xmrig | 0ad9c0f579a949af6813783ba1296e45914c543a20e7b3554aa52e0f6987eb79

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
Size

1.9MB
MD5

038fe4601734bbe5e88b1a1bcc0becb8
SHA1

147e42301949e03e435538ba59ff29c19321c308
SHA256

0ad9c0f579a949af6813783ba1296e45914c543a20e7b3554aa52e0f6987eb79
SHA512

8455fafde104834e970adffc48ba5d631ea15154bc506be11f34ca0dd17b90f832f401cd66f56cdc907b2c0f179c4dce74db1d006a48331cf7f9f39712aff1f4
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U18:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3720-213-0x00007FF6B9820000-0x00007FF6B9C12000-memory.dmp	xmrig
behavioral2/memory/4284-237-0x00007FF6CE070000-0x00007FF6CE462000-memory.dmp	xmrig
behavioral2/memory/4140-320-0x00007FF632E40000-0x00007FF633232000-memory.dmp	xmrig
behavioral2/memory/4980-323-0x00007FF71A060000-0x00007FF71A452000-memory.dmp	xmrig
behavioral2/memory/4524-354-0x00007FF687C80000-0x00007FF688072000-memory.dmp	xmrig
behavioral2/memory/2032-356-0x00007FF6DA160000-0x00007FF6DA552000-memory.dmp	xmrig
behavioral2/memory/2328-355-0x00007FF7BC840000-0x00007FF7BCC32000-memory.dmp	xmrig
behavioral2/memory/3160-353-0x00007FF6F0A20000-0x00007FF6F0E12000-memory.dmp	xmrig
behavioral2/memory/1224-351-0x00007FF7D2F00000-0x00007FF7D32F2000-memory.dmp	xmrig
behavioral2/memory/2004-322-0x00007FF72F860000-0x00007FF72FC52000-memory.dmp	xmrig
behavioral2/memory/2416-317-0x00007FF749880000-0x00007FF749C72000-memory.dmp	xmrig
behavioral2/memory/372-259-0x00007FF733140000-0x00007FF733532000-memory.dmp	xmrig
behavioral2/memory/2848-300-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	xmrig
behavioral2/memory/3492-249-0x00007FF622390000-0x00007FF622782000-memory.dmp	xmrig
behavioral2/memory/3092-236-0x00007FF69E820000-0x00007FF69EC12000-memory.dmp	xmrig
behavioral2/memory/4116-248-0x00007FF63F440000-0x00007FF63F832000-memory.dmp	xmrig
behavioral2/memory/3616-182-0x00007FF7BCFE0000-0x00007FF7BD3D2000-memory.dmp	xmrig
behavioral2/memory/4728-181-0x00007FF6FD280000-0x00007FF6FD672000-memory.dmp	xmrig
behavioral2/memory/2912-168-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp	xmrig
behavioral2/memory/4528-115-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp	xmrig
behavioral2/memory/4528-5946-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp	xmrig
behavioral2/memory/2728-5960-0x00007FF702610000-0x00007FF702A02000-memory.dmp	xmrig
behavioral2/memory/2912-5976-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp	xmrig
behavioral2/memory/4728-5979-0x00007FF6FD280000-0x00007FF6FD672000-memory.dmp	xmrig
behavioral2/memory/4524-5987-0x00007FF687C80000-0x00007FF688072000-memory.dmp	xmrig
behavioral2/memory/3616-5992-0x00007FF7BCFE0000-0x00007FF7BD3D2000-memory.dmp	xmrig
behavioral2/memory/3092-5997-0x00007FF69E820000-0x00007FF69EC12000-memory.dmp	xmrig
behavioral2/memory/4116-5994-0x00007FF63F440000-0x00007FF63F832000-memory.dmp	xmrig
behavioral2/memory/2328-5985-0x00007FF7BC840000-0x00007FF7BCC32000-memory.dmp	xmrig
behavioral2/memory/372-5983-0x00007FF733140000-0x00007FF733532000-memory.dmp	xmrig
behavioral2/memory/2032-6001-0x00007FF6DA160000-0x00007FF6DA552000-memory.dmp	xmrig
behavioral2/memory/1224-6013-0x00007FF7D2F00000-0x00007FF7D32F2000-memory.dmp	xmrig
behavioral2/memory/4140-6033-0x00007FF632E40000-0x00007FF633232000-memory.dmp	xmrig
behavioral2/memory/3492-6036-0x00007FF622390000-0x00007FF622782000-memory.dmp	xmrig
behavioral2/memory/2004-6030-0x00007FF72F860000-0x00007FF72FC52000-memory.dmp	xmrig
behavioral2/memory/3720-6027-0x00007FF6B9820000-0x00007FF6B9C12000-memory.dmp	xmrig
behavioral2/memory/4980-6024-0x00007FF71A060000-0x00007FF71A452000-memory.dmp	xmrig
behavioral2/memory/2416-6021-0x00007FF749880000-0x00007FF749C72000-memory.dmp	xmrig
behavioral2/memory/3160-6017-0x00007FF6F0A20000-0x00007FF6F0E12000-memory.dmp	xmrig
behavioral2/memory/2848-6011-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	xmrig
behavioral2/memory/4284-6008-0x00007FF6CE070000-0x00007FF6CE462000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2744	powershell.exe
5	2744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2728	CeJCcyN.exe
4524	HkJPcAG.exe
4528	NDytBeE.exe
2912	HAPMwct.exe
4728	zUijGhs.exe
2328	PTUeSYV.exe
3616	YbZJpCG.exe
3720	BbYppor.exe
3092	IssXTxq.exe
4284	xidusHU.exe
4116	jKYzTTI.exe
3492	yMULtHf.exe
372	IQTvzCi.exe
2848	cdPhGEA.exe
2416	zmStYJC.exe
4140	vvMqBHl.exe
2004	ySkEWHV.exe
4980	KdmIrcz.exe
2032	lIWodTE.exe
1224	lskUGSu.exe
3160	UDhXsZB.exe
4568	HEkoKMa.exe
4428	eQqGkBV.exe
2660	ZWFaqmA.exe
3684	FEHKXuD.exe
3200	ELPyqIG.exe
3340	LEvkYRX.exe
4972	dQmSeKE.exe
1976	WyyKPrs.exe
3384	hGQRcuH.exe
4424	kKGJxUq.exe
2024	ktHEbpf.exe
4840	mykXSHN.exe
4596	lrrjVUy.exe
4476	HoFdkQm.exe
4040	WYlhvaG.exe
1108	DtDisfM.exe
2280	fjsLllh.exe
3968	mnwlqxq.exe
800	avSZzke.exe
1948	hNoLSNN.exe
820	cJBmVhC.exe
4896	sQHbphF.exe
4900	fEUKkja.exe
1136	dhGnnlK.exe
756	aqENxFH.exe
5036	JPIdRpX.exe
1484	PGRxVFc.exe
3884	oRxpGxG.exe
4108	hQANOlA.exe
4992	VPdKYIG.exe
4128	CyNCudS.exe
4636	NZlVJZH.exe
4400	ZxArEiZ.exe
4572	kwOVciO.exe
4748	EoBQhfv.exe
1348	CzNqbBH.exe
2748	mkkrMbF.exe
4440	PSttZgc.exe
4272	nCTNNDC.exe
2348	jBdJLEe.exe
3736	uhrqlmB.exe
5068	MsDzPTB.exe
2708	WRftAlI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-0-0x00007FF663420000-0x00007FF663812000-memory.dmp	upx
behavioral2/files/0x00080000000233f9-5.dat	upx
behavioral2/files/0x0007000000023400-18.dat	upx
behavioral2/files/0x0007000000023404-32.dat	upx
behavioral2/files/0x000700000002340b-81.dat	upx
behavioral2/files/0x0007000000023411-101.dat	upx
behavioral2/files/0x0007000000023419-177.dat	upx
behavioral2/memory/3720-213-0x00007FF6B9820000-0x00007FF6B9C12000-memory.dmp	upx
behavioral2/memory/4284-237-0x00007FF6CE070000-0x00007FF6CE462000-memory.dmp	upx
behavioral2/memory/4140-320-0x00007FF632E40000-0x00007FF633232000-memory.dmp	upx
behavioral2/memory/4980-323-0x00007FF71A060000-0x00007FF71A452000-memory.dmp	upx
behavioral2/memory/4524-354-0x00007FF687C80000-0x00007FF688072000-memory.dmp	upx
behavioral2/memory/2032-356-0x00007FF6DA160000-0x00007FF6DA552000-memory.dmp	upx
behavioral2/memory/2328-355-0x00007FF7BC840000-0x00007FF7BCC32000-memory.dmp	upx
behavioral2/memory/3160-353-0x00007FF6F0A20000-0x00007FF6F0E12000-memory.dmp	upx
behavioral2/memory/1224-351-0x00007FF7D2F00000-0x00007FF7D32F2000-memory.dmp	upx
behavioral2/memory/2004-322-0x00007FF72F860000-0x00007FF72FC52000-memory.dmp	upx
behavioral2/memory/2416-317-0x00007FF749880000-0x00007FF749C72000-memory.dmp	upx
behavioral2/memory/372-259-0x00007FF733140000-0x00007FF733532000-memory.dmp	upx
behavioral2/memory/2848-300-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	upx
behavioral2/memory/3492-249-0x00007FF622390000-0x00007FF622782000-memory.dmp	upx
behavioral2/memory/3092-236-0x00007FF69E820000-0x00007FF69EC12000-memory.dmp	upx
behavioral2/memory/4116-248-0x00007FF63F440000-0x00007FF63F832000-memory.dmp	upx
behavioral2/memory/3616-182-0x00007FF7BCFE0000-0x00007FF7BD3D2000-memory.dmp	upx
behavioral2/memory/4728-181-0x00007FF6FD280000-0x00007FF6FD672000-memory.dmp	upx
behavioral2/files/0x0007000000023423-180.dat	upx
behavioral2/files/0x0007000000023422-179.dat	upx
behavioral2/files/0x0007000000023421-176.dat	upx
behavioral2/files/0x0007000000023420-175.dat	upx
behavioral2/files/0x000700000002341f-174.dat	upx
behavioral2/files/0x000700000002341e-173.dat	upx
behavioral2/files/0x000700000002341d-172.dat	upx
behavioral2/files/0x000700000002341c-171.dat	upx
behavioral2/memory/2912-168-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp	upx
behavioral2/files/0x000700000002341b-164.dat	upx
behavioral2/files/0x000700000002341a-159.dat	upx
behavioral2/files/0x0007000000023414-157.dat	upx
behavioral2/files/0x0007000000023413-155.dat	upx
behavioral2/files/0x000700000002340c-150.dat	upx
behavioral2/files/0x000700000002340d-145.dat	upx
behavioral2/files/0x000700000002340e-143.dat	upx
behavioral2/files/0x0007000000023405-141.dat	upx
behavioral2/files/0x0007000000023418-138.dat	upx
behavioral2/files/0x0007000000023417-137.dat	upx
behavioral2/files/0x0007000000023412-130.dat	upx
behavioral2/files/0x0007000000023410-123.dat	upx
behavioral2/files/0x0007000000023416-120.dat	upx
behavioral2/files/0x000700000002340a-119.dat	upx
behavioral2/memory/4528-115-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp	upx
behavioral2/files/0x0007000000023406-105.dat	upx
behavioral2/files/0x000700000002340f-93.dat	upx
behavioral2/files/0x0007000000023415-118.dat	upx
behavioral2/files/0x0007000000023408-108.dat	upx
behavioral2/files/0x0007000000023402-76.dat	upx
behavioral2/files/0x0007000000023403-69.dat	upx
behavioral2/files/0x0007000000023409-58.dat	upx
behavioral2/files/0x0007000000023407-54.dat	upx
behavioral2/files/0x00080000000233ff-43.dat	upx
behavioral2/files/0x0007000000023401-33.dat	upx
behavioral2/memory/2728-28-0x00007FF702610000-0x00007FF702A02000-memory.dmp	upx
behavioral2/files/0x00080000000233fc-17.dat	upx
behavioral2/memory/4528-5946-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp	upx
behavioral2/memory/2728-5960-0x00007FF702610000-0x00007FF702A02000-memory.dmp	upx
behavioral2/memory/2912-5976-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sJqiKBY.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\YBXkCWQ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ennEzTz.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\nqQwdSM.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\biScgCP.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZRkBPbG.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\IZDsfgk.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\GMiOJYn.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\zyPThmZ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\TQnEBby.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\UbELiLW.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\QyzJLwf.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\fgqQbNW.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ucyrdRt.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\yrwvWRR.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\LgOseXU.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\cwQUyvD.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\siuyVjh.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\MiiUXCa.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\VSSWelU.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\BDklfos.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\CKGunlV.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\OZQGuJo.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\dsMrBOS.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\CKgdobi.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\LFIEpjZ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZYTCcQN.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\qHtrJXm.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\gptpOvL.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\IfFQLuZ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\YFAoKsb.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\aabhtKc.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ojCUcbi.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\EFunYVd.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\nAHEBcC.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\RxVSXsS.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\bUfxyBB.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\SLWXlWs.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\qHYyhRb.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\MYUjzKK.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\qTNSfWj.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\gMNRTzb.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\guBWjaI.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\TmwbkVQ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\QRpibMi.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\YhHGCkj.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\QqvMNYq.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\CxMeapL.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\XeNoBTy.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\rKXbDbG.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\zwDqjZl.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\otPrdwT.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZgQUGIk.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\MTXmwMK.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\Eicoqpv.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\AcgBtPN.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\UazOYlY.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\YBagIVq.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ysiOOFd.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\RKurpmm.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\whIyjMQ.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZalCfUj.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\NnBvuUK.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\iVGBFsC.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeLockMemoryPrivilege	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2744	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	82
PID 4136 wrote to memory of 2744	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	82
PID 4136 wrote to memory of 2728	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	83
PID 4136 wrote to memory of 2728	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	83
PID 4136 wrote to memory of 4528	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	84
PID 4136 wrote to memory of 4528	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	84
PID 4136 wrote to memory of 4524	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	85
PID 4136 wrote to memory of 4524	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	85
PID 4136 wrote to memory of 2912	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	86
PID 4136 wrote to memory of 2912	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	86
PID 4136 wrote to memory of 4728	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	87
PID 4136 wrote to memory of 4728	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	87
PID 4136 wrote to memory of 3092	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	88
PID 4136 wrote to memory of 3092	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	88
PID 4136 wrote to memory of 2328	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	89
PID 4136 wrote to memory of 2328	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	89
PID 4136 wrote to memory of 3616	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	90
PID 4136 wrote to memory of 3616	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	90
PID 4136 wrote to memory of 3720	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	91
PID 4136 wrote to memory of 3720	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	91
PID 4136 wrote to memory of 4284	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	92
PID 4136 wrote to memory of 4284	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	92
PID 4136 wrote to memory of 4116	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	93
PID 4136 wrote to memory of 4116	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	93
PID 4136 wrote to memory of 3492	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	94
PID 4136 wrote to memory of 3492	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	94
PID 4136 wrote to memory of 372	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	95
PID 4136 wrote to memory of 372	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	95
PID 4136 wrote to memory of 2848	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	96
PID 4136 wrote to memory of 2848	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	96
PID 4136 wrote to memory of 2416	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	97
PID 4136 wrote to memory of 2416	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	97
PID 4136 wrote to memory of 4140	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	98
PID 4136 wrote to memory of 4140	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	98
PID 4136 wrote to memory of 2004	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	99
PID 4136 wrote to memory of 2004	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	99
PID 4136 wrote to memory of 4980	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	100
PID 4136 wrote to memory of 4980	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	100
PID 4136 wrote to memory of 2032	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	101
PID 4136 wrote to memory of 2032	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	101
PID 4136 wrote to memory of 1224	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	102
PID 4136 wrote to memory of 1224	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	102
PID 4136 wrote to memory of 3160	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	103
