xmrig | 229b5359d8ff19465d9e26298c78567d9423f28597898eb1b491392b1e70702a

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 09:14 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
Size

2.2MB
MD5

102a823e199cc4e4ac7cc155c58accc4
SHA1

a9e62f6d46955791547b9be91cf5045b16ef68bc
SHA256

229b5359d8ff19465d9e26298c78567d9423f28597898eb1b491392b1e70702a
SHA512

04000e035c8f9c5a38e8ba48b1c5390434614b4a18ac16bc28f919836a6b0fd6d3ca98c0dfcf2e51c21479482e52f7a274c4d8017ebc17babeb5c60403a00543
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfF:NABS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/3360-393-0x00007FF7188D0000-0x00007FF718CC2000-memory.dmp	xmrig
behavioral2/memory/4896-469-0x00007FF6D9790000-0x00007FF6D9B82000-memory.dmp	xmrig
behavioral2/memory/4668-518-0x00007FF6FC0B0000-0x00007FF6FC4A2000-memory.dmp	xmrig
behavioral2/memory/2460-521-0x00007FF6BC170000-0x00007FF6BC562000-memory.dmp	xmrig
behavioral2/memory/3112-702-0x00007FF600530000-0x00007FF600922000-memory.dmp	xmrig
behavioral2/memory/4544-631-0x00007FF76F0F0000-0x00007FF76F4E2000-memory.dmp	xmrig
behavioral2/memory/2436-522-0x00007FF60AF90000-0x00007FF60B382000-memory.dmp	xmrig
behavioral2/memory/1104-519-0x00007FF6C0450000-0x00007FF6C0842000-memory.dmp	xmrig
behavioral2/memory/4980-517-0x00007FF655AB0000-0x00007FF655EA2000-memory.dmp	xmrig
behavioral2/memory/2820-516-0x00007FF6112A0000-0x00007FF611692000-memory.dmp	xmrig
behavioral2/memory/1888-515-0x00007FF77EA80000-0x00007FF77EE72000-memory.dmp	xmrig
behavioral2/memory/4220-514-0x00007FF69F410000-0x00007FF69F802000-memory.dmp	xmrig
behavioral2/memory/1540-513-0x00007FF73A900000-0x00007FF73ACF2000-memory.dmp	xmrig
behavioral2/memory/1928-511-0x00007FF6ED890000-0x00007FF6EDC82000-memory.dmp	xmrig
behavioral2/memory/4988-390-0x00007FF786620000-0x00007FF786A12000-memory.dmp	xmrig
behavioral2/memory/2276-343-0x00007FF6DFE00000-0x00007FF6E01F2000-memory.dmp	xmrig
behavioral2/memory/2000-289-0x00007FF7BF950000-0x00007FF7BFD42000-memory.dmp	xmrig
behavioral2/memory/2832-245-0x00007FF674F40000-0x00007FF675332000-memory.dmp	xmrig
behavioral2/memory/4072-204-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	xmrig
behavioral2/memory/1096-189-0x00007FF6D1690000-0x00007FF6D1A82000-memory.dmp	xmrig
behavioral2/memory/4876-138-0x00007FF7BC0F0000-0x00007FF7BC4E2000-memory.dmp	xmrig
behavioral2/memory/2232-102-0x00007FF678C20000-0x00007FF679012000-memory.dmp	xmrig
behavioral2/memory/3856-83-0x00007FF7BA5E0000-0x00007FF7BA9D2000-memory.dmp	xmrig
behavioral2/memory/4476-59-0x00007FF720B60000-0x00007FF720F52000-memory.dmp	xmrig
behavioral2/memory/3856-4568-0x00007FF7BA5E0000-0x00007FF7BA9D2000-memory.dmp	xmrig
behavioral2/memory/2232-4570-0x00007FF678C20000-0x00007FF679012000-memory.dmp	xmrig
behavioral2/memory/4876-4605-0x00007FF7BC0F0000-0x00007FF7BC4E2000-memory.dmp	xmrig
behavioral2/memory/4072-4621-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	xmrig
behavioral2/memory/2000-4627-0x00007FF7BF950000-0x00007FF7BFD42000-memory.dmp	xmrig
behavioral2/memory/4988-4642-0x00007FF786620000-0x00007FF786A12000-memory.dmp	xmrig
behavioral2/memory/4544-4645-0x00007FF76F0F0000-0x00007FF76F4E2000-memory.dmp	xmrig
behavioral2/memory/2460-4652-0x00007FF6BC170000-0x00007FF6BC562000-memory.dmp	xmrig
behavioral2/memory/2820-4666-0x00007FF6112A0000-0x00007FF611692000-memory.dmp	xmrig
behavioral2/memory/4220-4680-0x00007FF69F410000-0x00007FF69F802000-memory.dmp	xmrig
behavioral2/memory/3112-4685-0x00007FF600530000-0x00007FF600922000-memory.dmp	xmrig
behavioral2/memory/1104-4689-0x00007FF6C0450000-0x00007FF6C0842000-memory.dmp	xmrig
behavioral2/memory/1928-4682-0x00007FF6ED890000-0x00007FF6EDC82000-memory.dmp	xmrig
behavioral2/memory/4668-4675-0x00007FF6FC0B0000-0x00007FF6FC4A2000-memory.dmp	xmrig
behavioral2/memory/4980-4671-0x00007FF655AB0000-0x00007FF655EA2000-memory.dmp	xmrig
behavioral2/memory/1888-4663-0x00007FF77EA80000-0x00007FF77EE72000-memory.dmp	xmrig
behavioral2/memory/2436-4661-0x00007FF60AF90000-0x00007FF60B382000-memory.dmp	xmrig
behavioral2/memory/4896-4648-0x00007FF6D9790000-0x00007FF6D9B82000-memory.dmp	xmrig
behavioral2/memory/1540-4640-0x00007FF73A900000-0x00007FF73ACF2000-memory.dmp	xmrig
behavioral2/memory/3360-4630-0x00007FF7188D0000-0x00007FF718CC2000-memory.dmp	xmrig
behavioral2/memory/2276-4635-0x00007FF6DFE00000-0x00007FF6E01F2000-memory.dmp	xmrig
behavioral2/memory/2832-4634-0x00007FF674F40000-0x00007FF675332000-memory.dmp	xmrig
behavioral2/memory/5000-5169-0x00007FF68BC50000-0x00007FF68C042000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3260	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4476	INOaBBi.exe
3856	sJqoQca.exe
2232	bFEHTvs.exe
4876	lkLLEmT.exe
1096	xoewhMF.exe
4072	GZyzKJl.exe
2832	tBlkobs.exe
2000	WPdnPEQ.exe
2276	rprJkzf.exe
4988	tumOvLh.exe
2460	DGEpRjP.exe
3360	oZaUgXn.exe
2436	kdUgdpj.exe
4896	ScnlVYy.exe
1928	JRiVxQP.exe
1540	zkkyzSY.exe
4544	wZVTjaW.exe
4220	mhjdQpf.exe
1888	qLMPfGV.exe
2820	FcAvsSi.exe
4980	lAFPxRe.exe
4668	JEhXeKh.exe
3112	DlOEkxR.exe
1104	olLJgpx.exe
224	mDHaqMS.exe
324	BNMslXo.exe
1132	KAxtDwy.exe
2268	MJbQRLf.exe
1100	lDAXLen.exe
2240	cQUFqCr.exe
2980	cRbYLWx.exe
4264	mAnjmdq.exe
4984	cZVklwW.exe
3952	HcYcSeu.exe
848	qFxgWKL.exe
5084	gwwqoUg.exe
5060	cwmPLjm.exe
1456	JXYfvjK.exe
3128	mdOegrp.exe
4492	aPFtJJV.exe
3140	GVpCCEp.exe
3820	wKpWZmP.exe
3672	BcmqNfy.exe
1516	NveIdPo.exe
2712	ZhgXxVy.exe
3092	PlSEPTu.exe
4796	KCKbkZx.exe
1924	ZKftOBY.exe
2076	RYMzQjt.exe
2096	JuSuTmw.exe
1884	RQGunkY.exe
5068	KGpmRtG.exe
4628	TEHkkEF.exe
4316	UDeSUmi.exe
4732	uvuuywp.exe
5080	QNRrhic.exe
1656	unLnQLJ.exe
768	HpsvFon.exe
4944	siiBIAl.exe
3108	HInrMKy.exe
3824	udhFRau.exe
4516	iKClnCY.exe
1572	CMzBLOV.exe
4172	dZEMWJL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF68BC50000-0x00007FF68C042000-memory.dmp	upx
behavioral2/files/0x000b000000023b79-7.dat	upx
behavioral2/files/0x000a000000023b7e-6.dat	upx
behavioral2/files/0x000a000000023b7f-15.dat	upx
behavioral2/files/0x000a000000023b83-39.dat	upx
behavioral2/files/0x000a000000023b89-111.dat	upx
behavioral2/files/0x000a000000023ba3-193.dat	upx
behavioral2/memory/3360-393-0x00007FF7188D0000-0x00007FF718CC2000-memory.dmp	upx
behavioral2/memory/4896-469-0x00007FF6D9790000-0x00007FF6D9B82000-memory.dmp	upx
behavioral2/memory/4668-518-0x00007FF6FC0B0000-0x00007FF6FC4A2000-memory.dmp	upx
behavioral2/memory/2460-521-0x00007FF6BC170000-0x00007FF6BC562000-memory.dmp	upx
behavioral2/memory/3112-702-0x00007FF600530000-0x00007FF600922000-memory.dmp	upx
behavioral2/memory/4544-631-0x00007FF76F0F0000-0x00007FF76F4E2000-memory.dmp	upx
behavioral2/memory/2436-522-0x00007FF60AF90000-0x00007FF60B382000-memory.dmp	upx
behavioral2/memory/1104-519-0x00007FF6C0450000-0x00007FF6C0842000-memory.dmp	upx
behavioral2/memory/4980-517-0x00007FF655AB0000-0x00007FF655EA2000-memory.dmp	upx
behavioral2/memory/2820-516-0x00007FF6112A0000-0x00007FF611692000-memory.dmp	upx
behavioral2/memory/1888-515-0x00007FF77EA80000-0x00007FF77EE72000-memory.dmp	upx
behavioral2/memory/4220-514-0x00007FF69F410000-0x00007FF69F802000-memory.dmp	upx
behavioral2/memory/1540-513-0x00007FF73A900000-0x00007FF73ACF2000-memory.dmp	upx
behavioral2/memory/1928-511-0x00007FF6ED890000-0x00007FF6EDC82000-memory.dmp	upx
behavioral2/memory/4988-390-0x00007FF786620000-0x00007FF786A12000-memory.dmp	upx
behavioral2/memory/2276-343-0x00007FF6DFE00000-0x00007FF6E01F2000-memory.dmp	upx
behavioral2/memory/2000-289-0x00007FF7BF950000-0x00007FF7BFD42000-memory.dmp	upx
behavioral2/memory/2832-245-0x00007FF674F40000-0x00007FF675332000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-211.dat	upx
behavioral2/files/0x000a000000023ba5-210.dat	upx
behavioral2/files/0x000a000000023b92-205.dat	upx
behavioral2/memory/4072-204-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-196.dat	upx
behavioral2/files/0x000a000000023ba2-192.dat	upx
behavioral2/files/0x000a000000023ba1-191.dat	upx
behavioral2/memory/1096-189-0x00007FF6D1690000-0x00007FF6D1A82000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-177.dat	upx
behavioral2/files/0x000b000000023b7a-175.dat	upx
behavioral2/files/0x000a000000023b9b-174.dat	upx
behavioral2/files/0x000a000000023b9a-173.dat	upx
behavioral2/files/0x000a000000023b91-165.dat	upx
behavioral2/files/0x000a000000023b99-164.dat	upx
behavioral2/files/0x000a000000023b8c-160.dat	upx
behavioral2/files/0x000a000000023b98-151.dat	upx
behavioral2/files/0x000a000000023b8f-148.dat	upx
behavioral2/files/0x000a000000023b97-144.dat	upx
behavioral2/memory/4876-138-0x00007FF7BC0F0000-0x00007FF7BC4E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-132.dat	upx
behavioral2/files/0x000a000000023b95-129.dat	upx
behavioral2/files/0x000a000000023b9c-176.dat	upx
behavioral2/files/0x000a000000023b88-126.dat	upx
behavioral2/files/0x000a000000023b8d-169.dat	upx
behavioral2/files/0x000a000000023b90-154.dat	upx
behavioral2/files/0x000a000000023b8a-114.dat	upx
behavioral2/files/0x000a000000023b8e-105.dat	upx
behavioral2/memory/2232-102-0x00007FF678C20000-0x00007FF679012000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-123.dat	upx
behavioral2/files/0x000a000000023b93-119.dat	upx
behavioral2/files/0x000a000000023b86-86.dat	upx
behavioral2/files/0x000a000000023b8b-82.dat	upx
behavioral2/files/0x000a000000023b87-74.dat	upx
behavioral2/files/0x000a000000023b85-73.dat	upx
behavioral2/files/0x000a000000023b84-72.dat	upx
behavioral2/files/0x000a000000023b82-71.dat	upx
behavioral2/memory/3856-83-0x00007FF7BA5E0000-0x00007FF7BA9D2000-memory.dmp	upx
behavioral2/memory/4476-59-0x00007FF720B60000-0x00007FF720F52000-memory.dmp	upx
behavioral2/files/0x000a000000023b81-50.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OBkQelw.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\qLAeduq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\hjIScfM.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\uCcjEKZ.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\TdHwdEr.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\WVjWvXV.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\nCZhgNO.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\AwRmuUO.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\NVGyWic.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\wyRMDYv.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\npkgldc.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\RNLjvVZ.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\hcVqfkq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\tEQTJzF.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\YlJYtoh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\vAmGBUk.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ZDmVqEF.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\lApvHVS.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\HnycFHg.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\CyYuKMq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\iKZcTaj.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\AYQGnDI.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\XWiNJcT.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\RvjaYgE.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\GDIudwp.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kvFrmTt.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\JRUxqBG.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\slZyeyP.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\SNTwrXD.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\rrQusha.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\LQZlHNc.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\Eivhqpe.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\VlVmGFq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\rMbtOML.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\OfpIHfY.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\uQiOKwl.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\FYKtpGg.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\DIRVNSn.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\DgFSFqf.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\TNWlLsa.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\yFFIVce.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\VDEqMGh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\qwmZJCS.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\jIgLjnU.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\WGwIPYy.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\lDEJdBX.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\TJzXKod.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\uvyJDPa.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kQvPhpn.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\HOTwlik.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\DhNTcdW.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\RSKbFIf.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\dDseyRK.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\LyrZfHT.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\SrwBvvO.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\NLhGzVK.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\EcsEdEj.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\XBDHyVJ.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\YFZcJPG.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\YxPTfia.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\OVNALCB.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\AIlDzhG.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\AjuSItP.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\PXnePPs.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe
3260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeLockMemoryPrivilege	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3260	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	84
PID 5000 wrote to memory of 3260	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	84
PID 5000 wrote to memory of 4476	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	85
PID 5000 wrote to memory of 4476	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	85
PID 5000 wrote to memory of 3856	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	86
PID 5000 wrote to memory of 3856	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	86
PID 5000 wrote to memory of 2232	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	87
PID 5000 wrote to memory of 2232	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	87
PID 5000 wrote to memory of 4876	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	88
PID 5000 wrote to memory of 4876	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	88
PID 5000 wrote to memory of 1096	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	89
PID 5000 wrote to memory of 1096	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	89
PID 5000 wrote to memory of 4072	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	90
PID 5000 wrote to memory of 4072	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	90
PID 5000 wrote to memory of 2832	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	91
PID 5000 wrote to memory of 2832	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	91
PID 5000 wrote to memory of 2000	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	92
PID 5000 wrote to memory of 2000	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	92
PID 5000 wrote to memory of 2276	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	93
PID 5000 wrote to memory of 2276	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	93
PID 5000 wrote to memory of 4988	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	94
PID 5000 wrote to memory of 4988	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	94
PID 5000 wrote to memory of 2460	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	95
PID 5000 wrote to memory of 2460	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	95
PID 5000 wrote to memory of 3360	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	96
PID 5000 wrote to memory of 3360	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	96
PID 5000 wrote to memory of 2436	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	97
PID 5000 wrote to memory of 2436	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	97
PID 5000 wrote to memory of 4896	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	98
PID 5000 wrote to memory of 4896	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	98
PID 5000 wrote to memory of 1928	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	99
PID 5000 wrote to memory of 1928	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	99
PID 5000 wrote to memory of 1540	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	100
PID 5000 wrote to memory of 1540	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	100
PID 5000 wrote to memory of 2820	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	101
PID 5000 wrote to memory of 2820	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	101
PID 5000 wrote to memory of 4980	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	102
