xmrig | d3f0df90061a84dba9d37b6868c2eeca4c53f60a28ce448da45f0b52201b0a08

Analysis

max time kernel
83s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Size

1.4MB
MD5

0ec640803f1b1bc9856fa8b4ce7d7f95
SHA1

58c6c8aae58d40f736f006aed51484acf7a02949
SHA256

d3f0df90061a84dba9d37b6868c2eeca4c53f60a28ce448da45f0b52201b0a08
SHA512

c6601f1b5035392ebe75acef0b16f42e2bff7fb22243c43ea606c509cc191015314a820d5da6cdbc6153ecf99e036ffff5dc8556fd973797c7576c10be7be280
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VxzCk:Lz071uv4BPMkibTIA5CJRL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2724-21-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2700-22-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2428-104-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2408-154-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2460-156-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2476-2377-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2992-2380-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/240-2705-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2428-2706-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2460-2704-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2724-2802-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2408-3098-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2700-3362-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2852-2450-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/1552-2381-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/1992-2379-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2224-2378-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/1552-143-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/240-140-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/1992-138-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2852-136-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2476-129-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2224-101-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2608	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	qHnIMwM.exe
2724	VJTiGdD.exe
2700	efIAGpm.exe
2460	mLrPxTI.exe
2224	XkZbMyh.exe
2428	sSDMIUm.exe
2476	WgdJGOX.exe
2852	YUUsGGe.exe
1992	NtaneNl.exe
240	VBbpcHt.exe
1552	iMpRYYl.exe
2408	NZBTksf.exe
1128	OXizvhM.exe
1796	ItaxpFa.exe
904	OwYknqz.exe
2632	pzTXjPf.exe
748	jeuZaWZ.exe
1680	snjIlnI.exe
2344	wlyfGye.exe
2132	iISuNxs.exe
1276	JRqyWMB.exe
1524	alPFqre.exe
2368	RkTMEFT.exe
832	BHYvMAM.exe
1104	NzpVtqx.exe
2044	AXaqEIr.exe
2792	raYehHZ.exe
3004	MgaLtKR.exe
476	jYsHuCo.exe
1976	obtHAVg.exe
436	JiUMVJB.exe
2268	RmIFAoy.exe
1864	JkHJJkd.exe
1868	BXbjroH.exe
2080	IUxYSkQ.exe
1488	ZOhHRVE.exe
1800	XcfBOQK.exe
1164	irQALZF.exe
2868	vLXXoVj.exe
2328	asyBJba.exe
2884	gfbpPYY.exe
2256	wwlgccy.exe
1844	GFEuOlj.exe
1364	vqAexNy.exe
868	izLEOPS.exe
836	dqKzVsB.exe
2876	ChLiojP.exe
2856	tfPfICX.exe
2984	BADZteJ.exe
844	qvTYJIa.exe
1580	qENthLF.exe
2976	MACFomt.exe
2836	wZuhNix.exe
1752	OwDSGup.exe
2292	pNaLHBs.exe
2752	IxwTOwB.exe
2052	pzaycsz.exe
2456	FUpxJrO.exe
860	wcZQtMo.exe
2580	dqbWhBK.exe
1132	EbwHNbg.exe
1812	qcdbKWr.exe
940	saSazSZ.exe
2712	OLPrzjf.exe

