xmrig | 4d70bffa55ecd87db447d11385c21c1488b9660acf125d70d6c358f953eca3e2

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
Size

1.9MB
MD5

0ca1546aff79a589ae6e5a0b9f67cc8a
SHA1

32c2deb14fc7a1f69e1e8f555a289caf1f3aa175
SHA256

4d70bffa55ecd87db447d11385c21c1488b9660acf125d70d6c358f953eca3e2
SHA512

3a61eac2e9ea10c0f8acbf4c449ab7ee1b3a493d36e2a74c75826de6c78b359af9b4997a4742005015e19c3d9527ddcf545729be793c7a5c3e7786a037c96e6b
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U13q:NABr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/5116-191-0x00007FF762E90000-0x00007FF763282000-memory.dmp	xmrig
behavioral2/memory/4128-193-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp	xmrig
behavioral2/memory/3212-207-0x00007FF675AA0000-0x00007FF675E92000-memory.dmp	xmrig
behavioral2/memory/4132-214-0x00007FF6DCEF0000-0x00007FF6DD2E2000-memory.dmp	xmrig
behavioral2/memory/1580-220-0x00007FF62E790000-0x00007FF62EB82000-memory.dmp	xmrig
behavioral2/memory/1916-219-0x00007FF621A50000-0x00007FF621E42000-memory.dmp	xmrig
behavioral2/memory/1712-218-0x00007FF6DEAE0000-0x00007FF6DEED2000-memory.dmp	xmrig
behavioral2/memory/3540-217-0x00007FF65B360000-0x00007FF65B752000-memory.dmp	xmrig
behavioral2/memory/3076-216-0x00007FF6FD2B0000-0x00007FF6FD6A2000-memory.dmp	xmrig
behavioral2/memory/2040-215-0x00007FF631730000-0x00007FF631B22000-memory.dmp	xmrig
behavioral2/memory/2816-213-0x00007FF62B630000-0x00007FF62BA22000-memory.dmp	xmrig
behavioral2/memory/3652-212-0x00007FF699440000-0x00007FF699832000-memory.dmp	xmrig
behavioral2/memory/4728-211-0x00007FF714F70000-0x00007FF715362000-memory.dmp	xmrig
behavioral2/memory/1220-210-0x00007FF7A5A30000-0x00007FF7A5E22000-memory.dmp	xmrig
behavioral2/memory/1084-209-0x00007FF786E10000-0x00007FF787202000-memory.dmp	xmrig
behavioral2/memory/1124-206-0x00007FF7299A0000-0x00007FF729D92000-memory.dmp	xmrig
behavioral2/memory/2580-205-0x00007FF6CEEB0000-0x00007FF6CF2A2000-memory.dmp	xmrig
behavioral2/memory/5020-202-0x00007FF696AB0000-0x00007FF696EA2000-memory.dmp	xmrig
behavioral2/memory/4176-201-0x00007FF601850000-0x00007FF601C42000-memory.dmp	xmrig
behavioral2/memory/2192-185-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp	xmrig
behavioral2/memory/3904-145-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp	xmrig
behavioral2/memory/1072-132-0x00007FF657700000-0x00007FF657AF2000-memory.dmp	xmrig
behavioral2/memory/1632-96-0x00007FF703B50000-0x00007FF703F42000-memory.dmp	xmrig
behavioral2/memory/4520-34-0x00007FF7555C0000-0x00007FF7559B2000-memory.dmp	xmrig
behavioral2/memory/5116-4143-0x00007FF762E90000-0x00007FF763282000-memory.dmp	xmrig
behavioral2/memory/1072-4152-0x00007FF657700000-0x00007FF657AF2000-memory.dmp	xmrig
behavioral2/memory/4128-4166-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp	xmrig
behavioral2/memory/2192-4165-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp	xmrig
behavioral2/memory/3904-4159-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp	xmrig
behavioral2/memory/4176-4188-0x00007FF601850000-0x00007FF601C42000-memory.dmp	xmrig
behavioral2/memory/1580-4216-0x00007FF62E790000-0x00007FF62EB82000-memory.dmp	xmrig
behavioral2/memory/4728-4232-0x00007FF714F70000-0x00007FF715362000-memory.dmp	xmrig
behavioral2/memory/3076-4226-0x00007FF6FD2B0000-0x00007FF6FD6A2000-memory.dmp	xmrig
behavioral2/memory/2040-4224-0x00007FF631730000-0x00007FF631B22000-memory.dmp	xmrig
behavioral2/memory/4132-4212-0x00007FF6DCEF0000-0x00007FF6DD2E2000-memory.dmp	xmrig
behavioral2/memory/1084-4208-0x00007FF786E10000-0x00007FF787202000-memory.dmp	xmrig
behavioral2/memory/2580-4204-0x00007FF6CEEB0000-0x00007FF6CF2A2000-memory.dmp	xmrig
behavioral2/memory/1124-4203-0x00007FF7299A0000-0x00007FF729D92000-memory.dmp	xmrig
behavioral2/memory/5020-4198-0x00007FF696AB0000-0x00007FF696EA2000-memory.dmp	xmrig
behavioral2/memory/3652-4187-0x00007FF699440000-0x00007FF699832000-memory.dmp	xmrig
behavioral2/memory/3212-4183-0x00007FF675AA0000-0x00007FF675E92000-memory.dmp	xmrig
behavioral2/memory/1712-4180-0x00007FF6DEAE0000-0x00007FF6DEED2000-memory.dmp	xmrig
behavioral2/memory/1916-4173-0x00007FF621A50000-0x00007FF621E42000-memory.dmp	xmrig
behavioral2/memory/1220-4178-0x00007FF7A5A30000-0x00007FF7A5E22000-memory.dmp	xmrig
behavioral2/memory/2816-4174-0x00007FF62B630000-0x00007FF62BA22000-memory.dmp	xmrig
behavioral2/memory/3864-4641-0x00007FF728FE0000-0x00007FF7293D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4828	powershell.exe
12	4828	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4520	uUbvthl.exe
3540	YmWegkl.exe
1632	SHUvZxz.exe
1072	NpRViAY.exe
3904	RAVoNQA.exe
1712	URpRSmd.exe
2192	IWMpNGI.exe
5116	AJnrKjJ.exe
4128	MMxEqGA.exe
4176	LCxNMSs.exe
5020	gSEwstx.exe
1916	FJCHlNZ.exe
2580	gXIDlFl.exe
1124	mgwMRBV.exe
3212	wjERXNy.exe
1084	MJZKVsT.exe
1220	cMnFKqi.exe
4728	SlACBpf.exe
1580	lsqMWjy.exe
3652	oTMtsSB.exe
2816	OsvFMQY.exe
4132	dsvgsxh.exe
2040	LLewwmK.exe
3076	XRnaszo.exe
4396	hhWcwBd.exe
2004	WxdKXnn.exe
3016	yVBYKZa.exe
3812	vmglVxF.exe
2500	lpiEFSW.exe
4148	uOpwUNl.exe
4136	dtkTGlb.exe
5088	qTerlcW.exe
2032	LbUWyys.exe
2072	WWkEcMR.exe
1296	rkzmhgg.exe
2972	PhbFEwe.exe
2316	sTEZBys.exe
1052	LugfUHH.exe
2348	HkZBnwU.exe
544	pYleCpe.exe
4988	fyyejXs.exe
3324	cTgwGwB.exe
4588	GZQpQRL.exe
5048	BchJuUN.exe
4812	axiYlna.exe
2852	bSzzwlh.exe
1436	xPuZMLg.exe
4264	ijVIukG.exe
2596	cfcTFUl.exe
1668	hXLcZbK.exe
2940	VcnTqIh.exe
4880	iRFXiyQ.exe
4964	acYnIiG.exe
1164	kJxxHyO.exe
2360	tPpmWID.exe
2860	VwrFbnX.exe
2236	ltIJGHD.exe
4900	HBqbBNX.exe
5036	hfFjStp.exe
2356	MOdVdEo.exe
3836	zLlHguT.exe
756	SdyPWXv.exe
2876	fJteSxe.exe
8	KfyOCDO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3864-0-0x00007FF728FE0000-0x00007FF7293D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b74-7.dat	upx
behavioral2/files/0x000a000000023b78-8.dat	upx
behavioral2/files/0x000a000000023b7b-21.dat	upx
behavioral2/files/0x000a000000023b83-59.dat	upx
behavioral2/files/0x000a000000023b7d-82.dat	upx
behavioral2/files/0x000a000000023b8a-143.dat	upx
behavioral2/files/0x000a000000023b94-181.dat	upx
behavioral2/memory/5116-191-0x00007FF762E90000-0x00007FF763282000-memory.dmp	upx
behavioral2/memory/4128-193-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp	upx
behavioral2/memory/3212-207-0x00007FF675AA0000-0x00007FF675E92000-memory.dmp	upx
behavioral2/memory/4132-214-0x00007FF6DCEF0000-0x00007FF6DD2E2000-memory.dmp	upx
behavioral2/memory/1580-220-0x00007FF62E790000-0x00007FF62EB82000-memory.dmp	upx
behavioral2/memory/1916-219-0x00007FF621A50000-0x00007FF621E42000-memory.dmp	upx
behavioral2/memory/1712-218-0x00007FF6DEAE0000-0x00007FF6DEED2000-memory.dmp	upx
behavioral2/memory/3540-217-0x00007FF65B360000-0x00007FF65B752000-memory.dmp	upx
behavioral2/memory/3076-216-0x00007FF6FD2B0000-0x00007FF6FD6A2000-memory.dmp	upx
behavioral2/memory/2040-215-0x00007FF631730000-0x00007FF631B22000-memory.dmp	upx
behavioral2/memory/2816-213-0x00007FF62B630000-0x00007FF62BA22000-memory.dmp	upx
behavioral2/memory/3652-212-0x00007FF699440000-0x00007FF699832000-memory.dmp	upx
behavioral2/memory/4728-211-0x00007FF714F70000-0x00007FF715362000-memory.dmp	upx
behavioral2/memory/1220-210-0x00007FF7A5A30000-0x00007FF7A5E22000-memory.dmp	upx
behavioral2/memory/1084-209-0x00007FF786E10000-0x00007FF787202000-memory.dmp	upx
behavioral2/memory/1124-206-0x00007FF7299A0000-0x00007FF729D92000-memory.dmp	upx
behavioral2/memory/2580-205-0x00007FF6CEEB0000-0x00007FF6CF2A2000-memory.dmp	upx
behavioral2/memory/5020-202-0x00007FF696AB0000-0x00007FF696EA2000-memory.dmp	upx
behavioral2/memory/4176-201-0x00007FF601850000-0x00007FF601C42000-memory.dmp	upx
behavioral2/files/0x000b000000023b75-189.dat	upx
behavioral2/files/0x000a000000023b97-188.dat	upx
behavioral2/files/0x000a000000023b90-186.dat	upx
behavioral2/memory/2192-185-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-167.dat	upx
behavioral2/files/0x000a000000023b92-163.dat	upx
behavioral2/files/0x000a000000023b89-159.dat	upx
behavioral2/files/0x000a000000023b88-155.dat	upx
behavioral2/files/0x000a000000023b91-152.dat	upx
behavioral2/files/0x000a000000023b8f-150.dat	upx
behavioral2/files/0x000a000000023b8e-148.dat	upx
behavioral2/files/0x000a000000023b96-147.dat	upx
behavioral2/files/0x000a000000023b95-146.dat	upx
behavioral2/memory/3904-145-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-139.dat	upx
behavioral2/files/0x000a000000023b86-138.dat	upx
behavioral2/files/0x000a000000023b85-133.dat	upx
behavioral2/memory/1072-132-0x00007FF657700000-0x00007FF657AF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-128.dat	upx
behavioral2/files/0x000a000000023b84-125.dat	upx
behavioral2/files/0x000a000000023b87-114.dat	upx
behavioral2/files/0x000a000000023b8c-111.dat	upx
behavioral2/files/0x000a000000023b82-107.dat	upx
behavioral2/files/0x000a000000023b8b-106.dat	upx
behavioral2/memory/1632-96-0x00007FF703B50000-0x00007FF703F42000-memory.dmp	upx
behavioral2/files/0x000a000000023b7c-76.dat	upx
behavioral2/files/0x000a000000023b80-66.dat	upx
behavioral2/files/0x000a000000023b7e-60.dat	upx
behavioral2/files/0x000a000000023b7f-89.dat	upx
behavioral2/files/0x000a000000023b7a-50.dat	upx
behavioral2/memory/4520-34-0x00007FF7555C0000-0x00007FF7559B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b79-29.dat	upx
behavioral2/memory/5116-4143-0x00007FF762E90000-0x00007FF763282000-memory.dmp	upx
behavioral2/memory/1072-4152-0x00007FF657700000-0x00007FF657AF2000-memory.dmp	upx
behavioral2/memory/4128-4166-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp	upx
behavioral2/memory/2192-4165-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp	upx
behavioral2/memory/3904-4159-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\STgkAIv.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YUxTuIQ.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\xVmpAhb.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\mHdlZUR.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\yriGJDi.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\aUadwfF.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\jRCQEhk.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ELzuZws.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\wFagnIr.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\exOVKoE.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\LTscujS.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\WiXqJbf.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\vGTNnoO.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\xHUfLZR.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\oHnWtxs.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ucyeZBT.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\gGLuOsf.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\bNGPUBi.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\baajsGN.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\SEunufA.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\vcAdGdc.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\SEDhfEU.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\qNTMNyj.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\xdFHlgW.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\TcSfSNs.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\dVZZVqn.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\lkhftrU.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YGJQwSK.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YbxyFFz.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\LZiQfwd.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\hNCcRAj.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\jLZvefr.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ZJkpDxB.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\qZDpdKq.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\tIbzrIl.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\CmkhsXV.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\VrVQFmB.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YHqMUkp.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ibUcegZ.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\SjjTLlr.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\MRcQIIW.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\RzaFREi.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\KypvuEN.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\qhNnkfZ.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\QlewNMj.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\QUqznEp.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YWeKOxo.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\DgXSIql.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\qFseLNx.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\sOpGsmi.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\xSzPAcq.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\rjvZFLw.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\dhuLbYL.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\NKOUnAz.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\GlGfwSH.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ifxyjaX.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\zbyhwtf.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\KDkADFQ.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\YMsJGXC.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\APfVWHW.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\jzgjABv.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\uHavMJN.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\ACLXdNZ.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
File created	C:\Windows\System\vtYjJkU.exe	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeLockMemoryPrivilege	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4828	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	84
PID 3864 wrote to memory of 4828	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	84
PID 3864 wrote to memory of 4520	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	85
PID 3864 wrote to memory of 4520	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	85
PID 3864 wrote to memory of 3540	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	86
PID 3864 wrote to memory of 3540	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	86
PID 3864 wrote to memory of 1632	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	87
PID 3864 wrote to memory of 1632	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	87
PID 3864 wrote to memory of 1072	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	88
PID 3864 wrote to memory of 1072	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	88
PID 3864 wrote to memory of 3904	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	89
PID 3864 wrote to memory of 3904	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	89
PID 3864 wrote to memory of 1712	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	90
PID 3864 wrote to memory of 1712	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	90
PID 3864 wrote to memory of 2192	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	91
PID 3864 wrote to memory of 2192	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	91
PID 3864 wrote to memory of 5116	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	92
PID 3864 wrote to memory of 5116	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	92
PID 3864 wrote to memory of 4128	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	93
PID 3864 wrote to memory of 4128	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	93
PID 3864 wrote to memory of 4176	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	94
PID 3864 wrote to memory of 4176	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	94
PID 3864 wrote to memory of 5020	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	95
PID 3864 wrote to memory of 5020	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	95
PID 3864 wrote to memory of 3212	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	96
PID 3864 wrote to memory of 3212	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	96
PID 3864 wrote to memory of 1916	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	97
PID 3864 wrote to memory of 1916	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	97
PID 3864 wrote to memory of 2580	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	98
PID 3864 wrote to memory of 2580	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	98
PID 3864 wrote to memory of 1124	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	99
PID 3864 wrote to memory of 1124	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	99
PID 3864 wrote to memory of 1084	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	100
PID 3864 wrote to memory of 1084	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	100
PID 3864 wrote to memory of 1220	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	101
PID 3864 wrote to memory of 1220	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	101
PID 3864 wrote to memory of 3016	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	102
PID 3864 wrote to memory of 3016	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	102
