xmrig | 401118e67cb0ca651699b35842373ed9e42b8df7d853eef4072b36d70a66e186

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
Size

2.7MB
MD5

17435883ba662f79264e0284eda0b79b
SHA1

8e82d543cbfccd9e7b0b7fb29271c18fc04e2150
SHA256

401118e67cb0ca651699b35842373ed9e42b8df7d853eef4072b36d70a66e186
SHA512

f134f1e4c061dae90f32f39eb0ba7c7d51a7c459e0cdd529c7d7fbba198256b9dece222346a9f14c7e3bd7acc6bc2e4399c6e30cf3294eb8a9134f11a09c9568
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/qn:NABD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1784-270-0x00007FF697980000-0x00007FF697D72000-memory.dmp	xmrig
behavioral2/memory/2672-275-0x00007FF7853F0000-0x00007FF7857E2000-memory.dmp	xmrig
behavioral2/memory/2716-291-0x00007FF68FB30000-0x00007FF68FF22000-memory.dmp	xmrig
behavioral2/memory/2148-309-0x00007FF663870000-0x00007FF663C62000-memory.dmp	xmrig
behavioral2/memory/4104-318-0x00007FF73B9F0000-0x00007FF73BDE2000-memory.dmp	xmrig
behavioral2/memory/3600-323-0x00007FF605920000-0x00007FF605D12000-memory.dmp	xmrig
behavioral2/memory/464-328-0x00007FF6D0B50000-0x00007FF6D0F42000-memory.dmp	xmrig
behavioral2/memory/1072-327-0x00007FF6BD7C0000-0x00007FF6BDBB2000-memory.dmp	xmrig
behavioral2/memory/2108-326-0x00007FF7D55C0000-0x00007FF7D59B2000-memory.dmp	xmrig
behavioral2/memory/2520-325-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	xmrig
behavioral2/memory/4576-324-0x00007FF79C260000-0x00007FF79C652000-memory.dmp	xmrig
behavioral2/memory/2528-322-0x00007FF7CCA10000-0x00007FF7CCE02000-memory.dmp	xmrig
behavioral2/memory/4512-321-0x00007FF763BA0000-0x00007FF763F92000-memory.dmp	xmrig
behavioral2/memory/3012-320-0x00007FF74EAC0000-0x00007FF74EEB2000-memory.dmp	xmrig
behavioral2/memory/1880-319-0x00007FF6A61B0000-0x00007FF6A65A2000-memory.dmp	xmrig
behavioral2/memory/2300-317-0x00007FF7D2FC0000-0x00007FF7D33B2000-memory.dmp	xmrig
behavioral2/memory/5036-307-0x00007FF67CEA0000-0x00007FF67D292000-memory.dmp	xmrig
behavioral2/memory/4744-288-0x00007FF716CD0000-0x00007FF7170C2000-memory.dmp	xmrig
behavioral2/memory/4956-264-0x00007FF61A580000-0x00007FF61A972000-memory.dmp	xmrig
behavioral2/memory/1836-224-0x00007FF6252B0000-0x00007FF6256A2000-memory.dmp	xmrig
behavioral2/memory/2188-214-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp	xmrig
behavioral2/memory/2936-118-0x00007FF659DC0000-0x00007FF65A1B2000-memory.dmp	xmrig
behavioral2/memory/1128-89-0x00007FF7971C0000-0x00007FF7975B2000-memory.dmp	xmrig
behavioral2/memory/2520-3453-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	xmrig
behavioral2/memory/2188-3457-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp	xmrig
behavioral2/memory/2936-3461-0x00007FF659DC0000-0x00007FF65A1B2000-memory.dmp	xmrig
behavioral2/memory/1128-3465-0x00007FF7971C0000-0x00007FF7975B2000-memory.dmp	xmrig
behavioral2/memory/4956-3472-0x00007FF61A580000-0x00007FF61A972000-memory.dmp	xmrig
behavioral2/memory/1784-3480-0x00007FF697980000-0x00007FF697D72000-memory.dmp	xmrig
behavioral2/memory/1836-3477-0x00007FF6252B0000-0x00007FF6256A2000-memory.dmp	xmrig
behavioral2/memory/2672-3512-0x00007FF7853F0000-0x00007FF7857E2000-memory.dmp	xmrig
behavioral2/memory/1880-3564-0x00007FF6A61B0000-0x00007FF6A65A2000-memory.dmp	xmrig
behavioral2/memory/3012-3557-0x00007FF74EAC0000-0x00007FF74EEB2000-memory.dmp	xmrig
behavioral2/memory/464-3539-0x00007FF6D0B50000-0x00007FF6D0F42000-memory.dmp	xmrig
behavioral2/memory/2148-3515-0x00007FF663870000-0x00007FF663C62000-memory.dmp	xmrig
behavioral2/memory/2716-3509-0x00007FF68FB30000-0x00007FF68FF22000-memory.dmp	xmrig
behavioral2/memory/2108-3499-0x00007FF7D55C0000-0x00007FF7D59B2000-memory.dmp	xmrig
behavioral2/memory/3600-3488-0x00007FF605920000-0x00007FF605D12000-memory.dmp	xmrig
behavioral2/memory/5036-3508-0x00007FF67CEA0000-0x00007FF67D292000-memory.dmp	xmrig
behavioral2/memory/4104-3506-0x00007FF73B9F0000-0x00007FF73BDE2000-memory.dmp	xmrig
behavioral2/memory/1072-3502-0x00007FF6BD7C0000-0x00007FF6BDBB2000-memory.dmp	xmrig
behavioral2/memory/4744-3498-0x00007FF716CD0000-0x00007FF7170C2000-memory.dmp	xmrig
behavioral2/memory/2300-3493-0x00007FF7D2FC0000-0x00007FF7D33B2000-memory.dmp	xmrig
behavioral2/memory/2528-3490-0x00007FF7CCA10000-0x00007FF7CCE02000-memory.dmp	xmrig
behavioral2/memory/4512-3486-0x00007FF763BA0000-0x00007FF763F92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	4488	powershell.exe
11	4488	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4488	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3424	YjPFpPy.exe
4576	nJFHvow.exe
2520	gnSmIWi.exe
1128	GtOIkxC.exe
2936	zEQBfxi.exe
2188	nYpurvY.exe
1836	UQxYlHX.exe
4956	gwLoLfm.exe
1784	ESKuZEs.exe
2672	GqkpRJK.exe
4744	CTOyRyO.exe
2716	bKuyPfS.exe
5036	WOYtBjF.exe
2108	bBqDiPh.exe
2148	rmMtEAW.exe
2300	xEGkydt.exe
4104	vOOyDjR.exe
1072	IYRGumz.exe
1880	vbpzGiF.exe
3012	xsofqUw.exe
4512	PTKEcLX.exe
2528	aIacPJQ.exe
3600	baTMuTX.exe
464	LgryBPD.exe
2852	dTCsHeb.exe
1036	NlHamZa.exe
4932	npWvsuQ.exe
1968	VdoOzjR.exe
4772	bjqyBRE.exe
4992	lQeYUMu.exe
1728	vgqSMya.exe
3240	JkuMmgL.exe
3672	xHdVZic.exe
3500	lAqnBxM.exe
1520	kIxDiNc.exe
1760	sQJpBJY.exe
3988	GtbXcbu.exe
4844	OFhQnhn.exe
512	fhWcfWf.exe
2352	CyxMPfh.exe
1124	YApBVWD.exe
3612	BfUiJzI.exe
4472	CQWqwTE.exe
3708	UDwpknS.exe
60	PvwQBae.exe
4872	BegIIoD.exe
4748	UWZMBcM.exe
3768	uTydwYd.exe
4680	GfxAHwc.exe
4452	lxLceDV.exe
4460	FUBYqOE.exe
3168	oGRKAqd.exe
3996	Oeqjftq.exe
4016	HWrAMLr.exe
3816	ncqzrwo.exe
3420	gsNBbVs.exe
3984	aNvttsb.exe
632	dYKnylz.exe
3652	auUQsqR.exe
4468	xafBDTI.exe
4040	TUPnOan.exe
2808	giKyiGV.exe
1936	BLIzzBo.exe
1992	QRBxJOb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4736-0-0x00007FF6E5A20000-0x00007FF6E5E12000-memory.dmp	upx
behavioral2/files/0x000c000000023b98-5.dat	upx
behavioral2/files/0x000a000000023b9f-24.dat	upx
behavioral2/files/0x000a000000023ba0-33.dat	upx
behavioral2/files/0x000a000000023ba3-28.dat	upx
behavioral2/files/0x000a000000023ba1-19.dat	upx
behavioral2/files/0x000a000000023ba2-20.dat	upx
behavioral2/memory/3424-13-0x00007FF630940000-0x00007FF630D32000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-79.dat	upx
behavioral2/files/0x000a000000023ba9-99.dat	upx
behavioral2/files/0x000a000000023bb8-133.dat	upx
behavioral2/files/0x000a000000023bc0-182.dat	upx
behavioral2/memory/1784-270-0x00007FF697980000-0x00007FF697D72000-memory.dmp	upx
behavioral2/memory/2672-275-0x00007FF7853F0000-0x00007FF7857E2000-memory.dmp	upx
behavioral2/memory/2716-291-0x00007FF68FB30000-0x00007FF68FF22000-memory.dmp	upx
behavioral2/memory/2148-309-0x00007FF663870000-0x00007FF663C62000-memory.dmp	upx
behavioral2/memory/4104-318-0x00007FF73B9F0000-0x00007FF73BDE2000-memory.dmp	upx
behavioral2/memory/3600-323-0x00007FF605920000-0x00007FF605D12000-memory.dmp	upx
behavioral2/memory/464-328-0x00007FF6D0B50000-0x00007FF6D0F42000-memory.dmp	upx
behavioral2/memory/1072-327-0x00007FF6BD7C0000-0x00007FF6BDBB2000-memory.dmp	upx
behavioral2/memory/2108-326-0x00007FF7D55C0000-0x00007FF7D59B2000-memory.dmp	upx
behavioral2/memory/2520-325-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	upx
behavioral2/memory/4576-324-0x00007FF79C260000-0x00007FF79C652000-memory.dmp	upx
behavioral2/memory/2528-322-0x00007FF7CCA10000-0x00007FF7CCE02000-memory.dmp	upx
behavioral2/memory/4512-321-0x00007FF763BA0000-0x00007FF763F92000-memory.dmp	upx
behavioral2/memory/3012-320-0x00007FF74EAC0000-0x00007FF74EEB2000-memory.dmp	upx
behavioral2/memory/1880-319-0x00007FF6A61B0000-0x00007FF6A65A2000-memory.dmp	upx
behavioral2/memory/2300-317-0x00007FF7D2FC0000-0x00007FF7D33B2000-memory.dmp	upx
behavioral2/memory/5036-307-0x00007FF67CEA0000-0x00007FF67D292000-memory.dmp	upx
behavioral2/memory/4744-288-0x00007FF716CD0000-0x00007FF7170C2000-memory.dmp	upx
behavioral2/memory/4956-264-0x00007FF61A580000-0x00007FF61A972000-memory.dmp	upx
behavioral2/memory/1836-224-0x00007FF6252B0000-0x00007FF6256A2000-memory.dmp	upx
behavioral2/memory/2188-214-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-190.dat	upx
behavioral2/files/0x000a000000023bc1-189.dat	upx
behavioral2/files/0x0031000000023bbf-177.dat	upx
behavioral2/files/0x0031000000023bbe-173.dat	upx
behavioral2/files/0x0031000000023bbd-171.dat	upx
behavioral2/files/0x000a000000023bbc-166.dat	upx
behavioral2/files/0x000a000000023bb5-163.dat	upx
behavioral2/files/0x000a000000023bb6-162.dat	upx
behavioral2/files/0x000a000000023bb4-160.dat	upx
behavioral2/files/0x000a000000023bbb-159.dat	upx
behavioral2/files/0x000a000000023bba-154.dat	upx
behavioral2/files/0x000a000000023bb9-147.dat	upx
behavioral2/files/0x000a000000023baf-145.dat	upx
behavioral2/files/0x000a000000023baa-138.dat	upx
behavioral2/files/0x000a000000023bb7-137.dat	upx
behavioral2/files/0x000a000000023bb3-134.dat	upx
behavioral2/files/0x000a000000023bb2-178.dat	upx
behavioral2/files/0x000a000000023bac-176.dat	upx
behavioral2/files/0x000a000000023ba7-124.dat	upx
behavioral2/files/0x000a000000023bb0-113.dat	upx
behavioral2/files/0x000a000000023ba5-103.dat	upx
behavioral2/files/0x000a000000023bad-94.dat	upx
behavioral2/files/0x000a000000023bb1-121.dat	upx
behavioral2/memory/2936-118-0x00007FF659DC0000-0x00007FF65A1B2000-memory.dmp	upx
behavioral2/memory/1128-89-0x00007FF7971C0000-0x00007FF7975B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-107.dat	upx
behavioral2/files/0x000a000000023ba4-75.dat	upx
behavioral2/files/0x000a000000023ba8-74.dat	upx
behavioral2/files/0x000a000000023ba6-66.dat	upx
behavioral2/memory/2520-3453-0x00007FF680600000-0x00007FF6809F2000-memory.dmp	upx
behavioral2/memory/2188-3457-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IHhwxvd.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\ZvPcCPA.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\JPFPfVd.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\zuVocJk.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\fvjGDjO.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\LiOegPG.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\AxNCwTv.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\hkMNmwp.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\oYcLuUv.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\OUGuIQN.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\nsVsfYh.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\XttVOyA.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\QzBDRkK.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\FNmYMvg.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\UDpTRbg.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\EYVPDnr.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\CSPZxiD.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\YDtFePQ.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\fYxkUXa.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\SghUmIA.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\qduxUQl.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\OGuJWef.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\mfsZPhC.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\yjKLwBH.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\WKKuPae.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\DgYfsdt.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\sNAMkab.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\iELViLr.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\DglwWZP.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\ynmlLLR.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\PoygJTU.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\DEFcHvc.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\kqevRtn.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\nmHzgEv.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\WmWSwoc.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\ookVRAB.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\BgWHdlb.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\sswKCXU.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\SXpHvyv.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\wkzoKEJ.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\lhKpYgd.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\NqHAaHP.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\BnBoEsS.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\IVTrAeA.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\jVDHWtl.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\JGDmFdU.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\AIyRfbw.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\eSObTkD.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\kTOAzwl.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\krUhRpW.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\cFimmTs.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\ZNzWsEv.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\LdTCjXM.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\epdHLza.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\kQnfsjB.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\enkCZzE.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\viArsXd.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\TryyiMw.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\nmWNzDc.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\jmvrLRj.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\OryeiQU.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\vxyJJSr.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\jZwtWxf.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
File created	C:\Windows\System\cGRsDon.exe	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
Token: SeDebugPrivilege	4488	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4488	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	85
PID 4736 wrote to memory of 4488	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	85
PID 4736 wrote to memory of 3424	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	86
PID 4736 wrote to memory of 3424	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	86
PID 4736 wrote to memory of 4576	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	87
PID 4736 wrote to memory of 4576	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	87
PID 4736 wrote to memory of 2520	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	88
PID 4736 wrote to memory of 2520	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	88
PID 4736 wrote to memory of 1128	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	89
PID 4736 wrote to memory of 1128	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	89
PID 4736 wrote to memory of 2936	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	90
PID 4736 wrote to memory of 2936	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	90
