xmrig | ec366f9f46ab1d402baa621b7c63509f80fd79efc30b66505bd4d8a1cec4e35f

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
Size

1.8MB
MD5

0e49e4513023425096cd7b12abdf3d9e
SHA1

b20b6ec0ffc38daaa60b3375a6d973681e33f0b1
SHA256

ec366f9f46ab1d402baa621b7c63509f80fd79efc30b66505bd4d8a1cec4e35f
SHA512

fa157a357ac9ab6b59e73bbea6179e25099b8b9ded8d46c2eabbb27a944f87bb3c96a5d3ecec23a9b94820703719a1e5c841caf9be844e6e0ff61fc0c8a2a3d5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtI:Lz071uv4BPMkibTIA5I4TNrpDGgDQmKw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3604-83-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp	xmrig
behavioral2/memory/1444-98-0x00007FF746A30000-0x00007FF746E22000-memory.dmp	xmrig
behavioral2/memory/4032-101-0x00007FF65A530000-0x00007FF65A922000-memory.dmp	xmrig
behavioral2/memory/2492-103-0x00007FF769650000-0x00007FF769A42000-memory.dmp	xmrig
behavioral2/memory/3552-105-0x00007FF781C60000-0x00007FF782052000-memory.dmp	xmrig
behavioral2/memory/2272-104-0x00007FF76B500000-0x00007FF76B8F2000-memory.dmp	xmrig
behavioral2/memory/3768-102-0x00007FF7452A0000-0x00007FF745692000-memory.dmp	xmrig
behavioral2/memory/1952-100-0x00007FF7CEC10000-0x00007FF7CF002000-memory.dmp	xmrig
behavioral2/memory/1980-99-0x00007FF70BC60000-0x00007FF70C052000-memory.dmp	xmrig
behavioral2/memory/2224-97-0x00007FF71AAE0000-0x00007FF71AED2000-memory.dmp	xmrig
behavioral2/memory/2524-94-0x00007FF68F770000-0x00007FF68FB62000-memory.dmp	xmrig
behavioral2/memory/2036-91-0x00007FF7C8970000-0x00007FF7C8D62000-memory.dmp	xmrig
behavioral2/memory/4708-87-0x00007FF61AE50000-0x00007FF61B242000-memory.dmp	xmrig
behavioral2/memory/5084-64-0x00007FF6A61A0000-0x00007FF6A6592000-memory.dmp	xmrig
behavioral2/memory/364-282-0x00007FF780C50000-0x00007FF781042000-memory.dmp	xmrig
behavioral2/memory/1496-285-0x00007FF7144D0000-0x00007FF7148C2000-memory.dmp	xmrig
behavioral2/memory/792-284-0x00007FF663810000-0x00007FF663C02000-memory.dmp	xmrig
behavioral2/memory/1368-283-0x00007FF690F40000-0x00007FF691332000-memory.dmp	xmrig
behavioral2/memory/3428-186-0x00007FF677DA0000-0x00007FF678192000-memory.dmp	xmrig
behavioral2/memory/4772-173-0x00007FF7EAE40000-0x00007FF7EB232000-memory.dmp	xmrig
behavioral2/memory/372-168-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/4976-158-0x00007FF662640000-0x00007FF662A32000-memory.dmp	xmrig
behavioral2/memory/3104-128-0x00007FF628190000-0x00007FF628582000-memory.dmp	xmrig
behavioral2/memory/4140-118-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp	xmrig
behavioral2/memory/1256-117-0x00007FF7917D0000-0x00007FF791BC2000-memory.dmp	xmrig
behavioral2/memory/4140-768-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp	xmrig
behavioral2/memory/4976-1617-0x00007FF662640000-0x00007FF662A32000-memory.dmp	xmrig
behavioral2/memory/2492-1874-0x00007FF769650000-0x00007FF769A42000-memory.dmp	xmrig
behavioral2/memory/3604-1859-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp	xmrig
behavioral2/memory/4032-1849-0x00007FF65A530000-0x00007FF65A922000-memory.dmp	xmrig
behavioral2/memory/3552-1890-0x00007FF781C60000-0x00007FF782052000-memory.dmp	xmrig
behavioral2/memory/1980-1809-0x00007FF70BC60000-0x00007FF70C052000-memory.dmp	xmrig
behavioral2/memory/1952-1804-0x00007FF7CEC10000-0x00007FF7CF002000-memory.dmp	xmrig
behavioral2/memory/2524-1736-0x00007FF68F770000-0x00007FF68FB62000-memory.dmp	xmrig
behavioral2/memory/4708-1728-0x00007FF61AE50000-0x00007FF61B242000-memory.dmp	xmrig
behavioral2/memory/2036-1725-0x00007FF7C8970000-0x00007FF7C8D62000-memory.dmp	xmrig
behavioral2/memory/2272-1713-0x00007FF76B500000-0x00007FF76B8F2000-memory.dmp	xmrig
behavioral2/memory/792-2202-0x00007FF663810000-0x00007FF663C02000-memory.dmp	xmrig
behavioral2/memory/364-2148-0x00007FF780C50000-0x00007FF781042000-memory.dmp	xmrig
behavioral2/memory/3428-2130-0x00007FF677DA0000-0x00007FF678192000-memory.dmp	xmrig
behavioral2/memory/1368-2110-0x00007FF690F40000-0x00007FF691332000-memory.dmp	xmrig
behavioral2/memory/372-2098-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/4772-2123-0x00007FF7EAE40000-0x00007FF7EB232000-memory.dmp	xmrig
behavioral2/memory/1496-2092-0x00007FF7144D0000-0x00007FF7148C2000-memory.dmp	xmrig
behavioral2/memory/3104-2071-0x00007FF628190000-0x00007FF628582000-memory.dmp	xmrig
behavioral2/memory/1256-2029-0x00007FF7917D0000-0x00007FF791BC2000-memory.dmp	xmrig
behavioral2/memory/1444-1681-0x00007FF746A30000-0x00007FF746E22000-memory.dmp	xmrig
behavioral2/memory/2224-1663-0x00007FF71AAE0000-0x00007FF71AED2000-memory.dmp	xmrig
behavioral2/memory/3768-1640-0x00007FF7452A0000-0x00007FF745692000-memory.dmp	xmrig
behavioral2/memory/5084-1648-0x00007FF6A61A0000-0x00007FF6A6592000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	1364	powershell.exe
8	1364	powershell.exe
17	1364	powershell.exe
18	1364	powershell.exe
20	1364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1364	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4976	tKhyVnj.exe
3768	JbrpdZu.exe
5084	LsJYSun.exe
3604	BeTRgPu.exe
4708	XlgrqGX.exe
2036	PaeskKS.exe
2492	XvOXxOP.exe
2524	DgkovnW.exe
2224	VEQyZbh.exe
2272	bLMJPuS.exe
1444	kKhEXiO.exe
1980	QOUoyqJ.exe
1952	oRyFXNs.exe
3552	SHqeNhH.exe
4032	RiVQfrc.exe
1256	kMyxekL.exe
3104	OrlXmBi.exe
372	IqJQFvR.exe
1496	NvgyQQv.exe
4772	riBbUSs.exe
3428	FdqhEbO.exe
364	fIiChwR.exe
1368	WdlQKOy.exe
792	fReRsfR.exe
4412	BXMDDRF.exe
2860	YaWIvfm.exe
4308	oLNlepv.exe
4344	MqOsBra.exe
2900	ajDPNYA.exe
412	xxEwEKA.exe
2984	WreaIvU.exe
1672	kUzHUrC.exe
3476	LqkSuGp.exe
316	MFcGKMN.exe
1856	TdXqLDf.exe
2976	ghSmqKk.exe
824	uMbjUOb.exe
4444	DPYIJxx.exe
2072	IZbwAFc.exe
3284	AdQJXEL.exe
2564	PBWgVCc.exe
4172	CRmzXBy.exe
3512	arBjBrX.exe
4336	JqLcrtc.exe
4476	MtooVNJ.exe
4360	pPIdXSL.exe
5128	EEBYcEv.exe
5144	CFRkNyn.exe
5196	FeyBxpP.exe
5212	ThvjUfg.exe
5228	HNvufhf.exe
5260	QbgHauZ.exe
5308	vXarpag.exe
5324	cpXUGAn.exe
5344	dLCBopC.exe
5364	IHVuVhQ.exe
5476	HtPDdVp.exe
5492	FppiFGm.exe
5528	TIKInLw.exe
5560	hrvucXr.exe
5588	lPQOTtC.exe
5624	ZYRsYhH.exe
5672	WaYsAQq.exe
5696	coocSPD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4140-0-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp	upx
behavioral2/files/0x000b000000023219-7.dat	upx
behavioral2/memory/4976-8-0x00007FF662640000-0x00007FF662A32000-memory.dmp	upx
behavioral2/files/0x0008000000023242-13.dat	upx
behavioral2/files/0x0007000000023243-11.dat	upx
behavioral2/files/0x0008000000023244-37.dat	upx
behavioral2/files/0x0007000000023246-43.dat	upx
behavioral2/files/0x0007000000023247-51.dat	upx
behavioral2/files/0x0008000000023240-52.dat	upx
behavioral2/files/0x0007000000023248-60.dat	upx
behavioral2/files/0x000700000002324a-68.dat	upx
behavioral2/files/0x000700000002324c-84.dat	upx
behavioral2/memory/3604-83-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp	upx
behavioral2/files/0x000700000002324e-90.dat	upx
behavioral2/memory/1444-98-0x00007FF746A30000-0x00007FF746E22000-memory.dmp	upx
behavioral2/memory/4032-101-0x00007FF65A530000-0x00007FF65A922000-memory.dmp	upx
behavioral2/memory/2492-103-0x00007FF769650000-0x00007FF769A42000-memory.dmp	upx
behavioral2/memory/3552-105-0x00007FF781C60000-0x00007FF782052000-memory.dmp	upx
behavioral2/memory/2272-104-0x00007FF76B500000-0x00007FF76B8F2000-memory.dmp	upx
behavioral2/memory/3768-102-0x00007FF7452A0000-0x00007FF745692000-memory.dmp	upx
behavioral2/memory/1952-100-0x00007FF7CEC10000-0x00007FF7CF002000-memory.dmp	upx
behavioral2/memory/1980-99-0x00007FF70BC60000-0x00007FF70C052000-memory.dmp	upx
behavioral2/memory/2224-97-0x00007FF71AAE0000-0x00007FF71AED2000-memory.dmp	upx
behavioral2/memory/2524-94-0x00007FF68F770000-0x00007FF68FB62000-memory.dmp	upx
behavioral2/files/0x000700000002324d-92.dat	upx
behavioral2/memory/2036-91-0x00007FF7C8970000-0x00007FF7C8D62000-memory.dmp	upx
behavioral2/memory/4708-87-0x00007FF61AE50000-0x00007FF61B242000-memory.dmp	upx
behavioral2/files/0x000700000002324b-82.dat	upx
behavioral2/files/0x0007000000023249-72.dat	upx
behavioral2/memory/5084-64-0x00007FF6A61A0000-0x00007FF6A6592000-memory.dmp	upx
behavioral2/files/0x0008000000023245-34.dat	upx
behavioral2/files/0x000700000002324f-110.dat	upx
behavioral2/files/0x0007000000023252-125.dat	upx
behavioral2/files/0x0007000000023255-133.dat	upx
behavioral2/files/0x0007000000023251-136.dat	upx
behavioral2/files/0x0007000000023256-141.dat	upx
behavioral2/files/0x0007000000023257-146.dat	upx
behavioral2/files/0x0007000000023258-155.dat	upx
behavioral2/files/0x0007000000023259-165.dat	upx
behavioral2/files/0x000700000002325a-170.dat	upx
behavioral2/files/0x000700000002325c-180.dat	upx
behavioral2/files/0x000700000002325d-187.dat	upx
behavioral2/files/0x000700000002325e-200.dat	upx
behavioral2/files/0x0007000000023261-209.dat	upx
behavioral2/files/0x000700000002325f-205.dat	upx
behavioral2/files/0x0007000000023260-204.dat	upx
behavioral2/memory/364-282-0x00007FF780C50000-0x00007FF781042000-memory.dmp	upx
behavioral2/memory/1496-285-0x00007FF7144D0000-0x00007FF7148C2000-memory.dmp	upx
behavioral2/memory/792-284-0x00007FF663810000-0x00007FF663C02000-memory.dmp	upx
behavioral2/memory/1368-283-0x00007FF690F40000-0x00007FF691332000-memory.dmp	upx
behavioral2/files/0x000700000002325b-188.dat	upx
behavioral2/memory/3428-186-0x00007FF677DA0000-0x00007FF678192000-memory.dmp	upx
behavioral2/memory/4772-173-0x00007FF7EAE40000-0x00007FF7EB232000-memory.dmp	upx
behavioral2/memory/372-168-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	upx
behavioral2/memory/4976-158-0x00007FF662640000-0x00007FF662A32000-memory.dmp	upx
behavioral2/files/0x0007000000023254-140.dat	upx
behavioral2/memory/3104-128-0x00007FF628190000-0x00007FF628582000-memory.dmp	upx
behavioral2/memory/4140-118-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp	upx
behavioral2/files/0x0007000000023250-119.dat	upx
behavioral2/memory/1256-117-0x00007FF7917D0000-0x00007FF791BC2000-memory.dmp	upx
behavioral2/memory/4140-768-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp	upx
behavioral2/memory/4976-1617-0x00007FF662640000-0x00007FF662A32000-memory.dmp	upx
behavioral2/memory/2492-1874-0x00007FF769650000-0x00007FF769A42000-memory.dmp	upx
behavioral2/memory/3604-1859-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\swrUqrK.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\AhCELBI.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\ePQKPtG.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\zuHwZdt.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\xxCHvNk.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\HKjAGAd.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\HXatrjj.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\PBwiYGb.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\xBTpFwl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\gEFjjDf.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\gMAenSO.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\UDAzbdm.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\tGXYvky.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\arBjBrX.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\UOGIPuf.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\QwikJAu.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\TALOurb.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\sCIVpXA.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\oLNlepv.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FIcZSLW.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\EBIsZjI.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\yrWYDsy.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\OXzqNPL.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\tJdwdEO.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\mIbVRyG.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\NbTnKMJ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BDdMAOl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\qthLzpl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BvGwfUM.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\iMAawfl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\gyJURYX.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\AOsQxSz.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\WAwqSyn.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\ZCmJBVW.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\YsPZYcr.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\YEDAAuu.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\aLmUAqY.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\oFIFxrp.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FcvjWnr.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\XCvfkRd.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\vYHaJLR.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\qxoxTtK.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\XNlfION.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\iXLRQob.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\aizXElv.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\zZObmfc.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\VmVhtjI.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\iXAYaDi.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\OvXXynE.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\tWqnOkK.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\LTmsLsT.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\oRyFXNs.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\wNgjWIo.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\QHKetFR.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\jFYqgJY.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\cHuSqqR.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\RFHHgmD.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\iYMWnxF.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\kZYRdBx.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FvRxstl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\KCqJGlQ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\KPBPLaU.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\leHlcYG.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\HuCfTcu.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1364	powershell.exe
1364	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeLockMemoryPrivilege	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1364	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	91
PID 4140 wrote to memory of 1364	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	91
PID 4140 wrote to memory of 4976	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	92
PID 4140 wrote to memory of 4976	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	92
PID 4140 wrote to memory of 3768	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	93
PID 4140 wrote to memory of 3768	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	93
PID 4140 wrote to memory of 5084	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	94
PID 4140 wrote to memory of 5084	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	94
PID 4140 wrote to memory of 3604	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	95
PID 4140 wrote to memory of 3604	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	95
PID 4140 wrote to memory of 4708	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	96
PID 4140 wrote to memory of 4708	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	96
PID 4140 wrote to memory of 2036	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	97
PID 4140 wrote to memory of 2036	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	97
PID 4140 wrote to memory of 2492	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	98
PID 4140 wrote to memory of 2492	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	98
PID 4140 wrote to memory of 2524	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	99
PID 4140 wrote to memory of 2524	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	99
PID 4140 wrote to memory of 2224	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	100
PID 4140 wrote to memory of 2224	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	100
PID 4140 wrote to memory of 2272	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	101
PID 4140 wrote to memory of 2272	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	101
PID 4140 wrote to memory of 1444	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	102
PID 4140 wrote to memory of 1444	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	102
PID 4140 wrote to memory of 1980	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	103
PID 4140 wrote to memory of 1980	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	103
PID 4140 wrote to memory of 1952	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	104
PID 4140 wrote to memory of 1952	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	104
PID 4140 wrote to memory of 3552	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	105
PID 4140 wrote to memory of 3552	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	105
PID 4140 wrote to memory of 4032	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	106
PID 4140 wrote to memory of 4032	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	106
PID 4140 wrote to memory of 1256	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	107