PID 3864 wrote to memory of 4728	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	103
PID 3864 wrote to memory of 4728	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	103
PID 3864 wrote to memory of 1580	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	104
PID 3864 wrote to memory of 1580	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	104
PID 3864 wrote to memory of 3652	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	105
PID 3864 wrote to memory of 3652	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	105
PID 3864 wrote to memory of 2816	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	106
PID 3864 wrote to memory of 2816	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	106
PID 3864 wrote to memory of 4132	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	107
PID 3864 wrote to memory of 4132	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	107
PID 3864 wrote to memory of 2040	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	108
PID 3864 wrote to memory of 2040	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	108
PID 3864 wrote to memory of 3076	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	109
PID 3864 wrote to memory of 3076	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	109
PID 3864 wrote to memory of 4396	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	110
PID 3864 wrote to memory of 4396	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	110
PID 3864 wrote to memory of 2004	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	111
PID 3864 wrote to memory of 2004	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	111
PID 3864 wrote to memory of 3812	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	112
PID 3864 wrote to memory of 3812	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	112
PID 3864 wrote to memory of 2500	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	113
PID 3864 wrote to memory of 2500	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	113
PID 3864 wrote to memory of 4148	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	114
PID 3864 wrote to memory of 4148	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	114
PID 3864 wrote to memory of 4136	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	115
PID 3864 wrote to memory of 4136	3864	0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ca1546aff79a589ae6e5a0b9f67cc8a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\System\uUbvthl.exe
  C:\Windows\System\uUbvthl.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\YmWegkl.exe
  C:\Windows\System\YmWegkl.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\SHUvZxz.exe
  C:\Windows\System\SHUvZxz.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\NpRViAY.exe
  C:\Windows\System\NpRViAY.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\RAVoNQA.exe
  C:\Windows\System\RAVoNQA.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\URpRSmd.exe
  C:\Windows\System\URpRSmd.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\IWMpNGI.exe
  C:\Windows\System\IWMpNGI.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\AJnrKjJ.exe
  C:\Windows\System\AJnrKjJ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\MMxEqGA.exe
  C:\Windows\System\MMxEqGA.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\LCxNMSs.exe
  C:\Windows\System\LCxNMSs.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\gSEwstx.exe
  C:\Windows\System\gSEwstx.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\wjERXNy.exe
  C:\Windows\System\wjERXNy.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\FJCHlNZ.exe
  C:\Windows\System\FJCHlNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\gXIDlFl.exe
  C:\Windows\System\gXIDlFl.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\mgwMRBV.exe
  C:\Windows\System\mgwMRBV.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\MJZKVsT.exe
  C:\Windows\System\MJZKVsT.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\cMnFKqi.exe
  C:\Windows\System\cMnFKqi.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\yVBYKZa.exe
  C:\Windows\System\yVBYKZa.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\SlACBpf.exe
  C:\Windows\System\SlACBpf.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\lsqMWjy.exe
  C:\Windows\System\lsqMWjy.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\oTMtsSB.exe
  C:\Windows\System\oTMtsSB.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\OsvFMQY.exe
  C:\Windows\System\OsvFMQY.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\dsvgsxh.exe
  C:\Windows\System\dsvgsxh.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\LLewwmK.exe
  C:\Windows\System\LLewwmK.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\XRnaszo.exe
  C:\Windows\System\XRnaszo.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\hhWcwBd.exe
  C:\Windows\System\hhWcwBd.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\WxdKXnn.exe
  C:\Windows\System\WxdKXnn.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vmglVxF.exe
  C:\Windows\System\vmglVxF.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\lpiEFSW.exe
  C:\Windows\System\lpiEFSW.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\uOpwUNl.exe
  C:\Windows\System\uOpwUNl.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\dtkTGlb.exe
  C:\Windows\System\dtkTGlb.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\qTerlcW.exe
  C:\Windows\System\qTerlcW.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\LbUWyys.exe
  C:\Windows\System\LbUWyys.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\WWkEcMR.exe
  C:\Windows\System\WWkEcMR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\rkzmhgg.exe
  C:\Windows\System\rkzmhgg.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\PhbFEwe.exe
  C:\Windows\System\PhbFEwe.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\sTEZBys.exe
  C:\Windows\System\sTEZBys.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\LugfUHH.exe
  C:\Windows\System\LugfUHH.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\HkZBnwU.exe
  C:\Windows\System\HkZBnwU.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\pYleCpe.exe
  C:\Windows\System\pYleCpe.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\fyyejXs.exe
  C:\Windows\System\fyyejXs.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\cTgwGwB.exe
  C:\Windows\System\cTgwGwB.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\GZQpQRL.exe
  C:\Windows\System\GZQpQRL.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\BchJuUN.exe
  C:\Windows\System\BchJuUN.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\axiYlna.exe
  C:\Windows\System\axiYlna.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\bSzzwlh.exe
  C:\Windows\System\bSzzwlh.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\xPuZMLg.exe
  C:\Windows\System\xPuZMLg.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ijVIukG.exe
  C:\Windows\System\ijVIukG.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\cfcTFUl.exe
  C:\Windows\System\cfcTFUl.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\hXLcZbK.exe
  C:\Windows\System\hXLcZbK.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VcnTqIh.exe
  C:\Windows\System\VcnTqIh.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\iRFXiyQ.exe
  C:\Windows\System\iRFXiyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\acYnIiG.exe
  C:\Windows\System\acYnIiG.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\kJxxHyO.exe
  C:\Windows\System\kJxxHyO.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\tPpmWID.exe
  C:\Windows\System\tPpmWID.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\VwrFbnX.exe
  C:\Windows\System\VwrFbnX.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ltIJGHD.exe
  C:\Windows\System\ltIJGHD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\HBqbBNX.exe
  C:\Windows\System\HBqbBNX.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\hfFjStp.exe
  C:\Windows\System\hfFjStp.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\MOdVdEo.exe
  C:\Windows\System\MOdVdEo.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\zLlHguT.exe
  C:\Windows\System\zLlHguT.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\SdyPWXv.exe
  C:\Windows\System\SdyPWXv.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\fJteSxe.exe
  C:\Windows\System\fJteSxe.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\KfyOCDO.exe
  C:\Windows\System\KfyOCDO.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\CHCvjuX.exe
  C:\Windows\System\CHCvjuX.exe
  2⤵
  PID:784
- C:\Windows\System\rfXLXjG.exe
  C:\Windows\System\rfXLXjG.exe
  2⤵
  PID:372
- C:\Windows\System\PMtVJym.exe
  C:\Windows\System\PMtVJym.exe
  2⤵
  PID:1452
- C:\Windows\System\bTKSFUB.exe
  C:\Windows\System\bTKSFUB.exe
  2⤵
  PID:5136
- C:\Windows\System\eOpqHpP.exe
  C:\Windows\System\eOpqHpP.exe
  2⤵
  PID:5392
- C:\Windows\System\tsaqBQZ.exe
  C:\Windows\System\tsaqBQZ.exe
  2⤵
  PID:5428
- C:\Windows\System\EyktfgD.exe
  C:\Windows\System\EyktfgD.exe
  2⤵
  PID:5488
- C:\Windows\System\PGAvvEp.exe
  C:\Windows\System\PGAvvEp.exe
  2⤵
  PID:5504
- C:\Windows\System\xqrDPQV.exe
  C:\Windows\System\xqrDPQV.exe
  2⤵
  PID:5520
- C:\Windows\System\NcFAwCs.exe
  C:\Windows\System\NcFAwCs.exe
  2⤵
  PID:5536
- C:\Windows\System\tzqYqnF.exe
  C:\Windows\System\tzqYqnF.exe
  2⤵
  PID:5556
- C:\Windows\System\krNlaFT.exe
  C:\Windows\System\krNlaFT.exe
  2⤵
  PID:5580
- C:\Windows\System\haKOpyY.exe
  C:\Windows\System\haKOpyY.exe
  2⤵
  PID:5612
- C:\Windows\System\xTyyWKr.exe
  C:\Windows\System\xTyyWKr.exe
  2⤵
  PID:5632
- C:\Windows\System\ZppBUop.exe
  C:\Windows\System\ZppBUop.exe
  2⤵
  PID:5656
- C:\Windows\System\JjZauLu.exe
  C:\Windows\System\JjZauLu.exe
  2⤵
  PID:5672
- C:\Windows\System\oxXkQJZ.exe
  C:\Windows\System\oxXkQJZ.exe
  2⤵
  PID:5696
- C:\Windows\System\FTniRfY.exe
  C:\Windows\System\FTniRfY.exe
  2⤵
  PID:5716
- C:\Windows\System\pEjbLUN.exe
  C:\Windows\System\pEjbLUN.exe
  2⤵
  PID:5748
- C:\Windows\System\YSuSmGR.exe
  C:\Windows\System\YSuSmGR.exe
  2⤵
  PID:5776
- C:\Windows\System\rpcrpaI.exe
  C:\Windows\System\rpcrpaI.exe
  2⤵
  PID:5792
- C:\Windows\System\XyIhLai.exe
  C:\Windows\System\XyIhLai.exe
  2⤵
  PID:5812
- C:\Windows\System\NUAgTMG.exe
  C:\Windows\System\NUAgTMG.exe
  2⤵
  PID:5844
- C:\Windows\System\ScERNeA.exe
  C:\Windows\System\ScERNeA.exe
  2⤵
  PID:5864
- C:\Windows\System\kuvtpPi.exe
  C:\Windows\System\kuvtpPi.exe
  2⤵
  PID:5888
- C:\Windows\System\XgwBdGI.exe
  C:\Windows\System\XgwBdGI.exe
  2⤵
  PID:5920
- C:\Windows\System\UrRNGKF.exe
  C:\Windows\System\UrRNGKF.exe
  2⤵
  PID:5948
- C:\Windows\System\jFPgBoQ.exe
  C:\Windows\System\jFPgBoQ.exe
  2⤵
  PID:5992
- C:\Windows\System\dPywdjq.exe
  C:\Windows\System\dPywdjq.exe
  2⤵
  PID:6016
- C:\Windows\System\ridPdUF.exe
  C:\Windows\System\ridPdUF.exe
  2⤵
  PID:6040
- C:\Windows\System\zGJbFmc.exe
  C:\Windows\System\zGJbFmc.exe
  2⤵
  PID:6064
- C:\Windows\System\pBpTiHh.exe
  C:\Windows\System\pBpTiHh.exe
  2⤵
  PID:6084
- C:\Windows\System\MBuWevB.exe
  C:\Windows\System\MBuWevB.exe
  2⤵
  PID:6104
- C:\Windows\System\PUlOJYP.exe
  C:\Windows\System\PUlOJYP.exe
  2⤵
  PID:6136
- C:\Windows\System\CwDxjGk.exe
  C:\Windows\System\CwDxjGk.exe
  2⤵
  PID:2492
- C:\Windows\System\eefJMEn.exe
  C:\Windows\System\eefJMEn.exe
  2⤵
  PID:4584
- C:\Windows\System\ckFtMuG.exe
  C:\Windows\System\ckFtMuG.exe
  2⤵
  PID:3840
- C:\Windows\System\JYrTpVz.exe
  C:\Windows\System\JYrTpVz.exe
  2⤵
  PID:3280
- C:\Windows\System\FaeORTN.exe
  C:\Windows\System\FaeORTN.exe
  2⤵
  PID:3956
- C:\Windows\System\FROuBDW.exe
  C:\Windows\System\FROuBDW.exe
  2⤵
  PID:3608
- C:\Windows\System\TktzjnC.exe
  C:\Windows\System\TktzjnC.exe
  2⤵
  PID:4976
- C:\Windows\System\hTqqusF.exe
  C:\Windows\System\hTqqusF.exe
  2⤵
  PID:2260
- C:\Windows\System\rDbvfyW.exe
  C:\Windows\System\rDbvfyW.exe
  2⤵
  PID:892
- C:\Windows\System\LKHWbyk.exe
  C:\Windows\System\LKHWbyk.exe
  2⤵
  PID:2696
- C:\Windows\System\LiFXUpy.exe
  C:\Windows\System\LiFXUpy.exe
  2⤵
  PID:2352
- C:\Windows\System\mEzrcMq.exe
  C:\Windows\System\mEzrcMq.exe
  2⤵
  PID:5220
- C:\Windows\System\EcaJpfk.exe
  C:\Windows\System\EcaJpfk.exe
  2⤵
  PID:5264
- C:\Windows\System\aXuuTKD.exe
  C:\Windows\System\aXuuTKD.exe
  2⤵
  PID:3756
- C:\Windows\System\sfmRoPX.exe
  C:\Windows\System\sfmRoPX.exe
  2⤵
  PID:788
- C:\Windows\System\tSAuivp.exe
  C:\Windows\System\tSAuivp.exe
  2⤵
  PID:4100
- C:\Windows\System\xPWNCAU.exe
  C:\Windows\System\xPWNCAU.exe
  2⤵
  PID:404
- C:\Windows\System\SSXArJT.exe
  C:\Windows\System\SSXArJT.exe
  2⤵
  PID:4820
- C:\Windows\System\lMhsCtY.exe
  C:\Windows\System\lMhsCtY.exe
  2⤵
  PID:1544
- C:\Windows\System\ZedUPBL.exe
  C:\Windows\System\ZedUPBL.exe
  2⤵
  PID:2628
- C:\Windows\System\kMUgwRK.exe
  C:\Windows\System\kMUgwRK.exe
  2⤵
  PID:1060
- C:\Windows\System\RphrTwt.exe
  C:\Windows\System\RphrTwt.exe
  2⤵
  PID:4000
- C:\Windows\System\YLoiyds.exe
  C:\Windows\System\YLoiyds.exe
  2⤵
  PID:4788
- C:\Windows\System\dnuvDQd.exe
  C:\Windows\System\dnuvDQd.exe
  2⤵
  PID:4668
- C:\Windows\System\TgakmLO.exe
  C:\Windows\System\TgakmLO.exe
  2⤵
  PID:3404
- C:\Windows\System\qrcioop.exe
  C:\Windows\System\qrcioop.exe
  2⤵
  PID:2088
- C:\Windows\System\nlhryAk.exe
  C:\Windows\System\nlhryAk.exe
  2⤵
  PID:3240
- C:\Windows\System\mLLHfMS.exe
  C:\Windows\System\mLLHfMS.exe
  2⤵
  PID:1248
- C:\Windows\System\UchyuGr.exe
  C:\Windows\System\UchyuGr.exe
  2⤵
  PID:208
- C:\Windows\System\VjMlvMA.exe
  C:\Windows\System\VjMlvMA.exe
  2⤵
  PID:5532
- C:\Windows\System\DwiagEz.exe
  C:\Windows\System\DwiagEz.exe
  2⤵
  PID:5456
- C:\Windows\System\tFXRWoF.exe
  C:\Windows\System\tFXRWoF.exe
  2⤵
  PID:5604
- C:\Windows\System\jpNMFBe.exe
  C:\Windows\System\jpNMFBe.exe
  2⤵
  PID:5624
- C:\Windows\System\qCUWShJ.exe
  C:\Windows\System\qCUWShJ.exe
  2⤵
  PID:4904
- C:\Windows\System\xQggKFs.exe
  C:\Windows\System\xQggKFs.exe
  2⤵
  PID:5768
- C:\Windows\System\QJMOHGN.exe
  C:\Windows\System\QJMOHGN.exe
  2⤵
  PID:5516
- C:\Windows\System\MtSkUpK.exe
  C:\Windows\System\MtSkUpK.exe
  2⤵
  PID:5828
- C:\Windows\System\YSZoBmC.exe
  C:\Windows\System\YSZoBmC.exe
  2⤵
  PID:4276
- C:\Windows\System\POPiCed.exe
  C:\Windows\System\POPiCed.exe
  2⤵
  PID:5648
- C:\Windows\System\xyBRdFn.exe
  C:\Windows\System\xyBRdFn.exe
  2⤵
  PID:5680
- C:\Windows\System\ZzPmVLm.exe
  C:\Windows\System\ZzPmVLm.exe
  2⤵
  PID:5764
- C:\Windows\System\AlYYjWY.exe
  C:\Windows\System\AlYYjWY.exe
  2⤵
  PID:6028
- C:\Windows\System\LTNRtSF.exe
  C:\Windows\System\LTNRtSF.exe
  2⤵
  PID:6056
- C:\Windows\System\KGfUiPN.exe
  C:\Windows\System\KGfUiPN.exe
  2⤵
  PID:3188
- C:\Windows\System\cdMBCMx.exe
  C:\Windows\System\cdMBCMx.exe
  2⤵
  PID:5904
- C:\Windows\System\chRgclm.exe
  C:\Windows\System\chRgclm.exe
  2⤵
  PID:3628
- C:\Windows\System\kovyAgW.exe
  C:\Windows\System\kovyAgW.exe
  2⤵
  PID:5168
- C:\Windows\System\CmkhsXV.exe
  C:\Windows\System\CmkhsXV.exe
  2⤵
  PID:1968
- C:\Windows\System\qMzmSVh.exe
  C:\Windows\System\qMzmSVh.exe
  2⤵
  PID:5980
- C:\Windows\System\QCanlyQ.exe
  C:\Windows\System\QCanlyQ.exe
  2⤵
  PID:5212
- C:\Windows\System\msraMYG.exe
  C:\Windows\System\msraMYG.exe
  2⤵
  PID:4772
- C:\Windows\System\IpLPJRr.exe
  C:\Windows\System\IpLPJRr.exe
  2⤵
  PID:4700
- C:\Windows\System\aPkGRTy.exe
  C:\Windows\System\aPkGRTy.exe
  2⤵
  PID:3672
- C:\Windows\System\mRSUfwG.exe
  C:\Windows\System\mRSUfwG.exe
  2⤵
  PID:5144
- C:\Windows\System\ahHzxDA.exe
  C:\Windows\System\ahHzxDA.exe
  2⤵
  PID:5056
- C:\Windows\System\UQOYKdJ.exe
  C:\Windows\System\UQOYKdJ.exe
  2⤵
  PID:4852
- C:\Windows\System\VlIACbE.exe
  C:\Windows\System\VlIACbE.exe
  2⤵
  PID:4784
- C:\Windows\System\sfDvaSn.exe
  C:\Windows\System\sfDvaSn.exe
  2⤵
  PID:5452
- C:\Windows\System\DdmoRFl.exe
  C:\Windows\System\DdmoRFl.exe
  2⤵
  PID:5568
- C:\Windows\System\dgvwhoR.exe
  C:\Windows\System\dgvwhoR.exe
  2⤵
  PID:3408
- C:\Windows\System\tgwqWGN.exe
  C:\Windows\System\tgwqWGN.exe
  2⤵
  PID:4240
- C:\Windows\System\nrpBPbm.exe
  C:\Windows\System\nrpBPbm.exe
  2⤵
  PID:5712
- C:\Windows\System\VMBpUpa.exe
  C:\Windows\System\VMBpUpa.exe
  2⤵
  PID:5820
- C:\Windows\System\SWBUPyT.exe
  C:\Windows\System\SWBUPyT.exe
  2⤵
  PID:5596
- C:\Windows\System\XVrxSHx.exe
  C:\Windows\System\XVrxSHx.exe
  2⤵
  PID:5668
- C:\Windows\System\EYcFKBj.exe
  C:\Windows\System\EYcFKBj.exe
  2⤵
  PID:5788
- C:\Windows\System\HEmGrIa.exe
  C:\Windows\System\HEmGrIa.exe
  2⤵
  PID:2512
- C:\Windows\System\YUNHgHv.exe
  C:\Windows\System\YUNHgHv.exe
  2⤵
  PID:6164
- C:\Windows\System\wKEPFea.exe
  C:\Windows\System\wKEPFea.exe
  2⤵
  PID:6188
- C:\Windows\System\zZaURal.exe
  C:\Windows\System\zZaURal.exe
  2⤵
  PID:6204
- C:\Windows\System\zJJTejo.exe
  C:\Windows\System\zJJTejo.exe
  2⤵
  PID:6232
- C:\Windows\System\NXYxTNi.exe
  C:\Windows\System\NXYxTNi.exe
  2⤵
  PID:6252
- C:\Windows\System\uCGTuyu.exe
  C:\Windows\System\uCGTuyu.exe
  2⤵
  PID:6272
- C:\Windows\System\SJfikED.exe
  C:\Windows\System\SJfikED.exe
  2⤵
  PID:6296
- C:\Windows\System\bbYLmhc.exe
