AjomKDI.exe
  2⤵
  PID:1584
- C:\Windows\System\IluzwBI.exe
  C:\Windows\System\IluzwBI.exe
  2⤵
  PID:4360
- C:\Windows\System\xgwUvgX.exe
  C:\Windows\System\xgwUvgX.exe
  2⤵
  PID:1704
- C:\Windows\System\jIqNcqS.exe
  C:\Windows\System\jIqNcqS.exe
  2⤵
  PID:2104
- C:\Windows\System\FlaQLqI.exe
  C:\Windows\System\FlaQLqI.exe
  2⤵
  PID:4856
- C:\Windows\System\GsJLGUC.exe
  C:\Windows\System\GsJLGUC.exe
  2⤵
  PID:4428
- C:\Windows\System\LOPbZZx.exe
  C:\Windows\System\LOPbZZx.exe
  2⤵
  PID:6184
- C:\Windows\System\TRlyKOE.exe
  C:\Windows\System\TRlyKOE.exe
  2⤵
  PID:6252
- C:\Windows\System\ptNmjnd.exe
  C:\Windows\System\ptNmjnd.exe
  2⤵
  PID:6316
- C:\Windows\System\gAKNCqV.exe
  C:\Windows\System\gAKNCqV.exe
  2⤵
  PID:6372
- C:\Windows\System\UsHkohu.exe
  C:\Windows\System\UsHkohu.exe
  2⤵
  PID:6428
- C:\Windows\System\PwmJqJt.exe
  C:\Windows\System\PwmJqJt.exe
  2⤵
  PID:6504
- C:\Windows\System\srXpcRn.exe
  C:\Windows\System\srXpcRn.exe
  2⤵
  PID:4680
- C:\Windows\System\YWPQjjf.exe
  C:\Windows\System\YWPQjjf.exe
  2⤵
  PID:7196
- C:\Windows\System\cdhALXT.exe
  C:\Windows\System\cdhALXT.exe
  2⤵
  PID:7632
- C:\Windows\System\TaOCeyb.exe
  C:\Windows\System\TaOCeyb.exe
  2⤵
  PID:7660
- C:\Windows\System\AoEUykR.exe
  C:\Windows\System\AoEUykR.exe
  2⤵
  PID:7764
- C:\Windows\System\hCOvqpi.exe
  C:\Windows\System\hCOvqpi.exe
  2⤵
  PID:7780
- C:\Windows\System\FWyEfzv.exe
  C:\Windows\System\FWyEfzv.exe
  2⤵
  PID:7800
- C:\Windows\System\phgtvJY.exe
  C:\Windows\System\phgtvJY.exe
  2⤵
  PID:7816
- C:\Windows\System\uHyXaqV.exe
  C:\Windows\System\uHyXaqV.exe
  2⤵
  PID:7836
- C:\Windows\System\PPVixRQ.exe
  C:\Windows\System\PPVixRQ.exe
  2⤵
  PID:7860
- C:\Windows\System\VbSsswN.exe
  C:\Windows\System\VbSsswN.exe
  2⤵
  PID:7884
- C:\Windows\System\IaymoYE.exe
  C:\Windows\System\IaymoYE.exe
  2⤵
  PID:7908
- C:\Windows\System\EMtBqQx.exe
  C:\Windows\System\EMtBqQx.exe
  2⤵
  PID:7932
- C:\Windows\System\upykEWN.exe
  C:\Windows\System\upykEWN.exe
  2⤵
  PID:7956
- C:\Windows\System\zZvGUlT.exe
  C:\Windows\System\zZvGUlT.exe
  2⤵
  PID:7976
- C:\Windows\System\lXhYYTK.exe
  C:\Windows\System\lXhYYTK.exe
  2⤵
  PID:8000
- C:\Windows\System\npyVMXC.exe
  C:\Windows\System\npyVMXC.exe
  2⤵
  PID:8024
- C:\Windows\System\YSRdQWV.exe
  C:\Windows\System\YSRdQWV.exe
  2⤵
  PID:8052
- C:\Windows\System\QGdRtrh.exe
  C:\Windows\System\QGdRtrh.exe
  2⤵
  PID:8072
- C:\Windows\System\HkXRMJT.exe
  C:\Windows\System\HkXRMJT.exe
  2⤵
  PID:8096
- C:\Windows\System\Mdtxnfl.exe
  C:\Windows\System\Mdtxnfl.exe
  2⤵
  PID:8116
- C:\Windows\System\mTTwUkF.exe
  C:\Windows\System\mTTwUkF.exe
  2⤵
  PID:5784
- C:\Windows\System\Hvfrttz.exe
  C:\Windows\System\Hvfrttz.exe
  2⤵
  PID:6148
- C:\Windows\System\YqGoSgf.exe
  C:\Windows\System\YqGoSgf.exe
  2⤵
  PID:7176
- C:\Windows\System\XrAHicg.exe
  C:\Windows\System\XrAHicg.exe
  2⤵
  PID:7228
- C:\Windows\System\XWifDYk.exe
  C:\Windows\System\XWifDYk.exe
  2⤵
  PID:6776
- C:\Windows\System\dCJDlkP.exe
  C:\Windows\System\dCJDlkP.exe
  2⤵
  PID:6828
- C:\Windows\System\fpHPEvR.exe
  C:\Windows\System\fpHPEvR.exe
  2⤵
  PID:6924
- C:\Windows\System\qpBrFFF.exe
  C:\Windows\System\qpBrFFF.exe
  2⤵
  PID:7004
- C:\Windows\System\ljuqhsr.exe
  C:\Windows\System\ljuqhsr.exe
  2⤵
  PID:7112
- C:\Windows\System\pMhCYml.exe
  C:\Windows\System\pMhCYml.exe
  2⤵
  PID:7140
- C:\Windows\System\WCQUzxa.exe
  C:\Windows\System\WCQUzxa.exe
  2⤵
  PID:1104
- C:\Windows\System\SFLhQFD.exe
  C:\Windows\System\SFLhQFD.exe
  2⤵
  PID:5436
- C:\Windows\System\LgiYhCP.exe
  C:\Windows\System\LgiYhCP.exe
  2⤵
  PID:3596
- C:\Windows\System\whUYxeu.exe
  C:\Windows\System\whUYxeu.exe
  2⤵
  PID:464
- C:\Windows\System\QtMRPaQ.exe
  C:\Windows\System\QtMRPaQ.exe
  2⤵
  PID:5992
- C:\Windows\System\suyjNpO.exe
  C:\Windows\System\suyjNpO.exe
  2⤵
  PID:6140
- C:\Windows\System\CXDkdnT.exe
  C:\Windows\System\CXDkdnT.exe
  2⤵
  PID:6220
- C:\Windows\System\VrPEsKo.exe
  C:\Windows\System\VrPEsKo.exe
  2⤵
  PID:3404
- C:\Windows\System\ZipICFy.exe
  C:\Windows\System\ZipICFy.exe
  2⤵
  PID:7916
- C:\Windows\System\SzFFURl.exe
  C:\Windows\System\SzFFURl.exe
  2⤵
  PID:8032
- C:\Windows\System\yuWfACW.exe
  C:\Windows\System\yuWfACW.exe
  2⤵
  PID:6808
- C:\Windows\System\doWQIee.exe
  C:\Windows\System\doWQIee.exe
  2⤵
  PID:6928
- C:\Windows\System\fXPRNuG.exe
  C:\Windows\System\fXPRNuG.exe
  2⤵
  PID:7124
- C:\Windows\System\NGWYRdA.exe
  C:\Windows\System\NGWYRdA.exe
  2⤵
  PID:5384
- C:\Windows\System\BshfVhp.exe
  C:\Windows\System\BshfVhp.exe
  2⤵
  PID:3892
- C:\Windows\System\evRKCWC.exe
  C:\Windows\System\evRKCWC.exe
  2⤵
  PID:6096
- C:\Windows\System\GgYkwiS.exe
  C:\Windows\System\GgYkwiS.exe
  2⤵
  PID:4020
- C:\Windows\System\cTYMdAg.exe
  C:\Windows\System\cTYMdAg.exe
  2⤵
  PID:8440
- C:\Windows\System\pkyqNGe.exe
  C:\Windows\System\pkyqNGe.exe
  2⤵
  PID:8456
- C:\Windows\System\uLwtjAp.exe
  C:\Windows\System\uLwtjAp.exe
  2⤵
  PID:8504
- C:\Windows\System\kUoVqSW.exe
  C:\Windows\System\kUoVqSW.exe
  2⤵
  PID:8568
- C:\Windows\System\Msjzbtd.exe
  C:\Windows\System\Msjzbtd.exe
  2⤵
  PID:8588
- C:\Windows\System\AWfokFA.exe
  C:\Windows\System\AWfokFA.exe
  2⤵
  PID:8604
- C:\Windows\System\Grbutsv.exe
  C:\Windows\System\Grbutsv.exe
  2⤵
  PID:8620
- C:\Windows\System\kytwGvu.exe
  C:\Windows\System\kytwGvu.exe
  2⤵
  PID:8640
- C:\Windows\System\oLaPDMy.exe
  C:\Windows\System\oLaPDMy.exe
  2⤵
  PID:8656
- C:\Windows\System\mxTbrIV.exe
  C:\Windows\System\mxTbrIV.exe
  2⤵
  PID:8676
- C:\Windows\System\ZnXCBHl.exe
  C:\Windows\System\ZnXCBHl.exe
  2⤵
  PID:8692
- C:\Windows\System\huXIJcK.exe
  C:\Windows\System\huXIJcK.exe
  2⤵
  PID:8708
- C:\Windows\System\TANTdHf.exe
  C:\Windows\System\TANTdHf.exe
  2⤵
  PID:8724
- C:\Windows\System\gJraMOp.exe
  C:\Windows\System\gJraMOp.exe
  2⤵
  PID:8740
- C:\Windows\System\ZRhBIPU.exe
  C:\Windows\System\ZRhBIPU.exe
  2⤵
  PID:8756
- C:\Windows\System\uPTRcdm.exe
  C:\Windows\System\uPTRcdm.exe
  2⤵
  PID:8772
- C:\Windows\System\acCphRQ.exe
  C:\Windows\System\acCphRQ.exe
  2⤵
  PID:8788
- C:\Windows\System\GFFDVNa.exe
  C:\Windows\System\GFFDVNa.exe
  2⤵
  PID:8808
- C:\Windows\System\qdKpRrD.exe
  C:\Windows\System\qdKpRrD.exe
  2⤵
  PID:8828
- C:\Windows\System\ALpmxBC.exe
  C:\Windows\System\ALpmxBC.exe
  2⤵
  PID:8844
- C:\Windows\System\AITYmmp.exe
  C:\Windows\System\AITYmmp.exe
  2⤵
  PID:8876
- C:\Windows\System\DitLvMH.exe
  C:\Windows\System\DitLvMH.exe
  2⤵
  PID:8924
- C:\Windows\System\MrIPGBM.exe
  C:\Windows\System\MrIPGBM.exe
  2⤵
  PID:8940
- C:\Windows\System\DpsadJD.exe
  C:\Windows\System\DpsadJD.exe
  2⤵
  PID:8956
- C:\Windows\System\nClhrVl.exe
  C:\Windows\System\nClhrVl.exe
  2⤵
  PID:8980
- C:\Windows\System\vRHWJGq.exe
  C:\Windows\System\vRHWJGq.exe
  2⤵
  PID:8996
- C:\Windows\System\uiqfTTz.exe
  C:\Windows\System\uiqfTTz.exe
  2⤵
  PID:9016
- C:\Windows\System\MomhnIb.exe
  C:\Windows\System\MomhnIb.exe
  2⤵
  PID:9032
- C:\Windows\System\FupAVUY.exe
  C:\Windows\System\FupAVUY.exe
  2⤵
  PID:9096
- C:\Windows\System\zglOZJU.exe
  C:\Windows\System\zglOZJU.exe
  2⤵
  PID:9128
- C:\Windows\System\UZgOeDw.exe
  C:\Windows\System\UZgOeDw.exe
  2⤵
  PID:9148
- C:\Windows\System\yptDGqc.exe
  C:\Windows\System\yptDGqc.exe
  2⤵
  PID:9172
- C:\Windows\System\mUcMJnU.exe
  C:\Windows\System\mUcMJnU.exe
  2⤵
  PID:9192
- C:\Windows\System\dwezHnd.exe
  C:\Windows\System\dwezHnd.exe
  2⤵
  PID:7832
- C:\Windows\System\iQGUWqk.exe
  C:\Windows\System\iQGUWqk.exe
  2⤵
  PID:7892
- C:\Windows\System\UAJDVvM.exe
  C:\Windows\System\UAJDVvM.exe
  2⤵
  PID:8008
- C:\Windows\System\lPTODde.exe
  C:\Windows\System\lPTODde.exe
  2⤵
  PID:8084
- C:\Windows\System\gpqcCyI.exe
  C:\Windows\System\gpqcCyI.exe
  2⤵
  PID:4108
- C:\Windows\System\qotBeUf.exe
  C:\Windows\System\qotBeUf.exe
  2⤵
  PID:4876
- C:\Windows\System\EKlxthH.exe
  C:\Windows\System\EKlxthH.exe
  2⤵
  PID:7208
- C:\Windows\System\cFwPmqD.exe
  C:\Windows\System\cFwPmqD.exe
  2⤵
  PID:6896
- C:\Windows\System\NiqkkDn.exe
  C:\Windows\System\NiqkkDn.exe
  2⤵
  PID:5496
- C:\Windows\System\oFblDvx.exe
  C:\Windows\System\oFblDvx.exe
  2⤵
  PID:6124
- C:\Windows\System\zvHBBrr.exe
  C:\Windows\System\zvHBBrr.exe
  2⤵
  PID:8284
- C:\Windows\System\BLOiEmU.exe
  C:\Windows\System\BLOiEmU.exe
  2⤵
  PID:8316
- C:\Windows\System\cKPoHjH.exe
  C:\Windows\System\cKPoHjH.exe
  2⤵
  PID:3700
- C:\Windows\System\DIvSplp.exe
  C:\Windows\System\DIvSplp.exe
  2⤵
  PID:4900
- C:\Windows\System\LKXYTji.exe
  C:\Windows\System\LKXYTji.exe
  2⤵
  PID:4004
- C:\Windows\System\NOcxXqD.exe
  C:\Windows\System\NOcxXqD.exe
  2⤵
  PID:3496
- C:\Windows\System\lPhivYX.exe
  C:\Windows\System\lPhivYX.exe
  2⤵
  PID:2036
- C:\Windows\System\hrMmzab.exe
  C:\Windows\System\hrMmzab.exe
  2⤵
  PID:1044
- C:\Windows\System\ubojgSx.exe
  C:\Windows\System\ubojgSx.exe
  2⤵
  PID:1232
- C:\Windows\System\ehYAYDt.exe
  C:\Windows\System\ehYAYDt.exe
  2⤵
  PID:3088
- C:\Windows\System\wQIzIlS.exe
  C:\Windows\System\wQIzIlS.exe
  2⤵
  PID:3112
- C:\Windows\System\GGPwePN.exe
  C:\Windows\System\GGPwePN.exe
  2⤵
  PID:8448
- C:\Windows\System\WoNisVV.exe
  C:\Windows\System\WoNisVV.exe
  2⤵
  PID:4896
- C:\Windows\System\elHtiMh.exe
  C:\Windows\System\elHtiMh.exe
  2⤵
  PID:8600
- C:\Windows\System\IqHrzdP.exe
  C:\Windows\System\IqHrzdP.exe
  2⤵
  PID:8492
- C:\Windows\System\gfLvJvv.exe
  C:\Windows\System\gfLvJvv.exe
  2⤵
  PID:8700
- C:\Windows\System\UYFYTpl.exe
  C:\Windows\System\UYFYTpl.exe
  2⤵
  PID:8800
- C:\Windows\System\jEOmiCV.exe
  C:\Windows\System\jEOmiCV.exe
  2⤵
  PID:8856
- C:\Windows\System\NeLqWAp.exe
  C:\Windows\System\NeLqWAp.exe
  2⤵
  PID:8912
- C:\Windows\System\zOfIBQQ.exe
  C:\Windows\System\zOfIBQQ.exe
  2⤵
  PID:8512
- C:\Windows\System\UzhWQzS.exe
  C:\Windows\System\UzhWQzS.exe
  2⤵
  PID:8836
- C:\Windows\System\hQDZABc.exe
  C:\Windows\System\hQDZABc.exe
  2⤵
  PID:8552
- C:\Windows\System\eWkNpwY.exe
  C:\Windows\System\eWkNpwY.exe
  2⤵
  PID:8576
- C:\Windows\System\QodxIbB.exe
  C:\Windows\System\QodxIbB.exe
  2⤵
  PID:9012
- C:\Windows\System\IIHtQBV.exe
  C:\Windows\System\IIHtQBV.exe
  2⤵
  PID:9028
- C:\Windows\System\TEgJGJq.exe
  C:\Windows\System\TEgJGJq.exe
  2⤵
  PID:8752
- C:\Windows\System\OYwUxom.exe
  C:\Windows\System\OYwUxom.exe
  2⤵
  PID:9084
- C:\Windows\System\veHBKSD.exe
  C:\Windows\System\veHBKSD.exe
  2⤵
  PID:8824
- C:\Windows\System\gVAyJcv.exe
  C:\Windows\System\gVAyJcv.exe
  2⤵
  PID:8884
- C:\Windows\System\swJIslW.exe
  C:\Windows\System\swJIslW.exe
  2⤵
  PID:2452
- C:\Windows\System\SvWlLuP.exe
  C:\Windows\System\SvWlLuP.exe
  2⤵
  PID:8068
- C:\Windows\System\FSqDyIP.exe
  C:\Windows\System\FSqDyIP.exe
  2⤵
  PID:6988
- C:\Windows\System\uGFGSID.exe
  C:\Windows\System\uGFGSID.exe
  2⤵
  PID:9088
- C:\Windows\System\KCfYpuc.exe
  C:\Windows\System\KCfYpuc.exe
  2⤵
  PID:5016
- C:\Windows\System\yfclSte.exe