PID 4140 wrote to memory of 1256	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	107
PID 4140 wrote to memory of 3104	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	108
PID 4140 wrote to memory of 3104	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	108
PID 4140 wrote to memory of 1496	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	109
PID 4140 wrote to memory of 1496	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	109
PID 4140 wrote to memory of 372	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	110
PID 4140 wrote to memory of 372	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	110
PID 4140 wrote to memory of 4772	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	111
PID 4140 wrote to memory of 4772	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	111
PID 4140 wrote to memory of 3428	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	112
PID 4140 wrote to memory of 3428	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	112
PID 4140 wrote to memory of 364	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	113
PID 4140 wrote to memory of 364	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	113
PID 4140 wrote to memory of 1368	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	114
PID 4140 wrote to memory of 1368	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	114
PID 4140 wrote to memory of 792	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	115
PID 4140 wrote to memory of 792	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	115
PID 4140 wrote to memory of 4412	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	116
PID 4140 wrote to memory of 4412	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	116
PID 4140 wrote to memory of 2860	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	117
PID 4140 wrote to memory of 2860	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	117
PID 4140 wrote to memory of 4308	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	118
PID 4140 wrote to memory of 4308	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	118
PID 4140 wrote to memory of 4344	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	119
PID 4140 wrote to memory of 4344	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	119
PID 4140 wrote to memory of 2900	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	120
PID 4140 wrote to memory of 2900	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	120
PID 4140 wrote to memory of 412	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	121
PID 4140 wrote to memory of 412	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	121
PID 4140 wrote to memory of 2984	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	122
PID 4140 wrote to memory of 2984	4140	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\System\tKhyVnj.exe
  C:\Windows\System\tKhyVnj.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\JbrpdZu.exe
  C:\Windows\System\JbrpdZu.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\LsJYSun.exe
  C:\Windows\System\LsJYSun.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\BeTRgPu.exe
  C:\Windows\System\BeTRgPu.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\XlgrqGX.exe
  C:\Windows\System\XlgrqGX.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\PaeskKS.exe
  C:\Windows\System\PaeskKS.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\XvOXxOP.exe
  C:\Windows\System\XvOXxOP.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\DgkovnW.exe
  C:\Windows\System\DgkovnW.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\VEQyZbh.exe
  C:\Windows\System\VEQyZbh.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\bLMJPuS.exe
  C:\Windows\System\bLMJPuS.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\kKhEXiO.exe
  C:\Windows\System\kKhEXiO.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\QOUoyqJ.exe
  C:\Windows\System\QOUoyqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\oRyFXNs.exe
  C:\Windows\System\oRyFXNs.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\SHqeNhH.exe
  C:\Windows\System\SHqeNhH.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\RiVQfrc.exe
  C:\Windows\System\RiVQfrc.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\kMyxekL.exe
  C:\Windows\System\kMyxekL.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\OrlXmBi.exe
  C:\Windows\System\OrlXmBi.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\NvgyQQv.exe
  C:\Windows\System\NvgyQQv.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\IqJQFvR.exe
  C:\Windows\System\IqJQFvR.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\riBbUSs.exe
  C:\Windows\System\riBbUSs.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\FdqhEbO.exe
  C:\Windows\System\FdqhEbO.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\fIiChwR.exe
  C:\Windows\System\fIiChwR.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\WdlQKOy.exe
  C:\Windows\System\WdlQKOy.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\fReRsfR.exe
  C:\Windows\System\fReRsfR.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\BXMDDRF.exe
  C:\Windows\System\BXMDDRF.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\YaWIvfm.exe
  C:\Windows\System\YaWIvfm.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\oLNlepv.exe
  C:\Windows\System\oLNlepv.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\MqOsBra.exe
  C:\Windows\System\MqOsBra.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\ajDPNYA.exe
  C:\Windows\System\ajDPNYA.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xxEwEKA.exe
  C:\Windows\System\xxEwEKA.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\WreaIvU.exe
  C:\Windows\System\WreaIvU.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kUzHUrC.exe
  C:\Windows\System\kUzHUrC.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\LqkSuGp.exe
  C:\Windows\System\LqkSuGp.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\MFcGKMN.exe
  C:\Windows\System\MFcGKMN.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\TdXqLDf.exe
  C:\Windows\System\TdXqLDf.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ghSmqKk.exe
  C:\Windows\System\ghSmqKk.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\uMbjUOb.exe
  C:\Windows\System\uMbjUOb.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\DPYIJxx.exe
  C:\Windows\System\DPYIJxx.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\IZbwAFc.exe
  C:\Windows\System\IZbwAFc.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\AdQJXEL.exe
  C:\Windows\System\AdQJXEL.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\PBWgVCc.exe
  C:\Windows\System\PBWgVCc.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\CRmzXBy.exe
  C:\Windows\System\CRmzXBy.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\arBjBrX.exe
  C:\Windows\System\arBjBrX.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\JqLcrtc.exe
  C:\Windows\System\JqLcrtc.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\MtooVNJ.exe
  C:\Windows\System\MtooVNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\pPIdXSL.exe
  C:\Windows\System\pPIdXSL.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\EEBYcEv.exe
  C:\Windows\System\EEBYcEv.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\CFRkNyn.exe
  C:\Windows\System\CFRkNyn.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\FeyBxpP.exe
  C:\Windows\System\FeyBxpP.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\ThvjUfg.exe
  C:\Windows\System\ThvjUfg.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\HNvufhf.exe
  C:\Windows\System\HNvufhf.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\QbgHauZ.exe
  C:\Windows\System\QbgHauZ.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\vXarpag.exe
  C:\Windows\System\vXarpag.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\cpXUGAn.exe
  C:\Windows\System\cpXUGAn.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\dLCBopC.exe
  C:\Windows\System\dLCBopC.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\IHVuVhQ.exe
  C:\Windows\System\IHVuVhQ.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\HtPDdVp.exe
  C:\Windows\System\HtPDdVp.exe
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Windows\System\FppiFGm.exe
  C:\Windows\System\FppiFGm.exe
  2⤵
  - Executes dropped EXE
  PID:5492
- C:\Windows\System\TIKInLw.exe
  C:\Windows\System\TIKInLw.exe
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Windows\System\hrvucXr.exe
  C:\Windows\System\hrvucXr.exe
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Windows\System\lPQOTtC.exe
  C:\Windows\System\lPQOTtC.exe
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Windows\System\ZYRsYhH.exe
  C:\Windows\System\ZYRsYhH.exe
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Windows\System\WaYsAQq.exe
  C:\Windows\System\WaYsAQq.exe
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System\coocSPD.exe
  C:\Windows\System\coocSPD.exe
  2⤵
  - Executes dropped EXE
  PID:5696
- C:\Windows\System\lSibAIF.exe
  C:\Windows\System\lSibAIF.exe
  2⤵
  PID:5728
- C:\Windows\System\qtHITwt.exe
  C:\Windows\System\qtHITwt.exe
  2⤵
  PID:5756
- C:\Windows\System\gtsoYTO.exe
  C:\Windows\System\gtsoYTO.exe
  2⤵
  PID:5796
- C:\Windows\System\GZooXvk.exe
  C:\Windows\System\GZooXvk.exe
  2⤵
  PID:5824
- C:\Windows\System\WFWcBbH.exe
  C:\Windows\System\WFWcBbH.exe
  2⤵
  PID:5852
- C:\Windows\System\iCCCNib.exe
  C:\Windows\System\iCCCNib.exe
  2⤵
  PID:5872
- C:\Windows\System\QZHMIhd.exe
  C:\Windows\System\QZHMIhd.exe
  2⤵
  PID:5900
- C:\Windows\System\KKpsimO.exe
  C:\Windows\System\KKpsimO.exe
  2⤵
  PID:5936
- C:\Windows\System\tJdwdEO.exe
  C:\Windows\System\tJdwdEO.exe
  2⤵
  PID:5980
- C:\Windows\System\NVLuEGn.exe
  C:\Windows\System\NVLuEGn.exe
  2⤵
  PID:6012
- C:\Windows\System\mYbKbRb.exe
  C:\Windows\System\mYbKbRb.exe
  2⤵
  PID:6064
- C:\Windows\System\MrMwGgp.exe
  C:\Windows\System\MrMwGgp.exe
  2⤵
  PID:6108
- C:\Windows\System\TiNIrnG.exe
  C:\Windows\System\TiNIrnG.exe
  2⤵
  PID:6136
- C:\Windows\System\oxljnNC.exe
  C:\Windows\System\oxljnNC.exe
  2⤵
  PID:3152
- C:\Windows\System\saCaVsT.exe
  C:\Windows\System\saCaVsT.exe
  2⤵
  PID:1604
- C:\Windows\System\XSHeCTz.exe
  C:\Windows\System\XSHeCTz.exe
  2⤵
  PID:1972
- C:\Windows\System\aBCjUpj.exe
  C:\Windows\System\aBCjUpj.exe
  2⤵
  PID:2348
- C:\Windows\System\uTPvDmX.exe
  C:\Windows\System\uTPvDmX.exe
  2⤵
  PID:3928
- C:\Windows\System\WPiobtk.exe
  C:\Windows\System\WPiobtk.exe
  2⤵
  PID:5372
- C:\Windows\System\iyRdMrb.exe
  C:\Windows\System\iyRdMrb.exe
  2⤵
  PID:3852
- C:\Windows\System\XzaGIjb.exe
  C:\Windows\System\XzaGIjb.exe
  2⤵
  PID:760
- C:\Windows\System\zWWdCkJ.exe
  C:\Windows\System\zWWdCkJ.exe
  2⤵
  PID:5680
- C:\Windows\System\NrAsYWc.exe
  C:\Windows\System\NrAsYWc.exe
  2⤵
  PID:5764
- C:\Windows\System\yvCzhxP.exe
  C:\Windows\System\yvCzhxP.exe
  2⤵
  PID:6020
- C:\Windows\System\Szmbvuq.exe
  C:\Windows\System\Szmbvuq.exe
  2⤵
  PID:5136
- C:\Windows\System\zUFsqjh.exe
  C:\Windows\System\zUFsqjh.exe
  2⤵
  PID:4472
- C:\Windows\System\ZsrbtQz.exe
  C:\Windows\System\ZsrbtQz.exe
  2⤵
  PID:3004
- C:\Windows\System\OjRHVyv.exe
  C:\Windows\System\OjRHVyv.exe
  2⤵
  PID:5220
- C:\Windows\System\UOGIPuf.exe
  C:\Windows\System\UOGIPuf.exe
  2⤵
  PID:5316
- C:\Windows\System\MnUzyKr.exe
  C:\Windows\System\MnUzyKr.exe
  2⤵
  PID:3832
- C:\Windows\System\yaOuZnT.exe
  C:\Windows\System\yaOuZnT.exe
  2⤵
  PID:5484
- C:\Windows\System\YsPZYcr.exe
  C:\Windows\System\YsPZYcr.exe
  2⤵
  PID:1408
- C:\Windows\System\qlDJxfb.exe
  C:\Windows\System\qlDJxfb.exe
  2⤵
  PID:5604
- C:\Windows\System\aCUjNfZ.exe
  C:\Windows\System\aCUjNfZ.exe
  2⤵
  PID:5684
- C:\Windows\System\XKcjKtf.exe
  C:\Windows\System\XKcjKtf.exe
  2⤵
  PID:5840
- C:\Windows\System\oPqmVLy.exe
  C:\Windows\System\oPqmVLy.exe
  2⤵
  PID:5808
- C:\Windows\System\kGzwCGO.exe
  C:\Windows\System\kGzwCGO.exe
  2⤵
  PID:5864
- C:\Windows\System\dmHknST.exe
  C:\Windows\System\dmHknST.exe
  2⤵
  PID:5952
- C:\Windows\System\Scnwsao.exe
  C:\Windows\System\Scnwsao.exe
  2⤵
  PID:4384
- C:\Windows\System\knVjgfw.exe
  C:\Windows\System\knVjgfw.exe
  2⤵
  PID:6116
- C:\Windows\System\bqsdMpb.exe
  C:\Windows\System\bqsdMpb.exe
  2⤵
  PID:1808
- C:\Windows\System\TAzwDbG.exe
  C:\Windows\System\TAzwDbG.exe
  2⤵
  PID:2772
- C:\Windows\System\auWGcEv.exe
  C:\Windows\System\auWGcEv.exe
  2⤵
  PID:4252
- C:\Windows\System\CoNHBFT.exe
  C:\Windows\System\CoNHBFT.exe
  2⤵
  PID:1716
- C:\Windows\System\oxdJikT.exe
  C:\Windows\System\oxdJikT.exe
  2⤵
  PID:8
- C:\Windows\System\ImghjsF.exe
  C:\Windows\System\ImghjsF.exe
  2⤵
  PID:5208
- C:\Windows\System\SrgTaxr.exe
  C:\Windows\System\SrgTaxr.exe
  2⤵
  PID:2876
- C:\Windows\System\eBtaErK.exe
  C:\Windows\System\eBtaErK.exe
  2⤵
  PID:1712
- C:\Windows\System\QzzCXpk.exe
  C:\Windows\System\QzzCXpk.exe
  2⤵
  PID:1040
- C:\Windows\System\sZTfZiZ.exe
  C:\Windows\System\sZTfZiZ.exe
  2⤵
  PID:5440
- C:\Windows\System\JKxUpcE.exe
  C:\Windows\System\JKxUpcE.exe
  2⤵
  PID:5512
- C:\Windows\System\iFjTuch.exe
  C:\Windows\System\iFjTuch.exe
  2⤵
  PID:2932
- C:\Windows\System\zeVtEIo.exe
  C:\Windows\System\zeVtEIo.exe
  2⤵
  PID:5584
- C:\Windows\System\bGLhiEQ.exe
  C:\Windows\System\bGLhiEQ.exe
  2⤵
  PID:5832
- C:\Windows\System\xxnMMOq.exe
  C:\Windows\System\xxnMMOq.exe
  2⤵
  PID:6032
- C:\Windows\System\nAtOvgr.exe
  C:\Windows\System\nAtOvgr.exe
  2⤵
  PID:5868
- C:\Windows\System\RBfzPQx.exe
  C:\Windows\System\RBfzPQx.exe
  2⤵
  PID:6008
- C:\Windows\System\GYiWzRd.exe
  C:\Windows\System\GYiWzRd.exe
  2⤵
  PID:5028
- C:\Windows\System\bQcPEBo.exe
  C:\Windows\System\bQcPEBo.exe
  2⤵
  PID:3356
- C:\Windows\System\swrUqrK.exe
  C:\Windows\System\swrUqrK.exe
  2⤵
  PID:1480
- C:\Windows\System\MOwNNrK.exe
  C:\Windows\System\MOwNNrK.exe
  2⤵
  PID:5352
- C:\Windows\System\yvTOkTh.exe
  C:\Windows\System\yvTOkTh.exe
  2⤵
  PID:4380
- C:\Windows\System\FvRxstl.exe
  C:\Windows\System\FvRxstl.exe
  2⤵
  PID:3596
- C:\Windows\System\ulnnOXv.exe
  C:\Windows\System\ulnnOXv.exe
  2⤵
  PID:5712
- C:\Windows\System\iEBQjgf.exe
  C:\Windows\System\iEBQjgf.exe
  2⤵
  PID:5276
- C:\Windows\System\kqDcDRq.exe
  C:\Windows\System\kqDcDRq.exe
  2⤵
  PID:4592
- C:\Windows\System\BcpAghV.exe
  C:\Windows\System\BcpAghV.exe
  2⤵
  PID:5360
- C:\Windows\System\hLIVicq.exe
  C:\Windows\System\hLIVicq.exe
  2⤵
  PID:32
- C:\Windows\System\aEFFCXm.exe
  C:\Windows\System\aEFFCXm.exe
  2⤵
  PID:5416
- C:\Windows\System\bEVCXDJ.exe
  C:\Windows\System\bEVCXDJ.exe
  2⤵
  PID:5812
- C:\Windows\System\wNgjWIo.exe
  C:\Windows\System\wNgjWIo.exe
  2⤵
  PID:3960
- C:\Windows\System\WwutgWZ.exe
  C:\Windows\System\WwutgWZ.exe
  2⤵
  PID:6168
- C:\Windows\System\ueQQGFE.exe
  C:\Windows\System\ueQQGFE.exe
  2⤵
  PID:6204
- C:\Windows\System\ESHwHHj.exe
  C:\Windows\System\ESHwHHj.exe
  2⤵
  PID:6220
- C:\Windows\System\bmfeNpP.exe
  C:\Windows\System\bmfeNpP.exe
  2⤵
  PID:6240
- C:\Windows\System\mmEDean.exe
  C:\Windows\System\mmEDean.exe
  2⤵
  PID:6264
- C:\Windows\System\fBmDRgG.exe
  C:\Windows\System\fBmDRgG.exe
  2⤵
  PID:6284
- C:\Windows\System\ZmMmVFj.exe
  C:\Windows\System\ZmMmVFj.exe
  2⤵
  PID:6304
- C:\Windows\System\KMBzOWH.exe
  C:\Windows\System\KMBzOWH.exe
  2⤵
  PID:6324
- C:\Windows\System\hAKsvnf.exe
  C:\Windows\System\hAKsvnf.exe
  2⤵
  PID:6352
- C:\Windows\System\AtKxmIt.exe
  C:\Windows\System\AtKxmIt.exe
  2⤵
  PID:6376
- C:\Windows\System\ifrNRGq.exe
  C:\Windows\System\ifrNRGq.exe
  2⤵
  PID:6400
- C:\Windows\System\MocouIK.exe
  C:\Windows\System\MocouIK.exe
  2⤵
  PID:6420
- C:\Windows\System\YYEroEj.exe
  C:\Windows\System\YYEroEj.exe
  2⤵
  PID:6440
- C:\Windows\System\JwPNdZr.exe
  C:\Windows\System\JwPNdZr.exe
  2⤵
  PID:6524
- C:\Windows\System\hqGPzzD.exe
  C:\Windows\System\hqGPzzD.exe
  2⤵
  PID:6548
- C:\Windows\System\SaHGfZs.exe
  C:\Windows\System\SaHGfZs.exe
  2⤵
  PID:6588
- C:\Windows\System\xnvCFxk.exe
  C:\Windows\System\xnvCFxk.exe
  2⤵
  PID:6612
- C:\Windows\System\ZsPCYGw.exe
  C:\Windows\System\ZsPCYGw.exe
  2⤵
  PID:6640
- C:\Windows\System\WJxUfEs.exe
  C:\Windows\System\WJxUfEs.exe
  2⤵
  PID:6660
- C:\Windows\System\XqjFdVK.exe
  C:\Windows\System\XqjFdVK.exe
  2⤵
  PID:6680
- C:\Windows\System\elCMJMJ.exe
  C:\Windows\System\elCMJMJ.exe
  2⤵
  PID:6736
- C:\Windows\System\zROxPRU.exe
  C:\Windows\System\zROxPRU.exe
  2⤵
  PID:6764
- C:\Windows\System\iLkNktk.exe
  C:\Windows\System\iLkNktk.exe
  2⤵
  PID:6788
- C:\Windows\System\YeqdGUq.exe
  C:\Windows\System\YeqdGUq.exe
  2⤵
  PID:6828
- C:\Windows\System\JIAFvLf.exe
  C:\Windows\System\JIAFvLf.exe
  2⤵
  PID:6892
- C:\Windows\System\WBKPMrC.exe
  C:\Windows\System\WBKPMrC.exe
  2⤵
  PID:6912
- C:\Windows\System\QPdRGpM.exe
  C:\Windows\System\QPdRGpM.exe
  2⤵
  PID:6928
- C:\Windows\System\IlpOfLH.exe
  C:\Windows\System\IlpOfLH.exe
  2⤵
  PID:6948
- C:\Windows\System\GzSNAPB.exe
  C:\Windows\System\GzSNAPB.exe
  2⤵
  PID:6980
- C:\Windows\System\KfNxGkh.exe
  C:\Windows\System\KfNxGkh.exe
  2⤵
  PID:7032
- C:\Windows\System\xWydxye.exe
  C:\Windows\System\xWydxye.exe
  2⤵
  PID:7048
- C:\Windows\System\DFlLhrS.exe
  C:\Windows\System\DFlLhrS.exe
  2⤵
  PID:7088
- C:\Windows\System\QpDmTwd.exe
