xmrig | e1077496aa0aaa730fe2d98380e8a426c9c1d7ab84939d0a6cf2857090706dd4

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
Size

2.2MB
MD5

0ecdaafc84d690a0dffd3834a9cd9fb9
SHA1

019fb45cd508c7bfebb11f5eea76bb7f1750c06b
SHA256

e1077496aa0aaa730fe2d98380e8a426c9c1d7ab84939d0a6cf2857090706dd4
SHA512

fc5ab20607e66da690b334502d848c690b94ca59fb8bdf4942a9d5b3734e7808ddba04a135835a54fbf4cb8456fe432e1e7bce19c56eb5c2cb8408f9547ea309
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf3h:NABC

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/2700-52-0x00007FF70E8E0000-0x00007FF70ECD2000-memory.dmp	xmrig
behavioral2/memory/3064-39-0x00007FF7738C0000-0x00007FF773CB2000-memory.dmp	xmrig
behavioral2/memory/4912-288-0x00007FF64CE00000-0x00007FF64D1F2000-memory.dmp	xmrig
behavioral2/memory/3508-313-0x00007FF617690000-0x00007FF617A82000-memory.dmp	xmrig
behavioral2/memory/3056-376-0x00007FF7C6980000-0x00007FF7C6D72000-memory.dmp	xmrig
behavioral2/memory/388-381-0x00007FF637800000-0x00007FF637BF2000-memory.dmp	xmrig
behavioral2/memory/3464-386-0x00007FF703E90000-0x00007FF704282000-memory.dmp	xmrig
behavioral2/memory/2020-385-0x00007FF752050000-0x00007FF752442000-memory.dmp	xmrig
behavioral2/memory/2332-384-0x00007FF7FFAE0000-0x00007FF7FFED2000-memory.dmp	xmrig
behavioral2/memory/964-383-0x00007FF62E930000-0x00007FF62ED22000-memory.dmp	xmrig
behavioral2/memory/3436-380-0x00007FF70DAF0000-0x00007FF70DEE2000-memory.dmp	xmrig
behavioral2/memory/4072-379-0x00007FF7F8600000-0x00007FF7F89F2000-memory.dmp	xmrig
behavioral2/memory/3688-375-0x00007FF690140000-0x00007FF690532000-memory.dmp	xmrig
behavioral2/memory/3088-261-0x00007FF7FD160000-0x00007FF7FD552000-memory.dmp	xmrig
behavioral2/memory/5040-214-0x00007FF78C720000-0x00007FF78CB12000-memory.dmp	xmrig
behavioral2/memory/4776-208-0x00007FF74FDA0000-0x00007FF750192000-memory.dmp	xmrig
behavioral2/memory/2280-196-0x00007FF669CB0000-0x00007FF66A0A2000-memory.dmp	xmrig
behavioral2/memory/4996-174-0x00007FF7AE1C0000-0x00007FF7AE5B2000-memory.dmp	xmrig
behavioral2/memory/4868-4691-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp	xmrig
behavioral2/memory/2700-4698-0x00007FF70E8E0000-0x00007FF70ECD2000-memory.dmp	xmrig
behavioral2/memory/2332-4714-0x00007FF7FFAE0000-0x00007FF7FFED2000-memory.dmp	xmrig
behavioral2/memory/2504-4721-0x00007FF7E9460000-0x00007FF7E9852000-memory.dmp	xmrig
behavioral2/memory/4996-4720-0x00007FF7AE1C0000-0x00007FF7AE5B2000-memory.dmp	xmrig
behavioral2/memory/4072-4737-0x00007FF7F8600000-0x00007FF7F89F2000-memory.dmp	xmrig
behavioral2/memory/2020-4745-0x00007FF752050000-0x00007FF752442000-memory.dmp	xmrig
behavioral2/memory/4776-4778-0x00007FF74FDA0000-0x00007FF750192000-memory.dmp	xmrig
behavioral2/memory/4024-4766-0x00007FF7715E0000-0x00007FF7719D2000-memory.dmp	xmrig
behavioral2/memory/3056-4760-0x00007FF7C6980000-0x00007FF7C6D72000-memory.dmp	xmrig
behavioral2/memory/3088-4755-0x00007FF7FD160000-0x00007FF7FD552000-memory.dmp	xmrig
behavioral2/memory/5040-4751-0x00007FF78C720000-0x00007FF78CB12000-memory.dmp	xmrig
behavioral2/memory/2248-4731-0x00007FF7B4930000-0x00007FF7B4D22000-memory.dmp	xmrig
behavioral2/memory/3508-4787-0x00007FF617690000-0x00007FF617A82000-memory.dmp	xmrig
behavioral2/memory/4912-4773-0x00007FF64CE00000-0x00007FF64D1F2000-memory.dmp	xmrig
behavioral2/memory/3436-4841-0x00007FF70DAF0000-0x00007FF70DEE2000-memory.dmp	xmrig
behavioral2/memory/2280-4838-0x00007FF669CB0000-0x00007FF66A0A2000-memory.dmp	xmrig
behavioral2/memory/3464-4831-0x00007FF703E90000-0x00007FF704282000-memory.dmp	xmrig
behavioral2/memory/388-4832-0x00007FF637800000-0x00007FF637BF2000-memory.dmp	xmrig
behavioral2/memory/3688-4830-0x00007FF690140000-0x00007FF690532000-memory.dmp	xmrig
behavioral2/memory/4920-4801-0x00007FF6B4660000-0x00007FF6B4A52000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
9	4844	powershell.exe
11	4844	powershell.exe
15	4844	powershell.exe
16	4844	powershell.exe
18	4844	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4868	sOVRWSu.exe
3952	fjJTOqx.exe
3064	sYKEoBc.exe
2700	qKQcdud.exe
2248	QrSZjCI.exe
964	SSdKomv.exe
2332	MQFUEeR.exe
4024	UemPasg.exe
2504	UIfXuwp.exe
4920	gFAAsLx.exe
4996	QOnHLVi.exe
2280	weqbKSx.exe
4776	XPthKxa.exe
5040	UvWkxQB.exe
2020	wiUQnIw.exe
3088	vDZSmWT.exe
4912	dIqhARj.exe
3508	oGkNqZI.exe
3688	LgzUEFO.exe
3056	JHZzYdT.exe
4072	LTkkdZS.exe
3464	mvhcSiF.exe
3436	CHRzpYd.exe
388	caTdOSf.exe
4084	aAMKfnc.exe
4712	tukfkyX.exe
2940	ytsyEZB.exe
2220	gCGdtTg.exe
4752	iFQBvXK.exe
2652	rUFPMZy.exe
4572	vUBuFnU.exe
1572	GgvRGuY.exe
2596	MuwaJHz.exe
2204	SncNIRZ.exe
880	XwJYmOg.exe
1188	lBUlQwq.exe
3780	qcUqDhD.exe
1340	YAXeTPO.exe
3852	LEBPJiL.exe
4924	BEvshDb.exe
1396	UaXVMJW.exe
3956	KUjQxAD.exe
3396	otMPnAu.exe
2052	lZHknfV.exe
3136	XNPmocW.exe
2772	pQmQSfB.exe
4612	EGxZfPO.exe
3388	FrwlzXZ.exe
4500	RLjXdAG.exe
2932	cVDhbRM.exe
1456	fTpOyAG.exe
3504	DXwtzNT.exe
4384	vcvTmbE.exe
4372	igmPuVF.exe
4564	tsswDWM.exe
1876	uYCKqSk.exe
5068	VXVrawy.exe
1864	jUkAEZH.exe
4992	fLVeANa.exe
1552	TJVxDmz.exe
3620	HnERVuY.exe
2936	qJJnrtO.exe
1400	UQzVHiN.exe
2244	hPSSzHH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4076-0-0x00007FF6BAE60000-0x00007FF6BB252000-memory.dmp	upx
behavioral2/files/0x000b000000023b84-5.dat	upx
behavioral2/files/0x000a000000023b89-8.dat	upx
behavioral2/memory/3952-20-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-51.dat	upx
behavioral2/files/0x000a000000023b93-67.dat	upx
behavioral2/files/0x000a000000023b96-80.dat	upx
behavioral2/files/0x000a000000023b97-115.dat	upx
behavioral2/memory/4024-76-0x00007FF7715E0000-0x00007FF7719D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-71.dat	upx
behavioral2/files/0x000a000000023b92-70.dat	upx
behavioral2/files/0x000a000000023b8b-62.dat	upx
behavioral2/memory/2248-59-0x00007FF7B4930000-0x00007FF7B4D22000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-55.dat	upx
behavioral2/memory/2700-52-0x00007FF70E8E0000-0x00007FF70ECD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-50.dat	upx
behavioral2/files/0x000a000000023b8f-48.dat	upx
behavioral2/files/0x000a000000023b8d-43.dat	upx
behavioral2/memory/3064-39-0x00007FF7738C0000-0x00007FF773CB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-117.dat	upx
behavioral2/files/0x000a000000023b98-142.dat	upx
behavioral2/files/0x000a000000023bac-180.dat	upx
behavioral2/memory/4912-288-0x00007FF64CE00000-0x00007FF64D1F2000-memory.dmp	upx
behavioral2/memory/3508-313-0x00007FF617690000-0x00007FF617A82000-memory.dmp	upx
behavioral2/memory/3056-376-0x00007FF7C6980000-0x00007FF7C6D72000-memory.dmp	upx
behavioral2/memory/388-381-0x00007FF637800000-0x00007FF637BF2000-memory.dmp	upx
behavioral2/memory/3464-386-0x00007FF703E90000-0x00007FF704282000-memory.dmp	upx
behavioral2/memory/2020-385-0x00007FF752050000-0x00007FF752442000-memory.dmp	upx
behavioral2/memory/2332-384-0x00007FF7FFAE0000-0x00007FF7FFED2000-memory.dmp	upx
behavioral2/memory/964-383-0x00007FF62E930000-0x00007FF62ED22000-memory.dmp	upx
behavioral2/memory/3436-380-0x00007FF70DAF0000-0x00007FF70DEE2000-memory.dmp	upx
behavioral2/memory/4072-379-0x00007FF7F8600000-0x00007FF7F89F2000-memory.dmp	upx
behavioral2/memory/3688-375-0x00007FF690140000-0x00007FF690532000-memory.dmp	upx
behavioral2/memory/3088-261-0x00007FF7FD160000-0x00007FF7FD552000-memory.dmp	upx
behavioral2/memory/5040-214-0x00007FF78C720000-0x00007FF78CB12000-memory.dmp	upx
behavioral2/memory/4776-208-0x00007FF74FDA0000-0x00007FF750192000-memory.dmp	upx
behavioral2/memory/2280-196-0x00007FF669CB0000-0x00007FF66A0A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-181.dat	upx
behavioral2/files/0x000a000000023bab-179.dat	upx
behavioral2/files/0x000a000000023baa-178.dat	upx
behavioral2/files/0x000a000000023ba9-177.dat	upx
behavioral2/memory/4996-174-0x00007FF7AE1C0000-0x00007FF7AE5B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-172.dat	upx
behavioral2/files/0x000a000000023ba1-170.dat	upx
behavioral2/files/0x000a000000023ba6-168.dat	upx
behavioral2/files/0x000a000000023b95-165.dat	upx
behavioral2/files/0x000a000000023ba5-155.dat	upx
behavioral2/files/0x000a000000023b99-154.dat	upx
behavioral2/files/0x000a000000023b9e-151.dat	upx
behavioral2/memory/4920-139-0x00007FF6B4660000-0x00007FF6B4A52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-138.dat	upx
behavioral2/files/0x000a000000023ba3-137.dat	upx
behavioral2/files/0x000a000000023ba2-134.dat	upx
behavioral2/files/0x000a000000023b9b-133.dat	upx
behavioral2/files/0x000a000000023ba8-173.dat	upx
behavioral2/files/0x000a000000023ba0-128.dat	upx
behavioral2/files/0x000a000000023b9f-125.dat	upx
behavioral2/memory/2504-112-0x00007FF7E9460000-0x00007FF7E9852000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-107.dat	upx
behavioral2/files/0x000a000000023b8c-98.dat	upx
behavioral2/files/0x000a000000023b9a-94.dat	upx
behavioral2/files/0x000a000000023b8a-27.dat	upx
behavioral2/files/0x000a000000023b88-19.dat	upx
behavioral2/memory/4868-15-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AMYEpJw.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\IZaFqTx.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\QYtETkN.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\KLYLvmn.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wbJbfAM.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dtQEPez.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\bfeYIos.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\jHkTAbX.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\UuuvpbC.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\JdSARlb.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\GhgvtaV.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\IyEMmWM.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\RjvBQhm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\BAHFNGD.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ucfRPpZ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\gcgpTFs.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\NXbRYla.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\KjjmnjI.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\lecVXsQ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\Axxrmmx.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\RGgSzYK.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\lJuEHit.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wxPwpgD.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\SFJuVEn.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\neYuaky.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\uWZhOMT.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\DdqguVT.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dlbYSUH.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\MmTUTGb.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\fkhvGfz.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\XvUNjyA.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\FCBtZSm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\HqxxSwk.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ryYpQKc.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\VNwdfuo.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\quGhsKQ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\luIwPSC.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\WQJXXkK.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\RpojFZI.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wsdGiEo.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\qDthzTQ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\WxEBBQy.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dKTyvTg.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\fcHdsYV.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\zueVaIo.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\mWWMfNm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\GkBHcKO.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\eyTSbzF.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\YGTFomJ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wLlRNqO.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\Mknkegp.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ysjFchW.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\WaVIAdH.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\YCAnzvs.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\IUPUmlH.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\zAOndnM.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\oLeKCVq.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\HCQyrxV.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\AWccvzE.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wQHnElu.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\CFPQOks.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\lyAJfqv.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\wUsqQia.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\qofwRHY.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeLockMemoryPrivilege	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4844	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	84
PID 4076 wrote to memory of 4844	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	84
PID 4076 wrote to memory of 4868	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	85
PID 4076 wrote to memory of 4868	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	85
PID 4076 wrote to memory of 3952	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	86
PID 4076 wrote to memory of 3952	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	86
PID 4076 wrote to memory of 3064	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	87
PID 4076 wrote to memory of 3064	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	87
PID 4076 wrote to memory of 2700	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	88
PID 4076 wrote to memory of 2700	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	88
PID 4076 wrote to memory of 2248	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	89
PID 4076 wrote to memory of 2248	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	89
PID 4076 wrote to memory of 2504	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	90
PID 4076 wrote to memory of 2504	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	90
PID 4076 wrote to memory of 964	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	91
PID 4076 wrote to memory of 964	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	91
PID 4076 wrote to memory of 2332	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	92
PID 4076 wrote to memory of 2332	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	92
PID 4076 wrote to memory of 4024	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	93
PID 4076 wrote to memory of 4024	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	93
PID 4076 wrote to memory of 4920	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	94
PID 4076 wrote to memory of 4920	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	94
PID 4076 wrote to memory of 4996	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	95
PID 4076 wrote to memory of 4996	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	95
PID 4076 wrote to memory of 4776	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	96
PID 4076 wrote to memory of 4776	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	96
PID 4076 wrote to memory of 2280	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	97
PID 4076 wrote to memory of 2280	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	97
PID 4076 wrote to memory of 5040	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	98
PID 4076 wrote to memory of 5040	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	98
PID 4076 wrote to memory of 3688	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	99
PID 4076 wrote to memory of 3688	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	99
PID 4076 wrote to memory of 2020	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	100
PID 4076 wrote to memory of 2020	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	100
PID 4076 wrote to memory of 3088	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	101
PID 4076 wrote to memory of 3088	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	101
PID 4076 wrote to memory of 4912	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	102
PID 4076 wrote to memory of 4912	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	102
PID 4076 wrote to memory of 3508	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	103
PID 4076 wrote to memory of 3508	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	103
PID 4076 wrote to memory of 3056	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	104
PID 4076 wrote to memory of 3056	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	104
PID 4076 wrote to memory of 2940	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	105
PID 4076 wrote to memory of 2940	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	105
PID 4076 wrote to memory of 4072	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	106
