xmrig | adc1d4d4de7c05b5d4fa32c8e4deb16fed67355f9eca2658d76e15b7a33241d8

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Size

1.9MB
MD5

0f85deb6b3434fbecfccc7e7fd043efc
SHA1

1a7cf4438161a6471c0925bd0f353ef2368dac2b
SHA256

adc1d4d4de7c05b5d4fa32c8e4deb16fed67355f9eca2658d76e15b7a33241d8
SHA512

c071fd2e06ddce47e9d9c56d6116490ddeccdddd0927f154b4a78912ee4b04cd56e234d51c9f17bc9be155c6b165558b0b5d3e7fb23ba4cdb17fdd556b7eaf5f
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1b:NABk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1524-162-0x00007FF7ED5B0000-0x00007FF7ED9A2000-memory.dmp	xmrig
behavioral2/memory/2036-239-0x00007FF6EC8D0000-0x00007FF6ECCC2000-memory.dmp	xmrig
behavioral2/memory/3988-291-0x00007FF7BA600000-0x00007FF7BA9F2000-memory.dmp	xmrig
behavioral2/memory/432-335-0x00007FF721620000-0x00007FF721A12000-memory.dmp	xmrig
behavioral2/memory/1960-336-0x00007FF6AD590000-0x00007FF6AD982000-memory.dmp	xmrig
behavioral2/memory/2120-369-0x00007FF795790000-0x00007FF795B82000-memory.dmp	xmrig
behavioral2/memory/1828-377-0x00007FF7B8AC0000-0x00007FF7B8EB2000-memory.dmp	xmrig
behavioral2/memory/444-384-0x00007FF650B10000-0x00007FF650F02000-memory.dmp	xmrig
behavioral2/memory/3252-387-0x00007FF79BEC0000-0x00007FF79C2B2000-memory.dmp	xmrig
behavioral2/memory/4060-386-0x00007FF68AFB0000-0x00007FF68B3A2000-memory.dmp	xmrig
behavioral2/memory/3284-385-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	xmrig
behavioral2/memory/4144-383-0x00007FF652BA0000-0x00007FF652F92000-memory.dmp	xmrig
behavioral2/memory/932-382-0x00007FF78AFC0000-0x00007FF78B3B2000-memory.dmp	xmrig
behavioral2/memory/1508-373-0x00007FF6BF2C0000-0x00007FF6BF6B2000-memory.dmp	xmrig
behavioral2/memory/2336-372-0x00007FF7D99B0000-0x00007FF7D9DA2000-memory.dmp	xmrig
behavioral2/memory/5052-350-0x00007FF6E4C70000-0x00007FF6E5062000-memory.dmp	xmrig
behavioral2/memory/3376-323-0x00007FF7B53B0000-0x00007FF7B57A2000-memory.dmp	xmrig
behavioral2/memory/2288-282-0x00007FF627C40000-0x00007FF628032000-memory.dmp	xmrig
behavioral2/memory/4532-280-0x00007FF68F750000-0x00007FF68FB42000-memory.dmp	xmrig
behavioral2/memory/3588-261-0x00007FF73FAF0000-0x00007FF73FEE2000-memory.dmp	xmrig
behavioral2/memory/4356-237-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp	xmrig
behavioral2/memory/3520-218-0x00007FF7CE9E0000-0x00007FF7CEDD2000-memory.dmp	xmrig
behavioral2/memory/3540-212-0x00007FF718300000-0x00007FF7186F2000-memory.dmp	xmrig
behavioral2/memory/3284-4668-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	xmrig
behavioral2/memory/4356-4679-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp	xmrig
behavioral2/memory/3540-4684-0x00007FF718300000-0x00007FF7186F2000-memory.dmp	xmrig
behavioral2/memory/3520-4705-0x00007FF7CE9E0000-0x00007FF7CEDD2000-memory.dmp	xmrig
behavioral2/memory/2288-4714-0x00007FF627C40000-0x00007FF628032000-memory.dmp	xmrig
behavioral2/memory/3588-4721-0x00007FF73FAF0000-0x00007FF73FEE2000-memory.dmp	xmrig
behavioral2/memory/4144-4740-0x00007FF652BA0000-0x00007FF652F92000-memory.dmp	xmrig
behavioral2/memory/2336-4764-0x00007FF7D99B0000-0x00007FF7D9DA2000-memory.dmp	xmrig
behavioral2/memory/444-4785-0x00007FF650B10000-0x00007FF650F02000-memory.dmp	xmrig
behavioral2/memory/1508-4825-0x00007FF6BF2C0000-0x00007FF6BF6B2000-memory.dmp	xmrig
behavioral2/memory/1828-4819-0x00007FF7B8AC0000-0x00007FF7B8EB2000-memory.dmp	xmrig
behavioral2/memory/1960-4788-0x00007FF6AD590000-0x00007FF6AD982000-memory.dmp	xmrig
behavioral2/memory/932-4777-0x00007FF78AFC0000-0x00007FF78B3B2000-memory.dmp	xmrig
behavioral2/memory/5052-4760-0x00007FF6E4C70000-0x00007FF6E5062000-memory.dmp	xmrig
behavioral2/memory/2120-4754-0x00007FF795790000-0x00007FF795B82000-memory.dmp	xmrig
behavioral2/memory/3376-4749-0x00007FF7B53B0000-0x00007FF7B57A2000-memory.dmp	xmrig
behavioral2/memory/432-4726-0x00007FF721620000-0x00007FF721A12000-memory.dmp	xmrig
behavioral2/memory/3252-4734-0x00007FF79BEC0000-0x00007FF79C2B2000-memory.dmp	xmrig
behavioral2/memory/2036-4701-0x00007FF6EC8D0000-0x00007FF6ECCC2000-memory.dmp	xmrig
behavioral2/memory/4532-4692-0x00007FF68F750000-0x00007FF68FB42000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
8	1804	powershell.exe
10	1804	powershell.exe
12	1804	powershell.exe
13	1804	powershell.exe
15	1804	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1804	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3704	tLtORxV.exe
3284	iuVRmbY.exe
4060	VNBZHOY.exe
1524	mDiYxNg.exe
3540	UMuVyYP.exe
3520	pTAsCvC.exe
4356	GhJdQJU.exe
2036	IJCUKTA.exe
3588	hrxKAoq.exe
4532	JfwkPLL.exe
2288	XYnjgNQ.exe
3252	RBDWrzY.exe
3988	gPZXkGt.exe
3376	MDQLACp.exe
432	QhesiXZ.exe
1960	rBZvhqY.exe
5052	ayUHCoi.exe
2120	HBjJCbh.exe
2336	qtZyGmI.exe
1508	MdBiXzL.exe
1828	zgEBcYR.exe
932	axyUtLY.exe
4144	QVasFpg.exe
444	Wvpoioh.exe
1768	WUbfLle.exe
4256	EAtVNFr.exe
1016	squRtDe.exe
448	qjJyQtP.exe
1704	aXiFRbE.exe
1468	WvAbDWq.exe
4948	pdvgAdC.exe
4760	tdHpyot.exe
3820	jbQkuIw.exe
540	ueBvQEa.exe
1144	hmJLLSH.exe
3248	raaMReE.exe
3560	QhMqGas.exe
4372	wjRtGnk.exe
1544	wxyQTJn.exe
1304	hlEKkcy.exe
1064	xxfIHTX.exe
2016	vWLHuRG.exe
4440	IybIzUe.exe
3000	UjDmvRq.exe
4588	WpmCgJc.exe
1388	CEKuwwf.exe
4952	Ifwbtmy.exe
4636	JsRIEan.exe
2976	WPuhTIv.exe
3732	AtIpXzX.exe
4984	wTZOFjz.exe
3776	KYPYnku.exe
3176	rudztXN.exe
4200	sFPShnv.exe
3208	NgcOdgA.exe
316	PnvGiJK.exe
4272	jqoqwcO.exe
2940	ojOMNnw.exe
3128	rxEFQuW.exe
5024	fVInmcT.exe
4056	lpYsrWG.exe
4716	LicGJbc.exe
4196	QDBMiof.exe
1516	ChnUEkH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/936-0-0x00007FF6CB330000-0x00007FF6CB722000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-13.dat	upx
behavioral2/files/0x000a000000023bc5-40.dat	upx
behavioral2/files/0x000a000000023bce-84.dat	upx
behavioral2/memory/1524-162-0x00007FF7ED5B0000-0x00007FF7ED9A2000-memory.dmp	upx
behavioral2/files/0x000e000000023bef-184.dat	upx
behavioral2/memory/2036-239-0x00007FF6EC8D0000-0x00007FF6ECCC2000-memory.dmp	upx
behavioral2/memory/3988-291-0x00007FF7BA600000-0x00007FF7BA9F2000-memory.dmp	upx
behavioral2/memory/432-335-0x00007FF721620000-0x00007FF721A12000-memory.dmp	upx
behavioral2/memory/1960-336-0x00007FF6AD590000-0x00007FF6AD982000-memory.dmp	upx
behavioral2/memory/2120-369-0x00007FF795790000-0x00007FF795B82000-memory.dmp	upx
behavioral2/memory/1828-377-0x00007FF7B8AC0000-0x00007FF7B8EB2000-memory.dmp	upx
behavioral2/memory/444-384-0x00007FF650B10000-0x00007FF650F02000-memory.dmp	upx
behavioral2/memory/3252-387-0x00007FF79BEC0000-0x00007FF79C2B2000-memory.dmp	upx
behavioral2/memory/4060-386-0x00007FF68AFB0000-0x00007FF68B3A2000-memory.dmp	upx
behavioral2/memory/3284-385-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	upx
behavioral2/memory/4144-383-0x00007FF652BA0000-0x00007FF652F92000-memory.dmp	upx
behavioral2/memory/932-382-0x00007FF78AFC0000-0x00007FF78B3B2000-memory.dmp	upx
behavioral2/memory/1508-373-0x00007FF6BF2C0000-0x00007FF6BF6B2000-memory.dmp	upx
behavioral2/memory/2336-372-0x00007FF7D99B0000-0x00007FF7D9DA2000-memory.dmp	upx
behavioral2/memory/5052-350-0x00007FF6E4C70000-0x00007FF6E5062000-memory.dmp	upx
behavioral2/memory/3376-323-0x00007FF7B53B0000-0x00007FF7B57A2000-memory.dmp	upx
behavioral2/memory/2288-282-0x00007FF627C40000-0x00007FF628032000-memory.dmp	upx
behavioral2/memory/4532-280-0x00007FF68F750000-0x00007FF68FB42000-memory.dmp	upx
behavioral2/memory/3588-261-0x00007FF73FAF0000-0x00007FF73FEE2000-memory.dmp	upx
behavioral2/memory/4356-237-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp	upx
behavioral2/memory/3520-218-0x00007FF7CE9E0000-0x00007FF7CEDD2000-memory.dmp	upx
behavioral2/memory/3540-212-0x00007FF718300000-0x00007FF7186F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-180.dat	upx
behavioral2/files/0x000b000000023bde-176.dat	upx
behavioral2/files/0x000a000000023bd7-175.dat	upx
behavioral2/files/0x000a000000023bd6-168.dat	upx
behavioral2/files/0x000a000000023be8-161.dat	upx
behavioral2/files/0x000b000000023bdf-160.dat	upx
behavioral2/files/0x000a000000023bd3-155.dat	upx
behavioral2/files/0x000a000000023bd2-153.dat	upx
behavioral2/files/0x000a000000023bd1-150.dat	upx
behavioral2/files/0x000a000000023bcc-148.dat	upx
behavioral2/files/0x000a000000023bd0-147.dat	upx
behavioral2/files/0x000a000000023bdd-146.dat	upx
behavioral2/files/0x000a000000023bdc-145.dat	upx
behavioral2/files/0x000a000000023bd5-163.dat	upx
behavioral2/files/0x000a000000023bdb-137.dat	upx
behavioral2/files/0x000a000000023bda-136.dat	upx
behavioral2/files/0x000a000000023bd9-130.dat	upx
behavioral2/files/0x000a000000023bcb-121.dat	upx
behavioral2/files/0x000a000000023bca-118.dat	upx
behavioral2/files/0x000a000000023bcf-144.dat	upx
behavioral2/files/0x000a000000023bd4-113.dat	upx
behavioral2/files/0x000a000000023bd8-129.dat	upx
behavioral2/files/0x000a000000023bc8-91.dat	upx
behavioral2/files/0x000a000000023bc6-81.dat	upx
behavioral2/files/0x000a000000023bc9-80.dat	upx
behavioral2/files/0x000a000000023bc7-66.dat	upx
behavioral2/files/0x000a000000023bc2-53.dat	upx
behavioral2/files/0x000a000000023bc4-50.dat	upx
behavioral2/files/0x000a000000023bc3-46.dat	upx
behavioral2/files/0x000a000000023bbf-30.dat	upx
behavioral2/files/0x000a000000023bc1-29.dat	upx
behavioral2/files/0x0033000000023bb4-17.dat	upx
behavioral2/memory/3704-9-0x00007FF64D430000-0x00007FF64D822000-memory.dmp	upx
behavioral2/memory/3284-4668-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	upx
behavioral2/memory/4356-4679-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp	upx
behavioral2/memory/3540-4684-0x00007FF718300000-0x00007FF7186F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NtGeffc.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\PzphHzH.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\nvNgSYo.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\mATzCIf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\RkggmXZ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VXWZpNc.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\RmWKsOE.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ODttsRp.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\dbLFyzm.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\RHyjIWk.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\nUsXPWQ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\fYtDxmc.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\utvkGZv.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VhYtUhH.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\dKQMkWk.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\GNNvABg.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\QjVpNFQ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VTXZhHy.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\dqlrHLa.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\RnSvuNW.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ECEVHJS.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\HpJHvci.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\xNbjfqk.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ScNdVGh.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\CGwvZax.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\vEAiaqI.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\oSBhTSG.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ZpqYgnW.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\EmfpZui.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ohYhfAG.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\zxhfMHT.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\degDqdh.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ZbRSqdQ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\hatNOTc.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\wLwPaUG.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\FPWoVlJ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\yqluRNo.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\YlSVpTg.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\DreVkNX.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\BepGUVi.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\xrZugMs.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\QYEiVZd.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\kacYjMq.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\JSSLTBD.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\iPqWLkT.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VvFOYVR.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\KtCLMnN.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\AEtqOBI.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\tkQVfnn.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\SDIWsKn.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\YbdQlPi.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\cUxnHCf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\aNcsBns.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\gdyvUWf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\MoGtYgs.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\MkwbEWJ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\NFyHFJP.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\BENGTRm.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\CHevumT.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\exFqNbf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\UiJpPJn.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\SvdSpkU.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\JljxgwM.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\bIOcxsN.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1804	powershell.exe
1804	powershell.exe
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeLockMemoryPrivilege	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	13280	dwm.exe
Token: SeChangeNotifyPrivilege	13280	dwm.exe
Token: 33	13280	dwm.exe
Token: SeIncBasePriorityPrivilege	13280	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1804	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	86
PID 936 wrote to memory of 1804	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	86
PID 936 wrote to memory of 3704	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	87
PID 936 wrote to memory of 3704	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	87
PID 936 wrote to memory of 3284	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	88
PID 936 wrote to memory of 3284	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	88
PID 936 wrote to memory of 4060	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	89
PID 936 wrote to memory of 4060	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	89
PID 936 wrote to memory of 1524	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	90
PID 936 wrote to memory of 1524	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	90
PID 936 wrote to memory of 3540	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	91
PID 936 wrote to memory of 3540	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	91
PID 936 wrote to memory of 3520	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	92
PID 936 wrote to memory of 3520	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	92
PID 936 wrote to memory of 4356	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	93
PID 936 wrote to memory of 4356	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	93
PID 936 wrote to memory of 2036	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	94
PID 936 wrote to memory of 2036	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	94
PID 936 wrote to memory of 3588	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	95
PID 936 wrote to memory of 3588	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	95
PID 936 wrote to memory of 4532	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	96
PID 936 wrote to memory of 4532	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	96
PID 936 wrote to memory of 2288	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	97
PID 936 wrote to memory of 2288	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	97
PID 936 wrote to memory of 3252	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	98
PID 936 wrote to memory of 3252	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	98
PID 936 wrote to memory of 3988	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	99
PID 936 wrote to memory of 3988	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	99
PID 936 wrote to memory of 3376	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	100
PID 936 wrote to memory of 3376	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	100
PID 936 wrote to memory of 2120	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	101
PID 936 wrote to memory of 2120	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	101
PID 936 wrote to memory of 1508	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	102
PID 936 wrote to memory of 1508	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	102
PID 936 wrote to memory of 432	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	103
PID 936 wrote to memory of 432	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	103
