xmrig | 34f23a5f6637cff79da74acd8147515467729c5be03652cac9095e0add76c92a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
Size

1.9MB
MD5

0cc3d4d05974303bd82b6ff27573dc0f
SHA1

8096b365e4a25e13f35b584396a819505668252c
SHA256

34f23a5f6637cff79da74acd8147515467729c5be03652cac9095e0add76c92a
SHA512

3519fe7b35e53862a5c3b82f821936670600edc1f734dcd5d547dfa352d9788ae39c78c6ba0381a5b51eefc5f0336729e257dbbda60ecc81e14b735610c33a07
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1e:NABT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4268-156-0x00007FF6DF3A0000-0x00007FF6DF792000-memory.dmp	xmrig
behavioral2/memory/2184-175-0x00007FF7AF7D0000-0x00007FF7AFBC2000-memory.dmp	xmrig
behavioral2/memory/1916-187-0x00007FF761580000-0x00007FF761972000-memory.dmp	xmrig
behavioral2/memory/680-186-0x00007FF6470C0000-0x00007FF6474B2000-memory.dmp	xmrig
behavioral2/memory/404-182-0x00007FF72D5A0000-0x00007FF72D992000-memory.dmp	xmrig
behavioral2/memory/3340-181-0x00007FF67CFA0000-0x00007FF67D392000-memory.dmp	xmrig
behavioral2/memory/4932-179-0x00007FF63B5B0000-0x00007FF63B9A2000-memory.dmp	xmrig
behavioral2/memory/4240-178-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp	xmrig
behavioral2/memory/4104-177-0x00007FF6F0400000-0x00007FF6F07F2000-memory.dmp	xmrig
behavioral2/memory/1300-176-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	xmrig
behavioral2/memory/2260-174-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp	xmrig
behavioral2/memory/5020-173-0x00007FF7DEEB0000-0x00007FF7DF2A2000-memory.dmp	xmrig
behavioral2/memory/2112-172-0x00007FF639EE0000-0x00007FF63A2D2000-memory.dmp	xmrig
behavioral2/memory/2196-171-0x00007FF6B1B60000-0x00007FF6B1F52000-memory.dmp	xmrig
behavioral2/memory/4852-170-0x00007FF649700000-0x00007FF649AF2000-memory.dmp	xmrig
behavioral2/memory/4980-150-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp	xmrig
behavioral2/memory/888-148-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp	xmrig
behavioral2/memory/4816-138-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp	xmrig
behavioral2/memory/3500-109-0x00007FF67F530000-0x00007FF67F922000-memory.dmp	xmrig
behavioral2/memory/888-4341-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp	xmrig
behavioral2/memory/4816-4347-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp	xmrig
behavioral2/memory/4980-4351-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp	xmrig
behavioral2/memory/2260-4355-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp	xmrig
behavioral2/memory/4852-4373-0x00007FF649700000-0x00007FF649AF2000-memory.dmp	xmrig
behavioral2/memory/4240-4370-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp	xmrig
behavioral2/memory/4932-4367-0x00007FF63B5B0000-0x00007FF63B9A2000-memory.dmp	xmrig
behavioral2/memory/4104-4361-0x00007FF6F0400000-0x00007FF6F07F2000-memory.dmp	xmrig
behavioral2/memory/5020-4369-0x00007FF7DEEB0000-0x00007FF7DF2A2000-memory.dmp	xmrig
behavioral2/memory/4268-4365-0x00007FF6DF3A0000-0x00007FF6DF792000-memory.dmp	xmrig
behavioral2/memory/2184-4362-0x00007FF7AF7D0000-0x00007FF7AFBC2000-memory.dmp	xmrig
behavioral2/memory/404-4403-0x00007FF72D5A0000-0x00007FF72D992000-memory.dmp	xmrig
behavioral2/memory/3340-4407-0x00007FF67CFA0000-0x00007FF67D392000-memory.dmp	xmrig
behavioral2/memory/2196-4376-0x00007FF6B1B60000-0x00007FF6B1F52000-memory.dmp	xmrig
behavioral2/memory/2112-4395-0x00007FF639EE0000-0x00007FF63A2D2000-memory.dmp	xmrig
behavioral2/memory/1916-4388-0x00007FF761580000-0x00007FF761972000-memory.dmp	xmrig
behavioral2/memory/1300-4382-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	xmrig
behavioral2/memory/3428-4819-0x00007FF688590000-0x00007FF688982000-memory.dmp	xmrig
behavioral2/memory/3952-4992-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp	xmrig
behavioral2/memory/2256-4990-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp	xmrig
behavioral2/memory/2788-4998-0x00007FF72D110000-0x00007FF72D502000-memory.dmp	xmrig
behavioral2/memory/2256-5049-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp	xmrig
behavioral2/memory/2788-5063-0x00007FF72D110000-0x00007FF72D502000-memory.dmp	xmrig
behavioral2/memory/4072-5052-0x00007FF6B7060000-0x00007FF6B7452000-memory.dmp	xmrig
behavioral2/memory/3952-5075-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp	xmrig
behavioral2/memory/4536-5082-0x00007FF773CB0000-0x00007FF7740A2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	1468	powershell.exe
13	1468	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3500	UMjkboM.exe
680	kuSAnmZ.exe
4816	RozlJsx.exe
888	cOjWSbG.exe
4980	TYGrwkG.exe
4268	EHpoOJS.exe
4852	RlYlyhi.exe
2196	fTqbzuo.exe
1916	LUkAUHg.exe
2112	cXGAAiC.exe
5020	VwFILcw.exe
2260	dgMboLg.exe
2184	kCLBpnk.exe
1300	ZDmLbVx.exe
4104	yuHZUgn.exe
4240	yBFtbKZ.exe
4932	szRguBJ.exe
4072	APSQhEP.exe
4536	vUTZplI.exe
3340	xVSqETY.exe
404	FbRFekv.exe
2256	yuUUBFw.exe
3952	FIrwdWZ.exe
2788	kPiKezR.exe
3476	VxlOPqz.exe
4452	DTZmdno.exe
1240	gcvRYfB.exe
1116	LjHjQUt.exe
1568	PQRztDP.exe
4460	nJQzNnf.exe
3816	KRAjppJ.exe
1104	xvxKFaW.exe
3704	mKrTSCw.exe
4628	oowDiOH.exe
4180	gfkvbpI.exe
2988	QDbwamj.exe
220	DYBLxWw.exe
3372	lbopxTD.exe
3556	oKltBaU.exe
4360	cfjNYhw.exe
2804	pzUoWnw.exe
4172	WbSKUGU.exe
4780	SVpayLL.exe
2520	jJJHmVv.exe
3152	mjWvXGM.exe
4592	VesxxWJ.exe
1080	yZXpIrJ.exe
2080	jMQbuQp.exe
2500	ktcdITZ.exe
1208	HvOBXUR.exe
1688	HryBvcT.exe
2648	lnIcpDt.exe
880	YRlZOrB.exe
2336	gNrzlbP.exe
4492	lmszruJ.exe
1992	YhgbKMs.exe
3800	HSVZiAP.exe
3192	smnDEhI.exe
2564	oQuzpxz.exe
4892	PnUnrcB.exe
664	CbfaHMn.exe
3836	TOSpEmQ.exe
5056	rswrPEs.exe
2784	eiXzuAS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3428-0-0x00007FF688590000-0x00007FF688982000-memory.dmp	upx
behavioral2/files/0x000c000000023b50-7.dat	upx
behavioral2/files/0x000a000000023bb0-53.dat	upx
behavioral2/files/0x0031000000023bb4-75.dat	upx
behavioral2/files/0x000a000000023bbe-123.dat	upx
behavioral2/files/0x000a000000023bbf-143.dat	upx
behavioral2/memory/4268-156-0x00007FF6DF3A0000-0x00007FF6DF792000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-169.dat	upx
behavioral2/memory/2184-175-0x00007FF7AF7D0000-0x00007FF7AFBC2000-memory.dmp	upx
behavioral2/memory/4536-180-0x00007FF773CB0000-0x00007FF7740A2000-memory.dmp	upx
behavioral2/memory/2788-185-0x00007FF72D110000-0x00007FF72D502000-memory.dmp	upx
behavioral2/memory/4072-188-0x00007FF6B7060000-0x00007FF6B7452000-memory.dmp	upx
behavioral2/memory/1916-187-0x00007FF761580000-0x00007FF761972000-memory.dmp	upx
behavioral2/memory/680-186-0x00007FF6470C0000-0x00007FF6474B2000-memory.dmp	upx
behavioral2/memory/3952-184-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp	upx
behavioral2/memory/2256-183-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp	upx
behavioral2/memory/404-182-0x00007FF72D5A0000-0x00007FF72D992000-memory.dmp	upx
behavioral2/memory/3340-181-0x00007FF67CFA0000-0x00007FF67D392000-memory.dmp	upx
behavioral2/memory/4932-179-0x00007FF63B5B0000-0x00007FF63B9A2000-memory.dmp	upx
behavioral2/memory/4240-178-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp	upx
behavioral2/memory/4104-177-0x00007FF6F0400000-0x00007FF6F07F2000-memory.dmp	upx
behavioral2/memory/1300-176-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	upx
behavioral2/memory/2260-174-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp	upx
behavioral2/memory/5020-173-0x00007FF7DEEB0000-0x00007FF7DF2A2000-memory.dmp	upx
behavioral2/memory/2112-172-0x00007FF639EE0000-0x00007FF63A2D2000-memory.dmp	upx
behavioral2/memory/2196-171-0x00007FF6B1B60000-0x00007FF6B1F52000-memory.dmp	upx
behavioral2/memory/4852-170-0x00007FF649700000-0x00007FF649AF2000-memory.dmp	upx
behavioral2/files/0x000b000000023baa-168.dat	upx
behavioral2/files/0x000a000000023bc9-167.dat	upx
behavioral2/files/0x000b000000023bc3-166.dat	upx
behavioral2/files/0x000a000000023bc4-165.dat	upx
behavioral2/files/0x000a000000023bc8-164.dat	upx
behavioral2/files/0x000a000000023bc7-163.dat	upx
behavioral2/files/0x000a000000023bc6-162.dat	upx
behavioral2/files/0x000a000000023bbd-161.dat	upx
behavioral2/files/0x000a000000023bca-155.dat	upx
behavioral2/files/0x000a000000023bc1-154.dat	upx
behavioral2/files/0x000a000000023bc0-153.dat	upx
behavioral2/files/0x000a000000023bbc-152.dat	upx
behavioral2/memory/4980-150-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp	upx
behavioral2/memory/888-148-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp	upx
behavioral2/memory/4816-138-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-132.dat	upx
behavioral2/files/0x000a000000023bb8-117.dat	upx
behavioral2/files/0x000a000000023bb9-116.dat	upx
behavioral2/files/0x000a000000023bb7-112.dat	upx
behavioral2/memory/3500-109-0x00007FF67F530000-0x00007FF67F922000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-90.dat	upx
behavioral2/files/0x000a000000023bba-87.dat	upx
behavioral2/files/0x0031000000023bb5-82.dat	upx
behavioral2/files/0x000a000000023bb3-70.dat	upx
behavioral2/files/0x000a000000023bb1-65.dat	upx
behavioral2/files/0x0031000000023bb6-58.dat	upx
behavioral2/files/0x000a000000023bb2-69.dat	upx
behavioral2/files/0x000a000000023baf-36.dat	upx
behavioral2/files/0x000a000000023bad-22.dat	upx
behavioral2/files/0x000a000000023bae-21.dat	upx
behavioral2/files/0x000c000000023ba9-18.dat	upx
behavioral2/memory/888-4341-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp	upx
behavioral2/memory/4816-4347-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp	upx
behavioral2/memory/4980-4351-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp	upx
behavioral2/memory/2260-4355-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp	upx
behavioral2/memory/4852-4373-0x00007FF649700000-0x00007FF649AF2000-memory.dmp	upx
behavioral2/memory/4240-4370-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WdEQdwi.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\gahfFkG.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\HChMQSL.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ckwxVWJ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\iDKdUTo.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\GzOfWgd.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\QdOpwMX.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\JuOPcIa.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\teuNwSR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ctNFcEi.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\OXCzTpx.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\hMlhlDZ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\cNeBTvc.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\LEtOMsQ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\kzwYfou.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\fogObXS.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\CyvNheF.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\HdDYcop.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\JsutDrH.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\zOcXwzI.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\YczqSjA.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\IctQfKo.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\duKPAtX.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\cHrgwSW.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ggbTgZR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\pkgRswH.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\OdWbFBj.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\VRiNBcn.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\cVCZZMF.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\YLnQovR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\SzNrgmR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\wFKsiws.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\RdZQNut.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\wNKZHGX.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\tABTYru.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ChVgxQc.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\HbEPICN.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\wnVXnBv.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\hWrPDrQ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\GmqKzRt.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\JaGWQwL.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\OXuLRrq.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\GMfcMvv.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\TmSJPEm.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\DYBLxWw.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\IswqqMB.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\SXsnJZg.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\FKRSwPq.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\uJKdDSD.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\MgeICIu.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\IqkhVuf.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\addnVcI.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\hSeJhdJ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\wjNdUDu.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\xDDRheP.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\TZlLDlt.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\DAyHPtL.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ptOhArZ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\fKLZmeq.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\yzZbxav.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\EjdIoIR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\VDmeuRp.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\TimrCGW.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\LziLpby.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1468	powershell.exe
1468	powershell.exe
1468	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeLockMemoryPrivilege	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 1468	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	85
PID 3428 wrote to memory of 1468	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	85
PID 3428 wrote to memory of 3500	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	86
PID 3428 wrote to memory of 3500	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	86
PID 3428 wrote to memory of 680	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	87
PID 3428 wrote to memory of 680	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	87
PID 3428 wrote to memory of 4816	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	88
PID 3428 wrote to memory of 4816	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	88
PID 3428 wrote to memory of 888	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	89
PID 3428 wrote to memory of 888	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	89
PID 3428 wrote to memory of 4980	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	90
PID 3428 wrote to memory of 4980	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	90
PID 3428 wrote to memory of 2112	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	91
PID 3428 wrote to memory of 2112	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	91
PID 3428 wrote to memory of 4268	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	92
PID 3428 wrote to memory of 4268	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	92
PID 3428 wrote to memory of 4852	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	93
PID 3428 wrote to memory of 4852	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	93
PID 3428 wrote to memory of 2196	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	94
PID 3428 wrote to memory of 2196	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	94
PID 3428 wrote to memory of 1916	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	95
PID 3428 wrote to memory of 1916	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	95
PID 3428 wrote to memory of 5020	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	96
PID 3428 wrote to memory of 5020	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	96
PID 3428 wrote to memory of 2260	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	97
PID 3428 wrote to memory of 2260	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	97
PID 3428 wrote to memory of 2184	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	98
PID 3428 wrote to memory of 2184	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	98
PID 3428 wrote to memory of 1300	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	99
PID 3428 wrote to memory of 1300	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	99
PID 3428 wrote to memory of 4104	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	100
PID 3428 wrote to memory of 4104	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	100
PID 3428 wrote to memory of 4240	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	101
PID 3428 wrote to memory of 4240	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	101
PID 3428 wrote to memory of 4932	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	102
PID 3428 wrote to memory of 4932	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	102
PID 3428 wrote to memory of 4072	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	103