  C:\Windows\System\yfclSte.exe
  2⤵
  PID:1140
- C:\Windows\System\rSEoWGq.exe
  C:\Windows\System\rSEoWGq.exe
  2⤵
  PID:8144
- C:\Windows\System\cwYAuMB.exe
  C:\Windows\System\cwYAuMB.exe
  2⤵
  PID:8248
- C:\Windows\System\eKlkqwf.exe
  C:\Windows\System\eKlkqwf.exe
  2⤵
  PID:8652
- C:\Windows\System\EsQDcYM.exe
  C:\Windows\System\EsQDcYM.exe
  2⤵
  PID:8900
- C:\Windows\System\XHZwrPs.exe
  C:\Windows\System\XHZwrPs.exe
  2⤵
  PID:2264
- C:\Windows\System\BUBWbtx.exe
  C:\Windows\System\BUBWbtx.exe
  2⤵
  PID:7852
- C:\Windows\System\XMcxUDE.exe
  C:\Windows\System\XMcxUDE.exe
  2⤵
  PID:8408
- C:\Windows\System\rUclMgY.exe
  C:\Windows\System\rUclMgY.exe
  2⤵
  PID:8556
- C:\Windows\System\YoCLjts.exe
  C:\Windows\System\YoCLjts.exe
  2⤵
  PID:9232
- C:\Windows\System\jHLpHdA.exe
  C:\Windows\System\jHLpHdA.exe
  2⤵
  PID:9256
- C:\Windows\System\SHfHwHG.exe
  C:\Windows\System\SHfHwHG.exe
  2⤵
  PID:9276
- C:\Windows\System\PCyybgj.exe
  C:\Windows\System\PCyybgj.exe
  2⤵
  PID:9304
- C:\Windows\System\GPlNRmf.exe
  C:\Windows\System\GPlNRmf.exe
  2⤵
  PID:9324
- C:\Windows\System\QnXQoSN.exe
  C:\Windows\System\QnXQoSN.exe
  2⤵
  PID:9344
- C:\Windows\System\XzmAnSH.exe
  C:\Windows\System\XzmAnSH.exe
  2⤵
  PID:9364
- C:\Windows\System\iRWbekA.exe
  C:\Windows\System\iRWbekA.exe
  2⤵
  PID:9388
- C:\Windows\System\NEGqKSD.exe
  C:\Windows\System\NEGqKSD.exe
  2⤵
  PID:9408
- C:\Windows\System\NWXRcxG.exe
  C:\Windows\System\NWXRcxG.exe
  2⤵
  PID:9432
- C:\Windows\System\oeIVCuL.exe
  C:\Windows\System\oeIVCuL.exe
  2⤵
  PID:9456
- C:\Windows\System\yCpFoKh.exe
  C:\Windows\System\yCpFoKh.exe
  2⤵
  PID:9476
- C:\Windows\System\XQapfZZ.exe
  C:\Windows\System\XQapfZZ.exe
  2⤵
  PID:9504
- C:\Windows\System\ogFChTE.exe
  C:\Windows\System\ogFChTE.exe
  2⤵
  PID:9532
- C:\Windows\System\DhmolvF.exe
  C:\Windows\System\DhmolvF.exe
  2⤵
  PID:9548
- C:\Windows\System\LgdftrA.exe
  C:\Windows\System\LgdftrA.exe
  2⤵
  PID:9564
- C:\Windows\System\VdLIRUy.exe
  C:\Windows\System\VdLIRUy.exe
  2⤵
  PID:9592
- C:\Windows\System\rIrHoRN.exe
  C:\Windows\System\rIrHoRN.exe
  2⤵
  PID:9616
- C:\Windows\System\ggSmbTv.exe
  C:\Windows\System\ggSmbTv.exe
  2⤵
  PID:9636
- C:\Windows\System\blbNrbo.exe
  C:\Windows\System\blbNrbo.exe
  2⤵
  PID:9652
- C:\Windows\System\ohjdSCV.exe
  C:\Windows\System\ohjdSCV.exe
  2⤵
  PID:9672
- C:\Windows\System\jasXxdE.exe
  C:\Windows\System\jasXxdE.exe
  2⤵
  PID:9696
- C:\Windows\System\zlgSxWz.exe
  C:\Windows\System\zlgSxWz.exe
  2⤵
  PID:9720
- C:\Windows\System\eLnhlXZ.exe
  C:\Windows\System\eLnhlXZ.exe
  2⤵
  PID:9744
- C:\Windows\System\FJGygWc.exe
  C:\Windows\System\FJGygWc.exe
  2⤵
  PID:9768
- C:\Windows\System\NsqTLjP.exe
  C:\Windows\System\NsqTLjP.exe
  2⤵
  PID:9804
- C:\Windows\System\KpUKWvs.exe
  C:\Windows\System\KpUKWvs.exe
  2⤵
  PID:9828
- C:\Windows\System\DNcIwkn.exe
  C:\Windows\System\DNcIwkn.exe
  2⤵
  PID:9848
- C:\Windows\System\gwPbCmo.exe
  C:\Windows\System\gwPbCmo.exe
  2⤵
  PID:9868
- C:\Windows\System\DIpmPbB.exe
  C:\Windows\System\DIpmPbB.exe
  2⤵
  PID:9900
- C:\Windows\System\TeXplGg.exe
  C:\Windows\System\TeXplGg.exe
  2⤵
  PID:9924
- C:\Windows\System\pCQNLGS.exe
  C:\Windows\System\pCQNLGS.exe
  2⤵
  PID:9940
- C:\Windows\System\UpcgFWp.exe
  C:\Windows\System\UpcgFWp.exe
  2⤵
  PID:9968
- C:\Windows\System\ZAAneBa.exe
  C:\Windows\System\ZAAneBa.exe
  2⤵
  PID:9992
- C:\Windows\System\cNMDvSn.exe
  C:\Windows\System\cNMDvSn.exe
  2⤵
  PID:10008
- C:\Windows\System\CJtIZSA.exe
  C:\Windows\System\CJtIZSA.exe
  2⤵
  PID:10040
- C:\Windows\System\AlDoVwB.exe
  C:\Windows\System\AlDoVwB.exe
  2⤵
  PID:10060
- C:\Windows\System\SwkHzeb.exe
  C:\Windows\System\SwkHzeb.exe
  2⤵
  PID:10092
- C:\Windows\System\FtYgUdW.exe
  C:\Windows\System\FtYgUdW.exe
  2⤵
  PID:10108
- C:\Windows\System\DNZNDmh.exe
  C:\Windows\System\DNZNDmh.exe
  2⤵
  PID:10124
- C:\Windows\System\QGRzOcF.exe
  C:\Windows\System\QGRzOcF.exe
  2⤵
  PID:10144
- C:\Windows\System\UQlrhoP.exe
  C:\Windows\System\UQlrhoP.exe
  2⤵
  PID:10168
- C:\Windows\System\oeRuTqt.exe
  C:\Windows\System\oeRuTqt.exe
  2⤵
  PID:10188
- C:\Windows\System\gALGnvy.exe
  C:\Windows\System\gALGnvy.exe
  2⤵
  PID:10212
- C:\Windows\System\IDVEWWu.exe
  C:\Windows\System\IDVEWWu.exe
  2⤵
  PID:10236
- C:\Windows\System\xwTmYJn.exe
  C:\Windows\System\xwTmYJn.exe
  2⤵
  PID:8992
- C:\Windows\System\fbZTQPJ.exe
  C:\Windows\System\fbZTQPJ.exe
  2⤵
  PID:4528
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4528 -s 244
    3⤵
    PID:11108
- C:\Windows\System\PAoqWvE.exe
  C:\Windows\System\PAoqWvE.exe
  2⤵
  PID:8480
- C:\Windows\System\YwkQQNR.exe
  C:\Windows\System\YwkQQNR.exe
  2⤵
  PID:1956
- C:\Windows\System\GFyiIJZ.exe
  C:\Windows\System\GFyiIJZ.exe
  2⤵
  PID:1296
- C:\Windows\System\TeDAcXz.exe
  C:\Windows\System\TeDAcXz.exe
  2⤵
  PID:4632
- C:\Windows\System\GsamJGh.exe
  C:\Windows\System\GsamJGh.exe
  2⤵
  PID:8736
- C:\Windows\System\HzsfCJB.exe
  C:\Windows\System\HzsfCJB.exe
  2⤵
  PID:3660
- C:\Windows\System\wSRBMRY.exe
  C:\Windows\System\wSRBMRY.exe
  2⤵
  PID:9144
- C:\Windows\System\JgWazSQ.exe
  C:\Windows\System\JgWazSQ.exe
  2⤵
  PID:9400
- C:\Windows\System\HLozkYA.exe
  C:\Windows\System\HLozkYA.exe
  2⤵
  PID:8564
- C:\Windows\System\VyLSrXb.exe
  C:\Windows\System\VyLSrXb.exe
  2⤵
  PID:9540
- C:\Windows\System\biAmgqs.exe
  C:\Windows\System\biAmgqs.exe
  2⤵
  PID:8748
- C:\Windows\System\pdDJvLr.exe
  C:\Windows\System\pdDJvLr.exe
  2⤵
  PID:8780
- C:\Windows\System\rDVAGpZ.exe
  C:\Windows\System\rDVAGpZ.exe
  2⤵
  PID:9248
- C:\Windows\System\pmUnSaX.exe
  C:\Windows\System\pmUnSaX.exe
  2⤵
  PID:2848
- C:\Windows\System\rZTvXLO.exe
  C:\Windows\System\rZTvXLO.exe
  2⤵
  PID:9860
- C:\Windows\System\HEFTgFS.exe
  C:\Windows\System\HEFTgFS.exe
  2⤵
  PID:10248
- C:\Windows\System\FrJaVfz.exe
  C:\Windows\System\FrJaVfz.exe
  2⤵
  PID:10268
- C:\Windows\System\jRdHSDk.exe
  C:\Windows\System\jRdHSDk.exe
  2⤵
  PID:10288
- C:\Windows\System\RRiHZUR.exe
  C:\Windows\System\RRiHZUR.exe
  2⤵
  PID:10336
- C:\Windows\System\IaMGyVU.exe
  C:\Windows\System\IaMGyVU.exe
  2⤵
  PID:10356
- C:\Windows\System\XLmTIsD.exe
  C:\Windows\System\XLmTIsD.exe
  2⤵
  PID:10376
- C:\Windows\System\bBDGElv.exe
  C:\Windows\System\bBDGElv.exe
  2⤵
  PID:10400
- C:\Windows\System\gwFAsJG.exe
  C:\Windows\System\gwFAsJG.exe
  2⤵
  PID:10420
- C:\Windows\System\NQkYqWx.exe
  C:\Windows\System\NQkYqWx.exe
  2⤵
  PID:10440
- C:\Windows\System\XvvrHyZ.exe
  C:\Windows\System\XvvrHyZ.exe
  2⤵
  PID:10460
- C:\Windows\System\KvJDIiW.exe
  C:\Windows\System\KvJDIiW.exe
  2⤵
  PID:10480
- C:\Windows\System\WQRhCQO.exe
  C:\Windows\System\WQRhCQO.exe
  2⤵
  PID:10496
- C:\Windows\System\cFclDRD.exe
  C:\Windows\System\cFclDRD.exe
  2⤵
  PID:10520
- C:\Windows\System\PXEYvyH.exe
  C:\Windows\System\PXEYvyH.exe
  2⤵
  PID:10544
- C:\Windows\System\iuatAbS.exe
  C:\Windows\System\iuatAbS.exe
  2⤵
  PID:10560
- C:\Windows\System\xbCmagA.exe
  C:\Windows\System\xbCmagA.exe
  2⤵
  PID:10592
- C:\Windows\System\YvKuCUk.exe
  C:\Windows\System\YvKuCUk.exe
  2⤵
  PID:10620
- C:\Windows\System\NYeYcUl.exe
  C:\Windows\System\NYeYcUl.exe
  2⤵
  PID:10640
- C:\Windows\System\sxPEPDp.exe
  C:\Windows\System\sxPEPDp.exe
  2⤵
  PID:10668
- C:\Windows\System\kcgFnaP.exe
  C:\Windows\System\kcgFnaP.exe
  2⤵
  PID:10688
- C:\Windows\System\SdcfvMh.exe
  C:\Windows\System\SdcfvMh.exe
  2⤵
  PID:10712
- C:\Windows\System\lMqzEFZ.exe
  C:\Windows\System\lMqzEFZ.exe
  2⤵
  PID:10732
- C:\Windows\System\jCLhkMq.exe
  C:\Windows\System\jCLhkMq.exe
  2⤵
  PID:10752
- C:\Windows\System\vrKzTNw.exe
  C:\Windows\System\vrKzTNw.exe
  2⤵
  PID:10768
- C:\Windows\System\arISUrx.exe
  C:\Windows\System\arISUrx.exe
  2⤵
  PID:10784
- C:\Windows\System\aWDMbyn.exe
  C:\Windows\System\aWDMbyn.exe
  2⤵
  PID:10812
- C:\Windows\System\wRrPSgS.exe
  C:\Windows\System\wRrPSgS.exe
  2⤵
  PID:10832
- C:\Windows\System\yfzoIAV.exe
  C:\Windows\System\yfzoIAV.exe
  2⤵
  PID:10860
- C:\Windows\System\yugbFcK.exe
  C:\Windows\System\yugbFcK.exe
  2⤵
  PID:10896
- C:\Windows\System\igZnyyR.exe
  C:\Windows\System\igZnyyR.exe
  2⤵
  PID:10920
- C:\Windows\System\SOdncFP.exe
  C:\Windows\System\SOdncFP.exe
  2⤵
  PID:10940
- C:\Windows\System\psTeoFw.exe
  C:\Windows\System\psTeoFw.exe
  2⤵
  PID:10960
- C:\Windows\System\Rcvisbu.exe
  C:\Windows\System\Rcvisbu.exe
  2⤵
  PID:10984
- C:\Windows\System\xDHxGCI.exe
  C:\Windows\System\xDHxGCI.exe
  2⤵
  PID:11004
- C:\Windows\System\VbypXPw.exe
  C:\Windows\System\VbypXPw.exe
  2⤵
  PID:11036
- C:\Windows\System\KWauAYo.exe
  C:\Windows\System\KWauAYo.exe
  2⤵
  PID:11056
- C:\Windows\System\tKtcckt.exe
  C:\Windows\System\tKtcckt.exe
  2⤵
  PID:11080
- C:\Windows\System\wczVsFP.exe
  C:\Windows\System\wczVsFP.exe
  2⤵
  PID:11116
- C:\Windows\System\KILEGcV.exe
  C:\Windows\System\KILEGcV.exe
  2⤵
  PID:11140
- C:\Windows\System\QkkIyIX.exe
  C:\Windows\System\QkkIyIX.exe
  2⤵
  PID:11160
- C:\Windows\System\bZKeBRp.exe
  C:\Windows\System\bZKeBRp.exe
  2⤵
  PID:11184
- C:\Windows\System\vqFlhIH.exe
  C:\Windows\System\vqFlhIH.exe
  2⤵
  PID:11208
- C:\Windows\System\dlpSJpt.exe
  C:\Windows\System\dlpSJpt.exe
  2⤵
  PID:11232
- C:\Windows\System\LncrBda.exe
  C:\Windows\System\LncrBda.exe
  2⤵
  PID:11248
- C:\Windows\System\tenZLnk.exe
  C:\Windows\System\tenZLnk.exe
  2⤵
  PID:9384
- C:\Windows\System\ttfzPwe.exe
  C:\Windows\System\ttfzPwe.exe
  2⤵
  PID:9472
- C:\Windows\System\KbFBTIQ.exe
  C:\Windows\System\KbFBTIQ.exe
  2⤵
  PID:9524
- C:\Windows\System\ZncwzXr.exe
  C:\Windows\System\ZncwzXr.exe
  2⤵
  PID:10116
- C:\Windows\System\DTbewGI.exe
  C:\Windows\System\DTbewGI.exe
  2⤵
  PID:8544
- C:\Windows\System\VFbHnSw.exe
  C:\Windows\System\VFbHnSw.exe
  2⤵
  PID:7868
- C:\Windows\System\uaaMhmj.exe
  C:\Windows\System\uaaMhmj.exe
  2⤵
  PID:8896
- C:\Windows\System\RPPZzBw.exe
  C:\Windows\System\RPPZzBw.exe
  2⤵
  PID:9292
- C:\Windows\System\YuxDZPl.exe
  C:\Windows\System\YuxDZPl.exe
  2⤵
  PID:9320
- C:\Windows\System\iJfZOvZ.exe
  C:\Windows\System\iJfZOvZ.exe
  2⤵
  PID:9224
- C:\Windows\System\LaxaTlN.exe
  C:\Windows\System\LaxaTlN.exe
  2⤵
  PID:9820
- C:\Windows\System\euJwpHA.exe
  C:\Windows\System\euJwpHA.exe
  2⤵
  PID:9420
- C:\Windows\System\ESulfMs.exe
  C:\Windows\System\ESulfMs.exe
  2⤵
  PID:10368
- C:\Windows\System\OwPDGfv.exe
  C:\Windows\System\OwPDGfv.exe
  2⤵
  PID:10412
- C:\Windows\System\gqNORyv.exe
  C:\Windows\System\gqNORyv.exe
  2⤵
  PID:10448
- C:\Windows\System\BWTbTlp.exe
  C:\Windows\System\BWTbTlp.exe
  2⤵
  PID:9556
- C:\Windows\System\FqcZoCP.exe
  C:\Windows\System\FqcZoCP.exe
  2⤵
  PID:10532
- C:\Windows\System\NRKdlTV.exe
  C:\Windows\System\NRKdlTV.exe
  2⤵
  PID:10552
- C:\Windows\System\GbiTUJi.exe
  C:\Windows\System\GbiTUJi.exe
  2⤵
  PID:10200
- C:\Windows\System\tBNVVWL.exe
  C:\Windows\System\tBNVVWL.exe
  2⤵
  PID:9692
