xmrig | c9817f1fb32bd47a5b01a6cf52b8466ca515b174f101c2ffa23d4737b0d1bd1c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
Size

1.4MB
MD5

0fb5d09eda876bbda55b4d6f94dc97a2
SHA1

29342319a9ae78e7347e203a0626e1aa0a716cb2
SHA256

c9817f1fb32bd47a5b01a6cf52b8466ca515b174f101c2ffa23d4737b0d1bd1c
SHA512

c5097485237f4ed3df6d707a1d2a587a556ce199033453c756690cf1748dfbf977a91a3bec38ee1b7a8e09ec0d27298e55ff5696091aab23e7c9423ebb826dcb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwA+:Lz071uv4BPMkibTIA5CJj+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/1948-257-0x00007FF6566B0000-0x00007FF656AA2000-memory.dmp	xmrig
behavioral2/memory/5064-214-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	xmrig
behavioral2/memory/4880-169-0x00007FF69E9D0000-0x00007FF69EDC2000-memory.dmp	xmrig
behavioral2/memory/3728-165-0x00007FF6FDBE0000-0x00007FF6FDFD2000-memory.dmp	xmrig
behavioral2/memory/2308-121-0x00007FF6BA860000-0x00007FF6BAC52000-memory.dmp	xmrig
behavioral2/memory/2872-88-0x00007FF7E60D0000-0x00007FF7E64C2000-memory.dmp	xmrig
behavioral2/memory/5004-71-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp	xmrig
behavioral2/memory/4616-38-0x00007FF7BDAA0000-0x00007FF7BDE92000-memory.dmp	xmrig
behavioral2/memory/4312-307-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	xmrig
behavioral2/memory/548-312-0x00007FF77CD20000-0x00007FF77D112000-memory.dmp	xmrig
behavioral2/memory/4948-313-0x00007FF7D1340000-0x00007FF7D1732000-memory.dmp	xmrig
behavioral2/memory/4972-314-0x00007FF61C1C0000-0x00007FF61C5B2000-memory.dmp	xmrig
behavioral2/memory/4884-346-0x00007FF727A10000-0x00007FF727E02000-memory.dmp	xmrig
behavioral2/memory/2892-316-0x00007FF7EC1A0000-0x00007FF7EC592000-memory.dmp	xmrig
behavioral2/memory/1736-319-0x00007FF68C4D0000-0x00007FF68C8C2000-memory.dmp	xmrig
behavioral2/memory/3400-494-0x00007FF6C44F0000-0x00007FF6C48E2000-memory.dmp	xmrig
behavioral2/memory/2676-1679-0x00007FF7A7ED0000-0x00007FF7A82C2000-memory.dmp	xmrig
behavioral2/memory/1656-1676-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp	xmrig
behavioral2/memory/1732-1304-0x00007FF6B1DE0000-0x00007FF6B21D2000-memory.dmp	xmrig
behavioral2/memory/8-605-0x00007FF7B1780000-0x00007FF7B1B72000-memory.dmp	xmrig
behavioral2/memory/1656-5872-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp	xmrig
behavioral2/memory/5004-5874-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp	xmrig
behavioral2/memory/2308-5883-0x00007FF6BA860000-0x00007FF6BAC52000-memory.dmp	xmrig
behavioral2/memory/4972-5985-0x00007FF61C1C0000-0x00007FF61C5B2000-memory.dmp	xmrig
behavioral2/memory/2676-5983-0x00007FF7A7ED0000-0x00007FF7A82C2000-memory.dmp	xmrig
behavioral2/memory/5064-5950-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	xmrig
behavioral2/memory/4880-5939-0x00007FF69E9D0000-0x00007FF69EDC2000-memory.dmp	xmrig
behavioral2/memory/2872-5882-0x00007FF7E60D0000-0x00007FF7E64C2000-memory.dmp	xmrig
behavioral2/memory/548-6004-0x00007FF77CD20000-0x00007FF77D112000-memory.dmp	xmrig
behavioral2/memory/4312-5991-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	xmrig
behavioral2/memory/2892-6019-0x00007FF7EC1A0000-0x00007FF7EC592000-memory.dmp	xmrig
behavioral2/memory/3400-6009-0x00007FF6C44F0000-0x00007FF6C48E2000-memory.dmp	xmrig
behavioral2/memory/1736-6030-0x00007FF68C4D0000-0x00007FF68C8C2000-memory.dmp	xmrig
behavioral2/memory/4884-6064-0x00007FF727A10000-0x00007FF727E02000-memory.dmp	xmrig
behavioral2/memory/4948-6061-0x00007FF7D1340000-0x00007FF7D1732000-memory.dmp	xmrig
behavioral2/memory/1732-6102-0x00007FF6B1DE0000-0x00007FF6B21D2000-memory.dmp	xmrig
behavioral2/memory/8-6100-0x00007FF7B1780000-0x00007FF7B1B72000-memory.dmp	xmrig
behavioral2/memory/2056-6751-0x00007FF73F420000-0x00007FF73F812000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4616	cCiZgHC.exe
1656	XEWaueX.exe
5004	QFMZtOn.exe
2872	TZxkyUD.exe
2308	UkdmcNL.exe
2676	cjigtBN.exe
3728	ArVHqeY.exe
4880	qqItooU.exe
5064	uqVYvTr.exe
1948	BCkmIrH.exe
4312	RLRogfQ.exe
3196	KHQLAWV.exe
2216	VNhxvzh.exe
548	nlWsTzR.exe
4948	bowiCHL.exe
4248	EszEkHz.exe
4972	IxunJKh.exe
2892	AkSJaol.exe
1736	KtcsAqP.exe
4884	lcCpDyh.exe
3400	bcONxpV.exe
4684	hTezgRR.exe
8	LuaUANf.exe
1732	wdSfRUf.exe
1472	HtwnPiq.exe
3564	jCuXgxe.exe
3988	lGwfZFy.exe
1968	UUOdwIK.exe
1696	rsykhqC.exe
4316	YWytdpo.exe
2356	gKthhTj.exe
4408	yWoWdzf.exe
716	PKOWwyZ.exe
3456	FaJvtkl.exe
4488	QCFEKsU.exe
452	YkyGMhU.exe
3964	hEPtuya.exe
5080	faUtVcE.exe
4936	mAZSwSh.exe
3472	mAQOTdL.exe
2436	iazhNrK.exe
812	TpOhVSH.exe
3284	XfpsoPd.exe
4576	QvXAnJE.exe
1084	ChXazvr.exe
4908	WTGOcBH.exe
4648	zolejiC.exe
2360	KyyDTPN.exe
4912	NgONgyJ.exe
4388	TYevSuV.exe
344	pNXtIdi.exe
972	FgIBzmo.exe
2476	mYELTNi.exe
4304	UbHSjDu.exe
4284	geqPpKb.exe
1944	LLjQgyf.exe
4944	wavqyrZ.exe
2064	TXzXOLU.exe
1356	BsDlDPb.exe
1576	yETFYYk.exe
2804	gAghVCG.exe
4356	vWJCDBX.exe
4332	JMDzFhK.exe
872	YCamlyf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2056-0-0x00007FF73F420000-0x00007FF73F812000-memory.dmp	upx
behavioral2/files/0x000b000000023b9d-5.dat	upx
behavioral2/files/0x000a000000023ba2-7.dat	upx
behavioral2/files/0x000a000000023ba1-10.dat	upx
behavioral2/files/0x000a000000023bad-79.dat	upx
behavioral2/files/0x000a000000023bab-105.dat	upx
behavioral2/files/0x000a000000023bb7-127.dat	upx
behavioral2/memory/1948-257-0x00007FF6566B0000-0x00007FF656AA2000-memory.dmp	upx
behavioral2/memory/5064-214-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-196.dat	upx
behavioral2/files/0x000a000000023bc6-195.dat	upx
behavioral2/files/0x000a000000023bc5-194.dat	upx
behavioral2/files/0x000a000000023bb3-190.dat	upx
behavioral2/files/0x000b000000023b9e-189.dat	upx
behavioral2/files/0x000a000000023bb2-187.dat	upx
behavioral2/files/0x000a000000023bae-185.dat	upx
behavioral2/files/0x000a000000023bc4-184.dat	upx
behavioral2/files/0x000a000000023bc3-183.dat	upx
behavioral2/files/0x000a000000023bc1-178.dat	upx
behavioral2/files/0x000a000000023bc0-175.dat	upx
behavioral2/files/0x000a000000023bbf-172.dat	upx
behavioral2/files/0x000a000000023bbe-170.dat	upx
behavioral2/memory/4880-169-0x00007FF69E9D0000-0x00007FF69EDC2000-memory.dmp	upx
behavioral2/memory/3728-165-0x00007FF6FDBE0000-0x00007FF6FDFD2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-163.dat	upx
behavioral2/files/0x0031000000023bb5-162.dat	upx
behavioral2/files/0x000a000000023bc7-197.dat	upx
behavioral2/files/0x0031000000023bb4-154.dat	upx
behavioral2/files/0x000a000000023bbb-148.dat	upx
behavioral2/files/0x000b000000023ba4-145.dat	upx
behavioral2/files/0x000a000000023bba-144.dat	upx
behavioral2/files/0x000a000000023bc2-182.dat	upx
behavioral2/files/0x000a000000023bb9-139.dat	upx
behavioral2/files/0x000a000000023bb1-171.dat	upx
behavioral2/files/0x000a000000023bbd-161.dat	upx
behavioral2/memory/2308-121-0x00007FF6BA860000-0x00007FF6BAC52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-137.dat	upx
behavioral2/files/0x000a000000023baa-102.dat	upx
behavioral2/files/0x000a000000023ba9-98.dat	upx
behavioral2/files/0x000a000000023baf-95.dat	upx
behavioral2/files/0x000a000000023bb0-94.dat	upx
behavioral2/files/0x000a000000023ba8-92.dat	upx
behavioral2/memory/2872-88-0x00007FF7E60D0000-0x00007FF7E64C2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba5-73.dat	upx
behavioral2/memory/5004-71-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-68.dat	upx
behavioral2/files/0x000a000000023ba7-58.dat	upx
behavioral2/files/0x000a000000023ba6-52.dat	upx
behavioral2/files/0x000a000000023ba3-42.dat	upx
behavioral2/memory/4616-38-0x00007FF7BDAA0000-0x00007FF7BDE92000-memory.dmp	upx
behavioral2/memory/4312-307-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	upx
behavioral2/memory/548-312-0x00007FF77CD20000-0x00007FF77D112000-memory.dmp	upx
behavioral2/memory/4948-313-0x00007FF7D1340000-0x00007FF7D1732000-memory.dmp	upx
behavioral2/memory/4972-314-0x00007FF61C1C0000-0x00007FF61C5B2000-memory.dmp	upx
behavioral2/memory/4884-346-0x00007FF727A10000-0x00007FF727E02000-memory.dmp	upx
behavioral2/memory/2892-316-0x00007FF7EC1A0000-0x00007FF7EC592000-memory.dmp	upx
behavioral2/memory/1736-319-0x00007FF68C4D0000-0x00007FF68C8C2000-memory.dmp	upx
behavioral2/memory/3400-494-0x00007FF6C44F0000-0x00007FF6C48E2000-memory.dmp	upx
behavioral2/memory/2676-1679-0x00007FF7A7ED0000-0x00007FF7A82C2000-memory.dmp	upx
behavioral2/memory/1656-1676-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp	upx
behavioral2/memory/1732-1304-0x00007FF6B1DE0000-0x00007FF6B21D2000-memory.dmp	upx
behavioral2/memory/8-605-0x00007FF7B1780000-0x00007FF7B1B72000-memory.dmp	upx
behavioral2/memory/1656-5872-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp	upx
behavioral2/memory/5004-5874-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aAzoaAF.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\UGXaOgR.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\xeqHiZp.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\sKxUFzM.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\lPDMAUx.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\dxuaAxY.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\xFfibUq.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\hclWHbE.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\HAKDwWI.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\CSaiwXK.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\vqnqttM.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\TJASqts.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ehWUcFE.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\xCJQnAy.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\uBNIvzB.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\LHSvTio.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\mqrUmZR.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\nXfxvKt.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\rrPxNlk.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\yNzNLDc.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\sFKSTJC.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\LhErXYn.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ejbLymV.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\JsnbREe.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\cVDpFiU.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\BoTSVEw.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\glgsxWB.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\jMeTqQR.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\yHafwox.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\EdUYjAi.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\iHbuogb.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\uOnXtEw.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\dHkHCrc.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\fLVMYGD.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\VHFCpzG.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\CqiiZaN.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\uGUPjpa.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\YzWungg.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\OYpZpZo.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\FyosoQN.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ylfLHQB.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\EGoCHKj.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ndwJHcd.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\wYDlCTg.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\wVkwLNb.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\JDQxpAf.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\kHlCgqV.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\LHxZJJi.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\EqkREVL.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\bwlAIJF.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\vbUyTPx.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\DjIBMNF.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\zwjpShT.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ygMigry.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\TcAcvrM.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\lAxuWLf.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ToIeQKj.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\MCNQFJm.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\tHQUkjO.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\hCiNIda.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\MBuROwu.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\FGsncJR.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\sERMVWf.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\yGnBrwZ.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeLockMemoryPrivilege	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3460	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	85
PID 2056 wrote to memory of 3460	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	85
PID 2056 wrote to memory of 4616	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	86
PID 2056 wrote to memory of 4616	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	86
PID 2056 wrote to memory of 1656	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	87
PID 2056 wrote to memory of 1656	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	87
PID 2056 wrote to memory of 5004	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	88
PID 2056 wrote to memory of 5004	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	88
PID 2056 wrote to memory of 2872	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	89
PID 2056 wrote to memory of 2872	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	89
PID 2056 wrote to memory of 2308	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	90
PID 2056 wrote to memory of 2308	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	90
PID 2056 wrote to memory of 2676	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	91
PID 2056 wrote to memory of 2676	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	91
PID 2056 wrote to memory of 3728	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	92
PID 2056 wrote to memory of 3728	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	92
PID 2056 wrote to memory of 4880	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	93
PID 2056 wrote to memory of 4880	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	93
PID 2056 wrote to memory of 5064	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	94
PID 2056 wrote to memory of 5064	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	94
PID 2056 wrote to memory of 1948	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	95
PID 2056 wrote to memory of 1948	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	95
PID 2056 wrote to memory of 4312	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	96
PID 2056 wrote to memory of 4312	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	96
PID 2056 wrote to memory of 3196	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	97
PID 2056 wrote to memory of 3196	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	97
PID 2056 wrote to memory of 2216	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	98
PID 2056 wrote to memory of 2216	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	98
PID 2056 wrote to memory of 548	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	99
PID 2056 wrote to memory of 548	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	99
PID 2056 wrote to memory of 4948	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	100
PID 2056 wrote to memory of 4948	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	100
PID 2056 wrote to memory of 4248	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	101
PID 2056 wrote to memory of 4248	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	101
PID 2056 wrote to memory of 4972	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	102
PID 2056 wrote to memory of 4972	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	102
PID 2056 wrote to memory of 2892	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	103
PID 2056 wrote to memory of 2892	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	103
PID 2056 wrote to memory of 1736	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	104
PID 2056 wrote to memory of 1736	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	104
PID 2056 wrote to memory of 4884	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	105
PID 2056 wrote to memory of 4884	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	105
PID 2056 wrote to memory of 3400	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	106
PID 2056 wrote to memory of 3400	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	106
PID 2056 wrote to memory of 1696	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	107
PID 2056 wrote to memory of 1696	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	107
PID 2056 wrote to memory of 4316	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	108