  C:\Windows\System\QpDmTwd.exe
  2⤵
  PID:7116
- C:\Windows\System\ihZEXTA.exe
  C:\Windows\System\ihZEXTA.exe
  2⤵
  PID:7140
- C:\Windows\System\ALqmkHh.exe
  C:\Windows\System\ALqmkHh.exe
  2⤵
  PID:7156
- C:\Windows\System\qeZqxzL.exe
  C:\Windows\System\qeZqxzL.exe
  2⤵
  PID:5096
- C:\Windows\System\dLqZHpf.exe
  C:\Windows\System\dLqZHpf.exe
  2⤵
  PID:6192
- C:\Windows\System\ngWTRtx.exe
  C:\Windows\System\ngWTRtx.exe
  2⤵
  PID:6260
- C:\Windows\System\mwIwPRQ.exe
  C:\Windows\System\mwIwPRQ.exe
  2⤵
  PID:6276
- C:\Windows\System\nYfFfis.exe
  C:\Windows\System\nYfFfis.exe
  2⤵
  PID:6296
- C:\Windows\System\bZaIVWd.exe
  C:\Windows\System\bZaIVWd.exe
  2⤵
  PID:6488
- C:\Windows\System\KWXqugi.exe
  C:\Windows\System\KWXqugi.exe
  2⤵
  PID:6460
- C:\Windows\System\QJTXMbO.exe
  C:\Windows\System\QJTXMbO.exe
  2⤵
  PID:6544
- C:\Windows\System\bSvrKQf.exe
  C:\Windows\System\bSvrKQf.exe
  2⤵
  PID:6692
- C:\Windows\System\XSWdKxp.exe
  C:\Windows\System\XSWdKxp.exe
  2⤵
  PID:3452
- C:\Windows\System\SlJDkBX.exe
  C:\Windows\System\SlJDkBX.exe
  2⤵
  PID:6776
- C:\Windows\System\glbJvHm.exe
  C:\Windows\System\glbJvHm.exe
  2⤵
  PID:6900
- C:\Windows\System\EFUZRfI.exe
  C:\Windows\System\EFUZRfI.exe
  2⤵
  PID:6936
- C:\Windows\System\lRSXXgZ.exe
  C:\Windows\System\lRSXXgZ.exe
  2⤵
  PID:7080
- C:\Windows\System\dnataqF.exe
  C:\Windows\System\dnataqF.exe
  2⤵
  PID:5772
- C:\Windows\System\vTlDPZP.exe
  C:\Windows\System\vTlDPZP.exe
  2⤵
  PID:6188
- C:\Windows\System\TDaacUi.exe
  C:\Windows\System\TDaacUi.exe
  2⤵
  PID:6216
- C:\Windows\System\JPSVorH.exe
  C:\Windows\System\JPSVorH.exe
  2⤵
  PID:6364
- C:\Windows\System\icRtuUS.exe
  C:\Windows\System\icRtuUS.exe
  2⤵
  PID:6724
- C:\Windows\System\lwgbUBV.exe
  C:\Windows\System\lwgbUBV.exe
  2⤵
  PID:6888
- C:\Windows\System\TqUxxpS.exe
  C:\Windows\System\TqUxxpS.exe
  2⤵
  PID:7096
- C:\Windows\System\lHiSbIe.exe
  C:\Windows\System\lHiSbIe.exe
  2⤵
  PID:4940
- C:\Windows\System\eAvzHIb.exe
  C:\Windows\System\eAvzHIb.exe
  2⤵
  PID:6864
- C:\Windows\System\FyhIuHi.exe
  C:\Windows\System\FyhIuHi.exe
  2⤵
  PID:6960
- C:\Windows\System\CwXZilq.exe
  C:\Windows\System\CwXZilq.exe
  2⤵
  PID:7192
- C:\Windows\System\SxDFlQi.exe
  C:\Windows\System\SxDFlQi.exe
  2⤵
  PID:7212
- C:\Windows\System\uXaeOHs.exe
  C:\Windows\System\uXaeOHs.exe
  2⤵
  PID:7232
- C:\Windows\System\XjbRBDJ.exe
  C:\Windows\System\XjbRBDJ.exe
  2⤵
  PID:7268
- C:\Windows\System\VmVhtjI.exe
  C:\Windows\System\VmVhtjI.exe
  2⤵
  PID:7312
- C:\Windows\System\KOdmsoX.exe
  C:\Windows\System\KOdmsoX.exe
  2⤵
  PID:7328
- C:\Windows\System\SRLSCRz.exe
  C:\Windows\System\SRLSCRz.exe
  2⤵
  PID:7376
- C:\Windows\System\fXAWsie.exe
  C:\Windows\System\fXAWsie.exe
  2⤵
  PID:7424
- C:\Windows\System\pHQqdeX.exe
  C:\Windows\System\pHQqdeX.exe
  2⤵
  PID:7464
- C:\Windows\System\HKjAGAd.exe
  C:\Windows\System\HKjAGAd.exe
  2⤵
  PID:7484
- C:\Windows\System\GVpPVNR.exe
  C:\Windows\System\GVpPVNR.exe
  2⤵
  PID:7536
- C:\Windows\System\TsdnnEp.exe
  C:\Windows\System\TsdnnEp.exe
  2⤵
  PID:7576
- C:\Windows\System\FzHzgPJ.exe
  C:\Windows\System\FzHzgPJ.exe
  2⤵
  PID:7592
- C:\Windows\System\kdpizhh.exe
  C:\Windows\System\kdpizhh.exe
  2⤵
  PID:7612
- C:\Windows\System\szldNrs.exe
  C:\Windows\System\szldNrs.exe
  2⤵
  PID:7632
- C:\Windows\System\DmIMtAx.exe
  C:\Windows\System\DmIMtAx.exe
  2⤵
  PID:7652
- C:\Windows\System\WkjFkNn.exe
  C:\Windows\System\WkjFkNn.exe
  2⤵
  PID:7672
- C:\Windows\System\XvROgJM.exe
  C:\Windows\System\XvROgJM.exe
  2⤵
  PID:7696
- C:\Windows\System\LJOcVMC.exe
  C:\Windows\System\LJOcVMC.exe
  2⤵
  PID:7716
- C:\Windows\System\xUdcQuZ.exe
  C:\Windows\System\xUdcQuZ.exe
  2⤵
  PID:7756
- C:\Windows\System\BXFWmAM.exe
  C:\Windows\System\BXFWmAM.exe
  2⤵
  PID:7784
- C:\Windows\System\McpJKms.exe
  C:\Windows\System\McpJKms.exe
  2⤵
  PID:7812
- C:\Windows\System\vnIPNbU.exe
  C:\Windows\System\vnIPNbU.exe
  2⤵
  PID:7828
- C:\Windows\System\BWayrUy.exe
  C:\Windows\System\BWayrUy.exe
  2⤵
  PID:7852
- C:\Windows\System\VrZgYHA.exe
  C:\Windows\System\VrZgYHA.exe
  2⤵
  PID:7872
- C:\Windows\System\EkTQlNA.exe
  C:\Windows\System\EkTQlNA.exe
  2⤵
  PID:7892
- C:\Windows\System\qnkXoTx.exe
  C:\Windows\System\qnkXoTx.exe
  2⤵
  PID:7912
- C:\Windows\System\qprtKBj.exe
  C:\Windows\System\qprtKBj.exe
  2⤵
  PID:7932
- C:\Windows\System\UwiGCoP.exe
  C:\Windows\System\UwiGCoP.exe
  2⤵
  PID:7956
- C:\Windows\System\arKgzvm.exe
  C:\Windows\System\arKgzvm.exe
  2⤵
  PID:7976
- C:\Windows\System\ZLQHUna.exe
  C:\Windows\System\ZLQHUna.exe
  2⤵
  PID:7992
- C:\Windows\System\JEHgagq.exe
  C:\Windows\System\JEHgagq.exe
  2⤵
  PID:8016
- C:\Windows\System\RxHVekO.exe
  C:\Windows\System\RxHVekO.exe
  2⤵
  PID:8036
- C:\Windows\System\axMCjCy.exe
  C:\Windows\System\axMCjCy.exe
  2⤵
  PID:8056
- C:\Windows\System\wrIQlYP.exe
  C:\Windows\System\wrIQlYP.exe
  2⤵
  PID:8072
- C:\Windows\System\gMAenSO.exe
  C:\Windows\System\gMAenSO.exe
  2⤵
  PID:8096
- C:\Windows\System\SjPkhcs.exe
  C:\Windows\System\SjPkhcs.exe
  2⤵
  PID:8116
- C:\Windows\System\IeTpcLM.exe
  C:\Windows\System\IeTpcLM.exe
  2⤵
  PID:8140
- C:\Windows\System\zNpGhmp.exe
  C:\Windows\System\zNpGhmp.exe
  2⤵
  PID:8156
- C:\Windows\System\ButIIJo.exe
  C:\Windows\System\ButIIJo.exe
  2⤵
  PID:8180
- C:\Windows\System\GBIONDi.exe
  C:\Windows\System\GBIONDi.exe
  2⤵
  PID:7184
- C:\Windows\System\TlSmRId.exe
  C:\Windows\System\TlSmRId.exe
  2⤵
  PID:7200
- C:\Windows\System\nzlJGYG.exe
  C:\Windows\System\nzlJGYG.exe
  2⤵
  PID:7252
- C:\Windows\System\lDPhzyt.exe
  C:\Windows\System\lDPhzyt.exe
  2⤵
  PID:3532
- C:\Windows\System\tWhuVzG.exe
  C:\Windows\System\tWhuVzG.exe
  2⤵
  PID:7400
- C:\Windows\System\QwUjkzT.exe
  C:\Windows\System\QwUjkzT.exe
  2⤵
  PID:8048
- C:\Windows\System\ljaQQni.exe
  C:\Windows\System\ljaQQni.exe
  2⤵
  PID:8108
- C:\Windows\System\pYpYtOW.exe
  C:\Windows\System\pYpYtOW.exe
  2⤵
  PID:7600
- C:\Windows\System\pqziVSy.exe
  C:\Windows\System\pqziVSy.exe
  2⤵
  PID:7264
- C:\Windows\System\xkPiChn.exe
  C:\Windows\System\xkPiChn.exe
  2⤵
  PID:7404
- C:\Windows\System\mHqCPbC.exe
  C:\Windows\System\mHqCPbC.exe
  2⤵
  PID:7624
- C:\Windows\System\XNlfION.exe
  C:\Windows\System\XNlfION.exe
  2⤵
  PID:7780
- C:\Windows\System\sjvRtLj.exe
  C:\Windows\System\sjvRtLj.exe
  2⤵
  PID:7880
- C:\Windows\System\xlBZqen.exe
  C:\Windows\System\xlBZqen.exe
  2⤵
  PID:7972
- C:\Windows\System\vbwVpoP.exe
  C:\Windows\System\vbwVpoP.exe
  2⤵
  PID:8168
- C:\Windows\System\YddZSvo.exe
  C:\Windows\System\YddZSvo.exe
  2⤵
  PID:8080
- C:\Windows\System\KCqJGlQ.exe
  C:\Windows\System\KCqJGlQ.exe
  2⤵
  PID:7480
- C:\Windows\System\AokMuuE.exe
  C:\Windows\System\AokMuuE.exe
  2⤵
  PID:8032
- C:\Windows\System\NuTNVGI.exe
  C:\Windows\System\NuTNVGI.exe
  2⤵
  PID:8208
- C:\Windows\System\GCVfJNl.exe
  C:\Windows\System\GCVfJNl.exe
  2⤵
  PID:8224
- C:\Windows\System\SPLLCwb.exe
  C:\Windows\System\SPLLCwb.exe
  2⤵
  PID:8260
- C:\Windows\System\gYDynLB.exe
  C:\Windows\System\gYDynLB.exe
  2⤵
  PID:8288
- C:\Windows\System\EwhwWAk.exe
  C:\Windows\System\EwhwWAk.exe
  2⤵
  PID:8304
- C:\Windows\System\rDUtSfO.exe
  C:\Windows\System\rDUtSfO.exe
  2⤵
  PID:8328
- C:\Windows\System\DvmCDqG.exe
  C:\Windows\System\DvmCDqG.exe
  2⤵
  PID:8344
- C:\Windows\System\FqtIIvn.exe
  C:\Windows\System\FqtIIvn.exe
  2⤵
  PID:8364
- C:\Windows\System\aNDRXeB.exe
  C:\Windows\System\aNDRXeB.exe
  2⤵
  PID:8384
- C:\Windows\System\oHszXmJ.exe
  C:\Windows\System\oHszXmJ.exe
  2⤵
  PID:8400
- C:\Windows\System\JRAefNe.exe
  C:\Windows\System\JRAefNe.exe
  2⤵
  PID:8416
- C:\Windows\System\qfdwGjg.exe
  C:\Windows\System\qfdwGjg.exe
  2⤵
  PID:8436
- C:\Windows\System\IaMzLNv.exe
  C:\Windows\System\IaMzLNv.exe
  2⤵
  PID:8456
- C:\Windows\System\KrCVvmk.exe
  C:\Windows\System\KrCVvmk.exe
  2⤵
  PID:8476
- C:\Windows\System\zUivkuB.exe
  C:\Windows\System\zUivkuB.exe
  2⤵
  PID:8496
- C:\Windows\System\ZkgoeJh.exe
  C:\Windows\System\ZkgoeJh.exe
  2⤵
  PID:8516
- C:\Windows\System\SQEccZn.exe
  C:\Windows\System\SQEccZn.exe
  2⤵
  PID:8532
- C:\Windows\System\gkNkBPg.exe
  C:\Windows\System\gkNkBPg.exe
  2⤵
  PID:8548
- C:\Windows\System\fQlJmDf.exe
  C:\Windows\System\fQlJmDf.exe
  2⤵
  PID:8564
- C:\Windows\System\zuWiJAK.exe
  C:\Windows\System\zuWiJAK.exe
  2⤵
  PID:8580
- C:\Windows\System\vycZnKU.exe
  C:\Windows\System\vycZnKU.exe
  2⤵
  PID:8596
- C:\Windows\System\QKmffAy.exe
  C:\Windows\System\QKmffAy.exe
  2⤵
  PID:8612
- C:\Windows\System\swQnsUj.exe
  C:\Windows\System\swQnsUj.exe
  2⤵
  PID:8632
- C:\Windows\System\hYaFldy.exe
  C:\Windows\System\hYaFldy.exe
  2⤵
  PID:8648
- C:\Windows\System\pxBbrVo.exe
  C:\Windows\System\pxBbrVo.exe
  2⤵
  PID:8668
- C:\Windows\System\LHTMxBt.exe
  C:\Windows\System\LHTMxBt.exe
  2⤵
  PID:8708
- C:\Windows\System\bhKWcKV.exe
  C:\Windows\System\bhKWcKV.exe
  2⤵
  PID:8732
- C:\Windows\System\bkkBqhz.exe
  C:\Windows\System\bkkBqhz.exe
  2⤵
  PID:8752
- C:\Windows\System\OvXXynE.exe
  C:\Windows\System\OvXXynE.exe
  2⤵
  PID:8772
- C:\Windows\System\oWFsAQn.exe
  C:\Windows\System\oWFsAQn.exe
  2⤵
  PID:8788
- C:\Windows\System\rYnMxTm.exe
  C:\Windows\System\rYnMxTm.exe
  2⤵
  PID:8812
- C:\Windows\System\gyiOdao.exe
  C:\Windows\System\gyiOdao.exe
  2⤵
  PID:8828
- C:\Windows\System\hJuGIhe.exe
  C:\Windows\System\hJuGIhe.exe
  2⤵
  PID:8852
- C:\Windows\System\sAFMwjy.exe
  C:\Windows\System\sAFMwjy.exe
  2⤵
  PID:8868
- C:\Windows\System\rTUGrDp.exe
  C:\Windows\System\rTUGrDp.exe
  2⤵
  PID:8884
- C:\Windows\System\juJZCds.exe
  C:\Windows\System\juJZCds.exe
  2⤵
  PID:8900
- C:\Windows\System\yjSafDo.exe
  C:\Windows\System\yjSafDo.exe
  2⤵
  PID:8920
- C:\Windows\System\PEHLnBv.exe
  C:\Windows\System\PEHLnBv.exe
  2⤵
  PID:8940
- C:\Windows\System\zoXFgeg.exe
  C:\Windows\System\zoXFgeg.exe
  2⤵
  PID:8956
- C:\Windows\System\YgqiHyH.exe
  C:\Windows\System\YgqiHyH.exe
  2⤵
  PID:8972
- C:\Windows\System\KzwuthI.exe
  C:\Windows\System\KzwuthI.exe
  2⤵
  PID:8992
- C:\Windows\System\YcYlpVD.exe
  C:\Windows\System\YcYlpVD.exe
  2⤵
  PID:9012
- C:\Windows\System\DbQcmow.exe
  C:\Windows\System\DbQcmow.exe
  2⤵
  PID:9036
- C:\Windows\System\UbHJzXf.exe
  C:\Windows\System\UbHJzXf.exe
  2⤵
  PID:9056
- C:\Windows\System\CioLMcw.exe
  C:\Windows\System\CioLMcw.exe
  2⤵
  PID:9084
- C:\Windows\System\ycygDsS.exe
  C:\Windows\System\ycygDsS.exe
  2⤵
  PID:9108
- C:\Windows\System\tsJPuFM.exe
  C:\Windows\System\tsJPuFM.exe
  2⤵
  PID:9128
- C:\Windows\System\HXatrjj.exe
  C:\Windows\System\HXatrjj.exe
  2⤵
  PID:9148
- C:\Windows\System\XWNYWYu.exe
  C:\Windows\System\XWNYWYu.exe
  2⤵
  PID:9168
- C:\Windows\System\LrsdDPK.exe
  C:\Windows\System\LrsdDPK.exe
  2⤵
  PID:9192
- C:\Windows\System\WqWSXcN.exe
  C:\Windows\System\WqWSXcN.exe
  2⤵
  PID:9208
- C:\Windows\System\NPYqBZU.exe
  C:\Windows\System\NPYqBZU.exe
  2⤵
  PID:8008
- C:\Windows\System\mdHEnBP.exe
  C:\Windows\System\mdHEnBP.exe
  2⤵
  PID:7712
- C:\Windows\System\OvjVgCF.exe
  C:\Windows\System\OvjVgCF.exe
  2⤵
  PID:7556
- C:\Windows\System\TeIKiuz.exe
  C:\Windows\System\TeIKiuz.exe
  2⤵
  PID:8064
- C:\Windows\System\ePQKPtG.exe
  C:\Windows\System\ePQKPtG.exe
  2⤵
  PID:8132
- C:\Windows\System\PBwiYGb.exe
  C:\Windows\System\PBwiYGb.exe
  2⤵
  PID:8152
- C:\Windows\System\QPLIVwt.exe
  C:\Windows\System\QPLIVwt.exe
  2⤵
  PID:7068
- C:\Windows\System\yKGoyfX.exe
  C:\Windows\System\yKGoyfX.exe
  2⤵
  PID:8544
- C:\Windows\System\ENFjCCX.exe
  C:\Windows\System\ENFjCCX.exe
  2⤵
  PID:8252
- C:\Windows\System\MARosmb.exe
  C:\Windows\System\MARosmb.exe
  2⤵
  PID:8620
- C:\Windows\System\hEivabF.exe
  C:\Windows\System\hEivabF.exe
  2⤵
  PID:8656
- C:\Windows\System\WtTNOYJ.exe
  C:\Windows\System\WtTNOYJ.exe
  2⤵
  PID:8316
- C:\Windows\System\pGxqcBL.exe
  C:\Windows\System\pGxqcBL.exe
  2⤵
  PID:8724
- C:\Windows\System\ocymWxe.exe
  C:\Windows\System\ocymWxe.exe
  2⤵
  PID:7648
- C:\Windows\System\xWBFJGv.exe
  C:\Windows\System\xWBFJGv.exe
  2⤵
  PID:8088
- C:\Windows\System\rpFRrYN.exe
  C:\Windows\System\rpFRrYN.exe
  2⤵
  PID:8408
- C:\Windows\System\nwsXwIL.exe
  C:\Windows\System\nwsXwIL.exe
  2⤵
  PID:8824
- C:\Windows\System\kXCZWwO.exe
  C:\Windows\System\kXCZWwO.exe
  2⤵
  PID:8860
- C:\Windows\System\FCMnRts.exe
  C:\Windows\System\FCMnRts.exe
  2⤵
  PID:9668
- C:\Windows\System\ACeUNhq.exe
  C:\Windows\System\ACeUNhq.exe
  2⤵
  PID:9684
- C:\Windows\System\SMbtIOB.exe
  C:\Windows\System\SMbtIOB.exe
  2⤵
  PID:9700
- C:\Windows\System\GDSsbyW.exe
  C:\Windows\System\GDSsbyW.exe
  2⤵
  PID:9716
- C:\Windows\System\AOsQxSz.exe
  C:\Windows\System\AOsQxSz.exe
  2⤵
  PID:9736
- C:\Windows\System\HWmBKfs.exe
  C:\Windows\System\HWmBKfs.exe
  2⤵
  PID:9756
- C:\Windows\System\XQOGSsV.exe
  C:\Windows\System\XQOGSsV.exe
  2⤵
  PID:9780
- C:\Windows\System\IBVTUlw.exe
  C:\Windows\System\IBVTUlw.exe
  2⤵
  PID:9796
- C:\Windows\System\dfBIQxx.exe
  C:\Windows\System\dfBIQxx.exe
  2⤵
  PID:9816
- C:\Windows\System\dgtAIvj.exe
  C:\Windows\System\dgtAIvj.exe
  2⤵
  PID:9832
- C:\Windows\System\GDWiWuK.exe
  C:\Windows\System\GDWiWuK.exe
  2⤵
  PID:9856
- C:\Windows\System\yHsJAid.exe
  C:\Windows\System\yHsJAid.exe
  2⤵
  PID:9876
- C:\Windows\System\epZjUas.exe
  C:\Windows\System\epZjUas.exe
  2⤵
  PID:9896
- C:\Windows\System\LDFSgET.exe
  C:\Windows\System\LDFSgET.exe
  2⤵
  PID:9916
- C:\Windows\System\uyYRylX.exe
  C:\Windows\System\uyYRylX.exe
  2⤵
  PID:9936
- C:\Windows\System\DTdmmdZ.exe
  C:\Windows\System\DTdmmdZ.exe
  2⤵
  PID:9960
- C:\Windows\System\YEFXThe.exe
  C:\Windows\System\YEFXThe.exe
  2⤵
  PID:9976
- C:\Windows\System\OgJJmkS.exe
  C:\Windows\System\OgJJmkS.exe
  2⤵
  PID:10004
- C:\Windows\System\YyjCRxa.exe
  C:\Windows\System\YyjCRxa.exe
  2⤵
  PID:10028
- C:\Windows\System\TxSTPfd.exe
  C:\Windows\System\TxSTPfd.exe
  2⤵
  PID:10044
- C:\Windows\System\PAICSHa.exe
  C:\Windows\System\PAICSHa.exe
  2⤵
  PID:10064
- C:\Windows\System\epSwzYk.exe
  C:\Windows\System\epSwzYk.exe
  2⤵
  PID:10084
- C:\Windows\System\iYMWnxF.exe
  C:\Windows\System\iYMWnxF.exe
  2⤵
  PID:10104
- C:\Windows\System\MpOajuy.exe
  C:\Windows\System\MpOajuy.exe
  2⤵
  PID:10132
- C:\Windows\System\reBugHn.exe
  C:\Windows\System\reBugHn.exe
  2⤵
  PID:10148
- C:\Windows\System\NQyNsIe.exe
  C:\Windows\System\NQyNsIe.exe
  2⤵
  PID:10172
- C:\Windows\System\GRtDpbl.exe
  C:\Windows\System\GRtDpbl.exe
  2⤵
  PID:10192
- C:\Windows\System\cHuSqqR.exe
  C:\Windows\System\cHuSqqR.exe
  2⤵
  PID:10212
- C:\Windows\System\JlzSnae.exe
  C:\Windows\System\JlzSnae.exe
  2⤵
  PID:8804
- C:\Windows\System\jQdApyg.exe
  C:\Windows\System\jQdApyg.exe
  2⤵
  PID:9104
- C:\Windows\System\EYRFKsB.exe
  C:\Windows\System\EYRFKsB.exe
  2⤵
  PID:9188
- C:\Windows\System\FYSwLWq.exe
  C:\Windows\System\FYSwLWq.exe
  2⤵
  PID:3972
- C:\Windows\System\xTDDTbf.exe
  C:\Windows\System\xTDDTbf.exe
  2⤵
  PID:8696
- C:\Windows\System\IqMtfWJ.exe
  C:\Windows\System\IqMtfWJ.exe
  2⤵
  PID:8276
- C:\Windows\System\kJDhWdi.exe
  C:\Windows\System\kJDhWdi.exe
  2⤵
  PID:9232
- C:\Windows\System\crVScYD.exe
  C:\Windows\System\crVScYD.exe
  2⤵
  PID:8716
- C:\Windows\System\blUHbcV.exe
  C:\Windows\System\blUHbcV.exe
  2⤵
  PID:9220
- C:\Windows\System\KlMqHIx.exe
  C:\Windows\System\KlMqHIx.exe
  2⤵
  PID:9448
- C:\Windows\System\BQZGclh.exe
  C:\Windows\System\BQZGclh.exe
  2⤵
  PID:9488
- C:\Windows\System\ryfaTZM.exe
  C:\Windows\System\ryfaTZM.exe
  2⤵
  PID:9712
- C:\Windows\System\bqcrvRK.exe
  C:\Windows\System\bqcrvRK.exe
  2⤵
  PID:9692
- C:\Windows\System\CueNipJ.exe
  C:\Windows\System\CueNipJ.exe
  2⤵
  PID:9892
- C:\Windows\System\YvsbqaP.exe
  C:\Windows\System\YvsbqaP.exe
  2⤵
  PID:9968
- C:\Windows\System\vxCAPKR.exe
  C:\Windows\System\vxCAPKR.exe
  2⤵
  PID:9824
- C:\Windows\System\KJKvAHF.exe
  C:\Windows\System\KJKvAHF.exe
  2⤵
  PID:9840
- C:\Windows\System\ZvWUJQC.exe
  C:\Windows\System\ZvWUJQC.exe
  2⤵
  PID:10164
- C:\Windows\System\iFcLkpI.exe
  C:\Windows\System\iFcLkpI.exe
  2⤵
  PID:10184
- C:\Windows\System\GZFnNks.exe
  C:\Windows\System\GZFnNks.exe
  2⤵
  PID:10208
- C:\Windows\System\LGLDBoT.exe
  C:\Windows\System\LGLDBoT.exe
  2⤵
  PID:10128
- C:\Windows\System\xWiXRzE.exe
  C:\Windows\System\xWiXRzE.exe
  2⤵
  PID:10156
- C:\Windows\System\gNnsLxq.exe
  C:\Windows\System\gNnsLxq.exe
  2⤵
  PID:8472
- C:\Windows\System\bPMHLMA.exe
  C:\Windows\System\bPMHLMA.exe
  2⤵
  PID:8588
- C:\Windows\System\nLrPmun.exe
  C:\Windows\System\nLrPmun.exe
  2⤵
  PID:9100
- C:\Windows\System\HjoJTvk.exe
  C:\Windows\System\HjoJTvk.exe
  2⤵
  PID:9328
- C:\Windows\System\jAmuZrv.exe
  C:\Windows\System\jAmuZrv.exe
  2⤵
  PID:8412
- C:\Windows\System\meJeHYP.exe
  C:\Windows\System\meJeHYP.exe
  2⤵
  PID:9204
- C:\Windows\System\uRsGBAV.exe
  C:\Windows\System\uRsGBAV.exe
  2⤵
  PID:9120
- C:\Windows\System\GbZqEAV.exe
  C:\Windows\System\GbZqEAV.exe
  2⤵
  PID:9792
- C:\Windows\System\oyuSuQr.exe
  C:\Windows\System\oyuSuQr.exe
  2⤵
  PID:8492
- C:\Windows\System\PtSMpmH.exe
  C:\Windows\System\PtSMpmH.exe
  2⤵
  PID:10244
- C:\Windows\System\DoMWhOC.exe
  C:\Windows\System\DoMWhOC.exe
  2⤵
  PID:10264
- C:\Windows\System\XxBYsDJ.exe