- C:\Windows\System\WzMtaZT.exe
  C:\Windows\System\WzMtaZT.exe
  2⤵
  PID:10680
- C:\Windows\System\RkqBSRT.exe
  C:\Windows\System\RkqBSRT.exe
  2⤵
  PID:10728
- C:\Windows\System\uhxtbyS.exe
  C:\Windows\System\uhxtbyS.exe
  2⤵
  PID:10764
- C:\Windows\System\duPgPrD.exe
  C:\Windows\System\duPgPrD.exe
  2⤵
  PID:10796
- C:\Windows\System\fGEtLzr.exe
  C:\Windows\System\fGEtLzr.exe
  2⤵
  PID:9440
- C:\Windows\System\zAchzJy.exe
  C:\Windows\System\zAchzJy.exe
  2⤵
  PID:10932
- C:\Windows\System\PxYZHvR.exe
  C:\Windows\System\PxYZHvR.exe
  2⤵
  PID:11276
- C:\Windows\System\MSXBJbr.exe
  C:\Windows\System\MSXBJbr.exe
  2⤵
  PID:11296
- C:\Windows\System\TQHJMrG.exe
  C:\Windows\System\TQHJMrG.exe
  2⤵
  PID:11320
- C:\Windows\System\fLPZQoz.exe
  C:\Windows\System\fLPZQoz.exe
  2⤵
  PID:11344
- C:\Windows\System\gypEQZf.exe
  C:\Windows\System\gypEQZf.exe
  2⤵
  PID:11368
- C:\Windows\System\OfqUpiH.exe
  C:\Windows\System\OfqUpiH.exe
  2⤵
  PID:11388
- C:\Windows\System\Chmvxjk.exe
  C:\Windows\System\Chmvxjk.exe
  2⤵
  PID:11408
- C:\Windows\System\xsZLkAZ.exe
  C:\Windows\System\xsZLkAZ.exe
  2⤵
  PID:11428
- C:\Windows\System\nlRfGtF.exe
  C:\Windows\System\nlRfGtF.exe
  2⤵
  PID:11444
- C:\Windows\System\mfYSiXS.exe
  C:\Windows\System\mfYSiXS.exe
  2⤵
  PID:11460
- C:\Windows\System\eMzKdSv.exe
  C:\Windows\System\eMzKdSv.exe
  2⤵
  PID:11476
- C:\Windows\System\MPGxfkf.exe
  C:\Windows\System\MPGxfkf.exe
  2⤵
  PID:11504
- C:\Windows\System\sRbMKuW.exe
  C:\Windows\System\sRbMKuW.exe
  2⤵
  PID:11528
- C:\Windows\System\PNhByqT.exe
  C:\Windows\System\PNhByqT.exe
  2⤵
  PID:11552
- C:\Windows\System\SIFvoFb.exe
  C:\Windows\System\SIFvoFb.exe
  2⤵
  PID:11576
- C:\Windows\System\EDRKTVJ.exe
  C:\Windows\System\EDRKTVJ.exe
  2⤵
  PID:11600
- C:\Windows\System\FJSyzqY.exe
  C:\Windows\System\FJSyzqY.exe
  2⤵
  PID:11620
- C:\Windows\System\zFOCfnL.exe
  C:\Windows\System\zFOCfnL.exe
  2⤵
  PID:11644
- C:\Windows\System\lEUjJZR.exe
  C:\Windows\System\lEUjJZR.exe
  2⤵
  PID:11664
- C:\Windows\System\TGlFVVD.exe
  C:\Windows\System\TGlFVVD.exe
  2⤵
  PID:11684
- C:\Windows\System\qYlRlnQ.exe
  C:\Windows\System\qYlRlnQ.exe
  2⤵
  PID:11708
- C:\Windows\System\lcQTMUU.exe
  C:\Windows\System\lcQTMUU.exe
  2⤵
  PID:11732
- C:\Windows\System\fIyOwMe.exe
  C:\Windows\System\fIyOwMe.exe
  2⤵
  PID:11752
- C:\Windows\System\EiTLHBn.exe
  C:\Windows\System\EiTLHBn.exe
  2⤵
  PID:11772
- C:\Windows\System\hWPRDYv.exe
  C:\Windows\System\hWPRDYv.exe
  2⤵
  PID:11796
- C:\Windows\System\bMuKjqr.exe
  C:\Windows\System\bMuKjqr.exe
  2⤵
  PID:11824
- C:\Windows\System\DFsZSqb.exe
  C:\Windows\System\DFsZSqb.exe
  2⤵
  PID:11844
- C:\Windows\System\Sctctfu.exe
  C:\Windows\System\Sctctfu.exe
  2⤵
  PID:11876
- C:\Windows\System\jFpSAhK.exe
  C:\Windows\System\jFpSAhK.exe
  2⤵
  PID:11896
- C:\Windows\System\mSfEaTH.exe
  C:\Windows\System\mSfEaTH.exe
  2⤵
  PID:11920
- C:\Windows\System\XpAYGap.exe
  C:\Windows\System\XpAYGap.exe
  2⤵
  PID:11948
- C:\Windows\System\ebLPOtW.exe
  C:\Windows\System\ebLPOtW.exe
  2⤵
  PID:11968
- C:\Windows\System\bsqbvIV.exe
  C:\Windows\System\bsqbvIV.exe
  2⤵
  PID:11988
- C:\Windows\System\iXuJCYn.exe
  C:\Windows\System\iXuJCYn.exe
  2⤵
  PID:12012
- C:\Windows\System\ZJmSMPI.exe
  C:\Windows\System\ZJmSMPI.exe
  2⤵
  PID:12036
- C:\Windows\System\xpERmtq.exe
  C:\Windows\System\xpERmtq.exe
  2⤵
  PID:12060
- C:\Windows\System\SfayKQd.exe
  C:\Windows\System\SfayKQd.exe
  2⤵
  PID:12080
- C:\Windows\System\rkKpGJZ.exe
  C:\Windows\System\rkKpGJZ.exe
  2⤵
  PID:12104
- C:\Windows\System\QHzDSXg.exe
  C:\Windows\System\QHzDSXg.exe
  2⤵
  PID:12132
- C:\Windows\System\zWppBzd.exe
  C:\Windows\System\zWppBzd.exe
  2⤵
  PID:12156
- C:\Windows\System\yyncJSP.exe
  C:\Windows\System\yyncJSP.exe
  2⤵
  PID:12180
- C:\Windows\System\iODqvvE.exe
  C:\Windows\System\iODqvvE.exe
  2⤵
  PID:12200
- C:\Windows\System\yCXuSrR.exe
  C:\Windows\System\yCXuSrR.exe
  2⤵
  PID:12224
- C:\Windows\System\atxikkA.exe
  C:\Windows\System\atxikkA.exe
  2⤵
  PID:12244
- C:\Windows\System\fsSFPkM.exe
  C:\Windows\System\fsSFPkM.exe
  2⤵
  PID:12268
- C:\Windows\System\vHbevME.exe
  C:\Windows\System\vHbevME.exe
  2⤵
  PID:10980
- C:\Windows\System\PPVcVss.exe
  C:\Windows\System\PPVcVss.exe
  2⤵
  PID:9896
- C:\Windows\System\GSVkwVx.exe
  C:\Windows\System\GSVkwVx.exe
  2⤵
  PID:10284
- C:\Windows\System\NemrsRB.exe
  C:\Windows\System\NemrsRB.exe
  2⤵
  PID:9980
- C:\Windows\System\wJDlgbu.exe
  C:\Windows\System\wJDlgbu.exe
  2⤵
  PID:9952
- C:\Windows\System\XjXUuLy.exe
  C:\Windows\System\XjXUuLy.exe
  2⤵
  PID:10384
- C:\Windows\System\qzNyoCb.exe
  C:\Windows\System\qzNyoCb.exe
  2⤵
  PID:9936
- C:\Windows\System\WlnlKfm.exe
  C:\Windows\System\WlnlKfm.exe
  2⤵
  PID:10508
- C:\Windows\System\xwRmRKL.exe
  C:\Windows\System\xwRmRKL.exe
  2⤵
  PID:9312
- C:\Windows\System\sdcjusB.exe
  C:\Windows\System\sdcjusB.exe
  2⤵
  PID:10224
- C:\Windows\System\UitDnnc.exe
  C:\Windows\System\UitDnnc.exe
  2⤵
  PID:10332
- C:\Windows\System\QVjKPgv.exe
  C:\Windows\System\QVjKPgv.exe
  2⤵
  PID:10512
- C:\Windows\System\XRJcRgX.exe
  C:\Windows\System\XRJcRgX.exe
  2⤵
  PID:10820
- C:\Windows\System\euwrjiw.exe
  C:\Windows\System\euwrjiw.exe
  2⤵
  PID:9044
- C:\Windows\System\LjuITXE.exe
  C:\Windows\System\LjuITXE.exe
  2⤵
  PID:10852
- C:\Windows\System\mUHmyDA.exe
  C:\Windows\System\mUHmyDA.exe
  2⤵
  PID:7132
- C:\Windows\System\cYAnBin.exe
  C:\Windows\System\cYAnBin.exe
  2⤵
  PID:2056
- C:\Windows\System\xgjVpNI.exe
  C:\Windows\System\xgjVpNI.exe
  2⤵
  PID:516
- C:\Windows\System\IMuXjME.exe
  C:\Windows\System\IMuXjME.exe
  2⤵
  PID:11272
- C:\Windows\System\smIfaxc.exe
  C:\Windows\System\smIfaxc.exe
  2⤵
  PID:11288
- C:\Windows\System\AjQWVRq.exe
  C:\Windows\System\AjQWVRq.exe
  2⤵
  PID:9760
- C:\Windows\System\JYjHYSO.exe
  C:\Windows\System\JYjHYSO.exe
  2⤵
  PID:11404
- C:\Windows\System\QtBReBn.exe
  C:\Windows\System\QtBReBn.exe
  2⤵
  PID:11020
- C:\Windows\System\hIniehU.exe
  C:\Windows\System\hIniehU.exe
  2⤵
  PID:11052
- C:\Windows\System\TAOajcx.exe
  C:\Windows\System\TAOajcx.exe
  2⤵
  PID:11660
- C:\Windows\System\KrEwiNf.exe
  C:\Windows\System\KrEwiNf.exe
  2⤵
  PID:12300
- C:\Windows\System\vpzTboe.exe
  C:\Windows\System\vpzTboe.exe
  2⤵
  PID:12324
- C:\Windows\System\bqrCfos.exe
  C:\Windows\System\bqrCfos.exe
  2⤵
  PID:12656
- C:\Windows\System\UoVGKKk.exe
  C:\Windows\System\UoVGKKk.exe
  2⤵
  PID:12676
- C:\Windows\System\uXuHWYv.exe
  C:\Windows\System\uXuHWYv.exe
  2⤵
  PID:12696
- C:\Windows\System\eAomnOb.exe
  C:\Windows\System\eAomnOb.exe
  2⤵
  PID:12992
- C:\Windows\System\WKfpMHG.exe
  C:\Windows\System\WKfpMHG.exe
  2⤵
  PID:13008
- C:\Windows\System\aWUuvlr.exe
  C:\Windows\System\aWUuvlr.exe
  2⤵
  PID:11256
- C:\Windows\System\DPzegsi.exe
  C:\Windows\System\DPzegsi.exe
  2⤵
  PID:10104
- C:\Windows\System\PQNXPnB.exe
  C:\Windows\System\PQNXPnB.exe
  2⤵
  PID:11916
- C:\Windows\System\fOYZekL.exe
  C:\Windows\System\fOYZekL.exe
  2⤵
  PID:11316
- C:\Windows\System\IqKQhDS.exe
  C:\Windows\System\IqKQhDS.exe
  2⤵
  PID:11468
- C:\Windows\System\wkxzEcF.exe
  C:\Windows\System\wkxzEcF.exe
  2⤵
  PID:11788
- C:\Windows\System\WwuDXRu.exe
  C:\Windows\System\WwuDXRu.exe
  2⤵
  PID:12444
- C:\Windows\System\uWFAEGO.exe
  C:\Windows\System\uWFAEGO.exe
  2⤵
  PID:9976
- C:\Windows\System\rpBKbgL.exe
  C:\Windows\System\rpBKbgL.exe
  2⤵
  PID:12504
- C:\Windows\System\WKKBCqY.exe
  C:\Windows\System\WKKBCqY.exe
  2⤵
  PID:10080
- C:\Windows\System\wVBWLtt.exe
  C:\Windows\System\wVBWLtt.exe
  2⤵
  PID:12528
- C:\Windows\System\wEaIDzj.exe
  C:\Windows\System\wEaIDzj.exe
  2⤵
  PID:9920
- C:\Windows\System\mJsvEVe.exe
  C:\Windows\System\mJsvEVe.exe
  2⤵
  PID:9712
- C:\Windows\System\kZhyWsi.exe
  C:\Windows\System\kZhyWsi.exe
  2⤵
  PID:10760
- C:\Windows\System\SPYUAJQ.exe
  C:\Windows\System\SPYUAJQ.exe
  2⤵
  PID:11240
- C:\Windows\System\gFErxbg.exe
  C:\Windows\System\gFErxbg.exe
  2⤵
  PID:12684
- C:\Windows\System\gVDTbjJ.exe
  C:\Windows\System\gVDTbjJ.exe
  2⤵
  PID:12756
- C:\Windows\System\OiVSAiQ.exe
  C:\Windows\System\OiVSAiQ.exe
  2⤵
  PID:13004
- C:\Windows\System\QwzXPyn.exe
  C:\Windows\System\QwzXPyn.exe
  2⤵
  PID:13204
- C:\Windows\System\ydgaAUS.exe
  C:\Windows\System\ydgaAUS.exe
  2⤵
  PID:12976
- C:\Windows\System\AwsZldm.exe
  C:\Windows\System\AwsZldm.exe
  2⤵
  PID:13308
- C:\Windows\System\qdpFegU.exe
  C:\Windows\System\qdpFegU.exe
  2⤵
  PID:13020
- C:\Windows\System\LgPaZSc.exe
  C:\Windows\System\LgPaZSc.exe
  2⤵
  PID:13072
- C:\Windows\System\oHyCYkK.exe
  C:\Windows\System\oHyCYkK.exe
  2⤵
  PID:10492
- C:\Windows\System\CySOcml.exe
  C:\Windows\System\CySOcml.exe
  2⤵
  PID:13176
- C:\Windows\System\HbGHEHC.exe
  C:\Windows\System\HbGHEHC.exe
  2⤵
  PID:9664
- C:\Windows\System\okOYyyI.exe
  C:\Windows\System\okOYyyI.exe
  2⤵
  PID:10488
- C:\Windows\System\cDSiJCv.exe
  C:\Windows\System\cDSiJCv.exe
  2⤵
  PID:13024
- C:\Windows\System\CVxnBVq.exe
  C:\Windows\System\CVxnBVq.exe
  2⤵
  PID:10968
- C:\Windows\System\euzxAtr.exe
  C:\Windows\System\euzxAtr.exe
  2⤵
  PID:11812
- C:\Windows\System\JFxgxRx.exe
  C:\Windows\System\JFxgxRx.exe
  2⤵
  PID:11360
- C:\Windows\System\rLVQnbK.exe
  C:\Windows\System\rLVQnbK.exe
  2⤵
  PID:11588
- C:\Windows\System\nSozQec.exe
  C:\Windows\System\nSozQec.exe
  2⤵
  PID:11628
- C:\Windows\System\WKneqNe.exe
  C:\Windows\System\WKneqNe.exe
  2⤵
  PID:11780
- C:\Windows\System\FkSjYKz.exe
  C:\Windows\System\FkSjYKz.exe
  2⤵
  PID:11112
- C:\Windows\System\WZBEgyY.exe
  C:\Windows\System\WZBEgyY.exe
  2⤵
  PID:10528
- C:\Windows\System\BdMASpf.exe
  C:\Windows\System\BdMASpf.exe
  2⤵
  PID:12276
- C:\Windows\System\WZXmswM.exe
  C:\Windows\System\WZXmswM.exe
  2⤵
  PID:9956
- C:\Windows\System\uPiULDz.exe
  C:\Windows\System\uPiULDz.exe
  2⤵
  PID:12292
- C:\Windows\System\vIbBYyE.exe
  C:\Windows\System\vIbBYyE.exe
  2⤵
  PID:12612
- C:\Windows\System\UjhfeXj.exe
  C:\Windows\System\UjhfeXj.exe
  2⤵
  PID:13104
- C:\Windows\System\veiiRfC.exe
  C:\Windows\System\veiiRfC.exe
  2⤵
  PID:10456
- C:\Windows\System\QXVBgCE.exe
  C:\Windows\System\QXVBgCE.exe
  2⤵
  PID:12616
- C:\Windows\System\cpywvGl.exe
  C:\Windows\System\cpywvGl.exe
  2⤵
  PID:11336
- C:\Windows\System\zGwImhX.exe
  C:\Windows\System\zGwImhX.exe
  2⤵
  PID:11864
- C:\Windows\System\fgYgJxa.exe
  C:\Windows\System\fgYgJxa.exe
  2⤵
  PID:11956
- C:\Windows\System\hkgnYFd.exe
  C:\Windows\System\hkgnYFd.exe
  2⤵
  PID:13228
- C:\Windows\System\OwUjvbQ.exe
  C:\Windows\System\OwUjvbQ.exe
  2⤵
  PID:10884
- C:\Windows\System\VjttiZu.exe
  C:\Windows\System\VjttiZu.exe
  2⤵
  PID:13044
- C:\Windows\System\zMzGaQQ.exe
  C:\Windows\System\zMzGaQQ.exe
  2⤵
  PID:11724
- C:\Windows\System\XeJDSbF.exe
  C:\Windows\System\XeJDSbF.exe
  2⤵
  PID:12904
- C:\Windows\System\rpSynTr.exe
  C:\Windows\System\rpSynTr.exe
  2⤵
  PID:10868
- C:\Windows\System\jkYRnkP.exe