PID 4076 wrote to memory of 4072	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	106
PID 4076 wrote to memory of 3464	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	107
PID 4076 wrote to memory of 3464	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	107
PID 4076 wrote to memory of 3436	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	108
PID 4076 wrote to memory of 3436	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	108
PID 4076 wrote to memory of 388	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	109
PID 4076 wrote to memory of 388	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	109
PID 4076 wrote to memory of 4084	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	110
PID 4076 wrote to memory of 4084	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	110
PID 4076 wrote to memory of 4712	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	111
PID 4076 wrote to memory of 4712	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	111
PID 4076 wrote to memory of 2220	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	112
PID 4076 wrote to memory of 2220	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	112
PID 4076 wrote to memory of 4752	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	113
PID 4076 wrote to memory of 4752	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	113
PID 4076 wrote to memory of 2652	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	114
PID 4076 wrote to memory of 2652	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	114
PID 4076 wrote to memory of 4572	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	115
PID 4076 wrote to memory of 4572	4076	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System\sOVRWSu.exe
  C:\Windows\System\sOVRWSu.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\fjJTOqx.exe
  C:\Windows\System\fjJTOqx.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\sYKEoBc.exe
  C:\Windows\System\sYKEoBc.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\qKQcdud.exe
  C:\Windows\System\qKQcdud.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\QrSZjCI.exe
  C:\Windows\System\QrSZjCI.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UIfXuwp.exe
  C:\Windows\System\UIfXuwp.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\SSdKomv.exe
  C:\Windows\System\SSdKomv.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\MQFUEeR.exe
  C:\Windows\System\MQFUEeR.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\UemPasg.exe
  C:\Windows\System\UemPasg.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\gFAAsLx.exe
  C:\Windows\System\gFAAsLx.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\QOnHLVi.exe
  C:\Windows\System\QOnHLVi.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\XPthKxa.exe
  C:\Windows\System\XPthKxa.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\weqbKSx.exe
  C:\Windows\System\weqbKSx.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\UvWkxQB.exe
  C:\Windows\System\UvWkxQB.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\LgzUEFO.exe
  C:\Windows\System\LgzUEFO.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\wiUQnIw.exe
  C:\Windows\System\wiUQnIw.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\vDZSmWT.exe
  C:\Windows\System\vDZSmWT.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\dIqhARj.exe
  C:\Windows\System\dIqhARj.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\oGkNqZI.exe
  C:\Windows\System\oGkNqZI.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\JHZzYdT.exe
  C:\Windows\System\JHZzYdT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\ytsyEZB.exe
  C:\Windows\System\ytsyEZB.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\LTkkdZS.exe
  C:\Windows\System\LTkkdZS.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\mvhcSiF.exe
  C:\Windows\System\mvhcSiF.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\CHRzpYd.exe
  C:\Windows\System\CHRzpYd.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\caTdOSf.exe
  C:\Windows\System\caTdOSf.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\aAMKfnc.exe
  C:\Windows\System\aAMKfnc.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\tukfkyX.exe
  C:\Windows\System\tukfkyX.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\gCGdtTg.exe
  C:\Windows\System\gCGdtTg.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\iFQBvXK.exe
  C:\Windows\System\iFQBvXK.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\rUFPMZy.exe
  C:\Windows\System\rUFPMZy.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\vUBuFnU.exe
  C:\Windows\System\vUBuFnU.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\GgvRGuY.exe
  C:\Windows\System\GgvRGuY.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\MuwaJHz.exe
  C:\Windows\System\MuwaJHz.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\SncNIRZ.exe
  C:\Windows\System\SncNIRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\XwJYmOg.exe
  C:\Windows\System\XwJYmOg.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\lBUlQwq.exe
  C:\Windows\System\lBUlQwq.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\qcUqDhD.exe
  C:\Windows\System\qcUqDhD.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\YAXeTPO.exe
  C:\Windows\System\YAXeTPO.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\LEBPJiL.exe
  C:\Windows\System\LEBPJiL.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\BEvshDb.exe
  C:\Windows\System\BEvshDb.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\UaXVMJW.exe
  C:\Windows\System\UaXVMJW.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\KUjQxAD.exe
  C:\Windows\System\KUjQxAD.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\otMPnAu.exe
  C:\Windows\System\otMPnAu.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\lZHknfV.exe
  C:\Windows\System\lZHknfV.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\FrwlzXZ.exe
  C:\Windows\System\FrwlzXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\XNPmocW.exe
  C:\Windows\System\XNPmocW.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\pQmQSfB.exe
  C:\Windows\System\pQmQSfB.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\EGxZfPO.exe
  C:\Windows\System\EGxZfPO.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\RLjXdAG.exe
  C:\Windows\System\RLjXdAG.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\cVDhbRM.exe
  C:\Windows\System\cVDhbRM.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\fTpOyAG.exe
  C:\Windows\System\fTpOyAG.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\DXwtzNT.exe
  C:\Windows\System\DXwtzNT.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\vcvTmbE.exe
  C:\Windows\System\vcvTmbE.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\igmPuVF.exe
  C:\Windows\System\igmPuVF.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\tsswDWM.exe
  C:\Windows\System\tsswDWM.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\uYCKqSk.exe
  C:\Windows\System\uYCKqSk.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\VXVrawy.exe
  C:\Windows\System\VXVrawy.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\jUkAEZH.exe
  C:\Windows\System\jUkAEZH.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\fLVeANa.exe
  C:\Windows\System\fLVeANa.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\TJVxDmz.exe
  C:\Windows\System\TJVxDmz.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\HnERVuY.exe
  C:\Windows\System\HnERVuY.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\qJJnrtO.exe
  C:\Windows\System\qJJnrtO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\UQzVHiN.exe
  C:\Windows\System\UQzVHiN.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\hPSSzHH.exe
  C:\Windows\System\hPSSzHH.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\zMioErd.exe
  C:\Windows\System\zMioErd.exe
  2⤵
  PID:2172
- C:\Windows\System\ClkgBrN.exe
  C:\Windows\System\ClkgBrN.exe
  2⤵
  PID:1252
- C:\Windows\System\qyozXBv.exe
  C:\Windows\System\qyozXBv.exe
  2⤵
  PID:4772
- C:\Windows\System\GVKXwxj.exe
  C:\Windows\System\GVKXwxj.exe
  2⤵
  PID:2524
- C:\Windows\System\LrJJuKk.exe
  C:\Windows\System\LrJJuKk.exe
  2⤵
  PID:2276
- C:\Windows\System\qHlrkgc.exe
  C:\Windows\System\qHlrkgc.exe
  2⤵
  PID:1352
- C:\Windows\System\gneUJgY.exe
  C:\Windows\System\gneUJgY.exe
  2⤵
  PID:2004
- C:\Windows\System\sJRobkS.exe
  C:\Windows\System\sJRobkS.exe
  2⤵
  PID:5060
- C:\Windows\System\YVvQTxC.exe
  C:\Windows\System\YVvQTxC.exe
  2⤵
  PID:5012
- C:\Windows\System\xjleTNW.exe
  C:\Windows\System\xjleTNW.exe
  2⤵
  PID:5144
- C:\Windows\System\caMYKgD.exe
  C:\Windows\System\caMYKgD.exe
  2⤵
  PID:5168
- C:\Windows\System\fsabiCz.exe
  C:\Windows\System\fsabiCz.exe
  2⤵
  PID:5224
- C:\Windows\System\DCqMfXJ.exe
  C:\Windows\System\DCqMfXJ.exe
  2⤵
  PID:5252
- C:\Windows\System\upSadju.exe
  C:\Windows\System\upSadju.exe
  2⤵
  PID:5272
- C:\Windows\System\APqKaaI.exe
  C:\Windows\System\APqKaaI.exe
  2⤵
  PID:5296
- C:\Windows\System\IjEgreN.exe
  C:\Windows\System\IjEgreN.exe
  2⤵
  PID:5320
- C:\Windows\System\ogpgGaz.exe
  C:\Windows\System\ogpgGaz.exe
  2⤵
  PID:5340
- C:\Windows\System\ttGdLSr.exe
  C:\Windows\System\ttGdLSr.exe
  2⤵
  PID:5356
- C:\Windows\System\JZSlYoK.exe
  C:\Windows\System\JZSlYoK.exe
  2⤵
  PID:5392
- C:\Windows\System\VPQrBFV.exe
  C:\Windows\System\VPQrBFV.exe
  2⤵
  PID:5416
- C:\Windows\System\trMUXck.exe
  C:\Windows\System\trMUXck.exe
  2⤵
  PID:5452
- C:\Windows\System\gRdytZb.exe
  C:\Windows\System\gRdytZb.exe
  2⤵
  PID:5468
- C:\Windows\System\kAHmdBQ.exe
  C:\Windows\System\kAHmdBQ.exe
  2⤵
  PID:5484
- C:\Windows\System\LoTmryq.exe
  C:\Windows\System\LoTmryq.exe
  2⤵
  PID:5500
- C:\Windows\System\sxoGRDg.exe
  C:\Windows\System\sxoGRDg.exe
  2⤵
  PID:5524
- C:\Windows\System\aaobKmb.exe
  C:\Windows\System\aaobKmb.exe
  2⤵
  PID:5544
- C:\Windows\System\TbcvIpB.exe
  C:\Windows\System\TbcvIpB.exe
  2⤵
  PID:5560
- C:\Windows\System\drfjjAs.exe
  C:\Windows\System\drfjjAs.exe
  2⤵
  PID:5576
- C:\Windows\System\jpKklRr.exe
  C:\Windows\System\jpKklRr.exe
  2⤵
  PID:5596
- C:\Windows\System\uLZridR.exe
  C:\Windows\System\uLZridR.exe
  2⤵
  PID:5616
- C:\Windows\System\jybeVLT.exe
  C:\Windows\System\jybeVLT.exe
  2⤵
  PID:5640
- C:\Windows\System\XQxrRzA.exe
  C:\Windows\System\XQxrRzA.exe
  2⤵
  PID:5660
- C:\Windows\System\LoqsEVc.exe
  C:\Windows\System\LoqsEVc.exe
  2⤵
  PID:5684
- C:\Windows\System\mhkKZMs.exe
  C:\Windows\System\mhkKZMs.exe
  2⤵
  PID:5704
- C:\Windows\System\VPpzTEy.exe
  C:\Windows\System\VPpzTEy.exe
  2⤵
  PID:5720
- C:\Windows\System\ZMrCfcl.exe
  C:\Windows\System\ZMrCfcl.exe
  2⤵
  PID:5740
- C:\Windows\System\EuzcbRf.exe
  C:\Windows\System\EuzcbRf.exe
  2⤵
  PID:5764
- C:\Windows\System\aQhtikL.exe
  C:\Windows\System\aQhtikL.exe
  2⤵
  PID:5784
- C:\Windows\System\jzdZtkw.exe
  C:\Windows\System\jzdZtkw.exe
  2⤵
  PID:5800
- C:\Windows\System\WKxUNjS.exe
  C:\Windows\System\WKxUNjS.exe
  2⤵
  PID:5824
- C:\Windows\System\CbGODFj.exe
  C:\Windows\System\CbGODFj.exe
  2⤵
  PID:5840
- C:\Windows\System\aRwPAae.exe
  C:\Windows\System\aRwPAae.exe
  2⤵
  PID:5868
- C:\Windows\System\LAAhGeT.exe
  C:\Windows\System\LAAhGeT.exe
  2⤵
  PID:5892
- C:\Windows\System\DsHSmad.exe
  C:\Windows\System\DsHSmad.exe
  2⤵
  PID:5916
- C:\Windows\System\OnWZTiw.exe
  C:\Windows\System\OnWZTiw.exe
  2⤵
  PID:5936
- C:\Windows\System\cBBsyWv.exe
  C:\Windows\System\cBBsyWv.exe
  2⤵
  PID:5956
- C:\Windows\System\uTtkZBx.exe
  C:\Windows\System\uTtkZBx.exe
  2⤵
  PID:2176
- C:\Windows\System\zWFOPpX.exe
  C:\Windows\System\zWFOPpX.exe
  2⤵
  PID:3480
- C:\Windows\System\nEIrpFY.exe
  C:\Windows\System\nEIrpFY.exe
  2⤵
  PID:5284
- C:\Windows\System\BmNZwsn.exe
  C:\Windows\System\BmNZwsn.exe
  2⤵
  PID:5372
- C:\Windows\System\psxZWEP.exe
  C:\Windows\System\psxZWEP.exe
  2⤵
  PID:5196
- C:\Windows\System\UyAXeKz.exe
  C:\Windows\System\UyAXeKz.exe
  2⤵
  PID:5236
- C:\Windows\System\RFHnsuw.exe
  C:\Windows\System\RFHnsuw.exe
  2⤵
  PID:860
- C:\Windows\System\LecZylw.exe
  C:\Windows\System\LecZylw.exe
  2⤵
  PID:5352
- C:\Windows\System\BGduyUz.exe
  C:\Windows\System\BGduyUz.exe
  2⤵
  PID:5400
- C:\Windows\System\xGhAPeg.exe
  C:\Windows\System\xGhAPeg.exe
  2⤵
  PID:5428
- C:\Windows\System\foUowol.exe
  C:\Windows\System\foUowol.exe
  2⤵
  PID:5464
- C:\Windows\System\FZTXPAW.exe
  C:\Windows\System\FZTXPAW.exe
  2⤵
  PID:5496
- C:\Windows\System\QKooERw.exe
  C:\Windows\System\QKooERw.exe
  2⤵
  PID:5540
- C:\Windows\System\RUADVeS.exe
  C:\Windows\System\RUADVeS.exe
  2⤵
  PID:5572
- C:\Windows\System\mjYwNBP.exe
  C:\Windows\System\mjYwNBP.exe
  2⤵
  PID:5608
- C:\Windows\System\WtYcQTZ.exe
  C:\Windows\System\WtYcQTZ.exe
  2⤵
  PID:5648
- C:\Windows\System\gqOgnzS.exe
  C:\Windows\System\gqOgnzS.exe
  2⤵
  PID:5672
- C:\Windows\System\lRzZtUs.exe
  C:\Windows\System\lRzZtUs.exe
  2⤵
  PID:5712
- C:\Windows\System\VeMUdZj.exe
  C:\Windows\System\VeMUdZj.exe
  2⤵
  PID:5748
- C:\Windows\System\TANtYoC.exe
  C:\Windows\System\TANtYoC.exe
  2⤵
  PID:5780
- C:\Windows\System\hWmorRA.exe
  C:\Windows\System\hWmorRA.exe
  2⤵
  PID:5832
- C:\Windows\System\uEpjgtA.exe
  C:\Windows\System\uEpjgtA.exe
  2⤵
  PID:5860
- C:\Windows\System\cXgUmSB.exe
  C:\Windows\System\cXgUmSB.exe
  2⤵
  PID:5900
- C:\Windows\System\AegcMyf.exe
  C:\Windows\System\AegcMyf.exe
  2⤵
  PID:6452
- C:\Windows\System\OYsTpUY.exe
  C:\Windows\System\OYsTpUY.exe
  2⤵
  PID:6472
- C:\Windows\System\yjInlWo.exe
  C:\Windows\System\yjInlWo.exe
  2⤵
  PID:6492
- C:\Windows\System\YHsWBMT.exe
  C:\Windows\System\YHsWBMT.exe
  2⤵
  PID:6508
- C:\Windows\System\gaVqNDp.exe
  C:\Windows\System\gaVqNDp.exe
  2⤵
  PID:6532
- C:\Windows\System\JbwvxiB.exe
  C:\Windows\System\JbwvxiB.exe
  2⤵
  PID:6552
- C:\Windows\System\EgYKhcW.exe
  C:\Windows\System\EgYKhcW.exe
  2⤵
  PID:6576
- C:\Windows\System\NTOcpIe.exe
  C:\Windows\System\NTOcpIe.exe
  2⤵
  PID:6592
- C:\Windows\System\sTPEuBC.exe
  C:\Windows\System\sTPEuBC.exe
  2⤵
  PID:6616
- C:\Windows\System\lWeJGgk.exe
  C:\Windows\System\lWeJGgk.exe
  2⤵
  PID:6636
- C:\Windows\System\rpAbnYy.exe
  C:\Windows\System\rpAbnYy.exe
  2⤵
  PID:6656
- C:\Windows\System\uVPqbEL.exe
  C:\Windows\System\uVPqbEL.exe
  2⤵
  PID:6676
- C:\Windows\System\zIispfc.exe
  C:\Windows\System\zIispfc.exe
  2⤵
  PID:6700
- C:\Windows\System\oKnPVOx.exe
  C:\Windows\System\oKnPVOx.exe
  2⤵
  PID:6720
- C:\Windows\System\GCVahLu.exe
  C:\Windows\System\GCVahLu.exe
  2⤵
  PID:6928
- C:\Windows\System\aKAsuPk.exe
  C:\Windows\System\aKAsuPk.exe
  2⤵
  PID:6944
- C:\Windows\System\SjTSCmb.exe
  C:\Windows\System\SjTSCmb.exe
  2⤵
  PID:6964
- C:\Windows\System\CMucLSD.exe
  C:\Windows\System\CMucLSD.exe
  2⤵
  PID:6988
- C:\Windows\System\nawkCAJ.exe
  C:\Windows\System\nawkCAJ.exe
  2⤵
  PID:7016
- C:\Windows\System\wPaLbWH.exe
  C:\Windows\System\wPaLbWH.exe
  2⤵
  PID:7032
- C:\Windows\System\wWTzaEv.exe
  C:\Windows\System\wWTzaEv.exe
  2⤵
  PID:5288
- C:\Windows\System\PNmaEkQ.exe
  C:\Windows\System\PNmaEkQ.exe
  2⤵
  PID:2776
- C:\Windows\System\lPhRAzu.exe
  C:\Windows\System\lPhRAzu.exe
  2⤵
  PID:3300
- C:\Windows\System\KSgHKWI.exe
  C:\Windows\System\KSgHKWI.exe
  2⤵
  PID:3204
- C:\Windows\System\kZzgqPM.exe
  C:\Windows\System\kZzgqPM.exe
  2⤵
  PID:3172
- C:\Windows\System\zQmXSBt.exe
  C:\Windows\System\zQmXSBt.exe
  2⤵
  PID:648
- C:\Windows\System\iBVLMQF.exe
  C:\Windows\System\iBVLMQF.exe
  2⤵
  PID:4100
- C:\Windows\System\mixmRQv.exe
  C:\Windows\System\mixmRQv.exe
  2⤵
  PID:5020
- C:\Windows\System\sdLFezf.exe
  C:\Windows\System\sdLFezf.exe
  2⤵
  PID:2884
- C:\Windows\System\mPogJeF.exe
  C:\Windows\System\mPogJeF.exe
  2⤵
  PID:6160
- C:\Windows\System\ceCwJlk.exe
  C:\Windows\System\ceCwJlk.exe
  2⤵
  PID:6172
- C:\Windows\System\fCpgOtt.exe
  C:\Windows\System\fCpgOtt.exe
  2⤵
  PID:6196
- C:\Windows\System\tOsVbGX.exe
  C:\Windows\System\tOsVbGX.exe
  2⤵
  PID:6216
- C:\Windows\System\zeSZQbv.exe
  C:\Windows\System\zeSZQbv.exe
  2⤵
  PID:6252
- C:\Windows\System\pxSeqab.exe
  C:\Windows\System\pxSeqab.exe
  2⤵
  PID:6240
- C:\Windows\System\ovqhNSg.exe
  C:\Windows\System\ovqhNSg.exe
  2⤵
  PID:6272
- C:\Windows\System\AvEVXTB.exe
  C:\Windows\System\AvEVXTB.exe
  2⤵
  PID:6312
- C:\Windows\System\DkLaZUl.exe
  C:\Windows\System\DkLaZUl.exe
  2⤵
  PID:2364
- C:\Windows\System\VmfebAg.exe
  C:\Windows\System\VmfebAg.exe
  2⤵
  PID:6420
- C:\Windows\System\tuTkTlw.exe
  C:\Windows\System\tuTkTlw.exe
  2⤵
  PID:6448
- C:\Windows\System\kRpurCD.exe
  C:\Windows\System\kRpurCD.exe
  2⤵
  PID:6520
- C:\Windows\System\wOCdOEn.exe
  C:\Windows\System\wOCdOEn.exe
  2⤵
  PID:6588
- C:\Windows\System\QEYSzTu.exe
  C:\Windows\System\QEYSzTu.exe
  2⤵
  PID:6612
- C:\Windows\System\lZyIIbV.exe
  C:\Windows\System\lZyIIbV.exe
  2⤵
  PID:6644
- C:\Windows\System\kmaXIHr.exe
  C:\Windows\System\kmaXIHr.exe
  2⤵
  PID:6692
- C:\Windows\System\SxseJAc.exe
  C:\Windows\System\SxseJAc.exe
  2⤵
  PID:7048
- C:\Windows\System\YuqdTJl.exe