PID 4736 wrote to memory of 2188	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	91
PID 4736 wrote to memory of 2188	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	91
PID 4736 wrote to memory of 1836	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	92
PID 4736 wrote to memory of 1836	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	92
PID 4736 wrote to memory of 2716	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	93
PID 4736 wrote to memory of 2716	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	93
PID 4736 wrote to memory of 4956	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	94
PID 4736 wrote to memory of 4956	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	94
PID 4736 wrote to memory of 2108	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	95
PID 4736 wrote to memory of 2108	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	95
PID 4736 wrote to memory of 1784	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	96
PID 4736 wrote to memory of 1784	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	96
PID 4736 wrote to memory of 2672	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	97
PID 4736 wrote to memory of 2672	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	97
PID 4736 wrote to memory of 4744	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	98
PID 4736 wrote to memory of 4744	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	98
PID 4736 wrote to memory of 5036	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	99
PID 4736 wrote to memory of 5036	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	99
PID 4736 wrote to memory of 1880	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	100
PID 4736 wrote to memory of 1880	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	100
PID 4736 wrote to memory of 3012	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	101
PID 4736 wrote to memory of 3012	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	101
PID 4736 wrote to memory of 2148	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	102
PID 4736 wrote to memory of 2148	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	102
PID 4736 wrote to memory of 2300	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	103
PID 4736 wrote to memory of 2300	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	103
PID 4736 wrote to memory of 4104	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	104
PID 4736 wrote to memory of 4104	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	104
PID 4736 wrote to memory of 1072	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	105
PID 4736 wrote to memory of 1072	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	105
PID 4736 wrote to memory of 4512	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	106
PID 4736 wrote to memory of 4512	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	106
PID 4736 wrote to memory of 2852	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	107
PID 4736 wrote to memory of 2852	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	107
PID 4736 wrote to memory of 2528	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	108
PID 4736 wrote to memory of 2528	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	108
PID 4736 wrote to memory of 3600	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	109
PID 4736 wrote to memory of 3600	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	109
PID 4736 wrote to memory of 4992	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	110
PID 4736 wrote to memory of 4992	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	110
PID 4736 wrote to memory of 464	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	111
PID 4736 wrote to memory of 464	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	111
PID 4736 wrote to memory of 1036	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	112
PID 4736 wrote to memory of 1036	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	112
PID 4736 wrote to memory of 4932	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	113
PID 4736 wrote to memory of 4932	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	113
PID 4736 wrote to memory of 1968	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	114
PID 4736 wrote to memory of 1968	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	114
PID 4736 wrote to memory of 4772	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	115
PID 4736 wrote to memory of 4772	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	115
PID 4736 wrote to memory of 1728	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	116
PID 4736 wrote to memory of 1728	4736	17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17435883ba662f79264e0284eda0b79b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\System\YjPFpPy.exe
  C:\Windows\System\YjPFpPy.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\nJFHvow.exe
  C:\Windows\System\nJFHvow.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\gnSmIWi.exe
  C:\Windows\System\gnSmIWi.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\GtOIkxC.exe
  C:\Windows\System\GtOIkxC.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\zEQBfxi.exe
  C:\Windows\System\zEQBfxi.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\nYpurvY.exe
  C:\Windows\System\nYpurvY.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\UQxYlHX.exe
  C:\Windows\System\UQxYlHX.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\bKuyPfS.exe
  C:\Windows\System\bKuyPfS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gwLoLfm.exe
  C:\Windows\System\gwLoLfm.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\bBqDiPh.exe
  C:\Windows\System\bBqDiPh.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ESKuZEs.exe
  C:\Windows\System\ESKuZEs.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\GqkpRJK.exe
  C:\Windows\System\GqkpRJK.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\CTOyRyO.exe
  C:\Windows\System\CTOyRyO.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\WOYtBjF.exe
  C:\Windows\System\WOYtBjF.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\vbpzGiF.exe
  C:\Windows\System\vbpzGiF.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\xsofqUw.exe
  C:\Windows\System\xsofqUw.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\rmMtEAW.exe
  C:\Windows\System\rmMtEAW.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\xEGkydt.exe
  C:\Windows\System\xEGkydt.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\vOOyDjR.exe
  C:\Windows\System\vOOyDjR.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\IYRGumz.exe
  C:\Windows\System\IYRGumz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\PTKEcLX.exe
  C:\Windows\System\PTKEcLX.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\dTCsHeb.exe
  C:\Windows\System\dTCsHeb.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\aIacPJQ.exe
  C:\Windows\System\aIacPJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\baTMuTX.exe
  C:\Windows\System\baTMuTX.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\lQeYUMu.exe
  C:\Windows\System\lQeYUMu.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\LgryBPD.exe
  C:\Windows\System\LgryBPD.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\NlHamZa.exe
  C:\Windows\System\NlHamZa.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\npWvsuQ.exe
  C:\Windows\System\npWvsuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\VdoOzjR.exe
  C:\Windows\System\VdoOzjR.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\bjqyBRE.exe
  C:\Windows\System\bjqyBRE.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\vgqSMya.exe
  C:\Windows\System\vgqSMya.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\JkuMmgL.exe
  C:\Windows\System\JkuMmgL.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\xHdVZic.exe
  C:\Windows\System\xHdVZic.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\lAqnBxM.exe
  C:\Windows\System\lAqnBxM.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\kIxDiNc.exe
  C:\Windows\System\kIxDiNc.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\YApBVWD.exe
  C:\Windows\System\YApBVWD.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\sQJpBJY.exe
  C:\Windows\System\sQJpBJY.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\BfUiJzI.exe
  C:\Windows\System\BfUiJzI.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\GtbXcbu.exe
  C:\Windows\System\GtbXcbu.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\OFhQnhn.exe
  C:\Windows\System\OFhQnhn.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\UDwpknS.exe
  C:\Windows\System\UDwpknS.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\BegIIoD.exe
  C:\Windows\System\BegIIoD.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\uTydwYd.exe
  C:\Windows\System\uTydwYd.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\oGRKAqd.exe
  C:\Windows\System\oGRKAqd.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\ncqzrwo.exe
  C:\Windows\System\ncqzrwo.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\fhWcfWf.exe
  C:\Windows\System\fhWcfWf.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\CyxMPfh.exe
  C:\Windows\System\CyxMPfh.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\CQWqwTE.exe
  C:\Windows\System\CQWqwTE.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\PvwQBae.exe
  C:\Windows\System\PvwQBae.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\UWZMBcM.exe
  C:\Windows\System\UWZMBcM.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\GfxAHwc.exe
  C:\Windows\System\GfxAHwc.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\lxLceDV.exe
  C:\Windows\System\lxLceDV.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\FUBYqOE.exe
  C:\Windows\System\FUBYqOE.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\Oeqjftq.exe
  C:\Windows\System\Oeqjftq.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\HWrAMLr.exe
  C:\Windows\System\HWrAMLr.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\gsNBbVs.exe
  C:\Windows\System\gsNBbVs.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\aNvttsb.exe
  C:\Windows\System\aNvttsb.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\dYKnylz.exe
  C:\Windows\System\dYKnylz.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\auUQsqR.exe
  C:\Windows\System\auUQsqR.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\xafBDTI.exe
  C:\Windows\System\xafBDTI.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\TUPnOan.exe
  C:\Windows\System\TUPnOan.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\giKyiGV.exe
  C:\Windows\System\giKyiGV.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\BLIzzBo.exe
  C:\Windows\System\BLIzzBo.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QRBxJOb.exe
  C:\Windows\System\QRBxJOb.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\UGuVFkU.exe
  C:\Windows\System\UGuVFkU.exe
  2⤵
  PID:4032
- C:\Windows\System\CuEUKjY.exe
  C:\Windows\System\CuEUKjY.exe
  2⤵
  PID:2648
- C:\Windows\System\wZnRfQg.exe
  C:\Windows\System\wZnRfQg.exe
  2⤵
  PID:3216
- C:\Windows\System\DPARTiv.exe
  C:\Windows\System\DPARTiv.exe
  2⤵
  PID:3876
- C:\Windows\System\orzTdom.exe
  C:\Windows\System\orzTdom.exe
  2⤵
  PID:5020
- C:\Windows\System\albxzOb.exe
  C:\Windows\System\albxzOb.exe
  2⤵
  PID:4524
- C:\Windows\System\FZtAOCT.exe
  C:\Windows\System\FZtAOCT.exe
  2⤵
  PID:5232
- C:\Windows\System\weNTUYz.exe
  C:\Windows\System\weNTUYz.exe
  2⤵
  PID:5376
- C:\Windows\System\fNbXKQu.exe
  C:\Windows\System\fNbXKQu.exe
  2⤵
  PID:5392
- C:\Windows\System\caKWmpn.exe
  C:\Windows\System\caKWmpn.exe
  2⤵
  PID:5408
- C:\Windows\System\GHIjduN.exe
  C:\Windows\System\GHIjduN.exe
  2⤵
  PID:5424
- C:\Windows\System\ununOmt.exe
  C:\Windows\System\ununOmt.exe
  2⤵
  PID:5440
- C:\Windows\System\AwJgnxa.exe
  C:\Windows\System\AwJgnxa.exe
  2⤵
  PID:5456
- C:\Windows\System\nIKLPGc.exe
  C:\Windows\System\nIKLPGc.exe
  2⤵
  PID:5484
- C:\Windows\System\mBgfbsN.exe
  C:\Windows\System\mBgfbsN.exe
  2⤵
  PID:5844
- C:\Windows\System\ZVmjmHe.exe
  C:\Windows\System\ZVmjmHe.exe
  2⤵
  PID:5860
- C:\Windows\System\aUddBhr.exe
  C:\Windows\System\aUddBhr.exe
  2⤵
  PID:5876
- C:\Windows\System\xloqgor.exe
  C:\Windows\System\xloqgor.exe
  2⤵
  PID:5892
- C:\Windows\System\DuBMEvv.exe
  C:\Windows\System\DuBMEvv.exe
  2⤵
  PID:5912
- C:\Windows\System\KbKrQKX.exe
  C:\Windows\System\KbKrQKX.exe
  2⤵
  PID:5940
- C:\Windows\System\tOXOVhP.exe
  C:\Windows\System\tOXOVhP.exe
  2⤵
  PID:5964
- C:\Windows\System\nzdFJlB.exe
  C:\Windows\System\nzdFJlB.exe
  2⤵
  PID:5984
- C:\Windows\System\jqpNbdp.exe
  C:\Windows\System\jqpNbdp.exe
  2⤵
  PID:6008
- C:\Windows\System\pySKicq.exe
  C:\Windows\System\pySKicq.exe
  2⤵
  PID:6032
- C:\Windows\System\gncFeqe.exe
  C:\Windows\System\gncFeqe.exe
  2⤵
  PID:6056
- C:\Windows\System\POsQOSg.exe
  C:\Windows\System\POsQOSg.exe
  2⤵
  PID:6084
- C:\Windows\System\FjiIOFe.exe
  C:\Windows\System\FjiIOFe.exe
  2⤵
  PID:6112
- C:\Windows\System\OzmHrMA.exe
  C:\Windows\System\OzmHrMA.exe
  2⤵
  PID:6136
- C:\Windows\System\YVCqCOE.exe
  C:\Windows\System\YVCqCOE.exe
  2⤵
  PID:4340
- C:\Windows\System\kytOiWv.exe
  C:\Windows\System\kytOiWv.exe
  2⤵
  PID:2728
- C:\Windows\System\NWCEuAV.exe
  C:\Windows\System\NWCEuAV.exe
  2⤵
  PID:2956
- C:\Windows\System\CcGtpje.exe
  C:\Windows\System\CcGtpje.exe
  2⤵
  PID:4072
- C:\Windows\System\JosVWxz.exe
  C:\Windows\System\JosVWxz.exe
  2⤵
  PID:2732
- C:\Windows\System\EKylBTp.exe
  C:\Windows\System\EKylBTp.exe
  2⤵
  PID:4640
- C:\Windows\System\JFbPefZ.exe
  C:\Windows\System\JFbPefZ.exe
  2⤵
  PID:1092
- C:\Windows\System\FjkKICa.exe
  C:\Windows\System\FjkKICa.exe
  2⤵
  PID:2744
- C:\Windows\System\rEDZnqP.exe
  C:\Windows\System\rEDZnqP.exe
  2⤵
  PID:5060
- C:\Windows\System\Qhmlahj.exe
  C:\Windows\System\Qhmlahj.exe
  2⤵
  PID:2628
- C:\Windows\System\GmKocvR.exe
  C:\Windows\System\GmKocvR.exe
  2⤵
  PID:4988
- C:\Windows\System\HwdZhJn.exe
  C:\Windows\System\HwdZhJn.exe
  2⤵
  PID:1788
- C:\Windows\System\ZIaGxNJ.exe
  C:\Windows\System\ZIaGxNJ.exe
  2⤵
  PID:2940
- C:\Windows\System\prkKzba.exe
  C:\Windows\System\prkKzba.exe
  2⤵
  PID:5256
- C:\Windows\System\aEYssLB.exe
  C:\Windows\System\aEYssLB.exe
  2⤵
  PID:5304
- C:\Windows\System\BjWXvHv.exe
  C:\Windows\System\BjWXvHv.exe
  2⤵
  PID:5268
- C:\Windows\System\OvqRTaC.exe
  C:\Windows\System\OvqRTaC.exe
  2⤵
  PID:5404
- C:\Windows\System\WjmfwSh.exe
  C:\Windows\System\WjmfwSh.exe
  2⤵
  PID:5452
- C:\Windows\System\RtBdezp.exe
  C:\Windows\System\RtBdezp.exe
  2⤵
  PID:5520
- C:\Windows\System\xlyxnoS.exe
  C:\Windows\System\xlyxnoS.exe
  2⤵
  PID:5580
- C:\Windows\System\lrUtspN.exe