PID 2056 wrote to memory of 4316	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	108
PID 2056 wrote to memory of 4684	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	109
PID 2056 wrote to memory of 4684	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	109
PID 2056 wrote to memory of 8	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	110
PID 2056 wrote to memory of 8	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	110
PID 2056 wrote to memory of 1732	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	111
PID 2056 wrote to memory of 1732	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	111
PID 2056 wrote to memory of 1472	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	112
PID 2056 wrote to memory of 1472	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	112
PID 2056 wrote to memory of 3564	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	113
PID 2056 wrote to memory of 3564	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	113
PID 2056 wrote to memory of 3988	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	114
PID 2056 wrote to memory of 3988	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	114
PID 2056 wrote to memory of 1968	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	115
PID 2056 wrote to memory of 1968	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	115
PID 2056 wrote to memory of 2356	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	116
PID 2056 wrote to memory of 2356	2056	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System\cCiZgHC.exe
  C:\Windows\System\cCiZgHC.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\XEWaueX.exe
  C:\Windows\System\XEWaueX.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\QFMZtOn.exe
  C:\Windows\System\QFMZtOn.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\TZxkyUD.exe
  C:\Windows\System\TZxkyUD.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\UkdmcNL.exe
  C:\Windows\System\UkdmcNL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\cjigtBN.exe
  C:\Windows\System\cjigtBN.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ArVHqeY.exe
  C:\Windows\System\ArVHqeY.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\qqItooU.exe
  C:\Windows\System\qqItooU.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\uqVYvTr.exe
  C:\Windows\System\uqVYvTr.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\BCkmIrH.exe
  C:\Windows\System\BCkmIrH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\RLRogfQ.exe
  C:\Windows\System\RLRogfQ.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\KHQLAWV.exe
  C:\Windows\System\KHQLAWV.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\VNhxvzh.exe
  C:\Windows\System\VNhxvzh.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\nlWsTzR.exe
  C:\Windows\System\nlWsTzR.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\bowiCHL.exe
  C:\Windows\System\bowiCHL.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\EszEkHz.exe
  C:\Windows\System\EszEkHz.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\IxunJKh.exe
  C:\Windows\System\IxunJKh.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\AkSJaol.exe
  C:\Windows\System\AkSJaol.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\KtcsAqP.exe
  C:\Windows\System\KtcsAqP.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\lcCpDyh.exe
  C:\Windows\System\lcCpDyh.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\bcONxpV.exe
  C:\Windows\System\bcONxpV.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\rsykhqC.exe
  C:\Windows\System\rsykhqC.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YWytdpo.exe
  C:\Windows\System\YWytdpo.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\hTezgRR.exe
  C:\Windows\System\hTezgRR.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\LuaUANf.exe
  C:\Windows\System\LuaUANf.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\wdSfRUf.exe
  C:\Windows\System\wdSfRUf.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\HtwnPiq.exe
  C:\Windows\System\HtwnPiq.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\jCuXgxe.exe
  C:\Windows\System\jCuXgxe.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\lGwfZFy.exe
  C:\Windows\System\lGwfZFy.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\UUOdwIK.exe
  C:\Windows\System\UUOdwIK.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\gKthhTj.exe
  C:\Windows\System\gKthhTj.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\yWoWdzf.exe
  C:\Windows\System\yWoWdzf.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\PKOWwyZ.exe
  C:\Windows\System\PKOWwyZ.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\FaJvtkl.exe
  C:\Windows\System\FaJvtkl.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\QCFEKsU.exe
  C:\Windows\System\QCFEKsU.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\YkyGMhU.exe
  C:\Windows\System\YkyGMhU.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\hEPtuya.exe
  C:\Windows\System\hEPtuya.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\faUtVcE.exe
  C:\Windows\System\faUtVcE.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\mAZSwSh.exe
  C:\Windows\System\mAZSwSh.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\mAQOTdL.exe
  C:\Windows\System\mAQOTdL.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\iazhNrK.exe
  C:\Windows\System\iazhNrK.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\TpOhVSH.exe
  C:\Windows\System\TpOhVSH.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\XfpsoPd.exe
  C:\Windows\System\XfpsoPd.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\QvXAnJE.exe
  C:\Windows\System\QvXAnJE.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ChXazvr.exe
  C:\Windows\System\ChXazvr.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\WTGOcBH.exe
  C:\Windows\System\WTGOcBH.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\zolejiC.exe
  C:\Windows\System\zolejiC.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\KyyDTPN.exe
  C:\Windows\System\KyyDTPN.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\NgONgyJ.exe
  C:\Windows\System\NgONgyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\TYevSuV.exe
  C:\Windows\System\TYevSuV.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\pNXtIdi.exe
  C:\Windows\System\pNXtIdi.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\FgIBzmo.exe
  C:\Windows\System\FgIBzmo.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\mYELTNi.exe
  C:\Windows\System\mYELTNi.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\UbHSjDu.exe
  C:\Windows\System\UbHSjDu.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\geqPpKb.exe
  C:\Windows\System\geqPpKb.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\LLjQgyf.exe
  C:\Windows\System\LLjQgyf.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\wavqyrZ.exe
  C:\Windows\System\wavqyrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\TXzXOLU.exe
  C:\Windows\System\TXzXOLU.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\BsDlDPb.exe
  C:\Windows\System\BsDlDPb.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\yETFYYk.exe
  C:\Windows\System\yETFYYk.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gAghVCG.exe
  C:\Windows\System\gAghVCG.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\qwCeGPC.exe
  C:\Windows\System\qwCeGPC.exe
  2⤵
  PID:2488
- C:\Windows\System\vWJCDBX.exe
  C:\Windows\System\vWJCDBX.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\JMDzFhK.exe
  C:\Windows\System\JMDzFhK.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\YCamlyf.exe
  C:\Windows\System\YCamlyf.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\fBuqoMh.exe
  C:\Windows\System\fBuqoMh.exe
  2⤵
  PID:4124
- C:\Windows\System\hIiSvvO.exe
  C:\Windows\System\hIiSvvO.exe
  2⤵
  PID:2620
- C:\Windows\System\zMomCug.exe
  C:\Windows\System\zMomCug.exe
  2⤵
  PID:2380
- C:\Windows\System\NhnTqJB.exe
  C:\Windows\System\NhnTqJB.exe
  2⤵
  PID:2564
- C:\Windows\System\ofaMSUn.exe
  C:\Windows\System\ofaMSUn.exe
  2⤵
  PID:4776
- C:\Windows\System\keQeFLI.exe
  C:\Windows\System\keQeFLI.exe
  2⤵
  PID:3544
- C:\Windows\System\EawrLaX.exe
  C:\Windows\System\EawrLaX.exe
  2⤵
  PID:3352
- C:\Windows\System\NgseQVc.exe
  C:\Windows\System\NgseQVc.exe
  2⤵
  PID:3620
- C:\Windows\System\PXkTTfy.exe
  C:\Windows\System\PXkTTfy.exe
  2⤵
  PID:656
- C:\Windows\System\QgurjgL.exe
  C:\Windows\System\QgurjgL.exe
  2⤵
  PID:5128
- C:\Windows\System\wpuTWOJ.exe
  C:\Windows\System\wpuTWOJ.exe
  2⤵
  PID:5152
- C:\Windows\System\IDdXCmX.exe
  C:\Windows\System\IDdXCmX.exe
  2⤵
  PID:5172
- C:\Windows\System\BGvTOWm.exe
  C:\Windows\System\BGvTOWm.exe
  2⤵
  PID:5188
- C:\Windows\System\IzMTPZd.exe
  C:\Windows\System\IzMTPZd.exe
  2⤵
  PID:5248
- C:\Windows\System\aIMeaOx.exe
  C:\Windows\System\aIMeaOx.exe
  2⤵
  PID:5276
- C:\Windows\System\njsLdjS.exe
  C:\Windows\System\njsLdjS.exe
  2⤵
  PID:5292
- C:\Windows\System\KgPyHFB.exe
  C:\Windows\System\KgPyHFB.exe
  2⤵
  PID:5308
- C:\Windows\System\HBALYQO.exe
  C:\Windows\System\HBALYQO.exe
  2⤵
  PID:5336
- C:\Windows\System\mjNdSZE.exe
  C:\Windows\System\mjNdSZE.exe
  2⤵
  PID:5356
- C:\Windows\System\eKPlWXB.exe
  C:\Windows\System\eKPlWXB.exe
  2⤵
  PID:5372
- C:\Windows\System\hyvfEUA.exe
  C:\Windows\System\hyvfEUA.exe
  2⤵
  PID:5392
- C:\Windows\System\IokQPRF.exe
  C:\Windows\System\IokQPRF.exe
  2⤵
  PID:5416
- C:\Windows\System\VpGBLmn.exe
  C:\Windows\System\VpGBLmn.exe
  2⤵
  PID:5444
- C:\Windows\System\SzHynfZ.exe
  C:\Windows\System\SzHynfZ.exe
  2⤵
  PID:5460
- C:\Windows\System\peTtFkZ.exe
  C:\Windows\System\peTtFkZ.exe
  2⤵
  PID:5496
- C:\Windows\System\FlefgHQ.exe
  C:\Windows\System\FlefgHQ.exe
  2⤵
  PID:5576
- C:\Windows\System\pHiodNn.exe
  C:\Windows\System\pHiodNn.exe
  2⤵
  PID:5596
- C:\Windows\System\GWRsInO.exe
  C:\Windows\System\GWRsInO.exe
  2⤵
  PID:5616
- C:\Windows\System\JYxwZKA.exe
  C:\Windows\System\JYxwZKA.exe
  2⤵
  PID:5644
- C:\Windows\System\cfWGXIh.exe
  C:\Windows\System\cfWGXIh.exe
  2⤵
  PID:5660
- C:\Windows\System\EvgKWFa.exe
  C:\Windows\System\EvgKWFa.exe
  2⤵
  PID:5676
- C:\Windows\System\DADUrHl.exe
  C:\Windows\System\DADUrHl.exe
  2⤵
  PID:5700
- C:\Windows\System\jKHtxSy.exe
  C:\Windows\System\jKHtxSy.exe
  2⤵
  PID:5720
- C:\Windows\System\XBNCfNN.exe
  C:\Windows\System\XBNCfNN.exe
  2⤵
  PID:5740
- C:\Windows\System\MBrRlCL.exe
  C:\Windows\System\MBrRlCL.exe
  2⤵
  PID:5756
- C:\Windows\System\aitWJIh.exe
  C:\Windows\System\aitWJIh.exe
  2⤵
  PID:5844
- C:\Windows\System\XVAVPOV.exe
  C:\Windows\System\XVAVPOV.exe
  2⤵
  PID:5868
- C:\Windows\System\UnAAzkB.exe
  C:\Windows\System\UnAAzkB.exe
  2⤵
  PID:5892
- C:\Windows\System\xDehkPJ.exe
  C:\Windows\System\xDehkPJ.exe
  2⤵
  PID:5908
- C:\Windows\System\QUtuUmn.exe
  C:\Windows\System\QUtuUmn.exe
  2⤵
  PID:5932
- C:\Windows\System\FzquRsr.exe
  C:\Windows\System\FzquRsr.exe
  2⤵
  PID:5956
- C:\Windows\System\VNarcGp.exe
  C:\Windows\System\VNarcGp.exe
  2⤵
  PID:5976
- C:\Windows\System\NGoIkGg.exe
  C:\Windows\System\NGoIkGg.exe
  2⤵
  PID:5996
- C:\Windows\System\vyqOkmc.exe
  C:\Windows\System\vyqOkmc.exe
  2⤵
  PID:6024
- C:\Windows\System\mQqwyRs.exe
  C:\Windows\System\mQqwyRs.exe
  2⤵
  PID:6044
- C:\Windows\System\RleZJsl.exe
  C:\Windows\System\RleZJsl.exe
  2⤵
  PID:6096
- C:\Windows\System\HPrgCZf.exe
  C:\Windows\System\HPrgCZf.exe
  2⤵
  PID:6124
- C:\Windows\System\lxNaUXU.exe
  C:\Windows\System\lxNaUXU.exe
  2⤵
  PID:1144
- C:\Windows\System\HnUayMY.exe
  C:\Windows\System\HnUayMY.exe
  2⤵
  PID:2592
- C:\Windows\System\EpdaqHQ.exe
  C:\Windows\System\EpdaqHQ.exe
  2⤵
  PID:3644
- C:\Windows\System\LFtxscF.exe
  C:\Windows\System\LFtxscF.exe
  2⤵
  PID:3500
- C:\Windows\System\UgtGuIr.exe
  C:\Windows\System\UgtGuIr.exe
  2⤵
  PID:3868
- C:\Windows\System\TktlHYT.exe
  C:\Windows\System\TktlHYT.exe
  2⤵
  PID:5084
- C:\Windows\System\XwsxrzA.exe
  C:\Windows\System\XwsxrzA.exe
  2⤵
  PID:1288
- C:\Windows\System\sBFMOUQ.exe
  C:\Windows\System\sBFMOUQ.exe
  2⤵
  PID:1600
- C:\Windows\System\SvPbIDz.exe
  C:\Windows\System\SvPbIDz.exe
  2⤵
  PID:4784
- C:\Windows\System\wZUFzqL.exe
  C:\Windows\System\wZUFzqL.exe
  2⤵
  PID:432
- C:\Windows\System\WyRpMqX.exe
  C:\Windows\System\WyRpMqX.exe
  2⤵
  PID:3636
- C:\Windows\System\IVHxQQF.exe
  C:\Windows\System\IVHxQQF.exe
  2⤵
  PID:4552
- C:\Windows\System\qfSFbEi.exe
  C:\Windows\System\qfSFbEi.exe
  2⤵
  PID:1792
- C:\Windows\System\WEwQzmo.exe
  C:\Windows\System\WEwQzmo.exe
  2⤵
  PID:3836
- C:\Windows\System\QdMwjhz.exe
  C:\Windows\System\QdMwjhz.exe
  2⤵
  PID:1876
- C:\Windows\System\HrnPGVe.exe
  C:\Windows\System\HrnPGVe.exe
  2⤵
  PID:3332
- C:\Windows\System\dHFcqnZ.exe
  C:\Windows\System\dHFcqnZ.exe
  2⤵
  PID:2852
- C:\Windows\System\LhnriHZ.exe
  C:\Windows\System\LhnriHZ.exe
  2⤵
  PID:5240
- C:\Windows\System\JTgeCci.exe
  C:\Windows\System\JTgeCci.exe
  2⤵
  PID:4208
- C:\Windows\System\AbmLtfB.exe
  C:\Windows\System\AbmLtfB.exe
  2⤵
  PID:5456
- C:\Windows\System\mkVHeNy.exe
  C:\Windows\System\mkVHeNy.exe
  2⤵
  PID:5180
- C:\Windows\System\UrvpWuW.exe
  C:\Windows\System\UrvpWuW.exe
  2⤵
  PID:5300
- C:\Windows\System\RVajcdI.exe
  C:\Windows\System\RVajcdI.exe
  2⤵
  PID:5368
- C:\Windows\System\Btccikr.exe
  C:\Windows\System\Btccikr.exe
  2⤵
  PID:5636
- C:\Windows\System\ZalBrCW.exe
  C:\Windows\System\ZalBrCW.exe
  2⤵
  PID:4620
- C:\Windows\System\hjpZbUP.exe
  C:\Windows\System\hjpZbUP.exe
  2⤵
  PID:1284
- C:\Windows\System\KoLVAhU.exe
  C:\Windows\System\KoLVAhU.exe
  2⤵
  PID:5060
- C:\Windows\System\ALCmjsZ.exe
  C:\Windows\System\ALCmjsZ.exe
  2⤵
  PID:3784
- C:\Windows\System\yDdkiML.exe
  C:\Windows\System\yDdkiML.exe
  2⤵
  PID:2860
- C:\Windows\System\rIuQryP.exe
  C:\Windows\System\rIuQryP.exe
  2⤵
  PID:5096
- C:\Windows\System\GGCnGuX.exe
  C:\Windows\System\GGCnGuX.exe
  2⤵
  PID:2736
- C:\Windows\System\XOyHCqE.exe
  C:\Windows\System\XOyHCqE.exe
  2⤵
  PID:1644
- C:\Windows\System\XyAFfqU.exe
  C:\Windows\System\XyAFfqU.exe
  2⤵
  PID:1672
- C:\Windows\System\TijGGXT.exe
  C:\Windows\System\TijGGXT.exe
  2⤵
  PID:4644
- C:\Windows\System\rQwJiOz.exe
  C:\Windows\System\rQwJiOz.exe
  2⤵
  PID:1916
- C:\Windows\System\IavuNur.exe
  C:\Windows\System\IavuNur.exe
  2⤵
  PID:3336
- C:\Windows\System\UMokZVk.exe
  C:\Windows\System\UMokZVk.exe
  2⤵
  PID:5764
- C:\Windows\System\dBOoZMr.exe
  C:\Windows\System\dBOoZMr.exe
  2⤵
  PID:4000
- C:\Windows\System\dilFsnT.exe
  C:\Windows\System\dilFsnT.exe
  2⤵
  PID:5316
- C:\Windows\System\EqSKHPe.exe
  C:\Windows\System\EqSKHPe.exe
  2⤵
  PID:5904
- C:\Windows\System\nsDmpff.exe
  C:\Windows\System\nsDmpff.exe
  2⤵
  PID:5608
- C:\Windows\System\SNIfDBW.exe
  C:\Windows\System\SNIfDBW.exe
  2⤵
  PID:5964
- C:\Windows\System\eFIGxEh.exe
  C:\Windows\System\eFIGxEh.exe
  2⤵
  PID:5672
- C:\Windows\System\xdZaZDc.exe
  C:\Windows\System\xdZaZDc.exe
  2⤵
  PID:6056
- C:\Windows\System\KYlmctJ.exe
  C:\Windows\System\KYlmctJ.exe
  2⤵
  PID:5732
- C:\Windows\System\AIbpJiD.exe
  C:\Windows\System\AIbpJiD.exe
  2⤵
  PID:6108
- C:\Windows\System\CMegYvX.exe
  C:\Windows\System\CMegYvX.exe
  2⤵
  PID:5572
- C:\Windows\System\mrEXhDa.exe
  C:\Windows\System\mrEXhDa.exe
  2⤵
  PID:3356
- C:\Windows\System\kLLfJUw.exe
  C:\Windows\System\kLLfJUw.exe
  2⤵
  PID:428
- C:\Windows\System\LRxLeVR.exe
  C:\Windows\System\LRxLeVR.exe
  2⤵
  PID:5808
- C:\Windows\System\VeJlNex.exe
  C:\Windows\System\VeJlNex.exe
  2⤵
  PID:6156
- C:\Windows\System\eKqedWq.exe
  C:\Windows\System\eKqedWq.exe
  2⤵
  PID:6176
- C:\Windows\System\THjCpKL.exe
  C:\Windows\System\THjCpKL.exe
  2⤵
  PID:6196
- C:\Windows\System\zozjJbN.exe
  C:\Windows\System\zozjJbN.exe
  2⤵
  PID:6212
- C:\Windows\System\UbVHFUN.exe
  C:\Windows\System\UbVHFUN.exe
  2⤵
  PID:6236
- C:\Windows\System\spEYKNl.exe
  C:\Windows\System\spEYKNl.exe
  2⤵
  PID:6256
- C:\Windows\System\ObqkTdc.exe
  C:\Windows\System\ObqkTdc.exe
  2⤵
  PID:6276
- C:\Windows\System\vUbzSPR.exe
  C:\Windows\System\vUbzSPR.exe
  2⤵
  PID:6304
- C:\Windows\System\XzHOxlo.exe
  C:\Windows\System\XzHOxlo.exe
  2⤵
  PID:6324
- C:\Windows\System\YFDVJmM.exe
  C:\Windows\System\YFDVJmM.exe
  2⤵
  PID:6348
- C:\Windows\System\nFQxbdH.exe
  C:\Windows\System\nFQxbdH.exe
  2⤵
  PID:6364
- C:\Windows\System\EykTTXm.exe
  C:\Windows\System\EykTTXm.exe
  2⤵
  PID:6388
- C:\Windows\System\sbiJeUl.exe
  C:\Windows\System\sbiJeUl.exe
  2⤵
  PID:6408
- C:\Windows\System\cnUqurr.exe
  C:\Windows\System\cnUqurr.exe
  2⤵
  PID:6428
- C:\Windows\System\humxEOo.exe
  C:\Windows\System\humxEOo.exe
  2⤵
  PID:6452
- C:\Windows\System\xJLMzOq.exe
  C:\Windows\System\xJLMzOq.exe
  2⤵
  PID:6468
- C:\Windows\System\JHLOCqB.exe
  C:\Windows\System\JHLOCqB.exe
  2⤵
  PID:6492
- C:\Windows\System\FmvshBK.exe
  C:\Windows\System\FmvshBK.exe
  2⤵
  PID:6508
- C:\Windows\System\NSuhhNX.exe
  C:\Windows\System\NSuhhNX.exe
  2⤵
  PID:6536
- C:\Windows\System\HpZnmQI.exe