  C:\Windows\System\bbYLmhc.exe
  2⤵
  PID:6328
- C:\Windows\System\uAsvbjO.exe
  C:\Windows\System\uAsvbjO.exe
  2⤵
  PID:6348
- C:\Windows\System\HvnNwfz.exe
  C:\Windows\System\HvnNwfz.exe
  2⤵
  PID:6368
- C:\Windows\System\lbYGCnb.exe
  C:\Windows\System\lbYGCnb.exe
  2⤵
  PID:6388
- C:\Windows\System\hxufGeM.exe
  C:\Windows\System\hxufGeM.exe
  2⤵
  PID:6412
- C:\Windows\System\EkiGoQy.exe
  C:\Windows\System\EkiGoQy.exe
  2⤵
  PID:6436
- C:\Windows\System\YjVAXiY.exe
  C:\Windows\System\YjVAXiY.exe
  2⤵
  PID:6456
- C:\Windows\System\ulbNDFi.exe
  C:\Windows\System\ulbNDFi.exe
  2⤵
  PID:6472
- C:\Windows\System\ycSNZuA.exe
  C:\Windows\System\ycSNZuA.exe
  2⤵
  PID:6496
- C:\Windows\System\PQDWecQ.exe
  C:\Windows\System\PQDWecQ.exe
  2⤵
  PID:6516
- C:\Windows\System\TMMsFXU.exe
  C:\Windows\System\TMMsFXU.exe
  2⤵
  PID:6544
- C:\Windows\System\DeCmTHQ.exe
  C:\Windows\System\DeCmTHQ.exe
  2⤵
  PID:6564
- C:\Windows\System\AfFJSPH.exe
  C:\Windows\System\AfFJSPH.exe
  2⤵
  PID:6592
- C:\Windows\System\dtNoUOE.exe
  C:\Windows\System\dtNoUOE.exe
  2⤵
  PID:6624
- C:\Windows\System\TgaKWvE.exe
  C:\Windows\System\TgaKWvE.exe
  2⤵
  PID:6816
- C:\Windows\System\RyuiFxd.exe
  C:\Windows\System\RyuiFxd.exe
  2⤵
  PID:6844
- C:\Windows\System\ffNMtIT.exe
  C:\Windows\System\ffNMtIT.exe
  2⤵
  PID:6864
- C:\Windows\System\ePuiOaP.exe
  C:\Windows\System\ePuiOaP.exe
  2⤵
  PID:6884
- C:\Windows\System\HiLUNaX.exe
  C:\Windows\System\HiLUNaX.exe
  2⤵
  PID:6912
- C:\Windows\System\iXBZYPs.exe
  C:\Windows\System\iXBZYPs.exe
  2⤵
  PID:6932
- C:\Windows\System\VOUhLeY.exe
  C:\Windows\System\VOUhLeY.exe
  2⤵
  PID:6956
- C:\Windows\System\CbXAWDJ.exe
  C:\Windows\System\CbXAWDJ.exe
  2⤵
  PID:6984
- C:\Windows\System\OuZhOXg.exe
  C:\Windows\System\OuZhOXg.exe
  2⤵
  PID:7004
- C:\Windows\System\VEEOFpk.exe
  C:\Windows\System\VEEOFpk.exe
  2⤵
  PID:7028
- C:\Windows\System\rTbsyea.exe
  C:\Windows\System\rTbsyea.exe
  2⤵
  PID:7048
- C:\Windows\System\yQBFowN.exe
  C:\Windows\System\yQBFowN.exe
  2⤵
  PID:7080
- C:\Windows\System\NSVbgiQ.exe
  C:\Windows\System\NSVbgiQ.exe
  2⤵
  PID:7100
- C:\Windows\System\MyRqnrx.exe
  C:\Windows\System\MyRqnrx.exe
  2⤵
  PID:7136
- C:\Windows\System\NLYjUhk.exe
  C:\Windows\System\NLYjUhk.exe
  2⤵
  PID:7156
- C:\Windows\System\AIECKRq.exe
  C:\Windows\System\AIECKRq.exe
  2⤵
  PID:2692
- C:\Windows\System\sYrwkWV.exe
  C:\Windows\System\sYrwkWV.exe
  2⤵
  PID:5500
- C:\Windows\System\VJoieKY.exe
  C:\Windows\System\VJoieKY.exe
  2⤵
  PID:1764
- C:\Windows\System\QUoeOvz.exe
  C:\Windows\System\QUoeOvz.exe
  2⤵
  PID:2740
- C:\Windows\System\lktdEBj.exe
  C:\Windows\System\lktdEBj.exe
  2⤵
  PID:2232
- C:\Windows\System\frkJePw.exe
  C:\Windows\System\frkJePw.exe
  2⤵
  PID:5424
- C:\Windows\System\xPAyrNg.exe
  C:\Windows\System\xPAyrNg.exe
  2⤵
  PID:5600
- C:\Windows\System\ppSnEfo.exe
  C:\Windows\System\ppSnEfo.exe
  2⤵
  PID:4564
- C:\Windows\System\WxNydiC.exe
  C:\Windows\System\WxNydiC.exe
  2⤵
  PID:5244
- C:\Windows\System\GQVKtoy.exe
  C:\Windows\System\GQVKtoy.exe
  2⤵
  PID:6344
- C:\Windows\System\QQVTuqC.exe
  C:\Windows\System\QQVTuqC.exe
  2⤵
  PID:5876
- C:\Windows\System\ameRujV.exe
  C:\Windows\System\ameRujV.exe
  2⤵
  PID:6584
- C:\Windows\System\OXbZlIP.exe
  C:\Windows\System\OXbZlIP.exe
  2⤵
  PID:212
- C:\Windows\System\THQBBXG.exe
  C:\Windows\System\THQBBXG.exe
  2⤵
  PID:6176
- C:\Windows\System\ubDsaUr.exe
  C:\Windows\System\ubDsaUr.exe
  2⤵
  PID:6708
- C:\Windows\System\wWqRErW.exe
  C:\Windows\System\wWqRErW.exe
  2⤵
  PID:6248
- C:\Windows\System\IJXwFSP.exe
  C:\Windows\System\IJXwFSP.exe
  2⤵
  PID:952
- C:\Windows\System\gYaxeCZ.exe
  C:\Windows\System\gYaxeCZ.exe
  2⤵
  PID:6380
- C:\Windows\System\lbdEHsB.exe
  C:\Windows\System\lbdEHsB.exe
  2⤵
  PID:3476
- C:\Windows\System\gwJGKOF.exe
  C:\Windows\System\gwJGKOF.exe
  2⤵
  PID:6528
- C:\Windows\System\bBXlYTV.exe
  C:\Windows\System\bBXlYTV.exe
  2⤵
  PID:6604
- C:\Windows\System\TdVgGDN.exe
  C:\Windows\System\TdVgGDN.exe
  2⤵
  PID:6880
- C:\Windows\System\bZMMsJo.exe
  C:\Windows\System\bZMMsJo.exe
  2⤵
  PID:6196
- C:\Windows\System\sWSKJvy.exe
  C:\Windows\System\sWSKJvy.exe
  2⤵
  PID:6288
- C:\Windows\System\IgxklaQ.exe
  C:\Windows\System\IgxklaQ.exe
  2⤵
  PID:6740
- C:\Windows\System\nGbmhOr.exe
  C:\Windows\System\nGbmhOr.exe
  2⤵
  PID:7172
- C:\Windows\System\IpjUDGS.exe
  C:\Windows\System\IpjUDGS.exe
  2⤵
  PID:7200
- C:\Windows\System\slLgjJP.exe
  C:\Windows\System\slLgjJP.exe
  2⤵
  PID:7228
- C:\Windows\System\XKEBOtr.exe
  C:\Windows\System\XKEBOtr.exe
  2⤵
  PID:7252
- C:\Windows\System\UQhfQyy.exe
  C:\Windows\System\UQhfQyy.exe
  2⤵
  PID:7280
- C:\Windows\System\gJvzewh.exe
  C:\Windows\System\gJvzewh.exe
  2⤵
  PID:7296
- C:\Windows\System\TQjejHi.exe
  C:\Windows\System\TQjejHi.exe
  2⤵
  PID:7528
- C:\Windows\System\fzpFsNI.exe
  C:\Windows\System\fzpFsNI.exe
  2⤵
  PID:7548
- C:\Windows\System\IhMEJsz.exe
  C:\Windows\System\IhMEJsz.exe
  2⤵
  PID:7568
- C:\Windows\System\CycyzfN.exe
  C:\Windows\System\CycyzfN.exe
  2⤵
  PID:7588
- C:\Windows\System\ZtHUigb.exe
  C:\Windows\System\ZtHUigb.exe
  2⤵
  PID:7604
- C:\Windows\System\WmXeMbh.exe
  C:\Windows\System\WmXeMbh.exe
  2⤵
  PID:7624
- C:\Windows\System\TkmINmf.exe
  C:\Windows\System\TkmINmf.exe
  2⤵
  PID:7852
- C:\Windows\System\mMBvEGf.exe
  C:\Windows\System\mMBvEGf.exe
  2⤵
  PID:7880
- C:\Windows\System\ihjDitx.exe
  C:\Windows\System\ihjDitx.exe
  2⤵
  PID:7908
- C:\Windows\System\hfGjvMB.exe
  C:\Windows\System\hfGjvMB.exe
  2⤵
  PID:7924
- C:\Windows\System\JncRYLi.exe
  C:\Windows\System\JncRYLi.exe
  2⤵
  PID:7956
- C:\Windows\System\ibUcegZ.exe
  C:\Windows\System\ibUcegZ.exe
  2⤵
  PID:7980
- C:\Windows\System\ehHDsBW.exe
  C:\Windows\System\ehHDsBW.exe
  2⤵
  PID:8008
- C:\Windows\System\pRiMEPA.exe
  C:\Windows\System\pRiMEPA.exe
  2⤵
  PID:8024
- C:\Windows\System\eplgxMa.exe
  C:\Windows\System\eplgxMa.exe
  2⤵
  PID:8056
- C:\Windows\System\rwwyDMW.exe
  C:\Windows\System\rwwyDMW.exe
  2⤵
  PID:8088
- C:\Windows\System\RuhEImj.exe
  C:\Windows\System\RuhEImj.exe
  2⤵
  PID:8108
- C:\Windows\System\sjYDTrt.exe
  C:\Windows\System\sjYDTrt.exe
  2⤵
  PID:8140
- C:\Windows\System\ZZrJPJo.exe
  C:\Windows\System\ZZrJPJo.exe
  2⤵
  PID:8164
- C:\Windows\System\InwpgVV.exe
  C:\Windows\System\InwpgVV.exe
  2⤵
  PID:8184
- C:\Windows\System\hCgipJg.exe
  C:\Windows\System\hCgipJg.exe
  2⤵
  PID:6480
- C:\Windows\System\qMmBsnV.exe
  C:\Windows\System\qMmBsnV.exe
  2⤵
  PID:6560
- C:\Windows\System\KJzSmvv.exe
  C:\Windows\System\KJzSmvv.exe
  2⤵
  PID:6800
- C:\Windows\System\qTGCflh.exe
  C:\Windows\System\qTGCflh.exe
  2⤵
  PID:6920
- C:\Windows\System\oTQCZIQ.exe
  C:\Windows\System\oTQCZIQ.exe
  2⤵
  PID:5128
- C:\Windows\System\FRvEzYr.exe
  C:\Windows\System\FRvEzYr.exe
  2⤵
  PID:5416
- C:\Windows\System\HnNTUzj.exe
  C:\Windows\System\HnNTUzj.exe
  2⤵
  PID:6852
- C:\Windows\System\pQGocmc.exe
  C:\Windows\System\pQGocmc.exe
  2⤵
  PID:7060
- C:\Windows\System\XKyQSJv.exe
  C:\Windows\System\XKyQSJv.exe
  2⤵
  PID:7180
- C:\Windows\System\iSGbnKU.exe
  C:\Windows\System\iSGbnKU.exe
  2⤵
  PID:6896
- C:\Windows\System\vmaAKsS.exe
  C:\Windows\System\vmaAKsS.exe
  2⤵
  PID:7320
- C:\Windows\System\aTJiCCG.exe
  C:\Windows\System\aTJiCCG.exe
  2⤵
  PID:7340
- C:\Windows\System\kLespnI.exe
  C:\Windows\System\kLespnI.exe
  2⤵
  PID:7360
- C:\Windows\System\aqfpLUk.exe
  C:\Windows\System\aqfpLUk.exe
  2⤵
  PID:7384
- C:\Windows\System\ZxsLoHF.exe
  C:\Windows\System\ZxsLoHF.exe
  2⤵
  PID:7412
- C:\Windows\System\fsbbJjI.exe
  C:\Windows\System\fsbbJjI.exe
  2⤵
  PID:7440
- C:\Windows\System\YRCPULA.exe
  C:\Windows\System\YRCPULA.exe
  2⤵
  PID:7464
- C:\Windows\System\vXNhQig.exe
  C:\Windows\System\vXNhQig.exe
  2⤵
  PID:7500
- C:\Windows\System\fQSHxXb.exe
  C:\Windows\System\fQSHxXb.exe
  2⤵
  PID:6996
- C:\Windows\System\utiVWXU.exe
  C:\Windows\System\utiVWXU.exe
  2⤵
  PID:7620
- C:\Windows\System\zVGnFSp.exe
  C:\Windows\System\zVGnFSp.exe
  2⤵
  PID:7716
- C:\Windows\System\tYCjqzO.exe
  C:\Windows\System\tYCjqzO.exe
  2⤵
  PID:1672
- C:\Windows\System\doQKFdU.exe
  C:\Windows\System\doQKFdU.exe
  2⤵
  PID:6024
- C:\Windows\System\VRpaeRp.exe
  C:\Windows\System\VRpaeRp.exe
  2⤵
  PID:2568
- C:\Windows\System\ZVlmKNR.exe
  C:\Windows\System\ZVlmKNR.exe
  2⤵
  PID:884
- C:\Windows\System\JjWOcLb.exe
  C:\Windows\System\JjWOcLb.exe
  2⤵
  PID:6552
- C:\Windows\System\lOHWsuS.exe
  C:\Windows\System\lOHWsuS.exe
  2⤵
  PID:6080
- C:\Windows\System\gccdBvp.exe
  C:\Windows\System\gccdBvp.exe
  2⤵
  PID:7424
- C:\Windows\System\LGqBFjX.exe
  C:\Windows\System\LGqBFjX.exe
  2⤵
  PID:7536
- C:\Windows\System\nRwdXFP.exe
  C:\Windows\System\nRwdXFP.exe
  2⤵
  PID:7844
- C:\Windows\System\mLofjcI.exe
  C:\Windows\System\mLofjcI.exe
  2⤵
  PID:7920
- C:\Windows\System\TNElOrX.exe
  C:\Windows\System\TNElOrX.exe
  2⤵
  PID:7988
- C:\Windows\System\jSlZkhm.exe
  C:\Windows\System\jSlZkhm.exe
  2⤵
  PID:7748
- C:\Windows\System\WMgFyuc.exe
  C:\Windows\System\WMgFyuc.exe
  2⤵
  PID:7184
- C:\Windows\System\eAoqFYl.exe
  C:\Windows\System\eAoqFYl.exe
  2⤵
  PID:6556
- C:\Windows\System\GwmvHGR.exe
  C:\Windows\System\GwmvHGR.exe
  2⤵
  PID:8960
- C:\Windows\System\eyhTcKS.exe
  C:\Windows\System\eyhTcKS.exe
  2⤵
  PID:8992
- C:\Windows\System\FqdFAYH.exe
  C:\Windows\System\FqdFAYH.exe
  2⤵
  PID:9016
- C:\Windows\System\GzfkNev.exe
  C:\Windows\System\GzfkNev.exe
  2⤵
  PID:9036
- C:\Windows\System\cEUuvqt.exe
  C:\Windows\System\cEUuvqt.exe
  2⤵
  PID:9072
- C:\Windows\System\gVkcozO.exe
  C:\Windows\System\gVkcozO.exe
  2⤵
  PID:9096
- C:\Windows\System\XGkjCry.exe
  C:\Windows\System\XGkjCry.exe
  2⤵
  PID:9116
- C:\Windows\System\IEOCWFZ.exe
  C:\Windows\System\IEOCWFZ.exe
  2⤵
  PID:9136
- C:\Windows\System\saCbbEK.exe
  C:\Windows\System\saCbbEK.exe
  2⤵
  PID:9152
- C:\Windows\System\wFagnIr.exe
  C:\Windows\System\wFagnIr.exe
  2⤵
  PID:9172
- C:\Windows\System\UzKSSit.exe
  C:\Windows\System\UzKSSit.exe
  2⤵
  PID:9196
- C:\Windows\System\kramhXi.exe
  C:\Windows\System\kramhXi.exe
  2⤵
  PID:6812
- C:\Windows\System\SaLUYpf.exe
  C:\Windows\System\SaLUYpf.exe
  2⤵
  PID:7056
- C:\Windows\System\WWdiSQc.exe
  C:\Windows\System\WWdiSQc.exe
  2⤵
  PID:7112
- C:\Windows\System\nODIcec.exe
  C:\Windows\System\nODIcec.exe
  2⤵
  PID:7404
- C:\Windows\System\nXbiZyW.exe
  C:\Windows\System\nXbiZyW.exe
  2⤵
  PID:7564
- C:\Windows\System\esFFsDK.exe
  C:\Windows\System\esFFsDK.exe
  2⤵
  PID:7196
- C:\Windows\System\coKLtsK.exe
  C:\Windows\System\coKLtsK.exe
  2⤵
  PID:6360
- C:\Windows\System\GCLxqut.exe
  C:\Windows\System\GCLxqut.exe
  2⤵
  PID:8044
- C:\Windows\System\mbCmGBh.exe
  C:\Windows\System\mbCmGBh.exe
  2⤵
  PID:7724
- C:\Windows\System\EWHfXwz.exe
  C:\Windows\System\EWHfXwz.exe
  2⤵
  PID:8096
- C:\Windows\System\tKPHYKJ.exe
  C:\Windows\System\tKPHYKJ.exe
  2⤵
  PID:6428
- C:\Windows\System\owXUEqg.exe
  C:\Windows\System\owXUEqg.exe
  2⤵
  PID:8196
- C:\Windows\System\jtFKvCD.exe
  C:\Windows\System\jtFKvCD.exe
  2⤵
  PID:6116
- C:\Windows\System\zdkvNEp.exe
  C:\Windows\System\zdkvNEp.exe
  2⤵
  PID:7864
- C:\Windows\System\CqJiYAW.exe
  C:\Windows\System\CqJiYAW.exe
  2⤵
  PID:8456
- C:\Windows\System\OhTWGJI.exe
  C:\Windows\System\OhTWGJI.exe
  2⤵
  PID:7328
- C:\Windows\System\eibBYKZ.exe
  C:\Windows\System\eibBYKZ.exe
  2⤵
  PID:7368
- C:\Windows\System\gehYLGt.exe
  C:\Windows\System\gehYLGt.exe
  2⤵
  PID:8288
- C:\Windows\System\GQfmFKG.exe
  C:\Windows\System\GQfmFKG.exe
  2⤵
  PID:7476
- C:\Windows\System\fwwqZUG.exe
  C:\Windows\System\fwwqZUG.exe
  2⤵
  PID:3184
- C:\Windows\System\dTcvusj.exe
  C:\Windows\System\dTcvusj.exe
  2⤵
  PID:8512
- C:\Windows\System\MXKEhYg.exe
  C:\Windows\System\MXKEhYg.exe
  2⤵
  PID:5756
- C:\Windows\System\TOtLWLU.exe
  C:\Windows\System\TOtLWLU.exe
  2⤵
  PID:7824
- C:\Windows\System\LHKFhjP.exe
  C:\Windows\System\LHKFhjP.exe
  2⤵
  PID:7664
- C:\Windows\System\vcAdGdc.exe
  C:\Windows\System\vcAdGdc.exe
  2⤵
  PID:8588
- C:\Windows\System\RylOwLC.exe
  C:\Windows\System\RylOwLC.exe
  2⤵
  PID:8600
- C:\Windows\System\zAQijHw.exe
  C:\Windows\System\zAQijHw.exe
  2⤵
  PID:8248
- C:\Windows\System\KJmMBgH.exe
  C:\Windows\System\KJmMBgH.exe
  2⤵
  PID:8680
- C:\Windows\System\arVJzOE.exe
  C:\Windows\System\arVJzOE.exe
  2⤵
  PID:8696
- C:\Windows\System\fPpTlDg.exe
  C:\Windows\System\fPpTlDg.exe
  2⤵
  PID:8440
- C:\Windows\System\UlWHAiv.exe
  C:\Windows\System\UlWHAiv.exe
  2⤵
  PID:8820
- C:\Windows\System\yFyBllb.exe
  C:\Windows\System\yFyBllb.exe
  2⤵
  PID:8736
- C:\Windows\System\hVQYtWv.exe
  C:\Windows\System\hVQYtWv.exe
  2⤵
  PID:8632
- C:\Windows\System\dwSrqjk.exe
  C:\Windows\System\dwSrqjk.exe
  2⤵
  PID:9028
- C:\Windows\System\CzweyoZ.exe
  C:\Windows\System\CzweyoZ.exe
  2⤵
  PID:9068
- C:\Windows\System\zsOZonR.exe
  C:\Windows\System\zsOZonR.exe
  2⤵
  PID:8932
- C:\Windows\System\wSuFXTq.exe
  C:\Windows\System\wSuFXTq.exe
  2⤵
  PID:8976
- C:\Windows\System\topqevh.exe
  C:\Windows\System\topqevh.exe
  2⤵
  PID:9168
- C:\Windows\System\RusbiBt.exe
  C:\Windows\System\RusbiBt.exe
  2⤵
  PID:1876
- C:\Windows\System\bDyGbZj.exe
  C:\Windows\System\bDyGbZj.exe
  2⤵
  PID:9104
- C:\Windows\System\zUSoBht.exe
  C:\Windows\System\zUSoBht.exe
  2⤵
  PID:9148
- C:\Windows\System\fPHENBG.exe
  C:\Windows\System\fPHENBG.exe
  2⤵
  PID:6652
- C:\Windows\System\LEXJiSL.exe
  C:\Windows\System\LEXJiSL.exe
  2⤵
  PID:7776
- C:\Windows\System\sQmqFXr.exe
  C:\Windows\System\sQmqFXr.exe
  2⤵
  PID:7940
- C:\Windows\System\YbTOiWG.exe
  C:\Windows\System\YbTOiWG.exe
  2⤵
  PID:7316
- C:\Windows\System\AuErgwt.exe
  C:\Windows\System\AuErgwt.exe
  2⤵
  PID:7420
- C:\Windows\System\nLEcVAg.exe
  C:\Windows\System\nLEcVAg.exe
  2⤵
  PID:7040
- C:\Windows\System\slELLWk.exe
  C:\Windows\System\slELLWk.exe
  2⤵
  PID:7312
- C:\Windows\System\umeuVnA.exe
  C:\Windows\System\umeuVnA.exe
  2⤵
  PID:8224
- C:\Windows\System\BpBJDOM.exe
  C:\Windows\System\BpBJDOM.exe
  2⤵
  PID:7472
- C:\Windows\System\VJXBLaV.exe
  C:\Windows\System\VJXBLaV.exe
  2⤵
  PID:8468
- C:\Windows\System\mdLkyyP.exe
  C:\Windows\System\mdLkyyP.exe
  2⤵
  PID:7600
- C:\Windows\System\CckSKFF.exe
  C:\Windows\System\CckSKFF.exe
  2⤵
  PID:9024
- C:\Windows\System\QSpEGQK.exe
  C:\Windows\System\QSpEGQK.exe
  2⤵
  PID:8908
- C:\Windows\System\qgBATQV.exe
  C:\Windows\System\qgBATQV.exe
  2⤵
  PID:9220
- C:\Windows\System\kskncdf.exe
  C:\Windows\System\kskncdf.exe
  2⤵
  PID:9240
- C:\Windows\System\nwyneJJ.exe
  C:\Windows\System\nwyneJJ.exe
  2⤵
  PID:9264
- C:\Windows\System\hpOjNLc.exe
  C:\Windows\System\hpOjNLc.exe
  2⤵
  PID:9288
- C:\Windows\System\HSYoBcS.exe
  C:\Windows\System\HSYoBcS.exe
  2⤵
  PID:9312
- C:\Windows\System\rJDsRRg.exe
  C:\Windows\System\rJDsRRg.exe
  2⤵
  PID:9332
- C:\Windows\System\kyKoyRp.exe
  C:\Windows\System\kyKoyRp.exe
  2⤵
  PID:9352
- C:\Windows\System\WbKolmN.exe
  C:\Windows\System\WbKolmN.exe
  2⤵
  PID:9376
- C:\Windows\System\KQvuuYH.exe
  C:\Windows\System\KQvuuYH.exe
  2⤵
  PID:9400
- C:\Windows\System\cLmNJCD.exe
  C:\Windows\System\cLmNJCD.exe
  2⤵
  PID:9420
- C:\Windows\System\EaQlOxP.exe
  C:\Windows\System\EaQlOxP.exe
  2⤵
  PID:9440
- C:\Windows\System\ifweBEM.exe
  C:\Windows\System\ifweBEM.exe
  2⤵
  PID:9464
- C:\Windows\System\akDaOLb.exe
  C:\Windows\System\akDaOLb.exe
  2⤵
  PID:9492
- C:\Windows\System\BBVgjGP.exe
  C:\Windows\System\BBVgjGP.exe
  2⤵
  PID:9516
- C:\Windows\System\MMKrMCw.exe
  C:\Windows\System\MMKrMCw.exe
  2⤵
  PID:9532
- C:\Windows\System\gcVQIuu.exe
  C:\Windows\System\gcVQIuu.exe
  2⤵
  PID:9556
- C:\Windows\System\HJDinIf.exe
  C:\Windows\System\HJDinIf.exe
  2⤵
  PID:9576
- C:\Windows\System\kBPIeaj.exe
  C:\Windows\System\kBPIeaj.exe
  2⤵
  PID:9600
- C:\Windows\System\krQddxv.exe
  C:\Windows\System\krQddxv.exe
  2⤵
  PID:9628
- C:\Windows\System\iwopToU.exe
  C:\Windows\System\iwopToU.exe
  2⤵
  PID:9648
- C:\Windows\System\CTrEAlm.exe
  C:\Windows\System\CTrEAlm.exe
  2⤵
  PID:9668
- C:\Windows\System\gpaALpQ.exe
  C:\Windows\System\gpaALpQ.exe
  2⤵
  PID:9692
- C:\Windows\System\sfNkcwF.exe
  C:\Windows\System\sfNkcwF.exe
  2⤵
  PID:9716
- C:\Windows\System\hjBODCx.exe
  C:\Windows\System\hjBODCx.exe
  2⤵
  PID:9740
- C:\Windows\System\ohInITs.exe
  C:\Windows\System\ohInITs.exe
  2⤵
  PID:9764
- C:\Windows\System\jAtXahE.exe
  C:\Windows\System\jAtXahE.exe
  2⤵
  PID:9788
- C:\Windows\System\SnPLGwg.exe
  C:\Windows\System\SnPLGwg.exe
  2⤵
  PID:9808
- C:\Windows\System\JTzJAWY.exe
  C:\Windows\System\JTzJAWY.exe
  2⤵
  PID:9832
- C:\Windows\System\pXSGeku.exe
  C:\Windows\System\pXSGeku.exe
  2⤵
  PID:9856
- C:\Windows\System\Bewzcuv.exe
  C:\Windows\System\Bewzcuv.exe
  2⤵
  PID:9880
- C:\Windows\System\yTHPBtv.exe
  C:\Windows\System\yTHPBtv.exe
  2⤵
  PID:9896
- C:\Windows\System\VkGvUWU.exe
  C:\Windows\System\VkGvUWU.exe
  2⤵
  PID:9916
- C:\Windows\System\bQomatn.exe
  C:\Windows\System\bQomatn.exe
  2⤵
  PID:9932
- C:\Windows\System\rJFAfds.exe
  C:\Windows\System\rJFAfds.exe
  2⤵
  PID:9948
- C:\Windows\System\RFfhttn.exe
  C:\Windows\System\RFfhttn.exe