PID 3428 wrote to memory of 4072	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	103
PID 3428 wrote to memory of 4536	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	104
PID 3428 wrote to memory of 4536	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	104
PID 3428 wrote to memory of 3340	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	105
PID 3428 wrote to memory of 3340	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	105
PID 3428 wrote to memory of 404	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	106
PID 3428 wrote to memory of 404	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	106
PID 3428 wrote to memory of 2256	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	107
PID 3428 wrote to memory of 2256	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	107
PID 3428 wrote to memory of 3952	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	108
PID 3428 wrote to memory of 3952	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	108
PID 3428 wrote to memory of 2788	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	109
PID 3428 wrote to memory of 2788	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	109
PID 3428 wrote to memory of 3476	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	110
PID 3428 wrote to memory of 3476	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	110
PID 3428 wrote to memory of 4452	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	111
PID 3428 wrote to memory of 4452	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	111
PID 3428 wrote to memory of 1240	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	112
PID 3428 wrote to memory of 1240	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	112
PID 3428 wrote to memory of 1116	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	113
PID 3428 wrote to memory of 1116	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	113
PID 3428 wrote to memory of 1568	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	114
PID 3428 wrote to memory of 1568	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	114
PID 3428 wrote to memory of 4460	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	115
PID 3428 wrote to memory of 4460	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	115
PID 3428 wrote to memory of 3816	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	116
PID 3428 wrote to memory of 3816	3428	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1468" "2964" "2888" "2968" "0" "0" "2972" "0" "0" "0" "0" "0"
    3⤵
    PID:13176
- C:\Windows\System\UMjkboM.exe
  C:\Windows\System\UMjkboM.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\kuSAnmZ.exe
  C:\Windows\System\kuSAnmZ.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\RozlJsx.exe
  C:\Windows\System\RozlJsx.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\cOjWSbG.exe
  C:\Windows\System\cOjWSbG.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\TYGrwkG.exe
  C:\Windows\System\TYGrwkG.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\cXGAAiC.exe
  C:\Windows\System\cXGAAiC.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\EHpoOJS.exe
  C:\Windows\System\EHpoOJS.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\RlYlyhi.exe
  C:\Windows\System\RlYlyhi.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\fTqbzuo.exe
  C:\Windows\System\fTqbzuo.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LUkAUHg.exe
  C:\Windows\System\LUkAUHg.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\VwFILcw.exe
  C:\Windows\System\VwFILcw.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\dgMboLg.exe
  C:\Windows\System\dgMboLg.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\kCLBpnk.exe
  C:\Windows\System\kCLBpnk.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ZDmLbVx.exe
  C:\Windows\System\ZDmLbVx.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yuHZUgn.exe
  C:\Windows\System\yuHZUgn.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\yBFtbKZ.exe
  C:\Windows\System\yBFtbKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\szRguBJ.exe
  C:\Windows\System\szRguBJ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\APSQhEP.exe
  C:\Windows\System\APSQhEP.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\vUTZplI.exe
  C:\Windows\System\vUTZplI.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\xVSqETY.exe
  C:\Windows\System\xVSqETY.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\FbRFekv.exe
  C:\Windows\System\FbRFekv.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\yuUUBFw.exe
  C:\Windows\System\yuUUBFw.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FIrwdWZ.exe
  C:\Windows\System\FIrwdWZ.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\kPiKezR.exe
  C:\Windows\System\kPiKezR.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\VxlOPqz.exe
  C:\Windows\System\VxlOPqz.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\DTZmdno.exe
  C:\Windows\System\DTZmdno.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\gcvRYfB.exe
  C:\Windows\System\gcvRYfB.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\LjHjQUt.exe
  C:\Windows\System\LjHjQUt.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\PQRztDP.exe
  C:\Windows\System\PQRztDP.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\nJQzNnf.exe
  C:\Windows\System\nJQzNnf.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\KRAjppJ.exe
  C:\Windows\System\KRAjppJ.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\xvxKFaW.exe
  C:\Windows\System\xvxKFaW.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\mKrTSCw.exe
  C:\Windows\System\mKrTSCw.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\oowDiOH.exe
  C:\Windows\System\oowDiOH.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\gfkvbpI.exe
  C:\Windows\System\gfkvbpI.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\QDbwamj.exe
  C:\Windows\System\QDbwamj.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DYBLxWw.exe
  C:\Windows\System\DYBLxWw.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\lbopxTD.exe
  C:\Windows\System\lbopxTD.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\oKltBaU.exe
  C:\Windows\System\oKltBaU.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\cfjNYhw.exe
  C:\Windows\System\cfjNYhw.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\pzUoWnw.exe
  C:\Windows\System\pzUoWnw.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jJJHmVv.exe
  C:\Windows\System\jJJHmVv.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\WbSKUGU.exe
  C:\Windows\System\WbSKUGU.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\SVpayLL.exe
  C:\Windows\System\SVpayLL.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\HvOBXUR.exe
  C:\Windows\System\HvOBXUR.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\mjWvXGM.exe
  C:\Windows\System\mjWvXGM.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\VesxxWJ.exe
  C:\Windows\System\VesxxWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\yZXpIrJ.exe
  C:\Windows\System\yZXpIrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\jMQbuQp.exe
  C:\Windows\System\jMQbuQp.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\lnIcpDt.exe
  C:\Windows\System\lnIcpDt.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ktcdITZ.exe
  C:\Windows\System\ktcdITZ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HryBvcT.exe
  C:\Windows\System\HryBvcT.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\lmszruJ.exe
  C:\Windows\System\lmszruJ.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\YRlZOrB.exe
  C:\Windows\System\YRlZOrB.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\gNrzlbP.exe
  C:\Windows\System\gNrzlbP.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\TOSpEmQ.exe
  C:\Windows\System\TOSpEmQ.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\YhgbKMs.exe
  C:\Windows\System\YhgbKMs.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\HSVZiAP.exe
  C:\Windows\System\HSVZiAP.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\smnDEhI.exe
  C:\Windows\System\smnDEhI.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\oQuzpxz.exe
  C:\Windows\System\oQuzpxz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\PnUnrcB.exe
  C:\Windows\System\PnUnrcB.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\CbfaHMn.exe
  C:\Windows\System\CbfaHMn.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\rswrPEs.exe
  C:\Windows\System\rswrPEs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\eiXzuAS.exe
  C:\Windows\System\eiXzuAS.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\IURywTa.exe
  C:\Windows\System\IURywTa.exe
  2⤵
  PID:3672
- C:\Windows\System\raLUsdA.exe
  C:\Windows\System\raLUsdA.exe
  2⤵
  PID:3872
- C:\Windows\System\jBNvPHS.exe
  C:\Windows\System\jBNvPHS.exe
  2⤵
  PID:1416
- C:\Windows\System\bwRXeQC.exe
  C:\Windows\System\bwRXeQC.exe
  2⤵
  PID:3296
- C:\Windows\System\BqAiiOJ.exe
  C:\Windows\System\BqAiiOJ.exe
  2⤵
  PID:5060
- C:\Windows\System\GrZDYLZ.exe
  C:\Windows\System\GrZDYLZ.exe
  2⤵
  PID:1700
- C:\Windows\System\cUcitep.exe
  C:\Windows\System\cUcitep.exe
  2⤵
  PID:4804
- C:\Windows\System\PzaLFbQ.exe
  C:\Windows\System\PzaLFbQ.exe
  2⤵
  PID:4216
- C:\Windows\System\JLJxSNF.exe
  C:\Windows\System\JLJxSNF.exe
  2⤵
  PID:4064
- C:\Windows\System\YqQcuwn.exe
  C:\Windows\System\YqQcuwn.exe
  2⤵
  PID:3788
- C:\Windows\System\cFIrdal.exe
  C:\Windows\System\cFIrdal.exe
  2⤵
  PID:4944
- C:\Windows\System\mhIpxtO.exe
  C:\Windows\System\mhIpxtO.exe
  2⤵
  PID:920
- C:\Windows\System\pAeFyex.exe
  C:\Windows\System\pAeFyex.exe
  2⤵
  PID:712
- C:\Windows\System\QTGRXIx.exe
  C:\Windows\System\QTGRXIx.exe
  2⤵
  PID:532
- C:\Windows\System\HPpoHGa.exe
  C:\Windows\System\HPpoHGa.exe
  2⤵
  PID:5068
- C:\Windows\System\WFLSoBB.exe
  C:\Windows\System\WFLSoBB.exe
  2⤵
  PID:2152
- C:\Windows\System\FHiIXRN.exe
  C:\Windows\System\FHiIXRN.exe
  2⤵
  PID:396
- C:\Windows\System\XwtmoIi.exe
  C:\Windows\System\XwtmoIi.exe
  2⤵
  PID:5080
- C:\Windows\System\WYJHHAM.exe
  C:\Windows\System\WYJHHAM.exe
  2⤵
  PID:4352
- C:\Windows\System\MaGWCzc.exe
  C:\Windows\System\MaGWCzc.exe
  2⤵
  PID:1824
- C:\Windows\System\xJkmNid.exe
  C:\Windows\System\xJkmNid.exe
  2⤵
  PID:1412
- C:\Windows\System\JuqRRrZ.exe
  C:\Windows\System\JuqRRrZ.exe
  2⤵
  PID:2096
- C:\Windows\System\HPyQtgP.exe
  C:\Windows\System\HPyQtgP.exe
  2⤵
  PID:2176
- C:\Windows\System\hpCyHOn.exe
  C:\Windows\System\hpCyHOn.exe
  2⤵
  PID:1652
- C:\Windows\System\FLYLCuG.exe
  C:\Windows\System\FLYLCuG.exe
  2⤵
  PID:1716
- C:\Windows\System\JkoYGdk.exe
  C:\Windows\System\JkoYGdk.exe
  2⤵
  PID:3388
- C:\Windows\System\UfRHCks.exe
  C:\Windows\System\UfRHCks.exe
  2⤵
  PID:1504
- C:\Windows\System\jJUsiPW.exe
  C:\Windows\System\jJUsiPW.exe
  2⤵
  PID:3392
- C:\Windows\System\kjiBscE.exe
  C:\Windows\System\kjiBscE.exe
  2⤵
  PID:3512
- C:\Windows\System\UvYsqUm.exe
  C:\Windows\System\UvYsqUm.exe
  2⤵
  PID:5160
- C:\Windows\System\suazAXP.exe
  C:\Windows\System\suazAXP.exe
  2⤵
  PID:5180
- C:\Windows\System\IPpoPBx.exe
  C:\Windows\System\IPpoPBx.exe
  2⤵
  PID:5200
- C:\Windows\System\uENiEZo.exe
  C:\Windows\System\uENiEZo.exe
  2⤵
  PID:5220
- C:\Windows\System\VXbhSto.exe
  C:\Windows\System\VXbhSto.exe
  2⤵
  PID:5236
- C:\Windows\System\gnjjoNc.exe
  C:\Windows\System\gnjjoNc.exe
  2⤵
  PID:5268
- C:\Windows\System\EVfiUiy.exe
  C:\Windows\System\EVfiUiy.exe
  2⤵
  PID:5292
- C:\Windows\System\UvLuLaU.exe
  C:\Windows\System\UvLuLaU.exe
  2⤵
  PID:5324
- C:\Windows\System\XGACCQg.exe
  C:\Windows\System\XGACCQg.exe
  2⤵
  PID:5348
- C:\Windows\System\DRLmDYq.exe
  C:\Windows\System\DRLmDYq.exe
  2⤵
  PID:5372
- C:\Windows\System\eYAchHp.exe
  C:\Windows\System\eYAchHp.exe
  2⤵
  PID:5392
- C:\Windows\System\ekSVNXI.exe
  C:\Windows\System\ekSVNXI.exe
  2⤵
  PID:5416
- C:\Windows\System\ohpKcDT.exe
  C:\Windows\System\ohpKcDT.exe
  2⤵
  PID:5432
- C:\Windows\System\wCyBLqm.exe
  C:\Windows\System\wCyBLqm.exe
  2⤵
  PID:5460
- C:\Windows\System\ungznau.exe
  C:\Windows\System\ungznau.exe
  2⤵
  PID:5480
- C:\Windows\System\SMXWGFJ.exe
  C:\Windows\System\SMXWGFJ.exe
  2⤵
  PID:5504
- C:\Windows\System\cTRQvPp.exe
  C:\Windows\System\cTRQvPp.exe
  2⤵
  PID:5520
- C:\Windows\System\mdcpKzn.exe
  C:\Windows\System\mdcpKzn.exe
  2⤵
  PID:5544
- C:\Windows\System\WiCtqkh.exe
  C:\Windows\System\WiCtqkh.exe
  2⤵
  PID:5568
- C:\Windows\System\BbxoVwv.exe
  C:\Windows\System\BbxoVwv.exe
  2⤵
  PID:5588
- C:\Windows\System\iCdPmHI.exe
  C:\Windows\System\iCdPmHI.exe
  2⤵
  PID:5616
- C:\Windows\System\tIQopWs.exe
  C:\Windows\System\tIQopWs.exe
  2⤵
  PID:5632
- C:\Windows\System\zSjaDfB.exe
  C:\Windows\System\zSjaDfB.exe
  2⤵
  PID:5656
- C:\Windows\System\BlHHODE.exe
  C:\Windows\System\BlHHODE.exe
  2⤵
  PID:5672
- C:\Windows\System\csdHwNk.exe
  C:\Windows\System\csdHwNk.exe
  2⤵
  PID:5700
- C:\Windows\System\tdRqBGV.exe
  C:\Windows\System\tdRqBGV.exe
  2⤵
  PID:5728
- C:\Windows\System\lIwDHWi.exe
  C:\Windows\System\lIwDHWi.exe
  2⤵
  PID:5752
- C:\Windows\System\ODmyRGQ.exe
  C:\Windows\System\ODmyRGQ.exe
  2⤵
  PID:5772
- C:\Windows\System\JADzfVs.exe
  C:\Windows\System\JADzfVs.exe
  2⤵
  PID:5800
- C:\Windows\System\wuqJPcE.exe
  C:\Windows\System\wuqJPcE.exe
  2⤵
  PID:5816
- C:\Windows\System\bnZWDiM.exe
  C:\Windows\System\bnZWDiM.exe
  2⤵
  PID:5840
- C:\Windows\System\iIgqdeV.exe
  C:\Windows\System\iIgqdeV.exe
  2⤵
  PID:5856
- C:\Windows\System\KASysqK.exe
  C:\Windows\System\KASysqK.exe
  2⤵
  PID:5880
- C:\Windows\System\GXPEzGL.exe
  C:\Windows\System\GXPEzGL.exe
  2⤵
  PID:5900
- C:\Windows\System\FzvRdhG.exe
  C:\Windows\System\FzvRdhG.exe
  2⤵
  PID:5920
- C:\Windows\System\toQuAhX.exe
  C:\Windows\System\toQuAhX.exe
  2⤵
  PID:5940
- C:\Windows\System\GEUrepc.exe
  C:\Windows\System\GEUrepc.exe
  2⤵
  PID:5960
- C:\Windows\System\Tlmcvgq.exe
  C:\Windows\System\Tlmcvgq.exe
  2⤵
  PID:5984
- C:\Windows\System\YsaZtAG.exe
  C:\Windows\System\YsaZtAG.exe
  2⤵
  PID:6012
- C:\Windows\System\xjyKsxd.exe
  C:\Windows\System\xjyKsxd.exe
  2⤵
  PID:6032
- C:\Windows\System\dwutzEk.exe
  C:\Windows\System\dwutzEk.exe
  2⤵
  PID:6052
- C:\Windows\System\BbVVLRw.exe
  C:\Windows\System\BbVVLRw.exe
  2⤵
  PID:6076
- C:\Windows\System\nHZwoVs.exe
  C:\Windows\System\nHZwoVs.exe
  2⤵
  PID:6096
- C:\Windows\System\oEadrGW.exe
  C:\Windows\System\oEadrGW.exe
  2⤵
  PID:6124
- C:\Windows\System\AcDHZYf.exe
  C:\Windows\System\AcDHZYf.exe
  2⤵
  PID:1624
- C:\Windows\System\ShMixZN.exe
  C:\Windows\System\ShMixZN.exe
  2⤵
  PID:1092
- C:\Windows\System\tvuByxN.exe
  C:\Windows\System\tvuByxN.exe
  2⤵
  PID:5128
- C:\Windows\System\eMCtcvU.exe
  C:\Windows\System\eMCtcvU.exe
  2⤵
  PID:708
- C:\Windows\System\grbFHXq.exe
  C:\Windows\System\grbFHXq.exe
  2⤵
  PID:4012
- C:\Windows\System\QUihVuC.exe
  C:\Windows\System\QUihVuC.exe
  2⤵
  PID:4404
- C:\Windows\System\aoKmSMu.exe
  C:\Windows\System\aoKmSMu.exe
  2⤵
  PID:5144
- C:\Windows\System\TTBCzQt.exe
  C:\Windows\System\TTBCzQt.exe
  2⤵
  PID:5428
- C:\Windows\System\BWoLEBv.exe
  C:\Windows\System\BWoLEBv.exe
  2⤵
  PID:5196
- C:\Windows\System\VyupHfS.exe
  C:\Windows\System\VyupHfS.exe
  2⤵
  PID:624
- C:\Windows\System\wogJXRV.exe
  C:\Windows\System\wogJXRV.exe
  2⤵
  PID:5552
- C:\Windows\System\AFEKdJR.exe
  C:\Windows\System\AFEKdJR.exe
  2⤵
  PID:5032
- C:\Windows\System\lvDEssu.exe
  C:\Windows\System\lvDEssu.exe
  2⤵
  PID:5300
- C:\Windows\System\DrcyEhd.exe
  C:\Windows\System\DrcyEhd.exe
  2⤵
  PID:4116
- C:\Windows\System\BOfNFGc.exe
  C:\Windows\System\BOfNFGc.exe
  2⤵
  PID:5472
- C:\Windows\System\TpmFBxS.exe
  C:\Windows\System\TpmFBxS.exe
  2⤵
  PID:5260
- C:\Windows\System\SfWKIoW.exe
  C:\Windows\System\SfWKIoW.exe
  2⤵
  PID:5952
- C:\Windows\System\jFwlBVI.exe
  C:\Windows\System\jFwlBVI.exe
  2⤵
  PID:5664
- C:\Windows\System\UgGKXVY.exe
  C:\Windows\System\UgGKXVY.exe
  2⤵
  PID:5400
- C:\Windows\System\RgguJVU.exe
  C:\Windows\System\RgguJVU.exe
  2⤵
  PID:5408
- C:\Windows\System\zwaKvIu.exe
  C:\Windows\System\zwaKvIu.exe
  2⤵
  PID:6040
- C:\Windows\System\vzWeKMk.exe
  C:\Windows\System\vzWeKMk.exe
  2⤵
  PID:5500
- C:\Windows\System\HWxqXJG.exe
  C:\Windows\System\HWxqXJG.exe
  2⤵
  PID:5836
- C:\Windows\System\QveHqOI.exe
  C:\Windows\System\QveHqOI.exe
  2⤵
  PID:5784
- C:\Windows\System\NYCKGtY.exe
  C:\Windows\System\NYCKGtY.exe
  2⤵
  PID:5872
- C:\Windows\System\mKPHmGj.exe
  C:\Windows\System\mKPHmGj.exe
  2⤵
  PID:6156
- C:\Windows\System\RmpRVRk.exe
  C:\Windows\System\RmpRVRk.exe
  2⤵
  PID:6172
- C:\Windows\System\MZeZerR.exe
  C:\Windows\System\MZeZerR.exe
  2⤵
  PID:6200
- C:\Windows\System\LFzwTjV.exe
  C:\Windows\System\LFzwTjV.exe
  2⤵
  PID:6232
- C:\Windows\System\LHPoJNx.exe
  C:\Windows\System\LHPoJNx.exe
  2⤵
  PID:6252
- C:\Windows\System\IARnDGs.exe
  C:\Windows\System\IARnDGs.exe
  2⤵
  PID:6276
- C:\Windows\System\DdenCCF.exe
  C:\Windows\System\DdenCCF.exe
  2⤵
  PID:6300
- C:\Windows\System\YrktjPV.exe
  C:\Windows\System\YrktjPV.exe
  2⤵
  PID:6324
- C:\Windows\System\CnuHHca.exe
  C:\Windows\System\CnuHHca.exe
  2⤵
  PID:6340
- C:\Windows\System\HNlizXN.exe