  C:\Windows\System\HpZnmQI.exe
  2⤵
  PID:6564
- C:\Windows\System\zvDBwKl.exe
  C:\Windows\System\zvDBwKl.exe
  2⤵
  PID:6592
- C:\Windows\System\wtLjslu.exe
  C:\Windows\System\wtLjslu.exe
  2⤵
  PID:6612
- C:\Windows\System\ptuedFe.exe
  C:\Windows\System\ptuedFe.exe
  2⤵
  PID:6632
- C:\Windows\System\wqFrZZF.exe
  C:\Windows\System\wqFrZZF.exe
  2⤵
  PID:6652
- C:\Windows\System\XysEPWZ.exe
  C:\Windows\System\XysEPWZ.exe
  2⤵
  PID:6668
- C:\Windows\System\mbgLTMu.exe
  C:\Windows\System\mbgLTMu.exe
  2⤵
  PID:6688
- C:\Windows\System\YBpAeqU.exe
  C:\Windows\System\YBpAeqU.exe
  2⤵
  PID:6708
- C:\Windows\System\INhIfMb.exe
  C:\Windows\System\INhIfMb.exe
  2⤵
  PID:6732
- C:\Windows\System\SRNvdQL.exe
  C:\Windows\System\SRNvdQL.exe
  2⤵
  PID:6752
- C:\Windows\System\ZEYYFWc.exe
  C:\Windows\System\ZEYYFWc.exe
  2⤵
  PID:6772
- C:\Windows\System\yIOBVOv.exe
  C:\Windows\System\yIOBVOv.exe
  2⤵
  PID:6788
- C:\Windows\System\BnTbBeD.exe
  C:\Windows\System\BnTbBeD.exe
  2⤵
  PID:6808
- C:\Windows\System\RDiGqex.exe
  C:\Windows\System\RDiGqex.exe
  2⤵
  PID:6832
- C:\Windows\System\qneYPrG.exe
  C:\Windows\System\qneYPrG.exe
  2⤵
  PID:6852
- C:\Windows\System\HSffftd.exe
  C:\Windows\System\HSffftd.exe
  2⤵
  PID:6872
- C:\Windows\System\FJXIROE.exe
  C:\Windows\System\FJXIROE.exe
  2⤵
  PID:6888
- C:\Windows\System\zZOVynA.exe
  C:\Windows\System\zZOVynA.exe
  2⤵
  PID:6908
- C:\Windows\System\ROhlPTe.exe
  C:\Windows\System\ROhlPTe.exe
  2⤵
  PID:6924
- C:\Windows\System\yyUilmz.exe
  C:\Windows\System\yyUilmz.exe
  2⤵
  PID:6944
- C:\Windows\System\KNJtYiK.exe
  C:\Windows\System\KNJtYiK.exe
  2⤵
  PID:6964
- C:\Windows\System\AWhoFnH.exe
  C:\Windows\System\AWhoFnH.exe
  2⤵
  PID:6980
- C:\Windows\System\pOodTNd.exe
  C:\Windows\System\pOodTNd.exe
  2⤵
  PID:7004
- C:\Windows\System\gpupnsV.exe
  C:\Windows\System\gpupnsV.exe
  2⤵
  PID:7024
- C:\Windows\System\HCLiEil.exe
  C:\Windows\System\HCLiEil.exe
  2⤵
  PID:7048
- C:\Windows\System\yuTnkKl.exe
  C:\Windows\System\yuTnkKl.exe
  2⤵
  PID:7072
- C:\Windows\System\LGvQazZ.exe
  C:\Windows\System\LGvQazZ.exe
  2⤵
  PID:7096
- C:\Windows\System\ApSlIkZ.exe
  C:\Windows\System\ApSlIkZ.exe
  2⤵
  PID:7112
- C:\Windows\System\vLIWmNY.exe
  C:\Windows\System\vLIWmNY.exe
  2⤵
  PID:7132
- C:\Windows\System\CpQLIRy.exe
  C:\Windows\System\CpQLIRy.exe
  2⤵
  PID:7164
- C:\Windows\System\DGiiTHK.exe
  C:\Windows\System\DGiiTHK.exe
  2⤵
  PID:3148
- C:\Windows\System\ZTlzhoA.exe
  C:\Windows\System\ZTlzhoA.exe
  2⤵
  PID:5424
- C:\Windows\System\pAnaunu.exe
  C:\Windows\System\pAnaunu.exe
  2⤵
  PID:5164
- C:\Windows\System\DiXoREc.exe
  C:\Windows\System\DiXoREc.exe
  2⤵
  PID:5628
- C:\Windows\System\xqDrkdj.exe
  C:\Windows\System\xqDrkdj.exe
  2⤵
  PID:1108
- C:\Windows\System\gWZHuHO.exe
  C:\Windows\System\gWZHuHO.exe
  2⤵
  PID:2368
- C:\Windows\System\akhtJvU.exe
  C:\Windows\System\akhtJvU.exe
  2⤵
  PID:4964
- C:\Windows\System\KHbasaz.exe
  C:\Windows\System\KHbasaz.exe
  2⤵
  PID:5560
- C:\Windows\System\artCAgt.exe
  C:\Windows\System\artCAgt.exe
  2⤵
  PID:2848
- C:\Windows\System\ZyJLxze.exe
  C:\Windows\System\ZyJLxze.exe
  2⤵
  PID:6012
- C:\Windows\System\wWuUdhh.exe
  C:\Windows\System\wWuUdhh.exe
  2⤵
  PID:6104
- C:\Windows\System\ZThwoqZ.exe
  C:\Windows\System\ZThwoqZ.exe
  2⤵
  PID:3200
- C:\Windows\System\HdRnIGZ.exe
  C:\Windows\System\HdRnIGZ.exe
  2⤵
  PID:3588
- C:\Windows\System\DShUmjM.exe
  C:\Windows\System\DShUmjM.exe
  2⤵
  PID:6172
- C:\Windows\System\LrwVABC.exe
  C:\Windows\System\LrwVABC.exe
  2⤵
  PID:6204
- C:\Windows\System\dCxHHEf.exe
  C:\Windows\System\dCxHHEf.exe
  2⤵
  PID:6252
- C:\Windows\System\sxLFlJR.exe
  C:\Windows\System\sxLFlJR.exe
  2⤵
  PID:5948
- C:\Windows\System\uiWayxD.exe
  C:\Windows\System\uiWayxD.exe
  2⤵
  PID:6400
- C:\Windows\System\FvTHJbi.exe
  C:\Windows\System\FvTHJbi.exe
  2⤵
  PID:6424
- C:\Windows\System\IoIEGmN.exe
  C:\Windows\System\IoIEGmN.exe
  2⤵
  PID:6448
- C:\Windows\System\yKyXWsf.exe
  C:\Windows\System\yKyXWsf.exe
  2⤵
  PID:6504
- C:\Windows\System\meYbNWK.exe
  C:\Windows\System\meYbNWK.exe
  2⤵
  PID:6532
- C:\Windows\System\bUnnrLh.exe
  C:\Windows\System\bUnnrLh.exe
  2⤵
  PID:6572
- C:\Windows\System\QKJILds.exe
  C:\Windows\System\QKJILds.exe
  2⤵
  PID:7184
- C:\Windows\System\bgYzFtV.exe
  C:\Windows\System\bgYzFtV.exe
  2⤵
  PID:7204
- C:\Windows\System\abuoilR.exe
  C:\Windows\System\abuoilR.exe
  2⤵
  PID:7224
- C:\Windows\System\usUhLnP.exe
  C:\Windows\System\usUhLnP.exe
  2⤵
  PID:7248
- C:\Windows\System\ctXWFHB.exe
  C:\Windows\System\ctXWFHB.exe
  2⤵
  PID:7268
- C:\Windows\System\oVKTuyK.exe
  C:\Windows\System\oVKTuyK.exe
  2⤵
  PID:7284
- C:\Windows\System\jfxVznM.exe
  C:\Windows\System\jfxVznM.exe
  2⤵
  PID:7308
- C:\Windows\System\vtlCZwW.exe
  C:\Windows\System\vtlCZwW.exe
  2⤵
  PID:7324
- C:\Windows\System\WoaOThX.exe
  C:\Windows\System\WoaOThX.exe
  2⤵
  PID:7344
- C:\Windows\System\txAUYIj.exe
  C:\Windows\System\txAUYIj.exe
  2⤵
  PID:7364
- C:\Windows\System\eXoghSg.exe
  C:\Windows\System\eXoghSg.exe
  2⤵
  PID:7380
- C:\Windows\System\EbTOtOU.exe
  C:\Windows\System\EbTOtOU.exe
  2⤵
  PID:7408
- C:\Windows\System\jjJSIdu.exe
  C:\Windows\System\jjJSIdu.exe
  2⤵
  PID:7428
- C:\Windows\System\MgZFUUe.exe
  C:\Windows\System\MgZFUUe.exe
  2⤵
  PID:7448
- C:\Windows\System\VMTKyNE.exe
  C:\Windows\System\VMTKyNE.exe
  2⤵
  PID:7464
- C:\Windows\System\DaDcgdM.exe
  C:\Windows\System\DaDcgdM.exe
  2⤵
  PID:7488
- C:\Windows\System\XCuPuaU.exe
  C:\Windows\System\XCuPuaU.exe
  2⤵
  PID:7508
- C:\Windows\System\SKkuyeo.exe
  C:\Windows\System\SKkuyeo.exe
  2⤵
  PID:7528
- C:\Windows\System\NezrOxI.exe
  C:\Windows\System\NezrOxI.exe
  2⤵
  PID:7552
- C:\Windows\System\OqThyUF.exe
  C:\Windows\System\OqThyUF.exe
  2⤵
  PID:7576
- C:\Windows\System\uJEsbhP.exe
  C:\Windows\System\uJEsbhP.exe
  2⤵
  PID:7596
- C:\Windows\System\yDoPSzg.exe
  C:\Windows\System\yDoPSzg.exe
  2⤵
  PID:7616
- C:\Windows\System\daQzMxl.exe
  C:\Windows\System\daQzMxl.exe
  2⤵
  PID:7632
- C:\Windows\System\KkQSCmn.exe
  C:\Windows\System\KkQSCmn.exe
  2⤵
  PID:7656
- C:\Windows\System\rjwaINW.exe
  C:\Windows\System\rjwaINW.exe
  2⤵
  PID:7672
- C:\Windows\System\hLQIItT.exe
  C:\Windows\System\hLQIItT.exe
  2⤵
  PID:7700
- C:\Windows\System\yXiukii.exe
  C:\Windows\System\yXiukii.exe
  2⤵
  PID:7716
- C:\Windows\System\EXkcXVb.exe
  C:\Windows\System\EXkcXVb.exe
  2⤵
  PID:7736
- C:\Windows\System\rWtpaXp.exe
  C:\Windows\System\rWtpaXp.exe
  2⤵
  PID:7756
- C:\Windows\System\RRBmBuL.exe
  C:\Windows\System\RRBmBuL.exe
  2⤵
  PID:7780
- C:\Windows\System\hhJMKwd.exe
  C:\Windows\System\hhJMKwd.exe
  2⤵
  PID:7804
- C:\Windows\System\imdiXkn.exe
  C:\Windows\System\imdiXkn.exe
  2⤵
  PID:7820
- C:\Windows\System\gfmOoRV.exe
  C:\Windows\System\gfmOoRV.exe
  2⤵
  PID:7848
- C:\Windows\System\rSknWpC.exe
  C:\Windows\System\rSknWpC.exe
  2⤵
  PID:7868
- C:\Windows\System\obOepcq.exe
  C:\Windows\System\obOepcq.exe
  2⤵
  PID:7884
- C:\Windows\System\IFOGQcK.exe
  C:\Windows\System\IFOGQcK.exe
  2⤵
  PID:7904
- C:\Windows\System\Xbmyacr.exe
  C:\Windows\System\Xbmyacr.exe
  2⤵
  PID:7924
- C:\Windows\System\uSlFTId.exe
  C:\Windows\System\uSlFTId.exe
  2⤵
  PID:7944
- C:\Windows\System\uhreZtD.exe
  C:\Windows\System\uhreZtD.exe
  2⤵
  PID:7968
- C:\Windows\System\qLYGqYP.exe
  C:\Windows\System\qLYGqYP.exe
  2⤵
  PID:7988
- C:\Windows\System\EtIBkND.exe
  C:\Windows\System\EtIBkND.exe
  2⤵
  PID:8004
- C:\Windows\System\DTongtN.exe
  C:\Windows\System\DTongtN.exe
  2⤵
  PID:8020
- C:\Windows\System\ZaahaPq.exe
  C:\Windows\System\ZaahaPq.exe
  2⤵
  PID:8052
- C:\Windows\System\DseeuMw.exe
  C:\Windows\System\DseeuMw.exe
  2⤵
  PID:8080
- C:\Windows\System\TSMkkMt.exe
  C:\Windows\System\TSMkkMt.exe
  2⤵
  PID:8096
- C:\Windows\System\PwrvzQf.exe
  C:\Windows\System\PwrvzQf.exe
  2⤵
  PID:8116
- C:\Windows\System\fFUCqJQ.exe
  C:\Windows\System\fFUCqJQ.exe
  2⤵
  PID:8132
- C:\Windows\System\lwDGZVV.exe
  C:\Windows\System\lwDGZVV.exe
  2⤵
  PID:8156
- C:\Windows\System\FbFRAlU.exe
  C:\Windows\System\FbFRAlU.exe
  2⤵
  PID:8176
- C:\Windows\System\BqQsyfq.exe
  C:\Windows\System\BqQsyfq.exe
  2⤵
  PID:3052
- C:\Windows\System\PqGoISp.exe
  C:\Windows\System\PqGoISp.exe
  2⤵
  PID:2680
- C:\Windows\System\KTEEfPQ.exe
  C:\Windows\System\KTEEfPQ.exe
  2⤵
  PID:3480
- C:\Windows\System\txVqLKD.exe
  C:\Windows\System\txVqLKD.exe
  2⤵
  PID:1904
- C:\Windows\System\EutCNJq.exe
  C:\Windows\System\EutCNJq.exe
  2⤵
  PID:4056
- C:\Windows\System\OfZfjwM.exe
  C:\Windows\System\OfZfjwM.exe
  2⤵
  PID:6824
- C:\Windows\System\CDHjHRF.exe
  C:\Windows\System\CDHjHRF.exe
  2⤵
  PID:6900
- C:\Windows\System\VtGoHjq.exe
  C:\Windows\System\VtGoHjq.exe
  2⤵
  PID:6932
- C:\Windows\System\QjWJMzc.exe
  C:\Windows\System\QjWJMzc.exe
  2⤵
  PID:6960
- C:\Windows\System\RooRtpd.exe
  C:\Windows\System\RooRtpd.exe
  2⤵
  PID:7068
- C:\Windows\System\NfqMFNX.exe
  C:\Windows\System\NfqMFNX.exe
  2⤵
  PID:7152
- C:\Windows\System\idNjasy.exe
  C:\Windows\System\idNjasy.exe
  2⤵
  PID:5968
- C:\Windows\System\bhFNiQf.exe
  C:\Windows\System\bhFNiQf.exe
  2⤵
  PID:5364
- C:\Windows\System\TSwoOVk.exe
  C:\Windows\System\TSwoOVk.exe
  2⤵
  PID:3572
- C:\Windows\System\HTbMvsD.exe
  C:\Windows\System\HTbMvsD.exe
  2⤵
  PID:6372
- C:\Windows\System\sVilzSS.exe
  C:\Windows\System\sVilzSS.exe
  2⤵
  PID:1116
- C:\Windows\System\fgTMEax.exe
  C:\Windows\System\fgTMEax.exe
  2⤵
  PID:6288
- C:\Windows\System\QwJvXdo.exe
  C:\Windows\System\QwJvXdo.exe
  2⤵
  PID:8208
- C:\Windows\System\RDKbrnR.exe
  C:\Windows\System\RDKbrnR.exe
  2⤵
  PID:8224
- C:\Windows\System\BoLRgAJ.exe
  C:\Windows\System\BoLRgAJ.exe
  2⤵
  PID:8248
- C:\Windows\System\nNwLkOW.exe
  C:\Windows\System\nNwLkOW.exe
  2⤵
  PID:8264
- C:\Windows\System\OeLAtro.exe
  C:\Windows\System\OeLAtro.exe
  2⤵
  PID:8288
- C:\Windows\System\ckEvpcX.exe
  C:\Windows\System\ckEvpcX.exe
  2⤵
  PID:8308
- C:\Windows\System\qrgZFxn.exe
  C:\Windows\System\qrgZFxn.exe
  2⤵
  PID:8328
- C:\Windows\System\GsOCKKk.exe
  C:\Windows\System\GsOCKKk.exe
  2⤵
  PID:8356
- C:\Windows\System\BXNirsb.exe
  C:\Windows\System\BXNirsb.exe
  2⤵
  PID:8372
- C:\Windows\System\CJXSKfR.exe
  C:\Windows\System\CJXSKfR.exe
  2⤵
  PID:8404
- C:\Windows\System\aPxBrCw.exe
  C:\Windows\System\aPxBrCw.exe
  2⤵
  PID:8428
- C:\Windows\System\GSckBTd.exe
  C:\Windows\System\GSckBTd.exe
  2⤵
  PID:8444
- C:\Windows\System\uvCbilv.exe
  C:\Windows\System\uvCbilv.exe
  2⤵
  PID:8464
- C:\Windows\System\WIopoKC.exe
  C:\Windows\System\WIopoKC.exe
  2⤵
  PID:8488
- C:\Windows\System\RAFezzG.exe
  C:\Windows\System\RAFezzG.exe
  2⤵
  PID:8508
- C:\Windows\System\PRdCLLp.exe
  C:\Windows\System\PRdCLLp.exe
  2⤵
  PID:8532
- C:\Windows\System\ExCtnwS.exe
  C:\Windows\System\ExCtnwS.exe
  2⤵
  PID:8548
- C:\Windows\System\WVMkEvg.exe
  C:\Windows\System\WVMkEvg.exe
  2⤵
  PID:8568
- C:\Windows\System\CiOfIJX.exe
  C:\Windows\System\CiOfIJX.exe
  2⤵
  PID:8588
- C:\Windows\System\lWZHbRK.exe
  C:\Windows\System\lWZHbRK.exe
  2⤵
  PID:8604
- C:\Windows\System\hZxySVS.exe
  C:\Windows\System\hZxySVS.exe
  2⤵
  PID:8628
- C:\Windows\System\rYtCwWl.exe
  C:\Windows\System\rYtCwWl.exe
  2⤵
  PID:8648
- C:\Windows\System\IVuRSot.exe
  C:\Windows\System\IVuRSot.exe
  2⤵
  PID:8668
- C:\Windows\System\ldUNYaQ.exe
  C:\Windows\System\ldUNYaQ.exe
  2⤵
  PID:8692
- C:\Windows\System\cuQSbEp.exe
  C:\Windows\System\cuQSbEp.exe
  2⤵
  PID:8708
- C:\Windows\System\nFAigvC.exe
  C:\Windows\System\nFAigvC.exe
  2⤵
  PID:8732
- C:\Windows\System\bDljiyh.exe
  C:\Windows\System\bDljiyh.exe
  2⤵
  PID:8748
- C:\Windows\System\TEtmMKW.exe
  C:\Windows\System\TEtmMKW.exe
  2⤵
  PID:8772
- C:\Windows\System\EqRELdK.exe
  C:\Windows\System\EqRELdK.exe
  2⤵
  PID:8792
- C:\Windows\System\iaGaKjS.exe
  C:\Windows\System\iaGaKjS.exe
  2⤵
  PID:8808
- C:\Windows\System\svEjoIU.exe
  C:\Windows\System\svEjoIU.exe
  2⤵
  PID:8832
- C:\Windows\System\KnSSJXi.exe
  C:\Windows\System\KnSSJXi.exe
  2⤵
  PID:8852
- C:\Windows\System\wjDLgVk.exe
  C:\Windows\System\wjDLgVk.exe
  2⤵
  PID:8872
- C:\Windows\System\eMscPQc.exe
  C:\Windows\System\eMscPQc.exe
  2⤵
  PID:8896
- C:\Windows\System\AUnSWJF.exe
  C:\Windows\System\AUnSWJF.exe
  2⤵
  PID:8916
- C:\Windows\System\hXGhuSC.exe
  C:\Windows\System\hXGhuSC.exe
  2⤵
  PID:8932
- C:\Windows\System\dOpRNJd.exe
  C:\Windows\System\dOpRNJd.exe
  2⤵
  PID:8948
- C:\Windows\System\xdBZgbX.exe
  C:\Windows\System\xdBZgbX.exe
  2⤵
  PID:8972
- C:\Windows\System\agxeQZv.exe
  C:\Windows\System\agxeQZv.exe
  2⤵
  PID:8988
- C:\Windows\System\xMvpozQ.exe
  C:\Windows\System\xMvpozQ.exe
  2⤵
  PID:9016
- C:\Windows\System\EfsTQrX.exe
  C:\Windows\System\EfsTQrX.exe
  2⤵
  PID:9032
- C:\Windows\System\aNLPVVz.exe
  C:\Windows\System\aNLPVVz.exe
  2⤵
  PID:9052
- C:\Windows\System\oGnGzmP.exe
  C:\Windows\System\oGnGzmP.exe
  2⤵
  PID:9076
- C:\Windows\System\vJzDibJ.exe
  C:\Windows\System\vJzDibJ.exe
  2⤵
  PID:9096
- C:\Windows\System\elmitZD.exe
  C:\Windows\System\elmitZD.exe
  2⤵
  PID:9112
- C:\Windows\System\bYMPWwM.exe
  C:\Windows\System\bYMPWwM.exe
  2⤵
  PID:9136
- C:\Windows\System\jHkfBUH.exe
  C:\Windows\System\jHkfBUH.exe
  2⤵
  PID:9152
- C:\Windows\System\cqIwrdI.exe
  C:\Windows\System\cqIwrdI.exe
  2⤵
  PID:9172
- C:\Windows\System\sQXszWW.exe
  C:\Windows\System\sQXszWW.exe
  2⤵
  PID:9192
- C:\Windows\System\giwGZji.exe
  C:\Windows\System\giwGZji.exe
  2⤵
  PID:7180
- C:\Windows\System\aNruhyi.exe
  C:\Windows\System\aNruhyi.exe
  2⤵
  PID:7236
- C:\Windows\System\fqGlvVu.exe
  C:\Windows\System\fqGlvVu.exe
  2⤵
  PID:7264
- C:\Windows\System\TLjfegs.exe
  C:\Windows\System\TLjfegs.exe
  2⤵
  PID:6660
- C:\Windows\System\xaykrKL.exe
  C:\Windows\System\xaykrKL.exe
  2⤵
  PID:540
- C:\Windows\System\wuudIXU.exe
  C:\Windows\System\wuudIXU.exe
  2⤵
  PID:7424
- C:\Windows\System\AvXjNrX.exe
  C:\Windows\System\AvXjNrX.exe
  2⤵
  PID:7472
- C:\Windows\System\LFGEkhd.exe
  C:\Windows\System\LFGEkhd.exe
  2⤵
  PID:7548
- C:\Windows\System\tQHPsyM.exe
  C:\Windows\System\tQHPsyM.exe
  2⤵
  PID:7584
- C:\Windows\System\xaUnuAK.exe
  C:\Windows\System\xaUnuAK.exe
  2⤵
  PID:5160
- C:\Windows\System\CmnTsFJ.exe
  C:\Windows\System\CmnTsFJ.exe
  2⤵
  PID:7712
- C:\Windows\System\BPfbSYR.exe
  C:\Windows\System\BPfbSYR.exe
  2⤵
  PID:6920
- C:\Windows\System\WkInjxM.exe
  C:\Windows\System\WkInjxM.exe
  2⤵
  PID:5568
- C:\Windows\System\HdsrDMX.exe
  C:\Windows\System\HdsrDMX.exe
  2⤵
  PID:7860
- C:\Windows\System\BRoFdNi.exe
  C:\Windows\System\BRoFdNi.exe
  2⤵
  PID:7920
- C:\Windows\System\VbwZhue.exe
  C:\Windows\System\VbwZhue.exe
  2⤵
  PID:7940
- C:\Windows\System\SjTgFoP.exe
  C:\Windows\System\SjTgFoP.exe
  2⤵
  PID:7984
- C:\Windows\System\MgVSHsG.exe
  C:\Windows\System\MgVSHsG.exe
  2⤵
  PID:9220
- C:\Windows\System\lkNnHyh.exe
  C:\Windows\System\lkNnHyh.exe
  2⤵
  PID:9240
- C:\Windows\System\ltWPvOQ.exe
  C:\Windows\System\ltWPvOQ.exe
  2⤵
  PID:9260
- C:\Windows\System\ciXQBjb.exe
  C:\Windows\System\ciXQBjb.exe
  2⤵
  PID:9276
- C:\Windows\System\cZmUFaW.exe
  C:\Windows\System\cZmUFaW.exe
  2⤵
  PID:9292
- C:\Windows\System\YXPFEvV.exe
  C:\Windows\System\YXPFEvV.exe
  2⤵
  PID:9308
- C:\Windows\System\AtbMKaJ.exe
  C:\Windows\System\AtbMKaJ.exe
  2⤵
  PID:9344
- C:\Windows\System\KAuVviC.exe
  C:\Windows\System\KAuVviC.exe
  2⤵
  PID:9376
- C:\Windows\System\pojWFJx.exe
  C:\Windows\System\pojWFJx.exe
  2⤵
  PID:9420
- C:\Windows\System\cqqhPym.exe
  C:\Windows\System\cqqhPym.exe
  2⤵
  PID:9436
- C:\Windows\System\wbfeNDe.exe
  C:\Windows\System\wbfeNDe.exe
  2⤵
  PID:9460
- C:\Windows\System\QcGCeba.exe
  C:\Windows\System\QcGCeba.exe
  2⤵
  PID:9480
- C:\Windows\System\zUDQAgS.exe
  C:\Windows\System\zUDQAgS.exe
  2⤵
  PID:9504
- C:\Windows\System\cZhhIyr.exe
  C:\Windows\System\cZhhIyr.exe
  2⤵
  PID:9520
- C:\Windows\System\jDBLVUS.exe
  C:\Windows\System\jDBLVUS.exe
  2⤵
  PID:9540
- C:\Windows\System\TETtWUz.exe
  C:\Windows\System\TETtWUz.exe
  2⤵
  PID:9560
- C:\Windows\System\QUdbkcP.exe
  C:\Windows\System\QUdbkcP.exe
  2⤵
  PID:9576
- C:\Windows\System\UrCOxjy.exe
  C:\Windows\System\UrCOxjy.exe
  2⤵
  PID:9808
- C:\Windows\System\mcZDPJl.exe
  C:\Windows\System\mcZDPJl.exe
  2⤵
  PID:9832
- C:\Windows\System\rmhtWjx.exe
  C:\Windows\System\rmhtWjx.exe
  2⤵
  PID:9848
- C:\Windows\System\BBRAywS.exe
  C:\Windows\System\BBRAywS.exe
  2⤵
  PID:9872
- C:\Windows\System\GKKYXNF.exe
  C:\Windows\System\GKKYXNF.exe
  2⤵
  PID:9896
- C:\Windows\System\yYvBXTi.exe
  C:\Windows\System\yYvBXTi.exe
  2⤵
  PID:9920
- C:\Windows\System\wkueJzJ.exe
  C:\Windows\System\wkueJzJ.exe
  2⤵
  PID:9940
- C:\Windows\System\kBPuJze.exe
  C:\Windows\System\kBPuJze.exe
  2⤵
  PID:9956
- C:\Windows\System\ptmJtPo.exe
  C:\Windows\System\ptmJtPo.exe
  2⤵
  PID:9972
- C:\Windows\System\FfyKqBE.exe
  C:\Windows\System\FfyKqBE.exe
  2⤵
  PID:9992
- C:\Windows\System\gYGBfmH.exe