PID 4136 wrote to memory of 3160	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	103
PID 4136 wrote to memory of 4568	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	104
PID 4136 wrote to memory of 4568	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	104
PID 4136 wrote to memory of 1976	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	105
PID 4136 wrote to memory of 1976	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	105
PID 4136 wrote to memory of 4428	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	106
PID 4136 wrote to memory of 4428	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	106
PID 4136 wrote to memory of 2660	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	107
PID 4136 wrote to memory of 2660	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	107
PID 4136 wrote to memory of 3684	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	108
PID 4136 wrote to memory of 3684	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	108
PID 4136 wrote to memory of 3200	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	109
PID 4136 wrote to memory of 3200	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	109
PID 4136 wrote to memory of 3340	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	110
PID 4136 wrote to memory of 3340	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	110
PID 4136 wrote to memory of 4972	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	111
PID 4136 wrote to memory of 4972	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	111
PID 4136 wrote to memory of 3384	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	112
PID 4136 wrote to memory of 3384	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	112
PID 4136 wrote to memory of 4424	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	113
PID 4136 wrote to memory of 4424	4136	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System\CeJCcyN.exe
  C:\Windows\System\CeJCcyN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\NDytBeE.exe
  C:\Windows\System\NDytBeE.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\HkJPcAG.exe
  C:\Windows\System\HkJPcAG.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\HAPMwct.exe
  C:\Windows\System\HAPMwct.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\zUijGhs.exe
  C:\Windows\System\zUijGhs.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\IssXTxq.exe
  C:\Windows\System\IssXTxq.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\PTUeSYV.exe
  C:\Windows\System\PTUeSYV.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\YbZJpCG.exe
  C:\Windows\System\YbZJpCG.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\BbYppor.exe
  C:\Windows\System\BbYppor.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\xidusHU.exe
  C:\Windows\System\xidusHU.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\jKYzTTI.exe
  C:\Windows\System\jKYzTTI.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\yMULtHf.exe
  C:\Windows\System\yMULtHf.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\IQTvzCi.exe
  C:\Windows\System\IQTvzCi.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\cdPhGEA.exe
  C:\Windows\System\cdPhGEA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\zmStYJC.exe
  C:\Windows\System\zmStYJC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vvMqBHl.exe
  C:\Windows\System\vvMqBHl.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ySkEWHV.exe
  C:\Windows\System\ySkEWHV.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\KdmIrcz.exe
  C:\Windows\System\KdmIrcz.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\lIWodTE.exe
  C:\Windows\System\lIWodTE.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\lskUGSu.exe
  C:\Windows\System\lskUGSu.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\UDhXsZB.exe
  C:\Windows\System\UDhXsZB.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\HEkoKMa.exe
  C:\Windows\System\HEkoKMa.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\WyyKPrs.exe
  C:\Windows\System\WyyKPrs.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\eQqGkBV.exe
  C:\Windows\System\eQqGkBV.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ZWFaqmA.exe
  C:\Windows\System\ZWFaqmA.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\FEHKXuD.exe
  C:\Windows\System\FEHKXuD.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\ELPyqIG.exe
  C:\Windows\System\ELPyqIG.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\LEvkYRX.exe
  C:\Windows\System\LEvkYRX.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\dQmSeKE.exe
  C:\Windows\System\dQmSeKE.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\hGQRcuH.exe
  C:\Windows\System\hGQRcuH.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\kKGJxUq.exe
  C:\Windows\System\kKGJxUq.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ktHEbpf.exe
  C:\Windows\System\ktHEbpf.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\mykXSHN.exe
  C:\Windows\System\mykXSHN.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\lrrjVUy.exe
  C:\Windows\System\lrrjVUy.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\HoFdkQm.exe
  C:\Windows\System\HoFdkQm.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\WYlhvaG.exe
  C:\Windows\System\WYlhvaG.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\DtDisfM.exe
  C:\Windows\System\DtDisfM.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\fjsLllh.exe
  C:\Windows\System\fjsLllh.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\mnwlqxq.exe
  C:\Windows\System\mnwlqxq.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\avSZzke.exe
  C:\Windows\System\avSZzke.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\hNoLSNN.exe
  C:\Windows\System\hNoLSNN.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\cJBmVhC.exe
  C:\Windows\System\cJBmVhC.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\sQHbphF.exe
  C:\Windows\System\sQHbphF.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\fEUKkja.exe
  C:\Windows\System\fEUKkja.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\dhGnnlK.exe
  C:\Windows\System\dhGnnlK.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\kwOVciO.exe
  C:\Windows\System\kwOVciO.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\EoBQhfv.exe
  C:\Windows\System\EoBQhfv.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\aqENxFH.exe
  C:\Windows\System\aqENxFH.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\JPIdRpX.exe
  C:\Windows\System\JPIdRpX.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\jBdJLEe.exe
  C:\Windows\System\jBdJLEe.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\PGRxVFc.exe
  C:\Windows\System\PGRxVFc.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\oRxpGxG.exe
  C:\Windows\System\oRxpGxG.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\hQANOlA.exe
  C:\Windows\System\hQANOlA.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\VPdKYIG.exe
  C:\Windows\System\VPdKYIG.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\CyNCudS.exe
  C:\Windows\System\CyNCudS.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\NZlVJZH.exe
  C:\Windows\System\NZlVJZH.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ZxArEiZ.exe
  C:\Windows\System\ZxArEiZ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\CzNqbBH.exe
  C:\Windows\System\CzNqbBH.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\mkkrMbF.exe
  C:\Windows\System\mkkrMbF.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\PSttZgc.exe
  C:\Windows\System\PSttZgc.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\nCTNNDC.exe
  C:\Windows\System\nCTNNDC.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\uhrqlmB.exe
  C:\Windows\System\uhrqlmB.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\MsDzPTB.exe
  C:\Windows\System\MsDzPTB.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\WRftAlI.exe
  C:\Windows\System\WRftAlI.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JLqbiYS.exe
  C:\Windows\System\JLqbiYS.exe
  2⤵
  PID:2928
- C:\Windows\System\wdEYmso.exe
  C:\Windows\System\wdEYmso.exe
  2⤵
  PID:4268
- C:\Windows\System\LWmNAAv.exe
  C:\Windows\System\LWmNAAv.exe
  2⤵
  PID:4904
- C:\Windows\System\ggcCpfT.exe
  C:\Windows\System\ggcCpfT.exe
  2⤵
  PID:1904
- C:\Windows\System\UCqzIRE.exe
  C:\Windows\System\UCqzIRE.exe
  2⤵
  PID:4756
- C:\Windows\System\oCryBLw.exe
  C:\Windows\System\oCryBLw.exe
  2⤵
  PID:1596
- C:\Windows\System\CaScQHP.exe
  C:\Windows\System\CaScQHP.exe
  2⤵
  PID:1184
- C:\Windows\System\cUaupSq.exe
  C:\Windows\System\cUaupSq.exe
  2⤵
  PID:544
- C:\Windows\System\pPaPTNK.exe
  C:\Windows\System\pPaPTNK.exe
  2⤵
  PID:4964
- C:\Windows\System\zLxpixC.exe
  C:\Windows\System\zLxpixC.exe
  2⤵
  PID:2232
- C:\Windows\System\fPgJGbB.exe
  C:\Windows\System\fPgJGbB.exe
  2⤵
  PID:3316
- C:\Windows\System\aWXRpcM.exe
  C:\Windows\System\aWXRpcM.exe
  2⤵
  PID:2140
- C:\Windows\System\MExSWlM.exe
  C:\Windows\System\MExSWlM.exe
  2⤵
  PID:3592
- C:\Windows\System\QYuqmAV.exe
  C:\Windows\System\QYuqmAV.exe
  2⤵
  PID:5212
- C:\Windows\System\RBPJLdr.exe
  C:\Windows\System\RBPJLdr.exe
  2⤵
  PID:5252
- C:\Windows\System\ylGYeFG.exe
  C:\Windows\System\ylGYeFG.exe
  2⤵
  PID:5268
- C:\Windows\System\RdKbJAU.exe
  C:\Windows\System\RdKbJAU.exe
  2⤵
  PID:5284
- C:\Windows\System\KmTrUfl.exe
  C:\Windows\System\KmTrUfl.exe
  2⤵
  PID:5308
- C:\Windows\System\LsWsbLC.exe
  C:\Windows\System\LsWsbLC.exe
  2⤵
  PID:5324
- C:\Windows\System\bwQlwqc.exe
  C:\Windows\System\bwQlwqc.exe
  2⤵
  PID:5436
- C:\Windows\System\UMJPdWl.exe
  C:\Windows\System\UMJPdWl.exe
  2⤵
  PID:5460
- C:\Windows\System\sTUDoYR.exe
  C:\Windows\System\sTUDoYR.exe
  2⤵
  PID:5480
- C:\Windows\System\WXeyavR.exe
  C:\Windows\System\WXeyavR.exe
  2⤵
  PID:5500
- C:\Windows\System\TZhCNeK.exe
  C:\Windows\System\TZhCNeK.exe
  2⤵
  PID:5520
- C:\Windows\System\WQJrYve.exe
  C:\Windows\System\WQJrYve.exe
  2⤵
  PID:5544
- C:\Windows\System\kryNeQM.exe
  C:\Windows\System\kryNeQM.exe
  2⤵
  PID:5568
- C:\Windows\System\tJBMrgm.exe
  C:\Windows\System\tJBMrgm.exe
  2⤵
  PID:5920
- C:\Windows\System\nRwYanC.exe
  C:\Windows\System\nRwYanC.exe
  2⤵
  PID:5976
- C:\Windows\System\OwewKXM.exe
  C:\Windows\System\OwewKXM.exe
  2⤵
  PID:6000
- C:\Windows\System\BLVppLL.exe
  C:\Windows\System\BLVppLL.exe
  2⤵
  PID:6020
- C:\Windows\System\iqtukMt.exe
  C:\Windows\System\iqtukMt.exe
  2⤵
  PID:6036
- C:\Windows\System\iiNlfwZ.exe
  C:\Windows\System\iiNlfwZ.exe
  2⤵
  PID:6056
- C:\Windows\System\TMtUuWP.exe
  C:\Windows\System\TMtUuWP.exe
  2⤵
  PID:6084
- C:\Windows\System\uSCglIf.exe
  C:\Windows\System\uSCglIf.exe
  2⤵
  PID:6108
- C:\Windows\System\tjrYUqJ.exe
  C:\Windows\System\tjrYUqJ.exe
  2⤵
  PID:6128
- C:\Windows\System\IoCHyuZ.exe
  C:\Windows\System\IoCHyuZ.exe
  2⤵
  PID:2320
- C:\Windows\System\EWVujfo.exe
  C:\Windows\System\EWVujfo.exe
  2⤵
  PID:4412
- C:\Windows\System\IdHGFnz.exe
  C:\Windows\System\IdHGFnz.exe
  2⤵
  PID:4432
- C:\Windows\System\MLMmoCz.exe
  C:\Windows\System\MLMmoCz.exe
  2⤵
  PID:3856
- C:\Windows\System\JWADSKU.exe
  C:\Windows\System\JWADSKU.exe
  2⤵
  PID:3100
- C:\Windows\System\AvsvXxv.exe
  C:\Windows\System\AvsvXxv.exe
  2⤵
  PID:1900
- C:\Windows\System\fdIMgAX.exe
  C:\Windows\System\fdIMgAX.exe
  2⤵
  PID:4580
- C:\Windows\System\MUBgZde.exe
  C:\Windows\System\MUBgZde.exe
  2⤵
  PID:1248
- C:\Windows\System\OwFqdju.exe
  C:\Windows\System\OwFqdju.exe
  2⤵
  PID:2944
- C:\Windows\System\bStHRqq.exe
  C:\Windows\System\bStHRqq.exe
  2⤵
  PID:4836
- C:\Windows\System\jdTxgdW.exe
  C:\Windows\System\jdTxgdW.exe
  2⤵
  PID:4368
- C:\Windows\System\PLfEuca.exe
  C:\Windows\System\PLfEuca.exe
  2⤵
  PID:2904
- C:\Windows\System\CohKbfv.exe
  C:\Windows\System\CohKbfv.exe
  2⤵
  PID:1668
- C:\Windows\System\KKGslXv.exe
  C:\Windows\System\KKGslXv.exe
  2⤵
  PID:1472
- C:\Windows\System\RkKVTaq.exe
  C:\Windows\System\RkKVTaq.exe
  2⤵
  PID:5208
- C:\Windows\System\reujzYT.exe
  C:\Windows\System\reujzYT.exe
  2⤵
  PID:5276
- C:\Windows\System\wgIijvk.exe
  C:\Windows\System\wgIijvk.exe
  2⤵
  PID:5320
- C:\Windows\System\mXAcJRY.exe
  C:\Windows\System\mXAcJRY.exe
  2⤵
  PID:5400
- C:\Windows\System\LWxTxCa.exe
  C:\Windows\System\LWxTxCa.exe
  2⤵
  PID:5448
- C:\Windows\System\htXcdXF.exe
  C:\Windows\System\htXcdXF.exe
  2⤵
  PID:5492
- C:\Windows\System\ArsbVBK.exe
  C:\Windows\System\ArsbVBK.exe
  2⤵
  PID:5552
- C:\Windows\System\hdSJLqF.exe
  C:\Windows\System\hdSJLqF.exe
  2⤵
  PID:5512
- C:\Windows\System\pYKxQqM.exe
  C:\Windows\System\pYKxQqM.exe
  2⤵
  PID:5716
- C:\Windows\System\bRZFCLV.exe
  C:\Windows\System\bRZFCLV.exe
  2⤵
  PID:5736
- C:\Windows\System\vcQAPdq.exe
  C:\Windows\System\vcQAPdq.exe
  2⤵
  PID:5776
- C:\Windows\System\CqbVYGY.exe
  C:\Windows\System\CqbVYGY.exe
  2⤵
  PID:2988
- C:\Windows\System\aVKkSJw.exe
  C:\Windows\System\aVKkSJw.exe
  2⤵
  PID:2788
- C:\Windows\System\PAOBAHZ.exe
  C:\Windows\System\PAOBAHZ.exe
  2⤵
  PID:2008
- C:\Windows\System\wdgRxDh.exe
  C:\Windows\System\wdgRxDh.exe
  2⤵
  PID:2072
- C:\Windows\System\QZfWxPl.exe
  C:\Windows\System\QZfWxPl.exe
  2⤵
  PID:728
- C:\Windows\System\sZxGpuE.exe
  C:\Windows\System\sZxGpuE.exe
  2⤵
  PID:1540
- C:\Windows\System\vqAGvBY.exe
  C:\Windows\System\vqAGvBY.exe
  2⤵
  PID:1492
- C:\Windows\System\LMIJWfH.exe
  C:\Windows\System\LMIJWfH.exe
  2⤵
  PID:2968
- C:\Windows\System\yXgyIlr.exe
  C:\Windows\System\yXgyIlr.exe
  2⤵
  PID:1552
- C:\Windows\System\bIKmkSz.exe
  C:\Windows\System\bIKmkSz.exe
  2⤵
  PID:2384
- C:\Windows\System\AwwfWcP.exe
  C:\Windows\System\AwwfWcP.exe
  2⤵
  PID:1020
- C:\Windows\System\iwdOkRN.exe
  C:\Windows\System\iwdOkRN.exe
  2⤵
  PID:3752
- C:\Windows\System\HDYREYS.exe
  C:\Windows\System\HDYREYS.exe
  2⤵
  PID:5076
- C:\Windows\System\urbOSAP.exe
  C:\Windows\System\urbOSAP.exe
  2⤵
  PID:5932
- C:\Windows\System\ACGVjoa.exe
  C:\Windows\System\ACGVjoa.exe
  2⤵
  PID:6012
- C:\Windows\System\zZiLTYr.exe
  C:\Windows\System\zZiLTYr.exe
  2⤵
  PID:6064
- C:\Windows\System\trBDYkJ.exe
  C:\Windows\System\trBDYkJ.exe
  2⤵
  PID:6116
- C:\Windows\System\OwhtPml.exe
  C:\Windows\System\OwhtPml.exe
  2⤵
  PID:4888
- C:\Windows\System\dIIGusr.exe
  C:\Windows\System\dIIGusr.exe
  2⤵
  PID:4740
- C:\Windows\System\hSFQVbG.exe
  C:\Windows\System\hSFQVbG.exe
  2⤵
  PID:3552
- C:\Windows\System\PoHfsXx.exe
  C:\Windows\System\PoHfsXx.exe
  2⤵
  PID:4720
- C:\Windows\System\OWtgMre.exe
  C:\Windows\System\OWtgMre.exe
  2⤵
  PID:5016
- C:\Windows\System\JRETRkj.exe
  C:\Windows\System\JRETRkj.exe
  2⤵
  PID:4152
- C:\Windows\System\FDrnnQH.exe
  C:\Windows\System\FDrnnQH.exe
  2⤵
  PID:5428
- C:\Windows\System\wTbRFPd.exe
  C:\Windows\System\wTbRFPd.exe
  2⤵
  PID:5728
- C:\Windows\System\GLncHcR.exe
  C:\Windows\System\GLncHcR.exe
  2⤵
  PID:5528
- C:\Windows\System\IoGbFYf.exe
  C:\Windows\System\IoGbFYf.exe
  2⤵
  PID:1732
- C:\Windows\System\JgJCgAL.exe
  C:\Windows\System\JgJCgAL.exe
  2⤵
  PID:5908
- C:\Windows\System\WaFYLzd.exe
  C:\Windows\System\WaFYLzd.exe
  2⤵
  PID:5760
- C:\Windows\System\IPicIls.exe
  C:\Windows\System\IPicIls.exe
  2⤵
  PID:1812
- C:\Windows\System\OEhxiYS.exe
  C:\Windows\System\OEhxiYS.exe
  2⤵
  PID:6148
- C:\Windows\System\aplFVfH.exe
  C:\Windows\System\aplFVfH.exe
  2⤵
  PID:6164
- C:\Windows\System\PmvSQEn.exe
  C:\Windows\System\PmvSQEn.exe
  2⤵
  PID:6192
- C:\Windows\System\glZfyNB.exe
  C:\Windows\System\glZfyNB.exe
  2⤵
  PID:6216
- C:\Windows\System\aKHQXKa.exe
  C:\Windows\System\aKHQXKa.exe
  2⤵
  PID:6236
- C:\Windows\System\JlVMCHu.exe
  C:\Windows\System\JlVMCHu.exe
  2⤵
  PID:6260
- C:\Windows\System\XyFkLHH.exe
  C:\Windows\System\XyFkLHH.exe
  2⤵
  PID:6280
- C:\Windows\System\sHAYksp.exe
  C:\Windows\System\sHAYksp.exe
  2⤵
  PID:6304
- C:\Windows\System\cIKnWQg.exe
  C:\Windows\System\cIKnWQg.exe
  2⤵
  PID:6336
- C:\Windows\System\hRmnRfB.exe
  C:\Windows\System\hRmnRfB.exe
  2⤵
  PID:6356
- C:\Windows\System\GxWBcmv.exe
  C:\Windows\System\GxWBcmv.exe
  2⤵
  PID:6376
- C:\Windows\System\hHVeaAn.exe
  C:\Windows\System\hHVeaAn.exe
  2⤵
  PID:6400
- C:\Windows\System\egkfDaG.exe
  C:\Windows\System\egkfDaG.exe
  2⤵
  PID:6416
- C:\Windows\System\ouklInZ.exe
  C:\Windows\System\ouklInZ.exe
  2⤵
  PID:6432
- C:\Windows\System\mtANdPj.exe
  C:\Windows\System\mtANdPj.exe
  2⤵
  PID:6460
- C:\Windows\System\lwYtBDh.exe
  C:\Windows\System\lwYtBDh.exe
  2⤵
  PID:6484
- C:\Windows\System\BORQQOm.exe
  C:\Windows\System\BORQQOm.exe
  2⤵
  PID:6500
- C:\Windows\System\rwiwraA.exe
  C:\Windows\System\rwiwraA.exe
  2⤵
  PID:6540
- C:\Windows\System\eaZOyva.exe
  C:\Windows\System\eaZOyva.exe
  2⤵
  PID:6556
- C:\Windows\System\lzsjVmN.exe
  C:\Windows\System\lzsjVmN.exe
  2⤵
  PID:6584
- C:\Windows\System\QDsWogq.exe
  C:\Windows\System\QDsWogq.exe
  2⤵
  PID:6600
- C:\Windows\System\WEfKoJn.exe
  C:\Windows\System\WEfKoJn.exe
  2⤵
  PID:6624
- C:\Windows\System\FFfIbMQ.exe
  C:\Windows\System\FFfIbMQ.exe
  2⤵
  PID:6644
- C:\Windows\System\HJppGMh.exe
  C:\Windows\System\HJppGMh.exe