  C:\Windows\System\XxBYsDJ.exe
  2⤵
  PID:10284
- C:\Windows\System\WxXAUiw.exe
  C:\Windows\System\WxXAUiw.exe
  2⤵
  PID:10304
- C:\Windows\System\CHGweDx.exe
  C:\Windows\System\CHGweDx.exe
  2⤵
  PID:10324
- C:\Windows\System\faRJOQS.exe
  C:\Windows\System\faRJOQS.exe
  2⤵
  PID:10340
- C:\Windows\System\CMQTaOU.exe
  C:\Windows\System\CMQTaOU.exe
  2⤵
  PID:10364
- C:\Windows\System\hXLRLdt.exe
  C:\Windows\System\hXLRLdt.exe
  2⤵
  PID:10380
- C:\Windows\System\TBZTcrN.exe
  C:\Windows\System\TBZTcrN.exe
  2⤵
  PID:10400
- C:\Windows\System\qCYDvxS.exe
  C:\Windows\System\qCYDvxS.exe
  2⤵
  PID:10416
- C:\Windows\System\nEMPVhv.exe
  C:\Windows\System\nEMPVhv.exe
  2⤵
  PID:10440
- C:\Windows\System\vUANYHE.exe
  C:\Windows\System\vUANYHE.exe
  2⤵
  PID:10456
- C:\Windows\System\GlBaVgb.exe
  C:\Windows\System\GlBaVgb.exe
  2⤵
  PID:10476
- C:\Windows\System\cvyMjki.exe
  C:\Windows\System\cvyMjki.exe
  2⤵
  PID:10492
- C:\Windows\System\XolOHhU.exe
  C:\Windows\System\XolOHhU.exe
  2⤵
  PID:10512
- C:\Windows\System\pUanKGZ.exe
  C:\Windows\System\pUanKGZ.exe
  2⤵
  PID:10536
- C:\Windows\System\CBqrzAO.exe
  C:\Windows\System\CBqrzAO.exe
  2⤵
  PID:10556
- C:\Windows\System\TEbJqQZ.exe
  C:\Windows\System\TEbJqQZ.exe
  2⤵
  PID:10580
- C:\Windows\System\dflBSXU.exe
  C:\Windows\System\dflBSXU.exe
  2⤵
  PID:10600
- C:\Windows\System\ZeTGEMy.exe
  C:\Windows\System\ZeTGEMy.exe
  2⤵
  PID:10620
- C:\Windows\System\mOmvVno.exe
  C:\Windows\System\mOmvVno.exe
  2⤵
  PID:10636
- C:\Windows\System\OLZTuDK.exe
  C:\Windows\System\OLZTuDK.exe
  2⤵
  PID:10656
- C:\Windows\System\YXAcuGB.exe
  C:\Windows\System\YXAcuGB.exe
  2⤵
  PID:10676
- C:\Windows\System\ySCBOdW.exe
  C:\Windows\System\ySCBOdW.exe
  2⤵
  PID:10692
- C:\Windows\System\mAcMFTd.exe
  C:\Windows\System\mAcMFTd.exe
  2⤵
  PID:10712
- C:\Windows\System\dyAvTtc.exe
  C:\Windows\System\dyAvTtc.exe
  2⤵
  PID:10736
- C:\Windows\System\MfiUCBc.exe
  C:\Windows\System\MfiUCBc.exe
  2⤵
  PID:10756
- C:\Windows\System\ubxvvDy.exe
  C:\Windows\System\ubxvvDy.exe
  2⤵
  PID:10776
- C:\Windows\System\zMgbUWZ.exe
  C:\Windows\System\zMgbUWZ.exe
  2⤵
  PID:10792
- C:\Windows\System\iKZqGPK.exe
  C:\Windows\System\iKZqGPK.exe
  2⤵
  PID:10812
- C:\Windows\System\vYHaJLR.exe
  C:\Windows\System\vYHaJLR.exe
  2⤵
  PID:10832
- C:\Windows\System\OlnDyDo.exe
  C:\Windows\System\OlnDyDo.exe
  2⤵
  PID:10860
- C:\Windows\System\HAfCqQj.exe
  C:\Windows\System\HAfCqQj.exe
  2⤵
  PID:10888
- C:\Windows\System\TfjOdET.exe
  C:\Windows\System\TfjOdET.exe
  2⤵
  PID:10904
- C:\Windows\System\OXWJSRc.exe
  C:\Windows\System\OXWJSRc.exe
  2⤵
  PID:10928
- C:\Windows\System\pKSjZpe.exe
  C:\Windows\System\pKSjZpe.exe
  2⤵
  PID:10948
- C:\Windows\System\eLFwHRS.exe
  C:\Windows\System\eLFwHRS.exe
  2⤵
  PID:10968
- C:\Windows\System\vSJchfK.exe
  C:\Windows\System\vSJchfK.exe
  2⤵
  PID:10984
- C:\Windows\System\RsOOpTR.exe
  C:\Windows\System\RsOOpTR.exe
  2⤵
  PID:11248
- C:\Windows\System\GrHGyve.exe
  C:\Windows\System\GrHGyve.exe
  2⤵
  PID:9984
- C:\Windows\System\iXLRQob.exe
  C:\Windows\System\iXLRQob.exe
  2⤵
  PID:7908
- C:\Windows\System\oAnbZbU.exe
  C:\Windows\System\oAnbZbU.exe
  2⤵
  PID:9180
- C:\Windows\System\bgrMgTn.exe
  C:\Windows\System\bgrMgTn.exe
  2⤵
  PID:9788
- C:\Windows\System\JEDbnFy.exe
  C:\Windows\System\JEDbnFy.exe
  2⤵
  PID:9748
- C:\Windows\System\mDwPySx.exe
  C:\Windows\System\mDwPySx.exe
  2⤵
  PID:10296
- C:\Windows\System\tvXYVjy.exe
  C:\Windows\System\tvXYVjy.exe
  2⤵
  PID:10060
- C:\Windows\System\qYdDfXO.exe
  C:\Windows\System\qYdDfXO.exe
  2⤵
  PID:10448
- C:\Windows\System\gxWDscM.exe
  C:\Windows\System\gxWDscM.exe
  2⤵
  PID:10124
- C:\Windows\System\jjgwzVP.exe
  C:\Windows\System\jjgwzVP.exe
  2⤵
  PID:10644
- C:\Windows\System\cZekALo.exe
  C:\Windows\System\cZekALo.exe
  2⤵
  PID:10720
- C:\Windows\System\jTNJYnz.exe
  C:\Windows\System\jTNJYnz.exe
  2⤵
  PID:8876
- C:\Windows\System\bDOjZir.exe
  C:\Windows\System\bDOjZir.exe
  2⤵
  PID:10356
- C:\Windows\System\ESRFcJj.exe
  C:\Windows\System\ESRFcJj.exe
  2⤵
  PID:3216
- C:\Windows\System\kYUCUzY.exe
  C:\Windows\System\kYUCUzY.exe
  2⤵
  PID:11004
- C:\Windows\System\kRVcOWk.exe
  C:\Windows\System\kRVcOWk.exe
  2⤵
  PID:3164
- C:\Windows\System\BQSFUBr.exe
  C:\Windows\System\BQSFUBr.exe
  2⤵
  PID:10432
- C:\Windows\System\zAIEsns.exe
  C:\Windows\System\zAIEsns.exe
  2⤵
  PID:11092
- C:\Windows\System\lEvFgYh.exe
  C:\Windows\System\lEvFgYh.exe
  2⤵
  PID:10488
- C:\Windows\System\FSNNoHH.exe
  C:\Windows\System\FSNNoHH.exe
  2⤵
  PID:10552
- C:\Windows\System\OssKKOa.exe
  C:\Windows\System\OssKKOa.exe
  2⤵
  PID:4436
- C:\Windows\System\HXxfmxQ.exe
  C:\Windows\System\HXxfmxQ.exe
  2⤵
  PID:11180
- C:\Windows\System\ALEteHj.exe
  C:\Windows\System\ALEteHj.exe
  2⤵
  PID:10880
- C:\Windows\System\HxswoSc.exe
  C:\Windows\System\HxswoSc.exe
  2⤵
  PID:11272
- C:\Windows\System\prddJaw.exe
  C:\Windows\System\prddJaw.exe
  2⤵
  PID:11300
- C:\Windows\System\WnQbitf.exe
  C:\Windows\System\WnQbitf.exe
  2⤵
  PID:11316
- C:\Windows\System\GfNKiOa.exe
  C:\Windows\System\GfNKiOa.exe
  2⤵
  PID:11336
- C:\Windows\System\BKFTtVC.exe
  C:\Windows\System\BKFTtVC.exe
  2⤵
  PID:11388
- C:\Windows\System\hgPequU.exe
  C:\Windows\System\hgPequU.exe
  2⤵
  PID:11408
- C:\Windows\System\KBVJeiV.exe
  C:\Windows\System\KBVJeiV.exe
  2⤵
  PID:11428
- C:\Windows\System\BdbMxpn.exe
  C:\Windows\System\BdbMxpn.exe
  2⤵
  PID:11452
- C:\Windows\System\PuyKREG.exe
  C:\Windows\System\PuyKREG.exe
  2⤵
  PID:11476
- C:\Windows\System\HtnwTnt.exe
  C:\Windows\System\HtnwTnt.exe
  2⤵
  PID:11496
- C:\Windows\System\zymUATU.exe
  C:\Windows\System\zymUATU.exe
  2⤵
  PID:11512
- C:\Windows\System\ewLVZXZ.exe
  C:\Windows\System\ewLVZXZ.exe
  2⤵
  PID:11532
- C:\Windows\System\dMVgsWE.exe
  C:\Windows\System\dMVgsWE.exe
  2⤵
  PID:11552
- C:\Windows\System\TIrFhzn.exe
  C:\Windows\System\TIrFhzn.exe
  2⤵
  PID:11568
- C:\Windows\System\OzgjWnH.exe
  C:\Windows\System\OzgjWnH.exe
  2⤵
  PID:11584
- C:\Windows\System\oSMZxmZ.exe
  C:\Windows\System\oSMZxmZ.exe
  2⤵
  PID:11600
- C:\Windows\System\tICdvtU.exe
  C:\Windows\System\tICdvtU.exe
  2⤵
  PID:11616
- C:\Windows\System\KPBPLaU.exe
  C:\Windows\System\KPBPLaU.exe
  2⤵
  PID:11632
- C:\Windows\System\yXkaPdJ.exe
  C:\Windows\System\yXkaPdJ.exe
  2⤵
  PID:11656
- C:\Windows\System\OpZtVRr.exe
  C:\Windows\System\OpZtVRr.exe
  2⤵
  PID:11676
- C:\Windows\System\FJUjljS.exe
  C:\Windows\System\FJUjljS.exe
  2⤵
  PID:11696
- C:\Windows\System\sqLPkAx.exe
  C:\Windows\System\sqLPkAx.exe
  2⤵
  PID:11716
- C:\Windows\System\jGiqMQT.exe
  C:\Windows\System\jGiqMQT.exe
  2⤵
  PID:11736
- C:\Windows\System\rdTsWcw.exe
  C:\Windows\System\rdTsWcw.exe
  2⤵
  PID:11752
- C:\Windows\System\jWHrgiG.exe
  C:\Windows\System\jWHrgiG.exe
  2⤵
  PID:11768
- C:\Windows\System\ewEYasM.exe
  C:\Windows\System\ewEYasM.exe
  2⤵
  PID:11784
- C:\Windows\System\gfTSVFQ.exe
  C:\Windows\System\gfTSVFQ.exe
  2⤵
  PID:11804
- C:\Windows\System\aKYSMKL.exe
  C:\Windows\System\aKYSMKL.exe
  2⤵
  PID:11828
- C:\Windows\System\QWYTdrB.exe
  C:\Windows\System\QWYTdrB.exe
  2⤵
  PID:11848
- C:\Windows\System\tWIdZLf.exe
  C:\Windows\System\tWIdZLf.exe
  2⤵
  PID:11868
- C:\Windows\System\taEOlIF.exe
  C:\Windows\System\taEOlIF.exe
  2⤵
  PID:11892
- C:\Windows\System\aJPNWtU.exe
  C:\Windows\System\aJPNWtU.exe
  2⤵
  PID:11920
- C:\Windows\System\FMosVAQ.exe
  C:\Windows\System\FMosVAQ.exe
  2⤵
  PID:11940
- C:\Windows\System\VfwFifP.exe
  C:\Windows\System\VfwFifP.exe
  2⤵
  PID:11960
- C:\Windows\System\KFJjxDN.exe
  C:\Windows\System\KFJjxDN.exe
  2⤵
  PID:11976
- C:\Windows\System\nTPlABy.exe
  C:\Windows\System\nTPlABy.exe
  2⤵
  PID:11996
- C:\Windows\System\zzFhnsq.exe
  C:\Windows\System\zzFhnsq.exe
  2⤵
  PID:12012
- C:\Windows\System\mYJVukV.exe
  C:\Windows\System\mYJVukV.exe
  2⤵
  PID:12040
- C:\Windows\System\KYMTTED.exe
  C:\Windows\System\KYMTTED.exe
  2⤵
  PID:12056
- C:\Windows\System\VpYlZhV.exe
  C:\Windows\System\VpYlZhV.exe
  2⤵
  PID:12076
- C:\Windows\System\Tulztbs.exe
  C:\Windows\System\Tulztbs.exe
  2⤵
  PID:12096
- C:\Windows\System\nTmmaRj.exe
  C:\Windows\System\nTmmaRj.exe
  2⤵
  PID:12112
- C:\Windows\System\FSKyrmB.exe
  C:\Windows\System\FSKyrmB.exe
  2⤵
  PID:12132
- C:\Windows\System\jgaKnVV.exe
  C:\Windows\System\jgaKnVV.exe
  2⤵
  PID:12148
- C:\Windows\System\SJBLJmC.exe
  C:\Windows\System\SJBLJmC.exe
  2⤵
  PID:12168
- C:\Windows\System\mIbVRyG.exe
  C:\Windows\System\mIbVRyG.exe
  2⤵
  PID:12184
- C:\Windows\System\fxxEKPv.exe
  C:\Windows\System\fxxEKPv.exe
  2⤵
  PID:12200
- C:\Windows\System\mYfVOnW.exe
  C:\Windows\System\mYfVOnW.exe
  2⤵
  PID:12216
- C:\Windows\System\WVxafeJ.exe
  C:\Windows\System\WVxafeJ.exe
  2⤵
  PID:12232
- C:\Windows\System\uFjmrmh.exe
  C:\Windows\System\uFjmrmh.exe
  2⤵
  PID:12252
- C:\Windows\System\jNrNNKM.exe
  C:\Windows\System\jNrNNKM.exe
  2⤵
  PID:12272
- C:\Windows\System\QiVIBvp.exe
  C:\Windows\System\QiVIBvp.exe
  2⤵
  PID:10960
- C:\Windows\System\iXAYaDi.exe
  C:\Windows\System\iXAYaDi.exe
  2⤵
  PID:10040
- C:\Windows\System\kZYRdBx.exe
  C:\Windows\System\kZYRdBx.exe
  2⤵
  PID:9680
- C:\Windows\System\XBUKTjo.exe
  C:\Windows\System\XBUKTjo.exe
  2⤵
  PID:10428
- C:\Windows\System\pOGxCYE.exe
  C:\Windows\System\pOGxCYE.exe
  2⤵
  PID:10300
- C:\Windows\System\CwGZxXH.exe
  C:\Windows\System\CwGZxXH.exe
  2⤵
  PID:10332
- C:\Windows\System\ogwVxAx.exe
  C:\Windows\System\ogwVxAx.exe
  2⤵
  PID:11064
- C:\Windows\System\UBGKkrP.exe
  C:\Windows\System\UBGKkrP.exe
  2⤵
  PID:10548
- C:\Windows\System\QHKetFR.exe
  C:\Windows\System\QHKetFR.exe
  2⤵
  PID:10744
- C:\Windows\System\CmNLtWK.exe
  C:\Windows\System\CmNLtWK.exe
  2⤵
  PID:10848
- C:\Windows\System\GmHKRqc.exe
  C:\Windows\System\GmHKRqc.exe
  2⤵
  PID:10916
- C:\Windows\System\KtnSxtz.exe
  C:\Windows\System\KtnSxtz.exe
  2⤵
  PID:10608
- C:\Windows\System\BAwqRoB.exe
  C:\Windows\System\BAwqRoB.exe
  2⤵
  PID:12592
- C:\Windows\System\fikKvla.exe
  C:\Windows\System\fikKvla.exe
  2⤵
  PID:12848
- C:\Windows\System\FqYPTgi.exe
  C:\Windows\System\FqYPTgi.exe
  2⤵
  PID:12872
- C:\Windows\System\qPueKqK.exe
  C:\Windows\System\qPueKqK.exe
  2⤵
  PID:12888
- C:\Windows\System\wQrQLaj.exe
  C:\Windows\System\wQrQLaj.exe
  2⤵
  PID:12908
- C:\Windows\System\odNYLMc.exe
  C:\Windows\System\odNYLMc.exe
  2⤵
  PID:12260
- C:\Windows\System\MsoBKPT.exe
  C:\Windows\System\MsoBKPT.exe
  2⤵
  PID:12284
- C:\Windows\System\ZhfRegS.exe
  C:\Windows\System\ZhfRegS.exe
  2⤵
  PID:6520
- C:\Windows\System\HAmzywX.exe
  C:\Windows\System\HAmzywX.exe
  2⤵
  PID:9932
- C:\Windows\System\FQqOWkH.exe
  C:\Windows\System\FQqOWkH.exe
  2⤵
  PID:732
- C:\Windows\System\KoCBThz.exe
  C:\Windows\System\KoCBThz.exe
  2⤵
  PID:11204
- C:\Windows\System\QrMdasB.exe
  C:\Windows\System\QrMdasB.exe
  2⤵
  PID:8300
- C:\Windows\System\EvgxUhH.exe
  C:\Windows\System\EvgxUhH.exe
  2⤵
  PID:11800
- C:\Windows\System\hyQHDvu.exe
  C:\Windows\System\hyQHDvu.exe
  2⤵
  PID:12020
- C:\Windows\System\cEwRfBF.exe
  C:\Windows\System\cEwRfBF.exe
  2⤵
  PID:10544
- C:\Windows\System\NevHIaT.exe
  C:\Windows\System\NevHIaT.exe
  2⤵
  PID:12128
- C:\Windows\System\rxmWARc.exe
  C:\Windows\System\rxmWARc.exe
  2⤵
  PID:1984
- C:\Windows\System\sLdcGXX.exe
  C:\Windows\System\sLdcGXX.exe
  2⤵
  PID:11324
- C:\Windows\System\NvPhrqA.exe
  C:\Windows\System\NvPhrqA.exe
  2⤵
  PID:11292
- C:\Windows\System\jRwVGmU.exe
  C:\Windows\System\jRwVGmU.exe
  2⤵
  PID:12456
- C:\Windows\System\zrOMgnr.exe
  C:\Windows\System\zrOMgnr.exe
  2⤵
  PID:11448
- C:\Windows\System\UROsbmx.exe
  C:\Windows\System\UROsbmx.exe
  2⤵
  PID:11488
- C:\Windows\System\oeBAXWz.exe
  C:\Windows\System\oeBAXWz.exe
  2⤵
  PID:11780
- C:\Windows\System\GowwHuI.exe
  C:\Windows\System\GowwHuI.exe
  2⤵
  PID:11732
- C:\Windows\System\YudSgCi.exe
  C:\Windows\System\YudSgCi.exe
  2⤵
  PID:11708
- C:\Windows\System\ehcfxvD.exe
  C:\Windows\System\ehcfxvD.exe
  2⤵
  PID:11664
- C:\Windows\System\kbuBbzv.exe
  C:\Windows\System\kbuBbzv.exe
  2⤵
  PID:11608
- C:\Windows\System\LajQUor.exe
  C:\Windows\System\LajQUor.exe
  2⤵
  PID:11576
- C:\Windows\System\EAKsWvP.exe
  C:\Windows\System\EAKsWvP.exe
  2⤵
  PID:4728
- C:\Windows\System\NjyBgfT.exe
  C:\Windows\System\NjyBgfT.exe
  2⤵
  PID:11936
- C:\Windows\System\lhEMBMe.exe
  C:\Windows\System\lhEMBMe.exe
  2⤵
  PID:12008
- C:\Windows\System\FIcZSLW.exe
  C:\Windows\System\FIcZSLW.exe
  2⤵
  PID:12164
- C:\Windows\System\VcmywsS.exe
  C:\Windows\System\VcmywsS.exe
  2⤵
  PID:11048
- C:\Windows\System\kjbyOKC.exe
  C:\Windows\System\kjbyOKC.exe
  2⤵
  PID:10824
- C:\Windows\System\BrQaPzw.exe
  C:\Windows\System\BrQaPzw.exe
  2⤵
  PID:11380
- C:\Windows\System\BdEoVZK.exe
  C:\Windows\System\BdEoVZK.exe
  2⤵
  PID:12316
- C:\Windows\System\mNxfurG.exe
  C:\Windows\System\mNxfurG.exe
  2⤵
  PID:3776
- C:\Windows\System\mRoXxCY.exe
  C:\Windows\System\mRoXxCY.exe
  2⤵
  PID:12708
- C:\Windows\System\sJgMxIk.exe
  C:\Windows\System\sJgMxIk.exe
  2⤵
  PID:12496
- C:\Windows\System\fWKsrCR.exe
  C:\Windows\System\fWKsrCR.exe
  2⤵
  PID:12996
- C:\Windows\System\sEnTHEe.exe
  C:\Windows\System\sEnTHEe.exe
  2⤵
  PID:4272
- C:\Windows\System\YkNOrre.exe
  C:\Windows\System\YkNOrre.exe
  2⤵
  PID:12536
- C:\Windows\System\BpdNWbt.exe
  C:\Windows\System\BpdNWbt.exe
  2⤵
  PID:12868
- C:\Windows\System\LMjjcGu.exe
  C:\Windows\System\LMjjcGu.exe
  2⤵
  PID:12840
- C:\Windows\System\sjDUqrG.exe
  C:\Windows\System\sjDUqrG.exe
  2⤵
  PID:12792
- C:\Windows\System\TzaiKxX.exe
  C:\Windows\System\TzaiKxX.exe
  2⤵
  PID:12756
- C:\Windows\System\KYEYYIO.exe
  C:\Windows\System\KYEYYIO.exe
  2⤵
  PID:12672
- C:\Windows\System\TKtDhjT.exe
  C:\Windows\System\TKtDhjT.exe
  2⤵
  PID:13060
- C:\Windows\System\wdhGMRw.exe
  C:\Windows\System\wdhGMRw.exe
  2⤵
  PID:13104
- C:\Windows\System\ufqKJKg.exe
  C:\Windows\System\ufqKJKg.exe
  2⤵
  PID:13152
- C:\Windows\System\SinEhDU.exe
  C:\Windows\System\SinEhDU.exe
  2⤵
  PID:13228
- C:\Windows\System\IunvJFB.exe
  C:\Windows\System\IunvJFB.exe
  2⤵
  PID:10352
- C:\Windows\System\bZvGJeH.exe
  C:\Windows\System\bZvGJeH.exe
  2⤵
  PID:5656
- C:\Windows\System\wuMQNZV.exe
  C:\Windows\System\wuMQNZV.exe
  2⤵
  PID:1776
- C:\Windows\System\PwxLkCi.exe
  C:\Windows\System\PwxLkCi.exe
  2⤵
  PID:11236
- C:\Windows\System\jUGSmKK.exe
  C:\Windows\System\jUGSmKK.exe
  2⤵
  PID:5776
- C:\Windows\System\zHJUfyP.exe
  C:\Windows\System\zHJUfyP.exe
  2⤵
  PID:10016
- C:\Windows\System\aizXElv.exe
  C:\Windows\System\aizXElv.exe
  2⤵
  PID:744
- C:\Windows\System\kAbxTrx.exe
  C:\Windows\System\kAbxTrx.exe
  2⤵
  PID:11724
- C:\Windows\System\DmxZHCC.exe
  C:\Windows\System\DmxZHCC.exe
  2⤵
  PID:11668
- C:\Windows\System\cTUhIfb.exe
  C:\Windows\System\cTUhIfb.exe
  2⤵
  PID:11548
- C:\Windows\System\xBTpFwl.exe
  C:\Windows\System\xBTpFwl.exe
  2⤵
  PID:13096
- C:\Windows\System\PuhbKZG.exe
  C:\Windows\System\PuhbKZG.exe
  2⤵
  PID:12372
- C:\Windows\System\GSlHICc.exe
  C:\Windows\System\GSlHICc.exe
  2⤵
  PID:3612
- C:\Windows\System\oqjzUCC.exe
  C:\Windows\System\oqjzUCC.exe
  2⤵
  PID:11624
- C:\Windows\System\oMCqvwv.exe
  C:\Windows\System\oMCqvwv.exe
  2⤵
  PID:10828
- C:\Windows\System\QajLves.exe
  C:\Windows\System\QajLves.exe
  2⤵
  PID:11912
- C:\Windows\System\hBlNMkh.exe
  C:\Windows\System\hBlNMkh.exe
  2⤵
  PID:13240
- C:\Windows\System\bizTMIE.exe
  C:\Windows\System\bizTMIE.exe
  2⤵
  PID:12156
- C:\Windows\System\SVYNHKJ.exe
  C:\Windows\System\SVYNHKJ.exe
  2⤵
  PID:12688
- C:\Windows\System\usNQNuu.exe
  C:\Windows\System\usNQNuu.exe
  2⤵
  PID:4660
- C:\Windows\System\jHMbxTP.exe
  C:\Windows\System\jHMbxTP.exe
  2⤵
  PID:2368
- C:\Windows\System\LnpwCBd.exe
  C:\Windows\System\LnpwCBd.exe
  2⤵
  PID:5708
- C:\Windows\System\tiDJvmy.exe
  C:\Windows\System\tiDJvmy.exe
  2⤵
  PID:5928
- C:\Windows\System\pBAGZAT.exe
  C:\Windows\System\pBAGZAT.exe
  2⤵
  PID:5996
- C:\Windows\System\AblytjD.exe
  C:\Windows\System\AblytjD.exe
  2⤵
  PID:4756
- C:\Windows\System\iavfHiw.exe
  C:\Windows\System\iavfHiw.exe
  2⤵
  PID:5064
- C:\Windows\System\zzUmhEC.exe
  C:\Windows\System\zzUmhEC.exe
  2⤵
  PID:3012
- C:\Windows\System\wZfiHTz.exe
  C:\Windows\System\wZfiHTz.exe
  2⤵
  PID:3580
- C:\Windows\System\eHIEhjM.exe
  C:\Windows\System\eHIEhjM.exe
  2⤵
  PID:3680
- C:\Windows\System\OSJlzmc.exe
  C:\Windows\System\OSJlzmc.exe
  2⤵
  PID:4740
- C:\Windows\System\rYOLNey.exe
  C:\Windows\System\rYOLNey.exe
  2⤵
  PID:3376
- C:\Windows\System\YyrvaKb.exe
  C:\Windows\System\YyrvaKb.exe
  2⤵
  PID:796
- C:\Windows\System\dIprzEE.exe
  C:\Windows\System\dIprzEE.exe
  2⤵
  PID:820
- C:\Windows\System\hteIVwG.exe
  C:\Windows\System\hteIVwG.exe
  2⤵
  PID:11612
- C:\Windows\System\jhrYtkV.exe
  C:\Windows\System\jhrYtkV.exe
  2⤵
  PID:2516
- C:\Windows\System\ngYRsoN.exe
  C:\Windows\System\ngYRsoN.exe
  2⤵
  PID:4192
- C:\Windows\System\ARzMLtG.exe
  C:\Windows\System\ARzMLtG.exe
  2⤵
  PID:4956
- C:\Windows\System\JNfGYsR.exe
  C:\Windows\System\JNfGYsR.exe
  2⤵
  PID:10684
- C:\Windows\System\RJqxlVf.exe
  C:\Windows\System\RJqxlVf.exe
  2⤵
  PID:1956
- C:\Windows\System\RaIsbrG.exe
  C:\Windows\System\RaIsbrG.exe