  C:\Windows\System\gYGBfmH.exe
  2⤵
  PID:10012
- C:\Windows\System\jRmMRAa.exe
  C:\Windows\System\jRmMRAa.exe
  2⤵
  PID:10032
- C:\Windows\System\WwSqKIn.exe
  C:\Windows\System\WwSqKIn.exe
  2⤵
  PID:10052
- C:\Windows\System\WxAPlCl.exe
  C:\Windows\System\WxAPlCl.exe
  2⤵
  PID:10072
- C:\Windows\System\NovfFnm.exe
  C:\Windows\System\NovfFnm.exe
  2⤵
  PID:10096
- C:\Windows\System\vOmPucD.exe
  C:\Windows\System\vOmPucD.exe
  2⤵
  PID:10112
- C:\Windows\System\bkYdJVC.exe
  C:\Windows\System\bkYdJVC.exe
  2⤵
  PID:10136
- C:\Windows\System\KnKWTnL.exe
  C:\Windows\System\KnKWTnL.exe
  2⤵
  PID:10152
- C:\Windows\System\SKKgfge.exe
  C:\Windows\System\SKKgfge.exe
  2⤵
  PID:10176
- C:\Windows\System\KNtHaaw.exe
  C:\Windows\System\KNtHaaw.exe
  2⤵
  PID:10192
- C:\Windows\System\HCBRHDX.exe
  C:\Windows\System\HCBRHDX.exe
  2⤵
  PID:10216
- C:\Windows\System\WGxBTou.exe
  C:\Windows\System\WGxBTou.exe
  2⤵
  PID:10236
- C:\Windows\System\WGbqkve.exe
  C:\Windows\System\WGbqkve.exe
  2⤵
  PID:7108
- C:\Windows\System\lXoWhbo.exe
  C:\Windows\System\lXoWhbo.exe
  2⤵
  PID:5404
- C:\Windows\System\CpAjrno.exe
  C:\Windows\System\CpAjrno.exe
  2⤵
  PID:3348
- C:\Windows\System\TxLYUle.exe
  C:\Windows\System\TxLYUle.exe
  2⤵
  PID:6052
- C:\Windows\System\QRCLoTx.exe
  C:\Windows\System\QRCLoTx.exe
  2⤵
  PID:5856
- C:\Windows\System\lZTxwUs.exe
  C:\Windows\System\lZTxwUs.exe
  2⤵
  PID:6560
- C:\Windows\System\YOXpHqq.exe
  C:\Windows\System\YOXpHqq.exe
  2⤵
  PID:8232
- C:\Windows\System\JCEsMTp.exe
  C:\Windows\System\JCEsMTp.exe
  2⤵
  PID:5552
- C:\Windows\System\TxKmOiZ.exe
  C:\Windows\System\TxKmOiZ.exe
  2⤵
  PID:5472
- C:\Windows\System\QxkvTsQ.exe
  C:\Windows\System\QxkvTsQ.exe
  2⤵
  PID:5716
- C:\Windows\System\tInQeST.exe
  C:\Windows\System\tInQeST.exe
  2⤵
  PID:8296
- C:\Windows\System\kBDlhfM.exe
  C:\Windows\System\kBDlhfM.exe
  2⤵
  PID:8388
- C:\Windows\System\KMEURny.exe
  C:\Windows\System\KMEURny.exe
  2⤵
  PID:7176
- C:\Windows\System\bOfKaXs.exe
  C:\Windows\System\bOfKaXs.exe
  2⤵
  PID:8456
- C:\Windows\System\KjKbmBj.exe
  C:\Windows\System\KjKbmBj.exe
  2⤵
  PID:8504
- C:\Windows\System\AElnJqP.exe
  C:\Windows\System\AElnJqP.exe
  2⤵
  PID:8580
- C:\Windows\System\KqefqRp.exe
  C:\Windows\System\KqefqRp.exe
  2⤵
  PID:7360
- C:\Windows\System\BNClJaj.exe
  C:\Windows\System\BNClJaj.exe
  2⤵
  PID:6720
- C:\Windows\System\SbSNXKq.exe
  C:\Windows\System\SbSNXKq.exe
  2⤵
  PID:8768
- C:\Windows\System\UgMMNxz.exe
  C:\Windows\System\UgMMNxz.exe
  2⤵
  PID:8828
- C:\Windows\System\IXFbsuS.exe
  C:\Windows\System\IXFbsuS.exe
  2⤵
  PID:8884
- C:\Windows\System\qBWkRdt.exe
  C:\Windows\System\qBWkRdt.exe
  2⤵
  PID:8928
- C:\Windows\System\wWfdvoe.exe
  C:\Windows\System\wWfdvoe.exe
  2⤵
  PID:8996
- C:\Windows\System\JpXXUAV.exe
  C:\Windows\System\JpXXUAV.exe
  2⤵
  PID:228
- C:\Windows\System\APhefld.exe
  C:\Windows\System\APhefld.exe
  2⤵
  PID:9040
- C:\Windows\System\bMlxMzG.exe
  C:\Windows\System\bMlxMzG.exe
  2⤵
  PID:9088
- C:\Windows\System\WifHkbm.exe
  C:\Windows\System\WifHkbm.exe
  2⤵
  PID:6896
- C:\Windows\System\SkERLYc.exe
  C:\Windows\System\SkERLYc.exe
  2⤵
  PID:7764
- C:\Windows\System\jOmFHkt.exe
  C:\Windows\System\jOmFHkt.exe
  2⤵
  PID:6604
- C:\Windows\System\eedrVXS.exe
  C:\Windows\System\eedrVXS.exe
  2⤵
  PID:7400
- C:\Windows\System\LbCyxyj.exe
  C:\Windows\System\LbCyxyj.exe
  2⤵
  PID:10252
- C:\Windows\System\uuAmCRV.exe
  C:\Windows\System\uuAmCRV.exe
  2⤵
  PID:10284
- C:\Windows\System\PIShXMj.exe
  C:\Windows\System\PIShXMj.exe
  2⤵
  PID:10308
- C:\Windows\System\NdvZWkr.exe
  C:\Windows\System\NdvZWkr.exe
  2⤵
  PID:10324
- C:\Windows\System\ddRvayV.exe
  C:\Windows\System\ddRvayV.exe
  2⤵
  PID:10348
- C:\Windows\System\DPKnDjs.exe
  C:\Windows\System\DPKnDjs.exe
  2⤵
  PID:10368
- C:\Windows\System\kXMaAVY.exe
  C:\Windows\System\kXMaAVY.exe
  2⤵
  PID:10388
- C:\Windows\System\EEaSrKg.exe
  C:\Windows\System\EEaSrKg.exe
  2⤵
  PID:10412
- C:\Windows\System\XSrggQY.exe
  C:\Windows\System\XSrggQY.exe
  2⤵
  PID:10432
- C:\Windows\System\RUAxUdU.exe
  C:\Windows\System\RUAxUdU.exe
  2⤵
  PID:10448
- C:\Windows\System\hzgvupu.exe
  C:\Windows\System\hzgvupu.exe
  2⤵
  PID:10468
- C:\Windows\System\eWHZjhI.exe
  C:\Windows\System\eWHZjhI.exe
  2⤵
  PID:10488
- C:\Windows\System\SanpluA.exe
  C:\Windows\System\SanpluA.exe
  2⤵
  PID:10512
- C:\Windows\System\lnGWPTD.exe
  C:\Windows\System\lnGWPTD.exe
  2⤵
  PID:10528
- C:\Windows\System\CTOLWZE.exe
  C:\Windows\System\CTOLWZE.exe
  2⤵
  PID:10548
- C:\Windows\System\RpozSgV.exe
  C:\Windows\System\RpozSgV.exe
  2⤵
  PID:10568
- C:\Windows\System\wlbcibz.exe
  C:\Windows\System\wlbcibz.exe
  2⤵
  PID:10592
- C:\Windows\System\SBdzEWR.exe
  C:\Windows\System\SBdzEWR.exe
  2⤵
  PID:10608
- C:\Windows\System\qkWbUFI.exe
  C:\Windows\System\qkWbUFI.exe
  2⤵
  PID:10632
- C:\Windows\System\PAArYba.exe
  C:\Windows\System\PAArYba.exe
  2⤵
  PID:10652
- C:\Windows\System\hQnBOtX.exe
  C:\Windows\System\hQnBOtX.exe
  2⤵
  PID:10668
- C:\Windows\System\OICJZzO.exe
  C:\Windows\System\OICJZzO.exe
  2⤵
  PID:10688
- C:\Windows\System\OtTwJWH.exe
  C:\Windows\System\OtTwJWH.exe
  2⤵
  PID:10704
- C:\Windows\System\JCANzot.exe
  C:\Windows\System\JCANzot.exe
  2⤵
  PID:10720
- C:\Windows\System\PhEJrkE.exe
  C:\Windows\System\PhEJrkE.exe
  2⤵
  PID:10736
- C:\Windows\System\guVeGQk.exe
  C:\Windows\System\guVeGQk.exe
  2⤵
  PID:10752
- C:\Windows\System\iJRkONs.exe
  C:\Windows\System\iJRkONs.exe
  2⤵
  PID:10768
- C:\Windows\System\blvSVOi.exe
  C:\Windows\System\blvSVOi.exe
  2⤵
  PID:10784
- C:\Windows\System\DrKxCUA.exe
  C:\Windows\System\DrKxCUA.exe
  2⤵
  PID:10800
- C:\Windows\System\DhVUFUZ.exe
  C:\Windows\System\DhVUFUZ.exe
  2⤵
  PID:10816
- C:\Windows\System\TdHioQL.exe
  C:\Windows\System\TdHioQL.exe
  2⤵
  PID:10832
- C:\Windows\System\hdKsVgU.exe
  C:\Windows\System\hdKsVgU.exe
  2⤵
  PID:10848
- C:\Windows\System\zkZvZWT.exe
  C:\Windows\System\zkZvZWT.exe
  2⤵
  PID:10864
- C:\Windows\System\wVDvgti.exe
  C:\Windows\System\wVDvgti.exe
  2⤵
  PID:10880
- C:\Windows\System\nAIXVBq.exe
  C:\Windows\System\nAIXVBq.exe
  2⤵
  PID:10896
- C:\Windows\System\IdnbOzm.exe
  C:\Windows\System\IdnbOzm.exe
  2⤵
  PID:10912
- C:\Windows\System\MTByAEi.exe
  C:\Windows\System\MTByAEi.exe
  2⤵
  PID:10936
- C:\Windows\System\NWlQhKR.exe
  C:\Windows\System\NWlQhKR.exe
  2⤵
  PID:10952
- C:\Windows\System\MmEbvUg.exe
  C:\Windows\System\MmEbvUg.exe
  2⤵
  PID:10968
- C:\Windows\System\SNinDUf.exe
  C:\Windows\System\SNinDUf.exe
  2⤵
  PID:10988
- C:\Windows\System\WHcvvND.exe
  C:\Windows\System\WHcvvND.exe
  2⤵
  PID:11032
- C:\Windows\System\YJFzeEC.exe
  C:\Windows\System\YJFzeEC.exe
  2⤵
  PID:11052
- C:\Windows\System\otKrmsI.exe
  C:\Windows\System\otKrmsI.exe
  2⤵
  PID:11068
- C:\Windows\System\LhqJPky.exe
  C:\Windows\System\LhqJPky.exe
  2⤵
  PID:11084
- C:\Windows\System\zdsPWDK.exe
  C:\Windows\System\zdsPWDK.exe
  2⤵
  PID:11104
- C:\Windows\System\PvNFyMI.exe
  C:\Windows\System\PvNFyMI.exe
  2⤵
  PID:11132
- C:\Windows\System\iscpbVI.exe
  C:\Windows\System\iscpbVI.exe
  2⤵
  PID:11148
- C:\Windows\System\wljeCQv.exe
  C:\Windows\System\wljeCQv.exe
  2⤵
  PID:11176
- C:\Windows\System\ZUcgybu.exe
  C:\Windows\System\ZUcgybu.exe
  2⤵
  PID:11192
- C:\Windows\System\MOwhSjH.exe
  C:\Windows\System\MOwhSjH.exe
  2⤵
  PID:11216
- C:\Windows\System\RovRrPa.exe
  C:\Windows\System\RovRrPa.exe
  2⤵
  PID:11236
- C:\Windows\System\eEaNucI.exe
  C:\Windows\System\eEaNucI.exe
  2⤵
  PID:11256
- C:\Windows\System\oidyDjw.exe
  C:\Windows\System\oidyDjw.exe
  2⤵
  PID:7876
- C:\Windows\System\kCCmfAp.exe
  C:\Windows\System\kCCmfAp.exe
  2⤵
  PID:7800
- C:\Windows\System\xdWWaRr.exe
  C:\Windows\System\xdWWaRr.exe
  2⤵
  PID:6972
- C:\Windows\System\HfccLUu.exe
  C:\Windows\System\HfccLUu.exe
  2⤵
  PID:8036
- C:\Windows\System\IEdSbVT.exe
  C:\Windows\System\IEdSbVT.exe
  2⤵
  PID:8044
- C:\Windows\System\kdCdYeD.exe
  C:\Windows\System\kdCdYeD.exe
  2⤵
  PID:9272
- C:\Windows\System\HQSxkob.exe
  C:\Windows\System\HQSxkob.exe
  2⤵
  PID:9428
- C:\Windows\System\YsTdcMf.exe
  C:\Windows\System\YsTdcMf.exe
  2⤵
  PID:9548
- C:\Windows\System\qXtKtQJ.exe
  C:\Windows\System\qXtKtQJ.exe
  2⤵
  PID:9608
- C:\Windows\System\QogQyUE.exe
  C:\Windows\System\QogQyUE.exe
  2⤵
  PID:6336
- C:\Windows\System\pVBVmtl.exe
  C:\Windows\System\pVBVmtl.exe
  2⤵
  PID:5204
- C:\Windows\System\nxsNrxx.exe
  C:\Windows\System\nxsNrxx.exe
  2⤵
  PID:11288
- C:\Windows\System\zsfUBMQ.exe
  C:\Windows\System\zsfUBMQ.exe
  2⤵
  PID:11308
- C:\Windows\System\nqmTDcD.exe
  C:\Windows\System\nqmTDcD.exe
  2⤵
  PID:11332
- C:\Windows\System\UcpOelp.exe
  C:\Windows\System\UcpOelp.exe
  2⤵
  PID:11348
- C:\Windows\System\LrldDpp.exe
  C:\Windows\System\LrldDpp.exe
  2⤵
  PID:11376
- C:\Windows\System\RHUQeHm.exe
  C:\Windows\System\RHUQeHm.exe
  2⤵
  PID:11400
- C:\Windows\System\AwnaMqg.exe
  C:\Windows\System\AwnaMqg.exe
  2⤵
  PID:11424
- C:\Windows\System\kJuaYjk.exe
  C:\Windows\System\kJuaYjk.exe
  2⤵
  PID:11452
- C:\Windows\System\NFxobJV.exe
  C:\Windows\System\NFxobJV.exe
  2⤵
  PID:11472
- C:\Windows\System\kDbOXIO.exe
  C:\Windows\System\kDbOXIO.exe
  2⤵
  PID:11492
- C:\Windows\System\uffuojk.exe
  C:\Windows\System\uffuojk.exe
  2⤵
  PID:11512
- C:\Windows\System\gDnvujt.exe
  C:\Windows\System\gDnvujt.exe
  2⤵
  PID:11536
- C:\Windows\System\OxiUFFU.exe
  C:\Windows\System\OxiUFFU.exe
  2⤵
  PID:11564
- C:\Windows\System\LEwvNqd.exe
  C:\Windows\System\LEwvNqd.exe
  2⤵
  PID:11588
- C:\Windows\System\wUBuGEh.exe
  C:\Windows\System\wUBuGEh.exe
  2⤵
  PID:11604
- C:\Windows\System\QmQVfTJ.exe
  C:\Windows\System\QmQVfTJ.exe
  2⤵
  PID:11628
- C:\Windows\System\cPWZchC.exe
  C:\Windows\System\cPWZchC.exe
  2⤵
  PID:11648
- C:\Windows\System\oYNqgYw.exe
  C:\Windows\System\oYNqgYw.exe
  2⤵
  PID:11668
- C:\Windows\System\aogpTlS.exe
  C:\Windows\System\aogpTlS.exe
  2⤵
  PID:11684
- C:\Windows\System\FBoeTbP.exe
  C:\Windows\System\FBoeTbP.exe
  2⤵
  PID:11716
- C:\Windows\System\LHXBtpD.exe
  C:\Windows\System\LHXBtpD.exe
  2⤵
  PID:11732
- C:\Windows\System\pmIQojA.exe
  C:\Windows\System\pmIQojA.exe
  2⤵
  PID:11752
- C:\Windows\System\xWUyHYQ.exe
  C:\Windows\System\xWUyHYQ.exe
  2⤵
  PID:11772
- C:\Windows\System\SgUbUvN.exe
  C:\Windows\System\SgUbUvN.exe
  2⤵
  PID:11792
- C:\Windows\System\OtuGChj.exe
  C:\Windows\System\OtuGChj.exe
  2⤵
  PID:11816
- C:\Windows\System\lYtpLeY.exe
  C:\Windows\System\lYtpLeY.exe
  2⤵
  PID:11832
- C:\Windows\System\dieSZeE.exe
  C:\Windows\System\dieSZeE.exe
  2⤵
  PID:11856
- C:\Windows\System\jWdKbWq.exe
  C:\Windows\System\jWdKbWq.exe
  2⤵
  PID:11880
- C:\Windows\System\AIavzbI.exe
  C:\Windows\System\AIavzbI.exe
  2⤵
  PID:11900
- C:\Windows\System\DdQIgos.exe
  C:\Windows\System\DdQIgos.exe
  2⤵
  PID:11924
- C:\Windows\System\SnmQazA.exe
  C:\Windows\System\SnmQazA.exe
  2⤵
  PID:11940
- C:\Windows\System\rXIcJae.exe
  C:\Windows\System\rXIcJae.exe
  2⤵
  PID:11964
- C:\Windows\System\kIXYFyq.exe
  C:\Windows\System\kIXYFyq.exe
  2⤵
  PID:11984
- C:\Windows\System\wPvqrXy.exe
  C:\Windows\System\wPvqrXy.exe
  2⤵
  PID:12000
- C:\Windows\System\kOVgRPp.exe
  C:\Windows\System\kOVgRPp.exe
  2⤵
  PID:12024
- C:\Windows\System\eLQullh.exe
  C:\Windows\System\eLQullh.exe
  2⤵
  PID:12048
- C:\Windows\System\QfMSWVE.exe
  C:\Windows\System\QfMSWVE.exe
  2⤵
  PID:12068
- C:\Windows\System\OoupzZS.exe
  C:\Windows\System\OoupzZS.exe
  2⤵
  PID:12088
- C:\Windows\System\kDpdyjM.exe
  C:\Windows\System\kDpdyjM.exe
  2⤵
  PID:12108
- C:\Windows\System\YFpLLAV.exe
  C:\Windows\System\YFpLLAV.exe
  2⤵
  PID:12124
- C:\Windows\System\FkVgbxh.exe
  C:\Windows\System\FkVgbxh.exe
  2⤵
  PID:12140
- C:\Windows\System\hxPghbl.exe
  C:\Windows\System\hxPghbl.exe
  2⤵
  PID:12156
- C:\Windows\System\XwGPJRS.exe
  C:\Windows\System\XwGPJRS.exe
  2⤵
  PID:12180
- C:\Windows\System\mxwBVMv.exe
  C:\Windows\System\mxwBVMv.exe
  2⤵
  PID:12200
- C:\Windows\System\oDHtbAh.exe
  C:\Windows\System\oDHtbAh.exe
  2⤵
  PID:12220
- C:\Windows\System\oYppflY.exe
  C:\Windows\System\oYppflY.exe
  2⤵
  PID:12244
- C:\Windows\System\TWyyXdZ.exe
  C:\Windows\System\TWyyXdZ.exe
  2⤵
  PID:12260
- C:\Windows\System\WinRXAr.exe
  C:\Windows\System\WinRXAr.exe
  2⤵
  PID:12284
- C:\Windows\System\AKoPqpT.exe
  C:\Windows\System\AKoPqpT.exe
  2⤵
  PID:6188
- C:\Windows\System\ptDbFbe.exe
  C:\Windows\System\ptDbFbe.exe
  2⤵
  PID:6004
- C:\Windows\System\cfbbpRK.exe
  C:\Windows\System\cfbbpRK.exe
  2⤵
  PID:6460
- C:\Windows\System\UzyJwMo.exe
  C:\Windows\System\UzyJwMo.exe
  2⤵
  PID:9716
- C:\Windows\System\NnPmvkh.exe
  C:\Windows\System\NnPmvkh.exe
  2⤵
  PID:8320
- C:\Windows\System\xfMDcKd.exe
  C:\Windows\System\xfMDcKd.exe
  2⤵
  PID:8216
- C:\Windows\System\hNTxJiH.exe
  C:\Windows\System\hNTxJiH.exe
  2⤵
  PID:7196
- C:\Windows\System\RyaZGsZ.exe
  C:\Windows\System\RyaZGsZ.exe
  2⤵
  PID:9952
- C:\Windows\System\MQiZDvt.exe
  C:\Windows\System\MQiZDvt.exe
  2⤵
  PID:9988
- C:\Windows\System\tfdZWkM.exe
  C:\Windows\System\tfdZWkM.exe
  2⤵
  PID:8524
- C:\Windows\System\TMtadVn.exe
  C:\Windows\System\TMtadVn.exe
  2⤵
  PID:8560
- C:\Windows\System\feJqbiR.exe
  C:\Windows\System\feJqbiR.exe
  2⤵
  PID:10104
- C:\Windows\System\JCHSQgn.exe
  C:\Windows\System\JCHSQgn.exe
  2⤵
  PID:10160
- C:\Windows\System\Kmgljum.exe
  C:\Windows\System\Kmgljum.exe
  2⤵
  PID:7320
- C:\Windows\System\YNKABKY.exe
  C:\Windows\System\YNKABKY.exe
  2⤵
  PID:8680
- C:\Windows\System\nOIxyDv.exe
  C:\Windows\System\nOIxyDv.exe
  2⤵
  PID:2528
- C:\Windows\System\gPTvJYu.exe
  C:\Windows\System\gPTvJYu.exe
  2⤵
  PID:7456
- C:\Windows\System\oyyBcBu.exe
  C:\Windows\System\oyyBcBu.exe
  2⤵
  PID:8188
- C:\Windows\System\zcAQlEi.exe
  C:\Windows\System\zcAQlEi.exe
  2⤵
  PID:4940
- C:\Windows\System\nJixkcO.exe
  C:\Windows\System\nJixkcO.exe
  2⤵
  PID:12312
- C:\Windows\System\xeVGTQX.exe
  C:\Windows\System\xeVGTQX.exe
  2⤵
  PID:12332
- C:\Windows\System\MHztzZB.exe
  C:\Windows\System\MHztzZB.exe
  2⤵
  PID:12352
- C:\Windows\System\pWfqoYz.exe
  C:\Windows\System\pWfqoYz.exe
  2⤵
  PID:12368
- C:\Windows\System\nKzGlDO.exe
  C:\Windows\System\nKzGlDO.exe
  2⤵
  PID:12396
- C:\Windows\System\ECUdURH.exe
  C:\Windows\System\ECUdURH.exe
  2⤵
  PID:12416
- C:\Windows\System\NFRhtgk.exe
  C:\Windows\System\NFRhtgk.exe
  2⤵
  PID:12436
- C:\Windows\System\SpWvOBD.exe
  C:\Windows\System\SpWvOBD.exe
  2⤵
  PID:12456
- C:\Windows\System\gQVZwtc.exe
  C:\Windows\System\gQVZwtc.exe
  2⤵
  PID:12476
- C:\Windows\System\vBwhOkp.exe
  C:\Windows\System\vBwhOkp.exe
  2⤵
  PID:12496
- C:\Windows\System\cddRTSk.exe
  C:\Windows\System\cddRTSk.exe
  2⤵
  PID:12512
- C:\Windows\System\EFHMtjD.exe
  C:\Windows\System\EFHMtjD.exe
  2⤵
  PID:12536
- C:\Windows\System\FUNTeun.exe
  C:\Windows\System\FUNTeun.exe
  2⤵
  PID:12556
- C:\Windows\System\SPZTjXV.exe
  C:\Windows\System\SPZTjXV.exe
  2⤵
  PID:12576
- C:\Windows\System\VXmiMLu.exe
  C:\Windows\System\VXmiMLu.exe
  2⤵
  PID:12600
- C:\Windows\System\NaDXmaa.exe
  C:\Windows\System\NaDXmaa.exe
  2⤵
  PID:12616
- C:\Windows\System\hGpjRDP.exe
  C:\Windows\System\hGpjRDP.exe
  2⤵
  PID:12640
- C:\Windows\System\QrEBdGE.exe
  C:\Windows\System\QrEBdGE.exe
  2⤵
  PID:12660
- C:\Windows\System\AjZmoBc.exe
  C:\Windows\System\AjZmoBc.exe
  2⤵
  PID:12688
- C:\Windows\System\dZoEEnG.exe
  C:\Windows\System\dZoEEnG.exe
  2⤵
  PID:12708
- C:\Windows\System\abNKckc.exe
  C:\Windows\System\abNKckc.exe
  2⤵
  PID:12732
- C:\Windows\System\ybIiKTb.exe
  C:\Windows\System\ybIiKTb.exe
  2⤵
  PID:12752
- C:\Windows\System\hngyRbd.exe
  C:\Windows\System\hngyRbd.exe
  2⤵
  PID:12772
- C:\Windows\System\VdbNdZf.exe
  C:\Windows\System\VdbNdZf.exe
  2⤵
  PID:12796
- C:\Windows\System\NsCaOZg.exe
  C:\Windows\System\NsCaOZg.exe
  2⤵
  PID:12820
- C:\Windows\System\bbjuMCH.exe
  C:\Windows\System\bbjuMCH.exe
  2⤵
  PID:12840
- C:\Windows\System\KNHvTUu.exe
  C:\Windows\System\KNHvTUu.exe
  2⤵
  PID:12856
- C:\Windows\System\eXNZapC.exe
  C:\Windows\System\eXNZapC.exe
  2⤵
  PID:12880
- C:\Windows\System\FAByoYs.exe
  C:\Windows\System\FAByoYs.exe
  2⤵
  PID:12904
- C:\Windows\System\OxorLdu.exe
  C:\Windows\System\OxorLdu.exe
  2⤵
  PID:12928
- C:\Windows\System\xbjDfTq.exe
  C:\Windows\System\xbjDfTq.exe
  2⤵
  PID:12952
- C:\Windows\System\khnUANi.exe
  C:\Windows\System\khnUANi.exe
  2⤵
  PID:12972
- C:\Windows\System\VOWOhoE.exe
  C:\Windows\System\VOWOhoE.exe
  2⤵
  PID:12992
- C:\Windows\System\BbQqZSy.exe
  C:\Windows\System\BbQqZSy.exe
  2⤵
  PID:13020
- C:\Windows\System\jcvHHjY.exe
  C:\Windows\System\jcvHHjY.exe
  2⤵
  PID:13036
- C:\Windows\System\AposCOH.exe
  C:\Windows\System\AposCOH.exe
  2⤵
  PID:13060
- C:\Windows\System\KvoXsmQ.exe
  C:\Windows\System\KvoXsmQ.exe
  2⤵
  PID:13080
- C:\Windows\System\wKwhRPE.exe
  C:\Windows\System\wKwhRPE.exe
  2⤵
  PID:13104