  2⤵
  PID:9968
- C:\Windows\System\HmaCEoZ.exe
  C:\Windows\System\HmaCEoZ.exe
  2⤵
  PID:9984
- C:\Windows\System\NfyFhLk.exe
  C:\Windows\System\NfyFhLk.exe
  2⤵
  PID:10000
- C:\Windows\System\KqjVpOd.exe
  C:\Windows\System\KqjVpOd.exe
  2⤵
  PID:10016
- C:\Windows\System\FedYvPp.exe
  C:\Windows\System\FedYvPp.exe
  2⤵
  PID:10032
- C:\Windows\System\KscUZWk.exe
  C:\Windows\System\KscUZWk.exe
  2⤵
  PID:10048
- C:\Windows\System\EyQyWQJ.exe
  C:\Windows\System\EyQyWQJ.exe
  2⤵
  PID:10072
- C:\Windows\System\RDIWYko.exe
  C:\Windows\System\RDIWYko.exe
  2⤵
  PID:10100
- C:\Windows\System\cSPOmbi.exe
  C:\Windows\System\cSPOmbi.exe
  2⤵
  PID:10120
- C:\Windows\System\MvcSRIP.exe
  C:\Windows\System\MvcSRIP.exe
  2⤵
  PID:10148
- C:\Windows\System\bRZGZkx.exe
  C:\Windows\System\bRZGZkx.exe
  2⤵
  PID:10168
- C:\Windows\System\TExjuFS.exe
  C:\Windows\System\TExjuFS.exe
  2⤵
  PID:10196
- C:\Windows\System\BmXKHHM.exe
  C:\Windows\System\BmXKHHM.exe
  2⤵
  PID:10216
- C:\Windows\System\ruXUexs.exe
  C:\Windows\System\ruXUexs.exe
  2⤵
  PID:9188
- C:\Windows\System\kizVFcG.exe
  C:\Windows\System\kizVFcG.exe
  2⤵
  PID:7332
- C:\Windows\System\jOKxRmS.exe
  C:\Windows\System\jOKxRmS.exe
  2⤵
  PID:8676
- C:\Windows\System\vkcIiqL.exe
  C:\Windows\System\vkcIiqL.exe
  2⤵
  PID:8516
- C:\Windows\System\dUOGqxE.exe
  C:\Windows\System\dUOGqxE.exe
  2⤵
  PID:9236
- C:\Windows\System\oTZkfcr.exe
  C:\Windows\System\oTZkfcr.exe
  2⤵
  PID:9296
- C:\Windows\System\EoXFhaK.exe
  C:\Windows\System\EoXFhaK.exe
  2⤵
  PID:9348
- C:\Windows\System\PaxRSOR.exe
  C:\Windows\System\PaxRSOR.exe
  2⤵
  PID:9412
- C:\Windows\System\kIhKISi.exe
  C:\Windows\System\kIhKISi.exe
  2⤵
  PID:9432
- C:\Windows\System\rPHfIVM.exe
  C:\Windows\System\rPHfIVM.exe
  2⤵
  PID:9544
- C:\Windows\System\zmVqfmA.exe
  C:\Windows\System\zmVqfmA.exe
  2⤵
  PID:9616
- C:\Windows\System\ihkWTde.exe
  C:\Windows\System\ihkWTde.exe
  2⤵
  PID:9732
- C:\Windows\System\ULgcsUR.exe
  C:\Windows\System\ULgcsUR.exe
  2⤵
  PID:9756
- C:\Windows\System\JDeqSKS.exe
  C:\Windows\System\JDeqSKS.exe
  2⤵
  PID:10244
- C:\Windows\System\qADvoBm.exe
  C:\Windows\System\qADvoBm.exe
  2⤵
  PID:10268
- C:\Windows\System\TbRmKqM.exe
  C:\Windows\System\TbRmKqM.exe
  2⤵
  PID:10288
- C:\Windows\System\MtOitpB.exe
  C:\Windows\System\MtOitpB.exe
  2⤵
  PID:10312
- C:\Windows\System\ixDHzCB.exe
  C:\Windows\System\ixDHzCB.exe
  2⤵
  PID:10336
- C:\Windows\System\BKPScDW.exe
  C:\Windows\System\BKPScDW.exe
  2⤵
  PID:10360
- C:\Windows\System\iCgEXmt.exe
  C:\Windows\System\iCgEXmt.exe
  2⤵
  PID:10376
- C:\Windows\System\qByXOQS.exe
  C:\Windows\System\qByXOQS.exe
  2⤵
  PID:10396
- C:\Windows\System\EDPSvnF.exe
  C:\Windows\System\EDPSvnF.exe
  2⤵
  PID:10412
- C:\Windows\System\gJmwrDe.exe
  C:\Windows\System\gJmwrDe.exe
  2⤵
  PID:10432
- C:\Windows\System\WjPdptE.exe
  C:\Windows\System\WjPdptE.exe
  2⤵
  PID:10452
- C:\Windows\System\rAlXbDW.exe
  C:\Windows\System\rAlXbDW.exe
  2⤵
  PID:10476
- C:\Windows\System\QqquPFM.exe
  C:\Windows\System\QqquPFM.exe
  2⤵
  PID:10500
- C:\Windows\System\GIigAAy.exe
  C:\Windows\System\GIigAAy.exe
  2⤵
  PID:10520
- C:\Windows\System\JdFywpJ.exe
  C:\Windows\System\JdFywpJ.exe
  2⤵
  PID:10540
- C:\Windows\System\bvSPQvF.exe
  C:\Windows\System\bvSPQvF.exe
  2⤵
  PID:10560
- C:\Windows\System\gGcWYPj.exe
  C:\Windows\System\gGcWYPj.exe
  2⤵
  PID:10584
- C:\Windows\System\HdJFAlC.exe
  C:\Windows\System\HdJFAlC.exe
  2⤵
  PID:10604
- C:\Windows\System\ycSMuSC.exe
  C:\Windows\System\ycSMuSC.exe
  2⤵
  PID:10620
- C:\Windows\System\ZBxENvg.exe
  C:\Windows\System\ZBxENvg.exe
  2⤵
  PID:10644
- C:\Windows\System\qfFkjHr.exe
  C:\Windows\System\qfFkjHr.exe
  2⤵
  PID:10664
- C:\Windows\System\iBPpygL.exe
  C:\Windows\System\iBPpygL.exe
  2⤵
  PID:10684
- C:\Windows\System\mIOFgQZ.exe
  C:\Windows\System\mIOFgQZ.exe
  2⤵
  PID:10708
- C:\Windows\System\scyahIZ.exe
  C:\Windows\System\scyahIZ.exe
  2⤵
  PID:10732
- C:\Windows\System\CkzVBuJ.exe
  C:\Windows\System\CkzVBuJ.exe
  2⤵
  PID:10756
- C:\Windows\System\YsmfYdL.exe
  C:\Windows\System\YsmfYdL.exe
  2⤵
  PID:10780
- C:\Windows\System\FrIBIFi.exe
  C:\Windows\System\FrIBIFi.exe
  2⤵
  PID:10800
- C:\Windows\System\llpythP.exe
  C:\Windows\System\llpythP.exe
  2⤵
  PID:10828
- C:\Windows\System\vGIkKSX.exe
  C:\Windows\System\vGIkKSX.exe
  2⤵
  PID:10848
- C:\Windows\System\WObcaUO.exe
  C:\Windows\System\WObcaUO.exe
  2⤵
  PID:10872
- C:\Windows\System\hAmKhRt.exe
  C:\Windows\System\hAmKhRt.exe
  2⤵
  PID:10888
- C:\Windows\System\fSqufzT.exe
  C:\Windows\System\fSqufzT.exe
  2⤵
  PID:10908
- C:\Windows\System\byQgrwc.exe
  C:\Windows\System\byQgrwc.exe
  2⤵
  PID:10932
- C:\Windows\System\gqJnuEn.exe
  C:\Windows\System\gqJnuEn.exe
  2⤵
  PID:10952
- C:\Windows\System\CtbCCWe.exe
  C:\Windows\System\CtbCCWe.exe
  2⤵
  PID:10972
- C:\Windows\System\hNCEseG.exe
  C:\Windows\System\hNCEseG.exe
  2⤵
  PID:10996
- C:\Windows\System\LTVpEUC.exe
  C:\Windows\System\LTVpEUC.exe
  2⤵
  PID:11016
- C:\Windows\System\yPcENUn.exe
  C:\Windows\System\yPcENUn.exe
  2⤵
  PID:11036
- C:\Windows\System\mCSiIXD.exe
  C:\Windows\System\mCSiIXD.exe
  2⤵
  PID:11056
- C:\Windows\System\ANBmStn.exe
  C:\Windows\System\ANBmStn.exe
  2⤵
  PID:11072
- C:\Windows\System\JmwFXQB.exe
  C:\Windows\System\JmwFXQB.exe
  2⤵
  PID:11088
- C:\Windows\System\MSpgApH.exe
  C:\Windows\System\MSpgApH.exe
  2⤵
  PID:11104
- C:\Windows\System\MoPrRZO.exe
  C:\Windows\System\MoPrRZO.exe
  2⤵
  PID:11120
- C:\Windows\System\NhzbGku.exe
  C:\Windows\System\NhzbGku.exe
  2⤵
  PID:11136
- C:\Windows\System\AEgAfzX.exe
  C:\Windows\System\AEgAfzX.exe
  2⤵
  PID:11156
- C:\Windows\System\jKOwkVO.exe
  C:\Windows\System\jKOwkVO.exe
  2⤵
  PID:11172
- C:\Windows\System\VTjdIGA.exe
  C:\Windows\System\VTjdIGA.exe
  2⤵
  PID:11188
- C:\Windows\System\UsTlopK.exe
  C:\Windows\System\UsTlopK.exe
  2⤵
  PID:11208
- C:\Windows\System\fyizZKi.exe
  C:\Windows\System\fyizZKi.exe
  2⤵
  PID:11232
- C:\Windows\System\fpGRCzm.exe
  C:\Windows\System\fpGRCzm.exe
  2⤵
  PID:11252
- C:\Windows\System\HhuKdLO.exe
  C:\Windows\System\HhuKdLO.exe
  2⤵
  PID:9924
- C:\Windows\System\LBAOftN.exe
  C:\Windows\System\LBAOftN.exe
  2⤵
  PID:9996
- C:\Windows\System\gkErmoF.exe
  C:\Windows\System\gkErmoF.exe
  2⤵
  PID:10056
- C:\Windows\System\aZxWIlC.exe
  C:\Windows\System\aZxWIlC.exe
  2⤵
  PID:10136
- C:\Windows\System\tNxUsmS.exe
  C:\Windows\System\tNxUsmS.exe
  2⤵
  PID:9448
- C:\Windows\System\oTXCaVJ.exe
  C:\Windows\System\oTXCaVJ.exe
  2⤵
  PID:9500
- C:\Windows\System\nuiQAIk.exe
  C:\Windows\System\nuiQAIk.exe
  2⤵
  PID:6508
- C:\Windows\System\kzWwYip.exe
  C:\Windows\System\kzWwYip.exe
  2⤵
  PID:9276
- C:\Windows\System\bzoAFuz.exe
  C:\Windows\System\bzoAFuz.exe
  2⤵
  PID:9748
- C:\Windows\System\ZSMqlLp.exe
  C:\Windows\System\ZSMqlLp.exe
  2⤵
  PID:8624
- C:\Windows\System\glsZRGY.exe
  C:\Windows\System\glsZRGY.exe
  2⤵
  PID:6940
- C:\Windows\System\mmEqDTU.exe
  C:\Windows\System\mmEqDTU.exe
  2⤵
  PID:9800
- C:\Windows\System\bQdnigS.exe
  C:\Windows\System\bQdnigS.exe
  2⤵
  PID:10296
- C:\Windows\System\YctCKvu.exe
  C:\Windows\System\YctCKvu.exe
  2⤵
  PID:10320
- C:\Windows\System\hCkAprE.exe
  C:\Windows\System\hCkAprE.exe
  2⤵
  PID:9956
- C:\Windows\System\rphEFpM.exe
  C:\Windows\System\rphEFpM.exe
  2⤵
  PID:9396
- C:\Windows\System\UIVcgzf.exe
  C:\Windows\System\UIVcgzf.exe
  2⤵
  PID:10204
- C:\Windows\System\DDwZaMO.exe
  C:\Windows\System\DDwZaMO.exe
  2⤵
  PID:8744
- C:\Windows\System\XLiRnxL.exe
  C:\Windows\System\XLiRnxL.exe
  2⤵
  PID:10260
- C:\Windows\System\KgtaVQB.exe
  C:\Windows\System\KgtaVQB.exe
  2⤵
  PID:11268
- C:\Windows\System\xXTBxFy.exe
  C:\Windows\System\xXTBxFy.exe
  2⤵
  PID:11292
- C:\Windows\System\MCjPVBc.exe
  C:\Windows\System\MCjPVBc.exe
  2⤵
  PID:11316
- C:\Windows\System\EMHsxMQ.exe
  C:\Windows\System\EMHsxMQ.exe
  2⤵
  PID:11340
- C:\Windows\System\mUAfnWY.exe
  C:\Windows\System\mUAfnWY.exe
  2⤵
  PID:11360
- C:\Windows\System\YdeSPpu.exe
  C:\Windows\System\YdeSPpu.exe
  2⤵
  PID:11384
- C:\Windows\System\DkXqOpY.exe
  C:\Windows\System\DkXqOpY.exe
  2⤵
  PID:11408
- C:\Windows\System\vJSJzKc.exe
  C:\Windows\System\vJSJzKc.exe
  2⤵
  PID:11432
- C:\Windows\System\LIepsAn.exe
  C:\Windows\System\LIepsAn.exe
  2⤵
  PID:11448
- C:\Windows\System\OhOPGwV.exe
  C:\Windows\System\OhOPGwV.exe
  2⤵
  PID:11464
- C:\Windows\System\VNmHhKi.exe
  C:\Windows\System\VNmHhKi.exe
  2⤵
  PID:11484
- C:\Windows\System\VrVQFmB.exe
  C:\Windows\System\VrVQFmB.exe
  2⤵
  PID:11504
- C:\Windows\System\WELYgFw.exe
  C:\Windows\System\WELYgFw.exe
  2⤵
  PID:11520
- C:\Windows\System\UBvrmWE.exe
  C:\Windows\System\UBvrmWE.exe
  2⤵
  PID:11540
- C:\Windows\System\JOYKmfn.exe
  C:\Windows\System\JOYKmfn.exe
  2⤵
  PID:11556
- C:\Windows\System\uQdZWHq.exe
  C:\Windows\System\uQdZWHq.exe
  2⤵
  PID:11572
- C:\Windows\System\CwOSfcQ.exe
  C:\Windows\System\CwOSfcQ.exe
  2⤵
  PID:11588
- C:\Windows\System\GcXlItu.exe
  C:\Windows\System\GcXlItu.exe
  2⤵
  PID:11616
- C:\Windows\System\AeqyWVW.exe
  C:\Windows\System\AeqyWVW.exe
  2⤵
  PID:11636
- C:\Windows\System\ktigzCt.exe
  C:\Windows\System\ktigzCt.exe
  2⤵
  PID:11656
- C:\Windows\System\llgkYES.exe
  C:\Windows\System\llgkYES.exe
  2⤵
  PID:11688
- C:\Windows\System\bhstGXO.exe
  C:\Windows\System\bhstGXO.exe
  2⤵
  PID:11712
- C:\Windows\System\szcagHr.exe
  C:\Windows\System\szcagHr.exe
  2⤵
  PID:11744
- C:\Windows\System\qZKHCAt.exe
  C:\Windows\System\qZKHCAt.exe
  2⤵
  PID:11768
- C:\Windows\System\ntVDrQe.exe
  C:\Windows\System\ntVDrQe.exe
  2⤵
  PID:11800
- C:\Windows\System\qpVBsPg.exe
  C:\Windows\System\qpVBsPg.exe
  2⤵
  PID:11820
- C:\Windows\System\FAMihIm.exe
  C:\Windows\System\FAMihIm.exe
  2⤵
  PID:11848
- C:\Windows\System\rlGXNqj.exe
  C:\Windows\System\rlGXNqj.exe
  2⤵
  PID:11872
- C:\Windows\System\PgUyXij.exe
  C:\Windows\System\PgUyXij.exe
  2⤵
  PID:11892
- C:\Windows\System\ExRIykc.exe
  C:\Windows\System\ExRIykc.exe
  2⤵
  PID:11932
- C:\Windows\System\zpdWVYu.exe
  C:\Windows\System\zpdWVYu.exe
  2⤵
  PID:11956
- C:\Windows\System\cALjEeF.exe
  C:\Windows\System\cALjEeF.exe
  2⤵
  PID:11980
- C:\Windows\System\gJislyk.exe
  C:\Windows\System\gJislyk.exe
  2⤵
  PID:12012
- C:\Windows\System\eYIoMft.exe
  C:\Windows\System\eYIoMft.exe
  2⤵
  PID:12036
- C:\Windows\System\HRxJHCV.exe
  C:\Windows\System\HRxJHCV.exe
  2⤵
  PID:12056
- C:\Windows\System\UlRvOMn.exe
  C:\Windows\System\UlRvOMn.exe
  2⤵
  PID:12076
- C:\Windows\System\msqburJ.exe
  C:\Windows\System\msqburJ.exe
  2⤵
  PID:12100
- C:\Windows\System\sTvJuHa.exe
  C:\Windows\System\sTvJuHa.exe
  2⤵
  PID:12132
- C:\Windows\System\SeOvwDZ.exe
  C:\Windows\System\SeOvwDZ.exe
  2⤵
  PID:12160
- C:\Windows\System\CQNJiit.exe
  C:\Windows\System\CQNJiit.exe
  2⤵
  PID:12180
- C:\Windows\System\vQzHkIK.exe
  C:\Windows\System\vQzHkIK.exe
  2⤵
  PID:12204
- C:\Windows\System\JdBlmTu.exe
  C:\Windows\System\JdBlmTu.exe
  2⤵
  PID:12236
- C:\Windows\System\MvbaUKM.exe
  C:\Windows\System\MvbaUKM.exe
  2⤵
  PID:12260
- C:\Windows\System\xMrllas.exe
  C:\Windows\System\xMrllas.exe
  2⤵
  PID:11064
- C:\Windows\System\JZIaFNW.exe
  C:\Windows\System\JZIaFNW.exe
  2⤵
  PID:9504
- C:\Windows\System\eNeRjgk.exe
  C:\Windows\System\eNeRjgk.exe
  2⤵
  PID:10492
- C:\Windows\System\mEBWtAT.exe
  C:\Windows\System\mEBWtAT.exe
  2⤵
  PID:10532
- C:\Windows\System\kMvzvYd.exe
  C:\Windows\System\kMvzvYd.exe
  2⤵
  PID:10580
- C:\Windows\System\rBhsYXc.exe
  C:\Windows\System\rBhsYXc.exe
  2⤵
  PID:9644
- C:\Windows\System\HteRWIs.exe
  C:\Windows\System\HteRWIs.exe
  2⤵
  PID:9708
- C:\Windows\System\zMeuAiC.exe
  C:\Windows\System\zMeuAiC.exe
  2⤵
  PID:9664
- C:\Windows\System\tNXyODD.exe
  C:\Windows\System\tNXyODD.exe
  2⤵
  PID:10324
- C:\Windows\System\RnLJppg.exe
  C:\Windows\System\RnLJppg.exe
  2⤵
  PID:10796
- C:\Windows\System\rahOKOe.exe
  C:\Windows\System\rahOKOe.exe
  2⤵
  PID:10856
- C:\Windows\System\qowvDGa.exe
  C:\Windows\System\qowvDGa.exe
  2⤵
  PID:10916
- C:\Windows\System\ttamdWc.exe
  C:\Windows\System\ttamdWc.exe
  2⤵
  PID:10964
- C:\Windows\System\XnAwVbD.exe
  C:\Windows\System\XnAwVbD.exe
  2⤵
  PID:11004
- C:\Windows\System\EXyNeGb.exe
  C:\Windows\System\EXyNeGb.exe
  2⤵
  PID:3436
- C:\Windows\System\cafoEuf.exe
  C:\Windows\System\cafoEuf.exe
  2⤵
  PID:10328
- C:\Windows\System\vZuUOWo.exe
  C:\Windows\System\vZuUOWo.exe
  2⤵
  PID:11308
- C:\Windows\System\IcxFFte.exe
  C:\Windows\System\IcxFFte.exe
  2⤵
  PID:11380
- C:\Windows\System\GMNShUm.exe
  C:\Windows\System\GMNShUm.exe
  2⤵
  PID:11472
- C:\Windows\System\dCVJyRJ.exe
  C:\Windows\System\dCVJyRJ.exe
  2⤵
  PID:12296
- C:\Windows\System\MjzrMgq.exe
  C:\Windows\System\MjzrMgq.exe
  2⤵
  PID:12320
- C:\Windows\System\FTDzvKr.exe
  C:\Windows\System\FTDzvKr.exe
  2⤵
  PID:12336
- C:\Windows\System\GslsHDE.exe
  C:\Windows\System\GslsHDE.exe
  2⤵
  PID:12360
- C:\Windows\System\DyaNHTm.exe
  C:\Windows\System\DyaNHTm.exe
  2⤵
  PID:12388
- C:\Windows\System\OWaAVnC.exe
  C:\Windows\System\OWaAVnC.exe
  2⤵
  PID:12408
- C:\Windows\System\IxHtqlW.exe
  C:\Windows\System\IxHtqlW.exe
  2⤵
  PID:12424
- C:\Windows\System\KGSZHVZ.exe
  C:\Windows\System\KGSZHVZ.exe
  2⤵
  PID:12440
- C:\Windows\System\tOeXGyo.exe
  C:\Windows\System\tOeXGyo.exe
  2⤵
  PID:12460
- C:\Windows\System\fqUAxXf.exe
  C:\Windows\System\fqUAxXf.exe
  2⤵
  PID:12476
- C:\Windows\System\XxdCEzu.exe
  C:\Windows\System\XxdCEzu.exe
  2⤵
  PID:12496
- C:\Windows\System\NEzWVsH.exe
  C:\Windows\System\NEzWVsH.exe
  2⤵
  PID:12512
- C:\Windows\System\YxbehNC.exe
  C:\Windows\System\YxbehNC.exe
  2⤵
  PID:12532
- C:\Windows\System\ABCiAjc.exe
  C:\Windows\System\ABCiAjc.exe
  2⤵
  PID:12548
- C:\Windows\System\SNuOnxy.exe
  C:\Windows\System\SNuOnxy.exe
  2⤵
  PID:12564
- C:\Windows\System\TpTylnZ.exe
  C:\Windows\System\TpTylnZ.exe
  2⤵
  PID:12580
- C:\Windows\System\DzncYwA.exe
  C:\Windows\System\DzncYwA.exe
  2⤵
  PID:12604
- C:\Windows\System\yLCasLK.exe
  C:\Windows\System\yLCasLK.exe
  2⤵
  PID:12628
- C:\Windows\System\hAlNxee.exe
  C:\Windows\System\hAlNxee.exe
  2⤵
  PID:12652
- C:\Windows\System\IpIDtLs.exe
  C:\Windows\System\IpIDtLs.exe
  2⤵
  PID:12676
- C:\Windows\System\PWPyqRn.exe
  C:\Windows\System\PWPyqRn.exe
  2⤵
  PID:12696
- C:\Windows\System\lOVMtzj.exe
  C:\Windows\System\lOVMtzj.exe
  2⤵
  PID:12720
- C:\Windows\System\SEDhfEU.exe
  C:\Windows\System\SEDhfEU.exe
  2⤵
  PID:13220
- C:\Windows\System\qRiNfyK.exe
  C:\Windows\System\qRiNfyK.exe
  2⤵
  PID:13244
- C:\Windows\System\KRPsgDl.exe
  C:\Windows\System\KRPsgDl.exe
  2⤵
  PID:13268
- C:\Windows\System\auppJvC.exe
  C:\Windows\System\auppJvC.exe
  2⤵
  PID:13284
- C:\Windows\System\LMeLRTf.exe
  C:\Windows\System\LMeLRTf.exe
  2⤵
  PID:13304
- C:\Windows\System\OGnqYMM.exe
  C:\Windows\System\OGnqYMM.exe
  2⤵
  PID:11564
- C:\Windows\System\TTKdiFo.exe
  C:\Windows\System\TTKdiFo.exe
  2⤵
  PID:11624
- C:\Windows\System\iUPDEPk.exe
  C:\Windows\System\iUPDEPk.exe
  2⤵
  PID:11676
- C:\Windows\System\XFsouor.exe
  C:\Windows\System\XFsouor.exe
  2⤵
  PID:11148
- C:\Windows\System\mTBystz.exe
  C:\Windows\System\mTBystz.exe
  2⤵
  PID:11184
- C:\Windows\System\UCoYyov.exe
  C:\Windows\System\UCoYyov.exe
  2⤵
  PID:11808
- C:\Windows\System\WILkTdX.exe
  C:\Windows\System\WILkTdX.exe
  2⤵
  PID:11840
- C:\Windows\System\gQkWsSm.exe
  C:\Windows\System\gQkWsSm.exe
  2⤵
  PID:9260
- C:\Windows\System\AVhkRxI.exe
  C:\Windows\System\AVhkRxI.exe
  2⤵
  PID:8040
- C:\Windows\System\EZZOOKD.exe
  C:\Windows\System\EZZOOKD.exe
  2⤵
  PID:12000
- C:\Windows\System\jLZvefr.exe
  C:\Windows\System\jLZvefr.exe
  2⤵
  PID:10252
- C:\Windows\System\wJPtBOu.exe
  C:\Windows\System\wJPtBOu.exe
  2⤵
  PID:12524
- C:\Windows\System\udkzSzd.exe
  C:\Windows\System\udkzSzd.exe
  2⤵
  PID:12576
- C:\Windows\System\TXfFLLG.exe
  C:\Windows\System\TXfFLLG.exe
  2⤵
  PID:12636
- C:\Windows\System\NJNuVXy.exe
  C:\Windows\System\NJNuVXy.exe
  2⤵
  PID:11332
- C:\Windows\System\DzpPGeC.exe
  C:\Windows\System\DzpPGeC.exe
  2⤵
  PID:11392
- C:\Windows\System\AcjMPrS.exe
  C:\Windows\System\AcjMPrS.exe
  2⤵
  PID:3600
- C:\Windows\System\ZBGwFtt.exe
  C:\Windows\System\ZBGwFtt.exe
  2⤵
  PID:11580
- C:\Windows\System\pxmwMrr.exe
  C:\Windows\System\pxmwMrr.exe
  2⤵
  PID:4352
- C:\Windows\System\oWgShjy.exe
  C:\Windows\System\oWgShjy.exe
  2⤵
  PID:11784
- C:\Windows\System\exOVKoE.exe
  C:\Windows\System\exOVKoE.exe
  2⤵
  PID:11584
- C:\Windows\System\BYRErFQ.exe
  C:\Windows\System\BYRErFQ.exe
  2⤵
  PID:11456
- C:\Windows\System\QLaoUmS.exe
  C:\Windows\System\QLaoUmS.exe
  2⤵
  PID:10812
- C:\Windows\System\wYeGHAV.exe
  C:\Windows\System\wYeGHAV.exe
  2⤵
  PID:12468
- C:\Windows\System\SXjUZwq.exe
  C:\Windows\System\SXjUZwq.exe
  2⤵
  PID:11664
- C:\Windows\System\VczYnQZ.exe
  C:\Windows\System\VczYnQZ.exe
  2⤵
  PID:11100
- C:\Windows\System\JmwWlSg.exe
  C:\Windows\System\JmwWlSg.exe
  2⤵
  PID:11920
- C:\Windows\System\wuOkKRx.exe
  C:\Windows\System\wuOkKRx.exe
  2⤵
  PID:13208
- C:\Windows\System\bOLYpkV.exe