  C:\Windows\System\YuqdTJl.exe
  2⤵
  PID:6852
- C:\Windows\System\VbGhvMt.exe
  C:\Windows\System\VbGhvMt.exe
  2⤵
  PID:6884
- C:\Windows\System\QQuyhnp.exe
  C:\Windows\System\QQuyhnp.exe
  2⤵
  PID:6920
- C:\Windows\System\NlOoXnN.exe
  C:\Windows\System\NlOoXnN.exe
  2⤵
  PID:6960
- C:\Windows\System\yJwNbZB.exe
  C:\Windows\System\yJwNbZB.exe
  2⤵
  PID:7024
- C:\Windows\System\dUVyYSA.exe
  C:\Windows\System\dUVyYSA.exe
  2⤵
  PID:7040
- C:\Windows\System\ecqcrmr.exe
  C:\Windows\System\ecqcrmr.exe
  2⤵
  PID:5448
- C:\Windows\System\TLakAEQ.exe
  C:\Windows\System\TLakAEQ.exe
  2⤵
  PID:5972
- C:\Windows\System\YihOtkk.exe
  C:\Windows\System\YihOtkk.exe
  2⤵
  PID:3228
- C:\Windows\System\KFDddPH.exe
  C:\Windows\System\KFDddPH.exe
  2⤵
  PID:3784
- C:\Windows\System\bRIBTEf.exe
  C:\Windows\System\bRIBTEf.exe
  2⤵
  PID:1228
- C:\Windows\System\UvdPayW.exe
  C:\Windows\System\UvdPayW.exe
  2⤵
  PID:4672
- C:\Windows\System\vpHagRh.exe
  C:\Windows\System\vpHagRh.exe
  2⤵
  PID:4484
- C:\Windows\System\AIfdjxo.exe
  C:\Windows\System\AIfdjxo.exe
  2⤵
  PID:804
- C:\Windows\System\hBiTrZE.exe
  C:\Windows\System\hBiTrZE.exe
  2⤵
  PID:5888
- C:\Windows\System\LHvleJS.exe
  C:\Windows\System\LHvleJS.exe
  2⤵
  PID:4268
- C:\Windows\System\lKaDWwd.exe
  C:\Windows\System\lKaDWwd.exe
  2⤵
  PID:6192
- C:\Windows\System\itVWFBD.exe
  C:\Windows\System\itVWFBD.exe
  2⤵
  PID:448
- C:\Windows\System\DczKuZA.exe
  C:\Windows\System\DczKuZA.exe
  2⤵
  PID:3656
- C:\Windows\System\wAQHuKf.exe
  C:\Windows\System\wAQHuKf.exe
  2⤵
  PID:464
- C:\Windows\System\jYXBAAQ.exe
  C:\Windows\System\jYXBAAQ.exe
  2⤵
  PID:6220
- C:\Windows\System\QdbdCUi.exe
  C:\Windows\System\QdbdCUi.exe
  2⤵
  PID:6164
- C:\Windows\System\CgxNEgt.exe
  C:\Windows\System\CgxNEgt.exe
  2⤵
  PID:6208
- C:\Windows\System\BCbFnIw.exe
  C:\Windows\System\BCbFnIw.exe
  2⤵
  PID:3768
- C:\Windows\System\gAQuFxZ.exe
  C:\Windows\System\gAQuFxZ.exe
  2⤵
  PID:6320
- C:\Windows\System\FvNWbBt.exe
  C:\Windows\System\FvNWbBt.exe
  2⤵
  PID:6504
- C:\Windows\System\PlarGfh.exe
  C:\Windows\System\PlarGfh.exe
  2⤵
  PID:5028
- C:\Windows\System\eZPZwRo.exe
  C:\Windows\System\eZPZwRo.exe
  2⤵
  PID:6608
- C:\Windows\System\rVOwfaZ.exe
  C:\Windows\System\rVOwfaZ.exe
  2⤵
  PID:6980
- C:\Windows\System\IOVFjPu.exe
  C:\Windows\System\IOVFjPu.exe
  2⤵
  PID:6428
- C:\Windows\System\kAJlNTy.exe
  C:\Windows\System\kAJlNTy.exe
  2⤵
  PID:6712
- C:\Windows\System\SVcMbnJ.exe
  C:\Windows\System\SVcMbnJ.exe
  2⤵
  PID:3604
- C:\Windows\System\nRqnHff.exe
  C:\Windows\System\nRqnHff.exe
  2⤵
  PID:6912
- C:\Windows\System\RzqIUpu.exe
  C:\Windows\System\RzqIUpu.exe
  2⤵
  PID:5424
- C:\Windows\System\LJSOGla.exe
  C:\Windows\System\LJSOGla.exe
  2⤵
  PID:4764
- C:\Windows\System\wYGbUQl.exe
  C:\Windows\System\wYGbUQl.exe
  2⤵
  PID:6996
- C:\Windows\System\FKJEsNY.exe
  C:\Windows\System\FKJEsNY.exe
  2⤵
  PID:6184
- C:\Windows\System\sdhpCfG.exe
  C:\Windows\System\sdhpCfG.exe
  2⤵
  PID:1224
- C:\Windows\System\YgpimCA.exe
  C:\Windows\System\YgpimCA.exe
  2⤵
  PID:6288
- C:\Windows\System\dAocQrR.exe
  C:\Windows\System\dAocQrR.exe
  2⤵
  PID:6324
- C:\Windows\System\mLpwLcT.exe
  C:\Windows\System\mLpwLcT.exe
  2⤵
  PID:7188
- C:\Windows\System\gQMHoub.exe
  C:\Windows\System\gQMHoub.exe
  2⤵
  PID:7208
- C:\Windows\System\TOiuoKu.exe
  C:\Windows\System\TOiuoKu.exe
  2⤵
  PID:7236
- C:\Windows\System\ztTtWNP.exe
  C:\Windows\System\ztTtWNP.exe
  2⤵
  PID:7256
- C:\Windows\System\LrJergv.exe
  C:\Windows\System\LrJergv.exe
  2⤵
  PID:7276
- C:\Windows\System\VYIVJQu.exe
  C:\Windows\System\VYIVJQu.exe
  2⤵
  PID:7296
- C:\Windows\System\UjeDTdj.exe
  C:\Windows\System\UjeDTdj.exe
  2⤵
  PID:7324
- C:\Windows\System\dparLPJ.exe
  C:\Windows\System\dparLPJ.exe
  2⤵
  PID:7352
- C:\Windows\System\AAnbYlS.exe
  C:\Windows\System\AAnbYlS.exe
  2⤵
  PID:7368
- C:\Windows\System\JXivuYw.exe
  C:\Windows\System\JXivuYw.exe
  2⤵
  PID:7388
- C:\Windows\System\ntFZuKW.exe
  C:\Windows\System\ntFZuKW.exe
  2⤵
  PID:7412
- C:\Windows\System\XgIdEXK.exe
  C:\Windows\System\XgIdEXK.exe
  2⤵
  PID:7436
- C:\Windows\System\zSPffyV.exe
  C:\Windows\System\zSPffyV.exe
  2⤵
  PID:7456
- C:\Windows\System\CWTHhVH.exe
  C:\Windows\System\CWTHhVH.exe
  2⤵
  PID:7476
- C:\Windows\System\ZXntNIp.exe
  C:\Windows\System\ZXntNIp.exe
  2⤵
  PID:7496
- C:\Windows\System\aqSRIeR.exe
  C:\Windows\System\aqSRIeR.exe
  2⤵
  PID:7524
- C:\Windows\System\wEByXzS.exe
  C:\Windows\System\wEByXzS.exe
  2⤵
  PID:7552
- C:\Windows\System\VmrinIB.exe
  C:\Windows\System\VmrinIB.exe
  2⤵
  PID:7576
- C:\Windows\System\JIOdGMR.exe
  C:\Windows\System\JIOdGMR.exe
  2⤵
  PID:7612
- C:\Windows\System\dYLPlBk.exe
  C:\Windows\System\dYLPlBk.exe
  2⤵
  PID:7636
- C:\Windows\System\APXIjYF.exe
  C:\Windows\System\APXIjYF.exe
  2⤵
  PID:7660
- C:\Windows\System\Xuldlru.exe
  C:\Windows\System\Xuldlru.exe
  2⤵
  PID:7680
- C:\Windows\System\afmkqFT.exe
  C:\Windows\System\afmkqFT.exe
  2⤵
  PID:7700
- C:\Windows\System\QdyuRzr.exe
  C:\Windows\System\QdyuRzr.exe
  2⤵
  PID:7724
- C:\Windows\System\pBEoemX.exe
  C:\Windows\System\pBEoemX.exe
  2⤵
  PID:7744
- C:\Windows\System\fOMhSWD.exe
  C:\Windows\System\fOMhSWD.exe
  2⤵
  PID:7764
- C:\Windows\System\OdKgFDO.exe
  C:\Windows\System\OdKgFDO.exe
  2⤵
  PID:7812
- C:\Windows\System\eDwYKwn.exe
  C:\Windows\System\eDwYKwn.exe
  2⤵
  PID:7832
- C:\Windows\System\ldyFQcv.exe
  C:\Windows\System\ldyFQcv.exe
  2⤵
  PID:7856
- C:\Windows\System\YfmcrdX.exe
  C:\Windows\System\YfmcrdX.exe
  2⤵
  PID:7880
- C:\Windows\System\lBcEfQQ.exe
  C:\Windows\System\lBcEfQQ.exe
  2⤵
  PID:7908
- C:\Windows\System\gpIjwuB.exe
  C:\Windows\System\gpIjwuB.exe
  2⤵
  PID:7928
- C:\Windows\System\KYwJXvR.exe
  C:\Windows\System\KYwJXvR.exe
  2⤵
  PID:7960
- C:\Windows\System\IYBVNCd.exe
  C:\Windows\System\IYBVNCd.exe
  2⤵
  PID:7976
- C:\Windows\System\kcVfVah.exe
  C:\Windows\System\kcVfVah.exe
  2⤵
  PID:8000
- C:\Windows\System\JZmDKOp.exe
  C:\Windows\System\JZmDKOp.exe
  2⤵
  PID:8024
- C:\Windows\System\bnmqPxI.exe
  C:\Windows\System\bnmqPxI.exe
  2⤵
  PID:8056
- C:\Windows\System\jSYGviV.exe
  C:\Windows\System\jSYGviV.exe
  2⤵
  PID:8080
- C:\Windows\System\WzmRyVL.exe
  C:\Windows\System\WzmRyVL.exe
  2⤵
  PID:8104
- C:\Windows\System\zKDAuws.exe
  C:\Windows\System\zKDAuws.exe
  2⤵
  PID:8132
- C:\Windows\System\RIjgLAB.exe
  C:\Windows\System\RIjgLAB.exe
  2⤵
  PID:8156
- C:\Windows\System\TJyOZUa.exe
  C:\Windows\System\TJyOZUa.exe
  2⤵
  PID:8176
- C:\Windows\System\xXspemB.exe
  C:\Windows\System\xXspemB.exe
  2⤵
  PID:6900
- C:\Windows\System\CopXeCJ.exe
  C:\Windows\System\CopXeCJ.exe
  2⤵
  PID:6464
- C:\Windows\System\BlRtTFA.exe
  C:\Windows\System\BlRtTFA.exe
  2⤵
  PID:2672
- C:\Windows\System\APqwVSR.exe
  C:\Windows\System\APqwVSR.exe
  2⤵
  PID:6232
- C:\Windows\System\tnzXbBu.exe
  C:\Windows\System\tnzXbBu.exe
  2⤵
  PID:6952
- C:\Windows\System\XLVKWhA.exe
  C:\Windows\System\XLVKWhA.exe
  2⤵
  PID:1144
- C:\Windows\System\FocWknD.exe
  C:\Windows\System\FocWknD.exe
  2⤵
  PID:7180
- C:\Windows\System\fUzjVtw.exe
  C:\Windows\System\fUzjVtw.exe
  2⤵
  PID:6188
- C:\Windows\System\yftufAz.exe
  C:\Windows\System\yftufAz.exe
  2⤵
  PID:1660
- C:\Windows\System\EDNtQWH.exe
  C:\Windows\System\EDNtQWH.exe
  2⤵
  PID:7364
- C:\Windows\System\GvQYrTV.exe
  C:\Windows\System\GvQYrTV.exe
  2⤵
  PID:3596
- C:\Windows\System\GWhghsU.exe
  C:\Windows\System\GWhghsU.exe
  2⤵
  PID:7512
- C:\Windows\System\KmOGQLy.exe
  C:\Windows\System\KmOGQLy.exe
  2⤵
  PID:7204
- C:\Windows\System\hhHwwQW.exe
  C:\Windows\System\hhHwwQW.exe
  2⤵
  PID:7216
- C:\Windows\System\cgJoXgW.exe
  C:\Windows\System\cgJoXgW.exe
  2⤵
  PID:7228
- C:\Windows\System\HxXeLHc.exe
  C:\Windows\System\HxXeLHc.exe
  2⤵
  PID:7696
- C:\Windows\System\AmSaIBF.exe
  C:\Windows\System\AmSaIBF.exe
  2⤵
  PID:7292
- C:\Windows\System\uwzemPq.exe
  C:\Windows\System\uwzemPq.exe
  2⤵
  PID:7320
- C:\Windows\System\hXQLDSF.exe
  C:\Windows\System\hXQLDSF.exe
  2⤵
  PID:7384
- C:\Windows\System\EnFLDlr.exe
  C:\Windows\System\EnFLDlr.exe
  2⤵
  PID:7544
- C:\Windows\System\iLTHqob.exe
  C:\Windows\System\iLTHqob.exe
  2⤵
  PID:8008
- C:\Windows\System\lOpAQxO.exe
  C:\Windows\System\lOpAQxO.exe
  2⤵
  PID:7620
- C:\Windows\System\unWgEGA.exe
  C:\Windows\System\unWgEGA.exe
  2⤵
  PID:7672
- C:\Windows\System\PdUbSur.exe
  C:\Windows\System\PdUbSur.exe
  2⤵
  PID:7736
- C:\Windows\System\RbtZcTf.exe
  C:\Windows\System\RbtZcTf.exe
  2⤵
  PID:7756
- C:\Windows\System\wSUjQiQ.exe
  C:\Windows\System\wSUjQiQ.exe
  2⤵
  PID:8204
- C:\Windows\System\Okbzqsi.exe
  C:\Windows\System\Okbzqsi.exe
  2⤵
  PID:8228
- C:\Windows\System\QthJWPo.exe
  C:\Windows\System\QthJWPo.exe
  2⤵
  PID:8252
- C:\Windows\System\mWPAgDB.exe
  C:\Windows\System\mWPAgDB.exe
  2⤵
  PID:8280
- C:\Windows\System\KFYpcEn.exe
  C:\Windows\System\KFYpcEn.exe
  2⤵
  PID:8308
- C:\Windows\System\ciBqehn.exe
  C:\Windows\System\ciBqehn.exe
  2⤵
  PID:8336
- C:\Windows\System\BJaFSDE.exe
  C:\Windows\System\BJaFSDE.exe
  2⤵
  PID:8364
- C:\Windows\System\VniSjkp.exe
  C:\Windows\System\VniSjkp.exe
  2⤵
  PID:8380
- C:\Windows\System\DGfxLJo.exe
  C:\Windows\System\DGfxLJo.exe
  2⤵
  PID:8408
- C:\Windows\System\qtSiYAQ.exe
  C:\Windows\System\qtSiYAQ.exe
  2⤵
  PID:8432
- C:\Windows\System\FGxXHaR.exe
  C:\Windows\System\FGxXHaR.exe
  2⤵
  PID:8460
- C:\Windows\System\bJNMAJz.exe
  C:\Windows\System\bJNMAJz.exe
  2⤵
  PID:8480
- C:\Windows\System\rGLHTTq.exe
  C:\Windows\System\rGLHTTq.exe
  2⤵
  PID:8508
- C:\Windows\System\rhcWkoL.exe
  C:\Windows\System\rhcWkoL.exe
  2⤵
  PID:8536
- C:\Windows\System\YQrKHyL.exe
  C:\Windows\System\YQrKHyL.exe
  2⤵
  PID:8556
- C:\Windows\System\uMMZajL.exe
  C:\Windows\System\uMMZajL.exe
  2⤵
  PID:8584
- C:\Windows\System\CWCCeQZ.exe
  C:\Windows\System\CWCCeQZ.exe
  2⤵
  PID:8608
- C:\Windows\System\hnoBvRJ.exe
  C:\Windows\System\hnoBvRJ.exe
  2⤵
  PID:8632
- C:\Windows\System\xGtrEVB.exe
  C:\Windows\System\xGtrEVB.exe
  2⤵
  PID:8652
- C:\Windows\System\hSqDrnt.exe
  C:\Windows\System\hSqDrnt.exe
  2⤵
  PID:8680
- C:\Windows\System\gGHtNee.exe
  C:\Windows\System\gGHtNee.exe
  2⤵
  PID:8696
- C:\Windows\System\KIvDrQs.exe
  C:\Windows\System\KIvDrQs.exe
  2⤵
  PID:8720
- C:\Windows\System\MjRgpwO.exe
  C:\Windows\System\MjRgpwO.exe
  2⤵
  PID:8752
- C:\Windows\System\nOXfgIC.exe
  C:\Windows\System\nOXfgIC.exe
  2⤵
  PID:8768
- C:\Windows\System\ugIPHOQ.exe
  C:\Windows\System\ugIPHOQ.exe
  2⤵
  PID:8788
- C:\Windows\System\yrXXNDf.exe
  C:\Windows\System\yrXXNDf.exe
  2⤵
  PID:8808
- C:\Windows\System\OjxqPuY.exe
  C:\Windows\System\OjxqPuY.exe
  2⤵
  PID:8836
- C:\Windows\System\ObhzPGH.exe
  C:\Windows\System\ObhzPGH.exe
  2⤵
  PID:8872
- C:\Windows\System\kVIEYUH.exe
  C:\Windows\System\kVIEYUH.exe
  2⤵
  PID:8888
- C:\Windows\System\FhzkvgN.exe
  C:\Windows\System\FhzkvgN.exe
  2⤵
  PID:8908
- C:\Windows\System\ptyIlkz.exe
  C:\Windows\System\ptyIlkz.exe
  2⤵
  PID:8932
- C:\Windows\System\wTjuYBm.exe
  C:\Windows\System\wTjuYBm.exe
  2⤵
  PID:8956
- C:\Windows\System\FioYVwb.exe
  C:\Windows\System\FioYVwb.exe
  2⤵
  PID:8980
- C:\Windows\System\tmodLNv.exe
  C:\Windows\System\tmodLNv.exe
  2⤵
  PID:9000
- C:\Windows\System\GnFMyBE.exe
  C:\Windows\System\GnFMyBE.exe
  2⤵
  PID:9024
- C:\Windows\System\mLlVtVz.exe
  C:\Windows\System\mLlVtVz.exe
  2⤵
  PID:9048
- C:\Windows\System\deStKTs.exe
  C:\Windows\System\deStKTs.exe
  2⤵
  PID:9072
- C:\Windows\System\lKWqdNL.exe
  C:\Windows\System\lKWqdNL.exe
  2⤵
  PID:9088
- C:\Windows\System\mfWtRvz.exe
  C:\Windows\System\mfWtRvz.exe
  2⤵
  PID:9116
- C:\Windows\System\UgroZFh.exe
  C:\Windows\System\UgroZFh.exe
  2⤵
  PID:9132
- C:\Windows\System\tAXQoXb.exe
  C:\Windows\System\tAXQoXb.exe
  2⤵
  PID:9164
- C:\Windows\System\iRKYytW.exe
  C:\Windows\System\iRKYytW.exe
  2⤵
  PID:9184
- C:\Windows\System\IAjEiNP.exe
  C:\Windows\System\IAjEiNP.exe
  2⤵
  PID:9212
- C:\Windows\System\PXZfWpY.exe
  C:\Windows\System\PXZfWpY.exe
  2⤵
  PID:7788
- C:\Windows\System\jOChKve.exe
  C:\Windows\System\jOChKve.exe
  2⤵
  PID:7840
- C:\Windows\System\xUNzwSo.exe
  C:\Windows\System\xUNzwSo.exe
  2⤵
  PID:7420
- C:\Windows\System\bCMCMdR.exe
  C:\Windows\System\bCMCMdR.exe
  2⤵
  PID:3668
- C:\Windows\System\QwOSrKt.exe
  C:\Windows\System\QwOSrKt.exe
  2⤵
  PID:7924
- C:\Windows\System\BpUCDal.exe
  C:\Windows\System\BpUCDal.exe
  2⤵
  PID:7572
- C:\Windows\System\GPNqLUq.exe
  C:\Windows\System\GPNqLUq.exe
  2⤵
  PID:7548
- C:\Windows\System\MSeYxKF.exe
  C:\Windows\System\MSeYxKF.exe
  2⤵
  PID:8044
- C:\Windows\System\vubwLXm.exe
  C:\Windows\System\vubwLXm.exe
  2⤵
  PID:7008
- C:\Windows\System\CnyOGVo.exe
  C:\Windows\System\CnyOGVo.exe
  2⤵
  PID:7824
- C:\Windows\System\ZnNCdPB.exe
  C:\Windows\System\ZnNCdPB.exe
  2⤵
  PID:8288
- C:\Windows\System\CdISKtw.exe
  C:\Windows\System\CdISKtw.exe
  2⤵
  PID:3588
- C:\Windows\System\SyMonrL.exe
  C:\Windows\System\SyMonrL.exe
  2⤵
  PID:8356
- C:\Windows\System\BAZyOdb.exe
  C:\Windows\System\BAZyOdb.exe
  2⤵
  PID:8452
- C:\Windows\System\jWLMynv.exe
  C:\Windows\System\jWLMynv.exe
  2⤵
  PID:8496
- C:\Windows\System\NoquTdE.exe
  C:\Windows\System\NoquTdE.exe
  2⤵
  PID:7784
- C:\Windows\System\qEvbmJK.exe
  C:\Windows\System\qEvbmJK.exe
  2⤵
  PID:7336
- C:\Windows\System\QYJPAnx.exe
  C:\Windows\System\QYJPAnx.exe
  2⤵
  PID:7452
- C:\Windows\System\rOfMbmD.exe
  C:\Windows\System\rOfMbmD.exe
  2⤵
  PID:8068
- C:\Windows\System\hSHdJKE.exe
  C:\Windows\System\hSHdJKE.exe
  2⤵
  PID:8172
- C:\Windows\System\IAKAjJU.exe
  C:\Windows\System\IAKAjJU.exe
  2⤵
  PID:5032
- C:\Windows\System\UnzGLlg.exe
  C:\Windows\System\UnzGLlg.exe
  2⤵
  PID:8848
- C:\Windows\System\HWlPdML.exe
  C:\Windows\System\HWlPdML.exe
  2⤵
  PID:8904
- C:\Windows\System\neDJSWJ.exe
  C:\Windows\System\neDJSWJ.exe
  2⤵
  PID:9220
- C:\Windows\System\KrgIlhY.exe
  C:\Windows\System\KrgIlhY.exe
  2⤵
  PID:9240
- C:\Windows\System\lmYiKJJ.exe
  C:\Windows\System\lmYiKJJ.exe
  2⤵
  PID:9268
- C:\Windows\System\EUxmhcU.exe
  C:\Windows\System\EUxmhcU.exe
  2⤵
  PID:9288
- C:\Windows\System\vqCxeRc.exe
  C:\Windows\System\vqCxeRc.exe
  2⤵
  PID:9316
- C:\Windows\System\kkBzXXW.exe
  C:\Windows\System\kkBzXXW.exe
  2⤵
  PID:9336
- C:\Windows\System\DjMHEdl.exe
  C:\Windows\System\DjMHEdl.exe
  2⤵
  PID:9352
- C:\Windows\System\IFcVVrg.exe
  C:\Windows\System\IFcVVrg.exe
  2⤵
  PID:9372
- C:\Windows\System\LJxHXAX.exe
  C:\Windows\System\LJxHXAX.exe
  2⤵
  PID:9396
- C:\Windows\System\kVzdHhl.exe
  C:\Windows\System\kVzdHhl.exe
  2⤵
  PID:9420
- C:\Windows\System\yzMbSoA.exe
  C:\Windows\System\yzMbSoA.exe
  2⤵
  PID:9444
- C:\Windows\System\xPYUQaA.exe
  C:\Windows\System\xPYUQaA.exe
  2⤵
  PID:9468
- C:\Windows\System\xDVVHXf.exe
  C:\Windows\System\xDVVHXf.exe
  2⤵
  PID:9488
- C:\Windows\System\iSPRtMY.exe
  C:\Windows\System\iSPRtMY.exe
  2⤵
  PID:9508
- C:\Windows\System\AXWBasM.exe
  C:\Windows\System\AXWBasM.exe
  2⤵
  PID:9532
- C:\Windows\System\tyJRLaj.exe
  C:\Windows\System\tyJRLaj.exe
  2⤵
  PID:9560
- C:\Windows\System\HevtJcQ.exe
  C:\Windows\System\HevtJcQ.exe
  2⤵
  PID:9580
- C:\Windows\System\HmElscQ.exe
  C:\Windows\System\HmElscQ.exe
  2⤵
  PID:9600
- C:\Windows\System\rRoTplj.exe
  C:\Windows\System\rRoTplj.exe
  2⤵
  PID:9620
- C:\Windows\System\PKgYSUg.exe
  C:\Windows\System\PKgYSUg.exe
  2⤵
  PID:9652
- C:\Windows\System\mGZakZK.exe
  C:\Windows\System\mGZakZK.exe
  2⤵
  PID:9672
- C:\Windows\System\JCpHBHG.exe
  C:\Windows\System\JCpHBHG.exe
  2⤵
  PID:9692
- C:\Windows\System\yehIPDD.exe
  C:\Windows\System\yehIPDD.exe
  2⤵
  PID:9716
- C:\Windows\System\hjbwapX.exe
  C:\Windows\System\hjbwapX.exe
  2⤵
  PID:9740
- C:\Windows\System\JasueJk.exe
  C:\Windows\System\JasueJk.exe
  2⤵
  PID:9768
- C:\Windows\System\xLdIfvv.exe
  C:\Windows\System\xLdIfvv.exe
  2⤵
  PID:9788
- C:\Windows\System\aPrwciG.exe
  C:\Windows\System\aPrwciG.exe
  2⤵
  PID:9808
- C:\Windows\System\QezVNPo.exe
  C:\Windows\System\QezVNPo.exe
  2⤵
  PID:9840
- C:\Windows\System\LsemBJj.exe
  C:\Windows\System\LsemBJj.exe
  2⤵
  PID:9864
- C:\Windows\System\xSCxlmR.exe
  C:\Windows\System\xSCxlmR.exe
  2⤵
  PID:9884
- C:\Windows\System\eyXxuYd.exe
  C:\Windows\System\eyXxuYd.exe
  2⤵
  PID:9908
- C:\Windows\System\xXCnytM.exe
  C:\Windows\System\xXCnytM.exe
  2⤵
  PID:9932
- C:\Windows\System\GbMbyqv.exe
  C:\Windows\System\GbMbyqv.exe
  2⤵
  PID:9960
- C:\Windows\System\rxcoQgk.exe
  C:\Windows\System\rxcoQgk.exe
  2⤵
  PID:9988
- C:\Windows\System\JooVWut.exe
  C:\Windows\System\JooVWut.exe
  2⤵
  PID:10008
- C:\Windows\System\VXyUuxl.exe
  C:\Windows\System\VXyUuxl.exe
  2⤵
  PID:10032
- C:\Windows\System\jitiNSA.exe
  C:\Windows\System\jitiNSA.exe
  2⤵
  PID:10052
- C:\Windows\System\WCibNps.exe
  C:\Windows\System\WCibNps.exe
  2⤵
  PID:10072
- C:\Windows\System\XDeJQVT.exe
  C:\Windows\System\XDeJQVT.exe
  2⤵
  PID:10096
- C:\Windows\System\RqaJhhI.exe
  C:\Windows\System\RqaJhhI.exe