PID 5000 wrote to memory of 4980	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	102
PID 5000 wrote to memory of 4544	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	103
PID 5000 wrote to memory of 4544	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	103
PID 5000 wrote to memory of 4220	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	104
PID 5000 wrote to memory of 4220	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	104
PID 5000 wrote to memory of 1888	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	105
PID 5000 wrote to memory of 1888	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	105
PID 5000 wrote to memory of 4668	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	106
PID 5000 wrote to memory of 4668	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	106
PID 5000 wrote to memory of 3112	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	107
PID 5000 wrote to memory of 3112	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	107
PID 5000 wrote to memory of 1104	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	108
PID 5000 wrote to memory of 1104	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	108
PID 5000 wrote to memory of 224	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	109
PID 5000 wrote to memory of 224	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	109
PID 5000 wrote to memory of 324	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	110
PID 5000 wrote to memory of 324	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	110
PID 5000 wrote to memory of 1132	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	111
PID 5000 wrote to memory of 1132	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	111
PID 5000 wrote to memory of 2268	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	112
PID 5000 wrote to memory of 2268	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	112
PID 5000 wrote to memory of 1100	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	113
PID 5000 wrote to memory of 1100	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	113
PID 5000 wrote to memory of 2240	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	114
PID 5000 wrote to memory of 2240	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	114
PID 5000 wrote to memory of 2980	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	115
PID 5000 wrote to memory of 2980	5000	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\System\INOaBBi.exe
  C:\Windows\System\INOaBBi.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\sJqoQca.exe
  C:\Windows\System\sJqoQca.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\bFEHTvs.exe
  C:\Windows\System\bFEHTvs.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\lkLLEmT.exe
  C:\Windows\System\lkLLEmT.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\xoewhMF.exe
  C:\Windows\System\xoewhMF.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\GZyzKJl.exe
  C:\Windows\System\GZyzKJl.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\tBlkobs.exe
  C:\Windows\System\tBlkobs.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\WPdnPEQ.exe
  C:\Windows\System\WPdnPEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\rprJkzf.exe
  C:\Windows\System\rprJkzf.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\tumOvLh.exe
  C:\Windows\System\tumOvLh.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\DGEpRjP.exe
  C:\Windows\System\DGEpRjP.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\oZaUgXn.exe
  C:\Windows\System\oZaUgXn.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\kdUgdpj.exe
  C:\Windows\System\kdUgdpj.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ScnlVYy.exe
  C:\Windows\System\ScnlVYy.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\JRiVxQP.exe
  C:\Windows\System\JRiVxQP.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\zkkyzSY.exe
  C:\Windows\System\zkkyzSY.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\FcAvsSi.exe
  C:\Windows\System\FcAvsSi.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\lAFPxRe.exe
  C:\Windows\System\lAFPxRe.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\wZVTjaW.exe
  C:\Windows\System\wZVTjaW.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\mhjdQpf.exe
  C:\Windows\System\mhjdQpf.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\qLMPfGV.exe
  C:\Windows\System\qLMPfGV.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\JEhXeKh.exe
  C:\Windows\System\JEhXeKh.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DlOEkxR.exe
  C:\Windows\System\DlOEkxR.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\olLJgpx.exe
  C:\Windows\System\olLJgpx.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\mDHaqMS.exe
  C:\Windows\System\mDHaqMS.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\BNMslXo.exe
  C:\Windows\System\BNMslXo.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\KAxtDwy.exe
  C:\Windows\System\KAxtDwy.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\MJbQRLf.exe
  C:\Windows\System\MJbQRLf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\lDAXLen.exe
  C:\Windows\System\lDAXLen.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\cQUFqCr.exe
  C:\Windows\System\cQUFqCr.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\cRbYLWx.exe
  C:\Windows\System\cRbYLWx.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\mAnjmdq.exe
  C:\Windows\System\mAnjmdq.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\cZVklwW.exe
  C:\Windows\System\cZVklwW.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\HcYcSeu.exe
  C:\Windows\System\HcYcSeu.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\qFxgWKL.exe
  C:\Windows\System\qFxgWKL.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\PlSEPTu.exe
  C:\Windows\System\PlSEPTu.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\gwwqoUg.exe
  C:\Windows\System\gwwqoUg.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\cwmPLjm.exe
  C:\Windows\System\cwmPLjm.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\JXYfvjK.exe
  C:\Windows\System\JXYfvjK.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\mdOegrp.exe
  C:\Windows\System\mdOegrp.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\aPFtJJV.exe
  C:\Windows\System\aPFtJJV.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\GVpCCEp.exe
  C:\Windows\System\GVpCCEp.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\wKpWZmP.exe
  C:\Windows\System\wKpWZmP.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\BcmqNfy.exe
  C:\Windows\System\BcmqNfy.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\NveIdPo.exe
  C:\Windows\System\NveIdPo.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\ZhgXxVy.exe
  C:\Windows\System\ZhgXxVy.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\KCKbkZx.exe
  C:\Windows\System\KCKbkZx.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ZKftOBY.exe
  C:\Windows\System\ZKftOBY.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\RYMzQjt.exe
  C:\Windows\System\RYMzQjt.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JuSuTmw.exe
  C:\Windows\System\JuSuTmw.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\RQGunkY.exe
  C:\Windows\System\RQGunkY.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\KGpmRtG.exe
  C:\Windows\System\KGpmRtG.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\TEHkkEF.exe
  C:\Windows\System\TEHkkEF.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\UDeSUmi.exe
  C:\Windows\System\UDeSUmi.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\uvuuywp.exe
  C:\Windows\System\uvuuywp.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\QNRrhic.exe
  C:\Windows\System\QNRrhic.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\unLnQLJ.exe
  C:\Windows\System\unLnQLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\HpsvFon.exe
  C:\Windows\System\HpsvFon.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\siiBIAl.exe
  C:\Windows\System\siiBIAl.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\iKtrfBK.exe
  C:\Windows\System\iKtrfBK.exe
  2⤵
  PID:4340
- C:\Windows\System\HInrMKy.exe
  C:\Windows\System\HInrMKy.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\udhFRau.exe
  C:\Windows\System\udhFRau.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\iKClnCY.exe
  C:\Windows\System\iKClnCY.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\CMzBLOV.exe
  C:\Windows\System\CMzBLOV.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\dZEMWJL.exe
  C:\Windows\System\dZEMWJL.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\teycFBj.exe
  C:\Windows\System\teycFBj.exe
  2⤵
  PID:3916
- C:\Windows\System\PzDXmDL.exe
  C:\Windows\System\PzDXmDL.exe
  2⤵
  PID:2756
- C:\Windows\System\fuaHNCZ.exe
  C:\Windows\System\fuaHNCZ.exe
  2⤵
  PID:4260
- C:\Windows\System\gcJwYoU.exe
  C:\Windows\System\gcJwYoU.exe
  2⤵
  PID:4900
- C:\Windows\System\QMPxSro.exe
  C:\Windows\System\QMPxSro.exe
  2⤵
  PID:4308
- C:\Windows\System\usTeMUh.exe
  C:\Windows\System\usTeMUh.exe
  2⤵
  PID:3960
- C:\Windows\System\VCSWFou.exe
  C:\Windows\System\VCSWFou.exe
  2⤵
  PID:884
- C:\Windows\System\ktpRtuR.exe
  C:\Windows\System\ktpRtuR.exe
  2⤵
  PID:4120
- C:\Windows\System\eGLEInX.exe
  C:\Windows\System\eGLEInX.exe
  2⤵
  PID:3716
- C:\Windows\System\BravaFY.exe
  C:\Windows\System\BravaFY.exe
  2⤵
  PID:5128
- C:\Windows\System\vqJBThV.exe
  C:\Windows\System\vqJBThV.exe
  2⤵
  PID:5148
- C:\Windows\System\DnWZkdi.exe
  C:\Windows\System\DnWZkdi.exe
  2⤵
  PID:5176
- C:\Windows\System\SfKPYRZ.exe
  C:\Windows\System\SfKPYRZ.exe
  2⤵
  PID:5204
- C:\Windows\System\bCdWfKD.exe
  C:\Windows\System\bCdWfKD.exe
  2⤵
  PID:5224
- C:\Windows\System\NQDFYuJ.exe
  C:\Windows\System\NQDFYuJ.exe
  2⤵
  PID:5248
- C:\Windows\System\lNocEhs.exe
  C:\Windows\System\lNocEhs.exe
  2⤵
  PID:5280
- C:\Windows\System\VgmNOsS.exe
  C:\Windows\System\VgmNOsS.exe
  2⤵
  PID:5296
- C:\Windows\System\KUoDodW.exe
  C:\Windows\System\KUoDodW.exe
  2⤵
  PID:5324
- C:\Windows\System\toGvmyh.exe
  C:\Windows\System\toGvmyh.exe
  2⤵
  PID:5340
- C:\Windows\System\vRsfEvq.exe
  C:\Windows\System\vRsfEvq.exe
  2⤵
  PID:5364
- C:\Windows\System\VsbARfu.exe
  C:\Windows\System\VsbARfu.exe
  2⤵
  PID:5384
- C:\Windows\System\vGrmgyY.exe
  C:\Windows\System\vGrmgyY.exe
  2⤵
  PID:5408
- C:\Windows\System\iLfBZbx.exe
  C:\Windows\System\iLfBZbx.exe
  2⤵
  PID:5428
- C:\Windows\System\HZsKWzo.exe
  C:\Windows\System\HZsKWzo.exe
  2⤵
  PID:5484
- C:\Windows\System\WRVuvVq.exe
  C:\Windows\System\WRVuvVq.exe
  2⤵
  PID:5500
- C:\Windows\System\paeiRxu.exe
  C:\Windows\System\paeiRxu.exe
  2⤵
  PID:5544
- C:\Windows\System\vYRFEek.exe
  C:\Windows\System\vYRFEek.exe
  2⤵
  PID:5560
- C:\Windows\System\sQEdugB.exe
  C:\Windows\System\sQEdugB.exe
  2⤵
  PID:5576
- C:\Windows\System\EsKLmTt.exe
  C:\Windows\System\EsKLmTt.exe
  2⤵
  PID:5604
- C:\Windows\System\lXRsEMD.exe
  C:\Windows\System\lXRsEMD.exe
  2⤵
  PID:5624
- C:\Windows\System\XijyxSF.exe
  C:\Windows\System\XijyxSF.exe
  2⤵
  PID:5648
- C:\Windows\System\EBMbRcA.exe
  C:\Windows\System\EBMbRcA.exe
  2⤵
  PID:5688
- C:\Windows\System\gJqtDdH.exe
  C:\Windows\System\gJqtDdH.exe
  2⤵
  PID:5712
- C:\Windows\System\LgClNgl.exe
  C:\Windows\System\LgClNgl.exe
  2⤵
  PID:5728
- C:\Windows\System\QWKIQIC.exe
  C:\Windows\System\QWKIQIC.exe
  2⤵
  PID:5752
- C:\Windows\System\RqnFWkI.exe
  C:\Windows\System\RqnFWkI.exe
  2⤵
  PID:5772
- C:\Windows\System\FLsZTGz.exe
  C:\Windows\System\FLsZTGz.exe
  2⤵
  PID:5792
- C:\Windows\System\XTFvhCP.exe
  C:\Windows\System\XTFvhCP.exe
  2⤵
  PID:5836
- C:\Windows\System\hsyZaUS.exe
  C:\Windows\System\hsyZaUS.exe
  2⤵
  PID:5864
- C:\Windows\System\oUOzfGr.exe
  C:\Windows\System\oUOzfGr.exe
  2⤵
  PID:5880
- C:\Windows\System\JjPQKzw.exe
  C:\Windows\System\JjPQKzw.exe
  2⤵
  PID:5916
- C:\Windows\System\Uqfzpcl.exe
  C:\Windows\System\Uqfzpcl.exe
  2⤵
  PID:5936
- C:\Windows\System\CfhBRII.exe
  C:\Windows\System\CfhBRII.exe
  2⤵
  PID:5956
- C:\Windows\System\sOGGGNz.exe
  C:\Windows\System\sOGGGNz.exe
  2⤵
  PID:5984
- C:\Windows\System\mJKDKAm.exe
  C:\Windows\System\mJKDKAm.exe
  2⤵
  PID:6028
- C:\Windows\System\YPXxuQc.exe
  C:\Windows\System\YPXxuQc.exe
  2⤵
  PID:6052
- C:\Windows\System\pByLqFi.exe
  C:\Windows\System\pByLqFi.exe
  2⤵
  PID:6068
- C:\Windows\System\QQhVvHO.exe
  C:\Windows\System\QQhVvHO.exe
  2⤵
  PID:6096
- C:\Windows\System\xWedwSk.exe
  C:\Windows\System\xWedwSk.exe
  2⤵
  PID:6132
- C:\Windows\System\HZkOwBj.exe
  C:\Windows\System\HZkOwBj.exe
  2⤵
  PID:2864
- C:\Windows\System\PtxLfjL.exe
  C:\Windows\System\PtxLfjL.exe
  2⤵
  PID:4496
- C:\Windows\System\mVfbsED.exe
  C:\Windows\System\mVfbsED.exe
  2⤵
  PID:1668
- C:\Windows\System\GreWnIZ.exe
  C:\Windows\System\GreWnIZ.exe
  2⤵
  PID:3272
- C:\Windows\System\bJGeoPB.exe
  C:\Windows\System\bJGeoPB.exe
  2⤵
  PID:1932
- C:\Windows\System\SHjgHtP.exe
  C:\Windows\System\SHjgHtP.exe
  2⤵
  PID:2496
- C:\Windows\System\AzPJqAT.exe
  C:\Windows\System\AzPJqAT.exe
  2⤵
  PID:3380
- C:\Windows\System\iwxMVeV.exe
  C:\Windows\System\iwxMVeV.exe
  2⤵
  PID:5268
- C:\Windows\System\YCoIswG.exe
  C:\Windows\System\YCoIswG.exe
  2⤵
  PID:4424
- C:\Windows\System\imiOMnr.exe
  C:\Windows\System\imiOMnr.exe
  2⤵
  PID:5392
- C:\Windows\System\txIOgeQ.exe
  C:\Windows\System\txIOgeQ.exe
  2⤵
  PID:5436
- C:\Windows\System\XuLhbap.exe
  C:\Windows\System\XuLhbap.exe
  2⤵
  PID:708
- C:\Windows\System\OHceDkE.exe
  C:\Windows\System\OHceDkE.exe
  2⤵
  PID:2612
- C:\Windows\System\QdzbhCx.exe
  C:\Windows\System\QdzbhCx.exe
  2⤵
  PID:2916
- C:\Windows\System\wwRjGlA.exe
  C:\Windows\System\wwRjGlA.exe
  2⤵
  PID:5212
- C:\Windows\System\pzGKYFc.exe
  C:\Windows\System\pzGKYFc.exe
  2⤵
  PID:748
- C:\Windows\System\AfSdXSZ.exe
  C:\Windows\System\AfSdXSZ.exe
  2⤵
  PID:2388
- C:\Windows\System\fyzHeLE.exe
  C:\Windows\System\fyzHeLE.exe
  2⤵
  PID:1408
- C:\Windows\System\ClJNQvS.exe
  C:\Windows\System\ClJNQvS.exe
  2⤵
  PID:4392
- C:\Windows\System\zyqbqaP.exe
  C:\Windows\System\zyqbqaP.exe
  2⤵
  PID:4820
- C:\Windows\System\YNIRHeB.exe
  C:\Windows\System\YNIRHeB.exe
  2⤵
  PID:5976
- C:\Windows\System\IKhLbHq.exe
  C:\Windows\System\IKhLbHq.exe
  2⤵
  PID:2308
- C:\Windows\System\zcVkJOs.exe
  C:\Windows\System\zcVkJOs.exe
  2⤵
  PID:5168
- C:\Windows\System\fvJlHeE.exe
  C:\Windows\System\fvJlHeE.exe
  2⤵
  PID:6044
- C:\Windows\System\zOlLBWv.exe
  C:\Windows\System\zOlLBWv.exe
  2⤵
  PID:6084
- C:\Windows\System\pygeZVL.exe
  C:\Windows\System\pygeZVL.exe
  2⤵
  PID:6148
- C:\Windows\System\fKLAeNZ.exe
  C:\Windows\System\fKLAeNZ.exe
  2⤵
  PID:6180
- C:\Windows\System\cgINDrN.exe
  C:\Windows\System\cgINDrN.exe
  2⤵
  PID:6200
- C:\Windows\System\TeAQNGo.exe
  C:\Windows\System\TeAQNGo.exe
  2⤵
  PID:6228
- C:\Windows\System\IcfarRp.exe
  C:\Windows\System\IcfarRp.exe
  2⤵
  PID:6256
- C:\Windows\System\utypbhT.exe
  C:\Windows\System\utypbhT.exe
  2⤵
  PID:6272
- C:\Windows\System\kdlUbfB.exe
  C:\Windows\System\kdlUbfB.exe
  2⤵
  PID:6296
- C:\Windows\System\rpHYCMk.exe
  C:\Windows\System\rpHYCMk.exe
  2⤵
  PID:6316
- C:\Windows\System\xvOwbwU.exe
  C:\Windows\System\xvOwbwU.exe
  2⤵
  PID:6344
- C:\Windows\System\rYkdvHC.exe
  C:\Windows\System\rYkdvHC.exe
  2⤵
  PID:6360
- C:\Windows\System\vPMlQWQ.exe
  C:\Windows\System\vPMlQWQ.exe
  2⤵
  PID:6380
- C:\Windows\System\ZVmRbYE.exe
  C:\Windows\System\ZVmRbYE.exe
  2⤵
  PID:6408
- C:\Windows\System\bCDwzkE.exe
  C:\Windows\System\bCDwzkE.exe
  2⤵
  PID:6432
- C:\Windows\System\dLTVTni.exe
  C:\Windows\System\dLTVTni.exe
  2⤵
  PID:6460
- C:\Windows\System\LbWVyXK.exe
  C:\Windows\System\LbWVyXK.exe
  2⤵
  PID:6500
- C:\Windows\System\KZkQDZR.exe
  C:\Windows\System\KZkQDZR.exe
  2⤵
  PID:6516
- C:\Windows\System\TFmqbKx.exe
  C:\Windows\System\TFmqbKx.exe
  2⤵
  PID:6532
- C:\Windows\System\ubIuvqy.exe
  C:\Windows\System\ubIuvqy.exe
  2⤵
  PID:6568
- C:\Windows\System\KTvxdVI.exe
  C:\Windows\System\KTvxdVI.exe
  2⤵
  PID:6600
- C:\Windows\System\oHVdtua.exe
  C:\Windows\System\oHVdtua.exe
  2⤵
  PID:6624
- C:\Windows\System\vxssXaG.exe
  C:\Windows\System\vxssXaG.exe
  2⤵
  PID:6640
- C:\Windows\System\qIaxZVM.exe
  C:\Windows\System\qIaxZVM.exe
  2⤵
  PID:6664
- C:\Windows\System\pkoQOru.exe
  C:\Windows\System\pkoQOru.exe
  2⤵
  PID:6688
- C:\Windows\System\bgcAzga.exe
  C:\Windows\System\bgcAzga.exe
  2⤵
  PID:6832
- C:\Windows\System\nhAwJhX.exe
  C:\Windows\System\nhAwJhX.exe
  2⤵
  PID:6848
- C:\Windows\System\FyDmRSQ.exe
  C:\Windows\System\FyDmRSQ.exe
  2⤵
  PID:6864
- C:\Windows\System\vhArfys.exe
  C:\Windows\System\vhArfys.exe
  2⤵
  PID:6880
- C:\Windows\System\WjJbGLY.exe
  C:\Windows\System\WjJbGLY.exe
  2⤵
  PID:6900
- C:\Windows\System\zAWbFNp.exe
  C:\Windows\System\zAWbFNp.exe
  2⤵
  PID:6916
- C:\Windows\System\UNKkxRf.exe
  C:\Windows\System\UNKkxRf.exe
  2⤵
  PID:6932
- C:\Windows\System\APCgoii.exe
  C:\Windows\System\APCgoii.exe
  2⤵
  PID:6948
- C:\Windows\System\kPyaulS.exe
  C:\Windows\System\kPyaulS.exe
  2⤵
  PID:6964
- C:\Windows\System\kcSQqTO.exe
  C:\Windows\System\kcSQqTO.exe
  2⤵
  PID:6980
- C:\Windows\System\PBKeEHN.exe