- C:\Windows\System\sTYWDPD.exe
  C:\Windows\System\sTYWDPD.exe
  2⤵
  PID:13124
- C:\Windows\System\tVnBVQT.exe
  C:\Windows\System\tVnBVQT.exe
  2⤵
  PID:13144
- C:\Windows\System\YKJWHHD.exe
  C:\Windows\System\YKJWHHD.exe
  2⤵
  PID:13164
- C:\Windows\System\ToRKyMO.exe
  C:\Windows\System\ToRKyMO.exe
  2⤵
  PID:9160
- C:\Windows\System\BwWkPkE.exe
  C:\Windows\System\BwWkPkE.exe
  2⤵
  PID:7696
- C:\Windows\System\TespVoo.exe
  C:\Windows\System\TespVoo.exe
  2⤵
  PID:6620
- C:\Windows\System\jmEHbkb.exe
  C:\Windows\System\jmEHbkb.exe
  2⤵
  PID:6528
- C:\Windows\System\vPiimeD.exe
  C:\Windows\System\vPiimeD.exe
  2⤵
  PID:10944
- C:\Windows\System\jYWUYtU.exe
  C:\Windows\System\jYWUYtU.exe
  2⤵
  PID:11164
- C:\Windows\System\lxrlisp.exe
  C:\Windows\System\lxrlisp.exe
  2⤵
  PID:9472
- C:\Windows\System\BKXLewH.exe
  C:\Windows\System\BKXLewH.exe
  2⤵
  PID:7520
- C:\Windows\System\dIRrPAJ.exe
  C:\Windows\System\dIRrPAJ.exe
  2⤵
  PID:10660
- C:\Windows\System\GohiOCI.exe
  C:\Windows\System\GohiOCI.exe
  2⤵
  PID:9304
- C:\Windows\System\YtwNpTV.exe
  C:\Windows\System\YtwNpTV.exe
  2⤵
  PID:9320
- C:\Windows\System\HkkETzF.exe
  C:\Windows\System\HkkETzF.exe
  2⤵
  PID:8868
- C:\Windows\System\tuCztap.exe
  C:\Windows\System\tuCztap.exe
  2⤵
  PID:6544
- C:\Windows\System\emHrNzB.exe
  C:\Windows\System\emHrNzB.exe
  2⤵
  PID:8500
- C:\Windows\System\nGowHTi.exe
  C:\Windows\System\nGowHTi.exe
  2⤵
  PID:5032
- C:\Windows\System\WDMjTBq.exe
  C:\Windows\System\WDMjTBq.exe
  2⤵
  PID:12152
- C:\Windows\System\riGIZWe.exe
  C:\Windows\System\riGIZWe.exe
  2⤵
  PID:13204
- C:\Windows\System\GPLVjTO.exe
  C:\Windows\System\GPLVjTO.exe
  2⤵
  PID:10400
- C:\Windows\System\WFRcBgH.exe
  C:\Windows\System\WFRcBgH.exe
  2⤵
  PID:12812
- C:\Windows\System\OiuLjbz.exe
  C:\Windows\System\OiuLjbz.exe
  2⤵
  PID:2292
- C:\Windows\System\CeKUvKM.exe
  C:\Windows\System\CeKUvKM.exe
  2⤵
  PID:7664
- C:\Windows\System\yzRRVhL.exe
  C:\Windows\System\yzRRVhL.exe
  2⤵
  PID:7980
- C:\Windows\System\tmmFjBN.exe
  C:\Windows\System\tmmFjBN.exe
  2⤵
  PID:9708
- C:\Windows\System\YLFmchT.exe
  C:\Windows\System\YLFmchT.exe
  2⤵
  PID:10876
- C:\Windows\System\JagPmHF.exe
  C:\Windows\System\JagPmHF.exe
  2⤵
  PID:10928
- C:\Windows\System\xvGpdJJ.exe
  C:\Windows\System\xvGpdJJ.exe
  2⤵
  PID:9448
- C:\Windows\System\KyrUTrE.exe
  C:\Windows\System\KyrUTrE.exe
  2⤵
  PID:11644
- C:\Windows\System\GUUIwft.exe
  C:\Windows\System\GUUIwft.exe
  2⤵
  PID:520
- C:\Windows\System\wIqfeYP.exe
  C:\Windows\System\wIqfeYP.exe
  2⤵
  PID:2212
- C:\Windows\System\wrgqgsd.exe
  C:\Windows\System\wrgqgsd.exe
  2⤵
  PID:1536
- C:\Windows\System\hZaQmDS.exe
  C:\Windows\System\hZaQmDS.exe
  2⤵
  PID:1408
- C:\Windows\System\dzCJrlE.exe
  C:\Windows\System\dzCJrlE.exe
  2⤵
  PID:5688
- C:\Windows\System\tpZYAFG.exe
  C:\Windows\System\tpZYAFG.exe
  2⤵
  PID:12132
- C:\Windows\System\qsECOMN.exe
  C:\Windows\System\qsECOMN.exe
  2⤵
  PID:5836
- C:\Windows\System\McbtraQ.exe
  C:\Windows\System\McbtraQ.exe
  2⤵
  PID:13268
- C:\Windows\System\qwFiAzU.exe
  C:\Windows\System\qwFiAzU.exe
  2⤵
  PID:9104
- C:\Windows\System\RpeTvgf.exe
  C:\Windows\System\RpeTvgf.exe
  2⤵
  PID:6716
- C:\Windows\System\lmEJiao.exe
  C:\Windows\System\lmEJiao.exe
  2⤵
  PID:6040
- C:\Windows\System\eKTYOtO.exe
  C:\Windows\System\eKTYOtO.exe
  2⤵
  PID:11468
- C:\Windows\System\ZVXfqYh.exe
  C:\Windows\System\ZVXfqYh.exe
  2⤵
  PID:12504
- C:\Windows\System\pmZWSgt.exe
  C:\Windows\System\pmZWSgt.exe
  2⤵
  PID:9492
- C:\Windows\System\SyKMvOa.exe
  C:\Windows\System\SyKMvOa.exe
  2⤵
  PID:8016
- C:\Windows\System\AdryqZk.exe
  C:\Windows\System\AdryqZk.exe
  2⤵
  PID:12936
- C:\Windows\System\FvNfiCQ.exe
  C:\Windows\System\FvNfiCQ.exe
  2⤵
  PID:13256
- C:\Windows\System\jARuLBn.exe
  C:\Windows\System\jARuLBn.exe
  2⤵
  PID:10728
- C:\Windows\System\BcRhrBK.exe
  C:\Windows\System\BcRhrBK.exe
  2⤵
  PID:1840
- C:\Windows\System\UJaohxi.exe
  C:\Windows\System\UJaohxi.exe
  2⤵
  PID:6316
- C:\Windows\System\opBvHrQ.exe
  C:\Windows\System\opBvHrQ.exe
  2⤵
  PID:8844
- C:\Windows\System\dmLpnOQ.exe
  C:\Windows\System\dmLpnOQ.exe
  2⤵
  PID:12364
- C:\Windows\System\AoUTPOo.exe
  C:\Windows\System\AoUTPOo.exe
  2⤵
  PID:7300
- C:\Windows\System\bAxBnZc.exe
  C:\Windows\System\bAxBnZc.exe
  2⤵
  PID:11252
- C:\Windows\System\tnbTOWz.exe
  C:\Windows\System\tnbTOWz.exe
  2⤵
  PID:9452
- C:\Windows\System\UJzIyuL.exe
  C:\Windows\System\UJzIyuL.exe
  2⤵
  PID:10332
- C:\Windows\System\YODXKUk.exe
  C:\Windows\System\YODXKUk.exe
  2⤵
  PID:13140
- C:\Windows\System\ZaByYbV.exe
  C:\Windows\System\ZaByYbV.exe
  2⤵
  PID:10484
- C:\Windows\System\xKVkIWQ.exe
  C:\Windows\System\xKVkIWQ.exe
  2⤵
  PID:8200
- C:\Windows\System\TKPQCPe.exe
  C:\Windows\System\TKPQCPe.exe
  2⤵
  PID:13264
- C:\Windows\System\BpCTFTU.exe
  C:\Windows\System\BpCTFTU.exe
  2⤵
  PID:11504
- C:\Windows\System\LnjLIEb.exe
  C:\Windows\System\LnjLIEb.exe
  2⤵
  PID:11852
- C:\Windows\System\SFkAofk.exe
  C:\Windows\System\SFkAofk.exe
  2⤵
  PID:12096
- C:\Windows\System\zBAYvpR.exe
  C:\Windows\System\zBAYvpR.exe
  2⤵
  PID:11624
- C:\Windows\System\DOHqYpn.exe
  C:\Windows\System\DOHqYpn.exe
  2⤵
  PID:7388
- C:\Windows\System\FoNWBvq.exe
  C:\Windows\System\FoNWBvq.exe
  2⤵
  PID:11696
- C:\Windows\System\yNJaVZi.exe
  C:\Windows\System\yNJaVZi.exe
  2⤵
  PID:11488
- C:\Windows\System\rKDHBNy.exe
  C:\Windows\System\rKDHBNy.exe
  2⤵
  PID:10068
- C:\Windows\System\UQgOZIr.exe
  C:\Windows\System\UQgOZIr.exe
  2⤵
  PID:12172
- C:\Windows\System\DSOqylm.exe
  C:\Windows\System\DSOqylm.exe
  2⤵
  PID:8340
- C:\Windows\System\VmBLcwo.exe
  C:\Windows\System\VmBLcwo.exe
  2⤵
  PID:10316
- C:\Windows\System\jkCWFzG.exe
  C:\Windows\System\jkCWFzG.exe
  2⤵
  PID:8240
- C:\Windows\System\tmelYRL.exe
  C:\Windows\System\tmelYRL.exe
  2⤵
  PID:12348
- C:\Windows\System\WWZQsCv.exe
  C:\Windows\System\WWZQsCv.exe
  2⤵
  PID:9044
- C:\Windows\System\aOjSRmC.exe
  C:\Windows\System\aOjSRmC.exe
  2⤵
  PID:2080
- C:\Windows\System\ISfECfW.exe
  C:\Windows\System\ISfECfW.exe
  2⤵
  PID:11728
- C:\Windows\System\LZiRDIX.exe
  C:\Windows\System\LZiRDIX.exe
  2⤵
  PID:1060
- C:\Windows\System\WAbbIxn.exe
  C:\Windows\System\WAbbIxn.exe
  2⤵
  PID:10396
- C:\Windows\System\SWbZqab.exe
  C:\Windows\System\SWbZqab.exe
  2⤵
  PID:12912
- C:\Windows\System\JrZDiLa.exe
  C:\Windows\System\JrZDiLa.exe
  2⤵
  PID:4436
- C:\Windows\System\oKSokOA.exe
  C:\Windows\System\oKSokOA.exe
  2⤵
  PID:11484
- C:\Windows\System\YIwhbki.exe
  C:\Windows\System\YIwhbki.exe
  2⤵
  PID:11596
- C:\Windows\System\HlxBuDs.exe
  C:\Windows\System\HlxBuDs.exe
  2⤵
  PID:7192
- C:\Windows\System\GAIkNDZ.exe
  C:\Windows\System\GAIkNDZ.exe
  2⤵
  PID:6356
- C:\Windows\System\cBIqTgz.exe
  C:\Windows\System\cBIqTgz.exe
  2⤵
  PID:8092
- C:\Windows\System\RKbHMxn.exe
  C:\Windows\System\RKbHMxn.exe
  2⤵
  PID:12252
- C:\Windows\System\lEAQOFx.exe
  C:\Windows\System\lEAQOFx.exe
  2⤵
  PID:7460
- C:\Windows\System\QIhhOqW.exe
  C:\Windows\System\QIhhOqW.exe
  2⤵
  PID:10856
- C:\Windows\System\LtReewQ.exe
  C:\Windows\System\LtReewQ.exe
  2⤵
  PID:11188
- C:\Windows\System\UDJdozB.exe
  C:\Windows\System\UDJdozB.exe
  2⤵
  PID:10932
- C:\Windows\System\exokqNp.exe
  C:\Windows\System\exokqNp.exe
  2⤵
  PID:13028
- C:\Windows\System\SNuTSol.exe
  C:\Windows\System\SNuTSol.exe
  2⤵
  PID:10228
- C:\Windows\System\QTrtvqO.exe
  C:\Windows\System\QTrtvqO.exe
  2⤵
  PID:8636
- C:\Windows\System\tkXMQhD.exe
  C:\Windows\System\tkXMQhD.exe
  2⤵
  PID:10356
- C:\Windows\System\ySHrfPN.exe
  C:\Windows\System\ySHrfPN.exe
  2⤵
  PID:13324
- C:\Windows\System\HxKkBpn.exe
  C:\Windows\System\HxKkBpn.exe
  2⤵
  PID:13344
- C:\Windows\System\DPWZeUV.exe
  C:\Windows\System\DPWZeUV.exe
  2⤵
  PID:13360
- C:\Windows\System\GcMbgGv.exe
  C:\Windows\System\GcMbgGv.exe
  2⤵
  PID:13376
- C:\Windows\System\yGNxJwv.exe
  C:\Windows\System\yGNxJwv.exe
  2⤵
  PID:13392
- C:\Windows\System\SvfRcYj.exe
  C:\Windows\System\SvfRcYj.exe
  2⤵
  PID:13420
- C:\Windows\System\KWvQvWO.exe
  C:\Windows\System\KWvQvWO.exe
  2⤵
  PID:13436
- C:\Windows\System\VdVBiUu.exe
  C:\Windows\System\VdVBiUu.exe
  2⤵
  PID:13464
- C:\Windows\System\RdabhQM.exe
  C:\Windows\System\RdabhQM.exe
  2⤵
  PID:13488
- C:\Windows\System\lJJFezn.exe
  C:\Windows\System\lJJFezn.exe
  2⤵
  PID:13512
- C:\Windows\System\cgFgnCR.exe
  C:\Windows\System\cgFgnCR.exe
  2⤵
  PID:13532
- C:\Windows\System\hJYIvyH.exe
  C:\Windows\System\hJYIvyH.exe
  2⤵
  PID:13552
- C:\Windows\System\tjjOZMu.exe
  C:\Windows\System\tjjOZMu.exe
  2⤵
  PID:13576
- C:\Windows\System\mAiSZtC.exe
  C:\Windows\System\mAiSZtC.exe
  2⤵
  PID:13596
- C:\Windows\System\CKRiPsE.exe
  C:\Windows\System\CKRiPsE.exe
  2⤵
  PID:13616
- C:\Windows\System\YxwckQu.exe
  C:\Windows\System\YxwckQu.exe
  2⤵
  PID:13644
- C:\Windows\System\QfJuvxB.exe
  C:\Windows\System\QfJuvxB.exe
  2⤵
  PID:13668
- C:\Windows\System\HPEvlxB.exe
  C:\Windows\System\HPEvlxB.exe
  2⤵
  PID:13692
- C:\Windows\System\grJzzTv.exe
  C:\Windows\System\grJzzTv.exe
  2⤵
  PID:13712
- C:\Windows\System\OahApfV.exe
  C:\Windows\System\OahApfV.exe
  2⤵
  PID:14144
- C:\Windows\System\PYYznSg.exe
  C:\Windows\System\PYYznSg.exe
  2⤵
  PID:14160
- C:\Windows\System\TMHusUH.exe
  C:\Windows\System\TMHusUH.exe
  2⤵
  PID:14184
- C:\Windows\System\JXphgVx.exe
  C:\Windows\System\JXphgVx.exe
  2⤵
  PID:14200
- C:\Windows\System\TSzJEkX.exe
  C:\Windows\System\TSzJEkX.exe
  2⤵
  PID:14228
- C:\Windows\System\sFDPAnK.exe
  C:\Windows\System\sFDPAnK.exe
  2⤵
  PID:14248
- C:\Windows\System\vdJcfbJ.exe
  C:\Windows\System\vdJcfbJ.exe
  2⤵
  PID:14272
- C:\Windows\System\UvqZoJf.exe
  C:\Windows\System\UvqZoJf.exe
  2⤵
  PID:14300
- C:\Windows\System\cRUSdPh.exe
  C:\Windows\System\cRUSdPh.exe
  2⤵
  PID:4932
- C:\Windows\System\bqPgSSF.exe
  C:\Windows\System\bqPgSSF.exe
  2⤵
  PID:3908
- C:\Windows\System\dObdSVt.exe
  C:\Windows\System\dObdSVt.exe
  2⤵
  PID:10920
- C:\Windows\System\DBRGhON.exe
  C:\Windows\System\DBRGhON.exe
  2⤵
  PID:13784
- C:\Windows\System\iLGbZjd.exe
  C:\Windows\System\iLGbZjd.exe
  2⤵
  PID:9820
- C:\Windows\System\EfiLPwF.exe
  C:\Windows\System\EfiLPwF.exe
  2⤵
  PID:12888
- C:\Windows\System\uFblzgl.exe
  C:\Windows\System\uFblzgl.exe
  2⤵
  PID:11840
- C:\Windows\System\vMCZjRO.exe
  C:\Windows\System\vMCZjRO.exe
  2⤵
  PID:6524
- C:\Windows\System\jODhNkh.exe
  C:\Windows\System\jODhNkh.exe
  2⤵
  PID:6784
- C:\Windows\System\iTQqFGb.exe
  C:\Windows\System\iTQqFGb.exe
  2⤵
  PID:5988
- C:\Windows\System\KbCUzpI.exe
  C:\Windows\System\KbCUzpI.exe
  2⤵
  PID:13916
- C:\Windows\System\OEpDSGP.exe
  C:\Windows\System\OEpDSGP.exe
  2⤵
  PID:13836
- C:\Windows\System\EIFHSrM.exe
  C:\Windows\System\EIFHSrM.exe
  2⤵
  PID:13992
- C:\Windows\System\DaGCPYz.exe
  C:\Windows\System\DaGCPYz.exe
  2⤵
  PID:11888
- C:\Windows\System\hMjMoSZ.exe
  C:\Windows\System\hMjMoSZ.exe
  2⤵
  PID:13748
- C:\Windows\System\QbXMVmy.exe
  C:\Windows\System\QbXMVmy.exe
  2⤵
  PID:13796
- C:\Windows\System\qbsTjuq.exe
  C:\Windows\System\qbsTjuq.exe
  2⤵
  PID:8304
- C:\Windows\System\BEAuMdX.exe
  C:\Windows\System\BEAuMdX.exe
  2⤵
  PID:13896
- C:\Windows\System\HKheRGw.exe
  C:\Windows\System\HKheRGw.exe
  2⤵
  PID:13096
- C:\Windows\System\AuEgqrg.exe
  C:\Windows\System\AuEgqrg.exe
  2⤵
  PID:13936
- C:\Windows\System\AglAnfV.exe
  C:\Windows\System\AglAnfV.exe
  2⤵
  PID:13840
- C:\Windows\System\MNCxzth.exe
  C:\Windows\System\MNCxzth.exe
  2⤵
  PID:14028
- C:\Windows\System\ivkrRux.exe
  C:\Windows\System\ivkrRux.exe
  2⤵
  PID:7772
- C:\Windows\System\quZaKkG.exe
  C:\Windows\System\quZaKkG.exe
  2⤵
  PID:12748
- C:\Windows\System\NUXWwdV.exe
  C:\Windows\System\NUXWwdV.exe
  2⤵
  PID:3492
- C:\Windows\System\RGvIIXD.exe
  C:\Windows\System\RGvIIXD.exe
  2⤵
  PID:10300
- C:\Windows\System\QjIwfpS.exe
  C:\Windows\System\QjIwfpS.exe
  2⤵
  PID:9776
- C:\Windows\System\cwhwZVN.exe
  C:\Windows\System\cwhwZVN.exe
  2⤵
  PID:11680
- C:\Windows\System\aZLtoRC.exe
  C:\Windows\System\aZLtoRC.exe
  2⤵
  PID:11212
- C:\Windows\System\wufSxQN.exe
  C:\Windows\System\wufSxQN.exe
  2⤵
  PID:13428
- C:\Windows\System\JlywvBb.exe
  C:\Windows\System\JlywvBb.exe
  2⤵
  PID:9980
- C:\Windows\System\jZWkHAQ.exe
  C:\Windows\System\jZWkHAQ.exe
  2⤵
  PID:13680
- C:\Windows\System\AfqFxQl.exe
  C:\Windows\System\AfqFxQl.exe
  2⤵
  PID:10248
- C:\Windows\System\PdTmxzr.exe
  C:\Windows\System\PdTmxzr.exe
  2⤵
  PID:13544
- C:\Windows\System\FVfKwsz.exe
  C:\Windows\System\FVfKwsz.exe
  2⤵
  PID:10844
- C:\Windows\System\iBfGXVm.exe
  C:\Windows\System\iBfGXVm.exe
  2⤵
  PID:14216
- C:\Windows\System\mjEWNJU.exe
  C:\Windows\System\mjEWNJU.exe
  2⤵
  PID:14268
- C:\Windows\System\fGKUCDC.exe
  C:\Windows\System\fGKUCDC.exe
  2⤵
  PID:12564
- C:\Windows\System\sWnnRQe.exe
  C:\Windows\System\sWnnRQe.exe
  2⤵
  PID:13444
- C:\Windows\System\nHXtEgg.exe
  C:\Windows\System\nHXtEgg.exe
  2⤵
  PID:9356
- C:\Windows\System\EBFZdRx.exe
  C:\Windows\System\EBFZdRx.exe
  2⤵
  PID:13976
- C:\Windows\System\pKKgZec.exe
  C:\Windows\System\pKKgZec.exe
  2⤵
  PID:12084
- C:\Windows\System\lzcJXnO.exe
  C:\Windows\System\lzcJXnO.exe
  2⤵
  PID:14208
- C:\Windows\System\ubBVmdJ.exe
  C:\Windows\System\ubBVmdJ.exe
  2⤵
  PID:14256
- C:\Windows\System\UMzWPaB.exe
  C:\Windows\System\UMzWPaB.exe
  2⤵
  PID:4788
- C:\Windows\System\JVNDNIk.exe
  C:\Windows\System\JVNDNIk.exe
  2⤵
  PID:11044
- C:\Windows\System\wBeEKKJ.exe
  C:\Windows\System\wBeEKKJ.exe
  2⤵
  PID:10976
- C:\Windows\System\sXEgQig.exe
  C:\Windows\System\sXEgQig.exe
  2⤵
  PID:3880
- C:\Windows\System\eeKmVDr.exe
  C:\Windows\System\eeKmVDr.exe
  2⤵
  PID:14008
- C:\Windows\System\vHrsEKs.exe
  C:\Windows\System\vHrsEKs.exe
  2⤵
  PID:13448
- C:\Windows\System\eYhKNaP.exe
  C:\Windows\System\eYhKNaP.exe
  2⤵
  PID:4132
- C:\Windows\System\uAxNqnw.exe
  C:\Windows\System\uAxNqnw.exe
  2⤵
  PID:14052
- C:\Windows\System\lHnWkuC.exe
  C:\Windows\System\lHnWkuC.exe
  2⤵
  PID:13708
- C:\Windows\System\nLYabWu.exe
  C:\Windows\System\nLYabWu.exe
  2⤵
  PID:2712
- C:\Windows\System\GIEbMEs.exe
  C:\Windows\System\GIEbMEs.exe
  2⤵
  PID:1456
- C:\Windows\System\wuZBIOF.exe
  C:\Windows\System\wuZBIOF.exe
  2⤵
  PID:2688
- C:\Windows\System\NjTeaml.exe
  C:\Windows\System\NjTeaml.exe
  2⤵
  PID:14132
- C:\Windows\System\mxbhPDs.exe
  C:\Windows\System\mxbhPDs.exe
  2⤵
  PID:14292
- C:\Windows\System\IxYzyli.exe
  C:\Windows\System\IxYzyli.exe
  2⤵
  PID:3632
- C:\Windows\System\RBaxKcB.exe
  C:\Windows\System\RBaxKcB.exe
  2⤵
  PID:8076
- C:\Windows\System\GnennwH.exe
  C:\Windows\System\GnennwH.exe
  2⤵
  PID:13224
- C:\Windows\System\yhcRGeR.exe
  C:\Windows\System\yhcRGeR.exe
  2⤵
  PID:9764
- C:\Windows\System\lPQhBhU.exe
  C:\Windows\System\lPQhBhU.exe
  2⤵
  PID:1812
- C:\Windows\System\eeEflIs.exe
  C:\Windows\System\eeEflIs.exe
  2⤵
  PID:6416
- C:\Windows\System\crjgXKv.exe
  C:\Windows\System\crjgXKv.exe
  2⤵
  PID:3104
- C:\Windows\System\jafRMRX.exe
  C:\Windows\System\jafRMRX.exe
  2⤵
  PID:14240
- C:\Windows\System\rYgQdeS.exe
  C:\Windows\System\rYgQdeS.exe
  2⤵
  PID:14040
- C:\Windows\System\OdRFeSu.exe
  C:\Windows\System\OdRFeSu.exe
  2⤵
  PID:516
- C:\Windows\System\pghSJqU.exe
  C:\Windows\System\pghSJqU.exe
  2⤵
  PID:3096
- C:\Windows\System\CGZRCfA.exe
  C:\Windows\System\CGZRCfA.exe
  2⤵
  PID:14308
- C:\Windows\System\PaEfnpq.exe
  C:\Windows\System\PaEfnpq.exe
  2⤵
  PID:14324
- C:\Windows\System\qIwjXoy.exe
  C:\Windows\System\qIwjXoy.exe
  2⤵
  PID:1716
- C:\Windows\System\DxVeTDt.exe
  C:\Windows\System\DxVeTDt.exe
  2⤵
  PID:1804
- C:\Windows\System\eZbOBqK.exe
  C:\Windows\System\eZbOBqK.exe
  2⤵
  PID:2780
- C:\Windows\System\kcUDGcR.exe
  C:\Windows\System\kcUDGcR.exe
  2⤵
  PID:14088
- C:\Windows\System\kavLCBA.exe
  C:\Windows\System\kavLCBA.exe
  2⤵
  PID:376
- C:\Windows\System\UNeoXcU.exe
  C:\Windows\System\UNeoXcU.exe
  2⤵
  PID:13920
- C:\Windows\System\ZCfHUqR.exe
  C:\Windows\System\ZCfHUqR.exe
  2⤵
  PID:11532
- C:\Windows\System\FWytBbW.exe
  C:\Windows\System\FWytBbW.exe
  2⤵
  PID:10292
- C:\Windows\System\UlltRzj.exe
  C:\Windows\System\UlltRzj.exe
  2⤵
  PID:3628
- C:\Windows\System\uxShyaS.exe
  C:\Windows\System\uxShyaS.exe
  2⤵
  PID:5124
- C:\Windows\System\KZeMYUm.exe
  C:\Windows\System\KZeMYUm.exe
  2⤵
  PID:10456
- C:\Windows\System\cEaaWeL.exe
  C:\Windows\System\cEaaWeL.exe
  2⤵
  PID:13864
- C:\Windows\System\vTUgzUT.exe
  C:\Windows\System\vTUgzUT.exe
  2⤵
  PID:220
- C:\Windows\System\pSthGRw.exe
  C:\Windows\System\pSthGRw.exe
  2⤵
  PID:13740
- C:\Windows\System\KuVfcyf.exe
  C:\Windows\System\KuVfcyf.exe
  2⤵
  PID:3672
- C:\Windows\System\piqiBBS.exe
  C:\Windows\System\piqiBBS.exe
  2⤵
  PID:2624
- C:\Windows\System\CuhFwBG.exe
  C:\Windows\System\CuhFwBG.exe
  2⤵
  PID:13472
- C:\Windows\System\JRXkZjw.exe
  C:\Windows\System\JRXkZjw.exe
  2⤵
  PID:5208
- C:\Windows\System\dFsITGo.exe