  C:\Windows\System\bOLYpkV.exe
  2⤵
  PID:13280
- C:\Windows\System\tSBfPKa.exe
  C:\Windows\System\tSBfPKa.exe
  2⤵
  PID:10084
- C:\Windows\System\TOhqWLj.exe
  C:\Windows\System\TOhqWLj.exe
  2⤵
  PID:4196
- C:\Windows\System\vnbGyaI.exe
  C:\Windows\System\vnbGyaI.exe
  2⤵
  PID:8968
- C:\Windows\System\HCtyLMN.exe
  C:\Windows\System\HCtyLMN.exe
  2⤵
  PID:12644
- C:\Windows\System\jYcLvJW.exe
  C:\Windows\System\jYcLvJW.exe
  2⤵
  PID:13252
- C:\Windows\System\ymCWail.exe
  C:\Windows\System\ymCWail.exe
  2⤵
  PID:12896
- C:\Windows\System\nsTsuOI.exe
  C:\Windows\System\nsTsuOI.exe
  2⤵
  PID:13180
- C:\Windows\System\QpeEzdN.exe
  C:\Windows\System\QpeEzdN.exe
  2⤵
  PID:11732
- C:\Windows\System\PBhmCXi.exe
  C:\Windows\System\PBhmCXi.exe
  2⤵
  PID:13292
- C:\Windows\System\PyKcQMu.exe
  C:\Windows\System\PyKcQMu.exe
  2⤵
  PID:9488
- C:\Windows\System\yoUnvGr.exe
  C:\Windows\System\yoUnvGr.exe
  2⤵
  PID:10792
- C:\Windows\System\HbohUaj.exe
  C:\Windows\System\HbohUaj.exe
  2⤵
  PID:11568
- C:\Windows\System\LYsyesL.exe
  C:\Windows\System\LYsyesL.exe
  2⤵
  PID:12380
- C:\Windows\System\bxKkuwn.exe
  C:\Windows\System\bxKkuwn.exe
  2⤵
  PID:12664
- C:\Windows\System\NVhlJDa.exe
  C:\Windows\System\NVhlJDa.exe
  2⤵
  PID:13012
- C:\Windows\System\TndyFDq.exe
  C:\Windows\System\TndyFDq.exe
  2⤵
  PID:11548
- C:\Windows\System\MgMRgnO.exe
  C:\Windows\System\MgMRgnO.exe
  2⤵
  PID:12824
- C:\Windows\System\ewyxsks.exe
  C:\Windows\System\ewyxsks.exe
  2⤵
  PID:12024
- C:\Windows\System\cwfJRnt.exe
  C:\Windows\System\cwfJRnt.exe
  2⤵
  PID:10116
- C:\Windows\System\FgTwtcl.exe
  C:\Windows\System\FgTwtcl.exe
  2⤵
  PID:12736
- C:\Windows\System\gMkmCTN.exe
  C:\Windows\System\gMkmCTN.exe
  2⤵
  PID:12112
- C:\Windows\System\hLvivWG.exe
  C:\Windows\System\hLvivWG.exe
  2⤵
  PID:4884
- C:\Windows\System\jBPYbCu.exe
  C:\Windows\System\jBPYbCu.exe
  2⤵
  PID:13260
- C:\Windows\System\FwViqFl.exe
  C:\Windows\System\FwViqFl.exe
  2⤵
  PID:12856
- C:\Windows\System\bcnebfT.exe
  C:\Windows\System\bcnebfT.exe
  2⤵
  PID:12352
- C:\Windows\System\bniWDWM.exe
  C:\Windows\System\bniWDWM.exe
  2⤵
  PID:12368
- C:\Windows\System\MYVGoos.exe
  C:\Windows\System\MYVGoos.exe
  2⤵
  PID:12280
- C:\Windows\System\DXHAtHh.exe
  C:\Windows\System\DXHAtHh.exe
  2⤵
  PID:2332
- C:\Windows\System\oYdLQvQ.exe
  C:\Windows\System\oYdLQvQ.exe
  2⤵
  PID:12864
- C:\Windows\System\HnQjnnj.exe
  C:\Windows\System\HnQjnnj.exe
  2⤵
  PID:9608
- C:\Windows\System\WmQwXiI.exe
  C:\Windows\System\WmQwXiI.exe
  2⤵
  PID:10420
- C:\Windows\System\ayohjXQ.exe
  C:\Windows\System\ayohjXQ.exe
  2⤵
  PID:10092
- C:\Windows\System\dSDdTaW.exe
  C:\Windows\System\dSDdTaW.exe
  2⤵
  PID:2716
- C:\Windows\System\VNSGSZl.exe
  C:\Windows\System\VNSGSZl.exe
  2⤵
  PID:64
- C:\Windows\System\eDDhdiM.exe
  C:\Windows\System\eDDhdiM.exe
  2⤵
  PID:10184
- C:\Windows\System\KcamJYp.exe
  C:\Windows\System\KcamJYp.exe
  2⤵
  PID:12196
- C:\Windows\System\lySigFG.exe
  C:\Windows\System\lySigFG.exe
  2⤵
  PID:9528
- C:\Windows\System\KXjSoVs.exe
  C:\Windows\System\KXjSoVs.exe
  2⤵
  PID:12716
- C:\Windows\System\coKbyWm.exe
  C:\Windows\System\coKbyWm.exe
  2⤵
  PID:11352
- C:\Windows\System\OKIlwzg.exe
  C:\Windows\System\OKIlwzg.exe
  2⤵
  PID:11860
- C:\Windows\System\OjJsnNJ.exe
  C:\Windows\System\OjJsnNJ.exe
  2⤵
  PID:11652
- C:\Windows\System\nIAXBSD.exe
  C:\Windows\System\nIAXBSD.exe
  2⤵
  PID:2172
- C:\Windows\System\dVEoWiY.exe
  C:\Windows\System\dVEoWiY.exe
  2⤵
  PID:1940
- C:\Windows\System\zUDFNVI.exe
  C:\Windows\System\zUDFNVI.exe
  2⤵
  PID:5108
- C:\Windows\System\gFcGgih.exe
  C:\Windows\System\gFcGgih.exe
  2⤵
  PID:1584
- C:\Windows\System\jFBVOLd.exe
  C:\Windows\System\jFBVOLd.exe
  2⤵
  PID:4968
- C:\Windows\System\mxoWZIl.exe
  C:\Windows\System\mxoWZIl.exe
  2⤵
  PID:10080
- C:\Windows\System\FrMmtUm.exe
  C:\Windows\System\FrMmtUm.exe
  2⤵
  PID:10368
- C:\Windows\System\AtgoZjh.exe
  C:\Windows\System\AtgoZjh.exe
  2⤵
  PID:9844
- C:\Windows\System\JOWFRbb.exe
  C:\Windows\System\JOWFRbb.exe
  2⤵
  PID:11552
- C:\Windows\System\rcxzDaK.exe
  C:\Windows\System\rcxzDaK.exe
  2⤵
  PID:13032
- C:\Windows\System\nPoBXWY.exe
  C:\Windows\System\nPoBXWY.exe
  2⤵
  PID:13296
- C:\Windows\System\ocYxSKH.exe
  C:\Windows\System\ocYxSKH.exe
  2⤵
  PID:13072
- C:\Windows\System\wPPuPOP.exe
  C:\Windows\System\wPPuPOP.exe
  2⤵
  PID:9360
- C:\Windows\System\EbsmaiQ.exe
  C:\Windows\System\EbsmaiQ.exe
  2⤵
  PID:1900
- C:\Windows\System\tDzcbCx.exe
  C:\Windows\System\tDzcbCx.exe
  2⤵
  PID:4560
- C:\Windows\System\SBrSsLd.exe
  C:\Windows\System\SBrSsLd.exe
  2⤵
  PID:5308
- C:\Windows\System\nEVYHsR.exe
  C:\Windows\System\nEVYHsR.exe
  2⤵
  PID:9892
- C:\Windows\System\DUhRnLb.exe
  C:\Windows\System\DUhRnLb.exe
  2⤵
  PID:9228
- C:\Windows\System\zEadcwT.exe
  C:\Windows\System\zEadcwT.exe
  2⤵
  PID:5324
- C:\Windows\System\QDeqPqz.exe
  C:\Windows\System\QDeqPqz.exe
  2⤵
  PID:2060
- C:\Windows\System\hsEzJQz.exe
  C:\Windows\System\hsEzJQz.exe
  2⤵
  PID:11276
- C:\Windows\System\EaXPQsv.exe
  C:\Windows\System\EaXPQsv.exe
  2⤵
  PID:4092
- C:\Windows\System\nPZuXsL.exe
  C:\Windows\System\nPZuXsL.exe
  2⤵
  PID:10680
- C:\Windows\System\oHnWtxs.exe
  C:\Windows\System\oHnWtxs.exe
  2⤵
  PID:5072
- C:\Windows\System\STgkAIv.exe
  C:\Windows\System\STgkAIv.exe
  2⤵
  PID:13320
- C:\Windows\System\bXtzFhK.exe
  C:\Windows\System\bXtzFhK.exe
  2⤵
  PID:13336
- C:\Windows\System\jcnibII.exe
  C:\Windows\System\jcnibII.exe
  2⤵
  PID:13352
- C:\Windows\System\CPXFliz.exe
  C:\Windows\System\CPXFliz.exe
  2⤵
  PID:13368
- C:\Windows\System\zrEZvbF.exe
  C:\Windows\System\zrEZvbF.exe
  2⤵
  PID:13384
- C:\Windows\System\TICONyS.exe
  C:\Windows\System\TICONyS.exe
  2⤵
  PID:13404
- C:\Windows\System\TIKqJpJ.exe
  C:\Windows\System\TIKqJpJ.exe
  2⤵
  PID:13420
- C:\Windows\System\RDVXaaa.exe
  C:\Windows\System\RDVXaaa.exe
  2⤵
  PID:13436
- C:\Windows\System\ztYmTtd.exe
  C:\Windows\System\ztYmTtd.exe
  2⤵
  PID:13452
- C:\Windows\System\ttsklEY.exe
  C:\Windows\System\ttsklEY.exe
  2⤵
  PID:13468
- C:\Windows\System\fTbPcuv.exe
  C:\Windows\System\fTbPcuv.exe
  2⤵
  PID:13484
- C:\Windows\System\dCSSGlG.exe
  C:\Windows\System\dCSSGlG.exe
  2⤵
  PID:13500
- C:\Windows\System\wXyigmD.exe
  C:\Windows\System\wXyigmD.exe
  2⤵
  PID:13516
- C:\Windows\System\VEsTRft.exe
  C:\Windows\System\VEsTRft.exe
  2⤵
  PID:13532
- C:\Windows\System\Gkjxdut.exe
  C:\Windows\System\Gkjxdut.exe
  2⤵
  PID:13548
- C:\Windows\System\WwQLbeD.exe
  C:\Windows\System\WwQLbeD.exe
  2⤵
  PID:13564
- C:\Windows\System\UjjEXzD.exe
  C:\Windows\System\UjjEXzD.exe
  2⤵
  PID:13580
- C:\Windows\System\rTwNoyO.exe
  C:\Windows\System\rTwNoyO.exe
  2⤵
  PID:13596
- C:\Windows\System\pQTsZIE.exe
  C:\Windows\System\pQTsZIE.exe
  2⤵
  PID:13616
- C:\Windows\System\exGVuUN.exe
  C:\Windows\System\exGVuUN.exe
  2⤵
  PID:13632
- C:\Windows\System\fljoRMx.exe
  C:\Windows\System\fljoRMx.exe
  2⤵
  PID:13648
- C:\Windows\System\KYzDbnN.exe
  C:\Windows\System\KYzDbnN.exe
  2⤵
  PID:13664
- C:\Windows\System\xdyYZYs.exe
  C:\Windows\System\xdyYZYs.exe
  2⤵
  PID:13680
- C:\Windows\System\gjBMVTZ.exe
  C:\Windows\System\gjBMVTZ.exe
  2⤵
  PID:13700
- C:\Windows\System\WQdYyXG.exe
  C:\Windows\System\WQdYyXG.exe
  2⤵
  PID:13716
- C:\Windows\System\viTQrIS.exe
  C:\Windows\System\viTQrIS.exe
  2⤵
  PID:13732
- C:\Windows\System\oqsTKhI.exe
  C:\Windows\System\oqsTKhI.exe
  2⤵
  PID:13748
- C:\Windows\System\BCVNPKw.exe
  C:\Windows\System\BCVNPKw.exe
  2⤵
  PID:13764
- C:\Windows\System\MKhsXQm.exe
  C:\Windows\System\MKhsXQm.exe
  2⤵
  PID:13780
- C:\Windows\System\EaVrrpM.exe
  C:\Windows\System\EaVrrpM.exe
  2⤵
  PID:13796
- C:\Windows\System\dUsueYS.exe
  C:\Windows\System\dUsueYS.exe
  2⤵
  PID:13812
- C:\Windows\System\bQfsGea.exe
  C:\Windows\System\bQfsGea.exe
  2⤵
  PID:13828
- C:\Windows\System\yCZcxwY.exe
  C:\Windows\System\yCZcxwY.exe
  2⤵
  PID:13844
- C:\Windows\System\GHzasio.exe
  C:\Windows\System\GHzasio.exe
  2⤵
  PID:13860
- C:\Windows\System\ISWdZSY.exe
  C:\Windows\System\ISWdZSY.exe
  2⤵
  PID:13876
- C:\Windows\System\aOoOioV.exe
  C:\Windows\System\aOoOioV.exe
  2⤵
  PID:13892
- C:\Windows\System\WOoVdnj.exe
  C:\Windows\System\WOoVdnj.exe
  2⤵
  PID:13908
- C:\Windows\System\hLsqjvH.exe
  C:\Windows\System\hLsqjvH.exe
  2⤵
  PID:13924
- C:\Windows\System\QebDJom.exe
  C:\Windows\System\QebDJom.exe
  2⤵
  PID:13940
- C:\Windows\System\ZCrlYwX.exe
  C:\Windows\System\ZCrlYwX.exe
  2⤵
  PID:13956
- C:\Windows\System\AGzbbjR.exe
  C:\Windows\System\AGzbbjR.exe
  2⤵
  PID:13972
- C:\Windows\System\lrltEpW.exe
  C:\Windows\System\lrltEpW.exe
  2⤵
  PID:13988
- C:\Windows\System\sdtYTYk.exe
  C:\Windows\System\sdtYTYk.exe
  2⤵
  PID:14008
- C:\Windows\System\susDvzu.exe
  C:\Windows\System\susDvzu.exe
  2⤵
  PID:14024
- C:\Windows\System\vMmetKV.exe
  C:\Windows\System\vMmetKV.exe
  2⤵
  PID:14040
- C:\Windows\System\WqAnsYN.exe
  C:\Windows\System\WqAnsYN.exe
  2⤵
  PID:14056
- C:\Windows\System\XJkzkLp.exe
  C:\Windows\System\XJkzkLp.exe
  2⤵
  PID:14072
- C:\Windows\System\QOHpRdY.exe
  C:\Windows\System\QOHpRdY.exe
  2⤵
  PID:14088
- C:\Windows\System\fHsYeAZ.exe
  C:\Windows\System\fHsYeAZ.exe
  2⤵
  PID:14104
- C:\Windows\System\zFpCTBE.exe
  C:\Windows\System\zFpCTBE.exe
  2⤵
  PID:14120
- C:\Windows\System\JgVHkaY.exe
  C:\Windows\System\JgVHkaY.exe
  2⤵
  PID:14140
- C:\Windows\System\ASDvDBq.exe
  C:\Windows\System\ASDvDBq.exe
  2⤵
  PID:14156
- C:\Windows\System\uJCkNWN.exe
  C:\Windows\System\uJCkNWN.exe
  2⤵
  PID:14172
- C:\Windows\System\cADUjjf.exe
  C:\Windows\System\cADUjjf.exe
  2⤵
  PID:14192
- C:\Windows\System\LJjHQHR.exe
  C:\Windows\System\LJjHQHR.exe
  2⤵
  PID:14208
- C:\Windows\System\lycSzyy.exe
  C:\Windows\System\lycSzyy.exe
  2⤵
  PID:14228
- C:\Windows\System\BuNPurx.exe
  C:\Windows\System\BuNPurx.exe
  2⤵
  PID:14244
- C:\Windows\System\METNeDM.exe
  C:\Windows\System\METNeDM.exe
  2⤵
  PID:14260
- C:\Windows\System\ESScXnG.exe
  C:\Windows\System\ESScXnG.exe
  2⤵
  PID:14276
- C:\Windows\System\BtwUclj.exe
  C:\Windows\System\BtwUclj.exe
  2⤵
  PID:14300
- C:\Windows\System\mhHadDd.exe
  C:\Windows\System\mhHadDd.exe
  2⤵
  PID:14324
- C:\Windows\System\MWZUEpI.exe
  C:\Windows\System\MWZUEpI.exe
  2⤵
  PID:13344
- C:\Windows\System\pLKJbkt.exe
  C:\Windows\System\pLKJbkt.exe
  2⤵
  PID:13392
- C:\Windows\System\wVwCmzR.exe
  C:\Windows\System\wVwCmzR.exe
  2⤵
  PID:13428
- C:\Windows\System\QLGdZrZ.exe
  C:\Windows\System\QLGdZrZ.exe
  2⤵
  PID:13444
- C:\Windows\System\QClFehb.exe
  C:\Windows\System\QClFehb.exe
  2⤵
  PID:13492
- C:\Windows\System\Xvcvnds.exe
  C:\Windows\System\Xvcvnds.exe
  2⤵
  PID:13524
- C:\Windows\System\KAmruyJ.exe
  C:\Windows\System\KAmruyJ.exe
  2⤵
  PID:13556
- C:\Windows\System\YuodVip.exe
  C:\Windows\System\YuodVip.exe
  2⤵
  PID:13608
- C:\Windows\System\ochZchf.exe
  C:\Windows\System\ochZchf.exe
  2⤵
  PID:13756
- C:\Windows\System\uXLzZIw.exe
  C:\Windows\System\uXLzZIw.exe
  2⤵
  PID:13808
- C:\Windows\System\snpxqEK.exe
  C:\Windows\System\snpxqEK.exe
  2⤵
  PID:13884
- C:\Windows\System\pmbnbYq.exe
  C:\Windows\System\pmbnbYq.exe
  2⤵
  PID:13952
- C:\Windows\System\skipQRe.exe
  C:\Windows\System\skipQRe.exe
  2⤵
  PID:13840
- C:\Windows\System\dooybqb.exe
  C:\Windows\System\dooybqb.exe
  2⤵
  PID:3616
- C:\Windows\System\CWiwFjt.exe
  C:\Windows\System\CWiwFjt.exe
  2⤵
  PID:116
- C:\Windows\System\gntBxrf.exe
  C:\Windows\System\gntBxrf.exe
  2⤵
  PID:14216
- C:\Windows\System\ilcSkCS.exe
  C:\Windows\System\ilcSkCS.exe
  2⤵
  PID:13544
- C:\Windows\System\XlaSfgq.exe
  C:\Windows\System\XlaSfgq.exe
  2⤵
  PID:13628
- C:\Windows\System\shdRRyo.exe
  C:\Windows\System\shdRRyo.exe
  2⤵
  PID:13692
- C:\Windows\System\mTujVvr.exe
  C:\Windows\System\mTujVvr.exe
  2⤵
  PID:4404
- C:\Windows\System\IijRFir.exe
  C:\Windows\System\IijRFir.exe
  2⤵
  PID:13916
- C:\Windows\System\FYTGbgu.exe
  C:\Windows\System\FYTGbgu.exe
  2⤵
  PID:13904
- C:\Windows\System\lVBdCKh.exe
  C:\Windows\System\lVBdCKh.exe
  2⤵
  PID:14064
- C:\Windows\System\zIuSWtQ.exe
  C:\Windows\System\zIuSWtQ.exe
  2⤵
  PID:14084
- C:\Windows\System\tOVEuAL.exe
  C:\Windows\System\tOVEuAL.exe
  2⤵
  PID:772
- C:\Windows\System\llLIPdP.exe
  C:\Windows\System\llLIPdP.exe
  2⤵
  PID:1016
- C:\Windows\System\mBhnPVI.exe
  C:\Windows\System\mBhnPVI.exe
  2⤵
  PID:4020
- C:\Windows\System\QuHTfEN.exe
  C:\Windows\System\QuHTfEN.exe
  2⤵
  PID:916
- C:\Windows\System\jPJQVEf.exe
  C:\Windows\System\jPJQVEf.exe
  2⤵
  PID:14116
- C:\Windows\System\AuJmvLU.exe
  C:\Windows\System\AuJmvLU.exe
  2⤵
  PID:14132
- C:\Windows\System\yUVmLqj.exe
  C:\Windows\System\yUVmLqj.exe
  2⤵
  PID:14164
- C:\Windows\System\BtrOGXn.exe
  C:\Windows\System\BtrOGXn.exe
  2⤵
  PID:1648
- C:\Windows\System\wZXYjGV.exe
  C:\Windows\System\wZXYjGV.exe
  2⤵
  PID:14272
- C:\Windows\System\JgnqLlo.exe
  C:\Windows\System\JgnqLlo.exe
  2⤵
  PID:3604
- C:\Windows\System\yduzoRF.exe
  C:\Windows\System\yduzoRF.exe
  2⤵
  PID:13448
- C:\Windows\System\OSybCYF.exe
  C:\Windows\System\OSybCYF.exe
  2⤵
  PID:1636
- C:\Windows\System\dnHBITk.exe
  C:\Windows\System\dnHBITk.exe
  2⤵
  PID:13540
- C:\Windows\System\EXoyzaG.exe
  C:\Windows\System\EXoyzaG.exe
  2⤵
  PID:13640
- C:\Windows\System\dParoeB.exe
  C:\Windows\System\dParoeB.exe
  2⤵
  PID:4252
- C:\Windows\System\xDCqnVf.exe
  C:\Windows\System\xDCqnVf.exe
  2⤵
  PID:13920
- C:\Windows\System\TQCzYER.exe
  C:\Windows\System\TQCzYER.exe
  2⤵
  PID:14048
- C:\Windows\System\PGGvOoi.exe
  C:\Windows\System\PGGvOoi.exe
  2⤵
  PID:3136
- C:\Windows\System\HnnXbsg.exe
  C:\Windows\System\HnnXbsg.exe
  2⤵
  PID:14188
- C:\Windows\System\fnixvQA.exe
  C:\Windows\System\fnixvQA.exe
  2⤵
  PID:3516
- C:\Windows\System\cElagGM.exe
  C:\Windows\System\cElagGM.exe
  2⤵
  PID:13480
- C:\Windows\System\vljDXeh.exe
  C:\Windows\System\vljDXeh.exe
  2⤵
  PID:14268
- C:\Windows\System\psXNPTo.exe
  C:\Windows\System\psXNPTo.exe
  2⤵
  PID:3968
- C:\Windows\System\LRkmVbF.exe
  C:\Windows\System\LRkmVbF.exe
  2⤵
  PID:752
- C:\Windows\System\lPSlhSr.exe
  C:\Windows\System\lPSlhSr.exe
  2⤵
  PID:2028
- C:\Windows\System\PyOgYiC.exe
  C:\Windows\System\PyOgYiC.exe
  2⤵
  PID:13460
- C:\Windows\System\vFZNwPg.exe
  C:\Windows\System\vFZNwPg.exe
  2⤵
  PID:13712
- C:\Windows\System\CaqJUOp.exe
  C:\Windows\System\CaqJUOp.exe
  2⤵
  PID:13476
- C:\Windows\System\BYmrqFB.exe
  C:\Windows\System\BYmrqFB.exe
  2⤵
  PID:13984
- C:\Windows\System\hxZGnrA.exe
  C:\Windows\System\hxZGnrA.exe
  2⤵
  PID:12216
- C:\Windows\System\WAVjCVx.exe
  C:\Windows\System\WAVjCVx.exe
  2⤵
  PID:6656
- C:\Windows\System\gzxRQAH.exe
  C:\Windows\System\gzxRQAH.exe
  2⤵
  PID:6600
- C:\Windows\System\byDsYfJ.exe
  C:\Windows\System\byDsYfJ.exe
  2⤵
  PID:6620
- C:\Windows\System\iPDHhNH.exe
  C:\Windows\System\iPDHhNH.exe
  2⤵
  PID:1068
- C:\Windows\System\oLUKFug.exe
  C:\Windows\System\oLUKFug.exe
  2⤵
  PID:6676
- C:\Windows\System\FZTJXla.exe
  C:\Windows\System\FZTJXla.exe
  2⤵
  PID:6704
- C:\Windows\System\emrGdMi.exe
  C:\Windows\System\emrGdMi.exe
  2⤵
  PID:7068
- C:\Windows\System\ouPtyoE.exe
  C:\Windows\System\ouPtyoE.exe
  2⤵
  PID:7120
- C:\Windows\System\KdmeshP.exe
  C:\Windows\System\KdmeshP.exe
  2⤵
  PID:6792
- C:\Windows\System\DcQCoGs.exe
  C:\Windows\System\DcQCoGs.exe
  2⤵
  PID:6872
- C:\Windows\System\oIriJtw.exe
  C:\Windows\System\oIriJtw.exe
  2⤵
  PID:6512
- C:\Windows\System\zqMDZEi.exe
  C:\Windows\System\zqMDZEi.exe
  2⤵
  PID:7128
- C:\Windows\System\mmTtQeg.exe
  C:\Windows\System\mmTtQeg.exe
  2⤵
  PID:7148
- C:\Windows\System\fGoNCVA.exe
  C:\Windows\System\fGoNCVA.exe
  2⤵
  PID:3356
- C:\Windows\System\uXmgPYt.exe
  C:\Windows\System\uXmgPYt.exe
  2⤵
  PID:3504
- C:\Windows\System\NjjBSte.exe
  C:\Windows\System\NjjBSte.exe
  2⤵
  PID:5684
- C:\Windows\System\TGYckIM.exe
  C:\Windows\System\TGYckIM.exe
  2⤵
  PID:7652
- C:\Windows\System\BArdXSW.exe
  C:\Windows\System\BArdXSW.exe
  2⤵
  PID:7684
- C:\Windows\System\WlTazCw.exe
  C:\Windows\System\WlTazCw.exe
  2⤵
  PID:7712
- C:\Windows\System\xQnUSjO.exe
  C:\Windows\System\xQnUSjO.exe
  2⤵
  PID:7756
- C:\Windows\System\NwGqxXz.exe
  C:\Windows\System\NwGqxXz.exe
  2⤵
  PID:7808
- C:\Windows\System\rxsKsEd.exe
  C:\Windows\System\rxsKsEd.exe
  2⤵
  PID:6280
- C:\Windows\System\emxsfRQ.exe
  C:\Windows\System\emxsfRQ.exe
  2⤵
  PID:6700
- C:\Windows\System\YuQCgye.exe
  C:\Windows\System\YuQCgye.exe
  2⤵
  PID:4492
- C:\Windows\System\cggOGBF.exe
  C:\Windows\System\cggOGBF.exe
  2⤵
  PID:7224
- C:\Windows\System\wekmTio.exe
  C:\Windows\System\wekmTio.exe
  2⤵
  PID:6964
- C:\Windows\System\ioZxBXU.exe
  C:\Windows\System\ioZxBXU.exe
  2⤵
  PID:2044
- C:\Windows\System\aGdcsvf.exe
  C:\Windows\System\aGdcsvf.exe
  2⤵
  PID:3208
- C:\Windows\System\vvxkJnw.exe
  C:\Windows\System\vvxkJnw.exe
  2⤵
  PID:5304
- C:\Windows\System\jvyLDjf.exe
  C:\Windows\System\jvyLDjf.exe
  2⤵
  PID:4332
- C:\Windows\System\MkKCLVK.exe
  C:\Windows\System\MkKCLVK.exe
  2⤵
  PID:5280
- C:\Windows\System\uhlOBdn.exe
  C:\Windows\System\uhlOBdn.exe
