xmrig | 0379ae9ef4b5a11ff3011e4704224c05adde23e0e08b28e6217c7e5744cdb66a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
Size 1.9MB
Sample240426-vpl8lsgc35
SHA256 0379ae9ef4b5a11ff3011e4704224c05adde23e0e08b28e6217c7e5744cdb66a
MD5 014099278b2616b62c03e27cd2a720c5
SHA1 5392c6e8cbe6b884e9d5541a9694fe7ec874396b
SHA512 ef460982b04bd69c17ad8b6e0069347b7667152222b76a8aed8ca5636c1aa96ecd00d4cf94badd96112bbbaff00cc01829edcf260195aeeec97326644ecfc536
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3Q:NABt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/2456-26-0x00007FF6187C0000-0x00007FF618BB2000-memory.dmp	xmrig
behavioral2/memory/3388-76-0x00007FF789170000-0x00007FF789562000-memory.dmp	xmrig
behavioral2/memory/264-83-0x00007FF6E6B30000-0x00007FF6E6F22000-memory.dmp	xmrig
behavioral2/memory/5012-527-0x00007FF6BC230000-0x00007FF6BC622000-memory.dmp	xmrig
behavioral2/memory/2020-529-0x00007FF624170000-0x00007FF624562000-memory.dmp	xmrig
behavioral2/memory/4532-528-0x00007FF708260000-0x00007FF708652000-memory.dmp	xmrig
behavioral2/memory/4412-531-0x00007FF7A7980000-0x00007FF7A7D72000-memory.dmp	xmrig
behavioral2/memory/512-530-0x00007FF6C2B80000-0x00007FF6C2F72000-memory.dmp	xmrig
behavioral2/memory/3132-536-0x00007FF7AB070000-0x00007FF7AB462000-memory.dmp	xmrig
behavioral2/memory/4328-545-0x00007FF63FA50000-0x00007FF63FE42000-memory.dmp	xmrig
behavioral2/memory/4164-97-0x00007FF636140000-0x00007FF636532000-memory.dmp	xmrig
behavioral2/memory/452-92-0x00007FF63E350000-0x00007FF63E742000-memory.dmp	xmrig
behavioral2/memory/760-88-0x00007FF69C6A0000-0x00007FF69CA92000-memory.dmp	xmrig
behavioral2/memory/424-84-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	xmrig
behavioral2/memory/1304-33-0x00007FF698500000-0x00007FF6988F2000-memory.dmp	xmrig
behavioral2/memory/1384-30-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp	xmrig
behavioral2/memory/1384-2110-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp	xmrig
behavioral2/memory/4440-2111-0x00007FF78F6C0000-0x00007FF78FAB2000-memory.dmp	xmrig
behavioral2/memory/4352-2112-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp	xmrig
behavioral2/memory/4520-2113-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp	xmrig
behavioral2/memory/1020-2114-0x00007FF711780000-0x00007FF711B72000-memory.dmp	xmrig
behavioral2/memory/4352-2619-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp	xmrig
behavioral2/memory/424-2626-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	xmrig
behavioral2/memory/4520-2632-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp	xmrig
behavioral2/memory/1020-2645-0x00007FF711780000-0x00007FF711B72000-memory.dmp	xmrig
behavioral2/memory/4164-2648-0x00007FF636140000-0x00007FF636532000-memory.dmp	xmrig
behavioral2/memory/452-2654-0x00007FF63E350000-0x00007FF63E742000-memory.dmp	xmrig
behavioral2/memory/5012-2667-0x00007FF6BC230000-0x00007FF6BC622000-memory.dmp	xmrig
behavioral2/memory/2020-2671-0x00007FF624170000-0x00007FF624562000-memory.dmp	xmrig
behavioral2/memory/512-2675-0x00007FF6C2B80000-0x00007FF6C2F72000-memory.dmp	xmrig
behavioral2/memory/4532-2665-0x00007FF708260000-0x00007FF708652000-memory.dmp	xmrig
behavioral2/memory/3132-2682-0x00007FF7AB070000-0x00007FF7AB462000-memory.dmp	xmrig
behavioral2/memory/4412-2680-0x00007FF7A7980000-0x00007FF7A7D72000-memory.dmp	xmrig
behavioral2/memory/4328-2721-0x00007FF63FA50000-0x00007FF63FE42000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1304	recdAXY.exe
1444	qkfkfkS.exe
2456	hsUWgWO.exe
1384	YAlNkZs.exe
3388	DwDwqJE.exe
4440	VruByZy.exe
264	GHsXOGn.exe
4352	vtBTHTB.exe
4520	VoBYpby.exe
424	NBhYjlk.exe
760	STFYyuo.exe
452	zDapXoL.exe
4164	FFkxZSA.exe
1020	ITZJFjj.exe
5012	mCAWSyg.exe
4532	FKqkLcm.exe
2020	kSGyuBu.exe
512	VPopzcB.exe
4412	aXbhtLr.exe
3132	aIwubAK.exe
4328	TcOfkFC.exe
3612	MjWjEUW.exe
1012	jwmDTLl.exe
1424	XhtbWhd.exe
2744	XuRsciy.exe
2080	TsFHKmI.exe
4928	snBbiHK.exe
2576	jmrZGkf.exe
4192	ADbIFOV.exe
3496	fgNJgIn.exe
3872	mLWavWo.exe
1044	FdtDavF.exe
3564	drKsHrE.exe
2252	fCTCpvv.exe
3868	mQCHZuO.exe
4676	wBoeHKp.exe
3640	xhQoRZc.exe
992	qIEcwCL.exe
4056	glXzjaW.exe
2824	NMrsAYk.exe
552	XnLesTS.exe
4872	cypSNxa.exe
3024	xzukiYq.exe
4456	gcGMEBU.exe
2360	WQproKK.exe
2588	HuRHmXb.exe
2260	ppAacyP.exe
1652	SpRRBeq.exe
2916	SrgjRUv.exe
4788	XQlWhWX.exe
2988	IfcaDbF.exe
4884	CyHVsNO.exe
668	TojSVHL.exe
2076	kEbWaox.exe
4360	wWSQguG.exe
5052	OKSawue.exe
2392	PqAmVTl.exe
3208	HjIuhDr.exe
3992	fwBsnKq.exe
4484	oWgofTa.exe
3012	QNCFstY.exe
3424	dUuQTvs.exe
2940	ZChYBKV.exe
4496	UXTyKqe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5068-0-0x00007FF69F1A0000-0x00007FF69F592000-memory.dmp	upx
behavioral2/files/0x001c000000023af8-5.dat	upx
behavioral2/files/0x000a000000023b84-8.dat	upx
behavioral2/files/0x000a000000023b83-12.dat	upx
behavioral2/files/0x000a000000023b85-16.dat	upx
behavioral2/memory/2456-26-0x00007FF6187C0000-0x00007FF618BB2000-memory.dmp	upx
behavioral2/memory/1444-24-0x00007FF70D810000-0x00007FF70DC02000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-59.dat	upx
behavioral2/memory/4352-66-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp	upx
behavioral2/memory/3388-76-0x00007FF789170000-0x00007FF789562000-memory.dmp	upx
behavioral2/memory/264-83-0x00007FF6E6B30000-0x00007FF6E6F22000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-89.dat	upx
behavioral2/files/0x000b000000023b8d-110.dat	upx
behavioral2/files/0x000a000000023b92-120.dat	upx
behavioral2/files/0x000a000000023b99-157.dat	upx
behavioral2/files/0x000a000000023b9d-169.dat	upx
behavioral2/files/0x000a000000023ba0-184.dat	upx
behavioral2/memory/5012-527-0x00007FF6BC230000-0x00007FF6BC622000-memory.dmp	upx
behavioral2/memory/2020-529-0x00007FF624170000-0x00007FF624562000-memory.dmp	upx
behavioral2/memory/4532-528-0x00007FF708260000-0x00007FF708652000-memory.dmp	upx
behavioral2/memory/4412-531-0x00007FF7A7980000-0x00007FF7A7D72000-memory.dmp	upx
behavioral2/memory/512-530-0x00007FF6C2B80000-0x00007FF6C2F72000-memory.dmp	upx
behavioral2/memory/3132-536-0x00007FF7AB070000-0x00007FF7AB462000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-189.dat	upx
behavioral2/files/0x000a000000023b9f-187.dat	upx
behavioral2/files/0x000a000000023b9e-182.dat	upx
behavioral2/files/0x000a000000023b9c-172.dat	upx
behavioral2/files/0x000a000000023b9b-167.dat	upx
behavioral2/files/0x000a000000023b9a-162.dat	upx
behavioral2/files/0x000a000000023b98-152.dat	upx
behavioral2/files/0x000a000000023b97-147.dat	upx
behavioral2/files/0x000a000000023b96-142.dat	upx
behavioral2/files/0x000a000000023b95-135.dat	upx
behavioral2/files/0x000a000000023b94-130.dat	upx
behavioral2/files/0x000a000000023b93-125.dat	upx
behavioral2/memory/4328-545-0x00007FF63FA50000-0x00007FF63FE42000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-115.dat	upx
behavioral2/files/0x000b000000023b80-105.dat	upx
behavioral2/memory/4164-97-0x00007FF636140000-0x00007FF636532000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-96.dat	upx
behavioral2/files/0x000b000000023b8e-93.dat	upx
behavioral2/memory/452-92-0x00007FF63E350000-0x00007FF63E742000-memory.dmp	upx
behavioral2/memory/1020-91-0x00007FF711780000-0x00007FF711B72000-memory.dmp	upx
behavioral2/memory/760-88-0x00007FF69C6A0000-0x00007FF69CA92000-memory.dmp	upx
behavioral2/memory/424-84-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-79.dat	upx
behavioral2/files/0x000a000000023b8b-74.dat	upx
behavioral2/memory/4520-70-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-71.dat	upx
behavioral2/files/0x000a000000023b8a-62.dat	upx
behavioral2/memory/4440-60-0x00007FF78F6C0000-0x00007FF78FAB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b87-48.dat	upx
behavioral2/files/0x000a000000023b86-42.dat	upx
behavioral2/memory/1304-33-0x00007FF698500000-0x00007FF6988F2000-memory.dmp	upx
behavioral2/memory/1384-30-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp	upx
behavioral2/memory/1384-2110-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp	upx
behavioral2/memory/4440-2111-0x00007FF78F6C0000-0x00007FF78FAB2000-memory.dmp	upx
behavioral2/memory/4352-2112-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp	upx
behavioral2/memory/4520-2113-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp	upx
behavioral2/memory/1020-2114-0x00007FF711780000-0x00007FF711B72000-memory.dmp	upx
behavioral2/memory/4352-2619-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp	upx
behavioral2/memory/424-2626-0x00007FF77E350000-0x00007FF77E742000-memory.dmp	upx
behavioral2/memory/4520-2632-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp	upx
behavioral2/memory/1020-2645-0x00007FF711780000-0x00007FF711B72000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NCKdtJm.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\RSCdPEy.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\wnzhJzj.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\vOQHTsq.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\zqapuzo.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\cnkWHDz.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\rFbaQaW.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\iroWYot.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\NxqjXUR.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\KMwMqRJ.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\NpswENL.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\uWsGdPX.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\IXAjGOV.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\cBhuref.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\SVeMBEH.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\xFJlQqS.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\jMqmIjx.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\CrzIVQs.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\Ibebvzc.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\JRmzTXL.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\XHvkzER.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\vyhMEQa.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\xNgYjRF.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\EGlhHSD.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\VhUFOSJ.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\qLvQCns.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\UaopqEM.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\XSkXQOT.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\vALNWpa.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\lkdJpQL.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\mAYpVnU.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\bGEGInU.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\PzNwgTn.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\nFEghoF.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\yPwOKAc.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\TjXemFi.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\YPxOWGq.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\kzJDYRp.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\MHZoWKd.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\SXjWcUZ.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\emnRYAU.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\BBUXKdi.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\QuBTsTu.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\QXjLdAV.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\Scvcnrt.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\zWKAhuV.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\MqqvfZe.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\JqinoFX.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\WncRhae.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\smwFWXs.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\lEJGXOI.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\VEdrzCU.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\ljVrTcS.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\wwOkphp.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\PMKshUE.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\VthINMm.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\rmKwurA.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\MgWqONH.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\BMqaBvR.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\YlzAUWf.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\QQbkjSk.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\YtvbMRT.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\noxdOyl.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
File created	C:\Windows\System\bYrQFyF.exe	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3976	powershell.exe
3976	powershell.exe
3976	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeLockMemoryPrivilege	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3976	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	84
PID 5068 wrote to memory of 3976	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	84
PID 5068 wrote to memory of 1304	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	85
PID 5068 wrote to memory of 1304	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	85
PID 5068 wrote to memory of 1444	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	86
PID 5068 wrote to memory of 1444	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	86
PID 5068 wrote to memory of 2456	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	87
PID 5068 wrote to memory of 2456	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	87
PID 5068 wrote to memory of 1384	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	88
PID 5068 wrote to memory of 1384	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	88
PID 5068 wrote to memory of 3388	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	89
PID 5068 wrote to memory of 3388	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	89
PID 5068 wrote to memory of 4440	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	90
PID 5068 wrote to memory of 4440	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	90
PID 5068 wrote to memory of 4520	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	91
PID 5068 wrote to memory of 4520	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	91
PID 5068 wrote to memory of 264	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	92
PID 5068 wrote to memory of 264	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	92
PID 5068 wrote to memory of 4352	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	93
PID 5068 wrote to memory of 4352	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	93
PID 5068 wrote to memory of 424	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	94
PID 5068 wrote to memory of 424	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	94
PID 5068 wrote to memory of 760	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	95
PID 5068 wrote to memory of 760	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	95
PID 5068 wrote to memory of 452	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	96
PID 5068 wrote to memory of 452	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	96
PID 5068 wrote to memory of 4164	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	97
PID 5068 wrote to memory of 4164	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	97
PID 5068 wrote to memory of 1020	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	98
PID 5068 wrote to memory of 1020	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	98
PID 5068 wrote to memory of 5012	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	99
PID 5068 wrote to memory of 5012	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	99
PID 5068 wrote to memory of 4532	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	100
PID 5068 wrote to memory of 4532	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	100
PID 5068 wrote to memory of 2020	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	101
PID 5068 wrote to memory of 2020	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	101
PID 5068 wrote to memory of 512	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	102
PID 5068 wrote to memory of 512	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	102
PID 5068 wrote to memory of 4412	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	103
PID 5068 wrote to memory of 4412	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	103
PID 5068 wrote to memory of 3132	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	104
PID 5068 wrote to memory of 3132	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	104
PID 5068 wrote to memory of 4328	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	105
PID 5068 wrote to memory of 4328	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	105
PID 5068 wrote to memory of 3612	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	106
PID 5068 wrote to memory of 3612	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	106