  2⤵
  PID:6660
- C:\Windows\System\cVkzoum.exe
  C:\Windows\System\cVkzoum.exe
  2⤵
  PID:6676
- C:\Windows\System\qIzZJOc.exe
  C:\Windows\System\qIzZJOc.exe
  2⤵
  PID:6700
- C:\Windows\System\bpsNKqE.exe
  C:\Windows\System\bpsNKqE.exe
  2⤵
  PID:6720
- C:\Windows\System\rhAIeiT.exe
  C:\Windows\System\rhAIeiT.exe
  2⤵
  PID:6744
- C:\Windows\System\bMZXJQz.exe
  C:\Windows\System\bMZXJQz.exe
  2⤵
  PID:6760
- C:\Windows\System\MUxkDQp.exe
  C:\Windows\System\MUxkDQp.exe
  2⤵
  PID:6788
- C:\Windows\System\YWrZyJX.exe
  C:\Windows\System\YWrZyJX.exe
  2⤵
  PID:6812
- C:\Windows\System\JgFrHAg.exe
  C:\Windows\System\JgFrHAg.exe
  2⤵
  PID:6836
- C:\Windows\System\VXfROjg.exe
  C:\Windows\System\VXfROjg.exe
  2⤵
  PID:6860
- C:\Windows\System\AmSDWYC.exe
  C:\Windows\System\AmSDWYC.exe
  2⤵
  PID:6876
- C:\Windows\System\BJhguNl.exe
  C:\Windows\System\BJhguNl.exe
  2⤵
  PID:6904
- C:\Windows\System\hMAoEHZ.exe
  C:\Windows\System\hMAoEHZ.exe
  2⤵
  PID:6940
- C:\Windows\System\YUrIqmn.exe
  C:\Windows\System\YUrIqmn.exe
  2⤵
  PID:6964
- C:\Windows\System\nnTdZCa.exe
  C:\Windows\System\nnTdZCa.exe
  2⤵
  PID:6980
- C:\Windows\System\kXbilVO.exe
  C:\Windows\System\kXbilVO.exe
  2⤵
  PID:7004
- C:\Windows\System\QYzwfYr.exe
  C:\Windows\System\QYzwfYr.exe
  2⤵
  PID:7024
- C:\Windows\System\gggzshd.exe
  C:\Windows\System\gggzshd.exe
  2⤵
  PID:7044
- C:\Windows\System\uFQVPGA.exe
  C:\Windows\System\uFQVPGA.exe
  2⤵
  PID:7064
- C:\Windows\System\wtvxToa.exe
  C:\Windows\System\wtvxToa.exe
  2⤵
  PID:7084
- C:\Windows\System\RLUWXAD.exe
  C:\Windows\System\RLUWXAD.exe
  2⤵
  PID:7104
- C:\Windows\System\hfaCRqE.exe
  C:\Windows\System\hfaCRqE.exe
  2⤵
  PID:7132
- C:\Windows\System\IJxMZoc.exe
  C:\Windows\System\IJxMZoc.exe
  2⤵
  PID:7152
- C:\Windows\System\lMRWPOZ.exe
  C:\Windows\System\lMRWPOZ.exe
  2⤵
  PID:2560
- C:\Windows\System\xBDnZHM.exe
  C:\Windows\System\xBDnZHM.exe
  2⤵
  PID:2692
- C:\Windows\System\ZDNBjpO.exe
  C:\Windows\System\ZDNBjpO.exe
  2⤵
  PID:368
- C:\Windows\System\QjgLxOD.exe
  C:\Windows\System\QjgLxOD.exe
  2⤵
  PID:2092
- C:\Windows\System\DrCoQXb.exe
  C:\Windows\System\DrCoQXb.exe
  2⤵
  PID:4388
- C:\Windows\System\AXDacyK.exe
  C:\Windows\System\AXDacyK.exe
  2⤵
  PID:5992
- C:\Windows\System\AfRkKEg.exe
  C:\Windows\System\AfRkKEg.exe
  2⤵
  PID:6188
- C:\Windows\System\mZvkzNm.exe
  C:\Windows\System\mZvkzNm.exe
  2⤵
  PID:6052
- C:\Windows\System\MPxETcD.exe
  C:\Windows\System\MPxETcD.exe
  2⤵
  PID:5072
- C:\Windows\System\ewwpSED.exe
  C:\Windows\System\ewwpSED.exe
  2⤵
  PID:3108
- C:\Windows\System\sdHxNMg.exe
  C:\Windows\System\sdHxNMg.exe
  2⤵
  PID:6272
- C:\Windows\System\RLRWnYU.exe
  C:\Windows\System\RLRWnYU.exe
  2⤵
  PID:6668
- C:\Windows\System\JHDqUct.exe
  C:\Windows\System\JHDqUct.exe
  2⤵
  PID:5260
- C:\Windows\System\YujWuJb.exe
  C:\Windows\System\YujWuJb.exe
  2⤵
  PID:2168
- C:\Windows\System\expZOnD.exe
  C:\Windows\System\expZOnD.exe
  2⤵
  PID:6800
- C:\Windows\System\zeygaCI.exe
  C:\Windows\System\zeygaCI.exe
  2⤵
  PID:6828
- C:\Windows\System\kcEurpJ.exe
  C:\Windows\System\kcEurpJ.exe
  2⤵
  PID:2292
- C:\Windows\System\QSkZNbo.exe
  C:\Windows\System\QSkZNbo.exe
  2⤵
  PID:6232
- C:\Windows\System\pmPhfEt.exe
  C:\Windows\System\pmPhfEt.exe
  2⤵
  PID:6612
- C:\Windows\System\fNpDcNu.exe
  C:\Windows\System\fNpDcNu.exe
  2⤵
  PID:6996
- C:\Windows\System\wFNKuJO.exe
  C:\Windows\System\wFNKuJO.exe
  2⤵
  PID:6396
- C:\Windows\System\qjqlkGc.exe
  C:\Windows\System\qjqlkGc.exe
  2⤵
  PID:6440
- C:\Windows\System\FGUIISE.exe
  C:\Windows\System\FGUIISE.exe
  2⤵
  PID:7172
- C:\Windows\System\QOrTEJD.exe
  C:\Windows\System\QOrTEJD.exe
  2⤵
  PID:7188
- C:\Windows\System\BAdExuF.exe
  C:\Windows\System\BAdExuF.exe
  2⤵
  PID:7216
- C:\Windows\System\LrLahYa.exe
  C:\Windows\System\LrLahYa.exe
  2⤵
  PID:7244
- C:\Windows\System\DrvZSTX.exe
  C:\Windows\System\DrvZSTX.exe
  2⤵
  PID:7264
- C:\Windows\System\JRmbVns.exe
  C:\Windows\System\JRmbVns.exe
  2⤵
  PID:7292
- C:\Windows\System\QfwvMSi.exe
  C:\Windows\System\QfwvMSi.exe
  2⤵
  PID:7312
- C:\Windows\System\UCfPAng.exe
  C:\Windows\System\UCfPAng.exe
  2⤵
  PID:7336
- C:\Windows\System\tVXJmom.exe
  C:\Windows\System\tVXJmom.exe
  2⤵
  PID:7364
- C:\Windows\System\UZxhdly.exe
  C:\Windows\System\UZxhdly.exe
  2⤵
  PID:7392
- C:\Windows\System\nvnXcYw.exe
  C:\Windows\System\nvnXcYw.exe
  2⤵
  PID:7412
- C:\Windows\System\JRvpthB.exe
  C:\Windows\System\JRvpthB.exe
  2⤵
  PID:7436
- C:\Windows\System\uSrrBLi.exe
  C:\Windows\System\uSrrBLi.exe
  2⤵
  PID:7456
- C:\Windows\System\OFiGVjr.exe
  C:\Windows\System\OFiGVjr.exe
  2⤵
  PID:7480
- C:\Windows\System\WPHJapx.exe
  C:\Windows\System\WPHJapx.exe
  2⤵
  PID:7504
- C:\Windows\System\ClAKPFs.exe
  C:\Windows\System\ClAKPFs.exe
  2⤵
  PID:7528
- C:\Windows\System\NKAoaVc.exe
  C:\Windows\System\NKAoaVc.exe
  2⤵
  PID:7552
- C:\Windows\System\uezGzuT.exe
  C:\Windows\System\uezGzuT.exe
  2⤵
  PID:7572
- C:\Windows\System\bowWxuc.exe
  C:\Windows\System\bowWxuc.exe
  2⤵
  PID:7596
- C:\Windows\System\OYNbMSQ.exe
  C:\Windows\System\OYNbMSQ.exe
  2⤵
  PID:7616
- C:\Windows\System\xiZnPFd.exe
  C:\Windows\System\xiZnPFd.exe
  2⤵
  PID:7652
- C:\Windows\System\wYeBLLS.exe
  C:\Windows\System\wYeBLLS.exe
  2⤵
  PID:7668
- C:\Windows\System\QJPaerE.exe
  C:\Windows\System\QJPaerE.exe
  2⤵
  PID:7692
- C:\Windows\System\BRnPUYi.exe
  C:\Windows\System\BRnPUYi.exe
  2⤵
  PID:7720
- C:\Windows\System\svaQarB.exe
  C:\Windows\System\svaQarB.exe
  2⤵
  PID:7736
- C:\Windows\System\oCQogIw.exe
  C:\Windows\System\oCQogIw.exe
  2⤵
  PID:7756
- C:\Windows\System\RWVyamr.exe
  C:\Windows\System\RWVyamr.exe
  2⤵
  PID:7776
- C:\Windows\System\yJuVpWH.exe
  C:\Windows\System\yJuVpWH.exe
  2⤵
  PID:7800
- C:\Windows\System\gwrlFXj.exe
  C:\Windows\System\gwrlFXj.exe
  2⤵
  PID:7820
- C:\Windows\System\lVtAaCP.exe
  C:\Windows\System\lVtAaCP.exe
  2⤵
  PID:7848
- C:\Windows\System\degiLUy.exe
  C:\Windows\System\degiLUy.exe
  2⤵
  PID:7864
- C:\Windows\System\agepzGT.exe
  C:\Windows\System\agepzGT.exe
  2⤵
  PID:7884
- C:\Windows\System\kUVEsMe.exe
  C:\Windows\System\kUVEsMe.exe
  2⤵
  PID:7904
- C:\Windows\System\TXTncZL.exe
  C:\Windows\System\TXTncZL.exe
  2⤵
  PID:7928
- C:\Windows\System\seTSlpt.exe
  C:\Windows\System\seTSlpt.exe
  2⤵
  PID:7952
- C:\Windows\System\pUPInqa.exe
  C:\Windows\System\pUPInqa.exe
  2⤵
  PID:7984
- C:\Windows\System\xpSOAau.exe
  C:\Windows\System\xpSOAau.exe
  2⤵
  PID:8004
- C:\Windows\System\zSriGXP.exe
  C:\Windows\System\zSriGXP.exe
  2⤵
  PID:8024
- C:\Windows\System\uSAPgwR.exe
  C:\Windows\System\uSAPgwR.exe
  2⤵
  PID:8048
- C:\Windows\System\dxSMfsx.exe
  C:\Windows\System\dxSMfsx.exe
  2⤵
  PID:8068
- C:\Windows\System\sqzzdcM.exe
  C:\Windows\System\sqzzdcM.exe
  2⤵
  PID:8096
- C:\Windows\System\ONfSVkm.exe
  C:\Windows\System\ONfSVkm.exe
  2⤵
  PID:8120
- C:\Windows\System\tESzSVd.exe
  C:\Windows\System\tESzSVd.exe
  2⤵
  PID:8148
- C:\Windows\System\txMXHal.exe
  C:\Windows\System\txMXHal.exe
  2⤵
  PID:8168
- C:\Windows\System\KHVHtSO.exe
  C:\Windows\System\KHVHtSO.exe
  2⤵
  PID:8188
- C:\Windows\System\ndKQbWl.exe
  C:\Windows\System\ndKQbWl.exe
  2⤵
  PID:6496
- C:\Windows\System\BeVEYnb.exe
  C:\Windows\System\BeVEYnb.exe
  2⤵
  PID:5564
- C:\Windows\System\nHdHCwI.exe
  C:\Windows\System\nHdHCwI.exe
  2⤵
  PID:6576
- C:\Windows\System\KnubPvi.exe
  C:\Windows\System\KnubPvi.exe
  2⤵
  PID:6312
- C:\Windows\System\DOhzXWW.exe
  C:\Windows\System\DOhzXWW.exe
  2⤵
  PID:7016
- C:\Windows\System\jCpKAgz.exe
  C:\Windows\System\jCpKAgz.exe
  2⤵
  PID:6712
- C:\Windows\System\HcByggU.exe
  C:\Windows\System\HcByggU.exe
  2⤵
  PID:1728
- C:\Windows\System\wDkevpU.exe
  C:\Windows\System\wDkevpU.exe
  2⤵
  PID:3328
- C:\Windows\System\fCYmrri.exe
  C:\Windows\System\fCYmrri.exe
  2⤵
  PID:6632
- C:\Windows\System\jygSBpN.exe
  C:\Windows\System\jygSBpN.exe
  2⤵
  PID:7096
- C:\Windows\System\MmVWOMn.exe
  C:\Windows\System\MmVWOMn.exe
  2⤵
  PID:7128
- C:\Windows\System\lqkgTxZ.exe
  C:\Windows\System\lqkgTxZ.exe
  2⤵
  PID:7144
- C:\Windows\System\JhCqzfA.exe
  C:\Windows\System\JhCqzfA.exe
  2⤵
  PID:6856
- C:\Windows\System\EnvWbhM.exe
  C:\Windows\System\EnvWbhM.exe
  2⤵
  PID:6028
- C:\Windows\System\RWXiYFT.exe
  C:\Windows\System\RWXiYFT.exe
  2⤵
  PID:5392
- C:\Windows\System\bmCpjoX.exe
  C:\Windows\System\bmCpjoX.exe
  2⤵
  PID:6932
- C:\Windows\System\GytCDmW.exe
  C:\Windows\System\GytCDmW.exe
  2⤵
  PID:6172
- C:\Windows\System\uIGmByV.exe
  C:\Windows\System\uIGmByV.exe
  2⤵
  PID:5556
- C:\Windows\System\bMuRLpJ.exe
  C:\Windows\System\bMuRLpJ.exe
  2⤵
  PID:7472
- C:\Windows\System\yKmcQws.exe
  C:\Windows\System\yKmcQws.exe
  2⤵
  PID:7524
- C:\Windows\System\QCadIkr.exe
  C:\Windows\System\QCadIkr.exe
  2⤵
  PID:7592
- C:\Windows\System\OHNdsDA.exe
  C:\Windows\System\OHNdsDA.exe
  2⤵
  PID:6344
- C:\Windows\System\GgPEFJi.exe
  C:\Windows\System\GgPEFJi.exe
  2⤵
  PID:6212
- C:\Windows\System\bxdimyx.exe
  C:\Windows\System\bxdimyx.exe
  2⤵
  PID:7080
- C:\Windows\System\DmJVVtj.exe
  C:\Windows\System\DmJVVtj.exe
  2⤵
  PID:6256
- C:\Windows\System\DucYPuo.exe
  C:\Windows\System\DucYPuo.exe
  2⤵
  PID:4564
- C:\Windows\System\FoJliDf.exe
  C:\Windows\System\FoJliDf.exe
  2⤵
  PID:7840
- C:\Windows\System\YnKZqQc.exe
  C:\Windows\System\YnKZqQc.exe
  2⤵
  PID:6412
- C:\Windows\System\xCfksLS.exe
  C:\Windows\System\xCfksLS.exe
  2⤵
  PID:7896
- C:\Windows\System\eCuvrqz.exe
  C:\Windows\System\eCuvrqz.exe
  2⤵
  PID:7256
- C:\Windows\System\llvlUEu.exe
  C:\Windows\System\llvlUEu.exe
  2⤵
  PID:8044
- C:\Windows\System\wFbZxsp.exe
  C:\Windows\System\wFbZxsp.exe
  2⤵
  PID:8208
- C:\Windows\System\FBiqMOL.exe
  C:\Windows\System\FBiqMOL.exe
  2⤵
  PID:8224
- C:\Windows\System\yPzeBCf.exe
  C:\Windows\System\yPzeBCf.exe
  2⤵
  PID:8252
- C:\Windows\System\BLsJxTe.exe
  C:\Windows\System\BLsJxTe.exe
  2⤵
  PID:8276
- C:\Windows\System\wxBYFVn.exe
  C:\Windows\System\wxBYFVn.exe
  2⤵
  PID:8296
- C:\Windows\System\LxFcBUH.exe
  C:\Windows\System\LxFcBUH.exe
  2⤵
  PID:8324
- C:\Windows\System\TXpkDPg.exe
  C:\Windows\System\TXpkDPg.exe
  2⤵
  PID:8340
- C:\Windows\System\NZXxpMD.exe
  C:\Windows\System\NZXxpMD.exe
  2⤵
  PID:8368
- C:\Windows\System\PRPixwj.exe
  C:\Windows\System\PRPixwj.exe
  2⤵
  PID:8384
- C:\Windows\System\jjsetzt.exe
  C:\Windows\System\jjsetzt.exe
  2⤵
  PID:8408
- C:\Windows\System\ubPGQgH.exe
  C:\Windows\System\ubPGQgH.exe
  2⤵
  PID:8432
- C:\Windows\System\bwSPGBG.exe
  C:\Windows\System\bwSPGBG.exe
  2⤵
  PID:8452
- C:\Windows\System\LOLWLvC.exe
  C:\Windows\System\LOLWLvC.exe
  2⤵
  PID:8476
- C:\Windows\System\VCQjEIW.exe
  C:\Windows\System\VCQjEIW.exe
  2⤵
  PID:8496
- C:\Windows\System\dfJsyVQ.exe
  C:\Windows\System\dfJsyVQ.exe
  2⤵
  PID:8520
- C:\Windows\System\TdUNCgP.exe
  C:\Windows\System\TdUNCgP.exe
  2⤵
  PID:8536
- C:\Windows\System\rndYbrp.exe
  C:\Windows\System\rndYbrp.exe
  2⤵
  PID:8560
- C:\Windows\System\gHWmmtu.exe
  C:\Windows\System\gHWmmtu.exe
  2⤵
  PID:8584
- C:\Windows\System\ttJLawP.exe
  C:\Windows\System\ttJLawP.exe
  2⤵
  PID:8608
- C:\Windows\System\GkEPeoX.exe
  C:\Windows\System\GkEPeoX.exe
  2⤵
  PID:8628
- C:\Windows\System\TVeFcDH.exe
  C:\Windows\System\TVeFcDH.exe
  2⤵
  PID:8648
- C:\Windows\System\zuZwqMk.exe
  C:\Windows\System\zuZwqMk.exe
  2⤵
  PID:8668
- C:\Windows\System\qovACbB.exe
  C:\Windows\System\qovACbB.exe
  2⤵
  PID:8696
- C:\Windows\System\XbAbSQY.exe
  C:\Windows\System\XbAbSQY.exe
  2⤵
  PID:8716
- C:\Windows\System\PjZBzjS.exe
  C:\Windows\System\PjZBzjS.exe
  2⤵
  PID:8736
- C:\Windows\System\KuiAEqo.exe
  C:\Windows\System\KuiAEqo.exe
  2⤵
  PID:8760
- C:\Windows\System\KUbHhUP.exe
  C:\Windows\System\KUbHhUP.exe
  2⤵
  PID:8776
- C:\Windows\System\AIkHwid.exe
  C:\Windows\System\AIkHwid.exe
  2⤵
  PID:8800
- C:\Windows\System\xOQZWXM.exe
  C:\Windows\System\xOQZWXM.exe
  2⤵
  PID:8824
- C:\Windows\System\RDmvEEs.exe
  C:\Windows\System\RDmvEEs.exe
  2⤵
  PID:8848
- C:\Windows\System\HdHthXy.exe
  C:\Windows\System\HdHthXy.exe
  2⤵
  PID:8872
- C:\Windows\System\ZErKjVJ.exe
  C:\Windows\System\ZErKjVJ.exe
  2⤵
  PID:8896
- C:\Windows\System\hgvtXDB.exe
  C:\Windows\System\hgvtXDB.exe
  2⤵
  PID:8916
- C:\Windows\System\wQwaOIN.exe
  C:\Windows\System\wQwaOIN.exe
  2⤵
  PID:8936
- C:\Windows\System\TKhTlCU.exe
  C:\Windows\System\TKhTlCU.exe
  2⤵
  PID:8956
- C:\Windows\System\yHDxMdp.exe
  C:\Windows\System\yHDxMdp.exe
  2⤵
  PID:8988
- C:\Windows\System\WiuUkzP.exe
  C:\Windows\System\WiuUkzP.exe
  2⤵
  PID:9008
- C:\Windows\System\IdGRTRx.exe
  C:\Windows\System\IdGRTRx.exe
  2⤵
  PID:9032
- C:\Windows\System\oCKVdmY.exe
  C:\Windows\System\oCKVdmY.exe
  2⤵
  PID:9048
- C:\Windows\System\RbMNrwl.exe
  C:\Windows\System\RbMNrwl.exe
  2⤵
  PID:9076
- C:\Windows\System\ozLKZOY.exe
  C:\Windows\System\ozLKZOY.exe
  2⤵
  PID:9096
- C:\Windows\System\oSuQMzW.exe
  C:\Windows\System\oSuQMzW.exe
  2⤵
  PID:9120
- C:\Windows\System\KETaBSY.exe
  C:\Windows\System\KETaBSY.exe
  2⤵
  PID:9136
- C:\Windows\System\WxIKXWs.exe
  C:\Windows\System\WxIKXWs.exe
  2⤵
  PID:9172
- C:\Windows\System\EPfRclE.exe
  C:\Windows\System\EPfRclE.exe
  2⤵
  PID:9204
- C:\Windows\System\NaiziBE.exe
  C:\Windows\System\NaiziBE.exe
  2⤵
  PID:7432
- C:\Windows\System\opOKknk.exe
  C:\Windows\System\opOKknk.exe
  2⤵
  PID:7464
- C:\Windows\System\vBNOevC.exe
  C:\Windows\System\vBNOevC.exe
  2⤵
  PID:7544
- C:\Windows\System\rwCbekt.exe
  C:\Windows\System\rwCbekt.exe
  2⤵
  PID:7580
- C:\Windows\System\JidDIwc.exe
  C:\Windows\System\JidDIwc.exe
  2⤵
  PID:6368
- C:\Windows\System\xEEpocL.exe
  C:\Windows\System\xEEpocL.exe
  2⤵
  PID:7112
- C:\Windows\System\yGZBrao.exe
  C:\Windows\System\yGZBrao.exe
  2⤵
  PID:788
- C:\Windows\System\yXPqeES.exe
  C:\Windows\System\yXPqeES.exe
  2⤵
  PID:7900
- C:\Windows\System\JLfBygE.exe
  C:\Windows\System\JLfBygE.exe
  2⤵
  PID:8040
- C:\Windows\System\JtUozyp.exe
  C:\Windows\System\JtUozyp.exe
  2⤵
  PID:7944
- C:\Windows\System\uwFVLlX.exe
  C:\Windows\System\uwFVLlX.exe
  2⤵
  PID:7360
- C:\Windows\System\bAmyYVD.exe
  C:\Windows\System\bAmyYVD.exe
  2⤵
  PID:8232
- C:\Windows\System\MnMALlN.exe
  C:\Windows\System\MnMALlN.exe
  2⤵
  PID:6508
- C:\Windows\System\rstFNzS.exe
  C:\Windows\System\rstFNzS.exe
  2⤵
  PID:8360
- C:\Windows\System\KfuJNuM.exe
  C:\Windows\System\KfuJNuM.exe
  2⤵
  PID:8416
- C:\Windows\System\BsFpvTo.exe
  C:\Windows\System\BsFpvTo.exe
  2⤵
  PID:8444
- C:\Windows\System\HdQzOUa.exe
  C:\Windows\System\HdQzOUa.exe
  2⤵
  PID:8508
- C:\Windows\System\EVBcvDr.exe
  C:\Windows\System\EVBcvDr.exe
  2⤵
  PID:8556
- C:\Windows\System\OCEkyAK.exe
  C:\Windows\System\OCEkyAK.exe
  2⤵
  PID:8604
- C:\Windows\System\TZAXbFE.exe
  C:\Windows\System\TZAXbFE.exe
  2⤵
  PID:9236
- C:\Windows\System\ueemrrG.exe
  C:\Windows\System\ueemrrG.exe
  2⤵
  PID:9260
- C:\Windows\System\TMoSyrF.exe
  C:\Windows\System\TMoSyrF.exe
  2⤵
  PID:9288
- C:\Windows\System\fRjCPmV.exe
  C:\Windows\System\fRjCPmV.exe
  2⤵
  PID:9308
- C:\Windows\System\OBEBQrs.exe
  C:\Windows\System\OBEBQrs.exe
  2⤵
  PID:9328
- C:\Windows\System\dMASpfK.exe
  C:\Windows\System\dMASpfK.exe
  2⤵
  PID:9356
- C:\Windows\System\meNYLtu.exe
  C:\Windows\System\meNYLtu.exe
  2⤵
  PID:9380
- C:\Windows\System\pQzmcfp.exe
  C:\Windows\System\pQzmcfp.exe
  2⤵
  PID:9404
- C:\Windows\System\GOiYizB.exe
  C:\Windows\System\GOiYizB.exe
  2⤵
  PID:9424
- C:\Windows\System\CDmQVEd.exe
  C:\Windows\System\CDmQVEd.exe
  2⤵
  PID:9444
- C:\Windows\System\ZMJtFle.exe
  C:\Windows\System\ZMJtFle.exe
  2⤵
  PID:9468
- C:\Windows\System\DYoPRbU.exe
  C:\Windows\System\DYoPRbU.exe
  2⤵
  PID:9496
- C:\Windows\System\gNoFpuE.exe
  C:\Windows\System\gNoFpuE.exe
  2⤵
  PID:9516
- C:\Windows\System\nJSxLww.exe
  C:\Windows\System\nJSxLww.exe
  2⤵
  PID:9536
- C:\Windows\System\QjuLHvj.exe
  C:\Windows\System\QjuLHvj.exe
  2⤵
  PID:9564
- C:\Windows\System\tncERKO.exe
  C:\Windows\System\tncERKO.exe
  2⤵
  PID:9584
- C:\Windows\System\jkVSLPX.exe
  C:\Windows\System\jkVSLPX.exe
  2⤵
  PID:9608
- C:\Windows\System\NGsRiLr.exe
  C:\Windows\System\NGsRiLr.exe
  2⤵
  PID:9632
- C:\Windows\System\ebAvDPD.exe
  C:\Windows\System\ebAvDPD.exe
  2⤵
  PID:9652
- C:\Windows\System\MUaHacM.exe
  C:\Windows\System\MUaHacM.exe
  2⤵
  PID:9672
- C:\Windows\System\ElrHjUl.exe
  C:\Windows\System\ElrHjUl.exe
  2⤵
  PID:9696
- C:\Windows\System\kPRtGjA.exe
  C:\Windows\System\kPRtGjA.exe
  2⤵
  PID:9720
- C:\Windows\System\zSGvvQa.exe
  C:\Windows\System\zSGvvQa.exe
  2⤵
  PID:9740
- C:\Windows\System\VkDOAzK.exe
  C:\Windows\System\VkDOAzK.exe
  2⤵
  PID:9760
- C:\Windows\System\ykyfgjS.exe
  C:\Windows\System\ykyfgjS.exe
  2⤵
  PID:9784
- C:\Windows\System\cfVoMTi.exe
  C:\Windows\System\cfVoMTi.exe
  2⤵
  PID:9800
- C:\Windows\System\ulTXPdV.exe
  C:\Windows\System\ulTXPdV.exe
  2⤵
  PID:9824
- C:\Windows\System\mjdDVKa.exe
  C:\Windows\System\mjdDVKa.exe
  2⤵
  PID:9848
- C:\Windows\System\uBcwHkT.exe