PID 936 wrote to memory of 1960	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	104
PID 936 wrote to memory of 1960	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	104
PID 936 wrote to memory of 5052	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	105
PID 936 wrote to memory of 5052	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	105
PID 936 wrote to memory of 2336	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	106
PID 936 wrote to memory of 2336	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	106
PID 936 wrote to memory of 1828	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	107
PID 936 wrote to memory of 1828	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	107
PID 936 wrote to memory of 932	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	108
PID 936 wrote to memory of 932	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	108
PID 936 wrote to memory of 4144	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	109
PID 936 wrote to memory of 4144	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	109
PID 936 wrote to memory of 444	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	110
PID 936 wrote to memory of 444	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	110
PID 936 wrote to memory of 1768	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	111
PID 936 wrote to memory of 1768	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	111
PID 936 wrote to memory of 4256	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	112
PID 936 wrote to memory of 4256	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	112
PID 936 wrote to memory of 1016	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	113
PID 936 wrote to memory of 1016	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	113
PID 936 wrote to memory of 448	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	114
PID 936 wrote to memory of 448	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	114
PID 936 wrote to memory of 1704	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	115
PID 936 wrote to memory of 1704	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	115
PID 936 wrote to memory of 1468	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	116
PID 936 wrote to memory of 1468	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	116
PID 936 wrote to memory of 4948	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	117
PID 936 wrote to memory of 4948	936	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System\tLtORxV.exe
  C:\Windows\System\tLtORxV.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\iuVRmbY.exe
  C:\Windows\System\iuVRmbY.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\VNBZHOY.exe
  C:\Windows\System\VNBZHOY.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\mDiYxNg.exe
  C:\Windows\System\mDiYxNg.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\UMuVyYP.exe
  C:\Windows\System\UMuVyYP.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\pTAsCvC.exe
  C:\Windows\System\pTAsCvC.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\GhJdQJU.exe
  C:\Windows\System\GhJdQJU.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\IJCUKTA.exe
  C:\Windows\System\IJCUKTA.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\hrxKAoq.exe
  C:\Windows\System\hrxKAoq.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\JfwkPLL.exe
  C:\Windows\System\JfwkPLL.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\XYnjgNQ.exe
  C:\Windows\System\XYnjgNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RBDWrzY.exe
  C:\Windows\System\RBDWrzY.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\gPZXkGt.exe
  C:\Windows\System\gPZXkGt.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\MDQLACp.exe
  C:\Windows\System\MDQLACp.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\HBjJCbh.exe
  C:\Windows\System\HBjJCbh.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\MdBiXzL.exe
  C:\Windows\System\MdBiXzL.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\QhesiXZ.exe
  C:\Windows\System\QhesiXZ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\rBZvhqY.exe
  C:\Windows\System\rBZvhqY.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\ayUHCoi.exe
  C:\Windows\System\ayUHCoi.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\qtZyGmI.exe
  C:\Windows\System\qtZyGmI.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\zgEBcYR.exe
  C:\Windows\System\zgEBcYR.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\axyUtLY.exe
  C:\Windows\System\axyUtLY.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\QVasFpg.exe
  C:\Windows\System\QVasFpg.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\Wvpoioh.exe
  C:\Windows\System\Wvpoioh.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\WUbfLle.exe
  C:\Windows\System\WUbfLle.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\EAtVNFr.exe
  C:\Windows\System\EAtVNFr.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\squRtDe.exe
  C:\Windows\System\squRtDe.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\qjJyQtP.exe
  C:\Windows\System\qjJyQtP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\aXiFRbE.exe
  C:\Windows\System\aXiFRbE.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\WvAbDWq.exe
  C:\Windows\System\WvAbDWq.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\pdvgAdC.exe
  C:\Windows\System\pdvgAdC.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\tdHpyot.exe
  C:\Windows\System\tdHpyot.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\hmJLLSH.exe
  C:\Windows\System\hmJLLSH.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\jbQkuIw.exe
  C:\Windows\System\jbQkuIw.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\ueBvQEa.exe
  C:\Windows\System\ueBvQEa.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\raaMReE.exe
  C:\Windows\System\raaMReE.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\QhMqGas.exe
  C:\Windows\System\QhMqGas.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\wjRtGnk.exe
  C:\Windows\System\wjRtGnk.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\wxyQTJn.exe
  C:\Windows\System\wxyQTJn.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\hlEKkcy.exe
  C:\Windows\System\hlEKkcy.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\xxfIHTX.exe
  C:\Windows\System\xxfIHTX.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\vWLHuRG.exe
  C:\Windows\System\vWLHuRG.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\IybIzUe.exe
  C:\Windows\System\IybIzUe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UjDmvRq.exe
  C:\Windows\System\UjDmvRq.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\WpmCgJc.exe
  C:\Windows\System\WpmCgJc.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\CEKuwwf.exe
  C:\Windows\System\CEKuwwf.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\Ifwbtmy.exe
  C:\Windows\System\Ifwbtmy.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\JsRIEan.exe
  C:\Windows\System\JsRIEan.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\WPuhTIv.exe
  C:\Windows\System\WPuhTIv.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\AtIpXzX.exe
  C:\Windows\System\AtIpXzX.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\wTZOFjz.exe
  C:\Windows\System\wTZOFjz.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\KYPYnku.exe
  C:\Windows\System\KYPYnku.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\rudztXN.exe
  C:\Windows\System\rudztXN.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\sFPShnv.exe
  C:\Windows\System\sFPShnv.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\NgcOdgA.exe
  C:\Windows\System\NgcOdgA.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\PnvGiJK.exe
  C:\Windows\System\PnvGiJK.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\jqoqwcO.exe
  C:\Windows\System\jqoqwcO.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\ojOMNnw.exe
  C:\Windows\System\ojOMNnw.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\rxEFQuW.exe
  C:\Windows\System\rxEFQuW.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\fVInmcT.exe
  C:\Windows\System\fVInmcT.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\lpYsrWG.exe
  C:\Windows\System\lpYsrWG.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\LicGJbc.exe
  C:\Windows\System\LicGJbc.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\QDBMiof.exe
  C:\Windows\System\QDBMiof.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\ChnUEkH.exe
  C:\Windows\System\ChnUEkH.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\XabqJHF.exe
  C:\Windows\System\XabqJHF.exe
  2⤵
  PID:4884
- C:\Windows\System\lVIyJaT.exe
  C:\Windows\System\lVIyJaT.exe
  2⤵
  PID:4376
- C:\Windows\System\IMBakXf.exe
  C:\Windows\System\IMBakXf.exe
  2⤵
  PID:3724
- C:\Windows\System\lhhwLMP.exe
  C:\Windows\System\lhhwLMP.exe
  2⤵
  PID:2412
- C:\Windows\System\dxeNdXT.exe
  C:\Windows\System\dxeNdXT.exe
  2⤵
  PID:5164
- C:\Windows\System\RQYKQoI.exe
  C:\Windows\System\RQYKQoI.exe
  2⤵
  PID:5192
- C:\Windows\System\IZQOvlS.exe
  C:\Windows\System\IZQOvlS.exe
  2⤵
  PID:5208
- C:\Windows\System\ptRDcgm.exe
  C:\Windows\System\ptRDcgm.exe
  2⤵
  PID:5232
- C:\Windows\System\YJkebDv.exe
  C:\Windows\System\YJkebDv.exe
  2⤵
  PID:5256
- C:\Windows\System\zyYHuOS.exe
  C:\Windows\System\zyYHuOS.exe
  2⤵
  PID:5276
- C:\Windows\System\gQcPMXi.exe
  C:\Windows\System\gQcPMXi.exe
  2⤵
  PID:5292
- C:\Windows\System\NjwbQDD.exe
  C:\Windows\System\NjwbQDD.exe
  2⤵
  PID:5320
- C:\Windows\System\tgpShNm.exe
  C:\Windows\System\tgpShNm.exe
  2⤵
  PID:5340
- C:\Windows\System\AyUHzBg.exe
  C:\Windows\System\AyUHzBg.exe
  2⤵
  PID:5364
- C:\Windows\System\BvmKWMK.exe
  C:\Windows\System\BvmKWMK.exe
  2⤵
  PID:5384
- C:\Windows\System\QIPuufr.exe
  C:\Windows\System\QIPuufr.exe
  2⤵
  PID:5400
- C:\Windows\System\RwYZcjc.exe
  C:\Windows\System\RwYZcjc.exe
  2⤵
  PID:5420
- C:\Windows\System\gBWCOQw.exe
  C:\Windows\System\gBWCOQw.exe
  2⤵
  PID:5436
- C:\Windows\System\dwdXdxD.exe
  C:\Windows\System\dwdXdxD.exe
  2⤵
  PID:5452
- C:\Windows\System\rKyZMVr.exe
  C:\Windows\System\rKyZMVr.exe
  2⤵
  PID:5472
- C:\Windows\System\cmqWGYo.exe
  C:\Windows\System\cmqWGYo.exe
  2⤵
  PID:5488
- C:\Windows\System\aQtHoqV.exe
  C:\Windows\System\aQtHoqV.exe
  2⤵
  PID:5504
- C:\Windows\System\KomubEC.exe
  C:\Windows\System\KomubEC.exe
  2⤵
  PID:5520
- C:\Windows\System\gVfgZnX.exe
  C:\Windows\System\gVfgZnX.exe
  2⤵
  PID:5544
- C:\Windows\System\BQzgFPy.exe
  C:\Windows\System\BQzgFPy.exe
  2⤵
  PID:5572
- C:\Windows\System\tGAinfE.exe
  C:\Windows\System\tGAinfE.exe
  2⤵
  PID:5668
- C:\Windows\System\opKrnUa.exe
  C:\Windows\System\opKrnUa.exe
  2⤵
  PID:5688
- C:\Windows\System\mkStPIK.exe
  C:\Windows\System\mkStPIK.exe
  2⤵
  PID:5716
- C:\Windows\System\CDVpTNy.exe
  C:\Windows\System\CDVpTNy.exe
  2⤵
  PID:5740
- C:\Windows\System\TRRMqgP.exe
  C:\Windows\System\TRRMqgP.exe
  2⤵
  PID:5764
- C:\Windows\System\WkGWesW.exe
  C:\Windows\System\WkGWesW.exe
  2⤵
  PID:5788
- C:\Windows\System\HlayExw.exe
  C:\Windows\System\HlayExw.exe
  2⤵
  PID:1904
- C:\Windows\System\HBweEWV.exe
  C:\Windows\System\HBweEWV.exe
  2⤵
  PID:5044
- C:\Windows\System\VMdNUSG.exe
  C:\Windows\System\VMdNUSG.exe
  2⤵
  PID:2404
- C:\Windows\System\muPFMbE.exe
  C:\Windows\System\muPFMbE.exe
  2⤵
  PID:3212
- C:\Windows\System\icfsuny.exe
  C:\Windows\System\icfsuny.exe
  2⤵
  PID:5200
- C:\Windows\System\lmptqVE.exe
  C:\Windows\System\lmptqVE.exe
  2⤵
  PID:5372
- C:\Windows\System\dpCyeFB.exe
  C:\Windows\System\dpCyeFB.exe
  2⤵
  PID:5408
- C:\Windows\System\NktCrgl.exe
  C:\Windows\System\NktCrgl.exe
  2⤵
  PID:5512
- C:\Windows\System\fvGyNvU.exe
  C:\Windows\System\fvGyNvU.exe
  2⤵
  PID:5552
- C:\Windows\System\byKQVdF.exe
  C:\Windows\System\byKQVdF.exe
  2⤵
  PID:5612
- C:\Windows\System\iwXgzVS.exe
  C:\Windows\System\iwXgzVS.exe
  2⤵
  PID:5652
- C:\Windows\System\JONKoPF.exe
  C:\Windows\System\JONKoPF.exe
  2⤵
  PID:5712
- C:\Windows\System\rYCEgdV.exe
  C:\Windows\System\rYCEgdV.exe
  2⤵
  PID:5796
- C:\Windows\System\WpNREPF.exe
  C:\Windows\System\WpNREPF.exe
  2⤵
  PID:5988
- C:\Windows\System\WiGoMnS.exe
  C:\Windows\System\WiGoMnS.exe
  2⤵
  PID:3624
- C:\Windows\System\uCVTzBN.exe
  C:\Windows\System\uCVTzBN.exe
  2⤵
  PID:1924
- C:\Windows\System\effilmo.exe
  C:\Windows\System\effilmo.exe
  2⤵
  PID:1740
- C:\Windows\System\cwqlHiU.exe
  C:\Windows\System\cwqlHiU.exe
  2⤵
  PID:4904
- C:\Windows\System\zwoIKbi.exe
  C:\Windows\System\zwoIKbi.exe
  2⤵
  PID:3160
- C:\Windows\System\cEULvns.exe
  C:\Windows\System\cEULvns.exe
  2⤵
  PID:3096
- C:\Windows\System\UuaLwIE.exe
  C:\Windows\System\UuaLwIE.exe
  2⤵
  PID:4572
- C:\Windows\System\UYMCYsZ.exe
  C:\Windows\System\UYMCYsZ.exe
  2⤵
  PID:3192
- C:\Windows\System\YlAEzza.exe
  C:\Windows\System\YlAEzza.exe
  2⤵
  PID:952
- C:\Windows\System\LVsWkCW.exe
  C:\Windows\System\LVsWkCW.exe
  2⤵
  PID:4620
- C:\Windows\System\DTrLnrY.exe
  C:\Windows\System\DTrLnrY.exe
  2⤵
  PID:5804
- C:\Windows\System\ptUhmBL.exe
  C:\Windows\System\ptUhmBL.exe
  2⤵
  PID:5704
- C:\Windows\System\iEizbHe.exe
  C:\Windows\System\iEizbHe.exe
  2⤵
  PID:6052
- C:\Windows\System\fPBKuVr.exe
  C:\Windows\System\fPBKuVr.exe
  2⤵
  PID:6064
- C:\Windows\System\igMTmDu.exe
  C:\Windows\System\igMTmDu.exe
  2⤵
  PID:2052
- C:\Windows\System\vrtoAbQ.exe
  C:\Windows\System\vrtoAbQ.exe
  2⤵
  PID:512
- C:\Windows\System\cPlhnNS.exe
  C:\Windows\System\cPlhnNS.exe
  2⤵
  PID:5272
- C:\Windows\System\TfFFTph.exe
  C:\Windows\System\TfFFTph.exe
  2⤵
  PID:5328
- C:\Windows\System\gdaroGs.exe
  C:\Windows\System\gdaroGs.exe
  2⤵
  PID:5500
- C:\Windows\System\itQdZaj.exe
  C:\Windows\System\itQdZaj.exe
  2⤵
  PID:5432
- C:\Windows\System\FYXcTvV.exe
  C:\Windows\System\FYXcTvV.exe
  2⤵
  PID:5636
- C:\Windows\System\uuTIvFQ.exe
  C:\Windows\System\uuTIvFQ.exe
  2⤵
  PID:5708
- C:\Windows\System\WgbnRbD.exe
  C:\Windows\System\WgbnRbD.exe
  2⤵
  PID:5540
- C:\Windows\System\JOkjFwl.exe
  C:\Windows\System\JOkjFwl.exe
  2⤵
  PID:5952
- C:\Windows\System\XHbKtof.exe
  C:\Windows\System\XHbKtof.exe
  2⤵
  PID:5596
- C:\Windows\System\oHXxnsF.exe
  C:\Windows\System\oHXxnsF.exe
  2⤵
  PID:5876
- C:\Windows\System\BMKrYOT.exe
  C:\Windows\System\BMKrYOT.exe
  2⤵
  PID:3512
- C:\Windows\System\RsLAapV.exe
  C:\Windows\System\RsLAapV.exe
  2⤵
  PID:764
- C:\Windows\System\esAGYuH.exe
  C:\Windows\System\esAGYuH.exe
  2⤵
  PID:4504
- C:\Windows\System\ZkWcKHX.exe
  C:\Windows\System\ZkWcKHX.exe
  2⤵
  PID:368
- C:\Windows\System\XMrjgfs.exe
  C:\Windows\System\XMrjgfs.exe
  2⤵
  PID:4568
- C:\Windows\System\TSmZgOr.exe
  C:\Windows\System\TSmZgOr.exe
  2⤵
  PID:2304
- C:\Windows\System\XMcRzrj.exe
  C:\Windows\System\XMcRzrj.exe
  2⤵
  PID:4180
- C:\Windows\System\MjkOvFM.exe
  C:\Windows\System\MjkOvFM.exe
  2⤵
  PID:4364
- C:\Windows\System\lfqLnIS.exe
  C:\Windows\System\lfqLnIS.exe
  2⤵
  PID:3676
- C:\Windows\System\wNFgiwf.exe
  C:\Windows\System\wNFgiwf.exe
  2⤵
  PID:5308
- C:\Windows\System\mqIpUvW.exe
  C:\Windows\System\mqIpUvW.exe
  2⤵
  PID:6160
- C:\Windows\System\TebVGsb.exe
  C:\Windows\System\TebVGsb.exe
  2⤵
  PID:6188
- C:\Windows\System\JYuuSHv.exe
  C:\Windows\System\JYuuSHv.exe
  2⤵
  PID:6208
- C:\Windows\System\ykhbvqv.exe
  C:\Windows\System\ykhbvqv.exe
  2⤵
  PID:6228
- C:\Windows\System\IcEkcwT.exe
  C:\Windows\System\IcEkcwT.exe
  2⤵
  PID:6252
- C:\Windows\System\nYammqQ.exe
  C:\Windows\System\nYammqQ.exe
  2⤵
  PID:6276
- C:\Windows\System\fCJCpQx.exe
  C:\Windows\System\fCJCpQx.exe
  2⤵
  PID:6300
- C:\Windows\System\LqLESEc.exe
  C:\Windows\System\LqLESEc.exe
  2⤵
  PID:6316
- C:\Windows\System\CjYfynD.exe
  C:\Windows\System\CjYfynD.exe
  2⤵
  PID:6340
- C:\Windows\System\UIDKmvZ.exe
  C:\Windows\System\UIDKmvZ.exe
  2⤵
  PID:6360
- C:\Windows\System\haGKfnl.exe
  C:\Windows\System\haGKfnl.exe
  2⤵
  PID:6384
- C:\Windows\System\uKsVPVg.exe
  C:\Windows\System\uKsVPVg.exe
  2⤵
  PID:6400
- C:\Windows\System\SFOpxCa.exe
  C:\Windows\System\SFOpxCa.exe
  2⤵
  PID:6424
- C:\Windows\System\BZIzhTG.exe
  C:\Windows\System\BZIzhTG.exe
  2⤵
  PID:6448
- C:\Windows\System\lRKfpUH.exe
  C:\Windows\System\lRKfpUH.exe
  2⤵
  PID:6500
- C:\Windows\System\smHozOR.exe
  C:\Windows\System\smHozOR.exe
  2⤵
  PID:6540
- C:\Windows\System\uAbMZFf.exe
  C:\Windows\System\uAbMZFf.exe
  2⤵
  PID:6572
- C:\Windows\System\PbYLhsR.exe
  C:\Windows\System\PbYLhsR.exe
  2⤵
  PID:6612
- C:\Windows\System\YAiKuHp.exe
  C:\Windows\System\YAiKuHp.exe
  2⤵
  PID:6660
- C:\Windows\System\taXYLPc.exe
  C:\Windows\System\taXYLPc.exe
  2⤵
  PID:6708
- C:\Windows\System\odGeeTH.exe
  C:\Windows\System\odGeeTH.exe
  2⤵
  PID:6756
- C:\Windows\System\dlHKLHp.exe
  C:\Windows\System\dlHKLHp.exe
  2⤵
  PID:6772
- C:\Windows\System\SxRGwgA.exe
  C:\Windows\System\SxRGwgA.exe
  2⤵
  PID:6808
- C:\Windows\System\PoUTczE.exe
  C:\Windows\System\PoUTczE.exe
  2⤵
  PID:6832
- C:\Windows\System\sGwRlKK.exe
  C:\Windows\System\sGwRlKK.exe
  2⤵
  PID:6864
- C:\Windows\System\SJfpnvk.exe
  C:\Windows\System\SJfpnvk.exe
  2⤵
  PID:6880
- C:\Windows\System\IvtxBpD.exe