Loads dropped DLL 64 IoCs

pid	Process
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1760-0-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x000b000000014b6d-3.dat	upx
behavioral1/memory/2992-8-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x002e000000015364-9.dat	upx
behavioral1/memory/2724-21-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2700-22-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x000800000001560a-16.dat	upx
behavioral1/files/0x000f0000000006fd-33.dat	upx
behavioral1/files/0x0007000000015a2d-32.dat	upx
behavioral1/files/0x000f0000000155d4-44.dat	upx
behavioral1/files/0x000a000000015c0d-41.dat	upx
behavioral1/files/0x0006000000016d41-56.dat	upx
behavioral1/files/0x0009000000015e5b-51.dat	upx
behavioral1/files/0x0006000000016d4a-62.dat	upx
behavioral1/files/0x0006000000016d55-72.dat	upx
behavioral1/files/0x0006000000017090-90.dat	upx
behavioral1/files/0x0006000000016e56-83.dat	upx
behavioral1/files/0x0005000000018698-105.dat	upx
behavioral1/files/0x0006000000018ae2-113.dat	upx
behavioral1/files/0x000600000001704f-123.dat	upx
behavioral1/files/0x0006000000018b15-119.dat	upx
behavioral1/memory/2428-104-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0006000000018ae8-116.dat	upx
behavioral1/memory/2408-154-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2460-156-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-158.dat	upx
behavioral1/files/0x0006000000018ae8-145.dat	upx
behavioral1/files/0x0006000000018b4a-165.dat	upx
behavioral1/files/0x0006000000018b6a-169.dat	upx
behavioral1/files/0x00050000000192c9-191.dat	upx
behavioral1/files/0x0006000000018d06-188.dat	upx
behavioral1/files/0x0006000000018b96-178.dat	upx
behavioral1/files/0x0006000000018ba2-186.dat	upx
behavioral1/memory/2476-2377-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2992-2380-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/240-2705-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2428-2706-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2460-2704-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2724-2802-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2408-3098-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2700-3362-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2852-2450-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/1552-2381-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/1992-2379-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2224-2378-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0006000000018b73-175.dat	upx
behavioral1/memory/1552-143-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-141.dat	upx
behavioral1/memory/240-140-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/1992-138-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2852-136-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x000500000001868c-132.dat	upx
behavioral1/files/0x0006000000018b33-152.dat	upx
behavioral1/files/0x0006000000018b37-150.dat	upx
behavioral1/files/0x0006000000018ae2-130.dat	upx
behavioral1/memory/2476-129-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2224-101-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0006000000016d89-78.dat	upx
behavioral1/files/0x0006000000016d84-76.dat	upx
behavioral1/files/0x0006000000016d4f-66.dat	upx
behavioral1/files/0x0006000000016d4f-64.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zZVhJUT.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\VJPhvma.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\XWyomco.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\vbZgbQG.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\nPAEUWc.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\XnMGaZf.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\YdTnxCV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\RYWnEFF.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\sDegXzQ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\LuimgaZ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\pGPXcqb.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xSSOrOK.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\mVzxoSG.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\DTqqouA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\FIBRkaD.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\RUcxCFV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\QnNoUDw.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\plhGDNi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\XalrIah.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\KUlwPpJ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\aCWAXfV.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\BXwvksy.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ofUhqKO.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\lXTeuil.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\FFDeFRS.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\cQcccVP.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\myGDYpM.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\GFEuOlj.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\lvQDRrq.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\ujDQsoZ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\AparpcA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\KNgqFsl.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\XDTJSMi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\VPtGnur.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\SbaOYpP.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\kdOoaBb.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\BCYVsyA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\HAkuGTY.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\SpUeYGt.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TglXuhi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\MQsLKWd.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\McyTiFg.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xtsyYzu.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\roOJbVl.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\acaoGLA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\sSDMIUm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\EEpZAqR.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xJhSouM.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\qENthLF.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\Umocyuu.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\EbwHNbg.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\KekaXpt.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\HEauRvi.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\FxbdDQz.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\wpHevwm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\XMQcrUR.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\YUUsGGe.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\QVheUKJ.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\jHZnLtI.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TfbjMwE.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\xxQARlg.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\TltFncm.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\MgaLtKR.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
File created	C:\Windows\System\slIIBgA.exe	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
Token: SeDebugPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2608	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	29
PID 1760 wrote to memory of 2608	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	29
PID 1760 wrote to memory of 2608	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	29
PID 1760 wrote to memory of 2992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	30
PID 1760 wrote to memory of 2700	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	31
PID 1760 wrote to memory of 2700	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	31
PID 1760 wrote to memory of 2700	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	31
PID 1760 wrote to memory of 2724	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	32
PID 1760 wrote to memory of 2724	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	32
PID 1760 wrote to memory of 2724	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	32
PID 1760 wrote to memory of 2460	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	33
PID 1760 wrote to memory of 2460	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	33
PID 1760 wrote to memory of 2460	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	33
PID 1760 wrote to memory of 2224	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	34
PID 1760 wrote to memory of 2224	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	34
PID 1760 wrote to memory of 2224	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	34
PID 1760 wrote to memory of 2428	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	35
PID 1760 wrote to memory of 2428	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	35
PID 1760 wrote to memory of 2428	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	35
PID 1760 wrote to memory of 2476	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	36
PID 1760 wrote to memory of 2476	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	36
PID 1760 wrote to memory of 2476	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	36
PID 1760 wrote to memory of 2852	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	37
PID 1760 wrote to memory of 2852	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	37
PID 1760 wrote to memory of 2852	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	37
PID 1760 wrote to memory of 1992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	38
PID 1760 wrote to memory of 1992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	38
PID 1760 wrote to memory of 1992	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	38
PID 1760 wrote to memory of 240	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	39
PID 1760 wrote to memory of 240	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	39
PID 1760 wrote to memory of 240	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	39
PID 1760 wrote to memory of 1552	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	40
PID 1760 wrote to memory of 1552	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	40
PID 1760 wrote to memory of 1552	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	40
PID 1760 wrote to memory of 2408	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	41
PID 1760 wrote to memory of 2408	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	41
PID 1760 wrote to memory of 2408	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	41
PID 1760 wrote to memory of 1128	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	42
PID 1760 wrote to memory of 1128	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	42
PID 1760 wrote to memory of 1128	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	42
PID 1760 wrote to memory of 1796	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	43
PID 1760 wrote to memory of 1796	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	43
PID 1760 wrote to memory of 1796	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	43
PID 1760 wrote to memory of 904	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	44
PID 1760 wrote to memory of 904	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	44
PID 1760 wrote to memory of 904	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	44
PID 1760 wrote to memory of 1680	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	45
PID 1760 wrote to memory of 1680	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	45
PID 1760 wrote to memory of 1680	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	45
PID 1760 wrote to memory of 2632	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	46
PID 1760 wrote to memory of 2632	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	46
PID 1760 wrote to memory of 2632	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	46
PID 1760 wrote to memory of 1276	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	47
PID 1760 wrote to memory of 1276	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	47
PID 1760 wrote to memory of 1276	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	47
PID 1760 wrote to memory of 748	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	48
PID 1760 wrote to memory of 748	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	48
PID 1760 wrote to memory of 748	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	48
PID 1760 wrote to memory of 1524	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	49
PID 1760 wrote to memory of 1524	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	49
PID 1760 wrote to memory of 1524	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	49
PID 1760 wrote to memory of 2344	1760	0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec640803f1b1bc9856fa8b4ce7d7f95_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System\qHnIMwM.exe
  C:\Windows\System\qHnIMwM.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\efIAGpm.exe
  C:\Windows\System\efIAGpm.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\VJTiGdD.exe
  C:\Windows\System\VJTiGdD.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\mLrPxTI.exe
  C:\Windows\System\mLrPxTI.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\XkZbMyh.exe
  C:\Windows\System\XkZbMyh.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\sSDMIUm.exe
  C:\Windows\System\sSDMIUm.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\WgdJGOX.exe
  C:\Windows\System\WgdJGOX.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\YUUsGGe.exe
  C:\Windows\System\YUUsGGe.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NtaneNl.exe
  C:\Windows\System\NtaneNl.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\VBbpcHt.exe
  C:\Windows\System\VBbpcHt.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\iMpRYYl.exe
  C:\Windows\System\iMpRYYl.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\NZBTksf.exe
  C:\Windows\System\NZBTksf.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\OXizvhM.exe
  C:\Windows\System\OXizvhM.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ItaxpFa.exe
  C:\Windows\System\ItaxpFa.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\OwYknqz.exe
  C:\Windows\System\OwYknqz.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\snjIlnI.exe
  C:\Windows\System\snjIlnI.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\pzTXjPf.exe
  C:\Windows\System\pzTXjPf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JRqyWMB.exe
  C:\Windows\System\JRqyWMB.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\jeuZaWZ.exe
  C:\Windows\System\jeuZaWZ.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\alPFqre.exe
  C:\Windows\System\alPFqre.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\wlyfGye.exe
  C:\Windows\System\wlyfGye.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\RkTMEFT.exe
  C:\Windows\System\RkTMEFT.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\iISuNxs.exe
  C:\Windows\System\iISuNxs.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\NzpVtqx.exe
  C:\Windows\System\NzpVtqx.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\BHYvMAM.exe
  C:\Windows\System\BHYvMAM.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\AXaqEIr.exe
  C:\Windows\System\AXaqEIr.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\raYehHZ.exe
  C:\Windows\System\raYehHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\MgaLtKR.exe
  C:\Windows\System\MgaLtKR.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\jYsHuCo.exe
  C:\Windows\System\jYsHuCo.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\obtHAVg.exe
  C:\Windows\System\obtHAVg.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\JiUMVJB.exe
  C:\Windows\System\JiUMVJB.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\IUxYSkQ.exe
  C:\Windows\System\IUxYSkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\RmIFAoy.exe
  C:\Windows\System\RmIFAoy.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\GFEuOlj.exe
  C:\Windows\System\GFEuOlj.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\JkHJJkd.exe
  C:\Windows\System\JkHJJkd.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\vqAexNy.exe
  C:\Windows\System\vqAexNy.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\BXbjroH.exe
  C:\Windows\System\BXbjroH.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ChLiojP.exe
  C:\Windows\System\ChLiojP.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ZOhHRVE.exe
  C:\Windows\System\ZOhHRVE.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\BADZteJ.exe
  C:\Windows\System\BADZteJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\XcfBOQK.exe
  C:\Windows\System\XcfBOQK.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\qvTYJIa.exe
  C:\Windows\System\qvTYJIa.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\irQALZF.exe
  C:\Windows\System\irQALZF.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\MACFomt.exe
  C:\Windows\System\MACFomt.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\vLXXoVj.exe
  C:\Windows\System\vLXXoVj.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\wZuhNix.exe
  C:\Windows\System\wZuhNix.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\asyBJba.exe
  C:\Windows\System\asyBJba.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\OwDSGup.exe
  C:\Windows\System\OwDSGup.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\gfbpPYY.exe
  C:\Windows\System\gfbpPYY.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\pNaLHBs.exe
  C:\Windows\System\pNaLHBs.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\wwlgccy.exe
  C:\Windows\System\wwlgccy.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\cGFikEY.exe
  C:\Windows\System\cGFikEY.exe
  2⤵
  PID:2056
- C:\Windows\System\izLEOPS.exe
  C:\Windows\System\izLEOPS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mFzDAiv.exe
  C:\Windows\System\mFzDAiv.exe
  2⤵
  PID:1956
- C:\Windows\System\dqKzVsB.exe
  C:\Windows\System\dqKzVsB.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\axjZWom.exe
  C:\Windows\System\axjZWom.exe
  2⤵
  PID:1108
- C:\Windows\System\tfPfICX.exe
  C:\Windows\System\tfPfICX.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\oTnOFAd.exe
  C:\Windows\System\oTnOFAd.exe
  2⤵
  PID:1584
- C:\Windows\System\qENthLF.exe
  C:\Windows\System\qENthLF.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\QVheUKJ.exe
  C:\Windows\System\QVheUKJ.exe
  2⤵
  PID:2552
- C:\Windows\System\IxwTOwB.exe
  C:\Windows\System\IxwTOwB.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\YQJeBub.exe
  C:\Windows\System\YQJeBub.exe
  2⤵
  PID:2740
- C:\Windows\System\pzaycsz.exe
  C:\Windows\System\pzaycsz.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\Gwjmsnr.exe
  C:\Windows\System\Gwjmsnr.exe
  2⤵
  PID:2592
- C:\Windows\System\FUpxJrO.exe
  C:\Windows\System\FUpxJrO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ILzvSdE.exe
  C:\Windows\System\ILzvSdE.exe
  2⤵
  PID:752
- C:\Windows\System\wcZQtMo.exe