  C:\Windows\System\lrUtspN.exe
  2⤵
  PID:5720
- C:\Windows\System\JVQixeE.exe
  C:\Windows\System\JVQixeE.exe
  2⤵
  PID:4864
- C:\Windows\System\KipzWcp.exe
  C:\Windows\System\KipzWcp.exe
  2⤵
  PID:796
- C:\Windows\System\bhMwYhl.exe
  C:\Windows\System\bhMwYhl.exe
  2⤵
  PID:2332
- C:\Windows\System\ZPBeDeA.exe
  C:\Windows\System\ZPBeDeA.exe
  2⤵
  PID:3288
- C:\Windows\System\HUloJGt.exe
  C:\Windows\System\HUloJGt.exe
  2⤵
  PID:2100
- C:\Windows\System\ibwsnru.exe
  C:\Windows\System\ibwsnru.exe
  2⤵
  PID:1512
- C:\Windows\System\qjVoBaq.exe
  C:\Windows\System\qjVoBaq.exe
  2⤵
  PID:3540
- C:\Windows\System\SaDspDS.exe
  C:\Windows\System\SaDspDS.exe
  2⤵
  PID:3608
- C:\Windows\System\YDnAPuh.exe
  C:\Windows\System\YDnAPuh.exe
  2⤵
  PID:3624
- C:\Windows\System\BYKiQwA.exe
  C:\Windows\System\BYKiQwA.exe
  2⤵
  PID:3128
- C:\Windows\System\HgmzUVX.exe
  C:\Windows\System\HgmzUVX.exe
  2⤵
  PID:3224
- C:\Windows\System\fLqjyEY.exe
  C:\Windows\System\fLqjyEY.exe
  2⤵
  PID:3780
- C:\Windows\System\WYfUVPf.exe
  C:\Windows\System\WYfUVPf.exe
  2⤵
  PID:5592
- C:\Windows\System\mmkpeRA.exe
  C:\Windows\System\mmkpeRA.exe
  2⤵
  PID:5692
- C:\Windows\System\PllMmOy.exe
  C:\Windows\System\PllMmOy.exe
  2⤵
  PID:5680
- C:\Windows\System\rUCMvdB.exe
  C:\Windows\System\rUCMvdB.exe
  2⤵
  PID:1916
- C:\Windows\System\vaBWjcI.exe
  C:\Windows\System\vaBWjcI.exe
  2⤵
  PID:212
- C:\Windows\System\ZMmWZhb.exe
  C:\Windows\System\ZMmWZhb.exe
  2⤵
  PID:5856
- C:\Windows\System\Ebbjatr.exe
  C:\Windows\System\Ebbjatr.exe
  2⤵
  PID:5952
- C:\Windows\System\ePUvTet.exe
  C:\Windows\System\ePUvTet.exe
  2⤵
  PID:5932
- C:\Windows\System\okdRVef.exe
  C:\Windows\System\okdRVef.exe
  2⤵
  PID:6052
- C:\Windows\System\adjHJxt.exe
  C:\Windows\System\adjHJxt.exe
  2⤵
  PID:6028
- C:\Windows\System\ZTCuPXR.exe
  C:\Windows\System\ZTCuPXR.exe
  2⤵
  PID:6128
- C:\Windows\System\dlLpOiT.exe
  C:\Windows\System\dlLpOiT.exe
  2⤵
  PID:3928
- C:\Windows\System\rsJIBxG.exe
  C:\Windows\System\rsJIBxG.exe
  2⤵
  PID:3256
- C:\Windows\System\dMpQITq.exe
  C:\Windows\System\dMpQITq.exe
  2⤵
  PID:4628
- C:\Windows\System\FYdpPjy.exe
  C:\Windows\System\FYdpPjy.exe
  2⤵
  PID:4964
- C:\Windows\System\bFibNCT.exe
  C:\Windows\System\bFibNCT.exe
  2⤵
  PID:5316
- C:\Windows\System\vZPkOiV.exe
  C:\Windows\System\vZPkOiV.exe
  2⤵
  PID:5400
- C:\Windows\System\YxHAWui.exe
  C:\Windows\System\YxHAWui.exe
  2⤵
  PID:5564
- C:\Windows\System\OaiJAJQ.exe
  C:\Windows\System\OaiJAJQ.exe
  2⤵
  PID:4580
- C:\Windows\System\veKiobL.exe
  C:\Windows\System\veKiobL.exe
  2⤵
  PID:5220
- C:\Windows\System\HWJRmyF.exe
  C:\Windows\System\HWJRmyF.exe
  2⤵
  PID:4752
- C:\Windows\System\jAWNszC.exe
  C:\Windows\System\jAWNszC.exe
  2⤵
  PID:5736
- C:\Windows\System\zdEnnOU.exe
  C:\Windows\System\zdEnnOU.exe
  2⤵
  PID:4000
- C:\Windows\System\nxjaNDU.exe
  C:\Windows\System\nxjaNDU.exe
  2⤵
  PID:2400
- C:\Windows\System\sushIJV.exe
  C:\Windows\System\sushIJV.exe
  2⤵
  PID:4976
- C:\Windows\System\ETsXrVT.exe
  C:\Windows\System\ETsXrVT.exe
  2⤵
  PID:1496
- C:\Windows\System\jzGiOsC.exe
  C:\Windows\System\jzGiOsC.exe
  2⤵
  PID:2480
- C:\Windows\System\yYeSYmM.exe
  C:\Windows\System\yYeSYmM.exe
  2⤵
  PID:5992
- C:\Windows\System\YNnoFYe.exe
  C:\Windows\System\YNnoFYe.exe
  2⤵
  PID:6164
- C:\Windows\System\uRiJqIl.exe
  C:\Windows\System\uRiJqIl.exe
  2⤵
  PID:6184
- C:\Windows\System\pYivHOl.exe
  C:\Windows\System\pYivHOl.exe
  2⤵
  PID:6204
- C:\Windows\System\cLnvfcT.exe
  C:\Windows\System\cLnvfcT.exe
  2⤵
  PID:6228
- C:\Windows\System\kLolbSM.exe
  C:\Windows\System\kLolbSM.exe
  2⤵
  PID:6252
- C:\Windows\System\iWfCaye.exe
  C:\Windows\System\iWfCaye.exe
  2⤵
  PID:6276
- C:\Windows\System\MIxjWMN.exe
  C:\Windows\System\MIxjWMN.exe
  2⤵
  PID:6304
- C:\Windows\System\zngkQdh.exe
  C:\Windows\System\zngkQdh.exe
  2⤵
  PID:6328
- C:\Windows\System\pNMPYQH.exe
  C:\Windows\System\pNMPYQH.exe
  2⤵
  PID:6348
- C:\Windows\System\CGzRCTl.exe
  C:\Windows\System\CGzRCTl.exe
  2⤵
  PID:6380
- C:\Windows\System\tdrbpvv.exe
  C:\Windows\System\tdrbpvv.exe
  2⤵
  PID:6404
- C:\Windows\System\sMrAJJX.exe
  C:\Windows\System\sMrAJJX.exe
  2⤵
  PID:6424
- C:\Windows\System\WuMYtDp.exe
  C:\Windows\System\WuMYtDp.exe
  2⤵
  PID:6452
- C:\Windows\System\ghSdVqa.exe
  C:\Windows\System\ghSdVqa.exe
  2⤵
  PID:6484
- C:\Windows\System\GXvxSfC.exe
  C:\Windows\System\GXvxSfC.exe
  2⤵
  PID:6508
- C:\Windows\System\VfYCsky.exe
  C:\Windows\System\VfYCsky.exe
  2⤵
  PID:6544
- C:\Windows\System\yZFbKVA.exe
  C:\Windows\System\yZFbKVA.exe
  2⤵
  PID:6572
- C:\Windows\System\UunkKqG.exe
  C:\Windows\System\UunkKqG.exe
  2⤵
  PID:6600
- C:\Windows\System\ummabgz.exe
  C:\Windows\System\ummabgz.exe
  2⤵
  PID:6620
- C:\Windows\System\hmICSON.exe
  C:\Windows\System\hmICSON.exe
  2⤵
  PID:6636
- C:\Windows\System\MfpWCeI.exe
  C:\Windows\System\MfpWCeI.exe
  2⤵
  PID:6672
- C:\Windows\System\SvMhVjU.exe
  C:\Windows\System\SvMhVjU.exe
  2⤵
  PID:6700
- C:\Windows\System\JDxCpPM.exe
  C:\Windows\System\JDxCpPM.exe
  2⤵
  PID:6724
- C:\Windows\System\yxhBjBS.exe
  C:\Windows\System\yxhBjBS.exe
  2⤵
  PID:6744
- C:\Windows\System\joafHkk.exe
  C:\Windows\System\joafHkk.exe
  2⤵
  PID:6768
- C:\Windows\System\XyDsnPW.exe
  C:\Windows\System\XyDsnPW.exe
  2⤵
  PID:6788
- C:\Windows\System\AdyUEAQ.exe
  C:\Windows\System\AdyUEAQ.exe
  2⤵
  PID:6812
- C:\Windows\System\eKQUjAJ.exe
  C:\Windows\System\eKQUjAJ.exe
  2⤵
  PID:6840
- C:\Windows\System\cMBoRgi.exe
  C:\Windows\System\cMBoRgi.exe
  2⤵
  PID:6860
- C:\Windows\System\wHdjWkM.exe
  C:\Windows\System\wHdjWkM.exe
  2⤵
  PID:6888
- C:\Windows\System\lCeNNtU.exe
  C:\Windows\System\lCeNNtU.exe
  2⤵
  PID:6912
- C:\Windows\System\OqnqSPs.exe
  C:\Windows\System\OqnqSPs.exe
  2⤵
  PID:6936
- C:\Windows\System\feRbalm.exe
  C:\Windows\System\feRbalm.exe
  2⤵
  PID:6964
- C:\Windows\System\pDilkwY.exe
  C:\Windows\System\pDilkwY.exe
  2⤵
  PID:6984
- C:\Windows\System\bgsMDnn.exe
  C:\Windows\System\bgsMDnn.exe
  2⤵
  PID:7004
- C:\Windows\System\AjQZRqd.exe
  C:\Windows\System\AjQZRqd.exe
  2⤵
  PID:7028
- C:\Windows\System\EIcpBMn.exe
  C:\Windows\System\EIcpBMn.exe
  2⤵
  PID:7052
- C:\Windows\System\jIpKTyG.exe
  C:\Windows\System\jIpKTyG.exe
  2⤵
  PID:7076
- C:\Windows\System\EeWxvBZ.exe
  C:\Windows\System\EeWxvBZ.exe
  2⤵
  PID:7104
- C:\Windows\System\ZMSYujI.exe
  C:\Windows\System\ZMSYujI.exe
  2⤵
  PID:7132
- C:\Windows\System\QAZlsos.exe
  C:\Windows\System\QAZlsos.exe
  2⤵
  PID:7160
- C:\Windows\System\gEjkqsV.exe
  C:\Windows\System\gEjkqsV.exe
  2⤵
  PID:5500
- C:\Windows\System\buiQrIV.exe
  C:\Windows\System\buiQrIV.exe
  2⤵
  PID:836
- C:\Windows\System\dLrswiE.exe
  C:\Windows\System\dLrswiE.exe
  2⤵
  PID:2980
- C:\Windows\System\dWDrEOR.exe
  C:\Windows\System\dWDrEOR.exe
  2⤵
  PID:6092
- C:\Windows\System\KnMuMGp.exe
  C:\Windows\System\KnMuMGp.exe
  2⤵
  PID:6016
- C:\Windows\System\csteSJL.exe
  C:\Windows\System\csteSJL.exe
  2⤵
  PID:3716
- C:\Windows\System\XkLkztY.exe
  C:\Windows\System\XkLkztY.exe
  2⤵
  PID:1608
- C:\Windows\System\zKqPPox.exe
  C:\Windows\System\zKqPPox.exe
  2⤵
  PID:3080
- C:\Windows\System\NqHAaHP.exe
  C:\Windows\System\NqHAaHP.exe
  2⤵
  PID:1236
- C:\Windows\System\vfvLKEZ.exe
  C:\Windows\System\vfvLKEZ.exe
  2⤵
  PID:1260
- C:\Windows\System\njZdSeE.exe
  C:\Windows\System\njZdSeE.exe
  2⤵
  PID:6540
- C:\Windows\System\TAQxjyI.exe
  C:\Windows\System\TAQxjyI.exe
  2⤵
  PID:4464
- C:\Windows\System\VkTIqVG.exe
  C:\Windows\System\VkTIqVG.exe
  2⤵
  PID:6236
- C:\Windows\System\dcMUyCq.exe
  C:\Windows\System\dcMUyCq.exe
  2⤵
  PID:6752
- C:\Windows\System\kySqZJJ.exe
  C:\Windows\System\kySqZJJ.exe
  2⤵
  PID:6340
- C:\Windows\System\xjsGCPf.exe
  C:\Windows\System\xjsGCPf.exe
  2⤵
  PID:6420
- C:\Windows\System\NFZHnAw.exe
  C:\Windows\System\NFZHnAw.exe
  2⤵
  PID:6668
- C:\Windows\System\UhSrXQM.exe
  C:\Windows\System\UhSrXQM.exe
  2⤵
  PID:6944
- C:\Windows\System\bYkcpvQ.exe
  C:\Windows\System\bYkcpvQ.exe
  2⤵
  PID:7036
- C:\Windows\System\kDzsJRf.exe
  C:\Windows\System\kDzsJRf.exe
  2⤵
  PID:5548
- C:\Windows\System\oKjMFbU.exe
  C:\Windows\System\oKjMFbU.exe
  2⤵
  PID:6608
- C:\Windows\System\LZlwwmm.exe
  C:\Windows\System\LZlwwmm.exe
  2⤵
  PID:6176
- C:\Windows\System\HHYWgKp.exe
  C:\Windows\System\HHYWgKp.exe
  2⤵
  PID:6908
- C:\Windows\System\ecYpUtT.exe
  C:\Windows\System\ecYpUtT.exe
  2⤵
  PID:6368
- C:\Windows\System\BBlbZJV.exe
  C:\Windows\System\BBlbZJV.exe
  2⤵
  PID:6296
- C:\Windows\System\LUXvckZ.exe
  C:\Windows\System\LUXvckZ.exe
  2⤵
  PID:6736
- C:\Windows\System\uZVhQpl.exe
  C:\Windows\System\uZVhQpl.exe
  2⤵
  PID:7184
- C:\Windows\System\YTowaAk.exe
  C:\Windows\System\YTowaAk.exe
  2⤵
  PID:7204
- C:\Windows\System\WcTvoVN.exe
  C:\Windows\System\WcTvoVN.exe
  2⤵
  PID:7228
- C:\Windows\System\bJNyusR.exe
  C:\Windows\System\bJNyusR.exe
  2⤵
  PID:7252
- C:\Windows\System\JooLsFt.exe
  C:\Windows\System\JooLsFt.exe
  2⤵
  PID:7276
- C:\Windows\System\PxocKDZ.exe
  C:\Windows\System\PxocKDZ.exe
  2⤵
  PID:7300
- C:\Windows\System\VIeslpW.exe
  C:\Windows\System\VIeslpW.exe
  2⤵
  PID:7324
- C:\Windows\System\UZaYGoG.exe
  C:\Windows\System\UZaYGoG.exe
  2⤵
  PID:7348
- C:\Windows\System\CBpcxyq.exe
  C:\Windows\System\CBpcxyq.exe
  2⤵
  PID:7372
- C:\Windows\System\OhjDoFY.exe
  C:\Windows\System\OhjDoFY.exe
  2⤵
  PID:7392
- C:\Windows\System\qLFejzK.exe
  C:\Windows\System\qLFejzK.exe
  2⤵
  PID:7416
- C:\Windows\System\tjbyqBG.exe
  C:\Windows\System\tjbyqBG.exe
  2⤵
  PID:7448
- C:\Windows\System\DpyeALx.exe
  C:\Windows\System\DpyeALx.exe
  2⤵
  PID:7468
- C:\Windows\System\VPthYNH.exe
  C:\Windows\System\VPthYNH.exe
  2⤵
  PID:7492
- C:\Windows\System\SsQDszX.exe
  C:\Windows\System\SsQDszX.exe
  2⤵
  PID:7516
- C:\Windows\System\aJvekmd.exe
  C:\Windows\System\aJvekmd.exe
  2⤵
  PID:7540
- C:\Windows\System\eyUQpSA.exe
  C:\Windows\System\eyUQpSA.exe
  2⤵
  PID:7564
- C:\Windows\System\peBVJey.exe
  C:\Windows\System\peBVJey.exe
  2⤵
  PID:7592
- C:\Windows\System\jnLZhlk.exe
  C:\Windows\System\jnLZhlk.exe
  2⤵
  PID:7612
- C:\Windows\System\Wpvsmta.exe
  C:\Windows\System\Wpvsmta.exe
  2⤵
  PID:7636
- C:\Windows\System\unaNceB.exe
  C:\Windows\System\unaNceB.exe
  2⤵
  PID:7660
- C:\Windows\System\GcmNFbk.exe
  C:\Windows\System\GcmNFbk.exe
  2⤵
  PID:7684
- C:\Windows\System\ZuDPDUm.exe
  C:\Windows\System\ZuDPDUm.exe
  2⤵
  PID:7728
- C:\Windows\System\gjUQQYM.exe
  C:\Windows\System\gjUQQYM.exe
  2⤵
  PID:7752
- C:\Windows\System\FOcBCmV.exe
  C:\Windows\System\FOcBCmV.exe
  2⤵
  PID:7772
- C:\Windows\System\rfcTeXF.exe
  C:\Windows\System\rfcTeXF.exe
  2⤵
  PID:7788
- C:\Windows\System\CJWGqSw.exe
  C:\Windows\System\CJWGqSw.exe
  2⤵
  PID:7812
- C:\Windows\System\mWuAFXJ.exe
  C:\Windows\System\mWuAFXJ.exe
  2⤵
  PID:7840
- C:\Windows\System\gBXkQzc.exe
  C:\Windows\System\gBXkQzc.exe
  2⤵
  PID:7864
- C:\Windows\System\MVNThHM.exe
  C:\Windows\System\MVNThHM.exe
  2⤵
  PID:7888
- C:\Windows\System\euwqubR.exe
  C:\Windows\System\euwqubR.exe
  2⤵
  PID:7912
- C:\Windows\System\WrnSCuO.exe
  C:\Windows\System\WrnSCuO.exe
  2⤵
  PID:7940
- C:\Windows\System\iHTIXdN.exe
  C:\Windows\System\iHTIXdN.exe
  2⤵
  PID:7960
- C:\Windows\System\gcqumpu.exe
  C:\Windows\System\gcqumpu.exe
  2⤵
  PID:7980
- C:\Windows\System\iIxfJzK.exe
  C:\Windows\System\iIxfJzK.exe
  2⤵
  PID:8008
- C:\Windows\System\BjOTPCo.exe
  C:\Windows\System\BjOTPCo.exe
  2⤵
  PID:8032
- C:\Windows\System\CPauCqA.exe
  C:\Windows\System\CPauCqA.exe
  2⤵
  PID:8068
- C:\Windows\System\Lqurvms.exe
  C:\Windows\System\Lqurvms.exe
  2⤵
  PID:8092
- C:\Windows\System\PgHNiyk.exe
  C:\Windows\System\PgHNiyk.exe
  2⤵
  PID:8120
- C:\Windows\System\OfRYRgm.exe
  C:\Windows\System\OfRYRgm.exe
  2⤵
  PID:8140
- C:\Windows\System\CRZfgNw.exe
  C:\Windows\System\CRZfgNw.exe
  2⤵
  PID:8164
- C:\Windows\System\JqGiJnm.exe
  C:\Windows\System\JqGiJnm.exe
  2⤵
  PID:8188
- C:\Windows\System\iwdNNiU.exe
  C:\Windows\System\iwdNNiU.exe
  2⤵
  PID:7144
- C:\Windows\System\gviIvih.exe
  C:\Windows\System\gviIvih.exe
  2⤵
  PID:6316
- C:\Windows\System\zenquJy.exe
  C:\Windows\System\zenquJy.exe
  2⤵
  PID:6820
- C:\Windows\System\AlJcsqX.exe
  C:\Windows\System\AlJcsqX.exe
  2⤵
  PID:6856
- C:\Windows\System\XtDhwSo.exe
  C:\Windows\System\XtDhwSo.exe
  2⤵
  PID:5048
- C:\Windows\System\ZAGsuiq.exe
  C:\Windows\System\ZAGsuiq.exe
  2⤵
  PID:6592
- C:\Windows\System\FNGHGVd.exe
  C:\Windows\System\FNGHGVd.exe
  2⤵
  PID:1652
- C:\Windows\System\ByqWEPt.exe
  C:\Windows\System\ByqWEPt.exe
  2⤵
  PID:6344
- C:\Windows\System\Reiojhw.exe
  C:\Windows\System\Reiojhw.exe
  2⤵
  PID:7084
- C:\Windows\System\pOIVjZg.exe
  C:\Windows\System\pOIVjZg.exe
  2⤵
  PID:7128
- C:\Windows\System\oULOOsW.exe
  C:\Windows\System\oULOOsW.exe
  2⤵
  PID:7260
- C:\Windows\System\dRRxNCt.exe
  C:\Windows\System\dRRxNCt.exe
  2⤵
  PID:4056
- C:\Windows\System\PYSGVJH.exe
  C:\Windows\System\PYSGVJH.exe
  2⤵
  PID:1416
- C:\Windows\System\DcwKYeV.exe
  C:\Windows\System\DcwKYeV.exe
  2⤵
  PID:6664
- C:\Windows\System\gowPvlB.exe
  C:\Windows\System\gowPvlB.exe
  2⤵
  PID:7536
- C:\Windows\System\vzrISyv.exe
  C:\Windows\System\vzrISyv.exe
  2⤵
  PID:7600
- C:\Windows\System\zIqQMtP.exe
  C:\Windows\System\zIqQMtP.exe
  2⤵
  PID:6628
- C:\Windows\System\AXFYhES.exe
  C:\Windows\System\AXFYhES.exe
  2⤵
  PID:6536
- C:\Windows\System\TpuWkWo.exe
  C:\Windows\System\TpuWkWo.exe
  2⤵
  PID:7288
- C:\Windows\System\tQcUmYx.exe
  C:\Windows\System\tQcUmYx.exe
  2⤵
  PID:7768
- C:\Windows\System\EkKGrRe.exe
  C:\Windows\System\EkKGrRe.exe
  2⤵
  PID:7808
- C:\Windows\System\AScCqwu.exe
  C:\Windows\System\AScCqwu.exe
  2⤵
  PID:6444
- C:\Windows\System\xHmWkUU.exe
  C:\Windows\System\xHmWkUU.exe
  2⤵
  PID:7896
- C:\Windows\System\aWHLKiu.exe
  C:\Windows\System\aWHLKiu.exe
  2⤵
  PID:7972
- C:\Windows\System\JqcwShK.exe
  C:\Windows\System\JqcwShK.exe
  2⤵
  PID:7560
- C:\Windows\System\brQcqnw.exe
  C:\Windows\System\brQcqnw.exe
  2⤵
  PID:7692
- C:\Windows\System\RAQycqW.exe
  C:\Windows\System\RAQycqW.exe
  2⤵
  PID:8184
- C:\Windows\System\WlnKnhT.exe
  C:\Windows\System\WlnKnhT.exe
  2⤵
  PID:7268
- C:\Windows\System\VjWJSqL.exe
  C:\Windows\System\VjWJSqL.exe
  2⤵
  PID:8196
- C:\Windows\System\GgxYlnn.exe
  C:\Windows\System\GgxYlnn.exe
  2⤵
  PID:8220
- C:\Windows\System\ZKxiQWu.exe
  C:\Windows\System\ZKxiQWu.exe
  2⤵
  PID:8244
- C:\Windows\System\eGBJttW.exe
  C:\Windows\System\eGBJttW.exe
  2⤵
  PID:8272
- C:\Windows\System\urYnCIL.exe
  C:\Windows\System\urYnCIL.exe
  2⤵
  PID:8300
- C:\Windows\System\ZzVhtIi.exe
  C:\Windows\System\ZzVhtIi.exe
  2⤵