  C:\Windows\System\HNlizXN.exe
  2⤵
  PID:6364
- C:\Windows\System\QglgLBX.exe
  C:\Windows\System\QglgLBX.exe
  2⤵
  PID:6392
- C:\Windows\System\DoSTqLR.exe
  C:\Windows\System\DoSTqLR.exe
  2⤵
  PID:6408
- C:\Windows\System\tUdXVHM.exe
  C:\Windows\System\tUdXVHM.exe
  2⤵
  PID:6432
- C:\Windows\System\ZXBKVSj.exe
  C:\Windows\System\ZXBKVSj.exe
  2⤵
  PID:6452
- C:\Windows\System\fVGCuOZ.exe
  C:\Windows\System\fVGCuOZ.exe
  2⤵
  PID:6472
- C:\Windows\System\mYGuhYs.exe
  C:\Windows\System\mYGuhYs.exe
  2⤵
  PID:6492
- C:\Windows\System\yaccMWN.exe
  C:\Windows\System\yaccMWN.exe
  2⤵
  PID:6516
- C:\Windows\System\DKudxZs.exe
  C:\Windows\System\DKudxZs.exe
  2⤵
  PID:6532
- C:\Windows\System\wWefKQx.exe
  C:\Windows\System\wWefKQx.exe
  2⤵
  PID:6556
- C:\Windows\System\cPajMFz.exe
  C:\Windows\System\cPajMFz.exe
  2⤵
  PID:6584
- C:\Windows\System\DJejwlz.exe
  C:\Windows\System\DJejwlz.exe
  2⤵
  PID:6604
- C:\Windows\System\nIfIAuF.exe
  C:\Windows\System\nIfIAuF.exe
  2⤵
  PID:6628
- C:\Windows\System\miDnjGU.exe
  C:\Windows\System\miDnjGU.exe
  2⤵
  PID:6644
- C:\Windows\System\FkSlqKH.exe
  C:\Windows\System\FkSlqKH.exe
  2⤵
  PID:6668
- C:\Windows\System\GNlDarF.exe
  C:\Windows\System\GNlDarF.exe
  2⤵
  PID:6696
- C:\Windows\System\qWfXkJa.exe
  C:\Windows\System\qWfXkJa.exe
  2⤵
  PID:6724
- C:\Windows\System\cZflYrQ.exe
  C:\Windows\System\cZflYrQ.exe
  2⤵
  PID:6740
- C:\Windows\System\DWorQgK.exe
  C:\Windows\System\DWorQgK.exe
  2⤵
  PID:6764
- C:\Windows\System\JHsLHWb.exe
  C:\Windows\System\JHsLHWb.exe
  2⤵
  PID:6780
- C:\Windows\System\LXHSdjo.exe
  C:\Windows\System\LXHSdjo.exe
  2⤵
  PID:6804
- C:\Windows\System\LBqUjWx.exe
  C:\Windows\System\LBqUjWx.exe
  2⤵
  PID:6824
- C:\Windows\System\TBtKVxz.exe
  C:\Windows\System\TBtKVxz.exe
  2⤵
  PID:6844
- C:\Windows\System\IzkOHds.exe
  C:\Windows\System\IzkOHds.exe
  2⤵
  PID:6860
- C:\Windows\System\CYRycKP.exe
  C:\Windows\System\CYRycKP.exe
  2⤵
  PID:6884
- C:\Windows\System\hCldIoU.exe
  C:\Windows\System\hCldIoU.exe
  2⤵
  PID:6900
- C:\Windows\System\dJysaaP.exe
  C:\Windows\System\dJysaaP.exe
  2⤵
  PID:6928
- C:\Windows\System\sCUiNfy.exe
  C:\Windows\System\sCUiNfy.exe
  2⤵
  PID:6948
- C:\Windows\System\DyMdNtO.exe
  C:\Windows\System\DyMdNtO.exe
  2⤵
  PID:6972
- C:\Windows\System\EmtqIGq.exe
  C:\Windows\System\EmtqIGq.exe
  2⤵
  PID:6988
- C:\Windows\System\vLDBZyS.exe
  C:\Windows\System\vLDBZyS.exe
  2⤵
  PID:7012
- C:\Windows\System\DkwZOdW.exe
  C:\Windows\System\DkwZOdW.exe
  2⤵
  PID:7036
- C:\Windows\System\AFuWFsM.exe
  C:\Windows\System\AFuWFsM.exe
  2⤵
  PID:7052
- C:\Windows\System\mniUfoZ.exe
  C:\Windows\System\mniUfoZ.exe
  2⤵
  PID:7076
- C:\Windows\System\WYXuaHj.exe
  C:\Windows\System\WYXuaHj.exe
  2⤵
  PID:7100
- C:\Windows\System\Tapnapp.exe
  C:\Windows\System\Tapnapp.exe
  2⤵
  PID:7124
- C:\Windows\System\YemHhkO.exe
  C:\Windows\System\YemHhkO.exe
  2⤵
  PID:7148
- C:\Windows\System\ywKVmqN.exe
  C:\Windows\System\ywKVmqN.exe
  2⤵
  PID:7164
- C:\Windows\System\TAXUdab.exe
  C:\Windows\System\TAXUdab.exe
  2⤵
  PID:5668
- C:\Windows\System\TboekTe.exe
  C:\Windows\System\TboekTe.exe
  2⤵
  PID:6004
- C:\Windows\System\NiFcsWu.exe
  C:\Windows\System\NiFcsWu.exe
  2⤵
  PID:5628
- C:\Windows\System\zoLCKsv.exe
  C:\Windows\System\zoLCKsv.exe
  2⤵
  PID:5792
- C:\Windows\System\qQSACcX.exe
  C:\Windows\System\qQSACcX.exe
  2⤵
  PID:5928
- C:\Windows\System\sjXBTBG.exe
  C:\Windows\System\sjXBTBG.exe
  2⤵
  PID:5824
- C:\Windows\System\MSEUcOa.exe
  C:\Windows\System\MSEUcOa.exe
  2⤵
  PID:5892
- C:\Windows\System\BENQXqi.exe
  C:\Windows\System\BENQXqi.exe
  2⤵
  PID:6192
- C:\Windows\System\yAhEgED.exe
  C:\Windows\System\yAhEgED.exe
  2⤵
  PID:5212
- C:\Windows\System\RSrqanz.exe
  C:\Windows\System\RSrqanz.exe
  2⤵
  PID:5424
- C:\Windows\System\OcTBUim.exe
  C:\Windows\System\OcTBUim.exe
  2⤵
  PID:1696
- C:\Windows\System\wPKXuQN.exe
  C:\Windows\System\wPKXuQN.exe
  2⤵
  PID:5172
- C:\Windows\System\qbbWXCC.exe
  C:\Windows\System\qbbWXCC.exe
  2⤵
  PID:5356
- C:\Windows\System\DJsdWYm.exe
  C:\Windows\System\DJsdWYm.exe
  2⤵
  PID:6788
- C:\Windows\System\UzBPLxt.exe
  C:\Windows\System\UzBPLxt.exe
  2⤵
  PID:6816
- C:\Windows\System\qeoWjaE.exe
  C:\Windows\System\qeoWjaE.exe
  2⤵
  PID:6856
- C:\Windows\System\QJBuwRC.exe
  C:\Windows\System\QJBuwRC.exe
  2⤵
  PID:5252
- C:\Windows\System\cIbKBTM.exe
  C:\Windows\System\cIbKBTM.exe
  2⤵
  PID:6920
- C:\Windows\System\flpfhLf.exe
  C:\Windows\System\flpfhLf.exe
  2⤵
  PID:6336
- C:\Windows\System\wuAkmdd.exe
  C:\Windows\System\wuAkmdd.exe
  2⤵
  PID:5576
- C:\Windows\System\PZbkLVy.exe
  C:\Windows\System\PZbkLVy.exe
  2⤵
  PID:6984
- C:\Windows\System\gLGYWEQ.exe
  C:\Windows\System\gLGYWEQ.exe
  2⤵
  PID:7044
- C:\Windows\System\RWaCCZl.exe
  C:\Windows\System\RWaCCZl.exe
  2⤵
  PID:6400
- C:\Windows\System\mfoLarC.exe
  C:\Windows\System\mfoLarC.exe
  2⤵
  PID:5380
- C:\Windows\System\OIsXQfV.exe
  C:\Windows\System\OIsXQfV.exe
  2⤵
  PID:5740
- C:\Windows\System\nYKipyc.exe
  C:\Windows\System\nYKipyc.exe
  2⤵
  PID:5320
- C:\Windows\System\xcsiqfs.exe
  C:\Windows\System\xcsiqfs.exe
  2⤵
  PID:6640
- C:\Windows\System\iyHhQjb.exe
  C:\Windows\System\iyHhQjb.exe
  2⤵
  PID:6688
- C:\Windows\System\jJFDlte.exe
  C:\Windows\System\jJFDlte.exe
  2⤵
  PID:6712
- C:\Windows\System\EMlukRW.exe
  C:\Windows\System\EMlukRW.exe
  2⤵
  PID:6212
- C:\Windows\System\TtQloMQ.exe
  C:\Windows\System\TtQloMQ.exe
  2⤵
  PID:6836
- C:\Windows\System\fJoKTnT.exe
  C:\Windows\System\fJoKTnT.exe
  2⤵
  PID:6940
- C:\Windows\System\FNXMVun.exe
  C:\Windows\System\FNXMVun.exe
  2⤵
  PID:7184
- C:\Windows\System\lyzfzmo.exe
  C:\Windows\System\lyzfzmo.exe
  2⤵
  PID:7208
- C:\Windows\System\RrcOXVy.exe
  C:\Windows\System\RrcOXVy.exe
  2⤵
  PID:7224
- C:\Windows\System\ynCHgKJ.exe
  C:\Windows\System\ynCHgKJ.exe
  2⤵
  PID:7248
- C:\Windows\System\KfvwooW.exe
  C:\Windows\System\KfvwooW.exe
  2⤵
  PID:7268
- C:\Windows\System\ChoFeZc.exe
  C:\Windows\System\ChoFeZc.exe
  2⤵
  PID:7288
- C:\Windows\System\AbiAymz.exe
  C:\Windows\System\AbiAymz.exe
  2⤵
  PID:7304
- C:\Windows\System\flFRgdE.exe
  C:\Windows\System\flFRgdE.exe
  2⤵
  PID:7328
- C:\Windows\System\VTcSSsh.exe
  C:\Windows\System\VTcSSsh.exe
  2⤵
  PID:7348
- C:\Windows\System\MbgIjYZ.exe
  C:\Windows\System\MbgIjYZ.exe
  2⤵
  PID:7368
- C:\Windows\System\KOaxLXE.exe
  C:\Windows\System\KOaxLXE.exe
  2⤵
  PID:7384
- C:\Windows\System\tnfIsaM.exe
  C:\Windows\System\tnfIsaM.exe
  2⤵
  PID:7408
- C:\Windows\System\JpbtnAu.exe
  C:\Windows\System\JpbtnAu.exe
  2⤵
  PID:7428
- C:\Windows\System\erLolpa.exe
  C:\Windows\System\erLolpa.exe
  2⤵
  PID:7448
- C:\Windows\System\slAzSeY.exe
  C:\Windows\System\slAzSeY.exe
  2⤵
  PID:7464
- C:\Windows\System\CDJgRSQ.exe
  C:\Windows\System\CDJgRSQ.exe
  2⤵
  PID:7488
- C:\Windows\System\YUOUdWY.exe
  C:\Windows\System\YUOUdWY.exe
  2⤵
  PID:7508
- C:\Windows\System\LISfxyz.exe
  C:\Windows\System\LISfxyz.exe
  2⤵
  PID:7528
- C:\Windows\System\FtvYtfc.exe
  C:\Windows\System\FtvYtfc.exe
  2⤵
  PID:7556
- C:\Windows\System\ogDjlMU.exe
  C:\Windows\System\ogDjlMU.exe
  2⤵
  PID:7576
- C:\Windows\System\WjjJbwO.exe
  C:\Windows\System\WjjJbwO.exe
  2⤵
  PID:7596
- C:\Windows\System\fOdVmQt.exe
  C:\Windows\System\fOdVmQt.exe
  2⤵
  PID:7620
- C:\Windows\System\lYvGvgy.exe
  C:\Windows\System\lYvGvgy.exe
  2⤵
  PID:7640
- C:\Windows\System\acOtIkz.exe
  C:\Windows\System\acOtIkz.exe
  2⤵
  PID:7664
- C:\Windows\System\JWbTmIv.exe
  C:\Windows\System\JWbTmIv.exe
  2⤵
  PID:7688
- C:\Windows\System\IeovAiR.exe
  C:\Windows\System\IeovAiR.exe
  2⤵
  PID:7704
- C:\Windows\System\hYwpcVH.exe
  C:\Windows\System\hYwpcVH.exe
  2⤵
  PID:7728
- C:\Windows\System\RUJDriQ.exe
  C:\Windows\System\RUJDriQ.exe
  2⤵
  PID:7748
- C:\Windows\System\QCyOErw.exe
  C:\Windows\System\QCyOErw.exe
  2⤵
  PID:7768
- C:\Windows\System\XsavnnZ.exe
  C:\Windows\System\XsavnnZ.exe
  2⤵
  PID:7792
- C:\Windows\System\OWhmypH.exe
  C:\Windows\System\OWhmypH.exe
  2⤵
  PID:7816
- C:\Windows\System\SKWxoel.exe
  C:\Windows\System\SKWxoel.exe
  2⤵
  PID:7836
- C:\Windows\System\PoGooYE.exe
  C:\Windows\System\PoGooYE.exe
  2⤵
  PID:7860
- C:\Windows\System\oHKDisI.exe
  C:\Windows\System\oHKDisI.exe
  2⤵
  PID:7888
- C:\Windows\System\XZsaPem.exe
  C:\Windows\System\XZsaPem.exe
  2⤵
  PID:7904
- C:\Windows\System\huDGEBT.exe
  C:\Windows\System\huDGEBT.exe
  2⤵
  PID:7924
- C:\Windows\System\ZmrCTmI.exe
  C:\Windows\System\ZmrCTmI.exe
  2⤵
  PID:7948
- C:\Windows\System\eIdKQnM.exe
  C:\Windows\System\eIdKQnM.exe
  2⤵
  PID:7968
- C:\Windows\System\XshqYfv.exe
  C:\Windows\System\XshqYfv.exe
  2⤵
  PID:7992
- C:\Windows\System\RYvpbrW.exe
  C:\Windows\System\RYvpbrW.exe
  2⤵
  PID:8016
- C:\Windows\System\FIYZgct.exe
  C:\Windows\System\FIYZgct.exe
  2⤵
  PID:8036
- C:\Windows\System\etrYTlY.exe
  C:\Windows\System\etrYTlY.exe
  2⤵
  PID:8064
- C:\Windows\System\FYBXHdU.exe
  C:\Windows\System\FYBXHdU.exe
  2⤵
  PID:8092
- C:\Windows\System\nVIcJvR.exe
  C:\Windows\System\nVIcJvR.exe
  2⤵
  PID:8108
- C:\Windows\System\LeqQJrK.exe
  C:\Windows\System\LeqQJrK.exe
  2⤵
  PID:8128
- C:\Windows\System\tEdHPqw.exe
  C:\Windows\System\tEdHPqw.exe
  2⤵
  PID:8148
- C:\Windows\System\FSiTtOS.exe
  C:\Windows\System\FSiTtOS.exe
  2⤵
  PID:8172
- C:\Windows\System\FuZSjJQ.exe
  C:\Windows\System\FuZSjJQ.exe
  2⤵
  PID:6420
- C:\Windows\System\bjkzDjq.exe
  C:\Windows\System\bjkzDjq.exe
  2⤵
  PID:6464
- C:\Windows\System\NkOJyJv.exe
  C:\Windows\System\NkOJyJv.exe
  2⤵
  PID:6508
- C:\Windows\System\fcDtQni.exe
  C:\Windows\System\fcDtQni.exe
  2⤵
  PID:6540
- C:\Windows\System\SRzCkXz.exe
  C:\Windows\System\SRzCkXz.exe
  2⤵
  PID:6048
- C:\Windows\System\tBaeSuv.exe
  C:\Windows\System\tBaeSuv.exe
  2⤵
  PID:7008
- C:\Windows\System\GfypvWL.exe
  C:\Windows\System\GfypvWL.exe
  2⤵
  PID:5808
- C:\Windows\System\qbTMrlA.exe
  C:\Windows\System\qbTMrlA.exe
  2⤵
  PID:6620
- C:\Windows\System\CeUdivb.exe
  C:\Windows\System\CeUdivb.exe
  2⤵
  PID:5716
- C:\Windows\System\AQoZqTb.exe
  C:\Windows\System\AQoZqTb.exe
  2⤵
  PID:6832
- C:\Windows\System\zyykHNR.exe
  C:\Windows\System\zyykHNR.exe
  2⤵
  PID:8216
- C:\Windows\System\ALlUUqj.exe
  C:\Windows\System\ALlUUqj.exe
  2⤵
  PID:8236
- C:\Windows\System\evRRjZV.exe
  C:\Windows\System\evRRjZV.exe
  2⤵
  PID:8256
- C:\Windows\System\gjCROSf.exe
  C:\Windows\System\gjCROSf.exe
  2⤵
  PID:8276
- C:\Windows\System\VdbXmiv.exe
  C:\Windows\System\VdbXmiv.exe
  2⤵
  PID:8300
- C:\Windows\System\lXUxdbL.exe
  C:\Windows\System\lXUxdbL.exe
  2⤵
  PID:8324
- C:\Windows\System\YZAfGSS.exe
  C:\Windows\System\YZAfGSS.exe
  2⤵
  PID:8344
- C:\Windows\System\XpsSuwX.exe
  C:\Windows\System\XpsSuwX.exe
  2⤵
  PID:8376
- C:\Windows\System\YpPisny.exe
  C:\Windows\System\YpPisny.exe
  2⤵
  PID:8396
- C:\Windows\System\rsIUsUZ.exe
  C:\Windows\System\rsIUsUZ.exe
  2⤵
  PID:8420
- C:\Windows\System\zKCanoy.exe
  C:\Windows\System\zKCanoy.exe
  2⤵
  PID:8440
- C:\Windows\System\JvBLKta.exe
  C:\Windows\System\JvBLKta.exe
  2⤵
  PID:8460
- C:\Windows\System\bWBFDtK.exe
  C:\Windows\System\bWBFDtK.exe
  2⤵
  PID:8476
- C:\Windows\System\EcdFUsD.exe
  C:\Windows\System\EcdFUsD.exe
  2⤵
  PID:8496
- C:\Windows\System\CBuNUvk.exe
  C:\Windows\System\CBuNUvk.exe
  2⤵
  PID:8516
- C:\Windows\System\nUDjfrU.exe
  C:\Windows\System\nUDjfrU.exe
  2⤵
  PID:8536
- C:\Windows\System\MTvlVQX.exe
  C:\Windows\System\MTvlVQX.exe
  2⤵
  PID:8556
- C:\Windows\System\kmgyKHa.exe
  C:\Windows\System\kmgyKHa.exe
  2⤵
  PID:8584
- C:\Windows\System\iRrPVxv.exe
  C:\Windows\System\iRrPVxv.exe
  2⤵
  PID:8604
- C:\Windows\System\xAtKNOa.exe
  C:\Windows\System\xAtKNOa.exe
  2⤵
  PID:8620
- C:\Windows\System\QMBijbK.exe
  C:\Windows\System\QMBijbK.exe
  2⤵
  PID:8636
- C:\Windows\System\kesvARj.exe
  C:\Windows\System\kesvARj.exe
  2⤵
  PID:8656
- C:\Windows\System\uxXVvYm.exe
  C:\Windows\System\uxXVvYm.exe
  2⤵
  PID:8680
- C:\Windows\System\YOLqOHg.exe
  C:\Windows\System\YOLqOHg.exe
  2⤵
  PID:8696
- C:\Windows\System\REcHUsd.exe
  C:\Windows\System\REcHUsd.exe
  2⤵
  PID:8724
- C:\Windows\System\JWSjunZ.exe
  C:\Windows\System\JWSjunZ.exe
  2⤵
  PID:8744
- C:\Windows\System\ilmRHtb.exe
  C:\Windows\System\ilmRHtb.exe
  2⤵
  PID:8764
- C:\Windows\System\ouXjTYC.exe
  C:\Windows\System\ouXjTYC.exe
  2⤵
  PID:8792
- C:\Windows\System\EOlNJfw.exe
  C:\Windows\System\EOlNJfw.exe
  2⤵
  PID:8812
- C:\Windows\System\nASCilo.exe
  C:\Windows\System\nASCilo.exe
  2⤵
  PID:8828
- C:\Windows\System\cUaOTFA.exe
  C:\Windows\System\cUaOTFA.exe
  2⤵
  PID:8852
- C:\Windows\System\TbzxgLb.exe
  C:\Windows\System\TbzxgLb.exe
  2⤵
  PID:8880
- C:\Windows\System\fesRjjT.exe
  C:\Windows\System\fesRjjT.exe
  2⤵
  PID:8900
- C:\Windows\System\jIQqyiK.exe
  C:\Windows\System\jIQqyiK.exe
  2⤵
  PID:8920
- C:\Windows\System\nNdlAUS.exe
  C:\Windows\System\nNdlAUS.exe
  2⤵
  PID:8948
- C:\Windows\System\oVOmtpB.exe
  C:\Windows\System\oVOmtpB.exe
  2⤵
  PID:8968
- C:\Windows\System\IoQZuPB.exe
  C:\Windows\System\IoQZuPB.exe
  2⤵
  PID:8988
- C:\Windows\System\vQIGTOb.exe
  C:\Windows\System\vQIGTOb.exe
  2⤵
  PID:9016
- C:\Windows\System\MBPgJcJ.exe
  C:\Windows\System\MBPgJcJ.exe
  2⤵
  PID:9040
- C:\Windows\System\bnxkQXk.exe
  C:\Windows\System\bnxkQXk.exe
  2⤵
  PID:9064
- C:\Windows\System\ghQDlNh.exe
  C:\Windows\System\ghQDlNh.exe
  2⤵
  PID:9088
- C:\Windows\System\WIVZtsL.exe
  C:\Windows\System\WIVZtsL.exe
  2⤵
  PID:9104
- C:\Windows\System\hivVPRx.exe
  C:\Windows\System\hivVPRx.exe
  2⤵
  PID:9128
- C:\Windows\System\stDOLSO.exe
  C:\Windows\System\stDOLSO.exe
  2⤵
  PID:9160
- C:\Windows\System\BtdJBMb.exe
  C:\Windows\System\BtdJBMb.exe
  2⤵
  PID:9180
- C:\Windows\System\MtugqwW.exe
  C:\Windows\System\MtugqwW.exe
  2⤵
  PID:9204
- C:\Windows\System\qgHATVa.exe
  C:\Windows\System\qgHATVa.exe
  2⤵
  PID:7072
- C:\Windows\System\DrPVulu.exe
  C:\Windows\System\DrPVulu.exe
  2⤵
  PID:7196
- C:\Windows\System\aLOEZBD.exe
  C:\Windows\System\aLOEZBD.exe
  2⤵
  PID:7220
- C:\Windows\System\Rlqiqqu.exe
  C:\Windows\System\Rlqiqqu.exe
  2⤵
  PID:7264
- C:\Windows\System\VuKYoGL.exe
  C:\Windows\System\VuKYoGL.exe
  2⤵
  PID:6360
- C:\Windows\System\NJCvzLO.exe
  C:\Windows\System\NJCvzLO.exe
  2⤵
  PID:9236
- C:\Windows\System\vnbOmfB.exe
  C:\Windows\System\vnbOmfB.exe
  2⤵
  PID:9256
- C:\Windows\System\YtOrEvK.exe
  C:\Windows\System\YtOrEvK.exe
  2⤵
  PID:9280
- C:\Windows\System\mbMYqGt.exe
  C:\Windows\System\mbMYqGt.exe
  2⤵
  PID:9308
- C:\Windows\System\wJTmLwc.exe
  C:\Windows\System\wJTmLwc.exe
  2⤵
  PID:9340
- C:\Windows\System\AvbjfMI.exe
  C:\Windows\System\AvbjfMI.exe
  2⤵
  PID:9360
- C:\Windows\System\roPmSuN.exe
  C:\Windows\System\roPmSuN.exe
  2⤵
  PID:9396
- C:\Windows\System\MHOIiyK.exe
  C:\Windows\System\MHOIiyK.exe
  2⤵
  PID:9416
- C:\Windows\System\AWzZABd.exe
  C:\Windows\System\AWzZABd.exe
  2⤵
  PID:9460
- C:\Windows\System\lcFMyyq.exe
  C:\Windows\System\lcFMyyq.exe
  2⤵
  PID:9496
- C:\Windows\System\BOwWdqK.exe
  C:\Windows\System\BOwWdqK.exe
  2⤵
  PID:9520
- C:\Windows\System\PFbwlRk.exe
  C:\Windows\System\PFbwlRk.exe
  2⤵
  PID:9536
- C:\Windows\System\xjQPUsD.exe
  C:\Windows\System\xjQPUsD.exe
  2⤵
  PID:9560
- C:\Windows\System\igLtnwf.exe
  C:\Windows\System\igLtnwf.exe
  2⤵
  PID:9592
- C:\Windows\System\trZXVca.exe
  C:\Windows\System\trZXVca.exe
  2⤵
  PID:9632
- C:\Windows\System\qGDNXsS.exe
  C:\Windows\System\qGDNXsS.exe
  2⤵
  PID:9652
- C:\Windows\System\KeVBbZl.exe
  C:\Windows\System\KeVBbZl.exe
  2⤵
  PID:9676
- C:\Windows\System\CvjFbWN.exe
  C:\Windows\System\CvjFbWN.exe
  2⤵
  PID:9696
- C:\Windows\System\BzboPfc.exe
  C:\Windows\System\BzboPfc.exe
  2⤵
  PID:9728
- C:\Windows\System\miaDtwg.exe
  C:\Windows\System\miaDtwg.exe
  2⤵
  PID:9752
- C:\Windows\System\kjlIoXa.exe
  C:\Windows\System\kjlIoXa.exe
  2⤵
  PID:9768
- C:\Windows\System\tvbYFBp.exe
  C:\Windows\System\tvbYFBp.exe
  2⤵
  PID:9792
- C:\Windows\System\raioAyU.exe
  C:\Windows\System\raioAyU.exe
  2⤵
  PID:9820
- C:\Windows\System\TjOFWTV.exe
  C:\Windows\System\TjOFWTV.exe
  2⤵
  PID:9840
- C:\Windows\System\FAxUspB.exe
  C:\Windows\System\FAxUspB.exe
  2⤵
  PID:9860
- C:\Windows\System\goAKHfp.exe
  C:\Windows\System\goAKHfp.exe
  2⤵
  PID:9880
- C:\Windows\System\DUowgNh.exe
  C:\Windows\System\DUowgNh.exe
  2⤵
  PID:9900
- C:\Windows\System\ZZRPwvo.exe
  C:\Windows\System\ZZRPwvo.exe
  2⤵
  PID:9920
- C:\Windows\System\FNWMFGy.exe
  C:\Windows\System\FNWMFGy.exe
  2⤵
  PID:9940
- C:\Windows\System\sTbdMSr.exe
  C:\Windows\System\sTbdMSr.exe
  2⤵
  PID:9960
- C:\Windows\System\jUwHtOo.exe
  C:\Windows\System\jUwHtOo.exe
  2⤵
  PID:9980
- C:\Windows\System\hdjdXFk.exe
  C:\Windows\System\hdjdXFk.exe
  2⤵
  PID:10000
- C:\Windows\System\hExUbby.exe
  C:\Windows\System\hExUbby.exe
  2⤵
  PID:10024
- C:\Windows\System\zWgqoDe.exe
  C:\Windows\System\zWgqoDe.exe
  2⤵
  PID:10048
- C:\Windows\System\TCEHHIj.exe
  C:\Windows\System\TCEHHIj.exe
  2⤵
  PID:10076
- C:\Windows\System\HcbjYkk.exe
  C:\Windows\System\HcbjYkk.exe
  2⤵
  PID:10096
- C:\Windows\System\TnoUtRB.exe
  C:\Windows\System\TnoUtRB.exe