  2⤵
  PID:12780
- C:\Windows\System\gaisMba.exe
  C:\Windows\System\gaisMba.exe
  2⤵
  PID:12308
- C:\Windows\System\lVuQmjy.exe
  C:\Windows\System\lVuQmjy.exe
  2⤵
  PID:512
- C:\Windows\System\Mbxtukf.exe
  C:\Windows\System\Mbxtukf.exe
  2⤵
  PID:1920
- C:\Windows\System\NRquxAc.exe
  C:\Windows\System\NRquxAc.exe
  2⤵
  PID:5376
- C:\Windows\System\HWtVidl.exe
  C:\Windows\System\HWtVidl.exe
  2⤵
  PID:5432
- C:\Windows\System\pplLAqN.exe
  C:\Windows\System\pplLAqN.exe
  2⤵
  PID:448
- C:\Windows\System\HvwbzIr.exe
  C:\Windows\System\HvwbzIr.exe
  2⤵
  PID:6880
- C:\Windows\System\BpopogU.exe
  C:\Windows\System\BpopogU.exe
  2⤵
  PID:5412
- C:\Windows\System\XTtHczb.exe
  C:\Windows\System\XTtHczb.exe
  2⤵
  PID:11328
- C:\Windows\System\hCPGzga.exe
  C:\Windows\System\hCPGzga.exe
  2⤵
  PID:876
- C:\Windows\System\qxoxTtK.exe
  C:\Windows\System\qxoxTtK.exe
  2⤵
  PID:5536
- C:\Windows\System\jIHNGJv.exe
  C:\Windows\System\jIHNGJv.exe
  2⤵
  PID:5520
- C:\Windows\System\PKcojIv.exe
  C:\Windows\System\PKcojIv.exe
  2⤵
  PID:2848
- C:\Windows\System\LTmsLsT.exe
  C:\Windows\System\LTmsLsT.exe
  2⤵
  PID:10852
- C:\Windows\System\RRyGkEy.exe
  C:\Windows\System\RRyGkEy.exe
  2⤵
  PID:12392
- C:\Windows\System\zIutVPm.exe
  C:\Windows\System\zIutVPm.exe
  2⤵
  PID:11760
- C:\Windows\System\ZwbAWPb.exe
  C:\Windows\System\ZwbAWPb.exe
  2⤵
  PID:1388
- C:\Windows\System\GbTeKRp.exe
  C:\Windows\System\GbTeKRp.exe
  2⤵
  PID:7024
- C:\Windows\System\MTPwLfc.exe
  C:\Windows\System\MTPwLfc.exe
  2⤵
  PID:7104
- C:\Windows\System\XaeSqov.exe
  C:\Windows\System\XaeSqov.exe
  2⤵
  PID:6248
- C:\Windows\System\IBfVvYw.exe
  C:\Windows\System\IBfVvYw.exe
  2⤵
  PID:6584
- C:\Windows\System\bAqFgEH.exe
  C:\Windows\System\bAqFgEH.exe
  2⤵
  PID:6468
- C:\Windows\System\mdMfQeT.exe
  C:\Windows\System\mdMfQeT.exe
  2⤵
  PID:6656
- C:\Windows\System\HGbPMcs.exe
  C:\Windows\System\HGbPMcs.exe
  2⤵
  PID:6992
- C:\Windows\System\brisXhf.exe
  C:\Windows\System\brisXhf.exe
  2⤵
  PID:7040
- C:\Windows\System\FqLCFzB.exe
  C:\Windows\System\FqLCFzB.exe
  2⤵
  PID:6484
- C:\Windows\System\xPaSRFY.exe
  C:\Windows\System\xPaSRFY.exe
  2⤵
  PID:5744
- C:\Windows\System\hSKgsYx.exe
  C:\Windows\System\hSKgsYx.exe
  2⤵
  PID:3920
- C:\Windows\System\XSpbpVU.exe
  C:\Windows\System\XSpbpVU.exe
  2⤵
  PID:2908
- C:\Windows\System\xxCHvNk.exe
  C:\Windows\System\xxCHvNk.exe
  2⤵
  PID:12048
- C:\Windows\System\gehNlVr.exe
  C:\Windows\System\gehNlVr.exe
  2⤵
  PID:7448
- C:\Windows\System\WAwqSyn.exe
  C:\Windows\System\WAwqSyn.exe
  2⤵
  PID:5608
- C:\Windows\System\WqzVJRB.exe
  C:\Windows\System\WqzVJRB.exe
  2⤵
  PID:5888
- C:\Windows\System\wOQeItn.exe
  C:\Windows\System\wOQeItn.exe
  2⤵
  PID:5896
- C:\Windows\System\bWCKcbm.exe
  C:\Windows\System\bWCKcbm.exe
  2⤵
  PID:7568
- C:\Windows\System\BDdMAOl.exe
  C:\Windows\System\BDdMAOl.exe
  2⤵
  PID:3640
- C:\Windows\System\RjQKGek.exe
  C:\Windows\System\RjQKGek.exe
  2⤵
  PID:6408
- C:\Windows\System\vqjihPK.exe
  C:\Windows\System\vqjihPK.exe
  2⤵
  PID:5296
- C:\Windows\System\hbpzkFN.exe
  C:\Windows\System\hbpzkFN.exe
  2⤵
  PID:3908
- C:\Windows\System\pyREtEf.exe
  C:\Windows\System\pyREtEf.exe
  2⤵
  PID:7148
- C:\Windows\System\IxbynzO.exe
  C:\Windows\System\IxbynzO.exe
  2⤵
  PID:5384
- C:\Windows\System\FcvjWnr.exe
  C:\Windows\System\FcvjWnr.exe
  2⤵
  PID:13176
- C:\Windows\System\YjbGPAw.exe
  C:\Windows\System\YjbGPAw.exe
  2⤵
  PID:11900
- C:\Windows\System\fadgVeP.exe
  C:\Windows\System\fadgVeP.exe
  2⤵
  PID:13408
- C:\Windows\System\fBPVXbj.exe
  C:\Windows\System\fBPVXbj.exe
  2⤵
  PID:13428
- C:\Windows\System\zZObmfc.exe
  C:\Windows\System\zZObmfc.exe
  2⤵
  PID:13444
- C:\Windows\System\zGtpNnz.exe
  C:\Windows\System\zGtpNnz.exe
  2⤵
  PID:13488
- C:\Windows\System\BajdUtb.exe
  C:\Windows\System\BajdUtb.exe
  2⤵
  PID:13528
- C:\Windows\System\yATelzi.exe
  C:\Windows\System\yATelzi.exe
  2⤵
  PID:13544
- C:\Windows\System\JYOtHXk.exe
  C:\Windows\System\JYOtHXk.exe
  2⤵
  PID:13624
- C:\Windows\System\bYWFFyL.exe
  C:\Windows\System\bYWFFyL.exe
  2⤵
  PID:13644
- C:\Windows\System\cInKxfD.exe
  C:\Windows\System\cInKxfD.exe
  2⤵
  PID:13668
- C:\Windows\System\citGYsk.exe
  C:\Windows\System\citGYsk.exe
  2⤵
  PID:14072
- C:\Windows\System\IOtofRW.exe
  C:\Windows\System\IOtofRW.exe
  2⤵
  PID:14220
- C:\Windows\System\YPukfdV.exe
  C:\Windows\System\YPukfdV.exe
  2⤵
  PID:14284
- C:\Windows\System\BXXxTpN.exe
  C:\Windows\System\BXXxTpN.exe
  2⤵
  PID:3508
- C:\Windows\System\WwJnHNx.exe
  C:\Windows\System\WwJnHNx.exe
  2⤵
  PID:11240
- C:\Windows\System\kvkRIno.exe
  C:\Windows\System\kvkRIno.exe
  2⤵
  PID:12464
- C:\Windows\System\MOlEmwL.exe
  C:\Windows\System\MOlEmwL.exe
  2⤵
  PID:3380
- C:\Windows\System\xUMVhic.exe
  C:\Windows\System\xUMVhic.exe
  2⤵
  PID:4636
- C:\Windows\System\VeaZbLq.exe
  C:\Windows\System\VeaZbLq.exe
  2⤵
  PID:12900
- C:\Windows\System\obEtSlm.exe
  C:\Windows\System\obEtSlm.exe
  2⤵
  PID:5456
- C:\Windows\System\gyJURYX.exe
  C:\Windows\System\gyJURYX.exe
  2⤵
  PID:5396
- C:\Windows\System\SKJqpJK.exe
  C:\Windows\System\SKJqpJK.exe
  2⤵
  PID:2716
- C:\Windows\System\ZCmJBVW.exe
  C:\Windows\System\ZCmJBVW.exe
  2⤵
  PID:2012
- C:\Windows\System\lnepIJr.exe
  C:\Windows\System\lnepIJr.exe
  2⤵
  PID:5428
- C:\Windows\System\GhmIMig.exe
  C:\Windows\System\GhmIMig.exe
  2⤵
  PID:13468
- C:\Windows\System\YMgRSbq.exe
  C:\Windows\System\YMgRSbq.exe
  2⤵
  PID:11232
- C:\Windows\System\qDQKtTk.exe
  C:\Windows\System\qDQKtTk.exe
  2⤵
  PID:13336
- C:\Windows\System\YqlVYey.exe
  C:\Windows\System\YqlVYey.exe
  2⤵
  PID:13700
- C:\Windows\System\ZwlyFhQ.exe
  C:\Windows\System\ZwlyFhQ.exe
  2⤵
  PID:13380
- C:\Windows\System\eLmqEbQ.exe
  C:\Windows\System\eLmqEbQ.exe
  2⤵
  PID:13772
- C:\Windows\System\SQnUjEL.exe
  C:\Windows\System\SQnUjEL.exe
  2⤵
  PID:13780
- C:\Windows\System\esItgEt.exe
  C:\Windows\System\esItgEt.exe
  2⤵
  PID:13692
- C:\Windows\System\grXEGYJ.exe
  C:\Windows\System\grXEGYJ.exe
  2⤵
  PID:13516
- C:\Windows\System\HJBbhkL.exe
  C:\Windows\System\HJBbhkL.exe
  2⤵
  PID:13896
- C:\Windows\System\WPefOQE.exe
  C:\Windows\System\WPefOQE.exe
  2⤵
  PID:13764
- C:\Windows\System\LSPDGTC.exe
  C:\Windows\System\LSPDGTC.exe
  2⤵
  PID:13912
- C:\Windows\System\tGXYvky.exe
  C:\Windows\System\tGXYvky.exe
  2⤵
  PID:13816
- C:\Windows\System\OfWXBWU.exe
  C:\Windows\System\OfWXBWU.exe
  2⤵
  PID:14060
- C:\Windows\System\TXPGsnO.exe
  C:\Windows\System\TXPGsnO.exe
  2⤵
  PID:1048
- C:\Windows\System\jQUITqO.exe
  C:\Windows\System\jQUITqO.exe
  2⤵
  PID:4408
- C:\Windows\System\iKloFmV.exe
  C:\Windows\System\iKloFmV.exe
  2⤵
  PID:14216
- C:\Windows\System\kYiKVmw.exe
  C:\Windows\System\kYiKVmw.exe
  2⤵
  PID:5924
- C:\Windows\System\nhwMKzG.exe
  C:\Windows\System\nhwMKzG.exe
  2⤵
  PID:5948
- C:\Windows\System\gaobpFC.exe
  C:\Windows\System\gaobpFC.exe
  2⤵
  PID:1624
- C:\Windows\System\aNQWEQV.exe
  C:\Windows\System\aNQWEQV.exe
  2⤵
  PID:6824
- C:\Windows\System\zBVhbeX.exe
  C:\Windows\System\zBVhbeX.exe
  2⤵
  PID:5568
- C:\Windows\System\zadZYgA.exe
  C:\Windows\System\zadZYgA.exe
  2⤵
  PID:4500
- C:\Windows\System\glNrwlD.exe
  C:\Windows\System\glNrwlD.exe
  2⤵
  PID:13716
- C:\Windows\System\OqLqrUc.exe
  C:\Windows\System\OqLqrUc.exe
  2⤵
  PID:13364
- C:\Windows\System\hokzRqI.exe
  C:\Windows\System\hokzRqI.exe
  2⤵
  PID:13756
- C:\Windows\System\hPBmFsG.exe
  C:\Windows\System\hPBmFsG.exe
  2⤵
  PID:5288
- C:\Windows\System\FDWAPuL.exe
  C:\Windows\System\FDWAPuL.exe
  2⤵
  PID:13580
- C:\Windows\System\qHJeOsu.exe
  C:\Windows\System\qHJeOsu.exe
  2⤵
  PID:13880
- C:\Windows\System\urYNHYm.exe
  C:\Windows\System\urYNHYm.exe
  2⤵
  PID:5404
- C:\Windows\System\NBJlKUU.exe
  C:\Windows\System\NBJlKUU.exe
  2⤵
  PID:14068
- C:\Windows\System\GWaspYn.exe
  C:\Windows\System\GWaspYn.exe
  2⤵
  PID:4400
- C:\Windows\System\RfUZnND.exe
  C:\Windows\System\RfUZnND.exe
  2⤵
  PID:2576
- C:\Windows\System\cisXfqx.exe
  C:\Windows\System\cisXfqx.exe
  2⤵
  PID:6716
- C:\Windows\System\lMxdeMg.exe
  C:\Windows\System\lMxdeMg.exe
  2⤵
  PID:3964
- C:\Windows\System\uvSYZwj.exe
  C:\Windows\System\uvSYZwj.exe
  2⤵
  PID:13540
- C:\Windows\System\ubAKsUI.exe
  C:\Windows\System\ubAKsUI.exe
  2⤵
  PID:5240
- C:\Windows\System\CrHEQyQ.exe
  C:\Windows\System\CrHEQyQ.exe
  2⤵
  PID:14112
- C:\Windows\System\BrGqqHt.exe
  C:\Windows\System\BrGqqHt.exe
  2⤵
  PID:13972
- C:\Windows\System\MvDSULl.exe
  C:\Windows\System\MvDSULl.exe
  2⤵
  PID:13892
- C:\Windows\System\kBCKkQa.exe
  C:\Windows\System\kBCKkQa.exe
  2⤵
  PID:14120
- C:\Windows\System\RmSzeAO.exe
  C:\Windows\System\RmSzeAO.exe
  2⤵
  PID:13952
- C:\Windows\System\VrijhvX.exe
  C:\Windows\System\VrijhvX.exe
  2⤵
  PID:14268
- C:\Windows\System\yGtTylk.exe
  C:\Windows\System\yGtTylk.exe
  2⤵
  PID:9664
- C:\Windows\System\kRKkIvk.exe
  C:\Windows\System\kRKkIvk.exe
  2⤵
  PID:4056
- C:\Windows\System\DZRIsQr.exe
  C:\Windows\System\DZRIsQr.exe
  2⤵
  PID:6076
- C:\Windows\System\wybmVkX.exe
  C:\Windows\System\wybmVkX.exe
  2⤵
  PID:14308
- C:\Windows\System\MEhtiZa.exe
  C:\Windows\System\MEhtiZa.exe
  2⤵
  PID:4748
- C:\Windows\System\JlxxTQy.exe
  C:\Windows\System\JlxxTQy.exe
  2⤵
  PID:6184
- C:\Windows\System\lAPsiYJ.exe
  C:\Windows\System\lAPsiYJ.exe
  2⤵
  PID:5920
- C:\Windows\System\EtPYsAH.exe
  C:\Windows\System\EtPYsAH.exe
  2⤵
  PID:6564
- C:\Windows\System\HUaNPBO.exe
  C:\Windows\System\HUaNPBO.exe
  2⤵
  PID:1004
- C:\Windows\System\jPaJHob.exe
  C:\Windows\System\jPaJHob.exe
  2⤵
  PID:13556
- C:\Windows\System\mWHnlwJ.exe
  C:\Windows\System\mWHnlwJ.exe
  2⤵
  PID:6080
- C:\Windows\System\MGUpbkY.exe
  C:\Windows\System\MGUpbkY.exe
  2⤵
  PID:13504
- C:\Windows\System\sqSAPZB.exe
  C:\Windows\System\sqSAPZB.exe
  2⤵
  PID:6504
- C:\Windows\System\HsBYyfF.exe
  C:\Windows\System\HsBYyfF.exe
  2⤵
  PID:6228
- C:\Windows\System\vwXZWWn.exe
  C:\Windows\System\vwXZWWn.exe
  2⤵
  PID:13768
- C:\Windows\System\HDOTWXg.exe
  C:\Windows\System\HDOTWXg.exe
  2⤵
  PID:6988
- C:\Windows\System\TzKWAfk.exe
  C:\Windows\System\TzKWAfk.exe
  2⤵
  PID:13940
- C:\Windows\System\ujPUYfw.exe
  C:\Windows\System\ujPUYfw.exe
  2⤵
  PID:6628
- C:\Windows\System\zdDIYiQ.exe
  C:\Windows\System\zdDIYiQ.exe
  2⤵
  PID:6688
- C:\Windows\System\eFAivFU.exe
  C:\Windows\System\eFAivFU.exe
  2⤵
  PID:5256
- C:\Windows\System\kwiCaqu.exe
  C:\Windows\System\kwiCaqu.exe
  2⤵
  PID:14256
- C:\Windows\System\rIwIhlI.exe
  C:\Windows\System\rIwIhlI.exe
  2⤵
  PID:13828
- C:\Windows\System\bUOkoDO.exe
  C:\Windows\System\bUOkoDO.exe
  2⤵
  PID:1724
- C:\Windows\System\CnkOoOq.exe
  C:\Windows\System\CnkOoOq.exe
  2⤵
  PID:3876
- C:\Windows\System\KSwByYk.exe
  C:\Windows\System\KSwByYk.exe
  2⤵
  PID:2188
- C:\Windows\System\KvonqTw.exe
  C:\Windows\System\KvonqTw.exe
  2⤵
  PID:13512
- C:\Windows\System\wEnwUOy.exe
  C:\Windows\System\wEnwUOy.exe
  2⤵
  PID:14088
- C:\Windows\System\UhVomvS.exe
  C:\Windows\System\UhVomvS.exe
  2⤵
  PID:5176
- C:\Windows\System\mmTNFHf.exe
  C:\Windows\System\mmTNFHf.exe
  2⤵
  PID:6492
- C:\Windows\System\fXzDBsz.exe
  C:\Windows\System\fXzDBsz.exe
  2⤵
  PID:6600
- C:\Windows\System\HvWPuUb.exe
  C:\Windows\System\HvWPuUb.exe
  2⤵
  PID:6728
- C:\Windows\System\hoHQimL.exe
  C:\Windows\System\hoHQimL.exe
  2⤵
  PID:6392
- C:\Windows\System\QtBmjne.exe
  C:\Windows\System\QtBmjne.exe
  2⤵
  PID:7288
- C:\Windows\System\fDYloff.exe
  C:\Windows\System\fDYloff.exe
  2⤵
  PID:6572
- C:\Windows\System\SYAeLhv.exe
  C:\Windows\System\SYAeLhv.exe
  2⤵
  PID:5668
- C:\Windows\System\OdjKaab.exe
  C:\Windows\System\OdjKaab.exe
  2⤵
  PID:6436
- C:\Windows\System\eESJKOC.exe
  C:\Windows\System\eESJKOC.exe
  2⤵
  PID:6856
- C:\Windows\System\DZBmAec.exe
  C:\Windows\System\DZBmAec.exe
  2⤵
  PID:14272
- C:\Windows\System\YLamSCs.exe
  C:\Windows\System\YLamSCs.exe
  2⤵
  PID:7284
- C:\Windows\System\iAaQekL.exe
  C:\Windows\System\iAaQekL.exe
  2⤵
  PID:4388
- C:\Windows\System\QMfZMfr.exe
  C:\Windows\System\QMfZMfr.exe
  2⤵
  PID:6732
- C:\Windows\System\aLSSXiw.exe
  C:\Windows\System\aLSSXiw.exe
  2⤵
  PID:7012
- C:\Windows\System\snjSYDH.exe
  C:\Windows\System\snjSYDH.exe
  2⤵
  PID:11908
- C:\Windows\System\KeaKJoq.exe
  C:\Windows\System\KeaKJoq.exe
  2⤵
  PID:11068
- C:\Windows\System\wdEFkbH.exe
  C:\Windows\System\wdEFkbH.exe
  2⤵
  PID:13696
- C:\Windows\System\MsrypQw.exe
  C:\Windows\System\MsrypQw.exe
  2⤵
  PID:4356
- C:\Windows\System\yzlsSui.exe
  C:\Windows\System\yzlsSui.exe
  2⤵
  PID:13832
- C:\Windows\System\YuoKxTW.exe
  C:\Windows\System\YuoKxTW.exe
  2⤵
  PID:3560
- C:\Windows\System\EvVlAJq.exe
  C:\Windows\System\EvVlAJq.exe
  2⤵
  PID:7180
- C:\Windows\System\IcAnyyg.exe
  C:\Windows\System\IcAnyyg.exe
  2⤵
  PID:3092
- C:\Windows\System\dIUSceG.exe
  C:\Windows\System\dIUSceG.exe
  2⤵
  PID:14356
- C:\Windows\System\VTjSGkg.exe
  C:\Windows\System\VTjSGkg.exe
  2⤵
  PID:14376
- C:\Windows\System\AsHOoWn.exe
  C:\Windows\System\AsHOoWn.exe
  2⤵
  PID:14396
- C:\Windows\System\AZqpZzt.exe
  C:\Windows\System\AZqpZzt.exe
  2⤵
  PID:14412
- C:\Windows\System\fcXCoAh.exe
  C:\Windows\System\fcXCoAh.exe
  2⤵
  PID:14428
- C:\Windows\System\fjwGItN.exe
  C:\Windows\System\fjwGItN.exe
  2⤵
  PID:14448
- C:\Windows\System\iOHIWUs.exe
  C:\Windows\System\iOHIWUs.exe
  2⤵
  PID:14472
- C:\Windows\System\XuaUXqC.exe
  C:\Windows\System\XuaUXqC.exe
  2⤵
  PID:14496
- C:\Windows\System\XuizTpi.exe
  C:\Windows\System\XuizTpi.exe
  2⤵
  PID:14516
- C:\Windows\System\uNspoBe.exe
  C:\Windows\System\uNspoBe.exe
  2⤵
  PID:14532
- C:\Windows\System\VBHttWE.exe
  C:\Windows\System\VBHttWE.exe
  2⤵
  PID:14548
- C:\Windows\System\yYRowhz.exe
  C:\Windows\System\yYRowhz.exe
  2⤵
  PID:14568
- C:\Windows\System\Lgrpigv.exe
  C:\Windows\System\Lgrpigv.exe
  2⤵
  PID:14596
- C:\Windows\System\dywNPHI.exe
  C:\Windows\System\dywNPHI.exe
  2⤵
  PID:14612
- C:\Windows\System\AGNRoAa.exe
  C:\Windows\System\AGNRoAa.exe
  2⤵
  PID:14640
- C:\Windows\System\igoJqpy.exe
  C:\Windows\System\igoJqpy.exe
  2⤵
  PID:14660
- C:\Windows\System\zwUQFhy.exe
  C:\Windows\System\zwUQFhy.exe
  2⤵
  PID:14684
- C:\Windows\System\YGyubDP.exe
  C:\Windows\System\YGyubDP.exe
  2⤵
  PID:14704
- C:\Windows\System\sbqghTQ.exe
  C:\Windows\System\sbqghTQ.exe
  2⤵
  PID:14724
- C:\Windows\System\eHgPaWQ.exe
  C:\Windows\System\eHgPaWQ.exe
  2⤵
  PID:14744
- C:\Windows\System\OHOywPc.exe
  C:\Windows\System\OHOywPc.exe
  2⤵
  PID:14768
- C:\Windows\System\TSBMhLi.exe
  C:\Windows\System\TSBMhLi.exe
  2⤵
  PID:14916
- C:\Windows\System\BeHZYIS.exe
  C:\Windows\System\BeHZYIS.exe
  2⤵
  PID:14940
- C:\Windows\System\XntiDJh.exe
  C:\Windows\System\XntiDJh.exe
  2⤵
  PID:14956
- C:\Windows\System\tYHKIGV.exe
  C:\Windows\System\tYHKIGV.exe
  2⤵
  PID:14980
- C:\Windows\System\qjQBTlS.exe
  C:\Windows\System\qjQBTlS.exe
  2⤵
  PID:15008
- C:\Windows\System\mHswvXS.exe
  C:\Windows\System\mHswvXS.exe
  2⤵
  PID:15032
- C:\Windows\System\rycfbbI.exe
  C:\Windows\System\rycfbbI.exe
  2⤵
  PID:15072
- C:\Windows\System\FgqzFlb.exe
  C:\Windows\System\FgqzFlb.exe
  2⤵
  PID:15096
- C:\Windows\System\MhDZsmb.exe
  C:\Windows\System\MhDZsmb.exe
  2⤵
  PID:15120
- C:\Windows\System\icizaAM.exe
  C:\Windows\System\icizaAM.exe
  2⤵
  PID:15140
- C:\Windows\System\rQpwTOl.exe
  C:\Windows\System\rQpwTOl.exe
  2⤵
  PID:15164
- C:\Windows\System\iwoliHS.exe
  C:\Windows\System\iwoliHS.exe
  2⤵
  PID:15180
- C:\Windows\System\elaEala.exe
  C:\Windows\System\elaEala.exe
  2⤵
  PID:15204
- C:\Windows\System\rlRRLHo.exe
  C:\Windows\System\rlRRLHo.exe
  2⤵
  PID:15220
- C:\Windows\System\ZXKZXNH.exe
  C:\Windows\System\ZXKZXNH.exe
  2⤵
  PID:6388
- C:\Windows\System\onTSBRb.exe
  C:\Windows\System\onTSBRb.exe
  2⤵
  PID:13844
- C:\Windows\System\sAbXSNw.exe
  C:\Windows\System\sAbXSNw.exe
  2⤵
  PID:7416
- C:\Windows\System\UYjricU.exe
  C:\Windows\System\UYjricU.exe
  2⤵
  PID:14328
- C:\Windows\System\UDWdGtQ.exe
  C:\Windows\System\UDWdGtQ.exe
  2⤵
  PID:7604
- C:\Windows\System\HWlFltX.exe
  C:\Windows\System\HWlFltX.exe
  2⤵
  PID:14388
- C:\Windows\System\AziGjmn.exe
  C:\Windows\System\AziGjmn.exe
  2⤵
  PID:14408
- C:\Windows\System\eYWLmrz.exe
  C:\Windows\System\eYWLmrz.exe
  2⤵
  PID:14468
- C:\Windows\System\nxPTAqO.exe
  C:\Windows\System\nxPTAqO.exe
  2⤵
  PID:14504
- C:\Windows\System\ObtCYvO.exe
  C:\Windows\System\ObtCYvO.exe
  2⤵
  PID:14832
- C:\Windows\System\xffgfKm.exe
  C:\Windows\System\xffgfKm.exe
  2⤵
  PID:14528
- C:\Windows\System\COFUOpJ.exe
  C:\Windows\System\COFUOpJ.exe
  2⤵
  PID:7300
- C:\Windows\System\oDlNqui.exe
  C:\Windows\System\oDlNqui.exe
  2⤵
  PID:7456
- C:\Windows\System\yYoJEkT.exe
  C:\Windows\System\yYoJEkT.exe
  2⤵
  PID:14868
- C:\Windows\System\SjEXWYg.exe
  C:\Windows\System\SjEXWYg.exe
  2⤵
  PID:14652
- C:\Windows\System\uNohOTz.exe
  C:\Windows\System\uNohOTz.exe
  2⤵
  PID:7508
- C:\Windows\System\DUXsLmr.exe
  C:\Windows\System\DUXsLmr.exe
  2⤵
  PID:7496
- C:\Windows\System\kysXkzc.exe
  C:\Windows\System\kysXkzc.exe
  2⤵
  PID:7572
- C:\Windows\System\mpzucBR.exe
  C:\Windows\System\mpzucBR.exe
  2⤵
  PID:15148
- C:\Windows\System\dpxLavp.exe
  C:\Windows\System\dpxLavp.exe