  C:\Windows\System\uBcwHkT.exe
  2⤵
  PID:9864
- C:\Windows\System\BTvXZMC.exe
  C:\Windows\System\BTvXZMC.exe
  2⤵
  PID:9884
- C:\Windows\System\lybUKrt.exe
  C:\Windows\System\lybUKrt.exe
  2⤵
  PID:9912
- C:\Windows\System\qQDBBoR.exe
  C:\Windows\System\qQDBBoR.exe
  2⤵
  PID:9940
- C:\Windows\System\oEziqIQ.exe
  C:\Windows\System\oEziqIQ.exe
  2⤵
  PID:9960
- C:\Windows\System\hHWaqYK.exe
  C:\Windows\System\hHWaqYK.exe
  2⤵
  PID:9980
- C:\Windows\System\GdYpKpI.exe
  C:\Windows\System\GdYpKpI.exe
  2⤵
  PID:10008
- C:\Windows\System\fzwJjTD.exe
  C:\Windows\System\fzwJjTD.exe
  2⤵
  PID:10032
- C:\Windows\System\xqVZuug.exe
  C:\Windows\System\xqVZuug.exe
  2⤵
  PID:10052
- C:\Windows\System\qCMzYvs.exe
  C:\Windows\System\qCMzYvs.exe
  2⤵
  PID:10076
- C:\Windows\System\Btihumr.exe
  C:\Windows\System\Btihumr.exe
  2⤵
  PID:10100
- C:\Windows\System\rnsLmFF.exe
  C:\Windows\System\rnsLmFF.exe
  2⤵
  PID:10120
- C:\Windows\System\ZRnmEjw.exe
  C:\Windows\System\ZRnmEjw.exe
  2⤵
  PID:1880
- C:\Windows\System\AiHySKb.exe
  C:\Windows\System\AiHySKb.exe
  2⤵
  PID:8964
- C:\Windows\System\RbENXbn.exe
  C:\Windows\System\RbENXbn.exe
  2⤵
  PID:8972
- C:\Windows\System\PBeLYRL.exe
  C:\Windows\System\PBeLYRL.exe
  2⤵
  PID:9040
- C:\Windows\System\ttVWePh.exe
  C:\Windows\System\ttVWePh.exe
  2⤵
  PID:8060
- C:\Windows\System\ZKRGUvA.exe
  C:\Windows\System\ZKRGUvA.exe
  2⤵
  PID:9112
- C:\Windows\System\ickMZYx.exe
  C:\Windows\System\ickMZYx.exe
  2⤵
  PID:8112
- C:\Windows\System\luQpCyB.exe
  C:\Windows\System\luQpCyB.exe
  2⤵
  PID:8160
- C:\Windows\System\zcFNIgP.exe
  C:\Windows\System\zcFNIgP.exe
  2⤵
  PID:8260
- C:\Windows\System\GPswltk.exe
  C:\Windows\System\GPswltk.exe
  2⤵
  PID:8312
- C:\Windows\System\cyDWlRF.exe
  C:\Windows\System\cyDWlRF.exe
  2⤵
  PID:8332
- C:\Windows\System\oVtnXJs.exe
  C:\Windows\System\oVtnXJs.exe
  2⤵
  PID:8472
- C:\Windows\System\BobBgLp.exe
  C:\Windows\System\BobBgLp.exe
  2⤵
  PID:9256
- C:\Windows\System\eneVgTD.exe
  C:\Windows\System\eneVgTD.exe
  2⤵
  PID:6872
- C:\Windows\System\DcnbKsE.exe
  C:\Windows\System\DcnbKsE.exe
  2⤵
  PID:8744
- C:\Windows\System\TmhOURP.exe
  C:\Windows\System\TmhOURP.exe
  2⤵
  PID:8752
- C:\Windows\System\AubaoQx.exe
  C:\Windows\System\AubaoQx.exe
  2⤵
  PID:7832
- C:\Windows\System\Dciwgzw.exe
  C:\Windows\System\Dciwgzw.exe
  2⤵
  PID:8268
- C:\Windows\System\DsQMVXY.exe
  C:\Windows\System\DsQMVXY.exe
  2⤵
  PID:6692
- C:\Windows\System\AGveAUS.exe
  C:\Windows\System\AGveAUS.exe
  2⤵
  PID:8812
- C:\Windows\System\JhznAHx.exe
  C:\Windows\System\JhznAHx.exe
  2⤵
  PID:9664
- C:\Windows\System\pmiAOyl.exe
  C:\Windows\System\pmiAOyl.exe
  2⤵
  PID:9752
- C:\Windows\System\VjbesOl.exe
  C:\Windows\System\VjbesOl.exe
  2⤵
  PID:8880
- C:\Windows\System\XRouKPB.exe
  C:\Windows\System\XRouKPB.exe
  2⤵
  PID:9840
- C:\Windows\System\Woyvwaj.exe
  C:\Windows\System\Woyvwaj.exe
  2⤵
  PID:7812
- C:\Windows\System\BKBUvyi.exe
  C:\Windows\System\BKBUvyi.exe
  2⤵
  PID:9028
- C:\Windows\System\ZMfWZpj.exe
  C:\Windows\System\ZMfWZpj.exe
  2⤵
  PID:9992
- C:\Windows\System\HXSwTQS.exe
  C:\Windows\System\HXSwTQS.exe
  2⤵
  PID:10060
- C:\Windows\System\qRsbtuD.exe
  C:\Windows\System\qRsbtuD.exe
  2⤵
  PID:10260
- C:\Windows\System\YwZzwhB.exe
  C:\Windows\System\YwZzwhB.exe
  2⤵
  PID:10284
- C:\Windows\System\IOpRDuS.exe
  C:\Windows\System\IOpRDuS.exe
  2⤵
  PID:10304
- C:\Windows\System\WSkOplD.exe
  C:\Windows\System\WSkOplD.exe
  2⤵
  PID:10328
- C:\Windows\System\ZxDppme.exe
  C:\Windows\System\ZxDppme.exe
  2⤵
  PID:10352
- C:\Windows\System\TnvTpgs.exe
  C:\Windows\System\TnvTpgs.exe
  2⤵
  PID:10372
- C:\Windows\System\IasolLd.exe
  C:\Windows\System\IasolLd.exe
  2⤵
  PID:10392
- C:\Windows\System\BYuhZgE.exe
  C:\Windows\System\BYuhZgE.exe
  2⤵
  PID:10420
- C:\Windows\System\dlkNonv.exe
  C:\Windows\System\dlkNonv.exe
  2⤵
  PID:10448
- C:\Windows\System\ZCNvooJ.exe
  C:\Windows\System\ZCNvooJ.exe
  2⤵
  PID:10464
- C:\Windows\System\hMeINqL.exe
  C:\Windows\System\hMeINqL.exe
  2⤵
  PID:10488
- C:\Windows\System\DfuzORM.exe
  C:\Windows\System\DfuzORM.exe
  2⤵
  PID:10516
- C:\Windows\System\jbWctnl.exe
  C:\Windows\System\jbWctnl.exe
  2⤵
  PID:10544
- C:\Windows\System\RxhNHbJ.exe
  C:\Windows\System\RxhNHbJ.exe
  2⤵
  PID:10568
- C:\Windows\System\sCNyYfz.exe
  C:\Windows\System\sCNyYfz.exe
  2⤵
  PID:10588
- C:\Windows\System\twrXWjz.exe
  C:\Windows\System\twrXWjz.exe
  2⤵
  PID:10612
- C:\Windows\System\MaXyMYR.exe
  C:\Windows\System\MaXyMYR.exe
  2⤵
  PID:10636
- C:\Windows\System\qdaEFaj.exe
  C:\Windows\System\qdaEFaj.exe
  2⤵
  PID:10656
- C:\Windows\System\uxVvJeS.exe
  C:\Windows\System\uxVvJeS.exe
  2⤵
  PID:10680
- C:\Windows\System\svYkQFw.exe
  C:\Windows\System\svYkQFw.exe
  2⤵
  PID:10704
- C:\Windows\System\tGRPMNZ.exe
  C:\Windows\System\tGRPMNZ.exe
  2⤵
  PID:10732
- C:\Windows\System\RMfsAKu.exe
  C:\Windows\System\RMfsAKu.exe
  2⤵
  PID:10756
- C:\Windows\System\KAxKxhX.exe
  C:\Windows\System\KAxKxhX.exe
  2⤵
  PID:10776
- C:\Windows\System\KeWwaQN.exe
  C:\Windows\System\KeWwaQN.exe
  2⤵
  PID:10820
- C:\Windows\System\hdAhAAz.exe
  C:\Windows\System\hdAhAAz.exe
  2⤵
  PID:10844
- C:\Windows\System\WGyyBcX.exe
  C:\Windows\System\WGyyBcX.exe
  2⤵
  PID:10860
- C:\Windows\System\lCDVqFe.exe
  C:\Windows\System\lCDVqFe.exe
  2⤵
  PID:10876
- C:\Windows\System\MuVqPkg.exe
  C:\Windows\System\MuVqPkg.exe
  2⤵
  PID:10892
- C:\Windows\System\XhhaBBK.exe
  C:\Windows\System\XhhaBBK.exe
  2⤵
  PID:10908
- C:\Windows\System\MdzyLeZ.exe
  C:\Windows\System\MdzyLeZ.exe
  2⤵
  PID:10928
- C:\Windows\System\iiXehJE.exe
  C:\Windows\System\iiXehJE.exe
  2⤵
  PID:10944
- C:\Windows\System\fvhlTMy.exe
  C:\Windows\System\fvhlTMy.exe
  2⤵
  PID:10972
- C:\Windows\System\vtxcgvk.exe
  C:\Windows\System\vtxcgvk.exe
  2⤵
  PID:11000
- C:\Windows\System\JxUfxVj.exe
  C:\Windows\System\JxUfxVj.exe
  2⤵
  PID:11020
- C:\Windows\System\ANeLQbQ.exe
  C:\Windows\System\ANeLQbQ.exe
  2⤵
  PID:11044
- C:\Windows\System\KFyZrhM.exe
  C:\Windows\System\KFyZrhM.exe
  2⤵
  PID:11064
- C:\Windows\System\OBZBfcL.exe
  C:\Windows\System\OBZBfcL.exe
  2⤵
  PID:11084
- C:\Windows\System\nWtCIeb.exe
  C:\Windows\System\nWtCIeb.exe
  2⤵
  PID:11108
- C:\Windows\System\QUSzEQx.exe
  C:\Windows\System\QUSzEQx.exe
  2⤵
  PID:11128
- C:\Windows\System\rVbGSHb.exe
  C:\Windows\System\rVbGSHb.exe
  2⤵
  PID:11144
- C:\Windows\System\ESfphzf.exe
  C:\Windows\System\ESfphzf.exe
  2⤵
  PID:11168
- C:\Windows\System\NEFJEdr.exe
  C:\Windows\System\NEFJEdr.exe
  2⤵
  PID:11192
- C:\Windows\System\SLyTDqo.exe
  C:\Windows\System\SLyTDqo.exe
  2⤵
  PID:11208
- C:\Windows\System\QdoLJQj.exe
  C:\Windows\System\QdoLJQj.exe
  2⤵
  PID:11240
- C:\Windows\System\kCAuEot.exe
  C:\Windows\System\kCAuEot.exe
  2⤵
  PID:11260
- C:\Windows\System\FYHLaAB.exe
  C:\Windows\System\FYHLaAB.exe
  2⤵
  PID:8308
- C:\Windows\System\UeYjgfD.exe
  C:\Windows\System\UeYjgfD.exe
  2⤵
  PID:7332
- C:\Windows\System\kLvuEOa.exe
  C:\Windows\System\kLvuEOa.exe
  2⤵
  PID:10220
- C:\Windows\System\ywnFXby.exe
  C:\Windows\System\ywnFXby.exe
  2⤵
  PID:7036
- C:\Windows\System\YtahsWf.exe
  C:\Windows\System\YtahsWf.exe
  2⤵
  PID:8516
- C:\Windows\System\IqKAbjc.exe
  C:\Windows\System\IqKAbjc.exe
  2⤵
  PID:9232
- C:\Windows\System\kCfxIOu.exe
  C:\Windows\System\kCfxIOu.exe
  2⤵
  PID:9336
- C:\Windows\System\NtTUvfS.exe
  C:\Windows\System\NtTUvfS.exe
  2⤵
  PID:9376
- C:\Windows\System\yhMpfIQ.exe
  C:\Windows\System\yhMpfIQ.exe
  2⤵
  PID:9452
- C:\Windows\System\IeNXvXN.exe
  C:\Windows\System\IeNXvXN.exe
  2⤵
  PID:9436
- C:\Windows\System\iJUIwvK.exe
  C:\Windows\System\iJUIwvK.exe
  2⤵
  PID:9276
- C:\Windows\System\rHFueiA.exe
  C:\Windows\System\rHFueiA.exe
  2⤵
  PID:8968
- C:\Windows\System\UOllJxo.exe
  C:\Windows\System\UOllJxo.exe
  2⤵
  PID:9508
- C:\Windows\System\IKhpJPM.exe
  C:\Windows\System\IKhpJPM.exe
  2⤵
  PID:9092
- C:\Windows\System\lnMyQSN.exe
  C:\Windows\System\lnMyQSN.exe
  2⤵
  PID:9576
- C:\Windows\System\mtfTIga.exe
  C:\Windows\System\mtfTIga.exe
  2⤵
  PID:9644
- C:\Windows\System\vHcjoLb.exe
  C:\Windows\System\vHcjoLb.exe
  2⤵
  PID:9728
- C:\Windows\System\LCAJcud.exe
  C:\Windows\System\LCAJcud.exe
  2⤵
  PID:8932
- C:\Windows\System\OZlYnnE.exe
  C:\Windows\System\OZlYnnE.exe
  2⤵
  PID:7684
- C:\Windows\System\JYLyJpP.exe
  C:\Windows\System\JYLyJpP.exe
  2⤵
  PID:7420
- C:\Windows\System\bWUjOHT.exe
  C:\Windows\System\bWUjOHT.exe
  2⤵
  PID:9952
- C:\Windows\System\oiUvjpE.exe
  C:\Windows\System\oiUvjpE.exe
  2⤵
  PID:9160
- C:\Windows\System\bNDlKEs.exe
  C:\Windows\System\bNDlKEs.exe
  2⤵
  PID:9188
- C:\Windows\System\RWKJHdb.exe
  C:\Windows\System\RWKJHdb.exe
  2⤵
  PID:10084
- C:\Windows\System\bLoftGw.exe
  C:\Windows\System\bLoftGw.exe
  2⤵
  PID:10272
- C:\Windows\System\MyVxYAP.exe
  C:\Windows\System\MyVxYAP.exe
  2⤵
  PID:10336
- C:\Windows\System\CkTcxyh.exe
  C:\Windows\System\CkTcxyh.exe
  2⤵
  PID:10148
- C:\Windows\System\cQcGPWB.exe
  C:\Windows\System\cQcGPWB.exe
  2⤵
  PID:10484
- C:\Windows\System\kNKLoAm.exe
  C:\Windows\System\kNKLoAm.exe
  2⤵
  PID:10556
- C:\Windows\System\RtWNrkR.exe
  C:\Windows\System\RtWNrkR.exe
  2⤵
  PID:10532
- C:\Windows\System\mlllLLW.exe
  C:\Windows\System\mlllLLW.exe
  2⤵
  PID:10676
- C:\Windows\System\QYxMDfu.exe
  C:\Windows\System\QYxMDfu.exe
  2⤵
  PID:11288
- C:\Windows\System\AQCGhkd.exe
  C:\Windows\System\AQCGhkd.exe
  2⤵
  PID:11304
- C:\Windows\System\ufbtDWm.exe
  C:\Windows\System\ufbtDWm.exe
  2⤵
  PID:11332
- C:\Windows\System\hsvkjLM.exe
  C:\Windows\System\hsvkjLM.exe
  2⤵
  PID:11356
- C:\Windows\System\HrfzBtH.exe
  C:\Windows\System\HrfzBtH.exe
  2⤵
  PID:11384
- C:\Windows\System\AyFbKGf.exe
  C:\Windows\System\AyFbKGf.exe
  2⤵
  PID:11412
- C:\Windows\System\kcDBIvD.exe
  C:\Windows\System\kcDBIvD.exe
  2⤵
  PID:11428
- C:\Windows\System\PYihfIZ.exe
  C:\Windows\System\PYihfIZ.exe
  2⤵
  PID:11452
- C:\Windows\System\hfRYaqA.exe
  C:\Windows\System\hfRYaqA.exe
  2⤵
  PID:11476
- C:\Windows\System\hRhWBID.exe
  C:\Windows\System\hRhWBID.exe
  2⤵
  PID:11500
- C:\Windows\System\zhEJxVQ.exe
  C:\Windows\System\zhEJxVQ.exe
  2⤵
  PID:11524
- C:\Windows\System\hZWXNwO.exe
  C:\Windows\System\hZWXNwO.exe
  2⤵
  PID:11540
- C:\Windows\System\jcYerVJ.exe
  C:\Windows\System\jcYerVJ.exe
  2⤵
  PID:11556
- C:\Windows\System\zeLtXIA.exe
  C:\Windows\System\zeLtXIA.exe
  2⤵
  PID:11572
- C:\Windows\System\DTbfYVQ.exe
  C:\Windows\System\DTbfYVQ.exe
  2⤵
  PID:11588
- C:\Windows\System\GTxvLjH.exe
  C:\Windows\System\GTxvLjH.exe
  2⤵
  PID:11604
- C:\Windows\System\ARgpKiR.exe
  C:\Windows\System\ARgpKiR.exe
  2⤵
  PID:11620
- C:\Windows\System\dsrXsCl.exe
  C:\Windows\System\dsrXsCl.exe
  2⤵
  PID:11636
- C:\Windows\System\XRxmuZj.exe
  C:\Windows\System\XRxmuZj.exe
  2⤵
  PID:11656
- C:\Windows\System\xUWfTfv.exe
  C:\Windows\System\xUWfTfv.exe
  2⤵
  PID:11680
- C:\Windows\System\LpbkESZ.exe
  C:\Windows\System\LpbkESZ.exe
  2⤵
  PID:11700
- C:\Windows\System\oHNGQLN.exe
  C:\Windows\System\oHNGQLN.exe
  2⤵
  PID:11720
- C:\Windows\System\FZNlvzy.exe
  C:\Windows\System\FZNlvzy.exe
  2⤵
  PID:11744
- C:\Windows\System\aeeRayM.exe
  C:\Windows\System\aeeRayM.exe
  2⤵
  PID:11764
- C:\Windows\System\MrtXIZG.exe
  C:\Windows\System\MrtXIZG.exe
  2⤵
  PID:11792
- C:\Windows\System\wDCLzdA.exe
  C:\Windows\System\wDCLzdA.exe
  2⤵
  PID:11812
- C:\Windows\System\lYmTomL.exe
  C:\Windows\System\lYmTomL.exe
  2⤵
  PID:11836
- C:\Windows\System\yJdxtbJ.exe
  C:\Windows\System\yJdxtbJ.exe
  2⤵
  PID:11860
- C:\Windows\System\jspsJZn.exe
  C:\Windows\System\jspsJZn.exe
  2⤵
  PID:11880
- C:\Windows\System\SAbArHy.exe
  C:\Windows\System\SAbArHy.exe
  2⤵
  PID:11900
- C:\Windows\System\NyoXSjZ.exe
  C:\Windows\System\NyoXSjZ.exe
  2⤵
  PID:11924
- C:\Windows\System\LmOYfvh.exe
  C:\Windows\System\LmOYfvh.exe
  2⤵
  PID:11944
- C:\Windows\System\peGOmdW.exe
  C:\Windows\System\peGOmdW.exe
  2⤵
  PID:11964
- C:\Windows\System\XxafUBg.exe
  C:\Windows\System\XxafUBg.exe
  2⤵
  PID:11988
- C:\Windows\System\ddHPTZM.exe
  C:\Windows\System\ddHPTZM.exe
  2⤵
  PID:12004
- C:\Windows\System\LdOOZJF.exe
  C:\Windows\System\LdOOZJF.exe
  2⤵
  PID:12024
- C:\Windows\System\mpHuWSx.exe
  C:\Windows\System\mpHuWSx.exe
  2⤵
  PID:12048
- C:\Windows\System\XZfrTym.exe
  C:\Windows\System\XZfrTym.exe
  2⤵
  PID:12072
- C:\Windows\System\bdECEVe.exe
  C:\Windows\System\bdECEVe.exe
  2⤵
  PID:12088
- C:\Windows\System\eoizubt.exe
  C:\Windows\System\eoizubt.exe
  2⤵
  PID:12112
- C:\Windows\System\EfMSRqH.exe
  C:\Windows\System\EfMSRqH.exe
  2⤵
  PID:12136
- C:\Windows\System\CmqvuWW.exe
  C:\Windows\System\CmqvuWW.exe
  2⤵
  PID:12160
- C:\Windows\System\tOjsJIm.exe
  C:\Windows\System\tOjsJIm.exe
  2⤵
  PID:12192
- C:\Windows\System\aIgmNcH.exe
  C:\Windows\System\aIgmNcH.exe
  2⤵
  PID:12216
- C:\Windows\System\YkGOBeJ.exe
  C:\Windows\System\YkGOBeJ.exe
  2⤵
  PID:12240
- C:\Windows\System\DbKRTrf.exe
  C:\Windows\System\DbKRTrf.exe
  2⤵
  PID:12268
- C:\Windows\System\GBipfme.exe
  C:\Windows\System\GBipfme.exe
  2⤵
  PID:10712
- C:\Windows\System\cTjKyCf.exe
  C:\Windows\System\cTjKyCf.exe
  2⤵
  PID:916
- C:\Windows\System\bPdpadw.exe
  C:\Windows\System\bPdpadw.exe
  2⤵
  PID:5372
- C:\Windows\System\csivtfG.exe
  C:\Windows\System\csivtfG.exe
  2⤵
  PID:1600
- C:\Windows\System\KeqLAYm.exe
  C:\Windows\System\KeqLAYm.exe
  2⤵
  PID:8864
- C:\Windows\System\MXgMjhg.exe
  C:\Windows\System\MXgMjhg.exe
  2⤵
  PID:9616
- C:\Windows\System\mIqTrRZ.exe
  C:\Windows\System\mIqTrRZ.exe
  2⤵
  PID:11104
- C:\Windows\System\uHcmKWh.exe
  C:\Windows\System\uHcmKWh.exe
  2⤵
  PID:9712
- C:\Windows\System\vZzikab.exe
  C:\Windows\System\vZzikab.exe
  2⤵
  PID:9768
- C:\Windows\System\RbXLQne.exe
  C:\Windows\System\RbXLQne.exe
  2⤵
  PID:11180
- C:\Windows\System\lxKlfAc.exe
  C:\Windows\System\lxKlfAc.exe
  2⤵
  PID:8080
- C:\Windows\System\RgNtOKy.exe
  C:\Windows\System\RgNtOKy.exe
  2⤵
  PID:12296
- C:\Windows\System\VlUGIKl.exe
  C:\Windows\System\VlUGIKl.exe
  2⤵
  PID:12316
- C:\Windows\System\SAoFKjM.exe
  C:\Windows\System\SAoFKjM.exe
  2⤵
  PID:12348
- C:\Windows\System\BkzUXbI.exe
  C:\Windows\System\BkzUXbI.exe
  2⤵
  PID:12368
- C:\Windows\System\AOgvOgr.exe
  C:\Windows\System\AOgvOgr.exe
  2⤵
  PID:12400
- C:\Windows\System\LyVPmzp.exe
  C:\Windows\System\LyVPmzp.exe
  2⤵
  PID:12424
- C:\Windows\System\CBeGOOk.exe
  C:\Windows\System\CBeGOOk.exe
  2⤵
  PID:12448
- C:\Windows\System\iMBbPcn.exe
  C:\Windows\System\iMBbPcn.exe
  2⤵
  PID:12472
- C:\Windows\System\ujaUgwj.exe
  C:\Windows\System\ujaUgwj.exe
  2⤵
  PID:12492
- C:\Windows\System\ZnmjQOF.exe
  C:\Windows\System\ZnmjQOF.exe
  2⤵
  PID:12512
- C:\Windows\System\vtYrRRu.exe
  C:\Windows\System\vtYrRRu.exe
  2⤵
  PID:12540
- C:\Windows\System\kQXJapr.exe
  C:\Windows\System\kQXJapr.exe
  2⤵
  PID:12560
- C:\Windows\System\LFpdiVB.exe
  C:\Windows\System\LFpdiVB.exe
  2⤵
  PID:12580
- C:\Windows\System\kedLPll.exe
  C:\Windows\System\kedLPll.exe
  2⤵
  PID:12604
- C:\Windows\System\fPShYTq.exe
  C:\Windows\System\fPShYTq.exe
  2⤵
  PID:12624
- C:\Windows\System\OebXfzD.exe
  C:\Windows\System\OebXfzD.exe
  2⤵
  PID:12644
- C:\Windows\System\TbHwazu.exe
  C:\Windows\System\TbHwazu.exe
  2⤵
  PID:12664
- C:\Windows\System\FApujGM.exe
  C:\Windows\System\FApujGM.exe
  2⤵
  PID:12680
- C:\Windows\System\mUmOors.exe
  C:\Windows\System\mUmOors.exe
  2⤵
  PID:12696
- C:\Windows\System\rMTldFc.exe
  C:\Windows\System\rMTldFc.exe
  2⤵
  PID:12712
- C:\Windows\System\kNViwYF.exe
  C:\Windows\System\kNViwYF.exe
  2⤵
  PID:12728
- C:\Windows\System\kAuxujk.exe
  C:\Windows\System\kAuxujk.exe
  2⤵
  PID:12748
- C:\Windows\System\JmqyVvS.exe
  C:\Windows\System\JmqyVvS.exe
  2⤵
  PID:12764
- C:\Windows\System\oTpHJMm.exe
  C:\Windows\System\oTpHJMm.exe
  2⤵
  PID:12780
- C:\Windows\System\pjwSVxX.exe
  C:\Windows\System\pjwSVxX.exe
  2⤵
  PID:12796
- C:\Windows\System\EGQCSVG.exe
  C:\Windows\System\EGQCSVG.exe
  2⤵
  PID:12816
- C:\Windows\System\Ooeakfu.exe
  C:\Windows\System\Ooeakfu.exe
  2⤵
  PID:12840
- C:\Windows\System\mRSwHYA.exe
  C:\Windows\System\mRSwHYA.exe
  2⤵
  PID:12856
- C:\Windows\System\UiANZeL.exe
  C:\Windows\System\UiANZeL.exe
  2⤵
  PID:12880
- C:\Windows\System\lMsJXeG.exe
  C:\Windows\System\lMsJXeG.exe
  2⤵
  PID:12900
- C:\Windows\System\OZXZITe.exe
  C:\Windows\System\OZXZITe.exe
  2⤵
  PID:12920
- C:\Windows\System\BrgLigW.exe
  C:\Windows\System\BrgLigW.exe
  2⤵
  PID:13092
- C:\Windows\System\maOwHpM.exe
  C:\Windows\System\maOwHpM.exe
  2⤵
  PID:11080
- C:\Windows\System\zZUoMFT.exe
  C:\Windows\System\zZUoMFT.exe
  2⤵
  PID:9704
- C:\Windows\System\NDVtoro.exe
  C:\Windows\System\NDVtoro.exe
  2⤵
  PID:10456
- C:\Windows\System\YPwPWuN.exe
  C:\Windows\System\YPwPWuN.exe
  2⤵
  PID:11348
- C:\Windows\System\GgOjDUU.exe
  C:\Windows\System\GgOjDUU.exe
  2⤵
  PID:10904
- C:\Windows\System\SUTSGDO.exe
  C:\Windows\System\SUTSGDO.exe
  2⤵
  PID:10992
- C:\Windows\System\SrRwrxS.exe