  C:\Windows\System\jkYRnkP.exe
  2⤵
  PID:12668
- C:\Windows\System\LhiphWJ.exe
  C:\Windows\System\LhiphWJ.exe
  2⤵
  PID:12320
- C:\Windows\System\BtnpHJs.exe
  C:\Windows\System\BtnpHJs.exe
  2⤵
  PID:11692
- C:\Windows\System\QNOnhnX.exe
  C:\Windows\System\QNOnhnX.exe
  2⤵
  PID:10600
- C:\Windows\System\aZjucgw.exe
  C:\Windows\System\aZjucgw.exe
  2⤵
  PID:11560
- C:\Windows\System\asWHshZ.exe
  C:\Windows\System\asWHshZ.exe
  2⤵
  PID:11680
- C:\Windows\System\MBeNzgh.exe
  C:\Windows\System\MBeNzgh.exe
  2⤵
  PID:12020
- C:\Windows\System\aDDYvbp.exe
  C:\Windows\System\aDDYvbp.exe
  2⤵
  PID:10636
- C:\Windows\System\KXqBsKw.exe
  C:\Windows\System\KXqBsKw.exe
  2⤵
  PID:12052
- C:\Windows\System\KxCBMlP.exe
  C:\Windows\System\KxCBMlP.exe
  2⤵
  PID:11872
- C:\Windows\System\WGKnMsW.exe
  C:\Windows\System\WGKnMsW.exe
  2⤵
  PID:13216
- C:\Windows\System\ATNCSJe.exe
  C:\Windows\System\ATNCSJe.exe
  2⤵
  PID:13084
- C:\Windows\System\AHJQfyk.exe
  C:\Windows\System\AHJQfyk.exe
  2⤵
  PID:13096
- C:\Windows\System\zwUHJMd.exe
  C:\Windows\System\zwUHJMd.exe
  2⤵
  PID:13272
- C:\Windows\System\pYSQGqt.exe
  C:\Windows\System\pYSQGqt.exe
  2⤵
  PID:12088
- C:\Windows\System\TXwpSuw.exe
  C:\Windows\System\TXwpSuw.exe
  2⤵
  PID:10632
- C:\Windows\System\nSlVqIe.exe
  C:\Windows\System\nSlVqIe.exe
  2⤵
  PID:13192
- C:\Windows\System\HYnZtCp.exe
  C:\Windows\System\HYnZtCp.exe
  2⤵
  PID:13060
- C:\Windows\System\LfXCShO.exe
  C:\Windows\System\LfXCShO.exe
  2⤵
  PID:10572
- C:\Windows\System\wywdQWp.exe
  C:\Windows\System\wywdQWp.exe
  2⤵
  PID:8628
- C:\Windows\System\ccLDmXd.exe
  C:\Windows\System\ccLDmXd.exe
  2⤵
  PID:12540
- C:\Windows\System\FBzcBuY.exe
  C:\Windows\System\FBzcBuY.exe
  2⤵
  PID:13256
- C:\Windows\System\CmlxjWh.exe
  C:\Windows\System\CmlxjWh.exe
  2⤵
  PID:12816
- C:\Windows\System\jMDdzrA.exe
  C:\Windows\System\jMDdzrA.exe
  2⤵
  PID:12092
- C:\Windows\System\JfjgmFP.exe
  C:\Windows\System\JfjgmFP.exe
  2⤵
  PID:12784
- C:\Windows\System\PJbLxHL.exe
  C:\Windows\System\PJbLxHL.exe
  2⤵
  PID:12432
- C:\Windows\System\joUxTYo.exe
  C:\Windows\System\joUxTYo.exe
  2⤵
  PID:12840
- C:\Windows\System\gZPfpMO.exe
  C:\Windows\System\gZPfpMO.exe
  2⤵
  PID:10660
- C:\Windows\System\PZKUcEb.exe
  C:\Windows\System\PZKUcEb.exe
  2⤵
  PID:12824
- C:\Windows\System\yanTTRX.exe
  C:\Windows\System\yanTTRX.exe
  2⤵
  PID:11980
- C:\Windows\System\yuOOtwM.exe
  C:\Windows\System\yuOOtwM.exe
  2⤵
  PID:12672
- C:\Windows\System\McqvcPg.exe
  C:\Windows\System\McqvcPg.exe
  2⤵
  PID:11452
- C:\Windows\System\AwkCvIE.exe
  C:\Windows\System\AwkCvIE.exe
  2⤵
  PID:12752
- C:\Windows\System\vhlbEhV.exe
  C:\Windows\System\vhlbEhV.exe
  2⤵
  PID:12512
- C:\Windows\System\jCmfzpg.exe
  C:\Windows\System\jCmfzpg.exe
  2⤵
  PID:11128
- C:\Windows\System\erljWxD.exe
  C:\Windows\System\erljWxD.exe
  2⤵
  PID:11108
- C:\Windows\System\icWFLfM.exe
  C:\Windows\System\icWFLfM.exe
  2⤵
  PID:8412
- C:\Windows\System\aGnmJaa.exe
  C:\Windows\System\aGnmJaa.exe
  2⤵
  PID:2180
- C:\Windows\System\yhaerRJ.exe
  C:\Windows\System\yhaerRJ.exe
  2⤵
  PID:13316
- C:\Windows\System\oCAtEYV.exe
  C:\Windows\System\oCAtEYV.exe
  2⤵
  PID:13332
- C:\Windows\System\CApMvXG.exe
  C:\Windows\System\CApMvXG.exe
  2⤵
  PID:13360
- C:\Windows\System\PmElzeo.exe
  C:\Windows\System\PmElzeo.exe
  2⤵
  PID:13376
- C:\Windows\System\DjngRKQ.exe
  C:\Windows\System\DjngRKQ.exe
  2⤵
  PID:13520
- C:\Windows\System\BdqZrQY.exe
  C:\Windows\System\BdqZrQY.exe
  2⤵
  PID:13536
- C:\Windows\System\wgbRnUI.exe
  C:\Windows\System\wgbRnUI.exe
  2⤵
  PID:13556
- C:\Windows\System\NqkfAcS.exe
  C:\Windows\System\NqkfAcS.exe
  2⤵
  PID:13576
- C:\Windows\System\aBOYCNg.exe
  C:\Windows\System\aBOYCNg.exe
  2⤵
  PID:13664
- C:\Windows\System\oMefmbZ.exe
  C:\Windows\System\oMefmbZ.exe
  2⤵
  PID:13692
- C:\Windows\System\jyyjifX.exe
  C:\Windows\System\jyyjifX.exe
  2⤵
  PID:13764
- C:\Windows\System\EBUQEYZ.exe
  C:\Windows\System\EBUQEYZ.exe
  2⤵
  PID:13800
- C:\Windows\System\YiLrMaa.exe
  C:\Windows\System\YiLrMaa.exe
  2⤵
  PID:13824
- C:\Windows\System\kNSFzLS.exe
  C:\Windows\System\kNSFzLS.exe
  2⤵
  PID:13908
- C:\Windows\System\soVGuiA.exe
  C:\Windows\System\soVGuiA.exe
  2⤵
  PID:13932
- C:\Windows\System\QYYTIPl.exe
  C:\Windows\System\QYYTIPl.exe
  2⤵
  PID:14084
- C:\Windows\System\SHzsVyF.exe
  C:\Windows\System\SHzsVyF.exe
  2⤵
  PID:14108
- C:\Windows\System\WerqrOh.exe
  C:\Windows\System\WerqrOh.exe
  2⤵
  PID:14132
- C:\Windows\System\xmTPyDI.exe
  C:\Windows\System\xmTPyDI.exe
  2⤵
  PID:14248
- C:\Windows\System\OWMHRxb.exe
  C:\Windows\System\OWMHRxb.exe
  2⤵
  PID:12496
- C:\Windows\System\rFMULwu.exe
  C:\Windows\System\rFMULwu.exe
  2⤵
  PID:5068
- C:\Windows\System\zNjDSie.exe
  C:\Windows\System\zNjDSie.exe
  2⤵
  PID:13612
- C:\Windows\System\xZHEgrs.exe
  C:\Windows\System\xZHEgrs.exe
  2⤵
  PID:13516
- C:\Windows\System\mXDQLsC.exe
  C:\Windows\System\mXDQLsC.exe
  2⤵
  PID:13472
- C:\Windows\System\CWarhmG.exe
  C:\Windows\System\CWarhmG.exe
  2⤵
  PID:13680
- C:\Windows\System\iULtNJf.exe
  C:\Windows\System\iULtNJf.exe
  2⤵
  PID:13712
- C:\Windows\System\JSByrhj.exe
  C:\Windows\System\JSByrhj.exe
  2⤵
  PID:13704
- C:\Windows\System\ssVsFjN.exe
  C:\Windows\System\ssVsFjN.exe
  2⤵
  PID:3880
- C:\Windows\System\NZOPbpX.exe
  C:\Windows\System\NZOPbpX.exe
  2⤵
  PID:13816
- C:\Windows\System\QyyKbQg.exe
  C:\Windows\System\QyyKbQg.exe
  2⤵
  PID:13860
- C:\Windows\System\miEzMRR.exe
  C:\Windows\System\miEzMRR.exe
  2⤵
  PID:13916
- C:\Windows\System\ujLUVex.exe
  C:\Windows\System\ujLUVex.exe
  2⤵
  PID:13940
- C:\Windows\System\EQJntzX.exe
  C:\Windows\System\EQJntzX.exe
  2⤵
  PID:13852
- C:\Windows\System\gbyJPdu.exe
  C:\Windows\System\gbyJPdu.exe
  2⤵
  PID:13960
- C:\Windows\System\OcAGJYl.exe
  C:\Windows\System\OcAGJYl.exe
  2⤵
  PID:14028
- C:\Windows\System\VeklxwP.exe
  C:\Windows\System\VeklxwP.exe
  2⤵
  PID:14040
- C:\Windows\System\HduLKsp.exe
  C:\Windows\System\HduLKsp.exe
  2⤵
  PID:13868
- C:\Windows\System\TabFcUe.exe
  C:\Windows\System\TabFcUe.exe
  2⤵
  PID:14060
- C:\Windows\System\DzjJIAU.exe
  C:\Windows\System\DzjJIAU.exe
  2⤵
  PID:3188
- C:\Windows\System\ZgTzHEr.exe
  C:\Windows\System\ZgTzHEr.exe
  2⤵
  PID:14100
- C:\Windows\System\QYOkJvw.exe
  C:\Windows\System\QYOkJvw.exe
  2⤵
  PID:14140
- C:\Windows\System\zjMnImH.exe
  C:\Windows\System\zjMnImH.exe
  2⤵
  PID:14188
- C:\Windows\System\TOyZWza.exe
  C:\Windows\System\TOyZWza.exe
  2⤵
  PID:4860
- C:\Windows\System\vFEbvSM.exe
  C:\Windows\System\vFEbvSM.exe
  2⤵
  PID:14212
- C:\Windows\System\GsWztpI.exe
  C:\Windows\System\GsWztpI.exe
  2⤵
  PID:14236
- C:\Windows\System\ygkIFxx.exe
  C:\Windows\System\ygkIFxx.exe
  2⤵
  PID:14244
- C:\Windows\System\iHTxwaX.exe
  C:\Windows\System\iHTxwaX.exe
  2⤵
  PID:14264
- C:\Windows\System\piRrUDr.exe
  C:\Windows\System\piRrUDr.exe
  2⤵
  PID:14284
- C:\Windows\System\bHVWITA.exe
  C:\Windows\System\bHVWITA.exe
  2⤵
  PID:8356
- C:\Windows\System\iXHiPLZ.exe
  C:\Windows\System\iXHiPLZ.exe
  2⤵
  PID:14276
- C:\Windows\System\MIJiptx.exe
  C:\Windows\System\MIJiptx.exe
  2⤵
  PID:2068
- C:\Windows\System\HFWVxXE.exe
  C:\Windows\System\HFWVxXE.exe
  2⤵
  PID:14324
- C:\Windows\System\gKDfQpb.exe
  C:\Windows\System\gKDfQpb.exe
  2⤵
  PID:10408
- C:\Windows\System\GaQGLHw.exe
  C:\Windows\System\GaQGLHw.exe
  2⤵
  PID:2548
- C:\Windows\System\hLaRwvQ.exe
  C:\Windows\System\hLaRwvQ.exe
  2⤵
  PID:9580
- C:\Windows\System\NGWelya.exe
  C:\Windows\System\NGWelya.exe
  2⤵
  PID:3096
- C:\Windows\System\FzvdwkN.exe
  C:\Windows\System\FzvdwkN.exe
  2⤵
  PID:1172
- C:\Windows\System\EjBzNzM.exe
  C:\Windows\System\EjBzNzM.exe
  2⤵
  PID:13456
- C:\Windows\System\KUirnyX.exe
  C:\Windows\System\KUirnyX.exe
  2⤵
  PID:224
- C:\Windows\System\pBqhoSP.exe
  C:\Windows\System\pBqhoSP.exe
  2⤵
  PID:928
- C:\Windows\System\iWnynaW.exe
  C:\Windows\System\iWnynaW.exe
  2⤵
  PID:12924
- C:\Windows\System\nPVHqlH.exe
  C:\Windows\System\nPVHqlH.exe
  2⤵
  PID:13388
- C:\Windows\System\QOnhKWX.exe
  C:\Windows\System\QOnhKWX.exe
  2⤵
  PID:11960
- C:\Windows\System\LyEOuws.exe
  C:\Windows\System\LyEOuws.exe
  2⤵
  PID:6712
- C:\Windows\System\IiXyFHi.exe
  C:\Windows\System\IiXyFHi.exe
  2⤵
  PID:7516
- C:\Windows\System\ybSMFyj.exe
  C:\Windows\System\ybSMFyj.exe
  2⤵
  PID:13384
- C:\Windows\System\RrRylCV.exe
  C:\Windows\System\RrRylCV.exe
  2⤵
  PID:13600
- C:\Windows\System\MsGaGID.exe
  C:\Windows\System\MsGaGID.exe
  2⤵
  PID:13568
- C:\Windows\System\mBbVMQb.exe
  C:\Windows\System\mBbVMQb.exe
  2⤵
  PID:13648
- C:\Windows\System\WHHYSQR.exe
  C:\Windows\System\WHHYSQR.exe
  2⤵
  PID:13444
- C:\Windows\System\FDEiQgQ.exe
  C:\Windows\System\FDEiQgQ.exe
  2⤵
  PID:13432
- C:\Windows\System\xTnwSRg.exe
  C:\Windows\System\xTnwSRg.exe
  2⤵
  PID:1644
- C:\Windows\System\UUmcVms.exe
  C:\Windows\System\UUmcVms.exe
  2⤵
  PID:13632
- C:\Windows\System\JrGvEza.exe
  C:\Windows\System\JrGvEza.exe
  2⤵
  PID:4868
- C:\Windows\System\LlyVOxt.exe
  C:\Windows\System\LlyVOxt.exe
  2⤵
  PID:2072
- C:\Windows\System\NCldPqj.exe
  C:\Windows\System\NCldPqj.exe
  2⤵
  PID:1300
- C:\Windows\System\nUaUUCh.exe
  C:\Windows\System\nUaUUCh.exe
  2⤵
  PID:13736
- C:\Windows\System\lyMPspb.exe
  C:\Windows\System\lyMPspb.exe
  2⤵
  PID:2356
- C:\Windows\System\OVlNSKo.exe
  C:\Windows\System\OVlNSKo.exe
  2⤵
  PID:13720
- C:\Windows\System\PDibmCc.exe
  C:\Windows\System\PDibmCc.exe
  2⤵
  PID:2652
- C:\Windows\System\RVqZnbf.exe
  C:\Windows\System\RVqZnbf.exe
  2⤵
  PID:2940
- C:\Windows\System\faKDOkF.exe
  C:\Windows\System\faKDOkF.exe
  2⤵
  PID:7648
- C:\Windows\System\TBCWOej.exe
  C:\Windows\System\TBCWOej.exe
  2⤵
  PID:13876
- C:\Windows\System\OmuTNUv.exe
  C:\Windows\System\OmuTNUv.exe
  2⤵
  PID:13920
- C:\Windows\System\UllQVeD.exe
  C:\Windows\System\UllQVeD.exe
  2⤵
  PID:13988
- C:\Windows\System\uggxFOk.exe
  C:\Windows\System\uggxFOk.exe
  2⤵
  PID:12536
- C:\Windows\System\cRmOJxD.exe
  C:\Windows\System\cRmOJxD.exe
  2⤵
  PID:8396
- C:\Windows\System\ooQVmdD.exe
  C:\Windows\System\ooQVmdD.exe
  2⤵
  PID:6556
- C:\Windows\System\nEoctKX.exe
  C:\Windows\System\nEoctKX.exe
  2⤵
  PID:13956
- C:\Windows\System\PfuoeSr.exe
  C:\Windows\System\PfuoeSr.exe
  2⤵
  PID:3028
- C:\Windows\System\xxdsZPp.exe
  C:\Windows\System\xxdsZPp.exe
  2⤵
  PID:13984
- C:\Windows\System\mqKYJsw.exe
  C:\Windows\System\mqKYJsw.exe
  2⤵
  PID:8400
- C:\Windows\System\QltnXcb.exe
  C:\Windows\System\QltnXcb.exe
  2⤵
  PID:2276
- C:\Windows\System\AmCxqwU.exe
  C:\Windows\System\AmCxqwU.exe
  2⤵
  PID:4692
- C:\Windows\System\DtsiumZ.exe
  C:\Windows\System\DtsiumZ.exe
  2⤵
  PID:14036
- C:\Windows\System\IBTmbWg.exe
  C:\Windows\System\IBTmbWg.exe
  2⤵
  PID:5824
- C:\Windows\System\UnIulQP.exe
  C:\Windows\System\UnIulQP.exe
  2⤵
  PID:5308
- C:\Windows\System\DHmEIri.exe
  C:\Windows\System\DHmEIri.exe