  C:\Windows\System\PBKeEHN.exe
  2⤵
  PID:7000
- C:\Windows\System\NUrjvEH.exe
  C:\Windows\System\NUrjvEH.exe
  2⤵
  PID:7020
- C:\Windows\System\fqXnTwr.exe
  C:\Windows\System\fqXnTwr.exe
  2⤵
  PID:7040
- C:\Windows\System\FQWTvnL.exe
  C:\Windows\System\FQWTvnL.exe
  2⤵
  PID:7064
- C:\Windows\System\oktGSjI.exe
  C:\Windows\System\oktGSjI.exe
  2⤵
  PID:7084
- C:\Windows\System\gYnCjWW.exe
  C:\Windows\System\gYnCjWW.exe
  2⤵
  PID:7104
- C:\Windows\System\QSWRXmF.exe
  C:\Windows\System\QSWRXmF.exe
  2⤵
  PID:7120
- C:\Windows\System\ejDAsZk.exe
  C:\Windows\System\ejDAsZk.exe
  2⤵
  PID:7140
- C:\Windows\System\kLINKTc.exe
  C:\Windows\System\kLINKTc.exe
  2⤵
  PID:7160
- C:\Windows\System\PFQTywF.exe
  C:\Windows\System\PFQTywF.exe
  2⤵
  PID:5308
- C:\Windows\System\dSMmJwx.exe
  C:\Windows\System\dSMmJwx.exe
  2⤵
  PID:5788
- C:\Windows\System\TfJQakS.exe
  C:\Windows\System\TfJQakS.exe
  2⤵
  PID:3940
- C:\Windows\System\fRaCgvB.exe
  C:\Windows\System\fRaCgvB.exe
  2⤵
  PID:5376
- C:\Windows\System\MHjuncX.exe
  C:\Windows\System\MHjuncX.exe
  2⤵
  PID:5256
- C:\Windows\System\AXeWqYC.exe
  C:\Windows\System\AXeWqYC.exe
  2⤵
  PID:4704
- C:\Windows\System\XVTpoxt.exe
  C:\Windows\System\XVTpoxt.exe
  2⤵
  PID:5532
- C:\Windows\System\LozgCpc.exe
  C:\Windows\System\LozgCpc.exe
  2⤵
  PID:5584
- C:\Windows\System\RzeqIqg.exe
  C:\Windows\System\RzeqIqg.exe
  2⤵
  PID:6040
- C:\Windows\System\rkqOYLp.exe
  C:\Windows\System\rkqOYLp.exe
  2⤵
  PID:5736
- C:\Windows\System\iaMcRyI.exe
  C:\Windows\System\iaMcRyI.exe
  2⤵
  PID:5764
- C:\Windows\System\ZDkVdXt.exe
  C:\Windows\System\ZDkVdXt.exe
  2⤵
  PID:5828
- C:\Windows\System\euHHAtb.exe
  C:\Windows\System\euHHAtb.exe
  2⤵
  PID:5876
- C:\Windows\System\QgSBBkB.exe
  C:\Windows\System\QgSBBkB.exe
  2⤵
  PID:5928
- C:\Windows\System\odDUmBE.exe
  C:\Windows\System\odDUmBE.exe
  2⤵
  PID:4892
- C:\Windows\System\YXxiztm.exe
  C:\Windows\System\YXxiztm.exe
  2⤵
  PID:6128
- C:\Windows\System\MzIVubj.exe
  C:\Windows\System\MzIVubj.exe
  2⤵
  PID:2192
- C:\Windows\System\kDXTeJX.exe
  C:\Windows\System\kDXTeJX.exe
  2⤵
  PID:3860
- C:\Windows\System\yzHmMeA.exe
  C:\Windows\System\yzHmMeA.exe
  2⤵
  PID:5520
- C:\Windows\System\AnwkJHr.exe
  C:\Windows\System\AnwkJHr.exe
  2⤵
  PID:5216
- C:\Windows\System\LlMIQYb.exe
  C:\Windows\System\LlMIQYb.exe
  2⤵
  PID:3668
- C:\Windows\System\FVkJpTh.exe
  C:\Windows\System\FVkJpTh.exe
  2⤵
  PID:4852
- C:\Windows\System\zFcTvOe.exe
  C:\Windows\System\zFcTvOe.exe
  2⤵
  PID:5124
- C:\Windows\System\ZmeNxFW.exe
  C:\Windows\System\ZmeNxFW.exe
  2⤵
  PID:6280
- C:\Windows\System\MYMouZy.exe
  C:\Windows\System\MYMouZy.exe
  2⤵
  PID:6560
- C:\Windows\System\NpchCeh.exe
  C:\Windows\System\NpchCeh.exe
  2⤵
  PID:6576
- C:\Windows\System\OqXZrkD.exe
  C:\Windows\System\OqXZrkD.exe
  2⤵
  PID:6756
- C:\Windows\System\KwrupOT.exe
  C:\Windows\System\KwrupOT.exe
  2⤵
  PID:6824
- C:\Windows\System\ULUXvEP.exe
  C:\Windows\System\ULUXvEP.exe
  2⤵
  PID:6924
- C:\Windows\System\ATrYZqR.exe
  C:\Windows\System\ATrYZqR.exe
  2⤵
  PID:6992
- C:\Windows\System\HhWZRrw.exe
  C:\Windows\System\HhWZRrw.exe
  2⤵
  PID:7112
- C:\Windows\System\rZGWsFQ.exe
  C:\Windows\System\rZGWsFQ.exe
  2⤵
  PID:5332
- C:\Windows\System\edLKvSa.exe
  C:\Windows\System\edLKvSa.exe
  2⤵
  PID:6440
- C:\Windows\System\IQUbKTl.exe
  C:\Windows\System\IQUbKTl.exe
  2⤵
  PID:6548
- C:\Windows\System\UKcMrAx.exe
  C:\Windows\System\UKcMrAx.exe
  2⤵
  PID:7176
- C:\Windows\System\RfsBSEU.exe
  C:\Windows\System\RfsBSEU.exe
  2⤵
  PID:7200
- C:\Windows\System\LRgfTEg.exe
  C:\Windows\System\LRgfTEg.exe
  2⤵
  PID:7228
- C:\Windows\System\ghGBgsa.exe
  C:\Windows\System\ghGBgsa.exe
  2⤵
  PID:7252
- C:\Windows\System\GmdLpQX.exe
  C:\Windows\System\GmdLpQX.exe
  2⤵
  PID:7280
- C:\Windows\System\oGYUWHm.exe
  C:\Windows\System\oGYUWHm.exe
  2⤵
  PID:7296
- C:\Windows\System\JROrAsM.exe
  C:\Windows\System\JROrAsM.exe
  2⤵
  PID:7328
- C:\Windows\System\MHnGFSu.exe
  C:\Windows\System\MHnGFSu.exe
  2⤵
  PID:7360
- C:\Windows\System\LZxPZya.exe
  C:\Windows\System\LZxPZya.exe
  2⤵
  PID:7380
- C:\Windows\System\ZlXnEPM.exe
  C:\Windows\System\ZlXnEPM.exe
  2⤵
  PID:7400
- C:\Windows\System\ZfMmXAB.exe
  C:\Windows\System\ZfMmXAB.exe
  2⤵
  PID:7424
- C:\Windows\System\uxGuSIW.exe
  C:\Windows\System\uxGuSIW.exe
  2⤵
  PID:7444
- C:\Windows\System\DMVtRgp.exe
  C:\Windows\System\DMVtRgp.exe
  2⤵
  PID:7464
- C:\Windows\System\VOrFmsp.exe
  C:\Windows\System\VOrFmsp.exe
  2⤵
  PID:7488
- C:\Windows\System\GBYZerf.exe
  C:\Windows\System\GBYZerf.exe
  2⤵
  PID:7512
- C:\Windows\System\ulQITku.exe
  C:\Windows\System\ulQITku.exe
  2⤵
  PID:7536
- C:\Windows\System\NSALrpr.exe
  C:\Windows\System\NSALrpr.exe
  2⤵
  PID:7560
- C:\Windows\System\eJkqXUO.exe
  C:\Windows\System\eJkqXUO.exe
  2⤵
  PID:7576
- C:\Windows\System\qcVujIq.exe
  C:\Windows\System\qcVujIq.exe
  2⤵
  PID:7680
- C:\Windows\System\vJiktwR.exe
  C:\Windows\System\vJiktwR.exe
  2⤵
  PID:7704
- C:\Windows\System\vkmbWCh.exe
  C:\Windows\System\vkmbWCh.exe
  2⤵
  PID:7720
- C:\Windows\System\yGfcgfB.exe
  C:\Windows\System\yGfcgfB.exe
  2⤵
  PID:7740
- C:\Windows\System\JdTHkWI.exe
  C:\Windows\System\JdTHkWI.exe
  2⤵
  PID:7760
- C:\Windows\System\LtFItBu.exe
  C:\Windows\System\LtFItBu.exe
  2⤵
  PID:7776
- C:\Windows\System\lECxjNP.exe
  C:\Windows\System\lECxjNP.exe
  2⤵
  PID:7796
- C:\Windows\System\qDwbccy.exe
  C:\Windows\System\qDwbccy.exe
  2⤵
  PID:7812
- C:\Windows\System\XrcBPZn.exe
  C:\Windows\System\XrcBPZn.exe
  2⤵
  PID:7840
- C:\Windows\System\opARkpN.exe
  C:\Windows\System\opARkpN.exe
  2⤵
  PID:7860
- C:\Windows\System\LNveZhS.exe
  C:\Windows\System\LNveZhS.exe
  2⤵
  PID:7884
- C:\Windows\System\uaupZaf.exe
  C:\Windows\System\uaupZaf.exe
  2⤵
  PID:7900
- C:\Windows\System\tXBwckK.exe
  C:\Windows\System\tXBwckK.exe
  2⤵
  PID:7928
- C:\Windows\System\NriXKqG.exe
  C:\Windows\System\NriXKqG.exe
  2⤵
  PID:7952
- C:\Windows\System\UHZZCVu.exe
  C:\Windows\System\UHZZCVu.exe
  2⤵
  PID:7976
- C:\Windows\System\gnioCTg.exe
  C:\Windows\System\gnioCTg.exe
  2⤵
  PID:7992
- C:\Windows\System\Pttznov.exe
  C:\Windows\System\Pttznov.exe
  2⤵
  PID:8016
- C:\Windows\System\XitZpKJ.exe
  C:\Windows\System\XitZpKJ.exe
  2⤵
  PID:8044
- C:\Windows\System\WzFFMpP.exe
  C:\Windows\System\WzFFMpP.exe
  2⤵
  PID:8064
- C:\Windows\System\cgdDuYn.exe
  C:\Windows\System\cgdDuYn.exe
  2⤵
  PID:8092
- C:\Windows\System\tPNasEV.exe
  C:\Windows\System\tPNasEV.exe
  2⤵
  PID:8112
- C:\Windows\System\ivVzojv.exe
  C:\Windows\System\ivVzojv.exe
  2⤵
  PID:8136
- C:\Windows\System\EpuuDRh.exe
  C:\Windows\System\EpuuDRh.exe
  2⤵
  PID:8160
- C:\Windows\System\jgjrhqP.exe
  C:\Windows\System\jgjrhqP.exe
  2⤵
  PID:8184
- C:\Windows\System\ROJhtvU.exe
  C:\Windows\System\ROJhtvU.exe
  2⤵
  PID:5860
- C:\Windows\System\LhXbFdQ.exe
  C:\Windows\System\LhXbFdQ.exe
  2⤵
  PID:6176
- C:\Windows\System\XnVEGMY.exe
  C:\Windows\System\XnVEGMY.exe
  2⤵
  PID:7132
- C:\Windows\System\eyWoiat.exe
  C:\Windows\System\eyWoiat.exe
  2⤵
  PID:5352
- C:\Windows\System\GvQDFRD.exe
  C:\Windows\System\GvQDFRD.exe
  2⤵
  PID:5400
- C:\Windows\System\ZnFORFJ.exe
  C:\Windows\System\ZnFORFJ.exe
  2⤵
  PID:6404
- C:\Windows\System\gdXPqnS.exe
  C:\Windows\System\gdXPqnS.exe
  2⤵
  PID:5516
- C:\Windows\System\mFanglj.exe
  C:\Windows\System\mFanglj.exe
  2⤵
  PID:7348
- C:\Windows\System\vVAVCVE.exe
  C:\Windows\System\vVAVCVE.exe
  2⤵
  PID:7420
- C:\Windows\System\yiIWTaZ.exe
  C:\Windows\System\yiIWTaZ.exe
  2⤵
  PID:7524
- C:\Windows\System\kTkgxkV.exe
  C:\Windows\System\kTkgxkV.exe
  2⤵
  PID:6828
- C:\Windows\System\ojpAKLC.exe
  C:\Windows\System\ojpAKLC.exe
  2⤵
  PID:6928
- C:\Windows\System\FIrKBBU.exe
  C:\Windows\System\FIrKBBU.exe
  2⤵
  PID:7012
- C:\Windows\System\VrYPHYX.exe
  C:\Windows\System\VrYPHYX.exe
  2⤵
  PID:7060
- C:\Windows\System\PxoaVls.exe
  C:\Windows\System\PxoaVls.exe
  2⤵
  PID:7136
- C:\Windows\System\KzfAfoD.exe
  C:\Windows\System\KzfAfoD.exe
  2⤵
  PID:7692
- C:\Windows\System\GaQfgUb.exe
  C:\Windows\System\GaQfgUb.exe
  2⤵
  PID:3524
- C:\Windows\System\EXMimzo.exe
  C:\Windows\System\EXMimzo.exe
  2⤵
  PID:8212
- C:\Windows\System\emUDGQQ.exe
  C:\Windows\System\emUDGQQ.exe
  2⤵
  PID:8232
- C:\Windows\System\nOYFanV.exe
  C:\Windows\System\nOYFanV.exe
  2⤵
  PID:8256
- C:\Windows\System\TetjRTB.exe
  C:\Windows\System\TetjRTB.exe
  2⤵
  PID:8280
- C:\Windows\System\JixOtES.exe
  C:\Windows\System\JixOtES.exe
  2⤵
  PID:8304
- C:\Windows\System\dTKbkLl.exe
  C:\Windows\System\dTKbkLl.exe
  2⤵
  PID:8328
- C:\Windows\System\zuogebs.exe
  C:\Windows\System\zuogebs.exe
  2⤵
  PID:8356
- C:\Windows\System\TRvmBEa.exe
  C:\Windows\System\TRvmBEa.exe
  2⤵
  PID:8376
- C:\Windows\System\NWekiWy.exe
  C:\Windows\System\NWekiWy.exe
  2⤵
  PID:8400
- C:\Windows\System\yyzduiN.exe
  C:\Windows\System\yyzduiN.exe
  2⤵
  PID:8416
- C:\Windows\System\tGqFmLc.exe
  C:\Windows\System\tGqFmLc.exe
  2⤵
  PID:8432
- C:\Windows\System\iTIyGdd.exe
  C:\Windows\System\iTIyGdd.exe
  2⤵
  PID:8452
- C:\Windows\System\CvoPZHu.exe
  C:\Windows\System\CvoPZHu.exe
  2⤵
  PID:8472
- C:\Windows\System\mGXtmsk.exe
  C:\Windows\System\mGXtmsk.exe
  2⤵
  PID:8500
- C:\Windows\System\OHHqnjY.exe
  C:\Windows\System\OHHqnjY.exe
  2⤵
  PID:8524
- C:\Windows\System\AkIGqct.exe
  C:\Windows\System\AkIGqct.exe
  2⤵
  PID:8544
- C:\Windows\System\ygtRaDY.exe
  C:\Windows\System\ygtRaDY.exe
  2⤵
  PID:8572
- C:\Windows\System\VuZRhzo.exe
  C:\Windows\System\VuZRhzo.exe
  2⤵
  PID:8592
- C:\Windows\System\IIouAUS.exe
  C:\Windows\System\IIouAUS.exe
  2⤵
  PID:8612
- C:\Windows\System\nxRrJZV.exe
  C:\Windows\System\nxRrJZV.exe
  2⤵
  PID:8636
- C:\Windows\System\onJQMPA.exe
  C:\Windows\System\onJQMPA.exe
  2⤵
  PID:8660
- C:\Windows\System\LUJyhgE.exe
  C:\Windows\System\LUJyhgE.exe
  2⤵
  PID:8684
- C:\Windows\System\pNZQkhr.exe
  C:\Windows\System\pNZQkhr.exe
  2⤵
  PID:8704
- C:\Windows\System\gpxqYFV.exe
  C:\Windows\System\gpxqYFV.exe
  2⤵
  PID:8724
- C:\Windows\System\ikXbJfS.exe
  C:\Windows\System\ikXbJfS.exe
  2⤵
  PID:8748
- C:\Windows\System\hEJeJLd.exe
  C:\Windows\System\hEJeJLd.exe
  2⤵
  PID:8772
- C:\Windows\System\IjQluPw.exe
  C:\Windows\System\IjQluPw.exe
  2⤵
  PID:8792
- C:\Windows\System\LntkkwB.exe
  C:\Windows\System\LntkkwB.exe
  2⤵
  PID:8812
- C:\Windows\System\RzGGZfX.exe
  C:\Windows\System\RzGGZfX.exe
  2⤵
  PID:8836
- C:\Windows\System\MinFHnt.exe
  C:\Windows\System\MinFHnt.exe
  2⤵
  PID:8852
- C:\Windows\System\mIdVGjw.exe
  C:\Windows\System\mIdVGjw.exe
  2⤵
  PID:8872
- C:\Windows\System\mSLTNjG.exe
  C:\Windows\System\mSLTNjG.exe
  2⤵
  PID:8912
- C:\Windows\System\oZggqgz.exe
  C:\Windows\System\oZggqgz.exe
  2⤵
  PID:8928
- C:\Windows\System\VWPryGl.exe
  C:\Windows\System\VWPryGl.exe
  2⤵
  PID:8952
- C:\Windows\System\LyEDqDd.exe
  C:\Windows\System\LyEDqDd.exe
  2⤵
  PID:8976
- C:\Windows\System\IrlVeGj.exe
  C:\Windows\System\IrlVeGj.exe
  2⤵
  PID:9124
- C:\Windows\System\HumgidI.exe
  C:\Windows\System\HumgidI.exe
  2⤵
  PID:9140
- C:\Windows\System\AtMRBOm.exe
  C:\Windows\System\AtMRBOm.exe
  2⤵
  PID:9164
- C:\Windows\System\SgmSDkL.exe
  C:\Windows\System\SgmSDkL.exe
  2⤵
  PID:9188
- C:\Windows\System\wrwBosZ.exe
  C:\Windows\System\wrwBosZ.exe
  2⤵
  PID:9208
- C:\Windows\System\GNNbige.exe
  C:\Windows\System\GNNbige.exe
  2⤵
  PID:7828
- C:\Windows\System\npLMsGm.exe
  C:\Windows\System\npLMsGm.exe
  2⤵
  PID:7868
- C:\Windows\System\dlNNipp.exe
  C:\Windows\System\dlNNipp.exe
  2⤵
  PID:5556
- C:\Windows\System\bmGihTt.exe
  C:\Windows\System\bmGihTt.exe
  2⤵
  PID:7988
- C:\Windows\System\fawMUxa.exe
  C:\Windows\System\fawMUxa.exe
  2⤵
  PID:7244
- C:\Windows\System\RNYPebN.exe
  C:\Windows\System\RNYPebN.exe
  2⤵
  PID:6008
- C:\Windows\System\LFbWbWm.exe
  C:\Windows\System\LFbWbWm.exe
  2⤵
  PID:3584
- C:\Windows\System\JbDCkxQ.exe
  C:\Windows\System\JbDCkxQ.exe
  2⤵
  PID:7372
- C:\Windows\System\GAtLuhF.exe
  C:\Windows\System\GAtLuhF.exe
  2⤵
  PID:4864
- C:\Windows\System\YBCpmgp.exe
  C:\Windows\System\YBCpmgp.exe
  2⤵
  PID:6312
- C:\Windows\System\bzvkMWX.exe
  C:\Windows\System\bzvkMWX.exe
  2⤵
  PID:6672
- C:\Windows\System\urvhIrl.exe
  C:\Windows\System\urvhIrl.exe
  2⤵
  PID:8196
- C:\Windows\System\YCKEYKg.exe
  C:\Windows\System\YCKEYKg.exe
  2⤵
  PID:8288
- C:\Windows\System\BkvTJna.exe
  C:\Windows\System\BkvTJna.exe
  2⤵
  PID:8316
- C:\Windows\System\GJGzrUs.exe
  C:\Windows\System\GJGzrUs.exe
  2⤵
  PID:8352
- C:\Windows\System\LBEVRqR.exe
  C:\Windows\System\LBEVRqR.exe
  2⤵
  PID:5312
- C:\Windows\System\fohIqsI.exe
  C:\Windows\System\fohIqsI.exe
  2⤵
  PID:6512
- C:\Windows\System\GEKZXfV.exe
  C:\Windows\System\GEKZXfV.exe
  2⤵
  PID:8508
- C:\Windows\System\emlSAUM.exe
  C:\Windows\System\emlSAUM.exe
  2⤵
  PID:8036
- C:\Windows\System\IWVgrfC.exe
  C:\Windows\System\IWVgrfC.exe
  2⤵
  PID:8564
- C:\Windows\System\uZupMCO.exe
  C:\Windows\System\uZupMCO.exe
  2⤵
  PID:9232
- C:\Windows\System\oBxVFiU.exe
  C:\Windows\System\oBxVFiU.exe
  2⤵
  PID:9256
- C:\Windows\System\VkxKlDV.exe
  C:\Windows\System\VkxKlDV.exe
  2⤵
  PID:9288
- C:\Windows\System\lfkJSMW.exe
  C:\Windows\System\lfkJSMW.exe
  2⤵
  PID:9312
- C:\Windows\System\wXahhry.exe
  C:\Windows\System\wXahhry.exe
  2⤵
  PID:9332
- C:\Windows\System\LHIYzJN.exe
  C:\Windows\System\LHIYzJN.exe
  2⤵
  PID:9356
- C:\Windows\System\edGaeUQ.exe
  C:\Windows\System\edGaeUQ.exe
  2⤵
  PID:9380
- C:\Windows\System\ZmqMzVA.exe
  C:\Windows\System\ZmqMzVA.exe
  2⤵
  PID:9412
- C:\Windows\System\vnwAzNw.exe
  C:\Windows\System\vnwAzNw.exe
  2⤵
  PID:9436
- C:\Windows\System\hOkAnuY.exe
  C:\Windows\System\hOkAnuY.exe
  2⤵
  PID:9456
- C:\Windows\System\WtDgdOP.exe
  C:\Windows\System\WtDgdOP.exe
  2⤵
  PID:9480
- C:\Windows\System\riWYpnu.exe
  C:\Windows\System\riWYpnu.exe
  2⤵
  PID:9504
- C:\Windows\System\GAmlaQx.exe
  C:\Windows\System\GAmlaQx.exe
  2⤵
  PID:9528
- C:\Windows\System\HNgGgBV.exe
  C:\Windows\System\HNgGgBV.exe
  2⤵
  PID:9552
- C:\Windows\System\uIAkguR.exe
  C:\Windows\System\uIAkguR.exe
  2⤵
  PID:9572
- C:\Windows\System\orsIYaS.exe
  C:\Windows\System\orsIYaS.exe
  2⤵
  PID:9596
- C:\Windows\System\VBIEUFr.exe
  C:\Windows\System\VBIEUFr.exe
  2⤵
  PID:9624
- C:\Windows\System\RZiNUhW.exe
  C:\Windows\System\RZiNUhW.exe
  2⤵
  PID:9644
- C:\Windows\System\lvksSre.exe
  C:\Windows\System\lvksSre.exe
  2⤵
  PID:9668
- C:\Windows\System\ghMbijt.exe
  C:\Windows\System\ghMbijt.exe
  2⤵
  PID:9688
- C:\Windows\System\dDBqUtA.exe
  C:\Windows\System\dDBqUtA.exe
  2⤵
  PID:9704
- C:\Windows\System\JPHqBMb.exe
  C:\Windows\System\JPHqBMb.exe
  2⤵
  PID:9728
- C:\Windows\System\YDqSJYZ.exe
  C:\Windows\System\YDqSJYZ.exe
  2⤵
  PID:9744
- C:\Windows\System\qIepwAF.exe
  C:\Windows\System\qIepwAF.exe
  2⤵
  PID:9768
- C:\Windows\System\sophUfs.exe
  C:\Windows\System\sophUfs.exe
  2⤵
  PID:9788
- C:\Windows\System\MowGmyz.exe
  C:\Windows\System\MowGmyz.exe
  2⤵
  PID:9824
- C:\Windows\System\lnRpdLQ.exe
  C:\Windows\System\lnRpdLQ.exe
  2⤵
  PID:9844
- C:\Windows\System\ZsJxuxz.exe
  C:\Windows\System\ZsJxuxz.exe
  2⤵
  PID:9932
- C:\Windows\System\BJoIohH.exe
  C:\Windows\System\BJoIohH.exe
  2⤵
  PID:9956
- C:\Windows\System\kbymZcy.exe
  C:\Windows\System\kbymZcy.exe
  2⤵
  PID:9984
- C:\Windows\System\CSuvxWZ.exe
  C:\Windows\System\CSuvxWZ.exe
  2⤵
  PID:10004
- C:\Windows\System\TzCocso.exe
  C:\Windows\System\TzCocso.exe
  2⤵
  PID:10028
- C:\Windows\System\NkFYOGM.exe
  C:\Windows\System\NkFYOGM.exe
  2⤵
  PID:10048
- C:\Windows\System\XUFjSHW.exe
  C:\Windows\System\XUFjSHW.exe
  2⤵
  PID:10072
- C:\Windows\System\jBMygzY.exe
  C:\Windows\System\jBMygzY.exe
  2⤵
  PID:10092
- C:\Windows\System\MrxCwAB.exe
  C:\Windows\System\MrxCwAB.exe
  2⤵
  PID:10116
- C:\Windows\System\oufVtFt.exe
  C:\Windows\System\oufVtFt.exe
  2⤵
  PID:10140
- C:\Windows\System\NmdFHMQ.exe
  C:\Windows\System\NmdFHMQ.exe
  2⤵
  PID:10160
- C:\Windows\System\wPXylYy.exe
  C:\Windows\System\wPXylYy.exe
  2⤵
  PID:10180
- C:\Windows\System\dnzbIgc.exe
  C:\Windows\System\dnzbIgc.exe
  2⤵
  PID:10204
- C:\Windows\System\WtUEXpW.exe
  C:\Windows\System\WtUEXpW.exe
  2⤵
  PID:10232
- C:\Windows\System\tIlXZGr.exe
  C:\Windows\System\tIlXZGr.exe
  2⤵
  PID:7292
- C:\Windows\System\SsocDSM.exe
  C:\Windows\System\SsocDSM.exe
  2⤵
  PID:8652
- C:\Windows\System\uKUuHqX.exe
  C:\Windows\System\uKUuHqX.exe
  2⤵
  PID:8764
- C:\Windows\System\VGJjZNa.exe
  C:\Windows\System\VGJjZNa.exe
  2⤵
  PID:8788
- C:\Windows\System\dVPvbYO.exe
  C:\Windows\System\dVPvbYO.exe
  2⤵
  PID:8884
- C:\Windows\System\yLlxNqJ.exe
  C:\Windows\System\yLlxNqJ.exe
  2⤵
  PID:8944
- C:\Windows\System\WjRrwDv.exe
  C:\Windows\System\WjRrwDv.exe
  2⤵
  PID:7984
- C:\Windows\System\pIhxbzV.exe
  C:\Windows\System\pIhxbzV.exe
  2⤵
  PID:8516
- C:\Windows\System\aGnWzkb.exe
  C:\Windows\System\aGnWzkb.exe
  2⤵
  PID:8108
- C:\Windows\System\RoSFuXO.exe
  C:\Windows\System\RoSFuXO.exe
  2⤵
  PID:8608
- C:\Windows\System\YdaNBSv.exe
  C:\Windows\System\YdaNBSv.exe