  C:\Windows\System\IvtxBpD.exe
  2⤵
  PID:6904
- C:\Windows\System\ODRIXbW.exe
  C:\Windows\System\ODRIXbW.exe
  2⤵
  PID:6920
- C:\Windows\System\QetkYCW.exe
  C:\Windows\System\QetkYCW.exe
  2⤵
  PID:6944
- C:\Windows\System\DuBnOry.exe
  C:\Windows\System\DuBnOry.exe
  2⤵
  PID:6968
- C:\Windows\System\LhqxTxY.exe
  C:\Windows\System\LhqxTxY.exe
  2⤵
  PID:6988
- C:\Windows\System\VJsgvgy.exe
  C:\Windows\System\VJsgvgy.exe
  2⤵
  PID:7036
- C:\Windows\System\vOwMzpM.exe
  C:\Windows\System\vOwMzpM.exe
  2⤵
  PID:7056
- C:\Windows\System\NUVQfIY.exe
  C:\Windows\System\NUVQfIY.exe
  2⤵
  PID:7072
- C:\Windows\System\zFXQgJL.exe
  C:\Windows\System\zFXQgJL.exe
  2⤵
  PID:7096
- C:\Windows\System\CKXalPl.exe
  C:\Windows\System\CKXalPl.exe
  2⤵
  PID:7144
- C:\Windows\System\bypJtHX.exe
  C:\Windows\System\bypJtHX.exe
  2⤵
  PID:5140
- C:\Windows\System\LZXzrIN.exe
  C:\Windows\System\LZXzrIN.exe
  2⤵
  PID:6200
- C:\Windows\System\YKtUKOa.exe
  C:\Windows\System\YKtUKOa.exe
  2⤵
  PID:4488
- C:\Windows\System\CpnpfKJ.exe
  C:\Windows\System\CpnpfKJ.exe
  2⤵
  PID:6328
- C:\Windows\System\HFGLXvH.exe
  C:\Windows\System\HFGLXvH.exe
  2⤵
  PID:5480
- C:\Windows\System\LGfHjUY.exe
  C:\Windows\System\LGfHjUY.exe
  2⤵
  PID:6372
- C:\Windows\System\rWINuFH.exe
  C:\Windows\System\rWINuFH.exe
  2⤵
  PID:6440
- C:\Windows\System\AvfQjmq.exe
  C:\Windows\System\AvfQjmq.exe
  2⤵
  PID:6152
- C:\Windows\System\edZnCva.exe
  C:\Windows\System\edZnCva.exe
  2⤵
  PID:2456
- C:\Windows\System\DANJECg.exe
  C:\Windows\System\DANJECg.exe
  2⤵
  PID:2380
- C:\Windows\System\KQLqKeQ.exe
  C:\Windows\System\KQLqKeQ.exe
  2⤵
  PID:6396
- C:\Windows\System\cjJDpYp.exe
  C:\Windows\System\cjJDpYp.exe
  2⤵
  PID:6764
- C:\Windows\System\JGAzrlq.exe
  C:\Windows\System\JGAzrlq.exe
  2⤵
  PID:3536
- C:\Windows\System\ZgaKwlV.exe
  C:\Windows\System\ZgaKwlV.exe
  2⤵
  PID:6824
- C:\Windows\System\xlEhARY.exe
  C:\Windows\System\xlEhARY.exe
  2⤵
  PID:6876
- C:\Windows\System\yvrNMSr.exe
  C:\Windows\System\yvrNMSr.exe
  2⤵
  PID:6964
- C:\Windows\System\zrZtDXw.exe
  C:\Windows\System\zrZtDXw.exe
  2⤵
  PID:6552
- C:\Windows\System\HjgSjex.exe
  C:\Windows\System\HjgSjex.exe
  2⤵
  PID:6624
- C:\Windows\System\SwzMOtD.exe
  C:\Windows\System\SwzMOtD.exe
  2⤵
  PID:7188
- C:\Windows\System\BJJsdHc.exe
  C:\Windows\System\BJJsdHc.exe
  2⤵
  PID:7208
- C:\Windows\System\UuWirll.exe
  C:\Windows\System\UuWirll.exe
  2⤵
  PID:7240
- C:\Windows\System\OPFxeIM.exe
  C:\Windows\System\OPFxeIM.exe
  2⤵
  PID:7272
- C:\Windows\System\jZVBVay.exe
  C:\Windows\System\jZVBVay.exe
  2⤵
  PID:7300
- C:\Windows\System\duYQpVU.exe
  C:\Windows\System\duYQpVU.exe
  2⤵
  PID:7324
- C:\Windows\System\cuSHSuM.exe
  C:\Windows\System\cuSHSuM.exe
  2⤵
  PID:7344
- C:\Windows\System\CQuVMxz.exe
  C:\Windows\System\CQuVMxz.exe
  2⤵
  PID:7364
- C:\Windows\System\elOozAQ.exe
  C:\Windows\System\elOozAQ.exe
  2⤵
  PID:7380
- C:\Windows\System\yQxyoUo.exe
  C:\Windows\System\yQxyoUo.exe
  2⤵
  PID:7404
- C:\Windows\System\giUMsnQ.exe
  C:\Windows\System\giUMsnQ.exe
  2⤵
  PID:7420
- C:\Windows\System\qISyyQP.exe
  C:\Windows\System\qISyyQP.exe
  2⤵
  PID:7444
- C:\Windows\System\dIFzZBd.exe
  C:\Windows\System\dIFzZBd.exe
  2⤵
  PID:7468
- C:\Windows\System\sOFhhuA.exe
  C:\Windows\System\sOFhhuA.exe
  2⤵
  PID:7484
- C:\Windows\System\vWOcAVS.exe
  C:\Windows\System\vWOcAVS.exe
  2⤵
  PID:7508
- C:\Windows\System\mGkFJDk.exe
  C:\Windows\System\mGkFJDk.exe
  2⤵
  PID:7524
- C:\Windows\System\ywNvvaO.exe
  C:\Windows\System\ywNvvaO.exe
  2⤵
  PID:7544
- C:\Windows\System\XxGSssW.exe
  C:\Windows\System\XxGSssW.exe
  2⤵
  PID:7564
- C:\Windows\System\EktRHQm.exe
  C:\Windows\System\EktRHQm.exe
  2⤵
  PID:7592
- C:\Windows\System\wGRtQcD.exe
  C:\Windows\System\wGRtQcD.exe
  2⤵
  PID:7612
- C:\Windows\System\FnpqeBO.exe
  C:\Windows\System\FnpqeBO.exe
  2⤵
  PID:7632
- C:\Windows\System\GohykCZ.exe
  C:\Windows\System\GohykCZ.exe
  2⤵
  PID:7656
- C:\Windows\System\rqhcHfC.exe
  C:\Windows\System\rqhcHfC.exe
  2⤵
  PID:7680
- C:\Windows\System\HkdSgFk.exe
  C:\Windows\System\HkdSgFk.exe
  2⤵
  PID:7696
- C:\Windows\System\bIcAQBQ.exe
  C:\Windows\System\bIcAQBQ.exe
  2⤵
  PID:7720
- C:\Windows\System\OkZdlOm.exe
  C:\Windows\System\OkZdlOm.exe
  2⤵
  PID:7740
- C:\Windows\System\wkjaUGI.exe
  C:\Windows\System\wkjaUGI.exe
  2⤵
  PID:7760
- C:\Windows\System\IytCBnl.exe
  C:\Windows\System\IytCBnl.exe
  2⤵
  PID:7780
- C:\Windows\System\MWdDTvF.exe
  C:\Windows\System\MWdDTvF.exe
  2⤵
  PID:7808
- C:\Windows\System\qnHIjCv.exe
  C:\Windows\System\qnHIjCv.exe
  2⤵
  PID:7836
- C:\Windows\System\NmeISFK.exe
  C:\Windows\System\NmeISFK.exe
  2⤵
  PID:7860
- C:\Windows\System\uLYFDaK.exe
  C:\Windows\System\uLYFDaK.exe
  2⤵
  PID:7880
- C:\Windows\System\hepTpOo.exe
  C:\Windows\System\hepTpOo.exe
  2⤵
  PID:7912
- C:\Windows\System\ZPeBbZT.exe
  C:\Windows\System\ZPeBbZT.exe
  2⤵
  PID:7936
- C:\Windows\System\PkLUKZg.exe
  C:\Windows\System\PkLUKZg.exe
  2⤵
  PID:7952
- C:\Windows\System\TMTVUui.exe
  C:\Windows\System\TMTVUui.exe
  2⤵
  PID:7980
- C:\Windows\System\nPHYxwF.exe
  C:\Windows\System\nPHYxwF.exe
  2⤵
  PID:8004
- C:\Windows\System\mGhlvBt.exe
  C:\Windows\System\mGhlvBt.exe
  2⤵
  PID:8024
- C:\Windows\System\zETSjEP.exe
  C:\Windows\System\zETSjEP.exe
  2⤵
  PID:8048
- C:\Windows\System\ugvVdmo.exe
  C:\Windows\System\ugvVdmo.exe
  2⤵
  PID:8076
- C:\Windows\System\AoXpTlo.exe
  C:\Windows\System\AoXpTlo.exe
  2⤵
  PID:8096
- C:\Windows\System\TRCqEKd.exe
  C:\Windows\System\TRCqEKd.exe
  2⤵
  PID:8124
- C:\Windows\System\PciUapK.exe
  C:\Windows\System\PciUapK.exe
  2⤵
  PID:8140
- C:\Windows\System\isSeKrv.exe
  C:\Windows\System\isSeKrv.exe
  2⤵
  PID:8164
- C:\Windows\System\MignRUf.exe
  C:\Windows\System\MignRUf.exe
  2⤵
  PID:8188
- C:\Windows\System\AnMGdHo.exe
  C:\Windows\System\AnMGdHo.exe
  2⤵
  PID:7064
- C:\Windows\System\AUAsDCQ.exe
  C:\Windows\System\AUAsDCQ.exe
  2⤵
  PID:7108
- C:\Windows\System\xFdMGxZ.exe
  C:\Windows\System\xFdMGxZ.exe
  2⤵
  PID:3780
- C:\Windows\System\VBDeMzn.exe
  C:\Windows\System\VBDeMzn.exe
  2⤵
  PID:6840
- C:\Windows\System\JYqJZKU.exe
  C:\Windows\System\JYqJZKU.exe
  2⤵
  PID:6408
- C:\Windows\System\VGAnBig.exe
  C:\Windows\System\VGAnBig.exe
  2⤵
  PID:6168
- C:\Windows\System\XYCRCOX.exe
  C:\Windows\System\XYCRCOX.exe
  2⤵
  PID:6644
- C:\Windows\System\DtuHxLM.exe
  C:\Windows\System\DtuHxLM.exe
  2⤵
  PID:6524
- C:\Windows\System\qQqtDSq.exe
  C:\Windows\System\qQqtDSq.exe
  2⤵
  PID:6676
- C:\Windows\System\OGITlAS.exe
  C:\Windows\System\OGITlAS.exe
  2⤵
  PID:6392
- C:\Windows\System\FsbzAak.exe
  C:\Windows\System\FsbzAak.exe
  2⤵
  PID:7352
- C:\Windows\System\wwpOOQf.exe
  C:\Windows\System\wwpOOQf.exe
  2⤵
  PID:7436
- C:\Windows\System\sekXhSB.exe
  C:\Windows\System\sekXhSB.exe
  2⤵
  PID:6728
- C:\Windows\System\xAuCxZC.exe
  C:\Windows\System\xAuCxZC.exe
  2⤵
  PID:7540
- C:\Windows\System\gONNvSR.exe
  C:\Windows\System\gONNvSR.exe
  2⤵
  PID:6224
- C:\Windows\System\iPxNbea.exe
  C:\Windows\System\iPxNbea.exe
  2⤵
  PID:212
- C:\Windows\System\zHLrxan.exe
  C:\Windows\System\zHLrxan.exe
  2⤵
  PID:5448
- C:\Windows\System\SperGDq.exe
  C:\Windows\System\SperGDq.exe
  2⤵
  PID:6436
- C:\Windows\System\LsdKTxD.exe
  C:\Windows\System\LsdKTxD.exe
  2⤵
  PID:5776
- C:\Windows\System\LLmhGrD.exe
  C:\Windows\System\LLmhGrD.exe
  2⤵
  PID:5468
- C:\Windows\System\CjifEoN.exe
  C:\Windows\System\CjifEoN.exe
  2⤵
  PID:6564
- C:\Windows\System\LgVfZgx.exe
  C:\Windows\System\LgVfZgx.exe
  2⤵
  PID:7084
- C:\Windows\System\kZJnVnL.exe
  C:\Windows\System\kZJnVnL.exe
  2⤵
  PID:3344
- C:\Windows\System\RVPmedA.exe
  C:\Windows\System\RVPmedA.exe
  2⤵
  PID:6028
- C:\Windows\System\vTstglL.exe
  C:\Windows\System\vTstglL.exe
  2⤵
  PID:2068
- C:\Windows\System\DDwWKsh.exe
  C:\Windows\System\DDwWKsh.exe
  2⤵
  PID:664
- C:\Windows\System\SaaOlBr.exe
  C:\Windows\System\SaaOlBr.exe
  2⤵
  PID:5536
- C:\Windows\System\vEfmkct.exe
  C:\Windows\System\vEfmkct.exe
  2⤵
  PID:7164
- C:\Windows\System\pZwrmPx.exe
  C:\Windows\System\pZwrmPx.exe
  2⤵
  PID:7400
- C:\Windows\System\SSAFqVl.exe
  C:\Windows\System\SSAFqVl.exe
  2⤵
  PID:7516
- C:\Windows\System\tSaJvaG.exe
  C:\Windows\System\tSaJvaG.exe
  2⤵
  PID:4068
- C:\Windows\System\ESPasjw.exe
  C:\Windows\System\ESPasjw.exe
  2⤵
  PID:6688
- C:\Windows\System\SruoVDg.exe
  C:\Windows\System\SruoVDg.exe
  2⤵
  PID:6780
- C:\Windows\System\ZVfKkGG.exe
  C:\Windows\System\ZVfKkGG.exe
  2⤵
  PID:3008
- C:\Windows\System\LKOvUhl.exe
  C:\Windows\System\LKOvUhl.exe
  2⤵
  PID:6336
- C:\Windows\System\FwyKsRb.exe
  C:\Windows\System\FwyKsRb.exe
  2⤵
  PID:6172
- C:\Windows\System\pCoHCZi.exe
  C:\Windows\System\pCoHCZi.exe
  2⤵
  PID:7288
- C:\Windows\System\GwfgiYU.exe
  C:\Windows\System\GwfgiYU.exe
  2⤵
  PID:8204
- C:\Windows\System\IzFKMrI.exe
  C:\Windows\System\IzFKMrI.exe
  2⤵
  PID:8228
- C:\Windows\System\MUTMeDM.exe
  C:\Windows\System\MUTMeDM.exe
  2⤵
  PID:8248
- C:\Windows\System\SbejYVd.exe
  C:\Windows\System\SbejYVd.exe
  2⤵
  PID:8272
- C:\Windows\System\rFchiQb.exe
  C:\Windows\System\rFchiQb.exe
  2⤵
  PID:8296
- C:\Windows\System\yoRUiDe.exe
  C:\Windows\System\yoRUiDe.exe
  2⤵
  PID:8312
- C:\Windows\System\xrCmVvF.exe
  C:\Windows\System\xrCmVvF.exe
  2⤵
  PID:8336
- C:\Windows\System\XgiAXCA.exe
  C:\Windows\System\XgiAXCA.exe
  2⤵
  PID:8364
- C:\Windows\System\OwrmxJM.exe
  C:\Windows\System\OwrmxJM.exe
  2⤵
  PID:8396
- C:\Windows\System\dujBTzV.exe
  C:\Windows\System\dujBTzV.exe
  2⤵
  PID:8420
- C:\Windows\System\KVrjTXu.exe
  C:\Windows\System\KVrjTXu.exe
  2⤵
  PID:8440
- C:\Windows\System\zHjVhnq.exe
  C:\Windows\System\zHjVhnq.exe
  2⤵
  PID:8456
- C:\Windows\System\FpdxuSv.exe
  C:\Windows\System\FpdxuSv.exe
  2⤵
  PID:8472
- C:\Windows\System\ebEiXgY.exe
  C:\Windows\System\ebEiXgY.exe
  2⤵
  PID:8492
- C:\Windows\System\gGuYwbL.exe
  C:\Windows\System\gGuYwbL.exe
  2⤵
  PID:8512
- C:\Windows\System\ylyuWWs.exe
  C:\Windows\System\ylyuWWs.exe
  2⤵
  PID:8532
- C:\Windows\System\ltKTxqm.exe
  C:\Windows\System\ltKTxqm.exe
  2⤵
  PID:8556
- C:\Windows\System\wnYhYdz.exe
  C:\Windows\System\wnYhYdz.exe
  2⤵
  PID:8576
- C:\Windows\System\YhYHCGE.exe
  C:\Windows\System\YhYHCGE.exe
  2⤵
  PID:8604
- C:\Windows\System\qAHptME.exe
  C:\Windows\System\qAHptME.exe
  2⤵
  PID:8620
- C:\Windows\System\KvdDTZB.exe
  C:\Windows\System\KvdDTZB.exe
  2⤵
  PID:8640
- C:\Windows\System\rrhJYMD.exe
  C:\Windows\System\rrhJYMD.exe
  2⤵
  PID:8664
- C:\Windows\System\JBdpSai.exe
  C:\Windows\System\JBdpSai.exe
  2⤵
  PID:8700
- C:\Windows\System\DOnyoMd.exe
  C:\Windows\System\DOnyoMd.exe
  2⤵
  PID:8732
- C:\Windows\System\fyxsUWS.exe
  C:\Windows\System\fyxsUWS.exe
  2⤵
  PID:8752
- C:\Windows\System\PfhtaoS.exe
  C:\Windows\System\PfhtaoS.exe
  2⤵
  PID:8780
- C:\Windows\System\gwoWdMc.exe
  C:\Windows\System\gwoWdMc.exe
  2⤵
  PID:8804
- C:\Windows\System\RwujWqm.exe
  C:\Windows\System\RwujWqm.exe
  2⤵
  PID:8824
- C:\Windows\System\fdvydln.exe
  C:\Windows\System\fdvydln.exe
  2⤵
  PID:8852
- C:\Windows\System\hgOPpGv.exe
  C:\Windows\System\hgOPpGv.exe
  2⤵
  PID:8880
- C:\Windows\System\ycXFotW.exe
  C:\Windows\System\ycXFotW.exe
  2⤵
  PID:8908
- C:\Windows\System\unPnkvY.exe
  C:\Windows\System\unPnkvY.exe
  2⤵
  PID:8928
- C:\Windows\System\DOTgCav.exe
  C:\Windows\System\DOTgCav.exe
  2⤵
  PID:8948
- C:\Windows\System\zBeHzJa.exe
  C:\Windows\System\zBeHzJa.exe
  2⤵
  PID:8976
- C:\Windows\System\AtYGxdb.exe
  C:\Windows\System\AtYGxdb.exe
  2⤵
  PID:8992
- C:\Windows\System\FkOjOrq.exe
  C:\Windows\System\FkOjOrq.exe
  2⤵
  PID:9024
- C:\Windows\System\NTaCcwo.exe
  C:\Windows\System\NTaCcwo.exe
  2⤵
  PID:9040
- C:\Windows\System\OgBtFCS.exe
  C:\Windows\System\OgBtFCS.exe
  2⤵
  PID:9064
- C:\Windows\System\ySEaobu.exe
  C:\Windows\System\ySEaobu.exe
  2⤵
  PID:9092
- C:\Windows\System\yyTBGbt.exe
  C:\Windows\System\yyTBGbt.exe
  2⤵
  PID:9112
- C:\Windows\System\lJmStux.exe
  C:\Windows\System\lJmStux.exe
  2⤵
  PID:9136
- C:\Windows\System\vvuZYSo.exe
  C:\Windows\System\vvuZYSo.exe
  2⤵
  PID:9160
- C:\Windows\System\JjkoNQm.exe
  C:\Windows\System\JjkoNQm.exe
  2⤵
  PID:9184
- C:\Windows\System\XXQqsor.exe
  C:\Windows\System\XXQqsor.exe
  2⤵
  PID:9208
- C:\Windows\System\ftTDMFl.exe
  C:\Windows\System\ftTDMFl.exe
  2⤵
  PID:5680
- C:\Windows\System\yXxpPfS.exe
  C:\Windows\System\yXxpPfS.exe
  2⤵
  PID:7520
- C:\Windows\System\MRiqAWJ.exe
  C:\Windows\System\MRiqAWJ.exe
  2⤵
  PID:7216
- C:\Windows\System\dPutbxO.exe
  C:\Windows\System\dPutbxO.exe
  2⤵
  PID:8156
- C:\Windows\System\WZVgBic.exe
  C:\Windows\System\WZVgBic.exe
  2⤵
  PID:7944
- C:\Windows\System\lIyaSYu.exe
  C:\Windows\System\lIyaSYu.exe
  2⤵
  PID:6936
- C:\Windows\System\BlvWHYI.exe
  C:\Windows\System\BlvWHYI.exe
  2⤵
  PID:6752
- C:\Windows\System\drcaGwN.exe
  C:\Windows\System\drcaGwN.exe
  2⤵
  PID:8176
- C:\Windows\System\YhZVaxw.exe
  C:\Windows\System\YhZVaxw.exe
  2⤵
  PID:7152
- C:\Windows\System\Arauttx.exe
  C:\Windows\System\Arauttx.exe
  2⤵
  PID:7428
- C:\Windows\System\lhJBcfd.exe
  C:\Windows\System\lhJBcfd.exe
  2⤵
  PID:7800
- C:\Windows\System\yDaStrc.exe
  C:\Windows\System\yDaStrc.exe
  2⤵
  PID:2664
- C:\Windows\System\YtSODBd.exe
  C:\Windows\System\YtSODBd.exe
  2⤵
  PID:7492
- C:\Windows\System\AfXsPyz.exe
  C:\Windows\System\AfXsPyz.exe
  2⤵
  PID:7664
- C:\Windows\System\NFBreEX.exe
  C:\Windows\System\NFBreEX.exe
  2⤵
  PID:7928
- C:\Windows\System\fDUrcKE.exe
  C:\Windows\System\fDUrcKE.exe
  2⤵
  PID:8212
- C:\Windows\System\yObHFfH.exe
  C:\Windows\System\yObHFfH.exe
  2⤵
  PID:8288
- C:\Windows\System\mbesYFL.exe
  C:\Windows\System\mbesYFL.exe
  2⤵
  PID:7996
- C:\Windows\System\gxBkfbC.exe
  C:\Windows\System\gxBkfbC.exe
  2⤵
  PID:8148
- C:\Windows\System\NwZehQD.exe
  C:\Windows\System\NwZehQD.exe
  2⤵
  PID:8520
- C:\Windows\System\wwDLMoB.exe
  C:\Windows\System\wwDLMoB.exe
  2⤵
  PID:8564
- C:\Windows\System\NJNWfjN.exe
  C:\Windows\System\NJNWfjN.exe
  2⤵
  PID:8592
- C:\Windows\System\hslFyIs.exe
  C:\Windows\System\hslFyIs.exe
  2⤵
  PID:8072
- C:\Windows\System\iMtRCZQ.exe
  C:\Windows\System\iMtRCZQ.exe
  2⤵
  PID:7924
- C:\Windows\System\FFWJxxl.exe
  C:\Windows\System\FFWJxxl.exe
  2⤵
  PID:7792
- C:\Windows\System\IRoJtFO.exe
  C:\Windows\System\IRoJtFO.exe
  2⤵
  PID:8672
- C:\Windows\System\nmCBtXl.exe
  C:\Windows\System\nmCBtXl.exe
  2⤵
  PID:5348
- C:\Windows\System\WVuiWBj.exe
  C:\Windows\System\WVuiWBj.exe
  2⤵
  PID:9224
- C:\Windows\System\gTxiYhK.exe
  C:\Windows\System\gTxiYhK.exe
  2⤵
  PID:9248
- C:\Windows\System\ChvZwxf.exe
  C:\Windows\System\ChvZwxf.exe
  2⤵
  PID:9268
- C:\Windows\System\aNAVgik.exe
  C:\Windows\System\aNAVgik.exe
  2⤵
  PID:9292
- C:\Windows\System\MSlvFpv.exe
  C:\Windows\System\MSlvFpv.exe
  2⤵
  PID:9312
- C:\Windows\System\vJjxmSA.exe
  C:\Windows\System\vJjxmSA.exe
  2⤵
  PID:9332
- C:\Windows\System\nlYmjyn.exe
  C:\Windows\System\nlYmjyn.exe
  2⤵
  PID:9356
- C:\Windows\System\nHVDNcp.exe
  C:\Windows\System\nHVDNcp.exe
  2⤵
  PID:9376
- C:\Windows\System\osiVpfS.exe
  C:\Windows\System\osiVpfS.exe
  2⤵
  PID:9392
- C:\Windows\System\cabKqYX.exe
  C:\Windows\System\cabKqYX.exe
  2⤵
  PID:9416
- C:\Windows\System\SVlaSPn.exe
  C:\Windows\System\SVlaSPn.exe
  2⤵
  PID:9436
- C:\Windows\System\LJIrjxp.exe
  C:\Windows\System\LJIrjxp.exe
  2⤵
  PID:9456
- C:\Windows\System\qGSTGNG.exe
  C:\Windows\System\qGSTGNG.exe
  2⤵
  PID:9480
- C:\Windows\System\yINbTXV.exe
  C:\Windows\System\yINbTXV.exe
  2⤵
  PID:9500
- C:\Windows\System\eIHcHVP.exe
  C:\Windows\System\eIHcHVP.exe
  2⤵
  PID:9520
- C:\Windows\System\abIqXWo.exe
  C:\Windows\System\abIqXWo.exe
  2⤵
  PID:9548
- C:\Windows\System\eJTYhZX.exe
  C:\Windows\System\eJTYhZX.exe
  2⤵
  PID:9564
- C:\Windows\System\HHVmUEa.exe
  C:\Windows\System\HHVmUEa.exe
  2⤵
  PID:9584
- C:\Windows\System\cmJIBen.exe
  C:\Windows\System\cmJIBen.exe
  2⤵
  PID:9608
- C:\Windows\System\KVaDGXm.exe
  C:\Windows\System\KVaDGXm.exe
  2⤵
  PID:9628
- C:\Windows\System\HZpdOlP.exe
  C:\Windows\System\HZpdOlP.exe
  2⤵
  PID:9648
- C:\Windows\System\wrAWvUj.exe
  C:\Windows\System\wrAWvUj.exe
  2⤵
  PID:9664
- C:\Windows\System\DIGVoTd.exe
  C:\Windows\System\DIGVoTd.exe
  2⤵
  PID:9692
- C:\Windows\System\vOogtSl.exe
  C:\Windows\System\vOogtSl.exe
  2⤵
  PID:9716
- C:\Windows\System\hYckySK.exe
  C:\Windows\System\hYckySK.exe
  2⤵
  PID:9736
- C:\Windows\System\JaHSVrS.exe
  C:\Windows\System\JaHSVrS.exe
  2⤵
  PID:9760
- C:\Windows\System\kWTqquk.exe
  C:\Windows\System\kWTqquk.exe
  2⤵
  PID:9784
- C:\Windows\System\gPldROP.exe
  C:\Windows\System\gPldROP.exe
  2⤵
  PID:9804
- C:\Windows\System\nwzCMHV.exe
  C:\Windows\System\nwzCMHV.exe
  2⤵
  PID:9824
- C:\Windows\System\abfTjpC.exe
  C:\Windows\System\abfTjpC.exe
  2⤵
  PID:9844
- C:\Windows\System\cvWICZA.exe
  C:\Windows\System\cvWICZA.exe
  2⤵
  PID:9868
- C:\Windows\System\ApADovv.exe
  C:\Windows\System\ApADovv.exe
  2⤵
  PID:9888
- C:\Windows\System\aJonCwv.exe
  C:\Windows\System\aJonCwv.exe