  C:\Windows\System\dFsITGo.exe
  2⤵
  PID:2372
- C:\Windows\System\eTtEZOY.exe
  C:\Windows\System\eTtEZOY.exe
  2⤵
  PID:4288
- C:\Windows\System\nRUmRcD.exe
  C:\Windows\System\nRUmRcD.exe
  2⤵
  PID:5144
- C:\Windows\System\NKkTOqg.exe
  C:\Windows\System\NKkTOqg.exe
  2⤵
  PID:4580
- C:\Windows\System\PIGVObX.exe
  C:\Windows\System\PIGVObX.exe
  2⤵
  PID:4244
- C:\Windows\System\seHKqGq.exe
  C:\Windows\System\seHKqGq.exe
  2⤵
  PID:4068
- C:\Windows\System\rmvfRpr.exe
  C:\Windows\System\rmvfRpr.exe
  2⤵
  PID:2332
- C:\Windows\System\DMPShJc.exe
  C:\Windows\System\DMPShJc.exe
  2⤵
  PID:11584
- C:\Windows\System\ZnOfHpU.exe
  C:\Windows\System\ZnOfHpU.exe
  2⤵
  PID:5244
- C:\Windows\System\NLNyelT.exe
  C:\Windows\System\NLNyelT.exe
  2⤵
  PID:2416
- C:\Windows\System\GihPCYi.exe
  C:\Windows\System\GihPCYi.exe
  2⤵
  PID:4652
- C:\Windows\System\yWziiWn.exe
  C:\Windows\System\yWziiWn.exe
  2⤵
  PID:5820
- C:\Windows\System\bYcJtHv.exe
  C:\Windows\System\bYcJtHv.exe
  2⤵
  PID:5800
- C:\Windows\System\ZEJYSuZ.exe
  C:\Windows\System\ZEJYSuZ.exe
  2⤵
  PID:1528
- C:\Windows\System\rOFDOqh.exe
  C:\Windows\System\rOFDOqh.exe
  2⤵
  PID:14288
- C:\Windows\System\kuUTmfE.exe
  C:\Windows\System\kuUTmfE.exe
  2⤵
  PID:13856
- C:\Windows\System\iKgJPJl.exe
  C:\Windows\System\iKgJPJl.exe
  2⤵
  PID:13932
- C:\Windows\System\oRwFAvl.exe
  C:\Windows\System\oRwFAvl.exe
  2⤵
  PID:14436
- C:\Windows\System\gVlxnhl.exe
  C:\Windows\System\gVlxnhl.exe
  2⤵
  PID:14452
- C:\Windows\System\jtaGODR.exe
  C:\Windows\System\jtaGODR.exe
  2⤵
  PID:14600
- C:\Windows\System\uxZBVku.exe
  C:\Windows\System\uxZBVku.exe
  2⤵
  PID:14616
- C:\Windows\System\RbuMgVA.exe
  C:\Windows\System\RbuMgVA.exe
  2⤵
  PID:14708
- C:\Windows\System\qIwGHTO.exe
  C:\Windows\System\qIwGHTO.exe
  2⤵
  PID:14904
- C:\Windows\System\dZAMNRL.exe
  C:\Windows\System\dZAMNRL.exe
  2⤵
  PID:14676
- C:\Windows\System\JQivmVv.exe
  C:\Windows\System\JQivmVv.exe
  2⤵
  PID:14664
- C:\Windows\System\BimdSNr.exe
  C:\Windows\System\BimdSNr.exe
  2⤵
  PID:14728
- C:\Windows\System\uDpoSGo.exe
  C:\Windows\System\uDpoSGo.exe
  2⤵
  PID:14764
- C:\Windows\System\yQCQkqg.exe
  C:\Windows\System\yQCQkqg.exe
  2⤵
  PID:14756
- C:\Windows\System\XxYHNFZ.exe
  C:\Windows\System\XxYHNFZ.exe
  2⤵
  PID:14792
- C:\Windows\System\nVGTLZe.exe
  C:\Windows\System\nVGTLZe.exe
  2⤵
  PID:14860
- C:\Windows\System\EITFjnu.exe
  C:\Windows\System\EITFjnu.exe
  2⤵
  PID:14876
- C:\Windows\System\MjiAZNv.exe
  C:\Windows\System\MjiAZNv.exe
  2⤵
  PID:14928
- C:\Windows\System\gQuAFGg.exe
  C:\Windows\System\gQuAFGg.exe
  2⤵
  PID:14968
- C:\Windows\System\VQNfLPp.exe
  C:\Windows\System\VQNfLPp.exe
  2⤵
  PID:14984
- C:\Windows\System\tVgVmLS.exe
  C:\Windows\System\tVgVmLS.exe
  2⤵
  PID:15004
- C:\Windows\System\naBYeQs.exe
  C:\Windows\System\naBYeQs.exe
  2⤵
  PID:15052
- C:\Windows\System\IsyoEKc.exe
  C:\Windows\System\IsyoEKc.exe
  2⤵
  PID:15324
- C:\Windows\System\NWOXlTF.exe
  C:\Windows\System\NWOXlTF.exe
  2⤵
  PID:14372
- C:\Windows\System\fUFiUox.exe
  C:\Windows\System\fUFiUox.exe
  2⤵
  PID:14408
- C:\Windows\System\EKhMcaj.exe
  C:\Windows\System\EKhMcaj.exe
  2⤵
  PID:14420
- C:\Windows\System\ezoucnV.exe
  C:\Windows\System\ezoucnV.exe
  2⤵
  PID:14504
- C:\Windows\System\ZlIForI.exe
  C:\Windows\System\ZlIForI.exe
  2⤵
  PID:14548
- C:\Windows\System\CPlVFjo.exe
  C:\Windows\System\CPlVFjo.exe
  2⤵
  PID:3392
- C:\Windows\System\yKQrMBi.exe
  C:\Windows\System\yKQrMBi.exe
  2⤵
  PID:5804
- C:\Windows\System\pfnWbeQ.exe
  C:\Windows\System\pfnWbeQ.exe
  2⤵
  PID:5832
- C:\Windows\System\MTECSor.exe
  C:\Windows\System\MTECSor.exe
  2⤵
  PID:14688
- C:\Windows\System\HDGAHnL.exe
  C:\Windows\System\HDGAHnL.exe
  2⤵
  PID:6068
- C:\Windows\System\YPkMAjz.exe
  C:\Windows\System\YPkMAjz.exe
  2⤵
  PID:6016
- C:\Windows\System\XpKogkn.exe
  C:\Windows\System\XpKogkn.exe
  2⤵
  PID:6020
- C:\Windows\System\cTiUKxB.exe
  C:\Windows\System\cTiUKxB.exe
  2⤵
  PID:14936
- C:\Windows\System\NRdjtAv.exe
  C:\Windows\System\NRdjtAv.exe
  2⤵
  PID:5140
- C:\Windows\System\OgYrImk.exe
  C:\Windows\System\OgYrImk.exe
  2⤵
  PID:15064
- C:\Windows\System\sBneDMI.exe
  C:\Windows\System\sBneDMI.exe
  2⤵
  PID:15236
- C:\Windows\System\WCmLejk.exe
  C:\Windows\System\WCmLejk.exe
  2⤵
  PID:15216
- C:\Windows\System\caojtQe.exe
  C:\Windows\System\caojtQe.exe
  2⤵
  PID:15220
- C:\Windows\System\EZkwhid.exe
  C:\Windows\System\EZkwhid.exe
  2⤵
  PID:15132
- C:\Windows\System\UDYtxoW.exe
  C:\Windows\System\UDYtxoW.exe
  2⤵
  PID:15168
- C:\Windows\System\rMtCGwh.exe
  C:\Windows\System\rMtCGwh.exe
  2⤵
  PID:15276
- C:\Windows\System\WUhYtmM.exe
  C:\Windows\System\WUhYtmM.exe
  2⤵
  PID:15304
- C:\Windows\System\xEKBVXY.exe
  C:\Windows\System\xEKBVXY.exe
  2⤵
  PID:14352
- C:\Windows\System\dQHevgz.exe
  C:\Windows\System\dQHevgz.exe
  2⤵
  PID:14384
- C:\Windows\System\yAGwWzv.exe
  C:\Windows\System\yAGwWzv.exe
  2⤵
  PID:14460
- C:\Windows\System\TlrETeU.exe
  C:\Windows\System\TlrETeU.exe
  2⤵
  PID:14416
- C:\Windows\System\SJLxCMO.exe
  C:\Windows\System\SJLxCMO.exe
  2⤵
  PID:4896
- C:\Windows\System\xdaoYLP.exe
  C:\Windows\System\xdaoYLP.exe
  2⤵
  PID:14516
- C:\Windows\System\uxMYkkw.exe
  C:\Windows\System\uxMYkkw.exe
  2⤵
  PID:6940
- C:\Windows\System\TrYcAkK.exe
  C:\Windows\System\TrYcAkK.exe
  2⤵
  PID:5256
- C:\Windows\System\FdlAPeq.exe
  C:\Windows\System\FdlAPeq.exe
  2⤵
  PID:5452
- C:\Windows\System\SJlBnof.exe
  C:\Windows\System\SJlBnof.exe
  2⤵
  PID:14856
- C:\Windows\System\kHYVSAF.exe
  C:\Windows\System\kHYVSAF.exe
  2⤵
  PID:14900
- C:\Windows\System\zzHmtKc.exe
  C:\Windows\System\zzHmtKc.exe
  2⤵
  PID:14844
- C:\Windows\System\kKcOOcX.exe
  C:\Windows\System\kKcOOcX.exe
  2⤵
  PID:14976
- C:\Windows\System\NTXkDBG.exe
  C:\Windows\System\NTXkDBG.exe
  2⤵
  PID:15104
- C:\Windows\System\XEpODnG.exe
  C:\Windows\System\XEpODnG.exe
  2⤵
  PID:5556
- C:\Windows\System\wqaGOmP.exe
  C:\Windows\System\wqaGOmP.exe
  2⤵
  PID:14872
- C:\Windows\System\rXVjUPA.exe
  C:\Windows\System\rXVjUPA.exe
  2⤵
  PID:15036
- C:\Windows\System\YYfNrJX.exe
  C:\Windows\System\YYfNrJX.exe
  2⤵
  PID:15192
- C:\Windows\System\oaZWuIr.exe
  C:\Windows\System\oaZWuIr.exe
  2⤵
  PID:1952
- C:\Windows\System\qymuisq.exe
  C:\Windows\System\qymuisq.exe
  2⤵
  PID:2744
- C:\Windows\System\UXiSDyp.exe
  C:\Windows\System\UXiSDyp.exe
  2⤵
  PID:6816
- C:\Windows\System\KFcoxyh.exe
  C:\Windows\System\KFcoxyh.exe
  2⤵
  PID:15240
- C:\Windows\System\KmiMdMo.exe
  C:\Windows\System\KmiMdMo.exe
  2⤵
  PID:15136
- C:\Windows\System\ycQeicQ.exe
  C:\Windows\System\ycQeicQ.exe
  2⤵
  PID:8152
- C:\Windows\System\ADiPDFA.exe
  C:\Windows\System\ADiPDFA.exe
  2⤵
  PID:15160
- C:\Windows\System\LNBZRTN.exe
  C:\Windows\System\LNBZRTN.exe
  2⤵
  PID:5692
- C:\Windows\System\UASxHqC.exe
  C:\Windows\System\UASxHqC.exe
  2⤵
  PID:2836
- C:\Windows\System\IlgeeXx.exe
  C:\Windows\System\IlgeeXx.exe
  2⤵
  PID:6244
- C:\Windows\System\AnUeRfE.exe
  C:\Windows\System\AnUeRfE.exe
  2⤵
  PID:5228
- C:\Windows\System\SfdhhyA.exe
  C:\Windows\System\SfdhhyA.exe
  2⤵
  PID:8484
- C:\Windows\System\bFrilvl.exe
  C:\Windows\System\bFrilvl.exe
  2⤵
  PID:8728
- C:\Windows\System\kiOSmgc.exe
  C:\Windows\System\kiOSmgc.exe
  2⤵
  PID:14552
- C:\Windows\System\oTNJBjv.exe
  C:\Windows\System\oTNJBjv.exe
  2⤵
  PID:8624
- C:\Windows\System\lKCyxYF.exe
  C:\Windows\System\lKCyxYF.exe
  2⤵
  PID:8392
- C:\Windows\System\gXLLUBB.exe
  C:\Windows\System\gXLLUBB.exe
  2⤵
  PID:7844
- C:\Windows\System\NGwjPcq.exe
  C:\Windows\System\NGwjPcq.exe
  2⤵
  PID:8104
- C:\Windows\System\djhjkMG.exe
  C:\Windows\System\djhjkMG.exe
  2⤵
  PID:9652
- C:\Windows\System\sCfzuHA.exe
  C:\Windows\System\sCfzuHA.exe
  2⤵
  PID:9132
- C:\Windows\System\nrzwTWq.exe
  C:\Windows\System\nrzwTWq.exe
  2⤵
  PID:14892
- C:\Windows\System\fvUXzdE.exe
  C:\Windows\System\fvUXzdE.exe
  2⤵
  PID:8764
- C:\Windows\System\JKZRrVF.exe
  C:\Windows\System\JKZRrVF.exe
  2⤵
  PID:7836
- C:\Windows\System\oOkVmtM.exe
  C:\Windows\System\oOkVmtM.exe
  2⤵
  PID:6184
- C:\Windows\System\HTxjCXJ.exe
  C:\Windows\System\HTxjCXJ.exe
  2⤵
  PID:8184
- C:\Windows\System\WiSEWum.exe
  C:\Windows\System\WiSEWum.exe
  2⤵
  PID:8124
- C:\Windows\System\EzvzBuZ.exe
  C:\Windows\System\EzvzBuZ.exe
  2⤵
  PID:6076
- C:\Windows\System\PTQyiRG.exe
  C:\Windows\System\PTQyiRG.exe
  2⤵
  PID:14080
- C:\Windows\System\XIKmVCK.exe
  C:\Windows\System\XIKmVCK.exe
  2⤵
  PID:8880
- C:\Windows\System\WVNOVRG.exe
  C:\Windows\System\WVNOVRG.exe
  2⤵
  PID:15196
- C:\Windows\System\pznijZo.exe
  C:\Windows\System\pznijZo.exe
  2⤵
  PID:15224
- C:\Windows\System\zCnNCdT.exe
  C:\Windows\System\zCnNCdT.exe
  2⤵
  PID:6956
- C:\Windows\System\WKkcsTG.exe
  C:\Windows\System\WKkcsTG.exe
  2⤵
  PID:4176
- C:\Windows\System\yNCFlln.exe
  C:\Windows\System\yNCFlln.exe
  2⤵
  PID:15188
- C:\Windows\System\XVSNrUs.exe
  C:\Windows\System\XVSNrUs.exe
  2⤵
  PID:15172
- C:\Windows\System\fHblcDN.exe
  C:\Windows\System\fHblcDN.exe
  2⤵
  PID:15328
- C:\Windows\System\RrrfxvY.exe
  C:\Windows\System\RrrfxvY.exe
  2⤵
  PID:11128
- C:\Windows\System\UUPSoPa.exe
  C:\Windows\System\UUPSoPa.exe
  2⤵
  PID:6272
- C:\Windows\System\udPqeWV.exe
  C:\Windows\System\udPqeWV.exe
  2⤵
  PID:9556
- C:\Windows\System\MHavKrx.exe
  C:\Windows\System\MHavKrx.exe
  2⤵
  PID:1088
- C:\Windows\System\VXZAUqk.exe
  C:\Windows\System\VXZAUqk.exe
  2⤵
  PID:5884
- C:\Windows\System\FvNwzfq.exe
  C:\Windows\System\FvNwzfq.exe
  2⤵
  PID:5792
- C:\Windows\System\YmKVyMo.exe
  C:\Windows\System\YmKVyMo.exe
  2⤵
  PID:7392
- C:\Windows\System\ZsnKmnu.exe
  C:\Windows\System\ZsnKmnu.exe
  2⤵
  PID:9700
- C:\Windows\System\URItSTh.exe
  C:\Windows\System\URItSTh.exe
  2⤵
  PID:9728
- C:\Windows\System\VUDxLTA.exe
  C:\Windows\System\VUDxLTA.exe
  2⤵
  PID:7352
- C:\Windows\System\sPTnBGm.exe
  C:\Windows\System\sPTnBGm.exe
  2⤵
  PID:14508
- C:\Windows\System\QkUPfqT.exe
  C:\Windows\System\QkUPfqT.exe
  2⤵
  PID:5588
- C:\Windows\System\BIopOXz.exe
  C:\Windows\System\BIopOXz.exe
  2⤵
  PID:10088
- C:\Windows\System\vFZBqCx.exe
  C:\Windows\System\vFZBqCx.exe
  2⤵
  PID:14660
- C:\Windows\System\zkydmSD.exe
  C:\Windows\System\zkydmSD.exe
  2⤵
  PID:9916
- C:\Windows\System\JRrgLgd.exe
  C:\Windows\System\JRrgLgd.exe
  2⤵
  PID:10128
- C:\Windows\System\KRvUqzI.exe
  C:\Windows\System\KRvUqzI.exe
  2⤵
  PID:14808
- C:\Windows\System\ZOeWbNO.exe
  C:\Windows\System\ZOeWbNO.exe
  2⤵
  PID:10048
- C:\Windows\System\GAnWMaL.exe
  C:\Windows\System\GAnWMaL.exe
  2⤵
  PID:14912
- C:\Windows\System\GgUDxqU.exe
  C:\Windows\System\GgUDxqU.exe
  2⤵
  PID:6072
- C:\Windows\System\BvMhLIa.exe
  C:\Windows\System\BvMhLIa.exe
  2⤵
  PID:14924
- C:\Windows\System\bWYriOo.exe
  C:\Windows\System\bWYriOo.exe
  2⤵
  PID:12900
- C:\Windows\System\afKbqRP.exe
  C:\Windows\System\afKbqRP.exe
  2⤵
  PID:10268
- C:\Windows\System\kaSigRq.exe
  C:\Windows\System\kaSigRq.exe
  2⤵
  PID:5544
- C:\Windows\System\Cdzamsv.exe
  C:\Windows\System\Cdzamsv.exe
  2⤵
  PID:15032
- C:\Windows\System\JZfDawK.exe
  C:\Windows\System\JZfDawK.exe
  2⤵
  PID:5264
- C:\Windows\System\XSUSSlO.exe
  C:\Windows\System\XSUSSlO.exe
  2⤵
  PID:10556
- C:\Windows\System\WCNwKGZ.exe
  C:\Windows\System\WCNwKGZ.exe
  2⤵
  PID:15024
- C:\Windows\System\KydSTBA.exe
  C:\Windows\System\KydSTBA.exe
  2⤵
  PID:9180
- C:\Windows\System\gAkJjQz.exe
  C:\Windows\System\gAkJjQz.exe
  2⤵
  PID:9120
- C:\Windows\System\uZMuZth.exe
  C:\Windows\System\uZMuZth.exe
  2⤵
  PID:4868
- C:\Windows\System\lAULfTD.exe
  C:\Windows\System\lAULfTD.exe
  2⤵
  PID:11384
- C:\Windows\System\KnONuzT.exe
  C:\Windows\System\KnONuzT.exe
  2⤵
  PID:14692
- C:\Windows\System\tFIvelq.exe
  C:\Windows\System\tFIvelq.exe
  2⤵
  PID:11296
- C:\Windows\System\uZlcJYv.exe
  C:\Windows\System\uZlcJYv.exe
  2⤵
  PID:9828
- C:\Windows\System\XhVlpxI.exe
  C:\Windows\System\XhVlpxI.exe
  2⤵
  PID:5952
- C:\Windows\System\LvMuuGO.exe
  C:\Windows\System\LvMuuGO.exe
  2⤵
  PID:8528
- C:\Windows\System\usoHdOg.exe
  C:\Windows\System\usoHdOg.exe
  2⤵
  PID:9796
- C:\Windows\System\DmFpqwi.exe
  C:\Windows\System\DmFpqwi.exe
  2⤵
  PID:11548
- C:\Windows\System\FKkPOYa.exe
  C:\Windows\System\FKkPOYa.exe
  2⤵
  PID:7304
- C:\Windows\System\jscPmVd.exe
  C:\Windows\System\jscPmVd.exe
  2⤵
  PID:12016
- C:\Windows\System\QSMRqex.exe
  C:\Windows\System\QSMRqex.exe
  2⤵
  PID:11656
- C:\Windows\System\TZQPzmW.exe
  C:\Windows\System\TZQPzmW.exe
  2⤵
  PID:11912
- C:\Windows\System\hCXMDTm.exe
  C:\Windows\System\hCXMDTm.exe
  2⤵
  PID:8384
- C:\Windows\System\NrqxgCa.exe
  C:\Windows\System\NrqxgCa.exe
  2⤵
  PID:7476
- C:\Windows\System\QXXaJiV.exe
  C:\Windows\System\QXXaJiV.exe
  2⤵
  PID:6380
- C:\Windows\System\TuMUGCg.exe
  C:\Windows\System\TuMUGCg.exe
  2⤵
  PID:7916
- C:\Windows\System\AuSzywu.exe
  C:\Windows\System\AuSzywu.exe
  2⤵
  PID:12680
- C:\Windows\System\IvCIDeP.exe
  C:\Windows\System\IvCIDeP.exe
  2⤵
  PID:12188
- C:\Windows\System\osTxldf.exe
  C:\Windows\System\osTxldf.exe
  2⤵
  PID:14960
- C:\Windows\System\BCAUHbY.exe
  C:\Windows\System\BCAUHbY.exe
  2⤵
  PID:8848
- C:\Windows\System\nrwNsuE.exe
  C:\Windows\System\nrwNsuE.exe
  2⤵
  PID:13016
- C:\Windows\System\QKMXsvG.exe
  C:\Windows\System\QKMXsvG.exe
  2⤵
  PID:7896
- C:\Windows\System\LISYZHW.exe
  C:\Windows\System\LISYZHW.exe
  2⤵
  PID:8820
- C:\Windows\System\xqDiBtU.exe
  C:\Windows\System\xqDiBtU.exe
  2⤵
  PID:9600
- C:\Windows\System\EPfqhuo.exe
  C:\Windows\System\EPfqhuo.exe
  2⤵
  PID:4032
- C:\Windows\System\WbSDMWm.exe
  C:\Windows\System\WbSDMWm.exe
  2⤵
  PID:12492
- C:\Windows\System\IgyjjcG.exe
  C:\Windows\System\IgyjjcG.exe
  2⤵
  PID:9668
- C:\Windows\System\GRpoajO.exe
  C:\Windows\System\GRpoajO.exe
  2⤵
  PID:8172
- C:\Windows\System\OXhEEMx.exe
  C:\Windows\System\OXhEEMx.exe
  2⤵
  PID:13048
- C:\Windows\System\jKNOsKB.exe
  C:\Windows\System\jKNOsKB.exe
  2⤵
  PID:7792
- C:\Windows\System\HPQJSLi.exe
  C:\Windows\System\HPQJSLi.exe
  2⤵
  PID:6140
- C:\Windows\System\OLQmbcR.exe
  C:\Windows\System\OLQmbcR.exe
  2⤵
  PID:11740
- C:\Windows\System\qlrMcIU.exe
  C:\Windows\System\qlrMcIU.exe
  2⤵
  PID:13004
- C:\Windows\System\OMypBHf.exe
  C:\Windows\System\OMypBHf.exe
  2⤵
  PID:11844
- C:\Windows\System\OrpZcPn.exe
  C:\Windows\System\OrpZcPn.exe
  2⤵
  PID:13152
- C:\Windows\System\msnJPOV.exe
  C:\Windows\System\msnJPOV.exe
  2⤵
  PID:12044
- C:\Windows\System\PuEpaBH.exe
  C:\Windows\System\PuEpaBH.exe
  2⤵
  PID:14956
- C:\Windows\System\MaCBAhk.exe
  C:\Windows\System\MaCBAhk.exe
  2⤵
  PID:14888
- C:\Windows\System\bpcVzzV.exe
  C:\Windows\System\bpcVzzV.exe
  2⤵
  PID:6520
- C:\Windows\System\GHYqXoh.exe
  C:\Windows\System\GHYqXoh.exe
  2⤵
  PID:6168
- C:\Windows\System\ekPhLzO.exe
  C:\Windows\System\ekPhLzO.exe
  2⤵
  PID:9768
- C:\Windows\System\jmidboo.exe
  C:\Windows\System\jmidboo.exe
  2⤵
  PID:9644
- C:\Windows\System\akFMMOK.exe
  C:\Windows\System\akFMMOK.exe
  2⤵
  PID:9660
- C:\Windows\System\cEVMrmZ.exe
  C:\Windows\System\cEVMrmZ.exe
  2⤵
  PID:6588
- C:\Windows\System\lhpVfuE.exe
  C:\Windows\System\lhpVfuE.exe
  2⤵
  PID:10644
- C:\Windows\System\wOsIFeK.exe
  C:\Windows\System\wOsIFeK.exe
  2⤵
  PID:10384
- C:\Windows\System\sjdyPby.exe
  C:\Windows\System\sjdyPby.exe
  2⤵
  PID:9724
- C:\Windows\System\xgezahW.exe
  C:\Windows\System\xgezahW.exe
  2⤵
  PID:11780
- C:\Windows\System\hoELIMS.exe
  C:\Windows\System\hoELIMS.exe
  2⤵
  PID:12636
- C:\Windows\System\xlBBEcP.exe
  C:\Windows\System\xlBBEcP.exe
  2⤵
  PID:11480
- C:\Windows\System\VtgaGgD.exe
  C:\Windows\System\VtgaGgD.exe
  2⤵
  PID:11708
- C:\Windows\System\FIfScnj.exe
  C:\Windows\System\FIfScnj.exe
  2⤵
  PID:9072
- C:\Windows\System\zjyxMCP.exe
  C:\Windows\System\zjyxMCP.exe
  2⤵
  PID:12548
- C:\Windows\System\zUJIfAn.exe
  C:\Windows\System\zUJIfAn.exe
  2⤵
  PID:11460
- C:\Windows\System\EnPCCHU.exe
  C:\Windows\System\EnPCCHU.exe
  2⤵
  PID:11304
- C:\Windows\System\XwMYKAE.exe
  C:\Windows\System\XwMYKAE.exe
  2⤵
  PID:12804
- C:\Windows\System\UPRYrcO.exe
  C:\Windows\System\UPRYrcO.exe
  2⤵
  PID:13676
- C:\Windows\System\pGKGaIO.exe
  C:\Windows\System\pGKGaIO.exe
  2⤵
  PID:10272
- C:\Windows\System\ccItqVb.exe
  C:\Windows\System\ccItqVb.exe
  2⤵
  PID:10260
- C:\Windows\System\sowjCUj.exe
  C:\Windows\System\sowjCUj.exe
  2⤵
  PID:4080
- C:\Windows\System\zfHHqOf.exe
  C:\Windows\System\zfHHqOf.exe
  2⤵
  PID:10404
- C:\Windows\System\mTGOGmV.exe
  C:\Windows\System\mTGOGmV.exe
  2⤵
  PID:13132
- C:\Windows\System\DXfnPZw.exe
  C:\Windows\System\DXfnPZw.exe
  2⤵
  PID:9324
- C:\Windows\System\KDuIvKI.exe
  C:\Windows\System\KDuIvKI.exe
  2⤵
  PID:8336
- C:\Windows\System\YabQIka.exe
  C:\Windows\System\YabQIka.exe
  2⤵
  PID:13240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fvwknfb.srg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkSJaol.exe