  2⤵
  PID:10116
- C:\Windows\System\buuAHvC.exe
  C:\Windows\System\buuAHvC.exe
  2⤵
  PID:10136
- C:\Windows\System\icPJVxG.exe
  C:\Windows\System\icPJVxG.exe
  2⤵
  PID:10164
- C:\Windows\System\bwxLGCM.exe
  C:\Windows\System\bwxLGCM.exe
  2⤵
  PID:10180
- C:\Windows\System\ctBLvTZ.exe
  C:\Windows\System\ctBLvTZ.exe
  2⤵
  PID:10200
- C:\Windows\System\qDaDIFA.exe
  C:\Windows\System\qDaDIFA.exe
  2⤵
  PID:10224
- C:\Windows\System\ULNWmqo.exe
  C:\Windows\System\ULNWmqo.exe
  2⤵
  PID:7116
- C:\Windows\System\YLboate.exe
  C:\Windows\System\YLboate.exe
  2⤵
  PID:6708
- C:\Windows\System\LvvmfGc.exe
  C:\Windows\System\LvvmfGc.exe
  2⤵
  PID:8228
- C:\Windows\System\qkZCcMq.exe
  C:\Windows\System\qkZCcMq.exe
  2⤵
  PID:8272
- C:\Windows\System\WYjATIB.exe
  C:\Windows\System\WYjATIB.exe
  2⤵
  PID:8316
- C:\Windows\System\YnGTrLt.exe
  C:\Windows\System\YnGTrLt.exe
  2⤵
  PID:2332
- C:\Windows\System\JsUVBWG.exe
  C:\Windows\System\JsUVBWG.exe
  2⤵
  PID:8408
- C:\Windows\System\ezKUJCl.exe
  C:\Windows\System\ezKUJCl.exe
  2⤵
  PID:8456
- C:\Windows\System\HykNmIx.exe
  C:\Windows\System\HykNmIx.exe
  2⤵
  PID:8580
- C:\Windows\System\msusCOa.exe
  C:\Windows\System\msusCOa.exe
  2⤵
  PID:7312
- C:\Windows\System\RwwbYyu.exe
  C:\Windows\System\RwwbYyu.exe
  2⤵
  PID:8740
- C:\Windows\System\PKWzpzY.exe
  C:\Windows\System\PKWzpzY.exe
  2⤵
  PID:8804
- C:\Windows\System\PNYtbJw.exe
  C:\Windows\System\PNYtbJw.exe
  2⤵
  PID:8868
- C:\Windows\System\ZdbjQfm.exe
  C:\Windows\System\ZdbjQfm.exe
  2⤵
  PID:4972
- C:\Windows\System\VkMfiOT.exe
  C:\Windows\System\VkMfiOT.exe
  2⤵
  PID:9076
- C:\Windows\System\tjvZsPx.exe
  C:\Windows\System\tjvZsPx.exe
  2⤵
  PID:7484
- C:\Windows\System\pAkaEvX.exe
  C:\Windows\System\pAkaEvX.exe
  2⤵
  PID:9172
- C:\Windows\System\ctZZKjy.exe
  C:\Windows\System\ctZZKjy.exe
  2⤵
  PID:7676
- C:\Windows\System\lpiyIbl.exe
  C:\Windows\System\lpiyIbl.exe
  2⤵
  PID:7724
- C:\Windows\System\ODNNdYI.exe
  C:\Windows\System\ODNNdYI.exe
  2⤵
  PID:232
- C:\Windows\System\meJqDfF.exe
  C:\Windows\System\meJqDfF.exe
  2⤵
  PID:10244
- C:\Windows\System\qCMItuT.exe
  C:\Windows\System\qCMItuT.exe
  2⤵
  PID:10268
- C:\Windows\System\sxJkUan.exe
  C:\Windows\System\sxJkUan.exe
  2⤵
  PID:10300
- C:\Windows\System\bbszoLT.exe
  C:\Windows\System\bbszoLT.exe
  2⤵
  PID:10320
- C:\Windows\System\baLDflL.exe
  C:\Windows\System\baLDflL.exe
  2⤵
  PID:10344
- C:\Windows\System\oQZLEyJ.exe
  C:\Windows\System\oQZLEyJ.exe
  2⤵
  PID:10364
- C:\Windows\System\MJCGQLJ.exe
  C:\Windows\System\MJCGQLJ.exe
  2⤵
  PID:10404
- C:\Windows\System\jcfllbn.exe
  C:\Windows\System\jcfllbn.exe
  2⤵
  PID:10424
- C:\Windows\System\dMqMszc.exe
  C:\Windows\System\dMqMszc.exe
  2⤵
  PID:10444
- C:\Windows\System\YPJayFl.exe
  C:\Windows\System\YPJayFl.exe
  2⤵
  PID:10468
- C:\Windows\System\gPNKdLG.exe
  C:\Windows\System\gPNKdLG.exe
  2⤵
  PID:10492
- C:\Windows\System\KZphpeJ.exe
  C:\Windows\System\KZphpeJ.exe
  2⤵
  PID:10516
- C:\Windows\System\kUlUzsd.exe
  C:\Windows\System\kUlUzsd.exe
  2⤵
  PID:10536
- C:\Windows\System\xdflSqp.exe
  C:\Windows\System\xdflSqp.exe
  2⤵
  PID:10560
- C:\Windows\System\hQoUMGp.exe
  C:\Windows\System\hQoUMGp.exe
  2⤵
  PID:10584
- C:\Windows\System\oUvDUsQ.exe
  C:\Windows\System\oUvDUsQ.exe
  2⤵
  PID:10600
- C:\Windows\System\DgisuUJ.exe
  C:\Windows\System\DgisuUJ.exe
  2⤵
  PID:10620
- C:\Windows\System\lcxBcTA.exe
  C:\Windows\System\lcxBcTA.exe
  2⤵
  PID:10640
- C:\Windows\System\VpXuvve.exe
  C:\Windows\System\VpXuvve.exe
  2⤵
  PID:10660
- C:\Windows\System\xtpdTMj.exe
  C:\Windows\System\xtpdTMj.exe
  2⤵
  PID:10684
- C:\Windows\System\hdvHWDr.exe
  C:\Windows\System\hdvHWDr.exe
  2⤵
  PID:10708
- C:\Windows\System\dzvUfNj.exe
  C:\Windows\System\dzvUfNj.exe
  2⤵
  PID:10728
- C:\Windows\System\QrOSkjf.exe
  C:\Windows\System\QrOSkjf.exe
  2⤵
  PID:10748
- C:\Windows\System\KLUOInX.exe
  C:\Windows\System\KLUOInX.exe
  2⤵
  PID:10768
- C:\Windows\System\wAWpDuX.exe
  C:\Windows\System\wAWpDuX.exe
  2⤵
  PID:10792
- C:\Windows\System\rTGwXTf.exe
  C:\Windows\System\rTGwXTf.exe
  2⤵
  PID:10816
- C:\Windows\System\nmfORkd.exe
  C:\Windows\System\nmfORkd.exe
  2⤵
  PID:10832
- C:\Windows\System\HzexaEX.exe
  C:\Windows\System\HzexaEX.exe
  2⤵
  PID:10852
- C:\Windows\System\NHIwtoJ.exe
  C:\Windows\System\NHIwtoJ.exe
  2⤵
  PID:10876
- C:\Windows\System\NTOCOio.exe
  C:\Windows\System\NTOCOio.exe
  2⤵
  PID:10908
- C:\Windows\System\CjJgguC.exe
  C:\Windows\System\CjJgguC.exe
  2⤵
  PID:10928
- C:\Windows\System\rIOqUkF.exe
  C:\Windows\System\rIOqUkF.exe
  2⤵
  PID:10956
- C:\Windows\System\jtaXWAH.exe
  C:\Windows\System\jtaXWAH.exe
  2⤵
  PID:10976
- C:\Windows\System\UcwDSyP.exe
  C:\Windows\System\UcwDSyP.exe
  2⤵
  PID:11000
- C:\Windows\System\fhnLTfH.exe
  C:\Windows\System\fhnLTfH.exe
  2⤵
  PID:11024
- C:\Windows\System\DwOQjOG.exe
  C:\Windows\System\DwOQjOG.exe
  2⤵
  PID:11052
- C:\Windows\System\Noxrkdi.exe
  C:\Windows\System\Noxrkdi.exe
  2⤵
  PID:11072
- C:\Windows\System\JrdofwH.exe
  C:\Windows\System\JrdofwH.exe
  2⤵
  PID:11096
- C:\Windows\System\RmhRsww.exe
  C:\Windows\System\RmhRsww.exe
  2⤵
  PID:11120
- C:\Windows\System\zOcXwzI.exe
  C:\Windows\System\zOcXwzI.exe
  2⤵
  PID:11140
- C:\Windows\System\ojnjgaf.exe
  C:\Windows\System\ojnjgaf.exe
  2⤵
  PID:11168
- C:\Windows\System\riUJGMz.exe
  C:\Windows\System\riUJGMz.exe
  2⤵
  PID:11188
- C:\Windows\System\EhFxKQh.exe
  C:\Windows\System\EhFxKQh.exe
  2⤵
  PID:11204
- C:\Windows\System\RdaiyZj.exe
  C:\Windows\System\RdaiyZj.exe
  2⤵
  PID:11232
- C:\Windows\System\YUBBojL.exe
  C:\Windows\System\YUBBojL.exe
  2⤵
  PID:11248
- C:\Windows\System\YkjbnUz.exe
  C:\Windows\System\YkjbnUz.exe
  2⤵
  PID:7984
- C:\Windows\System\LqXLsCr.exe
  C:\Windows\System\LqXLsCr.exe
  2⤵
  PID:7608
- C:\Windows\System\TihHByk.exe
  C:\Windows\System\TihHByk.exe
  2⤵
  PID:7156
- C:\Windows\System\iRzQXul.exe
  C:\Windows\System\iRzQXul.exe
  2⤵
  PID:9288
- C:\Windows\System\JpmhnXb.exe
  C:\Windows\System\JpmhnXb.exe
  2⤵
  PID:6612
- C:\Windows\System\nDBZBtw.exe
  C:\Windows\System\nDBZBtw.exe
  2⤵
  PID:9324
- C:\Windows\System\GcdNyTl.exe
  C:\Windows\System\GcdNyTl.exe
  2⤵
  PID:9424
- C:\Windows\System\qOXnFzF.exe
  C:\Windows\System\qOXnFzF.exe
  2⤵
  PID:9488
- C:\Windows\System\eHMapGm.exe
  C:\Windows\System\eHMapGm.exe
  2⤵
  PID:9544
- C:\Windows\System\vIkXiWZ.exe
  C:\Windows\System\vIkXiWZ.exe
  2⤵
  PID:8468
- C:\Windows\System\WZIbCGw.exe
  C:\Windows\System\WZIbCGw.exe
  2⤵
  PID:9644
- C:\Windows\System\gFNEAcF.exe
  C:\Windows\System\gFNEAcF.exe
  2⤵
  PID:8576
- C:\Windows\System\ceLmRVo.exe
  C:\Windows\System\ceLmRVo.exe
  2⤵
  PID:9708
- C:\Windows\System\DgkidEZ.exe
  C:\Windows\System\DgkidEZ.exe
  2⤵
  PID:8664
- C:\Windows\System\aCDjLtf.exe
  C:\Windows\System\aCDjLtf.exe
  2⤵
  PID:9776
- C:\Windows\System\VOZHwxC.exe
  C:\Windows\System\VOZHwxC.exe
  2⤵
  PID:9872
- C:\Windows\System\DqNHYPa.exe
  C:\Windows\System\DqNHYPa.exe
  2⤵
  PID:8860
- C:\Windows\System\FpdGwtW.exe
  C:\Windows\System\FpdGwtW.exe
  2⤵
  PID:10020
- C:\Windows\System\MiFUSRz.exe
  C:\Windows\System\MiFUSRz.exe
  2⤵
  PID:10068
- C:\Windows\System\ZtqZkSP.exe
  C:\Windows\System\ZtqZkSP.exe
  2⤵
  PID:8960
- C:\Windows\System\WUCcvnp.exe
  C:\Windows\System\WUCcvnp.exe
  2⤵
  PID:8984
- C:\Windows\System\AyyWsTX.exe
  C:\Windows\System\AyyWsTX.exe
  2⤵
  PID:10192
- C:\Windows\System\fgfFKZi.exe
  C:\Windows\System\fgfFKZi.exe
  2⤵
  PID:9032
- C:\Windows\System\JZXPsEv.exe
  C:\Windows\System\JZXPsEv.exe
  2⤵
  PID:8268
- C:\Windows\System\vegwBRy.exe
  C:\Windows\System\vegwBRy.exe
  2⤵
  PID:9072
- C:\Windows\System\IsiFiGL.exe
  C:\Windows\System\IsiFiGL.exe
  2⤵
  PID:8388
- C:\Windows\System\KUTnZfg.exe
  C:\Windows\System\KUTnZfg.exe
  2⤵
  PID:8736
- C:\Windows\System\INiAMXP.exe
  C:\Windows\System\INiAMXP.exe
  2⤵
  PID:8820
- C:\Windows\System\guAPTxF.exe
  C:\Windows\System\guAPTxF.exe
  2⤵
  PID:8916
- C:\Windows\System\NtCQtwc.exe
  C:\Windows\System\NtCQtwc.exe
  2⤵
  PID:7344
- C:\Windows\System\HzcrSfF.exe
  C:\Windows\System\HzcrSfF.exe
  2⤵
  PID:10356
- C:\Windows\System\NRPZzdP.exe
  C:\Windows\System\NRPZzdP.exe
  2⤵
  PID:7960
- C:\Windows\System\tiWHrSr.exe
  C:\Windows\System\tiWHrSr.exe
  2⤵
  PID:10436
- C:\Windows\System\JYoZtEq.exe
  C:\Windows\System\JYoZtEq.exe
  2⤵
  PID:7720
- C:\Windows\System\dqcrCMP.exe
  C:\Windows\System\dqcrCMP.exe
  2⤵
  PID:10528
- C:\Windows\System\xdWHReh.exe
  C:\Windows\System\xdWHReh.exe
  2⤵
  PID:10580
- C:\Windows\System\zFYNOjZ.exe
  C:\Windows\System\zFYNOjZ.exe
  2⤵
  PID:9484
- C:\Windows\System\KROJCYf.exe
  C:\Windows\System\KROJCYf.exe
  2⤵
  PID:9580
- C:\Windows\System\pclruVh.exe
  C:\Windows\System\pclruVh.exe
  2⤵
  PID:11284
- C:\Windows\System\QPyBCEY.exe
  C:\Windows\System\QPyBCEY.exe
  2⤵
  PID:11308
- C:\Windows\System\ZVmGsMl.exe
  C:\Windows\System\ZVmGsMl.exe
  2⤵
  PID:11332
- C:\Windows\System\HLUbMrW.exe
  C:\Windows\System\HLUbMrW.exe
  2⤵
  PID:11348
- C:\Windows\System\eJcbUCj.exe
  C:\Windows\System\eJcbUCj.exe
  2⤵
  PID:11376
- C:\Windows\System\vbwUVgS.exe
  C:\Windows\System\vbwUVgS.exe
  2⤵
  PID:11396
- C:\Windows\System\NiqqRzX.exe
  C:\Windows\System\NiqqRzX.exe
  2⤵
  PID:11420
- C:\Windows\System\JkAedhU.exe
  C:\Windows\System\JkAedhU.exe
  2⤵
  PID:11440
- C:\Windows\System\zqRmIfp.exe
  C:\Windows\System\zqRmIfp.exe
  2⤵
  PID:11472
- C:\Windows\System\DlrTzDb.exe
  C:\Windows\System\DlrTzDb.exe
  2⤵
  PID:11496
- C:\Windows\System\TgpLEzw.exe
  C:\Windows\System\TgpLEzw.exe
  2⤵
  PID:11512
- C:\Windows\System\GZhvszE.exe
  C:\Windows\System\GZhvszE.exe
  2⤵
  PID:11540
- C:\Windows\System\JlSNZPm.exe
  C:\Windows\System\JlSNZPm.exe
  2⤵
  PID:11556
- C:\Windows\System\EMSsOMV.exe
  C:\Windows\System\EMSsOMV.exe
  2⤵
  PID:11584
- C:\Windows\System\hlYAPTh.exe
  C:\Windows\System\hlYAPTh.exe
  2⤵
  PID:11604
- C:\Windows\System\dSLJfdj.exe
  C:\Windows\System\dSLJfdj.exe
  2⤵
  PID:11632
- C:\Windows\System\wTWfOfe.exe
  C:\Windows\System\wTWfOfe.exe
  2⤵
  PID:11656
- C:\Windows\System\rtampie.exe
  C:\Windows\System\rtampie.exe
  2⤵
  PID:11672
- C:\Windows\System\NPthyGB.exe
  C:\Windows\System\NPthyGB.exe
  2⤵
  PID:11692
- C:\Windows\System\GcbyRjK.exe
  C:\Windows\System\GcbyRjK.exe
  2⤵
  PID:11716
- C:\Windows\System\rynfbfY.exe
  C:\Windows\System\rynfbfY.exe
  2⤵
  PID:11736
- C:\Windows\System\wyJMuRY.exe
  C:\Windows\System\wyJMuRY.exe
  2⤵
  PID:11760
- C:\Windows\System\LiHKcGN.exe
  C:\Windows\System\LiHKcGN.exe
  2⤵
  PID:11792
- C:\Windows\System\GxbEAMI.exe
  C:\Windows\System\GxbEAMI.exe
  2⤵
  PID:11816
- C:\Windows\System\xPYLwUe.exe
  C:\Windows\System\xPYLwUe.exe
  2⤵
  PID:11836
- C:\Windows\System\vEYsiqY.exe
  C:\Windows\System\vEYsiqY.exe
  2⤵
  PID:11864
- C:\Windows\System\iMYFbNw.exe
  C:\Windows\System\iMYFbNw.exe
  2⤵
  PID:11888
- C:\Windows\System\uPTEdzB.exe
  C:\Windows\System\uPTEdzB.exe
  2⤵
  PID:11908
- C:\Windows\System\QWGwzJw.exe
  C:\Windows\System\QWGwzJw.exe
  2⤵
  PID:11932
- C:\Windows\System\MrelmKc.exe
  C:\Windows\System\MrelmKc.exe
  2⤵
  PID:11952
- C:\Windows\System\sVWWzLX.exe
  C:\Windows\System\sVWWzLX.exe
  2⤵
  PID:11976
- C:\Windows\System\qULCvLB.exe
  C:\Windows\System\qULCvLB.exe
  2⤵
  PID:11996
- C:\Windows\System\eJWAPYx.exe
  C:\Windows\System\eJWAPYx.exe
  2⤵
  PID:12016
- C:\Windows\System\VUTGuaT.exe
  C:\Windows\System\VUTGuaT.exe
  2⤵
  PID:12040
- C:\Windows\System\OAURMcX.exe
  C:\Windows\System\OAURMcX.exe
  2⤵
  PID:12060
- C:\Windows\System\ozXSxCc.exe
  C:\Windows\System\ozXSxCc.exe
  2⤵
  PID:12080
- C:\Windows\System\PLXeRBz.exe
  C:\Windows\System\PLXeRBz.exe
  2⤵
  PID:12104
- C:\Windows\System\LDgUDan.exe
  C:\Windows\System\LDgUDan.exe
  2⤵
  PID:12128
- C:\Windows\System\GrzwkPt.exe
  C:\Windows\System\GrzwkPt.exe
  2⤵
  PID:12152
- C:\Windows\System\KhFLLQH.exe
  C:\Windows\System\KhFLLQH.exe
  2⤵
  PID:12176
- C:\Windows\System\ciWyVqe.exe
  C:\Windows\System\ciWyVqe.exe
  2⤵
  PID:12212
- C:\Windows\System\wLrcshP.exe
  C:\Windows\System\wLrcshP.exe
  2⤵
  PID:12228
- C:\Windows\System\zFbfOiv.exe
  C:\Windows\System\zFbfOiv.exe
  2⤵
  PID:12248
- C:\Windows\System\dQgZtAV.exe
  C:\Windows\System\dQgZtAV.exe
  2⤵
  PID:12272
- C:\Windows\System\SUggsON.exe
  C:\Windows\System\SUggsON.exe
  2⤵
  PID:10696
- C:\Windows\System\sDtcEAB.exe
  C:\Windows\System\sDtcEAB.exe
  2⤵
  PID:9660
- C:\Windows\System\BAtHeFF.exe
  C:\Windows\System\BAtHeFF.exe
  2⤵
  PID:9704
- C:\Windows\System\WMFWkyX.exe
  C:\Windows\System\WMFWkyX.exe
  2⤵
  PID:10868
- C:\Windows\System\tlnBCZo.exe
  C:\Windows\System\tlnBCZo.exe
  2⤵
  PID:11016
- C:\Windows\System\GYQSefw.exe
  C:\Windows\System\GYQSefw.exe
  2⤵
  PID:11136
- C:\Windows\System\voZzSea.exe
  C:\Windows\System\voZzSea.exe
  2⤵
  PID:2328
- C:\Windows\System\PVNIFdU.exe
  C:\Windows\System\PVNIFdU.exe
  2⤵
  PID:10008
- C:\Windows\System\zvzQezQ.exe
  C:\Windows\System\zvzQezQ.exe
  2⤵
  PID:10124
- C:\Windows\System\sXtdgmi.exe
  C:\Windows\System\sXtdgmi.exe
  2⤵
  PID:8104
- C:\Windows\System\HkLgdGb.exe
  C:\Windows\System\HkLgdGb.exe
  2⤵
  PID:6684
- C:\Windows\System\vYegNTG.exe
  C:\Windows\System\vYegNTG.exe
  2⤵
  PID:4000
- C:\Windows\System\yJdrnwc.exe
  C:\Windows\System\yJdrnwc.exe
  2⤵
  PID:8432
- C:\Windows\System\icAmIka.exe
  C:\Windows\System\icAmIka.exe
  2⤵
  PID:8600
- C:\Windows\System\RTHDTUc.exe
  C:\Windows\System\RTHDTUc.exe
  2⤵
  PID:8888
- C:\Windows\System\jCVpkbY.exe
  C:\Windows\System\jCVpkbY.exe
  2⤵
  PID:8308
- C:\Windows\System\xEsoViM.exe
  C:\Windows\System\xEsoViM.exe
  2⤵
  PID:10288
- C:\Windows\System\hzkLIcU.exe
  C:\Windows\System\hzkLIcU.exe
  2⤵
  PID:10276
- C:\Windows\System\EQmAGHA.exe
  C:\Windows\System\EQmAGHA.exe
  2⤵
  PID:10504
- C:\Windows\System\fygpQXF.exe
  C:\Windows\System\fygpQXF.exe
  2⤵
  PID:10552
- C:\Windows\System\WLPXREA.exe
  C:\Windows\System\WLPXREA.exe
  2⤵
  PID:10608
- C:\Windows\System\SjWzYZz.exe
  C:\Windows\System\SjWzYZz.exe
  2⤵
  PID:10652
- C:\Windows\System\KrWCIyo.exe
  C:\Windows\System\KrWCIyo.exe
  2⤵
  PID:12300
- C:\Windows\System\GNKDiYf.exe
  C:\Windows\System\GNKDiYf.exe
  2⤵
  PID:12324
- C:\Windows\System\BfQQhqd.exe
  C:\Windows\System\BfQQhqd.exe
  2⤵
  PID:12348
- C:\Windows\System\SLcdCmu.exe
  C:\Windows\System\SLcdCmu.exe
  2⤵
  PID:12368
- C:\Windows\System\bgWTtkk.exe
  C:\Windows\System\bgWTtkk.exe
  2⤵
  PID:12392
- C:\Windows\System\pPjjxhI.exe
  C:\Windows\System\pPjjxhI.exe
  2⤵
  PID:12416
- C:\Windows\System\cWugONg.exe
  C:\Windows\System\cWugONg.exe
  2⤵
  PID:12444
- C:\Windows\System\HwjOvbr.exe
  C:\Windows\System\HwjOvbr.exe
  2⤵
  PID:12464
- C:\Windows\System\iHHmNvF.exe
  C:\Windows\System\iHHmNvF.exe
  2⤵
  PID:12488
- C:\Windows\System\lFcXSUM.exe
  C:\Windows\System\lFcXSUM.exe
  2⤵
  PID:12524
- C:\Windows\System\ubtlMGg.exe
  C:\Windows\System\ubtlMGg.exe
  2⤵
  PID:12548
- C:\Windows\System\qnMaCnU.exe
  C:\Windows\System\qnMaCnU.exe
  2⤵
  PID:12576
- C:\Windows\System\qpNxJEw.exe
  C:\Windows\System\qpNxJEw.exe
  2⤵
  PID:12596
- C:\Windows\System\hcFkaqc.exe
  C:\Windows\System\hcFkaqc.exe
  2⤵
  PID:12616
- C:\Windows\System\yqoYdfS.exe
  C:\Windows\System\yqoYdfS.exe
  2⤵
  PID:12652
- C:\Windows\System\IhjpErZ.exe
  C:\Windows\System\IhjpErZ.exe
  2⤵
  PID:12676
- C:\Windows\System\NkYNQeI.exe
  C:\Windows\System\NkYNQeI.exe
  2⤵
  PID:12708
- C:\Windows\System\SFtjvLh.exe
  C:\Windows\System\SFtjvLh.exe
  2⤵
  PID:12728
- C:\Windows\System\uYlWuPT.exe
  C:\Windows\System\uYlWuPT.exe
  2⤵
  PID:12760
- C:\Windows\System\AaMSEjJ.exe
  C:\Windows\System\AaMSEjJ.exe
  2⤵
  PID:12780
- C:\Windows\System\pVXCaNI.exe
  C:\Windows\System\pVXCaNI.exe
  2⤵
  PID:12804
- C:\Windows\System\paDRtqA.exe
  C:\Windows\System\paDRtqA.exe
  2⤵
  PID:12832
- C:\Windows\System\qSTOEKO.exe
  C:\Windows\System\qSTOEKO.exe
  2⤵
  PID:12860
- C:\Windows\System\VDknllO.exe
  C:\Windows\System\VDknllO.exe
  2⤵
  PID:12880
- C:\Windows\System\xWUcDwm.exe
  C:\Windows\System\xWUcDwm.exe
  2⤵
  PID:12900
- C:\Windows\System\QGMgkYc.exe
  C:\Windows\System\QGMgkYc.exe
  2⤵
  PID:12928
- C:\Windows\System\QkrAjRO.exe
  C:\Windows\System\QkrAjRO.exe
  2⤵
  PID:12952
- C:\Windows\System\mRPoogY.exe
  C:\Windows\System\mRPoogY.exe
  2⤵
  PID:12980
- C:\Windows\System\nTbjBog.exe
  C:\Windows\System\nTbjBog.exe
  2⤵
  PID:13008
- C:\Windows\System\KtQmFYn.exe
  C:\Windows\System\KtQmFYn.exe
  2⤵
  PID:13028
- C:\Windows\System\sXdEXit.exe
  C:\Windows\System\sXdEXit.exe
  2⤵
  PID:13052
- C:\Windows\System\OKjbABP.exe
  C:\Windows\System\OKjbABP.exe
  2⤵
  PID:13080
- C:\Windows\System\bahRjwy.exe
  C:\Windows\System\bahRjwy.exe
  2⤵
  PID:12376
- C:\Windows\System\qCHefkr.exe
  C:\Windows\System\qCHefkr.exe
  2⤵
  PID:11324
- C:\Windows\System\ZNDuODP.exe
  C:\Windows\System\ZNDuODP.exe
  2⤵
  PID:12432
- C:\Windows\System\lratolS.exe
  C:\Windows\System\lratolS.exe
  2⤵
  PID:11388
- C:\Windows\System\pBzvzJW.exe
  C:\Windows\System\pBzvzJW.exe
  2⤵
  PID:12456
- C:\Windows\System\CWlxBKD.exe
  C:\Windows\System\CWlxBKD.exe
  2⤵
  PID:12472