  2⤵
  PID:9908
- C:\Windows\System\xqKivBv.exe
  C:\Windows\System\xqKivBv.exe
  2⤵
  PID:9928
- C:\Windows\System\yUsabWq.exe
  C:\Windows\System\yUsabWq.exe
  2⤵
  PID:9960
- C:\Windows\System\uczGMJj.exe
  C:\Windows\System\uczGMJj.exe
  2⤵
  PID:9984
- C:\Windows\System\Quuipzq.exe
  C:\Windows\System\Quuipzq.exe
  2⤵
  PID:10004
- C:\Windows\System\tGavWUN.exe
  C:\Windows\System\tGavWUN.exe
  2⤵
  PID:10028
- C:\Windows\System\yvwSoMt.exe
  C:\Windows\System\yvwSoMt.exe
  2⤵
  PID:10052
- C:\Windows\System\NTnpoij.exe
  C:\Windows\System\NTnpoij.exe
  2⤵
  PID:10076
- C:\Windows\System\zRyVqqV.exe
  C:\Windows\System\zRyVqqV.exe
  2⤵
  PID:10092
- C:\Windows\System\NmfdclC.exe
  C:\Windows\System\NmfdclC.exe
  2⤵
  PID:8944
- C:\Windows\System\ruBVICD.exe
  C:\Windows\System\ruBVICD.exe
  2⤵
  PID:5700
- C:\Windows\System\HIfIAmd.exe
  C:\Windows\System\HIfIAmd.exe
  2⤵
  PID:9128
- C:\Windows\System\kyGrNPL.exe
  C:\Windows\System\kyGrNPL.exe
  2⤵
  PID:6848
- C:\Windows\System\XNtayec.exe
  C:\Windows\System\XNtayec.exe
  2⤵
  PID:7220
- C:\Windows\System\shsIbkg.exe
  C:\Windows\System\shsIbkg.exe
  2⤵
  PID:916
- C:\Windows\System\qLhcijM.exe
  C:\Windows\System\qLhcijM.exe
  2⤵
  PID:8280
- C:\Windows\System\OusgrpA.exe
  C:\Windows\System\OusgrpA.exe
  2⤵
  PID:8352
- C:\Windows\System\SIojSjo.exe
  C:\Windows\System\SIojSjo.exe
  2⤵
  PID:6420
- C:\Windows\System\QoNztrQ.exe
  C:\Windows\System\QoNztrQ.exe
  2⤵
  PID:8508
- C:\Windows\System\sWhrRpk.exe
  C:\Windows\System\sWhrRpk.exe
  2⤵
  PID:8172
- C:\Windows\System\aAQPwfe.exe
  C:\Windows\System\aAQPwfe.exe
  2⤵
  PID:8688
- C:\Windows\System\EJGnhjF.exe
  C:\Windows\System\EJGnhjF.exe
  2⤵
  PID:8636
- C:\Windows\System\rOqLzOK.exe
  C:\Windows\System\rOqLzOK.exe
  2⤵
  PID:9328
- C:\Windows\System\HpUsAqg.exe
  C:\Windows\System\HpUsAqg.exe
  2⤵
  PID:9472
- C:\Windows\System\DAlYvIJ.exe
  C:\Windows\System\DAlYvIJ.exe
  2⤵
  PID:9008
- C:\Windows\System\mQTfsjl.exe
  C:\Windows\System\mQTfsjl.exe
  2⤵
  PID:9056
- C:\Windows\System\lSTwvAs.exe
  C:\Windows\System\lSTwvAs.exe
  2⤵
  PID:9100
- C:\Windows\System\DlilflI.exe
  C:\Windows\System\DlilflI.exe
  2⤵
  PID:9152
- C:\Windows\System\SGBoyPz.exe
  C:\Windows\System\SGBoyPz.exe
  2⤵
  PID:9744
- C:\Windows\System\kIrYIRQ.exe
  C:\Windows\System\kIrYIRQ.exe
  2⤵
  PID:8116
- C:\Windows\System\UBrMQmb.exe
  C:\Windows\System\UBrMQmb.exe
  2⤵
  PID:7336
- C:\Windows\System\lMnImow.exe
  C:\Windows\System\lMnImow.exe
  2⤵
  PID:9876
- C:\Windows\System\MwlrwoA.exe
  C:\Windows\System\MwlrwoA.exe
  2⤵
  PID:6480
- C:\Windows\System\qaofVjA.exe
  C:\Windows\System\qaofVjA.exe
  2⤵
  PID:8408
- C:\Windows\System\gLnmmVF.exe
  C:\Windows\System\gLnmmVF.exe
  2⤵
  PID:9956
- C:\Windows\System\Zcgqdcn.exe
  C:\Windows\System\Zcgqdcn.exe
  2⤵
  PID:7280
- C:\Windows\System\deoRLJT.exe
  C:\Windows\System\deoRLJT.exe
  2⤵
  PID:10192
- C:\Windows\System\iUIMHTH.exe
  C:\Windows\System\iUIMHTH.exe
  2⤵
  PID:7012
- C:\Windows\System\LweFwPM.exe
  C:\Windows\System\LweFwPM.exe
  2⤵
  PID:8740
- C:\Windows\System\Czchdwn.exe
  C:\Windows\System\Czchdwn.exe
  2⤵
  PID:7584
- C:\Windows\System\JYdzVrW.exe
  C:\Windows\System\JYdzVrW.exe
  2⤵
  PID:8832
- C:\Windows\System\nLlSxAf.exe
  C:\Windows\System\nLlSxAf.exe
  2⤵
  PID:9408
- C:\Windows\System\DLMQeyW.exe
  C:\Windows\System\DLMQeyW.exe
  2⤵
  PID:9492
- C:\Windows\System\BKUrJXW.exe
  C:\Windows\System\BKUrJXW.exe
  2⤵
  PID:9528
- C:\Windows\System\mfvltPP.exe
  C:\Windows\System\mfvltPP.exe
  2⤵
  PID:10504
- C:\Windows\System\oHJeLMx.exe
  C:\Windows\System\oHJeLMx.exe
  2⤵
  PID:10528
- C:\Windows\System\TDHCeio.exe
  C:\Windows\System\TDHCeio.exe
  2⤵
  PID:10564
- C:\Windows\System\gEATqHh.exe
  C:\Windows\System\gEATqHh.exe
  2⤵
  PID:10592
- C:\Windows\System\LeOaxdV.exe
  C:\Windows\System\LeOaxdV.exe
  2⤵
  PID:10612
- C:\Windows\System\rIanldE.exe
  C:\Windows\System\rIanldE.exe
  2⤵
  PID:10636
- C:\Windows\System\mEpQayD.exe
  C:\Windows\System\mEpQayD.exe
  2⤵
  PID:10708
- C:\Windows\System\qnIevtS.exe
  C:\Windows\System\qnIevtS.exe
  2⤵
  PID:10828
- C:\Windows\System\ShVPbDD.exe
  C:\Windows\System\ShVPbDD.exe
  2⤵
  PID:10848
- C:\Windows\System\Yehxmug.exe
  C:\Windows\System\Yehxmug.exe
  2⤵
  PID:10900
- C:\Windows\System\DeONELB.exe
  C:\Windows\System\DeONELB.exe
  2⤵
  PID:10940
- C:\Windows\System\cUmUJwj.exe
  C:\Windows\System\cUmUJwj.exe
  2⤵
  PID:10996
- C:\Windows\System\yHInQCY.exe
  C:\Windows\System\yHInQCY.exe
  2⤵
  PID:11048
- C:\Windows\System\zxYYJTM.exe
  C:\Windows\System\zxYYJTM.exe
  2⤵
  PID:11076
- C:\Windows\System\VvFOYVR.exe
  C:\Windows\System\VvFOYVR.exe
  2⤵
  PID:11096
- C:\Windows\System\ObRaqnc.exe
  C:\Windows\System\ObRaqnc.exe
  2⤵
  PID:11112
- C:\Windows\System\xnuRzve.exe
  C:\Windows\System\xnuRzve.exe
  2⤵
  PID:11128
- C:\Windows\System\FkIvyxi.exe
  C:\Windows\System\FkIvyxi.exe
  2⤵
  PID:11144
- C:\Windows\System\hDeDkcn.exe
  C:\Windows\System\hDeDkcn.exe
  2⤵
  PID:11160
- C:\Windows\System\nPxZmak.exe
  C:\Windows\System\nPxZmak.exe
  2⤵
  PID:11176
- C:\Windows\System\sRxbfkS.exe
  C:\Windows\System\sRxbfkS.exe
  2⤵
  PID:11192
- C:\Windows\System\ljTIjmd.exe
  C:\Windows\System\ljTIjmd.exe
  2⤵
  PID:11208
- C:\Windows\System\uYzXgZn.exe
  C:\Windows\System\uYzXgZn.exe
  2⤵
  PID:11224
- C:\Windows\System\GYxCjxc.exe
  C:\Windows\System\GYxCjxc.exe
  2⤵
  PID:11240
- C:\Windows\System\alWbosc.exe
  C:\Windows\System\alWbosc.exe
  2⤵
  PID:11256
- C:\Windows\System\exRslya.exe
  C:\Windows\System\exRslya.exe
  2⤵
  PID:9976
- C:\Windows\System\ptOCIOK.exe
  C:\Windows\System\ptOCIOK.exe
  2⤵
  PID:9996
- C:\Windows\System\eJxwHZE.exe
  C:\Windows\System\eJxwHZE.exe
  2⤵
  PID:10152
- C:\Windows\System\XZogWKN.exe
  C:\Windows\System\XZogWKN.exe
  2⤵
  PID:8728
- C:\Windows\System\sihAMZw.exe
  C:\Windows\System\sihAMZw.exe
  2⤵
  PID:1776
- C:\Windows\System\gkUNhKI.exe
  C:\Windows\System\gkUNhKI.exe
  2⤵
  PID:2364
- C:\Windows\System\AESYJrD.exe
  C:\Windows\System\AESYJrD.exe
  2⤵
  PID:8504
- C:\Windows\System\OqVmvQb.exe
  C:\Windows\System\OqVmvQb.exe
  2⤵
  PID:10100
- C:\Windows\System\MiNebjx.exe
  C:\Windows\System\MiNebjx.exe
  2⤵
  PID:1112
- C:\Windows\System\bQWGEXP.exe
  C:\Windows\System\bQWGEXP.exe
  2⤵
  PID:10360
- C:\Windows\System\EcJAKJH.exe
  C:\Windows\System\EcJAKJH.exe
  2⤵
  PID:10404
- C:\Windows\System\MTVtqIO.exe
  C:\Windows\System\MTVtqIO.exe
  2⤵
  PID:8304
- C:\Windows\System\YmkWKaK.exe
  C:\Windows\System\YmkWKaK.exe
  2⤵
  PID:8136
- C:\Windows\System\bAtHNCA.exe
  C:\Windows\System\bAtHNCA.exe
  2⤵
  PID:9424
- C:\Windows\System\MtVSEFq.exe
  C:\Windows\System\MtVSEFq.exe
  2⤵
  PID:1920
- C:\Windows\System\AEFAvBI.exe
  C:\Windows\System\AEFAvBI.exe
  2⤵
  PID:9168
- C:\Windows\System\cWhJmnN.exe
  C:\Windows\System\cWhJmnN.exe
  2⤵
  PID:9792
- C:\Windows\System\yfpcqWe.exe
  C:\Windows\System\yfpcqWe.exe
  2⤵
  PID:10476
- C:\Windows\System\WhAcmzi.exe
  C:\Windows\System\WhAcmzi.exe
  2⤵
  PID:11276
- C:\Windows\System\fWEVNPs.exe
  C:\Windows\System\fWEVNPs.exe
  2⤵
  PID:11300
- C:\Windows\System\MPlcGvF.exe
  C:\Windows\System\MPlcGvF.exe
  2⤵
  PID:11324
- C:\Windows\System\KWyiJfL.exe
  C:\Windows\System\KWyiJfL.exe
  2⤵
  PID:11348
- C:\Windows\System\kPlQjyx.exe
  C:\Windows\System\kPlQjyx.exe
  2⤵
  PID:11368
- C:\Windows\System\DfKkVfA.exe
  C:\Windows\System\DfKkVfA.exe
  2⤵
  PID:11392
- C:\Windows\System\SLfFcgA.exe
  C:\Windows\System\SLfFcgA.exe
  2⤵
  PID:11420
- C:\Windows\System\tqUSAjd.exe
  C:\Windows\System\tqUSAjd.exe
  2⤵
  PID:11444
- C:\Windows\System\giQAJDa.exe
  C:\Windows\System\giQAJDa.exe
  2⤵
  PID:11464
- C:\Windows\System\XJMavuR.exe
  C:\Windows\System\XJMavuR.exe
  2⤵
  PID:11492
- C:\Windows\System\tlsAciN.exe
  C:\Windows\System\tlsAciN.exe
  2⤵
  PID:11512
- C:\Windows\System\VKtDSGK.exe
  C:\Windows\System\VKtDSGK.exe
  2⤵
  PID:11528
- C:\Windows\System\NAwRmrf.exe
  C:\Windows\System\NAwRmrf.exe
  2⤵
  PID:11552
- C:\Windows\System\yNYIzLn.exe
  C:\Windows\System\yNYIzLn.exe
  2⤵
  PID:11572
- C:\Windows\System\YbEhLOb.exe
  C:\Windows\System\YbEhLOb.exe
  2⤵
  PID:11592
- C:\Windows\System\dxkOEEZ.exe
  C:\Windows\System\dxkOEEZ.exe
  2⤵
  PID:11620
- C:\Windows\System\paxRehb.exe
  C:\Windows\System\paxRehb.exe
  2⤵
  PID:11640
- C:\Windows\System\wSXzozu.exe
  C:\Windows\System\wSXzozu.exe
  2⤵
  PID:11660
- C:\Windows\System\KjQXzde.exe
  C:\Windows\System\KjQXzde.exe
  2⤵
  PID:11684
- C:\Windows\System\JMxuHvR.exe
  C:\Windows\System\JMxuHvR.exe
  2⤵
  PID:11708
- C:\Windows\System\YteZmwF.exe
  C:\Windows\System\YteZmwF.exe
  2⤵
  PID:11732
- C:\Windows\System\nJIbdDT.exe
  C:\Windows\System\nJIbdDT.exe
  2⤵
  PID:11752
- C:\Windows\System\QngfUlr.exe
  C:\Windows\System\QngfUlr.exe
  2⤵
  PID:11772
- C:\Windows\System\rkmrVvO.exe
  C:\Windows\System\rkmrVvO.exe
  2⤵
  PID:11796
- C:\Windows\System\VtFqfZl.exe
  C:\Windows\System\VtFqfZl.exe
  2⤵
  PID:11816
- C:\Windows\System\BUkaKJx.exe
  C:\Windows\System\BUkaKJx.exe
  2⤵
  PID:11844
- C:\Windows\System\MAFChKa.exe
  C:\Windows\System\MAFChKa.exe
  2⤵
  PID:11864
- C:\Windows\System\rmDlBMv.exe
  C:\Windows\System\rmDlBMv.exe
  2⤵
  PID:11880
- C:\Windows\System\sauEcEC.exe
  C:\Windows\System\sauEcEC.exe
  2⤵
  PID:11900
- C:\Windows\System\sEqCbuW.exe
  C:\Windows\System\sEqCbuW.exe
  2⤵
  PID:11924
- C:\Windows\System\dDNHYgW.exe
  C:\Windows\System\dDNHYgW.exe
  2⤵
  PID:11948
- C:\Windows\System\RlAwTLp.exe
  C:\Windows\System\RlAwTLp.exe
  2⤵
  PID:11972
- C:\Windows\System\pahlXnQ.exe
  C:\Windows\System\pahlXnQ.exe
  2⤵
  PID:11988
- C:\Windows\System\tIWJbpo.exe
  C:\Windows\System\tIWJbpo.exe
  2⤵
  PID:12012
- C:\Windows\System\JVmbUPQ.exe
  C:\Windows\System\JVmbUPQ.exe
  2⤵
  PID:12036
- C:\Windows\System\BvdnjZV.exe
  C:\Windows\System\BvdnjZV.exe
  2⤵
  PID:12064
- C:\Windows\System\OZJuqny.exe
  C:\Windows\System\OZJuqny.exe
  2⤵
  PID:12084
- C:\Windows\System\YiRxIuz.exe
  C:\Windows\System\YiRxIuz.exe
  2⤵
  PID:12104
- C:\Windows\System\qCryRQj.exe
  C:\Windows\System\qCryRQj.exe
  2⤵
  PID:12120
- C:\Windows\System\gZxghXY.exe
  C:\Windows\System\gZxghXY.exe
  2⤵
  PID:12136
- C:\Windows\System\BxUvHmc.exe
  C:\Windows\System\BxUvHmc.exe
  2⤵
  PID:12152
- C:\Windows\System\QaRBglG.exe
  C:\Windows\System\QaRBglG.exe
  2⤵
  PID:12168
- C:\Windows\System\dfCNVYB.exe
  C:\Windows\System\dfCNVYB.exe
  2⤵
  PID:12184
- C:\Windows\System\BUsQYVg.exe
  C:\Windows\System\BUsQYVg.exe
  2⤵
  PID:12200
- C:\Windows\System\vtuFWpn.exe
  C:\Windows\System\vtuFWpn.exe
  2⤵
  PID:12216
- C:\Windows\System\fgSgxGp.exe
  C:\Windows\System\fgSgxGp.exe
  2⤵
  PID:12232
- C:\Windows\System\peGNrws.exe
  C:\Windows\System\peGNrws.exe
  2⤵
  PID:12248
- C:\Windows\System\yhwFduI.exe
  C:\Windows\System\yhwFduI.exe
  2⤵
  PID:12264
- C:\Windows\System\MmoInwI.exe
  C:\Windows\System\MmoInwI.exe
  2⤵
  PID:12280
- C:\Windows\System\kxqKpSO.exe
  C:\Windows\System\kxqKpSO.exe
  2⤵
  PID:10580
- C:\Windows\System\jKIzGoZ.exe
  C:\Windows\System\jKIzGoZ.exe
  2⤵
  PID:9464
- C:\Windows\System\atdOkMo.exe
  C:\Windows\System\atdOkMo.exe
  2⤵
  PID:9084
- C:\Windows\System\aGYwzFj.exe
  C:\Windows\System\aGYwzFj.exe
  2⤵
  PID:10836
- C:\Windows\System\QoBBnfn.exe
  C:\Windows\System\QoBBnfn.exe
  2⤵
  PID:10176
- C:\Windows\System\QRnMXIb.exe
  C:\Windows\System\QRnMXIb.exe
  2⤵
  PID:4312
- C:\Windows\System\fFjZFKU.exe
  C:\Windows\System\fFjZFKU.exe
  2⤵
  PID:9516
- C:\Windows\System\tAHoAUw.exe
  C:\Windows\System\tAHoAUw.exe
  2⤵
  PID:9488
- C:\Windows\System\YyIgBio.exe
  C:\Windows\System\YyIgBio.exe
  2⤵
  PID:10084
- C:\Windows\System\GFVMJXT.exe
  C:\Windows\System\GFVMJXT.exe
  2⤵
  PID:4852
- C:\Windows\System\asNAHeL.exe
  C:\Windows\System\asNAHeL.exe
  2⤵
  PID:3280
- C:\Windows\System\ohrAXZS.exe
  C:\Windows\System\ohrAXZS.exe
  2⤵
  PID:8464
- C:\Windows\System\iDmJoNl.exe
  C:\Windows\System\iDmJoNl.exe
  2⤵
  PID:12316
- C:\Windows\System\nAmSODt.exe
  C:\Windows\System\nAmSODt.exe
  2⤵
  PID:12340
- C:\Windows\System\YBPJKCP.exe
  C:\Windows\System\YBPJKCP.exe
  2⤵
  PID:12364
- C:\Windows\System\qMKpUNn.exe
  C:\Windows\System\qMKpUNn.exe
  2⤵
  PID:12384
- C:\Windows\System\xZeosGY.exe
  C:\Windows\System\xZeosGY.exe
  2⤵
  PID:12408
- C:\Windows\System\ySzJxtz.exe
  C:\Windows\System\ySzJxtz.exe
  2⤵
  PID:12428
- C:\Windows\System\PWqYeMx.exe
  C:\Windows\System\PWqYeMx.exe
  2⤵
  PID:12452
- C:\Windows\System\HzoFDKI.exe
  C:\Windows\System\HzoFDKI.exe
  2⤵
  PID:12472
- C:\Windows\System\EwYclQh.exe
  C:\Windows\System\EwYclQh.exe
  2⤵
  PID:12492
- C:\Windows\System\WZeGjAq.exe
  C:\Windows\System\WZeGjAq.exe
  2⤵
  PID:12520
- C:\Windows\System\VIJCXPM.exe
  C:\Windows\System\VIJCXPM.exe
  2⤵
  PID:12548
- C:\Windows\System\vzbxrww.exe
  C:\Windows\System\vzbxrww.exe
  2⤵
  PID:12572
- C:\Windows\System\EnhYKIg.exe
  C:\Windows\System\EnhYKIg.exe
  2⤵
  PID:12596
- C:\Windows\System\bXlKWoZ.exe
  C:\Windows\System\bXlKWoZ.exe
  2⤵
  PID:12616
- C:\Windows\System\LLURhlV.exe
  C:\Windows\System\LLURhlV.exe
  2⤵
  PID:12632
- C:\Windows\System\QyqPfVJ.exe
  C:\Windows\System\QyqPfVJ.exe
  2⤵
  PID:12652
- C:\Windows\System\sXtbyKC.exe
  C:\Windows\System\sXtbyKC.exe
  2⤵
  PID:12672
- C:\Windows\System\whXEker.exe
  C:\Windows\System\whXEker.exe
  2⤵
  PID:12692
- C:\Windows\System\xodmpRw.exe
  C:\Windows\System\xodmpRw.exe
  2⤵
  PID:12712
- C:\Windows\System\dBTdyAu.exe
  C:\Windows\System\dBTdyAu.exe
  2⤵
  PID:12732
- C:\Windows\System\VmMWEjz.exe
  C:\Windows\System\VmMWEjz.exe
  2⤵
  PID:12756
- C:\Windows\System\abggqEQ.exe
  C:\Windows\System\abggqEQ.exe
  2⤵
  PID:12784
- C:\Windows\System\vhaFclS.exe
  C:\Windows\System\vhaFclS.exe
  2⤵
  PID:12808
- C:\Windows\System\yeYGbNV.exe
  C:\Windows\System\yeYGbNV.exe
  2⤵
  PID:12824
- C:\Windows\System\TteuAdb.exe
  C:\Windows\System\TteuAdb.exe
  2⤵
  PID:12852
- C:\Windows\System\zRSestK.exe
  C:\Windows\System\zRSestK.exe
  2⤵
  PID:12868
- C:\Windows\System\wKZWEDS.exe
  C:\Windows\System\wKZWEDS.exe
  2⤵
  PID:12896
- C:\Windows\System\TBDUiZU.exe
  C:\Windows\System\TBDUiZU.exe
  2⤵
  PID:12916
- C:\Windows\System\mDlMDda.exe
  C:\Windows\System\mDlMDda.exe
  2⤵
  PID:12936
- C:\Windows\System\kwEJPaH.exe
  C:\Windows\System\kwEJPaH.exe
  2⤵
  PID:12960
- C:\Windows\System\xUvCODy.exe
  C:\Windows\System\xUvCODy.exe
  2⤵
  PID:12992
- C:\Windows\System\kzqNhic.exe
  C:\Windows\System\kzqNhic.exe
  2⤵
  PID:13008
- C:\Windows\System\GkBFdPt.exe
  C:\Windows\System\GkBFdPt.exe
  2⤵
  PID:13032
- C:\Windows\System\ZKYbbhN.exe
  C:\Windows\System\ZKYbbhN.exe
  2⤵
  PID:13052
- C:\Windows\System\KeOyfPT.exe
  C:\Windows\System\KeOyfPT.exe
  2⤵
  PID:13068
- C:\Windows\System\jLBWPIN.exe
  C:\Windows\System\jLBWPIN.exe
  2⤵
  PID:13092
- C:\Windows\System\dpDfywo.exe
  C:\Windows\System\dpDfywo.exe
  2⤵
  PID:12092
- C:\Windows\System\YOOBReB.exe
  C:\Windows\System\YOOBReB.exe
  2⤵
  PID:12444
- C:\Windows\System\YjYgqbL.exe
  C:\Windows\System\YjYgqbL.exe
  2⤵
  PID:10552
- C:\Windows\System\fBVZGxz.exe
  C:\Windows\System\fBVZGxz.exe
  2⤵
  PID:11920
- C:\Windows\System\FbvAPYk.exe
  C:\Windows\System\FbvAPYk.exe
  2⤵
  PID:12144
- C:\Windows\System\knAOgEq.exe
  C:\Windows\System\knAOgEq.exe
  2⤵
  PID:12208
- C:\Windows\System\zSKLiEh.exe
  C:\Windows\System\zSKLiEh.exe
  2⤵
  PID:13184
- C:\Windows\System\CMjzXLy.exe
  C:\Windows\System\CMjzXLy.exe
  2⤵
  PID:13208
- C:\Windows\System\SsLZWmO.exe
  C:\Windows\System\SsLZWmO.exe
  2⤵
  PID:13228
- C:\Windows\System\BkmqJwK.exe
  C:\Windows\System\BkmqJwK.exe
  2⤵
  PID:13292
- C:\Windows\System\VuHEhVq.exe
  C:\Windows\System\VuHEhVq.exe
  2⤵
  PID:12544
- C:\Windows\System\qxyzzrE.exe
  C:\Windows\System\qxyzzrE.exe
  2⤵
  PID:11544
- C:\Windows\System\rpdNBLb.exe
  C:\Windows\System\rpdNBLb.exe
  2⤵
  PID:11364
- C:\Windows\System\mCPiMHY.exe
  C:\Windows\System\mCPiMHY.exe
  2⤵
  PID:12864
- C:\Windows\System\VafYJcs.exe
  C:\Windows\System\VafYJcs.exe
  2⤵
  PID:12664
- C:\Windows\System\ZLeujBE.exe
  C:\Windows\System\ZLeujBE.exe
  2⤵
  PID:11376
- C:\Windows\System\dAnJSho.exe
  C:\Windows\System\dAnJSho.exe
  2⤵
  PID:12928
- C:\Windows\System\wxfcEuZ.exe
  C:\Windows\System\wxfcEuZ.exe
  2⤵
  PID:13044
- C:\Windows\System\TViZYLO.exe
  C:\Windows\System\TViZYLO.exe
  2⤵
  PID:13088
- C:\Windows\System\ajVVjWv.exe
  C:\Windows\System\ajVVjWv.exe
  2⤵
  PID:13136
- C:\Windows\System\McgCpnm.exe
  C:\Windows\System\McgCpnm.exe
  2⤵
  PID:13160
- C:\Windows\System\OiHSRJb.exe
  C:\Windows\System\OiHSRJb.exe
  2⤵
  PID:11268
- C:\Windows\System\DKdqIgG.exe
  C:\Windows\System\DKdqIgG.exe
  2⤵
  PID:9220
- C:\Windows\System\lLkzYgk.exe
  C:\Windows\System\lLkzYgk.exe
  2⤵
  PID:2780
- C:\Windows\System\wUSLbDv.exe
  C:\Windows\System\wUSLbDv.exe
  2⤵
  PID:11652
- C:\Windows\System\raJlEOX.exe
  C:\Windows\System\raJlEOX.exe
  2⤵
  PID:11768
- C:\Windows\System\ACFrFlZ.exe
  C:\Windows\System\ACFrFlZ.exe
  2⤵
  PID:10948
- C:\Windows\System\EehUeZY.exe
  C:\Windows\System\EehUeZY.exe
  2⤵
  PID:11792
- C:\Windows\System\MmlGeOa.exe