  C:\Windows\System\wcZQtMo.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\dEJUYzj.exe
  C:\Windows\System\dEJUYzj.exe
  2⤵
  PID:1568
- C:\Windows\System\dqbWhBK.exe
  C:\Windows\System\dqbWhBK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\AkETCPu.exe
  C:\Windows\System\AkETCPu.exe
  2⤵
  PID:280
- C:\Windows\System\EbwHNbg.exe
  C:\Windows\System\EbwHNbg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\CLSvoin.exe
  C:\Windows\System\CLSvoin.exe
  2⤵
  PID:2352
- C:\Windows\System\qcdbKWr.exe
  C:\Windows\System\qcdbKWr.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\zSetVbS.exe
  C:\Windows\System\zSetVbS.exe
  2⤵
  PID:1480
- C:\Windows\System\saSazSZ.exe
  C:\Windows\System\saSazSZ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\RRupSDh.exe
  C:\Windows\System\RRupSDh.exe
  2⤵
  PID:1872
- C:\Windows\System\OLPrzjf.exe
  C:\Windows\System\OLPrzjf.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\RbGZFUg.exe
  C:\Windows\System\RbGZFUg.exe
  2⤵
  PID:2636
- C:\Windows\System\jfSTYza.exe
  C:\Windows\System\jfSTYza.exe
  2⤵
  PID:2676
- C:\Windows\System\fzmsxox.exe
  C:\Windows\System\fzmsxox.exe
  2⤵
  PID:1792
- C:\Windows\System\tFyEnYF.exe
  C:\Windows\System\tFyEnYF.exe
  2⤵
  PID:2864
- C:\Windows\System\yrCtnlK.exe
  C:\Windows\System\yrCtnlK.exe
  2⤵
  PID:3024
- C:\Windows\System\LFJtJoD.exe
  C:\Windows\System\LFJtJoD.exe
  2⤵
  PID:1152
- C:\Windows\System\EpoRTLi.exe
  C:\Windows\System\EpoRTLi.exe
  2⤵
  PID:1156
- C:\Windows\System\crXRELp.exe
  C:\Windows\System\crXRELp.exe
  2⤵
  PID:1916
- C:\Windows\System\GflGUZD.exe
  C:\Windows\System\GflGUZD.exe
  2⤵
  PID:1304
- C:\Windows\System\dNbdtdu.exe
  C:\Windows\System\dNbdtdu.exe
  2⤵
  PID:1516
- C:\Windows\System\KsLNcnc.exe
  C:\Windows\System\KsLNcnc.exe
  2⤵
  PID:1636
- C:\Windows\System\kHNJtLX.exe
  C:\Windows\System\kHNJtLX.exe
  2⤵
  PID:1620
- C:\Windows\System\OeCwLMD.exe
  C:\Windows\System\OeCwLMD.exe
  2⤵
  PID:2540
- C:\Windows\System\hbywrQX.exe
  C:\Windows\System\hbywrQX.exe
  2⤵
  PID:840
- C:\Windows\System\amdevHA.exe
  C:\Windows\System\amdevHA.exe
  2⤵
  PID:1300
- C:\Windows\System\WhxApNt.exe
  C:\Windows\System\WhxApNt.exe
  2⤵
  PID:2660
- C:\Windows\System\nPAEUWc.exe
  C:\Windows\System\nPAEUWc.exe
  2⤵
  PID:1736
- C:\Windows\System\YNbrxDA.exe
  C:\Windows\System\YNbrxDA.exe
  2⤵
  PID:3044
- C:\Windows\System\ewLnzyW.exe
  C:\Windows\System\ewLnzyW.exe
  2⤵
  PID:1384
- C:\Windows\System\JLqpWMp.exe
  C:\Windows\System\JLqpWMp.exe
  2⤵
  PID:564
- C:\Windows\System\gqponZT.exe
  C:\Windows\System\gqponZT.exe
  2⤵
  PID:2304
- C:\Windows\System\NpSKKgp.exe
  C:\Windows\System\NpSKKgp.exe
  2⤵
  PID:872
- C:\Windows\System\qyGGRmO.exe
  C:\Windows\System\qyGGRmO.exe
  2⤵
  PID:2768
- C:\Windows\System\CYBTgna.exe
  C:\Windows\System\CYBTgna.exe
  2⤵
  PID:772
- C:\Windows\System\mLhGmiQ.exe
  C:\Windows\System\mLhGmiQ.exe
  2⤵
  PID:112
- C:\Windows\System\tPOJXlx.exe
  C:\Windows\System\tPOJXlx.exe
  2⤵
  PID:1652
- C:\Windows\System\wYXzBEw.exe
  C:\Windows\System\wYXzBEw.exe
  2⤵
  PID:2036
- C:\Windows\System\TEcBisf.exe
  C:\Windows\System\TEcBisf.exe
  2⤵
  PID:1948
- C:\Windows\System\bPhtCJg.exe
  C:\Windows\System\bPhtCJg.exe
  2⤵
  PID:3032
- C:\Windows\System\zhtyWDR.exe
  C:\Windows\System\zhtyWDR.exe
  2⤵
  PID:620
- C:\Windows\System\KliXNUb.exe
  C:\Windows\System\KliXNUb.exe
  2⤵
  PID:324
- C:\Windows\System\UIxKStF.exe
  C:\Windows\System\UIxKStF.exe
  2⤵
  PID:2688
- C:\Windows\System\Lmhekso.exe
  C:\Windows\System\Lmhekso.exe
  2⤵
  PID:1100
- C:\Windows\System\ffQiThe.exe
  C:\Windows\System\ffQiThe.exe
  2⤵
  PID:944
- C:\Windows\System\cvGDPnu.exe
  C:\Windows\System\cvGDPnu.exe
  2⤵
  PID:712
- C:\Windows\System\MMTlFCn.exe
  C:\Windows\System\MMTlFCn.exe
  2⤵
  PID:2500
- C:\Windows\System\HLjRKgP.exe
  C:\Windows\System\HLjRKgP.exe
  2⤵
  PID:2656
- C:\Windows\System\dImghwu.exe
  C:\Windows\System\dImghwu.exe
  2⤵
  PID:1920
- C:\Windows\System\eNCgasS.exe
  C:\Windows\System\eNCgasS.exe
  2⤵
  PID:2004
- C:\Windows\System\FFQQwcW.exe
  C:\Windows\System\FFQQwcW.exe
  2⤵
  PID:2704
- C:\Windows\System\bPqDZLI.exe
  C:\Windows\System\bPqDZLI.exe
  2⤵
  PID:2120
- C:\Windows\System\jpWWsfS.exe
  C:\Windows\System\jpWWsfS.exe
  2⤵
  PID:2128
- C:\Windows\System\lrWAsfL.exe
  C:\Windows\System\lrWAsfL.exe
  2⤵
  PID:2524
- C:\Windows\System\GBqoYgN.exe
  C:\Windows\System\GBqoYgN.exe
  2⤵
  PID:2172
- C:\Windows\System\dluYJcO.exe
  C:\Windows\System\dluYJcO.exe
  2⤵
  PID:1848
- C:\Windows\System\PsCYDHo.exe
  C:\Windows\System\PsCYDHo.exe
  2⤵
  PID:2400
- C:\Windows\System\NIXxmWb.exe
  C:\Windows\System\NIXxmWb.exe
  2⤵
  PID:2248
- C:\Windows\System\NfeLuuc.exe
  C:\Windows\System\NfeLuuc.exe
  2⤵
  PID:2708
- C:\Windows\System\NWegUyy.exe
  C:\Windows\System\NWegUyy.exe
  2⤵
  PID:1544
- C:\Windows\System\HjZrtLb.exe
  C:\Windows\System\HjZrtLb.exe
  2⤵
  PID:1388
- C:\Windows\System\TglXuhi.exe
  C:\Windows\System\TglXuhi.exe
  2⤵
  PID:2612
- C:\Windows\System\gBUvJVb.exe
  C:\Windows\System\gBUvJVb.exe
  2⤵
  PID:1008
- C:\Windows\System\oVCQJDg.exe
  C:\Windows\System\oVCQJDg.exe
  2⤵
  PID:2616
- C:\Windows\System\wmWYkeC.exe
  C:\Windows\System\wmWYkeC.exe
  2⤵
  PID:1332
- C:\Windows\System\MYfSdBZ.exe
  C:\Windows\System\MYfSdBZ.exe
  2⤵
  PID:1240
- C:\Windows\System\JdhPqJl.exe
  C:\Windows\System\JdhPqJl.exe
  2⤵
  PID:2308
- C:\Windows\System\IuilpPe.exe
  C:\Windows\System\IuilpPe.exe
  2⤵
  PID:2784
- C:\Windows\System\hmoFmCY.exe
  C:\Windows\System\hmoFmCY.exe
  2⤵
  PID:1268
- C:\Windows\System\aMsFuFA.exe
  C:\Windows\System\aMsFuFA.exe
  2⤵
  PID:1660
- C:\Windows\System\slIIBgA.exe
  C:\Windows\System\slIIBgA.exe
  2⤵
  PID:3084
- C:\Windows\System\mFNjFQs.exe
  C:\Windows\System\mFNjFQs.exe
  2⤵
  PID:3100
- C:\Windows\System\XORJKvt.exe
  C:\Windows\System\XORJKvt.exe
  2⤵
  PID:3116
- C:\Windows\System\CswbGUa.exe
  C:\Windows\System\CswbGUa.exe
  2⤵
  PID:3132
- C:\Windows\System\gBzNrMT.exe
  C:\Windows\System\gBzNrMT.exe
  2⤵
  PID:3156
- C:\Windows\System\OdEWjdn.exe
  C:\Windows\System\OdEWjdn.exe
  2⤵
  PID:3172
- C:\Windows\System\FJsiqtg.exe
  C:\Windows\System\FJsiqtg.exe
  2⤵
  PID:3188
- C:\Windows\System\dlNySki.exe
  C:\Windows\System\dlNySki.exe
  2⤵
  PID:3208
- C:\Windows\System\dyaySSi.exe
  C:\Windows\System\dyaySSi.exe
  2⤵
  PID:3224
- C:\Windows\System\mOsDpmT.exe
  C:\Windows\System\mOsDpmT.exe
  2⤵
  PID:3240
- C:\Windows\System\cOUsjrx.exe
  C:\Windows\System\cOUsjrx.exe
  2⤵
  PID:3256
- C:\Windows\System\usWZCQO.exe
  C:\Windows\System\usWZCQO.exe
  2⤵
  PID:3272
- C:\Windows\System\CXYCCjt.exe
  C:\Windows\System\CXYCCjt.exe
  2⤵
  PID:3288
- C:\Windows\System\jChxjva.exe
  C:\Windows\System\jChxjva.exe
  2⤵
  PID:3304
- C:\Windows\System\tSugjij.exe
  C:\Windows\System\tSugjij.exe
  2⤵
  PID:3324
- C:\Windows\System\GqEXZgc.exe
  C:\Windows\System\GqEXZgc.exe
  2⤵
  PID:3340
- C:\Windows\System\wvKWYUh.exe
  C:\Windows\System\wvKWYUh.exe
  2⤵
  PID:3356
- C:\Windows\System\SARUOLg.exe
  C:\Windows\System\SARUOLg.exe
  2⤵
  PID:3372
- C:\Windows\System\dWmtlcb.exe
  C:\Windows\System\dWmtlcb.exe
  2⤵
  PID:3392
- C:\Windows\System\JzSNceO.exe
  C:\Windows\System\JzSNceO.exe
  2⤵
  PID:3416
- C:\Windows\System\rQpnnRL.exe
  C:\Windows\System\rQpnnRL.exe
  2⤵
  PID:3436
- C:\Windows\System\XnMGaZf.exe
  C:\Windows\System\XnMGaZf.exe
  2⤵
  PID:3452
- C:\Windows\System\KsPiELx.exe
  C:\Windows\System\KsPiELx.exe
  2⤵
  PID:3532
- C:\Windows\System\iSUxMAa.exe
  C:\Windows\System\iSUxMAa.exe
  2⤵
  PID:3552
- C:\Windows\System\gzRlCms.exe
  C:\Windows\System\gzRlCms.exe
  2⤵
  PID:3568
- C:\Windows\System\NMSpNGV.exe
  C:\Windows\System\NMSpNGV.exe
  2⤵
  PID:3588
- C:\Windows\System\CPwKvQx.exe
  C:\Windows\System\CPwKvQx.exe
  2⤵
  PID:3604
- C:\Windows\System\NSJugMG.exe
  C:\Windows\System\NSJugMG.exe
  2⤵
  PID:3620
- C:\Windows\System\paHSZil.exe
  C:\Windows\System\paHSZil.exe
  2⤵
  PID:3636
- C:\Windows\System\qgEcKPR.exe
  C:\Windows\System\qgEcKPR.exe
  2⤵
  PID:3652
- C:\Windows\System\goJHDvl.exe
  C:\Windows\System\goJHDvl.exe
  2⤵
  PID:3756
- C:\Windows\System\lmNYlxE.exe
  C:\Windows\System\lmNYlxE.exe
  2⤵
  PID:3772
- C:\Windows\System\OYSSDRk.exe
  C:\Windows\System\OYSSDRk.exe
  2⤵
  PID:3788
- C:\Windows\System\dxXZWdf.exe
  C:\Windows\System\dxXZWdf.exe
  2⤵
  PID:3804
- C:\Windows\System\ZcQeVEa.exe
  C:\Windows\System\ZcQeVEa.exe
  2⤵
  PID:3820
- C:\Windows\System\tqWmofz.exe
  C:\Windows\System\tqWmofz.exe
  2⤵
  PID:3836
- C:\Windows\System\GuHwBQz.exe
  C:\Windows\System\GuHwBQz.exe
  2⤵
  PID:3852
- C:\Windows\System\qZRDZnx.exe
  C:\Windows\System\qZRDZnx.exe
  2⤵
  PID:3868
- C:\Windows\System\xYLcHoO.exe
  C:\Windows\System\xYLcHoO.exe
  2⤵
  PID:3884
- C:\Windows\System\FYQKDLV.exe
  C:\Windows\System\FYQKDLV.exe
  2⤵
  PID:3900
- C:\Windows\System\tKvhgBS.exe
  C:\Windows\System\tKvhgBS.exe
  2⤵
  PID:3916
- C:\Windows\System\kbzLaaD.exe
  C:\Windows\System\kbzLaaD.exe
  2⤵
  PID:3932
- C:\Windows\System\QCOXxcn.exe
  C:\Windows\System\QCOXxcn.exe
  2⤵
  PID:4060
- C:\Windows\System\wEQHeav.exe
  C:\Windows\System\wEQHeav.exe
  2⤵
  PID:4076
- C:\Windows\System\zzYSiEL.exe
  C:\Windows\System\zzYSiEL.exe
  2⤵
  PID:4092
- C:\Windows\System\weyhBZh.exe
  C:\Windows\System\weyhBZh.exe
  2⤵
  PID:2000
- C:\Windows\System\oQzuZXn.exe
  C:\Windows\System\oQzuZXn.exe
  2⤵
  PID:2840
- C:\Windows\System\GiZWOeO.exe
  C:\Windows\System\GiZWOeO.exe
  2⤵
  PID:1292
- C:\Windows\System\wbCqGfq.exe
  C:\Windows\System\wbCqGfq.exe
  2⤵
  PID:2084
- C:\Windows\System\AmdqMXA.exe
  C:\Windows\System\AmdqMXA.exe
  2⤵
  PID:3108
- C:\Windows\System\uhWqRDd.exe
  C:\Windows\System\uhWqRDd.exe
  2⤵
  PID:3216
- C:\Windows\System\WmaFqQZ.exe
  C:\Windows\System\WmaFqQZ.exe
  2⤵
  PID:1964
- C:\Windows\System\jnMtfLG.exe
  C:\Windows\System\jnMtfLG.exe
  2⤵
  PID:2380
- C:\Windows\System\fwxOVUB.exe
  C:\Windows\System\fwxOVUB.exe
  2⤵
  PID:2444
- C:\Windows\System\OpJpRPa.exe
  C:\Windows\System\OpJpRPa.exe
  2⤵
  PID:3468
- C:\Windows\System\iphKDua.exe
  C:\Windows\System\iphKDua.exe
  2⤵
  PID:1648
- C:\Windows\System\UZgFeTY.exe
  C:\Windows\System\UZgFeTY.exe
  2⤵
  PID:3484
- C:\Windows\System\iUkoJik.exe
  C:\Windows\System\iUkoJik.exe
  2⤵
  PID:2772
- C:\Windows\System\fcpzXLS.exe
  C:\Windows\System\fcpzXLS.exe
  2⤵
  PID:1728
- C:\Windows\System\bUfZIUa.exe
  C:\Windows\System\bUfZIUa.exe
  2⤵
  PID:3152
- C:\Windows\System\unmLowV.exe
  C:\Windows\System\unmLowV.exe
  2⤵
  PID:3180
- C:\Windows\System\oPxJSwQ.exe
  C:\Windows\System\oPxJSwQ.exe
  2⤵
  PID:2348
- C:\Windows\System\uBxENuf.exe
  C:\Windows\System\uBxENuf.exe
  2⤵
  PID:2596
- C:\Windows\System\RWspQMr.exe
  C:\Windows\System\RWspQMr.exe
  2⤵
  PID:3168
- C:\Windows\System\SDUBCog.exe
  C:\Windows\System\SDUBCog.exe
  2⤵
  PID:3232
- C:\Windows\System\siiMpcw.exe
  C:\Windows\System\siiMpcw.exe
  2⤵
  PID:3300
- C:\Windows\System\RUwapcf.exe
  C:\Windows\System\RUwapcf.exe
  2⤵
  PID:3368
- C:\Windows\System\LKIiEKy.exe
  C:\Windows\System\LKIiEKy.exe
  2⤵
  PID:3860
- C:\Windows\System\TECjkhZ.exe
  C:\Windows\System\TECjkhZ.exe
  2⤵
  PID:3248
- C:\Windows\System\jzrrGLc.exe
  C:\Windows\System\jzrrGLc.exe
  2⤵
  PID:2164
- C:\Windows\System\KekaXpt.exe
  C:\Windows\System\KekaXpt.exe
  2⤵
  PID:3352
- C:\Windows\System\EQCTekV.exe
  C:\Windows\System\EQCTekV.exe
  2⤵
  PID:3432
- C:\Windows\System\ivrZXOe.exe
  C:\Windows\System\ivrZXOe.exe
  2⤵
  PID:3492
- C:\Windows\System\DyOQqCi.exe
  C:\Windows\System\DyOQqCi.exe
  2⤵
  PID:3512
- C:\Windows\System\JEZWKkV.exe
  C:\Windows\System\JEZWKkV.exe
  2⤵
  PID:3812
- C:\Windows\System\NjVOrjV.exe
  C:\Windows\System\NjVOrjV.exe
  2⤵
  PID:2804
- C:\Windows\System\WdIewyq.exe
  C:\Windows\System\WdIewyq.exe
  2⤵
  PID:3600
- C:\Windows\System\EEpZAqR.exe
  C:\Windows\System\EEpZAqR.exe
  2⤵
  PID:3668
- C:\Windows\System\MuNEztL.exe
  C:\Windows\System\MuNEztL.exe
  2⤵
  PID:3684
- C:\Windows\System\kOYNFhJ.exe
  C:\Windows\System\kOYNFhJ.exe
  2⤵
  PID:3700
- C:\Windows\System\TGFNCKd.exe
  C:\Windows\System\TGFNCKd.exe
  2⤵
  PID:3716
- C:\Windows\System\UnfmWmb.exe
  C:\Windows\System\UnfmWmb.exe
  2⤵
  PID:3736
- C:\Windows\System\fCuwLYs.exe
  C:\Windows\System\fCuwLYs.exe
  2⤵
  PID:3752
- C:\Windows\System\MfjZLTf.exe
  C:\Windows\System\MfjZLTf.exe
  2⤵
  PID:3880
- C:\Windows\System\nNXpqYD.exe
  C:\Windows\System\nNXpqYD.exe
  2⤵
  PID:4000
- C:\Windows\System\KnlQmKl.exe
  C:\Windows\System\KnlQmKl.exe
  2⤵
  PID:2008
- C:\Windows\System\BXwvksy.exe
  C:\Windows\System\BXwvksy.exe
  2⤵
  PID:2860
- C:\Windows\System\ImsqWdC.exe
  C:\Windows\System\ImsqWdC.exe
  2⤵
  PID:2020
- C:\Windows\System\APShMJS.exe
  C:\Windows\System\APShMJS.exe
  2⤵
  PID:1312
- C:\Windows\System\VkFUKKg.exe
  C:\Windows\System\VkFUKKg.exe
  2⤵
  PID:2412
- C:\Windows\System\KXBdcsn.exe
  C:\Windows\System\KXBdcsn.exe
  2⤵
  PID:1772
- C:\Windows\System\hmZjwUZ.exe
  C:\Windows\System\hmZjwUZ.exe
  2⤵
  PID:4040
- C:\Windows\System\uCXTaVh.exe
  C:\Windows\System\uCXTaVh.exe
  2⤵
  PID:2796
- C:\Windows\System\mVzxoSG.exe
  C:\Windows\System\mVzxoSG.exe
  2⤵
  PID:3204
- C:\Windows\System\vENjZCz.exe
  C:\Windows\System\vENjZCz.exe
  2⤵
  PID:1960
- C:\Windows\System\FBzMiih.exe
  C:\Windows\System\FBzMiih.exe
  2⤵
  PID:2512
- C:\Windows\System\ersQPAj.exe
  C:\Windows\System\ersQPAj.exe
  2⤵
  PID:3488
- C:\Windows\System\iIUHbdr.exe
  C:\Windows\System\iIUHbdr.exe
  2⤵
  PID:2240
- C:\Windows\System\OIHBcpQ.exe
  C:\Windows\System\OIHBcpQ.exe
  2⤵
  PID:3128
- C:\Windows\System\gyQNmND.exe
  C:\Windows\System\gyQNmND.exe
  2⤵
  PID:3404
- C:\Windows\System\jKfxrTH.exe
  C:\Windows\System\jKfxrTH.exe
  2⤵
  PID:3448
- C:\Windows\System\FlCYsAu.exe
  C:\Windows\System\FlCYsAu.exe
  2⤵
  PID:3892
- C:\Windows\System\yeLOpAQ.exe
  C:\Windows\System\yeLOpAQ.exe
  2⤵
  PID:3548
- C:\Windows\System\nOthDLk.exe
  C:\Windows\System\nOthDLk.exe
  2⤵
  PID:3528
- C:\Windows\System\VDtyOmE.exe
  C:\Windows\System\VDtyOmE.exe
  2⤵
  PID:2648
- C:\Windows\System\DcybOxQ.exe
  C:\Windows\System\DcybOxQ.exe
  2⤵
  PID:644
- C:\Windows\System\pNBAWjd.exe
  C:\Windows\System\pNBAWjd.exe
  2⤵
  PID:3924
- C:\Windows\System\jHoagOM.exe
  C:\Windows\System\jHoagOM.exe
  2⤵
  PID:1624
- C:\Windows\System\yAjmgfQ.exe
  C:\Windows\System\yAjmgfQ.exe
  2⤵
  PID:3496
- C:\Windows\System\hcPCbdB.exe
  C:\Windows\System\hcPCbdB.exe
  2⤵
  PID:2284
- C:\Windows\System\NuFTUQa.exe
  C:\Windows\System\NuFTUQa.exe
  2⤵
  PID:2148
- C:\Windows\System\BmTfspR.exe
  C:\Windows\System\BmTfspR.exe
  2⤵
  PID:3672
- C:\Windows\System\iYrRfhv.exe
  C:\Windows\System\iYrRfhv.exe
  2⤵
  PID:4056
- C:\Windows\System\aoXqImP.exe
  C:\Windows\System\aoXqImP.exe
  2⤵
  PID:3940
- C:\Windows\System\IoyfMHW.exe
  C:\Windows\System\IoyfMHW.exe
  2⤵
  PID:2104
- C:\Windows\System\LVeCsgi.exe
  C:\Windows\System\LVeCsgi.exe
  2⤵
  PID:1256
- C:\Windows\System\TEcjvzg.exe
  C:\Windows\System\TEcjvzg.exe
  2⤵
  PID:2424
- C:\Windows\System\MlgoFfu.exe
  C:\Windows\System\MlgoFfu.exe
  2⤵
  PID:3780
- C:\Windows\System\McyTiFg.exe
  C:\Windows\System\McyTiFg.exe
  2⤵
  PID:3692
- C:\Windows\System\vLxshLi.exe
  C:\Windows\System\vLxshLi.exe
  2⤵
  PID:3848
- C:\Windows\System\zZVhJUT.exe
  C:\Windows\System\zZVhJUT.exe
  2⤵
  PID:2576
- C:\Windows\System\CdtrlUO.exe
  C:\Windows\System\CdtrlUO.exe
  2⤵
  PID:3080
- C:\Windows\System\DhoBWVy.exe
  C:\Windows\System\DhoBWVy.exe
  2⤵
  PID:3112
- C:\Windows\System\GooUWdq.exe
  C:\Windows\System\GooUWdq.exe
  2⤵
  PID:3268
- C:\Windows\System\KqiFpOW.exe
  C:\Windows\System\KqiFpOW.exe
  2⤵
  PID:3200
- C:\Windows\System\UsORtwG.exe
  C:\Windows\System\UsORtwG.exe
  2⤵
  PID:400
- C:\Windows\System\UjDInZZ.exe
  C:\Windows\System\UjDInZZ.exe
  2⤵
  PID:3220
- C:\Windows\System\Vqfgujm.exe
  C:\Windows\System\Vqfgujm.exe
  2⤵
  PID:3764
- C:\Windows\System\nMuboKX.exe
  C:\Windows\System\nMuboKX.exe
  2⤵
  PID:3144
- C:\Windows\System\wIvMOko.exe
  C:\Windows\System\wIvMOko.exe
  2⤵
  PID:3832
- C:\Windows\System\woSrotm.exe
  C:\Windows\System\woSrotm.exe
  2⤵
  PID:932
- C:\Windows\System\whgepiG.exe
  C:\Windows\System\whgepiG.exe
  2⤵
  PID:3896
- C:\Windows\System\BVUHwSD.exe
  C:\Windows\System\BVUHwSD.exe
  2⤵
  PID:3312
- C:\Windows\System\FgzJIHU.exe
  C:\Windows\System\FgzJIHU.exe
  2⤵
  PID:1288
- C:\Windows\System\MQsLKWd.exe
  C:\Windows\System\MQsLKWd.exe
  2⤵
  PID:3580
- C:\Windows\System\lhLvfQS.exe
  C:\Windows\System\lhLvfQS.exe
  2⤵
  PID:3400
- C:\Windows\System\bIBYqMa.exe
  C:\Windows\System\bIBYqMa.exe
  2⤵
  PID:1984
- C:\Windows\System\nkTvoaq.exe
  C:\Windows\System\nkTvoaq.exe
  2⤵
  PID:3616
- C:\Windows\System\HQuftZh.exe
  C:\Windows\System\HQuftZh.exe
  2⤵
  PID:3712
- C:\Windows\System\rNdHqnv.exe
  C:\Windows\System\rNdHqnv.exe
  2⤵
  PID:4028
- C:\Windows\System\dYWsjKd.exe
  C:\Windows\System\dYWsjKd.exe
  2⤵
  PID:3576
- C:\Windows\System\hCLlzqG.exe
  C:\Windows\System\hCLlzqG.exe
  2⤵
  PID:3996
- C:\Windows\System\EiGlppi.exe
  C:\Windows\System\EiGlppi.exe
  2⤵
  PID:3500
- C:\Windows\System\YPMMdKr.exe
  C:\Windows\System\YPMMdKr.exe
  2⤵
  PID:1208
- C:\Windows\System\PtdARnl.exe
  C:\Windows\System\PtdARnl.exe
  2⤵
  PID:1192
- C:\Windows\System\JckUiRP.exe
  C:\Windows\System\JckUiRP.exe
  2⤵
  PID:3000
- C:\Windows\System\DsNauoq.exe
  C:\Windows\System\DsNauoq.exe
  2⤵
  PID:1324
- C:\Windows\System\DTqqouA.exe
  C:\Windows\System\DTqqouA.exe
  2⤵
  PID:4068
- C:\Windows\System\AnZuIek.exe
  C:\Windows\System\AnZuIek.exe
  2⤵
  PID:4084
- C:\Windows\System\hGbTVcO.exe
  C:\Windows\System\hGbTVcO.exe
  2⤵
  PID:3124
- C:\Windows\System\EJGnXvO.exe
  C:\Windows\System\EJGnXvO.exe
  2⤵
  PID:3428
- C:\Windows\System\IAYBrmz.exe
  C:\Windows\System\IAYBrmz.exe
  2⤵
  PID:3564
- C:\Windows\System\jWoPlez.exe
  C:\Windows\System\jWoPlez.exe
  2⤵
  PID:3092
- C:\Windows\System\WeUucGs.exe
  C:\Windows\System\WeUucGs.exe
  2⤵
  PID:4108
- C:\Windows\System\HEauRvi.exe
  C:\Windows\System\HEauRvi.exe
  2⤵
  PID:4128
- C:\Windows\System\opiNrKL.exe
  C:\Windows\System\opiNrKL.exe
  2⤵
  PID:4144
- C:\Windows\System\YInmgDn.exe
  C:\Windows\System\YInmgDn.exe
  2⤵
  PID:4160
- C:\Windows\System\yalUBql.exe
  C:\Windows\System\yalUBql.exe
  2⤵
  PID:4176
- C:\Windows\System\PwBzOTl.exe
  C:\Windows\System\PwBzOTl.exe
  2⤵
  PID:4208
- C:\Windows\System\eeYiaWb.exe
  C:\Windows\System\eeYiaWb.exe
  2⤵
  PID:4232
- C:\Windows\System\WmpaJNa.exe
  C:\Windows\System\WmpaJNa.exe
  2⤵
  PID:4252
- C:\Windows\System\RFhcLcM.exe
  C:\Windows\System\RFhcLcM.exe
  2⤵
  PID:4268
- C:\Windows\System\kvYPAlT.exe
  C:\Windows\System\kvYPAlT.exe
  2⤵
  PID:4284
- C:\Windows\System\vOopVLi.exe
  C:\Windows\System\vOopVLi.exe
  2⤵
  PID:4300
- C:\Windows\System\CkfMupw.exe
  C:\Windows\System\CkfMupw.exe
  2⤵
  PID:4320
- C:\Windows\System\ZQxWxbW.exe
  C:\Windows\System\ZQxWxbW.exe
  2⤵
  PID:4336
- C:\Windows\System\MToNBPO.exe
  C:\Windows\System\MToNBPO.exe
  2⤵
  PID:4352
- C:\Windows\System\gSNmYzV.exe
  C:\Windows\System\gSNmYzV.exe
  2⤵
  PID:4368
- C:\Windows\System\uPgjCds.exe
  C:\Windows\System\uPgjCds.exe
  2⤵
  PID:4388