Filesize
1.4MB

MD5
f281145179943c4dc4664226985cfc52

SHA1
32e8a129c9059d4834ed546ee21ba46af9c59d6f

SHA256
7d4fad98f2d84902f50f209b42496ff152faa21f08068195cd5f9bade0ee9770

SHA512
a93dce13c6fd7e01419d76563ca836e2edbfca40b4e64caa4736991f926ba20e7ceeb1d7965b2b025e8088fdba0b9b88c5916c6de4af48ea4b89869c74cff507

Download Submit
C:\Windows\System\ArVHqeY.exe

Filesize
1.4MB

MD5
2aa2988237459c071815418e2a1e83f5

SHA1
5e9cd1e1d155ce862183e2fe3c305ed666836d4c

SHA256
a6d2c22bb48c405d2b95962123202e9d920203f5de1b49fb13347dc7043e1df2

SHA512
4d12250130e7767492536b5e89c1bee32a7d1543873a9e26322217c386846ce0bc55cede7b3a9215d758deb67473bec667b9abc6f79d7de1c1b4c7451fd2c405

Download Submit
C:\Windows\System\BCkmIrH.exe

Filesize
1.4MB

MD5
23ccf5d2895c9c14b53480f88f64ab84

SHA1
28702ebccde5060dce0ac6e5ea14479b3998814e

SHA256
5b1252bfb1e597ef2e28ea9660d96f82f0e2061d6cf6fb6aa79f30bc9ce98280

SHA512
43a5a57d0bf7d95e6b51205dd89cebcdc91bca08cbea959eac052fd1c9085ea07f0e5f31f42354c2d13a4d8544e3572ad24c5b90fdf059440fb35ce7f55857f1

Download Submit
C:\Windows\System\EszEkHz.exe

Filesize
1.4MB

MD5
d692bfc97761c85ec4375bcb252c0acd

SHA1
fbedfc77e7a8f233bc3c04761ee5c43b0de54f84

SHA256
5d9be570db3af38257e30dd49cc3e30149aeb89ea2fd5ab90b1b390b264e4633

SHA512
e7038ff6333e9959fbbd0b339a6e6e4d95eb8cd621a6533c26648309e3ab2cdc036fbf83b5d6e3c8ae24419738bd52afb2d691d4356f43d45cd841c11753ac92

Download Submit
C:\Windows\System\FaJvtkl.exe

Filesize
1.4MB

MD5
a441ab7410c4408a9c7f18e52abef8c5

SHA1
97104a5b288c0b0d82b8c8268a6223db85efb93a

SHA256
0c67861c6d05a295e7f48cecb9a40b7006b753d36cc6e6f72de17fa0f74c9545

SHA512
a94c2618f073df577ac1bf7c3403cf26faa41e1fe0c91e91a08d37251989a4437563e979844c410b7decb0aaaa6572779448f19a6956df9c3fade3b529eb0156

Download Submit
C:\Windows\System\HtwnPiq.exe

Filesize
1.4MB

MD5
34be558b53a60a13f122a9ee00006a81

SHA1
9783535c0025a4579fe4e324ba82d78dd2528b88

SHA256
4cbc0810bfab696bce82ee31c1d3f4c73e957e0b029d31aa0244b265deff8c0e

SHA512
98798499110677552375bdb298a9e8274eabeb2918017ecce0f6ef817fc692681475a5d53e18943c240ff1a357eb91667edaaffaf13a81e9daf7f7a0a59bb9ab

Download Submit
C:\Windows\System\IxunJKh.exe

Filesize
1.4MB

MD5
d5440b310f73a2aea7ac9ec3ccd9760a

SHA1
7332cc1c01628c77a82c09e42cd4c660a34f69a7

SHA256
a0bc89abde2f3adc7d59bd1d4f17aba2c82a6ef7b07179bd759d4e69ccabc269

SHA512
837477ce3303f7a21bef19954e2a4558e0676a130c975cdadffb95b257efd07f0613d9023cae64d1cf0379603ae18b62c6332209d61c828c74c687e317e8d551

Download Submit
C:\Windows\System\KHQLAWV.exe

Filesize
1.4MB

MD5
3d7d6e4cfd62e19f3cc01d9e520e959f

SHA1
1a5b68418806436fa45f01047ecdb51a09e81cc5

SHA256
871cf4657b9bb3659b5a644ea02e481e0af8dfad3a73d0234c291dddd20ba6af

SHA512
84f282c389d4dcc1fda2561c4f430b4401728872359bb45e208a555def65efe1731534069438f386d00a31af82016465f217b719fd3077464a7803661929d361

Download Submit
C:\Windows\System\KtcsAqP.exe

Filesize
1.4MB

MD5
aba3baa75579298c554f2e6947a99956

SHA1
0f98f92303b25f08d9ac31b0532f2d3b0c17a972

SHA256
4ffad3fc48f110835f96a0604e6633fc48633db3f269da8f629cb3458634e0e6

SHA512
b99511cc318ce408871261497ead52cad164bf224098ab25151164a92c3990de950e36f44abdc3ac9507c5890a2b0cfd1a54bebf0c0afc4ea272b565ef572eab

Download Submit
C:\Windows\System\LuaUANf.exe

Filesize
1.4MB

MD5
d60af985c861bd1caac40c29cde39906

SHA1
0028d5266bc852e9eda066a05233d3c319ad575f

SHA256
25a157e997b02410b9eb096762b1b028329a6d7128b7313c3c9c17957cf0e93b

SHA512
b650d2890f59df4a1f3d526284a3e63352fb6f7a8fc95b4b3d1b018bf95b7ea61bceca82a0d581f4c5d768264ada4d5a67ef42b977995147210cec23d2366495

Download Submit
C:\Windows\System\PKOWwyZ.exe

Filesize
1.4MB

MD5
810d5bef459738996895d95e037391c4

SHA1
249309bd85dd3edc82436c0b1e795d868d15f869

SHA256
2358664a5b04ab48d39f33eee93cedc5070afa16e14895a8c0cc9b668ff80e25

SHA512
19681d74bdcbb8377888aefdf09b031ddd1677594bdb6f470bd5bacb8a785cd873e2ed9aade6bd2efe9b72be36d0f14a3bd2941332e4c6744e3d0ad14e099cdb