PID 5068 wrote to memory of 1012	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	107
PID 5068 wrote to memory of 1012	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	107
PID 5068 wrote to memory of 1424	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	108
PID 5068 wrote to memory of 1424	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	108
PID 5068 wrote to memory of 2744	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	109
PID 5068 wrote to memory of 2744	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	109
PID 5068 wrote to memory of 2080	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	110
PID 5068 wrote to memory of 2080	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	110
PID 5068 wrote to memory of 4928	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	111
PID 5068 wrote to memory of 4928	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	111
PID 5068 wrote to memory of 2576	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	112
PID 5068 wrote to memory of 2576	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	112
PID 5068 wrote to memory of 4192	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	113
PID 5068 wrote to memory of 4192	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	113
PID 5068 wrote to memory of 3496	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	114
PID 5068 wrote to memory of 3496	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	114
PID 5068 wrote to memory of 3872	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	115
PID 5068 wrote to memory of 3872	5068	014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\014099278b2616b62c03e27cd2a720c5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\System\recdAXY.exe
  C:\Windows\System\recdAXY.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\qkfkfkS.exe
  C:\Windows\System\qkfkfkS.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hsUWgWO.exe
  C:\Windows\System\hsUWgWO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\YAlNkZs.exe
  C:\Windows\System\YAlNkZs.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\DwDwqJE.exe
  C:\Windows\System\DwDwqJE.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\VruByZy.exe
  C:\Windows\System\VruByZy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\VoBYpby.exe
  C:\Windows\System\VoBYpby.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\GHsXOGn.exe
  C:\Windows\System\GHsXOGn.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\vtBTHTB.exe
  C:\Windows\System\vtBTHTB.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\NBhYjlk.exe
  C:\Windows\System\NBhYjlk.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\STFYyuo.exe
  C:\Windows\System\STFYyuo.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\zDapXoL.exe
  C:\Windows\System\zDapXoL.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\FFkxZSA.exe
  C:\Windows\System\FFkxZSA.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\ITZJFjj.exe
  C:\Windows\System\ITZJFjj.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\mCAWSyg.exe
  C:\Windows\System\mCAWSyg.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\FKqkLcm.exe
  C:\Windows\System\FKqkLcm.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\kSGyuBu.exe
  C:\Windows\System\kSGyuBu.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\VPopzcB.exe
  C:\Windows\System\VPopzcB.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\aXbhtLr.exe
  C:\Windows\System\aXbhtLr.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\aIwubAK.exe
  C:\Windows\System\aIwubAK.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\TcOfkFC.exe
  C:\Windows\System\TcOfkFC.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\MjWjEUW.exe
  C:\Windows\System\MjWjEUW.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\jwmDTLl.exe
  C:\Windows\System\jwmDTLl.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\XhtbWhd.exe
  C:\Windows\System\XhtbWhd.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\XuRsciy.exe
  C:\Windows\System\XuRsciy.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TsFHKmI.exe
  C:\Windows\System\TsFHKmI.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\snBbiHK.exe
  C:\Windows\System\snBbiHK.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\jmrZGkf.exe
  C:\Windows\System\jmrZGkf.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ADbIFOV.exe
  C:\Windows\System\ADbIFOV.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\fgNJgIn.exe
  C:\Windows\System\fgNJgIn.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\mLWavWo.exe
  C:\Windows\System\mLWavWo.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\FdtDavF.exe
  C:\Windows\System\FdtDavF.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\drKsHrE.exe
  C:\Windows\System\drKsHrE.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\fCTCpvv.exe
  C:\Windows\System\fCTCpvv.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\mQCHZuO.exe
  C:\Windows\System\mQCHZuO.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\wBoeHKp.exe
  C:\Windows\System\wBoeHKp.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\xhQoRZc.exe
  C:\Windows\System\xhQoRZc.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\qIEcwCL.exe
  C:\Windows\System\qIEcwCL.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\glXzjaW.exe
  C:\Windows\System\glXzjaW.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\NMrsAYk.exe
  C:\Windows\System\NMrsAYk.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\XnLesTS.exe
  C:\Windows\System\XnLesTS.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\cypSNxa.exe
  C:\Windows\System\cypSNxa.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\xzukiYq.exe
  C:\Windows\System\xzukiYq.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\gcGMEBU.exe
  C:\Windows\System\gcGMEBU.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\WQproKK.exe
  C:\Windows\System\WQproKK.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\HuRHmXb.exe
  C:\Windows\System\HuRHmXb.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ppAacyP.exe
  C:\Windows\System\ppAacyP.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\SpRRBeq.exe
  C:\Windows\System\SpRRBeq.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\SrgjRUv.exe
  C:\Windows\System\SrgjRUv.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\XQlWhWX.exe
  C:\Windows\System\XQlWhWX.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\IfcaDbF.exe
  C:\Windows\System\IfcaDbF.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\CyHVsNO.exe
  C:\Windows\System\CyHVsNO.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\TojSVHL.exe
  C:\Windows\System\TojSVHL.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\kEbWaox.exe
  C:\Windows\System\kEbWaox.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\wWSQguG.exe
  C:\Windows\System\wWSQguG.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\OKSawue.exe
  C:\Windows\System\OKSawue.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\PqAmVTl.exe
  C:\Windows\System\PqAmVTl.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\HjIuhDr.exe
  C:\Windows\System\HjIuhDr.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\fwBsnKq.exe
  C:\Windows\System\fwBsnKq.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\oWgofTa.exe
  C:\Windows\System\oWgofTa.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\QNCFstY.exe
  C:\Windows\System\QNCFstY.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\dUuQTvs.exe
  C:\Windows\System\dUuQTvs.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\ZChYBKV.exe
  C:\Windows\System\ZChYBKV.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\UXTyKqe.exe
  C:\Windows\System\UXTyKqe.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\VWtHEex.exe
  C:\Windows\System\VWtHEex.exe
  2⤵
  PID:4308
- C:\Windows\System\CfeKJxO.exe
  C:\Windows\System\CfeKJxO.exe
  2⤵
  PID:1392
- C:\Windows\System\wremLYw.exe
  C:\Windows\System\wremLYw.exe
  2⤵
  PID:4240
- C:\Windows\System\kyzCQnv.exe
  C:\Windows\System\kyzCQnv.exe
  2⤵
  PID:1116
- C:\Windows\System\gQuyNeU.exe
  C:\Windows\System\gQuyNeU.exe
  2⤵
  PID:4340
- C:\Windows\System\rBiRPKN.exe
  C:\Windows\System\rBiRPKN.exe
  2⤵
  PID:828
- C:\Windows\System\jroxOwm.exe
  C:\Windows\System\jroxOwm.exe
  2⤵
  PID:2040
- C:\Windows\System\EstwZLw.exe
  C:\Windows\System\EstwZLw.exe
  2⤵
  PID:4948
- C:\Windows\System\MHrSyvd.exe
  C:\Windows\System\MHrSyvd.exe
  2⤵
  PID:1128
- C:\Windows\System\dLEMaQG.exe
  C:\Windows\System\dLEMaQG.exe
  2⤵
  PID:5124
- C:\Windows\System\DKQRLQN.exe
  C:\Windows\System\DKQRLQN.exe
  2⤵
  PID:5152
- C:\Windows\System\BOWuZuI.exe
  C:\Windows\System\BOWuZuI.exe
  2⤵
  PID:5180
- C:\Windows\System\jUrTdJu.exe
  C:\Windows\System\jUrTdJu.exe
  2⤵
  PID:5208
- C:\Windows\System\wgpAJvp.exe
  C:\Windows\System\wgpAJvp.exe
  2⤵
  PID:5236
- C:\Windows\System\CTqAlFx.exe
  C:\Windows\System\CTqAlFx.exe
  2⤵
  PID:5264
- C:\Windows\System\yNucGmo.exe
  C:\Windows\System\yNucGmo.exe
  2⤵
  PID:5292
- C:\Windows\System\rUkZwVw.exe
  C:\Windows\System\rUkZwVw.exe
  2⤵
  PID:5320
- C:\Windows\System\AyxrYkY.exe
  C:\Windows\System\AyxrYkY.exe
  2⤵
  PID:5348
- C:\Windows\System\WVIaifi.exe
  C:\Windows\System\WVIaifi.exe
  2⤵
  PID:5376
- C:\Windows\System\ufxqMFW.exe
  C:\Windows\System\ufxqMFW.exe
  2⤵
  PID:5404
- C:\Windows\System\OESExdG.exe
  C:\Windows\System\OESExdG.exe
  2⤵
  PID:5432
- C:\Windows\System\IvPXIen.exe
  C:\Windows\System\IvPXIen.exe
  2⤵
  PID:5460
- C:\Windows\System\EWXFEWM.exe
  C:\Windows\System\EWXFEWM.exe
  2⤵
  PID:5488
- C:\Windows\System\HvEfwRo.exe
  C:\Windows\System\HvEfwRo.exe
  2⤵
  PID:5516
- C:\Windows\System\POuYSbR.exe
  C:\Windows\System\POuYSbR.exe
  2⤵
  PID:5544
- C:\Windows\System\rcefFuJ.exe
  C:\Windows\System\rcefFuJ.exe
  2⤵
  PID:5572
- C:\Windows\System\wPvXHdf.exe
  C:\Windows\System\wPvXHdf.exe
  2⤵
  PID:5600
- C:\Windows\System\sImvnjX.exe
  C:\Windows\System\sImvnjX.exe
  2⤵
  PID:5628
- C:\Windows\System\UOMaHgF.exe
  C:\Windows\System\UOMaHgF.exe
  2⤵
  PID:5656
- C:\Windows\System\DlXKfej.exe
  C:\Windows\System\DlXKfej.exe
  2⤵
  PID:5684
- C:\Windows\System\QeVBcOf.exe
  C:\Windows\System\QeVBcOf.exe
  2⤵
  PID:5712
- C:\Windows\System\gcpRrrY.exe
  C:\Windows\System\gcpRrrY.exe
  2⤵
  PID:5740
- C:\Windows\System\JrfiFmj.exe
  C:\Windows\System\JrfiFmj.exe
  2⤵
  PID:5768
- C:\Windows\System\jbDoAAS.exe
  C:\Windows\System\jbDoAAS.exe
  2⤵
  PID:5800
- C:\Windows\System\QeNrYtL.exe
  C:\Windows\System\QeNrYtL.exe
  2⤵
  PID:5828
- C:\Windows\System\uOKPnrS.exe
  C:\Windows\System\uOKPnrS.exe
  2⤵
  PID:5852
- C:\Windows\System\sGLNttg.exe
  C:\Windows\System\sGLNttg.exe
  2⤵
  PID:5880
- C:\Windows\System\ScIbUWX.exe
  C:\Windows\System\ScIbUWX.exe
  2⤵
  PID:5908
- C:\Windows\System\eZEBZdq.exe
  C:\Windows\System\eZEBZdq.exe
  2⤵
  PID:5936
- C:\Windows\System\KOuQLmI.exe
  C:\Windows\System\KOuQLmI.exe
  2⤵
  PID:5964
- C:\Windows\System\ohXyofy.exe
  C:\Windows\System\ohXyofy.exe
  2⤵
  PID:5992
- C:\Windows\System\Nqvghns.exe
  C:\Windows\System\Nqvghns.exe
  2⤵
  PID:6020
- C:\Windows\System\aTUDFwp.exe
  C:\Windows\System\aTUDFwp.exe
  2⤵
  PID:6048
- C:\Windows\System\ScyijYI.exe
  C:\Windows\System\ScyijYI.exe
  2⤵
  PID:6108
- C:\Windows\System\zGWubKz.exe
  C:\Windows\System\zGWubKz.exe
  2⤵
  PID:6128
- C:\Windows\System\ktjzqpk.exe
  C:\Windows\System\ktjzqpk.exe
  2⤵
  PID:3688
- C:\Windows\System\ypmsaBm.exe
  C:\Windows\System\ypmsaBm.exe
  2⤵
  PID:1388
- C:\Windows\System\NGguyvd.exe
  C:\Windows\System\NGguyvd.exe
  2⤵
  PID:2096
- C:\Windows\System\TlydSgv.exe
  C:\Windows\System\TlydSgv.exe
  2⤵
  PID:4680
- C:\Windows\System\JufbyWf.exe
  C:\Windows\System\JufbyWf.exe
  2⤵
  PID:4524
- C:\Windows\System\TIrLfbC.exe
  C:\Windows\System\TIrLfbC.exe
  2⤵
  PID:1148
- C:\Windows\System\BPlEfyz.exe
  C:\Windows\System\BPlEfyz.exe
  2⤵
  PID:5192
- C:\Windows\System\DpihPNc.exe
  C:\Windows\System\DpihPNc.exe
  2⤵
  PID:5252
- C:\Windows\System\mudGItT.exe
  C:\Windows\System\mudGItT.exe
  2⤵
  PID:5312
- C:\Windows\System\NIFzSSb.exe
  C:\Windows\System\NIFzSSb.exe
  2⤵
  PID:3196
- C:\Windows\System\ZwOSaPn.exe
  C:\Windows\System\ZwOSaPn.exe
  2⤵
  PID:1412
- C:\Windows\System\mraosRM.exe
  C:\Windows\System\mraosRM.exe
  2⤵
  PID:5480
- C:\Windows\System\XQNEBqM.exe
  C:\Windows\System\XQNEBqM.exe
  2⤵
  PID:2196
- C:\Windows\System\LqeOiGD.exe
  C:\Windows\System\LqeOiGD.exe
  2⤵
  PID:5616
- C:\Windows\System\FVuHlop.exe
  C:\Windows\System\FVuHlop.exe
  2⤵
  PID:5668
- C:\Windows\System\nMNSagO.exe
  C:\Windows\System\nMNSagO.exe
  2⤵
  PID:5728
- C:\Windows\System\QqnuHLj.exe
  C:\Windows\System\QqnuHLj.exe
  2⤵
  PID:5788
- C:\Windows\System\MMdqhil.exe
  C:\Windows\System\MMdqhil.exe
  2⤵
  PID:5864
- C:\Windows\System\sIrVgmu.exe
  C:\Windows\System\sIrVgmu.exe
  2⤵
  PID:2072
- C:\Windows\System\poCAExV.exe
  C:\Windows\System\poCAExV.exe
  2⤵
  PID:5952
- C:\Windows\System\QwIEzin.exe
  C:\Windows\System\QwIEzin.exe
  2⤵
  PID:6004
- C:\Windows\System\JVOiOEj.exe
  C:\Windows\System\JVOiOEj.exe
  2⤵
  PID:1416
- C:\Windows\System\oqeeHsy.exe
  C:\Windows\System\oqeeHsy.exe
  2⤵
  PID:6124
- C:\Windows\System\QbAxXcE.exe
  C:\Windows\System\QbAxXcE.exe
  2⤵
  PID:3680
- C:\Windows\System\JMeQaiq.exe
  C:\Windows\System\JMeQaiq.exe
  2⤵
  PID:4260
- C:\Windows\System\dzXrlgB.exe
  C:\Windows\System\dzXrlgB.exe
  2⤵
  PID:5176
- C:\Windows\System\gRFJcWq.exe
  C:\Windows\System\gRFJcWq.exe
  2⤵
  PID:5360
- C:\Windows\System\VapaHVo.exe
  C:\Windows\System\VapaHVo.exe
  2⤵
  PID:5420
- C:\Windows\System\DtlrIhA.exe
  C:\Windows\System\DtlrIhA.exe
  2⤵
  PID:4780
- C:\Windows\System\JsFxXeE.exe
  C:\Windows\System\JsFxXeE.exe
  2⤵
  PID:2332
- C:\Windows\System\CiwFFKD.exe
  C:\Windows\System\CiwFFKD.exe
  2⤵
  PID:5784
- C:\Windows\System\rNBmPRQ.exe
  C:\Windows\System\rNBmPRQ.exe
  2⤵
  PID:5896
- C:\Windows\System\pjCuuCx.exe
  C:\Windows\System\pjCuuCx.exe
  2⤵
  PID:228
- C:\Windows\System\liMZWjF.exe
  C:\Windows\System\liMZWjF.exe
  2⤵
  PID:6068
- C:\Windows\System\JThohOn.exe
  C:\Windows\System\JThohOn.exe
  2⤵
  PID:4820
- C:\Windows\System\upmivkV.exe
  C:\Windows\System\upmivkV.exe
  2⤵
  PID:3704
- C:\Windows\System\dUIUVpC.exe
  C:\Windows\System\dUIUVpC.exe
  2⤵
  PID:5308
- C:\Windows\System\PBkHpQp.exe
  C:\Windows\System\PBkHpQp.exe
  2⤵
  PID:5724
- C:\Windows\System\arHweNc.exe
  C:\Windows\System\arHweNc.exe
  2⤵
  PID:1628
- C:\Windows\System\qKMtpVI.exe
  C:\Windows\System\qKMtpVI.exe
  2⤵
  PID:5168
- C:\Windows\System\vVRCxXy.exe
  C:\Windows\System\vVRCxXy.exe
  2⤵
  PID:684
- C:\Windows\System\UlwRCot.exe
  C:\Windows\System\UlwRCot.exe
  2⤵
  PID:3164
- C:\Windows\System\lRhfaXU.exe
  C:\Windows\System\lRhfaXU.exe
  2⤵
  PID:4320
- C:\Windows\System\WMKWfzu.exe
  C:\Windows\System\WMKWfzu.exe
  2⤵
  PID:3392
- C:\Windows\System\gXeiDvX.exe
  C:\Windows\System\gXeiDvX.exe
  2⤵
  PID:5948
- C:\Windows\System\dvHcHkp.exe
  C:\Windows\System\dvHcHkp.exe
  2⤵
  PID:1712
- C:\Windows\System\gkOUOiJ.exe
  C:\Windows\System\gkOUOiJ.exe
  2⤵
  PID:4224
- C:\Windows\System\GkELZzi.exe
  C:\Windows\System\GkELZzi.exe
  2⤵
  PID:5396
- C:\Windows\System\qnyBQKq.exe
  C:\Windows\System\qnyBQKq.exe
  2⤵
  PID:2708
- C:\Windows\System\hDByAxI.exe
  C:\Windows\System\hDByAxI.exe
  2⤵
  PID:1028
- C:\Windows\System\UWRrHdI.exe
  C:\Windows\System\UWRrHdI.exe
  2⤵
  PID:1092
- C:\Windows\System\HXxptUz.exe
  C:\Windows\System\HXxptUz.exe
  2⤵
  PID:2820
- C:\Windows\System\skubxmd.exe
  C:\Windows\System\skubxmd.exe
  2⤵
  PID:6156
- C:\Windows\System\PYvnGRV.exe
  C:\Windows\System\PYvnGRV.exe
  2⤵
  PID:6184
- C:\Windows\System\jINBocu.exe
  C:\Windows\System\jINBocu.exe
  2⤵
  PID:6204
- C:\Windows\System\sWEyJdk.exe
  C:\Windows\System\sWEyJdk.exe
  2⤵
  PID:6232
- C:\Windows\System\ZqUcZqq.exe
  C:\Windows\System\ZqUcZqq.exe
  2⤵
  PID:6252
- C:\Windows\System\bdBVtmP.exe
  C:\Windows\System\bdBVtmP.exe
  2⤵
  PID:6272
- C:\Windows\System\dWmxyhn.exe
  C:\Windows\System\dWmxyhn.exe
  2⤵
  PID:6292
- C:\Windows\System\gYkzlkE.exe
  C:\Windows\System\gYkzlkE.exe
  2⤵
  PID:6308
- C:\Windows\System\MdYGpfL.exe
  C:\Windows\System\MdYGpfL.exe
  2⤵
  PID:6344
- C:\Windows\System\pXZdPWL.exe
  C:\Windows\System\pXZdPWL.exe
  2⤵
  PID:6364
- C:\Windows\System\zhZHbjr.exe
  C:\Windows\System\zhZHbjr.exe
  2⤵
  PID:6416
- C:\Windows\System\NzhsSGD.exe
  C:\Windows\System\NzhsSGD.exe
  2⤵
  PID:6464
- C:\Windows\System\IEORRhA.exe
  C:\Windows\System\IEORRhA.exe
  2⤵
  PID:6496
- C:\Windows\System\rutkpbT.exe
  C:\Windows\System\rutkpbT.exe
  2⤵
  PID:6516
- C:\Windows\System\cByoLxo.exe
  C:\Windows\System\cByoLxo.exe
  2⤵
  PID:6560
- C:\Windows\System\IvdBsDS.exe
  C:\Windows\System\IvdBsDS.exe
  2⤵
  PID:6576
- C:\Windows\System\sYYJrEp.exe
  C:\Windows\System\sYYJrEp.exe
  2⤵
  PID:6596
- C:\Windows\System\DJogvVb.exe
  C:\Windows\System\DJogvVb.exe
  2⤵
  PID:6628
- C:\Windows\System\mBbWRNL.exe
  C:\Windows\System\mBbWRNL.exe
  2⤵
  PID:6648