- C:\Windows\System\ofUhqKO.exe
  C:\Windows\System\ofUhqKO.exe
  2⤵
  PID:4404
- C:\Windows\System\VyDToKA.exe
  C:\Windows\System\VyDToKA.exe
  2⤵
  PID:4420
- C:\Windows\System\RBMSEXM.exe
  C:\Windows\System\RBMSEXM.exe
  2⤵
  PID:4436
- C:\Windows\System\LmyGrer.exe
  C:\Windows\System\LmyGrer.exe
  2⤵
  PID:4460
- C:\Windows\System\vyNVHGQ.exe
  C:\Windows\System\vyNVHGQ.exe
  2⤵
  PID:4476
- C:\Windows\System\nwQEJkN.exe
  C:\Windows\System\nwQEJkN.exe
  2⤵
  PID:4492
- C:\Windows\System\KdLevva.exe
  C:\Windows\System\KdLevva.exe
  2⤵
  PID:4508
- C:\Windows\System\wpCMFky.exe
  C:\Windows\System\wpCMFky.exe
  2⤵
  PID:4524
- C:\Windows\System\BXYUbYb.exe
  C:\Windows\System\BXYUbYb.exe
  2⤵
  PID:4540
- C:\Windows\System\XZUKuWZ.exe
  C:\Windows\System\XZUKuWZ.exe
  2⤵
  PID:4580
- C:\Windows\System\EPAjkJJ.exe
  C:\Windows\System\EPAjkJJ.exe
  2⤵
  PID:4596
- C:\Windows\System\qfUzcof.exe
  C:\Windows\System\qfUzcof.exe
  2⤵
  PID:4612
- C:\Windows\System\iWpQiYr.exe
  C:\Windows\System\iWpQiYr.exe
  2⤵
  PID:4636
- C:\Windows\System\jCdSuRi.exe
  C:\Windows\System\jCdSuRi.exe
  2⤵
  PID:4660
- C:\Windows\System\CfANqMU.exe
  C:\Windows\System\CfANqMU.exe
  2⤵
  PID:4752
- C:\Windows\System\PwbADdm.exe
  C:\Windows\System\PwbADdm.exe
  2⤵
  PID:4768
- C:\Windows\System\wjdsxFY.exe
  C:\Windows\System\wjdsxFY.exe
  2⤵
  PID:4784
- C:\Windows\System\WjmGNOA.exe
  C:\Windows\System\WjmGNOA.exe
  2⤵
  PID:4800
- C:\Windows\System\abFIqES.exe
  C:\Windows\System\abFIqES.exe
  2⤵
  PID:4816
- C:\Windows\System\Mqtqeck.exe
  C:\Windows\System\Mqtqeck.exe
  2⤵
  PID:4832
- C:\Windows\System\FxbdDQz.exe
  C:\Windows\System\FxbdDQz.exe
  2⤵
  PID:4848
- C:\Windows\System\ZQXIbcb.exe
  C:\Windows\System\ZQXIbcb.exe
  2⤵
  PID:4864
- C:\Windows\System\wQGCBhv.exe
  C:\Windows\System\wQGCBhv.exe
  2⤵
  PID:4880
- C:\Windows\System\xIdhydd.exe
  C:\Windows\System\xIdhydd.exe
  2⤵
  PID:4900
- C:\Windows\System\CsKSPzu.exe
  C:\Windows\System\CsKSPzu.exe
  2⤵
  PID:4916
- C:\Windows\System\CFMiIpt.exe
  C:\Windows\System\CFMiIpt.exe
  2⤵
  PID:4932
- C:\Windows\System\tTKyPYd.exe
  C:\Windows\System\tTKyPYd.exe
  2⤵
  PID:4948
- C:\Windows\System\ZjtxRWT.exe
  C:\Windows\System\ZjtxRWT.exe
  2⤵
  PID:4964
- C:\Windows\System\GBYEsEX.exe
  C:\Windows\System\GBYEsEX.exe
  2⤵
  PID:4980
- C:\Windows\System\SwaUnpA.exe
  C:\Windows\System\SwaUnpA.exe
  2⤵
  PID:4996
- C:\Windows\System\tkHRDQD.exe
  C:\Windows\System\tkHRDQD.exe
  2⤵
  PID:5012
- C:\Windows\System\XwhwHXU.exe
  C:\Windows\System\XwhwHXU.exe
  2⤵
  PID:5028
- C:\Windows\System\ZQnBelz.exe
  C:\Windows\System\ZQnBelz.exe
  2⤵
  PID:5056
- C:\Windows\System\zySCZCr.exe
  C:\Windows\System\zySCZCr.exe
  2⤵
  PID:5072
- C:\Windows\System\ZzmlHmh.exe
  C:\Windows\System\ZzmlHmh.exe
  2⤵
  PID:5096
- C:\Windows\System\xxQARlg.exe
  C:\Windows\System\xxQARlg.exe
  2⤵
  PID:3928
- C:\Windows\System\SbaOYpP.exe
  C:\Windows\System\SbaOYpP.exe
  2⤵
  PID:4100
- C:\Windows\System\jibvRww.exe
  C:\Windows\System\jibvRww.exe
  2⤵
  PID:3648
- C:\Windows\System\quqPCGG.exe
  C:\Windows\System\quqPCGG.exe
  2⤵
  PID:2528
- C:\Windows\System\TfazbgU.exe
  C:\Windows\System\TfazbgU.exe
  2⤵
  PID:4012
- C:\Windows\System\nWZMVXs.exe
  C:\Windows\System\nWZMVXs.exe
  2⤵
  PID:4220
- C:\Windows\System\CcbPcnR.exe
  C:\Windows\System\CcbPcnR.exe
  2⤵
  PID:3632
- C:\Windows\System\SnWoben.exe
  C:\Windows\System\SnWoben.exe
  2⤵
  PID:4188
- C:\Windows\System\ITiRbci.exe
  C:\Windows\System\ITiRbci.exe
  2⤵
  PID:4240
- C:\Windows\System\xdWvpjy.exe
  C:\Windows\System\xdWvpjy.exe
  2⤵
  PID:4328
- C:\Windows\System\PDdMjIV.exe
  C:\Windows\System\PDdMjIV.exe
  2⤵
  PID:4312
- C:\Windows\System\WPOzpme.exe
  C:\Windows\System\WPOzpme.exe
  2⤵
  PID:4416
- C:\Windows\System\bGbBTxr.exe
  C:\Windows\System\bGbBTxr.exe
  2⤵
  PID:4556
- C:\Windows\System\ZdRmiZm.exe
  C:\Windows\System\ZdRmiZm.exe
  2⤵
  PID:4576
- C:\Windows\System\zfNxyGy.exe
  C:\Windows\System\zfNxyGy.exe
  2⤵
  PID:4656
- C:\Windows\System\owlzXCI.exe
  C:\Windows\System\owlzXCI.exe
  2⤵
  PID:4604
- C:\Windows\System\KvaZlRW.exe
  C:\Windows\System\KvaZlRW.exe
  2⤵
  PID:4680
- C:\Windows\System\TrfnfAL.exe
  C:\Windows\System\TrfnfAL.exe
  2⤵
  PID:4696
- C:\Windows\System\bkbbphG.exe
  C:\Windows\System\bkbbphG.exe
  2⤵
  PID:4796
- C:\Windows\System\ectbjan.exe
  C:\Windows\System\ectbjan.exe
  2⤵
  PID:4668
- C:\Windows\System\uoyRBTo.exe
  C:\Windows\System\uoyRBTo.exe
  2⤵
  PID:4724
- C:\Windows\System\mgkcgPq.exe
  C:\Windows\System\mgkcgPq.exe
  2⤵
  PID:4676
- C:\Windows\System\xvdvLZs.exe
  C:\Windows\System\xvdvLZs.exe
  2⤵
  PID:4748
- C:\Windows\System\rawxvAN.exe
  C:\Windows\System\rawxvAN.exe
  2⤵
  PID:5040
- C:\Windows\System\XfeWFki.exe
  C:\Windows\System\XfeWFki.exe
  2⤵
  PID:4960
- C:\Windows\System\NeIZwnB.exe
  C:\Windows\System\NeIZwnB.exe
  2⤵
  PID:4860
- C:\Windows\System\GYKwvTq.exe
  C:\Windows\System\GYKwvTq.exe
  2⤵
  PID:4924
- C:\Windows\System\ujMpNCn.exe
  C:\Windows\System\ujMpNCn.exe
  2⤵
  PID:5108
- C:\Windows\System\vXMNIdE.exe
  C:\Windows\System\vXMNIdE.exe
  2⤵
  PID:5084
- C:\Windows\System\SEuiGce.exe
  C:\Windows\System\SEuiGce.exe
  2⤵
  PID:3320
- C:\Windows\System\iUlCpFB.exe
  C:\Windows\System\iUlCpFB.exe
  2⤵
  PID:3036
- C:\Windows\System\cneOKuS.exe
  C:\Windows\System\cneOKuS.exe
  2⤵
  PID:4104
- C:\Windows\System\HxjYxZv.exe
  C:\Windows\System\HxjYxZv.exe
  2⤵
  PID:4216
- C:\Windows\System\IHJIVxG.exe
  C:\Windows\System\IHJIVxG.exe
  2⤵
  PID:4196
- C:\Windows\System\lxoKctf.exe
  C:\Windows\System\lxoKctf.exe
  2⤵
  PID:4156
- C:\Windows\System\hIHPVpn.exe
  C:\Windows\System\hIHPVpn.exe
  2⤵
  PID:920
- C:\Windows\System\qhJoGkB.exe
  C:\Windows\System\qhJoGkB.exe
  2⤵
  PID:4364
- C:\Windows\System\ukwxrSA.exe
  C:\Windows\System\ukwxrSA.exe
  2⤵
  PID:4444
- C:\Windows\System\EPBAApI.exe
  C:\Windows\System\EPBAApI.exe
  2⤵
  PID:4536
- C:\Windows\System\mlKxWUM.exe
  C:\Windows\System\mlKxWUM.exe
  2⤵
  PID:1520
- C:\Windows\System\mYqltEz.exe
  C:\Windows\System\mYqltEz.exe
  2⤵
  PID:4632
- C:\Windows\System\rifEmGz.exe
  C:\Windows\System\rifEmGz.exe
  2⤵
  PID:1532
- C:\Windows\System\mHVGTqK.exe
  C:\Windows\System\mHVGTqK.exe
  2⤵
  PID:4712
- C:\Windows\System\jxOIcMb.exe
  C:\Windows\System\jxOIcMb.exe
  2⤵
  PID:4588
- C:\Windows\System\nXuEitc.exe
  C:\Windows\System\nXuEitc.exe
  2⤵
  PID:4740
- C:\Windows\System\ZHgoRes.exe
  C:\Windows\System\ZHgoRes.exe
  2⤵
  PID:4720
- C:\Windows\System\njPFkmi.exe
  C:\Windows\System\njPFkmi.exe
  2⤵
  PID:2220
- C:\Windows\System\lSMRHIc.exe
  C:\Windows\System\lSMRHIc.exe
  2⤵
  PID:4716
- C:\Windows\System\IYECASL.exe
  C:\Windows\System\IYECASL.exe
  2⤵
  PID:4780
- C:\Windows\System\JJGLrLa.exe
  C:\Windows\System\JJGLrLa.exe
  2⤵
  PID:4844
- C:\Windows\System\jGXtUCD.exe
  C:\Windows\System\jGXtUCD.exe
  2⤵
  PID:4912
- C:\Windows\System\ZzAGTzt.exe
  C:\Windows\System\ZzAGTzt.exe
  2⤵
  PID:4200
- C:\Windows\System\cgklxGf.exe
  C:\Windows\System\cgklxGf.exe
  2⤵
  PID:5024
- C:\Windows\System\NdVHMWE.exe
  C:\Windows\System\NdVHMWE.exe
  2⤵
  PID:4152
- C:\Windows\System\uIcArZu.exe
  C:\Windows\System\uIcArZu.exe
  2⤵
  PID:4892
- C:\Windows\System\bMxHAzm.exe
  C:\Windows\System\bMxHAzm.exe
  2⤵
  PID:4244
- C:\Windows\System\MTOzqWv.exe
  C:\Windows\System\MTOzqWv.exe
  2⤵
  PID:4956
- C:\Windows\System\MlibjTS.exe
  C:\Windows\System\MlibjTS.exe
  2⤵
  PID:5116
- C:\Windows\System\sFlBnWO.exe
  C:\Windows\System\sFlBnWO.exe
  2⤵
  PID:4292
- C:\Windows\System\XwmygHN.exe
  C:\Windows\System\XwmygHN.exe
  2⤵
  PID:4308
- C:\Windows\System\sUmYeke.exe
  C:\Windows\System\sUmYeke.exe
  2⤵
  PID:4360
- C:\Windows\System\xWOxoNN.exe
  C:\Windows\System\xWOxoNN.exe
  2⤵
  PID:4764
- C:\Windows\System\VZtYEzi.exe
  C:\Windows\System\VZtYEzi.exe
  2⤵
  PID:3388
- C:\Windows\System\YpQEeFN.exe
  C:\Windows\System\YpQEeFN.exe
  2⤵
  PID:4516
- C:\Windows\System\gvVMkcp.exe
  C:\Windows\System\gvVMkcp.exe
  2⤵
  PID:4792
- C:\Windows\System\QJObjJa.exe
  C:\Windows\System\QJObjJa.exe
  2⤵
  PID:4624
- C:\Windows\System\LZONvTx.exe
  C:\Windows\System\LZONvTx.exe
  2⤵
  PID:4940
- C:\Windows\System\yDnwKem.exe
  C:\Windows\System\yDnwKem.exe
  2⤵
  PID:4412
- C:\Windows\System\TBUkCsn.exe
  C:\Windows\System\TBUkCsn.exe
  2⤵
  PID:4620
- C:\Windows\System\bytSpJC.exe
  C:\Windows\System\bytSpJC.exe
  2⤵
  PID:4976
- C:\Windows\System\mFgKjiW.exe
  C:\Windows\System\mFgKjiW.exe
  2⤵
  PID:5104
- C:\Windows\System\CHYqtXK.exe
  C:\Windows\System\CHYqtXK.exe
  2⤵
  PID:3708
- C:\Windows\System\lYTjOCg.exe
  C:\Windows\System\lYTjOCg.exe
  2⤵
  PID:5004
- C:\Windows\System\hXHfspp.exe
  C:\Windows\System\hXHfspp.exe
  2⤵
  PID:4432
- C:\Windows\System\mEteyKb.exe
  C:\Windows\System\mEteyKb.exe
  2⤵
  PID:4856
- C:\Windows\System\WPIQzul.exe
  C:\Windows\System\WPIQzul.exe
  2⤵
  PID:4348
- C:\Windows\System\fcLPotz.exe
  C:\Windows\System\fcLPotz.exe
  2⤵
  PID:4472
- C:\Windows\System\vmCxpcc.exe
  C:\Windows\System\vmCxpcc.exe
  2⤵
  PID:4468
- C:\Windows\System\xboUvsD.exe
  C:\Windows\System\xboUvsD.exe
  2⤵
  PID:4168
- C:\Windows\System\PfwOujI.exe
  C:\Windows\System\PfwOujI.exe
  2⤵
  PID:4648
- C:\Windows\System\tIfafnG.exe
  C:\Windows\System\tIfafnG.exe
  2⤵
  PID:4776
- C:\Windows\System\jXumsDh.exe
  C:\Windows\System\jXumsDh.exe
  2⤵
  PID:4700
- C:\Windows\System\uXCdBhu.exe
  C:\Windows\System\uXCdBhu.exe
  2⤵
  PID:4896
- C:\Windows\System\Qwczjen.exe
  C:\Windows\System\Qwczjen.exe
  2⤵
  PID:4396
- C:\Windows\System\yOYQMDd.exe
  C:\Windows\System\yOYQMDd.exe
  2⤵
  PID:1496
- C:\Windows\System\hAKSNSN.exe
  C:\Windows\System\hAKSNSN.exe
  2⤵
  PID:5140
- C:\Windows\System\QMRCPhN.exe
  C:\Windows\System\QMRCPhN.exe
  2⤵
  PID:5156
- C:\Windows\System\SRNHLeW.exe
  C:\Windows\System\SRNHLeW.exe
  2⤵
  PID:5172
- C:\Windows\System\mggzUtu.exe
  C:\Windows\System\mggzUtu.exe
  2⤵
  PID:5192
- C:\Windows\System\MRBptBP.exe
  C:\Windows\System\MRBptBP.exe
  2⤵
  PID:5208
- C:\Windows\System\EseUvky.exe
  C:\Windows\System\EseUvky.exe
  2⤵
  PID:5224
- C:\Windows\System\rKPImNC.exe
  C:\Windows\System\rKPImNC.exe
  2⤵
  PID:5240
- C:\Windows\System\QPqQIDs.exe
  C:\Windows\System\QPqQIDs.exe
  2⤵
  PID:5256
- C:\Windows\System\cGiqypb.exe
  C:\Windows\System\cGiqypb.exe
  2⤵
  PID:5272
- C:\Windows\System\ecpniwC.exe
  C:\Windows\System\ecpniwC.exe
  2⤵
  PID:5288
- C:\Windows\System\ytJjfjc.exe
  C:\Windows\System\ytJjfjc.exe
  2⤵
  PID:5304
- C:\Windows\System\dvQQkUg.exe
  C:\Windows\System\dvQQkUg.exe
  2⤵
  PID:5320
- C:\Windows\System\OUNEdWD.exe
  C:\Windows\System\OUNEdWD.exe
  2⤵
  PID:5336
- C:\Windows\System\iuigBzw.exe
  C:\Windows\System\iuigBzw.exe
  2⤵
  PID:5352
- C:\Windows\System\yqOgEDC.exe
  C:\Windows\System\yqOgEDC.exe
  2⤵
  PID:5368
- C:\Windows\System\YNaZlfi.exe
  C:\Windows\System\YNaZlfi.exe
  2⤵
  PID:5384
- C:\Windows\System\ezbNPIn.exe
  C:\Windows\System\ezbNPIn.exe
  2⤵
  PID:5400
- C:\Windows\System\MPWFTcR.exe
  C:\Windows\System\MPWFTcR.exe
  2⤵
  PID:5416
- C:\Windows\System\HeKLfkb.exe
  C:\Windows\System\HeKLfkb.exe
  2⤵
  PID:5432
- C:\Windows\System\hOACyMB.exe
  C:\Windows\System\hOACyMB.exe
  2⤵
  PID:5448
- C:\Windows\System\BvqwYna.exe
  C:\Windows\System\BvqwYna.exe
  2⤵
  PID:5464
- C:\Windows\System\plhGDNi.exe
  C:\Windows\System\plhGDNi.exe
  2⤵
  PID:5480
- C:\Windows\System\fNzCKgA.exe
  C:\Windows\System\fNzCKgA.exe
  2⤵
  PID:5496
- C:\Windows\System\fmjJwKx.exe
  C:\Windows\System\fmjJwKx.exe
  2⤵
  PID:5512
- C:\Windows\System\HNzyZrZ.exe
  C:\Windows\System\HNzyZrZ.exe
  2⤵
  PID:5528
- C:\Windows\System\mYgSYHq.exe
  C:\Windows\System\mYgSYHq.exe
  2⤵
  PID:5544
- C:\Windows\System\VosmvOK.exe
  C:\Windows\System\VosmvOK.exe
  2⤵
  PID:5560
- C:\Windows\System\PglMeng.exe
  C:\Windows\System\PglMeng.exe
  2⤵
  PID:5576
- C:\Windows\System\JZWZYji.exe
  C:\Windows\System\JZWZYji.exe
  2⤵
  PID:5592
- C:\Windows\System\xTRqQcz.exe
  C:\Windows\System\xTRqQcz.exe
  2⤵
  PID:5608
- C:\Windows\System\wMNFKUg.exe
  C:\Windows\System\wMNFKUg.exe
  2⤵
  PID:5624
- C:\Windows\System\eQpgWBX.exe
  C:\Windows\System\eQpgWBX.exe
  2⤵
  PID:5644
- C:\Windows\System\gFDGpwo.exe
  C:\Windows\System\gFDGpwo.exe
  2⤵
  PID:5660
- C:\Windows\System\kYzUnss.exe
  C:\Windows\System\kYzUnss.exe
  2⤵
  PID:5676
- C:\Windows\System\UNxNbcH.exe
  C:\Windows\System\UNxNbcH.exe
  2⤵
  PID:5692
- C:\Windows\System\cVVyHuh.exe
  C:\Windows\System\cVVyHuh.exe
  2⤵
  PID:5708
- C:\Windows\System\qFVGfgA.exe
  C:\Windows\System\qFVGfgA.exe
  2⤵
  PID:5728
- C:\Windows\System\apVYYBf.exe
  C:\Windows\System\apVYYBf.exe
  2⤵
  PID:5744
- C:\Windows\System\rOEiZJt.exe
  C:\Windows\System\rOEiZJt.exe
  2⤵
  PID:5760
- C:\Windows\System\dEUtjju.exe
  C:\Windows\System\dEUtjju.exe
  2⤵
  PID:5780
- C:\Windows\System\PlQkTbs.exe
  C:\Windows\System\PlQkTbs.exe
  2⤵
  PID:5796
- C:\Windows\System\eWHMLPu.exe
  C:\Windows\System\eWHMLPu.exe
  2⤵
  PID:5812
- C:\Windows\System\njHgzbQ.exe
  C:\Windows\System\njHgzbQ.exe
  2⤵
  PID:5828
- C:\Windows\System\xEWOCiO.exe
  C:\Windows\System\xEWOCiO.exe
  2⤵
  PID:5844
- C:\Windows\System\NxnNUqp.exe
  C:\Windows\System\NxnNUqp.exe
  2⤵
  PID:5860
- C:\Windows\System\nQKPjZO.exe
  C:\Windows\System\nQKPjZO.exe
  2⤵
  PID:5876
- C:\Windows\System\JVkfLBr.exe
  C:\Windows\System\JVkfLBr.exe
  2⤵
  PID:5892
- C:\Windows\System\sbTlYhM.exe
  C:\Windows\System\sbTlYhM.exe
  2⤵
  PID:5908
- C:\Windows\System\aoHrBjt.exe
  C:\Windows\System\aoHrBjt.exe
  2⤵
  PID:5924
- C:\Windows\System\dLsYdgf.exe
  C:\Windows\System\dLsYdgf.exe
  2⤵
  PID:5940
- C:\Windows\System\heOdwDr.exe
  C:\Windows\System\heOdwDr.exe
  2⤵
  PID:5956
- C:\Windows\System\FnujZkl.exe
  C:\Windows\System\FnujZkl.exe
  2⤵
  PID:5972
- C:\Windows\System\ZJQohUU.exe
  C:\Windows\System\ZJQohUU.exe
  2⤵
  PID:5988
- C:\Windows\System\NxiZPZo.exe
  C:\Windows\System\NxiZPZo.exe
  2⤵
  PID:6004
- C:\Windows\System\ppVztBK.exe
  C:\Windows\System\ppVztBK.exe
  2⤵
  PID:6020
- C:\Windows\System\nLQPjrR.exe
  C:\Windows\System\nLQPjrR.exe
  2⤵
  PID:6044
- C:\Windows\System\XwObDHH.exe
  C:\Windows\System\XwObDHH.exe
  2⤵
  PID:6060
- C:\Windows\System\BiKhZmC.exe
  C:\Windows\System\BiKhZmC.exe
  2⤵
  PID:6076
- C:\Windows\System\zxRVHWP.exe
  C:\Windows\System\zxRVHWP.exe
  2⤵
  PID:6092
- C:\Windows\System\avoNdwv.exe
  C:\Windows\System\avoNdwv.exe
  2⤵
  PID:6108
- C:\Windows\System\cqWGvsF.exe
  C:\Windows\System\cqWGvsF.exe
  2⤵
  PID:6124
- C:\Windows\System\GVDCAHK.exe
  C:\Windows\System\GVDCAHK.exe
  2⤵
  PID:6140
- C:\Windows\System\siiloFN.exe
  C:\Windows\System\siiloFN.exe
  2⤵
  PID:5136
- C:\Windows\System\OgIIMUJ.exe
  C:\Windows\System\OgIIMUJ.exe
  2⤵
  PID:3504
- C:\Windows\System\qaYjyBZ.exe
  C:\Windows\System\qaYjyBZ.exe
  2⤵
  PID:5080
- C:\Windows\System\NvwwHYk.exe
  C:\Windows\System\NvwwHYk.exe
  2⤵
  PID:4564
- C:\Windows\System\VQgJdua.exe
  C:\Windows\System\VQgJdua.exe
  2⤵
  PID:4428
- C:\Windows\System\AeBuLvm.exe
  C:\Windows\System\AeBuLvm.exe
  2⤵
  PID:5188
- C:\Windows\System\sbvVMwI.exe
  C:\Windows\System\sbvVMwI.exe
  2⤵
  PID:5232
- C:\Windows\System\yIGhmDJ.exe
  C:\Windows\System\yIGhmDJ.exe
  2⤵
  PID:5252
- C:\Windows\System\arsIXDu.exe
  C:\Windows\System\arsIXDu.exe
  2⤵
  PID:5312
- C:\Windows\System\lWUoHmC.exe
  C:\Windows\System\lWUoHmC.exe
  2⤵
  PID:5264
- C:\Windows\System\vaqBedQ.exe
  C:\Windows\System\vaqBedQ.exe
  2⤵
  PID:5376
- C:\Windows\System\XalrIah.exe
  C:\Windows\System\XalrIah.exe
  2⤵
  PID:5444
- C:\Windows\System\xGlFRFN.exe
  C:\Windows\System\xGlFRFN.exe
  2⤵
  PID:5508
- C:\Windows\System\tWfYfaz.exe
  C:\Windows\System\tWfYfaz.exe
  2⤵
  PID:5572
- C:\Windows\System\fBvAoZc.exe
  C:\Windows\System\fBvAoZc.exe
  2⤵
  PID:5424
- C:\Windows\System\kHsvFTw.exe
  C:\Windows\System\kHsvFTw.exe
  2⤵
  PID:5332
- C:\Windows\System\CRFDvQu.exe
  C:\Windows\System\CRFDvQu.exe
  2⤵
  PID:5300
- C:\Windows\System\GskStKf.exe
  C:\Windows\System\GskStKf.exe
  2⤵
  PID:5620
- C:\Windows\System\AvRMPdz.exe
  C:\Windows\System\AvRMPdz.exe
  2⤵
  PID:5460
- C:\Windows\System\xJaceqL.exe
  C:\Windows\System\xJaceqL.exe
  2⤵
  PID:5556
- C:\Windows\System\UrPSFOI.exe
  C:\Windows\System\UrPSFOI.exe
  2⤵
  PID:5684
- C:\Windows\System\iWVaLjY.exe
  C:\Windows\System\iWVaLjY.exe
  2⤵
  PID:5672
- C:\Windows\System\bOaxEkA.exe
  C:\Windows\System\bOaxEkA.exe
  2⤵
  PID:5768
- C:\Windows\System\YdTnxCV.exe
  C:\Windows\System\YdTnxCV.exe
  2⤵
  PID:5724
- C:\Windows\System\wOImMXZ.exe
  C:\Windows\System\wOImMXZ.exe
  2⤵
  PID:5756
- C:\Windows\System\PspDAdp.exe
  C:\Windows\System\PspDAdp.exe
  2⤵
  PID:5840
- C:\Windows\System\AUoLpAb.exe
  C:\Windows\System\AUoLpAb.exe
  2⤵
  PID:5872
- C:\Windows\System\DnTfvDH.exe
  C:\Windows\System\DnTfvDH.exe
  2⤵
  PID:5904
- C:\Windows\System\ZOGUZGf.exe
  C:\Windows\System\ZOGUZGf.exe
  2⤵
  PID:5952
- C:\Windows\System\HVtlsYV.exe
  C:\Windows\System\HVtlsYV.exe
  2⤵
  PID:5968
- C:\Windows\System\aYXjcho.exe
  C:\Windows\System\aYXjcho.exe
  2⤵
  PID:6016
- C:\Windows\System\jLEpmlW.exe
  C:\Windows\System\jLEpmlW.exe
  2⤵
  PID:6032
- C:\Windows\System\dmJHdJN.exe
  C:\Windows\System\dmJHdJN.exe
  2⤵
  PID:6100
- C:\Windows\System\cYPRBNP.exe
  C:\Windows\System\cYPRBNP.exe
  2⤵
  PID:5168
- C:\Windows\System\MNEkyLV.exe
  C:\Windows\System\MNEkyLV.exe
  2⤵
  PID:6056
- C:\Windows\System\YSSTHnU.exe
  C:\Windows\System\YSSTHnU.exe
  2⤵
  PID:1484
- C:\Windows\System\qCebMHL.exe
  C:\Windows\System\qCebMHL.exe
  2⤵
  PID:5132
- C:\Windows\System\usYdEFw.exe
  C:\Windows\System\usYdEFw.exe
  2⤵
  PID:5204
- C:\Windows\System\gdlflqR.exe
  C:\Windows\System\gdlflqR.exe
  2⤵
  PID:1016
- C:\Windows\System\URGbIFk.exe
  C:\Windows\System\URGbIFk.exe
  2⤵
  PID:5180
- C:\Windows\System\hphIWkx.exe
  C:\Windows\System\hphIWkx.exe
  2⤵
  PID:5268
- C:\Windows\System\yLabfvS.exe
  C:\Windows\System\yLabfvS.exe
  2⤵
  PID:5540
- C:\Windows\System\zahOZqY.exe
  C:\Windows\System\zahOZqY.exe
  2⤵
  PID:5552
- C:\Windows\System\FEwvfPP.exe
  C:\Windows\System\FEwvfPP.exe
  2⤵
  PID:5716
- C:\Windows\System\GQQIrOT.exe
  C:\Windows\System\GQQIrOT.exe
  2⤵
  PID:5652
- C:\Windows\System\IFpmBcl.exe
  C:\Windows\System\IFpmBcl.exe
  2⤵
  PID:5804
- C:\Windows\System\vKZcgdf.exe
  C:\Windows\System\vKZcgdf.exe
  2⤵
  PID:5364
- C:\Windows\System\vyHvmMm.exe
  C:\Windows\System\vyHvmMm.exe
  2⤵
  PID:5640
- C:\Windows\System\RtspYca.exe
  C:\Windows\System\RtspYca.exe
  2⤵
  PID:5852
- C:\Windows\System\UdDOUgc.exe
  C:\Windows\System\UdDOUgc.exe
  2⤵
  PID:5280
- C:\Windows\System\jLJPhIF.exe
  C:\Windows\System\jLJPhIF.exe
  2⤵
  PID:6116
- C:\Windows\System\ZgnJYmF.exe
  C:\Windows\System\ZgnJYmF.exe
  2⤵
  PID:5440
- C:\Windows\System\xMpoysc.exe
  C:\Windows\System\xMpoysc.exe
  2⤵
  PID:5408
- C:\Windows\System\bkYiUFm.exe
  C:\Windows\System\bkYiUFm.exe
  2⤵
  PID:5980
- C:\Windows\System\pHXpIYR.exe
  C:\Windows\System\pHXpIYR.exe
  2⤵
  PID:6052
- C:\Windows\System\cKBkyjM.exe
  C:\Windows\System\cKBkyjM.exe
  2⤵
  PID:5328
- C:\Windows\System\xVtcjxo.exe
  C:\Windows\System\xVtcjxo.exe
  2⤵
  PID:5736
- C:\Windows\System\fpGCYbr.exe