  2⤵
  PID:1724
- C:\Windows\System\XNByOoT.exe
  C:\Windows\System\XNByOoT.exe
  2⤵
  PID:5172
- C:\Windows\System\xhHiVNx.exe
  C:\Windows\System\xhHiVNx.exe
  2⤵
  PID:2536
- C:\Windows\System\ToAwhWe.exe
  C:\Windows\System\ToAwhWe.exe
  2⤵
  PID:3052
- C:\Windows\System\LVuFTnu.exe
  C:\Windows\System\LVuFTnu.exe
  2⤵
  PID:1336
- C:\Windows\System\VJPUjDX.exe
  C:\Windows\System\VJPUjDX.exe
  2⤵
  PID:228
- C:\Windows\System\kipTQfe.exe
  C:\Windows\System\kipTQfe.exe
  2⤵
  PID:2688
- C:\Windows\System\blSRwGn.exe
  C:\Windows\System\blSRwGn.exe
  2⤵
  PID:13948
- C:\Windows\System\EszcROz.exe
  C:\Windows\System\EszcROz.exe
  2⤵
  PID:5284
- C:\Windows\System\NDeEIgd.exe
  C:\Windows\System\NDeEIgd.exe
  2⤵
  PID:13968
- C:\Windows\System\mFlvQNz.exe
  C:\Windows\System\mFlvQNz.exe
  2⤵
  PID:5252
- C:\Windows\System\XdTKMtM.exe
  C:\Windows\System\XdTKMtM.exe
  2⤵
  PID:13996
- C:\Windows\System\FBhoBrx.exe
  C:\Windows\System\FBhoBrx.exe
  2⤵
  PID:4656
- C:\Windows\System\ZPpZctG.exe
  C:\Windows\System\ZPpZctG.exe
  2⤵
  PID:1500
- C:\Windows\System\TskaJdA.exe
  C:\Windows\System\TskaJdA.exe
  2⤵
  PID:5200
- C:\Windows\System\jgXZSja.exe
  C:\Windows\System\jgXZSja.exe
  2⤵
  PID:3708
- C:\Windows\System\oqxGBoD.exe
  C:\Windows\System\oqxGBoD.exe
  2⤵
  PID:2584
- C:\Windows\System\BEDvqEN.exe
  C:\Windows\System\BEDvqEN.exe
  2⤵
  PID:3156
- C:\Windows\System\VLczgyW.exe
  C:\Windows\System\VLczgyW.exe
  2⤵
  PID:13412
- C:\Windows\System\GVpPUbl.exe
  C:\Windows\System\GVpPUbl.exe
  2⤵
  PID:1980
- C:\Windows\System\agWJAmH.exe
  C:\Windows\System\agWJAmH.exe
  2⤵
  PID:3752
- C:\Windows\System\VTvuCEj.exe
  C:\Windows\System\VTvuCEj.exe
  2⤵
  PID:3648
- C:\Windows\System\dXaQwmn.exe
  C:\Windows\System\dXaQwmn.exe
  2⤵
  PID:13788
- C:\Windows\System\JKeKojM.exe
  C:\Windows\System\JKeKojM.exe
  2⤵
  PID:1804
- C:\Windows\System\LbBDSNn.exe
  C:\Windows\System\LbBDSNn.exe
  2⤵
  PID:1896
- C:\Windows\System\qbkpNHe.exe
  C:\Windows\System\qbkpNHe.exe
  2⤵
  PID:8540
- C:\Windows\System\xSzPAcq.exe
  C:\Windows\System\xSzPAcq.exe
  2⤵
  PID:8420
- C:\Windows\System\uOKZAjb.exe
  C:\Windows\System\uOKZAjb.exe
  2⤵
  PID:8452
- C:\Windows\System\sNRywpw.exe
  C:\Windows\System\sNRywpw.exe
  2⤵
  PID:9044
- C:\Windows\System\EqBrDbC.exe
  C:\Windows\System\EqBrDbC.exe
  2⤵
  PID:4376
- C:\Windows\System\MQNrUpJ.exe
  C:\Windows\System\MQNrUpJ.exe
  2⤵
  PID:14316
- C:\Windows\System\dSPmRdf.exe
  C:\Windows\System\dSPmRdf.exe
  2⤵
  PID:5316
- C:\Windows\System\efDQLjV.exe
  C:\Windows\System\efDQLjV.exe
  2⤵
  PID:6660
- C:\Windows\System\zjLhNMx.exe
  C:\Windows\System\zjLhNMx.exe
  2⤵
  PID:6928
- C:\Windows\System\cTnUZTG.exe
  C:\Windows\System\cTnUZTG.exe
  2⤵
  PID:2288
- C:\Windows\System\ncwQfOH.exe
  C:\Windows\System\ncwQfOH.exe
  2⤵
  PID:14020
- C:\Windows\System\EotqCcy.exe
  C:\Windows\System\EotqCcy.exe
  2⤵
  PID:6736
- C:\Windows\System\WYMYNqT.exe
  C:\Windows\System\WYMYNqT.exe
  2⤵
  PID:5692
- C:\Windows\System\PcfVNFN.exe
  C:\Windows\System\PcfVNFN.exe
  2⤵
  PID:6356
- C:\Windows\System\IngWrqz.exe
  C:\Windows\System\IngWrqz.exe
  2⤵
  PID:7188
- C:\Windows\System\jMSMLbl.exe
  C:\Windows\System\jMSMLbl.exe
  2⤵
  PID:7780
- C:\Windows\System\marKapZ.exe
  C:\Windows\System\marKapZ.exe
  2⤵
  PID:6484
- C:\Windows\System\oAUkPls.exe
  C:\Windows\System\oAUkPls.exe
  2⤵
  PID:14152
- C:\Windows\System\Hxmavif.exe
  C:\Windows\System\Hxmavif.exe
  2⤵
  PID:6396
- C:\Windows\System\sGXoOdY.exe
  C:\Windows\System\sGXoOdY.exe
  2⤵
  PID:7800
- C:\Windows\System\DrWWbdm.exe
  C:\Windows\System\DrWWbdm.exe
  2⤵
  PID:14148
- C:\Windows\System\Uqqnusv.exe
  C:\Windows\System\Uqqnusv.exe
  2⤵
  PID:8724
- C:\Windows\System\AhQMtOK.exe
  C:\Windows\System\AhQMtOK.exe
  2⤵
  PID:8772
- C:\Windows\System\rEHfClz.exe
  C:\Windows\System\rEHfClz.exe
  2⤵
  PID:8812
- C:\Windows\System\CSrceiP.exe
  C:\Windows\System\CSrceiP.exe
  2⤵
  PID:8904
- C:\Windows\System\GvGgbOu.exe
  C:\Windows\System\GvGgbOu.exe
  2⤵
  PID:9012
- C:\Windows\System\HCbTPmz.exe
  C:\Windows\System\HCbTPmz.exe
  2⤵
  PID:2504
- C:\Windows\System\QWxmJGq.exe
  C:\Windows\System\QWxmJGq.exe
  2⤵
  PID:6904
- C:\Windows\System\qQYCpxd.exe
  C:\Windows\System\qQYCpxd.exe
  2⤵
  PID:6240
- C:\Windows\System\hFRtNua.exe
  C:\Windows\System\hFRtNua.exe
  2⤵
  PID:9184
- C:\Windows\System\xbuDqVl.exe
  C:\Windows\System\xbuDqVl.exe
  2⤵
  PID:7672
- C:\Windows\System\IvqVaDm.exe
  C:\Windows\System\IvqVaDm.exe
  2⤵
  PID:7132
- C:\Windows\System\NdwkObk.exe
  C:\Windows\System\NdwkObk.exe
  2⤵
  PID:7272
- C:\Windows\System\Srxbvlc.exe
  C:\Windows\System\Srxbvlc.exe
  2⤵
  PID:7804
- C:\Windows\System\jdlbxLU.exe
  C:\Windows\System\jdlbxLU.exe
  2⤵
  PID:6616
- C:\Windows\System\lwIZMBD.exe
  C:\Windows\System\lwIZMBD.exe
  2⤵
  PID:6752
- C:\Windows\System\iqiaLbg.exe
  C:\Windows\System\iqiaLbg.exe
  2⤵
  PID:7516
- C:\Windows\System\GHMDZhv.exe
  C:\Windows\System\GHMDZhv.exe
  2⤵
  PID:5164
- C:\Windows\System\TKJyOLX.exe
  C:\Windows\System\TKJyOLX.exe
  2⤵
  PID:3396
- C:\Windows\System\tGzirsx.exe
  C:\Windows\System\tGzirsx.exe
  2⤵
  PID:1080
- C:\Windows\System\SgTHksO.exe
  C:\Windows\System\SgTHksO.exe
  2⤵
  PID:2544
- C:\Windows\System\zwxYFIG.exe
  C:\Windows\System\zwxYFIG.exe
  2⤵
  PID:1056
- C:\Windows\System\nqKMUuD.exe
  C:\Windows\System\nqKMUuD.exe
  2⤵
  PID:4304
- C:\Windows\System\tPiNaUh.exe
  C:\Windows\System\tPiNaUh.exe
  2⤵
  PID:13872
- C:\Windows\System\zTMPIEO.exe
  C:\Windows\System\zTMPIEO.exe
  2⤵
  PID:5160
- C:\Windows\System\KNvjdvQ.exe
  C:\Windows\System\KNvjdvQ.exe
  2⤵
  PID:524
- C:\Windows\System\EoYwRzC.exe
  C:\Windows\System\EoYwRzC.exe
  2⤵
  PID:4172
- C:\Windows\System\KenTSBG.exe
  C:\Windows\System\KenTSBG.exe
  2⤵
  PID:3348
- C:\Windows\System\uRxGMmj.exe
  C:\Windows\System\uRxGMmj.exe
  2⤵
  PID:13740
- C:\Windows\System\XyICoyO.exe
  C:\Windows\System\XyICoyO.exe
  2⤵
  PID:3228
- C:\Windows\System\scNAgZr.exe
  C:\Windows\System\scNAgZr.exe
  2⤵
  PID:2132
- C:\Windows\System\gDczYYo.exe
  C:\Windows\System\gDczYYo.exe
  2⤵
  PID:7768
- C:\Windows\System\QWuhKnw.exe
  C:\Windows\System\QWuhKnw.exe
  2⤵
  PID:6832
- C:\Windows\System\RJqOnvM.exe
  C:\Windows\System\RJqOnvM.exe
  2⤵
  PID:7248
- C:\Windows\System\NiESFTO.exe
  C:\Windows\System\NiESFTO.exe
  2⤵
  PID:6264
- C:\Windows\System\mgperrn.exe
  C:\Windows\System\mgperrn.exe
  2⤵
  PID:7636
- C:\Windows\System\ffzjgXC.exe
  C:\Windows\System\ffzjgXC.exe
  2⤵
  PID:8924
- C:\Windows\System\dozNHKT.exe
  C:\Windows\System\dozNHKT.exe
  2⤵
  PID:9032
- C:\Windows\System\CqSUEcx.exe
  C:\Windows\System\CqSUEcx.exe
  2⤵
  PID:1396
- C:\Windows\System\xHaoMzi.exe
  C:\Windows\System\xHaoMzi.exe
  2⤵
  PID:6720
- C:\Windows\System\CcmWCvg.exe
  C:\Windows\System\CcmWCvg.exe
  2⤵
  PID:7088
- C:\Windows\System\xfRIIlL.exe
  C:\Windows\System\xfRIIlL.exe
  2⤵
  PID:7020
- C:\Windows\System\SRvUdnK.exe
  C:\Windows\System\SRvUdnK.exe
  2⤵
  PID:7828
- C:\Windows\System\eHheQua.exe
  C:\Windows\System\eHheQua.exe
  2⤵
  PID:5628
- C:\Windows\System\AJYloMe.exe
  C:\Windows\System\AJYloMe.exe
  2⤵
  PID:3376
- C:\Windows\System\XQauRBe.exe
  C:\Windows\System\XQauRBe.exe
  2⤵
  PID:6980
- C:\Windows\System\wNBdexH.exe
  C:\Windows\System\wNBdexH.exe
  2⤵
  PID:564
- C:\Windows\System\VCJaKCJ.exe
  C:\Windows\System\VCJaKCJ.exe
  2⤵
  PID:6828
- C:\Windows\System\tzzsDmS.exe
  C:\Windows\System\tzzsDmS.exe
  2⤵
  PID:14344
- C:\Windows\System\XNPcwie.exe
  C:\Windows\System\XNPcwie.exe
  2⤵
  PID:14360
- C:\Windows\System\wlIeeFo.exe
  C:\Windows\System\wlIeeFo.exe
  2⤵
  PID:14376
- C:\Windows\System\qdAmuIP.exe
  C:\Windows\System\qdAmuIP.exe
  2⤵
  PID:14392
- C:\Windows\System\ZKmqEBS.exe
  C:\Windows\System\ZKmqEBS.exe
  2⤵
  PID:14408
- C:\Windows\System\IwJFIKw.exe
  C:\Windows\System\IwJFIKw.exe
  2⤵
  PID:14424
- C:\Windows\System\KxucWap.exe
  C:\Windows\System\KxucWap.exe
  2⤵
  PID:14440
- C:\Windows\System\inXTdrv.exe
  C:\Windows\System\inXTdrv.exe
  2⤵
  PID:14456
- C:\Windows\System\UacALtk.exe
  C:\Windows\System\UacALtk.exe
  2⤵
  PID:14472
- C:\Windows\System\gDhJGtp.exe
  C:\Windows\System\gDhJGtp.exe
  2⤵
  PID:14488
- C:\Windows\System\fkiILfX.exe
  C:\Windows\System\fkiILfX.exe
  2⤵
  PID:14504
- C:\Windows\System\wqbaUEG.exe
  C:\Windows\System\wqbaUEG.exe
  2⤵
  PID:14520
- C:\Windows\System\AVFiJnP.exe
  C:\Windows\System\AVFiJnP.exe
  2⤵
  PID:14536
- C:\Windows\System\NlFJvfu.exe
  C:\Windows\System\NlFJvfu.exe
  2⤵
  PID:14552
- C:\Windows\System\FJDWlNj.exe
  C:\Windows\System\FJDWlNj.exe
  2⤵
  PID:14568
- C:\Windows\System\tbiqcOd.exe
  C:\Windows\System\tbiqcOd.exe
  2⤵
  PID:14584
- C:\Windows\System\QdTygjG.exe
  C:\Windows\System\QdTygjG.exe
  2⤵
  PID:14600
- C:\Windows\System\HRbRCRL.exe
  C:\Windows\System\HRbRCRL.exe
  2⤵
  PID:14616
- C:\Windows\System\ifMmxza.exe
  C:\Windows\System\ifMmxza.exe
  2⤵
  PID:14632
- C:\Windows\System\drHdBGY.exe
  C:\Windows\System\drHdBGY.exe
  2⤵
  PID:14648
- C:\Windows\System\GRIcMCW.exe
  C:\Windows\System\GRIcMCW.exe
  2⤵
  PID:14664
- C:\Windows\System\QmJJAtN.exe
  C:\Windows\System\QmJJAtN.exe
  2⤵
  PID:14680
- C:\Windows\System\Weiozgh.exe
  C:\Windows\System\Weiozgh.exe
  2⤵
  PID:14696
- C:\Windows\System\vaUGJsE.exe
  C:\Windows\System\vaUGJsE.exe
  2⤵
  PID:14712
- C:\Windows\System\TuGYiSJ.exe
  C:\Windows\System\TuGYiSJ.exe
  2⤵
  PID:14728
- C:\Windows\System\jEFApmQ.exe
  C:\Windows\System\jEFApmQ.exe
  2⤵
  PID:14744
- C:\Windows\System\zYDMWRc.exe
  C:\Windows\System\zYDMWRc.exe
  2⤵
  PID:14760
- C:\Windows\System\RvglsQM.exe
  C:\Windows\System\RvglsQM.exe
  2⤵
  PID:14780
- C:\Windows\System\YQAGzjU.exe
  C:\Windows\System\YQAGzjU.exe
  2⤵
  PID:14796
- C:\Windows\System\EKeHZLP.exe
  C:\Windows\System\EKeHZLP.exe
  2⤵
  PID:14812
- C:\Windows\System\aFjhFro.exe
  C:\Windows\System\aFjhFro.exe
  2⤵
  PID:14828
- C:\Windows\System\YLgoISK.exe
  C:\Windows\System\YLgoISK.exe
  2⤵
  PID:14844
- C:\Windows\System\BuPKqSV.exe
  C:\Windows\System\BuPKqSV.exe
  2⤵
  PID:14860
- C:\Windows\System\iqqnzQN.exe
  C:\Windows\System\iqqnzQN.exe
  2⤵
  PID:14876
- C:\Windows\System\emorrHz.exe
  C:\Windows\System\emorrHz.exe
  2⤵
  PID:14892
- C:\Windows\System\tJeCIgj.exe
  C:\Windows\System\tJeCIgj.exe
  2⤵
  PID:14908
- C:\Windows\System\XmQVXZS.exe
  C:\Windows\System\XmQVXZS.exe
  2⤵
  PID:14924
- C:\Windows\System\sHXIzCM.exe
  C:\Windows\System\sHXIzCM.exe
  2⤵
  PID:14940
- C:\Windows\System\YnyELOz.exe
  C:\Windows\System\YnyELOz.exe
  2⤵
  PID:14956
- C:\Windows\System\HSfPZge.exe
  C:\Windows\System\HSfPZge.exe
  2⤵
  PID:14972
- C:\Windows\System\dazIqhX.exe
  C:\Windows\System\dazIqhX.exe
  2⤵
  PID:14988
- C:\Windows\System\haavSMu.exe
  C:\Windows\System\haavSMu.exe
  2⤵
  PID:15004
- C:\Windows\System\AYflIUX.exe
  C:\Windows\System\AYflIUX.exe
  2⤵
  PID:15020
- C:\Windows\System\FPiGvqx.exe
  C:\Windows\System\FPiGvqx.exe
  2⤵
  PID:15036
- C:\Windows\System\QHbwAiK.exe
  C:\Windows\System\QHbwAiK.exe
  2⤵
  PID:15052
- C:\Windows\System\scnstmE.exe
  C:\Windows\System\scnstmE.exe
  2⤵
  PID:15068
- C:\Windows\System\CauWwaj.exe
  C:\Windows\System\CauWwaj.exe
  2⤵
  PID:15084
- C:\Windows\System\njMwNvi.exe
  C:\Windows\System\njMwNvi.exe
  2⤵
  PID:15100
- C:\Windows\System\TDmYqBu.exe
  C:\Windows\System\TDmYqBu.exe
  2⤵
  PID:15116
- C:\Windows\System\gmpCoSM.exe
  C:\Windows\System\gmpCoSM.exe
  2⤵
  PID:15132
- C:\Windows\System\zBCBmFx.exe
  C:\Windows\System\zBCBmFx.exe
  2⤵
  PID:15148
- C:\Windows\System\NFwKYrQ.exe
  C:\Windows\System\NFwKYrQ.exe
  2⤵
  PID:15164
- C:\Windows\System\OemMhno.exe
  C:\Windows\System\OemMhno.exe
  2⤵
  PID:15180
- C:\Windows\System\QGXVHhw.exe
  C:\Windows\System\QGXVHhw.exe
  2⤵
  PID:15196
- C:\Windows\System\jBWBEei.exe
  C:\Windows\System\jBWBEei.exe
  2⤵
  PID:15212
- C:\Windows\System\rjvZFLw.exe
  C:\Windows\System\rjvZFLw.exe
  2⤵
  PID:15228
- C:\Windows\System\jGfRMhD.exe
  C:\Windows\System\jGfRMhD.exe
  2⤵
  PID:15244
- C:\Windows\System\bZGjvqv.exe
  C:\Windows\System\bZGjvqv.exe
  2⤵
  PID:15260
- C:\Windows\System\OxYXkar.exe
  C:\Windows\System\OxYXkar.exe
  2⤵
  PID:15276
- C:\Windows\System\yfvWKkK.exe
  C:\Windows\System\yfvWKkK.exe
  2⤵
  PID:15292
- C:\Windows\System\wWrVWLS.exe
  C:\Windows\System\wWrVWLS.exe
  2⤵
  PID:15308
- C:\Windows\System\kYNbgwY.exe
  C:\Windows\System\kYNbgwY.exe
  2⤵
  PID:15324
- C:\Windows\System\rrWBwYE.exe
  C:\Windows\System\rrWBwYE.exe
  2⤵
  PID:15340
- C:\Windows\System\uDiEunR.exe
  C:\Windows\System\uDiEunR.exe
  2⤵
  PID:15356
- C:\Windows\System\mCtbhhJ.exe
  C:\Windows\System\mCtbhhJ.exe
  2⤵
  PID:2936
- C:\Windows\System\pNYHPfr.exe
  C:\Windows\System\pNYHPfr.exe
  2⤵
  PID:8548
- C:\Windows\System\uRWFoDw.exe
  C:\Windows\System\uRWFoDw.exe
  2⤵
  PID:3104
- C:\Windows\System\rmrsxjZ.exe
  C:\Windows\System\rmrsxjZ.exe
  2⤵
  PID:3168
- C:\Windows\System\AHlHWGs.exe
  C:\Windows\System\AHlHWGs.exe
  2⤵
  PID:13852
- C:\Windows\System\PGAkpYU.exe
  C:\Windows\System\PGAkpYU.exe
  2⤵
  PID:7124
- C:\Windows\System\qywEwDV.exe
  C:\Windows\System\qywEwDV.exe
  2⤵
  PID:7036
- C:\Windows\System\fymOexI.exe
  C:\Windows\System\fymOexI.exe
  2⤵
  PID:4684
- C:\Windows\System\SJNjyfN.exe
  C:\Windows\System\SJNjyfN.exe
  2⤵
  PID:11168
- C:\Windows\System\mgaWiPd.exe
  C:\Windows\System\mgaWiPd.exe
  2⤵
  PID:14252
- C:\Windows\System\FnhEMzC.exe
  C:\Windows\System\FnhEMzC.exe
  2⤵
  PID:7544
- C:\Windows\System\CuXFtBz.exe
  C:\Windows\System\CuXFtBz.exe
  2⤵
  PID:8876
- C:\Windows\System\ztXCnZb.exe
  C:\Windows\System\ztXCnZb.exe
  2⤵
  PID:13572
- C:\Windows\System\JYfjFBD.exe
  C:\Windows\System\JYfjFBD.exe
  2⤵
  PID:7736
- C:\Windows\System\QpoTrwL.exe
  C:\Windows\System\QpoTrwL.exe
  2⤵
  PID:1044
- C:\Windows\System\NQVmQpQ.exe
  C:\Windows\System\NQVmQpQ.exe
  2⤵
  PID:3572
- C:\Windows\System\wccjHlN.exe
  C:\Windows\System\wccjHlN.exe
  2⤵
  PID:3888
- C:\Windows\System\gLefRWY.exe
  C:\Windows\System\gLefRWY.exe
  2⤵
  PID:5192
- C:\Windows\System\IiQuSvA.exe
  C:\Windows\System\IiQuSvA.exe
  2⤵
  PID:14612
- C:\Windows\System\SSEnIhB.exe
  C:\Windows\System\SSEnIhB.exe
  2⤵
  PID:14672
- C:\Windows\System\kHkdZLO.exe
  C:\Windows\System\kHkdZLO.exe
  2⤵
  PID:14704
- C:\Windows\System\NjltTMr.exe
  C:\Windows\System\NjltTMr.exe
  2⤵
  PID:14736
- C:\Windows\System\apbhbGB.exe
  C:\Windows\System\apbhbGB.exe
  2⤵
  PID:14772
- C:\Windows\System\dHfZvGN.exe
  C:\Windows\System\dHfZvGN.exe
  2⤵
  PID:14804
- C:\Windows\System\IcVnpqU.exe
  C:\Windows\System\IcVnpqU.exe
  2⤵
  PID:14836
- C:\Windows\System\YOUPUrL.exe
  C:\Windows\System\YOUPUrL.exe
  2⤵
  PID:14868
- C:\Windows\System\RTtDgYn.exe
  C:\Windows\System\RTtDgYn.exe
  2⤵
  PID:14888
- C:\Windows\System\oWbBKrK.exe
  C:\Windows\System\oWbBKrK.exe
  2⤵
  PID:14920
- C:\Windows\System\sjeNCsk.exe
  C:\Windows\System\sjeNCsk.exe
  2⤵
  PID:14952
- C:\Windows\System\VeIZcol.exe
  C:\Windows\System\VeIZcol.exe
  2⤵
  PID:14984
- C:\Windows\System\XBsYBlu.exe
  C:\Windows\System\XBsYBlu.exe
  2⤵
  PID:15060
- C:\Windows\System\TXVRnaj.exe
  C:\Windows\System\TXVRnaj.exe
  2⤵
  PID:15112
- C:\Windows\System\TUaEfsG.exe
  C:\Windows\System\TUaEfsG.exe
  2⤵
  PID:15144
- C:\Windows\System\kAtrAji.exe
  C:\Windows\System\kAtrAji.exe
  2⤵
  PID:15176
- C:\Windows\System\ZfxfKDy.exe
  C:\Windows\System\ZfxfKDy.exe
  2⤵
  PID:15224
- C:\Windows\System\fvheNZm.exe
  C:\Windows\System\fvheNZm.exe
  2⤵
  PID:15256
- C:\Windows\System\tekOxLy.exe
  C:\Windows\System\tekOxLy.exe
  2⤵
  PID:15320
- C:\Windows\System\ZwTiqfm.exe
  C:\Windows\System\ZwTiqfm.exe
  2⤵
  PID:4040
- C:\Windows\System\vrBIVMh.exe
  C:\Windows\System\vrBIVMh.exe
  2⤵
  PID:8464
- C:\Windows\System\MOwrPkV.exe
  C:\Windows\System\MOwrPkV.exe
  2⤵
  PID:6668
- C:\Windows\System\zJWYnMa.exe
  C:\Windows\System\zJWYnMa.exe
  2⤵
  PID:5564
- C:\Windows\System\ekRYaaU.exe
  C:\Windows\System\ekRYaaU.exe
  2⤵
  PID:5576
- C:\Windows\System\MxupELb.exe
  C:\Windows\System\MxupELb.exe
  2⤵
  PID:14100
- C:\Windows\System\nbDFLcl.exe
  C:\Windows\System\nbDFLcl.exe
  2⤵
  PID:6784
- C:\Windows\System\cXUeQnt.exe
  C:\Windows\System\cXUeQnt.exe
  2⤵
  PID:8948
- C:\Windows\System\ozjXAVF.exe
  C:\Windows\System\ozjXAVF.exe
  2⤵
  PID:9208
- C:\Windows\System\SbpwbkT.exe
  C:\Windows\System\SbpwbkT.exe
  2⤵
  PID:7820
- C:\Windows\System\pTkAQur.exe
  C:\Windows\System\pTkAQur.exe
  2⤵
  PID:5372
- C:\Windows\System\Zhssruy.exe
  C:\Windows\System\Zhssruy.exe
  2⤵
  PID:5384
- C:\Windows\System\qdkHZeN.exe
  C:\Windows\System\qdkHZeN.exe
  2⤵
  PID:5240
- C:\Windows\System\tdlaoTr.exe
  C:\Windows\System\tdlaoTr.exe
  2⤵
  PID:15048
- C:\Windows\System\iZtyRMK.exe
  C:\Windows\System\iZtyRMK.exe
  2⤵
  PID:12152
- C:\Windows\System\LQXQKFC.exe
  C:\Windows\System\LQXQKFC.exe
  2⤵
  PID:14448
- C:\Windows\System\vBTwFLT.exe
  C:\Windows\System\vBTwFLT.exe
  2⤵
  PID:5484
- C:\Windows\System\HAIevpM.exe
  C:\Windows\System\HAIevpM.exe
  2⤵
  PID:5704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x0cs4mol.43n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJnrKjJ.exe