  C:\Windows\System\SrRwrxS.exe
  2⤵
  PID:11756
- C:\Windows\System\oCyTIDk.exe
  C:\Windows\System\oCyTIDk.exe
  2⤵
  PID:11940
- C:\Windows\System\OGVVzDD.exe
  C:\Windows\System\OGVVzDD.exe
  2⤵
  PID:12000
- C:\Windows\System\YBagIVq.exe
  C:\Windows\System\YBagIVq.exe
  2⤵
  PID:12084
- C:\Windows\System\SQiEGQS.exe
  C:\Windows\System\SQiEGQS.exe
  2⤵
  PID:9420
- C:\Windows\System\PRWEaXN.exe
  C:\Windows\System\PRWEaXN.exe
  2⤵
  PID:12412
- C:\Windows\System\caYotmm.exe
  C:\Windows\System\caYotmm.exe
  2⤵
  PID:10244
- C:\Windows\System\QfmTqFG.exe
  C:\Windows\System\QfmTqFG.exe
  2⤵
  PID:11368
- C:\Windows\System\RakOYsu.exe
  C:\Windows\System\RakOYsu.exe
  2⤵
  PID:11564
- C:\Windows\System\tRBrWdV.exe
  C:\Windows\System\tRBrWdV.exe
  2⤵
  PID:12132
- C:\Windows\System\mAnTCbX.exe
  C:\Windows\System\mAnTCbX.exe
  2⤵
  PID:13052
- C:\Windows\System\bDTIKfA.exe
  C:\Windows\System\bDTIKfA.exe
  2⤵
  PID:5928
- C:\Windows\System\plWAWUl.exe
  C:\Windows\System\plWAWUl.exe
  2⤵
  PID:10300
- C:\Windows\System\GuhLWlW.exe
  C:\Windows\System\GuhLWlW.exe
  2⤵
  PID:13252
- C:\Windows\System\IMCSZhr.exe
  C:\Windows\System\IMCSZhr.exe
  2⤵
  PID:10980
- C:\Windows\System\PnhxTrh.exe
  C:\Windows\System\PnhxTrh.exe
  2⤵
  PID:9004
- C:\Windows\System\ZAyqPDo.exe
  C:\Windows\System\ZAyqPDo.exe
  2⤵
  PID:13264
- C:\Windows\System\yBDELJM.exe
  C:\Windows\System\yBDELJM.exe
  2⤵
  PID:12128
- C:\Windows\System\EagHRpR.exe
  C:\Windows\System\EagHRpR.exe
  2⤵
  PID:12464
- C:\Windows\System\rqoqrlw.exe
  C:\Windows\System\rqoqrlw.exe
  2⤵
  PID:12212
- C:\Windows\System\rGnHnwY.exe
  C:\Windows\System\rGnHnwY.exe
  2⤵
  PID:11252
- C:\Windows\System\OJhmQNN.exe
  C:\Windows\System\OJhmQNN.exe
  2⤵
  PID:12592
- C:\Windows\System\rHpTUrk.exe
  C:\Windows\System\rHpTUrk.exe
  2⤵
  PID:12660
- C:\Windows\System\ZSRJjlN.exe
  C:\Windows\System\ZSRJjlN.exe
  2⤵
  PID:9856
- C:\Windows\System\cahfPXY.exe
  C:\Windows\System\cahfPXY.exe
  2⤵
  PID:12656
- C:\Windows\System\SkbZSwf.exe
  C:\Windows\System\SkbZSwf.exe
  2⤵
  PID:2604
- C:\Windows\System\MHgmydP.exe
  C:\Windows\System\MHgmydP.exe
  2⤵
  PID:9128
- C:\Windows\System\bVobfos.exe
  C:\Windows\System\bVobfos.exe
  2⤵
  PID:12276
- C:\Windows\System\FPWhGCq.exe
  C:\Windows\System\FPWhGCq.exe
  2⤵
  PID:11580
- C:\Windows\System\kpOZSko.exe
  C:\Windows\System\kpOZSko.exe
  2⤵
  PID:11808
- C:\Windows\System\yqeMFgH.exe
  C:\Windows\System\yqeMFgH.exe
  2⤵
  PID:12380
- C:\Windows\System\ZglluOS.exe
  C:\Windows\System\ZglluOS.exe
  2⤵
  PID:1356
- C:\Windows\System\NrtoVwi.exe
  C:\Windows\System\NrtoVwi.exe
  2⤵
  PID:11016
- C:\Windows\System\HDpDGGh.exe
  C:\Windows\System\HDpDGGh.exe
  2⤵
  PID:12324
- C:\Windows\System\dpuoVgN.exe
  C:\Windows\System\dpuoVgN.exe
  2⤵
  PID:5332
- C:\Windows\System\fgchopn.exe
  C:\Windows\System\fgchopn.exe
  2⤵
  PID:10744
- C:\Windows\System\QXvyJVy.exe
  C:\Windows\System\QXvyJVy.exe
  2⤵
  PID:13172
- C:\Windows\System\HSCIwDR.exe
  C:\Windows\System\HSCIwDR.exe
  2⤵
  PID:9000
- C:\Windows\System\uUZDuvd.exe
  C:\Windows\System\uUZDuvd.exe
  2⤵
  PID:9184
- C:\Windows\System\jvJONow.exe
  C:\Windows\System\jvJONow.exe
  2⤵
  PID:11716
- C:\Windows\System\zzZOQWz.exe
  C:\Windows\System\zzZOQWz.exe
  2⤵
  PID:12616
- C:\Windows\System\RYRTbtJ.exe
  C:\Windows\System\RYRTbtJ.exe
  2⤵
  PID:12892
- C:\Windows\System\dlsePyD.exe
  C:\Windows\System\dlsePyD.exe
  2⤵
  PID:13240
- C:\Windows\System\OriVwMI.exe
  C:\Windows\System\OriVwMI.exe
  2⤵
  PID:10768
- C:\Windows\System\CFLoMdr.exe
  C:\Windows\System\CFLoMdr.exe
  2⤵
  PID:10816
- C:\Windows\System\QQbbxQE.exe
  C:\Windows\System\QQbbxQE.exe
  2⤵
  PID:5588
- C:\Windows\System\wZjncVM.exe
  C:\Windows\System\wZjncVM.exe
  2⤵
  PID:11868
- C:\Windows\System\vGXnGwi.exe
  C:\Windows\System\vGXnGwi.exe
  2⤵
  PID:12552
- C:\Windows\System\DAWlYNe.exe
  C:\Windows\System\DAWlYNe.exe
  2⤵
  PID:7700
- C:\Windows\System\nHwVkFv.exe
  C:\Windows\System\nHwVkFv.exe
  2⤵
  PID:2136
- C:\Windows\System\ahQKYPH.exe
  C:\Windows\System\ahQKYPH.exe
  2⤵
  PID:11120
- C:\Windows\System\jlMdyak.exe
  C:\Windows\System\jlMdyak.exe
  2⤵
  PID:3392
- C:\Windows\System\IlQdFZl.exe
  C:\Windows\System\IlQdFZl.exe
  2⤵
  PID:11028
- C:\Windows\System\jTynxPo.exe
  C:\Windows\System\jTynxPo.exe
  2⤵
  PID:11468
- C:\Windows\System\SYNGZfs.exe
  C:\Windows\System\SYNGZfs.exe
  2⤵
  PID:11492
- C:\Windows\System\taRWJPl.exe
  C:\Windows\System\taRWJPl.exe
  2⤵
  PID:12956
- C:\Windows\System\UveicIR.exe
  C:\Windows\System\UveicIR.exe
  2⤵
  PID:13128
- C:\Windows\System\BxRiuTx.exe
  C:\Windows\System\BxRiuTx.exe
  2⤵
  PID:12976
- C:\Windows\System\McaAoKJ.exe
  C:\Windows\System\McaAoKJ.exe
  2⤵
  PID:11284
- C:\Windows\System\ZXZLKjS.exe
  C:\Windows\System\ZXZLKjS.exe
  2⤵
  PID:9820
- C:\Windows\System\MaRkhVS.exe
  C:\Windows\System\MaRkhVS.exe
  2⤵
  PID:11760
- C:\Windows\System\jUVZMVM.exe
  C:\Windows\System\jUVZMVM.exe
  2⤵
  PID:10672
- C:\Windows\System\TZJsMVr.exe
  C:\Windows\System\TZJsMVr.exe
  2⤵
  PID:12248
- C:\Windows\System\baZsdMs.exe
  C:\Windows\System\baZsdMs.exe
  2⤵
  PID:13276
- C:\Windows\System\AgIMbun.exe
  C:\Windows\System\AgIMbun.exe
  2⤵
  PID:11300
- C:\Windows\System\PpLZSRz.exe
  C:\Windows\System\PpLZSRz.exe
  2⤵
  PID:8772
- C:\Windows\System\QfknsDu.exe
  C:\Windows\System\QfknsDu.exe
  2⤵
  PID:13212
- C:\Windows\System\cPsoukl.exe
  C:\Windows\System\cPsoukl.exe
  2⤵
  PID:11568
- C:\Windows\System\GbyQLDo.exe
  C:\Windows\System\GbyQLDo.exe
  2⤵
  PID:13356
- C:\Windows\System\ZdQUDoo.exe
  C:\Windows\System\ZdQUDoo.exe
  2⤵
  PID:13380
- C:\Windows\System\qYbdNKn.exe
  C:\Windows\System\qYbdNKn.exe
  2⤵
  PID:13652
- C:\Windows\System\TDslIQt.exe
  C:\Windows\System\TDslIQt.exe
  2⤵
  PID:13684
- C:\Windows\System\MUagFDt.exe
  C:\Windows\System\MUagFDt.exe
  2⤵
  PID:13708
- C:\Windows\System\pyhFTQA.exe
  C:\Windows\System\pyhFTQA.exe
  2⤵
  PID:13756
- C:\Windows\System\cuXONcd.exe
  C:\Windows\System\cuXONcd.exe
  2⤵
  PID:14060
- C:\Windows\System\cwVlksQ.exe
  C:\Windows\System\cwVlksQ.exe
  2⤵
  PID:14204
- C:\Windows\System\QLtlTWN.exe
  C:\Windows\System\QLtlTWN.exe
  2⤵
  PID:14284
- C:\Windows\System\SBfopYl.exe
  C:\Windows\System\SBfopYl.exe
  2⤵
  PID:9344
- C:\Windows\System\fGDdRXz.exe
  C:\Windows\System\fGDdRXz.exe
  2⤵
  PID:12972
- C:\Windows\System\DhxgFvJ.exe
  C:\Windows\System\DhxgFvJ.exe
  2⤵
  PID:13564
- C:\Windows\System\tuGAeVx.exe
  C:\Windows\System\tuGAeVx.exe
  2⤵
  PID:11584
- C:\Windows\System\rVBLRvQ.exe
  C:\Windows\System\rVBLRvQ.exe
  2⤵
  PID:13424
- C:\Windows\System\yHIcvee.exe
  C:\Windows\System\yHIcvee.exe
  2⤵
  PID:13492
- C:\Windows\System\WLoeadm.exe
  C:\Windows\System\WLoeadm.exe
  2⤵
  PID:12208
- C:\Windows\System\jKfRhMC.exe
  C:\Windows\System\jKfRhMC.exe
  2⤵
  PID:13468
- C:\Windows\System\JpHJZXu.exe
  C:\Windows\System\JpHJZXu.exe
  2⤵
  PID:13540
- C:\Windows\System\cznkAOB.exe
  C:\Windows\System\cznkAOB.exe
  2⤵
  PID:13548
- C:\Windows\System\RCvnyFt.exe
  C:\Windows\System\RCvnyFt.exe
  2⤵
  PID:13560
- C:\Windows\System\uHiFqWX.exe
  C:\Windows\System\uHiFqWX.exe
  2⤵
  PID:13584
- C:\Windows\System\PnlALqD.exe
  C:\Windows\System\PnlALqD.exe
  2⤵
  PID:13576
- C:\Windows\System\azKexUZ.exe
  C:\Windows\System\azKexUZ.exe
  2⤵
  PID:13512
- C:\Windows\System\AXHBMeQ.exe
  C:\Windows\System\AXHBMeQ.exe
  2⤵
  PID:13604
- C:\Windows\System\fuRwpGE.exe
  C:\Windows\System\fuRwpGE.exe
  2⤵
  PID:13724
- C:\Windows\System\eaAPpDk.exe
  C:\Windows\System\eaAPpDk.exe
  2⤵
  PID:13780
- C:\Windows\System\tJQpbwc.exe
  C:\Windows\System\tJQpbwc.exe
  2⤵
  PID:10836
- C:\Windows\System\rlbjsaF.exe
  C:\Windows\System\rlbjsaF.exe
  2⤵
  PID:13800
- C:\Windows\System\RVwHmCA.exe
  C:\Windows\System\RVwHmCA.exe
  2⤵
  PID:4612
- C:\Windows\System\jpCnsiN.exe
  C:\Windows\System\jpCnsiN.exe
  2⤵
  PID:13824
- C:\Windows\System\pWvQDOH.exe
  C:\Windows\System\pWvQDOH.exe
  2⤵
  PID:13792
- C:\Windows\System\HPwfOoE.exe
  C:\Windows\System\HPwfOoE.exe
  2⤵
  PID:3216
- C:\Windows\System\ZTPjMFi.exe
  C:\Windows\System\ZTPjMFi.exe
  2⤵
  PID:1740
- C:\Windows\System\JWwTjFh.exe
  C:\Windows\System\JWwTjFh.exe
  2⤵
  PID:3748
- C:\Windows\System\zuAzYYZ.exe
  C:\Windows\System\zuAzYYZ.exe
  2⤵
  PID:13644
- C:\Windows\System\ZsoDMPZ.exe
  C:\Windows\System\ZsoDMPZ.exe
  2⤵
  PID:13668
- C:\Windows\System\vbcVQIc.exe
  C:\Windows\System\vbcVQIc.exe
  2⤵
  PID:13916
- C:\Windows\System\qfTaLbC.exe
  C:\Windows\System\qfTaLbC.exe
  2⤵
  PID:13848
- C:\Windows\System\XlIOUex.exe
  C:\Windows\System\XlIOUex.exe
  2⤵
  PID:3732
- C:\Windows\System\ghGjfsF.exe
  C:\Windows\System\ghGjfsF.exe
  2⤵
  PID:13940
- C:\Windows\System\fycJDgN.exe
  C:\Windows\System\fycJDgN.exe
  2⤵
  PID:13628
- C:\Windows\System\yxHqezR.exe
  C:\Windows\System\yxHqezR.exe
  2⤵
  PID:12236
- C:\Windows\System\EytdXza.exe
  C:\Windows\System\EytdXza.exe
  2⤵
  PID:13412
- C:\Windows\System\JnEXkgE.exe
  C:\Windows\System\JnEXkgE.exe
  2⤵
  PID:13992
- C:\Windows\System\bPxNbKk.exe
  C:\Windows\System\bPxNbKk.exe
  2⤵
  PID:14012
- C:\Windows\System\VosAsNl.exe
  C:\Windows\System\VosAsNl.exe
  2⤵
  PID:14040
- C:\Windows\System\cJtwvXZ.exe
  C:\Windows\System\cJtwvXZ.exe
  2⤵
  PID:14124
- C:\Windows\System\oRUsacS.exe
  C:\Windows\System\oRUsacS.exe
  2⤵
  PID:14108
- C:\Windows\System\qYmQZWl.exe
  C:\Windows\System\qYmQZWl.exe
  2⤵
  PID:14112
- C:\Windows\System\tyDZazj.exe
  C:\Windows\System\tyDZazj.exe
  2⤵
  PID:14164
- C:\Windows\System\LDzDEXF.exe
  C:\Windows\System\LDzDEXF.exe
  2⤵
  PID:14144
- C:\Windows\System\Fojndmb.exe
  C:\Windows\System\Fojndmb.exe
  2⤵
  PID:13400
- C:\Windows\System\mozmVys.exe
  C:\Windows\System\mozmVys.exe
  2⤵
  PID:14120
- C:\Windows\System\HVfcdBN.exe
  C:\Windows\System\HVfcdBN.exe
  2⤵
  PID:14200
- C:\Windows\System\yuPWhRM.exe
  C:\Windows\System\yuPWhRM.exe
  2⤵
  PID:14240
- C:\Windows\System\mwzzifF.exe
  C:\Windows\System\mwzzifF.exe
  2⤵
  PID:14244
- C:\Windows\System\cANxEJs.exe
  C:\Windows\System\cANxEJs.exe
  2⤵
  PID:14224
- C:\Windows\System\avyMRil.exe
  C:\Windows\System\avyMRil.exe
  2⤵
  PID:14140
- C:\Windows\System\dqrOcIx.exe
  C:\Windows\System\dqrOcIx.exe
  2⤵
  PID:14096
- C:\Windows\System\JBfTHsC.exe
  C:\Windows\System\JBfTHsC.exe
  2⤵
  PID:14236
- C:\Windows\System\xZIxssg.exe
  C:\Windows\System\xZIxssg.exe
  2⤵
  PID:14332
- C:\Windows\System\PbuFzwW.exe
  C:\Windows\System\PbuFzwW.exe
  2⤵
  PID:1772
- C:\Windows\System\lyFBJjb.exe
  C:\Windows\System\lyFBJjb.exe
  2⤵
  PID:14320
- C:\Windows\System\PexoaZD.exe
  C:\Windows\System\PexoaZD.exe
  2⤵
  PID:12068
- C:\Windows\System\HXQmEYl.exe
  C:\Windows\System\HXQmEYl.exe
  2⤵
  PID:3256
- C:\Windows\System\ImXhMbb.exe
  C:\Windows\System\ImXhMbb.exe
  2⤵
  PID:9488
- C:\Windows\System\MFcHLIk.exe
  C:\Windows\System\MFcHLIk.exe
  2⤵
  PID:3640
- C:\Windows\System\PLpQdVO.exe
  C:\Windows\System\PLpQdVO.exe
  2⤵
  PID:3268
- C:\Windows\System\NsTlmwW.exe
  C:\Windows\System\NsTlmwW.exe
  2⤵
  PID:11532
- C:\Windows\System\ArNQFbg.exe
  C:\Windows\System\ArNQFbg.exe
  2⤵
  PID:13332
- C:\Windows\System\rgFvdUf.exe
  C:\Windows\System\rgFvdUf.exe
  2⤵
  PID:13396
- C:\Windows\System\rctxKrR.exe
  C:\Windows\System\rctxKrR.exe
  2⤵
  PID:5884
- C:\Windows\System\OqLNINQ.exe
  C:\Windows\System\OqLNINQ.exe
  2⤵
  PID:12988
- C:\Windows\System\GvkbXpx.exe
  C:\Windows\System\GvkbXpx.exe
  2⤵
  PID:4680
- C:\Windows\System\fcNBxIi.exe
  C:\Windows\System\fcNBxIi.exe
  2⤵
  PID:3164
- C:\Windows\System\NidjphS.exe
  C:\Windows\System\NidjphS.exe
  2⤵
  PID:13432
- C:\Windows\System\QPeHblM.exe
  C:\Windows\System\QPeHblM.exe
  2⤵
  PID:5860
- C:\Windows\System\eejmGma.exe
  C:\Windows\System\eejmGma.exe
  2⤵
  PID:12020
- C:\Windows\System\SSRTtuG.exe
  C:\Windows\System\SSRTtuG.exe
  2⤵
  PID:13456
- C:\Windows\System\YWihTou.exe
  C:\Windows\System\YWihTou.exe
  2⤵
  PID:13528
- C:\Windows\System\OefKYLX.exe
  C:\Windows\System\OefKYLX.exe
  2⤵
  PID:3888
- C:\Windows\System\tiDEcGh.exe
  C:\Windows\System\tiDEcGh.exe
  2⤵
  PID:13968
- C:\Windows\System\WZXdqgM.exe
  C:\Windows\System\WZXdqgM.exe
  2⤵
  PID:13676
- C:\Windows\System\lldtmlq.exe
  C:\Windows\System\lldtmlq.exe
  2⤵
  PID:13736
- C:\Windows\System\JELdVlL.exe
  C:\Windows\System\JELdVlL.exe
  2⤵
  PID:13476
- C:\Windows\System\PksgKiG.exe
  C:\Windows\System\PksgKiG.exe
  2⤵
  PID:12120
- C:\Windows\System\SYRkARC.exe
  C:\Windows\System\SYRkARC.exe
  2⤵
  PID:13796
- C:\Windows\System\nzKlAuU.exe
  C:\Windows\System\nzKlAuU.exe
  2⤵
  PID:1528
- C:\Windows\System\TlenWTs.exe
  C:\Windows\System\TlenWTs.exe
  2⤵
  PID:13868
- C:\Windows\System\VWBilMj.exe
  C:\Windows\System\VWBilMj.exe
  2⤵
  PID:13856
- C:\Windows\System\ftQzWMa.exe
  C:\Windows\System\ftQzWMa.exe
  2⤵
  PID:932
- C:\Windows\System\vwXfQSa.exe
  C:\Windows\System\vwXfQSa.exe
  2⤵
  PID:12772
- C:\Windows\System\aJhfpgn.exe
  C:\Windows\System\aJhfpgn.exe
  2⤵
  PID:14008
- C:\Windows\System\tboLnfh.exe
  C:\Windows\System\tboLnfh.exe
  2⤵
  PID:1988
- C:\Windows\System\lmpyzWe.exe
  C:\Windows\System\lmpyzWe.exe
  2⤵
  PID:14088
- C:\Windows\System\zXpugLx.exe
  C:\Windows\System\zXpugLx.exe
  2⤵
  PID:13404
- C:\Windows\System\lRMlBCi.exe
  C:\Windows\System\lRMlBCi.exe
  2⤵
  PID:14116
- C:\Windows\System\TuCzvGg.exe
  C:\Windows\System\TuCzvGg.exe
  2⤵
  PID:14176
- C:\Windows\System\UonuDOw.exe
  C:\Windows\System\UonuDOw.exe
  2⤵
  PID:14216
- C:\Windows\System\mjPFODw.exe
  C:\Windows\System\mjPFODw.exe
  2⤵
  PID:14184
- C:\Windows\System\LRKZzAL.exe
  C:\Windows\System\LRKZzAL.exe
  2⤵
  PID:14128
- C:\Windows\System\QRpibMi.exe
  C:\Windows\System\QRpibMi.exe
  2⤵
  PID:3000
- C:\Windows\System\gewcuwS.exe
  C:\Windows\System\gewcuwS.exe
  2⤵
  PID:14280
- C:\Windows\System\bKdMkRU.exe
  C:\Windows\System\bKdMkRU.exe
  2⤵
  PID:14300
- C:\Windows\System\XuVgRHo.exe
  C:\Windows\System\XuVgRHo.exe
  2⤵
  PID:13228
- C:\Windows\System\fFJkCWw.exe
  C:\Windows\System\fFJkCWw.exe
  2⤵
  PID:13640
- C:\Windows\System\prIWsDN.exe
  C:\Windows\System\prIWsDN.exe
  2⤵
  PID:13336
- C:\Windows\System\uTpHrFQ.exe
  C:\Windows\System\uTpHrFQ.exe
  2⤵
  PID:13352
- C:\Windows\System\ArWkAEu.exe
  C:\Windows\System\ArWkAEu.exe
  2⤵
  PID:3264
- C:\Windows\System\ZKbzHuS.exe
  C:\Windows\System\ZKbzHuS.exe
  2⤵
  PID:1560
- C:\Windows\System\eLVUlud.exe
  C:\Windows\System\eLVUlud.exe
  2⤵
  PID:764
- C:\Windows\System\NbiFvDi.exe
  C:\Windows\System\NbiFvDi.exe
  2⤵
  PID:4912
- C:\Windows\System\FrqaHsS.exe
  C:\Windows\System\FrqaHsS.exe
  2⤵
  PID:13488
- C:\Windows\System\vVFgkUl.exe
  C:\Windows\System\vVFgkUl.exe
  2⤵
  PID:13508
- C:\Windows\System\uupDELS.exe
  C:\Windows\System\uupDELS.exe
  2⤵
  PID:13700
- C:\Windows\System\EdASEIL.exe
  C:\Windows\System\EdASEIL.exe
  2⤵
  PID:13480
- C:\Windows\System\tJxpSqu.exe
  C:\Windows\System\tJxpSqu.exe
  2⤵
  PID:13692
- C:\Windows\System\iZxdwlJ.exe
  C:\Windows\System\iZxdwlJ.exe
  2⤵
  PID:13876
- C:\Windows\System\ZmfeNGL.exe
  C:\Windows\System\ZmfeNGL.exe
  2⤵
  PID:13952
- C:\Windows\System\fdgPftw.exe
  C:\Windows\System\fdgPftw.exe
  2⤵
  PID:14024
- C:\Windows\System\issPisc.exe
  C:\Windows\System\issPisc.exe
  2⤵
  PID:13920
- C:\Windows\System\KKjhOQp.exe
  C:\Windows\System\KKjhOQp.exe
  2⤵
  PID:14172
- C:\Windows\System\yoHFsLL.exe
  C:\Windows\System\yoHFsLL.exe
  2⤵
  PID:1784
- C:\Windows\System\xHLVjwc.exe
  C:\Windows\System\xHLVjwc.exe
  2⤵
  PID:14232
- C:\Windows\System\QfTeKBe.exe
  C:\Windows\System\QfTeKBe.exe
  2⤵
  PID:4352
- C:\Windows\System\KilVYjC.exe
  C:\Windows\System\KilVYjC.exe
  2⤵
  PID:13284
- C:\Windows\System\qjJwFfK.exe
  C:\Windows\System\qjJwFfK.exe
  2⤵
  PID:2248
- C:\Windows\System\fpNpgQt.exe
  C:\Windows\System\fpNpgQt.exe
  2⤵
  PID:5848
- C:\Windows\System\OEdyNqa.exe
  C:\Windows\System\OEdyNqa.exe
  2⤵
  PID:13464
- C:\Windows\System\AvjZXbt.exe
  C:\Windows\System\AvjZXbt.exe
  2⤵
  PID:3636
- C:\Windows\System\tYkVMoB.exe
  C:\Windows\System\tYkVMoB.exe
  2⤵
  PID:13820
- C:\Windows\System\yIGmiDB.exe
  C:\Windows\System\yIGmiDB.exe
  2⤵
  PID:13648
- C:\Windows\System\FCBAHJv.exe
  C:\Windows\System\FCBAHJv.exe
  2⤵
  PID:14056
- C:\Windows\System\SvDqlgc.exe
  C:\Windows\System\SvDqlgc.exe
  2⤵
  PID:14160
- C:\Windows\System\nyaPsbu.exe
  C:\Windows\System\nyaPsbu.exe
  2⤵
  PID:12180
- C:\Windows\System\vflhVDC.exe
  C:\Windows\System\vflhVDC.exe
  2⤵
  PID:6352
- C:\Windows\System\KzqAUKC.exe
  C:\Windows\System\KzqAUKC.exe
  2⤵
  PID:948
- C:\Windows\System\DrrMQkq.exe
  C:\Windows\System\DrrMQkq.exe
  2⤵
  PID:13328
- C:\Windows\System\ebTEJAa.exe
  C:\Windows\System\ebTEJAa.exe
  2⤵
  PID:5840
- C:\Windows\System\VOSJlHY.exe
  C:\Windows\System\VOSJlHY.exe
  2⤵
  PID:14052
- C:\Windows\System\TxlvrDB.exe
  C:\Windows\System\TxlvrDB.exe
  2⤵
  PID:2952
- C:\Windows\System\UcwJbVV.exe
  C:\Windows\System\UcwJbVV.exe
  2⤵
  PID:5832
- C:\Windows\System\VuzTVcV.exe
  C:\Windows\System\VuzTVcV.exe
  2⤵
  PID:13836