  PID:8324
- C:\Windows\System\NGxitPu.exe
  C:\Windows\System\NGxitPu.exe
  2⤵
  PID:8348
- C:\Windows\System\ErfsUYG.exe
  C:\Windows\System\ErfsUYG.exe
  2⤵
  PID:8368
- C:\Windows\System\STMOtft.exe
  C:\Windows\System\STMOtft.exe
  2⤵
  PID:8396
- C:\Windows\System\lygtHEJ.exe
  C:\Windows\System\lygtHEJ.exe
  2⤵
  PID:8412
- C:\Windows\System\cnurCrT.exe
  C:\Windows\System\cnurCrT.exe
  2⤵
  PID:8428
- C:\Windows\System\tjYMtnT.exe
  C:\Windows\System\tjYMtnT.exe
  2⤵
  PID:8456
- C:\Windows\System\Purpnan.exe
  C:\Windows\System\Purpnan.exe
  2⤵
  PID:8484
- C:\Windows\System\oAanvNg.exe
  C:\Windows\System\oAanvNg.exe
  2⤵
  PID:8504
- C:\Windows\System\uefdeHD.exe
  C:\Windows\System\uefdeHD.exe
  2⤵
  PID:8528
- C:\Windows\System\OssoSuc.exe
  C:\Windows\System\OssoSuc.exe
  2⤵
  PID:8556
- C:\Windows\System\wbNDjwb.exe
  C:\Windows\System\wbNDjwb.exe
  2⤵
  PID:8580
- C:\Windows\System\zHevegD.exe
  C:\Windows\System\zHevegD.exe
  2⤵
  PID:8600
- C:\Windows\System\wDXrYNW.exe
  C:\Windows\System\wDXrYNW.exe
  2⤵
  PID:8624
- C:\Windows\System\WEDiwfu.exe
  C:\Windows\System\WEDiwfu.exe
  2⤵
  PID:8648
- C:\Windows\System\aKQwnEC.exe
  C:\Windows\System\aKQwnEC.exe
  2⤵
  PID:8672
- C:\Windows\System\rboAsIU.exe
  C:\Windows\System\rboAsIU.exe
  2⤵
  PID:8700
- C:\Windows\System\qfDGzgN.exe
  C:\Windows\System\qfDGzgN.exe
  2⤵
  PID:8996
- C:\Windows\System\diQtqUC.exe
  C:\Windows\System\diQtqUC.exe
  2⤵
  PID:9032
- C:\Windows\System\ADwQoMh.exe
  C:\Windows\System\ADwQoMh.exe
  2⤵
  PID:9052
- C:\Windows\System\RBGDLmS.exe
  C:\Windows\System\RBGDLmS.exe
  2⤵
  PID:9072
- C:\Windows\System\NEZhRky.exe
  C:\Windows\System\NEZhRky.exe
  2⤵
  PID:9108
- C:\Windows\System\wicKVMv.exe
  C:\Windows\System\wicKVMv.exe
  2⤵
  PID:9128
- C:\Windows\System\NCOUrNd.exe
  C:\Windows\System\NCOUrNd.exe
  2⤵
  PID:9152
- C:\Windows\System\wZgPeOM.exe
  C:\Windows\System\wZgPeOM.exe
  2⤵
  PID:9180
- C:\Windows\System\LxyBfRf.exe
  C:\Windows\System\LxyBfRf.exe
  2⤵
  PID:9208
- C:\Windows\System\KUeCGLM.exe
  C:\Windows\System\KUeCGLM.exe
  2⤵
  PID:7332
- C:\Windows\System\YZcupHT.exe
  C:\Windows\System\YZcupHT.exe
  2⤵
  PID:4260
- C:\Windows\System\sDMMMYo.exe
  C:\Windows\System\sDMMMYo.exe
  2⤵
  PID:7952
- C:\Windows\System\jGYAnPM.exe
  C:\Windows\System\jGYAnPM.exe
  2⤵
  PID:7512
- C:\Windows\System\VdoQORt.exe
  C:\Windows\System\VdoQORt.exe
  2⤵
  PID:8056
- C:\Windows\System\wsCfGAU.exe
  C:\Windows\System\wsCfGAU.exe
  2⤵
  PID:7656
- C:\Windows\System\tdBQQVP.exe
  C:\Windows\System\tdBQQVP.exe
  2⤵
  PID:7880
- C:\Windows\System\qKPwZNq.exe
  C:\Windows\System\qKPwZNq.exe
  2⤵
  PID:6272
- C:\Windows\System\OkOGEOS.exe
  C:\Windows\System\OkOGEOS.exe
  2⤵
  PID:8264
- C:\Windows\System\tcOccPx.exe
  C:\Windows\System\tcOccPx.exe
  2⤵
  PID:904
- C:\Windows\System\hJFprVi.exe
  C:\Windows\System\hJFprVi.exe
  2⤵
  PID:7060
- C:\Windows\System\bsJMFWO.exe
  C:\Windows\System\bsJMFWO.exe
  2⤵
  PID:844
- C:\Windows\System\jPEePIo.exe
  C:\Windows\System\jPEePIo.exe
  2⤵
  PID:8496
- C:\Windows\System\ISqsxlw.exe
  C:\Windows\System\ISqsxlw.exe
  2⤵
  PID:6196
- C:\Windows\System\RBHfraX.exe
  C:\Windows\System\RBHfraX.exe
  2⤵
  PID:8696
- C:\Windows\System\fJAFIbE.exe
  C:\Windows\System\fJAFIbE.exe
  2⤵
  PID:6832
- C:\Windows\System\CcwRwEn.exe
  C:\Windows\System\CcwRwEn.exe
  2⤵
  PID:6516
- C:\Windows\System\nzpLigi.exe
  C:\Windows\System\nzpLigi.exe
  2⤵
  PID:8228
- C:\Windows\System\WyCdCQB.exe
  C:\Windows\System\WyCdCQB.exe
  2⤵
  PID:7072
- C:\Windows\System\WBKgJuG.exe
  C:\Windows\System\WBKgJuG.exe
  2⤵
  PID:864
- C:\Windows\System\NuSDlYB.exe
  C:\Windows\System\NuSDlYB.exe
  2⤵
  PID:840
- C:\Windows\System\NgCUQbQ.exe
  C:\Windows\System\NgCUQbQ.exe
  2⤵
  PID:8500
- C:\Windows\System\XOcYaDK.exe
  C:\Windows\System\XOcYaDK.exe
  2⤵
  PID:8620
- C:\Windows\System\uCYRqYp.exe
  C:\Windows\System\uCYRqYp.exe
  2⤵
  PID:9228
- C:\Windows\System\FBptwSj.exe
  C:\Windows\System\FBptwSj.exe
  2⤵
  PID:9268
- C:\Windows\System\xNdbZsy.exe
  C:\Windows\System\xNdbZsy.exe
  2⤵
  PID:9296
- C:\Windows\System\RHBwlUy.exe
  C:\Windows\System\RHBwlUy.exe
  2⤵
  PID:9316
- C:\Windows\System\wKxDCen.exe
  C:\Windows\System\wKxDCen.exe
  2⤵
  PID:9336
- C:\Windows\System\bzvJbAZ.exe
  C:\Windows\System\bzvJbAZ.exe
  2⤵
  PID:9364
- C:\Windows\System\HqgYVJG.exe
  C:\Windows\System\HqgYVJG.exe
  2⤵
  PID:9388
- C:\Windows\System\sRJHFcj.exe
  C:\Windows\System\sRJHFcj.exe
  2⤵
  PID:9412
- C:\Windows\System\FfIQGTK.exe
  C:\Windows\System\FfIQGTK.exe
  2⤵
  PID:9440
- C:\Windows\System\WCDWYJi.exe
  C:\Windows\System\WCDWYJi.exe
  2⤵
  PID:9472
- C:\Windows\System\KOdUPiA.exe
  C:\Windows\System\KOdUPiA.exe
  2⤵
  PID:9504
- C:\Windows\System\blYoEhD.exe
  C:\Windows\System\blYoEhD.exe
  2⤵
  PID:9520
- C:\Windows\System\RgYhztW.exe
  C:\Windows\System\RgYhztW.exe
  2⤵
  PID:9548
- C:\Windows\System\Jrjjvlu.exe
  C:\Windows\System\Jrjjvlu.exe
  2⤵
  PID:9572
- C:\Windows\System\Gycbamr.exe
  C:\Windows\System\Gycbamr.exe
  2⤵
  PID:9600
- C:\Windows\System\jIylILT.exe
  C:\Windows\System\jIylILT.exe
  2⤵
  PID:9624
- C:\Windows\System\mlLKnzm.exe
  C:\Windows\System\mlLKnzm.exe
  2⤵
  PID:9656
- C:\Windows\System\pyLVQVF.exe
  C:\Windows\System\pyLVQVF.exe
  2⤵
  PID:9680
- C:\Windows\System\bDOIJxe.exe
  C:\Windows\System\bDOIJxe.exe
  2⤵
  PID:9704
- C:\Windows\System\btBPaDQ.exe
  C:\Windows\System\btBPaDQ.exe
  2⤵
  PID:9728
- C:\Windows\System\LgLZHwy.exe
  C:\Windows\System\LgLZHwy.exe
  2⤵
  PID:9752
- C:\Windows\System\AnQyGFl.exe
  C:\Windows\System\AnQyGFl.exe
  2⤵
  PID:9780
- C:\Windows\System\uHnUZhE.exe
  C:\Windows\System\uHnUZhE.exe
  2⤵
  PID:9808
- C:\Windows\System\wvPBiQD.exe
  C:\Windows\System\wvPBiQD.exe
  2⤵
  PID:9828
- C:\Windows\System\ptYYhkO.exe
  C:\Windows\System\ptYYhkO.exe
  2⤵
  PID:9860
- C:\Windows\System\AdIFqrQ.exe
  C:\Windows\System\AdIFqrQ.exe
  2⤵
  PID:9884
- C:\Windows\System\IwdNWqI.exe
  C:\Windows\System\IwdNWqI.exe
  2⤵
  PID:9904
- C:\Windows\System\VmcKpts.exe
  C:\Windows\System\VmcKpts.exe
  2⤵
  PID:9932
- C:\Windows\System\oYcLuUv.exe
  C:\Windows\System\oYcLuUv.exe
  2⤵
  PID:9952
- C:\Windows\System\gsvBjrl.exe
  C:\Windows\System\gsvBjrl.exe
  2⤵
  PID:9976
- C:\Windows\System\CqFuWHW.exe
  C:\Windows\System\CqFuWHW.exe
  2⤵
  PID:9992
- C:\Windows\System\yUzGCbe.exe
  C:\Windows\System\yUzGCbe.exe
  2⤵
  PID:10020
- C:\Windows\System\nHookNF.exe
  C:\Windows\System\nHookNF.exe
  2⤵
  PID:10044
- C:\Windows\System\wLEFjLk.exe
  C:\Windows\System\wLEFjLk.exe
  2⤵
  PID:10068
- C:\Windows\System\fXKcBoZ.exe
  C:\Windows\System\fXKcBoZ.exe
  2⤵
  PID:10092
- C:\Windows\System\TFdTpaJ.exe
  C:\Windows\System\TFdTpaJ.exe
  2⤵
  PID:10116
- C:\Windows\System\eaxsldo.exe
  C:\Windows\System\eaxsldo.exe
  2⤵
  PID:10144
- C:\Windows\System\biWysTG.exe
  C:\Windows\System\biWysTG.exe
  2⤵
  PID:10168
- C:\Windows\System\DvfgrUl.exe
  C:\Windows\System\DvfgrUl.exe
  2⤵
  PID:10188
- C:\Windows\System\zbEFllD.exe
  C:\Windows\System\zbEFllD.exe
  2⤵
  PID:10216
- C:\Windows\System\SdiPNxI.exe
  C:\Windows\System\SdiPNxI.exe
  2⤵
  PID:10236
- C:\Windows\System\HMfeofw.exe
  C:\Windows\System\HMfeofw.exe
  2⤵
  PID:7956
- C:\Windows\System\lXwGUKm.exe
  C:\Windows\System\lXwGUKm.exe
  2⤵
  PID:8972
- C:\Windows\System\hyHgEVQ.exe
  C:\Windows\System\hyHgEVQ.exe
  2⤵
  PID:7284
- C:\Windows\System\GVZStvU.exe
  C:\Windows\System\GVZStvU.exe
  2⤵
  PID:8216
- C:\Windows\System\YHvqYvi.exe
  C:\Windows\System\YHvqYvi.exe
  2⤵
  PID:9016
- C:\Windows\System\VaQhNqb.exe
  C:\Windows\System\VaQhNqb.exe
  2⤵
  PID:9068
- C:\Windows\System\rJnZYuJ.exe
  C:\Windows\System\rJnZYuJ.exe
  2⤵
  PID:8808
- C:\Windows\System\dtMRCFd.exe
  C:\Windows\System\dtMRCFd.exe
  2⤵
  PID:9176
- C:\Windows\System\NsxWwlZ.exe
  C:\Windows\System\NsxWwlZ.exe
  2⤵
  PID:7364
- C:\Windows\System\lkTYorj.exe
  C:\Windows\System\lkTYorj.exe
  2⤵
  PID:8404
- C:\Windows\System\FjkZpov.exe
  C:\Windows\System\FjkZpov.exe
  2⤵
  PID:7996
- C:\Windows\System\rUjunOz.exe
  C:\Windows\System\rUjunOz.exe
  2⤵
  PID:7652
- C:\Windows\System\QCyeTCB.exe
  C:\Windows\System\QCyeTCB.exe
  2⤵
  PID:8040
- C:\Windows\System\HJqDUeC.exe
  C:\Windows\System\HJqDUeC.exe
  2⤵
  PID:8476
- C:\Windows\System\TRTjizR.exe
  C:\Windows\System\TRTjizR.exe
  2⤵
  PID:8608
- C:\Windows\System\axusQbN.exe
  C:\Windows\System\axusQbN.exe
  2⤵
  PID:8832
- C:\Windows\System\QAxXaUl.exe
  C:\Windows\System\QAxXaUl.exe
  2⤵
  PID:8464
- C:\Windows\System\wvuCKCp.exe
  C:\Windows\System\wvuCKCp.exe
  2⤵
  PID:8932
- C:\Windows\System\znJIqXT.exe
  C:\Windows\System\znJIqXT.exe
  2⤵
  PID:8736
- C:\Windows\System\xnmvCmD.exe
  C:\Windows\System\xnmvCmD.exe
  2⤵
  PID:9084
- C:\Windows\System\zbKZkPu.exe
  C:\Windows\System\zbKZkPu.exe
  2⤵
  PID:9196
- C:\Windows\System\uXRsdCL.exe
  C:\Windows\System\uXRsdCL.exe
  2⤵
  PID:9556
- C:\Windows\System\GltTSSW.exe
  C:\Windows\System\GltTSSW.exe
  2⤵
  PID:9564
- C:\Windows\System\phnBRVM.exe
  C:\Windows\System\phnBRVM.exe
  2⤵
  PID:8632
- C:\Windows\System\HKVoYGF.exe
  C:\Windows\System\HKVoYGF.exe
  2⤵
  PID:8356
- C:\Windows\System\PqzaldW.exe
  C:\Windows\System\PqzaldW.exe
  2⤵
  PID:9760
- C:\Windows\System\gOKXmMA.exe
  C:\Windows\System\gOKXmMA.exe
  2⤵
  PID:4392
- C:\Windows\System\JSOvgSf.exe
  C:\Windows\System\JSOvgSf.exe
  2⤵
  PID:9372
- C:\Windows\System\kXHrdTf.exe
  C:\Windows\System\kXHrdTf.exe
  2⤵
  PID:7316
- C:\Windows\System\cUdgmSb.exe
  C:\Windows\System\cUdgmSb.exe
  2⤵
  PID:10000
- C:\Windows\System\iAozuwv.exe
  C:\Windows\System\iAozuwv.exe
  2⤵
  PID:8376
- C:\Windows\System\oRkSxJI.exe
  C:\Windows\System\oRkSxJI.exe
  2⤵
  PID:10244
- C:\Windows\System\wMqbfco.exe
  C:\Windows\System\wMqbfco.exe
  2⤵
  PID:10272
- C:\Windows\System\kmuobFZ.exe
  C:\Windows\System\kmuobFZ.exe
  2⤵
  PID:10296
- C:\Windows\System\MdrYhBY.exe
  C:\Windows\System\MdrYhBY.exe
  2⤵
  PID:10316
- C:\Windows\System\KrAisPu.exe
  C:\Windows\System\KrAisPu.exe
  2⤵
  PID:10340
- C:\Windows\System\ciWEGVs.exe
  C:\Windows\System\ciWEGVs.exe
  2⤵
  PID:10360
- C:\Windows\System\lcfasQg.exe
  C:\Windows\System\lcfasQg.exe
  2⤵
  PID:10380
- C:\Windows\System\BakvBcD.exe
  C:\Windows\System\BakvBcD.exe
  2⤵
  PID:10404
- C:\Windows\System\qLdlycv.exe
  C:\Windows\System\qLdlycv.exe
  2⤵
  PID:10424
- C:\Windows\System\qjyYoRE.exe
  C:\Windows\System\qjyYoRE.exe
  2⤵
  PID:10452
- C:\Windows\System\trNvguD.exe
  C:\Windows\System\trNvguD.exe
  2⤵
  PID:10476
- C:\Windows\System\QbiCTLA.exe
  C:\Windows\System\QbiCTLA.exe
  2⤵
  PID:10500
- C:\Windows\System\vSVkzTN.exe
  C:\Windows\System\vSVkzTN.exe
  2⤵
  PID:10524
- C:\Windows\System\udwIFjx.exe
  C:\Windows\System\udwIFjx.exe
  2⤵
  PID:10552
- C:\Windows\System\UkfrFsH.exe
  C:\Windows\System\UkfrFsH.exe
  2⤵
  PID:10576
- C:\Windows\System\QTjgZGF.exe
  C:\Windows\System\QTjgZGF.exe
  2⤵
  PID:10604
- C:\Windows\System\qWdXtvQ.exe
  C:\Windows\System\qWdXtvQ.exe
  2⤵
  PID:10628
- C:\Windows\System\yTeUqPl.exe
  C:\Windows\System\yTeUqPl.exe
  2⤵
  PID:10660
- C:\Windows\System\WKDZLzu.exe
  C:\Windows\System\WKDZLzu.exe
  2⤵
  PID:10688
- C:\Windows\System\aUnIdPj.exe
  C:\Windows\System\aUnIdPj.exe
  2⤵
  PID:10704
- C:\Windows\System\WavQONE.exe
  C:\Windows\System\WavQONE.exe
  2⤵
  PID:10732
- C:\Windows\System\drfTgHD.exe
  C:\Windows\System\drfTgHD.exe
  2⤵
  PID:10760
- C:\Windows\System\xULHeyg.exe
  C:\Windows\System\xULHeyg.exe
  2⤵
  PID:10780
- C:\Windows\System\GqCVsEg.exe
  C:\Windows\System\GqCVsEg.exe
  2⤵
  PID:10800
- C:\Windows\System\bVYJlQD.exe
  C:\Windows\System\bVYJlQD.exe
  2⤵
  PID:10820
- C:\Windows\System\sIPerMC.exe
  C:\Windows\System\sIPerMC.exe
  2⤵
  PID:10840
- C:\Windows\System\YtPVVbm.exe
  C:\Windows\System\YtPVVbm.exe
  2⤵
  PID:10860
- C:\Windows\System\AwgzYvq.exe
  C:\Windows\System\AwgzYvq.exe
  2⤵
  PID:10876
- C:\Windows\System\PYnQJVl.exe
  C:\Windows\System\PYnQJVl.exe
  2⤵
  PID:10892
- C:\Windows\System\BhEWlqS.exe
  C:\Windows\System\BhEWlqS.exe
  2⤵
  PID:10908
- C:\Windows\System\UDEcwTo.exe
  C:\Windows\System\UDEcwTo.exe
  2⤵
  PID:10928
- C:\Windows\System\sumtmKr.exe
  C:\Windows\System\sumtmKr.exe
  2⤵
  PID:10948
- C:\Windows\System\tzCxNZL.exe
  C:\Windows\System\tzCxNZL.exe
  2⤵
  PID:10976
- C:\Windows\System\NYLYdJZ.exe
  C:\Windows\System\NYLYdJZ.exe
  2⤵
  PID:10996
- C:\Windows\System\wZafhrF.exe
  C:\Windows\System\wZafhrF.exe
  2⤵
  PID:11020
- C:\Windows\System\tnXPOfL.exe
  C:\Windows\System\tnXPOfL.exe
  2⤵
  PID:11056
- C:\Windows\System\WAlOGiw.exe
  C:\Windows\System\WAlOGiw.exe
  2⤵
  PID:11076
- C:\Windows\System\dTCTsiN.exe
  C:\Windows\System\dTCTsiN.exe
  2⤵
  PID:11100
- C:\Windows\System\GbynRQP.exe
  C:\Windows\System\GbynRQP.exe
  2⤵
  PID:11132
- C:\Windows\System\KlGYbXs.exe
  C:\Windows\System\KlGYbXs.exe
  2⤵
  PID:11160
- C:\Windows\System\rCcenTF.exe
  C:\Windows\System\rCcenTF.exe
  2⤵
  PID:11180
- C:\Windows\System\FRqMbKh.exe
  C:\Windows\System\FRqMbKh.exe
  2⤵
  PID:11204
- C:\Windows\System\BIGGCxM.exe
  C:\Windows\System\BIGGCxM.exe
  2⤵
  PID:11232
- C:\Windows\System\bpbxwcf.exe
  C:\Windows\System\bpbxwcf.exe
  2⤵
  PID:11256
- C:\Windows\System\AoCihoQ.exe
  C:\Windows\System\AoCihoQ.exe
  2⤵
  PID:8200
- C:\Windows\System\gcAmsZJ.exe
  C:\Windows\System\gcAmsZJ.exe
  2⤵
  PID:9220
- C:\Windows\System\FzSxVDW.exe
  C:\Windows\System\FzSxVDW.exe
  2⤵
  PID:9848
- C:\Windows\System\qpWpcik.exe
  C:\Windows\System\qpWpcik.exe
  2⤵
  PID:9880
- C:\Windows\System\DvPLMQL.exe
  C:\Windows\System\DvPLMQL.exe
  2⤵
  PID:9396
- C:\Windows\System\TUgzOrE.exe
  C:\Windows\System\TUgzOrE.exe
  2⤵
  PID:8720
- C:\Windows\System\arBeZOR.exe
  C:\Windows\System\arBeZOR.exe
  2⤵
  PID:8928
- C:\Windows\System\kCTGazL.exe
  C:\Windows\System\kCTGazL.exe
  2⤵
  PID:8772
- C:\Windows\System\NlgfuNI.exe
  C:\Windows\System\NlgfuNI.exe
  2⤵
  PID:9380
- C:\Windows\System\nrhTdSE.exe
  C:\Windows\System\nrhTdSE.exe
  2⤵
  PID:10064
- C:\Windows\System\uddMzCI.exe
  C:\Windows\System\uddMzCI.exe
  2⤵
  PID:10012
- C:\Windows\System\yGQrgDL.exe
  C:\Windows\System\yGQrgDL.exe
  2⤵
  PID:9516
- C:\Windows\System\qzBDhod.exe
  C:\Windows\System\qzBDhod.exe
  2⤵
  PID:9632
- C:\Windows\System\ZkrUgVL.exe
  C:\Windows\System\ZkrUgVL.exe
  2⤵
  PID:10180
- C:\Windows\System\ewSWEdj.exe
  C:\Windows\System\ewSWEdj.exe
  2⤵
  PID:10232
- C:\Windows\System\mQjhPdk.exe
  C:\Windows\System\mQjhPdk.exe
  2⤵
  PID:10252
- C:\Windows\System\fbxkWdG.exe
  C:\Windows\System\fbxkWdG.exe
  2⤵
  PID:10280
- C:\Windows\System\YdnYIjb.exe
  C:\Windows\System\YdnYIjb.exe
  2⤵
  PID:10352
- C:\Windows\System\NBqQLwD.exe