  2⤵
  PID:8312
- C:\Windows\System\joctViA.exe
  C:\Windows\System\joctViA.exe
  2⤵
  PID:14776
- C:\Windows\System\XakWydq.exe
  C:\Windows\System\XakWydq.exe
  2⤵
  PID:7824
- C:\Windows\System\jIZaJfF.exe
  C:\Windows\System\jIZaJfF.exe
  2⤵
  PID:14952
- C:\Windows\System\PItLSdZ.exe
  C:\Windows\System\PItLSdZ.exe
  2⤵
  PID:14988
- C:\Windows\System\LEqySYd.exe
  C:\Windows\System\LEqySYd.exe
  2⤵
  PID:6756
- C:\Windows\System\HqHCNXZ.exe
  C:\Windows\System\HqHCNXZ.exe
  2⤵
  PID:7664
- C:\Windows\System\OZxPgle.exe
  C:\Windows\System\OZxPgle.exe
  2⤵
  PID:14124
- C:\Windows\System\MtfyiuR.exe
  C:\Windows\System\MtfyiuR.exe
  2⤵
  PID:15172
- C:\Windows\System\yieVQMl.exe
  C:\Windows\System\yieVQMl.exe
  2⤵
  PID:15252
- C:\Windows\System\EGjnrao.exe
  C:\Windows\System\EGjnrao.exe
  2⤵
  PID:8692
- C:\Windows\System\lGOvxFs.exe
  C:\Windows\System\lGOvxFs.exe
  2⤵
  PID:5580
- C:\Windows\System\NdaQXID.exe
  C:\Windows\System\NdaQXID.exe
  2⤵
  PID:13460
- C:\Windows\System\PgjdBJY.exe
  C:\Windows\System\PgjdBJY.exe
  2⤵
  PID:7740
- C:\Windows\System\dXHCPMR.exe
  C:\Windows\System\dXHCPMR.exe
  2⤵
  PID:7792
- C:\Windows\System\VyFiHIp.exe
  C:\Windows\System\VyFiHIp.exe
  2⤵
  PID:6908
- C:\Windows\System\MxAhpcj.exe
  C:\Windows\System\MxAhpcj.exe
  2⤵
  PID:15068
- C:\Windows\System\tHJPQUh.exe
  C:\Windows\System\tHJPQUh.exe
  2⤵
  PID:7900
- C:\Windows\System\mluCqcE.exe
  C:\Windows\System\mluCqcE.exe
  2⤵
  PID:15348
- C:\Windows\System\wCvNntK.exe
  C:\Windows\System\wCvNntK.exe
  2⤵
  PID:15340
- C:\Windows\System\YWMOxcw.exe
  C:\Windows\System\YWMOxcw.exe
  2⤵
  PID:14932
- C:\Windows\System\ICakkVe.exe
  C:\Windows\System\ICakkVe.exe
  2⤵
  PID:8796
- C:\Windows\System\qOSJKky.exe
  C:\Windows\System\qOSJKky.exe
  2⤵
  PID:8628
- C:\Windows\System\cffjhHn.exe
  C:\Windows\System\cffjhHn.exe
  2⤵
  PID:7528
- C:\Windows\System\kHItYdY.exe
  C:\Windows\System\kHItYdY.exe
  2⤵
  PID:14420
- C:\Windows\System\lSOONEo.exe
  C:\Windows\System\lSOONEo.exe
  2⤵
  PID:10508
- C:\Windows\System\AJdKzGw.exe
  C:\Windows\System\AJdKzGw.exe
  2⤵
  PID:8512
- C:\Windows\System\BfagXWV.exe
  C:\Windows\System\BfagXWV.exe
  2⤵
  PID:15292
- C:\Windows\System\cVyoQCD.exe
  C:\Windows\System\cVyoQCD.exe
  2⤵
  PID:7688
- C:\Windows\System\FwInYKN.exe
  C:\Windows\System\FwInYKN.exe
  2⤵
  PID:6800
- C:\Windows\System\TnTNoIO.exe
  C:\Windows\System\TnTNoIO.exe
  2⤵
  PID:8232
- C:\Windows\System\BVlWpPk.exe
  C:\Windows\System\BVlWpPk.exe
  2⤵
  PID:8952
- C:\Windows\System\mMyNrPu.exe
  C:\Windows\System\mMyNrPu.exe
  2⤵
  PID:9300
- C:\Windows\System\JoMLNgK.exe
  C:\Windows\System\JoMLNgK.exe
  2⤵
  PID:11876
- C:\Windows\System\aCypirc.exe
  C:\Windows\System\aCypirc.exe
  2⤵
  PID:9944
- C:\Windows\System\qCQYpjc.exe
  C:\Windows\System\qCQYpjc.exe
  2⤵
  PID:8840
- C:\Windows\System\xIdTWaa.exe
  C:\Windows\System\xIdTWaa.exe
  2⤵
  PID:9632
- C:\Windows\System\cIdpoOo.exe
  C:\Windows\System\cIdpoOo.exe
  2⤵
  PID:9268
- C:\Windows\System\XShDovs.exe
  C:\Windows\System\XShDovs.exe
  2⤵
  PID:15004
- C:\Windows\System\eHhqzoG.exe
  C:\Windows\System\eHhqzoG.exe
  2⤵
  PID:6368
- C:\Windows\System\ftqAiVC.exe
  C:\Windows\System\ftqAiVC.exe
  2⤵
  PID:9504
- C:\Windows\System\WmWJRff.exe
  C:\Windows\System\WmWJRff.exe
  2⤵
  PID:7968
- C:\Windows\System\YStOhSb.exe
  C:\Windows\System\YStOhSb.exe
  2⤵
  PID:14608
- C:\Windows\System\cHQCCBX.exe
  C:\Windows\System\cHQCCBX.exe
  2⤵
  PID:3488
- C:\Windows\System\hcKuPwv.exe
  C:\Windows\System\hcKuPwv.exe
  2⤵
  PID:7660
- C:\Windows\System\zhOLzCV.exe
  C:\Windows\System\zhOLzCV.exe
  2⤵
  PID:8464
- C:\Windows\System\IwQzUjE.exe
  C:\Windows\System\IwQzUjE.exe
  2⤵
  PID:2204
- C:\Windows\System\acfgBoQ.exe
  C:\Windows\System\acfgBoQ.exe
  2⤵
  PID:9424
- C:\Windows\System\kGSWzro.exe
  C:\Windows\System\kGSWzro.exe
  2⤵
  PID:9380
- C:\Windows\System\rgfOcaU.exe
  C:\Windows\System\rgfOcaU.exe
  2⤵
  PID:9348
- C:\Windows\System\uNBaJYf.exe
  C:\Windows\System\uNBaJYf.exe
  2⤵
  PID:8704
- C:\Windows\System\iHeJKnn.exe
  C:\Windows\System\iHeJKnn.exe
  2⤵
  PID:9292
- C:\Windows\System\fFspxyL.exe
  C:\Windows\System\fFspxyL.exe
  2⤵
  PID:8376
- C:\Windows\System\zKMVzTu.exe
  C:\Windows\System\zKMVzTu.exe
  2⤵
  PID:9928
- C:\Windows\System\YkkJWhc.exe
  C:\Windows\System\YkkJWhc.exe
  2⤵
  PID:14672
- C:\Windows\System\HehoEif.exe
  C:\Windows\System\HehoEif.exe
  2⤵
  PID:9116
- C:\Windows\System\CcbjRdq.exe
  C:\Windows\System\CcbjRdq.exe
  2⤵
  PID:10096
- C:\Windows\System\EOyPQqy.exe
  C:\Windows\System\EOyPQqy.exe
  2⤵
  PID:7692
- C:\Windows\System\KnFRdwo.exe
  C:\Windows\System\KnFRdwo.exe
  2⤵
  PID:9948
- C:\Windows\System\ZNENUnH.exe
  C:\Windows\System\ZNENUnH.exe
  2⤵
  PID:9808
- C:\Windows\System\uOXIGqC.exe
  C:\Windows\System\uOXIGqC.exe
  2⤵
  PID:10000
- C:\Windows\System\dwbeeft.exe
  C:\Windows\System\dwbeeft.exe
  2⤵
  PID:9568
- C:\Windows\System\IEtccEG.exe
  C:\Windows\System\IEtccEG.exe
  2⤵
  PID:9956
- C:\Windows\System\BUPvLGR.exe
  C:\Windows\System\BUPvLGR.exe
  2⤵
  PID:9528
- C:\Windows\System\zYgjesr.exe
  C:\Windows\System\zYgjesr.exe
  2⤵
  PID:8444
- C:\Windows\System\HXlRYlq.exe
  C:\Windows\System\HXlRYlq.exe
  2⤵
  PID:15108
- C:\Windows\System\SfnpnsV.exe
  C:\Windows\System\SfnpnsV.exe
  2⤵
  PID:14248
- C:\Windows\System\OyaTAAr.exe
  C:\Windows\System\OyaTAAr.exe
  2⤵
  PID:5916
- C:\Windows\System\RvKBfUE.exe
  C:\Windows\System\RvKBfUE.exe
  2⤵
  PID:10500
- C:\Windows\System\wZGFHaB.exe
  C:\Windows\System\wZGFHaB.exe
  2⤵
  PID:8928
- C:\Windows\System\FMWSpQf.exe
  C:\Windows\System\FMWSpQf.exe
  2⤵
  PID:10252
- C:\Windows\System\tHGfZDC.exe
  C:\Windows\System\tHGfZDC.exe
  2⤵
  PID:8240
- C:\Windows\System\xCLFKPz.exe
  C:\Windows\System\xCLFKPz.exe
  2⤵
  PID:9256
- C:\Windows\System\hKuGkPI.exe
  C:\Windows\System\hKuGkPI.exe
  2⤵
  PID:10424
- C:\Windows\System\HhINDYc.exe
  C:\Windows\System\HhINDYc.exe
  2⤵
  PID:4364
- C:\Windows\System\KLMbwcZ.exe
  C:\Windows\System\KLMbwcZ.exe
  2⤵
  PID:15324
- C:\Windows\System\powAHGZ.exe
  C:\Windows\System\powAHGZ.exe
  2⤵
  PID:15060
- C:\Windows\System\ZieZWvs.exe
  C:\Windows\System\ZieZWvs.exe
  2⤵
  PID:11120
- C:\Windows\System\TecMRZc.exe
  C:\Windows\System\TecMRZc.exe
  2⤵
  PID:11124
- C:\Windows\System\dNPdKjF.exe
  C:\Windows\System\dNPdKjF.exe
  2⤵
  PID:11000
- C:\Windows\System\cWQNBiD.exe
  C:\Windows\System\cWQNBiD.exe
  2⤵
  PID:11044
- C:\Windows\System\eiOwoNE.exe
  C:\Windows\System\eiOwoNE.exe
  2⤵
  PID:9776
- C:\Windows\System\BjBOIMq.exe
  C:\Windows\System\BjBOIMq.exe
  2⤵
  PID:7768
- C:\Windows\System\QNUeHcv.exe
  C:\Windows\System\QNUeHcv.exe
  2⤵
  PID:9224
- C:\Windows\System\bbcQqQt.exe
  C:\Windows\System\bbcQqQt.exe
  2⤵
  PID:9616
- C:\Windows\System\xhSWXwW.exe
  C:\Windows\System\xhSWXwW.exe
  2⤵
  PID:15136
- C:\Windows\System\bciDjie.exe
  C:\Windows\System\bciDjie.exe
  2⤵
  PID:11012
- C:\Windows\System\FQLNwGp.exe
  C:\Windows\System\FQLNwGp.exe
  2⤵
  PID:9396
- C:\Windows\System\RqSmhWG.exe
  C:\Windows\System\RqSmhWG.exe
  2⤵
  PID:8744
- C:\Windows\System\DtHvabd.exe
  C:\Windows\System\DtHvabd.exe
  2⤵
  PID:12336
- C:\Windows\System\xrXsfsl.exe
  C:\Windows\System\xrXsfsl.exe
  2⤵
  PID:10764
- C:\Windows\System\Gmvvvsa.exe
  C:\Windows\System\Gmvvvsa.exe
  2⤵
  PID:9444
- C:\Windows\System\yvIIqrE.exe
  C:\Windows\System\yvIIqrE.exe
  2⤵
  PID:8396
- C:\Windows\System\JNgrxRH.exe
  C:\Windows\System\JNgrxRH.exe
  2⤵
  PID:9724
- C:\Windows\System\ylzeQbM.exe
  C:\Windows\System\ylzeQbM.exe
  2⤵
  PID:9556
- C:\Windows\System\NLiquVQ.exe
  C:\Windows\System\NLiquVQ.exe
  2⤵
  PID:9996
- C:\Windows\System\SWzPLmw.exe
  C:\Windows\System\SWzPLmw.exe
  2⤵
  PID:11160
- C:\Windows\System\wThKXFR.exe
  C:\Windows\System\wThKXFR.exe
  2⤵
  PID:14304
- C:\Windows\System\WJgsjZq.exe
  C:\Windows\System\WJgsjZq.exe
  2⤵
  PID:10080
- C:\Windows\System\fOkvDtA.exe
  C:\Windows\System\fOkvDtA.exe
  2⤵
  PID:11140
- C:\Windows\System\AklKHDC.exe
  C:\Windows\System\AklKHDC.exe
  2⤵
  PID:12120
- C:\Windows\System\bWxqzzS.exe
  C:\Windows\System\bWxqzzS.exe
  2⤵
  PID:9732
- C:\Windows\System\YUuiRoo.exe
  C:\Windows\System\YUuiRoo.exe
  2⤵
  PID:12504
- C:\Windows\System\eZDiPto.exe
  C:\Windows\System\eZDiPto.exe
  2⤵
  PID:11360
- C:\Windows\System\qBKjQUY.exe
  C:\Windows\System\qBKjQUY.exe
  2⤵
  PID:9352
- C:\Windows\System\NWXNrDD.exe
  C:\Windows\System\NWXNrDD.exe
  2⤵
  PID:12352
- C:\Windows\System\xApprud.exe
  C:\Windows\System\xApprud.exe
  2⤵
  PID:7584
- C:\Windows\System\jVVKCZi.exe
  C:\Windows\System\jVVKCZi.exe
  2⤵
  PID:9304
- C:\Windows\System\XXBxrap.exe
  C:\Windows\System\XXBxrap.exe
  2⤵
  PID:11016
- C:\Windows\System\GSWIZWu.exe
  C:\Windows\System\GSWIZWu.exe
  2⤵
  PID:12084
- C:\Windows\System\oaqwgOr.exe
  C:\Windows\System\oaqwgOr.exe
  2⤵
  PID:8528
- C:\Windows\System\rBnTaRN.exe
  C:\Windows\System\rBnTaRN.exe
  2⤵
  PID:12584
- C:\Windows\System\PqtwBtW.exe
  C:\Windows\System\PqtwBtW.exe
  2⤵
  PID:9384
- C:\Windows\System\rDTXSrF.exe
  C:\Windows\System\rDTXSrF.exe
  2⤵
  PID:7884
- C:\Windows\System\FMAqPuE.exe
  C:\Windows\System\FMAqPuE.exe
  2⤵
  PID:11080
- C:\Windows\System\hVGzNca.exe
  C:\Windows\System\hVGzNca.exe
  2⤵
  PID:12492
- C:\Windows\System\zTDTqVx.exe
  C:\Windows\System\zTDTqVx.exe
  2⤵
  PID:14924
- C:\Windows\System\EOLhiEs.exe
  C:\Windows\System\EOLhiEs.exe
  2⤵
  PID:12664
- C:\Windows\System\JJCwtVA.exe
  C:\Windows\System\JJCwtVA.exe
  2⤵
  PID:10052
- C:\Windows\System\NHrAlWk.exe
  C:\Windows\System\NHrAlWk.exe
  2⤵
  PID:12532
- C:\Windows\System\lvlSuEJ.exe
  C:\Windows\System\lvlSuEJ.exe
  2⤵
  PID:12036
- C:\Windows\System\YFZGhmX.exe
  C:\Windows\System\YFZGhmX.exe
  2⤵
  PID:12436
- C:\Windows\System\BoRNTao.exe
  C:\Windows\System\BoRNTao.exe
  2⤵
  PID:9452
- C:\Windows\System\PqulixK.exe
  C:\Windows\System\PqulixK.exe
  2⤵
  PID:4864
- C:\Windows\System\ezuqyTW.exe
  C:\Windows\System\ezuqyTW.exe
  2⤵
  PID:12460
- C:\Windows\System\dLrmrtU.exe
  C:\Windows\System\dLrmrtU.exe
  2⤵
  PID:11396
- C:\Windows\System\CnQAAgk.exe
  C:\Windows\System\CnQAAgk.exe
  2⤵
  PID:13024
- C:\Windows\System\kfsadnn.exe
  C:\Windows\System\kfsadnn.exe
  2⤵
  PID:13660
- C:\Windows\System\jZyybiX.exe
  C:\Windows\System\jZyybiX.exe
  2⤵
  PID:12668
- C:\Windows\System\XAHCsBP.exe
  C:\Windows\System\XAHCsBP.exe
  2⤵
  PID:12720
- C:\Windows\System\lPKRlQk.exe
  C:\Windows\System\lPKRlQk.exe
  2⤵
  PID:11704
- C:\Windows\System\xCVlOkA.exe
  C:\Windows\System\xCVlOkA.exe
  2⤵
  PID:15380
- C:\Windows\System\LpJEZXx.exe
  C:\Windows\System\LpJEZXx.exe
  2⤵
  PID:15400
- C:\Windows\System\disodZH.exe
  C:\Windows\System\disodZH.exe
  2⤵
  PID:15428
- C:\Windows\System\LUAbAcp.exe
  C:\Windows\System\LUAbAcp.exe
  2⤵
  PID:15452
- C:\Windows\System\TQjEdws.exe
  C:\Windows\System\TQjEdws.exe
  2⤵
  PID:15476
- C:\Windows\System\PymnDAd.exe
  C:\Windows\System\PymnDAd.exe
  2⤵
  PID:15680
- C:\Windows\System\vOyZlQM.exe
  C:\Windows\System\vOyZlQM.exe
  2⤵
  PID:15700
- C:\Windows\System\uTriMLh.exe
  C:\Windows\System\uTriMLh.exe
  2⤵
  PID:15716
- C:\Windows\System\VIeQhze.exe
  C:\Windows\System\VIeQhze.exe
  2⤵
  PID:15740
- C:\Windows\System\FmGoWkm.exe
  C:\Windows\System\FmGoWkm.exe
  2⤵
  PID:15764
- C:\Windows\System\sRzSNRz.exe
  C:\Windows\System\sRzSNRz.exe
  2⤵
  PID:15784
- C:\Windows\System\xMOoIRD.exe
  C:\Windows\System\xMOoIRD.exe
  2⤵
  PID:15816
- C:\Windows\System\uzbwzak.exe
  C:\Windows\System\uzbwzak.exe
  2⤵
  PID:15840
- C:\Windows\System\vtoYLAv.exe
  C:\Windows\System\vtoYLAv.exe
  2⤵
  PID:15856
- C:\Windows\System\nnzGzpH.exe
  C:\Windows\System\nnzGzpH.exe
  2⤵
  PID:15884
- C:\Windows\System\XkcmLIs.exe
  C:\Windows\System\XkcmLIs.exe
  2⤵
  PID:15912
- C:\Windows\System\eLbbmaC.exe
  C:\Windows\System\eLbbmaC.exe
  2⤵
  PID:15932
- C:\Windows\System\yOCeTZQ.exe
  C:\Windows\System\yOCeTZQ.exe
  2⤵
  PID:15952
- C:\Windows\System\XhXcsNb.exe
  C:\Windows\System\XhXcsNb.exe
  2⤵
  PID:15968
- C:\Windows\System\MKGTsup.exe
  C:\Windows\System\MKGTsup.exe
  2⤵
  PID:15984
- C:\Windows\System\IojPLyy.exe
  C:\Windows\System\IojPLyy.exe
  2⤵
  PID:16000
- C:\Windows\System\blEQmCt.exe
  C:\Windows\System\blEQmCt.exe
  2⤵
  PID:16016
- C:\Windows\System\xUZNGEO.exe
  C:\Windows\System\xUZNGEO.exe
  2⤵
  PID:16032
- C:\Windows\System\afKUfPU.exe
  C:\Windows\System\afKUfPU.exe
  2⤵
  PID:16052
- C:\Windows\System\UBTbnCb.exe
  C:\Windows\System\UBTbnCb.exe
  2⤵
  PID:16076
- C:\Windows\System\QgOpwMT.exe
  C:\Windows\System\QgOpwMT.exe
  2⤵
  PID:16104
- C:\Windows\System\ZGTrQpT.exe
  C:\Windows\System\ZGTrQpT.exe
  2⤵
  PID:16128
- C:\Windows\System\vcZMgZK.exe
  C:\Windows\System\vcZMgZK.exe
  2⤵
  PID:16152
- C:\Windows\System\MEzdZRm.exe
  C:\Windows\System\MEzdZRm.exe
  2⤵
  PID:16172
- C:\Windows\System\HtmMxUO.exe
  C:\Windows\System\HtmMxUO.exe
  2⤵
  PID:16192
- C:\Windows\System\EmdkFIk.exe
  C:\Windows\System\EmdkFIk.exe
  2⤵
  PID:16208
- C:\Windows\System\wSqTtka.exe
  C:\Windows\System\wSqTtka.exe
  2⤵
  PID:16232
- C:\Windows\System\xfaQVjJ.exe
  C:\Windows\System\xfaQVjJ.exe
  2⤵
  PID:16248
- C:\Windows\System\ayMheIY.exe
  C:\Windows\System\ayMheIY.exe
  2⤵
  PID:16272
- C:\Windows\System\BOkuXGT.exe
  C:\Windows\System\BOkuXGT.exe
  2⤵
  PID:16300
- C:\Windows\System\CrFfqIk.exe
  C:\Windows\System\CrFfqIk.exe
  2⤵
  PID:16324
- C:\Windows\System\hxtWhCx.exe
  C:\Windows\System\hxtWhCx.exe
  2⤵
  PID:16344
- C:\Windows\System\qWvgVKO.exe
  C:\Windows\System\qWvgVKO.exe
  2⤵
  PID:16368
- C:\Windows\System\mSiWIOc.exe
  C:\Windows\System\mSiWIOc.exe
  2⤵
  PID:1460
- C:\Windows\System\pduMSdd.exe
  C:\Windows\System\pduMSdd.exe
  2⤵
  PID:11056
- C:\Windows\System\aEbgtOh.exe
  C:\Windows\System\aEbgtOh.exe
  2⤵
  PID:12360
- C:\Windows\System\UMpXEEk.exe
  C:\Windows\System\UMpXEEk.exe
  2⤵
  PID:13272
- C:\Windows\System\YGTgZya.exe
  C:\Windows\System\YGTgZya.exe
  2⤵
  PID:13276
- C:\Windows\System\VQjfuHH.exe
  C:\Windows\System\VQjfuHH.exe
  2⤵
  PID:7928
- C:\Windows\System\PTDlQuB.exe
  C:\Windows\System\PTDlQuB.exe
  2⤵
  PID:15396
- C:\Windows\System\HPlkxKd.exe
  C:\Windows\System\HPlkxKd.exe
  2⤵
  PID:15448
- C:\Windows\System\seuVrrO.exe
  C:\Windows\System\seuVrrO.exe
  2⤵
  PID:15464
- C:\Windows\System\WyPejtv.exe
  C:\Windows\System\WyPejtv.exe
  2⤵
  PID:9400
- C:\Windows\System\WnpuMDm.exe
  C:\Windows\System\WnpuMDm.exe
  2⤵
  PID:11424
- C:\Windows\System\izxBcJZ.exe
  C:\Windows\System\izxBcJZ.exe
  2⤵
  PID:11444
- C:\Windows\System\IZXNWxL.exe
  C:\Windows\System\IZXNWxL.exe
  2⤵
  PID:10596
- C:\Windows\System\WuaYrYE.exe
  C:\Windows\System\WuaYrYE.exe
  2⤵
  PID:12280
- C:\Windows\System\qCFvnij.exe
  C:\Windows\System\qCFvnij.exe
  2⤵
  PID:12684
- C:\Windows\System\qvhAmNI.exe
  C:\Windows\System\qvhAmNI.exe
  2⤵
  PID:15552
- C:\Windows\System\VlXIJsd.exe
  C:\Windows\System\VlXIJsd.exe
  2⤵
  PID:15596
- C:\Windows\System\bTWrDRe.exe
  C:\Windows\System\bTWrDRe.exe
  2⤵
  PID:11192
- C:\Windows\System\qzKKqCN.exe
  C:\Windows\System\qzKKqCN.exe
  2⤵
  PID:15620
- C:\Windows\System\lfqAIxw.exe
  C:\Windows\System\lfqAIxw.exe
  2⤵
  PID:15388
- C:\Windows\System\MtqlOHd.exe
  C:\Windows\System\MtqlOHd.exe
  2⤵
  PID:15636
- C:\Windows\System\hCCtIvi.exe
  C:\Windows\System\hCCtIvi.exe
  2⤵
  PID:12508
- C:\Windows\System\DClqvUy.exe
  C:\Windows\System\DClqvUy.exe
  2⤵
  PID:12988
- C:\Windows\System\BiuXAvg.exe
  C:\Windows\System\BiuXAvg.exe
  2⤵
  PID:13148
- C:\Windows\System\fdToGwQ.exe
  C:\Windows\System\fdToGwQ.exe
  2⤵
  PID:15484
- C:\Windows\System\zeQMQBc.exe
  C:\Windows\System\zeQMQBc.exe
  2⤵
  PID:15728
- C:\Windows\System\mjyVUOA.exe
  C:\Windows\System\mjyVUOA.exe
  2⤵
  PID:15792
- C:\Windows\System\xZNXUTk.exe
  C:\Windows\System\xZNXUTk.exe
  2⤵
  PID:15520
- C:\Windows\System\heVdDDv.exe
  C:\Windows\System\heVdDDv.exe
  2⤵
  PID:15500
- C:\Windows\System\CNgkSbj.exe
  C:\Windows\System\CNgkSbj.exe
  2⤵
  PID:15904
- C:\Windows\System\YwXClSI.exe
  C:\Windows\System\YwXClSI.exe
  2⤵
  PID:15940
- C:\Windows\System\dDazgnH.exe
  C:\Windows\System\dDazgnH.exe
  2⤵
  PID:16008
- C:\Windows\System\GnlpmQl.exe
  C:\Windows\System\GnlpmQl.exe
  2⤵
  PID:12244
- C:\Windows\System\bHWnWEA.exe
  C:\Windows\System\bHWnWEA.exe
  2⤵
  PID:13040
- C:\Windows\System\CSKPZQv.exe
  C:\Windows\System\CSKPZQv.exe
  2⤵
  PID:16240
- C:\Windows\System\wDDAhbB.exe
  C:\Windows\System\wDDAhbB.exe
  2⤵
  PID:12612
- C:\Windows\System\KCfuZrH.exe
  C:\Windows\System\KCfuZrH.exe
  2⤵
  PID:16356
- C:\Windows\System\ReuaGsf.exe
  C:\Windows\System\ReuaGsf.exe
  2⤵
  PID:3288
- C:\Windows\System\pPMCNiN.exe
  C:\Windows\System\pPMCNiN.exe
  2⤵
  PID:12936
- C:\Windows\System\kkZodXT.exe
  C:\Windows\System\kkZodXT.exe
  2⤵
  PID:11904
- C:\Windows\System\JcLlGIG.exe
  C:\Windows\System\JcLlGIG.exe
  2⤵
  PID:12480
- C:\Windows\System\PGLmXBl.exe
  C:\Windows\System\PGLmXBl.exe
  2⤵
  PID:16340
- C:\Windows\System\xVcdcmG.exe
  C:\Windows\System\xVcdcmG.exe
  2⤵
  PID:15580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:12404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ydtu3l2.ewm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BXMDDRF.exe