  C:\Windows\System\fpGCYbr.exe
  2⤵
  PID:5740
- C:\Windows\System\ApBXpZQ.exe
  C:\Windows\System\ApBXpZQ.exe
  2⤵
  PID:5396
- C:\Windows\System\DhPQnkl.exe
  C:\Windows\System\DhPQnkl.exe
  2⤵
  PID:6072
- C:\Windows\System\bTfeqaV.exe
  C:\Windows\System\bTfeqaV.exe
  2⤵
  PID:5492
- C:\Windows\System\yfofTRp.exe
  C:\Windows\System\yfofTRp.exe
  2⤵
  PID:6148
- C:\Windows\System\huUXQSx.exe
  C:\Windows\System\huUXQSx.exe
  2⤵
  PID:6164
- C:\Windows\System\GkoFpWQ.exe
  C:\Windows\System\GkoFpWQ.exe
  2⤵
  PID:6180
- C:\Windows\System\ORAiJUc.exe
  C:\Windows\System\ORAiJUc.exe
  2⤵
  PID:6196
- C:\Windows\System\rtoROAM.exe
  C:\Windows\System\rtoROAM.exe
  2⤵
  PID:6212
- C:\Windows\System\ZOJWDTj.exe
  C:\Windows\System\ZOJWDTj.exe
  2⤵
  PID:6228
- C:\Windows\System\JcmMXLI.exe
  C:\Windows\System\JcmMXLI.exe
  2⤵
  PID:6244
- C:\Windows\System\lvQDRrq.exe
  C:\Windows\System\lvQDRrq.exe
  2⤵
  PID:6260
- C:\Windows\System\fGdESUH.exe
  C:\Windows\System\fGdESUH.exe
  2⤵
  PID:6276
- C:\Windows\System\UomZKRJ.exe
  C:\Windows\System\UomZKRJ.exe
  2⤵
  PID:6324
- C:\Windows\System\RMkemoT.exe
  C:\Windows\System\RMkemoT.exe
  2⤵
  PID:6352
- C:\Windows\System\bFxQcGf.exe
  C:\Windows\System\bFxQcGf.exe
  2⤵
  PID:6368
- C:\Windows\System\KVvIXbf.exe
  C:\Windows\System\KVvIXbf.exe
  2⤵
  PID:6384
- C:\Windows\System\wMxCDBD.exe
  C:\Windows\System\wMxCDBD.exe
  2⤵
  PID:6400
- C:\Windows\System\DFolRDA.exe
  C:\Windows\System\DFolRDA.exe
  2⤵
  PID:6416
- C:\Windows\System\srObORi.exe
  C:\Windows\System\srObORi.exe
  2⤵
  PID:6436
- C:\Windows\System\PSmJCre.exe
  C:\Windows\System\PSmJCre.exe
  2⤵
  PID:6456
- C:\Windows\System\hBiBkdL.exe
  C:\Windows\System\hBiBkdL.exe
  2⤵
  PID:6472
- C:\Windows\System\yXQzmtf.exe
  C:\Windows\System\yXQzmtf.exe
  2⤵
  PID:6488
- C:\Windows\System\zmmUOhT.exe
  C:\Windows\System\zmmUOhT.exe
  2⤵
  PID:6504
- C:\Windows\System\hgikcwr.exe
  C:\Windows\System\hgikcwr.exe
  2⤵
  PID:6520
- C:\Windows\System\shjhAmX.exe
  C:\Windows\System\shjhAmX.exe
  2⤵
  PID:6536
- C:\Windows\System\BUlWlge.exe
  C:\Windows\System\BUlWlge.exe
  2⤵
  PID:6552
- C:\Windows\System\qPJSSis.exe
  C:\Windows\System\qPJSSis.exe
  2⤵
  PID:6624
- C:\Windows\System\FIBRkaD.exe
  C:\Windows\System\FIBRkaD.exe
  2⤵
  PID:6648
- C:\Windows\System\ROvraAV.exe
  C:\Windows\System\ROvraAV.exe
  2⤵
  PID:6664
- C:\Windows\System\EyyIlUW.exe
  C:\Windows\System\EyyIlUW.exe
  2⤵
  PID:6684
- C:\Windows\System\QwjBmuv.exe
  C:\Windows\System\QwjBmuv.exe
  2⤵
  PID:6704
- C:\Windows\System\DeLpiKo.exe
  C:\Windows\System\DeLpiKo.exe
  2⤵
  PID:6720
- C:\Windows\System\HVBPaoi.exe
  C:\Windows\System\HVBPaoi.exe
  2⤵
  PID:6736
- C:\Windows\System\SoSuTCd.exe
  C:\Windows\System\SoSuTCd.exe
  2⤵
  PID:6752
- C:\Windows\System\pskCJDT.exe
  C:\Windows\System\pskCJDT.exe
  2⤵
  PID:6768
- C:\Windows\System\uQtBSJU.exe
  C:\Windows\System\uQtBSJU.exe
  2⤵
  PID:6784
- C:\Windows\System\XvhWWsV.exe
  C:\Windows\System\XvhWWsV.exe
  2⤵
  PID:6804
- C:\Windows\System\RTszqzI.exe
  C:\Windows\System\RTszqzI.exe
  2⤵
  PID:6820
- C:\Windows\System\MqQvsOO.exe
  C:\Windows\System\MqQvsOO.exe
  2⤵
  PID:6836
- C:\Windows\System\bjTSfvm.exe
  C:\Windows\System\bjTSfvm.exe
  2⤵
  PID:6852
- C:\Windows\System\OcxpTAz.exe
  C:\Windows\System\OcxpTAz.exe
  2⤵
  PID:6868
- C:\Windows\System\SKfYGig.exe
  C:\Windows\System\SKfYGig.exe
  2⤵
  PID:6884
- C:\Windows\System\rLQtPHy.exe
  C:\Windows\System\rLQtPHy.exe
  2⤵
  PID:6900
- C:\Windows\System\HNGmpUc.exe
  C:\Windows\System\HNGmpUc.exe
  2⤵
  PID:6916
- C:\Windows\System\GITMqOI.exe
  C:\Windows\System\GITMqOI.exe
  2⤵
  PID:6932
- C:\Windows\System\DkkKtmb.exe
  C:\Windows\System\DkkKtmb.exe
  2⤵
  PID:6948
- C:\Windows\System\pShNLqH.exe
  C:\Windows\System\pShNLqH.exe
  2⤵
  PID:6964
- C:\Windows\System\nynxUJp.exe
  C:\Windows\System\nynxUJp.exe
  2⤵
  PID:6980
- C:\Windows\System\GIFTnMG.exe
  C:\Windows\System\GIFTnMG.exe
  2⤵
  PID:6996
- C:\Windows\System\msUlbad.exe
  C:\Windows\System\msUlbad.exe
  2⤵
  PID:7080
- C:\Windows\System\EQSsZCZ.exe
  C:\Windows\System\EQSsZCZ.exe
  2⤵
  PID:7096
- C:\Windows\System\pRvhENJ.exe
  C:\Windows\System\pRvhENJ.exe
  2⤵
  PID:7112
- C:\Windows\System\hmZjtGk.exe
  C:\Windows\System\hmZjtGk.exe
  2⤵
  PID:7128
- C:\Windows\System\zQVXygY.exe
  C:\Windows\System\zQVXygY.exe
  2⤵
  PID:7144
- C:\Windows\System\cjTehTK.exe
  C:\Windows\System\cjTehTK.exe
  2⤵
  PID:7160
- C:\Windows\System\NGZwuwc.exe
  C:\Windows\System\NGZwuwc.exe
  2⤵
  PID:5588
- C:\Windows\System\qgCRyQC.exe
  C:\Windows\System\qgCRyQC.exe
  2⤵
  PID:5888
- C:\Windows\System\siWEfsF.exe
  C:\Windows\System\siWEfsF.exe
  2⤵
  PID:5752
- C:\Windows\System\JzyApGQ.exe
  C:\Windows\System\JzyApGQ.exe
  2⤵
  PID:6172
- C:\Windows\System\LuOgnSY.exe
  C:\Windows\System\LuOgnSY.exe
  2⤵
  PID:5036
- C:\Windows\System\NUrrpXC.exe
  C:\Windows\System\NUrrpXC.exe
  2⤵
  PID:5216
- C:\Windows\System\LaYgvuj.exe
  C:\Windows\System\LaYgvuj.exe
  2⤵
  PID:6160
- C:\Windows\System\MTsZdbv.exe
  C:\Windows\System\MTsZdbv.exe
  2⤵
  PID:6220
- C:\Windows\System\jrxjPAM.exe
  C:\Windows\System\jrxjPAM.exe
  2⤵
  PID:6288
- C:\Windows\System\YijOoXa.exe
  C:\Windows\System\YijOoXa.exe
  2⤵
  PID:6332
- C:\Windows\System\szzPoJG.exe
  C:\Windows\System\szzPoJG.exe
  2⤵
  PID:6348
- C:\Windows\System\LZeivIX.exe
  C:\Windows\System\LZeivIX.exe
  2⤵
  PID:6412
- C:\Windows\System\vBIwBBs.exe
  C:\Windows\System\vBIwBBs.exe
  2⤵
  PID:6304
- C:\Windows\System\JxLJbPM.exe
  C:\Windows\System\JxLJbPM.exe
  2⤵
  PID:6544
- C:\Windows\System\KCWMBHC.exe
  C:\Windows\System\KCWMBHC.exe
  2⤵
  PID:6464
- C:\Windows\System\SisGqTA.exe
  C:\Windows\System\SisGqTA.exe
  2⤵
  PID:6320
- C:\Windows\System\vKuWDsD.exe
  C:\Windows\System\vKuWDsD.exe
  2⤵
  PID:6468
- C:\Windows\System\bLMsAkp.exe
  C:\Windows\System\bLMsAkp.exe
  2⤵
  PID:6364
- C:\Windows\System\GGjLKth.exe
  C:\Windows\System\GGjLKth.exe
  2⤵
  PID:6564
- C:\Windows\System\BVsOfGQ.exe
  C:\Windows\System\BVsOfGQ.exe
  2⤵
  PID:6580
- C:\Windows\System\ZkFIFEG.exe
  C:\Windows\System\ZkFIFEG.exe
  2⤵
  PID:6452
- C:\Windows\System\AparpcA.exe
  C:\Windows\System\AparpcA.exe
  2⤵
  PID:6604
- C:\Windows\System\fLHMVHo.exe
  C:\Windows\System\fLHMVHo.exe
  2⤵
  PID:6620
- C:\Windows\System\qlJuVfx.exe
  C:\Windows\System\qlJuVfx.exe
  2⤵
  PID:6672
- C:\Windows\System\bQAYCCA.exe
  C:\Windows\System\bQAYCCA.exe
  2⤵
  PID:6712
- C:\Windows\System\sDfpbZn.exe
  C:\Windows\System\sDfpbZn.exe
  2⤵
  PID:6812
- C:\Windows\System\ZqxWPIZ.exe
  C:\Windows\System\ZqxWPIZ.exe
  2⤵
  PID:6876
- C:\Windows\System\bjUWgWJ.exe
  C:\Windows\System\bjUWgWJ.exe
  2⤵
  PID:6940
- C:\Windows\System\DIQudNH.exe
  C:\Windows\System\DIQudNH.exe
  2⤵
  PID:6692
- C:\Windows\System\jViTfmq.exe
  C:\Windows\System\jViTfmq.exe
  2⤵
  PID:6732
- C:\Windows\System\RnkLSQN.exe
  C:\Windows\System\RnkLSQN.exe
  2⤵
  PID:6728
- C:\Windows\System\TYiotld.exe
  C:\Windows\System\TYiotld.exe
  2⤵
  PID:6828
- C:\Windows\System\nCjfWTT.exe
  C:\Windows\System\nCjfWTT.exe
  2⤵
  PID:6896
- C:\Windows\System\hhUxMTB.exe
  C:\Windows\System\hhUxMTB.exe
  2⤵
  PID:6960
- C:\Windows\System\PJnTYRO.exe
  C:\Windows\System\PJnTYRO.exe
  2⤵
  PID:7024
- C:\Windows\System\sTAyoXH.exe
  C:\Windows\System\sTAyoXH.exe
  2⤵
  PID:7040
- C:\Windows\System\qPIqBoY.exe
  C:\Windows\System\qPIqBoY.exe
  2⤵
  PID:7060
- C:\Windows\System\rluCmtV.exe
  C:\Windows\System\rluCmtV.exe
  2⤵
  PID:7076
- C:\Windows\System\HmyGQkv.exe
  C:\Windows\System\HmyGQkv.exe
  2⤵
  PID:7136
- C:\Windows\System\mpmbApT.exe
  C:\Windows\System\mpmbApT.exe
  2⤵
  PID:2800
- C:\Windows\System\fnPgmAu.exe
  C:\Windows\System\fnPgmAu.exe
  2⤵
  PID:5668
- C:\Windows\System\UcoFfQy.exe
  C:\Windows\System\UcoFfQy.exe
  2⤵
  PID:5900
- C:\Windows\System\ESzXPtU.exe
  C:\Windows\System\ESzXPtU.exe
  2⤵
  PID:6268
- C:\Windows\System\VJPhvma.exe
  C:\Windows\System\VJPhvma.exe
  2⤵
  PID:5936
- C:\Windows\System\ulgDIBo.exe
  C:\Windows\System\ulgDIBo.exe
  2⤵
  PID:6192
- C:\Windows\System\AyYCWxl.exe
  C:\Windows\System\AyYCWxl.exe
  2⤵
  PID:6340
- C:\Windows\System\DjFnYrx.exe
  C:\Windows\System\DjFnYrx.exe
  2⤵
  PID:6480
- C:\Windows\System\pwGKzmo.exe
  C:\Windows\System\pwGKzmo.exe
  2⤵
  PID:7012
- C:\Windows\System\RqrbPnE.exe
  C:\Windows\System\RqrbPnE.exe
  2⤵
  PID:6588
- C:\Windows\System\rYAgYmu.exe
  C:\Windows\System\rYAgYmu.exe
  2⤵
  PID:6972
- C:\Windows\System\HrYwfMi.exe
  C:\Windows\System\HrYwfMi.exe
  2⤵
  PID:6312
- C:\Windows\System\xXUJwsk.exe
  C:\Windows\System\xXUJwsk.exe
  2⤵
  PID:6572
- C:\Windows\System\lXTeuil.exe
  C:\Windows\System\lXTeuil.exe
  2⤵
  PID:7004
- C:\Windows\System\AzydtzU.exe
  C:\Windows\System\AzydtzU.exe
  2⤵
  PID:6748
- C:\Windows\System\JvYDpRe.exe
  C:\Windows\System\JvYDpRe.exe
  2⤵
  PID:6832
- C:\Windows\System\DhEgRbi.exe
  C:\Windows\System\DhEgRbi.exe
  2⤵
  PID:6864
- C:\Windows\System\dYAQEZf.exe
  C:\Windows\System\dYAQEZf.exe
  2⤵
  PID:7048
- C:\Windows\System\esVhGlM.exe
  C:\Windows\System\esVhGlM.exe
  2⤵
  PID:7088
- C:\Windows\System\AmUlXFh.exe
  C:\Windows\System\AmUlXFh.exe
  2⤵
  PID:7120
- C:\Windows\System\YQYRcYC.exe
  C:\Windows\System\YQYRcYC.exe
  2⤵
  PID:6956
- C:\Windows\System\oCNLbKq.exe
  C:\Windows\System\oCNLbKq.exe
  2⤵
  PID:7036
- C:\Windows\System\TlBnpJI.exe
  C:\Windows\System\TlBnpJI.exe
  2⤵
  PID:5984
- C:\Windows\System\DShvVay.exe
  C:\Windows\System\DShvVay.exe
  2⤵
  PID:1640
- C:\Windows\System\dSRKGJa.exe
  C:\Windows\System\dSRKGJa.exe
  2⤵
  PID:6256
- C:\Windows\System\lWfrWyD.exe
  C:\Windows\System\lWfrWyD.exe
  2⤵
  PID:6616
- C:\Windows\System\jCKmGFV.exe
  C:\Windows\System\jCKmGFV.exe
  2⤵
  PID:6632
- C:\Windows\System\duPyqlO.exe
  C:\Windows\System\duPyqlO.exe
  2⤵
  PID:6308
- C:\Windows\System\oBbwLOL.exe
  C:\Windows\System\oBbwLOL.exe
  2⤵
  PID:6612
- C:\Windows\System\xOTJbyY.exe
  C:\Windows\System\xOTJbyY.exe
  2⤵
  PID:6496
- C:\Windows\System\xtsyYzu.exe
  C:\Windows\System\xtsyYzu.exe
  2⤵
  PID:6716
- C:\Windows\System\XGlAmXq.exe
  C:\Windows\System\XGlAmXq.exe
  2⤵
  PID:6988
- C:\Windows\System\hKmMoKD.exe
  C:\Windows\System\hKmMoKD.exe
  2⤵
  PID:7008
- C:\Windows\System\ooysUvz.exe
  C:\Windows\System\ooysUvz.exe
  2⤵
  PID:6796
- C:\Windows\System\SCJsupV.exe
  C:\Windows\System\SCJsupV.exe
  2⤵
  PID:7068
- C:\Windows\System\OuGsWGH.exe
  C:\Windows\System\OuGsWGH.exe
  2⤵
  PID:6448
- C:\Windows\System\XWyomco.exe
  C:\Windows\System\XWyomco.exe
  2⤵
  PID:5520
- C:\Windows\System\LMaczVo.exe
  C:\Windows\System\LMaczVo.exe
  2⤵
  PID:6640
- C:\Windows\System\qXqTsAC.exe
  C:\Windows\System\qXqTsAC.exe
  2⤵
  PID:6844
- C:\Windows\System\TDucaOe.exe
  C:\Windows\System\TDucaOe.exe
  2⤵
  PID:6512
- C:\Windows\System\ARkonNh.exe
  C:\Windows\System\ARkonNh.exe
  2⤵
  PID:6528
- C:\Windows\System\MWFUqvo.exe
  C:\Windows\System\MWFUqvo.exe
  2⤵
  PID:7176
- C:\Windows\System\mSrBCpZ.exe
  C:\Windows\System\mSrBCpZ.exe
  2⤵
  PID:7192
- C:\Windows\System\NHDEnkv.exe
  C:\Windows\System\NHDEnkv.exe
  2⤵
  PID:7208
- C:\Windows\System\lvGenGS.exe
  C:\Windows\System\lvGenGS.exe
  2⤵
  PID:7224
- C:\Windows\System\lTLzxpO.exe
  C:\Windows\System\lTLzxpO.exe
  2⤵
  PID:7240
- C:\Windows\System\xuDMjcH.exe
  C:\Windows\System\xuDMjcH.exe
  2⤵
  PID:7256
- C:\Windows\System\yqDDuzx.exe
  C:\Windows\System\yqDDuzx.exe
  2⤵
  PID:7272
- C:\Windows\System\sjwXehR.exe
  C:\Windows\System\sjwXehR.exe
  2⤵
  PID:7288
- C:\Windows\System\ZeGlrqz.exe
  C:\Windows\System\ZeGlrqz.exe
  2⤵
  PID:7304
- C:\Windows\System\JkAnARM.exe
  C:\Windows\System\JkAnARM.exe
  2⤵
  PID:7320
- C:\Windows\System\FQaNJlD.exe
  C:\Windows\System\FQaNJlD.exe
  2⤵
  PID:7336
- C:\Windows\System\KXrOxJj.exe
  C:\Windows\System\KXrOxJj.exe
  2⤵
  PID:7352
- C:\Windows\System\NgJZwSM.exe
  C:\Windows\System\NgJZwSM.exe
  2⤵
  PID:7368
- C:\Windows\System\pIjpvRo.exe
  C:\Windows\System\pIjpvRo.exe
  2⤵
  PID:7384
- C:\Windows\System\rimMsej.exe
  C:\Windows\System\rimMsej.exe
  2⤵
  PID:7400
- C:\Windows\System\RYWnEFF.exe
  C:\Windows\System\RYWnEFF.exe
  2⤵
  PID:7416
- C:\Windows\System\KNgqFsl.exe
  C:\Windows\System\KNgqFsl.exe
  2⤵
  PID:7432
- C:\Windows\System\emjfgPM.exe
  C:\Windows\System\emjfgPM.exe
  2⤵
  PID:7448
- C:\Windows\System\XHsGrWA.exe
  C:\Windows\System\XHsGrWA.exe
  2⤵
  PID:7464
- C:\Windows\System\azIzhyW.exe
  C:\Windows\System\azIzhyW.exe
  2⤵
  PID:7480
- C:\Windows\System\FASZHSW.exe
  C:\Windows\System\FASZHSW.exe
  2⤵
  PID:7500
- C:\Windows\System\polNgAc.exe
  C:\Windows\System\polNgAc.exe
  2⤵
  PID:7520
- C:\Windows\System\XqUpsKv.exe
  C:\Windows\System\XqUpsKv.exe
  2⤵
  PID:7536
- C:\Windows\System\RbgDrvY.exe
  C:\Windows\System\RbgDrvY.exe
  2⤵
  PID:7556
- C:\Windows\System\IpATkHT.exe
  C:\Windows\System\IpATkHT.exe
  2⤵
  PID:7572
- C:\Windows\System\vYLGTrE.exe
  C:\Windows\System\vYLGTrE.exe
  2⤵
  PID:7588
- C:\Windows\System\fWkUXwQ.exe
  C:\Windows\System\fWkUXwQ.exe
  2⤵
  PID:7608
- C:\Windows\System\BCYVsyA.exe
  C:\Windows\System\BCYVsyA.exe
  2⤵
  PID:7624
- C:\Windows\System\BjGHShl.exe
  C:\Windows\System\BjGHShl.exe
  2⤵
  PID:7640
- C:\Windows\System\NERrNcJ.exe
  C:\Windows\System\NERrNcJ.exe
  2⤵
  PID:7656
- C:\Windows\System\dzDzRMZ.exe
  C:\Windows\System\dzDzRMZ.exe
  2⤵
  PID:7672
- C:\Windows\System\oQbfeqQ.exe
  C:\Windows\System\oQbfeqQ.exe
  2⤵
  PID:7688
- C:\Windows\System\McsBogZ.exe
  C:\Windows\System\McsBogZ.exe
  2⤵
  PID:7708
- C:\Windows\System\FSTyqHu.exe
  C:\Windows\System\FSTyqHu.exe
  2⤵
  PID:7724
- C:\Windows\System\liArHyc.exe
  C:\Windows\System\liArHyc.exe
  2⤵
  PID:7740
- C:\Windows\System\nqEVAgO.exe
  C:\Windows\System\nqEVAgO.exe
  2⤵
  PID:7756
- C:\Windows\System\KwnckYo.exe
  C:\Windows\System\KwnckYo.exe
  2⤵
  PID:7772
- C:\Windows\System\CGtgFqe.exe
  C:\Windows\System\CGtgFqe.exe
  2⤵
  PID:7792
- C:\Windows\System\UiAEnyg.exe
  C:\Windows\System\UiAEnyg.exe
  2⤵
  PID:7808
- C:\Windows\System\oNDKKoS.exe
  C:\Windows\System\oNDKKoS.exe
  2⤵
  PID:7824
- C:\Windows\System\CaewWaY.exe
  C:\Windows\System\CaewWaY.exe
  2⤵
  PID:7840
- C:\Windows\System\ViQrxXY.exe
  C:\Windows\System\ViQrxXY.exe
  2⤵
  PID:7860
- C:\Windows\System\apiAWQF.exe
  C:\Windows\System\apiAWQF.exe
  2⤵
  PID:7876
- C:\Windows\System\fsQTGIG.exe
  C:\Windows\System\fsQTGIG.exe
  2⤵
  PID:7892
- C:\Windows\System\JgewDvd.exe
  C:\Windows\System\JgewDvd.exe
  2⤵
  PID:7908
- C:\Windows\System\xlvgjNk.exe
  C:\Windows\System\xlvgjNk.exe
  2⤵
  PID:7932
- C:\Windows\System\MotweWX.exe
  C:\Windows\System\MotweWX.exe
  2⤵
  PID:7948
- C:\Windows\System\sDegXzQ.exe
  C:\Windows\System\sDegXzQ.exe
  2⤵
  PID:7964
- C:\Windows\System\uWPGxZp.exe
  C:\Windows\System\uWPGxZp.exe
  2⤵
  PID:7980
- C:\Windows\System\iaiiDtU.exe
  C:\Windows\System\iaiiDtU.exe
  2⤵
  PID:7996
- C:\Windows\System\cDMeGCk.exe
  C:\Windows\System\cDMeGCk.exe
  2⤵
  PID:8012
- C:\Windows\System\sayeLMx.exe
  C:\Windows\System\sayeLMx.exe
  2⤵
  PID:8028
- C:\Windows\System\qMXEWiA.exe
  C:\Windows\System\qMXEWiA.exe
  2⤵
  PID:8044
- C:\Windows\System\tZWCSQB.exe
  C:\Windows\System\tZWCSQB.exe
  2⤵
  PID:8112
- C:\Windows\System\DWLxgJY.exe
  C:\Windows\System\DWLxgJY.exe
  2⤵
  PID:8128
- C:\Windows\System\QDbKygs.exe
  C:\Windows\System\QDbKygs.exe
  2⤵
  PID:8144
- C:\Windows\System\wpHevwm.exe
  C:\Windows\System\wpHevwm.exe
  2⤵
  PID:8160
- C:\Windows\System\GXZkluN.exe
  C:\Windows\System\GXZkluN.exe
  2⤵
  PID:8184
- C:\Windows\System\PjxHkLy.exe
  C:\Windows\System\PjxHkLy.exe
  2⤵
  PID:7108
- C:\Windows\System\TvHWsJX.exe
  C:\Windows\System\TvHWsJX.exe
  2⤵
  PID:6408
- C:\Windows\System\FFDeFRS.exe
  C:\Windows\System\FFDeFRS.exe
  2⤵
  PID:7200
- C:\Windows\System\LVXRsMv.exe
  C:\Windows\System\LVXRsMv.exe
  2⤵
  PID:7264
- C:\Windows\System\blPMZOi.exe
  C:\Windows\System\blPMZOi.exe
  2⤵
  PID:6928
- C:\Windows\System\lJLkgnr.exe
  C:\Windows\System\lJLkgnr.exe
  2⤵
  PID:7220
- C:\Windows\System\pbhnLLV.exe
  C:\Windows\System\pbhnLLV.exe
  2⤵
  PID:7296
- C:\Windows\System\gWpkTqa.exe
  C:\Windows\System\gWpkTqa.exe
  2⤵
  PID:7312
- C:\Windows\System\XwXFrZW.exe
  C:\Windows\System\XwXFrZW.exe
  2⤵
  PID:7332
- C:\Windows\System\NZpCOhf.exe
  C:\Windows\System\NZpCOhf.exe
  2⤵
  PID:7396
- C:\Windows\System\KsppsIX.exe
  C:\Windows\System\KsppsIX.exe
  2⤵
  PID:7488
- C:\Windows\System\FuBbPuk.exe
  C:\Windows\System\FuBbPuk.exe
  2⤵
  PID:7472
- C:\Windows\System\osMeNgs.exe
  C:\Windows\System\osMeNgs.exe
  2⤵
  PID:7476
- C:\Windows\System\LuimgaZ.exe
  C:\Windows\System\LuimgaZ.exe
  2⤵
  PID:1808
- C:\Windows\System\SMBbWUu.exe
  C:\Windows\System\SMBbWUu.exe
  2⤵
  PID:7604
- C:\Windows\System\hWYcxIX.exe
  C:\Windows\System\hWYcxIX.exe
  2⤵
  PID:7664
- C:\Windows\System\DETwjOq.exe
  C:\Windows\System\DETwjOq.exe
  2⤵
  PID:7648
- C:\Windows\System\lfkeAWh.exe
  C:\Windows\System\lfkeAWh.exe
  2⤵
  PID:7748
- C:\Windows\System\pqqfbuP.exe
  C:\Windows\System\pqqfbuP.exe
  2⤵
  PID:7800
- C:\Windows\System\vjRcayt.exe
  C:\Windows\System\vjRcayt.exe
  2⤵
  PID:7872
- C:\Windows\System\pytFEQD.exe
  C:\Windows\System\pytFEQD.exe
  2⤵
  PID:7900
- C:\Windows\System\xqJMzNR.exe
  C:\Windows\System\xqJMzNR.exe
  2⤵
  PID:8004
- C:\Windows\System\VjOtGmW.exe
  C:\Windows\System\VjOtGmW.exe
  2⤵
  PID:7884
- C:\Windows\System\MNKEVvs.exe
  C:\Windows\System\MNKEVvs.exe
  2⤵
  PID:7924
- C:\Windows\System\pUIXyrC.exe
  C:\Windows\System\pUIXyrC.exe
  2⤵
  PID:8020
- C:\Windows\System\MGRgwnM.exe
  C:\Windows\System\MGRgwnM.exe
  2⤵
  PID:8064
- C:\Windows\System\TuogpMp.exe
  C:\Windows\System\TuogpMp.exe
  2⤵
  PID:8140
- C:\Windows\System\Myugggr.exe
  C:\Windows\System\Myugggr.exe
  2⤵
  PID:6780
- C:\Windows\System\GlqpKZL.exe
  C:\Windows\System\GlqpKZL.exe
  2⤵
  PID:7216
- C:\Windows\System\HGICRBW.exe
  C:\Windows\System\HGICRBW.exe
  2⤵
  PID:7392
- C:\Windows\System\MNTTNBo.exe
  C:\Windows\System\MNTTNBo.exe
  2⤵
  PID:8180
- C:\Windows\System\sqZqgaa.exe
  C:\Windows\System\sqZqgaa.exe
  2⤵
  PID:7580
- C:\Windows\System\BccWDiN.exe
  C:\Windows\System\BccWDiN.exe
  2⤵
  PID:7028
- C:\Windows\System\NXeJuIB.exe
  C:\Windows\System\NXeJuIB.exe
  2⤵
  PID:7328
- C:\Windows\System\SvzrQwf.exe
  C:\Windows\System\SvzrQwf.exe
  2⤵
  PID:7516
- C:\Windows\System\yWegNwU.exe
  C:\Windows\System\yWegNwU.exe
  2⤵
  PID:7444
- C:\Windows\System\QiqAbbJ.exe
  C:\Windows\System\QiqAbbJ.exe
  2⤵
  PID:7252
- C:\Windows\System\CtArdaJ.exe
  C:\Windows\System\CtArdaJ.exe
  2⤵
  PID:6040
- C:\Windows\System\nSPYwvp.exe
  C:\Windows\System\nSPYwvp.exe
  2⤵
  PID:7716
- C:\Windows\System\iNYvvII.exe
  C:\Windows\System\iNYvvII.exe
  2⤵
  PID:7736
- C:\Windows\System\aSLVjEI.exe
  C:\Windows\System\aSLVjEI.exe
  2⤵
  PID:7764
- C:\Windows\System\NqKCVhS.exe
  C:\Windows\System\NqKCVhS.exe
  2⤵
  PID:7412
- C:\Windows\System\VFqhKCf.exe
  C:\Windows\System\VFqhKCf.exe
  2⤵
  PID:7992
- C:\Windows\System\tAqfYXL.exe
  C:\Windows\System\tAqfYXL.exe
  2⤵
  PID:7564
- C:\Windows\System\roOJbVl.exe
  C:\Windows\System\roOJbVl.exe
  2⤵
  PID:7364
- C:\Windows\System\azEvQRX.exe
  C:\Windows\System\azEvQRX.exe