  2⤵
  PID:5840
- C:\Windows\System\bWyazMg.exe
  C:\Windows\System\bWyazMg.exe
  2⤵
  PID:14092
- C:\Windows\System\ZmkSzxN.exe
  C:\Windows\System\ZmkSzxN.exe
  2⤵
  PID:14224
- C:\Windows\System\UzBKwqN.exe
  C:\Windows\System\UzBKwqN.exe
  2⤵
  PID:13776
- C:\Windows\System\iJOeTyp.exe
  C:\Windows\System\iJOeTyp.exe
  2⤵
  PID:13880
- C:\Windows\System\GtDYqNd.exe
  C:\Windows\System\GtDYqNd.exe
  2⤵
  PID:3784
- C:\Windows\System\EBQhnOd.exe
  C:\Windows\System\EBQhnOd.exe
  2⤵
  PID:14304
- C:\Windows\System\cIsxKmM.exe
  C:\Windows\System\cIsxKmM.exe
  2⤵
  PID:5576
- C:\Windows\System\snIEQoT.exe
  C:\Windows\System\snIEQoT.exe
  2⤵
  PID:14272
- C:\Windows\System\nJZYrzM.exe
  C:\Windows\System\nJZYrzM.exe
  2⤵
  PID:5704
- C:\Windows\System\twuyLQl.exe
  C:\Windows\System\twuyLQl.exe
  2⤵
  PID:14328
- C:\Windows\System\xRmrDFl.exe
  C:\Windows\System\xRmrDFl.exe
  2⤵
  PID:12560
- C:\Windows\System\HVREted.exe
  C:\Windows\System\HVREted.exe
  2⤵
  PID:4844
- C:\Windows\System\wavxYzn.exe
  C:\Windows\System\wavxYzn.exe
  2⤵
  PID:4128
- C:\Windows\System\llMNHxR.exe
  C:\Windows\System\llMNHxR.exe
  2⤵
  PID:3428
- C:\Windows\System\mQbwbMt.exe
  C:\Windows\System\mQbwbMt.exe
  2⤵
  PID:1340
- C:\Windows\System\AroCEwP.exe
  C:\Windows\System\AroCEwP.exe
  2⤵
  PID:13328
- C:\Windows\System\crpxqyS.exe
  C:\Windows\System\crpxqyS.exe
  2⤵
  PID:14288
- C:\Windows\System\saXIzxp.exe
  C:\Windows\System\saXIzxp.exe
  2⤵
  PID:5832
- C:\Windows\System\QZaPqYa.exe
  C:\Windows\System\QZaPqYa.exe
  2⤵
  PID:6860
- C:\Windows\System\oFoVAFk.exe
  C:\Windows\System\oFoVAFk.exe
  2⤵
  PID:12172
- C:\Windows\System\ZRLCOhq.exe
  C:\Windows\System\ZRLCOhq.exe
  2⤵
  PID:13344
- C:\Windows\System\kfZuzVh.exe
  C:\Windows\System\kfZuzVh.exe
  2⤵
  PID:6716
- C:\Windows\System\cwSPGLk.exe
  C:\Windows\System\cwSPGLk.exe
  2⤵
  PID:4912
- C:\Windows\System\ByUsMBJ.exe
  C:\Windows\System\ByUsMBJ.exe
  2⤵
  PID:13404
- C:\Windows\System\LZTIoDe.exe
  C:\Windows\System\LZTIoDe.exe
  2⤵
  PID:1520
- C:\Windows\System\HvZvNyR.exe
  C:\Windows\System\HvZvNyR.exe
  2⤵
  PID:13392
- C:\Windows\System\eLKsJWB.exe
  C:\Windows\System\eLKsJWB.exe
  2⤵
  PID:4460
- C:\Windows\System\eEEjHSm.exe
  C:\Windows\System\eEEjHSm.exe
  2⤵
  PID:4140
- C:\Windows\System\lGfDblG.exe
  C:\Windows\System\lGfDblG.exe
  2⤵
  PID:6092
- C:\Windows\System\TzKKNMr.exe
  C:\Windows\System\TzKKNMr.exe
  2⤵
  PID:6076
- C:\Windows\System\ZaQQRvK.exe
  C:\Windows\System\ZaQQRvK.exe
  2⤵
  PID:13492
- C:\Windows\System\fdMHHqd.exe
  C:\Windows\System\fdMHHqd.exe
  2⤵
  PID:13640
- C:\Windows\System\TJIUOGQ.exe
  C:\Windows\System\TJIUOGQ.exe
  2⤵
  PID:5556
- C:\Windows\System\CwWuvSZ.exe
  C:\Windows\System\CwWuvSZ.exe
  2⤵
  PID:13532
- C:\Windows\System\WTtKNzu.exe
  C:\Windows\System\WTtKNzu.exe
  2⤵
  PID:12748
- C:\Windows\System\KtwnTqP.exe
  C:\Windows\System\KtwnTqP.exe
  2⤵
  PID:13792
- C:\Windows\System\YKOPzhf.exe
  C:\Windows\System\YKOPzhf.exe
  2⤵
  PID:13592
- C:\Windows\System\iHaUVvW.exe
  C:\Windows\System\iHaUVvW.exe
  2⤵
  PID:2956
- C:\Windows\System\ACUxufh.exe
  C:\Windows\System\ACUxufh.exe
  2⤵
  PID:6588
- C:\Windows\System\UHRnrfO.exe
  C:\Windows\System\UHRnrfO.exe
  2⤵
  PID:1844
- C:\Windows\System\yORUjag.exe
  C:\Windows\System\yORUjag.exe
  2⤵
  PID:13676
- C:\Windows\System\kwsZAfD.exe
  C:\Windows\System\kwsZAfD.exe
  2⤵
  PID:936
- C:\Windows\System\eEWBsVY.exe
  C:\Windows\System\eEWBsVY.exe
  2⤵
  PID:6624
- C:\Windows\System\xExykxr.exe
  C:\Windows\System\xExykxr.exe
  2⤵
  PID:5484
- C:\Windows\System\jEsbmRI.exe
  C:\Windows\System\jEsbmRI.exe
  2⤵
  PID:1920
- C:\Windows\System\mzEUPmu.exe
  C:\Windows\System\mzEUPmu.exe
  2⤵
  PID:4584
- C:\Windows\System\eOBcgBP.exe
  C:\Windows\System\eOBcgBP.exe
  2⤵
  PID:5692
- C:\Windows\System\CEYAIYR.exe
  C:\Windows\System\CEYAIYR.exe
  2⤵
  PID:5700
- C:\Windows\System\FnMHtky.exe
  C:\Windows\System\FnMHtky.exe
  2⤵
  PID:428
- C:\Windows\System\CnqpzMY.exe
  C:\Windows\System\CnqpzMY.exe
  2⤵
  PID:8384
- C:\Windows\System\GgXcrDu.exe
  C:\Windows\System\GgXcrDu.exe
  2⤵
  PID:14096
- C:\Windows\System\GnamoRL.exe
  C:\Windows\System\GnamoRL.exe
  2⤵
  PID:6248
- C:\Windows\System\BtgUguo.exe
  C:\Windows\System\BtgUguo.exe
  2⤵
  PID:14152
- C:\Windows\System\AVJvDMR.exe
  C:\Windows\System\AVJvDMR.exe
  2⤵
  PID:13672
- C:\Windows\System\iWPKQvg.exe
  C:\Windows\System\iWPKQvg.exe
  2⤵
  PID:5976
- C:\Windows\System\DnMsUCQ.exe
  C:\Windows\System\DnMsUCQ.exe
  2⤵
  PID:6676
- C:\Windows\System\ujqtCje.exe
  C:\Windows\System\ujqtCje.exe
  2⤵
  PID:6680
- C:\Windows\System\wCjeEML.exe
  C:\Windows\System\wCjeEML.exe
  2⤵
  PID:6696
- C:\Windows\System\NBpGioI.exe
  C:\Windows\System\NBpGioI.exe
  2⤵
  PID:6688
- C:\Windows\System\qAZewQY.exe
  C:\Windows\System\qAZewQY.exe
  2⤵
  PID:6000
- C:\Windows\System\mxzruPQ.exe
  C:\Windows\System\mxzruPQ.exe
  2⤵
  PID:6700
- C:\Windows\System\knhKntI.exe
  C:\Windows\System\knhKntI.exe
  2⤵
  PID:2024
- C:\Windows\System\fWYdLBW.exe
  C:\Windows\System\fWYdLBW.exe
  2⤵
  PID:12596
- C:\Windows\System\FPmQvma.exe
  C:\Windows\System\FPmQvma.exe
  2⤵
  PID:4356
- C:\Windows\System\WvsPSVL.exe
  C:\Windows\System\WvsPSVL.exe
  2⤵
  PID:12140
- C:\Windows\System\VaTEggv.exe
  C:\Windows\System\VaTEggv.exe
  2⤵
  PID:13476
- C:\Windows\System\POemouo.exe
  C:\Windows\System\POemouo.exe
  2⤵
  PID:5864
- C:\Windows\System\nnUvbgf.exe
  C:\Windows\System\nnUvbgf.exe
  2⤵
  PID:5880
- C:\Windows\System\COzuDxV.exe
  C:\Windows\System\COzuDxV.exe
  2⤵
  PID:3452
- C:\Windows\System\ypBHEwm.exe
  C:\Windows\System\ypBHEwm.exe
  2⤵
  PID:4248
- C:\Windows\System\UkOaNyb.exe
  C:\Windows\System\UkOaNyb.exe
  2⤵
  PID:228
- C:\Windows\System\qwOTHBo.exe
  C:\Windows\System\qwOTHBo.exe
  2⤵
  PID:4244
- C:\Windows\System\BzXmJPo.exe
  C:\Windows\System\BzXmJPo.exe
  2⤵
  PID:6876
- C:\Windows\System\oMvWyoP.exe
  C:\Windows\System\oMvWyoP.exe
  2⤵
  PID:6932
- C:\Windows\System\lUnShTC.exe
  C:\Windows\System\lUnShTC.exe
  2⤵
  PID:6468
- C:\Windows\System\KsvPOUT.exe
  C:\Windows\System\KsvPOUT.exe
  2⤵
  PID:4448
- C:\Windows\System\UGkTsHQ.exe
  C:\Windows\System\UGkTsHQ.exe
  2⤵
  PID:7240
- C:\Windows\System\fGXpsAk.exe
  C:\Windows\System\fGXpsAk.exe
  2⤵
  PID:14008
- C:\Windows\System\BPhqTCU.exe
  C:\Windows\System\BPhqTCU.exe
  2⤵
  PID:7328
- C:\Windows\System\HfHPjDR.exe
  C:\Windows\System\HfHPjDR.exe
  2⤵
  PID:7260
- C:\Windows\System\LsxHPUR.exe
  C:\Windows\System\LsxHPUR.exe
  2⤵
  PID:5024
- C:\Windows\System\TzOxddT.exe
  C:\Windows\System\TzOxddT.exe
  2⤵
  PID:6620
- C:\Windows\System\hkEicKg.exe
  C:\Windows\System\hkEicKg.exe
  2⤵
  PID:6604
- C:\Windows\System\xfBEeVy.exe
  C:\Windows\System\xfBEeVy.exe
  2⤵
  PID:5456
- C:\Windows\System\nPVgeZh.exe
  C:\Windows\System\nPVgeZh.exe
  2⤵
  PID:5532
- C:\Windows\System\qTkqSBS.exe
  C:\Windows\System\qTkqSBS.exe
  2⤵
  PID:7480
- C:\Windows\System\CfhFmna.exe
  C:\Windows\System\CfhFmna.exe
  2⤵
  PID:2200
- C:\Windows\System\HmdgRhv.exe
  C:\Windows\System\HmdgRhv.exe
  2⤵
  PID:7496
- C:\Windows\System\qEdZFKc.exe
  C:\Windows\System\qEdZFKc.exe
  2⤵
  PID:6188
- C:\Windows\System\NEvqKOS.exe
  C:\Windows\System\NEvqKOS.exe
  2⤵
  PID:6224
- C:\Windows\System\QOvwqVp.exe
  C:\Windows\System\QOvwqVp.exe
  2⤵
  PID:5888
- C:\Windows\System\cOHghYw.exe
  C:\Windows\System\cOHghYw.exe
  2⤵
  PID:14124
- C:\Windows\System\zbtroPC.exe
  C:\Windows\System\zbtroPC.exe
  2⤵
  PID:3140
- C:\Windows\System\rmEyRRE.exe
  C:\Windows\System\rmEyRRE.exe
  2⤵
  PID:14104
- C:\Windows\System\FYmBpMg.exe
  C:\Windows\System\FYmBpMg.exe
  2⤵
  PID:5856
- C:\Windows\System\ZLoYcTz.exe
  C:\Windows\System\ZLoYcTz.exe
  2⤵
  PID:5760
- C:\Windows\System\gVZKEnh.exe
  C:\Windows\System\gVZKEnh.exe
  2⤵
  PID:6276
- C:\Windows\System\RoXvImT.exe
  C:\Windows\System\RoXvImT.exe
  2⤵
  PID:14200
- C:\Windows\System\nqJBZkS.exe
  C:\Windows\System\nqJBZkS.exe
  2⤵
  PID:6668
- C:\Windows\System\xiYOGIL.exe
  C:\Windows\System\xiYOGIL.exe
  2⤵
  PID:4788
- C:\Windows\System\RGCldkh.exe
  C:\Windows\System\RGCldkh.exe
  2⤵
  PID:6684
- C:\Windows\System\ReJYNZx.exe
  C:\Windows\System\ReJYNZx.exe
  2⤵
  PID:2836
- C:\Windows\System\rDKxdxs.exe
  C:\Windows\System\rDKxdxs.exe
  2⤵
  PID:14204
- C:\Windows\System\kcqNKBH.exe
  C:\Windows\System\kcqNKBH.exe
  2⤵
  PID:5116
- C:\Windows\System\pBsSiJJ.exe
  C:\Windows\System\pBsSiJJ.exe
  2⤵
  PID:1468
- C:\Windows\System\YamuRzq.exe
  C:\Windows\System\YamuRzq.exe
  2⤵
  PID:7592
- C:\Windows\System\XxZpzjz.exe
  C:\Windows\System\XxZpzjz.exe
  2⤵
  PID:1012
- C:\Windows\System\YocWWda.exe
  C:\Windows\System\YocWWda.exe
  2⤵
  PID:5740
- C:\Windows\System\SAcwxil.exe
  C:\Windows\System\SAcwxil.exe
  2⤵
  PID:2704
- C:\Windows\System\gKbhsPj.exe
  C:\Windows\System\gKbhsPj.exe
  2⤵
  PID:7188
- C:\Windows\System\WNFwHjZ.exe
  C:\Windows\System\WNFwHjZ.exe
  2⤵
  PID:5168
- C:\Windows\System\NywSRCO.exe
  C:\Windows\System\NywSRCO.exe
  2⤵
  PID:12152
- C:\Windows\System\dwKrxmo.exe
  C:\Windows\System\dwKrxmo.exe
  2⤵
  PID:1648
- C:\Windows\System\fRMMIqN.exe
  C:\Windows\System\fRMMIqN.exe
  2⤵
  PID:6948
- C:\Windows\System\VAYZgCB.exe
  C:\Windows\System\VAYZgCB.exe
  2⤵
  PID:7256
- C:\Windows\System\kUxLFoE.exe
  C:\Windows\System\kUxLFoE.exe
  2⤵
  PID:1412
- C:\Windows\System\nVLLKKZ.exe
  C:\Windows\System\nVLLKKZ.exe
  2⤵
  PID:5968
- C:\Windows\System\MYmVJDN.exe
  C:\Windows\System\MYmVJDN.exe
  2⤵
  PID:5932
- C:\Windows\System\wPijkdP.exe
  C:\Windows\System\wPijkdP.exe
  2⤵
  PID:13796
- C:\Windows\System\PzrSJkZ.exe
  C:\Windows\System\PzrSJkZ.exe
  2⤵
  PID:5148
- C:\Windows\System\JkcCwPU.exe
  C:\Windows\System\JkcCwPU.exe
  2⤵
  PID:4100
- C:\Windows\System\neWXnfT.exe
  C:\Windows\System\neWXnfT.exe
  2⤵
  PID:7280
- C:\Windows\System\XKnOxmy.exe
  C:\Windows\System\XKnOxmy.exe
  2⤵
  PID:7292
- C:\Windows\System\UkBejMy.exe
  C:\Windows\System\UkBejMy.exe
  2⤵
  PID:7040
- C:\Windows\System\TCgeOyU.exe
  C:\Windows\System\TCgeOyU.exe
  2⤵
  PID:4928
- C:\Windows\System\PPzagcb.exe
  C:\Windows\System\PPzagcb.exe
  2⤵
  PID:2280
- C:\Windows\System\NovkGCn.exe
  C:\Windows\System\NovkGCn.exe
  2⤵
  PID:7088
- C:\Windows\System\EEPOybe.exe
  C:\Windows\System\EEPOybe.exe
  2⤵
  PID:5400
- C:\Windows\System\Ijyzzmz.exe
  C:\Windows\System\Ijyzzmz.exe
  2⤵
  PID:1692
- C:\Windows\System\ifLkAyJ.exe
  C:\Windows\System\ifLkAyJ.exe
  2⤵
  PID:7052
- C:\Windows\System\jZxLgFU.exe
  C:\Windows\System\jZxLgFU.exe
  2⤵
  PID:2088
- C:\Windows\System\PbbYYHG.exe
  C:\Windows\System\PbbYYHG.exe
  2⤵
  PID:6600
- C:\Windows\System\ghwYfnC.exe
  C:\Windows\System\ghwYfnC.exe
  2⤵
  PID:5560
- C:\Windows\System\TveVybF.exe
  C:\Windows\System\TveVybF.exe
  2⤵
  PID:6652
- C:\Windows\System\bOUqQGH.exe
  C:\Windows\System\bOUqQGH.exe
  2⤵
  PID:7448
- C:\Windows\System\pZyoElg.exe
  C:\Windows\System\pZyoElg.exe
  2⤵
  PID:7724