- C:\Windows\System\IpMAdAS.exe
  C:\Windows\System\IpMAdAS.exe
  2⤵
  PID:6672
- C:\Windows\System\viTAkOg.exe
  C:\Windows\System\viTAkOg.exe
  2⤵
  PID:6696
- C:\Windows\System\xkpIRuE.exe
  C:\Windows\System\xkpIRuE.exe
  2⤵
  PID:6768
- C:\Windows\System\CppKQml.exe
  C:\Windows\System\CppKQml.exe
  2⤵
  PID:6788
- C:\Windows\System\uuWLxXd.exe
  C:\Windows\System\uuWLxXd.exe
  2⤵
  PID:6804
- C:\Windows\System\NVgSpFe.exe
  C:\Windows\System\NVgSpFe.exe
  2⤵
  PID:6828
- C:\Windows\System\ykJJcQl.exe
  C:\Windows\System\ykJJcQl.exe
  2⤵
  PID:6860
- C:\Windows\System\YhzVNMS.exe
  C:\Windows\System\YhzVNMS.exe
  2⤵
  PID:6884
- C:\Windows\System\QKSEPUR.exe
  C:\Windows\System\QKSEPUR.exe
  2⤵
  PID:6904
- C:\Windows\System\zdkWFxZ.exe
  C:\Windows\System\zdkWFxZ.exe
  2⤵
  PID:6948
- C:\Windows\System\zUZKPIc.exe
  C:\Windows\System\zUZKPIc.exe
  2⤵
  PID:6980
- C:\Windows\System\NHaRbqq.exe
  C:\Windows\System\NHaRbqq.exe
  2⤵
  PID:7000
- C:\Windows\System\ifkyjiD.exe
  C:\Windows\System\ifkyjiD.exe
  2⤵
  PID:7016
- C:\Windows\System\oogHpJY.exe
  C:\Windows\System\oogHpJY.exe
  2⤵
  PID:7040
- C:\Windows\System\HiliZNL.exe
  C:\Windows\System\HiliZNL.exe
  2⤵
  PID:7068
- C:\Windows\System\MLpYaQT.exe
  C:\Windows\System\MLpYaQT.exe
  2⤵
  PID:7084
- C:\Windows\System\stgMJgp.exe
  C:\Windows\System\stgMJgp.exe
  2⤵
  PID:7104
- C:\Windows\System\qJTgilH.exe
  C:\Windows\System\qJTgilH.exe
  2⤵
  PID:7144
- C:\Windows\System\CDvIxjq.exe
  C:\Windows\System\CDvIxjq.exe
  2⤵
  PID:6180
- C:\Windows\System\FcnKvdI.exe
  C:\Windows\System\FcnKvdI.exe
  2⤵
  PID:6216
- C:\Windows\System\ltBlZLO.exe
  C:\Windows\System\ltBlZLO.exe
  2⤵
  PID:6248
- C:\Windows\System\vhBLKTj.exe
  C:\Windows\System\vhBLKTj.exe
  2⤵
  PID:6284
- C:\Windows\System\VBNCICH.exe
  C:\Windows\System\VBNCICH.exe
  2⤵
  PID:6356
- C:\Windows\System\njWDuiq.exe
  C:\Windows\System\njWDuiq.exe
  2⤵
  PID:6380
- C:\Windows\System\YiCtqCo.exe
  C:\Windows\System\YiCtqCo.exe
  2⤵
  PID:6444
- C:\Windows\System\cnzdxJA.exe
  C:\Windows\System\cnzdxJA.exe
  2⤵
  PID:6488
- C:\Windows\System\YywogAP.exe
  C:\Windows\System\YywogAP.exe
  2⤵
  PID:6552
- C:\Windows\System\uhmnHzn.exe
  C:\Windows\System\uhmnHzn.exe
  2⤵
  PID:6592
- C:\Windows\System\celOoHx.exe
  C:\Windows\System\celOoHx.exe
  2⤵
  PID:6720
- C:\Windows\System\bJuOxnC.exe
  C:\Windows\System\bJuOxnC.exe
  2⤵
  PID:6736
- C:\Windows\System\itGkNit.exe
  C:\Windows\System\itGkNit.exe
  2⤵
  PID:6912
- C:\Windows\System\dsdZKzM.exe
  C:\Windows\System\dsdZKzM.exe
  2⤵
  PID:6932
- C:\Windows\System\VUFCAKq.exe
  C:\Windows\System\VUFCAKq.exe
  2⤵
  PID:7036
- C:\Windows\System\KfLLvzE.exe
  C:\Windows\System\KfLLvzE.exe
  2⤵
  PID:7080
- C:\Windows\System\cdrnONY.exe
  C:\Windows\System\cdrnONY.exe
  2⤵
  PID:7132
- C:\Windows\System\lllTXug.exe
  C:\Windows\System\lllTXug.exe
  2⤵
  PID:6168
- C:\Windows\System\ZfQaoyT.exe
  C:\Windows\System\ZfQaoyT.exe
  2⤵
  PID:6408
- C:\Windows\System\raBChBx.exe
  C:\Windows\System\raBChBx.exe
  2⤵
  PID:6536
- C:\Windows\System\lxNlPkT.exe
  C:\Windows\System\lxNlPkT.exe
  2⤵
  PID:6668
- C:\Windows\System\bAWjvjy.exe
  C:\Windows\System\bAWjvjy.exe
  2⤵
  PID:6848
- C:\Windows\System\ONeVmsb.exe
  C:\Windows\System\ONeVmsb.exe
  2⤵
  PID:6976
- C:\Windows\System\YKVOmug.exe
  C:\Windows\System\YKVOmug.exe
  2⤵
  PID:6540
- C:\Windows\System\CZdaMfF.exe
  C:\Windows\System\CZdaMfF.exe
  2⤵
  PID:6992
- C:\Windows\System\CfagHYJ.exe
  C:\Windows\System\CfagHYJ.exe
  2⤵
  PID:6196
- C:\Windows\System\CMXbulj.exe
  C:\Windows\System\CMXbulj.exe
  2⤵
  PID:6936
- C:\Windows\System\yIEpDmN.exe
  C:\Windows\System\yIEpDmN.exe
  2⤵
  PID:7196
- C:\Windows\System\ctzXxvz.exe
  C:\Windows\System\ctzXxvz.exe
  2⤵
  PID:7216
- C:\Windows\System\prNGWYI.exe
  C:\Windows\System\prNGWYI.exe
  2⤵
  PID:7232
- C:\Windows\System\VykLNfZ.exe
  C:\Windows\System\VykLNfZ.exe
  2⤵
  PID:7252
- C:\Windows\System\oheIEEo.exe
  C:\Windows\System\oheIEEo.exe
  2⤵
  PID:7276
- C:\Windows\System\UKgCuvP.exe
  C:\Windows\System\UKgCuvP.exe
  2⤵
  PID:7320
- C:\Windows\System\pROSAOY.exe
  C:\Windows\System\pROSAOY.exe
  2⤵
  PID:7340
- C:\Windows\System\AFqzYfp.exe
  C:\Windows\System\AFqzYfp.exe
  2⤵
  PID:7376
- C:\Windows\System\wfvwZPa.exe
  C:\Windows\System\wfvwZPa.exe
  2⤵
  PID:7396
- C:\Windows\System\GRYMdET.exe
  C:\Windows\System\GRYMdET.exe
  2⤵
  PID:7424
- C:\Windows\System\XSGtZUM.exe
  C:\Windows\System\XSGtZUM.exe
  2⤵
  PID:7448
- C:\Windows\System\VQHPgoh.exe
  C:\Windows\System\VQHPgoh.exe
  2⤵
  PID:7468
- C:\Windows\System\rdCKwNy.exe
  C:\Windows\System\rdCKwNy.exe
  2⤵
  PID:7516
- C:\Windows\System\EAdJvjn.exe
  C:\Windows\System\EAdJvjn.exe
  2⤵
  PID:7536
- C:\Windows\System\egnejkk.exe
  C:\Windows\System\egnejkk.exe
  2⤵
  PID:7556
- C:\Windows\System\srsbXBn.exe
  C:\Windows\System\srsbXBn.exe
  2⤵
  PID:7580
- C:\Windows\System\RRrLjKf.exe
  C:\Windows\System\RRrLjKf.exe
  2⤵
  PID:7620
- C:\Windows\System\AcYZKXC.exe
  C:\Windows\System\AcYZKXC.exe
  2⤵
  PID:7672
- C:\Windows\System\wZpdgYl.exe
  C:\Windows\System\wZpdgYl.exe
  2⤵
  PID:7696
- C:\Windows\System\voVXuMM.exe
  C:\Windows\System\voVXuMM.exe
  2⤵
  PID:7736
- C:\Windows\System\EblshRH.exe
  C:\Windows\System\EblshRH.exe
  2⤵
  PID:7760
- C:\Windows\System\lYZXdgz.exe
  C:\Windows\System\lYZXdgz.exe
  2⤵
  PID:7780
- C:\Windows\System\dxqexRM.exe
  C:\Windows\System\dxqexRM.exe
  2⤵
  PID:7800
- C:\Windows\System\tRpYsIk.exe
  C:\Windows\System\tRpYsIk.exe
  2⤵
  PID:7824
- C:\Windows\System\hhSEtCF.exe
  C:\Windows\System\hhSEtCF.exe
  2⤵
  PID:7844
- C:\Windows\System\eADQeXr.exe
  C:\Windows\System\eADQeXr.exe
  2⤵
  PID:7892
- C:\Windows\System\Ieuxfrr.exe
  C:\Windows\System\Ieuxfrr.exe
  2⤵
  PID:7912
- C:\Windows\System\PjRKstF.exe
  C:\Windows\System\PjRKstF.exe
  2⤵
  PID:7936
- C:\Windows\System\yBGQMfG.exe
  C:\Windows\System\yBGQMfG.exe
  2⤵
  PID:7952
- C:\Windows\System\eQWInOq.exe
  C:\Windows\System\eQWInOq.exe
  2⤵
  PID:7972
- C:\Windows\System\kazRZLz.exe
  C:\Windows\System\kazRZLz.exe
  2⤵
  PID:8000
- C:\Windows\System\yfCrjDn.exe
  C:\Windows\System\yfCrjDn.exe
  2⤵
  PID:8032
- C:\Windows\System\agfyyBq.exe
  C:\Windows\System\agfyyBq.exe
  2⤵
  PID:8056
- C:\Windows\System\fviyDTj.exe
  C:\Windows\System\fviyDTj.exe
  2⤵
  PID:8076
- C:\Windows\System\rBdcMbf.exe
  C:\Windows\System\rBdcMbf.exe
  2⤵
  PID:8100
- C:\Windows\System\Denfacy.exe
  C:\Windows\System\Denfacy.exe
  2⤵
  PID:8152
- C:\Windows\System\HiRTMrd.exe
  C:\Windows\System\HiRTMrd.exe
  2⤵
  PID:8176
- C:\Windows\System\HlDfDGd.exe
  C:\Windows\System\HlDfDGd.exe
  2⤵
  PID:7260
- C:\Windows\System\Engfpyn.exe
  C:\Windows\System\Engfpyn.exe
  2⤵
  PID:7300
- C:\Windows\System\taUKNYm.exe
  C:\Windows\System\taUKNYm.exe
  2⤵
  PID:7404
- C:\Windows\System\IlPffvP.exe
  C:\Windows\System\IlPffvP.exe
  2⤵
  PID:7440
- C:\Windows\System\rpLDjjP.exe
  C:\Windows\System\rpLDjjP.exe
  2⤵
  PID:7464
- C:\Windows\System\PiIiptK.exe
  C:\Windows\System\PiIiptK.exe
  2⤵
  PID:7568
- C:\Windows\System\zlBQQQL.exe
  C:\Windows\System\zlBQQQL.exe
  2⤵
  PID:7644
- C:\Windows\System\gMlTmGJ.exe
  C:\Windows\System\gMlTmGJ.exe
  2⤵
  PID:7680
- C:\Windows\System\rqEAklN.exe
  C:\Windows\System\rqEAklN.exe
  2⤵
  PID:6752
- C:\Windows\System\cpGDhQv.exe
  C:\Windows\System\cpGDhQv.exe
  2⤵
  PID:7808
- C:\Windows\System\vsNXioH.exe
  C:\Windows\System\vsNXioH.exe
  2⤵
  PID:7864
- C:\Windows\System\OuPMSCS.exe
  C:\Windows\System\OuPMSCS.exe
  2⤵
  PID:7980
- C:\Windows\System\yVYBUVR.exe
  C:\Windows\System\yVYBUVR.exe
  2⤵
  PID:8008
- C:\Windows\System\dOoXcVs.exe
  C:\Windows\System\dOoXcVs.exe
  2⤵
  PID:8044
- C:\Windows\System\UJxTANI.exe
  C:\Windows\System\UJxTANI.exe
  2⤵
  PID:8040
- C:\Windows\System\tjVmjiI.exe
  C:\Windows\System\tjVmjiI.exe
  2⤵
  PID:8092
- C:\Windows\System\YahofRj.exe
  C:\Windows\System\YahofRj.exe
  2⤵
  PID:8172
- C:\Windows\System\qJbncTN.exe
  C:\Windows\System\qJbncTN.exe
  2⤵
  PID:7336
- C:\Windows\System\IUCNIpV.exe
  C:\Windows\System\IUCNIpV.exe
  2⤵
  PID:7552
- C:\Windows\System\QHSOGtA.exe
  C:\Windows\System\QHSOGtA.exe
  2⤵
  PID:7668
- C:\Windows\System\ujuOHZK.exe
  C:\Windows\System\ujuOHZK.exe
  2⤵
  PID:7928
- C:\Windows\System\rKDohsd.exe
  C:\Windows\System\rKDohsd.exe
  2⤵
  PID:8024
- C:\Windows\System\bqrHjVR.exe
  C:\Windows\System\bqrHjVR.exe
  2⤵
  PID:8084
- C:\Windows\System\TjFNuGs.exe
  C:\Windows\System\TjFNuGs.exe
  2⤵
  PID:7208
- C:\Windows\System\LAmjrBD.exe
  C:\Windows\System\LAmjrBD.exe
  2⤵
  PID:7752
- C:\Windows\System\qrbWTsm.exe
  C:\Windows\System\qrbWTsm.exe
  2⤵
  PID:7856
- C:\Windows\System\gnKHdpZ.exe
  C:\Windows\System\gnKHdpZ.exe
  2⤵
  PID:8208
- C:\Windows\System\iLIgIOx.exe
  C:\Windows\System\iLIgIOx.exe
  2⤵
  PID:8248
- C:\Windows\System\jpSLHWx.exe
  C:\Windows\System\jpSLHWx.exe
  2⤵
  PID:8276
- C:\Windows\System\OcVxTum.exe
  C:\Windows\System\OcVxTum.exe
  2⤵
  PID:8300
- C:\Windows\System\houscuv.exe
  C:\Windows\System\houscuv.exe
  2⤵
  PID:8316
- C:\Windows\System\OAcFdiI.exe
  C:\Windows\System\OAcFdiI.exe
  2⤵
  PID:8336
- C:\Windows\System\ppuqNva.exe
  C:\Windows\System\ppuqNva.exe
  2⤵
  PID:8356
- C:\Windows\System\qkkcufx.exe
  C:\Windows\System\qkkcufx.exe
  2⤵
  PID:8404
- C:\Windows\System\QawRlZh.exe
  C:\Windows\System\QawRlZh.exe
  2⤵
  PID:8440
- C:\Windows\System\ugVeMhG.exe
  C:\Windows\System\ugVeMhG.exe
  2⤵
  PID:8460
- C:\Windows\System\ADGTLnn.exe
  C:\Windows\System\ADGTLnn.exe
  2⤵
  PID:8484
- C:\Windows\System\DxPOZwk.exe
  C:\Windows\System\DxPOZwk.exe
  2⤵
  PID:8504
- C:\Windows\System\vTkuWbT.exe
  C:\Windows\System\vTkuWbT.exe
  2⤵
  PID:8532
- C:\Windows\System\SaaAuoC.exe
  C:\Windows\System\SaaAuoC.exe
  2⤵
  PID:8552
- C:\Windows\System\EQVZdbB.exe
  C:\Windows\System\EQVZdbB.exe
  2⤵
  PID:8580
- C:\Windows\System\FnWYOMs.exe
  C:\Windows\System\FnWYOMs.exe
  2⤵
  PID:8604
- C:\Windows\System\AEogAJO.exe
  C:\Windows\System\AEogAJO.exe
  2⤵
  PID:8648
- C:\Windows\System\LJphbmN.exe
  C:\Windows\System\LJphbmN.exe
  2⤵
  PID:8672
- C:\Windows\System\MviKJrI.exe
  C:\Windows\System\MviKJrI.exe
  2⤵
  PID:8708
- C:\Windows\System\waxDYlR.exe
  C:\Windows\System\waxDYlR.exe
  2⤵
  PID:8748
- C:\Windows\System\sjUqEdD.exe
  C:\Windows\System\sjUqEdD.exe
  2⤵
  PID:8780
- C:\Windows\System\wNoGMYZ.exe
  C:\Windows\System\wNoGMYZ.exe
  2⤵
  PID:8800
- C:\Windows\System\NGSAgak.exe
  C:\Windows\System\NGSAgak.exe
  2⤵
  PID:8852
- C:\Windows\System\xoZaCan.exe
  C:\Windows\System\xoZaCan.exe
  2⤵
  PID:8872
- C:\Windows\System\jiucUEi.exe
  C:\Windows\System\jiucUEi.exe
  2⤵
  PID:8896
- C:\Windows\System\DUuOMgs.exe
  C:\Windows\System\DUuOMgs.exe
  2⤵
  PID:8920
- C:\Windows\System\kXHXrWr.exe
  C:\Windows\System\kXHXrWr.exe
  2⤵
  PID:8940
- C:\Windows\System\fMhLyiF.exe
  C:\Windows\System\fMhLyiF.exe
  2⤵
  PID:9008
- C:\Windows\System\PbEwNzd.exe
  C:\Windows\System\PbEwNzd.exe
  2⤵
  PID:9024
- C:\Windows\System\oSYQVPB.exe
  C:\Windows\System\oSYQVPB.exe
  2⤵
  PID:9048
- C:\Windows\System\IiPFgPq.exe
  C:\Windows\System\IiPFgPq.exe
  2⤵
  PID:9080
- C:\Windows\System\dMHdueN.exe
  C:\Windows\System\dMHdueN.exe
  2⤵
  PID:9104
- C:\Windows\System\WASGgzT.exe
  C:\Windows\System\WASGgzT.exe
  2⤵
  PID:9156
- C:\Windows\System\geNpryR.exe
  C:\Windows\System\geNpryR.exe
  2⤵
  PID:9176
- C:\Windows\System\BqCqVCg.exe
  C:\Windows\System\BqCqVCg.exe
  2⤵
  PID:9192
- C:\Windows\System\mwFOvVN.exe
  C:\Windows\System\mwFOvVN.exe
  2⤵
  PID:7748
- C:\Windows\System\HydGzlQ.exe
  C:\Windows\System\HydGzlQ.exe
  2⤵
  PID:7432
- C:\Windows\System\TsTQjRz.exe
  C:\Windows\System\TsTQjRz.exe
  2⤵
  PID:8328
- C:\Windows\System\TcZEfvz.exe
  C:\Windows\System\TcZEfvz.exe
  2⤵
  PID:8376
- C:\Windows\System\kFbUnIy.exe
  C:\Windows\System\kFbUnIy.exe
  2⤵
  PID:8452
- C:\Windows\System\pIJRDPt.exe
  C:\Windows\System\pIJRDPt.exe
  2⤵
  PID:8476
- C:\Windows\System\rUkjgzs.exe
  C:\Windows\System\rUkjgzs.exe
  2⤵
  PID:8520
- C:\Windows\System\WwYILtj.exe
  C:\Windows\System\WwYILtj.exe
  2⤵
  PID:8576
- C:\Windows\System\rtEERHC.exe
  C:\Windows\System\rtEERHC.exe
  2⤵
  PID:8664
- C:\Windows\System\EETWSwo.exe
  C:\Windows\System\EETWSwo.exe
  2⤵
  PID:8720
- C:\Windows\System\TXMbQDJ.exe
  C:\Windows\System\TXMbQDJ.exe
  2⤵
  PID:8756
- C:\Windows\System\BMsPaAc.exe
  C:\Windows\System\BMsPaAc.exe
  2⤵
  PID:8860
- C:\Windows\System\MpwvHrM.exe
  C:\Windows\System\MpwvHrM.exe
  2⤵
  PID:8864
- C:\Windows\System\wjdieVM.exe
  C:\Windows\System\wjdieVM.exe
  2⤵
  PID:8916
- C:\Windows\System\IBqitKn.exe
  C:\Windows\System\IBqitKn.exe
  2⤵
  PID:9056
- C:\Windows\System\gnbnrSL.exe
  C:\Windows\System\gnbnrSL.exe
  2⤵
  PID:9132
- C:\Windows\System\XpIQAfG.exe
  C:\Windows\System\XpIQAfG.exe
  2⤵
  PID:9208
- C:\Windows\System\qlkwOhr.exe
  C:\Windows\System\qlkwOhr.exe
  2⤵
  PID:8260
- C:\Windows\System\nbRItEv.exe
  C:\Windows\System\nbRItEv.exe
  2⤵
  PID:8352
- C:\Windows\System\vlBymoX.exe
  C:\Windows\System\vlBymoX.exe
  2⤵
  PID:8540
- C:\Windows\System\BMAPtYP.exe
  C:\Windows\System\BMAPtYP.exe
  2⤵
  PID:8640
- C:\Windows\System\OVAFBTj.exe
  C:\Windows\System\OVAFBTj.exe
  2⤵
  PID:8844
- C:\Windows\System\iMazvdY.exe
  C:\Windows\System\iMazvdY.exe
  2⤵
  PID:9016
- C:\Windows\System\kMOnPrl.exe
  C:\Windows\System\kMOnPrl.exe
  2⤵
  PID:8512
- C:\Windows\System\ZogXRMD.exe
  C:\Windows\System\ZogXRMD.exe
  2⤵
  PID:8348
- C:\Windows\System\WazJbAY.exe
  C:\Windows\System\WazJbAY.exe
  2⤵
  PID:8256
- C:\Windows\System\FFiuYQH.exe
  C:\Windows\System\FFiuYQH.exe
  2⤵
  PID:8500
- C:\Windows\System\HFseXld.exe
  C:\Windows\System\HFseXld.exe
  2⤵
  PID:9220
- C:\Windows\System\MjuQXhY.exe
  C:\Windows\System\MjuQXhY.exe
  2⤵
  PID:9268
- C:\Windows\System\titNFkp.exe
  C:\Windows\System\titNFkp.exe
  2⤵
  PID:9284
- C:\Windows\System\QVLfAEm.exe
  C:\Windows\System\QVLfAEm.exe
  2⤵
  PID:9324
- C:\Windows\System\MQjrIdl.exe
  C:\Windows\System\MQjrIdl.exe
  2⤵
  PID:9344
- C:\Windows\System\CFqTUsN.exe
  C:\Windows\System\CFqTUsN.exe
  2⤵
  PID:9368
- C:\Windows\System\SyEVbeN.exe
  C:\Windows\System\SyEVbeN.exe
  2⤵
  PID:9388
- C:\Windows\System\VlCdPjf.exe
  C:\Windows\System\VlCdPjf.exe
  2⤵
  PID:9404
- C:\Windows\System\hYSktCI.exe
  C:\Windows\System\hYSktCI.exe
  2⤵
  PID:9428
- C:\Windows\System\mxphQWv.exe
  C:\Windows\System\mxphQWv.exe
  2⤵
  PID:9448
- C:\Windows\System\PljRzjn.exe
  C:\Windows\System\PljRzjn.exe
  2⤵
  PID:9476
- C:\Windows\System\mwxwrEj.exe
  C:\Windows\System\mwxwrEj.exe
  2⤵
  PID:9496
- C:\Windows\System\gjueMUH.exe
  C:\Windows\System\gjueMUH.exe
  2⤵
  PID:9536
- C:\Windows\System\LhQpywr.exe
  C:\Windows\System\LhQpywr.exe
  2⤵
  PID:9572
- C:\Windows\System\ilPlDrB.exe
  C:\Windows\System\ilPlDrB.exe
  2⤵
  PID:9616
- C:\Windows\System\tlPFVSa.exe
  C:\Windows\System\tlPFVSa.exe
  2⤵
  PID:9708
- C:\Windows\System\EoGTeTe.exe
  C:\Windows\System\EoGTeTe.exe
  2⤵
  PID:9724
- C:\Windows\System\CAAeeWV.exe
  C:\Windows\System\CAAeeWV.exe
  2⤵
  PID:9740
- C:\Windows\System\rCVODmE.exe
  C:\Windows\System\rCVODmE.exe
  2⤵
  PID:9756
- C:\Windows\System\cgdLjHU.exe
  C:\Windows\System\cgdLjHU.exe
  2⤵
  PID:9772
- C:\Windows\System\hxPPMoo.exe
  C:\Windows\System\hxPPMoo.exe
  2⤵
  PID:9788
- C:\Windows\System\dUxCPCh.exe
  C:\Windows\System\dUxCPCh.exe
  2⤵
  PID:9804
- C:\Windows\System\WANxkkm.exe
  C:\Windows\System\WANxkkm.exe
  2⤵
  PID:9820
- C:\Windows\System\QxQDBph.exe
  C:\Windows\System\QxQDBph.exe
  2⤵
  PID:9840
- C:\Windows\System\cdIMXzQ.exe
  C:\Windows\System\cdIMXzQ.exe
  2⤵
  PID:9856
- C:\Windows\System\WXESOMz.exe
  C:\Windows\System\WXESOMz.exe
  2⤵
  PID:9872
- C:\Windows\System\xETRqAD.exe
  C:\Windows\System\xETRqAD.exe
  2⤵
  PID:9948
- C:\Windows\System\eqBkrAo.exe
  C:\Windows\System\eqBkrAo.exe
  2⤵
  PID:9968
- C:\Windows\System\vyTOBXe.exe
  C:\Windows\System\vyTOBXe.exe
  2⤵
  PID:10024
- C:\Windows\System\yDFIbfP.exe
  C:\Windows\System\yDFIbfP.exe
  2⤵
  PID:10136
- C:\Windows\System\VqYCCyy.exe
  C:\Windows\System\VqYCCyy.exe
  2⤵
  PID:10160
- C:\Windows\System\aUHOYzv.exe
  C:\Windows\System\aUHOYzv.exe
  2⤵
  PID:10200
- C:\Windows\System\GBpPjLJ.exe
  C:\Windows\System\GBpPjLJ.exe
  2⤵
  PID:10224
- C:\Windows\System\LVRJAOz.exe
  C:\Windows\System\LVRJAOz.exe
  2⤵
  PID:9244
- C:\Windows\System\pSlHzVQ.exe
  C:\Windows\System\pSlHzVQ.exe
  2⤵
  PID:9280
- C:\Windows\System\FolIwYw.exe
  C:\Windows\System\FolIwYw.exe
  2⤵
  PID:9364
- C:\Windows\System\IhhCWfu.exe
  C:\Windows\System\IhhCWfu.exe
  2⤵
  PID:9464
- C:\Windows\System\IQiLwDy.exe
  C:\Windows\System\IQiLwDy.exe
  2⤵
  PID:9492
- C:\Windows\System\xhqGgQv.exe
  C:\Windows\System\xhqGgQv.exe
  2⤵
  PID:9548
- C:\Windows\System\nkiyQVX.exe
  C:\Windows\System\nkiyQVX.exe
  2⤵
  PID:9612
- C:\Windows\System\XpmnYsE.exe
  C:\Windows\System\XpmnYsE.exe
  2⤵
  PID:9812
- C:\Windows\System\HTtloQD.exe
  C:\Windows\System\HTtloQD.exe
  2⤵
  PID:9904