  2⤵
  PID:7460
- C:\Windows\System\kkFcOAp.exe
  C:\Windows\System\kkFcOAp.exe
  2⤵
  PID:8056
- C:\Windows\System\NdpHEAR.exe
  C:\Windows\System\NdpHEAR.exe
  2⤵
  PID:7408
- C:\Windows\System\BCcZfyH.exe
  C:\Windows\System\BCcZfyH.exe
  2⤵
  PID:6516
- C:\Windows\System\ysNSKiZ.exe
  C:\Windows\System\ysNSKiZ.exe
  2⤵
  PID:7620
- C:\Windows\System\xICvGbM.exe
  C:\Windows\System\xICvGbM.exe
  2⤵
  PID:7836
- C:\Windows\System\ncCJDey.exe
  C:\Windows\System\ncCJDey.exe
  2⤵
  PID:7548
- C:\Windows\System\YpjSFwz.exe
  C:\Windows\System\YpjSFwz.exe
  2⤵
  PID:8196
- C:\Windows\System\JNCVcUb.exe
  C:\Windows\System\JNCVcUb.exe
  2⤵
  PID:8212
- C:\Windows\System\nyUWVjG.exe
  C:\Windows\System\nyUWVjG.exe
  2⤵
  PID:8228
- C:\Windows\System\XMQcrUR.exe
  C:\Windows\System\XMQcrUR.exe
  2⤵
  PID:8244
- C:\Windows\System\RCYNFOr.exe
  C:\Windows\System\RCYNFOr.exe
  2⤵
  PID:8260
- C:\Windows\System\cQCbFPu.exe
  C:\Windows\System\cQCbFPu.exe
  2⤵
  PID:8276
- C:\Windows\System\UfOtGti.exe
  C:\Windows\System\UfOtGti.exe
  2⤵
  PID:8292
- C:\Windows\System\KJdyxbf.exe
  C:\Windows\System\KJdyxbf.exe
  2⤵
  PID:8308
- C:\Windows\System\qZWnvFw.exe
  C:\Windows\System\qZWnvFw.exe
  2⤵
  PID:8328
- C:\Windows\System\xxPWFyr.exe
  C:\Windows\System\xxPWFyr.exe
  2⤵
  PID:8344
- C:\Windows\System\RySQhOo.exe
  C:\Windows\System\RySQhOo.exe
  2⤵
  PID:8360
- C:\Windows\System\NdRDMba.exe
  C:\Windows\System\NdRDMba.exe
  2⤵
  PID:8376
- C:\Windows\System\uVSlCTe.exe
  C:\Windows\System\uVSlCTe.exe
  2⤵
  PID:8392
- C:\Windows\System\vbZgbQG.exe
  C:\Windows\System\vbZgbQG.exe
  2⤵
  PID:8408
- C:\Windows\System\xIIXjoE.exe
  C:\Windows\System\xIIXjoE.exe
  2⤵
  PID:8424
- C:\Windows\System\pPpJNJH.exe
  C:\Windows\System\pPpJNJH.exe
  2⤵
  PID:8440
- C:\Windows\System\IOFxnIx.exe
  C:\Windows\System\IOFxnIx.exe
  2⤵
  PID:8456
- C:\Windows\System\DHtMKAG.exe
  C:\Windows\System\DHtMKAG.exe
  2⤵
  PID:8472
- C:\Windows\System\GuyKuYF.exe
  C:\Windows\System\GuyKuYF.exe
  2⤵
  PID:8488
- C:\Windows\System\wJTqtLc.exe
  C:\Windows\System\wJTqtLc.exe
  2⤵
  PID:8504
- C:\Windows\System\XstzTnK.exe
  C:\Windows\System\XstzTnK.exe
  2⤵
  PID:8524
- C:\Windows\System\BGObaov.exe
  C:\Windows\System\BGObaov.exe
  2⤵
  PID:8540
- C:\Windows\System\WzyZIoN.exe
  C:\Windows\System\WzyZIoN.exe
  2⤵
  PID:8560
- C:\Windows\System\RKJuldp.exe
  C:\Windows\System\RKJuldp.exe
  2⤵
  PID:8576
- C:\Windows\System\zCueWwr.exe
  C:\Windows\System\zCueWwr.exe
  2⤵
  PID:8592
- C:\Windows\System\NyfweCj.exe
  C:\Windows\System\NyfweCj.exe
  2⤵
  PID:8612
- C:\Windows\System\EatynLA.exe
  C:\Windows\System\EatynLA.exe
  2⤵
  PID:8632
- C:\Windows\System\bqHYWCa.exe
  C:\Windows\System\bqHYWCa.exe
  2⤵
  PID:8648
- C:\Windows\System\TaKclOa.exe
  C:\Windows\System\TaKclOa.exe
  2⤵
  PID:8668
- C:\Windows\System\lqtXRcW.exe
  C:\Windows\System\lqtXRcW.exe
  2⤵
  PID:8684
- C:\Windows\System\gNdfHPf.exe
  C:\Windows\System\gNdfHPf.exe
  2⤵
  PID:8700
- C:\Windows\System\BqsDXhR.exe
  C:\Windows\System\BqsDXhR.exe
  2⤵
  PID:8716
- C:\Windows\System\UwVzeoz.exe
  C:\Windows\System\UwVzeoz.exe
  2⤵
  PID:8732
- C:\Windows\System\LJOcqoH.exe
  C:\Windows\System\LJOcqoH.exe
  2⤵
  PID:8752
- C:\Windows\System\oBdyyqv.exe
  C:\Windows\System\oBdyyqv.exe
  2⤵
  PID:8772
- C:\Windows\System\Umocyuu.exe
  C:\Windows\System\Umocyuu.exe
  2⤵
  PID:8788
- C:\Windows\System\FtrUibu.exe
  C:\Windows\System\FtrUibu.exe
  2⤵
  PID:8808
- C:\Windows\System\mREnBdh.exe
  C:\Windows\System\mREnBdh.exe
  2⤵
  PID:8824
- C:\Windows\System\eCooWeS.exe
  C:\Windows\System\eCooWeS.exe
  2⤵
  PID:8840
- C:\Windows\System\SQPlTiJ.exe
  C:\Windows\System\SQPlTiJ.exe
  2⤵
  PID:8856
- C:\Windows\System\KUlwPpJ.exe
  C:\Windows\System\KUlwPpJ.exe
  2⤵
  PID:8872
- C:\Windows\System\rTsosSV.exe
  C:\Windows\System\rTsosSV.exe
  2⤵
  PID:8932
- C:\Windows\System\ZKCEbkI.exe
  C:\Windows\System\ZKCEbkI.exe
  2⤵
  PID:8948
- C:\Windows\System\IVqYFNq.exe
  C:\Windows\System\IVqYFNq.exe
  2⤵
  PID:8964
- C:\Windows\System\RHHkzsA.exe
  C:\Windows\System\RHHkzsA.exe
  2⤵
  PID:8980
- C:\Windows\System\SLJyvEW.exe
  C:\Windows\System\SLJyvEW.exe
  2⤵
  PID:8996
- C:\Windows\System\VkLRbYG.exe
  C:\Windows\System\VkLRbYG.exe
  2⤵
  PID:9012
- C:\Windows\System\zAxlwOt.exe
  C:\Windows\System\zAxlwOt.exe
  2⤵
  PID:9028
- C:\Windows\System\eUCdIcP.exe
  C:\Windows\System\eUCdIcP.exe
  2⤵
  PID:9044
- C:\Windows\System\pPHGdFD.exe
  C:\Windows\System\pPHGdFD.exe
  2⤵
  PID:9060
- C:\Windows\System\acaoGLA.exe
  C:\Windows\System\acaoGLA.exe
  2⤵
  PID:9076
- C:\Windows\System\RaJChEC.exe
  C:\Windows\System\RaJChEC.exe
  2⤵
  PID:9092
- C:\Windows\System\RkFNXlB.exe
  C:\Windows\System\RkFNXlB.exe
  2⤵
  PID:9108
- C:\Windows\System\DNJbBrq.exe
  C:\Windows\System\DNJbBrq.exe
  2⤵
  PID:9124
- C:\Windows\System\KNoVLjU.exe
  C:\Windows\System\KNoVLjU.exe
  2⤵
  PID:9140
- C:\Windows\System\PeoSxlT.exe
  C:\Windows\System\PeoSxlT.exe
  2⤵
  PID:9156
- C:\Windows\System\uapTldV.exe
  C:\Windows\System\uapTldV.exe
  2⤵
  PID:9172
- C:\Windows\System\ffFWplh.exe
  C:\Windows\System\ffFWplh.exe
  2⤵
  PID:9188
- C:\Windows\System\CJeNwJo.exe
  C:\Windows\System\CJeNwJo.exe
  2⤵
  PID:9204
- C:\Windows\System\wKeqbwv.exe
  C:\Windows\System\wKeqbwv.exe
  2⤵
  PID:7780
- C:\Windows\System\SxJpvQh.exe
  C:\Windows\System\SxJpvQh.exe
  2⤵
  PID:7916
- C:\Windows\System\avfxABD.exe
  C:\Windows\System\avfxABD.exe
  2⤵
  PID:8252
- C:\Windows\System\qSUUOLg.exe
  C:\Windows\System\qSUUOLg.exe
  2⤵
  PID:8008
- C:\Windows\System\tepHleY.exe
  C:\Windows\System\tepHleY.exe
  2⤵
  PID:7940
- C:\Windows\System\RxdpGbX.exe
  C:\Windows\System\RxdpGbX.exe
  2⤵
  PID:7636
- C:\Windows\System\kdOoaBb.exe
  C:\Windows\System\kdOoaBb.exe
  2⤵
  PID:8316
- C:\Windows\System\EeergBW.exe
  C:\Windows\System\EeergBW.exe
  2⤵
  PID:8356
- C:\Windows\System\DnOVAvD.exe
  C:\Windows\System\DnOVAvD.exe
  2⤵
  PID:8416
- C:\Windows\System\pGPXcqb.exe
  C:\Windows\System\pGPXcqb.exe
  2⤵
  PID:8480
- C:\Windows\System\hwvWVtz.exe
  C:\Windows\System\hwvWVtz.exe
  2⤵
  PID:8520
- C:\Windows\System\RUcxCFV.exe
  C:\Windows\System\RUcxCFV.exe
  2⤵
  PID:8156
- C:\Windows\System\qNVOTAc.exe
  C:\Windows\System\qNVOTAc.exe
  2⤵
  PID:7680
- C:\Windows\System\CMOZNCs.exe
  C:\Windows\System\CMOZNCs.exe
  2⤵
  PID:8304
- C:\Windows\System\Upvxjjm.exe
  C:\Windows\System\Upvxjjm.exe
  2⤵
  PID:8372
- C:\Windows\System\KKObceO.exe
  C:\Windows\System\KKObceO.exe
  2⤵
  PID:8552
- C:\Windows\System\pyXRXDA.exe
  C:\Windows\System\pyXRXDA.exe
  2⤵
  PID:8468
- C:\Windows\System\mFLWEHv.exe
  C:\Windows\System\mFLWEHv.exe
  2⤵
  PID:8536
- C:\Windows\System\EnMUBMk.exe
  C:\Windows\System\EnMUBMk.exe
  2⤵
  PID:8620
- C:\Windows\System\HAkuGTY.exe
  C:\Windows\System\HAkuGTY.exe
  2⤵
  PID:8660
- C:\Windows\System\OxBtVwu.exe
  C:\Windows\System\OxBtVwu.exe
  2⤵
  PID:8724
- C:\Windows\System\MCMvXgn.exe
  C:\Windows\System\MCMvXgn.exe
  2⤵
  PID:8768
- C:\Windows\System\UiKanRe.exe
  C:\Windows\System\UiKanRe.exe
  2⤵
  PID:7988
- C:\Windows\System\DWkCTDc.exe
  C:\Windows\System\DWkCTDc.exe
  2⤵
  PID:8740
- C:\Windows\System\usjrjrr.exe
  C:\Windows\System\usjrjrr.exe
  2⤵
  PID:8796
- C:\Windows\System\JMjtwQI.exe
  C:\Windows\System\JMjtwQI.exe
  2⤵
  PID:8836
- C:\Windows\System\JavlZqi.exe
  C:\Windows\System\JavlZqi.exe
  2⤵
  PID:8848
- C:\Windows\System\QnNoUDw.exe
  C:\Windows\System\QnNoUDw.exe
  2⤵
  PID:7928
- C:\Windows\System\Kqlytrp.exe
  C:\Windows\System\Kqlytrp.exe
  2⤵
  PID:8888
- C:\Windows\System\WgWyNdg.exe
  C:\Windows\System\WgWyNdg.exe
  2⤵
  PID:9116
- C:\Windows\System\MRnsjvS.exe
  C:\Windows\System\MRnsjvS.exe
  2⤵
  PID:9180
- C:\Windows\System\SjyNGBh.exe
  C:\Windows\System\SjyNGBh.exe
  2⤵
  PID:8220
- C:\Windows\System\PIOijJW.exe
  C:\Windows\System\PIOijJW.exe
  2⤵
  PID:7960
- C:\Windows\System\ZeskDOs.exe
  C:\Windows\System\ZeskDOs.exe
  2⤵
  PID:7768
- C:\Windows\System\ARIAMYB.exe
  C:\Windows\System\ARIAMYB.exe
  2⤵
  PID:8944
- C:\Windows\System\YxwmaCE.exe
  C:\Windows\System\YxwmaCE.exe
  2⤵
  PID:9040
- C:\Windows\System\soFQipM.exe
  C:\Windows\System\soFQipM.exe
  2⤵
  PID:7632
- C:\Windows\System\bvfGWiO.exe
  C:\Windows\System\bvfGWiO.exe
  2⤵
  PID:9132
- C:\Windows\System\DevTafl.exe
  C:\Windows\System\DevTafl.exe
  2⤵
  PID:7732
- C:\Windows\System\nSqvjUa.exe
  C:\Windows\System\nSqvjUa.exe
  2⤵
  PID:9104
- C:\Windows\System\XQhGiRA.exe
  C:\Windows\System\XQhGiRA.exe
  2⤵
  PID:8256
- C:\Windows\System\YdGjxHC.exe
  C:\Windows\System\YdGjxHC.exe
  2⤵
  PID:8904
- C:\Windows\System\QcfJYtt.exe
  C:\Windows\System\QcfJYtt.exe
  2⤵
  PID:8436
- C:\Windows\System\QcMkUfv.exe
  C:\Windows\System\QcMkUfv.exe
  2⤵
  PID:8664
- C:\Windows\System\NBSKUaJ.exe
  C:\Windows\System\NBSKUaJ.exe
  2⤵
  PID:8864
- C:\Windows\System\Wnidegq.exe
  C:\Windows\System\Wnidegq.exe
  2⤵
  PID:9148
- C:\Windows\System\OuDMbwR.exe
  C:\Windows\System\OuDMbwR.exe
  2⤵
  PID:7544
- C:\Windows\System\mGCVwYC.exe
  C:\Windows\System\mGCVwYC.exe
  2⤵
  PID:8640
- C:\Windows\System\BejVSnH.exe
  C:\Windows\System\BejVSnH.exe
  2⤵
  PID:9164
- C:\Windows\System\jwBgvGv.exe
  C:\Windows\System\jwBgvGv.exe
  2⤵
  PID:9196
- C:\Windows\System\uzJMKlm.exe
  C:\Windows\System\uzJMKlm.exe
  2⤵
  PID:8608
- C:\Windows\System\ObyxBeS.exe
  C:\Windows\System\ObyxBeS.exe
  2⤵
  PID:8572
- C:\Windows\System\lplkUCu.exe
  C:\Windows\System\lplkUCu.exe
  2⤵
  PID:9228
- C:\Windows\System\xHETHGR.exe
  C:\Windows\System\xHETHGR.exe
  2⤵
  PID:9244
- C:\Windows\System\XDGnsEq.exe
  C:\Windows\System\XDGnsEq.exe
  2⤵
  PID:9260
- C:\Windows\System\BRLQSlr.exe
  C:\Windows\System\BRLQSlr.exe
  2⤵
  PID:9280
- C:\Windows\System\msVsPIa.exe
  C:\Windows\System\msVsPIa.exe
  2⤵
  PID:9296
- C:\Windows\System\CUnPAGD.exe
  C:\Windows\System\CUnPAGD.exe
  2⤵
  PID:9312
- C:\Windows\System\mbAFXMJ.exe
  C:\Windows\System\mbAFXMJ.exe
  2⤵
  PID:9328
- C:\Windows\System\xmKXFct.exe
  C:\Windows\System\xmKXFct.exe
  2⤵
  PID:9344
- C:\Windows\System\OHvqFtn.exe
  C:\Windows\System\OHvqFtn.exe
  2⤵
  PID:9360
- C:\Windows\System\hUNOBLs.exe
  C:\Windows\System\hUNOBLs.exe
  2⤵
  PID:9376
- C:\Windows\System\JohIbhl.exe
  C:\Windows\System\JohIbhl.exe
  2⤵
  PID:9392
- C:\Windows\System\LuYmMrT.exe
  C:\Windows\System\LuYmMrT.exe
  2⤵
  PID:9408
- C:\Windows\System\tcmMuIa.exe
  C:\Windows\System\tcmMuIa.exe
  2⤵
  PID:9424
- C:\Windows\System\FJRsLCd.exe
  C:\Windows\System\FJRsLCd.exe
  2⤵
  PID:9440
- C:\Windows\System\ReXJNlQ.exe
  C:\Windows\System\ReXJNlQ.exe
  2⤵
  PID:9456
- C:\Windows\System\OSjZRLG.exe
  C:\Windows\System\OSjZRLG.exe
  2⤵
  PID:9472
- C:\Windows\System\YMDpFHh.exe
  C:\Windows\System\YMDpFHh.exe
  2⤵
  PID:9488
- C:\Windows\System\mhBoafp.exe
  C:\Windows\System\mhBoafp.exe
  2⤵
  PID:9504
- C:\Windows\System\BLsuTOx.exe
  C:\Windows\System\BLsuTOx.exe
  2⤵
  PID:9520
- C:\Windows\System\lBVsMax.exe
  C:\Windows\System\lBVsMax.exe
  2⤵
  PID:9536
- C:\Windows\System\wsCNduy.exe
  C:\Windows\System\wsCNduy.exe
  2⤵
  PID:9552
- C:\Windows\System\uclXkyA.exe
  C:\Windows\System\uclXkyA.exe
  2⤵
  PID:9568
- C:\Windows\System\FdBpfHO.exe
  C:\Windows\System\FdBpfHO.exe
  2⤵
  PID:9584
- C:\Windows\System\LSloRMZ.exe
  C:\Windows\System\LSloRMZ.exe
  2⤵
  PID:9600
- C:\Windows\System\LQHfuig.exe
  C:\Windows\System\LQHfuig.exe
  2⤵
  PID:9616
- C:\Windows\System\WmHIplH.exe
  C:\Windows\System\WmHIplH.exe
  2⤵
  PID:9632
- C:\Windows\System\ZjWeikr.exe
  C:\Windows\System\ZjWeikr.exe
  2⤵
  PID:9648
- C:\Windows\System\ainXGra.exe
  C:\Windows\System\ainXGra.exe
  2⤵
  PID:9668
- C:\Windows\System\IAJdybH.exe
  C:\Windows\System\IAJdybH.exe
  2⤵
  PID:9684
- C:\Windows\System\ZjKFLGd.exe
  C:\Windows\System\ZjKFLGd.exe
  2⤵
  PID:9700
- C:\Windows\System\hzhgRqx.exe
  C:\Windows\System\hzhgRqx.exe
  2⤵
  PID:9716
- C:\Windows\System\nOrodtl.exe
  C:\Windows\System\nOrodtl.exe
  2⤵
  PID:9732
- C:\Windows\System\kCVtGkx.exe
  C:\Windows\System\kCVtGkx.exe
  2⤵
  PID:9748
- C:\Windows\System\BSwVgZA.exe
  C:\Windows\System\BSwVgZA.exe
  2⤵
  PID:9764
- C:\Windows\System\zPbOFSo.exe
  C:\Windows\System\zPbOFSo.exe
  2⤵
  PID:9780
- C:\Windows\System\cJgeGwW.exe
  C:\Windows\System\cJgeGwW.exe
  2⤵
  PID:9796
- C:\Windows\System\CCmKFzr.exe
  C:\Windows\System\CCmKFzr.exe
  2⤵
  PID:9812
- C:\Windows\System\tHkJYgu.exe
  C:\Windows\System\tHkJYgu.exe
  2⤵
  PID:9828
- C:\Windows\System\aXpvOhl.exe
  C:\Windows\System\aXpvOhl.exe
  2⤵
  PID:9844
- C:\Windows\System\BxsJsiw.exe
  C:\Windows\System\BxsJsiw.exe
  2⤵
  PID:9860
- C:\Windows\System\nxDGvZU.exe
  C:\Windows\System\nxDGvZU.exe
  2⤵
  PID:9876
- C:\Windows\System\xxyDWLJ.exe
  C:\Windows\System\xxyDWLJ.exe
  2⤵
  PID:9892
- C:\Windows\System\ChTYBGW.exe
  C:\Windows\System\ChTYBGW.exe
  2⤵
  PID:9908
- C:\Windows\System\vvQFHPx.exe
  C:\Windows\System\vvQFHPx.exe
  2⤵
  PID:9924
- C:\Windows\System\BLPPcXA.exe
  C:\Windows\System\BLPPcXA.exe
  2⤵
  PID:9940
- C:\Windows\System\qbyuqFa.exe
  C:\Windows\System\qbyuqFa.exe
  2⤵
  PID:9956
- C:\Windows\System\EQsOGJA.exe
  C:\Windows\System\EQsOGJA.exe
  2⤵
  PID:9972
- C:\Windows\System\jExQWCC.exe
  C:\Windows\System\jExQWCC.exe
  2⤵
  PID:9988
- C:\Windows\System\OGuMAXm.exe
  C:\Windows\System\OGuMAXm.exe
  2⤵
  PID:10004
- C:\Windows\System\xJhSouM.exe
  C:\Windows\System\xJhSouM.exe
  2⤵
  PID:10020
- C:\Windows\System\uIHYyOx.exe
  C:\Windows\System\uIHYyOx.exe
  2⤵
  PID:10036
- C:\Windows\System\OPfgfHZ.exe
  C:\Windows\System\OPfgfHZ.exe
  2⤵
  PID:10052
- C:\Windows\System\nwdjroA.exe
  C:\Windows\System\nwdjroA.exe
  2⤵
  PID:10068
- C:\Windows\System\wOQINjI.exe
  C:\Windows\System\wOQINjI.exe
  2⤵
  PID:10084
- C:\Windows\System\DuAVSTs.exe
  C:\Windows\System\DuAVSTs.exe
  2⤵
  PID:10100
- C:\Windows\System\oDLmyDq.exe
  C:\Windows\System\oDLmyDq.exe
  2⤵
  PID:10120
- C:\Windows\System\EyeXenF.exe
  C:\Windows\System\EyeXenF.exe
  2⤵
  PID:10136
- C:\Windows\System\GlkSucP.exe
  C:\Windows\System\GlkSucP.exe
  2⤵
  PID:10152
- C:\Windows\System\yKqrKUK.exe
  C:\Windows\System\yKqrKUK.exe
  2⤵
  PID:10168
- C:\Windows\System\zigfXmM.exe
  C:\Windows\System\zigfXmM.exe
  2⤵
  PID:10184
- C:\Windows\System\tlCYDxp.exe
  C:\Windows\System\tlCYDxp.exe
  2⤵
  PID:10200
- C:\Windows\System\jmezHvU.exe
  C:\Windows\System\jmezHvU.exe
  2⤵
  PID:10216
- C:\Windows\System\HTqmfgg.exe
  C:\Windows\System\HTqmfgg.exe
  2⤵
  PID:10232
- C:\Windows\System\BIpVQhs.exe
  C:\Windows\System\BIpVQhs.exe
  2⤵
  PID:9292
- C:\Windows\System\maiafDe.exe
  C:\Windows\System\maiafDe.exe
  2⤵
  PID:9220
- C:\Windows\System\gVLBgyJ.exe
  C:\Windows\System\gVLBgyJ.exe
  2⤵
  PID:9320
- C:\Windows\System\LJMnwSq.exe
  C:\Windows\System\LJMnwSq.exe
  2⤵
  PID:9420
- C:\Windows\System\oqxpNpE.exe
  C:\Windows\System\oqxpNpE.exe
  2⤵
  PID:9512
- C:\Windows\System\ZIwhZDj.exe
  C:\Windows\System\ZIwhZDj.exe
  2⤵
  PID:9548
- C:\Windows\System\NtPRhzO.exe
  C:\Windows\System\NtPRhzO.exe
  2⤵
  PID:9612
- C:\Windows\System\AFJXDSq.exe
  C:\Windows\System\AFJXDSq.exe
  2⤵
  PID:9680
- C:\Windows\System\DEyoDdw.exe
  C:\Windows\System\DEyoDdw.exe
  2⤵
  PID:8852
- C:\Windows\System\VQQjiPK.exe
  C:\Windows\System\VQQjiPK.exe
  2⤵
  PID:9808
- C:\Windows\System\wxilUyv.exe
  C:\Windows\System\wxilUyv.exe
  2⤵
  PID:9904
- C:\Windows\System\OTIspNR.exe
  C:\Windows\System\OTIspNR.exe
  2⤵
  PID:9964
- C:\Windows\System\JnnkKmw.exe
  C:\Windows\System\JnnkKmw.exe
  2⤵
  PID:9968
- C:\Windows\System\YoVQxgG.exe
  C:\Windows\System\YoVQxgG.exe
  2⤵
  PID:10032
- C:\Windows\System\TTYpHnm.exe
  C:\Windows\System\TTYpHnm.exe
  2⤵
  PID:10128
- C:\Windows\System\dEDhjgJ.exe
  C:\Windows\System\dEDhjgJ.exe
  2⤵
  PID:10164
- C:\Windows\System\EfQrtWZ.exe
  C:\Windows\System\EfQrtWZ.exe
  2⤵
  PID:9252
- C:\Windows\System\umNAnZk.exe
  C:\Windows\System\umNAnZk.exe
  2⤵
  PID:9084
- C:\Windows\System\ypSgzOi.exe
  C:\Windows\System\ypSgzOi.exe
  2⤵
  PID:9516
- C:\Windows\System\BmKfFTz.exe
  C:\Windows\System\BmKfFTz.exe
  2⤵
  PID:9744
- C:\Windows\System\GgFSvUn.exe
  C:\Windows\System\GgFSvUn.exe
  2⤵
  PID:9996
- C:\Windows\System\AvKLiFS.exe
  C:\Windows\System\AvKLiFS.exe
  2⤵
  PID:7920
- C:\Windows\System\ewyWMpn.exe
  C:\Windows\System\ewyWMpn.exe
  2⤵
  PID:9336
- C:\Windows\System\dZUBgPt.exe
  C:\Windows\System\dZUBgPt.exe
  2⤵
  PID:9400
- C:\Windows\System\UyJSZqu.exe
  C:\Windows\System\UyJSZqu.exe
  2⤵
  PID:8500
- C:\Windows\System\czxZUGc.exe
  C:\Windows\System\czxZUGc.exe
  2⤵
  PID:9432
- C:\Windows\System\SYtkvaJ.exe
  C:\Windows\System\SYtkvaJ.exe
  2⤵
  PID:9528
- C:\Windows\System\ZyDHpFl.exe
  C:\Windows\System\ZyDHpFl.exe
  2⤵
  PID:9628
- C:\Windows\System\DtJfKOK.exe
  C:\Windows\System\DtJfKOK.exe
  2⤵
  PID:9664
- C:\Windows\System\svKrmPU.exe
  C:\Windows\System\svKrmPU.exe
  2⤵
  PID:8800
- C:\Windows\System\naFrpdM.exe
  C:\Windows\System\naFrpdM.exe
  2⤵
  PID:9824
- C:\Windows\System\NeXEbGK.exe
  C:\Windows\System\NeXEbGK.exe
  2⤵
  PID:9948
- C:\Windows\System\dtJoLsz.exe
  C:\Windows\System\dtJoLsz.exe
  2⤵
  PID:10048
- C:\Windows\System\VemLCeb.exe
  C:\Windows\System\VemLCeb.exe
  2⤵
  PID:10108
- C:\Windows\System\GStcMXY.exe
  C:\Windows\System\GStcMXY.exe
  2⤵
  PID:8960
- C:\Windows\System\sWuaKWP.exe
  C:\Windows\System\sWuaKWP.exe
  2⤵
  PID:10148
- C:\Windows\System\VgkvbLf.exe
  C:\Windows\System\VgkvbLf.exe
  2⤵
  PID:10180
- C:\Windows\System\UtpULCV.exe
  C:\Windows\System\UtpULCV.exe
  2⤵
  PID:7344
- C:\Windows\System\LXIjBFW.exe
  C:\Windows\System\LXIjBFW.exe
  2⤵
  PID:8920
- C:\Windows\System\GTRCteO.exe
  C:\Windows\System\GTRCteO.exe
  2⤵
  PID:9136
- C:\Windows\System\zYrZoIR.exe
  C:\Windows\System\zYrZoIR.exe
  2⤵
  PID:9072
- C:\Windows\System\sAaDUaX.exe
  C:\Windows\System\sAaDUaX.exe
  2⤵
  PID:9676
- C:\Windows\System\YWkFePR.exe
  C:\Windows\System\YWkFePR.exe
  2⤵
  PID:8656
- C:\Windows\System\GnNuTyL.exe
  C:\Windows\System\GnNuTyL.exe
  2⤵
  PID:8712
- C:\Windows\System\JgDZikg.exe
  C:\Windows\System\JgDZikg.exe
  2⤵
  PID:10080
- C:\Windows\System\xYMStcz.exe
  C:\Windows\System\xYMStcz.exe
  2⤵
  PID:9884
- C:\Windows\System\NJaioIq.exe
  C:\Windows\System\NJaioIq.exe
  2⤵
  PID:9624
- C:\Windows\System\IudJNNC.exe
  C:\Windows\System\IudJNNC.exe
  2⤵
  PID:8992
- C:\Windows\System\sTiQStV.exe
  C:\Windows\System\sTiQStV.exe
  2⤵
  PID:10252
- C:\Windows\System\REdyjWz.exe
  C:\Windows\System\REdyjWz.exe
  2⤵
  PID:10276
- C:\Windows\System\kvNWJrR.exe
  C:\Windows\System\kvNWJrR.exe
  2⤵
  PID:10292
- C:\Windows\System\usboFIe.exe
  C:\Windows\System\usboFIe.exe
  2⤵
  PID:10352
- C:\Windows\System\hkOChAn.exe
  C:\Windows\System\hkOChAn.exe
  2⤵
  PID:10368
- C:\Windows\System\atdKwqI.exe
  C:\Windows\System\atdKwqI.exe
  2⤵
  PID:10384
- C:\Windows\System\bokJVej.exe
  C:\Windows\System\bokJVej.exe
  2⤵
  PID:10400
- C:\Windows\System\NMaRByS.exe
  C:\Windows\System\NMaRByS.exe
  2⤵
  PID:10416
- C:\Windows\System\RwVTYsd.exe
  C:\Windows\System\RwVTYsd.exe
  2⤵
  PID:10432
- C:\Windows\System\LDzKfag.exe
  C:\Windows\System\LDzKfag.exe
  2⤵
  PID:10460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BHYvMAM.exe