  C:\Windows\System\MmlGeOa.exe
  2⤵
  PID:10324
- C:\Windows\System\jrxrzsX.exe
  C:\Windows\System\jrxrzsX.exe
  2⤵
  PID:12192
- C:\Windows\System\pqDzNFA.exe
  C:\Windows\System\pqDzNFA.exe
  2⤵
  PID:11984
- C:\Windows\System\caGqaMd.exe
  C:\Windows\System\caGqaMd.exe
  2⤵
  PID:10972
- C:\Windows\System\ODMIvBY.exe
  C:\Windows\System\ODMIvBY.exe
  2⤵
  PID:1048
- C:\Windows\System\nEvCOwP.exe
  C:\Windows\System\nEvCOwP.exe
  2⤵
  PID:11236
- C:\Windows\System\WXmbfhs.exe
  C:\Windows\System\WXmbfhs.exe
  2⤵
  PID:11172
- C:\Windows\System\uuObFSf.exe
  C:\Windows\System\uuObFSf.exe
  2⤵
  PID:8840
- C:\Windows\System\hIVawfI.exe
  C:\Windows\System\hIVawfI.exe
  2⤵
  PID:5148
- C:\Windows\System\cZtxtch.exe
  C:\Windows\System\cZtxtch.exe
  2⤵
  PID:12276
- C:\Windows\System\ycXwhHY.exe
  C:\Windows\System\ycXwhHY.exe
  2⤵
  PID:4564
- C:\Windows\System\bAPSegc.exe
  C:\Windows\System\bAPSegc.exe
  2⤵
  PID:11272
- C:\Windows\System\swrWsJA.exe
  C:\Windows\System\swrWsJA.exe
  2⤵
  PID:11716
- C:\Windows\System\oRgrkdQ.exe
  C:\Windows\System\oRgrkdQ.exe
  2⤵
  PID:12312
- C:\Windows\System\inGZbeB.exe
  C:\Windows\System\inGZbeB.exe
  2⤵
  PID:1184
- C:\Windows\System\cpnFgoo.exe
  C:\Windows\System\cpnFgoo.exe
  2⤵
  PID:11084
- C:\Windows\System\MuHXRAE.exe
  C:\Windows\System\MuHXRAE.exe
  2⤵
  PID:8388
- C:\Windows\System\PYReAah.exe
  C:\Windows\System\PYReAah.exe
  2⤵
  PID:10352
- C:\Windows\System\OGWRRXU.exe
  C:\Windows\System\OGWRRXU.exe
  2⤵
  PID:12508
- C:\Windows\System\IiOePDo.exe
  C:\Windows\System\IiOePDo.exe
  2⤵
  PID:11108
- C:\Windows\System\lrtWeMz.exe
  C:\Windows\System\lrtWeMz.exe
  2⤵
  PID:11388
- C:\Windows\System\aQkWSib.exe
  C:\Windows\System\aQkWSib.exe
  2⤵
  PID:13112
- C:\Windows\System\LfWRKlj.exe
  C:\Windows\System\LfWRKlj.exe
  2⤵
  PID:12752
- C:\Windows\System\dxuQzhH.exe
  C:\Windows\System\dxuQzhH.exe
  2⤵
  PID:13192
- C:\Windows\System\SLDlmmH.exe
  C:\Windows\System\SLDlmmH.exe
  2⤵
  PID:11760
- C:\Windows\System\QfchOeR.exe
  C:\Windows\System\QfchOeR.exe
  2⤵
  PID:12460
- C:\Windows\System\eCHMQGg.exe
  C:\Windows\System\eCHMQGg.exe
  2⤵
  PID:12100
- C:\Windows\System\snqJJsb.exe
  C:\Windows\System\snqJJsb.exe
  2⤵
  PID:11156
- C:\Windows\System\cqQDUro.exe
  C:\Windows\System\cqQDUro.exe
  2⤵
  PID:12724
- C:\Windows\System\tbATctA.exe
  C:\Windows\System\tbATctA.exe
  2⤵
  PID:3152
- C:\Windows\System\EsQNxvo.exe
  C:\Windows\System\EsQNxvo.exe
  2⤵
  PID:13200
- C:\Windows\System\AlGXSpw.exe
  C:\Windows\System\AlGXSpw.exe
  2⤵
  PID:9952
- C:\Windows\System\UYWSlBK.exe
  C:\Windows\System\UYWSlBK.exe
  2⤵
  PID:9536
- C:\Windows\System\uGGczmI.exe
  C:\Windows\System\uGGczmI.exe
  2⤵
  PID:12096
- C:\Windows\System\wGpPUzi.exe
  C:\Windows\System\wGpPUzi.exe
  2⤵
  PID:10536
- C:\Windows\System\kpgnSSV.exe
  C:\Windows\System\kpgnSSV.exe
  2⤵
  PID:11852
- C:\Windows\System\pMkuVoZ.exe
  C:\Windows\System\pMkuVoZ.exe
  2⤵
  PID:11960
- C:\Windows\System\PpopRPs.exe
  C:\Windows\System\PpopRPs.exe
  2⤵
  PID:11400
- C:\Windows\System\rhAbYzx.exe
  C:\Windows\System\rhAbYzx.exe
  2⤵
  PID:11748
- C:\Windows\System\lnejTMW.exe
  C:\Windows\System\lnejTMW.exe
  2⤵
  PID:11296
- C:\Windows\System\peKbcGM.exe
  C:\Windows\System\peKbcGM.exe
  2⤵
  PID:11104
- C:\Windows\System\qBrAluf.exe
  C:\Windows\System\qBrAluf.exe
  2⤵
  PID:3916
- C:\Windows\System\BcXZmZc.exe
  C:\Windows\System\BcXZmZc.exe
  2⤵
  PID:9340
- C:\Windows\System\lzmgVMg.exe
  C:\Windows\System\lzmgVMg.exe
  2⤵
  PID:10956
- C:\Windows\System\BPdQwAJ.exe
  C:\Windows\System\BPdQwAJ.exe
  2⤵
  PID:13116
- C:\Windows\System\ppoBKlH.exe
  C:\Windows\System\ppoBKlH.exe
  2⤵
  PID:11028
- C:\Windows\System\keESFLi.exe
  C:\Windows\System\keESFLi.exe
  2⤵
  PID:3488
- C:\Windows\System\ZpjFiXJ.exe
  C:\Windows\System\ZpjFiXJ.exe
  2⤵
  PID:10436
- C:\Windows\System\YDAGfPH.exe
  C:\Windows\System\YDAGfPH.exe
  2⤵
  PID:3368
- C:\Windows\System\FJWvmDi.exe
  C:\Windows\System\FJWvmDi.exe
  2⤵
  PID:2624
- C:\Windows\System\muOoZGG.exe
  C:\Windows\System\muOoZGG.exe
  2⤵
  PID:2876
- C:\Windows\System\fxQNqVG.exe
  C:\Windows\System\fxQNqVG.exe
  2⤵
  PID:8268
- C:\Windows\System\hBLhHSr.exe
  C:\Windows\System\hBLhHSr.exe
  2⤵
  PID:3372
- C:\Windows\System\hkJfdSM.exe
  C:\Windows\System\hkJfdSM.exe
  2⤵
  PID:5820
- C:\Windows\System\NQNVEwM.exe
  C:\Windows\System\NQNVEwM.exe
  2⤵
  PID:13172
- C:\Windows\System\OnXZYKH.exe
  C:\Windows\System\OnXZYKH.exe
  2⤵
  PID:3996
- C:\Windows\System\qcmeYJK.exe
  C:\Windows\System\qcmeYJK.exe
  2⤵
  PID:11896
- C:\Windows\System\VzhCxlh.exe
  C:\Windows\System\VzhCxlh.exe
  2⤵
  PID:3428
- C:\Windows\System\jCoUouP.exe
  C:\Windows\System\jCoUouP.exe
  2⤵
  PID:10464
- C:\Windows\System\VZdrjkQ.exe
  C:\Windows\System\VZdrjkQ.exe
  2⤵
  PID:3760
- C:\Windows\System\gdfoYwf.exe
  C:\Windows\System\gdfoYwf.exe
  2⤵
  PID:2768
- C:\Windows\System\NqmnqAl.exe
  C:\Windows\System\NqmnqAl.exe
  2⤵
  PID:13148
- C:\Windows\System\ihCgggs.exe
  C:\Windows\System\ihCgggs.exe
  2⤵
  PID:1236
- C:\Windows\System\nqmJtSw.exe
  C:\Windows\System\nqmJtSw.exe
  2⤵
  PID:1532
- C:\Windows\System\yFbWzar.exe
  C:\Windows\System\yFbWzar.exe
  2⤵
  PID:3308
- C:\Windows\System\ushBVXD.exe
  C:\Windows\System\ushBVXD.exe
  2⤵
  PID:1636
- C:\Windows\System\MQPSKrn.exe
  C:\Windows\System\MQPSKrn.exe
  2⤵
  PID:3424
- C:\Windows\System\WWCvemZ.exe
  C:\Windows\System\WWCvemZ.exe
  2⤵
  PID:3232
- C:\Windows\System\nDwKwMa.exe
  C:\Windows\System\nDwKwMa.exe
  2⤵
  PID:1716
- C:\Windows\System\iWYoiil.exe
  C:\Windows\System\iWYoiil.exe
  2⤵
  PID:1204
- C:\Windows\System\sDCllyr.exe
  C:\Windows\System\sDCllyr.exe
  2⤵
  PID:4188
- C:\Windows\System\xCsvGXS.exe
  C:\Windows\System\xCsvGXS.exe
  2⤵
  PID:12820
- C:\Windows\System\uwTkHvn.exe
  C:\Windows\System\uwTkHvn.exe
  2⤵
  PID:1496
- C:\Windows\System\tspXUxf.exe
  C:\Windows\System\tspXUxf.exe
  2⤵
  PID:1052
- C:\Windows\System\HasSeyk.exe
  C:\Windows\System\HasSeyk.exe
  2⤵
  PID:3164
- C:\Windows\System\PrtKPia.exe
  C:\Windows\System\PrtKPia.exe
  2⤵
  PID:12704
- C:\Windows\System\ZxTcxVb.exe
  C:\Windows\System\ZxTcxVb.exe
  2⤵
  PID:1940
- C:\Windows\System\WKunNsD.exe
  C:\Windows\System\WKunNsD.exe
  2⤵
  PID:3924
- C:\Windows\System\ormxVFV.exe
  C:\Windows\System\ormxVFV.exe
  2⤵
  PID:13332
- C:\Windows\System\dPxGlqr.exe
  C:\Windows\System\dPxGlqr.exe
  2⤵
  PID:13356
- C:\Windows\System\ripiVrI.exe
  C:\Windows\System\ripiVrI.exe
  2⤵
  PID:13388
- C:\Windows\System\bzKfKJp.exe
  C:\Windows\System\bzKfKJp.exe
  2⤵
  PID:13416
- C:\Windows\System\LGfQcHE.exe
  C:\Windows\System\LGfQcHE.exe
  2⤵
  PID:13440
- C:\Windows\System\WtjuKPL.exe
  C:\Windows\System\WtjuKPL.exe
  2⤵
  PID:13496
- C:\Windows\System\qFSZEyh.exe
  C:\Windows\System\qFSZEyh.exe
  2⤵
  PID:13516
- C:\Windows\System\IqMuvBe.exe
  C:\Windows\System\IqMuvBe.exe
  2⤵
  PID:13624
- C:\Windows\System\xzcgLDN.exe
  C:\Windows\System\xzcgLDN.exe
  2⤵
  PID:13692
- C:\Windows\System\uClLuOe.exe
  C:\Windows\System\uClLuOe.exe
  2⤵
  PID:13708
- C:\Windows\System\wRyJCAg.exe
  C:\Windows\System\wRyJCAg.exe
  2⤵
  PID:13764
- C:\Windows\System\LSSouqR.exe
  C:\Windows\System\LSSouqR.exe
  2⤵
  PID:13780
- C:\Windows\System\vTyClan.exe
  C:\Windows\System\vTyClan.exe
  2⤵
  PID:13812
- C:\Windows\System\thObPiZ.exe
  C:\Windows\System\thObPiZ.exe
  2⤵
  PID:13844
- C:\Windows\System\ZSNSywp.exe
  C:\Windows\System\ZSNSywp.exe
  2⤵
  PID:13864
- C:\Windows\System\xiepatj.exe
  C:\Windows\System\xiepatj.exe
  2⤵
  PID:13896
- C:\Windows\System\sQWpaxl.exe
  C:\Windows\System\sQWpaxl.exe
  2⤵
  PID:13920
- C:\Windows\System\PJOICkh.exe
  C:\Windows\System\PJOICkh.exe
  2⤵
  PID:13952
- C:\Windows\System\aZzJyWI.exe
  C:\Windows\System\aZzJyWI.exe
  2⤵
  PID:13972
- C:\Windows\System\BlwSViS.exe
  C:\Windows\System\BlwSViS.exe
  2⤵
  PID:13988
- C:\Windows\System\ZCcelDZ.exe
  C:\Windows\System\ZCcelDZ.exe
  2⤵
  PID:14068
- C:\Windows\System\HBfUVFf.exe
  C:\Windows\System\HBfUVFf.exe
  2⤵
  PID:14084
- C:\Windows\System\JrXbOOJ.exe
  C:\Windows\System\JrXbOOJ.exe
  2⤵
  PID:14140
- C:\Windows\System\YLQVHcS.exe
  C:\Windows\System\YLQVHcS.exe
  2⤵
  PID:14164
- C:\Windows\System\WGVonBR.exe
  C:\Windows\System\WGVonBR.exe
  2⤵
  PID:14196
- C:\Windows\System\cBgpwtP.exe
  C:\Windows\System\cBgpwtP.exe
  2⤵
  PID:14228
- C:\Windows\System\FeyQjHL.exe
  C:\Windows\System\FeyQjHL.exe
  2⤵
  PID:14256
- C:\Windows\System\TZPpIbG.exe
  C:\Windows\System\TZPpIbG.exe
  2⤵
  PID:14280
- C:\Windows\System\WPpXCCt.exe
  C:\Windows\System\WPpXCCt.exe
  2⤵
  PID:14300
- C:\Windows\System\dtkAqXb.exe
  C:\Windows\System\dtkAqXb.exe
  2⤵
  PID:14324
- C:\Windows\System\YKwoGOY.exe
  C:\Windows\System\YKwoGOY.exe
  2⤵
  PID:10908
- C:\Windows\System\MgwIZtW.exe
  C:\Windows\System\MgwIZtW.exe
  2⤵
  PID:2828
- C:\Windows\System\jMTzhBQ.exe
  C:\Windows\System\jMTzhBQ.exe
  2⤵
  PID:11504
- C:\Windows\System\GFuEfFx.exe
  C:\Windows\System\GFuEfFx.exe
  2⤵
  PID:2208
- C:\Windows\System\EbMxcen.exe
  C:\Windows\System\EbMxcen.exe
  2⤵
  PID:1232
- C:\Windows\System\bOMUtDr.exe
  C:\Windows\System\bOMUtDr.exe
  2⤵
  PID:3300
- C:\Windows\System\tixHaqu.exe
  C:\Windows\System\tixHaqu.exe
  2⤵
  PID:3336
- C:\Windows\System\oosKFTr.exe
  C:\Windows\System\oosKFTr.exe
  2⤵
  PID:13540
- C:\Windows\System\kBBwZxt.exe
  C:\Windows\System\kBBwZxt.exe
  2⤵
  PID:13448
- C:\Windows\System\WuwgoRw.exe
  C:\Windows\System\WuwgoRw.exe
  2⤵
  PID:13472
- C:\Windows\System\GwpejoK.exe
  C:\Windows\System\GwpejoK.exe
  2⤵
  PID:4380
- C:\Windows\System\hJFyeLW.exe
  C:\Windows\System\hJFyeLW.exe
  2⤵
  PID:13548
- C:\Windows\System\ZRQpKWE.exe
  C:\Windows\System\ZRQpKWE.exe
  2⤵
  PID:13792
- C:\Windows\System\tQhCdQd.exe
  C:\Windows\System\tQhCdQd.exe
  2⤵
  PID:13592
- C:\Windows\System\xZiHkij.exe
  C:\Windows\System\xZiHkij.exe
  2⤵
  PID:5020
- C:\Windows\System\YkfBuCm.exe
  C:\Windows\System\YkfBuCm.exe
  2⤵
  PID:13648
- C:\Windows\System\GwHHhmS.exe
  C:\Windows\System\GwHHhmS.exe
  2⤵
  PID:13724
- C:\Windows\System\TECIPMw.exe
  C:\Windows\System\TECIPMw.exe
  2⤵
  PID:13840
- C:\Windows\System\rQHqywb.exe
  C:\Windows\System\rQHqywb.exe
  2⤵
  PID:4764
- C:\Windows\System\djDASYs.exe
  C:\Windows\System\djDASYs.exe
  2⤵
  PID:2840
- C:\Windows\System\dkcLUiM.exe
  C:\Windows\System\dkcLUiM.exe
  2⤵
  PID:14076
- C:\Windows\System\EMdJNiQ.exe
  C:\Windows\System\EMdJNiQ.exe
  2⤵
  PID:14156
- C:\Windows\System\snivLxh.exe
  C:\Windows\System\snivLxh.exe
  2⤵
  PID:1456
- C:\Windows\System\UosZACr.exe
  C:\Windows\System\UosZACr.exe
  2⤵
  PID:4420
- C:\Windows\System\BnaqUyI.exe
  C:\Windows\System\BnaqUyI.exe
  2⤵
  PID:14192
- C:\Windows\System\toVVDbA.exe
  C:\Windows\System\toVVDbA.exe
  2⤵
  PID:14224
- C:\Windows\System\STbZmeD.exe
  C:\Windows\System\STbZmeD.exe
  2⤵
  PID:14332
- C:\Windows\System\OnOmLCz.exe
  C:\Windows\System\OnOmLCz.exe
  2⤵
  PID:1520
- C:\Windows\System\fJuHrLC.exe
  C:\Windows\System\fJuHrLC.exe
  2⤵
  PID:14264
- C:\Windows\System\SqShxrj.exe
  C:\Windows\System\SqShxrj.exe
  2⤵
  PID:2864
- C:\Windows\System\AXENDgb.exe
  C:\Windows\System\AXENDgb.exe
  2⤵
  PID:4556
- C:\Windows\System\INXnsge.exe
  C:\Windows\System\INXnsge.exe
  2⤵
  PID:13408
- C:\Windows\System\xzOppLv.exe
  C:\Windows\System\xzOppLv.exe
  2⤵
  PID:1848
- C:\Windows\System\GgxFiuX.exe
  C:\Windows\System\GgxFiuX.exe
  2⤵
  PID:13524
- C:\Windows\System\qGlspQj.exe
  C:\Windows\System\qGlspQj.exe
  2⤵
  PID:2892
- C:\Windows\System\KXbMaFl.exe
  C:\Windows\System\KXbMaFl.exe
  2⤵
  PID:5004
- C:\Windows\System\UXoVByp.exe
  C:\Windows\System\UXoVByp.exe
  2⤵
  PID:13748
- C:\Windows\System\YAwQYlq.exe
  C:\Windows\System\YAwQYlq.exe
  2⤵
  PID:3984
- C:\Windows\System\ZJcefIQ.exe
  C:\Windows\System\ZJcefIQ.exe
  2⤵
  PID:5584
- C:\Windows\System\eJsdOzR.exe
  C:\Windows\System\eJsdOzR.exe
  2⤵
  PID:5660
- C:\Windows\System\EDwcsQV.exe
  C:\Windows\System\EDwcsQV.exe
  2⤵
  PID:3612
- C:\Windows\System\jVAotwb.exe
  C:\Windows\System\jVAotwb.exe
  2⤵
  PID:4316
- C:\Windows\System\FUPPmXl.exe
  C:\Windows\System\FUPPmXl.exe
  2⤵
  PID:5864
- C:\Windows\System\NLdRayg.exe
  C:\Windows\System\NLdRayg.exe
  2⤵
  PID:5632
- C:\Windows\System\EkSejrh.exe
  C:\Windows\System\EkSejrh.exe
  2⤵
  PID:1500
- C:\Windows\System\BXyeBwo.exe
  C:\Windows\System\BXyeBwo.exe
  2⤵
  PID:5964
- C:\Windows\System\VuiZMxd.exe
  C:\Windows\System\VuiZMxd.exe
  2⤵
  PID:13984
- C:\Windows\System\prrkcfv.exe
  C:\Windows\System\prrkcfv.exe
  2⤵
  PID:14020
- C:\Windows\System\KRXeSre.exe
  C:\Windows\System\KRXeSre.exe
  2⤵
  PID:6016
- C:\Windows\System\izcmMZw.exe
  C:\Windows\System\izcmMZw.exe
  2⤵
  PID:14052
- C:\Windows\System\fHRfPNs.exe
  C:\Windows\System\fHRfPNs.exe
  2⤵
  PID:14136
- C:\Windows\System\IVblOMb.exe
  C:\Windows\System\IVblOMb.exe
  2⤵
  PID:14320
- C:\Windows\System\FPaXyvK.exe
  C:\Windows\System\FPaXyvK.exe
  2⤵
  PID:14288
- C:\Windows\System\KexdTmq.exe
  C:\Windows\System\KexdTmq.exe
  2⤵
  PID:640
- C:\Windows\System\bSVUjUm.exe
  C:\Windows\System\bSVUjUm.exe
  2⤵
  PID:13428
- C:\Windows\System\ZLLaJBc.exe
  C:\Windows\System\ZLLaJBc.exe
  2⤵
  PID:5872
- C:\Windows\System\qinNqap.exe
  C:\Windows\System\qinNqap.exe
  2⤵
  PID:13604
- C:\Windows\System\CpxGkYz.exe
  C:\Windows\System\CpxGkYz.exe
  2⤵
  PID:13384
- C:\Windows\System\EdkVBIu.exe
  C:\Windows\System\EdkVBIu.exe
  2⤵
  PID:5608
- C:\Windows\System\olsbpwC.exe
  C:\Windows\System\olsbpwC.exe
  2⤵
  PID:3580
- C:\Windows\System\jRyHoxA.exe
  C:\Windows\System\jRyHoxA.exe
  2⤵
  PID:5916
- C:\Windows\System\tXwHjEm.exe
  C:\Windows\System\tXwHjEm.exe
  2⤵
  PID:14004
- C:\Windows\System\aWsmWci.exe
  C:\Windows\System\aWsmWci.exe
  2⤵
  PID:6044
- C:\Windows\System\ZJhCBlY.exe
  C:\Windows\System\ZJhCBlY.exe
  2⤵
  PID:5360
- C:\Windows\System\OIyNnWM.exe
  C:\Windows\System\OIyNnWM.exe
  2⤵
  PID:13556
- C:\Windows\System\dfuscAj.exe
  C:\Windows\System\dfuscAj.exe
  2⤵
  PID:5484
- C:\Windows\System\healWSS.exe
  C:\Windows\System\healWSS.exe
  2⤵
  PID:8092
- C:\Windows\System\BhEQNHk.exe
  C:\Windows\System\BhEQNHk.exe
  2⤵
  PID:4448
- C:\Windows\System\dXOnkMj.exe
  C:\Windows\System\dXOnkMj.exe
  2⤵
  PID:5640
- C:\Windows\System\eGUZFax.exe
  C:\Windows\System\eGUZFax.exe
  2⤵
  PID:5968
- C:\Windows\System\qsURayd.exe
  C:\Windows\System\qsURayd.exe
  2⤵
  PID:4428
- C:\Windows\System\xhTMGzi.exe
  C:\Windows\System\xhTMGzi.exe
  2⤵
  PID:5840
- C:\Windows\System\mlVhbgt.exe
  C:\Windows\System\mlVhbgt.exe
  2⤵
  PID:4472
- C:\Windows\System\tDQlsHf.exe
  C:\Windows\System\tDQlsHf.exe
  2⤵
  PID:2704
- C:\Windows\System\zwjtaqI.exe
  C:\Windows\System\zwjtaqI.exe
  2⤵
  PID:14308
- C:\Windows\System\iPvoNuC.exe
  C:\Windows\System\iPvoNuC.exe
  2⤵
  PID:13608
- C:\Windows\System\ItTDnoD.exe
  C:\Windows\System\ItTDnoD.exe
  2⤵
  PID:5264
- C:\Windows\System\quXxFwS.exe
  C:\Windows\System\quXxFwS.exe
  2⤵
  PID:13716
- C:\Windows\System\narGaug.exe
  C:\Windows\System\narGaug.exe
  2⤵
  PID:13964
- C:\Windows\System\LeRNtuf.exe
  C:\Windows\System\LeRNtuf.exe
  2⤵
  PID:6496
- C:\Windows\System\dxbHoOc.exe
  C:\Windows\System\dxbHoOc.exe
  2⤵
  PID:1912
- C:\Windows\System\YQibyhK.exe
  C:\Windows\System\YQibyhK.exe
  2⤵
  PID:5444
- C:\Windows\System\ksKoibi.exe
  C:\Windows\System\ksKoibi.exe
  2⤵
  PID:14184
- C:\Windows\System\XllEunq.exe
  C:\Windows\System\XllEunq.exe
  2⤵
  PID:5780
- C:\Windows\System\ZYuqHrd.exe
  C:\Windows\System\ZYuqHrd.exe
  2⤵
  PID:10820
- C:\Windows\System\tNZhoRb.exe
  C:\Windows\System\tNZhoRb.exe
  2⤵
  PID:5352
- C:\Windows\System\nJULLCa.exe
  C:\Windows\System\nJULLCa.exe
  2⤵
  PID:3528
- C:\Windows\System\hzjZepX.exe
  C:\Windows\System\hzjZepX.exe
  2⤵
  PID:2032
- C:\Windows\System\ZxxbuNi.exe
  C:\Windows\System\ZxxbuNi.exe
  2⤵
  PID:6596
- C:\Windows\System\IwooVzP.exe
  C:\Windows\System\IwooVzP.exe
  2⤵
  PID:6608
- C:\Windows\System\apOhpUO.exe
  C:\Windows\System\apOhpUO.exe
  2⤵
  PID:12332
- C:\Windows\System\XjZuKnC.exe
  C:\Windows\System\XjZuKnC.exe
  2⤵
  PID:5724
- C:\Windows\System\OdZRdCP.exe
  C:\Windows\System\OdZRdCP.exe
  2⤵
  PID:6960
- C:\Windows\System\uJjmqFq.exe
  C:\Windows\System\uJjmqFq.exe
  2⤵
  PID:2468
- C:\Windows\System\FepYdtN.exe
  C:\Windows\System\FepYdtN.exe
  2⤵
  PID:13324
- C:\Windows\System\fobMTBu.exe
  C:\Windows\System\fobMTBu.exe
  2⤵
  PID:7844
- C:\Windows\System\AeoOrhY.exe
  C:\Windows\System\AeoOrhY.exe
  2⤵
  PID:7856
- C:\Windows\System\IuRyRPa.exe
  C:\Windows\System\IuRyRPa.exe
  2⤵
  PID:6932
- C:\Windows\System\tCxNOhj.exe
  C:\Windows\System\tCxNOhj.exe
  2⤵
  PID:13664
- C:\Windows\System\DVWBRTm.exe
  C:\Windows\System\DVWBRTm.exe
  2⤵
  PID:7356
- C:\Windows\System\pvpxTqm.exe
  C:\Windows\System\pvpxTqm.exe
  2⤵
  PID:7088
- C:\Windows\System\CSjjWia.exe
  C:\Windows\System\CSjjWia.exe
  2⤵
  PID:8356
- C:\Windows\System\RmXSqGI.exe
  C:\Windows\System\RmXSqGI.exe
  2⤵
  PID:4164
- C:\Windows\System\uMaMnUj.exe
  C:\Windows\System\uMaMnUj.exe
  2⤵
  PID:8012
- C:\Windows\System\EEYVLaH.exe