Download Submit
C:\Windows\System\QCFEKsU.exe

Filesize
1.4MB

MD5
1d115e66deaf5a7d88d91eb21e56c54b

SHA1
0863539585215b4b95194c0fe23d588277d7d65f

SHA256
ab89cd2b972979af3f625b4f5a2476230db3731e531003a1ed351e72d7a9ca8a

SHA512
e6f897ca2a65dced33a73f94b87fca233d7a700406dd38e9b9f7ecd7223456ab8a1e132f7c03de0b738bf8ca992511ef7c6d916806d22dc0a094f9c800aaead5

Download Submit
C:\Windows\System\QDGjaSK.exe

Filesize
18B

MD5
a308bab96af0d8b0405ced0df2e422de

SHA1
d1952ddc6ffadb32bc26dbd87f63673fe488019c

SHA256
8b1e86aaa211a5c5f8f89e89db4748f4041ce6a7eadabf706546f1da8a4c933b

SHA512
febe4ebe7f32e7b2ee0bea8360d9cfbd617f1e619f185f40ee924ced488e4b9c2a3a234ad49a740a246b10397b83d94709c1498bb18d2a41eaa09bad38561ccc

Download Submit
C:\Windows\System\QFMZtOn.exe

Filesize
1.4MB

MD5
8873a637eb1efa36558c7742d95d9b7c

SHA1
838f150349159b845115404cdff989ec901f7d41

SHA256
6a43734eeebdc9929b329df0c1a55d6e95d71d2047b378b759b6f390530e4155

SHA512
286587a6ba0e334cc3670e0d39acdb2a708fedbfe6433fe17104ecc43925390218bd9d613edb8cd911c62dc8c8fdcb34cbc17d70581f173dbe1be9830eb3e6b0

Download Submit
C:\Windows\System\RLRogfQ.exe

Filesize
1.4MB

MD5
0d39c7e584e902384d87315c6f1fdad2

SHA1
6704fb79e70c6b3fff5a7a1760134562d5dff8e0

SHA256
c660754fa5a61f4e1dcab09c2924e2c014eeb1a4a62515bf5d4ae2d729507eb0

SHA512
1a0a752bcfa504f4f930d5600b967a7a3f1984050cb90ee3e35788bf1f690c7e6adfb6cf34e854ee6e6dffc70e5d58700a6802519ab81561f6f5d675b522958b

Download Submit
C:\Windows\System\TZxkyUD.exe

Filesize
1.4MB

MD5
a7684f1bebd739eb8fcc4e943f1fcf50

SHA1
4788de6bbea4dbced78b4032e5175184c2ef524d

SHA256
4120eb0550043dc0be58ed5faff9851682482c5dbbca15160d66696fbee43ecd

SHA512
f8ca6b20c31837342cc6acc0de78c3b244e4ed4f94b3d17a91a53ce2f7cabf7a2623601feb138d015da38af64e8a1595b398eb4eb4e9a5456c062f3bb9535a9f

Download Submit
C:\Windows\System\UUOdwIK.exe

Filesize
1.4MB

MD5
5ccf194ebada5916cabce81c6835842c

SHA1
f8e5913f31c4690a416266eb2958ae2b3c03c581

SHA256
a7532387ba4c5ae796d9a02d086bb444170714ae31723702fff88d65b1e9625c

SHA512
b23c5224b14c2dd9850976b231a7fa0c7589beafdbc8f1f2eafa8bc3f8dbb126b0bc4ad5e17042ae9d3f3f3e0a7e0fae7e95a00e63e1588256230927760f4208

Download Submit
C:\Windows\System\UkdmcNL.exe

Filesize
1.4MB

MD5
624476091864df5cc7baefbbe3597b03

SHA1
a3cb3bc411e28665876d90fb0cd53e5369b9e380

SHA256
5b2c487d11f0f56a38027935b67874c2d163d3d59e28ade87ac6f20e9dd97655

SHA512
d6e09b737f16d3425367deb1fb5337b651dcf50da1719e049a789a49a3f2a221264692c9db715e2332a40b4486291e568708de4397e3dd2cedcd719df370827a

Download Submit
C:\Windows\System\VNhxvzh.exe

Filesize
1.4MB

MD5
200ed6b103ed1cc6d6d3c00f2f534593

SHA1
a1ade1cf8c94ef0c6a8a84acfd28b669b1f73987

SHA256
20f26b83c3aa6398f01efe1ace163cf1e07e46efd657a854b51674f9f9689061

SHA512
18a8464c254bc73ded3d56d711da609c6b8d7dd723f16143a37cb2c15b8b35ee3b6bf2038056b7fd83015d990a8036d29de047a902f8e8a69f3edc1cfbd0de78

Download Submit
C:\Windows\System\XEWaueX.exe

Filesize
1.4MB

MD5
7ee1f9d8852d96889deaae984eaabdb1

SHA1
41b5a1757c3687b8097dc7292323e56e71610329

SHA256
190982b36dd84c7c11512f4be53c557d9aeb3d14cfa18baae7f4c1023a95f0ed

SHA512
347d43f1f488612370ea82123caca72bb27ceedf245fafbfb49a1aabba95acc15bc9953b540c33a0a3fd0424067de02bc38f05c3dccd363c8e1e8983e65e95cc

Download Submit
C:\Windows\System\YWytdpo.exe

Filesize
1.4MB

MD5
ee736c9932a511ac5515cee562d5583c

SHA1
6081929df49059960548f3ba9389d71b743218a4

SHA256
96a9239cd07d01fecdfe91377b2b44412094f9b1a8208e0bcd53e29a8a5bfb24

SHA512
a5778a95d0af968b09a6401aa79368e133a41fd707e1371d59763ab1d79c5cdc7000389b89e247a123cbd1822986380477520ba51faa8ba631f409dcf494acd2

Download Submit
C:\Windows\System\YkyGMhU.exe

Filesize
1.4MB

MD5
1a11377edeeb39ee8d89dca8c50788d1

SHA1
e09bb854e4f3aae2f34d511c00075a59846fe500

SHA256
6ec2eca80690d0cddbb6ce2826ad3e7e2a49115991ebaec379995cd843641dad

SHA512
d551c19fc61c88c99bea0d381dd175488ca2ff63f165781aab23272240665a6195bc84b8985d8979da8b039bcd48e9fd07021fb4723a165f546e0c01c560c659

Download Submit
C:\Windows\System\bcONxpV.exe

Filesize
1.4MB

MD5
fa4661a22e2d87fe45668695b87fcde9

SHA1
043a9024207ecd944128a100b0672c6db5b03729

SHA256
e3f93cbced8315dcd5698570c5e39ae3228a96db4e25ade356bd0a5b446ab358

SHA512
939fcd7ccb546eac804d7d0305fda62c9655a958dc44abb75e6bae9afe163c3ced46eb87262e8f5c19dfcc0e4404175345385de8bbf3c2d33ed0e908b5a599de

Download Submit
C:\Windows\System\bowiCHL.exe

Filesize
1.4MB

MD5
177d7004cb151fb2b19440c77bb3a9f9

SHA1
e984e442bb34a3f9140aad7569d1c0116cec6d28

SHA256
382926ed93ef61dc0a568c77c8440ebf19bceb92915a9a8d9ba3e8c4631e164a

SHA512
ed7edab6a92a628437e8a6e1d76a399a2b387108fba280d6eefe70dc240064044c2ad9856c83b68088883329106c139040cb18b41ab04b03d9f00d45bcd50e70

Download Submit
C:\Windows\System\cCiZgHC.exe

Filesize
1.4MB

MD5
374076b67ecd34750e4fe35a63064004

SHA1
e27345f583a651d216dc0251b0211dd4d107156f

SHA256
1071dec406e06994bbebd122fe6daf5bd0586495f733459121b099bd23a28bfa

SHA512
e08803b6ce6e52a37c3653709ee3c9701d0c02f331379d23539c7a0e49f64dfa38da953c27a534d805489eb1db35b1e874c204667cd598b1ab1db22eed4a1885

Download Submit
C:\Windows\System\cjigtBN.exe

Filesize
1.4MB

MD5
11a374def6615e2295601e8ca9cc2f5a

SHA1
be8a00f9768c20090e2e45060cb4336a69734c84

SHA256
d27e81c0c9a1ed4349ffc2a55ca575fdbbf7b39a1d8005682a45398f38df2dc8

SHA512
6279ac4815db84beb828be444ad32e9bd5d05cd38fb65e35196af72837d24ef0abe9d736856ae0aeb8288fa70899c253ab27d76003ee5dfd530e146476e3c279

Download Submit
C:\Windows\System\faUtVcE.exe

Filesize
1.4MB

MD5
e1b1538f934d1e5efd08ede03462a459

SHA1
f53ee7a5a93a90f7e7578f4e54bfb979224e612b

SHA256
487b1896d14dcc3420571fcb8d65b839022a303e323aa62a189a505c76428a68

SHA512
5e535ba34bfcb0f911411b97f2c37d1162d05a2ed8e97668effd6ed16879a0b112832cdcbc365940e27bc2eb2f0662237231a6d246866b4024902b9e782d3b6c

Download Submit
C:\Windows\System\gKthhTj.exe

Filesize
1.4MB

MD5
dd221025d51eaed1abdaa07a96ed9970

SHA1
b88f27d849d9a8c4af0f468fe2082758294007bc

SHA256
c91ecc30cb86f8a46b8b24f12bbba3cd83a59e460611773348b83d54314880f6

SHA512
f7e9b07b1181623774f18e544a612ad6a0b1b001835097a7e704cfc5f498aed849b793d55e1037bad2cb944e4519a1bac24f0f25a88c8c73cdfbefb36c26e90c

Download Submit
C:\Windows\System\hEPtuya.exe

Filesize
1.4MB

MD5
1a7b32a897541b03932094450b7d840f

SHA1
e02d4eefa78f3ffba145d01b2709ca6ebde77bdc

SHA256
ea170b6c31a8bcc64ceac73bbbb09ac3b41a27c68dea8a11183f4f3af4461b2c

SHA512
8c94af6529edbdd7808f4d5bad21a72b45af9543eac8ac29309a4b1820698f06756e6ed40a45d4be9f0fc35da6b475c9be6de1356a2034cc0edb83fe0eb3c464

Download Submit
C:\Windows\System\hTezgRR.exe

Filesize
1.4MB

MD5
c03ebbb411b35bf24778c0fb795c5b5c

SHA1
03d82316c5c0121f647dc4962b9383dda55a1408

SHA256
72eaf9b900992c415bdd01e4d03de61ecb46d356c2daf936bfa9686fa366e6c3

SHA512
f1bf340b414cb9e3462ef522cbe63b348b57f8b24be951ebe0d19be2a136f449a93d6bb7e604b5ce951fd13de3503712b31e90473924527395e31a9e81c6fb73

Download Submit
C:\Windows\System\iazhNrK.exe

Filesize
1.4MB

MD5
cc0bfc70b727332199df2f855959e532

SHA1
351e0b36018f73d1e6202185c964fb4736554bb2

SHA256
6daeaedf01a12a0f2e68e1496d42e56aeab79ad32a8d68ced55d75258057c82c

SHA512
8fc1581deb24914f660354684b42668708d21bc96cb44626d1669f85e8fcd65dacc89c669ec95ba28e8291ce1fe31fa455765c5f7895e125e720204da2e30d74

Download Submit
C:\Windows\System\jCuXgxe.exe

Filesize
1.4MB

MD5
12f8fc9108381146af01c1e17e5a24cc

SHA1
3dcdfd98204dc10ec69eccfa8c9fffb8a5981c35

SHA256
ad8d3caa55e0873204eed9f8d702dd2a246991093c0aa27c9ab01363d1dad1ac

SHA512
5fbe0648025953bea4be81222f4d9a5f4e320a982d60593a41211c1ca4ed943f6352ef7fa5d8bb4b5d1f52b289b7207c8e13c7526daba57cdd70d1b88cce57d7

Download Submit
C:\Windows\System\lGwfZFy.exe

Filesize
1.4MB

MD5
aed887004dfe4670ad97c891fc2f214f

SHA1
fd617aee58ea53bbaf93f1af04bed1fc2d14ebde

SHA256
68879e610c652fbfd87493d8fd7f86abb34d68af55c92462cb628b29b990a9e0

SHA512
d0656918c4b1870951808403668165883424117a2f6b576419d88c7c703bfb0300ad730d0e104a29d12538cbb7d0b6b2ff80f5c9188712cc328d9d5b86e920e2

Download Submit
C:\Windows\System\lcCpDyh.exe

Filesize
1.4MB

MD5
d028d66c1be7942424752ad01aa99ff0

SHA1
afd4b780160dec139fd850f9d755e67e481db134

SHA256
602d3e5bfd7700769bdf226c2e29df05e9580b37a3983a62df2c24b861ecd429

SHA512
ba700462e307d271d2e7244d6c22f3321b90281a9fb94f66e0931f1ff4134b342072a9a6b009fcf307f6b609939f2d8f74600ec5c66c2f298dce145fc97aae30

Download Submit
C:\Windows\System\mAQOTdL.exe

Filesize
1.4MB

MD5
03a49ecdf2d1ba6ef16ac1d53dfcb0ef

SHA1
d23cf9580cf8ed4839306d0ff6baf71b04d4de55

SHA256
566515767b934e112ba789cdaae6375a4d5b3a0a56f50b84b8234f53680f5592

SHA512
a8fdb7f1ab6c2e82f262ad208d47f71caa80200b25d9b4269fad2a798817e827a1df980223e4712e3bb53edaefd49e45c3acc75725721a98106df14ee508878d

Download Submit
C:\Windows\System\mAZSwSh.exe

Filesize
1.4MB

MD5
2fae4fbd5b98bab2477081320a56e5d4

SHA1
ce27a42e685efd293cbd539ad1ca03ba51a7f954

SHA256
36bfe06ae01efcde44ba578c7e9b5917a53377af0cc1ec08790d456047f976fe

SHA512
6ba29843edb05d5d4bad80a5639cab36b6eb90a250df7b9f638fca58f2c0f7807752127026f35f05b7d2e876cb4d9ad7bf42583a4d99fcf7e88967e9d2a43fdb

Download Submit
C:\Windows\System\nlWsTzR.exe

Filesize
1.4MB

MD5
3a440beb9e9e41e6460dedc2324fd214

SHA1
97bd368976d6ad9aa8514501fb141f98b9b8a3e1

SHA256
fef51525dff10d21518be8bd85e19e7d6e9e66f35a0d45fa91c3e59e344b85fc

SHA512
88ccd21f32fc8898b56dfb0228ff742cb3c5adb2c474cfd54f1324c31c0a532e29331decfa4a11148cc287d7bb1cb1d1c82f9124580977f6bda4924e6cc5af7d

Download Submit
C:\Windows\System\qqItooU.exe

Filesize
1.4MB

MD5
a97783b50258f3d2989440513d0a5c08

SHA1
87cb4d416af2171232c3852602520b55d8fba651

SHA256
75f862f38c0c090b89e3ba0f6de708ae7fe5ef49d8f8312fe4b52e4734910ddd

SHA512
cdbe536afd1a54e2ebf8b08107c285c33ff554d4653d1fd23c75e52358640fbfc3f31a2b827e7eb46433dd84dd1b17a4f6d500dbaa1a5f2e20b43410688af0b2

Download Submit
C:\Windows\System\rsykhqC.exe

Filesize
1.4MB

MD5
98c39a5951b02a3b29d63fc946bcd5b1

SHA1
891fca875cf828b0081a3e7dc052eaa46461f000

SHA256
9bfafd2eca65a27c0c21143da60edc29a905f14a8eddd4d6f69eb3a2a8139f23

SHA512
e0aeb2a98dd3ffda34a2f3f8654c78454706e762349e53501877b2203ade6e2cb81643d29b2207138dec6b8ee98faf375c46a9295992fc7bd838cd83e766f8ef

Download Submit
C:\Windows\System\shWxrqi.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\uqVYvTr.exe

Filesize
1.4MB

MD5
d4960e5c52933b1fc3aaa28161576f9b

SHA1
b4b10a0ec270298adc97e6a86f4943ccbd3f0d7b

SHA256
12d0e584030ad560aa65dcd02af68f0422d935c155b6f665cf28bec8f2b4e78b

SHA512
5a238c1fc2c3d61fa19cc91f396cd2173ad24e0ef5f70b1a9648f3924fc35b81dbfe3acf62dea55f88fc192d31d701ad1cf39a75c35712a7a3f32d691ac6e453

Download Submit
C:\Windows\System\wdSfRUf.exe

Filesize
1.4MB

MD5
3b3541826117a545d8b4454d207f8e6d

SHA1
cef65fc44c3ed793a1f149d9b79077c8a3e16406

SHA256
fe09d4fa3dd4a7f95468deaf55e5a44dfa0cdf71efff6debf2a287a2d6004aa9

SHA512
66c983ef80faa1104670376f805abdd1ca3e4f295a3fc3bb57a004114e593d8a477869aa31e40a4bcb1d4e737054c0ab204036cdb11032c7e2c797ce2c663768

Download Submit
C:\Windows\System\yWoWdzf.exe

Filesize
1.4MB

MD5
701028185f68e8e822343e373680eb8a

SHA1
7b8e223692e5b24874e60ec9a03eb90fa7969aeb

SHA256
bbbb6c101f6a1d163aacd35cb3d322d07b1a220fae2f69278ee67440ab660c3e

SHA512
985246b0242b722af19dad571284c19ccfb0a735685329aec278b2bea5fe6cc07199bc0badfe7f1f8ebdebcde9c54b2e29d2f48fbeff8a46cfd115c72049cc0a

Download Submit
memory/8-6100-0x00007FF7B1780000-0x00007FF7B1B72000-memory.dmp

Filesize
3.9MB

Download
memory/8-605-0x00007FF7B1780000-0x00007FF7B1B72000-memory.dmp

Filesize
3.9MB

Download
memory/548-6004-0x00007FF77CD20000-0x00007FF77D112000-memory.dmp

Filesize
3.9MB

Download
memory/548-312-0x00007FF77CD20000-0x00007FF77D112000-memory.dmp

Filesize
3.9MB

Download
memory/1656-1676-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-5872-0x00007FF6CBAF0000-0x00007FF6CBEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-1304-0x00007FF6B1DE0000-0x00007FF6B21D2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-6102-0x00007FF6B1DE0000-0x00007FF6B21D2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-319-0x00007FF68C4D0000-0x00007FF68C8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-6030-0x00007FF68C4D0000-0x00007FF68C8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-257-0x00007FF6566B0000-0x00007FF656AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-6751-0x00007FF73F420000-0x00007FF73F812000-memory.dmp

Filesize
3.9MB

Download
memory/2056-1-0x00000258A5FB0000-0x00000258A5FC0000-memory.dmp

Filesize
64KB

Download
memory/2056-0-0x00007FF73F420000-0x00007FF73F812000-memory.dmp

Filesize
3.9MB

Download
memory/2308-5883-0x00007FF6BA860000-0x00007FF6BAC52000-memory.dmp

Filesize
3.9MB

Download
memory/2308-121-0x00007FF6BA860000-0x00007FF6BAC52000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5983-0x00007FF7A7ED0000-0x00007FF7A82C2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1679-0x00007FF7A7ED0000-0x00007FF7A82C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-5882-0x00007FF7E60D0000-0x00007FF7E64C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-88-0x00007FF7E60D0000-0x00007FF7E64C2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-6019-0x00007FF7EC1A0000-0x00007FF7EC592000-memory.dmp

Filesize
3.9MB

Download
memory/2892-316-0x00007FF7EC1A0000-0x00007FF7EC592000-memory.dmp

Filesize
3.9MB

Download
memory/3400-6009-0x00007FF6C44F0000-0x00007FF6C48E2000-memory.dmp

Filesize
3.9MB

Download
memory/3400-494-0x00007FF6C44F0000-0x00007FF6C48E2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-51-0x00007FFB68930000-0x00007FFB693F1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-35-0x00007FFB68930000-0x00007FFB693F1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-2167-0x00007FFB68930000-0x00007FFB693F1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-9-0x00007FFB68933000-0x00007FFB68935000-memory.dmp

Filesize
8KB

Download
memory/3460-32-0x000001A4E26D0000-0x000001A4E26F2000-memory.dmp

Filesize
136KB

Download
memory/3728-165-0x00007FF6FDBE0000-0x00007FF6FDFD2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-307-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp

Filesize
3.9MB

Download
memory/4312-5991-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp

Filesize
3.9MB

Download
memory/4616-38-0x00007FF7BDAA0000-0x00007FF7BDE92000-memory.dmp

Filesize
3.9MB

Download
memory/4880-169-0x00007FF69E9D0000-0x00007FF69EDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-5939-0x00007FF69E9D0000-0x00007FF69EDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-346-0x00007FF727A10000-0x00007FF727E02000-memory.dmp

Filesize
3.9MB

Download
memory/4884-6064-0x00007FF727A10000-0x00007FF727E02000-memory.dmp

Filesize
3.9MB

Download
memory/4948-313-0x00007FF7D1340000-0x00007FF7D1732000-memory.dmp

Filesize
3.9MB

Download
memory/4948-6061-0x00007FF7D1340000-0x00007FF7D1732000-memory.dmp

Filesize
3.9MB

Download
memory/4972-5985-0x00007FF61C1C0000-0x00007FF61C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-314-0x00007FF61C1C0000-0x00007FF61C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-71-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp

Filesize
3.9MB

Download
memory/5004-5874-0x00007FF6DDCA0000-0x00007FF6DE092000-memory.dmp

Filesize
3.9MB

Download
memory/5064-5950-0x00007FF680600000-0x00007FF6809F2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-214-0x00007FF680600000-0x00007FF6809F2000-memory.dmp

Filesize
3.9MB

Download