Filesize
1.4MB

MD5
e75df6108d331f2f573f8016ce04dedc

SHA1
5dfb7f6959ea872c61151d39fc554cbf17cd7101

SHA256
a9ca2130313ae6692814646619556acdb0ba6acc89a0c2471c21b8d12d84f47b

SHA512
96368062513efae84c9223055e88d1795097d2b968eb8b116b38a330208edcf56deba15b2c6414de9ba18bfe2ba749ae2423699b0be4c3d1bb3448d3faa81f6a

Download Submit
C:\Windows\system\JRqyWMB.exe

Filesize
1.4MB

MD5
26cd6e44e2d8cd30b5c3dcc5e22be437

SHA1
33008900b0474aa4e6f134f0a4d04e49b6219a30

SHA256
3eb81f8d41e767e5bf17beb59182f81f40a87769772a66dfc1aaba14d396a5c2

SHA512
59b7cf58b376450a8d3eb4fce8f0d5f8e1d3857ec5cd4204635c29043abfc7b3fc4dc2ac0170e49411a256b120c5b62c9df89d2bc928f3864c9a6659f6fb3c49

Download Submit
C:\Windows\system\JiUMVJB.exe

Filesize
1.4MB

MD5
182e4f848799a3aa5cb9f3e6908687df

SHA1
1d4c3087098ee1ec1710dddf268fe30a2e2b0232

SHA256
c1b21a57b11d88d1db39202d33e5c03727a413ed188c9040dcbbf6de5b958b76

SHA512
4cd90678c5a9c668b2a32fb6322ad753bb62be6a712cb026af912db5e14eedcbc33bc4c6f8c4f770861f7d352eae5a289b9c820fe77bacbb940e1b809f655285