  C:\Windows\System\EEYVLaH.exe
  2⤵
  PID:14120
- C:\Windows\System\dTboplf.exe
  C:\Windows\System\dTboplf.exe
  2⤵
  PID:5244
- C:\Windows\System\nwQIZMs.exe
  C:\Windows\System\nwQIZMs.exe
  2⤵
  PID:5752
- C:\Windows\System\OOuOhhy.exe
  C:\Windows\System\OOuOhhy.exe
  2⤵
  PID:4336
- C:\Windows\System\IYhrrsv.exe
  C:\Windows\System\IYhrrsv.exe
  2⤵
  PID:6980
- C:\Windows\System\xaBbEFZ.exe
  C:\Windows\System\xaBbEFZ.exe
  2⤵
  PID:7728
- C:\Windows\System\lfccCKD.exe
  C:\Windows\System\lfccCKD.exe
  2⤵
  PID:7892
- C:\Windows\System\wULsiOS.exe
  C:\Windows\System\wULsiOS.exe
  2⤵
  PID:7016
- C:\Windows\System\fMRiOiJ.exe
  C:\Windows\System\fMRiOiJ.exe
  2⤵
  PID:7232
- C:\Windows\System\eLBOpxX.exe
  C:\Windows\System\eLBOpxX.exe
  2⤵
  PID:7320
- C:\Windows\System\RJhfcwL.exe
  C:\Windows\System\RJhfcwL.exe
  2⤵
  PID:3784
- C:\Windows\System\qCMWbbA.exe
  C:\Windows\System\qCMWbbA.exe
  2⤵
  PID:7052
- C:\Windows\System\LlZVOFj.exe
  C:\Windows\System\LlZVOFj.exe
  2⤵
  PID:6640
- C:\Windows\System\XxABoyY.exe
  C:\Windows\System\XxABoyY.exe
  2⤵
  PID:7988
- C:\Windows\System\xwFgQHr.exe
  C:\Windows\System\xwFgQHr.exe
  2⤵
  PID:7000
- C:\Windows\System\QjBYrsI.exe
  C:\Windows\System\QjBYrsI.exe
  2⤵
  PID:7712
- C:\Windows\System\bdUrZCU.exe
  C:\Windows\System\bdUrZCU.exe
  2⤵
  PID:6996
- C:\Windows\System\lGYreqI.exe
  C:\Windows\System\lGYreqI.exe
  2⤵
  PID:8788
- C:\Windows\System\xUkafJm.exe
  C:\Windows\System\xUkafJm.exe
  2⤵
  PID:4328
- C:\Windows\System\olsgTKx.exe
  C:\Windows\System\olsgTKx.exe
  2⤵
  PID:4584
- C:\Windows\System\qYhmqhH.exe
  C:\Windows\System\qYhmqhH.exe
  2⤵
  PID:6604
- C:\Windows\System\dNDKKdl.exe
  C:\Windows\System\dNDKKdl.exe
  2⤵
  PID:5144
- C:\Windows\System\UjQZOox.exe
  C:\Windows\System\UjQZOox.exe
  2⤵
  PID:7228
- C:\Windows\System\eWQSaMu.exe
  C:\Windows\System\eWQSaMu.exe
  2⤵
  PID:7752
- C:\Windows\System\qbfvCDL.exe
  C:\Windows\System\qbfvCDL.exe
  2⤵
  PID:9016
- C:\Windows\System\RuCqoky.exe
  C:\Windows\System\RuCqoky.exe
  2⤵
  PID:5888
- C:\Windows\System\qaEXqHE.exe
  C:\Windows\System\qaEXqHE.exe
  2⤵
  PID:6260
- C:\Windows\System\LocywsS.exe
  C:\Windows\System\LocywsS.exe
  2⤵
  PID:6792
- C:\Windows\System\iMvWAUM.exe
  C:\Windows\System\iMvWAUM.exe
  2⤵
  PID:6720
- C:\Windows\System\depYyXx.exe
  C:\Windows\System\depYyXx.exe
  2⤵
  PID:6296
- C:\Windows\System\FKyWpTz.exe
  C:\Windows\System\FKyWpTz.exe
  2⤵
  PID:8652
- C:\Windows\System\XKGjCiX.exe
  C:\Windows\System\XKGjCiX.exe
  2⤵
  PID:7032
- C:\Windows\System\WPuOJLx.exe
  C:\Windows\System\WPuOJLx.exe
  2⤵
  PID:8152
- C:\Windows\System\mIpvIyZ.exe
  C:\Windows\System\mIpvIyZ.exe
  2⤵
  PID:8500
- C:\Windows\System\RuQiPsk.exe
  C:\Windows\System\RuQiPsk.exe
  2⤵
  PID:8184
- C:\Windows\System\pBXSYIG.exe
  C:\Windows\System\pBXSYIG.exe
  2⤵
  PID:8680
- C:\Windows\System\xYBhNYu.exe
  C:\Windows\System\xYBhNYu.exe
  2⤵
  PID:8384
- C:\Windows\System\wonVVXa.exe
  C:\Windows\System\wonVVXa.exe
  2⤵
  PID:9088
- C:\Windows\System\XwBlTzS.exe
  C:\Windows\System\XwBlTzS.exe
  2⤵
  PID:7004
- C:\Windows\System\aASKMor.exe
  C:\Windows\System\aASKMor.exe
  2⤵
  PID:9684
- C:\Windows\System\gpdNXqk.exe
  C:\Windows\System\gpdNXqk.exe
  2⤵
  PID:8812
- C:\Windows\System\IGGEsMj.exe
  C:\Windows\System\IGGEsMj.exe
  2⤵
  PID:8084
- C:\Windows\System\tReKIwa.exe
  C:\Windows\System\tReKIwa.exe
  2⤵
  PID:8544
- C:\Windows\System\CLWyTgs.exe
  C:\Windows\System\CLWyTgs.exe
  2⤵
  PID:9596
- C:\Windows\System\ZdyXGJl.exe
  C:\Windows\System\ZdyXGJl.exe
  2⤵
  PID:8016
- C:\Windows\System\RPlBiao.exe
  C:\Windows\System\RPlBiao.exe
  2⤵
  PID:9300
- C:\Windows\System\oTWhZtc.exe
  C:\Windows\System\oTWhZtc.exe
  2⤵
  PID:8584
- C:\Windows\System\MtwWoSD.exe
  C:\Windows\System\MtwWoSD.exe
  2⤵
  PID:5868
- C:\Windows\System\CdnqmlQ.exe
  C:\Windows\System\CdnqmlQ.exe
  2⤵
  PID:8224
- C:\Windows\System\uwcQsAJ.exe
  C:\Windows\System\uwcQsAJ.exe
  2⤵
  PID:7044
- C:\Windows\System\wwhNJOR.exe
  C:\Windows\System\wwhNJOR.exe
  2⤵
  PID:8800
- C:\Windows\System\iZAbpHa.exe
  C:\Windows\System\iZAbpHa.exe
  2⤵
  PID:9532
- C:\Windows\System\upiEaoh.exe
  C:\Windows\System\upiEaoh.exe
  2⤵
  PID:9368
- C:\Windows\System\WgDiJUf.exe
  C:\Windows\System\WgDiJUf.exe
  2⤵
  PID:9320
- C:\Windows\System\XdTvrAS.exe
  C:\Windows\System\XdTvrAS.exe
  2⤵
  PID:6196
- C:\Windows\System\NiFodRi.exe
  C:\Windows\System\NiFodRi.exe
  2⤵
  PID:9232
- C:\Windows\System\PRaDTUk.exe
  C:\Windows\System\PRaDTUk.exe
  2⤵
  PID:7264
- C:\Windows\System\BIWSFqw.exe
  C:\Windows\System\BIWSFqw.exe
  2⤵
  PID:13572
- C:\Windows\System\uVmsqcc.exe
  C:\Windows\System\uVmsqcc.exe
  2⤵
  PID:6940
- C:\Windows\System\cHBuWUU.exe
  C:\Windows\System\cHBuWUU.exe
  2⤵
  PID:8348
- C:\Windows\System\ctKNNOP.exe
  C:\Windows\System\ctKNNOP.exe
  2⤵
  PID:10184
- C:\Windows\System\ciyBlef.exe
  C:\Windows\System\ciyBlef.exe
  2⤵
  PID:8692
- C:\Windows\System\gyqsSjZ.exe
  C:\Windows\System\gyqsSjZ.exe
  2⤵
  PID:10060
- C:\Windows\System\qIfSJhF.exe
  C:\Windows\System\qIfSJhF.exe
  2⤵
  PID:7692
- C:\Windows\System\GlXUOKu.exe
  C:\Windows\System\GlXUOKu.exe
  2⤵
  PID:7732
- C:\Windows\System\BwaCYPP.exe
  C:\Windows\System\BwaCYPP.exe
  2⤵
  PID:14352
- C:\Windows\System\zGWfEhN.exe
  C:\Windows\System\zGWfEhN.exe
  2⤵
  PID:14392
- C:\Windows\System\Rxtetom.exe
  C:\Windows\System\Rxtetom.exe
  2⤵
  PID:14444
- C:\Windows\System\JMfKyoh.exe
  C:\Windows\System\JMfKyoh.exe
  2⤵
  PID:14460
- C:\Windows\System\IlBVJRa.exe
  C:\Windows\System\IlBVJRa.exe
  2⤵
  PID:14488
- C:\Windows\System\IsOCEHE.exe
  C:\Windows\System\IsOCEHE.exe
  2⤵
  PID:14508
- C:\Windows\System\qYQxePy.exe
  C:\Windows\System\qYQxePy.exe
  2⤵
  PID:14532
- C:\Windows\System\ahaOTBZ.exe
  C:\Windows\System\ahaOTBZ.exe
  2⤵
  PID:14556
- C:\Windows\System\qgrYwVS.exe
  C:\Windows\System\qgrYwVS.exe
  2⤵
  PID:14588
- C:\Windows\System\TTiziKg.exe
  C:\Windows\System\TTiziKg.exe
  2⤵
  PID:14620
- C:\Windows\System\UpOLioV.exe
  C:\Windows\System\UpOLioV.exe
  2⤵
  PID:14652
- C:\Windows\System\XhCHSID.exe
  C:\Windows\System\XhCHSID.exe
  2⤵
  PID:14676
- C:\Windows\System\XBjOXZm.exe
  C:\Windows\System\XBjOXZm.exe
  2⤵
  PID:14704
- C:\Windows\System\hLsjZhY.exe
  C:\Windows\System\hLsjZhY.exe
  2⤵
  PID:14732
- C:\Windows\System\MNOxikx.exe
  C:\Windows\System\MNOxikx.exe
  2⤵
  PID:14756
- C:\Windows\System\lQcvhnW.exe
  C:\Windows\System\lQcvhnW.exe
  2⤵
  PID:14776
- C:\Windows\System\KkQdIIt.exe
  C:\Windows\System\KkQdIIt.exe
  2⤵
  PID:14796
- C:\Windows\System\jmrjyxO.exe
  C:\Windows\System\jmrjyxO.exe
  2⤵
  PID:14832
- C:\Windows\System\fMFUvIA.exe
  C:\Windows\System\fMFUvIA.exe
  2⤵
  PID:14856
- C:\Windows\System\FCIJWDQ.exe
  C:\Windows\System\FCIJWDQ.exe
  2⤵
  PID:14880
- C:\Windows\System\AFJEGwv.exe
  C:\Windows\System\AFJEGwv.exe
  2⤵
  PID:14908
- C:\Windows\System\nJkcoeM.exe
  C:\Windows\System\nJkcoeM.exe
  2⤵
  PID:14928
- C:\Windows\System\oKQQoGp.exe
  C:\Windows\System\oKQQoGp.exe
  2⤵
  PID:14956
- C:\Windows\System\cdjGpxB.exe
  C:\Windows\System\cdjGpxB.exe
  2⤵
  PID:15088
- C:\Windows\System\BrTpPHC.exe
  C:\Windows\System\BrTpPHC.exe
  2⤵
  PID:15112
- C:\Windows\System\wgMQLrg.exe
  C:\Windows\System\wgMQLrg.exe
  2⤵
  PID:15184
- C:\Windows\System\qiKChuQ.exe
  C:\Windows\System\qiKChuQ.exe
  2⤵
  PID:15208
- C:\Windows\System\FIFsvYJ.exe
  C:\Windows\System\FIFsvYJ.exe
  2⤵
  PID:15240
- C:\Windows\System\VwEPAOx.exe
  C:\Windows\System\VwEPAOx.exe
  2⤵
  PID:15288
- C:\Windows\System\Jrapwwv.exe
  C:\Windows\System\Jrapwwv.exe
  2⤵
  PID:15304
- C:\Windows\System\RHusjVv.exe
  C:\Windows\System\RHusjVv.exe
  2⤵
  PID:15336
- C:\Windows\System\CHvdfeT.exe
  C:\Windows\System\CHvdfeT.exe
  2⤵
  PID:15356
- C:\Windows\System\uKkVoAC.exe
  C:\Windows\System\uKkVoAC.exe
  2⤵
  PID:8180
- C:\Windows\System\SQOxMQP.exe
  C:\Windows\System\SQOxMQP.exe
  2⤵
  PID:1352
- C:\Windows\System\UYiuxld.exe
  C:\Windows\System\UYiuxld.exe
  2⤵
  PID:7992
- C:\Windows\System\QeYNkfh.exe
  C:\Windows\System\QeYNkfh.exe
  2⤵
  PID:13468
- C:\Windows\System\tqiCoGm.exe
  C:\Windows\System\tqiCoGm.exe
  2⤵
  PID:10168
- C:\Windows\System\iCndWvk.exe
  C:\Windows\System\iCndWvk.exe
  2⤵
  PID:10128
- C:\Windows\System\toUDtaO.exe
  C:\Windows\System\toUDtaO.exe
  2⤵
  PID:6856
- C:\Windows\System\gflnmLx.exe
  C:\Windows\System\gflnmLx.exe
  2⤵
  PID:6484
- C:\Windows\System\SxpIjRE.exe
  C:\Windows\System\SxpIjRE.exe
  2⤵
  PID:8968
- C:\Windows\System\hrlyOzw.exe
  C:\Windows\System\hrlyOzw.exe
  2⤵
  PID:14440
- C:\Windows\System\hHxEhgN.exe
  C:\Windows\System\hHxEhgN.exe
  2⤵
  PID:10180
- C:\Windows\System\tTAgDTq.exe
  C:\Windows\System\tTAgDTq.exe
  2⤵
  PID:14516
- C:\Windows\System\TFctRlF.exe
  C:\Windows\System\TFctRlF.exe
  2⤵
  PID:14416
- C:\Windows\System\jlvmZqt.exe
  C:\Windows\System\jlvmZqt.exe
  2⤵
  PID:14468
- C:\Windows\System\DpABrGQ.exe
  C:\Windows\System\DpABrGQ.exe
  2⤵
  PID:10396
- C:\Windows\System\ISsnWYz.exe
  C:\Windows\System\ISsnWYz.exe
  2⤵
  PID:10456
- C:\Windows\System\cTvrquI.exe
  C:\Windows\System\cTvrquI.exe
  2⤵
  PID:11232
- C:\Windows\System\JKTTRbx.exe
  C:\Windows\System\JKTTRbx.exe
  2⤵
  PID:14712
- C:\Windows\System\PmywgQY.exe
  C:\Windows\System\PmywgQY.exe
  2⤵
  PID:2960
- C:\Windows\System\gtkdiHc.exe
  C:\Windows\System\gtkdiHc.exe
  2⤵
  PID:15096
- C:\Windows\System\zwlTeYf.exe
  C:\Windows\System\zwlTeYf.exe
  2⤵
  PID:14988
- C:\Windows\System\MqKZaVB.exe
  C:\Windows\System\MqKZaVB.exe
  2⤵
  PID:8108
- C:\Windows\System\uHzsUKd.exe
  C:\Windows\System\uHzsUKd.exe
  2⤵
  PID:15232
- C:\Windows\System\ysoOjJt.exe
  C:\Windows\System\ysoOjJt.exe
  2⤵
  PID:15056
- C:\Windows\System\KZEsaJj.exe
  C:\Windows\System\KZEsaJj.exe
  2⤵
  PID:10784
- C:\Windows\System\OPdioyq.exe
  C:\Windows\System\OPdioyq.exe
  2⤵
  PID:9920
- C:\Windows\System\AufticH.exe
  C:\Windows\System\AufticH.exe
  2⤵
  PID:15196
- C:\Windows\System\hqRyOYe.exe
  C:\Windows\System\hqRyOYe.exe
  2⤵
  PID:6580
- C:\Windows\System\nScDrQA.exe
  C:\Windows\System\nScDrQA.exe
  2⤵
  PID:6632
- C:\Windows\System\yhRfnzN.exe
  C:\Windows\System\yhRfnzN.exe
  2⤵
  PID:9816
- C:\Windows\System\SEHrCzs.exe
  C:\Windows\System\SEHrCzs.exe
  2⤵
  PID:14380
- C:\Windows\System\AJMYmyc.exe
  C:\Windows\System\AJMYmyc.exe
  2⤵
  PID:14368
- C:\Windows\System\YpDVfRd.exe
  C:\Windows\System\YpDVfRd.exe
  2⤵
  PID:10788
- C:\Windows\System\bGAHnnf.exe
  C:\Windows\System\bGAHnnf.exe
  2⤵
  PID:14876
- C:\Windows\System\YgVbHZt.exe
  C:\Windows\System\YgVbHZt.exe
  2⤵
  PID:14552
- C:\Windows\System\DxhTtWB.exe
  C:\Windows\System\DxhTtWB.exe
  2⤵
  PID:14692
- C:\Windows\System\hPJtIJD.exe
  C:\Windows\System\hPJtIJD.exe
  2⤵
  PID:7572
- C:\Windows\System\KqedVyf.exe
  C:\Windows\System\KqedVyf.exe
  2⤵
  PID:15024
- C:\Windows\System\HHrcEZQ.exe
  C:\Windows\System\HHrcEZQ.exe
  2⤵
  PID:10284
- C:\Windows\System\hFOizIc.exe
  C:\Windows\System\hFOizIc.exe
  2⤵
  PID:10332
- C:\Windows\System\pQmLWNM.exe
  C:\Windows\System\pQmLWNM.exe
  2⤵
  PID:8428
- C:\Windows\System\afxXadD.exe
  C:\Windows\System\afxXadD.exe
  2⤵
  PID:10272
- C:\Windows\System\sFiPraT.exe
  C:\Windows\System\sFiPraT.exe
  2⤵
  PID:10356
- C:\Windows\System\SfYxynN.exe
  C:\Windows\System\SfYxynN.exe
  2⤵
  PID:9772
- C:\Windows\System\RpTtpxO.exe
  C:\Windows\System\RpTtpxO.exe
  2⤵
  PID:15132
- C:\Windows\System\tpSlamr.exe
  C:\Windows\System\tpSlamr.exe
  2⤵
  PID:9624
- C:\Windows\System\GvBHMmh.exe
  C:\Windows\System\GvBHMmh.exe
  2⤵
  PID:14544
- C:\Windows\System\SeWRNme.exe
  C:\Windows\System\SeWRNme.exe
  2⤵
  PID:10212
- C:\Windows\System\ZIrnNti.exe
  C:\Windows\System\ZIrnNti.exe
  2⤵
  PID:14584
- C:\Windows\System\WwKciau.exe
  C:\Windows\System\WwKciau.exe
  2⤵
  PID:14820
- C:\Windows\System\wbBxBzX.exe
  C:\Windows\System\wbBxBzX.exe
  2⤵
  PID:10264
- C:\Windows\System\naqqVcr.exe
  C:\Windows\System\naqqVcr.exe
  2⤵
  PID:14872
- C:\Windows\System\JDgdVpn.exe
  C:\Windows\System\JDgdVpn.exe
  2⤵
  PID:10976
- C:\Windows\System\mfWRFnZ.exe
  C:\Windows\System\mfWRFnZ.exe
  2⤵
  PID:5696
- C:\Windows\System\vHFgPTm.exe
  C:\Windows\System\vHFgPTm.exe
  2⤵
  PID:15076
- C:\Windows\System\iGjGbsi.exe
  C:\Windows\System\iGjGbsi.exe
  2⤵
  PID:12516
- C:\Windows\System\Dppxfuh.exe
  C:\Windows\System\Dppxfuh.exe
  2⤵
  PID:15204
- C:\Windows\System\xhELnPV.exe
  C:\Windows\System\xhELnPV.exe
  2⤵
  PID:8132
- C:\Windows\System\hTdspsi.exe
  C:\Windows\System\hTdspsi.exe
  2⤵
  PID:8372
- C:\Windows\System\Smklacc.exe
  C:\Windows\System\Smklacc.exe
  2⤵
  PID:10720
- C:\Windows\System\qUafFDQ.exe
  C:\Windows\System\qUafFDQ.exe
  2⤵
  PID:10876
- C:\Windows\System\kwuNKLt.exe
  C:\Windows\System\kwuNKLt.exe
  2⤵
  PID:9544
- C:\Windows\System\SQWmuPM.exe
  C:\Windows\System\SQWmuPM.exe
  2⤵
  PID:7156
- C:\Windows\System\mZKxCha.exe
  C:\Windows\System\mZKxCha.exe
  2⤵
  PID:15072
- C:\Windows\System\uuiUWEV.exe
  C:\Windows\System\uuiUWEV.exe
  2⤵
  PID:15180
- C:\Windows\System\LNoApwa.exe
  C:\Windows\System\LNoApwa.exe
  2⤵
  PID:10924
- C:\Windows\System\vEWIMys.exe
  C:\Windows\System\vEWIMys.exe
  2⤵
  PID:624
- C:\Windows\System\fxsxseI.exe
  C:\Windows\System\fxsxseI.exe
  2⤵
  PID:12780
- C:\Windows\System\lamWeBk.exe
  C:\Windows\System\lamWeBk.exe
  2⤵
  PID:12608
- C:\Windows\System\BxAcYUF.exe
  C:\Windows\System\BxAcYUF.exe
  2⤵
  PID:10752
- C:\Windows\System\PwoKKpJ.exe
  C:\Windows\System\PwoKKpJ.exe
  2⤵
  PID:10484
- C:\Windows\System\zRXYzPj.exe
  C:\Windows\System\zRXYzPj.exe
  2⤵
  PID:15144
- C:\Windows\System\INXxJJU.exe
  C:\Windows\System\INXxJJU.exe
  2⤵
  PID:10248
- C:\Windows\System\yREneAc.exe
  C:\Windows\System\yREneAc.exe
  2⤵
  PID:14844
- C:\Windows\System\kZjLsVL.exe
  C:\Windows\System\kZjLsVL.exe
  2⤵
  PID:11580
- C:\Windows\System\cXQQWxF.exe
  C:\Windows\System\cXQQWxF.exe
  2⤵
  PID:14996
- C:\Windows\System\jybApRt.exe
  C:\Windows\System\jybApRt.exe
  2⤵
  PID:10772
- C:\Windows\System\mrwmnEl.exe
  C:\Windows\System\mrwmnEl.exe
  2⤵
  PID:1872
- C:\Windows\System\ooBmFAB.exe
  C:\Windows\System\ooBmFAB.exe
  2⤵
  PID:12848
- C:\Windows\System\gXvnzRE.exe
  C:\Windows\System\gXvnzRE.exe
  2⤵
  PID:14668
- C:\Windows\System\AJneEGu.exe
  C:\Windows\System\AJneEGu.exe
  2⤵
  PID:10984
- C:\Windows\System\kRfidLM.exe
  C:\Windows\System\kRfidLM.exe
  2⤵
  PID:14916
- C:\Windows\System\mNXiNAz.exe
  C:\Windows\System\mNXiNAz.exe
  2⤵
  PID:9636
- C:\Windows\System\uwZvHYs.exe
  C:\Windows\System\uwZvHYs.exe
  2⤵
  PID:11744
- C:\Windows\System\IHGCwtT.exe
  C:\Windows\System\IHGCwtT.exe
  2⤵
  PID:14496
- C:\Windows\System\rBuQdSv.exe
  C:\Windows\System\rBuQdSv.exe
  2⤵
  PID:9000
- C:\Windows\System\QieCdCk.exe
  C:\Windows\System\QieCdCk.exe
  2⤵
  PID:12904
- C:\Windows\System\FfcIMSb.exe
  C:\Windows\System\FfcIMSb.exe
  2⤵
  PID:14748
- C:\Windows\System\rJYHHvQ.exe
  C:\Windows\System\rJYHHvQ.exe
  2⤵
  PID:11340
- C:\Windows\System\gwYnhFA.exe
  C:\Windows\System\gwYnhFA.exe
  2⤵
  PID:10588
- C:\Windows\System\kNTmpep.exe
  C:\Windows\System\kNTmpep.exe
  2⤵
  PID:14684
- C:\Windows\System\zlsIlmu.exe
  C:\Windows\System\zlsIlmu.exe
  2⤵
  PID:10800
- C:\Windows\System\JuzHWkm.exe
  C:\Windows\System\JuzHWkm.exe
  2⤵
  PID:14664
- C:\Windows\System\wBZSaDK.exe
  C:\Windows\System\wBZSaDK.exe
  2⤵
  PID:10812
- C:\Windows\System\fveZiJX.exe
  C:\Windows\System\fveZiJX.exe
  2⤵
  PID:1240
- C:\Windows\System\CnQqNQj.exe
  C:\Windows\System\CnQqNQj.exe
  2⤵
  PID:11316
- C:\Windows\System\QhKaniG.exe
  C:\Windows\System\QhKaniG.exe
  2⤵
  PID:12924
- C:\Windows\System\IePQrDn.exe
  C:\Windows\System\IePQrDn.exe
  2⤵
  PID:15156
- C:\Windows\System\kRtNGgf.exe
  C:\Windows\System\kRtNGgf.exe
  2⤵
  PID:11612
- C:\Windows\System\SnfKPFm.exe
  C:\Windows\System\SnfKPFm.exe
  2⤵
  PID:15128
- C:\Windows\System\KSJQimS.exe
  C:\Windows\System\KSJQimS.exe
  2⤵
  PID:14484
- C:\Windows\System\ELBgqVU.exe
  C:\Windows\System\ELBgqVU.exe
  2⤵
  PID:15284
- C:\Windows\System\PkuZKhu.exe
  C:\Windows\System\PkuZKhu.exe
  2⤵
  PID:10516
- C:\Windows\System\miKxLQc.exe
  C:\Windows\System\miKxLQc.exe
  2⤵
  PID:10276
- C:\Windows\System\duTBtWC.exe
  C:\Windows\System\duTBtWC.exe
  2⤵
  PID:12176
- C:\Windows\System\EenvCHD.exe
  C:\Windows\System\EenvCHD.exe
  2⤵
  PID:11068
- C:\Windows\System\nlTIwrZ.exe
  C:\Windows\System\nlTIwrZ.exe
  2⤵
  PID:14816
- C:\Windows\System\TbDZlKE.exe
  C:\Windows\System\TbDZlKE.exe
  2⤵
  PID:9712
- C:\Windows\System\ryIPuCo.exe
  C:\Windows\System\ryIPuCo.exe
  2⤵
  PID:12256
- C:\Windows\System\QJBsrCd.exe
  C:\Windows\System\QJBsrCd.exe
  2⤵
  PID:8868
- C:\Windows\System\ROUfFoN.exe
  C:\Windows\System\ROUfFoN.exe
  2⤵
  PID:12072
- C:\Windows\System\JNNaTuL.exe
  C:\Windows\System\JNNaTuL.exe
  2⤵
  PID:11292
- C:\Windows\System\MNWunEP.exe
  C:\Windows\System\MNWunEP.exe
  2⤵
  PID:11888
- C:\Windows\System\VzutRRt.exe
  C:\Windows\System\VzutRRt.exe
  2⤵
  PID:14804
- C:\Windows\System\xwcMkWG.exe
  C:\Windows\System\xwcMkWG.exe
  2⤵
  PID:11968