  C:\Windows\System\NBqQLwD.exe
  2⤵
  PID:10356
- C:\Windows\System\dbtFHPn.exe
  C:\Windows\System\dbtFHPn.exe
  2⤵
  PID:10388
- C:\Windows\System\rdsLFAA.exe
  C:\Windows\System\rdsLFAA.exe
  2⤵
  PID:10420
- C:\Windows\System\eWbKeea.exe
  C:\Windows\System\eWbKeea.exe
  2⤵
  PID:10448
- C:\Windows\System\cDJOqmT.exe
  C:\Windows\System\cDJOqmT.exe
  2⤵
  PID:8880
- C:\Windows\System\EcLbfRM.exe
  C:\Windows\System\EcLbfRM.exe
  2⤵
  PID:7248
- C:\Windows\System\NWPpRnW.exe
  C:\Windows\System\NWPpRnW.exe
  2⤵
  PID:10720
- C:\Windows\System\NfdFuCY.exe
  C:\Windows\System\NfdFuCY.exe
  2⤵
  PID:10868
- C:\Windows\System\zsjuyPo.exe
  C:\Windows\System\zsjuyPo.exe
  2⤵
  PID:9744
- C:\Windows\System\xUBDGwH.exe
  C:\Windows\System\xUBDGwH.exe
  2⤵
  PID:9820
- C:\Windows\System\GMMgiaT.exe
  C:\Windows\System\GMMgiaT.exe
  2⤵
  PID:11112
- C:\Windows\System\BcaFqQj.exe
  C:\Windows\System\BcaFqQj.exe
  2⤵
  PID:11144
- C:\Windows\System\YQDceWZ.exe
  C:\Windows\System\YQDceWZ.exe
  2⤵
  PID:10288
- C:\Windows\System\wYbgobv.exe
  C:\Windows\System\wYbgobv.exe
  2⤵
  PID:6808
- C:\Windows\System\sdWEWps.exe
  C:\Windows\System\sdWEWps.exe
  2⤵
  PID:11284
- C:\Windows\System\Uqcdkac.exe
  C:\Windows\System\Uqcdkac.exe
  2⤵
  PID:11304
- C:\Windows\System\dmbaOEN.exe
  C:\Windows\System\dmbaOEN.exe
  2⤵
  PID:11320
- C:\Windows\System\aMkAPWo.exe
  C:\Windows\System\aMkAPWo.exe
  2⤵
  PID:11336
- C:\Windows\System\DWHhiaj.exe
  C:\Windows\System\DWHhiaj.exe
  2⤵
  PID:11352
- C:\Windows\System\yGDwQtF.exe
  C:\Windows\System\yGDwQtF.exe
  2⤵
  PID:11368
- C:\Windows\System\BxQqUDb.exe
  C:\Windows\System\BxQqUDb.exe
  2⤵
  PID:11384
- C:\Windows\System\GwJuqBQ.exe
  C:\Windows\System\GwJuqBQ.exe
  2⤵
  PID:11404
- C:\Windows\System\NAEfWdR.exe
  C:\Windows\System\NAEfWdR.exe
  2⤵
  PID:11420
- C:\Windows\System\JUKxxBC.exe
  C:\Windows\System\JUKxxBC.exe
  2⤵
  PID:11444
- C:\Windows\System\ixRJHSc.exe
  C:\Windows\System\ixRJHSc.exe
  2⤵
  PID:11464
- C:\Windows\System\nYKaIRj.exe
  C:\Windows\System\nYKaIRj.exe
  2⤵
  PID:11492
- C:\Windows\System\CPBxEeo.exe
  C:\Windows\System\CPBxEeo.exe
  2⤵
  PID:11520
- C:\Windows\System\dGgVGNV.exe
  C:\Windows\System\dGgVGNV.exe
  2⤵
  PID:11540
- C:\Windows\System\BnBoEsS.exe
  C:\Windows\System\BnBoEsS.exe
  2⤵
  PID:11560
- C:\Windows\System\EBnjgEy.exe
  C:\Windows\System\EBnjgEy.exe
  2⤵
  PID:11588
- C:\Windows\System\enLuXbm.exe
  C:\Windows\System\enLuXbm.exe
  2⤵
  PID:11612
- C:\Windows\System\vXGZfOu.exe
  C:\Windows\System\vXGZfOu.exe
  2⤵
  PID:11632
- C:\Windows\System\QWRDTbR.exe
  C:\Windows\System\QWRDTbR.exe
  2⤵
  PID:11660
- C:\Windows\System\WKKuPae.exe
  C:\Windows\System\WKKuPae.exe
  2⤵
  PID:11680
- C:\Windows\System\GtCKhms.exe
  C:\Windows\System\GtCKhms.exe
  2⤵
  PID:11712
- C:\Windows\System\IUxodCt.exe
  C:\Windows\System\IUxodCt.exe
  2⤵
  PID:11740
- C:\Windows\System\IMKhawl.exe
  C:\Windows\System\IMKhawl.exe
  2⤵
  PID:11768
- C:\Windows\System\onWCARD.exe
  C:\Windows\System\onWCARD.exe
  2⤵
  PID:11788
- C:\Windows\System\vPTbOPw.exe
  C:\Windows\System\vPTbOPw.exe
  2⤵
  PID:11812
- C:\Windows\System\meMkMSu.exe
  C:\Windows\System\meMkMSu.exe
  2⤵
  PID:11832
- C:\Windows\System\tzLQSDS.exe
  C:\Windows\System\tzLQSDS.exe
  2⤵
  PID:11856
- C:\Windows\System\CdYAFei.exe
  C:\Windows\System\CdYAFei.exe
  2⤵
  PID:11876
- C:\Windows\System\wyJmexk.exe
  C:\Windows\System\wyJmexk.exe
  2⤵
  PID:11896
- C:\Windows\System\KjqvliU.exe
  C:\Windows\System\KjqvliU.exe
  2⤵
  PID:11916
- C:\Windows\System\DSXVkaG.exe
  C:\Windows\System\DSXVkaG.exe
  2⤵
  PID:11940
- C:\Windows\System\ZlOFkhA.exe
  C:\Windows\System\ZlOFkhA.exe
  2⤵
  PID:11968
- C:\Windows\System\atALlBW.exe
  C:\Windows\System\atALlBW.exe
  2⤵
  PID:11992
- C:\Windows\System\vAaJewP.exe
  C:\Windows\System\vAaJewP.exe
  2⤵
  PID:12016
- C:\Windows\System\BPCoqpM.exe
  C:\Windows\System\BPCoqpM.exe
  2⤵
  PID:12040
- C:\Windows\System\ruCVFrX.exe
  C:\Windows\System\ruCVFrX.exe
  2⤵
  PID:12060
- C:\Windows\System\QZUxiFw.exe
  C:\Windows\System\QZUxiFw.exe
  2⤵
  PID:12084
- C:\Windows\System\vUCwaFu.exe
  C:\Windows\System\vUCwaFu.exe
  2⤵
  PID:12108
- C:\Windows\System\lkvYsBI.exe
  C:\Windows\System\lkvYsBI.exe
  2⤵
  PID:12128
- C:\Windows\System\EnpQEod.exe
  C:\Windows\System\EnpQEod.exe
  2⤵
  PID:12152
- C:\Windows\System\ScURBid.exe
  C:\Windows\System\ScURBid.exe
  2⤵
  PID:12176
- C:\Windows\System\PGlxTFJ.exe
  C:\Windows\System\PGlxTFJ.exe
  2⤵
  PID:12200
- C:\Windows\System\SRRvfCz.exe
  C:\Windows\System\SRRvfCz.exe
  2⤵
  PID:12228
- C:\Windows\System\YGWBuOL.exe
  C:\Windows\System\YGWBuOL.exe
  2⤵
  PID:12256
- C:\Windows\System\DQcGaXs.exe
  C:\Windows\System\DQcGaXs.exe
  2⤵
  PID:12284
- C:\Windows\System\xTPxiri.exe
  C:\Windows\System\xTPxiri.exe
  2⤵
  PID:10520
- C:\Windows\System\GGwoTMz.exe
  C:\Windows\System\GGwoTMz.exe
  2⤵
  PID:7436
- C:\Windows\System\AVQOWPS.exe
  C:\Windows\System\AVQOWPS.exe
  2⤵
  PID:7932
- C:\Windows\System\CIuLiPF.exe
  C:\Windows\System\CIuLiPF.exe
  2⤵
  PID:7244
- C:\Windows\System\mfXFAEV.exe
  C:\Windows\System\mfXFAEV.exe
  2⤵
  PID:10196
- C:\Windows\System\cNvfGCB.exe
  C:\Windows\System\cNvfGCB.exe
  2⤵
  PID:10792
- C:\Windows\System\OHEJcUK.exe
  C:\Windows\System\OHEJcUK.exe
  2⤵
  PID:10884
- C:\Windows\System\MbthqAf.exe
  C:\Windows\System\MbthqAf.exe
  2⤵
  PID:10944
- C:\Windows\System\yhunAix.exe
  C:\Windows\System\yhunAix.exe
  2⤵
  PID:8868
- C:\Windows\System\kUqdpZo.exe
  C:\Windows\System\kUqdpZo.exe
  2⤵
  PID:9308
- C:\Windows\System\aZSyuBS.exe
  C:\Windows\System\aZSyuBS.exe
  2⤵
  PID:9428
- C:\Windows\System\oeAFBuS.exe
  C:\Windows\System\oeAFBuS.exe
  2⤵
  PID:11176
- C:\Windows\System\VXYqLMi.exe
  C:\Windows\System\VXYqLMi.exe
  2⤵
  PID:10332
- C:\Windows\System\MbHFqia.exe
  C:\Windows\System\MbHFqia.exe
  2⤵
  PID:8180
- C:\Windows\System\uvIQZqI.exe
  C:\Windows\System\uvIQZqI.exe
  2⤵
  PID:11296
- C:\Windows\System\gzHikAF.exe
  C:\Windows\System\gzHikAF.exe
  2⤵
  PID:11400
- C:\Windows\System\hStzfVH.exe
  C:\Windows\System\hStzfVH.exe
  2⤵
  PID:11436
- C:\Windows\System\ZNzWsEv.exe
  C:\Windows\System\ZNzWsEv.exe
  2⤵
  PID:11472
- C:\Windows\System\nLdpPIf.exe
  C:\Windows\System\nLdpPIf.exe
  2⤵
  PID:11512
- C:\Windows\System\LoZuMJw.exe
  C:\Windows\System\LoZuMJw.exe
  2⤵
  PID:12292
- C:\Windows\System\UGQeBCB.exe
  C:\Windows\System\UGQeBCB.exe
  2⤵
  PID:12316
- C:\Windows\System\hoTEkgg.exe
  C:\Windows\System\hoTEkgg.exe
  2⤵
  PID:12344
- C:\Windows\System\xNgiLFD.exe
  C:\Windows\System\xNgiLFD.exe
  2⤵
  PID:12364
- C:\Windows\System\DgYfsdt.exe
  C:\Windows\System\DgYfsdt.exe
  2⤵
  PID:12388
- C:\Windows\System\rBFmWSG.exe
  C:\Windows\System\rBFmWSG.exe
  2⤵
  PID:12412
- C:\Windows\System\goeVwhk.exe
  C:\Windows\System\goeVwhk.exe
  2⤵
  PID:12432
- C:\Windows\System\evIkIUr.exe
  C:\Windows\System\evIkIUr.exe
  2⤵
  PID:12460
- C:\Windows\System\UnskIDu.exe
  C:\Windows\System\UnskIDu.exe
  2⤵
  PID:12484
- C:\Windows\System\cQKTvrU.exe
  C:\Windows\System\cQKTvrU.exe
  2⤵
  PID:12512
- C:\Windows\System\PAeOQPi.exe
  C:\Windows\System\PAeOQPi.exe
  2⤵
  PID:12536
- C:\Windows\System\dfgpQcd.exe
  C:\Windows\System\dfgpQcd.exe
  2⤵
  PID:12552
- C:\Windows\System\wHuxvyu.exe
  C:\Windows\System\wHuxvyu.exe
  2⤵
  PID:12588
- C:\Windows\System\UlLpocT.exe
  C:\Windows\System\UlLpocT.exe
  2⤵
  PID:12608
- C:\Windows\System\ItCdmAj.exe
  C:\Windows\System\ItCdmAj.exe
  2⤵
  PID:12632
- C:\Windows\System\fBCvJSb.exe
  C:\Windows\System\fBCvJSb.exe
  2⤵
  PID:12656
- C:\Windows\System\FSCexgg.exe
  C:\Windows\System\FSCexgg.exe
  2⤵
  PID:12680
- C:\Windows\System\bsMUmLz.exe
  C:\Windows\System\bsMUmLz.exe
  2⤵
  PID:12704
- C:\Windows\System\TryyiMw.exe
  C:\Windows\System\TryyiMw.exe
  2⤵
  PID:12732
- C:\Windows\System\BzwIWFy.exe
  C:\Windows\System\BzwIWFy.exe
  2⤵
  PID:12768
- C:\Windows\System\DpbLjIg.exe
  C:\Windows\System\DpbLjIg.exe
  2⤵
  PID:12788
- C:\Windows\System\slNKNqO.exe
  C:\Windows\System\slNKNqO.exe
  2⤵
  PID:12812
- C:\Windows\System\Jjchqzo.exe
  C:\Windows\System\Jjchqzo.exe
  2⤵
  PID:12840
- C:\Windows\System\OCSZEkO.exe
  C:\Windows\System\OCSZEkO.exe
  2⤵
  PID:12864
- C:\Windows\System\hTOqaPg.exe
  C:\Windows\System\hTOqaPg.exe
  2⤵
  PID:12892
- C:\Windows\System\WjTAqaZ.exe
  C:\Windows\System\WjTAqaZ.exe
  2⤵
  PID:12916
- C:\Windows\System\wuGowPh.exe
  C:\Windows\System\wuGowPh.exe
  2⤵
  PID:10852
- C:\Windows\System\ANQtrOk.exe
  C:\Windows\System\ANQtrOk.exe
  2⤵
  PID:11312
- C:\Windows\System\YHRYnLh.exe
  C:\Windows\System\YHRYnLh.exe
  2⤵
  PID:11676
- C:\Windows\System\kIdzXXy.exe
  C:\Windows\System\kIdzXXy.exe
  2⤵
  PID:11844
- C:\Windows\System\jmnnZsU.exe
  C:\Windows\System\jmnnZsU.exe
  2⤵
  PID:11904
- C:\Windows\System\YhavcEH.exe
  C:\Windows\System\YhavcEH.exe
  2⤵
  PID:11988
- C:\Windows\System\LwYLlEL.exe
  C:\Windows\System\LwYLlEL.exe
  2⤵
  PID:12240
- C:\Windows\System\pHLjtgK.exe
  C:\Windows\System\pHLjtgK.exe
  2⤵
  PID:10968
- C:\Windows\System\SWuThaR.exe
  C:\Windows\System\SWuThaR.exe
  2⤵
  PID:13136
- C:\Windows\System\LwnCmXi.exe
  C:\Windows\System\LwnCmXi.exe
  2⤵
  PID:12836
- C:\Windows\System\ULtliLG.exe
  C:\Windows\System\ULtliLG.exe
  2⤵
  PID:12776
- C:\Windows\System\sqkIlxt.exe
  C:\Windows\System\sqkIlxt.exe
  2⤵
  PID:5064
- C:\Windows\System\kfMjuik.exe
  C:\Windows\System\kfMjuik.exe
  2⤵
  PID:684
- C:\Windows\System\SjfIgSs.exe
  C:\Windows\System\SjfIgSs.exe
  2⤵
  PID:8572
- C:\Windows\System\xOmRYXf.exe
  C:\Windows\System\xOmRYXf.exe
  2⤵
  PID:13284
- C:\Windows\System\jcCDbBM.exe
  C:\Windows\System\jcCDbBM.exe
  2⤵
  PID:12048
- C:\Windows\System\fxRgUHq.exe
  C:\Windows\System\fxRgUHq.exe
  2⤵
  PID:10564
- C:\Windows\System\Mrfteei.exe
  C:\Windows\System\Mrfteei.exe
  2⤵
  PID:10956
- C:\Windows\System\TIzOqTP.exe
  C:\Windows\System\TIzOqTP.exe
  2⤵
  PID:12068
- C:\Windows\System\XyuKKgA.exe
  C:\Windows\System\XyuKKgA.exe
  2⤵
  PID:11120
- C:\Windows\System\qjwwpWX.exe
  C:\Windows\System\qjwwpWX.exe
  2⤵
  PID:10324
- C:\Windows\System\JGsqCmk.exe
  C:\Windows\System\JGsqCmk.exe
  2⤵
  PID:11600
- C:\Windows\System\uQPfxhU.exe
  C:\Windows\System\uQPfxhU.exe
  2⤵
  PID:9896
- C:\Windows\System\fMoreHA.exe
  C:\Windows\System\fMoreHA.exe
  2⤵
  PID:11416
- C:\Windows\System\PPzqnfN.exe
  C:\Windows\System\PPzqnfN.exe
  2⤵
  PID:11072
- C:\Windows\System\hfESrJT.exe
  C:\Windows\System\hfESrJT.exe
  2⤵
  PID:12560
- C:\Windows\System\TfsnUHk.exe
  C:\Windows\System\TfsnUHk.exe
  2⤵
  PID:12980
- C:\Windows\System\nqvhsBe.exe
  C:\Windows\System\nqvhsBe.exe
  2⤵
  PID:13084
- C:\Windows\System\sNAMkab.exe
  C:\Windows\System\sNAMkab.exe
  2⤵
  PID:12716
- C:\Windows\System\jUFsgzf.exe
  C:\Windows\System\jUFsgzf.exe
  2⤵
  PID:10160
- C:\Windows\System\FUWUmJq.exe
  C:\Windows\System\FUWUmJq.exe
  2⤵
  PID:11580
- C:\Windows\System\VBOpQMR.exe
  C:\Windows\System\VBOpQMR.exe
  2⤵
  PID:11012
- C:\Windows\System\UtqJAOb.exe
  C:\Windows\System\UtqJAOb.exe
  2⤵
  PID:11532
- C:\Windows\System\EOftnvq.exe
  C:\Windows\System\EOftnvq.exe
  2⤵
  PID:12668
- C:\Windows\System\zsapEck.exe
  C:\Windows\System\zsapEck.exe
  2⤵
  PID:13276
- C:\Windows\System\TzIxVhT.exe
  C:\Windows\System\TzIxVhT.exe
  2⤵
  PID:11872
- C:\Windows\System\lBXPqbO.exe
  C:\Windows\System\lBXPqbO.exe
  2⤵
  PID:12328
- C:\Windows\System\JMnPWGT.exe
  C:\Windows\System\JMnPWGT.exe
  2⤵
  PID:12872
- C:\Windows\System\FENxqfO.exe
  C:\Windows\System\FENxqfO.exe
  2⤵
  PID:10100
- C:\Windows\System\mYAlPwM.exe
  C:\Windows\System\mYAlPwM.exe
  2⤵
  PID:11928
- C:\Windows\System\upfdphe.exe
  C:\Windows\System\upfdphe.exe
  2⤵
  PID:9252
- C:\Windows\System\sCLQaKQ.exe
  C:\Windows\System\sCLQaKQ.exe
  2⤵
  PID:10488
- C:\Windows\System\ibPqHbe.exe
  C:\Windows\System\ibPqHbe.exe
  2⤵
  PID:11168
- C:\Windows\System\zzMkOIu.exe
  C:\Windows\System\zzMkOIu.exe
  2⤵
  PID:13248
- C:\Windows\System\lmyhMqq.exe
  C:\Windows\System\lmyhMqq.exe
  2⤵
  PID:13048
- C:\Windows\System\dkJYcCN.exe
  C:\Windows\System\dkJYcCN.exe
  2⤵
  PID:12168
- C:\Windows\System\gKXdzlG.exe
  C:\Windows\System\gKXdzlG.exe
  2⤵
  PID:13064
- C:\Windows\System\gdUJfUI.exe
  C:\Windows\System\gdUJfUI.exe
  2⤵
  PID:12324
- C:\Windows\System\fUdxCWh.exe
  C:\Windows\System\fUdxCWh.exe
  2⤵
  PID:12832
- C:\Windows\System\enkRZIT.exe
  C:\Windows\System\enkRZIT.exe
  2⤵
  PID:7460
- C:\Windows\System\rqUUUwp.exe
  C:\Windows\System\rqUUUwp.exe
  2⤵
  PID:11348
- C:\Windows\System\xnCtotj.exe
  C:\Windows\System\xnCtotj.exe
  2⤵
  PID:12452
- C:\Windows\System\YSHHIMZ.exe
  C:\Windows\System\YSHHIMZ.exe
  2⤵
  PID:11172
- C:\Windows\System\tZMCXis.exe
  C:\Windows\System\tZMCXis.exe
  2⤵
  PID:9640
- C:\Windows\System\XuiPwHC.exe
  C:\Windows\System\XuiPwHC.exe
  2⤵
  PID:5824
- C:\Windows\System\ErheqHJ.exe
  C:\Windows\System\ErheqHJ.exe
  2⤵
  PID:5828
- C:\Windows\System\DWvrAQl.exe
  C:\Windows\System\DWvrAQl.exe
  2⤵
  PID:3144
- C:\Windows\System\oUctmes.exe
  C:\Windows\System\oUctmes.exe
  2⤵
  PID:13300
- C:\Windows\System\XUJeDLU.exe
  C:\Windows\System\XUJeDLU.exe
  2⤵
  PID:10900
- C:\Windows\System\KxbMlvN.exe
  C:\Windows\System\KxbMlvN.exe
  2⤵
  PID:3664
- C:\Windows\System\kTZFdpm.exe
  C:\Windows\System\kTZFdpm.exe
  2⤵
  PID:12928
- C:\Windows\System\ZAXUumn.exe
  C:\Windows\System\ZAXUumn.exe
  2⤵
  PID:7760
- C:\Windows\System\MimgMwz.exe
  C:\Windows\System\MimgMwz.exe
  2⤵
  PID:12692
- C:\Windows\System\cdPAXFN.exe
  C:\Windows\System\cdPAXFN.exe
  2⤵
  PID:4664
- C:\Windows\System\xGHVxNw.exe
  C:\Windows\System\xGHVxNw.exe
  2⤵
  PID:456
- C:\Windows\System\MnDyvQV.exe
  C:\Windows\System\MnDyvQV.exe
  2⤵
  PID:3468
- C:\Windows\System\zTwsvvK.exe
  C:\Windows\System\zTwsvvK.exe
  2⤵
  PID:3492
- C:\Windows\System\YIhYMsi.exe
  C:\Windows\System\YIhYMsi.exe
  2⤵
  PID:13016
- C:\Windows\System\ZqIbjUu.exe
  C:\Windows\System\ZqIbjUu.exe
  2⤵
  PID:3980
- C:\Windows\System\StaUTtI.exe
  C:\Windows\System\StaUTtI.exe
  2⤵
  PID:2984
- C:\Windows\System\EZqsXMR.exe
  C:\Windows\System\EZqsXMR.exe
  2⤵
  PID:3416
- C:\Windows\System\LhGkKTo.exe
  C:\Windows\System\LhGkKTo.exe
  2⤵
  PID:5052
- C:\Windows\System\afVvXSX.exe
  C:\Windows\System\afVvXSX.exe
  2⤵
  PID:1060
- C:\Windows\System\HbSvitT.exe
  C:\Windows\System\HbSvitT.exe
  2⤵
  PID:10052
- C:\Windows\System\TnYvTZt.exe
  C:\Windows\System\TnYvTZt.exe
  2⤵
  PID:11948
- C:\Windows\System\ynmlLLR.exe
  C:\Windows\System\ynmlLLR.exe
  2⤵
  PID:2668
- C:\Windows\System\tfLGuMR.exe
  C:\Windows\System\tfLGuMR.exe
  2⤵
  PID:2432
- C:\Windows\System\EIDDbYm.exe
  C:\Windows\System\EIDDbYm.exe
  2⤵
  PID:4504