Download Submit
C:\Windows\system\NZBTksf.exe

Filesize
1.4MB

MD5
134c463e27ba032c2c85ccca89867976

SHA1
778f6e0d702ab11e66c86d308d1e07a70dcf23b8

SHA256
9e8a8a70fd3f57bdd8abee211bc5c218a8bd68cf5d8cdf18d3307e1cc7678988

SHA512
f01944d847039c7ca866d092ad5385c341197cd25c42580f4fd3a0806bdf6adf15e687e50f59cbedb3f0953e43ba17674946a786aba1b7e6e8758c8ccb81033a

Download Submit
C:\Windows\system\NtaneNl.exe

Filesize
1.4MB

MD5
e8922e4ae1bc6999003482f69bc3b6ac

SHA1
739298270e4e352a1c2a84a4ebca978c49a14ba3

SHA256
800d20d9d3d0667ac4f9f195e73f24a212e35059ae014cc8cb36431f772d7738

SHA512
fc81daf38862135bd06959fc85233b8e3444c85c7d7fbb5359421c0763d9f87d261cce7412ea6c676c69b1cbce13d5acea87a7e8da9e3dcfddb32d5a6373450f

Download Submit
C:\Windows\system\NzpVtqx.exe

Filesize
1.4MB

MD5
2120f7152a45190c4d915f8b525971a6

SHA1
cc7e72f2d97f4a74b6f8bc4c40238f556c380451

SHA256
35e3d6329f41a98f3e210c7399e4cf9a28c57fc1ae5c1a382715e8803f5067f1

SHA512
156d2221431e4e2ffc127903757690c7b4e6a29873f7f80ae754e2fd67cb98087a7dd25dd64cb82ba8c6ab3a718beefa0560651f1de4587d7bf90d381204951e

Download Submit
C:\Windows\system\OXizvhM.exe

Filesize
1.4MB

MD5
46c36a9ef426fe8f7c54ba69c0875020

SHA1
81046e65b917114a8d6a6fe242fb30d3c147ea88

SHA256
c0597d800455ac883b73ce5a6bf099be158aaecb3d2adc69206c3226fab53678

SHA512
a048f198de7a7deaf0dbc690ba823a8cd4d352d02367a6c3ebeaf783ffd921903a31d589b2974d16e5e21153470fe781637783cf2d46928242a037ae2a6a378b

Download Submit
C:\Windows\system\RkTMEFT.exe

Filesize
1.4MB

MD5
5a210b3f3413e3c66a63892f3c37ca65

SHA1
df858270ed67c4682a7fbbb0eb3506b3bf4b34f9

SHA256
410b019e6e0263809b5af966fc633ec1fc9bd48ec7da8ce4c0b6e2c8d269c801

SHA512
88b14ea2308c3db51ece25bf8e2b0fe60afa8ede10c07da8f8d4cd551f1c48af43820a8cce5a6136dcdd22a1c48de2a435ed94144a578b06c6b448184c585152

Download Submit
C:\Windows\system\SiulRuP.exe

Filesize
18B

MD5
98dbaea0a2672edce823e25a4d8bd0fe

SHA1
d09cac58408a9d9053b9d0becfa29a282f563bb8

SHA256
2d04180dbb71e06b64f51e97726eb98b2b7e2dbc8ed2da0335f09cc3e8eb655a

SHA512
feb2efbe8d617531973fca0389c760d6c816b08acfb396adbecd9f490d83d0988eecc0f8b29124400314382427cd97a66a37eefa4f8971c22dc2834a65c91cbc

Download Submit
C:\Windows\system\VBbpcHt.exe

Filesize
1.4MB

MD5
0bac6e1c1c3f490b7f4e38b515952ccc

SHA1
32649f609fc7bafd5b0b1f76d09282423c108f80

SHA256
26cfbe7fc2bcb2b64d63137718297a6e1519cf7fa4d738c97c182a0522ab8302

SHA512
ef121a13bc6d2f3ef4953e11c1357f5bf5269eacb39cd30b3752ea9374a57b3b128b20c18d38f96b5bd9cfd50c3811c11b95b62b79845265f358ef7256d4a45d

Download Submit
C:\Windows\system\VJTiGdD.exe

Filesize
1.4MB

MD5
fdf7a0d94eea8f8bd1bfa0d6b352048e

SHA1
12d2beed400a0d34d31374136d4c961b4f72199c

SHA256
c77427a28009ccfb82c42bb27c8042573ef48f4a45c5892cba4051315580e417

SHA512
c974aef3f33890e38567b5cda26a19140a088357372ee057d639eb92177a4f8a19fb004bacad6520e163cd762133752fcb19f4b85cbe98a9728cfa387cc06ef8

Download Submit
C:\Windows\system\YUUsGGe.exe

Filesize
1.4MB

MD5
83f913724c90ded92e78f79a723c7056

SHA1
db62f9f5f75d593bbace55fb02f53cd2113a472c

SHA256
004444af69ee20fc2dfecdee1f2561bcc51bd8643001b2efce4778136435715b

SHA512
228155e5ab7f3d2ec0bc2c892363899f7fbfbf4de4f5d3581f556ccabf6c4eacb7ed719846aaa0745f6910b96adeae267de4ef7a28d1045e701e9248da45acf7

Download Submit
C:\Windows\system\alPFqre.exe

Filesize
1.4MB

MD5
93ace9ed88772627d8a62a4b5d63674a

SHA1
d8c39ad26c207f27b96fb1a85a8e29426bb58658

SHA256
b9f490e17c7ebce5a0c87be1697b90c4c1d6acbfdd2954a2240638c41a9eeaba

SHA512
7dee5fbbff844e9b256f04236d54f5c14d92b5757111cb4bca35970939246fee4d6788869c5aa8574933ace32e3c8378805fdd4f60835816c9fa673e07f3b318

Download Submit
C:\Windows\system\iMpRYYl.exe

Filesize
1.4MB

MD5
2c2c548356b5f203fe62715b9cba52b1

SHA1
945583fc9aa1362cb682ad2927c4d4cada246f68

SHA256
d56acd362e4b0a436d01742b0c6ce3da5f50332f9cb42fad1d87f057ef264e93

SHA512
d5f7ae67e7cfc74e87ff444b3b0f72f7db3ed23d8e81a8ab96a3631c2671bf7f54ad3cb6119d2799628fa21de92834390e92530a8158afa2ba1672e4b8d4581a

Download Submit
C:\Windows\system\jYsHuCo.exe

Filesize
1.4MB

MD5
adb37a849a41a0d247d2b1a530a86902

SHA1
b5b56ee57f4f1570e3747fecc461a2ac22252f6a

SHA256
1f7eefecdab7d239bb7c364f21bc0ddec261bf988809250b784711a861871571

SHA512
1e37d4cafe90925bd253c402547f3e551e691761d525ca50d7ac678856a4c41c5e471a5d69515bc4c6121dd286c7200dab683947d4e9dde5668977b6938e1c2a

Download Submit
C:\Windows\system\mLrPxTI.exe

Filesize
1.4MB

MD5
7cfa73f75cfccd16f21827e58008a64c

SHA1
7a495a7f7246c6cb489a2133e3020731dcf70a9f

SHA256
d4ac36a475583d3ee9494113c084b6061bc0a7e3a97c3e7ff3ce2e515e8ebf5f

SHA512
22e726ad7ba95dcfad0b20fb7708ad602a43c010678866991d895e793716160bb45bf88b7d886a30b64591e04e749e7ac71399f59ea4ba6df8f038b4c995e4b5

Download Submit
C:\Windows\system\sSDMIUm.exe

Filesize
1.4MB

MD5
c067d5d74d6765d4424b7526cc2a20df

SHA1
648fe2f61898fc3d6b460c2f90f0fe21d6abf066

SHA256
16d96a97711083c5e8e2a268f0a3b504cdfe951672500a64d3f9cf229c322c40

SHA512
253108f7f96f43d20eaa4e57ba7fdd7811a47e31eb4b8d8684e8af10f07515f365da52b2fcd190b0d01d663ac5b5dbdec36de23a7b33670401bc82a759665075

Download Submit
C:\Windows\system\snjIlnI.exe

Filesize
1.4MB

MD5
54c84df5744a03c1b40dac672fb480b6

SHA1
0b31fa2aee78b19b768cf087d61e5c76aa2b860a

SHA256
11804c22f189a64bbdd416aa6a2b57b156ed7e548ca3fa565975ee0b6c30b7b5

SHA512
dcc8b949177341b91eefdee277846f866532666cfb5dd0d9eb9ceb232b5e9d622e238889a4bbd515bbed8d6fe67e5446029f644c6867b58250f2fd4d45d45678

Download Submit
C:\Windows\system\wlyfGye.exe

Filesize
1.1MB

MD5
861fb250b05a6730bd0e7b2484d592c5

SHA1
2be0f966223e414afdeb63b01446036f5c251bb8

SHA256
19f0a6f2b6cefd7654bead5087109d1aecf888d3f2bb519762466d0acffbdc16

SHA512
17ef9ab05110905b1683109e1f00a96c538b4527d5a30f62cfa6301274379fd091c1e6a2f7df634eeb43a643c7511a7263d0f138bc58b820914348a124524cbf

Download Submit
\Windows\system\AXaqEIr.exe

Filesize
1.4MB

MD5
6215fad0aad2fdc786f7b1acf7efcb62

SHA1
c2b1f0008e377dcf1d0ca646ed7146c80cb437a0

SHA256
65dd57eecedfa581adb5b58adecd8aec74c9a9b120b23647f2a4042628d9527f

SHA512
4d04fc737582cf902c5207bb7d5cd85e79e9811c81ca47f17201f2dbd0b340f0620ed8ccccdac91be4ae2c5a503f848e5c9381ada4fb08e57b631a03c6e7f0fb

Download Submit
\Windows\system\IUxYSkQ.exe

Filesize
1.4MB

MD5
172e9311380f1df70026e75688d97fd4

SHA1
ee5a8bcdad302819305c772ce6889822a19d5825

SHA256
5770989d44ea44840b7b4c007a0f5a5ec03a72a92547053a51b8993ee949bcae

SHA512
a8c22dc134b5ba2b3b9b35ee5da0bd803295078dd9f9519fc10bc0e18362bf6fd5b638ecc8a4521d491da4a4c750a9c2494bd3531eef9bb4bcf22198c8bbdcc3

Download Submit
\Windows\system\ItaxpFa.exe

Filesize
1.4MB

MD5
dda2c7bf39d04f66fb22acbe5f60e505

SHA1
666dfd706884542e93d83d7670e89ff028145a53

SHA256
648900c187667166043dfbabdb0d496422de6e6d9c6a3f98ffebc17902af932d

SHA512
fbd9b75760471a96457c2ee6af96571267c6cc8b155f61dd8c71a8de4e13f361e1609b58d550a822dbd69ab9f9276b199ee43a63202740c808ef257f41e842f6

Download Submit
\Windows\system\MgaLtKR.exe

Filesize
1.4MB

MD5
fc098a8c36b6bca46e9ad4d6286bf0c9

SHA1
2f4fb75a4c3d83071d606f475efb196b95769f2b

SHA256
a0d89ae38b30a34e37c628b5f319af21f2d9e9b34f9f3c10c4597695f054b81d

SHA512
b13f919bf04b24cf4a54f4a44a249e32cbe1e265b315de2d9f6da1854b7f85bebdcd31bbd2bdfdf48bac3f9948da70a0ab1e587f6aae849229ccffa30e5e57cd

Download Submit
\Windows\system\OwYknqz.exe

Filesize
1.4MB

MD5
6f0e446726afcae0533a8ab1857037a4

SHA1
30093525ed6b520ccc597f15cc387a93ea9ceb4d

SHA256
09f98ea3dfbf3871afe44153d977d8ca1d435a14985744ec2eea662a7e414801

SHA512
be3b309f33c6f6bbf5170362563022af954678088de226813d87fbc65de855317f8db772317bdcada95651a5fba1273481681acba768ac699d4f23d4a8476775

Download Submit
\Windows\system\RkTMEFT.exe

Filesize
1.2MB

MD5
74569c1058ee8219d693618199a357ad

SHA1
dc1b5927108fe68c2839af69311c3b0ef0263d30

SHA256
52356f3b45373b0ff1150867f1c6c8ea9e30c6ead9f93e493aa1a3a501f5db52

SHA512
2576c5a7c1e2de7dec18caf5e638d76b011ab4671e6fa37e1721db3e3533695a2370aecb906b8679fa6950af68826486b45245fcde435cdf0e51ad8bc1f0d122

Download Submit
\Windows\system\RmIFAoy.exe

Filesize
1.4MB

MD5
a0bf20e6bd2e89232926c2736fa859f7

SHA1
7db744b988f283f53e4e93af05c5210c105c925a

SHA256
f2222971521a3cc4ace7a5a4a2f61b77cf4719bf5d0315e85e31bc954df46ab6

SHA512
baaae94326acf0cc5fbb504a0337f54fa3dd5b06d6f14efad8298595bcce529b2673f9258e0be5f7513ae0bfca3de59a07bcf1c1c77c26fd2b9b5a95a6d8c663

Download Submit
\Windows\system\WgdJGOX.exe

Filesize
1.4MB

MD5
5aba81735c71dc90f930e540cede2f0a

SHA1
96ccf66d7e1f5e3ba4ada865449a6cdf0cfaa23f

SHA256
80baecd69bf6a5f084d7825d6a9e987bf5eaaf992fa635a7e1e0e0c3661e4821

SHA512
1c629509681b1f0dbd6981496fbf30defe26e0a7eaf54d97bdc3f5c1791b91fddc9b7e060377f1ce98894c6264180b7f34cc7f40463ead6771cb2fac7767c73a

Download Submit
\Windows\system\XkZbMyh.exe

Filesize
1.4MB

MD5
17a207c7efee365e49d6edb552e090a6

SHA1
bfde81c18da39bf853b0670fce457911ac949d3e

SHA256
5bf8d7bd104d38a9e4e94e2bd51cf37ab7d380217a4f8e41a4d333fa24737b06

SHA512
850c067af3dd27711a3e8b99078950b87302f8818446edcbc8d5537528208ec3fdc4c1766ecb3c4bbc9832cfe30709a7f91b078f81c0ab04e2099b4b5766904e

Download Submit
\Windows\system\efIAGpm.exe

Filesize
1.4MB

MD5
a769aa4c7dfb0c050a5df7ef1afc6df9

SHA1
5d3d28bb8c7f9716f48af17d723469beacc5229b

SHA256
2a644e1a658666ca2d878c6aad055dcf18f29c656a640507033ef916c68125e5

SHA512
183c006e8c772d0ca526944b2f31216313c99ddca44d439cf1ca350e281d27a242c20d2dc6c5b8d8587073769733dc9132d397d627bb0b25cff9da85d0bcacf0

Download Submit
\Windows\system\iISuNxs.exe

Filesize
1.4MB

MD5
5cb87c8aae692f9be880971f39c17d6d

SHA1
bfa0c36602fc2852b25fe5fdc217a0b1dd9a45b7

SHA256
ff13b56d7faa21c70c7ea108b5a86a19d6307555be836436c4692e41120deb0e

SHA512
b66036d17c1568d215216bd6cfbb1d0d46f78a91d85aaa8164b9a9fae5650bfa032239aefe52fc0dab37f59ae69ab92980e573c015afcaa1d718bf378039f9b8

Download Submit
\Windows\system\iMpRYYl.exe

Filesize
1.1MB

MD5
0ce2bb4ce3dbf333d3c95d3e41eb4e4b

SHA1
73e21fb87cb41407a0f78d942022a6812aab4118

SHA256
0135b427fe854e8961ec0cc981af68d46dae6ca467223ee1bba68ad995fb0dde

SHA512
17b60d3750c4db63a04c42114e7c1b6019a4e11ca4ddf903b8ef611ef2644a822b0e8838fcb222993a4220099c8f0ffcc45c1b1358328f13f2cb799bd7b4be73

Download Submit
\Windows\system\jeuZaWZ.exe

Filesize
1.4MB

MD5
67514020ff07d6f96b7097f2c7226fac

SHA1
8522af12c082f7854424985ebb8331c5c4f9e6a2

SHA256
9479e127441a351e8f5faf7054ab16252db7be33bd5d177349713a032a219f17

SHA512
48daf6af4d30c608e87fc33e504e851d6222d3fe3ad82410061650d707ed3ccb3fc31c1db7c589526b2551cb5558d2e78c0699d0f2fcf91d7fdb5067ebd9bf09

Download Submit
\Windows\system\obtHAVg.exe

Filesize
1.4MB

MD5
9c524e1a63a1db4a0742f8dd59816aff

SHA1
fdcbada69cfc014e33f6d9a296886536005c8afb

SHA256
4a3ee4cc008467f05fd7bb3e286cf96701038fa2840cccad8f62127c4a801e4d

SHA512
995c4ec656e90490aa60949c40fc4ee1e6e9b1f5ad403d5296ff3c5aa8d34b9908f083a75ba462cdb274a11a0ff2e4f2d221e342467f360a44674b7f6aa3a105

Download Submit
\Windows\system\pzTXjPf.exe

Filesize
1.4MB

MD5
73062da82eed035dd30948df948331bc

SHA1
a00d7192bdc9af8b7bfbfc26ef1edd47d05a143a

SHA256
abf4e71316290a375dac45e3fdd4897f7395885b192c3bb398ac612f3742e409

SHA512
a20c090b601420686b5f9a525d9b6c63beb58701ad87e4f8b2bf65a98597a79a9fa0b228ece5fc26f663687bebbdd4ae0de8aa80c5fd6d936da16d6870f6e0ae

Download Submit
\Windows\system\qHnIMwM.exe

Filesize
1.4MB

MD5
684a2cf3e3fcf28478044519f7dd524f

SHA1
7614887eebfe67ca4534102994374f85854347f3

SHA256
fb40a66f0ecd17e053e750d68b2b4c436212958b1d31ec507c63c51e21d7ae6c

SHA512
462af3a846a65d90a3379cba1160a28c81c1203f9fa3ab738ecd6e44a2fd3e389c4624b7e1189c1c9372f5280f480c5faa6e787ffd4ede58e1213b7c294f9fd9

Download Submit
\Windows\system\raYehHZ.exe

Filesize
1.4MB

MD5
ad8eaf8d95dac5a23bfc1172fec460e4

SHA1
5b764268e739d5e97dd90561a603582fffad1934

SHA256
9f37cb32c02141af6da7c359f30ab6da99cd9564b7651f68392113e2f5d82a0f

SHA512
cabac7e14308f62941acf15cdd298d254b574ffc4b6cf8fbc27f6bb1a872ef94323b74f33fe81ab33db9d6115d974b55893768214c46bd26f3202778743cce01

Download Submit
\Windows\system\wlyfGye.exe

Filesize
1.4MB

MD5
8515bb8d12b1e267b7317d3dcbc8a665

SHA1
2b0dbbda1dec83f5685b6921a51afcadf65a013e

SHA256
cc21bbd87b5c54e99b57e7eb140f8d32e10cb615ab5873a0dc9bdc4b551d9d7d

SHA512
c029a1a83e5163250574b0ef058aa1a2df58fc8295d8a3a64a356f06574301c9ec114aa56db90fcaea8d88e670cb02de2b57886f96519313377d6fbd35652a91

Download Submit
memory/240-2705-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/240-140-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/1552-2381-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1552-143-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1760-142-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1760-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1760-98-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-135-0x0000000002C80000-0x0000000003072000-memory.dmp

Filesize
3.9MB

Download
memory/1760-137-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-112-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-146-0x0000000002C80000-0x0000000003072000-memory.dmp

Filesize
3.9MB

Download
memory/1760-7-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1760-139-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/1760-14-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1760-102-0x0000000002C80000-0x0000000003072000-memory.dmp

Filesize
3.9MB

Download
memory/1760-100-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1760-0-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1760-13-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-138-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2379-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-2378-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2224-101-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3098-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2408-154-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2428-2706-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2428-104-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2704-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-156-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-2377-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-129-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-392-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2608-97-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/2608-31-0x000007FEF561E000-0x000007FEF561F000-memory.dmp

Filesize
4KB

Download
memory/2608-163-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/2608-164-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2700-3362-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-22-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-21-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2724-2802-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2852-136-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2852-2450-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2992-8-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2992-2380-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download