- C:\Windows\System\EXKKCui.exe
  C:\Windows\System\EXKKCui.exe
  2⤵
  PID:9716
- C:\Windows\System\suEYNZt.exe
  C:\Windows\System\suEYNZt.exe
  2⤵
  PID:9828
- C:\Windows\System\ryQlGEg.exe
  C:\Windows\System\ryQlGEg.exe
  2⤵
  PID:9916
- C:\Windows\System\fSIUnEw.exe
  C:\Windows\System\fSIUnEw.exe
  2⤵
  PID:9768
- C:\Windows\System\meziLsB.exe
  C:\Windows\System\meziLsB.exe
  2⤵
  PID:9868
- C:\Windows\System\CSvUMGo.exe
  C:\Windows\System\CSvUMGo.exe
  2⤵
  PID:10036
- C:\Windows\System\PcJldXD.exe
  C:\Windows\System\PcJldXD.exe
  2⤵
  PID:10068
- C:\Windows\System\KElLMbh.exe
  C:\Windows\System\KElLMbh.exe
  2⤵
  PID:10132
- C:\Windows\System\qAuoQwo.exe
  C:\Windows\System\qAuoQwo.exe
  2⤵
  PID:8932
- C:\Windows\System\LMYMRYs.exe
  C:\Windows\System\LMYMRYs.exe
  2⤵
  PID:8964
- C:\Windows\System\gQCgxXo.exe
  C:\Windows\System\gQCgxXo.exe
  2⤵
  PID:9456
- C:\Windows\System\qlIDpnq.exe
  C:\Windows\System\qlIDpnq.exe
  2⤵
  PID:9424
- C:\Windows\System\pUpRlKj.exe
  C:\Windows\System\pUpRlKj.exe
  2⤵
  PID:9596
- C:\Windows\System\NdNzYRN.exe
  C:\Windows\System\NdNzYRN.exe
  2⤵
  PID:9648
- C:\Windows\System\aAtbTiH.exe
  C:\Windows\System\aAtbTiH.exe
  2⤵
  PID:9764
- C:\Windows\System\piIcFmN.exe
  C:\Windows\System\piIcFmN.exe
  2⤵
  PID:9924
- C:\Windows\System\QTIgTzn.exe
  C:\Windows\System\QTIgTzn.exe
  2⤵
  PID:10196
- C:\Windows\System\mroXQbA.exe
  C:\Windows\System\mroXQbA.exe
  2⤵
  PID:9556
- C:\Windows\System\kYJUyvq.exe
  C:\Windows\System\kYJUyvq.exe
  2⤵
  PID:9528
- C:\Windows\System\EUCVvfs.exe
  C:\Windows\System\EUCVvfs.exe
  2⤵
  PID:9644
- C:\Windows\System\PIBfQUz.exe
  C:\Windows\System\PIBfQUz.exe
  2⤵
  PID:10180
- C:\Windows\System\irDVIdE.exe
  C:\Windows\System\irDVIdE.exe
  2⤵
  PID:10248
- C:\Windows\System\aiWUYwh.exe
  C:\Windows\System\aiWUYwh.exe
  2⤵
  PID:10268
- C:\Windows\System\GNcaqAL.exe
  C:\Windows\System\GNcaqAL.exe
  2⤵
  PID:10296
- C:\Windows\System\aDhJrLA.exe
  C:\Windows\System\aDhJrLA.exe
  2⤵
  PID:10324
- C:\Windows\System\LzQKRmr.exe
  C:\Windows\System\LzQKRmr.exe
  2⤵
  PID:10344
- C:\Windows\System\iizEqGF.exe
  C:\Windows\System\iizEqGF.exe
  2⤵
  PID:10380
- C:\Windows\System\PEPOwRv.exe
  C:\Windows\System\PEPOwRv.exe
  2⤵
  PID:10404
- C:\Windows\System\wPHndPU.exe
  C:\Windows\System\wPHndPU.exe
  2⤵
  PID:10420
- C:\Windows\System\CLKLbzY.exe
  C:\Windows\System\CLKLbzY.exe
  2⤵
  PID:10448
- C:\Windows\System\NVmQzEw.exe
  C:\Windows\System\NVmQzEw.exe
  2⤵
  PID:10468
- C:\Windows\System\DSMqNex.exe
  C:\Windows\System\DSMqNex.exe
  2⤵
  PID:10500
- C:\Windows\System\yEyDnjI.exe
  C:\Windows\System\yEyDnjI.exe
  2⤵
  PID:10524
- C:\Windows\System\ksUyaQE.exe
  C:\Windows\System\ksUyaQE.exe
  2⤵
  PID:10540
- C:\Windows\System\SrqVFGh.exe
  C:\Windows\System\SrqVFGh.exe
  2⤵
  PID:10600
- C:\Windows\System\zSGyNbk.exe
  C:\Windows\System\zSGyNbk.exe
  2⤵
  PID:10616
- C:\Windows\System\LTpIcwF.exe
  C:\Windows\System\LTpIcwF.exe
  2⤵
  PID:10636
- C:\Windows\System\ctxQmXY.exe
  C:\Windows\System\ctxQmXY.exe
  2⤵
  PID:10652
- C:\Windows\System\ImHnMxW.exe
  C:\Windows\System\ImHnMxW.exe
  2⤵
  PID:10668
- C:\Windows\System\EEcMFsL.exe
  C:\Windows\System\EEcMFsL.exe
  2⤵
  PID:10732
- C:\Windows\System\jBenMJF.exe
  C:\Windows\System\jBenMJF.exe
  2⤵
  PID:10768
- C:\Windows\System\lGNdiFg.exe
  C:\Windows\System\lGNdiFg.exe
  2⤵
  PID:10784
- C:\Windows\System\XerFmmA.exe
  C:\Windows\System\XerFmmA.exe
  2⤵
  PID:10808
- C:\Windows\System\ZzNoaWv.exe
  C:\Windows\System\ZzNoaWv.exe
  2⤵
  PID:10868
- C:\Windows\System\qdmMBvS.exe
  C:\Windows\System\qdmMBvS.exe
  2⤵
  PID:10924
- C:\Windows\System\gxAdTSI.exe
  C:\Windows\System\gxAdTSI.exe
  2⤵
  PID:10956
- C:\Windows\System\rReuZnr.exe
  C:\Windows\System\rReuZnr.exe
  2⤵
  PID:10988
- C:\Windows\System\eAhjCXI.exe
  C:\Windows\System\eAhjCXI.exe
  2⤵
  PID:11008
- C:\Windows\System\XvMtdCj.exe
  C:\Windows\System\XvMtdCj.exe
  2⤵
  PID:11036
- C:\Windows\System\bDvjBwQ.exe
  C:\Windows\System\bDvjBwQ.exe
  2⤵
  PID:11072
- C:\Windows\System\UrYJBZD.exe
  C:\Windows\System\UrYJBZD.exe
  2⤵
  PID:11104
- C:\Windows\System\gnxCxXL.exe
  C:\Windows\System\gnxCxXL.exe
  2⤵
  PID:11128
- C:\Windows\System\sdIIuWn.exe
  C:\Windows\System\sdIIuWn.exe
  2⤵
  PID:11148
- C:\Windows\System\bDHDwuE.exe
  C:\Windows\System\bDHDwuE.exe
  2⤵
  PID:11180
- C:\Windows\System\YRzovym.exe
  C:\Windows\System\YRzovym.exe
  2⤵
  PID:11204
- C:\Windows\System\HdCRpnq.exe
  C:\Windows\System\HdCRpnq.exe
  2⤵
  PID:11228
- C:\Windows\System\MuKHMnl.exe
  C:\Windows\System\MuKHMnl.exe
  2⤵
  PID:9352
- C:\Windows\System\fxALwvI.exe
  C:\Windows\System\fxALwvI.exe
  2⤵
  PID:9732
- C:\Windows\System\tjCrbUs.exe
  C:\Windows\System\tjCrbUs.exe
  2⤵
  PID:10304
- C:\Windows\System\SlUpacO.exe
  C:\Windows\System\SlUpacO.exe
  2⤵
  PID:10464
- C:\Windows\System\QgxZckK.exe
  C:\Windows\System\QgxZckK.exe
  2⤵
  PID:10428
- C:\Windows\System\LENvPRy.exe
  C:\Windows\System\LENvPRy.exe
  2⤵
  PID:10460
- C:\Windows\System\DyVQnjU.exe
  C:\Windows\System\DyVQnjU.exe
  2⤵
  PID:10536
- C:\Windows\System\GLGPBoX.exe
  C:\Windows\System\GLGPBoX.exe
  2⤵
  PID:10644
- C:\Windows\System\OIoBfhf.exe
  C:\Windows\System\OIoBfhf.exe
  2⤵
  PID:10700
- C:\Windows\System\CjWUNva.exe
  C:\Windows\System\CjWUNva.exe
  2⤵
  PID:10780
- C:\Windows\System\VXLrFhi.exe
  C:\Windows\System\VXLrFhi.exe
  2⤵
  PID:10744
- C:\Windows\System\KLUGjsN.exe
  C:\Windows\System\KLUGjsN.exe
  2⤵
  PID:10864
- C:\Windows\System\mrTBUmy.exe
  C:\Windows\System\mrTBUmy.exe
  2⤵
  PID:10976
- C:\Windows\System\cvXAWNh.exe
  C:\Windows\System\cvXAWNh.exe
  2⤵
  PID:11028
- C:\Windows\System\sQTcGdE.exe
  C:\Windows\System\sQTcGdE.exe
  2⤵
  PID:11116
- C:\Windows\System\FVdTtxD.exe
  C:\Windows\System\FVdTtxD.exe
  2⤵
  PID:11192
- C:\Windows\System\PVEUPze.exe
  C:\Windows\System\PVEUPze.exe
  2⤵
  PID:11248
- C:\Windows\System\fRMykOW.exe
  C:\Windows\System\fRMykOW.exe
  2⤵
  PID:9896
- C:\Windows\System\JtjBvGv.exe
  C:\Windows\System\JtjBvGv.exe
  2⤵
  PID:10376
- C:\Windows\System\MnFsMia.exe
  C:\Windows\System\MnFsMia.exe
  2⤵
  PID:10492
- C:\Windows\System\yuEvvIE.exe
  C:\Windows\System\yuEvvIE.exe
  2⤵
  PID:10660
- C:\Windows\System\uQGlyFe.exe
  C:\Windows\System\uQGlyFe.exe
  2⤵
  PID:10944
- C:\Windows\System\dRhFBcV.exe
  C:\Windows\System\dRhFBcV.exe
  2⤵
  PID:11000
- C:\Windows\System\Ejqspqw.exe
  C:\Windows\System\Ejqspqw.exe
  2⤵
  PID:11092
- C:\Windows\System\ezkwPre.exe
  C:\Windows\System\ezkwPre.exe
  2⤵
  PID:11200
- C:\Windows\System\sehnMSZ.exe
  C:\Windows\System\sehnMSZ.exe
  2⤵
  PID:10508
- C:\Windows\System\uXSZYnG.exe
  C:\Windows\System\uXSZYnG.exe
  2⤵
  PID:10684
- C:\Windows\System\yVNMqtf.exe
  C:\Windows\System\yVNMqtf.exe
  2⤵
  PID:11080
- C:\Windows\System\dqCtkdC.exe
  C:\Windows\System\dqCtkdC.exe
  2⤵
  PID:2116
- C:\Windows\System\DvxrZOc.exe
  C:\Windows\System\DvxrZOc.exe
  2⤵
  PID:11276
- C:\Windows\System\uxRYYrg.exe
  C:\Windows\System\uxRYYrg.exe
  2⤵
  PID:11304
- C:\Windows\System\rrEpkrS.exe
  C:\Windows\System\rrEpkrS.exe
  2⤵
  PID:11332
- C:\Windows\System\fRqTfoW.exe
  C:\Windows\System\fRqTfoW.exe
  2⤵
  PID:11364
- C:\Windows\System\gvUqlua.exe
  C:\Windows\System\gvUqlua.exe
  2⤵
  PID:11392
- C:\Windows\System\KjaYKER.exe
  C:\Windows\System\KjaYKER.exe
  2⤵
  PID:11424
- C:\Windows\System\jUBTlKA.exe
  C:\Windows\System\jUBTlKA.exe
  2⤵
  PID:11460
- C:\Windows\System\AzOUvec.exe
  C:\Windows\System\AzOUvec.exe
  2⤵
  PID:11480
- C:\Windows\System\QDlrgKE.exe
  C:\Windows\System\QDlrgKE.exe
  2⤵
  PID:11524
- C:\Windows\System\NTvPjFX.exe
  C:\Windows\System\NTvPjFX.exe
  2⤵
  PID:11544
- C:\Windows\System\xKegKaU.exe
  C:\Windows\System\xKegKaU.exe
  2⤵
  PID:11572
- C:\Windows\System\tZKTRbf.exe
  C:\Windows\System\tZKTRbf.exe
  2⤵
  PID:11588
- C:\Windows\System\CemZcdq.exe
  C:\Windows\System\CemZcdq.exe
  2⤵
  PID:11612
- C:\Windows\System\taPFRxz.exe
  C:\Windows\System\taPFRxz.exe
  2⤵
  PID:11636
- C:\Windows\System\iAFpOJk.exe
  C:\Windows\System\iAFpOJk.exe
  2⤵
  PID:11664
- C:\Windows\System\yMFXhiN.exe
  C:\Windows\System\yMFXhiN.exe
  2⤵
  PID:11684
- C:\Windows\System\aqndoHA.exe
  C:\Windows\System\aqndoHA.exe
  2⤵
  PID:11712
- C:\Windows\System\jVlCsKI.exe
  C:\Windows\System\jVlCsKI.exe
  2⤵
  PID:11748
- C:\Windows\System\EYzOzMi.exe
  C:\Windows\System\EYzOzMi.exe
  2⤵
  PID:11772
- C:\Windows\System\JFQuyTN.exe
  C:\Windows\System\JFQuyTN.exe
  2⤵
  PID:11816
- C:\Windows\System\JbuDhAU.exe
  C:\Windows\System\JbuDhAU.exe
  2⤵
  PID:11844
- C:\Windows\System\XWBugul.exe
  C:\Windows\System\XWBugul.exe
  2⤵
  PID:11868
- C:\Windows\System\VHSwQln.exe
  C:\Windows\System\VHSwQln.exe
  2⤵
  PID:11912
- C:\Windows\System\wtpcdoX.exe
  C:\Windows\System\wtpcdoX.exe
  2⤵
  PID:11940
- C:\Windows\System\THZGLuu.exe
  C:\Windows\System\THZGLuu.exe
  2⤵
  PID:11964
- C:\Windows\System\ZHFNMSJ.exe
  C:\Windows\System\ZHFNMSJ.exe
  2⤵
  PID:11984
- C:\Windows\System\TZJbaHl.exe
  C:\Windows\System\TZJbaHl.exe
  2⤵
  PID:12016
- C:\Windows\System\BnyfijB.exe
  C:\Windows\System\BnyfijB.exe
  2⤵
  PID:12036
- C:\Windows\System\ZErtPBO.exe
  C:\Windows\System\ZErtPBO.exe
  2⤵
  PID:12080
- C:\Windows\System\fMxgWQA.exe
  C:\Windows\System\fMxgWQA.exe
  2⤵
  PID:12104
- C:\Windows\System\CRijhrt.exe
  C:\Windows\System\CRijhrt.exe
  2⤵
  PID:12120
- C:\Windows\System\hSquFoN.exe
  C:\Windows\System\hSquFoN.exe
  2⤵
  PID:12144
- C:\Windows\System\gPjFKcv.exe
  C:\Windows\System\gPjFKcv.exe
  2⤵
  PID:12180
- C:\Windows\System\VOHfGoO.exe
  C:\Windows\System\VOHfGoO.exe
  2⤵
  PID:12200
- C:\Windows\System\gYOtVdu.exe
  C:\Windows\System\gYOtVdu.exe
  2⤵
  PID:12272
- C:\Windows\System\fqjcXBY.exe
  C:\Windows\System\fqjcXBY.exe
  2⤵
  PID:10840
- C:\Windows\System\nxFyLTg.exe
  C:\Windows\System\nxFyLTg.exe
  2⤵
  PID:11288
- C:\Windows\System\wvuvAKD.exe
  C:\Windows\System\wvuvAKD.exe
  2⤵
  PID:10332
- C:\Windows\System\YMOyyXs.exe
  C:\Windows\System\YMOyyXs.exe
  2⤵
  PID:11316
- C:\Windows\System\thGUUtC.exe
  C:\Windows\System\thGUUtC.exe
  2⤵
  PID:11372
- C:\Windows\System\iWmmnwP.exe
  C:\Windows\System\iWmmnwP.exe
  2⤵
  PID:11468
- C:\Windows\System\Oxorcim.exe
  C:\Windows\System\Oxorcim.exe
  2⤵
  PID:11536
- C:\Windows\System\EelxGVB.exe
  C:\Windows\System\EelxGVB.exe
  2⤵
  PID:11604
- C:\Windows\System\hlSORil.exe
  C:\Windows\System\hlSORil.exe
  2⤵
  PID:11644
- C:\Windows\System\CLPxZLB.exe
  C:\Windows\System\CLPxZLB.exe
  2⤵
  PID:11732
- C:\Windows\System\xsAYLmo.exe
  C:\Windows\System\xsAYLmo.exe
  2⤵
  PID:11788
- C:\Windows\System\pKFKFgc.exe
  C:\Windows\System\pKFKFgc.exe
  2⤵
  PID:11832
- C:\Windows\System\bEsgYEI.exe
  C:\Windows\System\bEsgYEI.exe
  2⤵
  PID:11952
- C:\Windows\System\GAgCxjN.exe
  C:\Windows\System\GAgCxjN.exe
  2⤵
  PID:12008
- C:\Windows\System\hptJdys.exe
  C:\Windows\System\hptJdys.exe
  2⤵
  PID:12096
- C:\Windows\System\yjnAdnu.exe
  C:\Windows\System\yjnAdnu.exe
  2⤵
  PID:12132
- C:\Windows\System\rUeecRH.exe
  C:\Windows\System\rUeecRH.exe
  2⤵
  PID:12192
- C:\Windows\System\yuzQWax.exe
  C:\Windows\System\yuzQWax.exe
  2⤵
  PID:12240
- C:\Windows\System\Qkiboqe.exe
  C:\Windows\System\Qkiboqe.exe
  2⤵
  PID:408
- C:\Windows\System\leubAxA.exe
  C:\Windows\System\leubAxA.exe
  2⤵
  PID:11120
- C:\Windows\System\cgjMhLh.exe
  C:\Windows\System\cgjMhLh.exe
  2⤵
  PID:11296
- C:\Windows\System\LwLQIxh.exe
  C:\Windows\System\LwLQIxh.exe
  2⤵
  PID:11564
- C:\Windows\System\bfOaxMW.exe
  C:\Windows\System\bfOaxMW.exe
  2⤵
  PID:11600
- C:\Windows\System\vDfhVef.exe
  C:\Windows\System\vDfhVef.exe
  2⤵
  PID:11708
- C:\Windows\System\XfIPdKz.exe
  C:\Windows\System\XfIPdKz.exe
  2⤵
  PID:12076
- C:\Windows\System\TQFIkSW.exe
  C:\Windows\System\TQFIkSW.exe
  2⤵
  PID:12268
- C:\Windows\System\qhFDmZc.exe
  C:\Windows\System\qhFDmZc.exe
  2⤵
  PID:11344
- C:\Windows\System\QXwKuSp.exe
  C:\Windows\System\QXwKuSp.exe
  2⤵
  PID:12032
- C:\Windows\System\ZrRXHPT.exe
  C:\Windows\System\ZrRXHPT.exe
  2⤵
  PID:208
- C:\Windows\System\QQcbrFO.exe
  C:\Windows\System\QQcbrFO.exe
  2⤵
  PID:11960
- C:\Windows\System\hopuZdd.exe
  C:\Windows\System\hopuZdd.exe
  2⤵
  PID:12312
- C:\Windows\System\xkvLbsy.exe
  C:\Windows\System\xkvLbsy.exe
  2⤵
  PID:12340
- C:\Windows\System\QUQUQJT.exe
  C:\Windows\System\QUQUQJT.exe
  2⤵
  PID:12360
- C:\Windows\System\rLbxkLQ.exe
  C:\Windows\System\rLbxkLQ.exe
  2⤵
  PID:12380
- C:\Windows\System\zEndzHq.exe
  C:\Windows\System\zEndzHq.exe
  2⤵
  PID:12400
- C:\Windows\System\ydIPwFg.exe
  C:\Windows\System\ydIPwFg.exe
  2⤵
  PID:12424
- C:\Windows\System\CCzeVBA.exe
  C:\Windows\System\CCzeVBA.exe
  2⤵
  PID:12456
- C:\Windows\System\pfetTVj.exe
  C:\Windows\System\pfetTVj.exe
  2⤵
  PID:12492
- C:\Windows\System\oewPdqU.exe
  C:\Windows\System\oewPdqU.exe
  2⤵
  PID:12532
- C:\Windows\System\Vdntuwo.exe
  C:\Windows\System\Vdntuwo.exe
  2⤵
  PID:12552
- C:\Windows\System\nHDSEmR.exe
  C:\Windows\System\nHDSEmR.exe
  2⤵
  PID:12584
- C:\Windows\System\nwaLJIh.exe
  C:\Windows\System\nwaLJIh.exe
  2⤵
  PID:12616
- C:\Windows\System\OwMgyhx.exe
  C:\Windows\System\OwMgyhx.exe
  2⤵
  PID:12636
- C:\Windows\System\Mchigub.exe
  C:\Windows\System\Mchigub.exe
  2⤵
  PID:12664
- C:\Windows\System\CQcbOVV.exe
  C:\Windows\System\CQcbOVV.exe
  2⤵
  PID:12692
- C:\Windows\System\glxAYrI.exe
  C:\Windows\System\glxAYrI.exe
  2⤵
  PID:12736
- C:\Windows\System\OlQudbp.exe
  C:\Windows\System\OlQudbp.exe
  2⤵
  PID:12752
- C:\Windows\System\KKRduBI.exe
  C:\Windows\System\KKRduBI.exe
  2⤵
  PID:12780
- C:\Windows\System\gfmfRlD.exe
  C:\Windows\System\gfmfRlD.exe
  2⤵
  PID:12796
- C:\Windows\System\KfzNrIR.exe
  C:\Windows\System\KfzNrIR.exe
  2⤵
  PID:12824
- C:\Windows\System\BRCYNeu.exe
  C:\Windows\System\BRCYNeu.exe
  2⤵
  PID:12844
- C:\Windows\System\EMQmDXG.exe
  C:\Windows\System\EMQmDXG.exe
  2⤵
  PID:12864
- C:\Windows\System\zEuoINc.exe
  C:\Windows\System\zEuoINc.exe
  2⤵
  PID:12884
- C:\Windows\System\ipHMhRm.exe
  C:\Windows\System\ipHMhRm.exe
  2⤵
  PID:12928
- C:\Windows\System\vNdvxwt.exe
  C:\Windows\System\vNdvxwt.exe
  2⤵
  PID:12952
- C:\Windows\System\VhbYGwb.exe
  C:\Windows\System\VhbYGwb.exe
  2⤵
  PID:13008
- C:\Windows\System\mMRTRgZ.exe
  C:\Windows\System\mMRTRgZ.exe
  2⤵
  PID:13024
- C:\Windows\System\ZnGURAL.exe
  C:\Windows\System\ZnGURAL.exe
  2⤵
  PID:13052
- C:\Windows\System\TEUwqdK.exe
  C:\Windows\System\TEUwqdK.exe
  2⤵
  PID:13092
- C:\Windows\System\UgsJmSX.exe
  C:\Windows\System\UgsJmSX.exe
  2⤵
  PID:13128
- C:\Windows\System\gnblRGk.exe
  C:\Windows\System\gnblRGk.exe
  2⤵
  PID:13148
- C:\Windows\System\tRoupxV.exe
  C:\Windows\System\tRoupxV.exe
  2⤵
  PID:13180
- C:\Windows\System\hkzUFtt.exe
  C:\Windows\System\hkzUFtt.exe
  2⤵
  PID:13224
- C:\Windows\System\PjkaZke.exe
  C:\Windows\System\PjkaZke.exe
  2⤵
  PID:13248
- C:\Windows\System\pEoPjVW.exe
  C:\Windows\System\pEoPjVW.exe
  2⤵
  PID:13268
- C:\Windows\System\NYdabRO.exe
  C:\Windows\System\NYdabRO.exe
  2⤵
  PID:13300
- C:\Windows\System\AXRwMaf.exe
  C:\Windows\System\AXRwMaf.exe
  2⤵
  PID:12328
- C:\Windows\System\tvNszed.exe
  C:\Windows\System\tvNszed.exe
  2⤵
  PID:12436
- C:\Windows\System\UOXYTfa.exe
  C:\Windows\System\UOXYTfa.exe
  2⤵
  PID:12476
- C:\Windows\System\lViQlRr.exe
  C:\Windows\System\lViQlRr.exe
  2⤵
  PID:12600
- C:\Windows\System\ZswpegS.exe
  C:\Windows\System\ZswpegS.exe
  2⤵
  PID:12644
- C:\Windows\System\DlnaOYG.exe
  C:\Windows\System\DlnaOYG.exe
  2⤵
  PID:12704
- C:\Windows\System\vXlSVSH.exe
  C:\Windows\System\vXlSVSH.exe
  2⤵
  PID:12792
- C:\Windows\System\LmjZVUw.exe
  C:\Windows\System\LmjZVUw.exe
  2⤵
  PID:12860
- C:\Windows\System\bPrRBJT.exe
  C:\Windows\System\bPrRBJT.exe
  2⤵
  PID:12880
- C:\Windows\System\oGLAUSq.exe
  C:\Windows\System\oGLAUSq.exe
  2⤵
  PID:12920
- C:\Windows\System\ivlblUD.exe
  C:\Windows\System\ivlblUD.exe
  2⤵
  PID:12940
- C:\Windows\System\bTxnOoA.exe
  C:\Windows\System\bTxnOoA.exe
  2⤵
  PID:13048
- C:\Windows\System\WMcdxyq.exe
  C:\Windows\System\WMcdxyq.exe
  2⤵
  PID:13112
- C:\Windows\System\MnIAlup.exe
  C:\Windows\System\MnIAlup.exe
  2⤵
  PID:2984
- C:\Windows\System\fklyGOC.exe
  C:\Windows\System\fklyGOC.exe
  2⤵
  PID:13204
- C:\Windows\System\FadCVSc.exe
  C:\Windows\System\FadCVSc.exe
  2⤵
  PID:2556
- C:\Windows\System\hTVNdzZ.exe
  C:\Windows\System\hTVNdzZ.exe
  2⤵
  PID:4916
- C:\Windows\System\qmgMSbQ.exe
  C:\Windows\System\qmgMSbQ.exe
  2⤵
  PID:1516
- C:\Windows\System\oEIiirS.exe
  C:\Windows\System\oEIiirS.exe
  2⤵
  PID:2100
- C:\Windows\System\GfHirLw.exe
  C:\Windows\System\GfHirLw.exe
  2⤵
  PID:12632
- C:\Windows\System\hTvlwfy.exe
  C:\Windows\System\hTvlwfy.exe
  2⤵
  PID:12768
- C:\Windows\System\FdKkSup.exe
  C:\Windows\System\FdKkSup.exe
  2⤵
  PID:12836
- C:\Windows\System\OHpaClm.exe
  C:\Windows\System\OHpaClm.exe
  2⤵
  PID:2912
- C:\Windows\System\cqpMabo.exe
  C:\Windows\System\cqpMabo.exe
  2⤵
  PID:5536
- C:\Windows\System\SQQYJLe.exe