Filesize
1.9MB

MD5
6763825d6529eead97bece871790223a

SHA1
b338a9107e02a746c49eb7f6d73302b3b7ac42cc

SHA256
f5312e6a7687647af2e8401cbebf47a97fa147f0e8c9da35caa383493ab051bf

SHA512
6ae215c141962af6160303a6e243f54672c2e714079052b4a0f93869328712c0e768413583c9ab4545cae21570d721b509940e75b9824e6beabab5335720e246

Download Submit
C:\Windows\System\FJCHlNZ.exe

Filesize
1.9MB

MD5
d9faf87193d1773db7bfa15240df0b81

SHA1
d038a608e25a4b59cb56a10bd7aa390bfd7f07b0

SHA256
6cccc675900e55a9849becba4ba009ecb5f2c9c94f39f56bb25a555815d72ed9

SHA512
26dfeb3788f5416919ac3b5652201dd2b64ad128c731b7b44bbf350af66eed9d072f1a10bb9f05307d4d137543231d864821e87343b19a0b98a8d9b0c93e44e1

Download Submit
C:\Windows\System\FmMvccC.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\IWMpNGI.exe

Filesize
1.9MB

MD5
9d07ababd14a54c25dcf717e7bbb373f

SHA1
4a6603989638e30e49eac48a1afe148102a502b0

SHA256
3a14b98edaa020699fc4fe6658228ac144fd6f4d411b3f42a48b7457246955ae

SHA512
1051dbd1d291b104d66c8b806caced6757c97560869e80d2e816ddfb1c1f7c4dd7fccbee86324a2b9cf4e597b17367f8fa66158a4f5c151f1363a20ec386155e

Download Submit
C:\Windows\System\LCxNMSs.exe

Filesize
1.9MB

MD5
7e9004fce98a97388916b9c00341baf2

SHA1
b4f55a9bf015e8ffd47cd64b9257965824b02bef

SHA256
2beb0065adf63e2a1703a269e886c749bd412f83fafbacca5742626cb51175f8

SHA512
13718f152d50dd9426c43ad1ad04ed441821c9fd16a53343a1ad2343bf1458375af1a5db3409a5a4bfe54bc6dd583ccd5ff4d1f7fb7a6b4f18dc88cc46a0dd84

Download Submit
C:\Windows\System\LLewwmK.exe

Filesize
1.9MB

MD5
2cdd04193ba34d65b3e663eb7d257201

SHA1
6674866e02dcc31d1a1c017deadbdf4e8e50f339

SHA256
f2a7b686873f5879677a2e7fa49ef97916f185aeee601067e750697a0b1dc342

SHA512
1d8d00bc507a20cd1b63d02a664ac0b0ef8e7ff9c5cc420b8b7e5ab648aca7d68601a528d1a88f06ad59e5d0a26f361c721ddf042e84331c075208ba44c6bc79