- C:\Windows\System\HEuoBgO.exe
  C:\Windows\System\HEuoBgO.exe
  2⤵
  PID:7080
- C:\Windows\System\pIJUMQp.exe
  C:\Windows\System\pIJUMQp.exe
  2⤵
  PID:7564
- C:\Windows\System\bvXyhck.exe
  C:\Windows\System\bvXyhck.exe
  2⤵
  PID:7216
- C:\Windows\System\dOyOYbq.exe
  C:\Windows\System\dOyOYbq.exe
  2⤵
  PID:7536
- C:\Windows\System\NegiiCE.exe
  C:\Windows\System\NegiiCE.exe
  2⤵
  PID:7460
- C:\Windows\System\BCuGaXO.exe
  C:\Windows\System\BCuGaXO.exe
  2⤵
  PID:7616
- C:\Windows\System\WdbXcAC.exe
  C:\Windows\System\WdbXcAC.exe
  2⤵
  PID:7824
- C:\Windows\System\DMruWtX.exe
  C:\Windows\System\DMruWtX.exe
  2⤵
  PID:13752
- C:\Windows\System\dkGBymN.exe
  C:\Windows\System\dkGBymN.exe
  2⤵
  PID:7148
- C:\Windows\System\rxnDulE.exe
  C:\Windows\System\rxnDulE.exe
  2⤵
  PID:7940
- C:\Windows\System\bZXeErf.exe
  C:\Windows\System\bZXeErf.exe
  2⤵
  PID:6664
- C:\Windows\System\eYKfVol.exe
  C:\Windows\System\eYKfVol.exe
  2⤵
  PID:4600
- C:\Windows\System\exCNKBQ.exe
  C:\Windows\System\exCNKBQ.exe
  2⤵
  PID:7528
- C:\Windows\System\XSkOjxK.exe
  C:\Windows\System\XSkOjxK.exe
  2⤵
  PID:7556
- C:\Windows\System\QpMOXfi.exe
  C:\Windows\System\QpMOXfi.exe
  2⤵
  PID:7584
- C:\Windows\System\muYpONo.exe
  C:\Windows\System\muYpONo.exe
  2⤵
  PID:5988
- C:\Windows\System\xXnucBk.exe
  C:\Windows\System\xXnucBk.exe
  2⤵
  PID:7568
- C:\Windows\System\BbMIegU.exe
  C:\Windows\System\BbMIegU.exe
  2⤵
  PID:5644
- C:\Windows\System\atqBDHQ.exe
  C:\Windows\System\atqBDHQ.exe
  2⤵
  PID:7796
- C:\Windows\System\yICUhPz.exe
  C:\Windows\System\yICUhPz.exe
  2⤵
  PID:5620
- C:\Windows\System\GEltbfm.exe
  C:\Windows\System\GEltbfm.exe
  2⤵
  PID:6004
- C:\Windows\System\pYqZDCr.exe
  C:\Windows\System\pYqZDCr.exe
  2⤵
  PID:6168
- C:\Windows\System\FFgePyv.exe
  C:\Windows\System\FFgePyv.exe
  2⤵
  PID:4752
- C:\Windows\System\pKeyJUR.exe
  C:\Windows\System\pKeyJUR.exe
  2⤵
  PID:14320
- C:\Windows\System\EcFQfpM.exe
  C:\Windows\System\EcFQfpM.exe
  2⤵
  PID:6204
- C:\Windows\System\BWHGnBy.exe
  C:\Windows\System\BWHGnBy.exe
  2⤵
  PID:6208
- C:\Windows\System\OCvlthC.exe
  C:\Windows\System\OCvlthC.exe
  2⤵
  PID:8260
- C:\Windows\System\fiZpFnu.exe
  C:\Windows\System\fiZpFnu.exe
  2⤵
  PID:3608
- C:\Windows\System\rvkwvOU.exe
  C:\Windows\System\rvkwvOU.exe
  2⤵
  PID:13400
- C:\Windows\System\EDVrFBH.exe
  C:\Windows\System\EDVrFBH.exe
  2⤵
  PID:7164
- C:\Windows\System\SGgBlUm.exe
  C:\Windows\System\SGgBlUm.exe
  2⤵
  PID:7244
- C:\Windows\System\mpOUjaP.exe
  C:\Windows\System\mpOUjaP.exe
  2⤵
  PID:8364
- C:\Windows\System\ifzLuEU.exe
  C:\Windows\System\ifzLuEU.exe
  2⤵
  PID:8380
- C:\Windows\System\AglYsGu.exe
  C:\Windows\System\AglYsGu.exe
  2⤵
  PID:7016
- C:\Windows\System\lmJZVLz.exe
  C:\Windows\System\lmJZVLz.exe
  2⤵
  PID:6356
- C:\Windows\System\eIqQlyz.exe
  C:\Windows\System\eIqQlyz.exe
  2⤵
  PID:5316
- C:\Windows\System\ZljKrqC.exe
  C:\Windows\System\ZljKrqC.exe
  2⤵
  PID:4496
- C:\Windows\System\CXqBfRK.exe
  C:\Windows\System\CXqBfRK.exe
  2⤵
  PID:5876
- C:\Windows\System\NKZDLum.exe
  C:\Windows\System\NKZDLum.exe
  2⤵
  PID:3932
- C:\Windows\System\iBGqVXC.exe
  C:\Windows\System\iBGqVXC.exe
  2⤵
  PID:13488
- C:\Windows\System\xfwrGlE.exe
  C:\Windows\System\xfwrGlE.exe
  2⤵
  PID:4080
- C:\Windows\System\GnMZRaX.exe
  C:\Windows\System\GnMZRaX.exe
  2⤵
  PID:12692
- C:\Windows\System\SdSUQwf.exe
  C:\Windows\System\SdSUQwf.exe
  2⤵
  PID:772
- C:\Windows\System\uYgcnhf.exe
  C:\Windows\System\uYgcnhf.exe
  2⤵
  PID:3920
- C:\Windows\System\OKFkTBe.exe
  C:\Windows\System\OKFkTBe.exe
  2⤵
  PID:7264
- C:\Windows\System\eqsOAsk.exe
  C:\Windows\System\eqsOAsk.exe
  2⤵
  PID:7056
- C:\Windows\System\BKNsmAI.exe
  C:\Windows\System\BKNsmAI.exe
  2⤵
  PID:5696
- C:\Windows\System\hXZGtUj.exe
  C:\Windows\System\hXZGtUj.exe
  2⤵
  PID:1196
- C:\Windows\System\bgKSvtB.exe
  C:\Windows\System\bgKSvtB.exe
  2⤵
  PID:5604
- C:\Windows\System\bDPlkcX.exe
  C:\Windows\System\bDPlkcX.exe
  2⤵
  PID:7308
- C:\Windows\System\abzILDn.exe
  C:\Windows\System\abzILDn.exe
  2⤵
  PID:4500
- C:\Windows\System\hjUSbxu.exe
  C:\Windows\System\hjUSbxu.exe
  2⤵
  PID:7948
- C:\Windows\System\osEXBPY.exe
  C:\Windows\System\osEXBPY.exe
  2⤵
  PID:7968
- C:\Windows\System\FDVlCbL.exe
  C:\Windows\System\FDVlCbL.exe
  2⤵
  PID:13784
- C:\Windows\System\xkPbPsS.exe
  C:\Windows\System\xkPbPsS.exe
  2⤵
  PID:7984
- C:\Windows\System\ktyZgzP.exe
  C:\Windows\System\ktyZgzP.exe
  2⤵
  PID:6180
- C:\Windows\System\mRETMQd.exe
  C:\Windows\System\mRETMQd.exe
  2⤵
  PID:7416
- C:\Windows\System\txmdbSs.exe
  C:\Windows\System\txmdbSs.exe
  2⤵
  PID:7552
- C:\Windows\System\gFGijXb.exe
  C:\Windows\System\gFGijXb.exe
  2⤵
  PID:4416
- C:\Windows\System\vaWliWX.exe
  C:\Windows\System\vaWliWX.exe
  2⤵
  PID:7400
- C:\Windows\System\isXRupb.exe
  C:\Windows\System\isXRupb.exe
  2⤵
  PID:7336
- C:\Windows\System\snQDuPB.exe
  C:\Windows\System\snQDuPB.exe
  2⤵
  PID:7644
- C:\Windows\System\gLOaRih.exe
  C:\Windows\System\gLOaRih.exe
  2⤵
  PID:7904
- C:\Windows\System\sqhWGnE.exe
  C:\Windows\System\sqhWGnE.exe
  2⤵
  PID:7828
- C:\Windows\System\tHVFddb.exe
  C:\Windows\System\tHVFddb.exe
  2⤵
  PID:7716
- C:\Windows\System\qBmvJxa.exe
  C:\Windows\System\qBmvJxa.exe
  2⤵
  PID:7620
- C:\Windows\System\proDdUZ.exe
  C:\Windows\System\proDdUZ.exe
  2⤵
  PID:6524
- C:\Windows\System\PqcZAKg.exe
  C:\Windows\System\PqcZAKg.exe
  2⤵
  PID:6592
- C:\Windows\System\KDKnAjx.exe
  C:\Windows\System\KDKnAjx.exe
  2⤵
  PID:6564
- C:\Windows\System\elJqmXe.exe
  C:\Windows\System\elJqmXe.exe
  2⤵
  PID:8140
- C:\Windows\System\rCQTnPh.exe
  C:\Windows\System\rCQTnPh.exe
  2⤵
  PID:7212
- C:\Windows\System\VeKuLxx.exe
  C:\Windows\System\VeKuLxx.exe
  2⤵
  PID:6744
- C:\Windows\System\KfSnBeQ.exe
  C:\Windows\System\KfSnBeQ.exe
  2⤵
  PID:7624
- C:\Windows\System\ogSnxXm.exe
  C:\Windows\System\ogSnxXm.exe
  2⤵
  PID:6880
- C:\Windows\System\meZLweW.exe
  C:\Windows\System\meZLweW.exe
  2⤵
  PID:7756
- C:\Windows\System\lgzxqJn.exe
  C:\Windows\System\lgzxqJn.exe
  2⤵
  PID:6036
- C:\Windows\System\BUVuByL.exe
  C:\Windows\System\BUVuByL.exe
  2⤵
  PID:7144
- C:\Windows\System\ngPlMdX.exe
  C:\Windows\System\ngPlMdX.exe
  2⤵
  PID:7524
- C:\Windows\System\ZxHjdgk.exe
  C:\Windows\System\ZxHjdgk.exe
  2⤵
  PID:7500
- C:\Windows\System\TDtDKDC.exe
  C:\Windows\System\TDtDKDC.exe
  2⤵
  PID:3024
- C:\Windows\System\LTlajMK.exe
  C:\Windows\System\LTlajMK.exe
  2⤵
  PID:8224
- C:\Windows\System\iaGGNMC.exe
  C:\Windows\System\iaGGNMC.exe
  2⤵
  PID:13652
- C:\Windows\System\ORzYqXc.exe
  C:\Windows\System\ORzYqXc.exe
  2⤵
  PID:6660
- C:\Windows\System\GwBrOCo.exe
  C:\Windows\System\GwBrOCo.exe
  2⤵
  PID:7572
- C:\Windows\System\WqYkRmB.exe
  C:\Windows\System\WqYkRmB.exe
  2⤵
  PID:14256
- C:\Windows\System\bIkkRcJ.exe
  C:\Windows\System\bIkkRcJ.exe
  2⤵
  PID:6672
- C:\Windows\System\TBmHmsF.exe
  C:\Windows\System\TBmHmsF.exe
  2⤵
  PID:4732
- C:\Windows\System\Ourmobz.exe
  C:\Windows\System\Ourmobz.exe
  2⤵
  PID:7204
- C:\Windows\System\nRZKXcS.exe
  C:\Windows\System\nRZKXcS.exe
  2⤵
  PID:5768
- C:\Windows\System\yYtCmnI.exe
  C:\Windows\System\yYtCmnI.exe
  2⤵
  PID:8332
- C:\Windows\System\duPvTXd.exe
  C:\Windows\System\duPvTXd.exe
  2⤵
  PID:5892
- C:\Windows\System\YIeXmLq.exe
  C:\Windows\System\YIeXmLq.exe
  2⤵
  PID:8348
- C:\Windows\System\KIJewDv.exe
  C:\Windows\System\KIJewDv.exe
  2⤵
  PID:7588
- C:\Windows\System\ubQDLZf.exe
  C:\Windows\System\ubQDLZf.exe
  2⤵
  PID:8288
- C:\Windows\System\vAaZzvB.exe
  C:\Windows\System\vAaZzvB.exe
  2⤵
  PID:1572
- C:\Windows\System\oTfhESk.exe
  C:\Windows\System\oTfhESk.exe
  2⤵
  PID:5820
- C:\Windows\System\HnGAPse.exe
  C:\Windows\System\HnGAPse.exe
  2⤵
  PID:6872
- C:\Windows\System\bortfPq.exe
  C:\Windows\System\bortfPq.exe
  2⤵
  PID:12652
- C:\Windows\System\XMUgGuS.exe
  C:\Windows\System\XMUgGuS.exe
  2⤵
  PID:7288
- C:\Windows\System\XtAXNTm.exe
  C:\Windows\System\XtAXNTm.exe
  2⤵
  PID:7220
- C:\Windows\System\lywOIRD.exe
  C:\Windows\System\lywOIRD.exe
  2⤵
  PID:5748
- C:\Windows\System\aQSlXrb.exe
  C:\Windows\System\aQSlXrb.exe
  2⤵
  PID:7372
- C:\Windows\System\nmRNgFQ.exe
  C:\Windows\System\nmRNgFQ.exe
  2⤵
  PID:3840
- C:\Windows\System\cNObMDS.exe
  C:\Windows\System\cNObMDS.exe
  2⤵
  PID:6324
- C:\Windows\System\clDysEa.exe
  C:\Windows\System\clDysEa.exe
  2⤵
  PID:7672
- C:\Windows\System\ZLKUcGE.exe
  C:\Windows\System\ZLKUcGE.exe
  2⤵
  PID:8148
- C:\Windows\System\wyTksxa.exe
  C:\Windows\System\wyTksxa.exe
  2⤵
  PID:7424
- C:\Windows\System\XnfUitY.exe
  C:\Windows\System\XnfUitY.exe
  2⤵
  PID:6984
- C:\Windows\System\vQpbcmn.exe
  C:\Windows\System\vQpbcmn.exe
  2⤵
  PID:7084
- C:\Windows\System\MbRLExA.exe
  C:\Windows\System\MbRLExA.exe
  2⤵
  PID:7064
- C:\Windows\System\anddkXP.exe
  C:\Windows\System\anddkXP.exe
  2⤵
  PID:7092
- C:\Windows\System\gwxQZEs.exe
  C:\Windows\System\gwxQZEs.exe
  2⤵
  PID:5180
- C:\Windows\System\ZaceQjQ.exe
  C:\Windows\System\ZaceQjQ.exe
  2⤵
  PID:5164
- C:\Windows\System\NEnghwy.exe
  C:\Windows\System\NEnghwy.exe
  2⤵
  PID:6292
- C:\Windows\System\WamgMbl.exe
  C:\Windows\System\WamgMbl.exe
  2⤵
  PID:5596
- C:\Windows\System\xIXRhHZ.exe
  C:\Windows\System\xIXRhHZ.exe
  2⤵
  PID:13888
- C:\Windows\System\LbRFLkP.exe
  C:\Windows\System\LbRFLkP.exe
  2⤵
  PID:7428
- C:\Windows\System\uQbYVUd.exe
  C:\Windows\System\uQbYVUd.exe
  2⤵
  PID:7444
- C:\Windows\System\VLnFsSb.exe
  C:\Windows\System\VLnFsSb.exe
  2⤵
  PID:7808
- C:\Windows\System\xnAWFNP.exe
  C:\Windows\System\xnAWFNP.exe
  2⤵
  PID:7760
- C:\Windows\System\iJLezjS.exe
  C:\Windows\System\iJLezjS.exe
  2⤵
  PID:7532
- C:\Windows\System\dnTIFRn.exe
  C:\Windows\System\dnTIFRn.exe
  2⤵
  PID:7656
- C:\Windows\System\mlVPBXH.exe
  C:\Windows\System\mlVPBXH.exe
  2⤵
  PID:8184
- C:\Windows\System\uXVZNmv.exe
  C:\Windows\System\uXVZNmv.exe
  2⤵
  PID:2964
- C:\Windows\System\iwFzkYh.exe
  C:\Windows\System\iwFzkYh.exe
  2⤵
  PID:8200
- C:\Windows\System\TTJUyjE.exe
  C:\Windows\System\TTJUyjE.exe
  2⤵
  PID:7744
- C:\Windows\System\CmkevcC.exe
  C:\Windows\System\CmkevcC.exe
  2⤵
  PID:5452
- C:\Windows\System\iJJGasB.exe
  C:\Windows\System\iJJGasB.exe
  2⤵
  PID:8172
- C:\Windows\System\pJBiufh.exe
  C:\Windows\System\pJBiufh.exe
  2⤵
  PID:6456
- C:\Windows\System\xjFYiqM.exe
  C:\Windows\System\xjFYiqM.exe
  2⤵
  PID:6812
- C:\Windows\System\MnYTUKn.exe
  C:\Windows\System\MnYTUKn.exe
  2⤵
  PID:14316
- C:\Windows\System\fVmHcig.exe
  C:\Windows\System\fVmHcig.exe
  2⤵
  PID:14172
- C:\Windows\System\RxyCRPe.exe
  C:\Windows\System\RxyCRPe.exe
  2⤵
  PID:6704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 11876 -ip 11876
1⤵
PID:12840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 12276 -ip 12276
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2iuvjw3.cma.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXlgnPk.exe