  2⤵
  PID:10120
- C:\Windows\System\hhlspGY.exe
  C:\Windows\System\hhlspGY.exe
  2⤵
  PID:10136
- C:\Windows\System\nheqddX.exe
  C:\Windows\System\nheqddX.exe
  2⤵
  PID:10164
- C:\Windows\System\JuOndPI.exe
  C:\Windows\System\JuOndPI.exe
  2⤵
  PID:10184
- C:\Windows\System\mKkBXLw.exe
  C:\Windows\System\mKkBXLw.exe
  2⤵
  PID:10208
- C:\Windows\System\dOUEWlT.exe
  C:\Windows\System\dOUEWlT.exe
  2⤵
  PID:10228
- C:\Windows\System\LYbKFlJ.exe
  C:\Windows\System\LYbKFlJ.exe
  2⤵
  PID:9084
- C:\Windows\System\jignXLm.exe
  C:\Windows\System\jignXLm.exe
  2⤵
  PID:8392
- C:\Windows\System\ZIuLvIs.exe
  C:\Windows\System\ZIuLvIs.exe
  2⤵
  PID:8472
- C:\Windows\System\vBUdLGN.exe
  C:\Windows\System\vBUdLGN.exe
  2⤵
  PID:8524
- C:\Windows\System\qnryqGo.exe
  C:\Windows\System\qnryqGo.exe
  2⤵
  PID:8572
- C:\Windows\System\GzUbIFz.exe
  C:\Windows\System\GzUbIFz.exe
  2⤵
  PID:7344
- C:\Windows\System\ipakNoG.exe
  C:\Windows\System\ipakNoG.exe
  2⤵
  PID:7888
- C:\Windows\System\cLUlVyZ.exe
  C:\Windows\System\cLUlVyZ.exe
  2⤵
  PID:7264
- C:\Windows\System\MbWxpfD.exe
  C:\Windows\System\MbWxpfD.exe
  2⤵
  PID:8688
- C:\Windows\System\PnEzxYO.exe
  C:\Windows\System\PnEzxYO.exe
  2⤵
  PID:8196
- C:\Windows\System\YiFwBbq.exe
  C:\Windows\System\YiFwBbq.exe
  2⤵
  PID:8776
- C:\Windows\System\RNEOovA.exe
  C:\Windows\System\RNEOovA.exe
  2⤵
  PID:8088
- C:\Windows\System\UDbNKOS.exe
  C:\Windows\System\UDbNKOS.exe
  2⤵
  PID:8924
- C:\Windows\System\RZkMIBQ.exe
  C:\Windows\System\RZkMIBQ.exe
  2⤵
  PID:6264
- C:\Windows\System\MBukJoe.exe
  C:\Windows\System\MBukJoe.exe
  2⤵
  PID:8964
- C:\Windows\System\cSxGPue.exe
  C:\Windows\System\cSxGPue.exe
  2⤵
  PID:9276
- C:\Windows\System\LRwPLtH.exe
  C:\Windows\System\LRwPLtH.exe
  2⤵
  PID:9060
- C:\Windows\System\lvClhJz.exe
  C:\Windows\System\lvClhJz.exe
  2⤵
  PID:9408
- C:\Windows\System\jlCShgY.exe
  C:\Windows\System\jlCShgY.exe
  2⤵
  PID:8400
- C:\Windows\System\qCXKfUF.exe
  C:\Windows\System\qCXKfUF.exe
  2⤵
  PID:9480
- C:\Windows\System\MCsyTKU.exe
  C:\Windows\System\MCsyTKU.exe
  2⤵
  PID:9660
- C:\Windows\System\StwWANZ.exe
  C:\Windows\System\StwWANZ.exe
  2⤵
  PID:10264
- C:\Windows\System\IxVLfYr.exe
  C:\Windows\System\IxVLfYr.exe
  2⤵
  PID:10296
- C:\Windows\System\fAsgOYD.exe
  C:\Windows\System\fAsgOYD.exe
  2⤵
  PID:10312
- C:\Windows\System\npVRUEm.exe
  C:\Windows\System\npVRUEm.exe
  2⤵
  PID:10328
- C:\Windows\System\MIVsfPp.exe
  C:\Windows\System\MIVsfPp.exe
  2⤵
  PID:10344
- C:\Windows\System\kHSFOJK.exe
  C:\Windows\System\kHSFOJK.exe
  2⤵
  PID:10368
- C:\Windows\System\SkRYtME.exe
  C:\Windows\System\SkRYtME.exe
  2⤵
  PID:10388
- C:\Windows\System\bKHNHdl.exe
  C:\Windows\System\bKHNHdl.exe
  2⤵
  PID:10408
- C:\Windows\System\ACAaqcf.exe
  C:\Windows\System\ACAaqcf.exe
  2⤵
  PID:10432
- C:\Windows\System\MTFaSGr.exe
  C:\Windows\System\MTFaSGr.exe
  2⤵
  PID:10456
- C:\Windows\System\xgXuMVz.exe
  C:\Windows\System\xgXuMVz.exe
  2⤵
  PID:10476
- C:\Windows\System\LFjGqWY.exe
  C:\Windows\System\LFjGqWY.exe
  2⤵
  PID:10496
- C:\Windows\System\GtfcXyf.exe
  C:\Windows\System\GtfcXyf.exe
  2⤵
  PID:10516
- C:\Windows\System\PSgIsaC.exe
  C:\Windows\System\PSgIsaC.exe
  2⤵
  PID:10544
- C:\Windows\System\CdxoIdC.exe
  C:\Windows\System\CdxoIdC.exe
  2⤵
  PID:10568
- C:\Windows\System\jgaKiRp.exe
  C:\Windows\System\jgaKiRp.exe
  2⤵
  PID:10592
- C:\Windows\System\ghfTxnJ.exe
  C:\Windows\System\ghfTxnJ.exe
  2⤵
  PID:10616
- C:\Windows\System\IkhsPRH.exe
  C:\Windows\System\IkhsPRH.exe
  2⤵
  PID:10648
- C:\Windows\System\PicDTTo.exe
  C:\Windows\System\PicDTTo.exe
  2⤵
  PID:10668
- C:\Windows\System\zDsbITw.exe
  C:\Windows\System\zDsbITw.exe
  2⤵
  PID:10692
- C:\Windows\System\jDvhYZi.exe
  C:\Windows\System\jDvhYZi.exe
  2⤵
  PID:10720
- C:\Windows\System\KcnTbHx.exe
  C:\Windows\System\KcnTbHx.exe
  2⤵
  PID:10744
- C:\Windows\System\TMBqjpI.exe
  C:\Windows\System\TMBqjpI.exe
  2⤵
  PID:10776
- C:\Windows\System\HsQErog.exe
  C:\Windows\System\HsQErog.exe
  2⤵
  PID:10796
- C:\Windows\System\Nmefcbb.exe
  C:\Windows\System\Nmefcbb.exe
  2⤵
  PID:10816
- C:\Windows\System\nDNGGEW.exe
  C:\Windows\System\nDNGGEW.exe
  2⤵
  PID:10840
- C:\Windows\System\oMSWynn.exe
  C:\Windows\System\oMSWynn.exe
  2⤵
  PID:10868
- C:\Windows\System\SJfxtlM.exe
  C:\Windows\System\SJfxtlM.exe
  2⤵
  PID:10892
- C:\Windows\System\LeUnpNd.exe
  C:\Windows\System\LeUnpNd.exe
  2⤵
  PID:10912
- C:\Windows\System\otmfBsS.exe
  C:\Windows\System\otmfBsS.exe
  2⤵
  PID:10940
- C:\Windows\System\JDUuJYM.exe
  C:\Windows\System\JDUuJYM.exe
  2⤵
  PID:10960
- C:\Windows\System\SARxwfr.exe
  C:\Windows\System\SARxwfr.exe
  2⤵
  PID:10984
- C:\Windows\System\DgxcigH.exe
  C:\Windows\System\DgxcigH.exe
  2⤵
  PID:11012
- C:\Windows\System\VoCfhxu.exe
  C:\Windows\System\VoCfhxu.exe
  2⤵
  PID:11028
- C:\Windows\System\bTXyNDD.exe
  C:\Windows\System\bTXyNDD.exe
  2⤵
  PID:11052
- C:\Windows\System\NXeccDW.exe
  C:\Windows\System\NXeccDW.exe
  2⤵
  PID:11072
- C:\Windows\System\OuGnuZP.exe
  C:\Windows\System\OuGnuZP.exe
  2⤵
  PID:11092
- C:\Windows\System\hhBpwZw.exe
  C:\Windows\System\hhBpwZw.exe
  2⤵
  PID:9852
- C:\Windows\System\mpUtmth.exe
  C:\Windows\System\mpUtmth.exe
  2⤵
  PID:7584
- C:\Windows\System\JdGPUJc.exe
  C:\Windows\System\JdGPUJc.exe
  2⤵
  PID:3964
- C:\Windows\System\xXiLUII.exe
  C:\Windows\System\xXiLUII.exe
  2⤵
  PID:8260
- C:\Windows\System\vZEXgCr.exe
  C:\Windows\System\vZEXgCr.exe
  2⤵
  PID:9984
- C:\Windows\System\JEfJQUe.exe
  C:\Windows\System\JEfJQUe.exe
  2⤵
  PID:8424
- C:\Windows\System\ncGLxHh.exe
  C:\Windows\System\ncGLxHh.exe
  2⤵
  PID:8780
- C:\Windows\System\ZraVmGv.exe
  C:\Windows\System\ZraVmGv.exe
  2⤵
  PID:8816
- C:\Windows\System\irtHcoP.exe
  C:\Windows\System\irtHcoP.exe
  2⤵
  PID:8852
- C:\Windows\System\VcTfrkN.exe
  C:\Windows\System\VcTfrkN.exe
  2⤵
  PID:8328
- C:\Windows\System\DezyqVD.exe
  C:\Windows\System\DezyqVD.exe
  2⤵
  PID:8824
- C:\Windows\System\AAVePdw.exe
  C:\Windows\System\AAVePdw.exe
  2⤵
  PID:7848
- C:\Windows\System\nLMbEyv.exe
  C:\Windows\System\nLMbEyv.exe
  2⤵
  PID:9016
- C:\Windows\System\gejjMfH.exe
  C:\Windows\System\gejjMfH.exe
  2⤵
  PID:9328
- C:\Windows\System\ebuYZQL.exe
  C:\Windows\System\ebuYZQL.exe
  2⤵
  PID:9064
- C:\Windows\System\mFkAlps.exe
  C:\Windows\System\mFkAlps.exe
  2⤵
  PID:9436
- C:\Windows\System\iFaTNDS.exe
  C:\Windows\System\iFaTNDS.exe
  2⤵
  PID:8304
- C:\Windows\System\GlsSEev.exe
  C:\Windows\System\GlsSEev.exe
  2⤵
  PID:8396
- C:\Windows\System\hjiyyrs.exe
  C:\Windows\System\hjiyyrs.exe
  2⤵
  PID:9628
- C:\Windows\System\TviUZOx.exe
  C:\Windows\System\TviUZOx.exe
  2⤵
  PID:9192
- C:\Windows\System\dQuqozE.exe
  C:\Windows\System\dQuqozE.exe
  2⤵
  PID:9708
- C:\Windows\System\OXWxaZK.exe
  C:\Windows\System\OXWxaZK.exe
  2⤵
  PID:7608
- C:\Windows\System\qpbAaLx.exe
  C:\Windows\System\qpbAaLx.exe
  2⤵
  PID:8220
- C:\Windows\System\GTbWOTt.exe
  C:\Windows\System\GTbWOTt.exe
  2⤵
  PID:8376
- C:\Windows\System\sKOoUzr.exe
  C:\Windows\System\sKOoUzr.exe
  2⤵
  PID:10684
- C:\Windows\System\ieHYrzk.exe
  C:\Windows\System\ieHYrzk.exe
  2⤵
  PID:10088
- C:\Windows\System\pmbCcXd.exe
  C:\Windows\System\pmbCcXd.exe
  2⤵
  PID:10752
- C:\Windows\System\pWnwPNa.exe
  C:\Windows\System\pWnwPNa.exe
  2⤵
  PID:8592
- C:\Windows\System\UpiYPBW.exe
  C:\Windows\System\UpiYPBW.exe
  2⤵
  PID:8144
- C:\Windows\System\lDSxata.exe
  C:\Windows\System\lDSxata.exe
  2⤵
  PID:10956
- C:\Windows\System\SGCEYXe.exe
  C:\Windows\System\SGCEYXe.exe
  2⤵
  PID:7304
- C:\Windows\System\MlYXouc.exe
  C:\Windows\System\MlYXouc.exe
  2⤵
  PID:11284
- C:\Windows\System\ijXtnzw.exe
  C:\Windows\System\ijXtnzw.exe
  2⤵
  PID:11308
- C:\Windows\System\ZqLFFuH.exe
  C:\Windows\System\ZqLFFuH.exe
  2⤵
  PID:11328
- C:\Windows\System\AEvECJC.exe
  C:\Windows\System\AEvECJC.exe
  2⤵
  PID:11348
- C:\Windows\System\faTotVT.exe
  C:\Windows\System\faTotVT.exe
  2⤵
  PID:11384
- C:\Windows\System\bcIoaUC.exe
  C:\Windows\System\bcIoaUC.exe
  2⤵
  PID:11404
- C:\Windows\System\iCcakmR.exe
  C:\Windows\System\iCcakmR.exe
  2⤵
  PID:11428
- C:\Windows\System\JrEbhiE.exe
  C:\Windows\System\JrEbhiE.exe
  2⤵
  PID:11444
- C:\Windows\System\EpdNLGJ.exe
  C:\Windows\System\EpdNLGJ.exe
  2⤵
  PID:11476
- C:\Windows\System\LjjZQqx.exe
  C:\Windows\System\LjjZQqx.exe
  2⤵
  PID:11504
- C:\Windows\System\MMtcxcD.exe
  C:\Windows\System\MMtcxcD.exe
  2⤵
  PID:11524
- C:\Windows\System\JgCJPWC.exe
  C:\Windows\System\JgCJPWC.exe
  2⤵
  PID:11548
- C:\Windows\System\XXamJZA.exe
  C:\Windows\System\XXamJZA.exe
  2⤵
  PID:11572
- C:\Windows\System\OuYuvwy.exe
  C:\Windows\System\OuYuvwy.exe
  2⤵
  PID:11600
- C:\Windows\System\CQHGqnS.exe
  C:\Windows\System\CQHGqnS.exe
  2⤵
  PID:11628
- C:\Windows\System\tuscxxN.exe
  C:\Windows\System\tuscxxN.exe
  2⤵
  PID:11656
- C:\Windows\System\bvOWgQQ.exe
  C:\Windows\System\bvOWgQQ.exe
  2⤵
  PID:11684
- C:\Windows\System\OvNRRpz.exe
  C:\Windows\System\OvNRRpz.exe
  2⤵
  PID:11712
- C:\Windows\System\SGzGxLW.exe
  C:\Windows\System\SGzGxLW.exe
  2⤵
  PID:11736
- C:\Windows\System\OrjCYAq.exe
  C:\Windows\System\OrjCYAq.exe
  2⤵
  PID:11776
- C:\Windows\System\jrQoBVk.exe
  C:\Windows\System\jrQoBVk.exe
  2⤵
  PID:11796
- C:\Windows\System\mnXssaw.exe
  C:\Windows\System\mnXssaw.exe
  2⤵
  PID:11820
- C:\Windows\System\zKoMOER.exe
  C:\Windows\System\zKoMOER.exe
  2⤵
  PID:11840
- C:\Windows\System\QSAyGuq.exe
  C:\Windows\System\QSAyGuq.exe
  2⤵
  PID:11864
- C:\Windows\System\QeFBqkV.exe
  C:\Windows\System\QeFBqkV.exe
  2⤵
  PID:11892
- C:\Windows\System\IhqdVHd.exe
  C:\Windows\System\IhqdVHd.exe
  2⤵
  PID:11932
- C:\Windows\System\ZPUeCkt.exe
  C:\Windows\System\ZPUeCkt.exe
  2⤵
  PID:11952
- C:\Windows\System\UJKZLaW.exe
  C:\Windows\System\UJKZLaW.exe
  2⤵
  PID:11976
- C:\Windows\System\ElZBexz.exe
  C:\Windows\System\ElZBexz.exe
  2⤵
  PID:12000
- C:\Windows\System\ixgGKgO.exe
  C:\Windows\System\ixgGKgO.exe
  2⤵
  PID:12024
- C:\Windows\System\IJEliZL.exe
  C:\Windows\System\IJEliZL.exe
  2⤵
  PID:12044
- C:\Windows\System\soQJEqP.exe
  C:\Windows\System\soQJEqP.exe
  2⤵
  PID:12064
- C:\Windows\System\kUPKODi.exe
  C:\Windows\System\kUPKODi.exe
  2⤵
  PID:12088
- C:\Windows\System\EVvYbZt.exe
  C:\Windows\System\EVvYbZt.exe
  2⤵
  PID:12116
- C:\Windows\System\zRRnayU.exe
  C:\Windows\System\zRRnayU.exe
  2⤵
  PID:12144
- C:\Windows\System\pjtzYwJ.exe
  C:\Windows\System\pjtzYwJ.exe
  2⤵
  PID:12164
- C:\Windows\System\ELoKsTs.exe
  C:\Windows\System\ELoKsTs.exe
  2⤵
  PID:12188
- C:\Windows\System\UTJafTh.exe
  C:\Windows\System\UTJafTh.exe
  2⤵
  PID:12208
- C:\Windows\System\vvGwDbO.exe
  C:\Windows\System\vvGwDbO.exe
  2⤵
  PID:12236
- C:\Windows\System\agyNPqw.exe
  C:\Windows\System\agyNPqw.exe
  2⤵
  PID:12264
- C:\Windows\System\ngAPGWC.exe
  C:\Windows\System\ngAPGWC.exe
  2⤵
  PID:12280
- C:\Windows\System\xrHdMoI.exe
  C:\Windows\System\xrHdMoI.exe
  2⤵
  PID:9236
- C:\Windows\System\krTNOPj.exe
  C:\Windows\System\krTNOPj.exe
  2⤵
  PID:11044
- C:\Windows\System\WKZcqEq.exe
  C:\Windows\System\WKZcqEq.exe
  2⤵
  PID:11060
- C:\Windows\System\IntFJdp.exe
  C:\Windows\System\IntFJdp.exe
  2⤵
  PID:11108
- C:\Windows\System\UIwvYqj.exe
  C:\Windows\System\UIwvYqj.exe
  2⤵
  PID:8736
- C:\Windows\System\OTlvgbu.exe
  C:\Windows\System\OTlvgbu.exe
  2⤵
  PID:7944
- C:\Windows\System\AWrnozy.exe
  C:\Windows\System\AWrnozy.exe
  2⤵
  PID:9540
- C:\Windows\System\wIuKYni.exe
  C:\Windows\System\wIuKYni.exe
  2⤵
  PID:8900
- C:\Windows\System\rsKFoSI.exe
  C:\Windows\System\rsKFoSI.exe
  2⤵
  PID:9572
- C:\Windows\System\HdETqzx.exe
  C:\Windows\System\HdETqzx.exe
  2⤵
  PID:9428
- C:\Windows\System\fxQGjTf.exe
  C:\Windows\System\fxQGjTf.exe
  2⤵
  PID:10252
- C:\Windows\System\UPXzprX.exe
  C:\Windows\System\UPXzprX.exe
  2⤵
  PID:10304
- C:\Windows\System\aibEaUV.exe
  C:\Windows\System\aibEaUV.exe
  2⤵
  PID:10356
- C:\Windows\System\WKebUrS.exe
  C:\Windows\System\WKebUrS.exe
  2⤵
  PID:10416
- C:\Windows\System\qBnZTyD.exe
  C:\Windows\System\qBnZTyD.exe
  2⤵
  PID:9824
- C:\Windows\System\bjFugna.exe
  C:\Windows\System\bjFugna.exe
  2⤵
  PID:7532
- C:\Windows\System\cRdzoxK.exe
  C:\Windows\System\cRdzoxK.exe
  2⤵
  PID:10508
- C:\Windows\System\mmAKdgz.exe
  C:\Windows\System\mmAKdgz.exe
  2⤵
  PID:10560
- C:\Windows\System\vMJJCrP.exe
  C:\Windows\System\vMJJCrP.exe
  2⤵
  PID:10612
- C:\Windows\System\ncptxlP.exe
  C:\Windows\System\ncptxlP.exe
  2⤵
  PID:8520
- C:\Windows\System\RqBaZxX.exe
  C:\Windows\System\RqBaZxX.exe
  2⤵
  PID:10144
- C:\Windows\System\eZrlTLe.exe
  C:\Windows\System\eZrlTLe.exe
  2⤵
  PID:9732
- C:\Windows\System\xHwHajx.exe
  C:\Windows\System\xHwHajx.exe
  2⤵
  PID:10220
- C:\Windows\System\pJcSHer.exe
  C:\Windows\System\pJcSHer.exe
  2⤵
  PID:10888
- C:\Windows\System\mUyvEok.exe
  C:\Windows\System\mUyvEok.exe
  2⤵
  PID:10708
- C:\Windows\System\bwOnIBy.exe
  C:\Windows\System\bwOnIBy.exe
  2⤵
  PID:12300
- C:\Windows\System\nIyxNIQ.exe
  C:\Windows\System\nIyxNIQ.exe
  2⤵
  PID:12324
- C:\Windows\System\YlBYtwQ.exe
  C:\Windows\System\YlBYtwQ.exe
  2⤵
  PID:12348
- C:\Windows\System\ewfjcHw.exe
  C:\Windows\System\ewfjcHw.exe
  2⤵
  PID:12368
- C:\Windows\System\tvMhlyH.exe
  C:\Windows\System\tvMhlyH.exe
  2⤵
  PID:12388
- C:\Windows\System\qFTdnIy.exe
  C:\Windows\System\qFTdnIy.exe
  2⤵
  PID:12408
- C:\Windows\System\KOAysfS.exe
  C:\Windows\System\KOAysfS.exe
  2⤵
  PID:12428
- C:\Windows\System\pKZAduO.exe
  C:\Windows\System\pKZAduO.exe
  2⤵
  PID:12452
- C:\Windows\System\zrFAFET.exe
  C:\Windows\System\zrFAFET.exe
  2⤵
  PID:12476
- C:\Windows\System\FFGDZLo.exe
  C:\Windows\System\FFGDZLo.exe
  2⤵
  PID:12496
- C:\Windows\System\onHHeGs.exe
  C:\Windows\System\onHHeGs.exe
  2⤵
  PID:12520
- C:\Windows\System\jbMMkZP.exe
  C:\Windows\System\jbMMkZP.exe
  2⤵
  PID:12540
- C:\Windows\System\zMpvRjO.exe
  C:\Windows\System\zMpvRjO.exe
  2⤵
  PID:12564
- C:\Windows\System\LmuRlZa.exe
  C:\Windows\System\LmuRlZa.exe
  2⤵
  PID:12600
- C:\Windows\System\IzuQCpW.exe
  C:\Windows\System\IzuQCpW.exe
  2⤵
  PID:12624
- C:\Windows\System\AsPGmef.exe
  C:\Windows\System\AsPGmef.exe
  2⤵
  PID:12644
- C:\Windows\System\tUyHGXE.exe
  C:\Windows\System\tUyHGXE.exe
  2⤵
  PID:12672
- C:\Windows\System\sgcbkkO.exe
  C:\Windows\System\sgcbkkO.exe
  2⤵
  PID:12692
- C:\Windows\System\fWJcGhH.exe
  C:\Windows\System\fWJcGhH.exe
  2⤵
  PID:12720
- C:\Windows\System\BTfKxJE.exe
  C:\Windows\System\BTfKxJE.exe
  2⤵
  PID:12752
- C:\Windows\System\ASKxfQE.exe
  C:\Windows\System\ASKxfQE.exe
  2⤵
  PID:12768
- C:\Windows\System\ZAfjaso.exe
  C:\Windows\System\ZAfjaso.exe
  2⤵
  PID:12792
- C:\Windows\System\NpHsmBc.exe
  C:\Windows\System\NpHsmBc.exe
  2⤵
  PID:12816
- C:\Windows\System\raIiVli.exe
  C:\Windows\System\raIiVli.exe
  2⤵
  PID:12844
- C:\Windows\System\kLaHJOB.exe
  C:\Windows\System\kLaHJOB.exe
  2⤵
  PID:12864
- C:\Windows\System\PQZEnMf.exe
  C:\Windows\System\PQZEnMf.exe
  2⤵
  PID:12892
- C:\Windows\System\aQNhDvL.exe
  C:\Windows\System\aQNhDvL.exe
  2⤵
  PID:12916
- C:\Windows\System\iylZFGM.exe
  C:\Windows\System\iylZFGM.exe
  2⤵
  PID:10324
- C:\Windows\System\cwspSgh.exe
  C:\Windows\System\cwspSgh.exe
  2⤵
  PID:12572
- C:\Windows\System\AQbOLID.exe
  C:\Windows\System\AQbOLID.exe
  2⤵
  PID:12612
- C:\Windows\System\pZYXGLE.exe
  C:\Windows\System\pZYXGLE.exe
  2⤵
  PID:11616
- C:\Windows\System\khqUClz.exe
  C:\Windows\System\khqUClz.exe
  2⤵
  PID:12984
- C:\Windows\System\YSKEshd.exe
  C:\Windows\System\YSKEshd.exe
  2⤵
  PID:13028
- C:\Windows\System\aNCXFIu.exe
  C:\Windows\System\aNCXFIu.exe
  2⤵
  PID:11912
- C:\Windows\System\vzaKUiV.exe
  C:\Windows\System\vzaKUiV.exe
  2⤵
  PID:8440
- C:\Windows\System\gxsKgzT.exe
  C:\Windows\System\gxsKgzT.exe
  2⤵
  PID:13240
- C:\Windows\System\LyqSrRX.exe
  C:\Windows\System\LyqSrRX.exe
  2⤵
  PID:12436
- C:\Windows\System\kWJaWht.exe
  C:\Windows\System\kWJaWht.exe
  2⤵
  PID:13288
- C:\Windows\System\VYqOZmx.exe
  C:\Windows\System\VYqOZmx.exe
  2⤵
  PID:11644
- C:\Windows\System\oNUMmmQ.exe
  C:\Windows\System\oNUMmmQ.exe
  2⤵
  PID:13036
- C:\Windows\System\amxGwGA.exe
  C:\Windows\System\amxGwGA.exe
  2⤵
  PID:3216
- C:\Windows\System\qdQoTXq.exe
  C:\Windows\System\qdQoTXq.exe
  2⤵
  PID:11520
- C:\Windows\System\oSEuinB.exe
  C:\Windows\System\oSEuinB.exe
  2⤵
  PID:10004
- C:\Windows\System\sxQRaxA.exe
  C:\Windows\System\sxQRaxA.exe
  2⤵
  PID:11220
- C:\Windows\System\xhtttEp.exe
  C:\Windows\System\xhtttEp.exe
  2⤵
  PID:11944
- C:\Windows\System\WSHIKJv.exe
  C:\Windows\System\WSHIKJv.exe
  2⤵
  PID:9388
- C:\Windows\System\eQQmWbt.exe
  C:\Windows\System\eQQmWbt.exe
  2⤵
  PID:4080
- C:\Windows\System\DvoFsBj.exe
  C:\Windows\System\DvoFsBj.exe
  2⤵
  PID:7972
- C:\Windows\System\GOhaUAc.exe
  C:\Windows\System\GOhaUAc.exe
  2⤵
  PID:10512
- C:\Windows\System\uWnxKMR.exe
  C:\Windows\System\uWnxKMR.exe
  2⤵
  PID:8576
- C:\Windows\System\yzwIzGn.exe