- C:\Windows\System\OuDxWCf.exe
  C:\Windows\System\OuDxWCf.exe
  2⤵
  PID:11436
- C:\Windows\System\DaynreR.exe
  C:\Windows\System\DaynreR.exe
  2⤵
  PID:10936
- C:\Windows\System\zOsZGmc.exe
  C:\Windows\System\zOsZGmc.exe
  2⤵
  PID:11484
- C:\Windows\System\jtkkHRn.exe
  C:\Windows\System\jtkkHRn.exe
  2⤵
  PID:11508
- C:\Windows\System\nksDVYg.exe
  C:\Windows\System\nksDVYg.exe
  2⤵
  PID:10968
- C:\Windows\System\kGALLOV.exe
  C:\Windows\System\kGALLOV.exe
  2⤵
  PID:12544
- C:\Windows\System\DAyHPtL.exe
  C:\Windows\System\DAyHPtL.exe
  2⤵
  PID:11040
- C:\Windows\System\QlTNAQA.exe
  C:\Windows\System\QlTNAQA.exe
  2⤵
  PID:11116
- C:\Windows\System\DuUOjBj.exe
  C:\Windows\System\DuUOjBj.exe
  2⤵
  PID:12668
- C:\Windows\System\BpmjSUf.exe
  C:\Windows\System\BpmjSUf.exe
  2⤵
  PID:11680
- C:\Windows\System\YiicUHg.exe
  C:\Windows\System\YiicUHg.exe
  2⤵
  PID:11200
- C:\Windows\System\lLcKPSN.exe
  C:\Windows\System\lLcKPSN.exe
  2⤵
  PID:11812
- C:\Windows\System\gfSXZzJ.exe
  C:\Windows\System\gfSXZzJ.exe
  2⤵
  PID:11884
- C:\Windows\System\aNyBoBl.exe
  C:\Windows\System\aNyBoBl.exe
  2⤵
  PID:6088
- C:\Windows\System\SVMPaKb.exe
  C:\Windows\System\SVMPaKb.exe
  2⤵
  PID:9736
- C:\Windows\System\UPmIYaY.exe
  C:\Windows\System\UPmIYaY.exe
  2⤵
  PID:9976
- C:\Windows\System\WSUNLgK.exe
  C:\Windows\System\WSUNLgK.exe
  2⤵
  PID:12224
- C:\Windows\System\LOaHIWv.exe
  C:\Windows\System\LOaHIWv.exe
  2⤵
  PID:13272
- C:\Windows\System\gZnhkFU.exe
  C:\Windows\System\gZnhkFU.exe
  2⤵
  PID:10884
- C:\Windows\System\GrnWRLU.exe
  C:\Windows\System\GrnWRLU.exe
  2⤵
  PID:9896
- C:\Windows\System\kkdufBo.exe
  C:\Windows\System\kkdufBo.exe
  2⤵
  PID:11640
- C:\Windows\System\wiZDJgj.exe
  C:\Windows\System\wiZDJgj.exe
  2⤵
  PID:11724
- C:\Windows\System\LeAtJfr.exe
  C:\Windows\System\LeAtJfr.exe
  2⤵
  PID:11776
- C:\Windows\System\bvDLSya.exe
  C:\Windows\System\bvDLSya.exe
  2⤵
  PID:12776
- C:\Windows\System\VvxaxqX.exe
  C:\Windows\System\VvxaxqX.exe
  2⤵
  PID:12988
- C:\Windows\System\tMffier.exe
  C:\Windows\System\tMffier.exe
  2⤵
  PID:13048
- C:\Windows\System\EjfjnkW.exe
  C:\Windows\System\EjfjnkW.exe
  2⤵
  PID:13124
- C:\Windows\System\BDZrvDT.exe
  C:\Windows\System\BDZrvDT.exe
  2⤵
  PID:13212
- C:\Windows\System\FByfEWT.exe
  C:\Windows\System\FByfEWT.exe
  2⤵
  PID:13248
- C:\Windows\System\mCUxMJW.exe
  C:\Windows\System\mCUxMJW.exe
  2⤵
  PID:10632
- C:\Windows\System\EDQwDDO.exe
  C:\Windows\System\EDQwDDO.exe
  2⤵
  PID:10808
- C:\Windows\System\JorWlSX.exe
  C:\Windows\System\JorWlSX.exe
  2⤵
  PID:11488
- C:\Windows\System\lobFnuw.exe
  C:\Windows\System\lobFnuw.exe
  2⤵
  PID:9888
- C:\Windows\System\DjXOoSN.exe
  C:\Windows\System\DjXOoSN.exe
  2⤵
  PID:11844
- C:\Windows\System\ozLmiwO.exe
  C:\Windows\System\ozLmiwO.exe
  2⤵
  PID:12812
- C:\Windows\System\bngXpUV.exe
  C:\Windows\System\bngXpUV.exe
  2⤵
  PID:12876
- C:\Windows\System\VPRjcSH.exe
  C:\Windows\System\VPRjcSH.exe
  2⤵
  PID:12588
- C:\Windows\System\cjPFhfc.exe
  C:\Windows\System\cjPFhfc.exe
  2⤵
  PID:9812
- C:\Windows\System\mFKIBhf.exe
  C:\Windows\System\mFKIBhf.exe
  2⤵
  PID:4888
- C:\Windows\System\PMHGULX.exe
  C:\Windows\System\PMHGULX.exe
  2⤵
  PID:12944
- C:\Windows\System\ohCAlht.exe
  C:\Windows\System\ohCAlht.exe
  2⤵
  PID:13108
- C:\Windows\System\BQMBcwq.exe
  C:\Windows\System\BQMBcwq.exe
  2⤵
  PID:11872
- C:\Windows\System\NxyPtkB.exe
  C:\Windows\System\NxyPtkB.exe
  2⤵
  PID:2356
- C:\Windows\System\vYkDZQL.exe
  C:\Windows\System\vYkDZQL.exe
  2⤵
  PID:10992
- C:\Windows\System\CkPVHVu.exe
  C:\Windows\System\CkPVHVu.exe
  2⤵
  PID:13252
- C:\Windows\System\jmjXPAh.exe
  C:\Windows\System\jmjXPAh.exe
  2⤵
  PID:10380
- C:\Windows\System\jFVzUQb.exe
  C:\Windows\System\jFVzUQb.exe
  2⤵
  PID:10208
- C:\Windows\System\YJWzBpN.exe
  C:\Windows\System\YJWzBpN.exe
  2⤵
  PID:10964
- C:\Windows\System\WLQuqeu.exe
  C:\Windows\System\WLQuqeu.exe
  2⤵
  PID:8596
- C:\Windows\System\QfPqxKW.exe
  C:\Windows\System\QfPqxKW.exe
  2⤵
  PID:11384
- C:\Windows\System\GOHELCs.exe
  C:\Windows\System\GOHELCs.exe
  2⤵
  PID:8940
- C:\Windows\System\hRXFeXP.exe
  C:\Windows\System\hRXFeXP.exe
  2⤵
  PID:11620
- C:\Windows\System\NzMZgct.exe
  C:\Windows\System\NzMZgct.exe
  2⤵
  PID:12076
- C:\Windows\System\hjRKoBR.exe
  C:\Windows\System\hjRKoBR.exe
  2⤵
  PID:12400
- C:\Windows\System\WkqxRAw.exe
  C:\Windows\System\WkqxRAw.exe
  2⤵
  PID:10824
- C:\Windows\System\MuIzjMM.exe
  C:\Windows\System\MuIzjMM.exe
  2⤵
  PID:11900
- C:\Windows\System\CrBWXvd.exe
  C:\Windows\System\CrBWXvd.exe
  2⤵
  PID:12640
- C:\Windows\System\qwzcJTW.exe
  C:\Windows\System\qwzcJTW.exe
  2⤵
  PID:4976
- C:\Windows\System\NBiqKVf.exe
  C:\Windows\System\NBiqKVf.exe
  2⤵
  PID:12136
- C:\Windows\System\BeJDPBX.exe
  C:\Windows\System\BeJDPBX.exe
  2⤵
  PID:13260
- C:\Windows\System\CfoMqJR.exe
  C:\Windows\System\CfoMqJR.exe
  2⤵
  PID:8848
- C:\Windows\System\PilUVfZ.exe
  C:\Windows\System\PilUVfZ.exe
  2⤵
  PID:10944
- C:\Windows\System\EfClZLL.exe
  C:\Windows\System\EfClZLL.exe
  2⤵
  PID:12052
- C:\Windows\System\XhPTvVN.exe
  C:\Windows\System\XhPTvVN.exe
  2⤵
  PID:12320
- C:\Windows\System\jsqkUHK.exe
  C:\Windows\System\jsqkUHK.exe
  2⤵
  PID:8936
- C:\Windows\System\ZJExgwQ.exe
  C:\Windows\System\ZJExgwQ.exe
  2⤵
  PID:12972
- C:\Windows\System\zSRlzOE.exe
  C:\Windows\System\zSRlzOE.exe
  2⤵
  PID:9868
- C:\Windows\System\ZWxOCHv.exe
  C:\Windows\System\ZWxOCHv.exe
  2⤵
  PID:9808
- C:\Windows\System\XcqjwdK.exe
  C:\Windows\System\XcqjwdK.exe
  2⤵
  PID:12532
- C:\Windows\System\tGYhigR.exe
  C:\Windows\System\tGYhigR.exe
  2⤵
  PID:2444
- C:\Windows\System\UMNGcne.exe
  C:\Windows\System\UMNGcne.exe
  2⤵
  PID:11732
- C:\Windows\System\OyKUfFF.exe
  C:\Windows\System\OyKUfFF.exe
  2⤵
  PID:1940
- C:\Windows\System\fGRNuad.exe
  C:\Windows\System\fGRNuad.exe
  2⤵
  PID:12744
- C:\Windows\System\DuVtehn.exe
  C:\Windows\System\DuVtehn.exe
  2⤵
  PID:11300
- C:\Windows\System\agmzQxD.exe
  C:\Windows\System\agmzQxD.exe
  2⤵
  PID:11968
- C:\Windows\System\ldqJFwB.exe
  C:\Windows\System\ldqJFwB.exe
  2⤵
  PID:13420
- C:\Windows\System\BJDWlhS.exe
  C:\Windows\System\BJDWlhS.exe
  2⤵
  PID:13496
- C:\Windows\System\NtBbWlA.exe
  C:\Windows\System\NtBbWlA.exe
  2⤵
  PID:13592
- C:\Windows\System\PXMVIFk.exe
  C:\Windows\System\PXMVIFk.exe
  2⤵
  PID:13624
- C:\Windows\System\fuqbFHl.exe
  C:\Windows\System\fuqbFHl.exe
  2⤵
  PID:13720
- C:\Windows\System\pFMwPLr.exe
  C:\Windows\System\pFMwPLr.exe
  2⤵
  PID:13812
- C:\Windows\System\QccxokW.exe
  C:\Windows\System\QccxokW.exe
  2⤵
  PID:13904
- C:\Windows\System\zBaxtFd.exe
  C:\Windows\System\zBaxtFd.exe
  2⤵
  PID:13956
- C:\Windows\System\bXWfJSg.exe
  C:\Windows\System\bXWfJSg.exe
  2⤵
  PID:14052
- C:\Windows\System\PpLCsXX.exe
  C:\Windows\System\PpLCsXX.exe
  2⤵
  PID:12496
- C:\Windows\System\FZiJpGN.exe
  C:\Windows\System\FZiJpGN.exe
  2⤵
  PID:13436
- C:\Windows\System\mqUePgg.exe
  C:\Windows\System\mqUePgg.exe
  2⤵
  PID:13472
- C:\Windows\System\lmzlRYv.exe
  C:\Windows\System\lmzlRYv.exe
  2⤵
  PID:13692
- C:\Windows\System\SZwNLdr.exe
  C:\Windows\System\SZwNLdr.exe
  2⤵
  PID:13740
- C:\Windows\System\UbZYWMB.exe
  C:\Windows\System\UbZYWMB.exe
  2⤵
  PID:13940
- C:\Windows\System\RxKWhTV.exe
  C:\Windows\System\RxKWhTV.exe
  2⤵
  PID:13188
- C:\Windows\System\lormgyp.exe
  C:\Windows\System\lormgyp.exe
  2⤵
  PID:14040
- C:\Windows\System\gSGBOMo.exe
  C:\Windows\System\gSGBOMo.exe
  2⤵
  PID:14064
- C:\Windows\System\XWKCVev.exe
  C:\Windows\System\XWKCVev.exe
  2⤵
  PID:13508
- C:\Windows\System\njarahk.exe
  C:\Windows\System\njarahk.exe
  2⤵
  PID:11940
- C:\Windows\System\NjPUfvg.exe
  C:\Windows\System\NjPUfvg.exe
  2⤵
  PID:13652
- C:\Windows\System\HxMDNKk.exe
  C:\Windows\System\HxMDNKk.exe
  2⤵
  PID:13400
- C:\Windows\System\wzfExHG.exe
  C:\Windows\System\wzfExHG.exe
  2⤵
  PID:13476
- C:\Windows\System\EOxuVEV.exe
  C:\Windows\System\EOxuVEV.exe
  2⤵
  PID:13604
- C:\Windows\System\jsvLhou.exe
  C:\Windows\System\jsvLhou.exe
  2⤵
  PID:13716
- C:\Windows\System\fnstfhm.exe
  C:\Windows\System\fnstfhm.exe
  2⤵
  PID:13668
- C:\Windows\System\jPIFvku.exe
  C:\Windows\System\jPIFvku.exe
  2⤵
  PID:13776
- C:\Windows\System\whXcRtQ.exe
  C:\Windows\System\whXcRtQ.exe
  2⤵
  PID:13428
- C:\Windows\System\AyLWsXM.exe
  C:\Windows\System\AyLWsXM.exe
  2⤵
  PID:13788
- C:\Windows\System\cQSPOTU.exe
  C:\Windows\System\cQSPOTU.exe
  2⤵
  PID:13540
- C:\Windows\System\LlJmVEa.exe
  C:\Windows\System\LlJmVEa.exe
  2⤵
  PID:13840
- C:\Windows\System\pqkySeY.exe
  C:\Windows\System\pqkySeY.exe
  2⤵
  PID:13852
- C:\Windows\System\ERzEHLA.exe
  C:\Windows\System\ERzEHLA.exe
  2⤵
  PID:13684
- C:\Windows\System\NKxwloC.exe
  C:\Windows\System\NKxwloC.exe
  2⤵
  PID:13656
- C:\Windows\System\CAbrCds.exe
  C:\Windows\System\CAbrCds.exe
  2⤵
  PID:13880
- C:\Windows\System\DFECVGC.exe
  C:\Windows\System\DFECVGC.exe
  2⤵
  PID:13924
- C:\Windows\System\lSPgjAW.exe
  C:\Windows\System\lSPgjAW.exe
  2⤵
  PID:13876
- C:\Windows\System\lYqRnuy.exe
  C:\Windows\System\lYqRnuy.exe
  2⤵
  PID:14020
- C:\Windows\System\RAbPKtm.exe
  C:\Windows\System\RAbPKtm.exe
  2⤵
  PID:13948
- C:\Windows\System\BnkaKhZ.exe
  C:\Windows\System\BnkaKhZ.exe
  2⤵
  PID:14104
- C:\Windows\System\KeIMUuu.exe
  C:\Windows\System\KeIMUuu.exe
  2⤵
  PID:13932
- C:\Windows\System\pFrAWGj.exe
  C:\Windows\System\pFrAWGj.exe
  2⤵
  PID:14088
- C:\Windows\System\xdVGhzz.exe
  C:\Windows\System\xdVGhzz.exe
  2⤵
  PID:13884
- C:\Windows\System\XXEBSHT.exe
  C:\Windows\System\XXEBSHT.exe
  2⤵
  PID:14132
- C:\Windows\System\QukswUT.exe
  C:\Windows\System\QukswUT.exe
  2⤵
  PID:14172
- C:\Windows\System\hmJygMN.exe
  C:\Windows\System\hmJygMN.exe
  2⤵
  PID:14180
- C:\Windows\System\NWxnudq.exe
  C:\Windows\System\NWxnudq.exe
  2⤵
  PID:14204
- C:\Windows\System\zpkGNBk.exe
  C:\Windows\System\zpkGNBk.exe
  2⤵
  PID:14240
- C:\Windows\System\AsXVQfB.exe
  C:\Windows\System\AsXVQfB.exe
  2⤵
  PID:14140
- C:\Windows\System\MCigSBL.exe
  C:\Windows\System\MCigSBL.exe
  2⤵
  PID:14276
- C:\Windows\System\sOxUddQ.exe
  C:\Windows\System\sOxUddQ.exe
  2⤵
  PID:14324
- C:\Windows\System\MjASxEE.exe
  C:\Windows\System\MjASxEE.exe
  2⤵
  PID:14272
- C:\Windows\System\jmjLYjt.exe
  C:\Windows\System\jmjLYjt.exe
  2⤵
  PID:9296
- C:\Windows\System\xvzILnh.exe
  C:\Windows\System\xvzILnh.exe
  2⤵
  PID:6296
- C:\Windows\System\LAGdxWd.exe
  C:\Windows\System\LAGdxWd.exe
  2⤵
  PID:14312
- C:\Windows\System\mLNQGOV.exe
  C:\Windows\System\mLNQGOV.exe
  2⤵
  PID:14220
- C:\Windows\System\xzaMIcV.exe
  C:\Windows\System\xzaMIcV.exe
  2⤵
  PID:14292
- C:\Windows\System\gOjsyPt.exe
  C:\Windows\System\gOjsyPt.exe
  2⤵
  PID:12036
- C:\Windows\System\eWWOPpZ.exe
  C:\Windows\System\eWWOPpZ.exe
  2⤵
  PID:10044
- C:\Windows\System\DLobzpg.exe
  C:\Windows\System\DLobzpg.exe
  2⤵
  PID:12164
- C:\Windows\System\wjoxJWF.exe
  C:\Windows\System\wjoxJWF.exe
  2⤵
  PID:13320
- C:\Windows\System\PQXobQe.exe
  C:\Windows\System\PQXobQe.exe
  2⤵
  PID:10508
- C:\Windows\System\FoVJYZv.exe
  C:\Windows\System\FoVJYZv.exe
  2⤵
  PID:13372
- C:\Windows\System\BPuVAeC.exe
  C:\Windows\System\BPuVAeC.exe
  2⤵
  PID:13468
- C:\Windows\System\SZqEmMw.exe
  C:\Windows\System\SZqEmMw.exe
  2⤵
  PID:13504
- C:\Windows\System\ytRYgGe.exe
  C:\Windows\System\ytRYgGe.exe
  2⤵
  PID:13176
- C:\Windows\System\IuTXWGN.exe
  C:\Windows\System\IuTXWGN.exe
  2⤵
  PID:3948
- C:\Windows\System\WtDCLDq.exe
  C:\Windows\System\WtDCLDq.exe
  2⤵
  PID:13452
- C:\Windows\System\soDBuXY.exe
  C:\Windows\System\soDBuXY.exe
  2⤵
  PID:13392
- C:\Windows\System\BCiiHjp.exe
  C:\Windows\System\BCiiHjp.exe
  2⤵
  PID:5040
- C:\Windows\System\AtIlIcl.exe
  C:\Windows\System\AtIlIcl.exe
  2⤵
  PID:4848
- C:\Windows\System\SjphGoJ.exe
  C:\Windows\System\SjphGoJ.exe
  2⤵
  PID:6132
- C:\Windows\System\yghrBJt.exe
  C:\Windows\System\yghrBJt.exe
  2⤵
  PID:11520
- C:\Windows\System\iQWohfP.exe
  C:\Windows\System\iQWohfP.exe
  2⤵
  PID:9056
- C:\Windows\System\WQWFTiY.exe
  C:\Windows\System\WQWFTiY.exe
  2⤵
  PID:13544
- C:\Windows\System\wLjHGID.exe
  C:\Windows\System\wLjHGID.exe
  2⤵
  PID:13440
- C:\Windows\System\PkcDwol.exe
  C:\Windows\System\PkcDwol.exe
  2⤵
  PID:13752
- C:\Windows\System\rDSTNaB.exe
  C:\Windows\System\rDSTNaB.exe
  2⤵
  PID:13172
- C:\Windows\System\QHWZPIL.exe
  C:\Windows\System\QHWZPIL.exe
  2⤵
  PID:4624
- C:\Windows\System\USSmwsr.exe
  C:\Windows\System\USSmwsr.exe
  2⤵
  PID:10720
- C:\Windows\System\CkeXwfb.exe
  C:\Windows\System\CkeXwfb.exe
  2⤵
  PID:3908
- C:\Windows\System\qQnpjxz.exe
  C:\Windows\System\qQnpjxz.exe
  2⤵
  PID:14032
- C:\Windows\System\VTSiNbv.exe
  C:\Windows\System\VTSiNbv.exe
  2⤵
  PID:14116
- C:\Windows\System\xkdUJFg.exe
  C:\Windows\System\xkdUJFg.exe
  2⤵
  PID:14096
- C:\Windows\System\uNPPddW.exe
  C:\Windows\System\uNPPddW.exe
  2⤵
  PID:14260
- C:\Windows\System\PUuLZSu.exe
  C:\Windows\System\PUuLZSu.exe
  2⤵
  PID:14236
- C:\Windows\System\LsNoKEA.exe
  C:\Windows\System\LsNoKEA.exe
  2⤵
  PID:14168
- C:\Windows\System\yxMBPtx.exe
  C:\Windows\System\yxMBPtx.exe
  2⤵
  PID:14308
- C:\Windows\System\AaZlEbo.exe
  C:\Windows\System\AaZlEbo.exe
  2⤵
  PID:2148
- C:\Windows\System\oNlBMTq.exe
  C:\Windows\System\oNlBMTq.exe
  2⤵
  PID:11344
- C:\Windows\System\HfdSGZO.exe
  C:\Windows\System\HfdSGZO.exe
  2⤵
  PID:14244
- C:\Windows\System\kbixiEB.exe
  C:\Windows\System\kbixiEB.exe
  2⤵
  PID:12072
- C:\Windows\System\avRObEi.exe
  C:\Windows\System\avRObEi.exe
  2⤵
  PID:6924
- C:\Windows\System\mVzEJOH.exe
  C:\Windows\System\mVzEJOH.exe
  2⤵
  PID:13608
- C:\Windows\System\VmrdJBy.exe
  C:\Windows\System\VmrdJBy.exe
  2⤵
  PID:13348
- C:\Windows\System\lEUdqQM.exe
  C:\Windows\System\lEUdqQM.exe
  2⤵
  PID:3164
- C:\Windows\System\pmagmEW.exe
  C:\Windows\System\pmagmEW.exe
  2⤵
  PID:11492
- C:\Windows\System\dKWkxUN.exe
  C:\Windows\System\dKWkxUN.exe
  2⤵
  PID:13620
- C:\Windows\System\jxQatGH.exe
  C:\Windows\System\jxQatGH.exe
  2⤵
  PID:13664
- C:\Windows\System\SbkDCtv.exe
  C:\Windows\System\SbkDCtv.exe
  2⤵
  PID:13792
- C:\Windows\System\rzQRHRd.exe
  C:\Windows\System\rzQRHRd.exe
  2⤵
  PID:9140
- C:\Windows\System\fdrJrTD.exe
  C:\Windows\System\fdrJrTD.exe
  2⤵
  PID:13912
- C:\Windows\System\gZipGwr.exe
  C:\Windows\System\gZipGwr.exe
  2⤵
  PID:13648
- C:\Windows\System\LyPiAPe.exe
  C:\Windows\System\LyPiAPe.exe
  2⤵
  PID:13916
- C:\Windows\System\gtySkAx.exe
  C:\Windows\System\gtySkAx.exe
  2⤵
  PID:10188
- C:\Windows\System\olowxtY.exe
  C:\Windows\System\olowxtY.exe
  2⤵
  PID:13800
- C:\Windows\System\aFvxOOc.exe
  C:\Windows\System\aFvxOOc.exe
  2⤵
  PID:14144
- C:\Windows\System\luMmBKi.exe
  C:\Windows\System\luMmBKi.exe
  2⤵
  PID:14224
- C:\Windows\System\VkLuXtP.exe
  C:\Windows\System\VkLuXtP.exe
  2⤵
  PID:14328
- C:\Windows\System\OJgaTKe.exe
  C:\Windows\System\OJgaTKe.exe
  2⤵
  PID:5764
- C:\Windows\System\ZyUnEat.exe
  C:\Windows\System\ZyUnEat.exe
  2⤵
  PID:13324
- C:\Windows\System\AzBuOOp.exe
  C:\Windows\System\AzBuOOp.exe
  2⤵
  PID:13220
- C:\Windows\System\XzbWqlx.exe
  C:\Windows\System\XzbWqlx.exe
  2⤵
  PID:1352
- C:\Windows\System\dHXQsYP.exe
  C:\Windows\System\dHXQsYP.exe
  2⤵
  PID:13744
- C:\Windows\System\NSWMxfr.exe
  C:\Windows\System\NSWMxfr.exe
  2⤵
  PID:13808
- C:\Windows\System\bMWwdBY.exe
  C:\Windows\System\bMWwdBY.exe
  2⤵
  PID:12236
- C:\Windows\System\FmbMHkk.exe
  C:\Windows\System\FmbMHkk.exe
  2⤵
  PID:13636
- C:\Windows\System\FwNHhmr.exe
  C:\Windows\System\FwNHhmr.exe
  2⤵
  PID:14228
- C:\Windows\System\HayGXNf.exe
  C:\Windows\System\HayGXNf.exe
  2⤵
  PID:4380
- C:\Windows\System\OOifHwg.exe
  C:\Windows\System\OOifHwg.exe
  2⤵
  PID:13588
- C:\Windows\System\ORegoQT.exe
  C:\Windows\System\ORegoQT.exe
  2⤵
  PID:14156
- C:\Windows\System\PbIPaFa.exe
  C:\Windows\System\PbIPaFa.exe
  2⤵
  PID:13856
- C:\Windows\System\PwuprkG.exe
  C:\Windows\System\PwuprkG.exe
  2⤵
  PID:14084
- C:\Windows\System\lLfumfL.exe
  C:\Windows\System\lLfumfL.exe
  2⤵
  PID:1532
- C:\Windows\System\FoSosIR.exe
  C:\Windows\System\FoSosIR.exe
  2⤵
  PID:7616
- C:\Windows\System\cNeBTvc.exe
  C:\Windows\System\cNeBTvc.exe
  2⤵
  PID:13888
- C:\Windows\System\QQfnGlt.exe
  C:\Windows\System\QQfnGlt.exe
  2⤵
  PID:692
- C:\Windows\System\NvSNFnW.exe
  C:\Windows\System\NvSNFnW.exe
  2⤵
  PID:804
- C:\Windows\System\RIqgwoE.exe
  C:\Windows\System\RIqgwoE.exe
  2⤵
  PID:14352
- C:\Windows\System\VeRRRfd.exe
  C:\Windows\System\VeRRRfd.exe
  2⤵
  PID:14368
- C:\Windows\System\PPWHiQu.exe
  C:\Windows\System\PPWHiQu.exe
  2⤵
  PID:14384
- C:\Windows\System\VASsksu.exe
  C:\Windows\System\VASsksu.exe
  2⤵
  PID:14400
- C:\Windows\System\nbvkHyc.exe
  C:\Windows\System\nbvkHyc.exe
  2⤵
  PID:14416
- C:\Windows\System\MwWcRCv.exe
  C:\Windows\System\MwWcRCv.exe
  2⤵
  PID:14436
- C:\Windows\System\uXpQlox.exe
  C:\Windows\System\uXpQlox.exe
  2⤵
  PID:14452
- C:\Windows\System\ipVpYnM.exe
  C:\Windows\System\ipVpYnM.exe
  2⤵
  PID:14468
- C:\Windows\System\vMNNWtP.exe
  C:\Windows\System\vMNNWtP.exe
  2⤵
  PID:14484
- C:\Windows\System\zrzvnCe.exe