  C:\Windows\System\SQQYJLe.exe
  2⤵
  PID:13244
- C:\Windows\System\sLwxjlz.exe
  C:\Windows\System\sLwxjlz.exe
  2⤵
  PID:3104
- C:\Windows\System\leHtbqF.exe
  C:\Windows\System\leHtbqF.exe
  2⤵
  PID:11472
- C:\Windows\System\MMOabat.exe
  C:\Windows\System\MMOabat.exe
  2⤵
  PID:772
- C:\Windows\System\waZKmeQ.exe
  C:\Windows\System\waZKmeQ.exe
  2⤵
  PID:4964
- C:\Windows\System\MvGdbcv.exe
  C:\Windows\System\MvGdbcv.exe
  2⤵
  PID:1664
- C:\Windows\System\bszMKTQ.exe
  C:\Windows\System\bszMKTQ.exe
  2⤵
  PID:3240
- C:\Windows\System\CMlKETw.exe
  C:\Windows\System\CMlKETw.exe
  2⤵
  PID:11676
- C:\Windows\System\yrejheh.exe
  C:\Windows\System\yrejheh.exe
  2⤵
  PID:1000
- C:\Windows\System\amTfuZa.exe
  C:\Windows\System\amTfuZa.exe
  2⤵
  PID:4616
- C:\Windows\System\oKrTavc.exe
  C:\Windows\System\oKrTavc.exe
  2⤵
  PID:1820
- C:\Windows\System\ELIFdwz.exe
  C:\Windows\System\ELIFdwz.exe
  2⤵
  PID:13324
- C:\Windows\System\ncXJupl.exe
  C:\Windows\System\ncXJupl.exe
  2⤵
  PID:13348
- C:\Windows\System\QMUuYWp.exe
  C:\Windows\System\QMUuYWp.exe
  2⤵
  PID:13372
- C:\Windows\System\kQWWqwx.exe
  C:\Windows\System\kQWWqwx.exe
  2⤵
  PID:13404
- C:\Windows\System\RKUdRIK.exe
  C:\Windows\System\RKUdRIK.exe
  2⤵
  PID:13356
- C:\Windows\System\oZEdDJF.exe
  C:\Windows\System\oZEdDJF.exe
  2⤵
  PID:13968
- C:\Windows\System\lSUjtMV.exe
  C:\Windows\System\lSUjtMV.exe
  2⤵
  PID:14328
- C:\Windows\System\qMWvlPL.exe
  C:\Windows\System\qMWvlPL.exe
  2⤵
  PID:13364
- C:\Windows\System\kEEZuOE.exe
  C:\Windows\System\kEEZuOE.exe
  2⤵
  PID:2328
- C:\Windows\System\aVKoaSm.exe
  C:\Windows\System\aVKoaSm.exe
  2⤵
  PID:6432
- C:\Windows\System\kXIEYlv.exe
  C:\Windows\System\kXIEYlv.exe
  2⤵
  PID:13508
- C:\Windows\System\fmFlpee.exe
  C:\Windows\System\fmFlpee.exe
  2⤵
  PID:13528
- C:\Windows\System\vveGElo.exe
  C:\Windows\System\vveGElo.exe
  2⤵
  PID:13580
- C:\Windows\System\QdyYvoZ.exe
  C:\Windows\System\QdyYvoZ.exe
  2⤵
  PID:6612
- C:\Windows\System\lyHgEQh.exe
  C:\Windows\System\lyHgEQh.exe
  2⤵
  PID:13612
- C:\Windows\System\gfdJYsC.exe
  C:\Windows\System\gfdJYsC.exe
  2⤵
  PID:13644
- C:\Windows\System\HPrfIId.exe
  C:\Windows\System\HPrfIId.exe
  2⤵
  PID:6660
- C:\Windows\System\bAUQGJZ.exe
  C:\Windows\System\bAUQGJZ.exe
  2⤵
  PID:13752
- C:\Windows\System\udHaPZp.exe
  C:\Windows\System\udHaPZp.exe
  2⤵
  PID:13236
- C:\Windows\System\YoSFDRL.exe
  C:\Windows\System\YoSFDRL.exe
  2⤵
  PID:13784
- C:\Windows\System\TqmIwnW.exe
  C:\Windows\System\TqmIwnW.exe
  2⤵
  PID:13804
- C:\Windows\System\kDMVfPV.exe
  C:\Windows\System\kDMVfPV.exe
  2⤵
  PID:13832
- C:\Windows\System\ykTiPAi.exe
  C:\Windows\System\ykTiPAi.exe
  2⤵
  PID:13848
- C:\Windows\System\oIyOtuf.exe
  C:\Windows\System\oIyOtuf.exe
  2⤵
  PID:13876
- C:\Windows\System\rliegVE.exe
  C:\Windows\System\rliegVE.exe
  2⤵
  PID:13908
- C:\Windows\System\XkPEsLY.exe
  C:\Windows\System\XkPEsLY.exe
  2⤵
  PID:2028
- C:\Windows\System\egFcEIh.exe
  C:\Windows\System\egFcEIh.exe
  2⤵
  PID:13932
- C:\Windows\System\ZYWrZJY.exe
  C:\Windows\System\ZYWrZJY.exe
  2⤵
  PID:13956
- C:\Windows\System\BzjLPrx.exe
  C:\Windows\System\BzjLPrx.exe
  2⤵
  PID:14020
- C:\Windows\System\EHrhQiu.exe
  C:\Windows\System\EHrhQiu.exe
  2⤵
  PID:14092
- C:\Windows\System\ZWVIyLY.exe
  C:\Windows\System\ZWVIyLY.exe
  2⤵
  PID:14116
- C:\Windows\System\TYVzwFS.exe
  C:\Windows\System\TYVzwFS.exe
  2⤵
  PID:14128
- C:\Windows\System\mDLYKjm.exe
  C:\Windows\System\mDLYKjm.exe
  2⤵
  PID:14144
- C:\Windows\System\JZBTMqR.exe
  C:\Windows\System\JZBTMqR.exe
  2⤵
  PID:14184
- C:\Windows\System\EAZpygU.exe
  C:\Windows\System\EAZpygU.exe
  2⤵
  PID:14168
- C:\Windows\System\mMsfmdm.exe
  C:\Windows\System\mMsfmdm.exe
  2⤵
  PID:14204
- C:\Windows\System\WQlQcCB.exe
  C:\Windows\System\WQlQcCB.exe
  2⤵
  PID:14236
- C:\Windows\System\uConKYQ.exe
  C:\Windows\System\uConKYQ.exe
  2⤵
  PID:14256
- C:\Windows\System\ytzxZcl.exe
  C:\Windows\System\ytzxZcl.exe
  2⤵
  PID:14276
- C:\Windows\System\xuEjjQy.exe
  C:\Windows\System\xuEjjQy.exe
  2⤵
  PID:12468
- C:\Windows\System\RJmcEpB.exe
  C:\Windows\System\RJmcEpB.exe
  2⤵
  PID:14320
- C:\Windows\System\UULdfRY.exe
  C:\Windows\System\UULdfRY.exe
  2⤵
  PID:13220
- C:\Windows\System\WKhnDRb.exe
  C:\Windows\System\WKhnDRb.exe
  2⤵
  PID:13260
- C:\Windows\System\MRdGDSf.exe
  C:\Windows\System\MRdGDSf.exe
  2⤵
  PID:6588
- C:\Windows\System\XbVnNch.exe
  C:\Windows\System\XbVnNch.exe
  2⤵
  PID:6372
- C:\Windows\System\ZPsHbVa.exe
  C:\Windows\System\ZPsHbVa.exe
  2⤵
  PID:7176
- C:\Windows\System\dnvKjaI.exe
  C:\Windows\System\dnvKjaI.exe
  2⤵
  PID:13416
- C:\Windows\System\NNeqQCc.exe
  C:\Windows\System\NNeqQCc.exe
  2⤵
  PID:7304
- C:\Windows\System\jBmKosp.exe
  C:\Windows\System\jBmKosp.exe
  2⤵
  PID:7384
- C:\Windows\System\WOfOihI.exe
  C:\Windows\System\WOfOihI.exe
  2⤵
  PID:13480
- C:\Windows\System\yWTBGsF.exe
  C:\Windows\System\yWTBGsF.exe
  2⤵
  PID:6456
- C:\Windows\System\uhbxwok.exe
  C:\Windows\System\uhbxwok.exe
  2⤵
  PID:13520
- C:\Windows\System\AhGkUwO.exe
  C:\Windows\System\AhGkUwO.exe
  2⤵
  PID:6480
- C:\Windows\System\akuOTtM.exe
  C:\Windows\System\akuOTtM.exe
  2⤵
  PID:7708
- C:\Windows\System\BSAAgem.exe
  C:\Windows\System\BSAAgem.exe
  2⤵
  PID:4980
- C:\Windows\System\xWfNdBs.exe
  C:\Windows\System\xWfNdBs.exe
  2⤵
  PID:5100
- C:\Windows\System\HGTBnbk.exe
  C:\Windows\System\HGTBnbk.exe
  2⤵
  PID:13656
- C:\Windows\System\TCWTBvi.exe
  C:\Windows\System\TCWTBvi.exe
  2⤵
  PID:8052
- C:\Windows\System\uxCcQgv.exe
  C:\Windows\System\uxCcQgv.exe
  2⤵
  PID:8140
- C:\Windows\System\ZvxrdWb.exe
  C:\Windows\System\ZvxrdWb.exe
  2⤵
  PID:8184
- C:\Windows\System\QZcbUXw.exe
  C:\Windows\System\QZcbUXw.exe
  2⤵
  PID:7332
- C:\Windows\System\XhfRYED.exe
  C:\Windows\System\XhfRYED.exe
  2⤵
  PID:7688
- C:\Windows\System\KGhyJbm.exe
  C:\Windows\System\KGhyJbm.exe
  2⤵
  PID:13620
- C:\Windows\System\CctXUwb.exe
  C:\Windows\System\CctXUwb.exe
  2⤵
  PID:13556
- C:\Windows\System\iQULIVt.exe
  C:\Windows\System\iQULIVt.exe
  2⤵
  PID:2504
- C:\Windows\System\CLvWgNa.exe
  C:\Windows\System\CLvWgNa.exe
  2⤵
  PID:3224
- C:\Windows\System\iJTctRb.exe
  C:\Windows\System\iJTctRb.exe
  2⤵
  PID:13728
- C:\Windows\System\aZDVuoo.exe
  C:\Windows\System\aZDVuoo.exe
  2⤵
  PID:13732
- C:\Windows\System\OwtZViZ.exe
  C:\Windows\System\OwtZViZ.exe
  2⤵
  PID:1636
- C:\Windows\System\cFycYsA.exe
  C:\Windows\System\cFycYsA.exe
  2⤵
  PID:3156
- C:\Windows\System\PDXsGlB.exe
  C:\Windows\System\PDXsGlB.exe
  2⤵
  PID:8224
- C:\Windows\System\FrKXtSt.exe
  C:\Windows\System\FrKXtSt.exe
  2⤵
  PID:8264
- C:\Windows\System\KNwHgAw.exe
  C:\Windows\System\KNwHgAw.exe
  2⤵
  PID:13748
- C:\Windows\System\mKfDpnk.exe
  C:\Windows\System\mKfDpnk.exe
  2⤵
  PID:8372
- C:\Windows\System\GTzXbXM.exe
  C:\Windows\System\GTzXbXM.exe
  2⤵
  PID:13816
- C:\Windows\System\HoetsPo.exe
  C:\Windows\System\HoetsPo.exe
  2⤵
  PID:13940
- C:\Windows\System\bUBPaiz.exe
  C:\Windows\System\bUBPaiz.exe
  2⤵
  PID:13900
- C:\Windows\System\RoalCfD.exe
  C:\Windows\System\RoalCfD.exe
  2⤵
  PID:13872
- C:\Windows\System\PYYqvMs.exe
  C:\Windows\System\PYYqvMs.exe
  2⤵
  PID:464
- C:\Windows\System\VVBLYUx.exe
  C:\Windows\System\VVBLYUx.exe
  2⤵
  PID:14004
- C:\Windows\System\SzhoUxi.exe
  C:\Windows\System\SzhoUxi.exe
  2⤵
  PID:14060
- C:\Windows\System\sJOGaLK.exe
  C:\Windows\System\sJOGaLK.exe
  2⤵
  PID:3732
- C:\Windows\System\IBluvUO.exe
  C:\Windows\System\IBluvUO.exe
  2⤵
  PID:14112
- C:\Windows\System\BpZDuOB.exe
  C:\Windows\System\BpZDuOB.exe
  2⤵
  PID:9040
- C:\Windows\System\HcIzlyM.exe
  C:\Windows\System\HcIzlyM.exe
  2⤵
  PID:7076
- C:\Windows\System\pIUNCxL.exe
  C:\Windows\System\pIUNCxL.exe
  2⤵
  PID:4408
- C:\Windows\System\BVVcNTx.exe
  C:\Windows\System\BVVcNTx.exe
  2⤵
  PID:6508
- C:\Windows\System\VsOGvpE.exe
  C:\Windows\System\VsOGvpE.exe
  2⤵
  PID:12352
- C:\Windows\System\DCSPMAg.exe
  C:\Windows\System\DCSPMAg.exe
  2⤵
  PID:2472
- C:\Windows\System\PXVbCKZ.exe
  C:\Windows\System\PXVbCKZ.exe
  2⤵
  PID:6796
- C:\Windows\System\cgAqPZW.exe
  C:\Windows\System\cgAqPZW.exe
  2⤵
  PID:3172
- C:\Windows\System\DJqKCWS.exe
  C:\Windows\System\DJqKCWS.exe
  2⤵
  PID:3108
- C:\Windows\System\YyXJfvK.exe
  C:\Windows\System\YyXJfvK.exe
  2⤵
  PID:9072
- C:\Windows\System\LPpCOcD.exe
  C:\Windows\System\LPpCOcD.exe
  2⤵
  PID:6424
- C:\Windows\System\LzhPEVH.exe
  C:\Windows\System\LzhPEVH.exe
  2⤵
  PID:9116
- C:\Windows\System\NiUYFPe.exe
  C:\Windows\System\NiUYFPe.exe
  2⤵
  PID:13632
- C:\Windows\System\gFcjEhU.exe
  C:\Windows\System\gFcjEhU.exe
  2⤵
  PID:9308
- C:\Windows\System\cQTdIcu.exe
  C:\Windows\System\cQTdIcu.exe
  2⤵
  PID:2508
- C:\Windows\System\BxlZzQK.exe
  C:\Windows\System\BxlZzQK.exe
  2⤵
  PID:7416
- C:\Windows\System\QhnXbYy.exe
  C:\Windows\System\QhnXbYy.exe
  2⤵
  PID:7768
- C:\Windows\System\spbMbGt.exe
  C:\Windows\System\spbMbGt.exe
  2⤵
  PID:4132
- C:\Windows\System\hbXnmWw.exe
  C:\Windows\System\hbXnmWw.exe
  2⤵
  PID:5160
- C:\Windows\System\ssoDkrP.exe
  C:\Windows\System\ssoDkrP.exe
  2⤵
  PID:13860
- C:\Windows\System\wvubIfZ.exe
  C:\Windows\System\wvubIfZ.exe
  2⤵
  PID:5272
- C:\Windows\System\PCxbPWK.exe
  C:\Windows\System\PCxbPWK.exe
  2⤵
  PID:13952
- C:\Windows\System\mLTzzkT.exe
  C:\Windows\System\mLTzzkT.exe
  2⤵
  PID:7128
- C:\Windows\System\taWMvWO.exe
  C:\Windows\System\taWMvWO.exe
  2⤵
  PID:13744
- C:\Windows\System\vPDRicf.exe
  C:\Windows\System\vPDRicf.exe
  2⤵
  PID:5356
- C:\Windows\System\PLmWzLz.exe
  C:\Windows\System\PLmWzLz.exe
  2⤵
  PID:2524
- C:\Windows\System\URjyydA.exe
  C:\Windows\System\URjyydA.exe
  2⤵
  PID:14108
- C:\Windows\System\RnPBxVP.exe
  C:\Windows\System\RnPBxVP.exe
  2⤵
  PID:10148
- C:\Windows\System\PwMeoNe.exe
  C:\Windows\System\PwMeoNe.exe
  2⤵
  PID:14164
- C:\Windows\System\kYtvKVm.exe
  C:\Windows\System\kYtvKVm.exe
  2⤵
  PID:9112
- C:\Windows\System\WyyuzUv.exe
  C:\Windows\System\WyyuzUv.exe
  2⤵
  PID:9384
- C:\Windows\System\iunnLKz.exe
  C:\Windows\System\iunnLKz.exe
  2⤵
  PID:8124
- C:\Windows\System\qcxvjnk.exe
  C:\Windows\System\qcxvjnk.exe
  2⤵
  PID:1192
- C:\Windows\System\jqZovYA.exe
  C:\Windows\System\jqZovYA.exe
  2⤵
  PID:1676
- C:\Windows\System\LrXQpWr.exe
  C:\Windows\System\LrXQpWr.exe
  2⤵
  PID:5524
- C:\Windows\System\RDxPtQT.exe
  C:\Windows\System\RDxPtQT.exe
  2⤵
  PID:14296
- C:\Windows\System\rcyhRTp.exe
  C:\Windows\System\rcyhRTp.exe
  2⤵
  PID:5608
- C:\Windows\System\HIFZftk.exe
  C:\Windows\System\HIFZftk.exe
  2⤵
  PID:9684
- C:\Windows\System\SgJGWRG.exe
  C:\Windows\System\SgJGWRG.exe
  2⤵
  PID:2300
- C:\Windows\System\iSvFnxl.exe
  C:\Windows\System\iSvFnxl.exe
  2⤵
  PID:5664
- C:\Windows\System\fifkznT.exe
  C:\Windows\System\fifkznT.exe
  2⤵
  PID:10172
- C:\Windows\System\RyCsWZT.exe
  C:\Windows\System\RyCsWZT.exe
  2⤵
  PID:5764
- C:\Windows\System\Pqfzigu.exe
  C:\Windows\System\Pqfzigu.exe
  2⤵
  PID:8596
- C:\Windows\System\gKtCFdr.exe
  C:\Windows\System\gKtCFdr.exe
  2⤵
  PID:7788
- C:\Windows\System\nUgvGOH.exe
  C:\Windows\System\nUgvGOH.exe
  2⤵
  PID:1396
- C:\Windows\System\nqbtYke.exe
  C:\Windows\System\nqbtYke.exe
  2⤵
  PID:1964
- C:\Windows\System\PaUAyHz.exe
  C:\Windows\System\PaUAyHz.exe
  2⤵
  PID:10308
- C:\Windows\System\NfFVdvi.exe
  C:\Windows\System\NfFVdvi.exe
  2⤵
  PID:7692
- C:\Windows\System\JnpBfVN.exe
  C:\Windows\System\JnpBfVN.exe
  2⤵
  PID:8136
- C:\Windows\System\IcaGVNS.exe
  C:\Windows\System\IcaGVNS.exe
  2⤵
  PID:5944
- C:\Windows\System\BKAOWUJ.exe
  C:\Windows\System\BKAOWUJ.exe
  2⤵
  PID:5972
- C:\Windows\System\bneRqwM.exe
  C:\Windows\System\bneRqwM.exe
  2⤵
  PID:8288
- C:\Windows\System\ghCGIev.exe
  C:\Windows\System\ghCGIev.exe
  2⤵
  PID:6076
- C:\Windows\System\SdbOJKz.exe
  C:\Windows\System\SdbOJKz.exe
  2⤵
  PID:6088
- C:\Windows\System\ZCABiDD.exe
  C:\Windows\System\ZCABiDD.exe
  2⤵
  PID:3672
- C:\Windows\System\jKmZaon.exe
  C:\Windows\System\jKmZaon.exe
  2⤵
  PID:10996
- C:\Windows\System\spdbyTJ.exe
  C:\Windows\System\spdbyTJ.exe
  2⤵
  PID:4348
- C:\Windows\System\vyJGTBn.exe
  C:\Windows\System\vyJGTBn.exe
  2⤵
  PID:3556
- C:\Windows\System\sSeuuLs.exe
  C:\Windows\System\sSeuuLs.exe
  2⤵
  PID:11136
- C:\Windows\System\ljeAbdI.exe
  C:\Windows\System\ljeAbdI.exe
  2⤵
  PID:11164
- C:\Windows\System\yhWWsva.exe
  C:\Windows\System\yhWWsva.exe
  2⤵
  PID:10208
- C:\Windows\System\esZKIUA.exe
  C:\Windows\System\esZKIUA.exe
  2⤵
  PID:5708
- C:\Windows\System\qqHWeUC.exe
  C:\Windows\System\qqHWeUC.exe
  2⤵
  PID:13604
- C:\Windows\System\noXDfkF.exe
  C:\Windows\System\noXDfkF.exe
  2⤵
  PID:1036
- C:\Windows\System\NckPRPF.exe
  C:\Windows\System\NckPRPF.exe
  2⤵
  PID:9640
- C:\Windows\System\uTimgvM.exe
  C:\Windows\System\uTimgvM.exe
  2⤵
  PID:5812
- C:\Windows\System\meMzKtR.exe
  C:\Windows\System\meMzKtR.exe
  2⤵
  PID:3560
- C:\Windows\System\eIVJZfX.exe
  C:\Windows\System\eIVJZfX.exe
  2⤵
  PID:6032
- C:\Windows\System\hHgmQeA.exe
  C:\Windows\System\hHgmQeA.exe
  2⤵
  PID:5888
- C:\Windows\System\ctcaXMv.exe
  C:\Windows\System\ctcaXMv.exe
  2⤵
  PID:9296
- C:\Windows\System\KIkhGhc.exe
  C:\Windows\System\KIkhGhc.exe
  2⤵
  PID:7192
- C:\Windows\System\JXhQFDN.exe
  C:\Windows\System\JXhQFDN.exe
  2⤵
  PID:5960
- C:\Windows\System\rxqPvDy.exe
  C:\Windows\System\rxqPvDy.exe
  2⤵
  PID:11356
- C:\Windows\System\uFVUAwv.exe
  C:\Windows\System\uFVUAwv.exe
  2⤵
  PID:13896
- C:\Windows\System\KHOhxXz.exe
  C:\Windows\System\KHOhxXz.exe
  2⤵
  PID:4072
- C:\Windows\System\nvhIhPB.exe
  C:\Windows\System\nvhIhPB.exe
  2⤵
  PID:8048
- C:\Windows\System\HxtluDL.exe
  C:\Windows\System\HxtluDL.exe
  2⤵
  PID:11556
- C:\Windows\System\lOhCTwE.exe
  C:\Windows\System\lOhCTwE.exe
  2⤵
  PID:11596
- C:\Windows\System\VNBXIKb.exe
  C:\Windows\System\VNBXIKb.exe
  2⤵
  PID:5344
- C:\Windows\System\AuTLtnT.exe
  C:\Windows\System\AuTLtnT.exe
  2⤵
  PID:5328
- C:\Windows\System\YZmlJEz.exe
  C:\Windows\System\YZmlJEz.exe
  2⤵
  PID:11828
- C:\Windows\System\ndmwooE.exe
  C:\Windows\System\ndmwooE.exe
  2⤵
  PID:3212
- C:\Windows\System\frXSTFV.exe
  C:\Windows\System\frXSTFV.exe
  2⤵
  PID:2804
- C:\Windows\System\SMqWXNF.exe
  C:\Windows\System\SMqWXNF.exe
  2⤵
  PID:3332
- C:\Windows\System\zWTQHxw.exe
  C:\Windows\System\zWTQHxw.exe
  2⤵
  PID:3280
- C:\Windows\System\cONZSXN.exe
  C:\Windows\System\cONZSXN.exe
  2⤵
  PID:5140
- C:\Windows\System\NEfDkTt.exe
  C:\Windows\System\NEfDkTt.exe
  2⤵
  PID:5304
- C:\Windows\System\JpBnCzV.exe
  C:\Windows\System\JpBnCzV.exe
  2⤵
  PID:10084
- C:\Windows\System\JgUbDCS.exe
  C:\Windows\System\JgUbDCS.exe
  2⤵
  PID:11948
- C:\Windows\System\arUdRnl.exe
  C:\Windows\System\arUdRnl.exe
  2⤵
  PID:12568
- C:\Windows\System\qKwPYnt.exe
  C:\Windows\System\qKwPYnt.exe
  2⤵
  PID:11252
- C:\Windows\System\crfLlji.exe
  C:\Windows\System\crfLlji.exe
  2⤵
  PID:9140
- C:\Windows\System\ZJvzvwe.exe
  C:\Windows\System\ZJvzvwe.exe
  2⤵
  PID:10336
- C:\Windows\System\YTCdjIb.exe
  C:\Windows\System\YTCdjIb.exe
  2⤵
  PID:12396
- C:\Windows\System\DFRpVaU.exe
  C:\Windows\System\DFRpVaU.exe
  2⤵
  PID:10564
- C:\Windows\System\sqOTnzA.exe
  C:\Windows\System\sqOTnzA.exe
  2⤵
  PID:5752
- C:\Windows\System\LwRhkVW.exe
  C:\Windows\System\LwRhkVW.exe
  2⤵
  PID:13068
- C:\Windows\System\QFqjkQH.exe
  C:\Windows\System\QFqjkQH.exe
  2⤵
  PID:10288
- C:\Windows\System\RxriWHT.exe
  C:\Windows\System\RxriWHT.exe
  2⤵
  PID:11260
- C:\Windows\System\xMRbLwv.exe
  C:\Windows\System\xMRbLwv.exe
  2⤵
  PID:6096
- C:\Windows\System\VRaVZmO.exe
  C:\Windows\System\VRaVZmO.exe
  2⤵
  PID:9584
- C:\Windows\System\zIwgWMw.exe
  C:\Windows\System\zIwgWMw.exe
  2⤵
  PID:4932
- C:\Windows\System\RrfAlqm.exe
  C:\Windows\System\RrfAlqm.exe
  2⤵
  PID:2216
- C:\Windows\System\vTfQQZx.exe
  C:\Windows\System\vTfQQZx.exe
  2⤵
  PID:11920
- C:\Windows\System\nxlpesA.exe
  C:\Windows\System\nxlpesA.exe
  2⤵
  PID:3068
- C:\Windows\System\YcDwcxI.exe
  C:\Windows\System\YcDwcxI.exe
  2⤵
  PID:5792
- C:\Windows\System\rxQiYLp.exe
  C:\Windows\System\rxQiYLp.exe
  2⤵
  PID:9880
- C:\Windows\System\lcSuFpt.exe
  C:\Windows\System\lcSuFpt.exe
  2⤵
  PID:5872
- C:\Windows\System\AkeNBDh.exe
  C:\Windows\System\AkeNBDh.exe
  2⤵
  PID:12028
- C:\Windows\System\riarMJD.exe
  C:\Windows\System\riarMJD.exe
  2⤵
  PID:12516
- C:\Windows\System\BdYNkkK.exe
  C:\Windows\System\BdYNkkK.exe
  2⤵
  PID:3472
- C:\Windows\System\ifUJWbb.exe
  C:\Windows\System\ifUJWbb.exe
  2⤵
  PID:7880
- C:\Windows\System\xLiQTMZ.exe
  C:\Windows\System\xLiQTMZ.exe
  2⤵
  PID:232
- C:\Windows\System\ibRMYtV.exe
  C:\Windows\System\ibRMYtV.exe
  2⤵
  PID:4400
- C:\Windows\System\TOyTGLH.exe
  C:\Windows\System\TOyTGLH.exe
  2⤵
  PID:3092
- C:\Windows\System\IuRGjsG.exe
  C:\Windows\System\IuRGjsG.exe
  2⤵
  PID:6228
- C:\Windows\System\QPNwflg.exe
  C:\Windows\System\QPNwflg.exe
  2⤵
  PID:7724
- C:\Windows\System\zmfEsvx.exe