Filesize
1.8MB

MD5
33a646c52a13eebd58d710a863cb8782

SHA1
41eaf6f8564af991eea1547ec02581802f72cb7d

SHA256
7b98947889e3b9b9af44bc8d4912af41df69c12ec923d06b4769552df983c839

SHA512
8cd137e7c03717a81e2ab1fc42304c877ab20beb7394b328798988446ae58f31e919ce154b01f49fabe068f784e7828bc029ada572e0a301141006f3398e2d45

Download Submit
C:\Windows\System\BeTRgPu.exe

Filesize
1.8MB

MD5
d45c2b66878b25fcd184d6611913a1e8

SHA1
c7c8f58aaf7cc27f463420d1d57017339e98e9ef

SHA256
4da9a087063768d70c8a4cf2bd3f809c54c7dc9bfd1e811b182e9fba6a4cd4d7

SHA512
5db3c1d5f97bfc8dda5f76ae499d7813e0e7376f109b4798d7b6844eea43a5689e7b5113ffd6625c85138beb0c95dd0356bb0b7f0595242bd7957df4f0bde6d6

Download Submit
C:\Windows\System\DgkovnW.exe

Filesize
1.8MB

MD5
36da46fd854307700fd5d8aa74e43579

SHA1
1d48f746df89da87b022f89d169155773ff82a16

SHA256
8dacf2573527bec3171b8adc7056adba64da0b87abb28b34085fa6fa450b6d46

SHA512
fd76834cda615db4f1e6926d7743e095439f3733713f2104d28b137451a8a1d6cb0b7822b94ec8fdcefdb7ca78d828e3d60f43ebf74e99a11613238eaaebf868

Download Submit
C:\Windows\System\FdqhEbO.exe

Filesize
1.8MB

MD5
bb06a2cf47db453c7bf8ecdcb3b376ec

SHA1
f42aef64d4b88233ab6c3bdd173bef5f4611d00b

SHA256
ccb1d60d0be5bca5f72d6043dbca9d2f1b83deab02c9ff76cb9c9c157596d64c

SHA512
cfc3f3d6d60a3f615ba3625cb2eaa8bb6c5119b91a1178deb2cf95a775558399bb46b25f867e99c0ceca7f9d1a856fd4f9c87b27155603caa1aab7e5434c177c

Download Submit
C:\Windows\System\IqJQFvR.exe

Filesize
1.8MB

MD5
ce0c1e2fc36d7593669c2d288c81510c

SHA1
27f4fc20d6e014bd96b34eb306a56c00dd700f97

SHA256
510f5d58674bbf9fd17b1913be94ad7acb24126f578fadbc4c3985b998d3a8b7

SHA512
c919b6db18c99d0cd3d576011d2ceb5f4a1be470d8cb798d1bef05c266b5774418e41ac1a2684140023994912d7bc9df4fef6c3cc6dae55522cb76c7bdb17a3f