  2⤵
  PID:9280
- C:\Windows\System\RdrutRB.exe
  C:\Windows\System\RdrutRB.exe
  2⤵
  PID:9352
- C:\Windows\System\CxWNuiq.exe
  C:\Windows\System\CxWNuiq.exe
  2⤵
  PID:8744
- C:\Windows\System\YcpHzab.exe
  C:\Windows\System\YcpHzab.exe
  2⤵
  PID:8156
- C:\Windows\System\AWJrmXe.exe
  C:\Windows\System\AWJrmXe.exe
  2⤵
  PID:1764
- C:\Windows\System\dglPWJn.exe
  C:\Windows\System\dglPWJn.exe
  2⤵
  PID:3120
- C:\Windows\System\fMQEvHM.exe
  C:\Windows\System\fMQEvHM.exe
  2⤵
  PID:9608
- C:\Windows\System\fZdrSNa.exe
  C:\Windows\System\fZdrSNa.exe
  2⤵
  PID:8880
- C:\Windows\System\uTZCfdw.exe
  C:\Windows\System\uTZCfdw.exe
  2⤵
  PID:920
- C:\Windows\System\PvioLqi.exe
  C:\Windows\System\PvioLqi.exe
  2⤵
  PID:9760
- C:\Windows\System\CgTnQve.exe
  C:\Windows\System\CgTnQve.exe
  2⤵
  PID:7092
- C:\Windows\System\ctVdUpZ.exe
  C:\Windows\System\ctVdUpZ.exe
  2⤵
  PID:8988
- C:\Windows\System\FwBTlhU.exe
  C:\Windows\System\FwBTlhU.exe
  2⤵
  PID:10244
- C:\Windows\System\ohLfIyF.exe
  C:\Windows\System\ohLfIyF.exe
  2⤵
  PID:10260
- C:\Windows\System\lePjuOe.exe
  C:\Windows\System\lePjuOe.exe
  2⤵
  PID:10276
- C:\Windows\System\BQmHfnS.exe
  C:\Windows\System\BQmHfnS.exe
  2⤵
  PID:10296
- C:\Windows\System\TIphLfD.exe
  C:\Windows\System\TIphLfD.exe
  2⤵
  PID:10320
- C:\Windows\System\QgAkaGL.exe
  C:\Windows\System\QgAkaGL.exe
  2⤵
  PID:10344
- C:\Windows\System\aqcujgW.exe
  C:\Windows\System\aqcujgW.exe
  2⤵
  PID:10368
- C:\Windows\System\phNNfZO.exe
  C:\Windows\System\phNNfZO.exe
  2⤵
  PID:10392
- C:\Windows\System\lOGRgEk.exe
  C:\Windows\System\lOGRgEk.exe
  2⤵
  PID:10416
- C:\Windows\System\gLSfZwP.exe
  C:\Windows\System\gLSfZwP.exe
  2⤵
  PID:10440
- C:\Windows\System\VFjvQXF.exe
  C:\Windows\System\VFjvQXF.exe
  2⤵
  PID:10476
- C:\Windows\System\zmpQTPE.exe
  C:\Windows\System\zmpQTPE.exe
  2⤵
  PID:10492
- C:\Windows\System\uQisXhI.exe
  C:\Windows\System\uQisXhI.exe
  2⤵
  PID:10508
- C:\Windows\System\qDyYTga.exe
  C:\Windows\System\qDyYTga.exe
  2⤵
  PID:10524
- C:\Windows\System\GDTIdCt.exe
  C:\Windows\System\GDTIdCt.exe
  2⤵
  PID:10608
- C:\Windows\System\HmmtHxV.exe
  C:\Windows\System\HmmtHxV.exe
  2⤵
  PID:10632
- C:\Windows\System\kzLfyhw.exe
  C:\Windows\System\kzLfyhw.exe
  2⤵
  PID:10652
- C:\Windows\System\OejRwcE.exe
  C:\Windows\System\OejRwcE.exe
  2⤵
  PID:10676
- C:\Windows\System\AEpHrKW.exe
  C:\Windows\System\AEpHrKW.exe
  2⤵
  PID:10696
- C:\Windows\System\eWBXwFL.exe
  C:\Windows\System\eWBXwFL.exe
  2⤵
  PID:10724
- C:\Windows\System\WQJXviT.exe
  C:\Windows\System\WQJXviT.exe
  2⤵
  PID:10748
- C:\Windows\System\PwpGkig.exe
  C:\Windows\System\PwpGkig.exe
  2⤵
  PID:10768
- C:\Windows\System\ObELMqa.exe
  C:\Windows\System\ObELMqa.exe
  2⤵
  PID:10796
- C:\Windows\System\yvEjjrz.exe
  C:\Windows\System\yvEjjrz.exe
  2⤵
  PID:10812
- C:\Windows\System\HzRcSxt.exe
  C:\Windows\System\HzRcSxt.exe
  2⤵
  PID:10828
- C:\Windows\System\mwsWckr.exe
  C:\Windows\System\mwsWckr.exe
  2⤵
  PID:10852
- C:\Windows\System\ldbgsrF.exe
  C:\Windows\System\ldbgsrF.exe
  2⤵
  PID:10872
- C:\Windows\System\gIzjOWd.exe
  C:\Windows\System\gIzjOWd.exe
  2⤵
  PID:10896
- C:\Windows\System\WBSVioL.exe
  C:\Windows\System\WBSVioL.exe
  2⤵
  PID:10916
- C:\Windows\System\rnFcXDK.exe
  C:\Windows\System\rnFcXDK.exe
  2⤵
  PID:10940
- C:\Windows\System\YAmdEXn.exe
  C:\Windows\System\YAmdEXn.exe
  2⤵
  PID:10968
- C:\Windows\System\TGFkCYi.exe
  C:\Windows\System\TGFkCYi.exe
  2⤵
  PID:10992
- C:\Windows\System\JCilwBP.exe
  C:\Windows\System\JCilwBP.exe
  2⤵
  PID:11016
- C:\Windows\System\bQnmmSh.exe
  C:\Windows\System\bQnmmSh.exe
  2⤵
  PID:11040
- C:\Windows\System\eYnIGWl.exe
  C:\Windows\System\eYnIGWl.exe
  2⤵
  PID:11060
- C:\Windows\System\eNakNEc.exe
  C:\Windows\System\eNakNEc.exe
  2⤵
  PID:11076
- C:\Windows\System\yVtzhsV.exe
  C:\Windows\System\yVtzhsV.exe
  2⤵
  PID:11104
- C:\Windows\System\IQkwmOV.exe
  C:\Windows\System\IQkwmOV.exe
  2⤵
  PID:11120
- C:\Windows\System\nVVzbsY.exe
  C:\Windows\System\nVVzbsY.exe
  2⤵
  PID:11144
- C:\Windows\System\lmCJJHB.exe
  C:\Windows\System\lmCJJHB.exe
  2⤵
  PID:11168
- C:\Windows\System\MqbIRgX.exe
  C:\Windows\System\MqbIRgX.exe
  2⤵
  PID:11192
- C:\Windows\System\vjulCKN.exe
  C:\Windows\System\vjulCKN.exe
  2⤵
  PID:11216
- C:\Windows\System\QYibOBo.exe
  C:\Windows\System\QYibOBo.exe
  2⤵
  PID:11244
- C:\Windows\System\kTtScBY.exe
  C:\Windows\System\kTtScBY.exe
  2⤵
  PID:5856
- C:\Windows\System\zqQtUka.exe
  C:\Windows\System\zqQtUka.exe
  2⤵
  PID:5492
- C:\Windows\System\nQOlpBJ.exe
  C:\Windows\System\nQOlpBJ.exe
  2⤵
  PID:6076
- C:\Windows\System\xBlfWby.exe
  C:\Windows\System\xBlfWby.exe
  2⤵
  PID:7048
- C:\Windows\System\LKKfxuA.exe
  C:\Windows\System\LKKfxuA.exe
  2⤵
  PID:5244
- C:\Windows\System\ntAkoAx.exe
  C:\Windows\System\ntAkoAx.exe
  2⤵
  PID:8276
- C:\Windows\System\VQpOWHM.exe
  C:\Windows\System\VQpOWHM.exe
  2⤵
  PID:8488
- C:\Windows\System\jUvbFEo.exe
  C:\Windows\System\jUvbFEo.exe
  2⤵
  PID:8392
- C:\Windows\System\ozczUJW.exe
  C:\Windows\System\ozczUJW.exe
  2⤵
  PID:7588
- C:\Windows\System\zNCKQWR.exe
  C:\Windows\System\zNCKQWR.exe
  2⤵
  PID:7756
- C:\Windows\System\fCVWOnU.exe
  C:\Windows\System\fCVWOnU.exe
  2⤵
  PID:9424
- C:\Windows\System\itQSRos.exe
  C:\Windows\System\itQSRos.exe
  2⤵
  PID:5816
- C:\Windows\System\RLAzMIe.exe
  C:\Windows\System\RLAzMIe.exe
  2⤵
  PID:9476
- C:\Windows\System\TbtONAR.exe
  C:\Windows\System\TbtONAR.exe
  2⤵
  PID:9540
- C:\Windows\System\DOHurgj.exe
  C:\Windows\System\DOHurgj.exe
  2⤵
  PID:3912
- C:\Windows\System\HyRQqaB.exe
  C:\Windows\System\HyRQqaB.exe
  2⤵
  PID:11288
- C:\Windows\System\TQuvMSj.exe
  C:\Windows\System\TQuvMSj.exe
  2⤵
  PID:11304
- C:\Windows\System\JGqWakV.exe
  C:\Windows\System\JGqWakV.exe
  2⤵
  PID:11324
- C:\Windows\System\nnoPJPK.exe
  C:\Windows\System\nnoPJPK.exe
  2⤵
  PID:11348
- C:\Windows\System\PQqcQpL.exe
  C:\Windows\System\PQqcQpL.exe
  2⤵
  PID:11368
- C:\Windows\System\VZaXqIY.exe
  C:\Windows\System\VZaXqIY.exe
  2⤵
  PID:11388
- C:\Windows\System\PRIyWEj.exe
  C:\Windows\System\PRIyWEj.exe
  2⤵
  PID:11416
- C:\Windows\System\sdyKoHB.exe
  C:\Windows\System\sdyKoHB.exe
  2⤵
  PID:11432
- C:\Windows\System\ldGqxgH.exe
  C:\Windows\System\ldGqxgH.exe
  2⤵
  PID:11448
- C:\Windows\System\OwdhEoo.exe
  C:\Windows\System\OwdhEoo.exe
  2⤵
  PID:11468
- C:\Windows\System\kHrYtMj.exe
  C:\Windows\System\kHrYtMj.exe
  2⤵
  PID:11496
- C:\Windows\System\DvPYsVy.exe
  C:\Windows\System\DvPYsVy.exe
  2⤵
  PID:11552
- C:\Windows\System\OlNALgR.exe
  C:\Windows\System\OlNALgR.exe
  2⤵
  PID:11568
- C:\Windows\System\QulOmIL.exe
  C:\Windows\System\QulOmIL.exe
  2⤵
  PID:11584
- C:\Windows\System\bgwbKwE.exe
  C:\Windows\System\bgwbKwE.exe
  2⤵
  PID:11608
- C:\Windows\System\BzryjUK.exe
  C:\Windows\System\BzryjUK.exe
  2⤵
  PID:11640
- C:\Windows\System\duvAeIh.exe
  C:\Windows\System\duvAeIh.exe
  2⤵
  PID:11660
- C:\Windows\System\aHhEJxV.exe
  C:\Windows\System\aHhEJxV.exe
  2⤵
  PID:11680
- C:\Windows\System\VjmOqzN.exe
  C:\Windows\System\VjmOqzN.exe
  2⤵
  PID:11704
- C:\Windows\System\KUjxWEm.exe
  C:\Windows\System\KUjxWEm.exe
  2⤵
  PID:11764
- C:\Windows\System\nUZpdQF.exe
  C:\Windows\System\nUZpdQF.exe
  2⤵
  PID:11788
- C:\Windows\System\vKpsAmH.exe
  C:\Windows\System\vKpsAmH.exe
  2⤵
  PID:11816
- C:\Windows\System\exMlrkK.exe
  C:\Windows\System\exMlrkK.exe
  2⤵
  PID:11836
- C:\Windows\System\dHIyOoq.exe
  C:\Windows\System\dHIyOoq.exe
  2⤵
  PID:11864
- C:\Windows\System\SNxnxGY.exe
  C:\Windows\System\SNxnxGY.exe
  2⤵
  PID:11892
- C:\Windows\System\IYcCWXi.exe
  C:\Windows\System\IYcCWXi.exe
  2⤵
  PID:11916
- C:\Windows\System\lQblXXQ.exe
  C:\Windows\System\lQblXXQ.exe
  2⤵
  PID:11972
- C:\Windows\System\VuGQmOi.exe
  C:\Windows\System\VuGQmOi.exe
  2⤵
  PID:11992
- C:\Windows\System\AXYkrRj.exe
  C:\Windows\System\AXYkrRj.exe
  2⤵
  PID:12012
- C:\Windows\System\lIHzGpj.exe
  C:\Windows\System\lIHzGpj.exe
  2⤵
  PID:12032
- C:\Windows\System\FgTesOS.exe
  C:\Windows\System\FgTesOS.exe
  2⤵
  PID:12056
- C:\Windows\System\lzZDMOc.exe
  C:\Windows\System\lzZDMOc.exe
  2⤵
  PID:12080
- C:\Windows\System\hnidoPC.exe
  C:\Windows\System\hnidoPC.exe
  2⤵
  PID:12100
- C:\Windows\System\Ehcmmyg.exe
  C:\Windows\System\Ehcmmyg.exe
  2⤵
  PID:12128
- C:\Windows\System\LycAoqi.exe
  C:\Windows\System\LycAoqi.exe
  2⤵
  PID:12144
- C:\Windows\System\RRwWRbL.exe
  C:\Windows\System\RRwWRbL.exe
  2⤵
  PID:12168
- C:\Windows\System\uNNJGno.exe
  C:\Windows\System\uNNJGno.exe
  2⤵
  PID:12192
- C:\Windows\System\UXMWkht.exe
  C:\Windows\System\UXMWkht.exe
  2⤵
  PID:12220
- C:\Windows\System\IoEWzXO.exe
  C:\Windows\System\IoEWzXO.exe
  2⤵
  PID:12244
- C:\Windows\System\WPUlVcP.exe
  C:\Windows\System\WPUlVcP.exe
  2⤵
  PID:12272
- C:\Windows\System\QxSuwNX.exe
  C:\Windows\System\QxSuwNX.exe
  2⤵
  PID:4420
- C:\Windows\System\StviKmI.exe
  C:\Windows\System\StviKmI.exe
  2⤵
  PID:8964
- C:\Windows\System\jFRrQjh.exe
  C:\Windows\System\jFRrQjh.exe
  2⤵
  PID:9780
- C:\Windows\System\DHNCRik.exe
  C:\Windows\System\DHNCRik.exe
  2⤵
  PID:9680
- C:\Windows\System\WzAZnog.exe
  C:\Windows\System\WzAZnog.exe
  2⤵
  PID:1068
- C:\Windows\System\dxaNTCD.exe
  C:\Windows\System\dxaNTCD.exe
  2⤵
  PID:4832
- C:\Windows\System\lUzquZe.exe
  C:\Windows\System\lUzquZe.exe
  2⤵
  PID:2516
- C:\Windows\System\qchymss.exe
  C:\Windows\System\qchymss.exe
  2⤵
  PID:9132
- C:\Windows\System\oCElVTH.exe
  C:\Windows\System\oCElVTH.exe
  2⤵
  PID:9176
- C:\Windows\System\sqJUYCq.exe
  C:\Windows\System\sqJUYCq.exe
  2⤵
  PID:7784
- C:\Windows\System\PYpeKhx.exe
  C:\Windows\System\PYpeKhx.exe
  2⤵
  PID:7032
- C:\Windows\System\FXjCDMa.exe
  C:\Windows\System\FXjCDMa.exe
  2⤵
  PID:10668
- C:\Windows\System\bwnzEji.exe
  C:\Windows\System\bwnzEji.exe
  2⤵
  PID:10784
- C:\Windows\System\LLHkblG.exe
  C:\Windows\System\LLHkblG.exe
  2⤵
  PID:10820
- C:\Windows\System\ZNhkHSk.exe
  C:\Windows\System\ZNhkHSk.exe
  2⤵
  PID:10956
- C:\Windows\System\yYbwJIB.exe
  C:\Windows\System\yYbwJIB.exe
  2⤵
  PID:11000
- C:\Windows\System\rjXGxbY.exe
  C:\Windows\System\rjXGxbY.exe
  2⤵
  PID:8264
- C:\Windows\System\NdhuWYD.exe
  C:\Windows\System\NdhuWYD.exe
  2⤵
  PID:8348
- C:\Windows\System\NNSlwhV.exe
  C:\Windows\System\NNSlwhV.exe
  2⤵
  PID:11164
- C:\Windows\System\xoUxwNZ.exe
  C:\Windows\System\xoUxwNZ.exe
  2⤵
  PID:7504
- C:\Windows\System\IMxTrQH.exe
  C:\Windows\System\IMxTrQH.exe
  2⤵
  PID:11136
- C:\Windows\System\JfzSmqI.exe
  C:\Windows\System\JfzSmqI.exe
  2⤵
  PID:9324
- C:\Windows\System\gQwMmaw.exe
  C:\Windows\System\gQwMmaw.exe
  2⤵
  PID:9544
- C:\Windows\System\PnPhJBM.exe
  C:\Windows\System\PnPhJBM.exe
  2⤵
  PID:6892
- C:\Windows\System\sMbRCMN.exe
  C:\Windows\System\sMbRCMN.exe
  2⤵
  PID:6976
- C:\Windows\System\XqKTqpS.exe
  C:\Windows\System\XqKTqpS.exe
  2⤵
  PID:8008
- C:\Windows\System\EpwbyeR.exe
  C:\Windows\System\EpwbyeR.exe
  2⤵
  PID:7484
- C:\Windows\System\PFvkyfJ.exe
  C:\Windows\System\PFvkyfJ.exe
  2⤵
  PID:9264
- C:\Windows\System\eSgSJrN.exe
  C:\Windows\System\eSgSJrN.exe
  2⤵
  PID:9700
- C:\Windows\System\efkOBDP.exe
  C:\Windows\System\efkOBDP.exe
  2⤵
  PID:9588
- C:\Windows\System\XBeRDJT.exe
  C:\Windows\System\XBeRDJT.exe
  2⤵
  PID:11344
- C:\Windows\System\CEVoXFB.exe
  C:\Windows\System\CEVoXFB.exe
  2⤵
  PID:11404
- C:\Windows\System\WQhAuKu.exe
  C:\Windows\System\WQhAuKu.exe
  2⤵
  PID:8924
- C:\Windows\System\SfMTUXz.exe
  C:\Windows\System\SfMTUXz.exe
  2⤵
  PID:6872
- C:\Windows\System\izVtgZK.exe
  C:\Windows\System\izVtgZK.exe
  2⤵
  PID:3176
- C:\Windows\System\iXmirCc.exe
  C:\Windows\System\iXmirCc.exe
  2⤵
  PID:11652
- C:\Windows\System\wieiylj.exe
  C:\Windows\System\wieiylj.exe
  2⤵
  PID:9900
- C:\Windows\System\awlBPmG.exe
  C:\Windows\System\awlBPmG.exe
  2⤵
  PID:12316
- C:\Windows\System\aiIseaO.exe
  C:\Windows\System\aiIseaO.exe
  2⤵
  PID:12344
- C:\Windows\System\NdiBAlR.exe
  C:\Windows\System\NdiBAlR.exe
  2⤵
  PID:12364
- C:\Windows\System\YMnbiHf.exe
  C:\Windows\System\YMnbiHf.exe
  2⤵
  PID:12388
- C:\Windows\System\CzgwzAL.exe
  C:\Windows\System\CzgwzAL.exe
  2⤵
  PID:12416
- C:\Windows\System\rTrmLnF.exe
  C:\Windows\System\rTrmLnF.exe
  2⤵
  PID:12464
- C:\Windows\System\uOFgfuV.exe
  C:\Windows\System\uOFgfuV.exe
  2⤵
  PID:12484
- C:\Windows\System\dcqrmyu.exe
  C:\Windows\System\dcqrmyu.exe
  2⤵
  PID:12508
- C:\Windows\System\XvRRvfY.exe
  C:\Windows\System\XvRRvfY.exe
  2⤵
  PID:12528
- C:\Windows\System\NnRQkFR.exe
  C:\Windows\System\NnRQkFR.exe
  2⤵
  PID:12548
- C:\Windows\System\BSDPVJN.exe
  C:\Windows\System\BSDPVJN.exe
  2⤵
  PID:12568
- C:\Windows\System\YSVRsgx.exe
  C:\Windows\System\YSVRsgx.exe
  2⤵
  PID:12588
- C:\Windows\System\HWaBcDB.exe
  C:\Windows\System\HWaBcDB.exe
  2⤵
  PID:12612
- C:\Windows\System\XpqmAov.exe
  C:\Windows\System\XpqmAov.exe
  2⤵
  PID:12632
- C:\Windows\System\TlovZdK.exe
  C:\Windows\System\TlovZdK.exe
  2⤵
  PID:12652
- C:\Windows\System\xxeJZpU.exe
  C:\Windows\System\xxeJZpU.exe
  2⤵
  PID:12672
- C:\Windows\System\rnLRXyO.exe
  C:\Windows\System\rnLRXyO.exe
  2⤵
  PID:12696
- C:\Windows\System\MQTliRX.exe
  C:\Windows\System\MQTliRX.exe
  2⤵
  PID:12716
- C:\Windows\System\GtZYbBx.exe
  C:\Windows\System\GtZYbBx.exe
  2⤵
  PID:12736
- C:\Windows\System\SWPsBLd.exe
  C:\Windows\System\SWPsBLd.exe
  2⤵
  PID:12764
- C:\Windows\System\FZbAizn.exe
  C:\Windows\System\FZbAizn.exe
  2⤵
  PID:12780
- C:\Windows\System\bgqQovj.exe
  C:\Windows\System\bgqQovj.exe
  2⤵
  PID:12808
- C:\Windows\System\ClKSoiX.exe
  C:\Windows\System\ClKSoiX.exe
  2⤵
  PID:12824
- C:\Windows\System\GqClQcv.exe
  C:\Windows\System\GqClQcv.exe
  2⤵
  PID:12840
- C:\Windows\System\ZlcjwGy.exe
  C:\Windows\System\ZlcjwGy.exe
  2⤵
  PID:12856
- C:\Windows\System\cmFyeWb.exe
  C:\Windows\System\cmFyeWb.exe
  2⤵
  PID:12872
- C:\Windows\System\KeMTBKe.exe
  C:\Windows\System\KeMTBKe.exe
  2⤵
  PID:12892
- C:\Windows\System\iruvTWc.exe
  C:\Windows\System\iruvTWc.exe
  2⤵
  PID:12912
- C:\Windows\System\sjPAeNy.exe
  C:\Windows\System\sjPAeNy.exe
  2⤵
  PID:12940
- C:\Windows\System\MhpFNaj.exe
  C:\Windows\System\MhpFNaj.exe
  2⤵
  PID:12964
- C:\Windows\System\WfblSZN.exe
  C:\Windows\System\WfblSZN.exe
  2⤵
  PID:12988
- C:\Windows\System\SciDylV.exe
  C:\Windows\System\SciDylV.exe
  2⤵
  PID:13012
- C:\Windows\System\xmbrvYw.exe
  C:\Windows\System\xmbrvYw.exe
  2⤵
  PID:13036
- C:\Windows\System\LBlPWDd.exe
  C:\Windows\System\LBlPWDd.exe
  2⤵
  PID:13056
- C:\Windows\System\mAMPBMN.exe
  C:\Windows\System\mAMPBMN.exe
  2⤵
  PID:13080
- C:\Windows\System\DQStawF.exe
  C:\Windows\System\DQStawF.exe
  2⤵
  PID:13104
- C:\Windows\System\hnjCUvA.exe
  C:\Windows\System\hnjCUvA.exe
  2⤵
  PID:13132
- C:\Windows\System\kPCyyNi.exe
  C:\Windows\System\kPCyyNi.exe
  2⤵
  PID:13156
- C:\Windows\System\ejlAquG.exe
  C:\Windows\System\ejlAquG.exe
  2⤵
  PID:13184
- C:\Windows\System\OGbSORM.exe
  C:\Windows\System\OGbSORM.exe
  2⤵
  PID:13208
- C:\Windows\System\uQWaDDa.exe
  C:\Windows\System\uQWaDDa.exe
  2⤵
  PID:13232
- C:\Windows\System\RYsBeeX.exe
  C:\Windows\System\RYsBeeX.exe
  2⤵
  PID:13252
- C:\Windows\System\tpCXZIE.exe
  C:\Windows\System\tpCXZIE.exe
  2⤵
  PID:10736
- C:\Windows\System\LdzFxDr.exe
  C:\Windows\System\LdzFxDr.exe
  2⤵
  PID:12644
- C:\Windows\System\GjPoIFs.exe
  C:\Windows\System\GjPoIFs.exe
  2⤵
  PID:12684
- C:\Windows\System\iXXtEYN.exe
  C:\Windows\System\iXXtEYN.exe
  2⤵
  PID:12732
- C:\Windows\System\DVHNUGj.exe
  C:\Windows\System\DVHNUGj.exe
  2⤵
  PID:12804
- C:\Windows\System\ULlcgXw.exe
  C:\Windows\System\ULlcgXw.exe
  2⤵
  PID:12864
- C:\Windows\System\hvGjknn.exe
  C:\Windows\System\hvGjknn.exe
  2⤵
  PID:12936
- C:\Windows\System\kfOFmPM.exe
  C:\Windows\System\kfOFmPM.exe
  2⤵
  PID:13004
- C:\Windows\System\zrCwkQF.exe
  C:\Windows\System\zrCwkQF.exe
  2⤵
  PID:11224
- C:\Windows\System\CRaFghZ.exe
  C:\Windows\System\CRaFghZ.exe
  2⤵
  PID:12088
- C:\Windows\System\dtMPDWc.exe
  C:\Windows\System\dtMPDWc.exe
  2⤵
  PID:13216
- C:\Windows\System\kAbFIPw.exe
  C:\Windows\System\kAbFIPw.exe
  2⤵
  PID:13276
- C:\Windows\System\WFgIODW.exe
  C:\Windows\System\WFgIODW.exe
  2⤵
  PID:8700
- C:\Windows\System\cBIyhVd.exe
  C:\Windows\System\cBIyhVd.exe
  2⤵
  PID:9968
- C:\Windows\System\ccjDQQJ.exe
  C:\Windows\System\ccjDQQJ.exe
  2⤵
  PID:11280
- C:\Windows\System\kLEiboe.exe
  C:\Windows\System\kLEiboe.exe
  2⤵
  PID:11428
- C:\Windows\System\hNBMOwD.exe
  C:\Windows\System\hNBMOwD.exe
  2⤵
  PID:10536
- C:\Windows\System\TxmdXDE.exe
  C:\Windows\System\TxmdXDE.exe
  2⤵
  PID:2224
- C:\Windows\System\YpQoeuc.exe
  C:\Windows\System\YpQoeuc.exe
  2⤵
  PID:12004
- C:\Windows\System\fYDDhUC.exe
  C:\Windows\System\fYDDhUC.exe
  2⤵
  PID:12096
- C:\Windows\System\REjOaiA.exe
  C:\Windows\System\REjOaiA.exe
  2⤵
  PID:12184
- C:\Windows\System\jOUymmP.exe
  C:\Windows\System\jOUymmP.exe
  2⤵
  PID:12252
- C:\Windows\System\TDIilUz.exe
  C:\Windows\System\TDIilUz.exe
  2⤵
  PID:10948
- C:\Windows\System\TYFoScw.exe