Filesize
2.2MB

MD5
9e0d811e48e967d19e801169736a25d1

SHA1
f1371bd71b6afe9ba181b3bb966dec933685697d

SHA256
a11fcb699e467bc2f50a7c151d1752f1848f77619f1bb0ca59aa9d26c9055417

SHA512
b03a0ee45477b5f74212d878b74b6e2d6506652babb7f9a61f97485a1ddd6aeb28477c79dacedb1034b6ec561784f0bd5a4358f284e4d366afd37d5b92504211

Download Submit
C:\Windows\System\Eobztkl.exe

Filesize
2.2MB

MD5
d0e7e17890ef7c3f9a3b8a941bf057ab

SHA1
cfef2c9e014dbf3ed44fb5d3ccaec15bc4e9869c

SHA256
d8f22ff97673933cde041f77695f3f5cc654e7c08c5616207bac1497b06bb31b

SHA512
29e51fca3b50e37d51028cf5e36841fcee16ed1330bdc375985de8fbb2d3f0c6d1783f905bc619d8ab6e1665acab995934ae0f89512d53b74d67402796cb93dd

Download Submit
C:\Windows\System\EuAJDdI.exe

Filesize
2.2MB

MD5
1a65b78839b7150dab0cd7fbd871b4ae

SHA1
02895ab30755bfa3a8388cc4c6f283555fe8ee08

SHA256
f8b282304c3ef0f803467a843352a68ce015d8cd40105b03721514ed38e2916d

SHA512
03fcafc2bb9c65177d0a746fc07a13de52470b9854e61c0096d8af3335b086ff90735ba4a64d9a932e77bc5e714e7c9022ea05c75daa78cd2572c28024e3f95e

Download Submit
C:\Windows\System\FONupTL.exe

Filesize
2.2MB

MD5
6598789edef4ddd7a67bde6d14e40ec9

SHA1
8808ad4646a6e9e5f3ed20d6a7d4d4124664a951

SHA256
6adfc7677b4d943682111ada9799f2f9506c61c0b100de2f06699d9b85ea1261

SHA512
8a4060dc01acc05ed150fcdff8b675dafe281de1f449c8258bb5115ada8a592a8b770851afd78e70f432d4609799797cffa744ae22b2b7a2f30b5433e7808c3a

Download Submit
C:\Windows\System\HATOFAN.exe

Filesize
2.2MB

MD5
9e2baff51a7c630bc2dbfa7fc0737189

SHA1
b99bd2cd5aa658620d907181d1c92760344751c2

SHA256
6b56575520bb9a182ebec878edea87ae473381dc572137afe7ad86201e8cb8ba

SHA512
77db564892aae372695c88af46416ff9bca38f86f1bc54938a7976a2232a1352b69d54de40f7de895d0464e839351a13fe654b2668d4ab71b1032a9c983dd7f9

Download Submit
C:\Windows\System\HpYviWO.exe

Filesize
2.2MB

MD5
4df37e234fef1f4150901f73dfe97fb0

SHA1
e70dfd6d7c79cb4e0e5c3adeabf50e7a330adb8f

SHA256
45918d495c64dcccabd71cdbd590b7816a9e18600624f245ee799dfb28c887df

SHA512
79c612902a7f8c22bd6614c9acbcd69023af2f8c9fe9bcd5cc726f124a6221846623782b2c100d77545f4415819a3d00ec4a9c7ab27bc3e3a6a057d69a0cc694

Download Submit
C:\Windows\System\JzkDQNM.exe

Filesize
2.2MB

MD5
1a930a006b8474eeedaa6560f950c583

SHA1
a8229b0db603ff5d8b5bca3eb27b9bfc5df21ec6

SHA256
ac3b84c0507589231f263f739d28447fd43055556eeb7638d60069d34a8bb6fb

SHA512
a86d02346a8033a0f5d2ef4a9ac3ebd9f1dd773cb1d107dc9f54fcb46473335a664030a25b3e765f0682981fde8760ebb3dae4a4487a46a4c5a59bbf153b39a5

Download Submit
C:\Windows\System\KKZPPev.exe

Filesize
2.2MB

MD5
a66b83ebcb9853a60a678d9aa68732c8

SHA1
4c32213073ab72b9025eaca4d2c8fc11437df25b

SHA256
726d7458ac3e9504a1a995a50daa6f5a7e37f020329511ae861f32ce1f8344bc

SHA512
aeda00739a3dd52bb08f397dc7d5d7f3a8c546b89a2a0501372f0b95af46ef9db69e136ab16e28ed4ad1d69f22c575bc159fbb052d382f88ed44d7f698e0e37d

Download Submit
C:\Windows\System\LguVgtS.exe

Filesize
2.2MB

MD5
3de0eaac28b84837257946904e935c78

SHA1
90ee4e4ae6abd1b87a4d70c690823c16b2173156

SHA256
1d39be825fa319daf193a615daa3738dbdee6cc4d64d965735c0b72717c22db0

SHA512
c11796106a70f2a295ffe198d793e149276882e9231ee43364c4fccc3bb180c6a55109c02454de5a5b8a30ed03621bf668149b125c0d09ba04ac3206abb5cd2f

Download Submit
C:\Windows\System\MlzFRJy.exe

Filesize
2.2MB

MD5
6289b2460a16f503a0c125b06bc1db55

SHA1
d3a5407c38944a2451e1425c7c6e6a45042ca1d7

SHA256
f302c7954529548acfd53a14c81a425d9a4b4865613c479d3ff52cb9e2e553d3

SHA512
48aa3ef529169bd021af2fc6798c20c411752665c929da94d7eab4e645a0396f9950dadf8c21b9c96b04de1d6c14fa8e1306244a1ee263a481d96dd7566e0d15

Download Submit
C:\Windows\System\PPzNYrw.exe

Filesize
2.2MB

MD5
9ce14bc1c93ccc9242a3692596a73b8b

SHA1
c1e878481aa0c95009e06a1ce5749d25ebe08e46

SHA256
f872644a8d0350fc2cc39be0489371518e57390f3dc464f3112c563f9e8e72ef

SHA512
1ea4dd39103258be689fbad7502787bd1049432977e4d6c0f9bf446681e4e9610d62153b9a81c22ad8f54ecce662c62f72680d0d6403aadc78972f8c08dd5e56

Download Submit
C:\Windows\System\PXabxfH.exe

Filesize
2.2MB

MD5
f01f6468d6c9ea32a828e6d5761f0887

SHA1
77f48bb80442e76b6a8f634acca127a46235c1c9

SHA256
13556c707c58e93c52a63ec7d8742e8abefeedbe300d52f67dce7c192576352c

SHA512
4dbc39209080e7b6c3ecef8d16e39095098b2af2743fc966307be0c88c8eceb6495ba2a3e30d5c398bb450b9e25233f5bdd21202e735e8995fef745fa3379f26

Download Submit
C:\Windows\System\Rpaekxe.exe

Filesize
2.2MB

MD5
6531fd1108f7e71a1e5761e2a12a2745

SHA1
ebc3655f4e731aa019b06ba15d747aaafce108e7

SHA256
36bfc12ec068fd0834bdc6d95bb405edcdec4d735ced33416288075550e9b62e

SHA512
c6e855c81bc5e670bb0d1a2f4265c89eaeae423c00186eb3cbd54904fd3841d6403f751c67060b678f63cf97f8504a640de793ce03d7c4ced9533872e6a68d56

Download Submit
C:\Windows\System\SPSeBIe.exe

Filesize
2.2MB

MD5
47eed8633cc90d20f0f549a2a1433afc

SHA1
8a64f85831d009f5f17983f805625422534c7066

SHA256
69fb61f104b46f42ccc28eaccac6c2504f4b868c0a0062f0a146dba11821945e

SHA512
74c89dbea1db39ac3a0be68fc1682a31300a6bfd55e84670dbc005095308ca067f78cb2bafe2831eb114bf8002e54a502c41d53ecb8328c3f175f1c0a360cf09

Download Submit
C:\Windows\System\SRQQYGF.exe

Filesize
2.2MB

MD5
06eb25d6a7f1d9257076eaf6c34682f3

SHA1
5d68c001532b74cb146eab599c10fd9d7ac247c7

SHA256
3ecd265a54d76668d77a9b8d69fe4840fd5fac6f5ae2c0a65353eb1b23743299

SHA512
e306474e90c1b9d3dd80eb7f81fca992fd83c8161e90c7faecbb4f68edab48df68babf2fec5ead6de32a0b3234587aaafec849c51d897db5789a913a5437e0b3

Download Submit
C:\Windows\System\TLDEEfa.exe

Filesize
2.2MB

MD5
db5cd8e46512d9c82b24f7872057e55b

SHA1
30686384e221e5bdbaa6578efca5aac4ba2fe88e

SHA256
21a477319c53c35efda14c424a573446885c3f447d29be07993c284333216200

SHA512
86c2f83a48e37991f18ce2bd51edb3acfa8956414aed8f31130d2846076cf0ccf575fc2926621e31f6cde9d9cc1550a3de4cfa9a1ec938ae3f58ef740ee4a4b1

Download Submit
C:\Windows\System\TVQUrLi.exe

Filesize
2.2MB

MD5
5509161d411c449b3431ae7353f6e4a9

SHA1
677d2096f6048b7a2631e34664bf1365a84a7bcc

SHA256
7923e009befcf06d0e1177e017caab3f95c8c6a4cd3c26e05ad807ca09a3ffdf

SHA512
186227035fd7452c58f2fc3271e407a0e63455b59619fece7c7ec91379cd3670d291c631ecae3c4398b459ce5b5362f6422fe98a787e756f365991707e0b4ecc

Download Submit
C:\Windows\System\TdoNDfw.exe

Filesize
2.2MB

MD5
068143e44125a545b6a3475524fddf10

SHA1
51216ce36dd94d9f5b305d715727f1e2391dbc7c

SHA256
8ec6d178668eee212fa4ecdd00d9dfcac8c980e9e5f8891b1a174832e9435a15

SHA512
a6485b87e1c51bb0a6711e335548b9de5cadb7ed96a7cba7ac4119323bac745775b72bd2e711a0545692347afcb9f10791b90785d9ecd6279001e143ecb3b92a