- C:\Windows\System\BHjsteY.exe
  C:\Windows\System\BHjsteY.exe
  2⤵
  PID:2656
- C:\Windows\System\RlBvLXo.exe
  C:\Windows\System\RlBvLXo.exe
  2⤵
  PID:1120
- C:\Windows\System\otJCWZM.exe
  C:\Windows\System\otJCWZM.exe
  2⤵
  PID:1208
- C:\Windows\System\anvvCys.exe
  C:\Windows\System\anvvCys.exe
  2⤵
  PID:1340
- C:\Windows\System\sElQWgs.exe
  C:\Windows\System\sElQWgs.exe
  2⤵
  PID:12652
- C:\Windows\System\OyMUqYG.exe
  C:\Windows\System\OyMUqYG.exe
  2⤵
  PID:12904
- C:\Windows\System\ROSQiWn.exe
  C:\Windows\System\ROSQiWn.exe
  2⤵
  PID:3544
- C:\Windows\System\HMthZeB.exe
  C:\Windows\System\HMthZeB.exe
  2⤵
  PID:4232
- C:\Windows\System\CXtUdud.exe
  C:\Windows\System\CXtUdud.exe
  2⤵
  PID:12428
- C:\Windows\System\BZkZunp.exe
  C:\Windows\System\BZkZunp.exe
  2⤵
  PID:5016
- C:\Windows\System\IbxopZw.exe
  C:\Windows\System\IbxopZw.exe
  2⤵
  PID:2044
- C:\Windows\System\cmFyfKz.exe
  C:\Windows\System\cmFyfKz.exe
  2⤵
  PID:2576
- C:\Windows\System\OvxVghs.exe
  C:\Windows\System\OvxVghs.exe
  2⤵
  PID:1412
- C:\Windows\System\suilvCa.exe
  C:\Windows\System\suilvCa.exe
  2⤵
  PID:4376
- C:\Windows\System\JXQhOPk.exe
  C:\Windows\System\JXQhOPk.exe
  2⤵
  PID:1224
- C:\Windows\System\yqdlFZm.exe
  C:\Windows\System\yqdlFZm.exe
  2⤵
  PID:10752
- C:\Windows\System\xgYdJpx.exe
  C:\Windows\System\xgYdJpx.exe
  2⤵
  PID:11344
- C:\Windows\System\JpAuOOc.exe
  C:\Windows\System\JpAuOOc.exe
  2⤵
  PID:2184
- C:\Windows\System\PNYSWef.exe
  C:\Windows\System\PNYSWef.exe
  2⤵
  PID:3368
- C:\Windows\System\XoAEhqi.exe
  C:\Windows\System\XoAEhqi.exe
  2⤵
  PID:5144
- C:\Windows\System\CNAotWg.exe
  C:\Windows\System\CNAotWg.exe
  2⤵
  PID:5148
- C:\Windows\System\egVUOXR.exe
  C:\Windows\System\egVUOXR.exe
  2⤵
  PID:4336
- C:\Windows\System\jjuxGnK.exe
  C:\Windows\System\jjuxGnK.exe
  2⤵
  PID:4352
- C:\Windows\System\yLaHzxO.exe
  C:\Windows\System\yLaHzxO.exe
  2⤵
  PID:4076
- C:\Windows\System\RimrXlV.exe
  C:\Windows\System\RimrXlV.exe
  2⤵
  PID:4280
- C:\Windows\System\QJGEAAU.exe
  C:\Windows\System\QJGEAAU.exe
  2⤵
  PID:2160
- C:\Windows\System\sCMRvlY.exe
  C:\Windows\System\sCMRvlY.exe
  2⤵
  PID:3588
- C:\Windows\System\RZgDDET.exe
  C:\Windows\System\RZgDDET.exe
  2⤵
  PID:5788
- C:\Windows\System\bvBihiO.exe
  C:\Windows\System\bvBihiO.exe
  2⤵
  PID:672
- C:\Windows\System\PNifblJ.exe
  C:\Windows\System\PNifblJ.exe
  2⤵
  PID:5152
- C:\Windows\System\odXLAPJ.exe
  C:\Windows\System\odXLAPJ.exe
  2⤵
  PID:5900
- C:\Windows\System\DTESeBJ.exe
  C:\Windows\System\DTESeBJ.exe
  2⤵
  PID:5972
- C:\Windows\System\jIeRwJk.exe
  C:\Windows\System\jIeRwJk.exe
  2⤵
  PID:6020
- C:\Windows\System\UrPBOwI.exe
  C:\Windows\System\UrPBOwI.exe
  2⤵
  PID:6096
- C:\Windows\System\iiAijSi.exe
  C:\Windows\System\iiAijSi.exe
  2⤵
  PID:2420
- C:\Windows\System\zPQbpRg.exe
  C:\Windows\System\zPQbpRg.exe
  2⤵
  PID:2584
- C:\Windows\System\XgkhTZb.exe
  C:\Windows\System\XgkhTZb.exe
  2⤵
  PID:4384
- C:\Windows\System\DsMIzbB.exe
  C:\Windows\System\DsMIzbB.exe
  2⤵
  PID:5312
- C:\Windows\System\kWUwECw.exe
  C:\Windows\System\kWUwECw.exe
  2⤵
  PID:5476
- C:\Windows\System\fwWBxqV.exe
  C:\Windows\System\fwWBxqV.exe
  2⤵
  PID:2136
- C:\Windows\System\pQojSdh.exe
  C:\Windows\System\pQojSdh.exe
  2⤵
  PID:5348
- C:\Windows\System\nzaxzjJ.exe
  C:\Windows\System\nzaxzjJ.exe
  2⤵
  PID:5576
- C:\Windows\System\nXWCanp.exe
  C:\Windows\System\nXWCanp.exe
  2⤵
  PID:2028
- C:\Windows\System\wBMSKnu.exe
  C:\Windows\System\wBMSKnu.exe
  2⤵
  PID:5504
- C:\Windows\System\KDIXEdJ.exe
  C:\Windows\System\KDIXEdJ.exe
  2⤵
  PID:5276
- C:\Windows\System\bvykamj.exe
  C:\Windows\System\bvykamj.exe
  2⤵
  PID:3764
- C:\Windows\System\PIKQBYI.exe
  C:\Windows\System\PIKQBYI.exe
  2⤵
  PID:716
- C:\Windows\System\bmtlxPR.exe
  C:\Windows\System\bmtlxPR.exe
  2⤵
  PID:3604
- C:\Windows\System\CcsJuQy.exe
  C:\Windows\System\CcsJuQy.exe
  2⤵
  PID:5584
- C:\Windows\System\oHVyzCk.exe
  C:\Windows\System\oHVyzCk.exe
  2⤵
  PID:5612
- C:\Windows\System\PRStsce.exe
  C:\Windows\System\PRStsce.exe
  2⤵
  PID:5604
- C:\Windows\System\jjfmOTU.exe
  C:\Windows\System\jjfmOTU.exe
  2⤵
  PID:5516
- C:\Windows\System\IvZaZvi.exe
  C:\Windows\System\IvZaZvi.exe
  2⤵
  PID:5632
- C:\Windows\System\hLQKcaV.exe
  C:\Windows\System\hLQKcaV.exe
  2⤵
  PID:5668
- C:\Windows\System\vHZzdix.exe
  C:\Windows\System\vHZzdix.exe
  2⤵
  PID:5644
- C:\Windows\System\SBiKHCt.exe
  C:\Windows\System\SBiKHCt.exe
  2⤵
  PID:220
- C:\Windows\System\IpjlLwQ.exe
  C:\Windows\System\IpjlLwQ.exe
  2⤵
  PID:3536
- C:\Windows\System\UaVaZih.exe
  C:\Windows\System\UaVaZih.exe
  2⤵
  PID:5132
- C:\Windows\System\odYOxmB.exe
  C:\Windows\System\odYOxmB.exe
  2⤵
  PID:1560
- C:\Windows\System\wmtXtlz.exe
  C:\Windows\System\wmtXtlz.exe
  2⤵
  PID:4224
- C:\Windows\System\GfGeYQe.exe
  C:\Windows\System\GfGeYQe.exe
  2⤵
  PID:4304
- C:\Windows\System\FCQGfGx.exe
  C:\Windows\System\FCQGfGx.exe
  2⤵
  PID:1472
- C:\Windows\System\azskaeB.exe
  C:\Windows\System\azskaeB.exe
  2⤵
  PID:4296
- C:\Windows\System\vFlBNYq.exe
  C:\Windows\System\vFlBNYq.exe
  2⤵
  PID:6132
- C:\Windows\System\VmNbzwG.exe
  C:\Windows\System\VmNbzwG.exe
  2⤵
  PID:3124
- C:\Windows\System\ZAiomVz.exe
  C:\Windows\System\ZAiomVz.exe
  2⤵
  PID:5740
- C:\Windows\System\kapGard.exe
  C:\Windows\System\kapGard.exe
  2⤵
  PID:5284
- C:\Windows\System\bavrdQv.exe
  C:\Windows\System\bavrdQv.exe
  2⤵
  PID:5356
- C:\Windows\System\XnMHRMY.exe
  C:\Windows\System\XnMHRMY.exe
  2⤵
  PID:5624
- C:\Windows\System\HQhTBpR.exe
  C:\Windows\System\HQhTBpR.exe
  2⤵
  PID:5496
- C:\Windows\System\SaYFQYq.exe
  C:\Windows\System\SaYFQYq.exe
  2⤵
  PID:5676
- C:\Windows\System\VpsQtPT.exe
  C:\Windows\System\VpsQtPT.exe
  2⤵
  PID:5212
- C:\Windows\System\EDNaOcC.exe
  C:\Windows\System\EDNaOcC.exe
  2⤵
  PID:5996
- C:\Windows\System\Yqwpkum.exe
  C:\Windows\System\Yqwpkum.exe
  2⤵
  PID:2868
- C:\Windows\System\mAmamiX.exe
  C:\Windows\System\mAmamiX.exe
  2⤵
  PID:4996
- C:\Windows\System\IABrDye.exe
  C:\Windows\System\IABrDye.exe
  2⤵
  PID:2152
- C:\Windows\System\YZiYEaA.exe
  C:\Windows\System\YZiYEaA.exe
  2⤵
  PID:5040
- C:\Windows\System\FnGpRMW.exe
  C:\Windows\System\FnGpRMW.exe
  2⤵
  PID:11688
- C:\Windows\System\irEOcDt.exe
  C:\Windows\System\irEOcDt.exe
  2⤵
  PID:4840
- C:\Windows\System\fsvhHjA.exe
  C:\Windows\System\fsvhHjA.exe
  2⤵
  PID:5272
- C:\Windows\System\FvZEWLI.exe
  C:\Windows\System\FvZEWLI.exe
  2⤵
  PID:5532
- C:\Windows\System\TGJWYvi.exe
  C:\Windows\System\TGJWYvi.exe
  2⤵
  PID:5628
- C:\Windows\System\ZSJTKBb.exe
  C:\Windows\System\ZSJTKBb.exe
  2⤵
  PID:1264
- C:\Windows\System\UPqjadV.exe
  C:\Windows\System\UPqjadV.exe
  2⤵
  PID:6048
- C:\Windows\System\iyNqclN.exe
  C:\Windows\System\iyNqclN.exe
  2⤵
  PID:5140
- C:\Windows\System\SXSWxyH.exe
  C:\Windows\System\SXSWxyH.exe
  2⤵
  PID:5296
- C:\Windows\System\RWbZonK.exe
  C:\Windows\System\RWbZonK.exe
  2⤵
  PID:696
- C:\Windows\System\TWzihGV.exe
  C:\Windows\System\TWzihGV.exe
  2⤵
  PID:4572
- C:\Windows\System\KtgtpBK.exe
  C:\Windows\System\KtgtpBK.exe
  2⤵
  PID:5432
- C:\Windows\System\LIKeRQD.exe
  C:\Windows\System\LIKeRQD.exe
  2⤵
  PID:5124
- C:\Windows\System\kNuywPK.exe
  C:\Windows\System\kNuywPK.exe
  2⤵
  PID:1488
- C:\Windows\System\JxrPXmY.exe
  C:\Windows\System\JxrPXmY.exe
  2⤵
  PID:1020
- C:\Windows\System\smUfHZi.exe
  C:\Windows\System\smUfHZi.exe
  2⤵
  PID:2932
- C:\Windows\System\OqCRGsX.exe
  C:\Windows\System\OqCRGsX.exe
  2⤵
  PID:13324
- C:\Windows\System\ngGTSex.exe
  C:\Windows\System\ngGTSex.exe
  2⤵
  PID:13348
- C:\Windows\System\oMJCErh.exe
  C:\Windows\System\oMJCErh.exe
  2⤵
  PID:13364
- C:\Windows\System\JokLiJC.exe
  C:\Windows\System\JokLiJC.exe
  2⤵
  PID:13380
- C:\Windows\System\NgGjbSu.exe
  C:\Windows\System\NgGjbSu.exe
  2⤵
  PID:13396
- C:\Windows\System\LCaHpch.exe
  C:\Windows\System\LCaHpch.exe
  2⤵
  PID:13412
- C:\Windows\System\yoTparl.exe
  C:\Windows\System\yoTparl.exe
  2⤵
  PID:13432
- C:\Windows\System\edfoHnf.exe
  C:\Windows\System\edfoHnf.exe
  2⤵
  PID:13460
- C:\Windows\System\SPUqxml.exe
  C:\Windows\System\SPUqxml.exe
  2⤵
  PID:13476
- C:\Windows\System\EcCAjrg.exe
  C:\Windows\System\EcCAjrg.exe
  2⤵
  PID:13492
- C:\Windows\System\Viriifh.exe
  C:\Windows\System\Viriifh.exe
  2⤵
  PID:13516
- C:\Windows\System\jOhOoeg.exe
  C:\Windows\System\jOhOoeg.exe
  2⤵
  PID:13532
- C:\Windows\System\eNPtZnK.exe
  C:\Windows\System\eNPtZnK.exe
  2⤵
  PID:13548
- C:\Windows\System\HIeYyFM.exe
  C:\Windows\System\HIeYyFM.exe
  2⤵
  PID:13564
- C:\Windows\System\bhIzbqT.exe
  C:\Windows\System\bhIzbqT.exe
  2⤵
  PID:13580
- C:\Windows\System\dNAPzWU.exe
  C:\Windows\System\dNAPzWU.exe
  2⤵
  PID:13596
- C:\Windows\System\xzrtSgx.exe
  C:\Windows\System\xzrtSgx.exe
  2⤵
  PID:13612
- C:\Windows\System\FIEvydg.exe
  C:\Windows\System\FIEvydg.exe
  2⤵
  PID:13628
- C:\Windows\System\zUWcHuI.exe
  C:\Windows\System\zUWcHuI.exe
  2⤵
  PID:13644
- C:\Windows\System\gXcbkkZ.exe
  C:\Windows\System\gXcbkkZ.exe
  2⤵
  PID:13660
- C:\Windows\System\jLUcdSp.exe
  C:\Windows\System\jLUcdSp.exe
  2⤵
  PID:13676
- C:\Windows\System\VZXshzL.exe
  C:\Windows\System\VZXshzL.exe
  2⤵
  PID:13692
- C:\Windows\System\CxgeliW.exe
  C:\Windows\System\CxgeliW.exe
  2⤵
  PID:13708
- C:\Windows\System\IZrgpAc.exe
  C:\Windows\System\IZrgpAc.exe
  2⤵
  PID:13724
- C:\Windows\System\LPIqzSz.exe
  C:\Windows\System\LPIqzSz.exe
  2⤵
  PID:13740
- C:\Windows\System\svOWngu.exe
  C:\Windows\System\svOWngu.exe
  2⤵
  PID:13756
- C:\Windows\System\AVvyWFq.exe
  C:\Windows\System\AVvyWFq.exe
  2⤵
  PID:13772
- C:\Windows\System\uBNgrTL.exe
  C:\Windows\System\uBNgrTL.exe
  2⤵
  PID:13788
- C:\Windows\System\zOxlmYx.exe
  C:\Windows\System\zOxlmYx.exe
  2⤵
  PID:13804
- C:\Windows\System\bHpJeGf.exe
  C:\Windows\System\bHpJeGf.exe
  2⤵
  PID:13820
- C:\Windows\System\wfpTxiJ.exe
  C:\Windows\System\wfpTxiJ.exe
  2⤵
  PID:13836
- C:\Windows\System\xtPVFTG.exe
  C:\Windows\System\xtPVFTG.exe
  2⤵
  PID:13852
- C:\Windows\System\wJBZLNe.exe
  C:\Windows\System\wJBZLNe.exe
  2⤵
  PID:13868
- C:\Windows\System\iJBnTKw.exe
  C:\Windows\System\iJBnTKw.exe
  2⤵
  PID:13884
- C:\Windows\System\vKABKua.exe
  C:\Windows\System\vKABKua.exe
  2⤵
  PID:13900
- C:\Windows\System\OeSsRBR.exe
  C:\Windows\System\OeSsRBR.exe
  2⤵
  PID:13916
- C:\Windows\System\ARGraPt.exe
  C:\Windows\System\ARGraPt.exe
  2⤵
  PID:13932
- C:\Windows\System\iEYwywX.exe
  C:\Windows\System\iEYwywX.exe
  2⤵
  PID:13948
- C:\Windows\System\HLcLtuP.exe
  C:\Windows\System\HLcLtuP.exe
  2⤵
  PID:13964
- C:\Windows\System\GNaBexK.exe
  C:\Windows\System\GNaBexK.exe
  2⤵
  PID:13980
- C:\Windows\System\dbwkvBQ.exe
  C:\Windows\System\dbwkvBQ.exe
  2⤵
  PID:13996
- C:\Windows\System\uCGZsGK.exe
  C:\Windows\System\uCGZsGK.exe
  2⤵
  PID:14012
- C:\Windows\System\steGIIm.exe
  C:\Windows\System\steGIIm.exe
  2⤵
  PID:14028
- C:\Windows\System\rsPrdsj.exe
  C:\Windows\System\rsPrdsj.exe
  2⤵
  PID:14044
- C:\Windows\System\yyNoWsp.exe
  C:\Windows\System\yyNoWsp.exe
  2⤵
  PID:14060
- C:\Windows\System\dJxnOhj.exe
  C:\Windows\System\dJxnOhj.exe
  2⤵
  PID:14076
- C:\Windows\System\DNyIBio.exe
  C:\Windows\System\DNyIBio.exe
  2⤵
  PID:14092
- C:\Windows\System\UvYmedO.exe
  C:\Windows\System\UvYmedO.exe
  2⤵
  PID:14112
- C:\Windows\System\sgJDnpL.exe
  C:\Windows\System\sgJDnpL.exe
  2⤵
  PID:14128
- C:\Windows\System\iuTeXsQ.exe
  C:\Windows\System\iuTeXsQ.exe
  2⤵
  PID:14148
- C:\Windows\System\eePjFDf.exe
  C:\Windows\System\eePjFDf.exe
  2⤵
  PID:14164
- C:\Windows\System\qawyPbn.exe
  C:\Windows\System\qawyPbn.exe
  2⤵
  PID:14180
- C:\Windows\System\HOpGFEK.exe
  C:\Windows\System\HOpGFEK.exe
  2⤵
  PID:14196
- C:\Windows\System\TQzDdyL.exe
  C:\Windows\System\TQzDdyL.exe
  2⤵
  PID:14212
- C:\Windows\System\kllkoFm.exe
  C:\Windows\System\kllkoFm.exe
  2⤵
  PID:14228
- C:\Windows\System\KtnUEAk.exe
  C:\Windows\System\KtnUEAk.exe
  2⤵
  PID:14244
- C:\Windows\System\qrixIXW.exe
  C:\Windows\System\qrixIXW.exe
  2⤵
  PID:14260
- C:\Windows\System\RzQcLYI.exe
  C:\Windows\System\RzQcLYI.exe
  2⤵
  PID:14276
- C:\Windows\System\pgCTCgQ.exe
  C:\Windows\System\pgCTCgQ.exe
  2⤵
  PID:14292
- C:\Windows\System\pHbtmYr.exe
  C:\Windows\System\pHbtmYr.exe
  2⤵
  PID:14308
- C:\Windows\System\CBmUaFD.exe
  C:\Windows\System\CBmUaFD.exe
  2⤵
  PID:14324
- C:\Windows\System\JEOkFXl.exe
  C:\Windows\System\JEOkFXl.exe
  2⤵
  PID:13320
- C:\Windows\System\FYGvYNL.exe
  C:\Windows\System\FYGvYNL.exe
  2⤵
  PID:13360
- C:\Windows\System\gUXnHcZ.exe
  C:\Windows\System\gUXnHcZ.exe
  2⤵
  PID:13392
- C:\Windows\System\KoQhXRV.exe
  C:\Windows\System\KoQhXRV.exe
  2⤵
  PID:13428
- C:\Windows\System\cGlvCOm.exe
  C:\Windows\System\cGlvCOm.exe
  2⤵
  PID:13472
- C:\Windows\System\HRLdcGl.exe
  C:\Windows\System\HRLdcGl.exe
  2⤵
  PID:13512
- C:\Windows\System\ggvyYXx.exe
  C:\Windows\System\ggvyYXx.exe
  2⤵
  PID:13544
- C:\Windows\System\tNklJIz.exe
  C:\Windows\System\tNklJIz.exe
  2⤵
  PID:13576
- C:\Windows\System\pyWNhct.exe
  C:\Windows\System\pyWNhct.exe
  2⤵
  PID:13608
- C:\Windows\System\jtZKdmd.exe
  C:\Windows\System\jtZKdmd.exe
  2⤵
  PID:13640
- C:\Windows\System\UMKXEvK.exe
  C:\Windows\System\UMKXEvK.exe
  2⤵
  PID:13672
- C:\Windows\System\nmWNzDc.exe
  C:\Windows\System\nmWNzDc.exe
  2⤵
  PID:13704
- C:\Windows\System\ndUUIwF.exe
  C:\Windows\System\ndUUIwF.exe
  2⤵
  PID:13736
- C:\Windows\System\BRJofKu.exe
  C:\Windows\System\BRJofKu.exe
  2⤵
  PID:13768
- C:\Windows\System\TNsvNFv.exe
  C:\Windows\System\TNsvNFv.exe
  2⤵
  PID:13800
- C:\Windows\System\XGTXHpn.exe
  C:\Windows\System\XGTXHpn.exe
  2⤵
  PID:13832
- C:\Windows\System\NWcHxVj.exe
  C:\Windows\System\NWcHxVj.exe
  2⤵
  PID:13864
- C:\Windows\System\KrBTltO.exe
  C:\Windows\System\KrBTltO.exe
  2⤵
  PID:13896
- C:\Windows\System\byPzPVN.exe
  C:\Windows\System\byPzPVN.exe
  2⤵
  PID:13924
- C:\Windows\System\cTHAxov.exe
  C:\Windows\System\cTHAxov.exe
  2⤵
  PID:13956
- C:\Windows\System\HyNFEJi.exe
  C:\Windows\System\HyNFEJi.exe
  2⤵
  PID:13988
- C:\Windows\System\kXJBJzb.exe
  C:\Windows\System\kXJBJzb.exe
  2⤵
  PID:14020
- C:\Windows\System\IneTkpd.exe
  C:\Windows\System\IneTkpd.exe
  2⤵
  PID:14052
- C:\Windows\System\hyiycYk.exe
  C:\Windows\System\hyiycYk.exe
  2⤵
  PID:14084
- C:\Windows\System\IhnQyvp.exe
  C:\Windows\System\IhnQyvp.exe
  2⤵
  PID:14120
- C:\Windows\System\DuYaOCf.exe
  C:\Windows\System\DuYaOCf.exe
  2⤵
  PID:14144
- C:\Windows\System\DCJpVpt.exe
  C:\Windows\System\DCJpVpt.exe
  2⤵
  PID:14176
- C:\Windows\System\enHIhBa.exe
  C:\Windows\System\enHIhBa.exe
  2⤵
  PID:14208
- C:\Windows\System\EhzZjnJ.exe