  C:\Windows\System\yzwIzGn.exe
  2⤵
  PID:10760
- C:\Windows\System\yGFjKvF.exe
  C:\Windows\System\yGFjKvF.exe
  2⤵
  PID:12688
- C:\Windows\System\mgzRLFS.exe
  C:\Windows\System\mgzRLFS.exe
  2⤵
  PID:11532
- C:\Windows\System\bWfiTuB.exe
  C:\Windows\System\bWfiTuB.exe
  2⤵
  PID:12872
- C:\Windows\System\nuDjpaF.exe
  C:\Windows\System\nuDjpaF.exe
  2⤵
  PID:9748
- C:\Windows\System\AuvoZzC.exe
  C:\Windows\System\AuvoZzC.exe
  2⤵
  PID:11972
- C:\Windows\System\TtDmjPK.exe
  C:\Windows\System\TtDmjPK.exe
  2⤵
  PID:11316
- C:\Windows\System\bcksVcX.exe
  C:\Windows\System\bcksVcX.exe
  2⤵
  PID:12072
- C:\Windows\System\LcBmvtE.exe
  C:\Windows\System\LcBmvtE.exe
  2⤵
  PID:3016
- C:\Windows\System\XvUNjyA.exe
  C:\Windows\System\XvUNjyA.exe
  2⤵
  PID:10104
- C:\Windows\System\bHtbRbr.exe
  C:\Windows\System\bHtbRbr.exe
  2⤵
  PID:13296
- C:\Windows\System\RaqwxpI.exe
  C:\Windows\System\RaqwxpI.exe
  2⤵
  PID:13072
- C:\Windows\System\MMQEryt.exe
  C:\Windows\System\MMQEryt.exe
  2⤵
  PID:13192
- C:\Windows\System\jllxQXz.exe
  C:\Windows\System\jllxQXz.exe
  2⤵
  PID:13124
- C:\Windows\System\QeCGvRM.exe
  C:\Windows\System\QeCGvRM.exe
  2⤵
  PID:4504
- C:\Windows\System\WmdTAYJ.exe
  C:\Windows\System\WmdTAYJ.exe
  2⤵
  PID:11696
- C:\Windows\System\ZmcVEeX.exe
  C:\Windows\System\ZmcVEeX.exe
  2⤵
  PID:11748
- C:\Windows\System\KyhXWvr.exe
  C:\Windows\System\KyhXWvr.exe
  2⤵
  PID:12036
- C:\Windows\System\fqJtpEA.exe
  C:\Windows\System\fqJtpEA.exe
  2⤵
  PID:12384
- C:\Windows\System\eVyOYap.exe
  C:\Windows\System\eVyOYap.exe
  2⤵
  PID:13064
- C:\Windows\System\XpDoZoU.exe
  C:\Windows\System\XpDoZoU.exe
  2⤵
  PID:11020
- C:\Windows\System\hInWbzr.exe
  C:\Windows\System\hInWbzr.exe
  2⤵
  PID:11804
- C:\Windows\System\csVWheP.exe
  C:\Windows\System\csVWheP.exe
  2⤵
  PID:2144
- C:\Windows\System\gYSAHGb.exe
  C:\Windows\System\gYSAHGb.exe
  2⤵
  PID:12492
- C:\Windows\System\tMNzQcZ.exe
  C:\Windows\System\tMNzQcZ.exe
  2⤵
  PID:1636
- C:\Windows\System\YAbIOvD.exe
  C:\Windows\System\YAbIOvD.exe
  2⤵
  PID:8476
- C:\Windows\System\tHcfogJ.exe
  C:\Windows\System\tHcfogJ.exe
  2⤵
  PID:7920
- C:\Windows\System\iPdjxzi.exe
  C:\Windows\System\iPdjxzi.exe
  2⤵
  PID:11000
- C:\Windows\System\vNDeoHp.exe
  C:\Windows\System\vNDeoHp.exe
  2⤵
  PID:10132
- C:\Windows\System\ofzANKu.exe
  C:\Windows\System\ofzANKu.exe
  2⤵
  PID:8244
- C:\Windows\System\sHrcufl.exe
  C:\Windows\System\sHrcufl.exe
  2⤵
  PID:12136
- C:\Windows\System\oMBTQyq.exe
  C:\Windows\System\oMBTQyq.exe
  2⤵
  PID:12316
- C:\Windows\System\KRDOGly.exe
  C:\Windows\System\KRDOGly.exe
  2⤵
  PID:13056
- C:\Windows\System\YGxkLlN.exe
  C:\Windows\System\YGxkLlN.exe
  2⤵
  PID:4404
- C:\Windows\System\jvvXHEj.exe
  C:\Windows\System\jvvXHEj.exe
  2⤵
  PID:12900
- C:\Windows\System\AckXWvV.exe
  C:\Windows\System\AckXWvV.exe
  2⤵
  PID:2796
- C:\Windows\System\MIDTMcv.exe
  C:\Windows\System\MIDTMcv.exe
  2⤵
  PID:11564
- C:\Windows\System\mNKRrvo.exe
  C:\Windows\System\mNKRrvo.exe
  2⤵
  PID:4480
- C:\Windows\System\UdweQiJ.exe
  C:\Windows\System\UdweQiJ.exe
  2⤵
  PID:11884
- C:\Windows\System\hSnxOHj.exe
  C:\Windows\System\hSnxOHj.exe
  2⤵
  PID:5796
- C:\Windows\System\EwLgvDv.exe
  C:\Windows\System\EwLgvDv.exe
  2⤵
  PID:13152
- C:\Windows\System\SaaKHXo.exe
  C:\Windows\System\SaaKHXo.exe
  2⤵
  PID:10992
- C:\Windows\System\NFwQQtL.exe
  C:\Windows\System\NFwQQtL.exe
  2⤵
  PID:12012
- C:\Windows\System\aUWxVPW.exe
  C:\Windows\System\aUWxVPW.exe
  2⤵
  PID:9312
- C:\Windows\System\LnjSYsK.exe
  C:\Windows\System\LnjSYsK.exe
  2⤵
  PID:13136
- C:\Windows\System\lBdiBmO.exe
  C:\Windows\System\lBdiBmO.exe
  2⤵
  PID:11232
- C:\Windows\System\KgizJVm.exe
  C:\Windows\System\KgizJVm.exe
  2⤵
  PID:832
- C:\Windows\System\RNZiJrF.exe
  C:\Windows\System\RNZiJrF.exe
  2⤵
  PID:7596
- C:\Windows\System\ygcFhsv.exe
  C:\Windows\System\ygcFhsv.exe
  2⤵
  PID:3716
- C:\Windows\System\wiUbKGr.exe
  C:\Windows\System\wiUbKGr.exe
  2⤵
  PID:4056
- C:\Windows\System\pFbrqxE.exe
  C:\Windows\System\pFbrqxE.exe
  2⤵
  PID:5064
- C:\Windows\System\SsTIecM.exe
  C:\Windows\System\SsTIecM.exe
  2⤵
  PID:13384
- C:\Windows\System\iJxePlx.exe
  C:\Windows\System\iJxePlx.exe
  2⤵
  PID:13408
- C:\Windows\System\poSRKac.exe
  C:\Windows\System\poSRKac.exe
  2⤵
  PID:13436
- C:\Windows\System\bgAEiIB.exe
  C:\Windows\System\bgAEiIB.exe
  2⤵
  PID:13472
- C:\Windows\System\uiSlxPK.exe
  C:\Windows\System\uiSlxPK.exe
  2⤵
  PID:13504
- C:\Windows\System\OJZdjft.exe
  C:\Windows\System\OJZdjft.exe
  2⤵
  PID:13548
- C:\Windows\System\LRyOdaV.exe
  C:\Windows\System\LRyOdaV.exe
  2⤵
  PID:13564
- C:\Windows\System\hqGiuww.exe
  C:\Windows\System\hqGiuww.exe
  2⤵
  PID:13608
- C:\Windows\System\mNKxBHR.exe
  C:\Windows\System\mNKxBHR.exe
  2⤵
  PID:13628
- C:\Windows\System\qTlcTUB.exe
  C:\Windows\System\qTlcTUB.exe
  2⤵
  PID:13724
- C:\Windows\System\MiIRBng.exe
  C:\Windows\System\MiIRBng.exe
  2⤵
  PID:13844
- C:\Windows\System\zAfLGTo.exe
  C:\Windows\System\zAfLGTo.exe
  2⤵
  PID:13868
- C:\Windows\System\rVAtNeP.exe
  C:\Windows\System\rVAtNeP.exe
  2⤵
  PID:13908
- C:\Windows\System\sesMvve.exe
  C:\Windows\System\sesMvve.exe
  2⤵
  PID:13932
- C:\Windows\System\KcLQpaT.exe
  C:\Windows\System\KcLQpaT.exe
  2⤵
  PID:13952
- C:\Windows\System\jTIWSOk.exe
  C:\Windows\System\jTIWSOk.exe
  2⤵
  PID:13968
- C:\Windows\System\rdbRglr.exe
  C:\Windows\System\rdbRglr.exe
  2⤵
  PID:13992
- C:\Windows\System\EDEVfcX.exe
  C:\Windows\System\EDEVfcX.exe
  2⤵
  PID:14028
- C:\Windows\System\ZugABGM.exe
  C:\Windows\System\ZugABGM.exe
  2⤵
  PID:14052
- C:\Windows\System\eXqOspL.exe
  C:\Windows\System\eXqOspL.exe
  2⤵
  PID:14084
- C:\Windows\System\JWzMgPo.exe
  C:\Windows\System\JWzMgPo.exe
  2⤵
  PID:14104
- C:\Windows\System\FwetCbe.exe
  C:\Windows\System\FwetCbe.exe
  2⤵
  PID:14120
- C:\Windows\System\OvWqyQJ.exe
  C:\Windows\System\OvWqyQJ.exe
  2⤵
  PID:14156
- C:\Windows\System\ifbvllG.exe
  C:\Windows\System\ifbvllG.exe
  2⤵
  PID:14180
- C:\Windows\System\fevzbNF.exe
  C:\Windows\System\fevzbNF.exe
  2⤵
  PID:14212
- C:\Windows\System\mHXYwYp.exe
  C:\Windows\System\mHXYwYp.exe
  2⤵
  PID:14232
- C:\Windows\System\hDyhUEQ.exe
  C:\Windows\System\hDyhUEQ.exe
  2⤵
  PID:14252
- C:\Windows\System\JjhJlcY.exe
  C:\Windows\System\JjhJlcY.exe
  2⤵
  PID:14268
- C:\Windows\System\icTHzBq.exe
  C:\Windows\System\icTHzBq.exe
  2⤵
  PID:14288
- C:\Windows\System\mTblWjk.exe
  C:\Windows\System\mTblWjk.exe
  2⤵
  PID:14324
- C:\Windows\System\aKbtYPx.exe
  C:\Windows\System\aKbtYPx.exe
  2⤵
  PID:1868
- C:\Windows\System\mojhzRQ.exe
  C:\Windows\System\mojhzRQ.exe
  2⤵
  PID:8744
- C:\Windows\System\NikioRe.exe
  C:\Windows\System\NikioRe.exe
  2⤵
  PID:11452
- C:\Windows\System\FpqHblo.exe
  C:\Windows\System\FpqHblo.exe
  2⤵
  PID:412
- C:\Windows\System\QgDwTJl.exe
  C:\Windows\System\QgDwTJl.exe
  2⤵
  PID:13332
- C:\Windows\System\WfLBxkj.exe
  C:\Windows\System\WfLBxkj.exe
  2⤵
  PID:5636
- C:\Windows\System\oYAdngq.exe
  C:\Windows\System\oYAdngq.exe
  2⤵
  PID:3592
- C:\Windows\System\paxKJKx.exe
  C:\Windows\System\paxKJKx.exe
  2⤵
  PID:13660
- C:\Windows\System\qMugWCU.exe
  C:\Windows\System\qMugWCU.exe
  2⤵
  PID:13520
- C:\Windows\System\soQBZDS.exe
  C:\Windows\System\soQBZDS.exe
  2⤵
  PID:13560
- C:\Windows\System\yuIewEC.exe
  C:\Windows\System\yuIewEC.exe
  2⤵
  PID:13600
- C:\Windows\System\RPGkzWW.exe
  C:\Windows\System\RPGkzWW.exe
  2⤵
  PID:1588
- C:\Windows\System\KizpeJk.exe
  C:\Windows\System\KizpeJk.exe
  2⤵
  PID:13816
- C:\Windows\System\jEyUAGP.exe
  C:\Windows\System\jEyUAGP.exe
  2⤵
  PID:13856
- C:\Windows\System\hcYCrSG.exe
  C:\Windows\System\hcYCrSG.exe
  2⤵
  PID:3248
- C:\Windows\System\nXlytNT.exe
  C:\Windows\System\nXlytNT.exe
  2⤵
  PID:2988
- C:\Windows\System\DoPyeeS.exe
  C:\Windows\System\DoPyeeS.exe
  2⤵
  PID:4684
- C:\Windows\System\vaOeQPb.exe
  C:\Windows\System\vaOeQPb.exe
  2⤵
  PID:3460
- C:\Windows\System\wuSFDzc.exe
  C:\Windows\System\wuSFDzc.exe
  2⤵
  PID:13804
- C:\Windows\System\XjrMxGQ.exe
  C:\Windows\System\XjrMxGQ.exe
  2⤵
  PID:13900
- C:\Windows\System\CumuuIL.exe
  C:\Windows\System\CumuuIL.exe
  2⤵
  PID:14100
- C:\Windows\System\jjkfmKl.exe
  C:\Windows\System\jjkfmKl.exe
  2⤵
  PID:14280
- C:\Windows\System\nQiMrRX.exe
  C:\Windows\System\nQiMrRX.exe
  2⤵
  PID:14144
- C:\Windows\System\YNdgKdW.exe
  C:\Windows\System\YNdgKdW.exe
  2⤵
  PID:5052
- C:\Windows\System\aRcnMeO.exe
  C:\Windows\System\aRcnMeO.exe
  2⤵
  PID:3448
- C:\Windows\System\RiaYiyx.exe
  C:\Windows\System\RiaYiyx.exe
  2⤵
  PID:14244
- C:\Windows\System\CyZFAgJ.exe
  C:\Windows\System\CyZFAgJ.exe
  2⤵
  PID:14304
- C:\Windows\System\SfedUqz.exe
  C:\Windows\System\SfedUqz.exe
  2⤵
  PID:960
- C:\Windows\System\vxqZndB.exe
  C:\Windows\System\vxqZndB.exe
  2⤵
  PID:5668
- C:\Windows\System\IadQrWb.exe
  C:\Windows\System\IadQrWb.exe
  2⤵
  PID:9576
- C:\Windows\System\VdPZhAq.exe
  C:\Windows\System\VdPZhAq.exe
  2⤵
  PID:12812
- C:\Windows\System\hdlfGyo.exe
  C:\Windows\System\hdlfGyo.exe
  2⤵
  PID:2632
- C:\Windows\System\mFwCpbO.exe
  C:\Windows\System\mFwCpbO.exe
  2⤵
  PID:5976
- C:\Windows\System\DfUEGGx.exe
  C:\Windows\System\DfUEGGx.exe
  2⤵
  PID:13348
- C:\Windows\System\bdifmnR.exe
  C:\Windows\System\bdifmnR.exe
  2⤵
  PID:536
- C:\Windows\System\RXDsAjd.exe
  C:\Windows\System\RXDsAjd.exe
  2⤵
  PID:6048
- C:\Windows\System\qBDObPW.exe
  C:\Windows\System\qBDObPW.exe
  2⤵
  PID:5088
- C:\Windows\System\yfQIadi.exe
  C:\Windows\System\yfQIadi.exe
  2⤵
  PID:13596
- C:\Windows\System\wKGfTpI.exe
  C:\Windows\System\wKGfTpI.exe
  2⤵
  PID:216
- C:\Windows\System\lbqnYux.exe
  C:\Windows\System\lbqnYux.exe
  2⤵
  PID:6072
- C:\Windows\System\Lrzmnis.exe
  C:\Windows\System\Lrzmnis.exe
  2⤵
  PID:13712
- C:\Windows\System\yXQPsdJ.exe
  C:\Windows\System\yXQPsdJ.exe
  2⤵
  PID:13652
- C:\Windows\System\dQHWjPS.exe
  C:\Windows\System\dQHWjPS.exe
  2⤵
  PID:5772
- C:\Windows\System\MURNDRz.exe
  C:\Windows\System\MURNDRz.exe
  2⤵
  PID:13776
- C:\Windows\System\wAaEXUd.exe
  C:\Windows\System\wAaEXUd.exe
  2⤵
  PID:13864
- C:\Windows\System\qorniKk.exe
  C:\Windows\System\qorniKk.exe
  2⤵
  PID:14000
- C:\Windows\System\SOVziNT.exe
  C:\Windows\System\SOVziNT.exe
  2⤵
  PID:3312
- C:\Windows\System\NXDOcAW.exe
  C:\Windows\System\NXDOcAW.exe
  2⤵
  PID:14036
- C:\Windows\System\HAevZID.exe
  C:\Windows\System\HAevZID.exe
  2⤵
  PID:14284
- C:\Windows\System\VAEeAcN.exe
  C:\Windows\System\VAEeAcN.exe
  2⤵
  PID:14196
- C:\Windows\System\EkJgodH.exe
  C:\Windows\System\EkJgodH.exe
  2⤵
  PID:13792
- C:\Windows\System\HWSTcTN.exe
  C:\Windows\System\HWSTcTN.exe
  2⤵
  PID:8740
- C:\Windows\System\IMhiVtm.exe
  C:\Windows\System\IMhiVtm.exe
  2⤵
  PID:8868
- C:\Windows\System\WBzbLup.exe
  C:\Windows\System\WBzbLup.exe
  2⤵
  PID:12800
- C:\Windows\System\aRnMOcy.exe
  C:\Windows\System\aRnMOcy.exe
  2⤵
  PID:5096
- C:\Windows\System\jWkSdig.exe
  C:\Windows\System\jWkSdig.exe
  2⤵
  PID:2196
- C:\Windows\System\juHGumw.exe
  C:\Windows\System\juHGumw.exe
  2⤵
  PID:5156
- C:\Windows\System\nCbigPk.exe
  C:\Windows\System\nCbigPk.exe
  2⤵
  PID:1264
- C:\Windows\System\GuefTvT.exe
  C:\Windows\System\GuefTvT.exe
  2⤵
  PID:688
- C:\Windows\System\ppkAwVp.exe
  C:\Windows\System\ppkAwVp.exe
  2⤵
  PID:6084
- C:\Windows\System\VIbJYZE.exe
  C:\Windows\System\VIbJYZE.exe
  2⤵
  PID:5436
- C:\Windows\System\XEZeiGH.exe
  C:\Windows\System\XEZeiGH.exe
  2⤵
  PID:14152
- C:\Windows\System\TadWzFU.exe
  C:\Windows\System\TadWzFU.exe
  2⤵
  PID:700
- C:\Windows\System\PmQYdKY.exe
  C:\Windows\System\PmQYdKY.exe
  2⤵
  PID:5376
- C:\Windows\System\XLjBARR.exe
  C:\Windows\System\XLjBARR.exe
  2⤵
  PID:2732
- C:\Windows\System\fKOXrSE.exe
  C:\Windows\System\fKOXrSE.exe
  2⤵
  PID:6012
- C:\Windows\System\SLrUyzp.exe
  C:\Windows\System\SLrUyzp.exe
  2⤵
  PID:4132
- C:\Windows\System\WFYUqTA.exe
  C:\Windows\System\WFYUqTA.exe
  2⤵
  PID:116
- C:\Windows\System\ZDZseNL.exe
  C:\Windows\System\ZDZseNL.exe
  2⤵
  PID:2872
- C:\Windows\System\SjPyMKI.exe
  C:\Windows\System\SjPyMKI.exe
  2⤵
  PID:4340
- C:\Windows\System\jtmlCBn.exe
  C:\Windows\System\jtmlCBn.exe
  2⤵
  PID:6068
- C:\Windows\System\UDCTmMY.exe
  C:\Windows\System\UDCTmMY.exe
  2⤵
  PID:13836
- C:\Windows\System\bFbRrxM.exe
  C:\Windows\System\bFbRrxM.exe
  2⤵
  PID:2460
- C:\Windows\System\FLIkPhl.exe
  C:\Windows\System\FLIkPhl.exe
  2⤵
  PID:13492
- C:\Windows\System\gpuKiYw.exe
  C:\Windows\System\gpuKiYw.exe
  2⤵
  PID:13512
- C:\Windows\System\MWnkJyv.exe
  C:\Windows\System\MWnkJyv.exe
  2⤵
  PID:14332
- C:\Windows\System\dlhkBBt.exe
  C:\Windows\System\dlhkBBt.exe
  2⤵
  PID:13684
- C:\Windows\System\SfKykDb.exe
  C:\Windows\System\SfKykDb.exe
  2⤵
  PID:4164
- C:\Windows\System\uWAoUmL.exe
  C:\Windows\System\uWAoUmL.exe
  2⤵
  PID:3192
- C:\Windows\System\pzStMAa.exe
  C:\Windows\System\pzStMAa.exe
  2⤵
  PID:5912
- C:\Windows\System\dieHhxG.exe
  C:\Windows\System\dieHhxG.exe
  2⤵
  PID:6388
- C:\Windows\System\KXKumSE.exe
  C:\Windows\System\KXKumSE.exe
  2⤵
  PID:1336
- C:\Windows\System\zyMWyMq.exe
  C:\Windows\System\zyMWyMq.exe
  2⤵
  PID:3944
- C:\Windows\System\KJWMfVd.exe
  C:\Windows\System\KJWMfVd.exe
  2⤵
  PID:5204
- C:\Windows\System\QUmybOH.exe
  C:\Windows\System\QUmybOH.exe
  2⤵
  PID:14188
- C:\Windows\System\fDTcvYK.exe
  C:\Windows\System\fDTcvYK.exe
  2⤵
  PID:4680
- C:\Windows\System\jvrAIZg.exe
  C:\Windows\System\jvrAIZg.exe
  2⤵
  PID:3264
- C:\Windows\System\WZhimHU.exe
  C:\Windows\System\WZhimHU.exe
  2⤵
  PID:5612
- C:\Windows\System\NVxUkRe.exe
  C:\Windows\System\NVxUkRe.exe
  2⤵
  PID:6392
- C:\Windows\System\tcNRqwJ.exe
  C:\Windows\System\tcNRqwJ.exe
  2⤵
  PID:2844
- C:\Windows\System\NyrKRsy.exe
  C:\Windows\System\NyrKRsy.exe
  2⤵
  PID:4768
- C:\Windows\System\xfdNnlX.exe
  C:\Windows\System\xfdNnlX.exe
  2⤵
  PID:13424
- C:\Windows\System\KzRYXIc.exe
  C:\Windows\System\KzRYXIc.exe
  2⤵
  PID:6024
- C:\Windows\System\VHjGIja.exe
  C:\Windows\System\VHjGIja.exe
  2⤵
  PID:3012
- C:\Windows\System\YSpcAwP.exe
  C:\Windows\System\YSpcAwP.exe
  2⤵
  PID:2588
- C:\Windows\System\SyxpTIo.exe
  C:\Windows\System\SyxpTIo.exe
  2⤵
  PID:6832
- C:\Windows\System\XmeQZjS.exe
  C:\Windows\System\XmeQZjS.exe
  2⤵
  PID:4876
- C:\Windows\System\expucfc.exe
  C:\Windows\System\expucfc.exe
  2⤵
  PID:6756
- C:\Windows\System\daxKcEq.exe
  C:\Windows\System\daxKcEq.exe
  2⤵
  PID:7072
- C:\Windows\System\kXdsxFw.exe
  C:\Windows\System\kXdsxFw.exe
  2⤵
  PID:7080
- C:\Windows\System\eOnjiEX.exe
  C:\Windows\System\eOnjiEX.exe
  2⤵
  PID:4356
- C:\Windows\System\pJnvZnQ.exe
  C:\Windows\System\pJnvZnQ.exe
  2⤵
  PID:13740
- C:\Windows\System\xGnbGYd.exe
  C:\Windows\System\xGnbGYd.exe
  2⤵
  PID:7056
- C:\Windows\System\leHhgBT.exe
  C:\Windows\System\leHhgBT.exe
  2⤵
  PID:6828
- C:\Windows\System\eGUjPBr.exe
  C:\Windows\System\eGUjPBr.exe
  2⤵
  PID:6404
- C:\Windows\System\lOoRWbg.exe
  C:\Windows\System\lOoRWbg.exe
  2⤵
  PID:6880
- C:\Windows\System\UMpXSdo.exe
  C:\Windows\System\UMpXSdo.exe
  2⤵
  PID:3308
- C:\Windows\System\DOsffUv.exe
  C:\Windows\System\DOsffUv.exe
  2⤵
  PID:7100
- C:\Windows\System\KLWlFir.exe
  C:\Windows\System\KLWlFir.exe
  2⤵
  PID:6096
- C:\Windows\System\hLtBxvR.exe
  C:\Windows\System\hLtBxvR.exe
  2⤵
  PID:13324
- C:\Windows\System\wOOsIau.exe
  C:\Windows\System\wOOsIau.exe
  2⤵
  PID:13640
- C:\Windows\System\wmIDGbf.exe
  C:\Windows\System\wmIDGbf.exe
  2⤵
  PID:6748
- C:\Windows\System\HLWDGrw.exe
  C:\Windows\System\HLWDGrw.exe
  2⤵
  PID:7064
- C:\Windows\System\KdetQga.exe
  C:\Windows\System\KdetQga.exe
  2⤵
  PID:8988
- C:\Windows\System\EjnTOVE.exe
  C:\Windows\System\EjnTOVE.exe
  2⤵
  PID:6016
- C:\Windows\System\JRjVntE.exe
  C:\Windows\System\JRjVntE.exe
  2⤵
  PID:3268
- C:\Windows\System\RhfVSCk.exe
  C:\Windows\System\RhfVSCk.exe
  2⤵
  PID:2148
- C:\Windows\System\rxoxZLv.exe
  C:\Windows\System\rxoxZLv.exe
  2⤵
  PID:7104
- C:\Windows\System\dGMXBDG.exe
  C:\Windows\System\dGMXBDG.exe
  2⤵
  PID:3180
- C:\Windows\System\fItHrYo.exe
  C:\Windows\System\fItHrYo.exe
  2⤵
  PID:12096
- C:\Windows\System\uWdAmer.exe
  C:\Windows\System\uWdAmer.exe
  2⤵
  PID:6384
- C:\Windows\System\NPhxyiu.exe
  C:\Windows\System\NPhxyiu.exe
  2⤵
  PID:13764
- C:\Windows\System\BOyOPso.exe
  C:\Windows\System\BOyOPso.exe
  2⤵
  PID:5160
- C:\Windows\System\aCQRbyE.exe
  C:\Windows\System\aCQRbyE.exe
  2⤵
  PID:2384
- C:\Windows\System\kYiDwvE.exe
  C:\Windows\System\kYiDwvE.exe
  2⤵
  PID:7776
- C:\Windows\System\flZvbLy.exe
  C:\Windows\System\flZvbLy.exe
  2⤵
  PID:6212
- C:\Windows\System\YPqtVGG.exe
  C:\Windows\System\YPqtVGG.exe
  2⤵
  PID:5880
- C:\Windows\System\ETYAIRX.exe
  C:\Windows\System\ETYAIRX.exe
  2⤵
  PID:1856
- C:\Windows\System\qKLzdtn.exe
  C:\Windows\System\qKLzdtn.exe
  2⤵
  PID:6780
- C:\Windows\System\RkflhRM.exe
  C:\Windows\System\RkflhRM.exe
  2⤵
  PID:4196
- C:\Windows\System\WiQUyye.exe