  C:\Windows\System\zrzvnCe.exe
  2⤵
  PID:14504
- C:\Windows\System\glvalzR.exe
  C:\Windows\System\glvalzR.exe
  2⤵
  PID:14520
- C:\Windows\System\EtjbgDc.exe
  C:\Windows\System\EtjbgDc.exe
  2⤵
  PID:14536
- C:\Windows\System\CapdqVk.exe
  C:\Windows\System\CapdqVk.exe
  2⤵
  PID:14552
- C:\Windows\System\GiGrLJh.exe
  C:\Windows\System\GiGrLJh.exe
  2⤵
  PID:14568
- C:\Windows\System\iFtAQxL.exe
  C:\Windows\System\iFtAQxL.exe
  2⤵
  PID:14584
- C:\Windows\System\SZrdzrt.exe
  C:\Windows\System\SZrdzrt.exe
  2⤵
  PID:14600
- C:\Windows\System\DpnjUlx.exe
  C:\Windows\System\DpnjUlx.exe
  2⤵
  PID:14616
- C:\Windows\System\zOOalOH.exe
  C:\Windows\System\zOOalOH.exe
  2⤵
  PID:14632
- C:\Windows\System\pDcjZKp.exe
  C:\Windows\System\pDcjZKp.exe
  2⤵
  PID:14648
- C:\Windows\System\UmODpfw.exe
  C:\Windows\System\UmODpfw.exe
  2⤵
  PID:14668
- C:\Windows\System\QhieusO.exe
  C:\Windows\System\QhieusO.exe
  2⤵
  PID:14684
- C:\Windows\System\IuwMNjV.exe
  C:\Windows\System\IuwMNjV.exe
  2⤵
  PID:14700
- C:\Windows\System\ebCbosN.exe
  C:\Windows\System\ebCbosN.exe
  2⤵
  PID:14716
- C:\Windows\System\ZIyckDm.exe
  C:\Windows\System\ZIyckDm.exe
  2⤵
  PID:14732
- C:\Windows\System\okzlFsp.exe
  C:\Windows\System\okzlFsp.exe
  2⤵
  PID:14752
- C:\Windows\System\cIiqvEV.exe
  C:\Windows\System\cIiqvEV.exe
  2⤵
  PID:14768
- C:\Windows\System\JqRMTyn.exe
  C:\Windows\System\JqRMTyn.exe
  2⤵
  PID:14784
- C:\Windows\System\DlVEoii.exe
  C:\Windows\System\DlVEoii.exe
  2⤵
  PID:14800
- C:\Windows\System\yAlJCuN.exe
  C:\Windows\System\yAlJCuN.exe
  2⤵
  PID:14816
- C:\Windows\System\yRcDhXM.exe
  C:\Windows\System\yRcDhXM.exe
  2⤵
  PID:14848
- C:\Windows\System\UjufBSu.exe
  C:\Windows\System\UjufBSu.exe
  2⤵
  PID:14608
- C:\Windows\System\ZiQBzdx.exe
  C:\Windows\System\ZiQBzdx.exe
  2⤵
  PID:14748
- C:\Windows\System\TEReRxR.exe
  C:\Windows\System\TEReRxR.exe
  2⤵
  PID:14196
- C:\Windows\System\BaCNUwo.exe
  C:\Windows\System\BaCNUwo.exe
  2⤵
  PID:14808
- C:\Windows\System\TrXxAjl.exe
  C:\Windows\System\TrXxAjl.exe
  2⤵
  PID:14868
- C:\Windows\System\fOuBNGA.exe
  C:\Windows\System\fOuBNGA.exe
  2⤵
  PID:5036
- C:\Windows\System\UzblUCN.exe
  C:\Windows\System\UzblUCN.exe
  2⤵
  PID:1136
- C:\Windows\System\hoXOxDg.exe
  C:\Windows\System\hoXOxDg.exe
  2⤵
  PID:14876
- C:\Windows\System\ZKfMCIr.exe
  C:\Windows\System\ZKfMCIr.exe
  2⤵
  PID:14928
- C:\Windows\System\eZfpcZR.exe
  C:\Windows\System\eZfpcZR.exe
  2⤵
  PID:14944
- C:\Windows\System\luxutOM.exe
  C:\Windows\System\luxutOM.exe
  2⤵
  PID:12024
- C:\Windows\System\DywSiuN.exe
  C:\Windows\System\DywSiuN.exe
  2⤵
  PID:14200
- C:\Windows\System\vtLfACr.exe
  C:\Windows\System\vtLfACr.exe
  2⤵
  PID:14964
- C:\Windows\System\fcFMcln.exe
  C:\Windows\System\fcFMcln.exe
  2⤵
  PID:14980
- C:\Windows\System\BwZpmpD.exe
  C:\Windows\System\BwZpmpD.exe
  2⤵
  PID:15008
- C:\Windows\System\fRgOEQM.exe
  C:\Windows\System\fRgOEQM.exe
  2⤵
  PID:15000
- C:\Windows\System\hSgGCzd.exe
  C:\Windows\System\hSgGCzd.exe
  2⤵
  PID:15032
- C:\Windows\System\fhktFQU.exe
  C:\Windows\System\fhktFQU.exe
  2⤵
  PID:15064
- C:\Windows\System\hHLFbsz.exe
  C:\Windows\System\hHLFbsz.exe
  2⤵
  PID:14444
- C:\Windows\System\JMCjZdT.exe
  C:\Windows\System\JMCjZdT.exe
  2⤵
  PID:15096
- C:\Windows\System\TbTjddU.exe
  C:\Windows\System\TbTjddU.exe
  2⤵
  PID:15112
- C:\Windows\System\WadcziS.exe
  C:\Windows\System\WadcziS.exe
  2⤵
  PID:15116
- C:\Windows\System\ZEaEUHB.exe
  C:\Windows\System\ZEaEUHB.exe
  2⤵
  PID:15148
- C:\Windows\System\yzNGMqm.exe
  C:\Windows\System\yzNGMqm.exe
  2⤵
  PID:15164
- C:\Windows\System\CRWolxg.exe
  C:\Windows\System\CRWolxg.exe
  2⤵
  PID:15188
- C:\Windows\System\FMeMsbV.exe
  C:\Windows\System\FMeMsbV.exe
  2⤵
  PID:15196
- C:\Windows\System\ddERVNa.exe
  C:\Windows\System\ddERVNa.exe
  2⤵
  PID:15212
- C:\Windows\System\juKliQA.exe
  C:\Windows\System\juKliQA.exe
  2⤵
  PID:15228
- C:\Windows\System\uqptnAM.exe
  C:\Windows\System\uqptnAM.exe
  2⤵
  PID:15244
- C:\Windows\System\QztRIIb.exe
  C:\Windows\System\QztRIIb.exe
  2⤵
  PID:15260
- C:\Windows\System\vhoStLn.exe
  C:\Windows\System\vhoStLn.exe
  2⤵
  PID:15276
- C:\Windows\System\YKhMlSD.exe
  C:\Windows\System\YKhMlSD.exe
  2⤵
  PID:1284
- C:\Windows\System\uiorqyy.exe
  C:\Windows\System\uiorqyy.exe
  2⤵
  PID:15304
- C:\Windows\System\OHQErMY.exe
  C:\Windows\System\OHQErMY.exe
  2⤵
  PID:15320
- C:\Windows\System\fdbxsWG.exe
  C:\Windows\System\fdbxsWG.exe
  2⤵
  PID:3044
- C:\Windows\System\TyWaIHe.exe
  C:\Windows\System\TyWaIHe.exe
  2⤵
  PID:15352
- C:\Windows\System\TEEaGUt.exe
  C:\Windows\System\TEEaGUt.exe
  2⤵
  PID:14408
- C:\Windows\System\JrlqOcN.exe
  C:\Windows\System\JrlqOcN.exe
  2⤵
  PID:14332
- C:\Windows\System\bMKtydD.exe
  C:\Windows\System\bMKtydD.exe
  2⤵
  PID:4936
- C:\Windows\System\uMwTcwd.exe
  C:\Windows\System\uMwTcwd.exe
  2⤵
  PID:14528
- C:\Windows\System\QrCXCid.exe
  C:\Windows\System\QrCXCid.exe
  2⤵
  PID:14824
- C:\Windows\System\oVGqMna.exe
  C:\Windows\System\oVGqMna.exe
  2⤵
  PID:14580
- C:\Windows\System\eRXmDOs.exe
  C:\Windows\System\eRXmDOs.exe
  2⤵
  PID:14656
- C:\Windows\System\qJbyFOt.exe
  C:\Windows\System\qJbyFOt.exe
  2⤵
  PID:14712
- C:\Windows\System\SREpkYj.exe
  C:\Windows\System\SREpkYj.exe
  2⤵
  PID:14692
- C:\Windows\System\HBLErmN.exe
  C:\Windows\System\HBLErmN.exe
  2⤵
  PID:14728
- C:\Windows\System\WxTwOrW.exe
  C:\Windows\System\WxTwOrW.exe
  2⤵
  PID:14776
- C:\Windows\System\VDmeuRp.exe
  C:\Windows\System\VDmeuRp.exe
  2⤵
  PID:14796
- C:\Windows\System\uDHTUYY.exe
  C:\Windows\System\uDHTUYY.exe
  2⤵
  PID:13568
- C:\Windows\System\XMaqdWz.exe
  C:\Windows\System\XMaqdWz.exe
  2⤵
  PID:2828
- C:\Windows\System\WGeNLvo.exe
  C:\Windows\System\WGeNLvo.exe
  2⤵
  PID:14812
- C:\Windows\System\UxzPcTG.exe
  C:\Windows\System\UxzPcTG.exe
  2⤵
  PID:13760
- C:\Windows\System\NrPiStR.exe
  C:\Windows\System\NrPiStR.exe
  2⤵
  PID:744
- C:\Windows\System\PCVRGJv.exe
  C:\Windows\System\PCVRGJv.exe
  2⤵
  PID:2968
- C:\Windows\System\SvOcLvM.exe
  C:\Windows\System\SvOcLvM.exe
  2⤵
  PID:1828
- C:\Windows\System\JlWxSJU.exe
  C:\Windows\System\JlWxSJU.exe
  2⤵
  PID:3268
- C:\Windows\System\WSzkGeZ.exe
  C:\Windows\System\WSzkGeZ.exe
  2⤵
  PID:3944
- C:\Windows\System\XliEYRd.exe
  C:\Windows\System\XliEYRd.exe
  2⤵
  PID:2772
- C:\Windows\System\jkgtBpX.exe
  C:\Windows\System\jkgtBpX.exe
  2⤵
  PID:4576
- C:\Windows\System\tcAtTCZ.exe
  C:\Windows\System\tcAtTCZ.exe
  2⤵
  PID:14952
- C:\Windows\System\fWafVSe.exe
  C:\Windows\System\fWafVSe.exe
  2⤵
  PID:4596
- C:\Windows\System\meObxxG.exe
  C:\Windows\System\meObxxG.exe
  2⤵
  PID:14968
- C:\Windows\System\PWLZzAK.exe
  C:\Windows\System\PWLZzAK.exe
  2⤵
  PID:15012
- C:\Windows\System\HJKLwLM.exe
  C:\Windows\System\HJKLwLM.exe
  2⤵
  PID:4480
- C:\Windows\System\TEzlpLS.exe
  C:\Windows\System\TEzlpLS.exe
  2⤵
  PID:15056
- C:\Windows\System\njSuhvC.exe
  C:\Windows\System\njSuhvC.exe
  2⤵
  PID:5136
- C:\Windows\System\SsPIXEd.exe
  C:\Windows\System\SsPIXEd.exe
  2⤵
  PID:5168
- C:\Windows\System\beKeoqj.exe
  C:\Windows\System\beKeoqj.exe
  2⤵
  PID:5332
- C:\Windows\System\rDoMCDB.exe
  C:\Windows\System\rDoMCDB.exe
  2⤵
  PID:5404
- C:\Windows\System\puTLpWi.exe
  C:\Windows\System\puTLpWi.exe
  2⤵
  PID:5492
- C:\Windows\System\NYDUfNl.exe
  C:\Windows\System\NYDUfNl.exe
  2⤵
  PID:5684
- C:\Windows\System\iBUrHpJ.exe
  C:\Windows\System\iBUrHpJ.exe
  2⤵
  PID:11408
- C:\Windows\System\SBhdObz.exe
  C:\Windows\System\SBhdObz.exe
  2⤵
  PID:6196
- C:\Windows\System\mEgbluz.exe
  C:\Windows\System\mEgbluz.exe
  2⤵
  PID:5232
- C:\Windows\System\NbVRvBW.exe
  C:\Windows\System\NbVRvBW.exe
  2⤵
  PID:4420
- C:\Windows\System\dZDhpRL.exe
  C:\Windows\System\dZDhpRL.exe
  2⤵
  PID:15144
- C:\Windows\System\jwaxFDk.exe
  C:\Windows\System\jwaxFDk.exe
  2⤵
  PID:15192
- C:\Windows\System\VZPhYdl.exe
  C:\Windows\System\VZPhYdl.exe
  2⤵
  PID:15236
- C:\Windows\System\GNGXNen.exe
  C:\Windows\System\GNGXNen.exe
  2⤵
  PID:14512
- C:\Windows\System\AaYkmdu.exe
  C:\Windows\System\AaYkmdu.exe
  2⤵
  PID:14596
- C:\Windows\System\seCAwaD.exe
  C:\Windows\System\seCAwaD.exe
  2⤵
  PID:14676
- C:\Windows\System\YXRuKfI.exe
  C:\Windows\System\YXRuKfI.exe
  2⤵
  PID:14724
- C:\Windows\System\jUEaMHd.exe
  C:\Windows\System\jUEaMHd.exe
  2⤵
  PID:3240
- C:\Windows\System\QbnlUrl.exe
  C:\Windows\System\QbnlUrl.exe
  2⤵
  PID:13432
- C:\Windows\System\kbRQJHF.exe
  C:\Windows\System\kbRQJHF.exe
  2⤵
  PID:14860
- C:\Windows\System\yhbXJCW.exe
  C:\Windows\System\yhbXJCW.exe
  2⤵
  PID:14840
- C:\Windows\System\crCvkOf.exe
  C:\Windows\System\crCvkOf.exe
  2⤵
  PID:2040
- C:\Windows\System\YfrdMOn.exe
  C:\Windows\System\YfrdMOn.exe
  2⤵
  PID:4076
- C:\Windows\System\QVVRazM.exe
  C:\Windows\System\QVVRazM.exe
  2⤵
  PID:2388
- C:\Windows\System\PHrELDo.exe
  C:\Windows\System\PHrELDo.exe
  2⤵
  PID:2840
- C:\Windows\System\ZljNcVY.exe
  C:\Windows\System\ZljNcVY.exe
  2⤵
  PID:15048
- C:\Windows\System\iqoHJui.exe
  C:\Windows\System\iqoHJui.exe
  2⤵
  PID:5796
- C:\Windows\System\wpeSnYf.exe
  C:\Windows\System\wpeSnYf.exe
  2⤵
  PID:4148
- C:\Windows\System\lwJEnxE.exe
  C:\Windows\System\lwJEnxE.exe
  2⤵
  PID:14960
- C:\Windows\System\SbdDJEo.exe
  C:\Windows\System\SbdDJEo.exe
  2⤵
  PID:1788
- C:\Windows\System\CVdfYNR.exe
  C:\Windows\System\CVdfYNR.exe
  2⤵
  PID:14888
- C:\Windows\System\LcMduuN.exe
  C:\Windows\System\LcMduuN.exe
  2⤵
  PID:5456
- C:\Windows\System\dBXsUyz.exe
  C:\Windows\System\dBXsUyz.exe
  2⤵
  PID:15060
- C:\Windows\System\osXtpFf.exe
  C:\Windows\System\osXtpFf.exe
  2⤵
  PID:2236
- C:\Windows\System\lgcCLvP.exe
  C:\Windows\System\lgcCLvP.exe
  2⤵
  PID:5600
- C:\Windows\System\YuoHKDd.exe
  C:\Windows\System\YuoHKDd.exe
  2⤵
  PID:5908
- C:\Windows\System\FqKLprR.exe
  C:\Windows\System\FqKLprR.exe
  2⤵
  PID:15132
- C:\Windows\System\mvFzLyF.exe
  C:\Windows\System\mvFzLyF.exe
  2⤵
  PID:5864
- C:\Windows\System\IqQLgMa.exe
  C:\Windows\System\IqQLgMa.exe
  2⤵
  PID:14828
- C:\Windows\System\Urjdquo.exe
  C:\Windows\System\Urjdquo.exe
  2⤵
  PID:2400
- C:\Windows\System\ZVOBquJ.exe
  C:\Windows\System\ZVOBquJ.exe
  2⤵
  PID:5712
- C:\Windows\System\ZazNlVB.exe
  C:\Windows\System\ZazNlVB.exe
  2⤵
  PID:5440
- C:\Windows\System\WLilCZl.exe
  C:\Windows\System\WLilCZl.exe
  2⤵
  PID:15084
- C:\Windows\System\UmVndpK.exe
  C:\Windows\System\UmVndpK.exe
  2⤵
  PID:5692
- C:\Windows\System\FTUvssi.exe
  C:\Windows\System\FTUvssi.exe
  2⤵
  PID:14640
- C:\Windows\System\zCqGmBa.exe
  C:\Windows\System\zCqGmBa.exe
  2⤵
  PID:4132
- C:\Windows\System\hHHAsjJ.exe
  C:\Windows\System\hHHAsjJ.exe
  2⤵
  PID:14792
- C:\Windows\System\HexMRvL.exe
  C:\Windows\System\HexMRvL.exe
  2⤵
  PID:14832
- C:\Windows\System\SRoASCT.exe
  C:\Windows\System\SRoASCT.exe
  2⤵
  PID:15316
- C:\Windows\System\ltvQWUb.exe
  C:\Windows\System\ltvQWUb.exe
  2⤵
  PID:3764
- C:\Windows\System\ztWygjc.exe
  C:\Windows\System\ztWygjc.exe
  2⤵
  PID:14880
- C:\Windows\System\DNcdDhW.exe
  C:\Windows\System\DNcdDhW.exe
  2⤵
  PID:14548
- C:\Windows\System\dbHajlg.exe
  C:\Windows\System\dbHajlg.exe
  2⤵
  PID:15076
- C:\Windows\System\jlmKThz.exe
  C:\Windows\System\jlmKThz.exe
  2⤵
  PID:15088
- C:\Windows\System\EfXvHoy.exe
  C:\Windows\System\EfXvHoy.exe
  2⤵
  PID:3244
- C:\Windows\System\HjsugGJ.exe
  C:\Windows\System\HjsugGJ.exe
  2⤵
  PID:14884
- C:\Windows\System\BWniMTZ.exe
  C:\Windows\System\BWniMTZ.exe
  2⤵
  PID:15016
- C:\Windows\System\OzwVYaQ.exe
  C:\Windows\System\OzwVYaQ.exe
  2⤵
  PID:4708
- C:\Windows\System\VDSjNsh.exe
  C:\Windows\System\VDSjNsh.exe
  2⤵
  PID:5644
- C:\Windows\System\MVpAZmT.exe
  C:\Windows\System\MVpAZmT.exe
  2⤵
  PID:13460
- C:\Windows\System\vLkftAm.exe
  C:\Windows\System\vLkftAm.exe
  2⤵
  PID:13412
- C:\Windows\System\JEKfYSu.exe
  C:\Windows\System\JEKfYSu.exe
  2⤵
  PID:14424
- C:\Windows\System\zcTjPeB.exe
  C:\Windows\System\zcTjPeB.exe
  2⤵
  PID:15208
- C:\Windows\System\msLbcPv.exe
  C:\Windows\System\msLbcPv.exe
  2⤵
  PID:15252
- C:\Windows\System\tZqzWFD.exe
  C:\Windows\System\tZqzWFD.exe
  2⤵
  PID:13964
- C:\Windows\System\tpSCtSj.exe
  C:\Windows\System\tpSCtSj.exe
  2⤵
  PID:4872
- C:\Windows\System\RFraboj.exe
  C:\Windows\System\RFraboj.exe
  2⤵
  PID:14988
- C:\Windows\System\ZzfPPMd.exe
  C:\Windows\System\ZzfPPMd.exe
  2⤵
  PID:15344
- C:\Windows\System\TPArCMj.exe
  C:\Windows\System\TPArCMj.exe
  2⤵
  PID:4100
- C:\Windows\System\OeGEeqH.exe
  C:\Windows\System\OeGEeqH.exe
  2⤵
  PID:14904
- C:\Windows\System\pwvBIoN.exe
  C:\Windows\System\pwvBIoN.exe
  2⤵
  PID:5532
- C:\Windows\System\yRgsbEl.exe
  C:\Windows\System\yRgsbEl.exe
  2⤵
  PID:6224
- C:\Windows\System\kGXtNEG.exe
  C:\Windows\System\kGXtNEG.exe
  2⤵
  PID:1612
- C:\Windows\System\OUukgFR.exe
  C:\Windows\System\OUukgFR.exe
  2⤵
  PID:14780
- C:\Windows\System\oiaLBsQ.exe
  C:\Windows\System\oiaLBsQ.exe
  2⤵
  PID:4712
- C:\Windows\System\YthLSRq.exe
  C:\Windows\System\YthLSRq.exe
  2⤵
  PID:14564
- C:\Windows\System\yDVxust.exe
  C:\Windows\System\yDVxust.exe
  2⤵
  PID:14288
- C:\Windows\System\fCfadyG.exe
  C:\Windows\System\fCfadyG.exe
  2⤵
  PID:12012
- C:\Windows\System\ntnrsnp.exe
  C:\Windows\System\ntnrsnp.exe
  2⤵
  PID:4704
- C:\Windows\System\HDVUrYX.exe
  C:\Windows\System\HDVUrYX.exe
  2⤵
  PID:5156
- C:\Windows\System\afYLoTq.exe
  C:\Windows\System\afYLoTq.exe
  2⤵
  PID:15288
- C:\Windows\System\jpIbMLU.exe
  C:\Windows\System\jpIbMLU.exe
  2⤵
  PID:15104
- C:\Windows\System\WbslBJK.exe
  C:\Windows\System\WbslBJK.exe
  2⤵
  PID:14544
- C:\Windows\System\PnkZYGO.exe
  C:\Windows\System\PnkZYGO.exe
  2⤵
  PID:15372
- C:\Windows\System\qQBnFqF.exe
  C:\Windows\System\qQBnFqF.exe
  2⤵
  PID:15388
- C:\Windows\System\DMHhfYz.exe
  C:\Windows\System\DMHhfYz.exe
  2⤵
  PID:15404
- C:\Windows\System\kCrRkfh.exe
  C:\Windows\System\kCrRkfh.exe
  2⤵
  PID:15420
- C:\Windows\System\peIXQFz.exe
  C:\Windows\System\peIXQFz.exe
  2⤵
  PID:15436
- C:\Windows\System\utPrVLY.exe
  C:\Windows\System\utPrVLY.exe
  2⤵
  PID:15452
- C:\Windows\System\DsotTDz.exe
  C:\Windows\System\DsotTDz.exe
  2⤵
  PID:15468
- C:\Windows\System\IzGUJUS.exe
  C:\Windows\System\IzGUJUS.exe
  2⤵
  PID:15484
- C:\Windows\System\zDGDrxX.exe
  C:\Windows\System\zDGDrxX.exe
  2⤵
  PID:15500
- C:\Windows\System\VKeyoaz.exe
  C:\Windows\System\VKeyoaz.exe
  2⤵
  PID:15532
- C:\Windows\System\slvmPIE.exe
  C:\Windows\System\slvmPIE.exe
  2⤵
  PID:15552
- C:\Windows\System\tsMTSoQ.exe
  C:\Windows\System\tsMTSoQ.exe
  2⤵
  PID:15584
- C:\Windows\System\XsMFopb.exe
  C:\Windows\System\XsMFopb.exe
  2⤵
  PID:15600
- C:\Windows\System\lDYhQtr.exe
  C:\Windows\System\lDYhQtr.exe
  2⤵
  PID:15616
- C:\Windows\System\cbSutpy.exe
  C:\Windows\System\cbSutpy.exe
  2⤵
  PID:15668
- C:\Windows\System\qYfcziK.exe
  C:\Windows\System\qYfcziK.exe
  2⤵
  PID:15692
- C:\Windows\System\ufiVdGN.exe
  C:\Windows\System\ufiVdGN.exe
  2⤵
  PID:15716
- C:\Windows\System\VqjihSH.exe
  C:\Windows\System\VqjihSH.exe
  2⤵
  PID:15732
- C:\Windows\System\wEiLhTV.exe
  C:\Windows\System\wEiLhTV.exe
  2⤵
  PID:15748
- C:\Windows\System\EvLKrOL.exe
  C:\Windows\System\EvLKrOL.exe
  2⤵
  PID:15764
- C:\Windows\System\kzhuAFl.exe
  C:\Windows\System\kzhuAFl.exe
  2⤵
  PID:15788
- C:\Windows\System\clYtVfg.exe
  C:\Windows\System\clYtVfg.exe
  2⤵
  PID:15812
- C:\Windows\System\RCuUKyG.exe
  C:\Windows\System\RCuUKyG.exe
  2⤵
  PID:15844
- C:\Windows\System\KGedhvH.exe
  C:\Windows\System\KGedhvH.exe
  2⤵
  PID:15860
- C:\Windows\System\sXhROXC.exe
  C:\Windows\System\sXhROXC.exe
  2⤵
  PID:15876
- C:\Windows\System\iKIIKMa.exe
  C:\Windows\System\iKIIKMa.exe
  2⤵
  PID:15892
- C:\Windows\System\YpOLnDw.exe
  C:\Windows\System\YpOLnDw.exe
  2⤵
  PID:15908
- C:\Windows\System\urQrdWC.exe
  C:\Windows\System\urQrdWC.exe
  2⤵
  PID:15924
- C:\Windows\System\jCcnTEA.exe
  C:\Windows\System\jCcnTEA.exe
  2⤵
  PID:15940
- C:\Windows\System\LJZxfai.exe
  C:\Windows\System\LJZxfai.exe
  2⤵
  PID:15956
- C:\Windows\System\ykKDwfW.exe
  C:\Windows\System\ykKDwfW.exe
  2⤵
  PID:15972
- C:\Windows\System\lFFHlKw.exe
  C:\Windows\System\lFFHlKw.exe
  2⤵
  PID:15988
- C:\Windows\System\vCfwczg.exe
  C:\Windows\System\vCfwczg.exe
  2⤵
  PID:16004
- C:\Windows\System\fhxOqsI.exe
  C:\Windows\System\fhxOqsI.exe
  2⤵
  PID:16020
- C:\Windows\System\gQkbALh.exe
  C:\Windows\System\gQkbALh.exe
  2⤵
  PID:16036
- C:\Windows\System\JDyotUR.exe
  C:\Windows\System\JDyotUR.exe
  2⤵
  PID:16052
- C:\Windows\System\oEWyPcb.exe
  C:\Windows\System\oEWyPcb.exe
  2⤵
  PID:16068
- C:\Windows\System\RRSQBSm.exe
  C:\Windows\System\RRSQBSm.exe
  2⤵
  PID:16084
- C:\Windows\System\PuTVyMB.exe
  C:\Windows\System\PuTVyMB.exe
  2⤵
  PID:16100
- C:\Windows\System\pmpOlty.exe
  C:\Windows\System\pmpOlty.exe
  2⤵
  PID:16120
- C:\Windows\System\WfedRUp.exe
  C:\Windows\System\WfedRUp.exe
  2⤵
  PID:16136
- C:\Windows\System\AFfmfDE.exe
  C:\Windows\System\AFfmfDE.exe
  2⤵
  PID:16152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_220asxgg.4so.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APSQhEP.exe