- C:\Windows\System\kbvDACr.exe
  C:\Windows\System\kbvDACr.exe
  2⤵
  PID:2404
- C:\Windows\System\VjfLeaS.exe
  C:\Windows\System\VjfLeaS.exe
  2⤵
  PID:14364
- C:\Windows\System\WUlVPey.exe
  C:\Windows\System\WUlVPey.exe
  2⤵
  PID:14388
- C:\Windows\System\vIPFoil.exe
  C:\Windows\System\vIPFoil.exe
  2⤵
  PID:14844
- C:\Windows\System\HpQkWCk.exe
  C:\Windows\System\HpQkWCk.exe
  2⤵
  PID:14860
- C:\Windows\System\xxxNCna.exe
  C:\Windows\System\xxxNCna.exe
  2⤵
  PID:14876
- C:\Windows\System\iaWPKNs.exe
  C:\Windows\System\iaWPKNs.exe
  2⤵
  PID:14892
- C:\Windows\System\OuYwWSA.exe
  C:\Windows\System\OuYwWSA.exe
  2⤵
  PID:14908
- C:\Windows\System\bbpzUvP.exe
  C:\Windows\System\bbpzUvP.exe
  2⤵
  PID:14704
- C:\Windows\System\tKTxSYc.exe
  C:\Windows\System\tKTxSYc.exe
  2⤵
  PID:14784
- C:\Windows\System\UAyZVZi.exe
  C:\Windows\System\UAyZVZi.exe
  2⤵
  PID:15280
- C:\Windows\System\ZIpBtWg.exe
  C:\Windows\System\ZIpBtWg.exe
  2⤵
  PID:15292
- C:\Windows\System\pdmHbdA.exe
  C:\Windows\System\pdmHbdA.exe
  2⤵
  PID:15356
- C:\Windows\System\jfgdxGJ.exe
  C:\Windows\System\jfgdxGJ.exe
  2⤵
  PID:14380
- C:\Windows\System\xJWUNMz.exe
  C:\Windows\System\xJWUNMz.exe
  2⤵
  PID:14408
- C:\Windows\System\JCIetmn.exe
  C:\Windows\System\JCIetmn.exe
  2⤵
  PID:14972
- C:\Windows\System\CwBJjUt.exe
  C:\Windows\System\CwBJjUt.exe
  2⤵
  PID:15000
- C:\Windows\System\eQOOkHe.exe
  C:\Windows\System\eQOOkHe.exe
  2⤵
  PID:15068
- C:\Windows\System\zBFEtsN.exe
  C:\Windows\System\zBFEtsN.exe
  2⤵
  PID:15028
- C:\Windows\System\JiwSnFk.exe
  C:\Windows\System\JiwSnFk.exe
  2⤵
  PID:14536
- C:\Windows\System\SKpJnKe.exe
  C:\Windows\System\SKpJnKe.exe
  2⤵
  PID:15112
- C:\Windows\System\OiWRidS.exe
  C:\Windows\System\OiWRidS.exe
  2⤵
  PID:15148
- C:\Windows\System\pzwrNFO.exe
  C:\Windows\System\pzwrNFO.exe
  2⤵
  PID:15176
- C:\Windows\System\GwoKNer.exe
  C:\Windows\System\GwoKNer.exe
  2⤵
  PID:15160
- C:\Windows\System\lsnMVEO.exe
  C:\Windows\System\lsnMVEO.exe
  2⤵
  PID:14488
- C:\Windows\System\tJuITfa.exe
  C:\Windows\System\tJuITfa.exe
  2⤵
  PID:14508
- C:\Windows\System\hYzjkmJ.exe
  C:\Windows\System\hYzjkmJ.exe
  2⤵
  PID:14524
- C:\Windows\System\IIVMaUT.exe
  C:\Windows\System\IIVMaUT.exe
  2⤵
  PID:14544
- C:\Windows\System\ZqwquQC.exe
  C:\Windows\System\ZqwquQC.exe
  2⤵
  PID:14560
- C:\Windows\System\fLHwLWI.exe
  C:\Windows\System\fLHwLWI.exe
  2⤵
  PID:14600
- C:\Windows\System\CuWLRLp.exe
  C:\Windows\System\CuWLRLp.exe
  2⤵
  PID:14636
- C:\Windows\System\JlGsXud.exe
  C:\Windows\System\JlGsXud.exe
  2⤵
  PID:3188
- C:\Windows\System\iiUIxGW.exe
  C:\Windows\System\iiUIxGW.exe
  2⤵
  PID:14680
- C:\Windows\System\mDNkeAT.exe
  C:\Windows\System\mDNkeAT.exe
  2⤵
  PID:14700
- C:\Windows\System\yFMiFQK.exe
  C:\Windows\System\yFMiFQK.exe
  2⤵
  PID:14760
- C:\Windows\System\uPrwmKu.exe
  C:\Windows\System\uPrwmKu.exe
  2⤵
  PID:14776
- C:\Windows\System\ACRSxzx.exe
  C:\Windows\System\ACRSxzx.exe
  2⤵
  PID:14800
- C:\Windows\System\gwCldUW.exe
  C:\Windows\System\gwCldUW.exe
  2⤵
  PID:14808
- C:\Windows\System\Lpmnnoy.exe
  C:\Windows\System\Lpmnnoy.exe
  2⤵
  PID:2164
- C:\Windows\System\pRqEEkm.exe
  C:\Windows\System\pRqEEkm.exe
  2⤵
  PID:5952
- C:\Windows\System\pBypUcO.exe
  C:\Windows\System\pBypUcO.exe
  2⤵
  PID:13716
- C:\Windows\System\SyviZsU.exe
  C:\Windows\System\SyviZsU.exe
  2⤵
  PID:3444
- C:\Windows\System\tYvLPfb.exe
  C:\Windows\System\tYvLPfb.exe
  2⤵
  PID:3400
- C:\Windows\System\DMDEhQi.exe
  C:\Windows\System\DMDEhQi.exe
  2⤵
  PID:5060
- C:\Windows\System\zOTgrdd.exe
  C:\Windows\System\zOTgrdd.exe
  2⤵
  PID:15048
- C:\Windows\System\inbOVKg.exe
  C:\Windows\System\inbOVKg.exe
  2⤵
  PID:4700
- C:\Windows\System\LAOGNgT.exe
  C:\Windows\System\LAOGNgT.exe
  2⤵
  PID:15188
- C:\Windows\System\kuXTppR.exe
  C:\Windows\System\kuXTppR.exe
  2⤵
  PID:15228
- C:\Windows\System\yIMOwgf.exe
  C:\Windows\System\yIMOwgf.exe
  2⤵
  PID:15240
- C:\Windows\System\obUvidw.exe
  C:\Windows\System\obUvidw.exe
  2⤵
  PID:15284
- C:\Windows\System\bwJGyxL.exe
  C:\Windows\System\bwJGyxL.exe
  2⤵
  PID:4300
- C:\Windows\System\eBZzOMx.exe
  C:\Windows\System\eBZzOMx.exe
  2⤵
  PID:15296
- C:\Windows\System\YZLGGDm.exe
  C:\Windows\System\YZLGGDm.exe
  2⤵
  PID:4708
- C:\Windows\System\DPILXKH.exe
  C:\Windows\System\DPILXKH.exe
  2⤵
  PID:14344
- C:\Windows\System\BGplWWF.exe
  C:\Windows\System\BGplWWF.exe
  2⤵
  PID:3132
- C:\Windows\System\NCshCUB.exe
  C:\Windows\System\NCshCUB.exe
  2⤵
  PID:2412
- C:\Windows\System\BzQxpaH.exe
  C:\Windows\System\BzQxpaH.exe
  2⤵
  PID:4832
- C:\Windows\System\dMZjYvM.exe
  C:\Windows\System\dMZjYvM.exe
  2⤵
  PID:15036
- C:\Windows\System\PdwXPmq.exe
  C:\Windows\System\PdwXPmq.exe
  2⤵
  PID:15052
- C:\Windows\System\HTzyWWB.exe
  C:\Windows\System\HTzyWWB.exe
  2⤵
  PID:15080
- C:\Windows\System\vUTqSut.exe
  C:\Windows\System\vUTqSut.exe
  2⤵
  PID:6104
- C:\Windows\System\FQUTstm.exe
  C:\Windows\System\FQUTstm.exe
  2⤵
  PID:14996
- C:\Windows\System\EQlIArr.exe
  C:\Windows\System\EQlIArr.exe
  2⤵
  PID:5048
- C:\Windows\System\CbrkXoJ.exe
  C:\Windows\System\CbrkXoJ.exe
  2⤵
  PID:4960
- C:\Windows\System\GMiOJYn.exe
  C:\Windows\System\GMiOJYn.exe
  2⤵
  PID:3348
- C:\Windows\System\dWozwla.exe
  C:\Windows\System\dWozwla.exe
  2⤵
  PID:4060
- C:\Windows\System\dWIjTld.exe
  C:\Windows\System\dWIjTld.exe
  2⤵
  PID:15100
- C:\Windows\System\ipeXKEW.exe
  C:\Windows\System\ipeXKEW.exe
  2⤵
  PID:15132
- C:\Windows\System\ggRkPuU.exe
  C:\Windows\System\ggRkPuU.exe
  2⤵
  PID:3372
- C:\Windows\System\ciqzMbb.exe
  C:\Windows\System\ciqzMbb.exe
  2⤵
  PID:15184
- C:\Windows\System\ysFpKXM.exe
  C:\Windows\System\ysFpKXM.exe
  2⤵
  PID:4692
- C:\Windows\System\rfxkNiZ.exe
  C:\Windows\System\rfxkNiZ.exe
  2⤵
  PID:2532
- C:\Windows\System\cutMyJV.exe
  C:\Windows\System\cutMyJV.exe
  2⤵
  PID:4632
- C:\Windows\System\KLasICi.exe
  C:\Windows\System\KLasICi.exe
  2⤵
  PID:15320
- C:\Windows\System\HSBuxRt.exe
  C:\Windows\System\HSBuxRt.exe
  2⤵
  PID:2520
- C:\Windows\System\PxgLUwA.exe
  C:\Windows\System\PxgLUwA.exe
  2⤵
  PID:3632
- C:\Windows\System\YulkEBM.exe
  C:\Windows\System\YulkEBM.exe
  2⤵
  PID:4336
- C:\Windows\System\YTzwUHQ.exe
  C:\Windows\System\YTzwUHQ.exe
  2⤵
  PID:3480
- C:\Windows\System\ERPZWUD.exe
  C:\Windows\System\ERPZWUD.exe
  2⤵
  PID:14960
- C:\Windows\System\zRReMJf.exe
  C:\Windows\System\zRReMJf.exe
  2⤵
  PID:2620
- C:\Windows\System\AcKrYap.exe
  C:\Windows\System\AcKrYap.exe
  2⤵
  PID:1008
- C:\Windows\System\VACGkxa.exe
  C:\Windows\System\VACGkxa.exe
  2⤵
  PID:14476
- C:\Windows\System\ZlhpJjV.exe
  C:\Windows\System\ZlhpJjV.exe
  2⤵
  PID:2488
- C:\Windows\System\NnBvuUK.exe
  C:\Windows\System\NnBvuUK.exe
  2⤵
  PID:14516
- C:\Windows\System\TrpxWLU.exe
  C:\Windows\System\TrpxWLU.exe
  2⤵
  PID:4208
- C:\Windows\System\wvjLZED.exe
  C:\Windows\System\wvjLZED.exe
  2⤵
  PID:116
- C:\Windows\System\WEhqCqh.exe
  C:\Windows\System\WEhqCqh.exe
  2⤵
  PID:1588
- C:\Windows\System\nmEFilq.exe
  C:\Windows\System\nmEFilq.exe
  2⤵
  PID:14572
- C:\Windows\System\oDCYVzh.exe
  C:\Windows\System\oDCYVzh.exe
  2⤵
  PID:14576
- C:\Windows\System\huyuCsX.exe
  C:\Windows\System\huyuCsX.exe
  2⤵
  PID:5140
- C:\Windows\System\tqChsVR.exe
  C:\Windows\System\tqChsVR.exe
  2⤵
  PID:5984
- C:\Windows\System\TALKHAG.exe
  C:\Windows\System\TALKHAG.exe
  2⤵
  PID:14612
- C:\Windows\System\ProiIDo.exe
  C:\Windows\System\ProiIDo.exe
  2⤵
  PID:5148
- C:\Windows\System\ZIreoDn.exe
  C:\Windows\System\ZIreoDn.exe
  2⤵
  PID:5164
- C:\Windows\System\fOHMQZN.exe
  C:\Windows\System\fOHMQZN.exe
  2⤵
  PID:14628
- C:\Windows\System\MpfCJWY.exe
  C:\Windows\System\MpfCJWY.exe
  2⤵
  PID:3928
- C:\Windows\System\PjFvivv.exe
  C:\Windows\System\PjFvivv.exe
  2⤵
  PID:4068
- C:\Windows\System\BSOzeIN.exe
  C:\Windows\System\BSOzeIN.exe
  2⤵
  PID:14676
- C:\Windows\System\xXOUzrJ.exe
  C:\Windows\System\xXOUzrJ.exe
  2⤵
  PID:14664
- C:\Windows\System\anmfuKD.exe
  C:\Windows\System\anmfuKD.exe
  2⤵
  PID:5152
- C:\Windows\System\TXwPNAu.exe
  C:\Windows\System\TXwPNAu.exe
  2⤵
  PID:5168
- C:\Windows\System\QHNqmoo.exe
  C:\Windows\System\QHNqmoo.exe
  2⤵
  PID:5356
- C:\Windows\System\yhyNTWJ.exe
  C:\Windows\System\yhyNTWJ.exe
  2⤵
  PID:3308
- C:\Windows\System\VgBjvyb.exe
  C:\Windows\System\VgBjvyb.exe
  2⤵
  PID:5404
- C:\Windows\System\BBjzKff.exe
  C:\Windows\System\BBjzKff.exe
  2⤵
  PID:15192
- C:\Windows\System\MxpNCww.exe
  C:\Windows\System\MxpNCww.exe
  2⤵
  PID:5912
- C:\Windows\System\MesZLjs.exe
  C:\Windows\System\MesZLjs.exe
  2⤵
  PID:14000
- C:\Windows\System\rBOrXjT.exe
  C:\Windows\System\rBOrXjT.exe
  2⤵
  PID:15064
- C:\Windows\System\kMHaUnn.exe
  C:\Windows\System\kMHaUnn.exe
  2⤵
  PID:5632
- C:\Windows\System\icIoECy.exe
  C:\Windows\System\icIoECy.exe
  2⤵
  PID:15040
- C:\Windows\System\RTJJWLG.exe
  C:\Windows\System\RTJJWLG.exe
  2⤵
  PID:5640
- C:\Windows\System\oiBozmy.exe
  C:\Windows\System\oiBozmy.exe
  2⤵
  PID:15016
- C:\Windows\System\BbIQrnX.exe
  C:\Windows\System\BbIQrnX.exe
  2⤵
  PID:15128
- C:\Windows\System\VbBgppW.exe
  C:\Windows\System\VbBgppW.exe
  2⤵
  PID:15096
- C:\Windows\System\eQoWvNT.exe
  C:\Windows\System\eQoWvNT.exe
  2⤵
  PID:14764
- C:\Windows\System\xBwDBPL.exe
  C:\Windows\System\xBwDBPL.exe
  2⤵
  PID:14840
- C:\Windows\System\CFGxWts.exe
  C:\Windows\System\CFGxWts.exe
  2⤵
  PID:14868
- C:\Windows\System\yYMmUSG.exe
  C:\Windows\System\yYMmUSG.exe
  2⤵
  PID:15200
- C:\Windows\System\jmZoaMm.exe
  C:\Windows\System\jmZoaMm.exe
  2⤵
  PID:2824
- C:\Windows\System\UjLDsvX.exe
  C:\Windows\System\UjLDsvX.exe
  2⤵
  PID:3548
- C:\Windows\System\Pgdzabs.exe
  C:\Windows\System\Pgdzabs.exe
  2⤵
  PID:2296
- C:\Windows\System\uYZEFIE.exe
  C:\Windows\System\uYZEFIE.exe
  2⤵
  PID:3236
- C:\Windows\System\koQXmeP.exe
  C:\Windows\System\koQXmeP.exe
  2⤵
  PID:14952
- C:\Windows\System\cPVAeGe.exe
  C:\Windows\System\cPVAeGe.exe
  2⤵
  PID:15256
- C:\Windows\System\MGEEfvl.exe
  C:\Windows\System\MGEEfvl.exe
  2⤵
  PID:15236
- C:\Windows\System\zcCnplb.exe
  C:\Windows\System\zcCnplb.exe
  2⤵
  PID:5644
- C:\Windows\System\hDMHnwn.exe
  C:\Windows\System\hDMHnwn.exe
  2⤵
  PID:2656
- C:\Windows\System\gAtjoGS.exe
  C:\Windows\System\gAtjoGS.exe
  2⤵
  PID:1480
- C:\Windows\System\hArOYHh.exe
  C:\Windows\System\hArOYHh.exe
  2⤵
  PID:5700
- C:\Windows\System\yujofPe.exe
  C:\Windows\System\yujofPe.exe
  2⤵
  PID:5652
- C:\Windows\System\ZTiUTbA.exe
  C:\Windows\System\ZTiUTbA.exe
  2⤵
  PID:5756
- C:\Windows\System\dSytCYJ.exe
  C:\Windows\System\dSytCYJ.exe
  2⤵
  PID:14948
- C:\Windows\System\PEqQBut.exe
  C:\Windows\System\PEqQBut.exe
  2⤵
  PID:5772
- C:\Windows\System\qVFlIMh.exe
  C:\Windows\System\qVFlIMh.exe
  2⤵
  PID:14964
- C:\Windows\System\boAIQaI.exe
  C:\Windows\System\boAIQaI.exe
  2⤵
  PID:14984
- C:\Windows\System\eEeXtIH.exe
  C:\Windows\System\eEeXtIH.exe
  2⤵
  PID:3376
- C:\Windows\System\XcUYsHY.exe
  C:\Windows\System\XcUYsHY.exe
  2⤵
  PID:1656
- C:\Windows\System\kcIDGvh.exe
  C:\Windows\System\kcIDGvh.exe
  2⤵
  PID:1916
- C:\Windows\System\dlLiUXp.exe
  C:\Windows\System\dlLiUXp.exe
  2⤵
  PID:4828
- C:\Windows\System\EivCAQC.exe
  C:\Windows\System\EivCAQC.exe
  2⤵
  PID:15104
- C:\Windows\System\DdhXsCU.exe
  C:\Windows\System\DdhXsCU.exe
  2⤵
  PID:15168
- C:\Windows\System\szBBltO.exe
  C:\Windows\System\szBBltO.exe
  2⤵
  PID:3528
- C:\Windows\System\JuMzCJZ.exe
  C:\Windows\System\JuMzCJZ.exe
  2⤵
  PID:2252
- C:\Windows\System\dyoYZcO.exe
  C:\Windows\System\dyoYZcO.exe
  2⤵
  PID:4316
- C:\Windows\System\kzeqVmq.exe
  C:\Windows\System\kzeqVmq.exe
  2⤵
  PID:2332
- C:\Windows\System\sBcwhfW.exe
  C:\Windows\System\sBcwhfW.exe
  2⤵
  PID:14452
- C:\Windows\System\sUuZcXI.exe
  C:\Windows\System\sUuZcXI.exe
  2⤵
  PID:14484
- C:\Windows\System\fdJGZWK.exe
  C:\Windows\System\fdJGZWK.exe
  2⤵
  PID:1928
- C:\Windows\System\JKfBnBG.exe
  C:\Windows\System\JKfBnBG.exe
  2⤵
  PID:2992
- C:\Windows\System\hDXmEQP.exe
  C:\Windows\System\hDXmEQP.exe
  2⤵
  PID:14616
- C:\Windows\System\iptacNb.exe
  C:\Windows\System\iptacNb.exe
  2⤵
  PID:5032
- C:\Windows\System\yiKLCZE.exe
  C:\Windows\System\yiKLCZE.exe
  2⤵
  PID:14648
- C:\Windows\System\ShkEyYQ.exe
  C:\Windows\System\ShkEyYQ.exe
  2⤵
  PID:14668
- C:\Windows\System\yOMDYis.exe
  C:\Windows\System\yOMDYis.exe
  2⤵
  PID:14740
- C:\Windows\System\pzLKCHU.exe
  C:\Windows\System\pzLKCHU.exe
  2⤵
  PID:5192
- C:\Windows\System\CUNgxxw.exe
  C:\Windows\System\CUNgxxw.exe
  2⤵
  PID:3624
- C:\Windows\System\GmaGQyO.exe
  C:\Windows\System\GmaGQyO.exe
  2⤵
  PID:5224
- C:\Windows\System\uWkENiq.exe
  C:\Windows\System\uWkENiq.exe
  2⤵
  PID:15324
- C:\Windows\System\HbQyBBD.exe
  C:\Windows\System\HbQyBBD.exe
  2⤵
  PID:14788
- C:\Windows\System\JXxmxRL.exe
  C:\Windows\System\JXxmxRL.exe
  2⤵
  PID:14824
- C:\Windows\System\zHrrbva.exe
  C:\Windows\System\zHrrbva.exe
  2⤵
  PID:4348
- C:\Windows\System\QadpRQH.exe
  C:\Windows\System\QadpRQH.exe
  2⤵
  PID:15216
- C:\Windows\System\yOmFjlk.exe
  C:\Windows\System\yOmFjlk.exe
  2⤵
  PID:15244
- C:\Windows\System\QngLKxB.exe
  C:\Windows\System\QngLKxB.exe
  2⤵
  PID:3472
- C:\Windows\System\ivgnTlv.exe
  C:\Windows\System\ivgnTlv.exe
  2⤵
  PID:6140
- C:\Windows\System\KTEpAzW.exe
  C:\Windows\System\KTEpAzW.exe
  2⤵
  PID:4552
- C:\Windows\System\AxBUTDe.exe
  C:\Windows\System\AxBUTDe.exe
  2⤵
  PID:3520
- C:\Windows\System\EghGglR.exe
  C:\Windows\System\EghGglR.exe
  2⤵
  PID:3708
- C:\Windows\System\UmTxokV.exe
  C:\Windows\System\UmTxokV.exe
  2⤵
  PID:5180
- C:\Windows\System\eZKTyNr.exe
  C:\Windows\System\eZKTyNr.exe
  2⤵
  PID:1388
- C:\Windows\System\UCeeSYi.exe
  C:\Windows\System\UCeeSYi.exe
  2⤵
  PID:5764
- C:\Windows\System\luUexIq.exe
  C:\Windows\System\luUexIq.exe
  2⤵
  PID:5788
- C:\Windows\System\NxILrSx.exe
  C:\Windows\System\NxILrSx.exe
  2⤵
  PID:5204
- C:\Windows\System\iycLFoP.exe
  C:\Windows\System\iycLFoP.exe
  2⤵
  PID:14412
- C:\Windows\System\NBkxXXq.exe
  C:\Windows\System\NBkxXXq.exe
  2⤵
  PID:216
- C:\Windows\System\xUEsDUD.exe
  C:\Windows\System\xUEsDUD.exe
  2⤵
  PID:2500
- C:\Windows\System\HDZALct.exe
  C:\Windows\System\HDZALct.exe
  2⤵
  PID:3452
- C:\Windows\System\LtXYStY.exe
  C:\Windows\System\LtXYStY.exe
  2⤵
  PID:15140
- C:\Windows\System\RuAZAZS.exe
  C:\Windows\System\RuAZAZS.exe
  2⤵
  PID:1876
- C:\Windows\System\WMmDUAJ.exe
  C:\Windows\System\WMmDUAJ.exe
  2⤵
  PID:6096
- C:\Windows\System\ULukwnW.exe
  C:\Windows\System\ULukwnW.exe
  2⤵
  PID:6100
- C:\Windows\System\pEotKwO.exe
  C:\Windows\System\pEotKwO.exe
  2⤵
  PID:1116
- C:\Windows\System\cfJRCUc.exe
  C:\Windows\System\cfJRCUc.exe
  2⤵
  PID:5968
- C:\Windows\System\vWMkGPF.exe
  C:\Windows\System\vWMkGPF.exe
  2⤵
  PID:4008
- C:\Windows\System\JIpOzTy.exe
  C:\Windows\System\JIpOzTy.exe
  2⤵
  PID:6080
- C:\Windows\System\jXZRUWR.exe
  C:\Windows\System\jXZRUWR.exe
  2⤵
  PID:2784
- C:\Windows\System\vSqyLjQ.exe
  C:\Windows\System\vSqyLjQ.exe
  2⤵
  PID:3704
- C:\Windows\System\APKXilQ.exe
  C:\Windows\System\APKXilQ.exe
  2⤵
  PID:6320
- C:\Windows\System\uGmlDMJ.exe
  C:\Windows\System\uGmlDMJ.exe
  2⤵
  PID:5296
- C:\Windows\System\rfkFjgp.exe
  C:\Windows\System\rfkFjgp.exe
  2⤵
  PID:3488
- C:\Windows\System\cNzQEro.exe
  C:\Windows\System\cNzQEro.exe
  2⤵
  PID:1776
- C:\Windows\System\bvwFzXX.exe
  C:\Windows\System\bvwFzXX.exe
  2⤵
  PID:6456
- C:\Windows\System\WUAXcYh.exe
  C:\Windows\System\WUAXcYh.exe
  2⤵
  PID:208
- C:\Windows\System\EEiXVxC.exe
  C:\Windows\System\EEiXVxC.exe
  2⤵
  PID:6176
- C:\Windows\System\mNUBRaC.exe
  C:\Windows\System\mNUBRaC.exe
  2⤵
  PID:14724
- C:\Windows\System\rETzvJi.exe
  C:\Windows\System\rETzvJi.exe
  2⤵
  PID:5352
- C:\Windows\System\irxIdPl.exe
  C:\Windows\System\irxIdPl.exe
  2⤵
  PID:6292
- C:\Windows\System\alAxUgg.exe
  C:\Windows\System\alAxUgg.exe
  2⤵
  PID:6364
- C:\Windows\System\KcfcmIa.exe
  C:\Windows\System\KcfcmIa.exe
  2⤵
  PID:14812
- C:\Windows\System\egNNIfg.exe
  C:\Windows\System\egNNIfg.exe
  2⤵
  PID:5456
- C:\Windows\System\BLKGvnF.exe
  C:\Windows\System\BLKGvnF.exe
  2⤵
  PID:1368
- C:\Windows\System\nfTgfDx.exe
  C:\Windows\System\nfTgfDx.exe
  2⤵
  PID:14384
- C:\Windows\System\zGONiiI.exe
  C:\Windows\System\zGONiiI.exe
  2⤵
  PID:6888
- C:\Windows\System\MPOrFGi.exe
  C:\Windows\System\MPOrFGi.exe
  2⤵
  PID:12720
- C:\Windows\System\rfziyns.exe
  C:\Windows\System\rfziyns.exe
  2⤵
  PID:5996
- C:\Windows\System\LGLGiyR.exe
  C:\Windows\System\LGLGiyR.exe
  2⤵
  PID:5084
- C:\Windows\System\deYKMhh.exe
  C:\Windows\System\deYKMhh.exe
  2⤵
  PID:3352
- C:\Windows\System\QppWFsl.exe
  C:\Windows\System\QppWFsl.exe
  2⤵
  PID:6636
- C:\Windows\System\jebifxp.exe
  C:\Windows\System\jebifxp.exe
  2⤵
  PID:6936
- C:\Windows\System\gULayJe.exe
  C:\Windows\System\gULayJe.exe
  2⤵
  PID:6736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzdiilte.vgp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BbYppor.exe