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZ2TD4H5\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3ci1vad.u5n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EAtVNFr.exe

Filesize
1.9MB

MD5
d4090491447201ad8381e9d368085e7e

SHA1
9c3f4451c76af4f5604f1d8f01a7f5b59121f0d8

SHA256
7893b041d17b9649b71bf7219e1c095fa5f3ccd142056925b8e94d4ce0a67295

SHA512
672ff5256e8db0fbdab30ad7bb3f355b9f4d384697e115c6937fcf4e0dd9178b5c38fb675238d1a5907f5cb4a95cf01fd58ef4429ecf0e0cd667e2363a9ed436

Download Submit
C:\Windows\System\GhJdQJU.exe

Filesize
1.9MB

MD5
858f9aad6a5a47e80aceb7551019a739

SHA1
5e7a21e88e913dd606877cf15ab821667abc835e

SHA256
78c345525201c518b922359759d258d363cf10cd7847a8d553c4495013440a63

SHA512
511e8a2151dc6ff0f66634c4b1f010f9ee6c28607468710ca94152ead274ee74d76910e4601f0f749f92cceb8c34a14dc4480dfc6e60f9134957aac4165c7659

Download Submit
C:\Windows\System\HBjJCbh.exe

Filesize
1.9MB

MD5
57ab841bdc6b3e9e3766460189f5f9f6

SHA1
8f7c27ef606caf17cf295f5fb2abac21bda42c5c

SHA256
85f0ba2572fe5d80043eb9bb33603f48d5f838238e1e725d8be974419b70fd69

SHA512
eae2e5b31259b50d0d60fd20cbf400e926240666599c96d7a1eb3ff29adbe6f09f8853b53142535dd8fb3c037dd82700b31049d684166b55c97590aa3917d129

Download Submit
C:\Windows\System\IJCUKTA.exe

Filesize
1.9MB

MD5
203a8cfc0721ec461295d28f32aaa4e8

SHA1
3b86640851c7515c15b24caf7fd54b0893757f90

SHA256
a7ce1f77af7a1a43b9df87ecf3a7818c4e4d13f76d4427ef6a52d1c65833b254

SHA512
2c087c4b98a28070cab9815760810ebb5afe72d070aaa7ac53c09af5813fac4fa399b537404357d2617bb89b76695cc9f5908ca06662f2dabdfa09dbbb396e03

Download Submit
C:\Windows\System\JfwkPLL.exe

Filesize
1.9MB

MD5
46b5d312055982c0a7b626cbd7b8e2eb

SHA1
f2d268d2ca10a8fea7741cb9b281c0bad32b07e8

SHA256
e9d3a1b739ab5edd1f260d9e90197c3eee17c1e3df4162ad5eb4669af9475b9c

SHA512
64abd9e3526d0bc9b437568da92fffd691657290734d8eb96cc818dfdddd6f028da36196bbdade310f8b54b8b80af462089cc5fc67526b433c09ab5790115cbf

Download Submit
C:\Windows\System\MDQLACp.exe

Filesize
1.9MB

MD5
1e6dd6a415abd07a5de20543a7a57604

SHA1
e4d42bf2c59241268c22122c9161ea5db2b600d9

SHA256
8ebd4d3d3ad0fd912659360d38c5df98ad5169ee1fd559691d712aa81ef03b15

SHA512
0ce3461161ad236ce7bde9e2d7a307cc6cc45cc0f91a597b19de99920d05ec8bf9dae334d4dcc7c9860520185dca7fd161325f5469d1540eb326d6f3b8cfcf4e

Download Submit
C:\Windows\System\MdBiXzL.exe

Filesize
1.9MB

MD5
6d665e6a0e90f3dfc2b64e552aa11b3a

SHA1
30a20c2d20aad617933ae5b13f508d106d91e101

SHA256
38679d56ba9c9632c27d9ffa3c6fd379fe621dc4d27beea74a84feda307a05c9

SHA512
79833651fde0e76a9900d727e3290f0384fbf2b3212ce14126cb13843e50fc66e05b4fef249e1f640469845ff1c88393a47f4c5e97206217edc2202d9911c6f9