Download Submit
C:\Windows\System\UqGUUQJ.exe

Filesize
2.2MB

MD5
d6e35c4419021edd4b5fe26a5a57ab33

SHA1
7136e5dc1578ae994f89c723c76a7dc3d79071a4

SHA256
fe277938a7ff039500a81b021912464c83710072de9d03c21bbb8188b314db2c

SHA512
45ccc67fa407a8e3324abdb8cd3abcf77752cabb7039288a28a929941d69e04cfd60afdc1698de65d3ab90906b8152b181c32c1b977140e6de437ae65afe337e

Download Submit
C:\Windows\System\YnCPwFl.exe

Filesize
2.2MB

MD5
99e33e796f5df74de537062d80c2e53b

SHA1
68a02a8c13aa4335d0e9e00aa5681f8cfc2101df

SHA256
953465acc693282aa862362e4ff83b0fd671e8cf0ea1f513c585070ad19e01fc

SHA512
b3fe5358c25df007169b26caccf289e88cd76dd139fdf166a77d442ff8f6cd3b5a4fa0381800f86562ea88976a771ed3950c7375b2f134c8f01a2ebb86382f46

Download Submit
C:\Windows\System\aEiBCPY.exe

Filesize
2.2MB

MD5
ee1b4444f810f4a58e2cc1ffcadbed60

SHA1
cbd51eeb6a4ff9869da88a5e163d866a09f6dcc4

SHA256
b3f31b497d1b98043d8f061eaf5924f335196be3062c0d1ce47810594031475b

SHA512
6c6063f47eee968f40fff473511f1d0e3494515290eba74e732016ca417414f4dd8d44ebaac6abddbe918dd0823afcdc32432bc2aa9399f159e301922bf52847

Download Submit
C:\Windows\System\aHaDSqb.exe

Filesize
2.2MB

MD5
0c922ff76800c8a19a7f5299fd20d670

SHA1
dd1d7ae32b82a400ae1604b929ff48a51e60f354

SHA256
54ae8afce27008dcfd2f86d657e507edecfe98b9b9cb067ff96e694e248eeb5c

SHA512
24539ab3d0625eb3d3fbd6a6c05aebfc6b6fad886a760d59bc3746771e0088dd16736016d77a3ca995337d7f4fc48836bac15b4397de5f46330a959d20d8c5a6

Download Submit
C:\Windows\System\aMJzIaO.exe

Filesize
2.2MB

MD5
c0ae3e604f4e02cf4adf46d5eb3802b9

SHA1
ba59ca6c42d037368cc677cf334412727811aa87

SHA256
d7a9862408f3e6ed18fe4dd20815a710986c4752230004f06905f9b423a6f39e

SHA512
0b9e68c5b783a938d9c32d2b1b38f68329116b1f51edc7299f05d77f6d59a4f5fc542f284382b71a48e87c11cab8f43e6c9abdfe43893ff607aa463224908854

Download Submit
C:\Windows\System\asrpSKs.exe

Filesize
2.2MB

MD5
76146f06b8e7c1130b015996d9f3dddf

SHA1
36f8f5377c2bde06014e3bd63e280df13177b87a

SHA256
9dea12947449bc093a187d7263de71f0034564635095bd1b006dc7646610d0ea

SHA512
24c64c1f93eee33adaf716626e8e07c55a18cfcbb5e9cfa8301122135981d14829f0b4e76341c4cefb5adfcf03355580caeaa5a227c2c750da9780d4dc09f014

Download Submit
C:\Windows\System\azPyrBG.exe

Filesize
2.2MB

MD5
6e36e518f0b133243873f72312709ca7

SHA1
f34b1b10a83a525043cd86eb489ec18d7fd871da

SHA256
28e40f5ade38467adb79f28884a17cf78dbdfaa7a9e3854ab9112b410c73552d

SHA512
c789264395dec7384bdc0f15c06db1dae9d561c09458c57c6f8fcbbb89f241d19449c683f90596f4a782e4a527c1fe73d221608ee56cd72f76904630c2e49dca

Download Submit
C:\Windows\System\bDbpNik.exe

Filesize
2.2MB

MD5
76c174c987cc34c130d6cbfcb3713ff1

SHA1
d9fe1f215151f6ee29fe504b874eccb77d5ba47c

SHA256
de21a2a095fa696d5cef4baac022e64fd7319595a2a4dd0ea25b99e53e10a111

SHA512
28463dc3d85bf53237bcb460f1484e3c1229ca23cfedba405f5e64af10a844bb4894c361833543a12960814da5515c291677faf6d5e26e202b1ab09675a40492

Download Submit
C:\Windows\System\bIALLNL.exe

Filesize
2.2MB

MD5
5dba3395d147eae792f6524dc008c708

SHA1
cebe88aca8218ae3426b86a7a30b2791dfe4ccd3

SHA256
201e3c8ebdb1b071ec73ca70d4d96cf66b5520d9ee9759697ff7a33aabfe11e4

SHA512
fa96752972ae54c924ee7a5cdb90b652fa5788f7f0ccf895e36ffd41827658d5ab382b84af017d9185a19ac8479bdd1e396571ade9f5d6be0079187133bb1c95

Download Submit
C:\Windows\System\dDgsEek.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\fABDShf.exe

Filesize
2.2MB

MD5
01e02a92985cb72fa9e8b4a9ca68a8b0

SHA1
0449df0764f381123558d71e2205b297414e371d

SHA256
31d6579836009cd5e6d9487353be1c2f2f5292f9e52a576a3ef305acda5095f5

SHA512
4bf55e1ceded20da0b82c6a016fa83de9ee37deddebbf2671f89d3aaca3233b9b685fe14df568194aae6beab9ee6ad3141f4272140f9168036280af34ae4c84b

Download Submit
C:\Windows\System\fOIwUxU.exe

Filesize
2.2MB

MD5
d273eff9e6761cda24cc907057f91b6d

SHA1
58c782e60460f4cac1b922dff8e8567ea6bbf1ba

SHA256
37c4d23b52cec5aea04139f00e7f4b08c387aa49f21fcfb9d1f127fd4fcabd32

SHA512
76418ff9540c80694082867ee880abd43bda7b7a7087393c648bba7298fd2fb7e9d3f70011bf5f3fa5919555ea88e7a9d79762d32410e75ffaed6337c122e12a

Download Submit
C:\Windows\System\gIbolzH.exe

Filesize
2.2MB

MD5
9beb296299797eec9d9a53e4117e4d7a

SHA1
93bc21b444baa3299bd18a299d8c7f90a1df532b

SHA256
f11b846e2da74b24b98614dc06c6301de2b6b222db6ea4f5947fc250cca45fa9

SHA512
6d8d944d34c7b8a0c020ae98fe8e56d234763afdcec1c10cbd9861056f89fe8cba8691be84bd41b5e4c8bed3fe2dcee05c661fe71949b686ea640624d126b579

Download Submit
C:\Windows\System\iVCoDTe.exe

Filesize
2.2MB

MD5
1c0cd88a087b9a90d17b22dffa958518

SHA1
5ea0731a17a13a0d52d490ff8ac47188c81f9bd5

SHA256
12cb17e41ad3618f082b6abceafe5ce03a750d86bcc875f565a09cc9d8143683

SHA512
e7c7714e1f1094f67578f6c088cb99334201746cfc8e3580a008a5bfcf2aa80206cdacb58766f1183af819f37e6f625005b949b9a6ecf554a7f23f77fb037dbc

Download Submit
C:\Windows\System\jJlHbKK.exe

Filesize
2.2MB

MD5
2a04d6482f0efda1967d13f928a56272

SHA1
a5a0e1f77b5a0b70e99149f76f3bbcb4748dbee7

SHA256
a304792c53e3c0a1f775c7035205735ca8ea2f90f8f91f7b93b28cc50f7486ff

SHA512
97613648decb50afb78f3839fd88cc499a2dd1f33760fa0c8d8284126d4c85cc9377cf1de551f848779598eab8449e9f5b8f018f07805b6082432ec4cf5fc493

Download Submit
C:\Windows\System\jQMZMoU.exe

Filesize
2.2MB

MD5
fe402464803b41d43db43fe1457f28aa

SHA1
63c05dd1dd8f34cc26766a8efe9f00705f30cec9

SHA256
792b104bc8f1aceebc9d38cd3199f7671eeeca83ae1ba36174964ba7407ff686

SHA512
5ec6db36c48bf50191bfe64deb48249c403fd5d04e29fc9ff8c34be3ac9db62d0f1f79c119a4cfc794a886bc438ba610e8ded012ec70bfc3bc32eee7a76feb1c

Download Submit
C:\Windows\System\mPMmMEe.exe

Filesize
2.2MB

MD5
c7059650eaca47e32081f03195a67f20

SHA1
f036c91811c62a4fe890b497703efd8c0927f783

SHA256
390494423ba01c13005580ca8a446f98aff833729a96144de0b9c413699f97fc

SHA512
b43781d8ffef0304e77205160bfe784757d5f9a361ded1ad577cf58582d9aef67a5a537c3c3d468bae91502c985f1dc3fa3fbda409844f1f967fa9ae9b9a289a

Download Submit
C:\Windows\System\rHjJamW.exe

Filesize
2.2MB

MD5
5a49b963279f8ae6050973ce6d4c87f5

SHA1
4f4b0f2eb822bbdbed9263bc3f0e6e00708864d0

SHA256
9aaed95499232a9c572c7222b5f08f9c885e2a375cddeaf4c38b9f09effecaeb

SHA512
43b2f9cc5898aeeea7eb2992fdfde0fa8f92c0b42155ab084acdb0a8362a3e831d94ea21c38d6feb86c01043fd3056faa3f45df31079f27067f10c94ace830cd

Download Submit
C:\Windows\System\wKLsVOV.exe

Filesize
2.2MB

MD5
dff5dcc68caa0588be077329e32def31

SHA1
c14375019f9baeaef066c4f6e6537a7655f0d835

SHA256
10ea2e0c3d35db135c7c9ae2c475111a7a8259845f4965afdf141ff54074624f

SHA512
0ec687baaf306f4dd9e72e411adbe8dd8f7025e2c311cbe52fd3e232cbd417a339ded1a0a8aac067b76907cf750dc973c9c82f64b80dc555a978d166c96dd06c

Download Submit
C:\Windows\System\wsRYeOu.exe

Filesize
2.2MB

MD5
5988b47bf118a70c19e0f59a2bf1f8df

SHA1
d4aeb2aae6b1a6e84e576b696ee09f3fe3ce04ba

SHA256
408ead8f091753873a92f583c515ccbb5bd7c549c733b79994ad586d3edbad09

SHA512
320cf9cb712e7132c3b660fd3e1bd9266d2fc74b5a1ff544ed6c5bc0229d09307d5f743e62600145127f50b4ef01f033ae7cc9ae6236c556c415f3469ae5e2ce

Download Submit
C:\Windows\System\yskYalh.exe

Filesize
2.2MB

MD5
d7f9b28418d58922bb60d1993929b37f

SHA1
a206fa5898e59b8589f8b10f08fa0c4151ff7943

SHA256
7350d0866230225c72de325f92fe66d19c1a491c58df3ee891bdef284b5f51e5

SHA512
a34add2e6d0e1a42421a8717d6c943f42490deff2557d543bb120a38935b6bf522079b29f60d9c95a4350821e812813dd3709691c37a0a3fbf91fdfafbc6c16e

Download Submit
C:\Windows\System\zbpTosF.exe

Filesize
2.2MB

MD5
aee5a3a0f811ee9bf9920f9b9a174de5

SHA1
383103606756d8b67e981da7359d9c2fb306a1d8

SHA256
b01769ff0e261098b7d1ae8367320e8a76c8e52f6b1cb2da83c6402eecf836b2

SHA512
d714d6d7486581624df0ae8c0ac5eeeab30f15f9b66f35533c3dd06905fa18b4cc6a0292bf2b55c6dd2df1c6132f73319ee367c00625850b4ee0f099021d11a4

Download Submit
memory/376-364-0x00007FF7C15F0000-0x00007FF7C19E2000-memory.dmp

Filesize
3.9MB

Download
memory/380-418-0x00007FF721060000-0x00007FF721452000-memory.dmp

Filesize
3.9MB

Download
memory/436-39-0x00007FF7C96E0000-0x00007FF7C9AD2000-memory.dmp

Filesize
3.9MB

Download
memory/728-367-0x00007FF6024B0000-0x00007FF6028A2000-memory.dmp

Filesize
3.9MB

Download
memory/732-4407-0x00007FF746F40000-0x00007FF747332000-memory.dmp

Filesize
3.9MB

Download
memory/732-534-0x00007FF746F40000-0x00007FF747332000-memory.dmp

Filesize
3.9MB

Download
memory/1212-532-0x00007FF641790000-0x00007FF641B82000-memory.dmp

Filesize
3.9MB

Download
memory/1456-199-0x00007FF738D00000-0x00007FF7390F2000-memory.dmp

Filesize
3.9MB

Download
memory/1484-234-0x00007FF7F8690000-0x00007FF7F8A82000-memory.dmp

Filesize
3.9MB

Download
memory/1580-529-0x00007FF646090000-0x00007FF646482000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2268-0x00007FF64AB10000-0x00007FF64AF02000-memory.dmp

Filesize
3.9MB

Download
memory/1640-44-0x00007FF64AB10000-0x00007FF64AF02000-memory.dmp

Filesize
3.9MB

Download
memory/1724-74-0x00007FF65F810000-0x00007FF65FC02000-memory.dmp

Filesize
3.9MB

Download
memory/1892-136-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2120-0x00007FF6A6F80000-0x00007FF6A7372000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1679-0x00007FF64AE00000-0x00007FF64B1F2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-10-0x00007FF64AE00000-0x00007FF64B1F2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-468-0x00007FF65F540000-0x00007FF65F932000-memory.dmp

Filesize
3.9MB

Download
memory/2268-4410-0x00007FF65F540000-0x00007FF65F932000-memory.dmp

Filesize
3.9MB

Download
memory/2596-525-0x00007FF7DFE20000-0x00007FF7E0212000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4392-0x00007FF7DFE20000-0x00007FF7E0212000-memory.dmp

Filesize
3.9MB

Download
memory/2888-531-0x00007FF62A0B0000-0x00007FF62A4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-530-0x00007FF7E2950000-0x00007FF7E2D42000-memory.dmp

Filesize
3.9MB

Download
memory/3020-1-0x000001EA646F0000-0x000001EA64700000-memory.dmp

Filesize
64KB

Download
memory/3020-0-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-1678-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp

Filesize
3.9MB

Download
memory/3412-4395-0x00007FF7135B0000-0x00007FF7139A2000-memory.dmp

Filesize
3.9MB

Download
memory/3412-527-0x00007FF7135B0000-0x00007FF7139A2000-memory.dmp

Filesize
3.9MB

Download
memory/3620-2097-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp

Filesize
3.9MB

Download
memory/3620-100-0x00007FF6ED630000-0x00007FF6EDA22000-memory.dmp

Filesize
3.9MB

Download
memory/3648-284-0x00007FF7A8D00000-0x00007FF7A90F2000-memory.dmp

Filesize
3.9MB

Download
memory/4720-528-0x00007FF6F8670000-0x00007FF6F8A62000-memory.dmp

Filesize
3.9MB

Download
memory/4720-4402-0x00007FF6F8670000-0x00007FF6F8A62000-memory.dmp

Filesize
3.9MB

Download
memory/4988-526-0x00007FF614CF0000-0x00007FF6150E2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-13-0x00007FF9A3843000-0x00007FF9A3845000-memory.dmp

Filesize
8KB

Download
memory/4996-12-0x000001BFD94A0000-0x000001BFD94B0000-memory.dmp

Filesize
64KB

Download
memory/4996-11-0x000001BFD94A0000-0x000001BFD94B0000-memory.dmp

Filesize
64KB

Download
memory/4996-2060-0x00007FF9A3843000-0x00007FF9A3845000-memory.dmp

Filesize
8KB

Download
memory/4996-299-0x000001BFDB9B0000-0x000001BFDB9D2000-memory.dmp

Filesize
136KB

Download
memory/4996-899-0x000001BFDC580000-0x000001BFDCD26000-memory.dmp

Filesize
7.6MB

Download
memory/4996-1860-0x000001BFD94A0000-0x000001BFD94B0000-memory.dmp

Filesize
64KB

Download
memory/4996-1861-0x000001BFD94A0000-0x000001BFD94B0000-memory.dmp

Filesize
64KB

Download
memory/5028-533-0x00007FF646D10000-0x00007FF647102000-memory.dmp

Filesize
3.9MB

Download
memory/5028-4488-0x00007FF646D10000-0x00007FF647102000-memory.dmp

Filesize
3.9MB

Download
memory/5100-4388-0x00007FF656960000-0x00007FF656D52000-memory.dmp

Filesize
3.9MB

Download
memory/5100-524-0x00007FF656960000-0x00007FF656D52000-memory.dmp

Filesize
3.9MB

Download