Download Submit
C:\Windows\System\LbUWyys.exe

Filesize
1.9MB

MD5
b4803f9f8809c1b1896714f743eed47a

SHA1
c8a8297a90e9d126cba192620d802f4feebc1844

SHA256
fc4b99baf3ebf0b63838944ceb36f41e33cfc76154a78fcd60024357e947771b

SHA512
ccf14163772b935f7f00064173714d6e83029c1cd4b6548e123e7da65691bc15bac62dde20c31a8771466ad0a40f70301c012867a1420911e11af59909a9dcee

Download Submit
C:\Windows\System\MJZKVsT.exe

Filesize
1.9MB

MD5
79707a0d249929fcd6a56aed5db877bd

SHA1
69cf52fadae72670492b805886fe28ded2fc693a

SHA256
1804fc98f529c975fd940ae83f0b458c6d1eabf968402eb4baac563c88cc6773

SHA512
e95d2caea409d770c3f704f62305a701423b758c3fd7e1fee4e9e3f40e3cdb37fc5015f43dfb323bf47cd554e1c9cea3e4f6cd2c79200ec8d33b71af1c364d93

Download Submit
C:\Windows\System\MMxEqGA.exe

Filesize
1.9MB

MD5
edb236390184fdc649dc8607d98cc8ad

SHA1
e09cd1dfe96533094636fb6e07171ed3a62e4762

SHA256
c536da964157dc88511951742cb13a43fa6e670f6f06e04fe82d41147fd9b8f3

SHA512
739e6056e250f77daa6d3c11378670bd6724ce17630450262daa82426bc7901814352eb04c118b654dca58ead79528e3a04ea4c2b14e8cf3a903cbafdc24daa5

Download Submit
C:\Windows\System\NpRViAY.exe

Filesize
1.9MB

MD5
dfc8f951e328430308715f94768713a2

SHA1
5839577de32605697dc29bbcfe4618a7ab443089

SHA256
2b53ea820614f69061eb99abf1738177aaa3e709c473cd2ff57a4732a51fda5f

SHA512
e0871f2189729437626b97d91836e3f3853e4bfbefb2221a234d5916a529593d495fd6ed69cf4b24834e24d48eccdf68cfb39befe8c7b6f25fa7b5d4b9403bfb

Download Submit
C:\Windows\System\OsvFMQY.exe

Filesize
1.9MB

MD5
1444061d8170c571cfb5282467c4a717

SHA1
fb1fec6498ed1d485283ebe25a2937eb179abdd8

SHA256
6751e2594e11212a4e6827abcf8961430d89b4bcd9c77e80fcf73cb2b59ddd01

SHA512
50856b1dba8810c7003cbcce53ba7217c5ff7d16656c2329efe169204ddff60e89dd44d00357d579017d983941dd0fe705fe5fd43fc62c0e72ce636777e11e95

Download Submit
C:\Windows\System\RAVoNQA.exe

Filesize
1.9MB

MD5
23e458833af77fa6021e755c99f7071e

SHA1
bb9bbe38a5c537b9ae3ac4a7777ec90477e4cc5a

SHA256
f8ae24507a48af2d5680826e0ea614550da56f7d166f2293737e502a1cf71dbd

SHA512
c2ae03cf9d7ccc30c52d8e6697578ad069f190693b0996001641983b179484de378d770166d3cff6b6cd39b777f8ece6899e0939aa4ce4ff7069093602ecd95e

Download Submit
C:\Windows\System\SHUvZxz.exe

Filesize
1.9MB

MD5
7161f240b2be6bdbb847270fa44a7e43

SHA1
da9f53459899074444eb1b243d670b3b0ccf33a8

SHA256
bac0c48381f4f463b921f7a0a1a9de5e4d94732e2fe1d9ff9334ef52d663970c

SHA512
1be89836455560dd2a3882e18629d241cef677c20786100ddce1485a1b9480bb3739f4343273e00c20e4b611d26282c93f495c49072ebad7c3727f935fe2ee82

Download Submit
C:\Windows\System\SlACBpf.exe

Filesize
1.9MB

MD5
c9d5f768a77135d460e542d41b725bd7

SHA1
3677584a7c03c84d1f7009fb8588f4cd06b78e41

SHA256
682542e87faa71bb414fb8b0d478776904dd0e49b71e52db7055aa071ef68341

SHA512
7246fc4f3d98e33104c8f8681630fe40a491dc5334021f65f3c783f2ea2a25a73c90dab17180fca9c052d2d813dbfc0876b738aa426d5cd871e3b81890212f27

Download Submit
C:\Windows\System\URpRSmd.exe

Filesize
1.9MB

MD5
0187ea3fc4adabc96a08fb64699dbdb3

SHA1
1aad4ed4bd5c99b1b333427331328abcb7f46e5d

SHA256
78288ab44551bea06c95e37aa51b14944f9de1f1abad51eeed5805f957c3d36f

SHA512
5bde6d42c528598e4176484646c97c488cc2795d5c417bd24b26dd7c7b92733f4bdec6add6c84140e4a0d3f0720439e9434c54a89b3282f86332ab9be56b2e91

Download Submit
C:\Windows\System\WWkEcMR.exe

Filesize
1.9MB

MD5
9814022591290d82e19462baac00da93

SHA1
c76bfd38ff7dbdb09cdaab324f78bcee7b4b4d85

SHA256
0d4247aa1d15f0d9ab2a524b50e310cc7befcf70301aff42080feb43caeb1680

SHA512
532458e1ab08d1e6dc3375b16c0dc8eacafe6e7c41c3e67f8cd77eb9803de578da4bfa70ac9130be7f70cf1533e158aac2d56f9fc6c3f553facaeaaeb3e398a8

Download Submit
C:\Windows\System\WxdKXnn.exe

Filesize
1.9MB

MD5
aaa38916dc6d8fc0e05f47c8ab6925d3

SHA1
6e2648b44c0c3e2726ed13b4bd8db3f1f097e93c

SHA256
cc849970ec62f2a8bb2be4aac54fae5bfc4afcad9a7c51fca198bdb9d0a0eec8

SHA512
6f8a309dabbcb23188e05cd19999b8e313204077bcfe9ced4ba8ebffec16a9da7eaf7e0d7e336469b08ab223ee15699e69dbbc18b9c249bab2c67cc3806a9b20

Download Submit
C:\Windows\System\XRnaszo.exe

Filesize
1.9MB

MD5
541ff4036e755a22795627d8c717673a

SHA1
db0a559a50f0b65bd271afeb70cae4aa2f4569e8

SHA256
d28a84255901cd764bd1e634492cd4fa197d43e8af9e02cca30006b19ba45bad

SHA512
3b097a35700971d0ad63fea53a54ad02823196bf2bc510a6e9f0c6835afd9d53212acf4497de83af64e51441647f476d359353f59dc06f11dc5ac45e074f6313

Download Submit
C:\Windows\System\YmWegkl.exe

Filesize
1.9MB

MD5
eac736f195524cca54783761f5d26d37

SHA1
efbc0513b831ee784ae71064929452dbb21a033b

SHA256
1c421339f0be6910fe0550490203e1107779b0204d27a2cea0c499a32babe7a3

SHA512
56d2a0921d0f1e954398c14966b17a8604f3355100f9fb046a505e422f22361ab45ebd257487b78b77cf0aea3734340a67b15e26d402d256284bf20e34ad9929

Download Submit
C:\Windows\System\cMnFKqi.exe

Filesize
1.9MB

MD5
2e92d789d018155d88a066575fbec9cc

SHA1
379d84ffed73ed81426ecfbbeed5ae9959be7d6d

SHA256
393fe6fca78f8f416858c9d24b7ce1cd77f0a4ca9cf149e2660622cf2455ddbb

SHA512
945b56367f8d3a73424b2f52598b88873aed01239f603c90206cbe2f752f4547e010a6d44e0052151d295d1781ad5aea18f715294734c1060c9801cae25513eb

Download Submit
C:\Windows\System\dsvgsxh.exe

Filesize
1.9MB

MD5
7095e2038f0c8b7e7164d39fa9d586c2

SHA1
8a30343d7ea5d03c5a2542ed31cd86398ae62911

SHA256
9363587dbfbc80e759daa02e0135fbbf7b70e20861532ed4732c518383f9e4dd

SHA512
8e12105d7e649a799cb3c7e61493cd93ae329f82e60435b348dca8d0e39d4573d212f22a74dc3208ebf58203727f021265120476d7cb12df5806158bda1c4506

Download Submit
C:\Windows\System\dtkTGlb.exe

Filesize
1.9MB

MD5
518f639d92a3c789893b989dc4dd85e2

SHA1
08ea8cba070ab0776cf9c2bf3e72452550cc5a24

SHA256
6f215f73fc54bfb70696a5a815579e00d534d553428750ec6b4654ab5b982747

SHA512
9825b03ba70acb7a568c2aa5e48ca2b753685845b846a6faed3a9e103666d426c57a597d0b8731aead8a022eb16b7015227a0fca9845c232b1598fd8acdcbdbd

Download Submit
C:\Windows\System\gSEwstx.exe

Filesize
1.9MB

MD5
08d8a5d1207cfe2bad7de1cd902c6d4c

SHA1
17ec174696f9f89c9f6429b78370edd34f050b02

SHA256
6969e585b5134c8ffab42dfdb48385e5bb454c9b1db2743f8913446ec092586b

SHA512
c30a14f354333125a5659751c1240558ab854c76199bf3edfb58ebee6449623e7b41b802cbf2cf080c2e3450183359e60bdcbd99762c49eb36302aed3bd360a7

Download Submit
C:\Windows\System\gXIDlFl.exe

Filesize
1.9MB

MD5
4f4229138d9d4bbb7dfa6e95df9d2301

SHA1
da317af0dc88ede52757ef7d61cb79dc9bfbbf53

SHA256
024181847c0b81d32fdf4bb751c92f7fa46603a2fa02c453f48280a359580a48

SHA512
f34ad5f75ea8f6c91fc1d166848310b38a14e17aa12dd0b0ae56777468d452389c4e0c379063d3035e060dd3179f05aecb99bb164139aceb344cb62aa7e8a48a

Download Submit
C:\Windows\System\hhWcwBd.exe

Filesize
1.9MB

MD5
7609b63302f50b95f600c23cf8809917

SHA1
b8512cdd265b3c607d71950f9848da86fe01da84

SHA256
463439f5ca9bf8396d95580417b1682d032ea4787b1e68611ed636e3d0a965bf

SHA512
ef9e446b8d4760f91d80d64b3223b6e5eb9404dc682451d5cf9d9142bb3a11c990fd0c3862c7e7eb078c6fa4ec08141cf8ca42f19f24bae9a96e9b6b81b5a773

Download Submit
C:\Windows\System\lpiEFSW.exe

Filesize
1.9MB

MD5
0da93b62075d2550662a18c62baa1983

SHA1
acf641079e9dfdd8898c2cc485fa4b6a1ae1ee17

SHA256
263baebb8ec319f98b8eca3c02152085c17c5149caddc245c1160f45f690910b

SHA512
57f60ccdf258f2050daf35ba00e3779f9fc787cda061629bb0f40ad6eff435bd010604d9e381ee25515f0de7ac7539e57c702529fab086977cf1ed37cbf66d6e

Download Submit
C:\Windows\System\lsqMWjy.exe

Filesize
1.9MB

MD5
1d8fa749a89eac3fcfe929812cb9a43e

SHA1
24376e637a0fd7fa98356b3e9f61f455503cea2b

SHA256
2e726d7469877b16b75543afe379a76be7f9b442edb8a648be6f202ba2d48ed4

SHA512
e968349073f7ecc5bbd566cf3596de9420dae142550f63722af984e006333d584097df9668cdac78fdfe9e8519bd305807d0afc6df11e99717ccbe2dd2e59f79

Download Submit
C:\Windows\System\mgwMRBV.exe

Filesize
1.9MB

MD5
9a6437699ca33d541fe934d90f227a96

SHA1
69f7abc32347839db0f2b30510ff0471a5123f85

SHA256
192156efcb2d6bd52e38e96a5bc5d9079af9a955a6b273a854383d574d56c343

SHA512
724f9e827d35830e381c885741bef35b47d54b7dc61af841a6b83bba0afaab08818c05df9f2369afc7066c2ad1c7756229af5ec57f474b4d7212d438864a950d

Download Submit
C:\Windows\System\oTMtsSB.exe

Filesize
1.9MB

MD5
214776472aec0dcd20f8a2d9295c192a

SHA1
28a0de607ea307d9f602b93f79e09ac27c878224

SHA256
604ff3e5ef7bc313888fcb83107aa1ec660a86af726f51a4bda667d5bd528a28

SHA512
184d82e4487932440ea2d0a543e98aaaa5abbbf1dd863c5ad96221ea8ab2cad354423369d6b7ab88ce3978c0e4724e1ed318deeebc9479a60048ccde88e3a207

Download Submit
C:\Windows\System\qTerlcW.exe

Filesize
1.9MB

MD5
3ee04e50d18d2e0c1e58115bc97b0af8

SHA1
a7b2f14182db9539dcdf1db1f44e2e1bd0378f03

SHA256
6e8fb4b7c6e39f610a2b169038686179fabae890465599f5a0fe60d5083ae80f

SHA512
114dfaa40969b0874dc68bda6c423e794c973783049e2d1996c7d8cbe50a57a07e22e7076ef675a9dcb8e1d50c48eb3852408e809357546ab71fb5f03d7de24f

Download Submit
C:\Windows\System\uOpwUNl.exe

Filesize
1.9MB

MD5
80ad301e4c8c95f7299eaf3202970167

SHA1
fb50e488ae42099440bfda536471f3b865cec18b

SHA256
f0e65cc862cd7140abad9baa76ca94d2ea656228b9d6fd37ebf1cc0dcaf6c073

SHA512
83905a449c8af258980fcd35b633349bb1e7194d3c4b69b764f1bec9c21c7a014c686458feb246bef4686aea96f09d1e2ac3e694a3ca8b8132e9b2e15ffd66da

Download Submit
C:\Windows\System\uUbvthl.exe

Filesize
1.9MB

MD5
acb3941b1825574a4dd4c9fd87c851e5

SHA1
258fabe787aedc9238e182f14d64a5c41314f161

SHA256
46b7049b6985415e056239284d7234e99a2a07963e32ee820fe7fcd4ca140e72

SHA512
3a71f72abb81a711e8ea29b446b6b3b41d5f492105553b682afa7208f64555251c8ec9d88b0efc65a88160dcb5e53134e058497a50a2d62d861d4dfbd05b9dc2

Download Submit
C:\Windows\System\vmglVxF.exe

Filesize
1.9MB

MD5
910ecdf4fbc37715a0665ff183d9e222

SHA1
44de3b1efaff8e84f132230bf97593cfd6bde54b

SHA256
c39a4e4ed0d5370d9fc7bea5a9c7517c44c1d5660603908b2a116d2c916450e0

SHA512
7ea7d2da1866eb894e89aa730c580eab617d95463137e9f045a5f30716c35171bbdf788d998d04fdd7445cbd686248e023a08d6796a6890ad69a6a375039a34f

Download Submit
C:\Windows\System\wjERXNy.exe

Filesize
1.9MB

MD5
b805018708a10a070cf2ee14887fe4ce

SHA1
cd12894b006b5091e1dd3e1aafcee6a9c1983260

SHA256
4ad965697e14db7fcc9bf640c245489b73ac9f3e651972895f44f979dfb6388b

SHA512
3ca53e2e01f640408c7d85b6b1e4ec252de8fc2639104072a35f345d66d88e4e3eaecb4d4a3da75b54135ba113b917ed9979acd1594130f9ac681984277c6904

Download Submit
C:\Windows\System\yVBYKZa.exe

Filesize
1.9MB

MD5
b4a3f138a9c94d28f8a86e1dfc2483a7

SHA1
6152e80c7ae878ffaadf5a7d03298ae4698aa3ff

SHA256
7364425ac29504728cd392a55105d7c6bc23fd99f7087d21475d6066b40d29aa

SHA512
304bcacb9a5ecd7f3c279a567f52ec44cabc679059b8b07cd8bff88b82765b960a3fb9af64e89dfc4d6f3e4be5e36430303a299197cc53f59132b014bb66d05c

Download Submit
memory/1072-4152-0x00007FF657700000-0x00007FF657AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-132-0x00007FF657700000-0x00007FF657AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-209-0x00007FF786E10000-0x00007FF787202000-memory.dmp

Filesize
3.9MB

Download
memory/1084-4208-0x00007FF786E10000-0x00007FF787202000-memory.dmp

Filesize
3.9MB

Download
memory/1124-206-0x00007FF7299A0000-0x00007FF729D92000-memory.dmp

Filesize
3.9MB

Download
memory/1124-4203-0x00007FF7299A0000-0x00007FF729D92000-memory.dmp

Filesize
3.9MB

Download
memory/1220-210-0x00007FF7A5A30000-0x00007FF7A5E22000-memory.dmp

Filesize
3.9MB

Download
memory/1220-4178-0x00007FF7A5A30000-0x00007FF7A5E22000-memory.dmp

Filesize
3.9MB

Download
memory/1580-4216-0x00007FF62E790000-0x00007FF62EB82000-memory.dmp

Filesize
3.9MB

Download
memory/1580-220-0x00007FF62E790000-0x00007FF62EB82000-memory.dmp

Filesize
3.9MB

Download
memory/1632-96-0x00007FF703B50000-0x00007FF703F42000-memory.dmp

Filesize
3.9MB

Download
memory/1712-218-0x00007FF6DEAE0000-0x00007FF6DEED2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-4180-0x00007FF6DEAE0000-0x00007FF6DEED2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-219-0x00007FF621A50000-0x00007FF621E42000-memory.dmp

Filesize
3.9MB

Download
memory/1916-4173-0x00007FF621A50000-0x00007FF621E42000-memory.dmp

Filesize
3.9MB

Download
memory/2040-215-0x00007FF631730000-0x00007FF631B22000-memory.dmp

Filesize
3.9MB

Download
memory/2040-4224-0x00007FF631730000-0x00007FF631B22000-memory.dmp

Filesize
3.9MB

Download
memory/2192-185-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-4165-0x00007FF6205F0000-0x00007FF6209E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-205-0x00007FF6CEEB0000-0x00007FF6CF2A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-4204-0x00007FF6CEEB0000-0x00007FF6CF2A2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-213-0x00007FF62B630000-0x00007FF62BA22000-memory.dmp

Filesize
3.9MB

Download
memory/2816-4174-0x00007FF62B630000-0x00007FF62BA22000-memory.dmp

Filesize
3.9MB

Download
memory/3076-216-0x00007FF6FD2B0000-0x00007FF6FD6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-4226-0x00007FF6FD2B0000-0x00007FF6FD6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-4183-0x00007FF675AA0000-0x00007FF675E92000-memory.dmp

Filesize
3.9MB

Download
memory/3212-207-0x00007FF675AA0000-0x00007FF675E92000-memory.dmp

Filesize
3.9MB

Download
memory/3540-217-0x00007FF65B360000-0x00007FF65B752000-memory.dmp

Filesize
3.9MB

Download
memory/3652-212-0x00007FF699440000-0x00007FF699832000-memory.dmp

Filesize
3.9MB

Download
memory/3652-4187-0x00007FF699440000-0x00007FF699832000-memory.dmp

Filesize
3.9MB

Download
memory/3864-4641-0x00007FF728FE0000-0x00007FF7293D2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-1-0x00000203C1060000-0x00000203C1070000-memory.dmp

Filesize
64KB

Download
memory/3864-0-0x00007FF728FE0000-0x00007FF7293D2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-145-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-4159-0x00007FF6734B0000-0x00007FF6738A2000-memory.dmp

Filesize
3.9MB

Download
memory/4128-193-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp

Filesize
3.9MB

Download
memory/4128-4166-0x00007FF6DEC60000-0x00007FF6DF052000-memory.dmp

Filesize
3.9MB

Download
memory/4132-4212-0x00007FF6DCEF0000-0x00007FF6DD2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4132-214-0x00007FF6DCEF0000-0x00007FF6DD2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-4188-0x00007FF601850000-0x00007FF601C42000-memory.dmp

Filesize
3.9MB

Download
memory/4176-201-0x00007FF601850000-0x00007FF601C42000-memory.dmp

Filesize
3.9MB

Download
memory/4520-34-0x00007FF7555C0000-0x00007FF7559B2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-4232-0x00007FF714F70000-0x00007FF715362000-memory.dmp

Filesize
3.9MB

Download
memory/4728-211-0x00007FF714F70000-0x00007FF715362000-memory.dmp

Filesize
3.9MB

Download
memory/4828-28-0x00007FFE5B090000-0x00007FFE5B3E5000-memory.dmp

Filesize
3.3MB

Download
memory/4828-131-0x00007FFE5B090000-0x00007FFE5B3E5000-memory.dmp

Filesize
3.3MB

Download
memory/4828-296-0x00000266D6540000-0x00000266D6CE6000-memory.dmp

Filesize
7.6MB

Download
memory/4828-53-0x00007FFE5B090000-0x00007FFE5B3E5000-memory.dmp

Filesize
3.3MB

Download
memory/4828-176-0x00000266D55F0000-0x00000266D5612000-memory.dmp

Filesize
136KB

Download
memory/5020-4198-0x00007FF696AB0000-0x00007FF696EA2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-202-0x00007FF696AB0000-0x00007FF696EA2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-191-0x00007FF762E90000-0x00007FF763282000-memory.dmp

Filesize
3.9MB

Download
memory/5116-4143-0x00007FF762E90000-0x00007FF763282000-memory.dmp

Filesize
3.9MB

Download