Filesize
1.9MB

MD5
4e977d13d05a6b2cd9d03490f1f5ff37

SHA1
0c7341fe8f6ae3f1e0e25479cac224abee807d13

SHA256
57055c23eb510e701a03fe643f8ecf4a6b2673aef5d70287692b0b32c3d5f30f

SHA512
41352f835683ec119a255499dda6599b40e1a53793162fb77bc987bbb948fca7850c261b9c629106e83e0ed6cb84e8dc8d731cab3f74d806ec83da8782a19cef

Download Submit
C:\Windows\System\CeJCcyN.exe

Filesize
1.9MB

MD5
35000028126ace84aef716ff9d88ae84

SHA1
9b2551d2a945cea33f7effc1f6a23b8d42c5349a

SHA256
5cad0b76f2eaa3ad16be35fa8b2696fe005c400ddef14c223f547ec10d41936d

SHA512
7bb8d6199642339ab115221fad95dc077805c8655408d92b4987c2f78452532d8c74bb1d2578a618cf0eb70aedef68b604914cbf5a16bdcd51c209786b4a845e

Download Submit
C:\Windows\System\DtDisfM.exe

Filesize
1.9MB

MD5
35e0b33749712784a4d325d058c7d298

SHA1
3195a23fed6a4b1e9c354d02a742b76fa346af15

SHA256
a9315178c8a3c8170dba426e6f6f4986c822cd399876b5676aa50d2ba4f13611

SHA512
a0ab2330d09ad6a8f6bb5fe58f95e12e306e18e29871463e136d09d9df62340bd6f6b30bb5d1085fabd560513b74e1507b4a480d06d35710ac531ca1ffebdae1

Download Submit
C:\Windows\System\ELPyqIG.exe

Filesize
1.9MB

MD5
f3af3cd21d305469f444a24bcee4680c

SHA1
7265d3c8188eb7783211108e0b1deb9d9be2157f

SHA256
d7bc400a725a7d7e35f9fcc719b66e43762dcf127cd33fe09ca84c56bb5df438

SHA512
1a4e9208f9af0db349760a64995d46e905718515d0806c63f1aae0feed57daff84a562d15a062dbc3e1006761a91d5db3b6e5f6f01e2377c286bad4cb902626d

Download Submit
C:\Windows\System\FEHKXuD.exe

Filesize
1.9MB

MD5
7e6dbf7785be8f13b3c1eef1be0771fe

SHA1
808c99a9b8441491e9207762d668d14c9b809076

SHA256
203b1269c23c4b451dc0465968c1bcd877b9bddd71b13df4124217f1581c3e1a

SHA512
57c95a6294840968f8dd5f993b0dfd375c2c18fc1fad2a305f0440805b26360b4a6995fc4f2235498be212c284446dc94be0ad5e3dffe35fbe5a20f046616512

Download Submit
C:\Windows\System\HAPMwct.exe

Filesize
1.9MB

MD5
dd8f4f30edcd365fe71f3f873d36d59d

SHA1
81e62a4318ff2f1fabea40356614fb8e44ec948c

SHA256
2d078a76a8442c8f3f1215949c3412953846f04ae4b29a486e0b9037fe93c048

SHA512
d16bae059400980d648f5afddefba329c5682e5b0ca3a4aea455ed67fb34c6fd49ebfe71de6cb678d29815a0706b407aaffd92d94fb6046ea72cd74cbb70d718

Download Submit
C:\Windows\System\HEkoKMa.exe

Filesize
1.9MB

MD5
f53eaf8274e970baa5225c11fbde8e91

SHA1
74f03d516e3bd312bd128500cf62344bc6857dd0

SHA256
1c513813d8f720a0a943de0fbdd31089eeec0cce817cf29a6fb7f47e72a03266

SHA512
b6c649331b120d9699aee7f0f25b68b736b54ef2022cab694b99e07269ff55a3b33958b24c2182ad94f8683e64945d5240c180a3c0e5ea8250840e525434b755

Download Submit
C:\Windows\System\HkJPcAG.exe

Filesize
1.9MB

MD5
2c28cdc64f0e37206440d20fb5d820ca

SHA1
4549db5bd75ae5df1a58d6ff3956689aa781dc91

SHA256
e851e5430d6a276dada2086d3893fd325e60cf930934541717201879ec318f7b

SHA512
d3fac63a64c42f512aa129528abed745fd98d49300540738e366d4c1e1bbae925f1c3280bbb38bd49553f5713d96c0ad6c05043c197b6c7dee20e8c34749d532

Download Submit
C:\Windows\System\HoFdkQm.exe

Filesize
1.9MB

MD5
5b1e2d8d89fa964f391481be569b4156

SHA1
3cf1fa27fb27e53d5e0d301564d8026ae422833f

SHA256
0877d1334cdadc5624360401af7860290ccfd22ae1654fc229353cb359ab280f

SHA512
2cf9eef0228d0268e09c7e12290f3b6dca9e9f5ffd5c06be8c6f4d3f6a897996f5f2d58ba3fc30f0c36d22902e362d0b8f0e7ea0dcd2956bb7a2647057193cd5