  C:\Windows\System\EhzZjnJ.exe
  2⤵
  PID:14240
- C:\Windows\System\rHDMYnz.exe
  C:\Windows\System\rHDMYnz.exe
  2⤵
  PID:14272
- C:\Windows\System\hHiUuBm.exe
  C:\Windows\System\hHiUuBm.exe
  2⤵
  PID:14304
- C:\Windows\System\xxBmswm.exe
  C:\Windows\System\xxBmswm.exe
  2⤵
  PID:13344
- C:\Windows\System\KWsfeIi.exe
  C:\Windows\System\KWsfeIi.exe
  2⤵
  PID:13408
- C:\Windows\System\AHEKPHN.exe
  C:\Windows\System\AHEKPHN.exe
  2⤵
  PID:13488
- C:\Windows\System\viBzPav.exe
  C:\Windows\System\viBzPav.exe
  2⤵
  PID:13560
- C:\Windows\System\IdQFuCu.exe
  C:\Windows\System\IdQFuCu.exe
  2⤵
  PID:13624
- C:\Windows\System\NCjJRis.exe
  C:\Windows\System\NCjJRis.exe
  2⤵
  PID:13688
- C:\Windows\System\sZVyqPa.exe
  C:\Windows\System\sZVyqPa.exe
  2⤵
  PID:13752
- C:\Windows\System\gjIaShL.exe
  C:\Windows\System\gjIaShL.exe
  2⤵
  PID:13816
- C:\Windows\System\GsnzzJg.exe
  C:\Windows\System\GsnzzJg.exe
  2⤵
  PID:13880
- C:\Windows\System\IHtrIYd.exe
  C:\Windows\System\IHtrIYd.exe
  2⤵
  PID:13940
- C:\Windows\System\GuEPade.exe
  C:\Windows\System\GuEPade.exe
  2⤵
  PID:13976
- C:\Windows\System\UytYDTG.exe
  C:\Windows\System\UytYDTG.exe
  2⤵
  PID:14040
- C:\Windows\System\JzhyYww.exe
  C:\Windows\System\JzhyYww.exe
  2⤵
  PID:14108
- C:\Windows\System\QcghRKx.exe
  C:\Windows\System\QcghRKx.exe
  2⤵
  PID:14172
- C:\Windows\System\knhNTiF.exe
  C:\Windows\System\knhNTiF.exe
  2⤵
  PID:3408
- C:\Windows\System\TuwlMGs.exe
  C:\Windows\System\TuwlMGs.exe
  2⤵
  PID:14288
- C:\Windows\System\nMmzRwm.exe
  C:\Windows\System\nMmzRwm.exe
  2⤵
  PID:13376
- C:\Windows\System\RozZdHS.exe
  C:\Windows\System\RozZdHS.exe
  2⤵
  PID:13528
- C:\Windows\System\thmQsgY.exe
  C:\Windows\System\thmQsgY.exe
  2⤵
  PID:13656
- C:\Windows\System\IKlcwcu.exe
  C:\Windows\System\IKlcwcu.exe
  2⤵
  PID:13784
- C:\Windows\System\XTiLLZL.exe
  C:\Windows\System\XTiLLZL.exe
  2⤵
  PID:13912
- C:\Windows\System\xYyWchF.exe
  C:\Windows\System\xYyWchF.exe
  2⤵
  PID:14008
- C:\Windows\System\RRhaiCu.exe
  C:\Windows\System\RRhaiCu.exe
  2⤵
  PID:14140
- C:\Windows\System\BylNjeq.exe
  C:\Windows\System\BylNjeq.exe
  2⤵
  PID:14256
- C:\Windows\System\jQqZmSc.exe
  C:\Windows\System\jQqZmSc.exe
  2⤵
  PID:13456
- C:\Windows\System\zTwLfai.exe
  C:\Windows\System\zTwLfai.exe
  2⤵
  PID:13720
- C:\Windows\System\ThbKnxt.exe
  C:\Windows\System\ThbKnxt.exe
  2⤵
  PID:14100
- C:\Windows\System\dPdBtrO.exe
  C:\Windows\System\dPdBtrO.exe
  2⤵
  PID:14204
- C:\Windows\System\wsPleHc.exe
  C:\Windows\System\wsPleHc.exe
  2⤵
  PID:13592
- C:\Windows\System\pfVefes.exe
  C:\Windows\System\pfVefes.exe
  2⤵
  PID:14072
- C:\Windows\System\ZsrGaCX.exe
  C:\Windows\System\ZsrGaCX.exe
  2⤵
  PID:13848
- C:\Windows\System\AbRqDZI.exe
  C:\Windows\System\AbRqDZI.exe
  2⤵
  PID:14332
- C:\Windows\System\UhuSNTG.exe
  C:\Windows\System\UhuSNTG.exe
  2⤵
  PID:14340
- C:\Windows\System\PnodUzz.exe
  C:\Windows\System\PnodUzz.exe
  2⤵
  PID:14356
- C:\Windows\System\MFCimcF.exe
  C:\Windows\System\MFCimcF.exe
  2⤵
  PID:14372
- C:\Windows\System\AcnvwEh.exe
  C:\Windows\System\AcnvwEh.exe
  2⤵
  PID:14388
- C:\Windows\System\vqEqvqA.exe
  C:\Windows\System\vqEqvqA.exe
  2⤵
  PID:14404
- C:\Windows\System\tyxvOWO.exe
  C:\Windows\System\tyxvOWO.exe
  2⤵
  PID:14420
- C:\Windows\System\jkLZsNI.exe
  C:\Windows\System\jkLZsNI.exe
  2⤵
  PID:14436
- C:\Windows\System\ZlhkgrD.exe
  C:\Windows\System\ZlhkgrD.exe
  2⤵
  PID:14452
- C:\Windows\System\dwjulfJ.exe
  C:\Windows\System\dwjulfJ.exe
  2⤵
  PID:14468
- C:\Windows\System\cfQJBDF.exe
  C:\Windows\System\cfQJBDF.exe
  2⤵
  PID:14484
- C:\Windows\System\APQIoxS.exe
  C:\Windows\System\APQIoxS.exe
  2⤵
  PID:14504
- C:\Windows\System\uGRJeib.exe
  C:\Windows\System\uGRJeib.exe
  2⤵
  PID:14520
- C:\Windows\System\VeyaLnc.exe
  C:\Windows\System\VeyaLnc.exe
  2⤵
  PID:14536
- C:\Windows\System\xonwRtl.exe
  C:\Windows\System\xonwRtl.exe
  2⤵
  PID:14552
- C:\Windows\System\RpKEjIQ.exe
  C:\Windows\System\RpKEjIQ.exe
  2⤵
  PID:14568
- C:\Windows\System\QFdmRzK.exe
  C:\Windows\System\QFdmRzK.exe
  2⤵
  PID:14584
- C:\Windows\System\otoyHKt.exe
  C:\Windows\System\otoyHKt.exe
  2⤵
  PID:14600
- C:\Windows\System\rhpQwIn.exe
  C:\Windows\System\rhpQwIn.exe
  2⤵
  PID:14616
- C:\Windows\System\bQBXMsG.exe
  C:\Windows\System\bQBXMsG.exe
  2⤵
  PID:14632
- C:\Windows\System\VsLjswA.exe
  C:\Windows\System\VsLjswA.exe
  2⤵
  PID:14648
- C:\Windows\System\BbJEfzm.exe
  C:\Windows\System\BbJEfzm.exe
  2⤵
  PID:14664
- C:\Windows\System\LjHvHre.exe
  C:\Windows\System\LjHvHre.exe
  2⤵
  PID:14680
- C:\Windows\System\CSmDFTR.exe
  C:\Windows\System\CSmDFTR.exe
  2⤵
  PID:14696
- C:\Windows\System\tXKJTyo.exe
  C:\Windows\System\tXKJTyo.exe
  2⤵
  PID:14712
- C:\Windows\System\eURTLKZ.exe
  C:\Windows\System\eURTLKZ.exe
  2⤵
  PID:14728
- C:\Windows\System\JaxdVXT.exe
  C:\Windows\System\JaxdVXT.exe
  2⤵
  PID:14744
- C:\Windows\System\kexZvuF.exe
  C:\Windows\System\kexZvuF.exe
  2⤵
  PID:14760
- C:\Windows\System\OeqSGzb.exe
  C:\Windows\System\OeqSGzb.exe
  2⤵
  PID:14776
- C:\Windows\System\SgAMarh.exe
  C:\Windows\System\SgAMarh.exe
  2⤵
  PID:14792
- C:\Windows\System\jDkoMHC.exe
  C:\Windows\System\jDkoMHC.exe
  2⤵
  PID:14808
- C:\Windows\System\vMRXukQ.exe
  C:\Windows\System\vMRXukQ.exe
  2⤵
  PID:14824
- C:\Windows\System\qJhiEqB.exe
  C:\Windows\System\qJhiEqB.exe
  2⤵
  PID:14840
- C:\Windows\System\naJQwTK.exe
  C:\Windows\System\naJQwTK.exe
  2⤵
  PID:14856
- C:\Windows\System\nKpWVEA.exe
  C:\Windows\System\nKpWVEA.exe
  2⤵
  PID:14872
- C:\Windows\System\mOPZNBH.exe
  C:\Windows\System\mOPZNBH.exe
  2⤵
  PID:14888
- C:\Windows\System\UyegiTf.exe
  C:\Windows\System\UyegiTf.exe
  2⤵
  PID:14904
- C:\Windows\System\GaqHUpL.exe
  C:\Windows\System\GaqHUpL.exe
  2⤵
  PID:14920
- C:\Windows\System\wWErpCf.exe
  C:\Windows\System\wWErpCf.exe
  2⤵
  PID:14936
- C:\Windows\System\fvNRaDZ.exe
  C:\Windows\System\fvNRaDZ.exe
  2⤵
  PID:14952
- C:\Windows\System\rIlWCTN.exe
  C:\Windows\System\rIlWCTN.exe
  2⤵
  PID:14968
- C:\Windows\System\vmQWJJW.exe
  C:\Windows\System\vmQWJJW.exe
  2⤵
  PID:14984
- C:\Windows\System\keNsVOu.exe
  C:\Windows\System\keNsVOu.exe
  2⤵
  PID:15000
- C:\Windows\System\dApeIZz.exe
  C:\Windows\System\dApeIZz.exe
  2⤵
  PID:15016
- C:\Windows\System\NlYCelw.exe
  C:\Windows\System\NlYCelw.exe
  2⤵
  PID:15032
- C:\Windows\System\xXZWAhs.exe
  C:\Windows\System\xXZWAhs.exe
  2⤵
  PID:15048
- C:\Windows\System\uJjMAeN.exe
  C:\Windows\System\uJjMAeN.exe
  2⤵
  PID:15064
- C:\Windows\System\FJXuAEp.exe
  C:\Windows\System\FJXuAEp.exe
  2⤵
  PID:15080
- C:\Windows\System\loSYSbN.exe
  C:\Windows\System\loSYSbN.exe
  2⤵
  PID:15096
- C:\Windows\System\DdvZCQe.exe
  C:\Windows\System\DdvZCQe.exe
  2⤵
  PID:15112
- C:\Windows\System\KbDAbTq.exe
  C:\Windows\System\KbDAbTq.exe
  2⤵
  PID:15128
- C:\Windows\System\aMrswKx.exe
  C:\Windows\System\aMrswKx.exe
  2⤵
  PID:15144
- C:\Windows\System\OEvuAHY.exe
  C:\Windows\System\OEvuAHY.exe
  2⤵
  PID:15160
- C:\Windows\System\ERsUnvE.exe
  C:\Windows\System\ERsUnvE.exe
  2⤵
  PID:15176
- C:\Windows\System\PkmedjN.exe
  C:\Windows\System\PkmedjN.exe
  2⤵
  PID:15192
- C:\Windows\System\edJYezl.exe
  C:\Windows\System\edJYezl.exe
  2⤵
  PID:15212
- C:\Windows\System\sqFpmwC.exe
  C:\Windows\System\sqFpmwC.exe
  2⤵
  PID:15228
- C:\Windows\System\OZfgAcY.exe
  C:\Windows\System\OZfgAcY.exe
  2⤵
  PID:15244
- C:\Windows\System\UGiiEVu.exe
  C:\Windows\System\UGiiEVu.exe
  2⤵
  PID:15260
- C:\Windows\System\VoiPntO.exe
  C:\Windows\System\VoiPntO.exe
  2⤵
  PID:15276
- C:\Windows\System\noyyvEG.exe
  C:\Windows\System\noyyvEG.exe
  2⤵
  PID:15292
- C:\Windows\System\qZjHSOf.exe
  C:\Windows\System\qZjHSOf.exe
  2⤵
  PID:15308
- C:\Windows\System\PNHppMG.exe
  C:\Windows\System\PNHppMG.exe
  2⤵
  PID:15324
- C:\Windows\System\REqyNSW.exe
  C:\Windows\System\REqyNSW.exe
  2⤵
  PID:15340
- C:\Windows\System\hHJFakZ.exe
  C:\Windows\System\hHJFakZ.exe
  2⤵
  PID:15356
- C:\Windows\System\BgWHdlb.exe
  C:\Windows\System\BgWHdlb.exe
  2⤵
  PID:14364
- C:\Windows\System\jXYHPdS.exe
  C:\Windows\System\jXYHPdS.exe
  2⤵
  PID:14396
- C:\Windows\System\SRFkdoE.exe
  C:\Windows\System\SRFkdoE.exe
  2⤵
  PID:14428
- C:\Windows\System\ObWjGNA.exe
  C:\Windows\System\ObWjGNA.exe
  2⤵
  PID:14460
- C:\Windows\System\hJqQTxG.exe
  C:\Windows\System\hJqQTxG.exe
  2⤵
  PID:14496
- C:\Windows\System\VNxXEPM.exe
  C:\Windows\System\VNxXEPM.exe
  2⤵
  PID:14528
- C:\Windows\System\QrOSTiF.exe
  C:\Windows\System\QrOSTiF.exe
  2⤵
  PID:14560
- C:\Windows\System\vLJbUfx.exe
  C:\Windows\System\vLJbUfx.exe
  2⤵
  PID:14592
- C:\Windows\System\HBWvGuS.exe
  C:\Windows\System\HBWvGuS.exe
  2⤵
  PID:14624
- C:\Windows\System\MYUnYtV.exe
  C:\Windows\System\MYUnYtV.exe
  2⤵
  PID:14656
- C:\Windows\System\MBXlZBK.exe
  C:\Windows\System\MBXlZBK.exe
  2⤵
  PID:14688
- C:\Windows\System\LnrKGvb.exe
  C:\Windows\System\LnrKGvb.exe
  2⤵
  PID:14720
- C:\Windows\System\kyhtnuM.exe
  C:\Windows\System\kyhtnuM.exe
  2⤵
  PID:14752
- C:\Windows\System\nStHUPG.exe
  C:\Windows\System\nStHUPG.exe
  2⤵
  PID:14784
- C:\Windows\System\DBYSCVJ.exe
  C:\Windows\System\DBYSCVJ.exe
  2⤵
  PID:14816
- C:\Windows\System\qppjlTB.exe
  C:\Windows\System\qppjlTB.exe
  2⤵
  PID:14848
- C:\Windows\System\QnuAApB.exe
  C:\Windows\System\QnuAApB.exe
  2⤵
  PID:14880
- C:\Windows\System\DMQKVKD.exe
  C:\Windows\System\DMQKVKD.exe
  2⤵
  PID:14912
- C:\Windows\System\wkiLlQt.exe
  C:\Windows\System\wkiLlQt.exe
  2⤵
  PID:14944
- C:\Windows\System\ZGGLrMh.exe
  C:\Windows\System\ZGGLrMh.exe
  2⤵
  PID:14976
- C:\Windows\System\yphOkNE.exe
  C:\Windows\System\yphOkNE.exe
  2⤵
  PID:15008
- C:\Windows\System\fLkILVw.exe
  C:\Windows\System\fLkILVw.exe
  2⤵
  PID:15028
- C:\Windows\System\ZGpTtCd.exe
  C:\Windows\System\ZGpTtCd.exe
  2⤵
  PID:15060
- C:\Windows\System\ynpYepw.exe
  C:\Windows\System\ynpYepw.exe
  2⤵
  PID:15092
- C:\Windows\System\DMkgkNA.exe
  C:\Windows\System\DMkgkNA.exe
  2⤵
  PID:15124
- C:\Windows\System\ygsdABt.exe
  C:\Windows\System\ygsdABt.exe
  2⤵
  PID:15156
- C:\Windows\System\IAuMmDh.exe
  C:\Windows\System\IAuMmDh.exe
  2⤵
  PID:15188
- C:\Windows\System\XcwnJmQ.exe
  C:\Windows\System\XcwnJmQ.exe
  2⤵
  PID:15224
- C:\Windows\System\wCCJLfY.exe
  C:\Windows\System\wCCJLfY.exe
  2⤵
  PID:15256
- C:\Windows\System\xieqSrh.exe
  C:\Windows\System\xieqSrh.exe
  2⤵
  PID:15288
- C:\Windows\System\kTOAzwl.exe
  C:\Windows\System\kTOAzwl.exe
  2⤵
  PID:15320
- C:\Windows\System\TvtOZBk.exe
  C:\Windows\System\TvtOZBk.exe
  2⤵
  PID:15352
- C:\Windows\System\zelZkUE.exe
  C:\Windows\System\zelZkUE.exe
  2⤵
  PID:14384
- C:\Windows\System\JOojzAz.exe
  C:\Windows\System\JOojzAz.exe
  2⤵
  PID:14476
- C:\Windows\System\fbTgdnv.exe
  C:\Windows\System\fbTgdnv.exe
  2⤵
  PID:14544
- C:\Windows\System\wkoGjHd.exe
  C:\Windows\System\wkoGjHd.exe
  2⤵
  PID:14608
- C:\Windows\System\JrFaxov.exe
  C:\Windows\System\JrFaxov.exe
  2⤵
  PID:14672
- C:\Windows\System\NomcVwU.exe
  C:\Windows\System\NomcVwU.exe
  2⤵
  PID:14736
- C:\Windows\System\iCfJQWi.exe
  C:\Windows\System\iCfJQWi.exe
  2⤵
  PID:14800
- C:\Windows\System\TusISLM.exe
  C:\Windows\System\TusISLM.exe
  2⤵
  PID:14864
- C:\Windows\System\nvZhcwa.exe
  C:\Windows\System\nvZhcwa.exe
  2⤵
  PID:14928
- C:\Windows\System\RVyXibY.exe
  C:\Windows\System\RVyXibY.exe
  2⤵
  PID:14992
- C:\Windows\System\qdmJXdF.exe
  C:\Windows\System\qdmJXdF.exe
  2⤵
  PID:15044
- C:\Windows\System\SfbnaQI.exe
  C:\Windows\System\SfbnaQI.exe
  2⤵
  PID:15088
- C:\Windows\System\bEqfLVw.exe
  C:\Windows\System\bEqfLVw.exe
  2⤵
  PID:15152
- C:\Windows\System\jkdUfqc.exe
  C:\Windows\System\jkdUfqc.exe
  2⤵
  PID:15220
- C:\Windows\System\vviwIQU.exe
  C:\Windows\System\vviwIQU.exe
  2⤵
  PID:15284
- C:\Windows\System\rmyhvnC.exe
  C:\Windows\System\rmyhvnC.exe
  2⤵
  PID:15348
- C:\Windows\System\iAEvPtX.exe
  C:\Windows\System\iAEvPtX.exe
  2⤵
  PID:14448
- C:\Windows\System\deVFsqq.exe
  C:\Windows\System\deVFsqq.exe
  2⤵
  PID:14580
- C:\Windows\System\KsrINUh.exe
  C:\Windows\System\KsrINUh.exe
  2⤵
  PID:14708
- C:\Windows\System\YJRXVHs.exe
  C:\Windows\System\YJRXVHs.exe
  2⤵
  PID:14836
- C:\Windows\System\yZZDqgc.exe
  C:\Windows\System\yZZDqgc.exe
  2⤵
  PID:14964
- C:\Windows\System\svGRoda.exe
  C:\Windows\System\svGRoda.exe
  2⤵
  PID:15076
- C:\Windows\System\rGXeJIc.exe
  C:\Windows\System\rGXeJIc.exe
  2⤵
  PID:15208
- C:\Windows\System\snCTIgV.exe
  C:\Windows\System\snCTIgV.exe
  2⤵
  PID:15336
- C:\Windows\System\ExwHszu.exe
  C:\Windows\System\ExwHszu.exe
  2⤵
  PID:14576
- C:\Windows\System\nCvGNje.exe
  C:\Windows\System\nCvGNje.exe
  2⤵
  PID:14832
- C:\Windows\System\XWJMlHq.exe
  C:\Windows\System\XWJMlHq.exe
  2⤵
  PID:15200
- C:\Windows\System\QIUeqpH.exe
  C:\Windows\System\QIUeqpH.exe
  2⤵
  PID:15316
- C:\Windows\System\WPRnmAG.exe
  C:\Windows\System\WPRnmAG.exe
  2⤵
  PID:14772
- C:\Windows\System\ZqITnmP.exe
  C:\Windows\System\ZqITnmP.exe
  2⤵
  PID:15272
- C:\Windows\System\LBXfLxq.exe
  C:\Windows\System\LBXfLxq.exe
  2⤵
  PID:15184
- C:\Windows\System\zczmxnX.exe
  C:\Windows\System\zczmxnX.exe
  2⤵
  PID:15024
- C:\Windows\System\FVKMywa.exe
  C:\Windows\System\FVKMywa.exe
  2⤵
  PID:15376
- C:\Windows\System\TceSRlY.exe
  C:\Windows\System\TceSRlY.exe
  2⤵
  PID:15392
- C:\Windows\System\LEhbBtt.exe
  C:\Windows\System\LEhbBtt.exe
  2⤵
  PID:15408
- C:\Windows\System\UtiCpqh.exe
  C:\Windows\System\UtiCpqh.exe
  2⤵
  PID:15424
- C:\Windows\System\EZrNBiV.exe
  C:\Windows\System\EZrNBiV.exe
  2⤵
  PID:15440
- C:\Windows\System\cjEibcr.exe
  C:\Windows\System\cjEibcr.exe
  2⤵
  PID:15456
- C:\Windows\System\uefhlal.exe
  C:\Windows\System\uefhlal.exe
  2⤵
  PID:15472
- C:\Windows\System\Fxbbjxo.exe
  C:\Windows\System\Fxbbjxo.exe
  2⤵
  PID:15488
- C:\Windows\System\FlFQTDh.exe
  C:\Windows\System\FlFQTDh.exe
  2⤵
  PID:15504
- C:\Windows\System\eimfmdV.exe
  C:\Windows\System\eimfmdV.exe
  2⤵
  PID:15520
- C:\Windows\System\rRGdqdM.exe
  C:\Windows\System\rRGdqdM.exe
  2⤵
  PID:15536
- C:\Windows\System\qeiwqMA.exe
  C:\Windows\System\qeiwqMA.exe
  2⤵
  PID:15552
- C:\Windows\System\YDtFePQ.exe
  C:\Windows\System\YDtFePQ.exe
  2⤵
  PID:15572
- C:\Windows\System\cLYaAaK.exe
  C:\Windows\System\cLYaAaK.exe
  2⤵
  PID:15588
- C:\Windows\System\CmxxMIW.exe
  C:\Windows\System\CmxxMIW.exe
  2⤵
  PID:15604
- C:\Windows\System\FmeVrOB.exe
  C:\Windows\System\FmeVrOB.exe
  2⤵
  PID:15620
- C:\Windows\System\PsbueQz.exe
  C:\Windows\System\PsbueQz.exe
  2⤵
  PID:15636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fmub0hi.4mq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CTOyRyO.exe