  C:\Windows\System\TYFoScw.exe
  2⤵
  PID:12260
- C:\Windows\System\MivzfKA.exe
  C:\Windows\System\MivzfKA.exe
  2⤵
  PID:3484
- C:\Windows\System\gHPmDgC.exe
  C:\Windows\System\gHPmDgC.exe
  2⤵
  PID:12492
- C:\Windows\System\PAKYjii.exe
  C:\Windows\System\PAKYjii.exe
  2⤵
  PID:12544
- C:\Windows\System\RbaOZGN.exe
  C:\Windows\System\RbaOZGN.exe
  2⤵
  PID:12980
- C:\Windows\System\iXwakZP.exe
  C:\Windows\System\iXwakZP.exe
  2⤵
  PID:11384
- C:\Windows\System\UtQUNly.exe
  C:\Windows\System\UtQUNly.exe
  2⤵
  PID:13052
- C:\Windows\System\QZsdbQy.exe
  C:\Windows\System\QZsdbQy.exe
  2⤵
  PID:6912
- C:\Windows\System\ZmdSqGV.exe
  C:\Windows\System\ZmdSqGV.exe
  2⤵
  PID:12668
- C:\Windows\System\xJGerrb.exe
  C:\Windows\System\xJGerrb.exe
  2⤵
  PID:11052
- C:\Windows\System\ArHgAzi.exe
  C:\Windows\System\ArHgAzi.exe
  2⤵
  PID:12500
- C:\Windows\System\UUnrpZm.exe
  C:\Windows\System\UUnrpZm.exe
  2⤵
  PID:13072
- C:\Windows\System\xhCtEQq.exe
  C:\Windows\System\xhCtEQq.exe
  2⤵
  PID:9512
- C:\Windows\System\vHcbiMd.exe
  C:\Windows\System\vHcbiMd.exe
  2⤵
  PID:6468
- C:\Windows\System\fIZtfyv.exe
  C:\Windows\System\fIZtfyv.exe
  2⤵
  PID:6804
- C:\Windows\System\JSGURgo.exe
  C:\Windows\System\JSGURgo.exe
  2⤵
  PID:9200
- C:\Windows\System\QWrkIox.exe
  C:\Windows\System\QWrkIox.exe
  2⤵
  PID:13308
- C:\Windows\System\ijhXccZ.exe
  C:\Windows\System\ijhXccZ.exe
  2⤵
  PID:9952
- C:\Windows\System\TKHUrgM.exe
  C:\Windows\System\TKHUrgM.exe
  2⤵
  PID:3288
- C:\Windows\System\mqkjrdh.exe
  C:\Windows\System\mqkjrdh.exe
  2⤵
  PID:10292
- C:\Windows\System\Pqjppde.exe
  C:\Windows\System\Pqjppde.exe
  2⤵
  PID:3956
- C:\Windows\System\eANyKmV.exe
  C:\Windows\System\eANyKmV.exe
  2⤵
  PID:12372
- C:\Windows\System\jHPVWnd.exe
  C:\Windows\System\jHPVWnd.exe
  2⤵
  PID:8148
- C:\Windows\System\pcbicez.exe
  C:\Windows\System\pcbicez.exe
  2⤵
  PID:2164
- C:\Windows\System\YmcKMfD.exe
  C:\Windows\System\YmcKMfD.exe
  2⤵
  PID:3192
- C:\Windows\System\eVeLCNt.exe
  C:\Windows\System\eVeLCNt.exe
  2⤵
  PID:2052
- C:\Windows\System\cjhmDPF.exe
  C:\Windows\System\cjhmDPF.exe
  2⤵
  PID:2144
- C:\Windows\System\dopFUED.exe
  C:\Windows\System\dopFUED.exe
  2⤵
  PID:9948
- C:\Windows\System\QAQNxqs.exe
  C:\Windows\System\QAQNxqs.exe
  2⤵
  PID:4412
- C:\Windows\System\nUZHiDV.exe
  C:\Windows\System\nUZHiDV.exe
  2⤵
  PID:12832
- C:\Windows\System\TLgjEpR.exe
  C:\Windows\System\TLgjEpR.exe
  2⤵
  PID:5572
- C:\Windows\System\BuYtgYZ.exe
  C:\Windows\System\BuYtgYZ.exe
  2⤵
  PID:11676
- C:\Windows\System\LTCTZdb.exe
  C:\Windows\System\LTCTZdb.exe
  2⤵
  PID:9676
- C:\Windows\System\TPxzbTk.exe
  C:\Windows\System\TPxzbTk.exe
  2⤵
  PID:3388
- C:\Windows\System\QwSxJsj.exe
  C:\Windows\System\QwSxJsj.exe
  2⤵
  PID:2520
- C:\Windows\System\IkDnfhZ.exe
  C:\Windows\System\IkDnfhZ.exe
  2⤵
  PID:3652
- C:\Windows\System\dmoXKsf.exe
  C:\Windows\System\dmoXKsf.exe
  2⤵
  PID:1624
- C:\Windows\System\noDMZcE.exe
  C:\Windows\System\noDMZcE.exe
  2⤵
  PID:12476
- C:\Windows\System\LbmyoNb.exe
  C:\Windows\System\LbmyoNb.exe
  2⤵
  PID:9876
- C:\Windows\System\AfiHjmP.exe
  C:\Windows\System\AfiHjmP.exe
  2⤵
  PID:13048
- C:\Windows\System\ZrcgskX.exe
  C:\Windows\System\ZrcgskX.exe
  2⤵
  PID:4884
- C:\Windows\System\VkXAPaS.exe
  C:\Windows\System\VkXAPaS.exe
  2⤵
  PID:2684
- C:\Windows\System\OSyvlwU.exe
  C:\Windows\System\OSyvlwU.exe
  2⤵
  PID:1748
- C:\Windows\System\nNzQgDQ.exe
  C:\Windows\System\nNzQgDQ.exe
  2⤵
  PID:12972
- C:\Windows\System\IVOUpRp.exe
  C:\Windows\System\IVOUpRp.exe
  2⤵
  PID:10984
- C:\Windows\System\ofBSnEd.exe
  C:\Windows\System\ofBSnEd.exe
  2⤵
  PID:3848
- C:\Windows\System\kGoqtCh.exe
  C:\Windows\System\kGoqtCh.exe
  2⤵
  PID:4288
- C:\Windows\System\rEwGlxz.exe
  C:\Windows\System\rEwGlxz.exe
  2⤵
  PID:2104
- C:\Windows\System\EKkHinH.exe
  C:\Windows\System\EKkHinH.exe
  2⤵
  PID:11232
- C:\Windows\System\wSyZmMv.exe
  C:\Windows\System\wSyZmMv.exe
  2⤵
  PID:11300
- C:\Windows\System\aOKIewm.exe
  C:\Windows\System\aOKIewm.exe
  2⤵
  PID:13120
- C:\Windows\System\PJDireM.exe
  C:\Windows\System\PJDireM.exe
  2⤵
  PID:13292
- C:\Windows\System\nhrjoKM.exe
  C:\Windows\System\nhrjoKM.exe
  2⤵
  PID:3184
- C:\Windows\System\tLxeLID.exe
  C:\Windows\System\tLxeLID.exe
  2⤵
  PID:11856
- C:\Windows\System\FqBVZbi.exe
  C:\Windows\System\FqBVZbi.exe
  2⤵
  PID:12340
- C:\Windows\System\KPyPSdz.exe
  C:\Windows\System\KPyPSdz.exe
  2⤵
  PID:8888
- C:\Windows\System\kmicoZc.exe
  C:\Windows\System\kmicoZc.exe
  2⤵
  PID:3352
- C:\Windows\System\dAyklRe.exe
  C:\Windows\System\dAyklRe.exe
  2⤵
  PID:9500
- C:\Windows\System\vtJCGQn.exe
  C:\Windows\System\vtJCGQn.exe
  2⤵
  PID:3312
- C:\Windows\System\WFsUgjR.exe
  C:\Windows\System\WFsUgjR.exe
  2⤵
  PID:12304
- C:\Windows\System\GWEGEQF.exe
  C:\Windows\System\GWEGEQF.exe
  2⤵
  PID:9300
- C:\Windows\System\AAWDLej.exe
  C:\Windows\System\AAWDLej.exe
  2⤵
  PID:9796
- C:\Windows\System\xifKwUt.exe
  C:\Windows\System\xifKwUt.exe
  2⤵
  PID:3576
- C:\Windows\System\HxmQEPs.exe
  C:\Windows\System\HxmQEPs.exe
  2⤵
  PID:1316
- C:\Windows\System\OwmqJss.exe
  C:\Windows\System\OwmqJss.exe
  2⤵
  PID:3640
- C:\Windows\System\JowXvYj.exe
  C:\Windows\System\JowXvYj.exe
  2⤵
  PID:13380
- C:\Windows\System\oYWdBNN.exe
  C:\Windows\System\oYWdBNN.exe
  2⤵
  PID:13452
- C:\Windows\System\COvzuDG.exe
  C:\Windows\System\COvzuDG.exe
  2⤵
  PID:13516
- C:\Windows\System\oUJTneO.exe
  C:\Windows\System\oUJTneO.exe
  2⤵
  PID:13560
- C:\Windows\System\zGkgGtI.exe
  C:\Windows\System\zGkgGtI.exe
  2⤵
  PID:13580
- C:\Windows\System\pifkKqW.exe
  C:\Windows\System\pifkKqW.exe
  2⤵
  PID:13624
- C:\Windows\System\UOTOxoR.exe
  C:\Windows\System\UOTOxoR.exe
  2⤵
  PID:13668
- C:\Windows\System\ysOhNFY.exe
  C:\Windows\System\ysOhNFY.exe
  2⤵
  PID:13700
- C:\Windows\System\EooeHLk.exe
  C:\Windows\System\EooeHLk.exe
  2⤵
  PID:13724
- C:\Windows\System\XCRufHf.exe
  C:\Windows\System\XCRufHf.exe
  2⤵
  PID:13780
- C:\Windows\System\oZgYBiV.exe
  C:\Windows\System\oZgYBiV.exe
  2⤵
  PID:13836
- C:\Windows\System\alzeZNO.exe
  C:\Windows\System\alzeZNO.exe
  2⤵
  PID:13880
- C:\Windows\System\ftLWENI.exe
  C:\Windows\System\ftLWENI.exe
  2⤵
  PID:13932
- C:\Windows\System\YcEqVnk.exe
  C:\Windows\System\YcEqVnk.exe
  2⤵
  PID:13952
- C:\Windows\System\YLdEPkA.exe
  C:\Windows\System\YLdEPkA.exe
  2⤵
  PID:14052
- C:\Windows\System\hMxbTdv.exe
  C:\Windows\System\hMxbTdv.exe
  2⤵
  PID:14172
- C:\Windows\System\fXiomCC.exe
  C:\Windows\System\fXiomCC.exe
  2⤵
  PID:14240
- C:\Windows\System\FgJTIhc.exe
  C:\Windows\System\FgJTIhc.exe
  2⤵
  PID:1260
- C:\Windows\System\IyMBSeS.exe
  C:\Windows\System\IyMBSeS.exe
  2⤵
  PID:13352
- C:\Windows\System\cshPqzY.exe
  C:\Windows\System\cshPqzY.exe
  2⤵
  PID:13400
- C:\Windows\System\SCbOHvB.exe
  C:\Windows\System\SCbOHvB.exe
  2⤵
  PID:13404
- C:\Windows\System\SdXSTTC.exe
  C:\Windows\System\SdXSTTC.exe
  2⤵
  PID:13316
- C:\Windows\System\sfaUoua.exe
  C:\Windows\System\sfaUoua.exe
  2⤵
  PID:3648
- C:\Windows\System\BNjDchm.exe
  C:\Windows\System\BNjDchm.exe
  2⤵
  PID:13532
- C:\Windows\System\HUwBHbC.exe
  C:\Windows\System\HUwBHbC.exe
  2⤵
  PID:3528
- C:\Windows\System\CNGrWbe.exe
  C:\Windows\System\CNGrWbe.exe
  2⤵
  PID:13568
- C:\Windows\System\EaVhnER.exe
  C:\Windows\System\EaVhnER.exe
  2⤵
  PID:1208
- C:\Windows\System\vaJhnIz.exe
  C:\Windows\System\vaJhnIz.exe
  2⤵
  PID:5012
- C:\Windows\System\lQlAStY.exe
  C:\Windows\System\lQlAStY.exe
  2⤵
  PID:13960
- C:\Windows\System\lDxcpqP.exe
  C:\Windows\System\lDxcpqP.exe
  2⤵
  PID:13816
- C:\Windows\System\IqemCgs.exe
  C:\Windows\System\IqemCgs.exe
  2⤵
  PID:2956
- C:\Windows\System\FkxGwWI.exe
  C:\Windows\System\FkxGwWI.exe
  2⤵
  PID:12108
- C:\Windows\System\wEEbCqf.exe
  C:\Windows\System\wEEbCqf.exe
  2⤵
  PID:12204
- C:\Windows\System\TUAWAqZ.exe
  C:\Windows\System\TUAWAqZ.exe
  2⤵
  PID:4356
- C:\Windows\System\NffdhLZ.exe
  C:\Windows\System\NffdhLZ.exe
  2⤵
  PID:5472
- C:\Windows\System\WUcnpag.exe
  C:\Windows\System\WUcnpag.exe
  2⤵
  PID:14020
- C:\Windows\System\iJcrrMH.exe
  C:\Windows\System\iJcrrMH.exe
  2⤵
  PID:5804
- C:\Windows\System\ApxAijA.exe
  C:\Windows\System\ApxAijA.exe
  2⤵
  PID:14064
- C:\Windows\System\zmNukLz.exe
  C:\Windows\System\zmNukLz.exe
  2⤵
  PID:3920
- C:\Windows\System\nanzQWk.exe
  C:\Windows\System\nanzQWk.exe
  2⤵
  PID:5452
- C:\Windows\System\yLPkyQa.exe
  C:\Windows\System\yLPkyQa.exe
  2⤵
  PID:5540
- C:\Windows\System\mTTNUuh.exe
  C:\Windows\System\mTTNUuh.exe
  2⤵
  PID:5708
- C:\Windows\System\EdoIGBw.exe
  C:\Windows\System\EdoIGBw.exe
  2⤵
  PID:3992
- C:\Windows\System\xnwDAbL.exe
  C:\Windows\System\xnwDAbL.exe
  2⤵
  PID:6216
- C:\Windows\System\htBCEut.exe
  C:\Windows\System\htBCEut.exe
  2⤵
  PID:564
- C:\Windows\System\SSuPFWs.exe
  C:\Windows\System\SSuPFWs.exe
  2⤵
  PID:5240
- C:\Windows\System\PhEhZHy.exe
  C:\Windows\System\PhEhZHy.exe
  2⤵
  PID:6712
- C:\Windows\System\bySDste.exe
  C:\Windows\System\bySDste.exe
  2⤵
  PID:5356
- C:\Windows\System\yYJYYbf.exe
  C:\Windows\System\yYJYYbf.exe
  2⤵
  PID:14208
- C:\Windows\System\BpOfqqS.exe
  C:\Windows\System\BpOfqqS.exe
  2⤵
  PID:14032
- C:\Windows\System\LtTrwXu.exe
  C:\Windows\System\LtTrwXu.exe
  2⤵
  PID:14104
- C:\Windows\System\ebJZAHB.exe
  C:\Windows\System\ebJZAHB.exe
  2⤵
  PID:5188
- C:\Windows\System\nuOLxuI.exe
  C:\Windows\System\nuOLxuI.exe
  2⤵
  PID:5140
- C:\Windows\System\aiiiPsa.exe
  C:\Windows\System\aiiiPsa.exe
  2⤵
  PID:14184
- C:\Windows\System\AcfdEvg.exe
  C:\Windows\System\AcfdEvg.exe
  2⤵
  PID:1804
- C:\Windows\System\WWMzPTK.exe
  C:\Windows\System\WWMzPTK.exe
  2⤵
  PID:5372
- C:\Windows\System\bXIGXai.exe
  C:\Windows\System\bXIGXai.exe
  2⤵
  PID:6776
- C:\Windows\System\bDzxsJd.exe
  C:\Windows\System\bDzxsJd.exe
  2⤵
  PID:6492
- C:\Windows\System\fXUozKp.exe
  C:\Windows\System\fXUozKp.exe
  2⤵
  PID:3144
- C:\Windows\System\PglTyhP.exe
  C:\Windows\System\PglTyhP.exe
  2⤵
  PID:2824
- C:\Windows\System\kftfnMU.exe
  C:\Windows\System\kftfnMU.exe
  2⤵
  PID:4840
- C:\Windows\System\zBWCNGE.exe
  C:\Windows\System\zBWCNGE.exe
  2⤵
  PID:4560
- C:\Windows\System\HKZEYuB.exe
  C:\Windows\System\HKZEYuB.exe
  2⤵
  PID:13804
- C:\Windows\System\ViZcnvG.exe
  C:\Windows\System\ViZcnvG.exe
  2⤵
  PID:13488
- C:\Windows\System\qkoxORW.exe
  C:\Windows\System\qkoxORW.exe
  2⤵
  PID:13676
- C:\Windows\System\mTpbJBV.exe
  C:\Windows\System\mTpbJBV.exe
  2⤵
  PID:13720
- C:\Windows\System\otBtXZu.exe
  C:\Windows\System\otBtXZu.exe
  2⤵
  PID:13620
- C:\Windows\System\XFAVIqd.exe
  C:\Windows\System\XFAVIqd.exe
  2⤵
  PID:13776
- C:\Windows\System\LiOqJNW.exe
  C:\Windows\System\LiOqJNW.exe
  2⤵
  PID:7028
- C:\Windows\System\bvqXFaM.exe
  C:\Windows\System\bvqXFaM.exe
  2⤵
  PID:6324
- C:\Windows\System\IEquUNx.exe
  C:\Windows\System\IEquUNx.exe
  2⤵
  PID:3376
- C:\Windows\System\uPIVHDW.exe
  C:\Windows\System\uPIVHDW.exe
  2⤵
  PID:13496
- C:\Windows\System\GViXxfQ.exe
  C:\Windows\System\GViXxfQ.exe
  2⤵
  PID:13648
- C:\Windows\System\cSnZHXL.exe
  C:\Windows\System\cSnZHXL.exe
  2⤵
  PID:13608
- C:\Windows\System\AUcOqjR.exe
  C:\Windows\System\AUcOqjR.exe
  2⤵
  PID:13888
- C:\Windows\System\TjvEFgY.exe
  C:\Windows\System\TjvEFgY.exe
  2⤵
  PID:14008
- C:\Windows\System\hpibhRw.exe
  C:\Windows\System\hpibhRw.exe
  2⤵
  PID:5684
- C:\Windows\System\kWqGgqd.exe
  C:\Windows\System\kWqGgqd.exe
  2⤵
  PID:8152
- C:\Windows\System\CPCazRJ.exe
  C:\Windows\System\CPCazRJ.exe
  2⤵
  PID:7476
- C:\Windows\System\HcVsKal.exe
  C:\Windows\System\HcVsKal.exe
  2⤵
  PID:7500
- C:\Windows\System\KyeYUep.exe
  C:\Windows\System\KyeYUep.exe
  2⤵
  PID:14124
- C:\Windows\System\bUUQofm.exe
  C:\Windows\System\bUUQofm.exe
  2⤵
  PID:14144
- C:\Windows\System\IqhhzTQ.exe
  C:\Windows\System\IqhhzTQ.exe
  2⤵
  PID:5944
- C:\Windows\System\NUZsBiv.exe
  C:\Windows\System\NUZsBiv.exe
  2⤵
  PID:13996
- C:\Windows\System\cvJGval.exe
  C:\Windows\System\cvJGval.exe
  2⤵
  PID:6476
- C:\Windows\System\NbNGQBt.exe
  C:\Windows\System\NbNGQBt.exe
  2⤵
  PID:8052
- C:\Windows\System\pIvIHyf.exe
  C:\Windows\System\pIvIHyf.exe
  2⤵
  PID:6728
- C:\Windows\System\UgmoYzn.exe
  C:\Windows\System\UgmoYzn.exe
  2⤵
  PID:6772
- C:\Windows\System\iqZlhyX.exe
  C:\Windows\System\iqZlhyX.exe
  2⤵
  PID:6632
- C:\Windows\System\lSFNSgZ.exe
  C:\Windows\System\lSFNSgZ.exe
  2⤵
  PID:14320
- C:\Windows\System\OLBDpNE.exe
  C:\Windows\System\OLBDpNE.exe
  2⤵
  PID:632
- C:\Windows\System\YnQeBLq.exe
  C:\Windows\System\YnQeBLq.exe
  2⤵
  PID:6000
- C:\Windows\System\IBfWPuq.exe
  C:\Windows\System\IBfWPuq.exe
  2⤵
  PID:6876
- C:\Windows\System\flcRJlM.exe
  C:\Windows\System\flcRJlM.exe
  2⤵
  PID:6996
- C:\Windows\System\sqdFzaA.exe
  C:\Windows\System\sqdFzaA.exe
  2⤵
  PID:13392
- C:\Windows\System\CtzKdTq.exe
  C:\Windows\System\CtzKdTq.exe
  2⤵
  PID:13576
- C:\Windows\System\CcGhKkK.exe
  C:\Windows\System\CcGhKkK.exe
  2⤵
  PID:8336
- C:\Windows\System\Cxackxh.exe
  C:\Windows\System\Cxackxh.exe
  2⤵
  PID:13428
- C:\Windows\System\jfZeHsj.exe
  C:\Windows\System\jfZeHsj.exe
  2⤵
  PID:13556
- C:\Windows\System\VcIasNF.exe
  C:\Windows\System\VcIasNF.exe
  2⤵
  PID:13712
- C:\Windows\System\cNZUdit.exe
  C:\Windows\System\cNZUdit.exe
  2⤵
  PID:8712
- C:\Windows\System\MmzcUMt.exe
  C:\Windows\System\MmzcUMt.exe
  2⤵
  PID:13844
- C:\Windows\System\RIUyfFX.exe
  C:\Windows\System\RIUyfFX.exe
  2⤵
  PID:1180
- C:\Windows\System\AqFzDzH.exe
  C:\Windows\System\AqFzDzH.exe
  2⤵
  PID:6248
- C:\Windows\System\jhVlpqb.exe
  C:\Windows\System\jhVlpqb.exe
  2⤵
  PID:9056
- C:\Windows\System\NQsLzzJ.exe
  C:\Windows\System\NQsLzzJ.exe
  2⤵
  PID:9860
- C:\Windows\System\trCEGnj.exe
  C:\Windows\System\trCEGnj.exe
  2⤵
  PID:5468
- C:\Windows\System\ktbPHvd.exe
  C:\Windows\System\ktbPHvd.exe
  2⤵
  PID:7224
- C:\Windows\System\LLNkeVX.exe
  C:\Windows\System\LLNkeVX.exe
  2⤵
  PID:7312
- C:\Windows\System\mKkbxXS.exe
  C:\Windows\System\mKkbxXS.exe
  2⤵
  PID:5612
- C:\Windows\System\pzKjAvy.exe
  C:\Windows\System\pzKjAvy.exe
  2⤵
  PID:12072
- C:\Windows\System\GOMaxGz.exe
  C:\Windows\System\GOMaxGz.exe
  2⤵
  PID:13192
- C:\Windows\System\qeSGsop.exe
  C:\Windows\System\qeSGsop.exe
  2⤵
  PID:4416
- C:\Windows\System\bQmNXfG.exe
  C:\Windows\System\bQmNXfG.exe
  2⤵
  PID:3504
- C:\Windows\System\yirbOqt.exe
  C:\Windows\System\yirbOqt.exe
  2⤵
  PID:6444
- C:\Windows\System\JZDbhBq.exe
  C:\Windows\System\JZDbhBq.exe
  2⤵
  PID:8100
- C:\Windows\System\ffXGdWl.exe
  C:\Windows\System\ffXGdWl.exe
  2⤵
  PID:5740
- C:\Windows\System\OrRgPiv.exe
  C:\Windows\System\OrRgPiv.exe
  2⤵
  PID:6356
- C:\Windows\System\XlktRZs.exe
  C:\Windows\System\XlktRZs.exe
  2⤵
  PID:3136
- C:\Windows\System\pWGIwsx.exe
  C:\Windows\System\pWGIwsx.exe
  2⤵
  PID:4328
- C:\Windows\System\FmdhZTU.exe
  C:\Windows\System\FmdhZTU.exe
  2⤵
  PID:14100
- C:\Windows\System\YhNdwMc.exe
  C:\Windows\System\YhNdwMc.exe
  2⤵
  PID:7772
- C:\Windows\System\jcysczK.exe
  C:\Windows\System\jcysczK.exe
  2⤵
  PID:8180
- C:\Windows\System\TmDzgtm.exe
  C:\Windows\System\TmDzgtm.exe
  2⤵
  PID:8936
- C:\Windows\System\sWcetHN.exe
  C:\Windows\System\sWcetHN.exe
  2⤵
  PID:9896
- C:\Windows\System\dohfewq.exe
  C:\Windows\System\dohfewq.exe
  2⤵
  PID:7652
- C:\Windows\System\TkGkaDD.exe
  C:\Windows\System\TkGkaDD.exe
  2⤵
  PID:9944
- C:\Windows\System\IphuvyX.exe
  C:\Windows\System\IphuvyX.exe
  2⤵
  PID:7184
- C:\Windows\System\hHwdczF.exe
  C:\Windows\System\hHwdczF.exe
  2⤵
  PID:10580
- C:\Windows\System\yKpuGTX.exe
  C:\Windows\System\yKpuGTX.exe
  2⤵
  PID:5196
- C:\Windows\System\CtLlFRs.exe
  C:\Windows\System\CtLlFRs.exe
  2⤵
  PID:11096
- C:\Windows\System\uMgJpBI.exe
  C:\Windows\System\uMgJpBI.exe
  2⤵
  PID:7496
- C:\Windows\System\UexRfpw.exe
  C:\Windows\System\UexRfpw.exe
  2⤵
  PID:11236
- C:\Windows\System\BbyhmkI.exe
  C:\Windows\System\BbyhmkI.exe
  2⤵
  PID:3900
- C:\Windows\System\eyvMHgl.exe
  C:\Windows\System\eyvMHgl.exe
  2⤵
  PID:14316
- C:\Windows\System\WFidvxm.exe
  C:\Windows\System\WFidvxm.exe
  2⤵
  PID:6592
- C:\Windows\System\jwcTlYJ.exe
  C:\Windows\System\jwcTlYJ.exe
  2⤵
  PID:9004
- C:\Windows\System\BLXFJJD.exe
  C:\Windows\System\BLXFJJD.exe
  2⤵
  PID:8732
- C:\Windows\System\nRwURdn.exe
  C:\Windows\System\nRwURdn.exe
  2⤵
  PID:6656
- C:\Windows\System\FGNbLSC.exe
  C:\Windows\System\FGNbLSC.exe
  2⤵
  PID:11364
- C:\Windows\System\cnselAd.exe
  C:\Windows\System\cnselAd.exe
  2⤵
  PID:9048
- C:\Windows\System\fyYlRGU.exe
  C:\Windows\System\fyYlRGU.exe
  2⤵
  PID:9072
- C:\Windows\System\ZfMBXov.exe
  C:\Windows\System\ZfMBXov.exe
  2⤵
  PID:11520
- C:\Windows\System\YvthObI.exe
  C:\Windows\System\YvthObI.exe
  2⤵
  PID:9100
- C:\Windows\System\TgKDjTC.exe
  C:\Windows\System\TgKDjTC.exe
  2⤵
  PID:10432
- C:\Windows\System\mFVnbwQ.exe
  C:\Windows\System\mFVnbwQ.exe
  2⤵
  PID:13508
- C:\Windows\System\aZKxpkk.exe
  C:\Windows\System\aZKxpkk.exe
  2⤵
  PID:8072
- C:\Windows\System\wtzXMDu.exe
  C:\Windows\System\wtzXMDu.exe