  C:\Windows\System\WiQUyye.exe
  2⤵
  PID:6120
- C:\Windows\System\BHzLMHp.exe
  C:\Windows\System\BHzLMHp.exe
  2⤵
  PID:2228
- C:\Windows\System\iaHUmWM.exe
  C:\Windows\System\iaHUmWM.exe
  2⤵
  PID:468
- C:\Windows\System\EnVxHgU.exe
  C:\Windows\System\EnVxHgU.exe
  2⤵
  PID:6444
- C:\Windows\System\cZuMwmA.exe
  C:\Windows\System\cZuMwmA.exe
  2⤵
  PID:2708
- C:\Windows\System\tdbMFJj.exe
  C:\Windows\System\tdbMFJj.exe
  2⤵
  PID:6684
- C:\Windows\System\BrHTVaj.exe
  C:\Windows\System\BrHTVaj.exe
  2⤵
  PID:6484
- C:\Windows\System\CxRAnoX.exe
  C:\Windows\System\CxRAnoX.exe
  2⤵
  PID:748
- C:\Windows\System\GfwBhJM.exe
  C:\Windows\System\GfwBhJM.exe
  2⤵
  PID:5776
- C:\Windows\System\wvRttzj.exe
  C:\Windows\System\wvRttzj.exe
  2⤵
  PID:4472
- C:\Windows\System\UHqlCsB.exe
  C:\Windows\System\UHqlCsB.exe
  2⤵
  PID:5732
- C:\Windows\System\JnvZYsH.exe
  C:\Windows\System\JnvZYsH.exe
  2⤵
  PID:4288
- C:\Windows\System\BgrXPro.exe
  C:\Windows\System\BgrXPro.exe
  2⤵
  PID:8844
- C:\Windows\System\LQdBibu.exe
  C:\Windows\System\LQdBibu.exe
  2⤵
  PID:6412
- C:\Windows\System\blDSyCw.exe
  C:\Windows\System\blDSyCw.exe
  2⤵
  PID:5884
- C:\Windows\System\lGwjJvF.exe
  C:\Windows\System\lGwjJvF.exe
  2⤵
  PID:1380
- C:\Windows\System\BaNqFTu.exe
  C:\Windows\System\BaNqFTu.exe
  2⤵
  PID:7804
- C:\Windows\System\eWcYlYz.exe
  C:\Windows\System\eWcYlYz.exe
  2⤵
  PID:7904
- C:\Windows\System\CKoslgG.exe
  C:\Windows\System\CKoslgG.exe
  2⤵
  PID:1816
- C:\Windows\System\gAocRHw.exe
  C:\Windows\System\gAocRHw.exe
  2⤵
  PID:636
- C:\Windows\System\XVKtGVJ.exe
  C:\Windows\System\XVKtGVJ.exe
  2⤵
  PID:7996
- C:\Windows\System\XtbEEeb.exe
  C:\Windows\System\XtbEEeb.exe
  2⤵
  PID:6204
- C:\Windows\System\YmgQRTn.exe
  C:\Windows\System\YmgQRTn.exe
  2⤵
  PID:7284
- C:\Windows\System\osZDYNX.exe
  C:\Windows\System\osZDYNX.exe
  2⤵
  PID:1172
- C:\Windows\System\mWWhFcv.exe
  C:\Windows\System\mWWhFcv.exe
  2⤵
  PID:7688
- C:\Windows\System\ImmtxhL.exe
  C:\Windows\System\ImmtxhL.exe
  2⤵
  PID:11620
- C:\Windows\System\kRrZQyg.exe
  C:\Windows\System\kRrZQyg.exe
  2⤵
  PID:4660
- C:\Windows\System\AWMMNmk.exe
  C:\Windows\System\AWMMNmk.exe
  2⤵
  PID:7592
- C:\Windows\System\XgjnVfd.exe
  C:\Windows\System\XgjnVfd.exe
  2⤵
  PID:12576
- C:\Windows\System\tfngheq.exe
  C:\Windows\System\tfngheq.exe
  2⤵
  PID:8012
- C:\Windows\System\mazhiWx.exe
  C:\Windows\System\mazhiWx.exe
  2⤵
  PID:8164
- C:\Windows\System\chBpTXL.exe
  C:\Windows\System\chBpTXL.exe
  2⤵
  PID:7716
- C:\Windows\System\GxzwCfm.exe
  C:\Windows\System\GxzwCfm.exe
  2⤵
  PID:7712
- C:\Windows\System\MNROmxk.exe
  C:\Windows\System\MNROmxk.exe
  2⤵
  PID:7752
- C:\Windows\System\XQcgcVj.exe
  C:\Windows\System\XQcgcVj.exe
  2⤵
  PID:7432
- C:\Windows\System\QgFOwYf.exe
  C:\Windows\System\QgFOwYf.exe
  2⤵
  PID:7956
- C:\Windows\System\SsBpJOa.exe
  C:\Windows\System\SsBpJOa.exe
  2⤵
  PID:8504
- C:\Windows\System\ipTDlgr.exe
  C:\Windows\System\ipTDlgr.exe
  2⤵
  PID:7808
- C:\Windows\System\lsNgKII.exe
  C:\Windows\System\lsNgKII.exe
  2⤵
  PID:8968
- C:\Windows\System\xURtYpf.exe
  C:\Windows\System\xURtYpf.exe
  2⤵
  PID:8468
- C:\Windows\System\ZdcjNzS.exe
  C:\Windows\System\ZdcjNzS.exe
  2⤵
  PID:7876
- C:\Windows\System\vWvrEWN.exe
  C:\Windows\System\vWvrEWN.exe
  2⤵
  PID:7128
- C:\Windows\System\UXznagU.exe
  C:\Windows\System\UXznagU.exe
  2⤵
  PID:7948
- C:\Windows\System\NRMaFub.exe
  C:\Windows\System\NRMaFub.exe
  2⤵
  PID:9156
- C:\Windows\System\cUENHFX.exe
  C:\Windows\System\cUENHFX.exe
  2⤵
  PID:7940
- C:\Windows\System\xfENmRz.exe
  C:\Windows\System\xfENmRz.exe
  2⤵
  PID:8428
- C:\Windows\System\nRRjkGK.exe
  C:\Windows\System\nRRjkGK.exe
  2⤵
  PID:8580
- C:\Windows\System\emmKUTq.exe
  C:\Windows\System\emmKUTq.exe
  2⤵
  PID:8516
- C:\Windows\System\yPugwAh.exe
  C:\Windows\System\yPugwAh.exe
  2⤵
  PID:12940
- C:\Windows\System\nlGHkPP.exe
  C:\Windows\System\nlGHkPP.exe
  2⤵
  PID:9332
- C:\Windows\System\yoZPIAx.exe
  C:\Windows\System\yoZPIAx.exe
  2⤵
  PID:8704
- C:\Windows\System\qjuLoQJ.exe
  C:\Windows\System\qjuLoQJ.exe
  2⤵
  PID:8664
- C:\Windows\System\oGqjvHh.exe
  C:\Windows\System\oGqjvHh.exe
  2⤵
  PID:6540
- C:\Windows\System\OdeoIrD.exe
  C:\Windows\System\OdeoIrD.exe
  2⤵
  PID:8616
- C:\Windows\System\PFoqAoQ.exe
  C:\Windows\System\PFoqAoQ.exe
  2⤵
  PID:8604
- C:\Windows\System\KvHoDZE.exe
  C:\Windows\System\KvHoDZE.exe
  2⤵
  PID:9860
- C:\Windows\System\QyitTum.exe
  C:\Windows\System\QyitTum.exe
  2⤵
  PID:5700
- C:\Windows\System\ieOqmRM.exe
  C:\Windows\System\ieOqmRM.exe
  2⤵
  PID:7656
- C:\Windows\System\eLBbCvf.exe
  C:\Windows\System\eLBbCvf.exe
  2⤵
  PID:5332
- C:\Windows\System\CnwIYWr.exe
  C:\Windows\System\CnwIYWr.exe
  2⤵
  PID:7900
- C:\Windows\System\YvdNJIb.exe
  C:\Windows\System\YvdNJIb.exe
  2⤵
  PID:8048
- C:\Windows\System\iACcOvY.exe
  C:\Windows\System\iACcOvY.exe
  2⤵
  PID:1344
- C:\Windows\System\ajZDovm.exe
  C:\Windows\System\ajZDovm.exe
  2⤵
  PID:7820
- C:\Windows\System\HTEWPCp.exe
  C:\Windows\System\HTEWPCp.exe
  2⤵
  PID:7144
- C:\Windows\System\DRrfhiA.exe
  C:\Windows\System\DRrfhiA.exe
  2⤵
  PID:9160
- C:\Windows\System\XrSjlfH.exe
  C:\Windows\System\XrSjlfH.exe
  2⤵
  PID:9916
- C:\Windows\System\HXDFKzq.exe
  C:\Windows\System\HXDFKzq.exe
  2⤵
  PID:8948
- C:\Windows\System\oKpRxCa.exe
  C:\Windows\System\oKpRxCa.exe
  2⤵
  PID:9968
- C:\Windows\System\LCuwDgU.exe
  C:\Windows\System\LCuwDgU.exe
  2⤵
  PID:8236
- C:\Windows\System\ooqQZna.exe
  C:\Windows\System\ooqQZna.exe
  2⤵
  PID:10360
- C:\Windows\System\VuHzNbr.exe
  C:\Windows\System\VuHzNbr.exe
  2⤵
  PID:10644
- C:\Windows\System\JsjDXCl.exe
  C:\Windows\System\JsjDXCl.exe
  2⤵
  PID:9360
- C:\Windows\System\FHtmmzA.exe
  C:\Windows\System\FHtmmzA.exe
  2⤵
  PID:8624
- C:\Windows\System\lLOoKmH.exe
  C:\Windows\System\lLOoKmH.exe
  2⤵
  PID:10484
- C:\Windows\System\LHoLmpB.exe
  C:\Windows\System\LHoLmpB.exe
  2⤵
  PID:10636
- C:\Windows\System\QIerPNf.exe
  C:\Windows\System\QIerPNf.exe
  2⤵
  PID:9520
- C:\Windows\System\YBMLXCN.exe
  C:\Windows\System\YBMLXCN.exe
  2⤵
  PID:1756
- C:\Windows\System\GkoWzMm.exe
  C:\Windows\System\GkoWzMm.exe
  2⤵
  PID:9796
- C:\Windows\System\mbvgUTg.exe
  C:\Windows\System\mbvgUTg.exe
  2⤵
  PID:9728
- C:\Windows\System\rMxPQxP.exe
  C:\Windows\System\rMxPQxP.exe
  2⤵
  PID:9296
- C:\Windows\System\hHaIOCe.exe
  C:\Windows\System\hHaIOCe.exe
  2⤵
  PID:10864
- C:\Windows\System\bWHJVpR.exe
  C:\Windows\System\bWHJVpR.exe
  2⤵
  PID:9928
- C:\Windows\System\jtrSgKl.exe
  C:\Windows\System\jtrSgKl.exe
  2⤵
  PID:6652
- C:\Windows\System\tquhpjr.exe
  C:\Windows\System\tquhpjr.exe
  2⤵
  PID:11140
- C:\Windows\System\vOzMdtP.exe
  C:\Windows\System\vOzMdtP.exe
  2⤵
  PID:8216
- C:\Windows\System\PtcfAWU.exe
  C:\Windows\System\PtcfAWU.exe
  2⤵
  PID:11228
- C:\Windows\System\PQgZdpg.exe
  C:\Windows\System\PQgZdpg.exe
  2⤵
  PID:10028
- C:\Windows\System\VpLedrt.exe
  C:\Windows\System\VpLedrt.exe
  2⤵
  PID:9872
- C:\Windows\System\FskYMRd.exe
  C:\Windows\System\FskYMRd.exe
  2⤵
  PID:8800
- C:\Windows\System\dSJwShn.exe
  C:\Windows\System\dSJwShn.exe
  2⤵
  PID:7252
- C:\Windows\System\nGpFggT.exe
  C:\Windows\System\nGpFggT.exe
  2⤵
  PID:9632
- C:\Windows\System\EUDkufY.exe
  C:\Windows\System\EUDkufY.exe
  2⤵
  PID:10804
- C:\Windows\System\TlwGCQf.exe
  C:\Windows\System\TlwGCQf.exe
  2⤵
  PID:9784
- C:\Windows\System\ErvMDdZ.exe
  C:\Windows\System\ErvMDdZ.exe
  2⤵
  PID:14364
- C:\Windows\System\srWRkcO.exe
  C:\Windows\System\srWRkcO.exe
  2⤵
  PID:14392
- C:\Windows\System\sBANOlQ.exe
  C:\Windows\System\sBANOlQ.exe
  2⤵
  PID:14412
- C:\Windows\System\ePWxBpQ.exe
  C:\Windows\System\ePWxBpQ.exe
  2⤵
  PID:14436
- C:\Windows\System\LpFLkoo.exe
  C:\Windows\System\LpFLkoo.exe
  2⤵
  PID:14464
- C:\Windows\System\BGGSNmK.exe
  C:\Windows\System\BGGSNmK.exe
  2⤵
  PID:14504
- C:\Windows\System\EYFGHnO.exe
  C:\Windows\System\EYFGHnO.exe
  2⤵
  PID:14540
- C:\Windows\System\pHzyDwD.exe
  C:\Windows\System\pHzyDwD.exe
  2⤵
  PID:14576
- C:\Windows\System\DFjwWCA.exe
  C:\Windows\System\DFjwWCA.exe
  2⤵
  PID:14600
- C:\Windows\System\KKHbCPQ.exe
  C:\Windows\System\KKHbCPQ.exe
  2⤵
  PID:14620
- C:\Windows\System\jwjAfJA.exe
  C:\Windows\System\jwjAfJA.exe
  2⤵
  PID:14644
- C:\Windows\System\luRxBhl.exe
  C:\Windows\System\luRxBhl.exe
  2⤵
  PID:14672
- C:\Windows\System\dcJkPps.exe
  C:\Windows\System\dcJkPps.exe
  2⤵
  PID:14696
- C:\Windows\System\JsrvrBG.exe
  C:\Windows\System\JsrvrBG.exe
  2⤵
  PID:14728
- C:\Windows\System\AHKXqKC.exe
  C:\Windows\System\AHKXqKC.exe
  2⤵
  PID:14748
- C:\Windows\System\aaTsbTn.exe
  C:\Windows\System\aaTsbTn.exe
  2⤵
  PID:14876
- C:\Windows\System\aWvGFfP.exe
  C:\Windows\System\aWvGFfP.exe
  2⤵
  PID:14896
- C:\Windows\System\UKUMQZE.exe
  C:\Windows\System\UKUMQZE.exe
  2⤵
  PID:14928
- C:\Windows\System\xllGfRp.exe
  C:\Windows\System\xllGfRp.exe
  2⤵
  PID:14956
- C:\Windows\System\NzWeGxu.exe
  C:\Windows\System\NzWeGxu.exe
  2⤵
  PID:14980
- C:\Windows\System\WLrbpnN.exe
  C:\Windows\System\WLrbpnN.exe
  2⤵
  PID:15008
- C:\Windows\System\ASLFezf.exe
  C:\Windows\System\ASLFezf.exe
  2⤵
  PID:15044
- C:\Windows\System\oosmhPC.exe
  C:\Windows\System\oosmhPC.exe
  2⤵
  PID:15076
- C:\Windows\System\UoxYfEQ.exe
  C:\Windows\System\UoxYfEQ.exe
  2⤵
  PID:15100
- C:\Windows\System\fDPolDd.exe
  C:\Windows\System\fDPolDd.exe
  2⤵
  PID:15124
- C:\Windows\System\QxnQqzZ.exe
  C:\Windows\System\QxnQqzZ.exe
  2⤵
  PID:15152
- C:\Windows\System\LxUgxfa.exe
  C:\Windows\System\LxUgxfa.exe
  2⤵
  PID:15184
- C:\Windows\System\NcWLtbu.exe
  C:\Windows\System\NcWLtbu.exe
  2⤵
  PID:15216
- C:\Windows\System\VZxOftV.exe
  C:\Windows\System\VZxOftV.exe
  2⤵
  PID:15252
- C:\Windows\System\evDitHb.exe
  C:\Windows\System\evDitHb.exe
  2⤵
  PID:15292
- C:\Windows\System\HiVSQGu.exe
  C:\Windows\System\HiVSQGu.exe
  2⤵
  PID:15324
- C:\Windows\System\VZzHUTr.exe
  C:\Windows\System\VZzHUTr.exe
  2⤵
  PID:15356
- C:\Windows\System\pqdzdlN.exe
  C:\Windows\System\pqdzdlN.exe
  2⤵
  PID:10880
- C:\Windows\System\pIhebxH.exe
  C:\Windows\System\pIhebxH.exe
  2⤵
  PID:14348
- C:\Windows\System\MOctcTs.exe
  C:\Windows\System\MOctcTs.exe
  2⤵
  PID:10352
- C:\Windows\System\XuTgCIm.exe
  C:\Windows\System\XuTgCIm.exe
  2⤵
  PID:14452
- C:\Windows\System\IRqyWcz.exe
  C:\Windows\System\IRqyWcz.exe
  2⤵
  PID:9588
- C:\Windows\System\ZXhCaZg.exe
  C:\Windows\System\ZXhCaZg.exe
  2⤵
  PID:10664
- C:\Windows\System\eMlCSzp.exe
  C:\Windows\System\eMlCSzp.exe
  2⤵
  PID:11468
- C:\Windows\System\HHmBBgg.exe
  C:\Windows\System\HHmBBgg.exe
  2⤵
  PID:14420
- C:\Windows\System\nuXmzUj.exe
  C:\Windows\System\nuXmzUj.exe
  2⤵
  PID:11008
- C:\Windows\System\HHsfhkQ.exe
  C:\Windows\System\HHsfhkQ.exe
  2⤵
  PID:14656
- C:\Windows\System\CxXHzEU.exe
  C:\Windows\System\CxXHzEU.exe
  2⤵
  PID:14680
- C:\Windows\System\tlutWwQ.exe
  C:\Windows\System\tlutWwQ.exe
  2⤵
  PID:14688
- C:\Windows\System\VszbGQx.exe
  C:\Windows\System\VszbGQx.exe
  2⤵
  PID:11236
- C:\Windows\System\xZXUuaI.exe
  C:\Windows\System\xZXUuaI.exe
  2⤵
  PID:14560
- C:\Windows\System\POPEbLg.exe
  C:\Windows\System\POPEbLg.exe
  2⤵
  PID:14424
- C:\Windows\System\mKRGeAy.exe
  C:\Windows\System\mKRGeAy.exe
  2⤵
  PID:7200
- C:\Windows\System\ebmnJrd.exe
  C:\Windows\System\ebmnJrd.exe
  2⤵
  PID:14616
- C:\Windows\System\YEZIrpn.exe
  C:\Windows\System\YEZIrpn.exe
  2⤵
  PID:14516
- C:\Windows\System\aDtDQaj.exe
  C:\Windows\System\aDtDQaj.exe
  2⤵
  PID:2128
- C:\Windows\System\RBBDFBk.exe
  C:\Windows\System\RBBDFBk.exe
  2⤵
  PID:11916
- C:\Windows\System\zMZRYSR.exe
  C:\Windows\System\zMZRYSR.exe
  2⤵
  PID:3472
- C:\Windows\System\SGJEbZJ.exe
  C:\Windows\System\SGJEbZJ.exe
  2⤵
  PID:14812
- C:\Windows\System\qEbEXsh.exe
  C:\Windows\System\qEbEXsh.exe
  2⤵
  PID:14840
- C:\Windows\System\QcHuzZM.exe
  C:\Windows\System\QcHuzZM.exe
  2⤵
  PID:14976
- C:\Windows\System\GSwdESy.exe
  C:\Windows\System\GSwdESy.exe
  2⤵
  PID:14844
- C:\Windows\System\ukIFywg.exe
  C:\Windows\System\ukIFywg.exe
  2⤵
  PID:15024
- C:\Windows\System\BgHBCKX.exe
  C:\Windows\System\BgHBCKX.exe
  2⤵
  PID:15248
- C:\Windows\System\OMgtDwK.exe
  C:\Windows\System\OMgtDwK.exe
  2⤵
  PID:15308
- C:\Windows\System\gzUgkMR.exe
  C:\Windows\System\gzUgkMR.exe
  2⤵
  PID:9172
- C:\Windows\System\qLijDZo.exe
  C:\Windows\System\qLijDZo.exe
  2⤵
  PID:10108
- C:\Windows\System\aPLXxLR.exe
  C:\Windows\System\aPLXxLR.exe
  2⤵
  PID:11084
- C:\Windows\System\rHRktsz.exe
  C:\Windows\System\rHRktsz.exe
  2⤵
  PID:14448
- C:\Windows\System\LTzwwLw.exe
  C:\Windows\System\LTzwwLw.exe
  2⤵
  PID:10288
- C:\Windows\System\mKTcnQk.exe
  C:\Windows\System\mKTcnQk.exe
  2⤵
  PID:10728
- C:\Windows\System\FmhlAdQ.exe
  C:\Windows\System\FmhlAdQ.exe
  2⤵
  PID:11132
- C:\Windows\System\vQIcYnA.exe
  C:\Windows\System\vQIcYnA.exe
  2⤵
  PID:15288
- C:\Windows\System\RmTnrNX.exe
  C:\Windows\System\RmTnrNX.exe
  2⤵
  PID:12744
- C:\Windows\System\LpyYjne.exe
  C:\Windows\System\LpyYjne.exe
  2⤵
  PID:11888
- C:\Windows\System\qIFPIuy.exe
  C:\Windows\System\qIFPIuy.exe
  2⤵
  PID:11808
- C:\Windows\System\uSsMuIV.exe
  C:\Windows\System\uSsMuIV.exe
  2⤵
  PID:10176
- C:\Windows\System\wLLNvAB.exe
  C:\Windows\System\wLLNvAB.exe
  2⤵
  PID:11860
- C:\Windows\System\pPmQptA.exe
  C:\Windows\System\pPmQptA.exe
  2⤵
  PID:11208
- C:\Windows\System\vmSvvwD.exe
  C:\Windows\System\vmSvvwD.exe
  2⤵
  PID:14720
- C:\Windows\System\Jpezptm.exe
  C:\Windows\System\Jpezptm.exe
  2⤵
  PID:13116
- C:\Windows\System\ZqHbHBA.exe
  C:\Windows\System\ZqHbHBA.exe
  2⤵
  PID:12076
- C:\Windows\System\LmhzSgp.exe
  C:\Windows\System\LmhzSgp.exe
  2⤵
  PID:14524
- C:\Windows\System\gBmLtNW.exe
  C:\Windows\System\gBmLtNW.exe
  2⤵
  PID:10364
- C:\Windows\System\nzGRFqc.exe
  C:\Windows\System\nzGRFqc.exe
  2⤵
  PID:10448
- C:\Windows\System\qKGcRGU.exe
  C:\Windows\System\qKGcRGU.exe
  2⤵
  PID:14912
- C:\Windows\System\JUyDYhZ.exe
  C:\Windows\System\JUyDYhZ.exe
  2⤵
  PID:9776
- C:\Windows\System\oThzJVs.exe
  C:\Windows\System\oThzJVs.exe
  2⤵
  PID:9920
- C:\Windows\System\mImGEwj.exe
  C:\Windows\System\mImGEwj.exe
  2⤵
  PID:15052
- C:\Windows\System\gVbVTBV.exe
  C:\Windows\System\gVbVTBV.exe
  2⤵
  PID:12336
- C:\Windows\System\AFOkLtN.exe
  C:\Windows\System\AFOkLtN.exe
  2⤵
  PID:11996
- C:\Windows\System\FcpMfmV.exe
  C:\Windows\System\FcpMfmV.exe
  2⤵
  PID:14340
- C:\Windows\System\GcRPrQI.exe
  C:\Windows\System\GcRPrQI.exe
  2⤵
  PID:15320
- C:\Windows\System\gwiuFtn.exe
  C:\Windows\System\gwiuFtn.exe
  2⤵
  PID:15200
- C:\Windows\System\lcNtJkY.exe
  C:\Windows\System\lcNtJkY.exe
  2⤵
  PID:12912
- C:\Windows\System\moXVhQY.exe
  C:\Windows\System\moXVhQY.exe
  2⤵
  PID:8292
- C:\Windows\System\NmuQlEA.exe
  C:\Windows\System\NmuQlEA.exe
  2⤵
  PID:9608
- C:\Windows\System\ADPtBdg.exe
  C:\Windows\System\ADPtBdg.exe
  2⤵
  PID:11536
- C:\Windows\System\EITPTJM.exe
  C:\Windows\System\EITPTJM.exe
  2⤵
  PID:12780
- C:\Windows\System\PpPzZmu.exe
  C:\Windows\System\PpPzZmu.exe
  2⤵
  PID:11216
- C:\Windows\System\UHogjcL.exe
  C:\Windows\System\UHogjcL.exe
  2⤵
  PID:11100
- C:\Windows\System\FBZojbu.exe
  C:\Windows\System\FBZojbu.exe
  2⤵
  PID:4104
- C:\Windows\System\Dcyliol.exe
  C:\Windows\System\Dcyliol.exe
  2⤵
  PID:12488
- C:\Windows\System\DVmBfiu.exe
  C:\Windows\System\DVmBfiu.exe
  2⤵
  PID:14952
- C:\Windows\System\KpvgIPy.exe
  C:\Windows\System\KpvgIPy.exe
  2⤵
  PID:11456
- C:\Windows\System\HxaEkoN.exe
  C:\Windows\System\HxaEkoN.exe
  2⤵
  PID:15244
- C:\Windows\System\LkOpFWe.exe
  C:\Windows\System\LkOpFWe.exe
  2⤵
  PID:9880
- C:\Windows\System\QeSDTAp.exe
  C:\Windows\System\QeSDTAp.exe
  2⤵
  PID:12444
- C:\Windows\System\NhBLabv.exe
  C:\Windows\System\NhBLabv.exe
  2⤵
  PID:14892
- C:\Windows\System\PJbuQMI.exe
  C:\Windows\System\PJbuQMI.exe
  2⤵
  PID:12960
- C:\Windows\System\vGBWjto.exe
  C:\Windows\System\vGBWjto.exe
  2⤵
  PID:14800
- C:\Windows\System\pMUdSsH.exe
  C:\Windows\System\pMUdSsH.exe
  2⤵
  PID:11292
- C:\Windows\System\YirrLSh.exe
  C:\Windows\System\YirrLSh.exe
  2⤵
  PID:12248
- C:\Windows\System\xoARXfe.exe
  C:\Windows\System\xoARXfe.exe
  2⤵
  PID:14772
- C:\Windows\System\RrvjSiP.exe
  C:\Windows\System\RrvjSiP.exe
  2⤵
  PID:11812
- C:\Windows\System\ovBuYGD.exe
  C:\Windows\System\ovBuYGD.exe
  2⤵
  PID:12364
- C:\Windows\System\soIODxk.exe
  C:\Windows\System\soIODxk.exe
  2⤵
  PID:10860
- C:\Windows\System\DRGZXJA.exe
  C:\Windows\System\DRGZXJA.exe
  2⤵
  PID:11244
- C:\Windows\System\RLzrANd.exe
  C:\Windows\System\RLzrANd.exe
  2⤵
  PID:12468
- C:\Windows\System\hfyJraE.exe
  C:\Windows\System\hfyJraE.exe
  2⤵
  PID:10380
- C:\Windows\System\kZLdSpk.exe
  C:\Windows\System\kZLdSpk.exe
  2⤵
  PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X5YW0357\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wuz4mkcy.h4t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CHRzpYd.exe