  C:\Windows\System\zmfEsvx.exe
  2⤵
  PID:5228
- C:\Windows\System\IpdyYvk.exe
  C:\Windows\System\IpdyYvk.exe
  2⤵
  PID:5988
- C:\Windows\System\phtOmuK.exe
  C:\Windows\System\phtOmuK.exe
  2⤵
  PID:11448
- C:\Windows\System\nMNqXEC.exe
  C:\Windows\System\nMNqXEC.exe
  2⤵
  PID:12596
- C:\Windows\System\ZCocUfA.exe
  C:\Windows\System\ZCocUfA.exe
  2⤵
  PID:3960
- C:\Windows\System\LQNXuMY.exe
  C:\Windows\System\LQNXuMY.exe
  2⤵
  PID:6376
- C:\Windows\System\NWwAIXx.exe
  C:\Windows\System\NWwAIXx.exe
  2⤵
  PID:6336
- C:\Windows\System\wVUNtJa.exe
  C:\Windows\System\wVUNtJa.exe
  2⤵
  PID:13888
- C:\Windows\System\UDWyexO.exe
  C:\Windows\System\UDWyexO.exe
  2⤵
  PID:13928
- C:\Windows\System\GakPdnm.exe
  C:\Windows\System\GakPdnm.exe
  2⤵
  PID:3880
- C:\Windows\System\Gsqzvat.exe
  C:\Windows\System\Gsqzvat.exe
  2⤵
  PID:10968
- C:\Windows\System\fcoFsbi.exe
  C:\Windows\System\fcoFsbi.exe
  2⤵
  PID:6092
- C:\Windows\System\RZkkcLj.exe
  C:\Windows\System\RZkkcLj.exe
  2⤵
  PID:6748
- C:\Windows\System\MgIfiKY.exe
  C:\Windows\System\MgIfiKY.exe
  2⤵
  PID:3028
- C:\Windows\System\NItYjoi.exe
  C:\Windows\System\NItYjoi.exe
  2⤵
  PID:5412
- C:\Windows\System\sIXFPBR.exe
  C:\Windows\System\sIXFPBR.exe
  2⤵
  PID:6764
- C:\Windows\System\fuuAEjX.exe
  C:\Windows\System\fuuAEjX.exe
  2⤵
  PID:3284
- C:\Windows\System\QachGBa.exe
  C:\Windows\System\QachGBa.exe
  2⤵
  PID:6856
- C:\Windows\System\McwCuRt.exe
  C:\Windows\System\McwCuRt.exe
  2⤵
  PID:5340
- C:\Windows\System\yAGvvjv.exe
  C:\Windows\System\yAGvvjv.exe
  2⤵
  PID:12524
- C:\Windows\System\dfAkvkA.exe
  C:\Windows\System\dfAkvkA.exe
  2⤵
  PID:11224
- C:\Windows\System\KesAsYH.exe
  C:\Windows\System\KesAsYH.exe
  2⤵
  PID:12684
- C:\Windows\System\WJboycx.exe
  C:\Windows\System\WJboycx.exe
  2⤵
  PID:11932
- C:\Windows\System\AdwBNSL.exe
  C:\Windows\System\AdwBNSL.exe
  2⤵
  PID:5504
- C:\Windows\System\Vmadsrn.exe
  C:\Windows\System\Vmadsrn.exe
  2⤵
  PID:6916
- C:\Windows\System\ZwrXNYJ.exe
  C:\Windows\System\ZwrXNYJ.exe
  2⤵
  PID:9412
- C:\Windows\System\CIycyEB.exe
  C:\Windows\System\CIycyEB.exe
  2⤵
  PID:12700
- C:\Windows\System\FpWiSNH.exe
  C:\Windows\System\FpWiSNH.exe
  2⤵
  PID:8132
- C:\Windows\System\XYRyCDd.exe
  C:\Windows\System\XYRyCDd.exe
  2⤵
  PID:5508
- C:\Windows\System\UVOAkuU.exe
  C:\Windows\System\UVOAkuU.exe
  2⤵
  PID:12916
- C:\Windows\System\UeyKTWB.exe
  C:\Windows\System\UeyKTWB.exe
  2⤵
  PID:4232
- C:\Windows\System\zVRkBTG.exe
  C:\Windows\System\zVRkBTG.exe
  2⤵
  PID:9676
- C:\Windows\System\eKcbtuu.exe
  C:\Windows\System\eKcbtuu.exe
  2⤵
  PID:13064
- C:\Windows\System\wusbyuk.exe
  C:\Windows\System\wusbyuk.exe
  2⤵
  PID:11268
- C:\Windows\System\PMSPgxG.exe
  C:\Windows\System\PMSPgxG.exe
  2⤵
  PID:6316
- C:\Windows\System\NVoqhEa.exe
  C:\Windows\System\NVoqhEa.exe
  2⤵
  PID:13192
- C:\Windows\System\SvhXdJD.exe
  C:\Windows\System\SvhXdJD.exe
  2⤵
  PID:7164
- C:\Windows\System\plkfxmV.exe
  C:\Windows\System\plkfxmV.exe
  2⤵
  PID:6744
- C:\Windows\System\egfLEaN.exe
  C:\Windows\System\egfLEaN.exe
  2⤵
  PID:13428
- C:\Windows\System\tloLESk.exe
  C:\Windows\System\tloLESk.exe
  2⤵
  PID:436
- C:\Windows\System\fGYmACp.exe
  C:\Windows\System\fGYmACp.exe
  2⤵
  PID:3800
- C:\Windows\System\VccqAvO.exe
  C:\Windows\System\VccqAvO.exe
  2⤵
  PID:7508
- C:\Windows\System\tzxCEUe.exe
  C:\Windows\System\tzxCEUe.exe
  2⤵
  PID:7640
- C:\Windows\System\ZrYuIPR.exe
  C:\Windows\System\ZrYuIPR.exe
  2⤵
  PID:12308
- C:\Windows\System\KRspXjm.exe
  C:\Windows\System\KRspXjm.exe
  2⤵
  PID:6148
- C:\Windows\System\bwqHhQw.exe
  C:\Windows\System\bwqHhQw.exe
  2⤵
  PID:6708
- C:\Windows\System\yZvwFtl.exe
  C:\Windows\System\yZvwFtl.exe
  2⤵
  PID:12228
- C:\Windows\System\CVQlOSw.exe
  C:\Windows\System\CVQlOSw.exe
  2⤵
  PID:3440
- C:\Windows\System\pxdwChL.exe
  C:\Windows\System\pxdwChL.exe
  2⤵
  PID:6988
- C:\Windows\System\JbOBBZL.exe
  C:\Windows\System\JbOBBZL.exe
  2⤵
  PID:8068
- C:\Windows\System\SzncJfa.exe
  C:\Windows\System\SzncJfa.exe
  2⤵
  PID:12236
- C:\Windows\System\qORvoDf.exe
  C:\Windows\System\qORvoDf.exe
  2⤵
  PID:6304
- C:\Windows\System\jnmphwv.exe
  C:\Windows\System\jnmphwv.exe
  2⤵
  PID:5780
- C:\Windows\System\LEqxBEW.exe
  C:\Windows\System\LEqxBEW.exe
  2⤵
  PID:2200
- C:\Windows\System\jWmtPAv.exe
  C:\Windows\System\jWmtPAv.exe
  2⤵
  PID:7816
- C:\Windows\System\COkRvxX.exe
  C:\Windows\System\COkRvxX.exe
  2⤵
  PID:12528
- C:\Windows\System\oqGAcIy.exe
  C:\Windows\System\oqGAcIy.exe
  2⤵
  PID:8812
- C:\Windows\System\vMqRMMN.exe
  C:\Windows\System\vMqRMMN.exe
  2⤵
  PID:7444
- C:\Windows\System\xzOEdVb.exe
  C:\Windows\System\xzOEdVb.exe
  2⤵
  PID:7612
- C:\Windows\System\IKiFFNJ.exe
  C:\Windows\System\IKiFFNJ.exe
  2⤵
  PID:6684
- C:\Windows\System\wydpyPg.exe
  C:\Windows\System\wydpyPg.exe
  2⤵
  PID:8956
- C:\Windows\System\cQupLef.exe
  C:\Windows\System\cQupLef.exe
  2⤵
  PID:3968
- C:\Windows\System\DfXdRBd.exe
  C:\Windows\System\DfXdRBd.exe
  2⤵
  PID:14032
- C:\Windows\System\OOGxtLi.exe
  C:\Windows\System\OOGxtLi.exe
  2⤵
  PID:6400
- C:\Windows\System\peJgWBO.exe
  C:\Windows\System\peJgWBO.exe
  2⤵
  PID:4688
- C:\Windows\System\HhbvZXP.exe
  C:\Windows\System\HhbvZXP.exe
  2⤵
  PID:11864
- C:\Windows\System\PEfmaTK.exe
  C:\Windows\System\PEfmaTK.exe
  2⤵
  PID:5984
- C:\Windows\System\MfrxRTt.exe
  C:\Windows\System\MfrxRTt.exe
  2⤵
  PID:11096
- C:\Windows\System\EXQKtHo.exe
  C:\Windows\System\EXQKtHo.exe
  2⤵
  PID:10128
- C:\Windows\System\NusiINq.exe
  C:\Windows\System\NusiINq.exe
  2⤵
  PID:5916
- C:\Windows\System\rGoijul.exe
  C:\Windows\System\rGoijul.exe
  2⤵
  PID:11840
- C:\Windows\System\oPcvQUx.exe
  C:\Windows\System\oPcvQUx.exe
  2⤵
  PID:7592
- C:\Windows\System\JIPJlmm.exe
  C:\Windows\System\JIPJlmm.exe
  2⤵
  PID:8368
- C:\Windows\System\JzeNeKW.exe
  C:\Windows\System\JzeNeKW.exe
  2⤵
  PID:8420
- C:\Windows\System\aLTxKHb.exe
  C:\Windows\System\aLTxKHb.exe
  2⤵
  PID:5248
- C:\Windows\System\PNrWUuY.exe
  C:\Windows\System\PNrWUuY.exe
  2⤵
  PID:7984
- C:\Windows\System\Cpusmyr.exe
  C:\Windows\System\Cpusmyr.exe
  2⤵
  PID:8472
- C:\Windows\System\gscdHBc.exe
  C:\Windows\System\gscdHBc.exe
  2⤵
  PID:8680
- C:\Windows\System\YfAIsMj.exe
  C:\Windows\System\YfAIsMj.exe
  2⤵
  PID:12856
- C:\Windows\System\EEHYMmy.exe
  C:\Windows\System\EEHYMmy.exe
  2⤵
  PID:8436
- C:\Windows\System\iroWYot.exe
  C:\Windows\System\iroWYot.exe
  2⤵
  PID:7904
- C:\Windows\System\pasSqMo.exe
  C:\Windows\System\pasSqMo.exe
  2⤵
  PID:8240
- C:\Windows\System\eTEibgJ.exe
  C:\Windows\System\eTEibgJ.exe
  2⤵
  PID:7476
- C:\Windows\System\owbQcAE.exe
  C:\Windows\System\owbQcAE.exe
  2⤵
  PID:8448
- C:\Windows\System\RVkrlgg.exe
  C:\Windows\System\RVkrlgg.exe
  2⤵
  PID:9204
- C:\Windows\System\MLokfLm.exe
  C:\Windows\System\MLokfLm.exe
  2⤵
  PID:8632
- C:\Windows\System\omxNXcJ.exe
  C:\Windows\System\omxNXcJ.exe
  2⤵
  PID:13296
- C:\Windows\System\smqFHIy.exe
  C:\Windows\System\smqFHIy.exe
  2⤵
  PID:6740
- C:\Windows\System\momIVUU.exe
  C:\Windows\System\momIVUU.exe
  2⤵
  PID:9148
- C:\Windows\System\hFhyvVI.exe
  C:\Windows\System\hFhyvVI.exe
  2⤵
  PID:8064
- C:\Windows\System\xxVUNEn.exe
  C:\Windows\System\xxVUNEn.exe
  2⤵
  PID:7948
- C:\Windows\System\TnoJJbP.exe
  C:\Windows\System\TnoJJbP.exe
  2⤵
  PID:6016
- C:\Windows\System\OPrcIUw.exe
  C:\Windows\System\OPrcIUw.exe
  2⤵
  PID:7480
- C:\Windows\System\yBRAwEX.exe
  C:\Windows\System\yBRAwEX.exe
  2⤵
  PID:5172
- C:\Windows\System\NQbtBAl.exe
  C:\Windows\System\NQbtBAl.exe
  2⤵
  PID:7596
- C:\Windows\System\eRhPiFl.exe
  C:\Windows\System\eRhPiFl.exe
  2⤵
  PID:7512
- C:\Windows\System\CulivMX.exe
  C:\Windows\System\CulivMX.exe
  2⤵
  PID:8764
- C:\Windows\System\PfIfoWW.exe
  C:\Windows\System\PfIfoWW.exe
  2⤵
  PID:7492
- C:\Windows\System\lRTTAhl.exe
  C:\Windows\System\lRTTAhl.exe
  2⤵
  PID:9060
- C:\Windows\System\LnMUvyb.exe
  C:\Windows\System\LnMUvyb.exe
  2⤵
  PID:5468
- C:\Windows\System\vqTZIyI.exe
  C:\Windows\System\vqTZIyI.exe
  2⤵
  PID:5680
- C:\Windows\System\FVCyvKu.exe
  C:\Windows\System\FVCyvKu.exe
  2⤵
  PID:8284
- C:\Windows\System\xpCtlWv.exe
  C:\Windows\System\xpCtlWv.exe
  2⤵
  PID:6872
- C:\Windows\System\KFbDvLr.exe
  C:\Windows\System\KFbDvLr.exe
  2⤵
  PID:5692
- C:\Windows\System\qzdhisW.exe
  C:\Windows\System\qzdhisW.exe
  2⤵
  PID:6820
- C:\Windows\System\KqfMGSB.exe
  C:\Windows\System\KqfMGSB.exe
  2⤵
  PID:8600
- C:\Windows\System\RMOOPOP.exe
  C:\Windows\System\RMOOPOP.exe
  2⤵
  PID:6240
- C:\Windows\System\AekDMhe.exe
  C:\Windows\System\AekDMhe.exe
  2⤵
  PID:11896
- C:\Windows\System\EMzunvq.exe
  C:\Windows\System\EMzunvq.exe
  2⤵
  PID:12112
- C:\Windows\System\djtgJuL.exe
  C:\Windows\System\djtgJuL.exe
  2⤵
  PID:10116
- C:\Windows\System\AXtcFMk.exe
  C:\Windows\System\AXtcFMk.exe
  2⤵
  PID:9688
- C:\Windows\System\UxRvWsF.exe
  C:\Windows\System\UxRvWsF.exe
  2⤵
  PID:11048
- C:\Windows\System\rUYpXtq.exe
  C:\Windows\System\rUYpXtq.exe
  2⤵
  PID:7056
- C:\Windows\System\UiDdrzu.exe
  C:\Windows\System\UiDdrzu.exe
  2⤵
  PID:14344
- C:\Windows\System\PJkxMkF.exe
  C:\Windows\System\PJkxMkF.exe
  2⤵
  PID:14368
- C:\Windows\System\gvAxeni.exe
  C:\Windows\System\gvAxeni.exe
  2⤵
  PID:14392
- C:\Windows\System\LqIZEvM.exe
  C:\Windows\System\LqIZEvM.exe
  2⤵
  PID:14484
- C:\Windows\System\vfTacLR.exe
  C:\Windows\System\vfTacLR.exe
  2⤵
  PID:14516
- C:\Windows\System\UaaDjvm.exe
  C:\Windows\System\UaaDjvm.exe
  2⤵
  PID:14536
- C:\Windows\System\EjxMPhJ.exe
  C:\Windows\System\EjxMPhJ.exe
  2⤵
  PID:14572
- C:\Windows\System\eWZPkkb.exe
  C:\Windows\System\eWZPkkb.exe
  2⤵
  PID:14596
- C:\Windows\System\LuAQrCP.exe
  C:\Windows\System\LuAQrCP.exe
  2⤵
  PID:14620
- C:\Windows\System\orUrfWs.exe
  C:\Windows\System\orUrfWs.exe
  2⤵
  PID:14644
- C:\Windows\System\nJJduah.exe
  C:\Windows\System\nJJduah.exe
  2⤵
  PID:14660
- C:\Windows\System\wIpBIIf.exe
  C:\Windows\System\wIpBIIf.exe
  2⤵
  PID:14680
- C:\Windows\System\tRzeBEP.exe
  C:\Windows\System\tRzeBEP.exe
  2⤵
  PID:14696
- C:\Windows\System\PgQIoFY.exe
  C:\Windows\System\PgQIoFY.exe
  2⤵
  PID:14712
- C:\Windows\System\ewFnDes.exe
  C:\Windows\System\ewFnDes.exe
  2⤵
  PID:14740
- C:\Windows\System\KtNXaUx.exe
  C:\Windows\System\KtNXaUx.exe
  2⤵
  PID:14768
- C:\Windows\System\HyCxuBa.exe
  C:\Windows\System\HyCxuBa.exe
  2⤵
  PID:14796
- C:\Windows\System\WqlrYLK.exe
  C:\Windows\System\WqlrYLK.exe
  2⤵
  PID:14820
- C:\Windows\System\knhHkyM.exe
  C:\Windows\System\knhHkyM.exe
  2⤵
  PID:14840
- C:\Windows\System\VOGWsYd.exe
  C:\Windows\System\VOGWsYd.exe
  2⤵
  PID:15100
- C:\Windows\System\hrgFzmZ.exe
  C:\Windows\System\hrgFzmZ.exe
  2⤵
  PID:15128
- C:\Windows\System\VswxvTy.exe
  C:\Windows\System\VswxvTy.exe
  2⤵
  PID:15168
- C:\Windows\System\vUaydSp.exe
  C:\Windows\System\vUaydSp.exe
  2⤵
  PID:15192
- C:\Windows\System\iWKiwiQ.exe
  C:\Windows\System\iWKiwiQ.exe
  2⤵
  PID:15220
- C:\Windows\System\TteMhDp.exe
  C:\Windows\System\TteMhDp.exe
  2⤵
  PID:15244
- C:\Windows\System\XPwfhEs.exe
  C:\Windows\System\XPwfhEs.exe
  2⤵
  PID:15284
- C:\Windows\System\yfdoYnv.exe
  C:\Windows\System\yfdoYnv.exe
  2⤵
  PID:15320
- C:\Windows\System\CBFpYZQ.exe
  C:\Windows\System\CBFpYZQ.exe
  2⤵
  PID:4704
- C:\Windows\System\rqrysZZ.exe
  C:\Windows\System\rqrysZZ.exe
  2⤵
  PID:9460
- C:\Windows\System\pgZXPfa.exe
  C:\Windows\System\pgZXPfa.exe
  2⤵
  PID:5364
- C:\Windows\System\IQbdFyE.exe
  C:\Windows\System\IQbdFyE.exe
  2⤵
  PID:7360
- C:\Windows\System\NdivpRd.exe
  C:\Windows\System\NdivpRd.exe
  2⤵
  PID:10048
- C:\Windows\System\diiJCEk.exe
  C:\Windows\System\diiJCEk.exe
  2⤵
  PID:9316
- C:\Windows\System\shoDNjX.exe
  C:\Windows\System\shoDNjX.exe
  2⤵
  PID:8244
- C:\Windows\System\DrkzcLw.exe
  C:\Windows\System\DrkzcLw.exe
  2⤵
  PID:11492
- C:\Windows\System\codamyo.exe
  C:\Windows\System\codamyo.exe
  2⤵
  PID:9680
- C:\Windows\System\TXtBexj.exe
  C:\Windows\System\TXtBexj.exe
  2⤵
  PID:8624
- C:\Windows\System\UUOjekc.exe
  C:\Windows\System\UUOjekc.exe
  2⤵
  PID:14592
- C:\Windows\System\nVMOCnz.exe
  C:\Windows\System\nVMOCnz.exe
  2⤵
  PID:10100
- C:\Windows\System\wgqgZsD.exe
  C:\Windows\System\wgqgZsD.exe
  2⤵
  PID:14652
- C:\Windows\System\jYFUzzs.exe
  C:\Windows\System\jYFUzzs.exe
  2⤵
  PID:14704
- C:\Windows\System\DpbZrrT.exe
  C:\Windows\System\DpbZrrT.exe
  2⤵
  PID:7792
- C:\Windows\System\SZlyrou.exe
  C:\Windows\System\SZlyrou.exe
  2⤵
  PID:14808
- C:\Windows\System\YrMdyCF.exe
  C:\Windows\System\YrMdyCF.exe
  2⤵
  PID:14388
- C:\Windows\System\CfAniDx.exe
  C:\Windows\System\CfAniDx.exe
  2⤵
  PID:14416
- C:\Windows\System\eNPfCnh.exe
  C:\Windows\System\eNPfCnh.exe
  2⤵
  PID:14436
- C:\Windows\System\ohDneJS.exe
  C:\Windows\System\ohDneJS.exe
  2⤵
  PID:14452
- C:\Windows\System\WCfZWhG.exe
  C:\Windows\System\WCfZWhG.exe
  2⤵
  PID:14924
- C:\Windows\System\xszPZNv.exe
  C:\Windows\System\xszPZNv.exe
  2⤵
  PID:14544
- C:\Windows\System\bXUIREe.exe
  C:\Windows\System\bXUIREe.exe
  2⤵
  PID:7504
- C:\Windows\System\ynXNXSP.exe
  C:\Windows\System\ynXNXSP.exe
  2⤵
  PID:14656
- C:\Windows\System\AVjbZxT.exe
  C:\Windows\System\AVjbZxT.exe
  2⤵
  PID:8312
- C:\Windows\System\RZDiuEC.exe
  C:\Windows\System\RZDiuEC.exe
  2⤵
  PID:14792
- C:\Windows\System\ISjhJXZ.exe
  C:\Windows\System\ISjhJXZ.exe
  2⤵
  PID:9752
- C:\Windows\System\LIsSFVA.exe
  C:\Windows\System\LIsSFVA.exe
  2⤵
  PID:9400
- C:\Windows\System\phFrmpB.exe
  C:\Windows\System\phFrmpB.exe
  2⤵
  PID:15352
- C:\Windows\System\exSOCHH.exe
  C:\Windows\System\exSOCHH.exe
  2⤵
  PID:10188
- C:\Windows\System\yoJCXeO.exe
  C:\Windows\System\yoJCXeO.exe
  2⤵
  PID:6388
- C:\Windows\System\WdGRHzH.exe
  C:\Windows\System\WdGRHzH.exe
  2⤵
  PID:3040
- C:\Windows\System\jVLXvfq.exe
  C:\Windows\System\jVLXvfq.exe
  2⤵
  PID:2220
- C:\Windows\System\TOclZkM.exe
  C:\Windows\System\TOclZkM.exe
  2⤵
  PID:10032
- C:\Windows\System\xoISxZC.exe
  C:\Windows\System\xoISxZC.exe
  2⤵
  PID:5588
- C:\Windows\System\GQDXMGH.exe
  C:\Windows\System\GQDXMGH.exe
  2⤵
  PID:15116
- C:\Windows\System\UVnCClY.exe
  C:\Windows\System\UVnCClY.exe
  2⤵
  PID:9168
- C:\Windows\System\uxjetab.exe
  C:\Windows\System\uxjetab.exe
  2⤵
  PID:9512
- C:\Windows\System\bXFDjbr.exe
  C:\Windows\System\bXFDjbr.exe
  2⤵
  PID:14964
- C:\Windows\System\BbPuJRa.exe
  C:\Windows\System\BbPuJRa.exe
  2⤵
  PID:9900
- C:\Windows\System\NhxEmYS.exe
  C:\Windows\System\NhxEmYS.exe
  2⤵
  PID:10920
- C:\Windows\System\HHLUSEn.exe
  C:\Windows\System\HHLUSEn.exe
  2⤵
  PID:10952
- C:\Windows\System\EzejdKP.exe
  C:\Windows\System\EzejdKP.exe
  2⤵
  PID:10556
- C:\Windows\System\WiucpRr.exe
  C:\Windows\System\WiucpRr.exe
  2⤵
  PID:5820
- C:\Windows\System\mvYgxbh.exe
  C:\Windows\System\mvYgxbh.exe
  2⤵
  PID:9944
- C:\Windows\System\UpvKLmH.exe
  C:\Windows\System\UpvKLmH.exe
  2⤵
  PID:10696
- C:\Windows\System\cQmuvHm.exe
  C:\Windows\System\cQmuvHm.exe
  2⤵
  PID:11700
- C:\Windows\System\HtYsfFy.exe
  C:\Windows\System\HtYsfFy.exe
  2⤵
  PID:10752
- C:\Windows\System\nXndvKi.exe
  C:\Windows\System\nXndvKi.exe
  2⤵
  PID:6840
- C:\Windows\System\Zrqxoah.exe
  C:\Windows\System\Zrqxoah.exe
  2⤵
  PID:11780
- C:\Windows\System\SFRoSmP.exe
  C:\Windows\System\SFRoSmP.exe
  2⤵
  PID:14952
- C:\Windows\System\ggEHcNu.exe
  C:\Windows\System\ggEHcNu.exe
  2⤵
  PID:14764
- C:\Windows\System\LWMtdcS.exe
  C:\Windows\System\LWMtdcS.exe
  2⤵
  PID:10748
- C:\Windows\System\sGXntKq.exe
  C:\Windows\System\sGXntKq.exe
  2⤵
  PID:14360
- C:\Windows\System\QTcZCyX.exe
  C:\Windows\System\QTcZCyX.exe
  2⤵
  PID:11996
- C:\Windows\System\lTnYcuT.exe
  C:\Windows\System\lTnYcuT.exe
  2⤵
  PID:10720
- C:\Windows\System\vdNGzHg.exe
  C:\Windows\System\vdNGzHg.exe
  2⤵
  PID:12068
- C:\Windows\System\SSCHMrU.exe
  C:\Windows\System\SSCHMrU.exe
  2⤵
  PID:10680
- C:\Windows\System\vgIwOhI.exe
  C:\Windows\System\vgIwOhI.exe
  2⤵
  PID:9836
- C:\Windows\System\oJcedFO.exe
  C:\Windows\System\oJcedFO.exe
  2⤵
  PID:9980
- C:\Windows\System\tRJCxcc.exe
  C:\Windows\System\tRJCxcc.exe
  2⤵
  PID:11220
- C:\Windows\System\ZHlUOLo.exe
  C:\Windows\System\ZHlUOLo.exe
  2⤵
  PID:9360
- C:\Windows\System\HXgktau.exe
  C:\Windows\System\HXgktau.exe
  2⤵
  PID:14936
- C:\Windows\System\zByZgkf.exe
  C:\Windows\System\zByZgkf.exe
  2⤵
  PID:10320
- C:\Windows\System\xoKNCzC.exe
  C:\Windows\System\xoKNCzC.exe
  2⤵
  PID:11084
- C:\Windows\System\xKZgoCb.exe
  C:\Windows\System\xKZgoCb.exe
  2⤵
  PID:11160
- C:\Windows\System\uLRcRmS.exe
  C:\Windows\System\uLRcRmS.exe
  2⤵
  PID:15264
- C:\Windows\System\zrMYiqV.exe
  C:\Windows\System\zrMYiqV.exe
  2⤵
  PID:15236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 3092 -ip 3092
1⤵
PID:6820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2wymrved.llz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2wymrved.llz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ADbIFOV.exe