Filesize
1.9MB

MD5
4ae6149be8e49cbe7f7bce461589a7cc

SHA1
e1e825b990b8a1400591e654d3b6521b9cee458a

SHA256
9360650e4b292ceabf6bc377fd2f5a8438fa857c0bf7ca45f5a3f44bd0d0a88c

SHA512
28a09382c68b9ad17cfa3b17dc48753011b3c65ae73864bfa06b8ab1bb159c46796a5634031eb9c5e5dde2be852e90011311c040458b0004333241db714c32e6

Download Submit
C:\Windows\System\DTZmdno.exe

Filesize
1.9MB

MD5
3bdafdd6f640897450018b37d1019f47

SHA1
9a75e54a314725562fbd9b19eeb2d323306517d4

SHA256
0f928cb33746b9246bd855389e6e0b30e3a792913640bea804fd593ebcd40bd1

SHA512
bf73a01bb764aee46bd4195cc54bb23af7e844fe724ccf28e27e1e0576bfa287ccfabbebc982e71d3485fec79bac7430fd6bf22498fb4739680664e957f2f123

Download Submit
C:\Windows\System\EHpoOJS.exe

Filesize
1.9MB

MD5
44185e25ebda5099d603018ec0f8b7b6

SHA1
5c1f6a1e0d964e38af093ef1924114f0c633b62b

SHA256
2e9a7a154295d94cc9ba0d520f515536eabbeefc1b4ae60d664ff80995cd7814

SHA512
b000ab45b232234365c937f38b57c16420a092248c0ea7ca34b6704ef5456587674ce806e25473f5470a4710020394c957be276817b41d431059d00de62feaea

Download Submit
C:\Windows\System\FIrwdWZ.exe

Filesize
1.9MB

MD5
fe6dd7a369e7f2636e16c0c8830faeac

SHA1
f49a7d92d5fa294707764c938a13885ee1070138

SHA256
29186eae594af15565ab7f170d550f107237f5da9bc113be15cb5712be5bb55a

SHA512
1b1eb8db21ca1105138914267992d6e27f9897f92914cb13ef80a5a5fe6c32584beb7a51629f211cae7a6fe5abe591441a9d355e785841203d8d2a8d1f359c6a

Download Submit
C:\Windows\System\FbRFekv.exe

Filesize
1.9MB

MD5
6da2ce9e54eaa932b4c8552ae8b1acaa

SHA1
5677e5fec9178849c6b04026e64c471a8f3e4f52

SHA256
24fc0641e87695c93ee65bff278806c08dbcced3389b1691a44f2984322c06bf

SHA512
bbb0f55f9b007427fa8776ac7ce539fff8e8da5ea2bc11dc1464bd5a97e54d5157f647b94a8323639d37cf87ae7d064617a3c7f0dde954c5aac8290206635bdf