Filesize
2.2MB

MD5
2983a71660c07290e4e647f3228b967d

SHA1
8692d6e34efad82ecdcb6d3de7c38c1c04e92036

SHA256
7a167edb632f788b0987ba4af49a45e732d6ef8a6e65ec47435d8043866b2c66

SHA512
364c58dcb2af7af55ae89721d9224dc8866f8edbcb7f9d26fefcc3b05275fd8422b72bd2e1f3ffbd8d1bc3d5ac3c95197da584afa1eb5ec6357e03ce6ad164af

Download Submit
C:\Windows\System\EznvALL.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\GgvRGuY.exe

Filesize
2.2MB

MD5
f8d6d3e6daf74353888e4e21714f6198

SHA1
b536223e197df7709b063fa185704e7df7f48f3a

SHA256
e89667bfd7b97575e056a69a6240f15381dff9bd8c2347181bf9e114814073fd

SHA512
1c8e4842f8a2f7ace504d8945810390451860dfb98d160a3b2483335061f1e2c147f1c1ad77aaef9f801c83b8e178fafc1eb837c15422cde74a20a4419e05d7c

Download Submit
C:\Windows\System\JHZzYdT.exe

Filesize
2.2MB

MD5
a816c26efe658a7ed621e0ae483ea9f4

SHA1
c487cc51244a3aa73e2a6e0dd16193952e255387

SHA256
894da43a6f71a61c5761931e96ecccfd8e53dbbe23d1612828f0bca30722f09b

SHA512
2900cf0ef15acfa0363446e128592a8f30306b3624acb5e5f5779a172039a88c06eb08519748ada01c294a1c7ef6c71873141b7a5ba57c06684fe44edc74a676

Download Submit
C:\Windows\System\LEBPJiL.exe

Filesize
2.2MB

MD5
8d168bf330397f1978316a8e7ea4f923

SHA1
3838245a0fdcb1ae2960816751f9f96375d74ec4

SHA256
dc2a202ada2546728e1cff0f8733911db7bf2a05329b6845eb687983489c0493

SHA512
50ac777f47a9dce2a1132619faa08d4db2f2115619f2b137fdedc7230cae9ae2fdc306d79adf4e4065ae3c0d0ab8c22d24e6d692266a645116d56d57d758742f

Download Submit
C:\Windows\System\LTkkdZS.exe

Filesize
2.2MB

MD5
8de8f04f4df5c1ba61f62cb7b32858df

SHA1
3ee7a7364b92395c3660d1bec89509c3b98e0cd5

SHA256
ffb30acf7f174aa0bb988beb0d03a5a81f73a6e860c5b633191bff30aff1d9e1

SHA512
5e07b2f3565345ab029ea1e969a61ad2d80e18f326cfa2183fe1b5ff962fd307c173a41ae43cf0ef63ea4291a5fc34ae3703e2ee225b1798f4aa8d3e0d1940b4

Download Submit
C:\Windows\System\LgzUEFO.exe

Filesize
2.2MB

MD5
c5f4e7ebfddedeacb8f05c0219c369ed

SHA1
050b258a97e3ddf33b303ed7d945c5fff30c63e9

SHA256
0ae1085349df67e0aade853bb3b42c39c894c1321076a0050161fe757b9c076e

SHA512
a9604314e72c25a3cd562899e61e93d2f47d07ed2b1e51458c05e70c7396b7dedcc78bcbbeb5021f9bd134f7330b3da7da745925e816e6da95a9a9111eb969a7

Download Submit
C:\Windows\System\MQFUEeR.exe

Filesize
2.2MB

MD5
8119bd89fcee232dea4bd1705419fccb

SHA1
d6f767744a8b7ea8fd10390e02b59d3058ee1e23

SHA256
69d29b08c65b86fc4f87aed19139a78450ec2a6a4c4528c00576a9839ec2e204

SHA512
26bb9bf00c46b2944da75fba1febe9669d178313954b003b278e320e64a8f98f7026c67db320176ed1971dde40642578b5b1604c2bcdfc4fad9c9bc043c084b7

Download Submit
C:\Windows\System\MuwaJHz.exe

Filesize
2.2MB

MD5
ffeedfd28a6d126d7db1e801caa454fb

SHA1
2bf517442eb33d531e335e5e8cc6ef90c0fced2e

SHA256
e183ab6d2c488cf57fb5d6d4157b1287104ddc7a10be0952d567b1e5298cbbb0

SHA512
6da68df6ee1a0a5733951426f0a68bcd79f4da1bb649ebedd0b10aecf066a677c6e202c1fc03a2b8d63cc7a3cbdd7c25c6f758665668fc072c3e31d87943de9b

Download Submit
C:\Windows\System\QOnHLVi.exe

Filesize
2.2MB

MD5
2263af5792a55b9ac99dc84d086d54ce

SHA1
9d654d791e61e2e6cd2be026b8e2be5e90a9bcf6

SHA256
674eb01a1ccb99c07fa8a82fff1a81d2a59f2cdc212401eb5639b5c87ea3ed83

SHA512
3401fbc5f7a31f89391ba85921996f0b1e6e641627be1a5ff5a590efad6dce1053846f35a300c752a4d7afaf475f2b35a00777111431a0a45e9d56438cfb8d5c

Download Submit
C:\Windows\System\QrSZjCI.exe

Filesize
2.2MB

MD5
2d2e83bfb28b1e236826a4ce26cda948

SHA1
73eb142b6ef88e74bb8745f7aa7e429b958ad06b

SHA256
fc83886e72a27cc07026ae900de98939d910f333fb1aabec8f94fc8f0511bf79

SHA512
0a96d8aa3f1f432e492a04eed5aef59d3bc7904f525a6e5a2022fc8d7ba84e3d84bc0894b4df583505d8fd7c2201e3dc1220908c335b7f1fddd382b27cb83974