  2⤵
  PID:11784
- C:\Windows\System\fQNceTS.exe
  C:\Windows\System\fQNceTS.exe
  2⤵
  PID:3420
- C:\Windows\System\fgTPiUZ.exe
  C:\Windows\System\fgTPiUZ.exe
  2⤵
  PID:10720
- C:\Windows\System\KGnbwcU.exe
  C:\Windows\System\KGnbwcU.exe
  2⤵
  PID:10792
- C:\Windows\System\XBtJNeP.exe
  C:\Windows\System\XBtJNeP.exe
  2⤵
  PID:13664
- C:\Windows\System\YHuMLlu.exe
  C:\Windows\System\YHuMLlu.exe
  2⤵
  PID:10892
- C:\Windows\System\cIpvdoN.exe
  C:\Windows\System\cIpvdoN.exe
  2⤵
  PID:8648
- C:\Windows\System\eUZtIWc.exe
  C:\Windows\System\eUZtIWc.exe
  2⤵
  PID:10988
- C:\Windows\System\OVZSjpF.exe
  C:\Windows\System\OVZSjpF.exe
  2⤵
  PID:13944
- C:\Windows\System\ECsXaNp.exe
  C:\Windows\System\ECsXaNp.exe
  2⤵
  PID:11952
- C:\Windows\System\lhzNfVb.exe
  C:\Windows\System\lhzNfVb.exe
  2⤵
  PID:11180
- C:\Windows\System\wfYJyuo.exe
  C:\Windows\System\wfYJyuo.exe
  2⤵
  PID:11256
- C:\Windows\System\LMxFray.exe
  C:\Windows\System\LMxFray.exe
  2⤵
  PID:8692
- C:\Windows\System\MWfaMCn.exe
  C:\Windows\System\MWfaMCn.exe
  2⤵
  PID:8556
- C:\Windows\System\SiCNHeB.exe
  C:\Windows\System\SiCNHeB.exe
  2⤵
  PID:2140
- C:\Windows\System\BBDquSe.exe
  C:\Windows\System\BBDquSe.exe
  2⤵
  PID:7116
- C:\Windows\System\aNZezTa.exe
  C:\Windows\System\aNZezTa.exe
  2⤵
  PID:11540
- C:\Windows\System\LpwuXDv.exe
  C:\Windows\System\LpwuXDv.exe
  2⤵
  PID:13796
- C:\Windows\System\blMBitQ.exe
  C:\Windows\System\blMBitQ.exe
  2⤵
  PID:11260
- C:\Windows\System\BicqpJu.exe
  C:\Windows\System\BicqpJu.exe
  2⤵
  PID:8584
- C:\Windows\System\HubTzno.exe
  C:\Windows\System\HubTzno.exe
  2⤵
  PID:11632
- C:\Windows\System\sqfxBde.exe
  C:\Windows\System\sqfxBde.exe
  2⤵
  PID:6088
- C:\Windows\System\RpQiZXd.exe
  C:\Windows\System\RpQiZXd.exe
  2⤵
  PID:4956
- C:\Windows\System\OEwXLeQ.exe
  C:\Windows\System\OEwXLeQ.exe
  2⤵
  PID:5820
- C:\Windows\System\JJcdFHH.exe
  C:\Windows\System\JJcdFHH.exe
  2⤵
  PID:7664
- C:\Windows\System\fvTLUze.exe
  C:\Windows\System\fvTLUze.exe
  2⤵
  PID:8028
- C:\Windows\System\couuqmn.exe
  C:\Windows\System\couuqmn.exe
  2⤵
  PID:7948
- C:\Windows\System\NyJHdmK.exe
  C:\Windows\System\NyJHdmK.exe
  2⤵
  PID:7480
- C:\Windows\System\RTDRgQF.exe
  C:\Windows\System\RTDRgQF.exe
  2⤵
  PID:9444
- C:\Windows\System\NXYfmpY.exe
  C:\Windows\System\NXYfmpY.exe
  2⤵
  PID:9468
- C:\Windows\System\qjUkgry.exe
  C:\Windows\System\qjUkgry.exe
  2⤵
  PID:9560
- C:\Windows\System\wmAbcaK.exe
  C:\Windows\System\wmAbcaK.exe
  2⤵
  PID:6160
- C:\Windows\System\MoSLZtf.exe
  C:\Windows\System\MoSLZtf.exe
  2⤵
  PID:8848
- C:\Windows\System\dFOHDQy.exe
  C:\Windows\System\dFOHDQy.exe
  2⤵
  PID:7644
- C:\Windows\System\OLVaPhW.exe
  C:\Windows\System\OLVaPhW.exe
  2⤵
  PID:7896
- C:\Windows\System\PfjOKAR.exe
  C:\Windows\System\PfjOKAR.exe
  2⤵
  PID:11340
- C:\Windows\System\kZtoZFR.exe
  C:\Windows\System\kZtoZFR.exe
  2⤵
  PID:14152
- C:\Windows\System\eBywoIJ.exe
  C:\Windows\System\eBywoIJ.exe
  2⤵
  PID:10468
- C:\Windows\System\iYdDDhb.exe
  C:\Windows\System\iYdDDhb.exe
  2⤵
  PID:5144
- C:\Windows\System\tHVrBta.exe
  C:\Windows\System\tHVrBta.exe
  2⤵
  PID:9740
- C:\Windows\System\YhiFVUO.exe
  C:\Windows\System\YhiFVUO.exe
  2⤵
  PID:10088
- C:\Windows\System\VlSruau.exe
  C:\Windows\System\VlSruau.exe
  2⤵
  PID:10588
- C:\Windows\System\LVQDgSu.exe
  C:\Windows\System\LVQDgSu.exe
  2⤵
  PID:12300
- C:\Windows\System\EjphTiJ.exe
  C:\Windows\System\EjphTiJ.exe
  2⤵
  PID:10128
- C:\Windows\System\DkJePkS.exe
  C:\Windows\System\DkJePkS.exe
  2⤵
  PID:10136
- C:\Windows\System\IVgXcSV.exe
  C:\Windows\System\IVgXcSV.exe
  2⤵
  PID:10156
- C:\Windows\System\yVCnyAZ.exe
  C:\Windows\System\yVCnyAZ.exe
  2⤵
  PID:7712
- C:\Windows\System\HpZqpZl.exe
  C:\Windows\System\HpZqpZl.exe
  2⤵
  PID:6556
- C:\Windows\System\HHLiVXX.exe
  C:\Windows\System\HHLiVXX.exe
  2⤵
  PID:10200
- C:\Windows\System\aDPGFjG.exe
  C:\Windows\System\aDPGFjG.exe
  2⤵
  PID:12620
- C:\Windows\System\itGbLFG.exe
  C:\Windows\System\itGbLFG.exe
  2⤵
  PID:5872
- C:\Windows\System\IpXMkRM.exe
  C:\Windows\System\IpXMkRM.exe
  2⤵
  PID:12908
- C:\Windows\System\VlwhgQI.exe
  C:\Windows\System\VlwhgQI.exe
  2⤵
  PID:13364
- C:\Windows\System\beyfFWF.exe
  C:\Windows\System\beyfFWF.exe
  2⤵
  PID:7324
- C:\Windows\System\UZanCeX.exe
  C:\Windows\System\UZanCeX.exe
  2⤵
  PID:13448
- C:\Windows\System\VBkeRAv.exe
  C:\Windows\System\VBkeRAv.exe
  2⤵
  PID:10460
- C:\Windows\System\UOxXBWI.exe
  C:\Windows\System\UOxXBWI.exe
  2⤵
  PID:13716
- C:\Windows\System\kMjLMxG.exe
  C:\Windows\System\kMjLMxG.exe
  2⤵
  PID:10744
- C:\Windows\System\pZmVaTa.exe
  C:\Windows\System\pZmVaTa.exe
  2⤵
  PID:9268
- C:\Windows\System\ihlduXq.exe
  C:\Windows\System\ihlduXq.exe
  2⤵
  PID:11924
- C:\Windows\System\ksJezlO.exe
  C:\Windows\System\ksJezlO.exe
  2⤵
  PID:11948
- C:\Windows\System\gUCZzFd.exe
  C:\Windows\System\gUCZzFd.exe
  2⤵
  PID:12216
- C:\Windows\System\SaYslDi.exe
  C:\Windows\System\SaYslDi.exe
  2⤵
  PID:3728
- C:\Windows\System\YWrYHmC.exe
  C:\Windows\System\YWrYHmC.exe
  2⤵
  PID:4780
- C:\Windows\System\dCDPCrF.exe
  C:\Windows\System\dCDPCrF.exe
  2⤵
  PID:7056
- C:\Windows\System\DSvDgTj.exe
  C:\Windows\System\DSvDgTj.exe
  2⤵
  PID:7288
- C:\Windows\System\fDYXKjX.exe
  C:\Windows\System\fDYXKjX.exe
  2⤵
  PID:8040
- C:\Windows\System\tAubwBN.exe
  C:\Windows\System\tAubwBN.exe
  2⤵
  PID:5236
- C:\Windows\System\kxMGPpw.exe
  C:\Windows\System\kxMGPpw.exe
  2⤵
  PID:10044
- C:\Windows\System\hrDnfsw.exe
  C:\Windows\System\hrDnfsw.exe
  2⤵
  PID:10112
- C:\Windows\System\hrZMELQ.exe
  C:\Windows\System\hrZMELQ.exe
  2⤵
  PID:6036
- C:\Windows\System\euBiYor.exe
  C:\Windows\System\euBiYor.exe
  2⤵
  PID:2132
- C:\Windows\System\qAsXjdg.exe
  C:\Windows\System\qAsXjdg.exe
  2⤵
  PID:8632
- C:\Windows\System\GIDFVbQ.exe
  C:\Windows\System\GIDFVbQ.exe
  2⤵
  PID:13200
- C:\Windows\System\uoaRWCk.exe
  C:\Windows\System\uoaRWCk.exe
  2⤵
  PID:11872
- C:\Windows\System\uJAnNRg.exe
  C:\Windows\System\uJAnNRg.exe
  2⤵
  PID:11480
- C:\Windows\System\vqsbjBw.exe
  C:\Windows\System\vqsbjBw.exe
  2⤵
  PID:7700
- C:\Windows\System\Ebtumlv.exe
  C:\Windows\System\Ebtumlv.exe
  2⤵
  PID:9196
- C:\Windows\System\jUJrVqh.exe
  C:\Windows\System\jUJrVqh.exe
  2⤵
  PID:9976
- C:\Windows\System\ZGRTSIA.exe
  C:\Windows\System\ZGRTSIA.exe
  2⤵
  PID:11668
- C:\Windows\System\DShkFgw.exe
  C:\Windows\System\DShkFgw.exe
  2⤵
  PID:11748
- C:\Windows\System\AbMSkyh.exe
  C:\Windows\System\AbMSkyh.exe
  2⤵
  PID:9308
- C:\Windows\System\qjedWYV.exe
  C:\Windows\System\qjedWYV.exe
  2⤵
  PID:12432
- C:\Windows\System\WGvpCIO.exe
  C:\Windows\System\WGvpCIO.exe
  2⤵
  PID:12112
- C:\Windows\System\uTFegZj.exe
  C:\Windows\System\uTFegZj.exe
  2⤵
  PID:5824
- C:\Windows\System\DJhNdtv.exe
  C:\Windows\System\DJhNdtv.exe
  2⤵
  PID:12280
- C:\Windows\System\mjtPGVl.exe
  C:\Windows\System\mjtPGVl.exe
  2⤵
  PID:12604
- C:\Windows\System\SsnjahU.exe
  C:\Windows\System\SsnjahU.exe
  2⤵
  PID:5536
- C:\Windows\System\DNoJGgl.exe
  C:\Windows\System\DNoJGgl.exe
  2⤵
  PID:4604
- C:\Windows\System\UnnpckJ.exe
  C:\Windows\System\UnnpckJ.exe
  2⤵
  PID:6704
- C:\Windows\System\mksRNhV.exe
  C:\Windows\System\mksRNhV.exe
  2⤵
  PID:8296
- C:\Windows\System\meDsxry.exe
  C:\Windows\System\meDsxry.exe
  2⤵
  PID:11320
- C:\Windows\System\rsRYDmS.exe
  C:\Windows\System\rsRYDmS.exe
  2⤵
  PID:7856
- C:\Windows\System\cvSTITq.exe
  C:\Windows\System\cvSTITq.exe
  2⤵
  PID:10304
- C:\Windows\System\PTwJXFO.exe
  C:\Windows\System\PTwJXFO.exe
  2⤵
  PID:12660
- C:\Windows\System\SAaibuh.exe
  C:\Windows\System\SAaibuh.exe
  2⤵
  PID:2188
- C:\Windows\System\ZffoJBx.exe
  C:\Windows\System\ZffoJBx.exe
  2⤵
  PID:4452
- C:\Windows\System\HzQtJez.exe
  C:\Windows\System\HzQtJez.exe
  2⤵
  PID:12960
- C:\Windows\System\oCpkCgI.exe
  C:\Windows\System\oCpkCgI.exe
  2⤵
  PID:10256
- C:\Windows\System\QdglKPC.exe
  C:\Windows\System\QdglKPC.exe
  2⤵
  PID:3556
- C:\Windows\System\BOclIaA.exe
  C:\Windows\System\BOclIaA.exe
  2⤵
  PID:11796
- C:\Windows\System\niLfgaL.exe
  C:\Windows\System\niLfgaL.exe
  2⤵
  PID:13044
- C:\Windows\System\KzDaQmH.exe
  C:\Windows\System\KzDaQmH.exe
  2⤵
  PID:10600
- C:\Windows\System\OBbXcfI.exe
  C:\Windows\System\OBbXcfI.exe
  2⤵
  PID:9808
- C:\Windows\System\uEUdlSd.exe
  C:\Windows\System\uEUdlSd.exe
  2⤵
  PID:844
- C:\Windows\System\LlKyTLX.exe
  C:\Windows\System\LlKyTLX.exe
  2⤵
  PID:9564
- C:\Windows\System\rpbLQFo.exe
  C:\Windows\System\rpbLQFo.exe
  2⤵
  PID:6220
- C:\Windows\System\qDffPVb.exe
  C:\Windows\System\qDffPVb.exe
  2⤵
  PID:7792
- C:\Windows\System\YJVnVIo.exe
  C:\Windows\System\YJVnVIo.exe
  2⤵
  PID:10484
- C:\Windows\System\XNQOlBM.exe
  C:\Windows\System\XNQOlBM.exe
  2⤵
  PID:7600
- C:\Windows\System\oxmKqHn.exe
  C:\Windows\System\oxmKqHn.exe
  2⤵
  PID:11072
- C:\Windows\System\ffHSZpI.exe
  C:\Windows\System\ffHSZpI.exe
  2⤵
  PID:544
- C:\Windows\System\FGYVNrD.exe
  C:\Windows\System\FGYVNrD.exe
  2⤵
  PID:228
- C:\Windows\System\tAbpZoI.exe
  C:\Windows\System\tAbpZoI.exe
  2⤵
  PID:1084
- C:\Windows\System\CPupxUC.exe
  C:\Windows\System\CPupxUC.exe
  2⤵
  PID:12040
- C:\Windows\System\AlhtFtM.exe
  C:\Windows\System\AlhtFtM.exe
  2⤵
  PID:11752
- C:\Windows\System\voWcOAE.exe
  C:\Windows\System\voWcOAE.exe
  2⤵
  PID:6208
- C:\Windows\System\qDEfSYX.exe
  C:\Windows\System\qDEfSYX.exe
  2⤵
  PID:11356
- C:\Windows\System\MHGTvKE.exe
  C:\Windows\System\MHGTvKE.exe
  2⤵
  PID:12428
- C:\Windows\System\PcNPqnt.exe
  C:\Windows\System\PcNPqnt.exe
  2⤵
  PID:13264
- C:\Windows\System\VqQpqpu.exe
  C:\Windows\System\VqQpqpu.exe
  2⤵
  PID:6788
- C:\Windows\System\yLcdWhT.exe
  C:\Windows\System\yLcdWhT.exe
  2⤵
  PID:9464
- C:\Windows\System\jDIEFwJ.exe
  C:\Windows\System\jDIEFwJ.exe
  2⤵
  PID:6744
- C:\Windows\System\DnLnMjE.exe
  C:\Windows\System\DnLnMjE.exe
  2⤵
  PID:3180
- C:\Windows\System\AnujdgS.exe
  C:\Windows\System\AnujdgS.exe
  2⤵
  PID:9832
- C:\Windows\System\wPOIVYW.exe
  C:\Windows\System\wPOIVYW.exe
  2⤵
  PID:10860
- C:\Windows\System\TIVeGJU.exe
  C:\Windows\System\TIVeGJU.exe
  2⤵
  PID:12920
- C:\Windows\System\JKIDvlD.exe
  C:\Windows\System\JKIDvlD.exe
  2⤵
  PID:13272
- C:\Windows\System\CnKaLax.exe
  C:\Windows\System\CnKaLax.exe
  2⤵
  PID:3416
- C:\Windows\System\pJccOVM.exe
  C:\Windows\System\pJccOVM.exe
  2⤵
  PID:5020
- C:\Windows\System\jhWCuCc.exe
  C:\Windows\System\jhWCuCc.exe
  2⤵
  PID:3008
- C:\Windows\System\lbeYoVa.exe
  C:\Windows\System\lbeYoVa.exe
  2⤵
  PID:11812
- C:\Windows\System\RIHmqVI.exe
  C:\Windows\System\RIHmqVI.exe
  2⤵
  PID:10012
- C:\Windows\System\hZpBkBT.exe
  C:\Windows\System\hZpBkBT.exe
  2⤵
  PID:4460
- C:\Windows\System\DPiiRhf.exe
  C:\Windows\System\DPiiRhf.exe
  2⤵
  PID:11580
- C:\Windows\System\JMeUpWU.exe
  C:\Windows\System\JMeUpWU.exe
  2⤵
  PID:3256
- C:\Windows\System\bcFpjHj.exe
  C:\Windows\System\bcFpjHj.exe
  2⤵
  PID:5952
- C:\Windows\System\tmoIrXC.exe
  C:\Windows\System\tmoIrXC.exe
  2⤵
  PID:3928
- C:\Windows\System\qVBRiYz.exe
  C:\Windows\System\qVBRiYz.exe
  2⤵
  PID:1944
- C:\Windows\System\ZbyyKGd.exe
  C:\Windows\System\ZbyyKGd.exe
  2⤵
  PID:12404
- C:\Windows\System\eeOGTRB.exe
  C:\Windows\System\eeOGTRB.exe
  2⤵
  PID:10732
- C:\Windows\System\QObHmVI.exe
  C:\Windows\System\QObHmVI.exe
  2⤵
  PID:12308
- C:\Windows\System\OeGqeMW.exe
  C:\Windows\System\OeGqeMW.exe
  2⤵
  PID:12380
- C:\Windows\System\hhnevHc.exe
  C:\Windows\System\hhnevHc.exe
  2⤵
  PID:13124
- C:\Windows\System\iIPElzF.exe
  C:\Windows\System\iIPElzF.exe
  2⤵
  PID:13732
- C:\Windows\System\RkTHEIb.exe
  C:\Windows\System\RkTHEIb.exe
  2⤵
  PID:10356
- C:\Windows\System\UosUTCY.exe
  C:\Windows\System\UosUTCY.exe
  2⤵
  PID:2932
- C:\Windows\System\pGEdyJe.exe
  C:\Windows\System\pGEdyJe.exe
  2⤵
  PID:11400
- C:\Windows\System\zsTlvjM.exe
  C:\Windows\System\zsTlvjM.exe
  2⤵
  PID:6800
- C:\Windows\System\CLgFHCm.exe
  C:\Windows\System\CLgFHCm.exe
  2⤵
  PID:10604
- C:\Windows\System\EGhCyqS.exe
  C:\Windows\System\EGhCyqS.exe
  2⤵
  PID:1872
- C:\Windows\System\FWZCNYx.exe
  C:\Windows\System\FWZCNYx.exe
  2⤵
  PID:10152
- C:\Windows\System\qSByfZH.exe
  C:\Windows\System\qSByfZH.exe
  2⤵
  PID:7556
- C:\Windows\System\SQCjgTM.exe
  C:\Windows\System\SQCjgTM.exe
  2⤵
  PID:6524
- C:\Windows\System\PHXokMW.exe
  C:\Windows\System\PHXokMW.exe
  2⤵
  PID:3632
- C:\Windows\System\UODnxvK.exe
  C:\Windows\System\UODnxvK.exe
  2⤵
  PID:12580
- C:\Windows\System\TnTmEdF.exe
  C:\Windows\System\TnTmEdF.exe
  2⤵
  PID:10704
- C:\Windows\System\VxQbgGz.exe
  C:\Windows\System\VxQbgGz.exe
  2⤵
  PID:13260
- C:\Windows\System\JjzIemm.exe
  C:\Windows\System\JjzIemm.exe
  2⤵
  PID:12124
- C:\Windows\System\qODEwbi.exe
  C:\Windows\System\qODEwbi.exe
  2⤵
  PID:11068
- C:\Windows\System\nPLHnbe.exe
  C:\Windows\System\nPLHnbe.exe
  2⤵
  PID:10692
- C:\Windows\System\ryDFaVM.exe
  C:\Windows\System\ryDFaVM.exe
  2⤵
  PID:9836
- C:\Windows\System\BnFKpMQ.exe
  C:\Windows\System\BnFKpMQ.exe
  2⤵
  PID:12448
- C:\Windows\System\HwjJRMP.exe
  C:\Windows\System\HwjJRMP.exe
  2⤵
  PID:1060
- C:\Windows\System\pCQBfAB.exe
  C:\Windows\System\pCQBfAB.exe
  2⤵
  PID:868
- C:\Windows\System\CCYuBRs.exe
  C:\Windows\System\CCYuBRs.exe
  2⤵
  PID:2032
- C:\Windows\System\yPQLFcu.exe
  C:\Windows\System\yPQLFcu.exe
  2⤵
  PID:7748
- C:\Windows\System\vCapgyv.exe
  C:\Windows\System\vCapgyv.exe
  2⤵
  PID:8440
- C:\Windows\System\VggzwqU.exe
  C:\Windows\System\VggzwqU.exe
  2⤵
  PID:10516
- C:\Windows\System\GGceOXP.exe
  C:\Windows\System\GGceOXP.exe
  2⤵
  PID:10532
- C:\Windows\System\rsbbIdg.exe
  C:\Windows\System\rsbbIdg.exe
  2⤵
  PID:8176
- C:\Windows\System\yUmUadR.exe
  C:\Windows\System\yUmUadR.exe
  2⤵
  PID:11804
- C:\Windows\System\JNyTVob.exe
  C:\Windows\System\JNyTVob.exe
  2⤵
  PID:8992
- C:\Windows\System\EsEUwhs.exe
  C:\Windows\System\EsEUwhs.exe
  2⤵
  PID:2936
- C:\Windows\System\biUSMld.exe
  C:\Windows\System\biUSMld.exe
  2⤵
  PID:2444
- C:\Windows\System\XcaBPyV.exe
  C:\Windows\System\XcaBPyV.exe
  2⤵
  PID:9152
- C:\Windows\System\UGzprFX.exe
  C:\Windows\System\UGzprFX.exe
  2⤵
  PID:6816
- C:\Windows\System\NGFxNzW.exe
  C:\Windows\System\NGFxNzW.exe
  2⤵
  PID:11852
- C:\Windows\System\mWKWpLM.exe
  C:\Windows\System\mWKWpLM.exe
  2⤵
  PID:584
- C:\Windows\System\ZhZclws.exe
  C:\Windows\System\ZhZclws.exe
  2⤵
  PID:12608
- C:\Windows\System\dmwbVMv.exe
  C:\Windows\System\dmwbVMv.exe
  2⤵
  PID:1568
- C:\Windows\System\EWvWNvX.exe
  C:\Windows\System\EWvWNvX.exe
  2⤵
  PID:8696
- C:\Windows\System\QqFAvto.exe
  C:\Windows\System\QqFAvto.exe
  2⤵
  PID:9752
- C:\Windows\System\fBZnwPu.exe
  C:\Windows\System\fBZnwPu.exe
  2⤵
  PID:12356
- C:\Windows\System\OrApSHJ.exe
  C:\Windows\System\OrApSHJ.exe
  2⤵
  PID:11600
- C:\Windows\System\QKIpbXI.exe
  C:\Windows\System\QKIpbXI.exe
  2⤵
  PID:12160
- C:\Windows\System\rwfGxWf.exe
  C:\Windows\System\rwfGxWf.exe
  2⤵
  PID:11648
- C:\Windows\System\WRsPxTK.exe
  C:\Windows\System\WRsPxTK.exe
  2⤵
  PID:4284
- C:\Windows\System\mmeXJHA.exe
  C:\Windows\System\mmeXJHA.exe
  2⤵
  PID:9428
- C:\Windows\System\jISGnzR.exe
  C:\Windows\System\jISGnzR.exe
  2⤵
  PID:12240
- C:\Windows\System\pfYBvRD.exe
  C:\Windows\System\pfYBvRD.exe
  2⤵
  PID:3620
- C:\Windows\System\lIqBgtx.exe
  C:\Windows\System\lIqBgtx.exe
  2⤵
  PID:9840
- C:\Windows\System\YyCxrbd.exe
  C:\Windows\System\YyCxrbd.exe
  2⤵
  PID:12744
- C:\Windows\System\LALTume.exe
  C:\Windows\System\LALTume.exe
  2⤵
  PID:11740
- C:\Windows\System\mZFKkKH.exe
  C:\Windows\System\mZFKkKH.exe
  2⤵
  PID:6636
- C:\Windows\System\CqMUKIL.exe
  C:\Windows\System\CqMUKIL.exe
  2⤵
  PID:3196
- C:\Windows\System\RpqVrhS.exe
  C:\Windows\System\RpqVrhS.exe
  2⤵
  PID:3832
- C:\Windows\System\gGeEFqV.exe
  C:\Windows\System\gGeEFqV.exe
  2⤵
  PID:4256
- C:\Windows\System\mXFSBAz.exe
  C:\Windows\System\mXFSBAz.exe
  2⤵
  PID:3492
- C:\Windows\System\XwKEoKr.exe
  C:\Windows\System\XwKEoKr.exe
  2⤵
  PID:1852
- C:\Windows\System\gwIqVFj.exe
  C:\Windows\System\gwIqVFj.exe
  2⤵
  PID:6340
- C:\Windows\System\sFTxgnO.exe
  C:\Windows\System\sFTxgnO.exe
  2⤵
  PID:7916
- C:\Windows\System\RFoBTOg.exe
  C:\Windows\System\RFoBTOg.exe
  2⤵
  PID:10764
- C:\Windows\System\BdqcLmB.exe
  C:\Windows\System\BdqcLmB.exe
  2⤵
  PID:9724
- C:\Windows\System\QFBLhRH.exe
  C:\Windows\System\QFBLhRH.exe
  2⤵
  PID:3616
- C:\Windows\System\HAqyDZo.exe
  C:\Windows\System\HAqyDZo.exe
  2⤵
  PID:12332
- C:\Windows\System\BtEXOlu.exe
  C:\Windows\System\BtEXOlu.exe
  2⤵
  PID:12600
- C:\Windows\System\MXKitbS.exe
  C:\Windows\System\MXKitbS.exe
  2⤵
  PID:14360
- C:\Windows\System\laXddFn.exe
  C:\Windows\System\laXddFn.exe
  2⤵
  PID:14388
- C:\Windows\System\QnJqglB.exe
  C:\Windows\System\QnJqglB.exe
  2⤵
  PID:14416
- C:\Windows\System\ALePpGO.exe
  C:\Windows\System\ALePpGO.exe
  2⤵
  PID:14444
- C:\Windows\System\QOnjSNf.exe
  C:\Windows\System\QOnjSNf.exe
  2⤵
  PID:14564
- C:\Windows\System\wjiYrdI.exe
  C:\Windows\System\wjiYrdI.exe
  2⤵
  PID:14580