Path C:\Windows\System\ADbIFOV.exe
Size 1.9MB
SHA256 1263e038c25e10ddf57f65839687c4e8a67709f45dae7b5705429702d675c546
MD5 372473c9707906c61db7b53d89ce793b
SHA1 3af77c78ff42801d43acbf5970e81c5143f915f0
SHA512 9a29c4b40655e051d6724f5acbd6c1c55284afb01293e0206b88ca5e9938097992de4c0a0301a00452507701ded48a0c77f23075c0585a5269731556c68ab6d7
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3v:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AXhNkmU.exe

Path C:\Windows\System\AXhNkmU.exe
Size 18B
SHA256 db72d8c0e4c270ca2b090504876e68c2da29c2ffd0505f696acb152cc4c05f53
MD5 78e69eb0a41877a1c6a39b6895b51435
SHA1 1d8004474a59c8c9038d183093e32ccf603c7af4
SHA512 952d231d47ac71b2a27861288e0ab964a8d53a0156a694ab3b4a9ff9aa52a710a47baad73e6e370215aecc0e6999433d8414ba8358fd4555669d517b5b979f9d
MD5 SHA1 SHA512

Submit Download

DwDwqJE.exe

Path C:\Windows\System\DwDwqJE.exe
Size 1.9MB
SHA256 65740573059fb04faafb997e22151a9c206f97f46d741b8eee822aba51805519
MD5 0eb4a0701575e2c5245a648d1d2a8a31
SHA1 283724b31686cf747645622c3d01fd7b7b439730
SHA512 6eca12069226ba3677c3653ce5c6539b466ec112114cc8c57dc56e08a8e7ff429659c0d1119d7db40c064bcdc76e24164b74aeff70e994f578404b364e0cf7f7
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3f:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

FFkxZSA.exe

Path C:\Windows\System\FFkxZSA.exe
Size 1.9MB
SHA256 7bc1194f51a3b78889801d3a8150a4f24cbcb4d4abd5994fad2cebba4b46b786
MD5 576b6507bdb4d6c64da6f6ae067533b1
SHA1 0fe7045723fcf34310eca1416cce2a4babb7c655
SHA512 7ed2a67511b86f20a7ac58af21136a5582ba1dece102576483a145ea100bd3459c83c6bf0e6d518859ef4e3917815d812ba2673c2e605a621462a837cf6a852c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3f:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

FKqkLcm.exe

Path C:\Windows\System\FKqkLcm.exe
Size 1.9MB
SHA256 606f2bd722266e8a7409448466aba910f1cfccd833095d7521263b3be40f2d8f
MD5 7153b3c14605b14b8fb70736975f5291
SHA1 817818ae9a2a99c069abe4f8866bf2a34b831dc4
SHA512 97d3f47a15cd0a0908963d8f6eeeb825fc764248c6e060159d0b926c7bda1e43dab28e83a3314fcfedbd8adb0788a377b498809c160d5c6b907929e7b4b87a5a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO35:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FdtDavF.exe