Download Submit
C:\Windows\System\KRAjppJ.exe

Filesize
1.9MB

MD5
731b60d04cf05dc963d0159c0bfbe720

SHA1
8bd09b2c4dbe6631ad842b02865d9ac0b6eaa73f

SHA256
5b8f5bc073ae226d8766945a3e96d1bbf715509858a5553e5cacab2c8d917544

SHA512
13fdb873e033b41c18d7df18c7dd8da50226a7c42db952dfaeb52658634dd4f1e3b9b61da67be20214ef422af2435074638c1d4a465d594aa49bff44b1c769ed

Download Submit
C:\Windows\System\LOjAFCx.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\LUkAUHg.exe

Filesize
1.9MB

MD5
7e78177398ab97193dd58ddb2a106c23

SHA1
5e7935a0b1cd7654e78f19cdd92ab21bba0c3a08

SHA256
3a6a41e0db0a4342edf1d3c7ba872f12e1f8ba81972559631d64d683bab16400

SHA512
ee882f32444687f160c8477baa3e0948b5136d64ab67abd39d9fa36515e319cf1122d85be0804bb72235d491f5ee7d97fefcafe58f60ffb4141690def682dd00

Download Submit
C:\Windows\System\LjHjQUt.exe

Filesize
1.9MB

MD5
6ce9cc06790413f63f35c6ce74daef63

SHA1
4fbea6c0893a891a7420f01f6ffcf92977e4641d

SHA256
e5465b1f1ef1332575a1c2c7c7e503f19ca4168efee6f6af4992dda216a1de4b

SHA512
1aa8f93b64a33855ffeec2b62d24be465101436d931b4da973030765517a59a707abcd9acc34fd2d242e331180092fa455ee5b4b76dbdea8ba58a590d98ed851

Download Submit
C:\Windows\System\PQRztDP.exe

Filesize
1.9MB

MD5
ce528c16819fbee6309883303462bc09

SHA1
0165ee56ae056a729101cbe149b1094aa6245196

SHA256
bcbf0612e21831a76f113612d2b136da3a316e90d7dc61327940c9a2519b77c3

SHA512
611d3882508b322637c045cc5c97a07172315eb49c919d32c37433b78e0b8a8a2d7014e321d7da42215a66339beea98faae389ea391c81f0beb8120ee40d3a48

Download Submit
C:\Windows\System\RlYlyhi.exe

Filesize
1.9MB

MD5
7a6ca618d4106a2b5f87f8caea3bcb5f

SHA1
bbdae3765843bf601b398563e0f4b8acdd0591ce

SHA256
1ae562b714f67eb884b3a80e613dd0bde7e3e9b3bd1fe6cf12576c80584bce85

SHA512
f6f002c80b69f11663cce7689ac51b46bd7204fd2dc7000cc5a5a17f39427c3b7b4d49ba5cb81af708a74a0e5d3af2add4ba689093eb21cbe1095177f5019607

Download Submit
C:\Windows\System\RozlJsx.exe

Filesize
1.9MB

MD5
e54b3581626d4a40c8d20c66b3f27940

SHA1
cc373bfaf70a35c0a37950cd4510d8f0470186d2

SHA256
ad69d51b925f140f59fee6b5c40b2f8e5d0cfef8720031e1a319df746f1db314

SHA512
bdb4f3c45b379d40cf723482f88ce7f867f478622471cb7524624ddcb7bf687824f27e9e5981393524e762a1901f097b96bf8a5d4b6179e4fe888eec7f129b0b

Download Submit
C:\Windows\System\TYGrwkG.exe

Filesize
1.9MB

MD5
72f2e4a6eaf1c4ec9b2fcd92358cd4a1

SHA1
6f201b8ae4ab9a75140cc2e7bb3d9165e04168e3

SHA256
4f31716659cb8673c67a3f34e2ee881ec5fdedfe5d440f310f24ffb1b0cf5ccf

SHA512
d42ae7b7a620f86a56b12928b9828f83387f9b3c74a50eb06b863f24bf0b7991ba91ce2346315bb20380eb100100d05e17dd2f9bde59b27fbc42ac9830c04cd9

Download Submit
C:\Windows\System\UMjkboM.exe

Filesize
1.9MB

MD5
f262737003acff81305a9a0d80c508df

SHA1
1cf42f60a86bf0476f14fd79ce0b9405d6a3004a

SHA256
2ddd8036bf129a3068f8f71a5db9dda25b4fd1037dd231855b02a805b66b4556

SHA512
af501678a492d2c286325ed240876639d509f1b579f3ebb79560ebb5f99628764119602e44d18c6fb00e46149a29186dff41dbe7bcc6efa540de9fa68974a519

Download Submit
C:\Windows\System\VwFILcw.exe

Filesize
1.9MB

MD5
bcec1bf827ee82563ec91dd8f553f7e7

SHA1
585907c8d4d8ce0a4a6bc3b79ec9cde8549ac83d

SHA256
81832f7c17cddde82db8d72bde40d81b20258ae48cffca247bdc3dd69bc2818f

SHA512
148ca0f8f6b3c5c24d9d442e5fd3c1fa1a19a1ec1afeac27afaf1df6781154e4d0fc4fa29f26dd3e63aeff2c64b563a13bb6a9b8cc59433a34b30b97a23ef4dc

Download Submit
C:\Windows\System\VxlOPqz.exe

Filesize
1.9MB

MD5
4908d3ba11366178a2719875a2dc4eec

SHA1
bc3447b64ca11906ade70eddba96fb383e546936

SHA256
22d6f0ac07389d361cb8ee51faa17ff2e96a4bdadce93860ec68c26dd34522ef

SHA512
fff9ff638c2c8fb5cf26c3409e0c725823d3a4b76cf405412a8ec4736c337df4457c462ff43d30b32de4e780b1bdabf10d5e05812a3d76b9bb817283c9573459

Download Submit
C:\Windows\System\ZDmLbVx.exe

Filesize
1.9MB

MD5
b1c0db015e87914c46fae87524072502

SHA1
8299d59c4bf5eed1ee7416763c3c8d2e9171bbd8

SHA256
16b6f1bc7d19e4c69ab076a1443f8069ddc472afb43adfab723a0efc36707a9f

SHA512
9b1e03cacbaab134f63f92a537a20ef014be103eed861fc392d0b057ccc691aa4f44a026e309ba581eb282c82a1073054a08ef37ebe0e7f67845b76100269863

Download Submit
C:\Windows\System\cOjWSbG.exe

Filesize
1.9MB

MD5
e714faf367817c0940c6bbbdaf3ad329

SHA1
4fc9055a48b6bfda677d4aa622bc8008e9e9295d

SHA256
aaa1cd6e8904d33f808e8e3489938e5d5ee94fe721fe657f41a915bd9d66bd55

SHA512
da8d5a1ca3ea78f5c360a1e7a39f1675903ddf1af737efeb0ebf16de33144f00aea71e45d9d6cb0a3d0c43f5a0c79b8e8d4a88b561f2b1eb754fbc7650a82b4d

Download Submit
C:\Windows\System\cXGAAiC.exe

Filesize
1.9MB

MD5
b4df3e6bd6db4347c941f8a3406944e7

SHA1
36cb1343eb1ce88c154be062e04e4670c84672db

SHA256
933864249c0ab93124a81a00bbce070026e52c9eed8b9c1c079a1aa45dec68ba

SHA512
51e779eb7c540fae496672aba199dde1b80bfa323bf2886d437634cef82e60afa9134d0e6bbe34bb4451288d50058e7e35e84ef2fc3761fe877ea2f0f5fc12cb

Download Submit
C:\Windows\System\dgMboLg.exe

Filesize
1.9MB

MD5
799b88b9d6c9cb62f6a9329ee9a48300

SHA1
d53dfc219a2ad5906178d2330d994d8803f1ea9b

SHA256
335ca93a16d6d7b968db2227d5f5711f9a36d38899c9178d03d8256dab07fe77

SHA512
420cbe99ddcc43ccb3c0c7c296b9d4bf360e982beafafbfaf129a0d723b3a46014bab336a7696c0adeee5697cf07ecbfb88982efec68d673d528919a2912a80d

Download Submit
C:\Windows\System\fTqbzuo.exe

Filesize
1.9MB

MD5
8b66606b5ba81cabf9bae531f2e0db87

SHA1
1af1b5f80c5158abd4016cdfcdacd43e69c3d512

SHA256
ec20d984961ed2568ec8ce3013ef4bc57ed80ec198ab45559caae9370a9b6b83

SHA512
434148c4d6fab3397945ab8cca7621f67ed0cb9896a2cd516f3ac8d5caa13b8e92bd5b52bcd88dbd3aa3d3cd78805d9153f34bab46d07a8b7d717b4c1663fc9a

Download Submit
C:\Windows\System\gcvRYfB.exe

Filesize
1.9MB

MD5
a48a7bc258bf0b7144a72f4f11ebc327

SHA1
f09a5784919264cc2617258ffa2ddc93aac5f244

SHA256
faa500b04234ed7dcfafef093c8fc88819778adfe35c27dbfbe692aebaa66281

SHA512
f870989ce09a1810b089a3d125d00291c81d4a578846cf2c8b04c8ed6e6f81bc716f8b747ad575d0bb8a106ce6a4e0f83a55b0af9ccd85e9b25c413b70ebbd32

Download Submit
C:\Windows\System\kCLBpnk.exe

Filesize
1.9MB

MD5
fc7ac8eec8dd39700a2d63a7f71016d4

SHA1
50cd04b25e201c4b573bdfb50bfd988943093e25

SHA256
e2e076ecc6f6e59860778141ec8cdb07c982a5066f0110390f63857ed35f6537

SHA512
518e26495b59bb7376c49df1e3d467054ca7e13d4aaa06c805edc4150b6cbb5c5b6871322d29c4f3cc6274e24dcad9d3b35fa5bff968bfa08246723d92836eda

Download Submit
C:\Windows\System\kPiKezR.exe

Filesize
1.9MB

MD5
2f477dbbcda09c353ab43253b8a34a4f

SHA1
0c11e75be071afa2e5e4ffd770da21206ed18e7d

SHA256
716b33f0a826b197e4e43796a91eb9b0c05fd29a2cd6589cd731adbac7e8a771

SHA512
d47ec4d381d1e014190e4125cb963a9e9a3196b630bea9fd6f8363673a11f7c25d4bb3a4a3530622d96e405be8007c0749f659b0fbfea46e67ef200717b075cb

Download Submit
C:\Windows\System\kuSAnmZ.exe

Filesize
1.9MB

MD5
0e794527222eb15c798d8ce1353fde5b

SHA1
08dec8f759ce446c28f68fd95982e786a5f07ca9

SHA256
723981c5a937eff1c49cfa5af78b638fa825fb53dba8cc4b20e027da918786ab

SHA512
5d06d5adb48d43fa5fd153857b86a05c33bd0a6a9ec0ee6b5b77a60fdfab21c2740961b6a161c1e7d0c4b2c6643e2054a2ada5fb3fc8f0cc073a2f96dccc6b42

Download Submit
C:\Windows\System\mKrTSCw.exe

Filesize
1.9MB

MD5
7ce42079cd1d8c54559bde555bc1f348

SHA1
44d7d6168d320c677e0133d896ac106bb38f5a04

SHA256
67c975b4863706de466613bf95bc57eac52eaa18e86c6f49305deb428b41604e

SHA512
f7babdda4c1d7308f277cd0ce1fd89f624e407d242cb7603f8e8e8f4e41ebfbf42756a550cd5dd2a754a82b9b9ce0023feebcc145f66d58a58b48c582c6df341

Download Submit
C:\Windows\System\nJQzNnf.exe

Filesize
1.9MB

MD5
b536dfd054eaade9e2dc956160ea411e

SHA1
c08fe3a8b385df759426eda60567edccbe1af325

SHA256
353557124abdf31349ed2b81c3f993c5d8ee0a15bb5ad2ac9aa40f253a641307

SHA512
2a105b8ad3beb6d9c36bd7d8237f235e5ed747f08f0a9adc8c8b6737705134a6dcf52d2bdab6a12d7f50e3b80f77c38dadb313b0b9236e9685fc42ce23257922

Download Submit
C:\Windows\System\szRguBJ.exe

Filesize
1.9MB

MD5
0060c60ec0a2f8cd5c6eef6b41e408b6

SHA1
3ae00b88ed12feeeb3fa0b130a215900c78a4cc7

SHA256
846964e7fdc3a2169613d0965640d041df92ecf5067547dbe4315453fec7f91a

SHA512
f5e4cf4f182fbb9f1f01d8a7b534bba90d217e27442244838c7136b9dbd8c561b495bbdd2a7b3e667db4a1e311ffeed00d6eeb5c33125b90a3efe4ad3160fa5c

Download Submit
C:\Windows\System\vUTZplI.exe

Filesize
1.9MB

MD5
c8c3393ea583cf6ca64ebd73126f188c

SHA1
2c4a1317c5426f93e4dd2dd4262a9424b12b861e

SHA256
249d6bfbf8a0fe3dd43d14cb334246559f4e4f7b37b3cad37181fc781dbd1144

SHA512
b197d05e63008435f15b436abc2ad3bff066e499ab9c1d925b0c30ce3fa793fac997f4e6a550a66b8bfadf16289f5159dc3aa24faef4f9d754c3cbb4f3a1b425

Download Submit
C:\Windows\System\xVSqETY.exe

Filesize
1.9MB

MD5
dad1b30d44b66cc4d400d36078b6c550

SHA1
aa441cadaa22ef1e4b39f52188e83522e8f6d2a9

SHA256
4d35dda1f1fc7bd77f9bdae189c24f43e1efb3c8d1db4f0661653d23b92fbbde

SHA512
48697f1ea99e6960e40631dbd2b23dd6fba337282cd1e2bb2e6feb253c09ee6d3910656a430eda16d611a74a2fa3e47e30364b784d4643eebd2febec42d60227

Download Submit
C:\Windows\System\xvxKFaW.exe

Filesize
1.9MB

MD5
ea5de21ad7f0733f298cbc06eea1b302

SHA1
acfe9161f02222448e99d9e0a02588c5ff2fa101

SHA256
c5ac1246dd005b332a8b577aea606cb5c3ce0d0c37ceb4a3744862d8c737e569

SHA512
60178d281666dddd4306315b2e03e36615b3bb35741afc54022cfbec3767932a389efadc286f248bb1d1abf8316f496927e38a5c8f5963d38160304986f8ac00

Download Submit
C:\Windows\System\yBFtbKZ.exe

Filesize
1.9MB

MD5
bdfa4c19badc1d0e26a084356328a55f

SHA1
3c6456d02e64f113ee0e6b2c75acf6e3bd77d430

SHA256
a6e6ceb26129f19944b2a89ed83bdf44d5771ec540903dd69f01a1c31e36752a

SHA512
62a71cb3e76145718d364d8a4c666528d05a064beb41617dc031f9ef2418dfe05754f5276b3770b1969ba65094a943d9e9d0422597a8948ca904c2637a5be081

Download Submit
C:\Windows\System\yuHZUgn.exe

Filesize
1.9MB

MD5
71468bd3cf86e353281535fbb7d2ad6f

SHA1
2f9806daca75d312b579c32b4afa409ea925d406

SHA256
06353f9c31e51661499e9752225160e719261ac021f8085596d640f10ddc25d8

SHA512
ef4b36e877f01807c7d9d1860c5d899fc5b4b4aff44722fba655fe745ff4757cb958368f76aea34e7a71e8456b20e693d71eaa5f2dc76160d2dcd5d0a544d4b2

Download Submit
C:\Windows\System\yuUUBFw.exe

Filesize
1.9MB

MD5
30eb9f02f3d6d51ecac2ebcabeb3f693

SHA1
79836283d4a69a7d647952229b9d1869c88c7d1c

SHA256
89a90c4088d6d2fef0b580f2296b0b0f3b80e339925e11f09822183773409365

SHA512
3a21a2ea034158a1dfd51917cdc76d42c676e0565345cf5558e3861c20ee4a83d7992c464cf5acf2969cfa13c36fb6a87aff5c2be3c1c6fe703c58cded268e3f

Download Submit
memory/404-4403-0x00007FF72D5A0000-0x00007FF72D992000-memory.dmp

Filesize
3.9MB

Download
memory/404-182-0x00007FF72D5A0000-0x00007FF72D992000-memory.dmp

Filesize
3.9MB

Download
memory/680-186-0x00007FF6470C0000-0x00007FF6474B2000-memory.dmp

Filesize
3.9MB

Download
memory/888-4341-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp

Filesize
3.9MB

Download
memory/888-148-0x00007FF6F2E40000-0x00007FF6F3232000-memory.dmp

Filesize
3.9MB

Download
memory/1300-176-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/1300-4382-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/1468-103-0x000001E555B80000-0x000001E555BA2000-memory.dmp

Filesize
136KB

Download
memory/1468-8-0x00007FFA5EC53000-0x00007FFA5EC55000-memory.dmp

Filesize
8KB

Download
memory/1468-68-0x00007FFA5EC50000-0x00007FFA5F711000-memory.dmp

Filesize
10.8MB

Download
memory/1468-2501-0x000001E5566B0000-0x000001E556E56000-memory.dmp

Filesize
7.6MB

Download
memory/1468-44-0x00007FFA5EC50000-0x00007FFA5F711000-memory.dmp

Filesize
10.8MB

Download
memory/1916-187-0x00007FF761580000-0x00007FF761972000-memory.dmp

Filesize
3.9MB

Download
memory/1916-4388-0x00007FF761580000-0x00007FF761972000-memory.dmp

Filesize
3.9MB

Download
memory/2112-172-0x00007FF639EE0000-0x00007FF63A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4395-0x00007FF639EE0000-0x00007FF63A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-175-0x00007FF7AF7D0000-0x00007FF7AFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-4362-0x00007FF7AF7D0000-0x00007FF7AFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-171-0x00007FF6B1B60000-0x00007FF6B1F52000-memory.dmp

Filesize
3.9MB

Download
memory/2196-4376-0x00007FF6B1B60000-0x00007FF6B1F52000-memory.dmp

Filesize
3.9MB

Download
memory/2256-4990-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp

Filesize
3.9MB

Download
memory/2256-183-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp

Filesize
3.9MB

Download
memory/2256-5049-0x00007FF6C9E10000-0x00007FF6CA202000-memory.dmp

Filesize
3.9MB

Download
memory/2260-174-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp

Filesize
3.9MB

Download
memory/2260-4355-0x00007FF6CC0A0000-0x00007FF6CC492000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4998-0x00007FF72D110000-0x00007FF72D502000-memory.dmp

Filesize
3.9MB

Download
memory/2788-185-0x00007FF72D110000-0x00007FF72D502000-memory.dmp

Filesize
3.9MB

Download
memory/2788-5063-0x00007FF72D110000-0x00007FF72D502000-memory.dmp

Filesize
3.9MB

Download
memory/3340-181-0x00007FF67CFA0000-0x00007FF67D392000-memory.dmp

Filesize
3.9MB

Download
memory/3340-4407-0x00007FF67CFA0000-0x00007FF67D392000-memory.dmp

Filesize
3.9MB

Download
memory/3428-1-0x000002880D120000-0x000002880D130000-memory.dmp

Filesize
64KB

Download
memory/3428-0-0x00007FF688590000-0x00007FF688982000-memory.dmp

Filesize
3.9MB

Download
memory/3428-4819-0x00007FF688590000-0x00007FF688982000-memory.dmp

Filesize
3.9MB

Download
memory/3500-109-0x00007FF67F530000-0x00007FF67F922000-memory.dmp

Filesize
3.9MB

Download
memory/3952-4992-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp

Filesize
3.9MB

Download
memory/3952-184-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp

Filesize
3.9MB

Download
memory/3952-5075-0x00007FF6A5820000-0x00007FF6A5C12000-memory.dmp

Filesize
3.9MB

Download
memory/4072-5052-0x00007FF6B7060000-0x00007FF6B7452000-memory.dmp

Filesize
3.9MB

Download
memory/4072-188-0x00007FF6B7060000-0x00007FF6B7452000-memory.dmp

Filesize
3.9MB

Download
memory/4104-177-0x00007FF6F0400000-0x00007FF6F07F2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-4361-0x00007FF6F0400000-0x00007FF6F07F2000-memory.dmp

Filesize
3.9MB

Download
memory/4240-178-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp

Filesize
3.9MB

Download
memory/4240-4370-0x00007FF62DF80000-0x00007FF62E372000-memory.dmp

Filesize
3.9MB

Download
memory/4268-4365-0x00007FF6DF3A0000-0x00007FF6DF792000-memory.dmp

Filesize
3.9MB

Download
memory/4268-156-0x00007FF6DF3A0000-0x00007FF6DF792000-memory.dmp

Filesize
3.9MB

Download
memory/4536-180-0x00007FF773CB0000-0x00007FF7740A2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-5082-0x00007FF773CB0000-0x00007FF7740A2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-4347-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-138-0x00007FF6F97F0000-0x00007FF6F9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-4373-0x00007FF649700000-0x00007FF649AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-170-0x00007FF649700000-0x00007FF649AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-4367-0x00007FF63B5B0000-0x00007FF63B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-179-0x00007FF63B5B0000-0x00007FF63B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-4351-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-150-0x00007FF612FC0000-0x00007FF6133B2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-4369-0x00007FF7DEEB0000-0x00007FF7DF2A2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-173-0x00007FF7DEEB0000-0x00007FF7DF2A2000-memory.dmp

Filesize
3.9MB

Download