Network

DNS

217.106.137.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.106.137.52.in-addr.arpa

IN PTR

Response
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom

3.120.98.217:8080

102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe

260 B
5

8.8.8.8:53

217.106.137.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

217.106.137.52.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_md1dwses.zcv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BNMslXo.exe

Filesize
2.2MB

MD5
20f1f8a921e49c58970afc030d135510

SHA1
a1ff14d2712934d129c54eab7b285a1ce0a8c4cc

SHA256
fce568005788803146447bcfb59fd19109cc3995161c5cf36f7afbcf762fbb25

SHA512
1064d245c8ff5c5e46bcbffbc0f2b48c0456709d9ac96b2cb525fbf458df74733aa8172c89e3c9c6eec4f15dabeb90aada6a902430fa155687b22ac8129757aa

Download Submit
C:\Windows\System\DGEpRjP.exe

Filesize
2.2MB

MD5
b4a4346fb9b057108608466c51a9b2a2

SHA1
6c7bee9b8e46571bb0e9bf0583be1130ec8ca84c

SHA256
6cab40154bfd25fd5ba8bf12231df482df3618ecd9d690ca713b10f369456003

SHA512
8c5f7f16cbd5e7598474b85d3bc842b66157e75f6d2c84d4203678e355649c05e01360e4970fe25c41a41b3c107af49c6d116d9f5121216bbb2115b8ee02bbce

Download Submit
C:\Windows\System\DlOEkxR.exe

Filesize
2.2MB

MD5
32874f8f125dbaff6bd7bc819a3d8476

SHA1
77e291ae7a29eccbeaea7ef459aefd7a4bf0b36e

SHA256
f4e347d0264c439398c276c39ad2b49f3e90eefc81053990a67f2d42cddb24a5

SHA512
b5c936aa65f53dcc7e4763c9771a4eaf1ef59da8a701c85bed75776ec403fcb7ca34df9a05aaff8cd69feb4d6af132585a86b76a99b9da4b5333284252aa42d2

Download Submit
C:\Windows\System\FcAvsSi.exe

Filesize
2.2MB

MD5
e0dee1f0bdd400802c4ae392ea1cf1ab

SHA1
ff40429f8db0ffbbe628a166ff28abbe212bf9b1

SHA256
836f349e68ae8b57dab64ad73b6d0de3d12aef37d842b02ceab731f9c4853b39

SHA512
a671f728d4c9012a7a9d15c8d7045a4926ddab10367d28f340425c6b1edbfde37ca30e17504f25fe199c9ee663883e33f891a62d0b3ccd4004d31cb910373bad

Download Submit
C:\Windows\System\FqKOVdu.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\GVpCCEp.exe

Filesize
2.2MB

MD5
679c80f7074f347290e67c6c8cfe61b4

SHA1
85dae2a1b532edee9e641b91a754b7d17782e77c

SHA256
13c844cafd5ba3614b02c8b1c38da73344a5094511d92ae116a90fe1b6f9c4a0

SHA512
4e48f779f090a05e9c2f5ac7b3074afddfb8328b2b827a2b0f60d26119d1aa1028c3ef3287b1a6f148ebe68ce083afcfb5b477176b0191d0aaf9bac9e484b336

Download Submit
C:\Windows\System\GZyzKJl.exe

Filesize
2.2MB

MD5
6fa6f198b75f2d131082884a8f1b2977

SHA1
e63c124658ee45c0c8401cee2318e78cf1f0c79a

SHA256
5dccea543a740d4db7a624433fd793268a6a0cf47e3817cf6eaa9d5225b44732

SHA512
2f8591a0aa63b0eeaf349ae3069bd846a14c1bf56b7e15768155b7d2abba20206e6170618612bc9e99f20f1731b0f0fcf9c83962430b6443fbc4d42a0eb3b8f1

Download Submit
C:\Windows\System\HcYcSeu.exe

Filesize
2.2MB

MD5
412b0bb2a608e5ecd8e35172db7843ad

SHA1
7042814810eac1cd6ce9bf90164ff548e782b55f

SHA256
a55a00260e6673169295451f196cf3bdcbfd5886682cc96cf63beb2184a304a3

SHA512
33da0ff5bb85cacce59f37e042ceaf0d01b9090f349b3f5faa8f230618ab635311e12d5b1bab75fd6581943f524d8586ec9b1180a0c48fd2470538710fba80d1

Download Submit
C:\Windows\System\INOaBBi.exe

Filesize
2.2MB

MD5
6dfa1c2e67dbd1c2225eb53ea502148c

SHA1
d453bef471c414242c6a6eecd24b7171e1c5cd20

SHA256
2b418b30ed343a9f3d8ada185d33e4a14475d74433a881ca820ee0593c29d0a4

SHA512
41933f0bb97305641ea79006b7b3acbe99576422dd1cb9017a33eec4a342ef06c2337f6d79954ab82af8dc3e83e83f64af97851e75dcb10ad8a0cc0105a02ae1

Download Submit
C:\Windows\System\JEhXeKh.exe

Filesize
2.2MB

MD5
0d5519a52f1df7410b6be542a72545f1

SHA1
4afa4e6c2761036ae8ec265534d05ad4795ae2b4

SHA256
777666d5941dc742b47ed4e8c967e0e8d427b73885f9c41315c09981258a16c3

SHA512
8c058d8438a0eb9529ae1b9aff7ac16ee6c25bb14dc26737c13e7897056504eb80efaafb45845d5473d3e459a858d783c395acfbd3a484811fba2eeec8f0eb0f

Download Submit
C:\Windows\System\JRiVxQP.exe

Filesize
2.2MB

MD5
8fd4bd6f01c0948bd1f95bfac817d38f

SHA1
4e38340f697b53888951fc320507b4fc639f1292

SHA256
265656ba103409b5d60dff352936e44f63fda2235fe4955b58f70b64e563591e

SHA512
315a36fa159bff15418fb3de77f59453f3a4ce00784e50f3f27a527002307bbdd928df5eebf25438d001ff946065aef4c3f1c91baf073ad01a31faa019345b1e

Download Submit
C:\Windows\System\JXYfvjK.exe

Filesize
2.2MB

MD5
60ab377baa837deaa3a5bd3863a8fe53

SHA1
8c9a1b7e9e27b762f80223ba054c257d6c4693a5

SHA256
766702a5a1f8e206ecefc19ec1174772d25e4581babad90ba3776eba54262344

SHA512
927e31b906ecc57c0323868a4edb82a8430c572125ca5b66d2d655a1cfce2f901be781f29e1654dade16ce5fa2114f06866e8dc8b310009d9569fbf934ce1f84