Download Submit
C:\Windows\System\SSdKomv.exe

Filesize
2.2MB

MD5
f97d54f6a6b38a08118b0938a9305044

SHA1
cdb24759eaea33832af88e5285b4c68abbe8b175

SHA256
3b697b57d388e11e67ad73b3d5843f2f99204d3bb7641c23d57e3b6f5c43a7b9

SHA512
2b8fb15ef2d6f864c7428656e9c7d664d84fa30a5b672387bbfe99af219d91d41299fa82aeffbdf717c79217fc64d0cfa7843033561258a71a35c1c95f4b064e

Download Submit
C:\Windows\System\SncNIRZ.exe

Filesize
2.2MB

MD5
a5f18ed82514da2c46a246437ae6508f

SHA1
3464ebb1ca097035a6276f016cbad23bcdd5c94e

SHA256
9c13ecb650ca29fa3ef28efa3efd3ad0dd70a4e502c2dae6698f73600584af4e

SHA512
134ab0055c27435686109a83c06c432d92ef34a3625aa849da3f260c9ad77d19c32eca18ad67bec61c36125dc1d824ae01a22a1a171b0e148c51241c49b048d1

Download Submit
C:\Windows\System\UIfXuwp.exe

Filesize
2.2MB

MD5
826c5c76381e0890f392636dfe0f237c

SHA1
891cf38a8c8111342af27bf7e32b6d264323b99b

SHA256
aacc5c26e9ec4128a07c2a089fcc4aa43d4d4c2e038f06e6fad427702bc0a927

SHA512
48f4155d39d506d18b672bfef0cbddbdbd8d4c209e23727675bd38ca6321d0507142b06aeef7dee5525b151f91da87a73f44a8bc3baf2c8e68b95b9935711e1c

Download Submit
C:\Windows\System\UemPasg.exe

Filesize
2.2MB

MD5
29f002b0113a824c67295b8887477efb

SHA1
1046d02b1b2a2a4a8acd13a00aec6f6c70b95dab

SHA256
a88183ede908f2eb43fde0abdf3eb37e22ae5e7bed6d35b32e748e337dcd507b

SHA512
cb15145e95c4af8f3ca0788ba58b52e659ca3f9e517afccb7eebe6257b841b3e11950ba08e4d62b35519f3b425a24fe646f422fbc0ef6293c57c98786090b93d

Download Submit
C:\Windows\System\UvWkxQB.exe

Filesize
2.2MB

MD5
e6217d5951d3a438492cc4b724cc68f4

SHA1
96a03062727210c548d3ffb6bec2fb14b135df98

SHA256
c9c8bd1169e2bcb94a9ba1822577eff4122264a043b15a3c333eadd6a9ab827c

SHA512
651de5f4c2b58c39fb6e38de4fe1a63f6edfbbf24b5011de94894d507d9025214c677325db70be3d1c2ae7a6b971cc8c0fdae96ab3feddfd5227e1171f331f3f

Download Submit
C:\Windows\System\XPthKxa.exe

Filesize
2.2MB

MD5
cbce58023341510567242c2af3708964

SHA1
1915de0992dad313e628f8d486a82da53fb56f4e

SHA256
ba9ab00ac7bb2eb32c61f105f2f6412ada73279e5c57e7c0b3a66bdc238ff69a

SHA512
3e1352e9dfa5e3a63a30d4f9bbeb04ace5fbed6d0e8c0e9fce73d4c5c7b4bda5bb380dcca0449f58dcca93f9e1dabb55bd68e7206fb21c9f7d2497655d5b825e

Download Submit
C:\Windows\System\XwJYmOg.exe

Filesize
2.2MB

MD5
37377e868795a70f4acafd01a85950ab

SHA1
67f9d19dca6434aaa27b3814e1b58c1d077194f4

SHA256
edc40f2bb42e253e606c6418db60af5e052e67beb99c871490d4016e6b7e5347

SHA512
a0a9b41505bf005a6b05f1b226d7839f9324ad7dcae3d8ef59fa915a0a51b7800721aecf84b34bbf956542bad8d844e86351bf577be2709c04d5ad8d41296c21

Download Submit
C:\Windows\System\YAXeTPO.exe

Filesize
2.2MB

MD5
1bb2636f14fc45d5ce697e9e8ae9a2f8

SHA1
a7bef909d13acb4f377981b830eb3b18d6bc2322

SHA256
5df3b5fdd2c49bbd786157ac38ae8570ee6e8af604c057983d48f6aa08d925b4

SHA512
7e803fceb650863580a449df3c8b49ade87e01b444a3e1e36a15c113ee25ae5b5da5380ace6c609e571e08a65e28a0f8fad54e0c6b41c91e278d7ea41d11033d

Download Submit
C:\Windows\System\aAMKfnc.exe

Filesize
2.2MB

MD5
64607f26019c933f63500951f8a6e1ad

SHA1
2603ff9a9b1526ab2a091b64130a41b4150703e6

SHA256
bb47eeca6e0b5970faa0e10ac86ad0b57f41e9e7fa7882e2a2bf94ac2e1ba583

SHA512
6ecf323ebcaaf63e946ac962a319d8a4033e33bef50a02ce93bd9fc4e1b1a524f5fb58ba22fdbc2b07e1e5c93ce936cbc1f231d682144583dbe404c1c98935bc

Download Submit
C:\Windows\System\caTdOSf.exe

Filesize
2.2MB

MD5
db54437ec2f72ecdfd34d4f1d7d6517c

SHA1
95cc6ce6a242f8103d8eea34a044e56e243294ff

SHA256
aca9407755430bc41b0cbdfb7f3a18bdb205e7e0afb3afae665ec9ff6e97df65

SHA512
c937dc79e34ff770d6e8f26f64f7051301bd28bd2e37d5cbac280376f7e5dffa00459d3976ab6caa0bcf61d59ef5ee9a6b57ee2bde1658e3f90d700579bfcc26

Download Submit
C:\Windows\System\dIqhARj.exe

Filesize
2.2MB

MD5
0d8cd3a708145cc5a0f89539ef11077e

SHA1
10032e4a7d82556d2975c7d9ab2b0b4e72491f88

SHA256
06d3d7b36edb55fb5192e298c2c0c5458795784a372c8bac50a5e8965e63a3e2

SHA512
75577709ec16303a41ccbb0e257b6c25d61f25474451eac40ff97f65e54ed90f6c43bb92c87d2e67376b82cdf99a9e2fd1c7b342fe41ea3d0fcc73725a40964a

Download Submit
C:\Windows\System\fjJTOqx.exe

Filesize
2.2MB

MD5
9b088af28a1e1d85bbefd81bb98f5196

SHA1
58af2f6906acc85577db5cc6574fc5e45e85cbb3

SHA256
edc69dd753924d7d9913bd56eb1e36c3cccfec52e1704cb4111abd2f835f3bdd

SHA512
230bb4b0fb033cd269c3f620038bf80369425290979e752808054380de8ea489fd8bfbf652bac10d7cff499d7fbf2fd31b6e6704b82ca8fbadb3474d858c24df

Download Submit
C:\Windows\System\gCGdtTg.exe

Filesize
2.2MB

MD5
c2e2ace51e07d55ec595209897070bdb

SHA1
795e5d0e17c5841dfcd89be12c86bab960dc564a

SHA256
065d23b851e745b49ba09e082dc93ae1888cafe0fd89e95f1fa3ff8703dfd80a

SHA512
fbd0b8fb2642a643092fa3130f8036ee5513db9a713670cc45c912662c930a19a2af9ab0e9802d088ae2e93c6a43e3b37270a41cfdb5c65df82de2a3c9261a44

Download Submit
C:\Windows\System\gFAAsLx.exe

Filesize
2.2MB

MD5
3434eb0f8e2dcac4818b9b0b0f0ceeab

SHA1
61c1d2e3c151af1e469ec1d2a23fbf1aca9c4803

SHA256
0587b4d1757d7ffde4ad66169b4ebee221c5a606930e14b356417a2077dfef3b

SHA512
d85a0952317d8c32c2d09eca12b3b8fd5dff5c4e413a36d674eac0d441753adb15ae852e284991d4983da47c83581e7242d3fafc5d7dca4001f05e178c2f0ad5

Download Submit
C:\Windows\System\hwGnNnf.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\iFQBvXK.exe

Filesize
2.2MB

MD5
180b62f9080778db0d5f41e66763eded

SHA1
5066c9081d0be2fb83dfe75683d187bbf068678f

SHA256
b17464ccf39192fbbcabc981dc44ed5967b40e188f794fba95a951e10e50b804

SHA512
ec09d2174cccb043bb3ee152f323f995bfcb174504d3cc352cb85875996a1ec8125ad34c77e45fef02ec64c6edfb1f38a78ffe2c880acc28832c3e494127ab4b

Download Submit
C:\Windows\System\lBUlQwq.exe

Filesize
2.2MB

MD5
50a2cda4c778710a36b79290c7ddf4d3

SHA1
4eb1ad032c9c42ed694bf9e8b3e89d739a09aec1

SHA256
d4a945099937913e29e52e7a43d293e5ebba16ce87f1a034f7189632034fe348

SHA512
a7af82ad255971a072b43f5c09ea0440ea457035c3d83f986c56f6940373c27d84f21d2f2351b398eefb663595147e6908ec9f56b89f02827a7a3a6f9691e056

Download Submit
C:\Windows\System\mvhcSiF.exe

Filesize
2.2MB

MD5
1552a25d923705a9986d2b946f6e69ae

SHA1
9cc7254e454f4a2026879692bf7fbaf31b0296f9

SHA256
2eb82cd8705ddba85c5cb025e2d73f6ff7a8d15aa902fb528d1aca877578ca86

SHA512
d34c0f07bd5678bdf83f99bc51188bf96cf2a5c4dffa382b5846d065f59d00f9e9808e69553d5eb8d5f709a8dac48671d296c57e5da24af156ebea8ea6d8ed59

Download Submit
C:\Windows\System\oGkNqZI.exe

Filesize
2.2MB

MD5
a38ea065e5ae3ffd29cf1631ed16a26d

SHA1
0e1dbe93f86864e0fe54970a96ab56029d5f7236

SHA256
aca717eb1324711dd3136e904eb00dd598d6604f063b0df6fcdb067b3ac228f2

SHA512
a5fbfd37c7100ac8b49379521de40e705fd48bd2c1cfb8222afcd9377e9174f5cc5703c605f996009f75663c5680316427dca438b8c7770daeee2ec787337bf0

Download Submit
C:\Windows\System\qKQcdud.exe

Filesize
2.2MB

MD5
4c59478b8cb23c3265dbd7b6e56f68ab

SHA1
ad0a729af23d247a7a821411dbf03e40ef4f7a3b

SHA256
db55359b668a74b4d4fc1bc9aed35fe767ee2593c8e3331459243ba032c20fc0

SHA512
8ad5d9673d32f6af38ce6ec84904000ca03123b51dbacf4483751352a2973c1c4f12c4485b7a562484cbe3be64c0fa04fb320f903f0fdea21728d921bb0e7205

Download Submit
C:\Windows\System\qcUqDhD.exe

Filesize
2.2MB

MD5
b501b18fc32ed937c97285bd813d6e5f

SHA1
dff70c8ed473060980a54d48647464356450a2bc

SHA256
4ddfbc85353ea70dc946001967c3e56af153edb48923f4c57d3b8319e6a01dd2

SHA512
18aebbeee3c94acf05d865ff6a7f3f96c0773735db68dca1a81d27988c82ccd31cbdfcd6b0be425b32052ceaf8fdc0def8860a160511e46eb8df455e1c5ae9af

Download Submit
C:\Windows\System\rUFPMZy.exe

Filesize
2.2MB

MD5
fe62b8d0c1b95fc29bc13316be744be1

SHA1
dd30c4c632df8e2020429400581285d4f7d038e3

SHA256
050a8860a25db62087bb416b72c604661977f18c4345056ef4090c49304c1c9e

SHA512
4fefc4d5b5e1b89c9865ce8ed932dec8ee685841f4867209b3ec71aaf0193eaa4d4550bbc7f8aeca09140a296fc688f7978252905087885812555ad1aec3950a

Download Submit
C:\Windows\System\sOVRWSu.exe

Filesize
2.2MB

MD5
b2f26ecc20e3d5ce0cf3a580adf49403

SHA1
b4ef8f939221eb47aa1d26d55a11c4b97ffb151f

SHA256
5599d6e22f49b33eeb5e395d7a91092194dd40811fd3759b786e883c9bc07124

SHA512
e9724a265167707541664ffdbba1addfbe014195d512f6da99136ab1e0937eae3ccb3dd102503eff8611dea3cde0a918287fca08ed09fb9f7b3697b0a0c6d716

Download Submit
C:\Windows\System\sYKEoBc.exe

Filesize
2.2MB

MD5
1ecfbbd13b27bc685b331cf0677f75dd

SHA1
e41dcd747b22eb3c938a102de2172bb3e4e83f9e

SHA256
bfec98f18506c95eabe9a1747eb4ce241b9ee071c2dd2738171c0211ef6f19e0

SHA512
7301652e9860ce4ad9947196999091981a29ccebb510930e4f3c8d46f01db8e0772ebd6a845131a4a6902bf7900db16d184a02747c17065bdbd439497ea3f2ba

Download Submit
C:\Windows\System\tukfkyX.exe

Filesize
2.2MB

MD5
5ba9ad02d8a83cac41c8b7f1f5395792

SHA1
603659b0d0aa5d01b77b645f2a5fbb696589f07b

SHA256
169971e1e334dc12adc39b594d155ce5418172f81c9a42788aa7b5a792af3ad6

SHA512
481a0773209e40e8ac458332af027996a6ef5b70c2bdd6f7e587a6451c6cea36570f66b4761ed8b646852e944aef0d1bcd0f7ab87b4bdb8ed127051003002883

Download Submit
C:\Windows\System\vDZSmWT.exe

Filesize
2.2MB

MD5
64980f61212ccceecea3001348a77994

SHA1
cc1a10de939b082d910b6793ba4ba9d5856555ec

SHA256
93ce9d14807800827994afe60e2ba9cb3125dfff736be00b5cc6ce915c78d2f8

SHA512
4b9581a56554dc525d1e15f72f987c94117038fe58503d7b66a9cb4cf5faabb96cd7d2568b7443935174a47f7a6be2897059eeabd84964023b0b2c2aa09f6bea

Download Submit
C:\Windows\System\vUBuFnU.exe

Filesize
2.2MB

MD5
7ac5e6f7b1b9892e7a761fef06ea70f5

SHA1
98fac51550e896f78d017e840ea2f114302999b6

SHA256
4744c2d1b25acb4fd8f807ea5cefb9041d79d4f7cd3754afbfb2f5e529d5529b

SHA512
ddaff4be92ffab50bf1ecd93dd5a09eafcedc98513d09062101b494551e603d6792490da48e1cc00417a3868f2ec6cade2b53c9a2cd19c2227458437a05098cc

Download Submit
C:\Windows\System\weqbKSx.exe

Filesize
2.2MB

MD5
6b0e64be83cda880ec205fd9302c7b5d

SHA1
2ab1ef3176560dfe15f08f4f512a115dc13ae764

SHA256
bad2afd28b9b3b1fefe70fab44223ea9ee15bad0026e8bf9ed8dc2bb792177fc

SHA512
b846fd8f6e5da873959749f876830a81042eb27c6e1aff1f9b3c993ed9958cb1981002fddea40f6dcdc7307b87ea09b855b8a423c364e4ee0ff78c53abe34dab

Download Submit
C:\Windows\System\wiUQnIw.exe

Filesize
2.2MB

MD5
9b6a38b6c91b5543ab24b9fadaa92f66

SHA1
f54303f492e4d084c7fbe4cc5980656fe623720c

SHA256
6ee88b02682e4e94501fc3b598a3fe04ab4a7ade8f9ae652362ab1112b85e464

SHA512
1d64d5084c7a0ec760659838f7253d049315866df927a956db7b4ab16e236acd3bd5784660c5161894b6d1ab348298a0719b33a188759d057bc86d280cdac531

Download Submit
C:\Windows\System\ytsyEZB.exe

Filesize
2.2MB

MD5
e1528d4d73d29777e34ec84f35124dd9

SHA1
e465bb89ac22c0b652b29243ed233fca1ae71ed7

SHA256
386de2d688768a87f61c468f5342ec072a0c6cd4d677a243dc0b30e0a0bb3396

SHA512
516994a19fb42d4071df66b15f87e3d0849c587c9bb3a414e820eb9e3ca6866e5a1a47c0e118f776adb67f0ba5fa3634aabceb460ff33665c2735b22ebdbdb7f

Download Submit
memory/388-4832-0x00007FF637800000-0x00007FF637BF2000-memory.dmp

Filesize
3.9MB

Download
memory/388-381-0x00007FF637800000-0x00007FF637BF2000-memory.dmp

Filesize
3.9MB

Download
memory/964-383-0x00007FF62E930000-0x00007FF62ED22000-memory.dmp

Filesize
3.9MB

Download
memory/2020-385-0x00007FF752050000-0x00007FF752442000-memory.dmp

Filesize
3.9MB

Download
memory/2020-4745-0x00007FF752050000-0x00007FF752442000-memory.dmp

Filesize
3.9MB

Download
memory/2248-59-0x00007FF7B4930000-0x00007FF7B4D22000-memory.dmp

Filesize
3.9MB

Download
memory/2248-4731-0x00007FF7B4930000-0x00007FF7B4D22000-memory.dmp

Filesize
3.9MB

Download
memory/2280-196-0x00007FF669CB0000-0x00007FF66A0A2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-4838-0x00007FF669CB0000-0x00007FF66A0A2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-4714-0x00007FF7FFAE0000-0x00007FF7FFED2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-384-0x00007FF7FFAE0000-0x00007FF7FFED2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-112-0x00007FF7E9460000-0x00007FF7E9852000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4721-0x00007FF7E9460000-0x00007FF7E9852000-memory.dmp

Filesize
3.9MB

Download
memory/2700-52-0x00007FF70E8E0000-0x00007FF70ECD2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4698-0x00007FF70E8E0000-0x00007FF70ECD2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-4760-0x00007FF7C6980000-0x00007FF7C6D72000-memory.dmp

Filesize
3.9MB

Download
memory/3056-376-0x00007FF7C6980000-0x00007FF7C6D72000-memory.dmp

Filesize
3.9MB

Download
memory/3064-39-0x00007FF7738C0000-0x00007FF773CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3088-261-0x00007FF7FD160000-0x00007FF7FD552000-memory.dmp

Filesize
3.9MB

Download
memory/3088-4755-0x00007FF7FD160000-0x00007FF7FD552000-memory.dmp

Filesize
3.9MB

Download
memory/3436-4841-0x00007FF70DAF0000-0x00007FF70DEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-380-0x00007FF70DAF0000-0x00007FF70DEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-4831-0x00007FF703E90000-0x00007FF704282000-memory.dmp

Filesize
3.9MB

Download
memory/3464-386-0x00007FF703E90000-0x00007FF704282000-memory.dmp

Filesize
3.9MB

Download
memory/3508-4787-0x00007FF617690000-0x00007FF617A82000-memory.dmp

Filesize
3.9MB

Download
memory/3508-313-0x00007FF617690000-0x00007FF617A82000-memory.dmp

Filesize
3.9MB

Download
memory/3688-375-0x00007FF690140000-0x00007FF690532000-memory.dmp

Filesize
3.9MB

Download
memory/3688-4830-0x00007FF690140000-0x00007FF690532000-memory.dmp

Filesize
3.9MB

Download
memory/3952-20-0x00007FF64C7A0000-0x00007FF64CB92000-memory.dmp

Filesize
3.9MB

Download
memory/4024-76-0x00007FF7715E0000-0x00007FF7719D2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-4766-0x00007FF7715E0000-0x00007FF7719D2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-4737-0x00007FF7F8600000-0x00007FF7F89F2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-379-0x00007FF7F8600000-0x00007FF7F89F2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-1-0x00000283AD280000-0x00000283AD290000-memory.dmp

Filesize
64KB

Download
memory/4076-0-0x00007FF6BAE60000-0x00007FF6BB252000-memory.dmp

Filesize
3.9MB

Download
memory/4776-4778-0x00007FF74FDA0000-0x00007FF750192000-memory.dmp

Filesize
3.9MB

Download
memory/4776-208-0x00007FF74FDA0000-0x00007FF750192000-memory.dmp

Filesize
3.9MB

Download
memory/4844-562-0x0000018D79C60000-0x0000018D7A406000-memory.dmp

Filesize
7.6MB

Download
memory/4844-382-0x00007FF8F25D3000-0x00007FF8F25D5000-memory.dmp

Filesize
8KB

Download
memory/4844-253-0x0000018D60AD0000-0x0000018D60AF2000-memory.dmp

Filesize
136KB

Download
memory/4844-36-0x0000018D78CD0000-0x0000018D78CE0000-memory.dmp

Filesize
64KB

Download
memory/4868-15-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp

Filesize
3.9MB

Download
memory/4868-4691-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp

Filesize
3.9MB

Download
memory/4912-288-0x00007FF64CE00000-0x00007FF64D1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-4773-0x00007FF64CE00000-0x00007FF64D1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4920-4801-0x00007FF6B4660000-0x00007FF6B4A52000-memory.dmp

Filesize
3.9MB

Download
memory/4920-139-0x00007FF6B4660000-0x00007FF6B4A52000-memory.dmp

Filesize
3.9MB

Download
memory/4996-174-0x00007FF7AE1C0000-0x00007FF7AE5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-4720-0x00007FF7AE1C0000-0x00007FF7AE5B2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-214-0x00007FF78C720000-0x00007FF78CB12000-memory.dmp

Filesize
3.9MB

Download
memory/5040-4751-0x00007FF78C720000-0x00007FF78CB12000-memory.dmp

Filesize
3.9MB

Download