Path C:\Windows\System\FdtDavF.exe
Size 1.9MB
SHA256 218d5f4f18f7dcbd2cbab4a5c25ba7a799cbdb7c47e4a86a743533d458f61f79
MD5 deeaedb733dff176719a3cd0a3708e95
SHA1 2115ef0e60bdf65885c1e53a9391d9a31770af30
SHA512 5ca25f8d6bff5ade55adc220e4695d8e9bbed86cb2a8b9ab2228fceac371cf4ece2061219dcc1cc6ce9e39c9d6a603e1e8cd460b63525bfa8d814a259b492e93
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3a:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHsXOGn.exe

Path C:\Windows\System\GHsXOGn.exe
Size 1.9MB
SHA256 264f69f2ddedb078aed2664550a643f1236bdd3fecf70bcd94d3b39d46b869f1
MD5 4afb2d9f127a3066975443fa57057c73
SHA1 11b87fab87f197e4af6e342bd6e8f8785cc7e9e4
SHA512 e31777d7a262ba1071ba1568c3815095fd179a67b3a9fbe94c46dad2b96a4bcce78a94df94cb9fbf74b0b32d9a936e4cb3d116715f596ed33be984fa3b52b09e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3pu:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQyiucE.exe

Path C:\Windows\System\IQyiucE.exe
Size 8B
SHA256 2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404
MD5 7e1e9fcc71af27d4f3a70b3e20ac77b9
SHA1 09ec64762a6dbe9e03ecdb61ea5de2d274d170f0
SHA512 3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91
MD5 SHA1 SHA512

Submit Download

ITZJFjj.exe

Path C:\Windows\System\ITZJFjj.exe
Size 1.9MB
SHA256 64f72e7c1cd5bea5482501769b0f9d860e1b22e349e55168faa7b2c2ff805d5e
MD5 010b2be58830632211c29794e4cc96df
SHA1 a346b2b962f02d5d71d1cfe29e6a898ed47deb6a
SHA512 20987613a708c7d054524530382d6bd1bc3aa6eeaac1a192ab13d3f62c7d4953cc5c0bc9a3ea1725eab4dfe66017d2fb1e9f91e4d0bb5df2b3a9dd1676a5a94e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3A:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

MjWjEUW.exe

Path C:\Windows\System\MjWjEUW.exe
Size 1.9MB
SHA256 f158bd47aca57d692d3d0759a68206750b626a67a777b80b7359d1416e6a85ea
MD5 763e33c6916bd399f27f13c57403ebbc
SHA1 36d9fde3a398e98502b1ec4d08c7eed793b80f0d
SHA512 ba09ebdcf081330f22c7b4158913cc739a8c7f96a3385b8e5a8e8428034d0fdc1b272b5c9bc76107419cf72d7e783c321a8ef70433fc135234a2dcbd67ad9629
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3h:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBhYjlk.exe

Path C:\Windows\System\NBhYjlk.exe
Size 1.9MB
SHA256 0634fce6737b2b8c8c753c0ea9a9639a12f89a125f13a8578a99dd4091516eaf
MD5 5e1a7a21ad948cec7935103359f38077
SHA1 32408dc428c28ef621b226aebb4c12b846ba9bab
SHA512 228fc5bd22d1e5bec0f817dc291a34d9f8ade607d01f15e44304ae358e075db970a4fa0d3acc5fca232d382325c9ad71273a7a41d725a61089816a27c635b913
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3T:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

STFYyuo.exe

Path C:\Windows\System\STFYyuo.exe
Size 1.9MB
SHA256 32c6ad1a5559d1588454d4f8d14d34c770d157b9d7914f3730caca4d242779fd
MD5 ed4bd8a020da0deabca27fade9fa08a2
SHA1 1f1af1d67d026954746599c6c1a243acb0d87e3a
SHA512 b0a41cd86a77aa1a5fa1e1fb75b0abb45b4ab4ec2692a3bf5ca584902f35cb4d349f86800bb00ede4d10e06be60c38140d862ee44937b9c2fa98210b76cc8643
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3L:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TcOfkFC.exe

Path C:\Windows\System\TcOfkFC.exe
Size 1.9MB
SHA256 362691e1a26b534870fe6a18559ff5c3e858f315fe44cb291ae021533b3fcfe3
MD5 a16e6b973abcd3cc0863ae5c26a38f40
SHA1 91bd8f31f994ecd72068f1b8b3f307b4f10ba740
SHA512 006b9b490abcfa2443b98b5addfc9c06410a31584a6b9bfb6ada9577b516da8a19f113dfebe82f1399a419dae7d7dda65d7c875e7ceabcd43e55f17150461530
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3Z:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TsFHKmI.exe

Path C:\Windows\System\TsFHKmI.exe
Size 1.9MB
SHA256 667300e5a8de28508a1b9f75561e1fa59af4f009c0c903d7c276b55e6c7e72b3
MD5 2b0a93e57a3cb9512e5983faf69d5a80
SHA1 e3fd4b5eab53cddef8681526527c9253e1058ce9
SHA512 4797d80f37d824731d0900418bb5692a6fbc44b6d81bbd0808f076028a794f40843e7db5273b2f9bd7484e5651fb54f7306ba8d3a522f57824af7d46137d74e4
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO34:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPopzcB.exe

Path C:\Windows\System\VPopzcB.exe
Size 1.9MB
SHA256 a60581901c013ad112b36f5712502c41209a99280bc000641a37fe996d561473
MD5 aa60f5ffddce0188f64eeed49230f012
SHA1 a22d53434571be76c69dd706da3e2e74b16f48ce
SHA512 4570c13188e7b419436c464a8fbe90bac632c31eb74ca7fb1e24374f1936b7a1b90397e7f4d85875a2ba5bd682fed100b6fa760e37fe0e56f28a0d9ff7c027cc
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3M:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoBYpby.exe

Path C:\Windows\System\VoBYpby.exe
Size 1.9MB
SHA256 6b31f8ce95ad6e3c3ce7822470198eecc2f9fe38e4c5e75e6429d7c210964327
MD5 150a13dc4f1603612fe9195d211debb4
SHA1 8761eec08b8f5a1e8edfba9caea463cfa84c933f
SHA512 ad1fab233792d4eb5108e3cc39a132d09bcd677f568a545eacd8d17ccca14d13dd02700b97ee3fceae4de700444e881d42348a8f5f5f04ee7238f89e281819c8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3d:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

VruByZy.exe

Path C:\Windows\System\VruByZy.exe
Size 1.9MB
SHA256 a0d358a06eb416fa63e82dd452389c58b304f9ca21fae8a982d36c0dfc3b454e
MD5 723484d4f1d4596cbb6496a7f63ae370
SHA1 3ace678dbaa76775b4f19979edb81a88721b6caa
SHA512 988a1aa10d3a91570449d034a63a0a401134cdf9a55ffd3e45b8579a2e4464466117526eef72339b21c0c70085ca5ce5188a42d1f77400875a89b56a04a2ddea
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO36:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

XhtbWhd.exe

Path C:\Windows\System\XhtbWhd.exe
Size 1.9MB
SHA256 ab2a4a1b5ccb58898426def9eaf7efa021f800281611ee2d506f1947b93aada1
MD5 c04372a3c4f4d02c35aae98d8ae1bd78
SHA1 180db671805fe9aea75a97fad1b8e213cc03a2ac
SHA512 ac5b105d1ec355f295bbb659f0500583c914ba201f2b9dd23cc633ebee1c8a9d7f9ee748b207e719fea4f991eee1620da39f7a4d4b9d69743c8cf0d8b17d052d
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3s:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

XuRsciy.exe

Path C:\Windows\System\XuRsciy.exe
Size 1.9MB
SHA256 7d772d756c045ee07d7ebabd2068dbf0102efaa0fd04d7125673496db1491af5
MD5 1db89bafd7e34f6ac9b1c4ff197a3fd6
SHA1 6a9b2e8a6c028c4265fe08cd018d9e2fe3a3312b
SHA512 40e936c3c6aeba1e01f6110a8efd6ca4cf25fb1c452c8e55af5a4e2e94039084d9889b01e8ec85b30fea0e45708bd02e06428f08d164df4afd318f3225dfc846
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO37:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

YAlNkZs.exe

Path C:\Windows\System\YAlNkZs.exe
Size 1.9MB
SHA256 b966180b7e70ec661c94ae1e4b3e2947a8a8b0718e02107869f3df9aa88c426a
MD5 4282f9edafda1d5d60a301aee8c644b3
SHA1 20aa4f431c22c23c24b08dd5f37be2edb0fab344
SHA512 35c6309e674de0a203a5d168041abd89252bfde81cd81c40181671f68e7c53be5b253a346a7f1ed9126d609cf67bc9cda009cec1bf7775abe648c391ed9e1690
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO32:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

aIwubAK.exe

Path C:\Windows\System\aIwubAK.exe
Size 1.9MB
SHA256 dcc625b899e0d70538bde9a6eff0b31c2eca5b3e2cd782150a196ebaa918b0f5
MD5 cac6283f91d1979136ccccb2a13d768a
SHA1 1c79c71b8e146a4bb625870abdc247c9483b1a50
SHA512 697d34900ffe7e99c32561454e05787730c5ea60809847a2aa8a6de1fe0c55dfa0d931ae5e4052b229dd71c54cf4ea8c8988a03c81f63e8c876d15540edfb2bc
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3/:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

aXbhtLr.exe

Path C:\Windows\System\aXbhtLr.exe
Size 1.9MB
SHA256 f4ea94ab633e7ddf697e8d744c4f266a40160dd22e91e330bd02e016b5de5721
MD5 b18162b68210de297056649900c635d0
SHA1 5b53eb93645838d2807193ad6f9376d4042d3dc6
SHA512 1ff2f42a666d3fa65cbb5d69c928fc8b47b32a9f9c3a1e19d827700e7b00be49088f2e4754c95f14dc1d149fb3215838400a64ec135d2a14508d9b5f305f2ae2
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3j:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

drKsHrE.exe

Path C:\Windows\System\drKsHrE.exe
Size 1.9MB
SHA256 a5713a30deaf251835a9f8dee8fab434f5718ce38b74952bb979ea979198f427
MD5 9a730ac6f17974e279565b53c6449445
SHA1 22edc5c37e2f9f543f2aae9dcbaf2ef71e655838
SHA512 281acbd95c13a923eec93fd53df2db1f184f214ff9fbf7f460be65d142df0b77387e10903faf60bf6f642f1b7a6130774edad2f2940ec113bc966a05147e442d
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3w:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fgNJgIn.exe

Path C:\Windows\System\fgNJgIn.exe
Size 1.9MB
SHA256 84e87e0a88c52d1d1f8d8cb8cdfa8fede8cb1e90a9c18ecc0d2f6b5fa0ffd6a9
MD5 ebfa1ab4d8a6dbaad71313ed8e077caf
SHA1 e3e7552703a3ae0c746136c4dae097b2ad993757
SHA512 4e2a1d15033e06f5fcdcb89104eb707bcc2ccbf32f0a7f3490ad40ff69e026a00e612b9112a05aa07038f0d5ccd1db11ff745265e0831a7eaecf94285ce5023e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO35:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hsUWgWO.exe

Path C:\Windows\System\hsUWgWO.exe
Size 1.9MB
SHA256 e7d6d951c5927560acf2d6df9f3090cea4f57f4ce5e00cd246dbd66cfc8751d8
MD5 8dd6ce2c5cb124be70a15602a22f1e8a
SHA1 e12dd1efb69d408ff83fa0cf89055f745f9c4cb9
SHA512 0301818446aa35eb62a867421b240bdffccf51746ece5e3e53118e0920d30fa52adc085372ca641cc1aca7cea0636a1984221d9f3ad62b0245c3b44f9f1ba9bc
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3C:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmrZGkf.exe

Path C:\Windows\System\jmrZGkf.exe
Size 1.9MB
SHA256 43eeb2f49498c29409e8c66be44eeaebfc1682c402ddd4f5431d77f1810e475e
MD5 b85a79504c559e5d201deba3569f52c5
SHA1 215d74f313b2e2735c9bb306d0f9e3824be1bed5
SHA512 3fc3efc519a000ceaae8ce0aa92c6122d52a66469def5e988b05d8bffb1fcc858dcd8d2898af5401f2be58c577534b601d3b23fe00c6a4dd489b7f7236ec60d8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3C:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

jwmDTLl.exe

Path C:\Windows\System\jwmDTLl.exe
Size 1.9MB
SHA256 2b36632737f19817bd2942456902c6c87b76540eba46c9fe2a5cdc5cdfa6ced8
MD5 23357f54392efc148456bc67b5f16226
SHA1 948f37eec4a552f4f9e00f1e3fc6150fadecf453
SHA512 635b8dc6b5bc096a94547869a4d0375796c693ab186b85188306685416358cc0e5dc98cb3910b60bf668acab44cadb1d2692bab298afabd42decc3081cc05c4e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3x:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kSGyuBu.exe

Path C:\Windows\System\kSGyuBu.exe
Size 1.9MB
SHA256 3a8585b477052b89e05fd8eeae6fb7fa499084569444b18c2cc32e8a5410245f
MD5 e60f2715144570db7e86a721ec1ce974
SHA1 acf3c376fce2903a0d12737c1647ed2bb2c3c66f
SHA512 601b9866c39301229f67c2af8315c6d272e048332a459d106a82f6ac33b7c16e44d427d43f589aa47dd528d43055daef6661d91c29653bd7339fd723aadeef15
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3S:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCAWSyg.exe

Path C:\Windows\System\mCAWSyg.exe
Size 1.9MB
SHA256 09b5e37836db328a51e6965f24d00f3059b835181a6b146212c7e257f28068e1
MD5 5602d6275aa567207ff8e00fce646381
SHA1 ee3b88a0e8fd047db321fe2684a177cc3b12a22b
SHA512 95b04521380750ce552f197c51520d34523cb49721d1c7c0b7fe4eaaa9d06693aaf4189354c888b4f8d914083d7524c62fc0a32b4f99b9d4ab77206f13c66583
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3p:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

mLWavWo.exe

Path C:\Windows\System\mLWavWo.exe
Size 1.9MB
SHA256 44a3e45bf3486ffa26716c0166996cb30a55661b242bc10b49f4b9f3008dba84
MD5 247756c7781e85c96a11d44fa818127b
SHA1 e662c3e1bc7888f380b9563e26545bcf57feaa75
SHA512 6d7fe20daf69651ef4d4253efa313df7d456a52e0a4c71595a049f9749b787c03807182639714fae8f95e22fb9200bd4a748f886cf8034c9ab7bf412873cffec
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3t:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkfkfkS.exe

Path C:\Windows\System\qkfkfkS.exe
Size 1.9MB
SHA256 993e6601e8d4f7e7fe7a2f43d683937401467e9a677d3fb739ecb53be4f422e3
MD5 341067e9723efab94bd48c3d6d71a792
SHA1 7471c09be8f968cb738c6726631261d1458d8085
SHA512 0088e5514977c851aacfd84fe0a0d22ee3811c730fc320c96d8d8e0698fdded58ec252643e55cba608854a578c9f21e71543717dee5047eacccff435f2d2f278
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3/:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

recdAXY.exe

Path C:\Windows\System\recdAXY.exe
Size 1.9MB
SHA256 c63f331e62f7d1b72360c7007cf249ec95c8d84514b06df8ba16c469f54f6d6f
MD5 8f9002115d28ba8a4ac6fe692d053324
SHA1 171b5fd864c9c44b2e2d759da5e5fec0f26d76b3
SHA512 572bdc836d2b6804b285f337fb9c58482a2d36a0f1a7f76f6cc102211e8837336fa487c57136f3163e92df0fbb6d422cfc3c5a08326539ffee22e047e57f195b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3H:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

snBbiHK.exe

Path C:\Windows\System\snBbiHK.exe
Size 1.9MB
SHA256 04a226c797bfc920607f21eaa56741fb922922fd231775ba8551b40014415892
MD5 407a3902290063dac4b449d6daa2dc1f
SHA1 63c8de854ac27eed64f8d9a53b1cb6d69712e23c
SHA512 eea3d00f042cd1c656fdf7695f326dfd87f2c2d1b4a641c57e3f353933056543602c94af7e824aab28572d7416e02d2e58f36a0200213abdad922cbfeed4444d
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3E:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vtBTHTB.exe

Path C:\Windows\System\vtBTHTB.exe
Size 1.9MB
SHA256 0d81b54d97534a350ad9f93e57af0c1bc36faf0302ec24f8b44de40b26e701b1
MD5 41c3e17b15bceada02964bf38fb4eabf
SHA1 50ae34a1013553f963262fb6342a63a390b0eaa6
SHA512 a19418653269fe9899e39f1f8a94eb9fe99296fd03d044642fcc06146e661a1db177936e3a4373fa24f478e672064995f78e97651178d8b77ca6c3b05d4e2a9b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO32:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

zDapXoL.exe

Path C:\Windows\System\zDapXoL.exe
Size 1.9MB
SHA256 4f3bb23cad55e624616e2638afc0acf0b115e6a85bbd45d31e030b016fc39afd
MD5 f56ce7f0480b32272e531bfc5c3b7fe4
SHA1 fdf617778d2c3f6c38f50d08e82fd28bef454f63
SHA512 b04d330743d81b75cb5e76be9d6e4f4bcc63da878b82da69138802328c0515dad4772a78eb85e450a3f90f96942d5626efd3a3b96212c0a74b2ded3a3650a28b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO3p:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/264-83-0x00007FF6E6B30000-0x00007FF6E6F22000-memory.dmp

Download

memory/424-2626-0x00007FF77E350000-0x00007FF77E742000-memory.dmp

Download

memory/424-84-0x00007FF77E350000-0x00007FF77E742000-memory.dmp

Download

memory/452-2654-0x00007FF63E350000-0x00007FF63E742000-memory.dmp

Download

memory/452-92-0x00007FF63E350000-0x00007FF63E742000-memory.dmp

Download

memory/512-2675-0x00007FF6C2B80000-0x00007FF6C2F72000-memory.dmp

Download

memory/512-530-0x00007FF6C2B80000-0x00007FF6C2F72000-memory.dmp

Download

memory/760-88-0x00007FF69C6A0000-0x00007FF69CA92000-memory.dmp

Download

memory/1020-2645-0x00007FF711780000-0x00007FF711B72000-memory.dmp

Download

memory/1020-2114-0x00007FF711780000-0x00007FF711B72000-memory.dmp

Download

memory/1020-91-0x00007FF711780000-0x00007FF711B72000-memory.dmp

Download

memory/1304-33-0x00007FF698500000-0x00007FF6988F2000-memory.dmp

Download

memory/1384-30-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp

Download

memory/1384-2110-0x00007FF6066F0000-0x00007FF606AE2000-memory.dmp

Download

memory/1444-24-0x00007FF70D810000-0x00007FF70DC02000-memory.dmp

Download

memory/2020-529-0x00007FF624170000-0x00007FF624562000-memory.dmp

Download

memory/2020-2671-0x00007FF624170000-0x00007FF624562000-memory.dmp

Download

memory/2456-26-0x00007FF6187C0000-0x00007FF618BB2000-memory.dmp

Download

memory/3132-536-0x00007FF7AB070000-0x00007FF7AB462000-memory.dmp

Download

memory/3132-2682-0x00007FF7AB070000-0x00007FF7AB462000-memory.dmp

Download

memory/3388-76-0x00007FF789170000-0x00007FF789562000-memory.dmp

Download

memory/3976-17-0x00007FFC1B380000-0x00007FFC1BE41000-memory.dmp

Download

memory/3976-1854-0x00007FFC1B380000-0x00007FFC1BE41000-memory.dmp

Download

memory/3976-69-0x0000028B2E8E0000-0x0000028B2E902000-memory.dmp

Download

memory/3976-36-0x0000028B2E960000-0x0000028B2E970000-memory.dmp

Download

memory/4164-2648-0x00007FF636140000-0x00007FF636532000-memory.dmp

Download

memory/4164-97-0x00007FF636140000-0x00007FF636532000-memory.dmp

Download

memory/4328-545-0x00007FF63FA50000-0x00007FF63FE42000-memory.dmp

Download

memory/4328-2721-0x00007FF63FA50000-0x00007FF63FE42000-memory.dmp

Download

memory/4352-2112-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp

Download

memory/4352-66-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp

Download

memory/4352-2619-0x00007FF6DF800000-0x00007FF6DFBF2000-memory.dmp

Download

memory/4412-2680-0x00007FF7A7980000-0x00007FF7A7D72000-memory.dmp

Download

memory/4412-531-0x00007FF7A7980000-0x00007FF7A7D72000-memory.dmp

Download

memory/4440-2111-0x00007FF78F6C0000-0x00007FF78FAB2000-memory.dmp

Download

memory/4440-60-0x00007FF78F6C0000-0x00007FF78FAB2000-memory.dmp

Download

memory/4520-2113-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp

Download

memory/4520-2632-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp

Download

memory/4520-70-0x00007FF6CEDD0000-0x00007FF6CF1C2000-memory.dmp

Download

memory/4532-2665-0x00007FF708260000-0x00007FF708652000-memory.dmp

Download

memory/4532-528-0x00007FF708260000-0x00007FF708652000-memory.dmp

Download

memory/5012-2667-0x00007FF6BC230000-0x00007FF6BC622000-memory.dmp

Download

memory/5012-527-0x00007FF6BC230000-0x00007FF6BC622000-memory.dmp

Download

memory/5068-0-0x00007FF69F1A0000-0x00007FF69F592000-memory.dmp

Download

memory/5068-1-0x0000022880F10000-0x0000022880F20000-memory.dmp

Download