Download Submit
C:\Windows\System\KAxtDwy.exe

Filesize
2.2MB

MD5
359e82daa633dc72a5273d44f5faa909

SHA1
dc9a53769766dbcd2a56ab95ef1be3850443060a

SHA256
f8544e802f4ce6174b5704aa6c36c285a29a03d7be4ee682e07bf39f647b5b80

SHA512
4ac9599da9bfcfe091d7b464670d739f21c780dabce2a974cf4b5a83feb89d22e93b58065c450f143861da7ec3db6e65eadec571d66049c495dd993b9cf2e37f

Download Submit
C:\Windows\System\MJbQRLf.exe

Filesize
2.2MB

MD5
ffdbf67aabefd8b5da17223cf69b78af

SHA1
1d1a2f688cb83c03a3c1dbe7a1ed32c78f1584e6

SHA256
5c21dbb41c970388eecf16d10937ca40d899f09121311da1f2fa0e108b8a1a10

SHA512
0a9cd312928060e654ce0b5a10d5e9581ff2d3daf78f9863fb20b25113e66ce7dbf1d8c2fc181735e2058ca414e49407b1fbe51cbb7c90a0831bc1fafddb0a22

Download Submit
C:\Windows\System\ScnlVYy.exe

Filesize
2.2MB

MD5
256830f9c8394edc4a62ac1032b4968c

SHA1
d739284d6b74d2d3c1bf7abf7869ee765286faca

SHA256
788ed395869aa0bb45b15120e3dbcd579ace323a44176d50b8e7e479b14050b7

SHA512
8efb3e720523fa44c062d8b31c9b0d693e7a1db0e7c21750d0367ddb15fc3e5ab03220ba7bf6178a7cde43f8a8e063c6065848333548fba2ee6aa11da2c19174

Download Submit
C:\Windows\System\WPdnPEQ.exe

Filesize
2.2MB

MD5
5df6162091580ef2c549f5fd2335eb0d

SHA1
bba7a20d3ab5fc14d3d297c40e80987fd1709e8e

SHA256
6114ebc118dbb388db23be0948277029190926ff61e23a942ea4df5fdf519c63

SHA512
42a14d996bcf6c8ad718e6e6f8bc04700f1676e2773c3ac307100a38ee7d284dd4c2d1db2ed371f952784ad6740cace52e91b84899058c2082c6607a8d350599

Download Submit
C:\Windows\System\aPFtJJV.exe

Filesize
2.2MB

MD5
f027ceb6e6e3a9478b3b3238d9cd1162

SHA1
9b8ac3308d4b65097ee566dccc498a1a5c56ca6f

SHA256
38cbb04de2f5687ac4256a2487237517f1de2047d73bcc2cdc8739abb218ffc9

SHA512
0ed5fdb6036bc91fc5a5a0a5ba56cc4c7a6f867d08f090b69b7aeb562c51efb5bd9d70288b7fe796b2a61ea30ad5c3c1d2ab18262e872ef0766ebfa5fc033fa5

Download Submit
C:\Windows\System\bFEHTvs.exe

Filesize
2.2MB

MD5
35d416c0f9fe0626c0b838ee6f0fb575

SHA1
5ccdb77db7476d9d8f122dcdc3766634adf15181

SHA256
6ac4421821c5f1078a7aa420a4048c8f4a65bcad3f3a73bd48c1da8edf7725cf

SHA512
8924061fcb8c6a5ac3c6d590e228c693692b3d9e4b4b19859996eb510a10ed377c572640743266c480bf045e6c515439dbf7d5a6f393b3c5ad1439b7e591ebad

Download Submit
C:\Windows\System\cQUFqCr.exe

Filesize
2.2MB

MD5
c202cc7a4d47496f0ad43d26d3332e3f

SHA1
e0efbfbe31177b699008a55773177f6061e7bf48

SHA256
8a20295410432e1a6e447874dd0ca75a5c1cb74ea22b03aa0dc9a5f47ce565a5

SHA512
9ff28ca27f0100549aeaaeb45d80861c06fc59828bb4fc345c33ac4b3538740802d5d185b4ef227d2624fb8979ac1085f38613f7ca3ae8096879d6650c93ab68

Download Submit
C:\Windows\System\cRbYLWx.exe

Filesize
2.2MB

MD5
54ca3c25793ddb548998c4a0feed1a33

SHA1
cdf06c68d968f6e35c5231dde0dc3e876dea30f4

SHA256
ea51ed373d384a85cba2feb3b0d4d339042471fd6175b940adeb0e725cc69e3a

SHA512
bba6e204bf4b258623d55601dcbe31137a802ebf23a68faeea2fc94a384b6c725f3a3fd97089933508b84e1a80ece763fa0be56692c718547d5cbe343b29954a

Download Submit
C:\Windows\System\cZVklwW.exe

Filesize
2.2MB

MD5
93d038b079aa5250cfde41515875858f

SHA1
48af72d55850025c526649b877a89974211bca66

SHA256
74691a4e2058041417d720fcd8f0efb20b89182864eabfe4c3af7e82a2e28714

SHA512
ba2cdb30e330bd51bd0a6b6762d48db6977bb22b6bac8bd53629768bf672e7935e9bac0d1b684cdba6d70f376df9d8e4490fadf30e243842a56be118bc1556ba

Download Submit
C:\Windows\System\cwmPLjm.exe

Filesize
2.2MB

MD5
e11609afce44d4b7444398a51d1cd7b4

SHA1
bf93dc59cee84980017a2cd202b6f9ad31bfba7b

SHA256
5b51c529ca8b7a8acb61cc4983d4b7f5a5fe4bfb7e4fade9d75b70801fb3de3f

SHA512
9d9d0a68b95eeeff7c78711b304347cc13d485aa6f162dcb135e6267c6e4e3c2bdad0f67875cce7664e455a23fd2c482579cfbb4e54a59bc3335c07b498eba77

Download Submit
C:\Windows\System\gwwqoUg.exe

Filesize
2.2MB

MD5
0e89880b0c623ae6b632f7b15d0577fa

SHA1
8dca1f07826e739c5466eddc98d42286cc62a534

SHA256
d0460739280698524614df631a528ac1dcf2b49822394485824d1e3ae6ac37b1

SHA512
70560550e29f7db7199240a0afe0ede8793a4db425910da8ef932bcca622cfae1aab1af4a8dc4824e139359a565a344b0d55410cbefaf031a673a688901648a6

Download Submit
C:\Windows\System\kdUgdpj.exe

Filesize
2.2MB

MD5
e6cd867ab7913630af4b308a29352c76

SHA1
e36912016319c2fdf98042f4dcc56a2aa01e9df2

SHA256
c8d9794d95fe27d351566e8fd694346f0744299b7f5d092c5e9b7de32977b87b

SHA512
8180b43a1a739e34603a383b0d717d7545e8813d8c6ac4846e11af9079c6e7b79f7ff3b5ce6bae29829e6c97293a2182b286327c641963ed2b62bccb073e9b48

Download Submit
C:\Windows\System\lAFPxRe.exe

Filesize
2.2MB

MD5
14e9ae6bb2782d85298d182b27bb78e1

SHA1
f5ca65d7bf7191bef9b8a359630d11831d306ec5

SHA256
fb22edc98cf79df4390b422a882caf0b78c166105cafd2f35bb9be65aa5c9afc

SHA512
c777b2aebe04eee76a07001f3fd292c512fe85baef61f5d407ee4df364dbfa24930a49650d55a00c09fee1803d839610bb717f40f337211a0e9cbcd6fad5c0d8

Download Submit
C:\Windows\System\lDAXLen.exe

Filesize
2.2MB

MD5
cc3b2e44bb1ee4cc4095a134f94db63e

SHA1
7e10468823b24a59e41ad8b0469897027ce0c45a

SHA256
48b5b4ddc9683e55ad5ad4785e71c4969486f8d9f155be087ab2f69ea2b276b5

SHA512
e8636f70e0f2a9697cc71125b4bfdaf47a59802a19fcc150b36c0efe0f792607fed94fbe88435e1994d6d86626f83a5404c0f3f5797baba612dca8f27739c9a8

Download Submit
C:\Windows\System\lkLLEmT.exe

Filesize
2.2MB

MD5
43e3a373bdbb2949adc8257082099c3d

SHA1
801edd06baff4478b03070ca0aefcb1569d454a5

SHA256
90ad7bd6bcde7cef872f4223c87d9f6b0f7ae6d50c602902507536bd1961eb27

SHA512
d783776022bdba958aa68143f1d9130265b05f901c789759a71c75464d394b7e894ce5af18987e2daa1c3bc6344491198ec5db38932e169072948eb48a49af39

Download Submit
C:\Windows\System\mAnjmdq.exe

Filesize
2.2MB

MD5
79a8247ae9251a26e01587c0a05b46eb

SHA1
37256a13d2e1cd0c27d78f41e72f7a0f418774d5

SHA256
b003e842f580cc5f04cac23a2542f190ee3b818db80766f7877fd15c54ca71f6

SHA512
edcae69ccd68a82bbe53fa76d6ad49f4bc95de37dae4ba7e9e8d1c9ae211873fb0f4dff8ebc6584b8dd9d395f75cd5011eb769971339e978b28057af1c6584ed

Download Submit
C:\Windows\System\mDHaqMS.exe

Filesize
2.2MB

MD5
e25bb668a4e8f48eda72031027ba84e7

SHA1
0c119cd0431af6e2d7d81d914aebf0f538c64843

SHA256
4ae2f13595430ac6afb1c5b225fecbf5cf00db7ac3b63ba9190335c813c1dfb8

SHA512
65962aecb506f34f83900b3fc9f177472c2929bbd50b78b2c50da91cda0e165ffc6f31d09cf9bb82a849b7c99fb268453c09d7f6377e19f92de4919e53fbcc6b

Download Submit
C:\Windows\System\mdOegrp.exe

Filesize
2.2MB

MD5
aa24dd946f50dcf80640dd87fb530a92

SHA1
f62d4b8a3e47af97143a307ca5c26fb44b01a751

SHA256
9de7b5fac630761abcec3f7d50d4fedaf90f28ac265283ecb601f8571a7b01a3

SHA512
1bd30857c6b6b7a6eca2c7e44e7c0a09f8eccc0d8982ffde2488f975664677bbc6b0fcf3bc26e635068a52563cbc3d663138fb9d5b10904b62a03922e29e0bd4

Download Submit
C:\Windows\System\mhjdQpf.exe

Filesize
2.2MB

MD5
69065174510af1ad054eb5ebfa8e66a6

SHA1
2b57e1762b8f02ea1e53aba78e2d716bfb5729ef

SHA256
40337dbe56b14c925662aa605d220c718e52ef9c416d206d4fa0a7e933ceb066

SHA512
16c00ebbf9c09897a2a57f162da3875f57da962b9d609af824e893029b7d9295fb4bddd8bdafa2f828aa82cffda307aae20c5e61b9591a32c61ba80ffbb24027

Download Submit
C:\Windows\System\oZaUgXn.exe

Filesize
2.2MB

MD5
b1a94c554c330c6dfe28d12a3e1e054d

SHA1
bd2f3ee5739ea2745427fcb7601b9c132c4c80ea

SHA256
5dcfd7697e28f02bb485f84cbdd51a41869ad6b05d7eb56636a6cdfe53b195b2

SHA512
fd9e96de465ae7fca0948ff7ef6e160b221c5b24865d4a7afb127cea268ad6aa2402911d9f88d157d0af7e29ff60099baec4b78ed00987436014691b0872880e

Download Submit
C:\Windows\System\olLJgpx.exe

Filesize
2.2MB

MD5
595e19fe55ff622ed094e2360e0b4763

SHA1
beabdb8a3e61e6a8ba8acf18231c62c4c630a983

SHA256
dd4a65bc72536ca815a3d4900b482e689e45c97ec35ea7b270e90a852dda77d2

SHA512
343cbe405a6b853d27d08d289c4dcb7c4215ca31deb46d01f8711945b02a48c60869c0100382752a78d2d2d0d8a8245b5ddb626a8b8ba0269391eb31755c41a6

Download Submit
C:\Windows\System\qFxgWKL.exe

Filesize
2.2MB

MD5
c4cc980acec3ffac55eb00e4e74fdc8b

SHA1
6371417970ad8ac88cc7787b8dcc25e0542098de

SHA256
c9793a3af45a737182e851fcba72fc5d64bfe5a7774b9f9be3f321bb462b8af6

SHA512
1170302ac446a442b2f145ff96628d11c7d5b3e297f4de49e67a3c1d088dd9cb88d333565c837adb3d3b7ea5b6f0f471c8a68308e50944732259a034eafd570e

Download Submit
C:\Windows\System\qLMPfGV.exe

Filesize
2.2MB

MD5
f583a8226545743aeacc262cfb072124

SHA1
00a6cf514fe5c5b611d2d7131244c732dbf69d31

SHA256
32000c1c96b4fbd3e1011049c4ed684056f80fa286c31cfe208cffa176b90570

SHA512
aec34c3b874a1481df56a54392d8e375e1c97351656839f961e5dee6aef7703b458d38a81df7f9edaea2020ec9ed3362bdadd5dfe5f212df299a5ef0a164fbd9

Download Submit
C:\Windows\System\rPhsmgz.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\rprJkzf.exe

Filesize
2.2MB

MD5
90979cdea8adabe8bbbf795fb2dc4a49

SHA1
751c633c62ec8b9dc842fb96713b668ef37b61bb

SHA256
918123c860cf5e301322e60d266a0d8daf0fddd4bb762ed0fcd99e70f99987f7

SHA512
3036d496de71e156c7cb5fb11b165e9c18dbe6cc1ba5134c16ca1c0c86874b9fc2fc9b82468aa35a017edf875d22e590df835f65027795aa3c1008d97c08894e

Download Submit
C:\Windows\System\sJqoQca.exe

Filesize
2.2MB

MD5
d95154a0cdc3a62efee067d03b5db49c

SHA1
41269c3fe1f3f01f3c4ea7cc806a79ca138aac3b

SHA256
4f63327ac6b718acc2e56951f2ae16d99c327b08c4cdbf21197595b1d5d8017e

SHA512
aa3dc12cbc7b07b75b11d974dbc6b4f59663387a0e2561137672cee36b030dfecf798622ad68edcca6e4ac15a36b0f4c1ed47578c4df92cb57384fda3b4f8688

Download Submit
C:\Windows\System\tBlkobs.exe

Filesize
2.2MB

MD5
0e65cdaf01881ac604e09b0d60a796ae

SHA1
cdd2d089920f97c7db62b6533ea39a5d244fa0c2

SHA256
43f19c7cf18e6435489239782a05bb588ad2165c3dfdc431d54a7a24f9d8374c

SHA512
64ec6ec23b79e8518a3e0991fd7345b4e71b0137f5ded87cc25a3a7547adce278eb314dbe1b8af6ff69b256e2baef7e83c8c3efdc844cb84583c79ce59a5d371

Download Submit
C:\Windows\System\tumOvLh.exe

Filesize
2.2MB

MD5
7dc87a980cd47bb38fabeaf7c7b8f853

SHA1
077d20afeb6534fe10dd31dae22af695c5f14055

SHA256
4dc39c1f6e9b0076a2fbf09e605940392ef74ae4ae7436709f3a022d77ca1d1f

SHA512
483d4e865dcd0ee9ab92280fa73685ddb09f77cdbd10f5973b4c3fe6d3d079add314586f65ef2c6e2ab111bcac81255fe67a7da83005359428c7d4087c95d117

Download Submit
C:\Windows\System\wZVTjaW.exe

Filesize
2.2MB

MD5
1d345741a014ddadac789470a687a7c1

SHA1
d9eeed212b8cb7fcf24c012ca37f9f731297b1f4

SHA256
83c3a40226080ea0d85b6691d8d394e66e15d6146e1be42b778e80c3eff5735e

SHA512
0af0dc9ef7614b5493e592ac79e63575b6d38ba3e99fb0bf3b652a8252e10c9355f2b4457eb49f0d9af6af912bec96630d7277889849eb0efbf775f663806cff

Download Submit
C:\Windows\System\xoewhMF.exe

Filesize
2.2MB

MD5
c77ff6ccb6e9bf47584fc6428b6eea41

SHA1
87c0de86b8209708085f7ca321f976b17d2f0daa

SHA256
4a041aa7c1e0fff13b50a5a54276ac43ebd1d50d8176a1e2f7d2fe39d58aab0b

SHA512
7c25238a14a4ebdbc865cff37e791ccaec4ba510379f101b1de8e8805f4c2dc0bbe48fe3882b4d0d8a54e90b668c0857b2234688f876d1fed5142fe6eaa9415e

Download Submit
C:\Windows\System\zkkyzSY.exe

Filesize
2.2MB

MD5
bafee6c12ecac31123e1d3ba2a79791c

SHA1
4130827f874c25d0551ec9e6091a4b41cbea3791

SHA256
5a95c6ae39e3eb063d7d8655294548a436315817d07266e4725807eb1de4d34b

SHA512
28523951a15499765f21fc10218d771901959a7f12fcf6b703574a170715a244db609be5ac77cc40113786b98754661eaad2aa46df732fc4cb682d0c47e5e0e8

Download Submit
memory/1096-189-0x00007FF6D1690000-0x00007FF6D1A82000-memory.dmp

Filesize
3.9MB

Download
memory/1104-519-0x00007FF6C0450000-0x00007FF6C0842000-memory.dmp

Filesize
3.9MB

Download
memory/1104-4689-0x00007FF6C0450000-0x00007FF6C0842000-memory.dmp

Filesize
3.9MB

Download
memory/1540-4640-0x00007FF73A900000-0x00007FF73ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-513-0x00007FF73A900000-0x00007FF73ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-4663-0x00007FF77EA80000-0x00007FF77EE72000-memory.dmp

Filesize
3.9MB

Download
memory/1888-515-0x00007FF77EA80000-0x00007FF77EE72000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4682-0x00007FF6ED890000-0x00007FF6EDC82000-memory.dmp

Filesize
3.9MB

Download
memory/1928-511-0x00007FF6ED890000-0x00007FF6EDC82000-memory.dmp

Filesize
3.9MB

Download
memory/2000-4627-0x00007FF7BF950000-0x00007FF7BFD42000-memory.dmp

Filesize
3.9MB

Download
memory/2000-289-0x00007FF7BF950000-0x00007FF7BFD42000-memory.dmp

Filesize
3.9MB

Download
memory/2232-102-0x00007FF678C20000-0x00007FF679012000-memory.dmp

Filesize
3.9MB

Download
memory/2232-4570-0x00007FF678C20000-0x00007FF679012000-memory.dmp

Filesize
3.9MB

Download
memory/2276-343-0x00007FF6DFE00000-0x00007FF6E01F2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-4635-0x00007FF6DFE00000-0x00007FF6E01F2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-522-0x00007FF60AF90000-0x00007FF60B382000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4661-0x00007FF60AF90000-0x00007FF60B382000-memory.dmp

Filesize
3.9MB

Download
memory/2460-4652-0x00007FF6BC170000-0x00007FF6BC562000-memory.dmp

Filesize
3.9MB

Download
memory/2460-521-0x00007FF6BC170000-0x00007FF6BC562000-memory.dmp

Filesize
3.9MB

Download
memory/2820-516-0x00007FF6112A0000-0x00007FF611692000-memory.dmp

Filesize
3.9MB

Download
memory/2820-4666-0x00007FF6112A0000-0x00007FF611692000-memory.dmp

Filesize
3.9MB

Download
memory/2832-245-0x00007FF674F40000-0x00007FF675332000-memory.dmp

Filesize
3.9MB

Download
memory/2832-4634-0x00007FF674F40000-0x00007FF675332000-memory.dmp

Filesize
3.9MB

Download
memory/3112-702-0x00007FF600530000-0x00007FF600922000-memory.dmp

Filesize
3.9MB

Download
memory/3112-4685-0x00007FF600530000-0x00007FF600922000-memory.dmp

Filesize
3.9MB

Download
memory/3260-45-0x00007FFA4C570000-0x00007FFA4D031000-memory.dmp

Filesize
10.8MB

Download
memory/3260-520-0x00007FFA4C570000-0x00007FFA4D031000-memory.dmp

Filesize
10.8MB

Download
memory/3260-178-0x0000022FFC1E0000-0x0000022FFC202000-memory.dmp

Filesize
136KB

Download
memory/3260-9-0x00007FFA4C573000-0x00007FFA4C575000-memory.dmp

Filesize
8KB

Download
memory/3360-393-0x00007FF7188D0000-0x00007FF718CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3360-4630-0x00007FF7188D0000-0x00007FF718CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3856-4568-0x00007FF7BA5E0000-0x00007FF7BA9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3856-83-0x00007FF7BA5E0000-0x00007FF7BA9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-4621-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-204-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/4220-514-0x00007FF69F410000-0x00007FF69F802000-memory.dmp

Filesize
3.9MB

Download
memory/4220-4680-0x00007FF69F410000-0x00007FF69F802000-memory.dmp

Filesize
3.9MB

Download
memory/4476-59-0x00007FF720B60000-0x00007FF720F52000-memory.dmp

Filesize
3.9MB

Download
memory/4544-4645-0x00007FF76F0F0000-0x00007FF76F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-631-0x00007FF76F0F0000-0x00007FF76F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-518-0x00007FF6FC0B0000-0x00007FF6FC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-4675-0x00007FF6FC0B0000-0x00007FF6FC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-138-0x00007FF7BC0F0000-0x00007FF7BC4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-4605-0x00007FF7BC0F0000-0x00007FF7BC4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-469-0x00007FF6D9790000-0x00007FF6D9B82000-memory.dmp

Filesize
3.9MB

Download
memory/4896-4648-0x00007FF6D9790000-0x00007FF6D9B82000-memory.dmp

Filesize
3.9MB

Download
memory/4980-4671-0x00007FF655AB0000-0x00007FF655EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-517-0x00007FF655AB0000-0x00007FF655EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-4642-0x00007FF786620000-0x00007FF786A12000-memory.dmp

Filesize
3.9MB

Download
memory/4988-390-0x00007FF786620000-0x00007FF786A12000-memory.dmp

Filesize
3.9MB

Download
memory/5000-0-0x00007FF68BC50000-0x00007FF68C042000-memory.dmp

Filesize
3.9MB

Download
memory/5000-5169-0x00007FF68BC50000-0x00007FF68C042000-memory.dmp

Filesize
3.9MB

Download
memory/5000-1-0x000001C7EE0F0000-0x000001C7EE100000-memory.dmp

Filesize
64KB

Download