Download Submit
C:\Windows\System\JbrpdZu.exe

Filesize
1.8MB

MD5
f3b8cdda95564edf66b8b2d1ca08fa91

SHA1
4ca9054ae742795bf3a94f46b170a5b95279061b

SHA256
7efa62a20f1cd24052690d28523658892213fa49c28bc06fdf2cfd3aa197c52e

SHA512
be63eaf79f84fb25ede90a0c5e0db95eca6bb36241519246eea2964ae7af5857284e0ca3d1adb27ac9af4fb0b2e36fe532656eca537573d46ffafdbd5e2ffcdc

Download Submit
C:\Windows\System\LqkSuGp.exe

Filesize
1.8MB

MD5
f9ea5ce8f9824fc0acc62ee971887c5e

SHA1
9467fcb5718a36bb802b63403d602c97d8259bf7

SHA256
9dc4f58a0afde63fea9926b8ecc51737ec8e453bdcb2243bc1356dc752ddad23

SHA512
cbd747cab84ea392bf930d64d13b090dd6a627b63d42acf75c0e118d3834e53732c8a94c250bdc391b38a7c37d3a17de68970af7d679dddc9ae222d5dd5af83e

Download Submit
C:\Windows\System\LsJYSun.exe

Filesize
1.8MB

MD5
d1e89c6717c951403815a8148b917ef0

SHA1
501fd1a24d587ba8fdce65d6f587f54fc9da0232

SHA256
ed65ab65358bdcb6c713366787dbbb3b4db4dfd6f976ccfc20e29b7a69869647

SHA512
f641ea516bd41abd226a3da527d2b4672170cee4007c363a3008c5de84a4f9cb38599b58533082c7645554b2f5ae68fdff8a89ba39ba200a0c8ea71e9b4dba8d

Download Submit
C:\Windows\System\MqOsBra.exe

Filesize
1.8MB

MD5
613072e7ccd0fb11f1f36bfcd1e49498

SHA1
29c8bd53e69bfa585ee3860f1e87236b1054c5e6

SHA256
0d4311c9a3a7176f7488bc7858e9ad64014ba912fc1bb0b0cd554611734f46d9

SHA512
6a9dc63fcecb16475a3e1062b8b33629dba5e00caaab0169907b0bc544e42eb196ca8ba4bc05d084a594395ab93d406b77178594bee0c936678633f4647a7de4

Download Submit
C:\Windows\System\NvgyQQv.exe

Filesize
1.8MB

MD5
8602eef40e09df393b13fa2f41dbf402

SHA1
c77d57c96b4e53cb24f17198ecdb3085b86ba915

SHA256
e2baef84a4d5fe3d4006b671f19b592147df551c269220ee151b53ac74002148

SHA512
3ec53cce73a60f81197800f5c32e86e1f88d0005a4f1d630cf33a7bf31211c4a18c9ac5e488d32056b1786c8985877ee554bcd9c094fa03109488b9492a9ea2d

Download Submit
C:\Windows\System\OrlXmBi.exe

Filesize
1.8MB

MD5
97963045ba84015f467301bf2034e897

SHA1
853f511ca76822d3eda61a555cf7e120b70240a2

SHA256
56c8465b2bb224e8a0b9f022b67766f3a245e9ee75de921a4332e53751d516e7

SHA512
3cfe88264efb3b72d7b866f327028409c86038d55b35f5318fde8f63e5a45d417ba984631f03ebe6aaea62c8fb99ea8b921071cb300538f2208597e1d3dc8e99

Download Submit
C:\Windows\System\PaeskKS.exe

Filesize
1.8MB

MD5
69c3f5b4962c687daf31d16481d7d65d

SHA1
4a987a3238d4c38467cb12e8029368d3be4d1839

SHA256
20eedbfe644047a57e3b81cc61a2ecfb277d3cde19d533b2105db8eabe56efcf

SHA512
a2e886f48919ab9b746715c0bcaa0f88b362bab18b6597f472cd7a5cfa94d2667b0de9c9a7d50e6c2067e7efab0c178f80fb8ca0981099c0cd3e5e83ecb74ae9

Download Submit
C:\Windows\System\QOUoyqJ.exe

Filesize
1.8MB

MD5
945195b1c2e9fd723aa8ceaf4b4242af

SHA1
901131b3df7b2f1eb60bf60e8c8fae40ea8d0782

SHA256
141779e06da26df3772be94e1d1dc9700cce165e1a600daed3b8a43994518072

SHA512
4f916cf090ce778f16ee3e56d54204db8099987ae86b087059feef8b7e42144c3ed3ec3a37d26cc8a620a80f54ae37bc931bfe946d70e38ff5a0f8828583b9d0

Download Submit
C:\Windows\System\RiVQfrc.exe

Filesize
1.8MB

MD5
2d198f42293033798aaef44345c48593

SHA1
b7e5b6543a265a80b8bed6ea8e546e3abef02c83

SHA256
d007e12ea853ae67f194787fb891f5b9aa002a00f67832b43e7c0c4bc89db23e

SHA512
ee6596f4407769683ed3115a070dc42058b008146bec6f72cc6e541ada3023c2a33dda4b2aa951756e31caece218a9b2b6b1ef695a4c3a747e6a50a84a8ffcd2

Download Submit
C:\Windows\System\SHqeNhH.exe

Filesize
1.8MB

MD5
32a705e0f2985bd4770d90a29a015672

SHA1
ea922fb86ef278797bb1a4a97bd0432b759470d5

SHA256
5b502d37bed153c0148b54a2dc240994b4ce83dd28a0ff1727863478118dfea7

SHA512
2fdb0cae4c13331c467e062661a2877a88d9a9f228f9ef243839f9632f2752a1c124634069d5ac44a43a71a107c9174873c61134307bb0b5c090484a55310725

Download Submit
C:\Windows\System\VEQyZbh.exe

Filesize
1.8MB

MD5
733f4b3977eb3591787d5ca0a33e24ca

SHA1
302b928723c52810ea62e39148e47228b02be3fc

SHA256
bfd418b66f4dc0ee4d635af23a0e93a4d6969b9f64e7c859a3f17d34c3a19ac8

SHA512
b29c5965f9283f527f05ce2be182bb1f679f1b3b644b84db198420850676bc7d7c9a6d4b8e93d783e751af6a4a916a0df18bc11c99032b69c3e292b7357b714f

Download Submit
C:\Windows\System\WdlQKOy.exe

Filesize
1.8MB

MD5
ebca45480207e553d78d7c0cada06e17

SHA1
4ebec4f4d8f2dce897d0e2568438b45b62e66715

SHA256
0b1b60e4e6e17edd04f9b24d999db6d0d504654697c3386dee8341bab7ab2aa6

SHA512
c8668edca6f9af35f9ccdefc5c1267c56f2882655084984b46e0f0d7f4d6201a16f027d13718fd5e934f11609a486e3272256631e1be403b4811199433f02a32

Download Submit
C:\Windows\System\WreaIvU.exe

Filesize
1.8MB

MD5
a5401349464bfc7ba6abca390708c033

SHA1
c7e1cf371a2140eef4519133be099552eaeda95f

SHA256
57b07c2cb2bd369a8a6529c78bdd58f16438d38be9611d811f2f8921388a2188

SHA512
d830c91a5cfea68ab300527340c88b11c77f7334c61d5b642fd461fd4ea0d440771c8afa2e385697df44b7ddfca96a98962b897fc1b7f738cb127f617bc88eaa

Download Submit
C:\Windows\System\XlgrqGX.exe

Filesize
1.8MB

MD5
c759e303370d2c7e908a1a415ae5ddf9

SHA1
249e8b9da41e4bb9d8659adfa8e1f302d1a77705

SHA256
3664f88dd4371be866878e0749a88e1f4684bc5c9e93e5f44e280ca982b538bf

SHA512
1939e5ceeb53ae75122e11beddf233f467422cac771eaf531ba18fce17d471eb01b1870ec26058f1ab40eb98552b19825e71769c4a70395b4d880b24f64c7adb

Download Submit
C:\Windows\System\XvOXxOP.exe

Filesize
1.8MB

MD5
bb1d03da3f91443d52ddaa4efea44a43

SHA1
5c05074cc404ca8f214a407850af5d3eef95b761

SHA256
1787a3ed72f16a93e17189f371fed14d07846301c8ecfc0bcaaa1bb2f48f9b49

SHA512
30ae932d7f98672d8ffd39b00eba1ab6f6aae30a5c83d7422f67b48677868c47a1001c11c838c3035bc3fe271aa18e67371b5703f179bb49bfc516ceb49fba29

Download Submit
C:\Windows\System\YaWIvfm.exe

Filesize
1.8MB

MD5
11e21fb14e6e9ba86b312e3c4699225a

SHA1
817cd2cdc29b930c7c23765c02d66c485aa9dcd6

SHA256
d7f08091a257b8893ec7b570f79b2f36332145e68a191267a7a9d843581883c5

SHA512
52d62907e79fcbfd5fa79a8c7f25655a6e72d7904689290ff3b5129f72ecaca93fd25d64d0453c1dc77dfe510b54694fd287857e8b1ae329a950c9a654e628b4

Download Submit
C:\Windows\System\ajDPNYA.exe

Filesize
1.8MB

MD5
4f727670a0a38f14ac1c7b678c39e728

SHA1
0d9313032dd7d1d6f23ffcb1549fc87587d135f2

SHA256
1a145d869d0aee8603744281f48d6340cf01b96d3abe5570a70d03f12b796709

SHA512
9d34fe2d88ae5a27fb997349bd20d5d2a9ade76849ab0b5eb08bcea127ddda859645d9e8c657fa55c7b40f37e69bcc1ac7c30087808cba3bceac2d518c17f5b3

Download Submit
C:\Windows\System\bLMJPuS.exe

Filesize
1.8MB

MD5
320b6784554640b86abbc6a63ec97132

SHA1
af5ff5f87d04b8eb57360b2ec7b5777744ea0474

SHA256
542280908c58d816faae984ad1a341fbd86170cb1525b209cf3292423f093277

SHA512
9f8c2e26d8ac4b54bff49115f448842b88054bbf2947fc614e4b88546be8dc15748b7c1947a54023e486059f80883592f75ed0328a3d2d71c2c912cb60eb9924

Download Submit
C:\Windows\System\fIiChwR.exe

Filesize
1.8MB

MD5
3a74d6ec9536ed61c8d2fd86bf0adf9e

SHA1
aa54a71beeba2a0d86c7b513bdc41aed10b7e215

SHA256
d58d4d791d3983249e553970cd265a41f4b15fc539bfce2175e32c0a45b21a89

SHA512
1f853eef5a35dc4fd1e7760539a1700d9c1d5b3da832ba50b2d38e35ff032526b73223721ab46f866a0258e288462f8ef7ed1abd7137ded713c2e8c5b22792b8

Download Submit
C:\Windows\System\fReRsfR.exe

Filesize
1.8MB

MD5
0d69b67c87e16d64618446f084bfd8b7

SHA1
3c7cbbf5623975f1ef5fc42166e18c8b27607427

SHA256
7691bb6424071d2e7a3c3f2902b1ba208f99e3e94f1211a80ca7b64e50ada8fe

SHA512
62dba91c78ff280f6871d571ea297dec041e8c398f5836b11cbafc875aa978ceb4d9058b141149de921664af808591d293316aa1d9ba6825de3a0ed3c9415f4f

Download Submit
C:\Windows\System\kKhEXiO.exe

Filesize
1.8MB

MD5
5f3a6e5e5766ae9cc35130ab037a42f1

SHA1
1c681228c53506f5e1b5ae4dded53cefad535a41

SHA256
423a9faa7ca737d29dfe7f0f2c8d017a29b16815ed86deae3cc5a1e0535dd6dd

SHA512
0a54f1c6de4c09bd6ac58c15c0d8715274dee155d12c2078b60046bcb0ad2f0a9cfe5a23294daf08353568548f8b4b779c9d6440d74d1d19b21b69ade1d675a8

Download Submit
C:\Windows\System\kMyxekL.exe

Filesize
1.8MB

MD5
5da934c044454b29814727ef94734c24

SHA1
430a5b72fc8053cc1c617a71b8852e6b04fbbc5a

SHA256
1a8d2733eb7360659dbda5a6c26eaca8eef543279209787bc114f9598ddf4d34

SHA512
66041044d8769149291cb0fb5c9017052148d05b2dcd020767ff5e70eb698c7717e8868683dbed60e3bdd094bef547911c827d8075fef354dfed77f558c2f32f

Download Submit
C:\Windows\System\kUzHUrC.exe

Filesize
1.8MB

MD5
2f18a225b6bb7e9f5b38ba593a5df4f9

SHA1
d322ceb1f48fc8b2205d25ff7ccc482b95d94711

SHA256
897925ef74e20ad266e3782b694b43ea16c87684385d858755f1804df4d828aa

SHA512
d81c35fbcecdc59b9b908a800698c9ea191042814b86664d806ca2108112be1ee9c2863e92784957e8e7afd36d572b54ccce7ffeb5cfa452481429ab0e234887

Download Submit
C:\Windows\System\oLNlepv.exe

Filesize
1.8MB

MD5
a7c3b19e24e201805e529ddb92c2ea7e

SHA1
6b8109e813cadf4860a3e12178ce25f6905a91be

SHA256
d2492347d145c76cabf4642a0f2893bd10d172343d6fe5c62f94aa7b776ea2ae

SHA512
8ec6e8f85420aedc637a13fb48bb623f5cf849e455eb6cfa5bd3ec7a3b7ff4553935e77b18dc0f8bbb2959755d2baf2f25ce864266eaca031219a6bc27875c3a

Download Submit
C:\Windows\System\oRyFXNs.exe

Filesize
1.8MB

MD5
1624fd74d43b5b05dbf3537bbf7dd41c

SHA1
6dc1c072f1be18f25001a70da8462e53ed44334e

SHA256
a37985da26c6553498bc85267e2dc15cfe4bd500d76a8bdc7a4d40c525fc32a6

SHA512
004f00c7abd351961ec07d74951a082afba8e13f8ed9d8198f4f01b0944ebb6cceabb4ae44c913626c57a15856f208d54f71cc128d10b52a9b08d512158ff2ec

Download Submit
C:\Windows\System\riBbUSs.exe

Filesize
1.8MB

MD5
7231df7a190b4d1881b02ec98a396227

SHA1
8b555fe51b86cde5822e1b80db45cbe7f40b9e3b

SHA256
ed8a64c51d5c9957439222bec535d213b75038ac49afa1a0f17fdbd90aaf6788

SHA512
771e6c1c07d1a577caa858c4c77933ec7d875260b3c9c8367cac495259fae5f44260401b432afbd4355d28416a2af9f4c1771dd3f41f4140ca1c907c590872c9

Download Submit
C:\Windows\System\tKhyVnj.exe

Filesize
1.8MB

MD5
f7c6fbdfbe863eeecc282d20367acc0c

SHA1
6f1951be7e43a6e46d39e88a37374354ad6a9ec4

SHA256
9d2ab4e6ec06ff9e1c5e02b8af115f0fe31c0b6f9449c990a4bc2e8c95a02772

SHA512
d04afe821639fd6e912caf79f6a5cb5be7bc9610a45bb56aeee1b90f8f7bec68fbc8ddd1c55a0203c53747639f9af36586f6c9289cddfe174dbe78caf8aa75e3

Download Submit
C:\Windows\System\xxEwEKA.exe

Filesize
1.8MB

MD5
289aa849fed70232f5ee456dd7cca339

SHA1
da62506e16beaa83434ea44d15f8bb20eebdc04e

SHA256
93c52e4ffc70d0e0d107572507cbffa265ddff3e48f30ac9cd3db40d87a1daeb

SHA512
bbb6e59f21a83ca394c7485fdc7ba6eee01f83b5bc061bece974ac23795fe94ac8541cf67699c07d9d69e35a7b91b7a3ccc500e3875a5e65b0d359ef409dbbfc

Download Submit
memory/364-282-0x00007FF780C50000-0x00007FF781042000-memory.dmp

Filesize
3.9MB

Download
memory/364-2148-0x00007FF780C50000-0x00007FF781042000-memory.dmp

Filesize
3.9MB

Download
memory/372-2098-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp

Filesize
3.9MB

Download
memory/372-168-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp

Filesize
3.9MB

Download
memory/792-284-0x00007FF663810000-0x00007FF663C02000-memory.dmp

Filesize
3.9MB

Download
memory/792-2202-0x00007FF663810000-0x00007FF663C02000-memory.dmp

Filesize
3.9MB

Download
memory/1256-117-0x00007FF7917D0000-0x00007FF791BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2029-0x00007FF7917D0000-0x00007FF791BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-2610-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/1364-1218-0x00007FFC4E983000-0x00007FFC4E985000-memory.dmp

Filesize
8KB

Download
memory/1364-78-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/1364-41-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/1364-4-0x00007FFC4E983000-0x00007FFC4E985000-memory.dmp

Filesize
8KB

Download
memory/1364-106-0x000002117FCB0000-0x0000021180456000-memory.dmp

Filesize
7.6MB

Download
memory/1364-134-0x0000021100000000-0x0000021101677000-memory.dmp

Filesize
22.5MB

Download
memory/1364-20-0x00000211663F0000-0x0000021166412000-memory.dmp

Filesize
136KB

Download
memory/1364-59-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/1368-2110-0x00007FF690F40000-0x00007FF691332000-memory.dmp

Filesize
3.9MB

Download
memory/1368-283-0x00007FF690F40000-0x00007FF691332000-memory.dmp

Filesize
3.9MB

Download
memory/1444-1681-0x00007FF746A30000-0x00007FF746E22000-memory.dmp

Filesize
3.9MB

Download
memory/1444-98-0x00007FF746A30000-0x00007FF746E22000-memory.dmp

Filesize
3.9MB

Download
memory/1496-285-0x00007FF7144D0000-0x00007FF7148C2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-2092-0x00007FF7144D0000-0x00007FF7148C2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-1804-0x00007FF7CEC10000-0x00007FF7CF002000-memory.dmp

Filesize
3.9MB

Download
memory/1952-100-0x00007FF7CEC10000-0x00007FF7CF002000-memory.dmp

Filesize
3.9MB

Download
memory/1980-99-0x00007FF70BC60000-0x00007FF70C052000-memory.dmp

Filesize
3.9MB

Download
memory/1980-1809-0x00007FF70BC60000-0x00007FF70C052000-memory.dmp

Filesize
3.9MB

Download
memory/2036-91-0x00007FF7C8970000-0x00007FF7C8D62000-memory.dmp

Filesize
3.9MB

Download
memory/2036-1725-0x00007FF7C8970000-0x00007FF7C8D62000-memory.dmp

Filesize
3.9MB

Download
memory/2224-1663-0x00007FF71AAE0000-0x00007FF71AED2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-97-0x00007FF71AAE0000-0x00007FF71AED2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-1713-0x00007FF76B500000-0x00007FF76B8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-104-0x00007FF76B500000-0x00007FF76B8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-103-0x00007FF769650000-0x00007FF769A42000-memory.dmp

Filesize
3.9MB

Download
memory/2492-1874-0x00007FF769650000-0x00007FF769A42000-memory.dmp

Filesize
3.9MB

Download
memory/2524-94-0x00007FF68F770000-0x00007FF68FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1736-0x00007FF68F770000-0x00007FF68FB62000-memory.dmp

Filesize
3.9MB

Download
memory/3104-128-0x00007FF628190000-0x00007FF628582000-memory.dmp

Filesize
3.9MB

Download
memory/3104-2071-0x00007FF628190000-0x00007FF628582000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2130-0x00007FF677DA0000-0x00007FF678192000-memory.dmp

Filesize
3.9MB

Download
memory/3428-186-0x00007FF677DA0000-0x00007FF678192000-memory.dmp

Filesize
3.9MB

Download
memory/3552-1890-0x00007FF781C60000-0x00007FF782052000-memory.dmp

Filesize
3.9MB

Download
memory/3552-105-0x00007FF781C60000-0x00007FF782052000-memory.dmp

Filesize
3.9MB

Download
memory/3604-1859-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3604-83-0x00007FF66DD00000-0x00007FF66E0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-102-0x00007FF7452A0000-0x00007FF745692000-memory.dmp

Filesize
3.9MB

Download
memory/3768-1640-0x00007FF7452A0000-0x00007FF745692000-memory.dmp

Filesize
3.9MB

Download
memory/4032-1849-0x00007FF65A530000-0x00007FF65A922000-memory.dmp

Filesize
3.9MB

Download
memory/4032-101-0x00007FF65A530000-0x00007FF65A922000-memory.dmp

Filesize
3.9MB

Download
memory/4140-768-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4140-0-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4140-118-0x00007FF65C990000-0x00007FF65CD82000-memory.dmp

Filesize
3.9MB

Download
memory/4140-1-0x000001FFDB300000-0x000001FFDB310000-memory.dmp

Filesize
64KB

Download
memory/4708-1728-0x00007FF61AE50000-0x00007FF61B242000-memory.dmp

Filesize
3.9MB

Download
memory/4708-87-0x00007FF61AE50000-0x00007FF61B242000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2123-0x00007FF7EAE40000-0x00007FF7EB232000-memory.dmp

Filesize
3.9MB

Download
memory/4772-173-0x00007FF7EAE40000-0x00007FF7EB232000-memory.dmp

Filesize
3.9MB

Download
memory/4976-1617-0x00007FF662640000-0x00007FF662A32000-memory.dmp

Filesize
3.9MB

Download
memory/4976-158-0x00007FF662640000-0x00007FF662A32000-memory.dmp

Filesize
3.9MB

Download
memory/4976-8-0x00007FF662640000-0x00007FF662A32000-memory.dmp

Filesize
3.9MB

Download
memory/5084-64-0x00007FF6A61A0000-0x00007FF6A6592000-memory.dmp

Filesize
3.9MB

Download
memory/5084-1648-0x00007FF6A61A0000-0x00007FF6A6592000-memory.dmp

Filesize
3.9MB

Download