Download Submit
C:\Windows\System\IQTvzCi.exe

Filesize
1.9MB

MD5
bf5b7d8c20fb99e864c878faa304505c

SHA1
8d5c57309754b9b00c67141fecfcb5e7c2d1d9c3

SHA256
e3b278008bbcf640b3c8ef5d7b6e56e0a79d99b6111ed9de7e9d88b7b063fdc5

SHA512
ea7587630443b29297a0d6a98f3f4598f2c1c6705d067263c5b8e45337c54f976ca20e50c51fdc22b61243464050526bf393df22dfea2a5ed1a47598bad5a08c

Download Submit
C:\Windows\System\IssXTxq.exe

Filesize
1.9MB

MD5
9bc1948e571b7bbefeb69b82709c568e

SHA1
53b9a5579cc7ce90d766bfd91781c24040a32cd1

SHA256
92af60c2fdcd50bdc5427d7ab222645e0630d2678bf48d08cbb55eb9565eea82

SHA512
4e5aeb1af554f00712ba62eb0c7b17b3c22a8a5be9b5543b078ed6b3e2c6b5e2d3810affc50e2659aa8ce76c4bcba65861e12d9f1f1f2731e434d5b1b607eb1c

Download Submit
C:\Windows\System\KdmIrcz.exe

Filesize
1.9MB

MD5
503b12bcc8aa1ffe157eb9a72786eb47

SHA1
8e302ec68356f822e180799ac86b230646e8a891

SHA256
f1668bded150f5897cd1e463e6a44ed710328b4dbc29151e6218f6103d204f3a

SHA512
a1ba852901f3ea3da9da7a073c85bb75bec05b7a7047862ea9b7285bd0d5e3743a39d86a37de78a798c2748403e1c01a8a2a49e9a6f8186b0150a15cb9877c1c

Download Submit
C:\Windows\System\LEvkYRX.exe

Filesize
1.9MB

MD5
9a51f972bb3568c935656042c25ddf25

SHA1
a84d0e434dfd9f8b0b7d4a50bb9e25cd713c33fc

SHA256
1913dfe452df3dc8f8ee29175f5263e13846a9622d4145abf887b889fb2830ee

SHA512
b22eb1a0785a9b22d06aa59a3a6f71108239835c2a5c58711a8becd60dc80aff9ac92d8633205d085186372c7bcabdd7b8cd0c4a417633933fc27c39496f1fa7

Download Submit
C:\Windows\System\NDytBeE.exe

Filesize
1.9MB

MD5
1813b99650c3faa237518a827a6245b9

SHA1
e3a830bf90ea308f59729125fbd86c4076e67587

SHA256
587e5474f35f9b794421481b519250653375a806c57cf80b64f9ba2b64373eaa

SHA512
a216bb3dafac17e7beda6de0fafdda9c3a22b9609a3493a97d42b48b680d56883cc7eaa2fd57ca026c6a9f524b6c323d5243f15a272d3f11c6f1a137e7a77d69

Download Submit
C:\Windows\System\PTUeSYV.exe

Filesize
1.9MB

MD5
d778d06991f0cbe3806d04afdda4bbb8

SHA1
b84276301a613624e09aaffbebdaca6e4871cf8c

SHA256
de269cd84e3c3101f25d5c6e7a833da1ef50f11665897beb3a0a0f9f28ba9c95

SHA512
3339bdd09265838a4c28b60507d66783b480827909381ceae421b41c3e92ebc401cd8cc41e2e2292d8b477f08835c97d8062c121a165c3b97d973e51d84d0889

Download Submit
C:\Windows\System\UDhXsZB.exe

Filesize
1.9MB

MD5
41af9e4a319b43dcc2e2bf66d9d7b8a6

SHA1
aa6d8da259e479cf672f87502d0149f6b1dd77d6

SHA256
f2dd70ea92f0fe26e9652638ce6df566104b69e7198428999687e5af206ea07e

SHA512
5bd880a2124d2b093fa7de55ded7b580c090c2b246af36926974c090c4d9eaa10f50b6f84cdaa5d8b87670d18c674c17a2fe7f9a09c9ab9f9efb7878f27bfde6

Download Submit
C:\Windows\System\WYlhvaG.exe

Filesize
1.9MB

MD5
e494607a0b45f3450eab88c57b00b200

SHA1
5ad00c86eb7f5d3bdd83bda84ef95dd98ad5f9eb

SHA256
ad5ab05c19ad21dbee39cdab4fb918df002dd99dcb8a6cfee0b69ff0c3710d42

SHA512
2ef09d0f42a26ecd39b7886caa2884a0a87cdf23f0dbad1add4f3b46bb0911ebd09ede50861e92318badc2a4b46d2741120c3f6d9b06d7eef1ed77a3671d1662

Download Submit
C:\Windows\System\WyyKPrs.exe

Filesize
1.9MB

MD5
2266c9ecf4ef591d0280194a55ffb7e6

SHA1
9567a0035fb397eec022f6c7e5b67547545af246

SHA256
496000bf5ab7d92d670ac7b1a6faa820cca6766328d5d8905a792d9731532170

SHA512
1682270d70a04fe198fd2daba7c587864fd18d33c2e2563116dc42a326472a77cd8eee0227760c04b5cb6f33d34db2a30bea7057710aa30fe60d08cebd98ad9f

Download Submit
C:\Windows\System\YbZJpCG.exe

Filesize
1.9MB

MD5
9c7f1b31d2aa0aacd0f2fc5cef2b53c5

SHA1
25a667671895fc16052ec22e24e57e0e8d2ab420

SHA256
13d8816ecca34e436936bf096060c1cf2940630783f239a947e69e237da4f03b

SHA512
8104c4159d405ee5729cec281dc692a4185ca7433840123253b2222a988952bd2f1d693e63264c8d5c05913af902dc7e48cbab95c924c7f77b8cb02053687111

Download Submit
C:\Windows\System\ZWFaqmA.exe

Filesize
1.9MB

MD5
0527115e2cbe0751d8c022dacc7b418c

SHA1
3186424ddc66dd9f26c0f0ced412d04d514f3f21

SHA256
1173ed8be408e5db6029263a4a7cad1e2916a90891dbdefe6f614d3566f7a2a0

SHA512
5fa044681491d6c36339d061de3371038c12a6a6dbe1125e1a69a563be13a444b5a79715db8e0fdd1ea665a33c0ed521091fa3c60afd29cf487fe423313a6f5f

Download Submit
C:\Windows\System\cdPhGEA.exe

Filesize
1.9MB

MD5
298d094558630f228cdd03444170572d

SHA1
06097a87735cd57a224e2409a0992a038a3d902e

SHA256
0d0401ef3c075f66ccc4b87023d9b766f452b1d03855fa4e89f09f7b14b8862a

SHA512
c2e7534e227663bc91ec9ac716a5099f69ca9381ba9bf159e464893df354074df188977b0e68ebe3c09d52437e2ec88ca62dde2af0d31595dace7c104ef66b03

Download Submit
C:\Windows\System\dQmSeKE.exe

Filesize
1.9MB

MD5
669118e370e6c2068be091cd26548d26

SHA1
8e12e03af9add9fd1c7dd1fb3db447df93be6fa9

SHA256
ee7e8b528cbea472d157a914c6f2235abd9cdf31b1489da042a4d6d32c9ca00b

SHA512
df814c3503d1db9aeff3275ff46fb3c1836a2f6d186232616fa6063af48c9044cab20483f05d5e4eab7cff73c371c7a0cec8464a076b4620747dba8891e3dd49

Download Submit
C:\Windows\System\eQqGkBV.exe

Filesize
1.9MB

MD5
c1aa6f3a928511039d9f0d17436aad69

SHA1
6d976bf5fd692998321a7c7fe982bab95da66ff9

SHA256
6be7e69f0e1f4bd7224a9dbeeb506ead54c487eef684e131626def96241665de

SHA512
a25161be5c0528fcfb94ab2fed7d472907c4f934db501d862fdf8dfdfd1a2201f654f71dc770fb7be5e29a3aba5812f54fc9e1e0f874d8442091007a39723916

Download Submit
C:\Windows\System\fjsLllh.exe

Filesize
1.9MB

MD5
55693fa8f1d85253bf49343c3ff7d9a2

SHA1
58766ce9ef927874d21b520ac9a03d31baa33b9a

SHA256
afb365004ebb77a31b17b1557e8fdd616b96f32504aed734ee7372c9dd8a36b5

SHA512
59aac62c293bd060ff792e24998bb6513e2fd0292bfd43a317d69eca4ddec9af4a020d3c686d3409e151415e341ded3764632d989fa182eedc46e95d20dde336

Download Submit
C:\Windows\System\hGQRcuH.exe

Filesize
1.9MB

MD5
42432bb54cf1b5285ecc99eafca8b5de

SHA1
fb1d021802a186e86285b589de366c9fa485c357

SHA256
3686d060416942782ed2e90b17a6ec26e14de419e3031bc25eeaf0838db584eb

SHA512
739c7d59f68b3cb1bf150d5eec583061f418976e36d6d1fb38dbcf6a4127accc0380390c7a20ed807183126856acd7f13a59efb719a6a95e857f942be5648712

Download Submit
C:\Windows\System\jKYzTTI.exe

Filesize
1.9MB

MD5
e0a374277befa7c6a88cb869a39c8294

SHA1
bc233a0077c5d1d62f6900cd872514fe5f5c64d8

SHA256
59f0022886636681a0ec3af2af5dd51dcd4edafa194b02f9f6c1609446bfa732

SHA512
4c9d123f4f43b890c5d8d6a249c870f69aa539e084c1d4e0120e7eb85a9343615c9b91785efa5ed4f81b43d78aece7d0d17c2b08e542cbcf7a7d9b845b7fb75b

Download Submit
C:\Windows\System\kKGJxUq.exe

Filesize
1.9MB

MD5
2a830f6c663143b3b0aa3d3d28e6abc1

SHA1
11b6efe25f0a6199322b386c11bdaade2f068914

SHA256
084e6deaf42290d83d066519331e011427999f98dfc89a692536488fb1de8f79

SHA512
d77c57b7a74ecfa7b656b0bddb60b726dece61c827a334bbad87ed0b233d52ef5f712b988848af3a5569fe61a3b6d3168e2b62c6c0e53993808010e9b693a056

Download Submit
C:\Windows\System\kqKbXQb.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\ktHEbpf.exe

Filesize
1.9MB

MD5
d6a7241dd01309858556148556e2e001

SHA1
c26b380dd596b07bfd2aef02562470f049de77c7

SHA256
b38facf1fddbf8d310254e2dfd6f517acb02e85d1852e74543c4fdb1c55152ff

SHA512
52e87c8e73201b5c8c591663beb1c7a87b12d7f744e51fd29a63486eabd0b929875fdf0b635363bfe08ae42ef612633ba8fdb0cc6e8eb467ef13610f0122facf

Download Submit
C:\Windows\System\lIWodTE.exe

Filesize
1.9MB

MD5
4e00d6e829a498d751e5a85ea18a00bb

SHA1
d130ed5050ac4301355f75d7e82387474dee8077

SHA256
13c95d5609571f7f6027be1659e309dfe9fc8302862895216883bb508874d8fd

SHA512
57087290f5ceeaaab7ec060d45adcd60d75af6c1c62a5ca5b6825247acec2505a7367820a85d2befda5575187b370b6182866b79f5ada8940495ae37839a4bca

Download Submit
C:\Windows\System\lrrjVUy.exe

Filesize
1.9MB

MD5
532ea9cbaecf628f4c60068e78497692

SHA1
ade3dddd927c4dffff080dbdea17b4634744146a

SHA256
322d432304c049c693cd5c3145fc78405101b87094a4bdb0af34fd19b1dbf306

SHA512
96328aca48fd56d436b10e5b6f50479c8ed5d80c34abab6464c2c1ec612487d820c95fa2bd89ea66a67503f290cb54b9fdb624e493d964201067813a48db992d

Download Submit
C:\Windows\System\lskUGSu.exe

Filesize
1.9MB

MD5
0e40729c1aa504623c935cfd5140b6de

SHA1
e125e23f39ef465eb7b4bf454283ae056e9b08d0

SHA256
c115aa51c448f118441f18e91ea9fa27b46e4933fcecc83f2c1d6aa1404ace1a

SHA512
ae2b161ba98455ef14dfe6a0c6a7d133d7735cf679981152f22310e9d6c9da3971ca4cc61a52ea71d1ad8b59d73632672b891ab155eba00ac7767e8274def226

Download Submit
C:\Windows\System\mnwlqxq.exe

Filesize
1.9MB

MD5
8843b99c77fb16a0a8c54aa29a07748c

SHA1
48bd2a531c8c3a693fdabd4b4a6813772ed4842e

SHA256
3eb91cbb2d89d6a818bf9a9c752b0950b46d2e7a63ee5adc936ae17ed10fa791

SHA512
17938dbbfcfd4e7c1f2d8648a716be571e344aefd3c015af581fab3064cfc4d1ab4d5e58d0e0ac8f9dc931a9ef81bd9ea53a40d705fd4fa6b02309eab79bef3e

Download Submit
C:\Windows\System\mykXSHN.exe

Filesize
1.9MB

MD5
05f0a8afa268b1bd9ffde3ee02e22aea

SHA1
d1b9b584c3b18afe065fec36e9e8236c535a3876

SHA256
5df121c52821ebea7f5c90ce6ca97cdb8cea2cf78acde0a24edb87ef50248cf6

SHA512
2be23bedbe1e4f3f3d2d6b15ced2de0a84e19fc1b143288cac3363c82f3cbd39734663f350834b1b418f277583135b28b4f27807dbf790d29ad84eb3c32aaeaa

Download Submit
C:\Windows\System\vvMqBHl.exe

Filesize
1.9MB

MD5
7e23921001975862c07d0c13b2f6bade

SHA1
154e313d29835838e8867a64ac9fbbe0cd6f193e

SHA256
93d866f069a204bd75713f1e2289e882c159e169d1c303f6373350a91cdd5495

SHA512
97c12805c8316cb2cca7cce2008c4401ae815925bf043677766564d321c158a4586fa6f92b725d776a34755e486d3286c55cbc49f36e5813c32969088956eb4d

Download Submit
C:\Windows\System\xidusHU.exe

Filesize
1.9MB

MD5
0c24c046754fae96ca911c97825d5c5e

SHA1
9c233e844a380cd95f655ab209f3290fc0d7b0cc

SHA256
d4b6cbab3774dbb11d3b194d9c501db50d342dba7a5168a6ce3351494369cc1c

SHA512
cac7ae6957326fa7f8432e0891990f297f9ffc63f8437f7ba6b9101511f658186f15e63b4f9268ec2f686094cbd853b567b5cf5e753ee34d3b2fa72a4ca09194

Download Submit
C:\Windows\System\yMULtHf.exe

Filesize
1.9MB

MD5
cb1014c00db5e70b3b514df525b16f1f

SHA1
d4d8017aeb4e510447d3f39d05483f5cf86e6e6d

SHA256
b0deff5ee8c866fc3a553bbab0f4f8c8cbfebf1a41828ed851cbe4e07732a8b2

SHA512
fa2ffa686108cb41108aec03c243b6242aad74cbc6d63ee8e31b97bd8d5e7382c741eba6a5068c333c0c0fab8fb7fc443aa65e4093a2fc299f755cdeb7c849f4

Download Submit
C:\Windows\System\ySkEWHV.exe

Filesize
1.9MB

MD5
8abe6922fefb4010aed443f323984284

SHA1
f2d0167f2719cb8e7a600e2e4c80e3512571412b

SHA256
f6a39f3600832136ce86848e6af85bb0b853f70f07fdc3d3f5535e36ad4e4bdf

SHA512
1b09077401f1be8815e47b3081aaa03d98250ac5d0e465516b6ebc146e1342139733cc0599cbb75ba90a5a86994b230976f4f0b3c5794cf9110a5062db852d77

Download Submit
C:\Windows\System\zUijGhs.exe

Filesize
1.9MB

MD5
81ff4953dfc8dcc9a1bbd1e8c85d92fd

SHA1
1929638d554a450a7d7afc1677ba9ef9d8719a3f

SHA256
4ee4ea2491acbf2a319816e30e4402e0efb9d279e72d54a46c1f70fe8f11d0a1

SHA512
76d0919db60690341abfe659935e9408f2394dd806aed9b8b304283c70a9b4659605faa9fe5628484c44018b731deb84ec88213b2a7d15b6e9ad89395449f01f

Download Submit
C:\Windows\System\zmStYJC.exe

Filesize
1.9MB

MD5
c588f1f26e919311d06665b31f86a381

SHA1
91f329f3805b931101fe318038dcce1f4f8840cd

SHA256
3a14782a143a7f8a1fa6f7de11b3b094b03b1346ba35de2b1e70da90ad68282d

SHA512
e5018c3093d334ce86f6383f229c785a50908f3dcf19ac70887fcef976a92e4b86ed9d76a55a54e57d52ca0bef349987f7238ca40a614580ceb4ab47fdddd0ef

Download Submit
memory/372-5983-0x00007FF733140000-0x00007FF733532000-memory.dmp

Filesize
3.9MB

Download
memory/372-259-0x00007FF733140000-0x00007FF733532000-memory.dmp

Filesize
3.9MB

Download
memory/1224-6013-0x00007FF7D2F00000-0x00007FF7D32F2000-memory.dmp

Filesize
3.9MB

Download
memory/1224-351-0x00007FF7D2F00000-0x00007FF7D32F2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-6030-0x00007FF72F860000-0x00007FF72FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2004-322-0x00007FF72F860000-0x00007FF72FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2032-6001-0x00007FF6DA160000-0x00007FF6DA552000-memory.dmp

Filesize
3.9MB

Download
memory/2032-356-0x00007FF6DA160000-0x00007FF6DA552000-memory.dmp

Filesize
3.9MB

Download
memory/2328-355-0x00007FF7BC840000-0x00007FF7BCC32000-memory.dmp

Filesize
3.9MB

Download
memory/2328-5985-0x00007FF7BC840000-0x00007FF7BCC32000-memory.dmp

Filesize
3.9MB

Download
memory/2416-317-0x00007FF749880000-0x00007FF749C72000-memory.dmp

Filesize
3.9MB

Download
memory/2416-6021-0x00007FF749880000-0x00007FF749C72000-memory.dmp

Filesize
3.9MB

Download
memory/2728-28-0x00007FF702610000-0x00007FF702A02000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5960-0x00007FF702610000-0x00007FF702A02000-memory.dmp

Filesize
3.9MB

Download
memory/2744-88-0x00007FFD8DBE0000-0x00007FFD8E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/2744-284-0x00000238BF970000-0x00000238BF992000-memory.dmp

Filesize
136KB

Download
memory/2744-370-0x00000238C08A0000-0x00000238C1046000-memory.dmp

Filesize
7.6MB

Download
memory/2744-89-0x00000238BFA30000-0x00000238BFA40000-memory.dmp

Filesize
64KB

Download
memory/2848-300-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-6011-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-168-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-5976-0x00007FF66E5B0000-0x00007FF66E9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-236-0x00007FF69E820000-0x00007FF69EC12000-memory.dmp

Filesize
3.9MB

Download
memory/3092-5997-0x00007FF69E820000-0x00007FF69EC12000-memory.dmp

Filesize
3.9MB

Download
memory/3160-353-0x00007FF6F0A20000-0x00007FF6F0E12000-memory.dmp

Filesize
3.9MB

Download
memory/3160-6017-0x00007FF6F0A20000-0x00007FF6F0E12000-memory.dmp

Filesize
3.9MB

Download
memory/3492-249-0x00007FF622390000-0x00007FF622782000-memory.dmp

Filesize
3.9MB

Download
memory/3492-6036-0x00007FF622390000-0x00007FF622782000-memory.dmp

Filesize
3.9MB

Download
memory/3616-5992-0x00007FF7BCFE0000-0x00007FF7BD3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-182-0x00007FF7BCFE0000-0x00007FF7BD3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-213-0x00007FF6B9820000-0x00007FF6B9C12000-memory.dmp

Filesize
3.9MB

Download
memory/3720-6027-0x00007FF6B9820000-0x00007FF6B9C12000-memory.dmp

Filesize
3.9MB

Download
memory/4116-248-0x00007FF63F440000-0x00007FF63F832000-memory.dmp

Filesize
3.9MB

Download
memory/4116-5994-0x00007FF63F440000-0x00007FF63F832000-memory.dmp

Filesize
3.9MB

Download
memory/4136-0-0x00007FF663420000-0x00007FF663812000-memory.dmp

Filesize
3.9MB

Download
memory/4136-1-0x00000238F0B80000-0x00000238F0B90000-memory.dmp

Filesize
64KB

Download
memory/4140-6033-0x00007FF632E40000-0x00007FF633232000-memory.dmp

Filesize
3.9MB

Download
memory/4140-320-0x00007FF632E40000-0x00007FF633232000-memory.dmp

Filesize
3.9MB

Download
memory/4284-237-0x00007FF6CE070000-0x00007FF6CE462000-memory.dmp

Filesize
3.9MB

Download
memory/4284-6008-0x00007FF6CE070000-0x00007FF6CE462000-memory.dmp

Filesize
3.9MB

Download
memory/4524-5987-0x00007FF687C80000-0x00007FF688072000-memory.dmp

Filesize
3.9MB

Download
memory/4524-354-0x00007FF687C80000-0x00007FF688072000-memory.dmp

Filesize
3.9MB

Download
memory/4528-5946-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp

Filesize
3.9MB

Download
memory/4528-115-0x00007FF7AB890000-0x00007FF7ABC82000-memory.dmp

Filesize
3.9MB

Download
memory/4728-5979-0x00007FF6FD280000-0x00007FF6FD672000-memory.dmp

Filesize
3.9MB

Download
memory/4728-181-0x00007FF6FD280000-0x00007FF6FD672000-memory.dmp

Filesize
3.9MB

Download
memory/4980-6024-0x00007FF71A060000-0x00007FF71A452000-memory.dmp

Filesize
3.9MB

Download
memory/4980-323-0x00007FF71A060000-0x00007FF71A452000-memory.dmp

Filesize
3.9MB

Download