Download Submit
C:\Windows\System\QVasFpg.exe

Filesize
1.9MB

MD5
60b45444730a27bbd5d4532d0df57cfe

SHA1
63db90a1e077831c04eb95be5d25617e5a66d559

SHA256
bf79fa3197cd6e1418e92b5750792d19e085169e92c29fa3f89a61698861e24b

SHA512
1374071225b10cea743026ae6cd513e803553f014ca67a5a5c2f7ab11b9c095eb3f57ab49f051da5d6ab8842bfd60fc2949f4832c46b2be837b1d1a13170e317

Download Submit
C:\Windows\System\QhesiXZ.exe

Filesize
1.9MB

MD5
f07fe2ee8203b43168eb8f058adbb69c

SHA1
72360023ba832ee3e00d5bca76ff3b98aa5906af

SHA256
17a4713e15232e2bfce45c3d8f7dc52001fcc173ae9d07f5a4cf9538f5474693

SHA512
e86d7a2ecc68d4384ab1e2c5a4b92ffcb51a20b0ab52fc49b2bfaff55730cbe3af58931b17852d91223ea06ef8042e1d159c5c0afbe0d29664e13f9c344c805a

Download Submit
C:\Windows\System\RBDWrzY.exe

Filesize
1.9MB

MD5
5ebc023508bace04ade2479df2d4e072

SHA1
67bcf17ffe8d16a81f91dd73378f3e2600d2b3a5

SHA256
ca03afc46c0cab539bd0ada6a85f30b397803591443819bacd4fee9551874eaf

SHA512
a4fe652f237ac30c6fc087c9dca8c53086d23223ea4471b6ec171947702d4b1006b75c8eb5c0f60450cf81857d817c017058a1e4c3b5d9891506fddffb85da2c

Download Submit
C:\Windows\System\UMuVyYP.exe

Filesize
1.9MB

MD5
765ade149b03efb61df0905338e51625

SHA1
129f0e6122a1ba59ecb4957c0f67bbdc74876c24

SHA256
30912b85834ce80d2831fdc2747eafa736d5bc6e991d9b0bc530d964eee94449

SHA512
dc4fec33680f1f6bcf9f4246b7ed8e702e82ab55192bcfca3ca50acbb61ad402d2296b541ac28257f913d5bc2d2d2d1502ba22afe7919253c9fa585697c7606f

Download Submit
C:\Windows\System\VNBZHOY.exe

Filesize
1.9MB

MD5
4ad375e2e7eb95413704452277ab8eaf

SHA1
8a68c7aac4fa043b9ac1d77774e287e909258c9e

SHA256
19e7dd0acc05faa75cd973cd2a36aaf473716684eb85a3a12bfc5629edc3b03b

SHA512
90697489cca2ea044145549584a9d855b59a2ca599bb341cf833728c216baabe0edf8adbe583684b0fdac8c8320cb48230e0e796405c8e785eebbfcbec08be2b

Download Submit
C:\Windows\System\WUbfLle.exe

Filesize
1.9MB

MD5
72feb5846cd88788f1c38c574f0db2e9

SHA1
02ef24876e24fcaf8dd0cf77bc65beb659021d1b

SHA256
b1aabc86b3d98a9158a28f6dd7351fba351df736526b84cc4967dcffb136ca7b

SHA512
d4f13bb4e00a0353d4de2b58fa80ccee41ea366ceeeb45f42f4c952dd8b7533cbc6da1d2e21bc8ea4017ec9ccd0ee3f8e83d1a461b2f32f972c7065b0b7b5ac9

Download Submit
C:\Windows\System\WvAbDWq.exe

Filesize
1.9MB

MD5
b3ba378553b622bca29723c72e6db977

SHA1
1b920b3fca1133198c1502661edd45fcc6e6ede1

SHA256
7fd1060ed52bff6ffe0185a9a798027bf554406053fd3ea6d88a2636882346ce

SHA512
ce0cbefecf7ed10ec7c87564770601ee6b8a0b9ebdcb5f9b17f06bc06593c5f8b80fb8419fdec8b707c49aed74d4b879514b9d14282b23fd4d97809d8535be8c

Download Submit
C:\Windows\System\Wvpoioh.exe

Filesize
1.9MB

MD5
569730a311f1d8956f3739e64097085a

SHA1
46e84e0e3702aafdc72cbe729f89016823f0edbf

SHA256
d91c90f71f83f2392b5415131dfc061ee4b670dbdc068f23fbf67f1a61ca5a42

SHA512
508f0a41241f2210163aaf713a1614be14c606a9d9f6d0272b1deac73db9558f5b7f3d5f9444057a63939c5e6140b1e1a0864f7d9daf259bd0e1c3bbcf638196

Download Submit
C:\Windows\System\XYnjgNQ.exe

Filesize
1.9MB

MD5
7088d9acb1ec9ec37f082f8e4223c82a

SHA1
59f79714226382d35bbb17d357f953f1dd2a1868

SHA256
cbbd4a446ceb3575ab6dcce17fefc114aa0d4692545718eb964c73e99ad21c50

SHA512
c0721ee6cb77e722466d910d5017403ca719b3e0986b38ade38a1f351316a7177b710dacf2cb31c683c912696d0e76cc93dd455ffdc5e025085af5bb53b8b21f

Download Submit
C:\Windows\System\aNxuOEh.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\aXiFRbE.exe

Filesize
1.9MB

MD5
938adc1cbdc361d235a339d83c16a126

SHA1
aa76a867fed065b321664cff796dad3751fed46f

SHA256
c1e9bfb260725da56f07c777f2a7ae8c8e84c99cdf20b59404679dad2ad206a4

SHA512
07dd78d7169fc581e74a1bff6e7219ea77fb076d8e2e783907bbc71fafd0ec1d6e641268e6e9c9c9cf9231b10c791cb394a4c798656267f89cd6e341d703e3bf

Download Submit
C:\Windows\System\axyUtLY.exe

Filesize
1.9MB

MD5
f0eff205f6ed617ff3d87f8271167f7a

SHA1
59cb9bcd72cc0d73481742a9999ff74bc6cfdca9

SHA256
59b8cb912e558ce1c27015b1db9126e4e66f7186ef992a94af93aa8cf6028154

SHA512
f90740116b5c308e49e991d3c7dff2f58e5ee61ccf5c57f4119f122332327944e79b695946b3690a7af6c419032a2bfdabc640384077037103b84643316c999a

Download Submit
C:\Windows\System\ayUHCoi.exe

Filesize
1.9MB

MD5
348c7c488c7026a22a4bf4da354539b6

SHA1
e19b4e97fae378dacf9d7316db5e9422065bae7e

SHA256
388ddbf048d2df6be68b902c38c6e1ef81e9118ef46fcd9e79fc3c0aa1ef1df6

SHA512
34aeef68684844ede5e6cda5cd78a71a2099988861cef4a72a4298f85f5f7772d9957c927506ec6b02ad1bfdf62749c2de980df3fa8d38e201e5439e40b0b859

Download Submit
C:\Windows\System\beZsnFW.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\gPZXkGt.exe

Filesize
1.9MB

MD5
e3a9b29574852b8a143dd14b65e759ef

SHA1
71bc49f11c128ca56cd7f8bff190a9507a7f497e

SHA256
095cf4804281e51f03b2fac22eceadeaf4bee70f8955b00a54aac5f7987c6622

SHA512
6c15a7206bca6a6aa4d12bb15e36dc569577e436fd3a7fd3da6ae62782c616732c2e799c89e995e782b354204ec49ac1169cc1bc921d4f5b9af6c4b73be46031

Download Submit
C:\Windows\System\hmJLLSH.exe

Filesize
1.9MB

MD5
78eae7282869ab8a574b1fede89ede6d

SHA1
d5bc308b112e6cccd1f69deddd2e25ef71ab892e

SHA256
4f559f8657d9c0cefddce8d8053ffc9869400e29405b5401591864212fc1276e

SHA512
860ff0bf6211eab988a1b6694314fd877eca934ef70f5ec5a4abcfa6cc6957547d0bea25aaa2ede2ac9eb9ef8dba4e86e008aaa91c545934fcc0464d3047f789

Download Submit
C:\Windows\System\hrxKAoq.exe

Filesize
1.9MB

MD5
ddbe47fd095beef6abb433bc26e067fa

SHA1
5403799a4d3254f7cadae79d1cb7b634bde62ce7

SHA256
514c068b9a5de7678cafd63814a2d8b9339a188b0ff6747c6991bc37bdc2a4ce

SHA512
098ce02f011ed561676aa4bb248e7624cd47b1f1bf9f0610ef457d8ce4e06b2ced2751ac6800fc18315afff96a5be4afdda7c19074af722e48898183538e00cd

Download Submit
C:\Windows\System\iuVRmbY.exe

Filesize
1.9MB

MD5
5f870446096702613db474568ac5b705

SHA1
11231ecd894d613466786a9921aee73a59928809

SHA256
e047e8dc640d0b7638ae95d1055fd99ea3c2bc97accd4a5c93c9b82f0e36696b

SHA512
cf535d398ca277f280c549cb29a2121ce5c583a5320158fe1602f6cdde3f7a600aabe5afb85b718c941a604bea461032576c512d4c34bebeb285e25e3079e673

Download Submit
C:\Windows\System\jbQkuIw.exe

Filesize
1.9MB

MD5
a951c2ce72115330bc2166b8faf9153f

SHA1
09694277f098b4bdf3455a8ec6b2737ad9190854

SHA256
6dc3d6131bf579ded925051bc7a860218a924031ad5446db3fe5c097d0607a67

SHA512
99f2d5615b87a477faefa2b0d8992aeed7fb0d9a972c709e6917677446a707df340e9ba9773e72d8c153ae9385eddc5b78bce75b7732403ae1272ad670b1d455

Download Submit
C:\Windows\System\mDiYxNg.exe

Filesize
1.9MB

MD5
0aeceaca1fafefd99724b4f2df300d10

SHA1
b90cf4265aa59fbfde811e4b4a897840e4cae7c8

SHA256
1ab31e3e57402fd1f10fd67735ba3cb3d36aaaefaa1f02219e1c380853b59bbd

SHA512
3583b13da98048738971880fe20953c87940ee1cde8f7bf62dc34ffdbb801ec2a60146983877b29eacb51ca6a45503db430ac5607f3e89f96b58a648cebd23cc

Download Submit
C:\Windows\System\pTAsCvC.exe

Filesize
1.9MB

MD5
36ff42d54f5ec8bb352f12a51add4a0c

SHA1
465c6e20cb67c6d7a1c7d06a65f86994b2b51e51

SHA256
363753f7e3e6597093752d74a7e4fc355f831dc6e5a032d70691636ff074a26b

SHA512
7a96fd145256bd6857b17c58dfc6ec6cfc6929579525acd0f95b24fe5ea4aef1c89277b2ea295833153777e3e25b75512aa527afbdcc8dbe25b7c8dcdf71d7c1

Download Submit
C:\Windows\System\pdvgAdC.exe

Filesize
1.9MB

MD5
64484fcfb30330df89ff7d47d114bccd

SHA1
822565986eef2024a841f1fb441b577e6d9d7eb2

SHA256
f995fcb521f30d443283bbb5ea2b03e709c45333f06cf3549d15d95de8112dee

SHA512
a6ed12c8a3b59d2e546b119ec0c4adc0d220faa475ec3678a9fd0b277b9761a43590b4dc9d8dae593fd83f7d9e8f87de7b0f8135a8bfe711d85013ecd6946669

Download Submit
C:\Windows\System\qjJyQtP.exe

Filesize
1.9MB

MD5
ec334afa1636d011471eb31d9694525a

SHA1
e7b9938fecc0e281ac054465c5d1f0ac74bba5a5

SHA256
e7d3aef6420a8f48bfebe4cb9197e8f1f7ee44ffdbbd33bc495eca38e0ce57b7

SHA512
60d77dac36b2b795d4d9c94ce6a0414c8d8b7dcfa775766acb1eaef7e49ff149db17c413411753f32a7375a474d9d2eb4f7d0e11fb7a5a8ff6ca1841a6766caf

Download Submit
C:\Windows\System\qtZyGmI.exe

Filesize
1.9MB

MD5
e8e427c44332290fbcb6559b6a1654f2

SHA1
ce4db1d60c139b89f8824e8d8a9c54329f0204a9

SHA256
cbadac2a00812d40c875e2b0d828c29dc6c638a014fbc4cf4df052bc7ba98bc2

SHA512
24bf7913f2cac7ce57e7cfaeace8dd2eae90a1aacd9d87d587e2c452ec7e296628a1c4f0504fb777fd71bd736e8c3d8013ddf69899eccc569d3f26f3adcdd8a8

Download Submit
C:\Windows\System\rBZvhqY.exe

Filesize
1.9MB

MD5
dd2e4983ab92af523b1484bfbc835c2d

SHA1
fd0d8b953ecaf28b28e3c5654ab90286d40b5707

SHA256
6112b6872f65531daba0ac4f7ed07c1825252d092575f156bb7d415662346ca3

SHA512
b075de9e5731ab609b6bcc0cac695db45193c77ec0ca1210f9e1627964c1c2b7923ddbd5d0166fa756b1bee3b3d68c392b5a3606d2a6bc27e86f606b346f8639

Download Submit
C:\Windows\System\raaMReE.exe

Filesize
1.9MB

MD5
fc695cfd3cc6fc8d7fbb56cb8df2e5f2

SHA1
623fb299c481899b23e348e14864b2fe7946bf46

SHA256
163f2741b8e4a368a4102fff02a1f5bbbe4297df69d0df643ccf17d2dcedfb47

SHA512
2c2a2ee632d22a22923767f602f95ea7af9a27ac62be4c9b659791e62273131b86a94bd55e748116bf6d47b4a734d654ddcad31a576a15d3ccb815306b2f5f76

Download Submit
C:\Windows\System\squRtDe.exe

Filesize
1.9MB

MD5
004ad1e1d5d95d799c2ab79abae16dfa

SHA1
c996b04d410622aa3bc6774df08777513d105df4

SHA256
cdbb2f21025a5de1caff50e5def38a205d572f55540c007084d5fba6ebc66419

SHA512
6dae0d970302d4bd040a3eced600d7953567f393e8d41b2796849e28ef860b7baf13a20f98b42e2cc3fd6a258d5a42f02d52ca6ac84982c69599a52d3905a29f

Download Submit
C:\Windows\System\tLtORxV.exe

Filesize
1.9MB

MD5
fd1524defbb2640ffaf6f77c844f318f

SHA1
25e4ecc15be0c6a60e295868b8c1e75e44880466

SHA256
c2fbbb4ead9d572f597ec02a058022087cf16886b67cd598644fabcaadfe27be

SHA512
17faa604f1a47213ad337ae4dd98d28bdfc94d460ecd34d6dabe058ee1ec341dedf9b87f374bed77d633d68be07b955af3b4476ebf13805a53b27fc90f130bf9

Download Submit
C:\Windows\System\tdHpyot.exe

Filesize
1.9MB

MD5
da9b11195e77b93c1b3d008d04aa66ed

SHA1
35a2eb25d6f01c2ec9d8abf2b08a9b31aada9e02

SHA256
891a555429542cda31e7fb6c168a5b88c3d42af969a752e1b76e7b4f5f9bd4e1

SHA512
cb293382c870a5e00689a5a504aab6ce4ebbbb47b1b9b4f1c453d39b711ad94d711d4cbf5d065f00c03cf979f641ede1bf7a26203546ddb88d99f8c599ad5fbc

Download Submit
C:\Windows\System\ueBvQEa.exe

Filesize
1.9MB

MD5
8e7d55ea95996c8a41e4c4fa1877a944

SHA1
9222f2eee45309e799a17e6074f623747bc7e132

SHA256
9402edbb73b8f664de55909f898eb2d5d6ad22ec3f1b14130589c8879b454dc8

SHA512
2618a82c26182b16e2205e8fbc5f0e3dd1f134935abafb4c9a810361c4b32e0f703d3995c8727538b8810d861907d95bde14bfeb9ff780ea976d32b53f5e7159

Download Submit
C:\Windows\System\zgEBcYR.exe

Filesize
1.9MB

MD5
13e337edf9abef6779a265f3caaaecd7

SHA1
ebd6d10c04dcf678cc01c557141c8e2dc3c9bdde

SHA256
ddf692b5242398ea1273b5c06a1b74f508d193f58a25aa626b8d0829b4bf6c1d

SHA512
f24e42d09ee314cedcb7e8aa7830089ad43ea9a3fd006d2bb2e6922ab4b62e2d8f7183b2c793e00bacd63844fe413421845e3d99e9c1e68fb5e84b013c7bc243

Download Submit
memory/432-4726-0x00007FF721620000-0x00007FF721A12000-memory.dmp

Filesize
3.9MB

Download
memory/432-335-0x00007FF721620000-0x00007FF721A12000-memory.dmp

Filesize
3.9MB

Download
memory/444-384-0x00007FF650B10000-0x00007FF650F02000-memory.dmp

Filesize
3.9MB

Download
memory/444-4785-0x00007FF650B10000-0x00007FF650F02000-memory.dmp

Filesize
3.9MB

Download
memory/932-4777-0x00007FF78AFC0000-0x00007FF78B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/932-382-0x00007FF78AFC0000-0x00007FF78B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/936-0-0x00007FF6CB330000-0x00007FF6CB722000-memory.dmp

Filesize
3.9MB

Download
memory/936-1-0x000001D986CA0000-0x000001D986CB0000-memory.dmp

Filesize
64KB

Download
memory/1508-4825-0x00007FF6BF2C0000-0x00007FF6BF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-373-0x00007FF6BF2C0000-0x00007FF6BF6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-162-0x00007FF7ED5B0000-0x00007FF7ED9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-12-0x00007FFFD2E53000-0x00007FFFD2E55000-memory.dmp

Filesize
8KB

Download
memory/1804-213-0x00000210162F0000-0x0000021016312000-memory.dmp

Filesize
136KB

Download
memory/1804-140-0x00007FFFD2E50000-0x00007FFFD3911000-memory.dmp

Filesize
10.8MB

Download
memory/1804-388-0x000002102F3A0000-0x000002102FB46000-memory.dmp

Filesize
7.6MB

Download
memory/1804-49-0x00007FFFD2E50000-0x00007FFFD3911000-memory.dmp

Filesize
10.8MB

Download
memory/1828-377-0x00007FF7B8AC0000-0x00007FF7B8EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-4819-0x00007FF7B8AC0000-0x00007FF7B8EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-336-0x00007FF6AD590000-0x00007FF6AD982000-memory.dmp

Filesize
3.9MB

Download
memory/1960-4788-0x00007FF6AD590000-0x00007FF6AD982000-memory.dmp

Filesize
3.9MB

Download
memory/2036-239-0x00007FF6EC8D0000-0x00007FF6ECCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-4701-0x00007FF6EC8D0000-0x00007FF6ECCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-369-0x00007FF795790000-0x00007FF795B82000-memory.dmp

Filesize
3.9MB

Download
memory/2120-4754-0x00007FF795790000-0x00007FF795B82000-memory.dmp

Filesize
3.9MB

Download
memory/2288-4714-0x00007FF627C40000-0x00007FF628032000-memory.dmp

Filesize
3.9MB

Download
memory/2288-282-0x00007FF627C40000-0x00007FF628032000-memory.dmp

Filesize
3.9MB

Download
memory/2336-4764-0x00007FF7D99B0000-0x00007FF7D9DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-372-0x00007FF7D99B0000-0x00007FF7D9DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-4734-0x00007FF79BEC0000-0x00007FF79C2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-387-0x00007FF79BEC0000-0x00007FF79C2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-385-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-4668-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp

Filesize
3.9MB

Download
memory/3376-4749-0x00007FF7B53B0000-0x00007FF7B57A2000-memory.dmp

Filesize
3.9MB

Download
memory/3376-323-0x00007FF7B53B0000-0x00007FF7B57A2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-4705-0x00007FF7CE9E0000-0x00007FF7CEDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3520-218-0x00007FF7CE9E0000-0x00007FF7CEDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-4684-0x00007FF718300000-0x00007FF7186F2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-212-0x00007FF718300000-0x00007FF7186F2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-4721-0x00007FF73FAF0000-0x00007FF73FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-261-0x00007FF73FAF0000-0x00007FF73FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-9-0x00007FF64D430000-0x00007FF64D822000-memory.dmp

Filesize
3.9MB

Download
memory/3988-291-0x00007FF7BA600000-0x00007FF7BA9F2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-386-0x00007FF68AFB0000-0x00007FF68B3A2000-memory.dmp

Filesize
3.9MB

Download
memory/4144-383-0x00007FF652BA0000-0x00007FF652F92000-memory.dmp

Filesize
3.9MB

Download
memory/4144-4740-0x00007FF652BA0000-0x00007FF652F92000-memory.dmp

Filesize
3.9MB

Download
memory/4356-4679-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp

Filesize
3.9MB

Download
memory/4356-237-0x00007FF6A9760000-0x00007FF6A9B52000-memory.dmp

Filesize
3.9MB

Download
memory/4532-280-0x00007FF68F750000-0x00007FF68FB42000-memory.dmp

Filesize
3.9MB

Download
memory/4532-4692-0x00007FF68F750000-0x00007FF68FB42000-memory.dmp

Filesize
3.9MB

Download
memory/5052-4760-0x00007FF6E4C70000-0x00007FF6E5062000-memory.dmp

Filesize
3.9MB

Download
memory/5052-350-0x00007FF6E4C70000-0x00007FF6E5062000-memory.dmp

Filesize
3.9MB

Download