Filesize
2.7MB

MD5
710c8a5cdcd4b0a83705e819a1389884

SHA1
36f0e04851b75b7865af1ecaa18326dd714c0ba4

SHA256
f707e527268bb3abb857079c04259dfd72cdea8059e1737d6866d6ea6c27cf71

SHA512
f39f43aa1bd2af5b06007554af8470e12a27a423914c6fd1578e2d4f8e93aa08596b8575091afdc630f35e462f5185ce4297581ff1ac5d698249866b547e1b5a

Download Submit
C:\Windows\System\ESKuZEs.exe

Filesize
2.7MB

MD5
fdf8b3f9ea8c20614c64581888339505

SHA1
076f93a0076dfd39eb88b3c50251b049780e0c87

SHA256
3c430e75d7b7fc1fcd0fd2a83709ae99f0225f44967221f085ab87f361467d66

SHA512
50a2eae5ca5f68ecffbf9c7cc7c001c43d2ed522b2d587dbc59f34d2891a255a28986f11d13f7731b7d4b87bd8d0296578bc53dbf8ed7258887e68f4a2455470

Download Submit
C:\Windows\System\GqkpRJK.exe

Filesize
2.7MB

MD5
967da0ebb877c52ad308f36db0f4978d

SHA1
6e660568fb7d4e4c0efb863203ce33f59a123194

SHA256
ffe97b2708166e1b3748ac75eda8cfa6d8de476955c297f9bc2183aa52daeece

SHA512
918c8aa04bf5b4b04d39b371d6dac07914e3f85dcf5ea93dc236e709313ef303db2e2ee65190f706ec6dae448aeb6f79b851bf892d7c1ef1def1c9000da48c48

Download Submit
C:\Windows\System\GtOIkxC.exe

Filesize
2.7MB

MD5
22a852d325ee5105bfbb7a77c4561299

SHA1
464f0f0a89a35dca48cbba8efeb7cefe75809055

SHA256
2b47bcdfa648f3a8b133909bf91894ba47fa30cb54e0160f23b5850d4a313c40

SHA512
b81da52be75cf90465e41c2d8d6e3fdb90056bd6f975ff840c40e961629be5a23b3b9dc25b6b6ca0ba9e5d4399abcb40e5a6470de1774a1a8ecfa8399e1f26be

Download Submit
C:\Windows\System\GtbXcbu.exe

Filesize
2.7MB

MD5
08080cfd9fbe2118b22935260e85ab1e

SHA1
8d75c9bc93e766d534d88f937515854fca94b81b

SHA256
1f6f23e3f3b41c703a2e0ea42ee78b8d80a632572941f2d60a6438b2c93fb0a6

SHA512
41ac68f810d0c09ba31038e7d0c6d476ca9daadb7ee08e059bfc99f17c0687c2588f3250d3b8d5e14febc981fd1e67acefab94c3f1dfdf772e3c30a6eba09df1

Download Submit
C:\Windows\System\IYRGumz.exe

Filesize
2.7MB

MD5
4d1c15a75030006af891cff899bd720f

SHA1
3d5fdc5648b9b9ccd8f2343a8dcd209b6761132a

SHA256
31b5f942e632cc98d17721189855715ed516e9069671d48ad5bd14f1679ca60a

SHA512
e8d93f3086db34b9fb3b22bf954a8f53617c56c9284b282b23b349b74927341c5ff7c24e0b667c0afada58279e899ec9991741f85e7b96e781d0591c65df326d

Download Submit
C:\Windows\System\JkuMmgL.exe

Filesize
2.7MB

MD5
d6da64f291bc90750c5ed6b96d932cc5

SHA1
5d7946d0bad8546984154dfd3e3be5b6a88f1f91

SHA256
71e3d601cad3a0e261b6031453a63ecd3da1c983b9eb35007cb4963e5eb31b0d

SHA512
b72157e25b9987924aa50314a02c111169008e7e6cea84efd9c435a9a3feacd04ee4bfef5c389128fc0466abb01c5a8729bde57c0c196c3db82fba723d13ff50

Download Submit
C:\Windows\System\LgryBPD.exe

Filesize
2.7MB

MD5
6dd36cabc392f248efad5b12cf8380ec

SHA1
d6bb78f150d60b8792c55a4606963490b3f094d0

SHA256
8af39f4e4ac80b31d11ccc9e1de0f5ed87ebc95482d1484199e53e9e2911df50

SHA512
a9c87968892df42f8c65c9c8b7e01aa9e6b0c9c80deb7c97bbafd919b662d395751736c03dcf1de22c8a574a7d27c13d51a5b2de755c87ea247507992c4353f2

Download Submit
C:\Windows\System\NlHamZa.exe

Filesize
2.7MB

MD5
f388df42f586c0018314e3e1f69682fb

SHA1
2fe438957a31f07365e3ce74ae7525c44ffbf3f6

SHA256
8786297e7cd3b72756ee56bfb164269afcf65dc26394b16edf555b92958f3924

SHA512
f8dde500c835fe2135eccf80020b4e30609a5f14e6c4d7739b6e17df2b5b9ab73e98d88df05a0f29c90bb02620d6343f215e45249139aa85e4ef3980d7ee0d75

Download Submit
C:\Windows\System\PTKEcLX.exe

Filesize
2.7MB

MD5
0ec3272b4599c62c30a5df662e64893f

SHA1
b316a1c3b30ce12ef507712f7ef7a80f16d40655

SHA256
a31de7502c17185f5286caedb09b5d49cb7e26d1e75d20f2b8dbf39bc487110f

SHA512
edbb8e62575985896a2d21fd4e245c2f89cc043c62af560a2ae2460f9e8ba5a7887c6e7dc0d254cde0f259e95e8a2b45b5c07536e899aa95dac59fff0a113382

Download Submit
C:\Windows\System\UQxYlHX.exe

Filesize
2.7MB

MD5
ca2a987077367b2998565fe72f71e4bb

SHA1
63455161aa8f019ac79f62556040ec0a0d22e79d

SHA256
00ceec249d4e576949348bd15907803ab986bbfff4c3f424c08622640482f1b2

SHA512
b238f84c7b94a46d121ad67077aaf954a9bfb8957a8f436f07b2e160df1146a124e854971670ff583fe794a4bb04604773ffbe697436b4c948daa9b3a8081749

Download Submit
C:\Windows\System\VdoOzjR.exe

Filesize
2.7MB

MD5
86e5e4ac65fcc721d20f224e102d9b3b

SHA1
cd90b48ff1bfb74b20263b6c6c507a2869cd21d7

SHA256
6bf70c52aec3250e03b167c7515539e59db00aec773bd3eea11fecbf5f5b19e1

SHA512
ce3d4ea96474a65cc0a4057007150439c8136dd458a3b732f28409bcc0ba3f16bd6686dc4ad9fbacdbdf6a0723c38648f350ebe4bb8aded7f187de75344879b8

Download Submit
C:\Windows\System\WOYtBjF.exe

Filesize
2.7MB

MD5
2bdb2b90f5590ad55fb41b9ceae18bbc

SHA1
92517fcc8d98b664c14cab3225b0ee82769b4831

SHA256
8e452981847641b18e7af7c8d16cfd053fc4cf5bf1624be3027037d1b802cb4f

SHA512
638f10026c4590027b063b81da8620745c64f4c9e463d91c55d9d27a0f46a5147f556e47924267e7ca4b71077e7a062956196b988c1c170a9712846bcaf29e41

Download Submit
C:\Windows\System\YjPFpPy.exe

Filesize
2.7MB

MD5
51ae5bd6c34827a2dc3edabe3a1394af

SHA1
59f36f5ffb0e1afe79a8f823ca09425a28b5a950

SHA256
2591cf34008285ccd6ea9a21122c6d19cae013ce2650c41f1f383848f1ab630a

SHA512
0c0884012e7acb031e41e6c3712f2fac9bbd96ae2e1b9a2d314355104e38d730da49c3e2be5bd7dae78001859aeb1276e2fc8c726a2ed1bfa2c3b8503953b1d5

Download Submit
C:\Windows\System\aIacPJQ.exe

Filesize
2.7MB

MD5
3b605c4df3b43f5b57dfc3652856e8d5

SHA1
21520fea968029e731c73337b44d97932c1beb5d

SHA256
ff8c9f8c45dba5299c363ed576dc5b1e6d31d83c1b2048d94ffce1359ced511f

SHA512
e086746eec26e0e2e33582893109767d856e8f605bb28ccea4289b3bc0fc2af0acd080d5605e85419f25e33c2d2d80a5280ec3a146922e1e20bd43dae3496327

Download Submit
C:\Windows\System\akRYHNI.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\bBqDiPh.exe

Filesize
2.7MB

MD5
92273cc668adcd1843ad853f75e500d8

SHA1
bb8ee8bab0074f11816db9410a2a942c0bc1edac

SHA256
7703d5e85d1c384f85551bfc41014d01001f07c8bec7ea763713185447222e9c

SHA512
f6bb5db74dd6d12a2e5cedc2cac708140cc254cef7eca78c950502e8b9b0b5a388d31d6039d5552f7dcdb1148d017ddf9ac35c63477f316a17befdad97ffd57d

Download Submit
C:\Windows\System\bKuyPfS.exe

Filesize
2.7MB

MD5
b9ceb97e85d1d8a1b3295233891dc315

SHA1
e71b637daaa124df5c44926083c443a298766f84

SHA256
0deb99d0d66eecd6c1dc97cd8581e14caddb124eaff20da48702b1648ba7c089

SHA512
91e29841f5111afd8d92cd537d76b224a4cfdd283d41d778e4a44f639715b3fd3ce9d31e6c37dec093f7717eaef08d8a6d5faefaec8d365dcd8af23815ceebb1

Download Submit
C:\Windows\System\baTMuTX.exe

Filesize
2.7MB

MD5
9835f04afac650b82aa84d55c1f50a77

SHA1
000448e7bd029464c6749459b28abbba13724b5f

SHA256
cd4a638708ac48ad63ee28cb07981770b0ff3d12aa5c38a3b365d6c548ce367d

SHA512
dccf66bd3443eb1f886d591e26654b6d92408b128a8976e35ab977111953438f64ded65a10bcd4e5c821cafbde281106be147e523e050f8c7f791eccb440f6a4

Download Submit
C:\Windows\System\bjqyBRE.exe

Filesize
2.7MB

MD5
5ce36c34a1f61bb15c0bf375259d1f07

SHA1
f6349dae0677b8668fa25e5e723d8feee58a742d

SHA256
0a69f9f5d92b5b30d2552481093bd9817f342359c961e0339a93afac5bc3f549

SHA512
6e4ae074c0d464c81da07f86a4259969656d4d055ccee4ec746c8787105aaf179afadcbd13d4b679888cae96629e91e995260b5a01b82d952630f47c621355a0

Download Submit
C:\Windows\System\dTCsHeb.exe

Filesize
2.7MB

MD5
aa1bab2101d147480f759a6c11867059

SHA1
6e88f286e36d785bc3a688b139dd85e2c277d300

SHA256
c8d297190bd7a7ac85287c6abd9fe448242a3ee114f1e51a66e9d3f9db2aa8f5

SHA512
112dd6140d770a886a5b4c95c84d2ebb13ca7b6407ec67dbbeba96218ea09b2d674e1329941a5fd81ff23880a2cc21749de18b59c5364cf78359de19d4a3c74a

Download Submit
C:\Windows\System\gnSmIWi.exe

Filesize
2.7MB

MD5
9a64e4996aecbd7e8c2269688a4e7143

SHA1
3d4065a26007d35ce83c5f1e6f1f706189ff4c5c

SHA256
058d329b3e70e91791a3ba916b3123499ce6ae11d6ec2c62c73a7bc37dd9f2b5

SHA512
be4dff88c8bd9b5a6b82a811d1d9705d5fc91b121210f05754968bc6d38a77112e6b62550e4e5c3bb8874f36bd9f8271243812730add4517ae78da28cde31ea9

Download Submit
C:\Windows\System\gwLoLfm.exe

Filesize
2.7MB

MD5
89f2228adbcaf7d0fc1ebd39d807b3be

SHA1
4e64c799f319e8d80a4dc47abbc31acde182097c

SHA256
259db0867ea249d0d3fa8cd2b4ee0302f7c03dc7b068b8b4adc25ce6258e6e5d

SHA512
76b0a1426d09cdc8976be0d267d37aa867c28fa01aab048014c860a8cd350e5a25bccb92be4213d630c1dfa699df1e10d788382794aea8b9b059cda396d3e8fe

Download Submit
C:\Windows\System\kIxDiNc.exe

Filesize
2.7MB

MD5
cdb6cacd8be965ee9100996aa1d9252e

SHA1
792ab81367d1892c1a4ad177ecba0134d3326739

SHA256
208fb7d16e4b1785486fd03b06711a4ba5b0a46d19f9e4f5b1ccae1834ffd0d7

SHA512
0d685e6b4477f7ac1e21487811f9b212ff560e5099cc0341a01bc7f76dcd598f9f22bc57055bfd6b731490e3000d151ebce027ed31851cb8ecd5d1d0ba24a0a7

Download Submit
C:\Windows\System\lAqnBxM.exe

Filesize
2.7MB

MD5
8c3d6a250908fa0397a694b9a9bf8c5f

SHA1
51f8c6d85c16d88cc21e15fa190942b357e14e0e

SHA256
f46d410baab92e9aeb1dadeaa1266913d84cd4e5ec7a1d5bb359eece7c03ee0a

SHA512
5aac32ba5e206f1d5daa951baa22d844dcf27b911b9f7133adf39a123a412aca0aeb9691c38decd03ad4bb625a239049ce237e8cb622ead398f80b8840324f2c

Download Submit
C:\Windows\System\lQeYUMu.exe

Filesize
2.7MB

MD5
a91e36f81a767eb8232d32a492996080

SHA1
6327b5afcba23c273675978145ffaa8c7bb8bae8

SHA256
c17964074391efeed47f48c98ca11b434f3992cffce8fcea2a3ec3acb8fb2060

SHA512
7cd5b4aa3b06fceb865cdb8a36d4b60e55a2a3f2ff5666461ad60af26faf0156ecfeeb86ecbeaea49f87450c8f19915852b5a81f88afab6dc9b9178d6859bfa3

Download Submit
C:\Windows\System\nJFHvow.exe

Filesize
2.7MB

MD5
21771f713362d969edc7bc209a3db17f

SHA1
4b9c84cb8f1a0442f806dad37f84184b70d8ad5f

SHA256
4c09c003082855c8642982ce4226f3f22355bfd1eb514941c09744d8074891ad

SHA512
27cd228d775d2630b0fabe7bb8df3b0a08ac1b68ad01e8d7eac14cac4dfef742b3c39abe269fdcd089f8b1b5f0c00fce030b0d18a5cd3e293c5001134999e473

Download Submit
C:\Windows\System\nYpurvY.exe

Filesize
2.7MB

MD5
fa24fd6f6ebf3b5c0d40dd8165c6d90a

SHA1
a85255c2da125cb9900e971c8e36053d28feef6d

SHA256
4579a64850162a5f4744dd8fadee60ed94cc15b400bc583e92e1c7f0fe07ea28

SHA512
ac3880a915c3907bd0ed1e31e439b35ab49ea12d8037af1f3380d4e7c411d64b3b494f6fa874b07d984977bf2f630e1e4c455c8f641389ccd60303cc693c3e50

Download Submit
C:\Windows\System\npWvsuQ.exe

Filesize
2.7MB

MD5
baa39496a7178d7b46ae27e886a84848

SHA1
e97178de06f74d723a1101dbdb041610ab1d776a

SHA256
cf5b690777e7b9e0c55a3da8efc980095bcf51707103e2b824aabc5f5ae4a5f4

SHA512
03388bb44c92699c34ece4c3cd249770ae9459887e41822e9398b27870edf21fba5edab51af7ad4a4725d0a1699f767a3c5b8d5559c54b6b31bb2aee452b767c

Download Submit
C:\Windows\System\rmMtEAW.exe

Filesize
2.7MB

MD5
78c337aec0c730fb8ec51386edbd6008

SHA1
ef9fe46bf1cc7e9e93e4431bea21763aca0da7b5

SHA256
d81b4601a854b5824f436fe95bc647324b4a2a472e8cb492292adbd37ad5e9bc

SHA512
5d5cc5a846beb591f5c9293fe072049f4d304ae54cd9da2f909217c982fb45862b81e46ed5dd9419395c614c47989e982f1ae012cc0cb5ab3a917fbd2fafd932

Download Submit
C:\Windows\System\sQJpBJY.exe

Filesize
2.7MB

MD5
54cd39cd1ee6b2de6f4b359d47408a59

SHA1
9e21e79cd31701f8d100d25e125ddebcd4782a4c

SHA256
6bae6d16cf3f67a501323603e8d1225c8b937d6a2c566cc3f70521f1ae561026

SHA512
d3a688528c20441c8b9cfecdd381ff39122ba6b0e65a6cca647fce0705078d6e1b7eaec0cdadbbdb80440ef1d3740d97e97b983c6c1f262b5cfb38bb4991c404

Download Submit
C:\Windows\System\vOOyDjR.exe

Filesize
2.7MB

MD5
81b810ea8058d812d623f435a454593e

SHA1
7f9687e45fde722cef72dc7c04477ce39f89ba23

SHA256
31b6df6df37ee3e40a442209cb0dc0ae773e484fd19a2b986b77d001f4d50e07

SHA512
57de4e273eabc35be8c8d6d56cc51e4ba6b955522feeee63f15c3ec7253bba69e4ee52bc87c4edcdd9570e9ef0b7f14d3e019a7299a1ef2d7ef88d6bcfc1d500

Download Submit
C:\Windows\System\vbpzGiF.exe

Filesize
2.7MB

MD5
380aac1917dc7dfd9aeb5dc0314ee74f

SHA1
7031af5ac288c8ab829f3ffcffb13aa8a151e5b0

SHA256
6c6a2198ef4b2dca373b043553dd02adaa45b4881538817b0ccedbd1cd838ea1

SHA512
1606e5512f7c8342e1ae2f10ece39a14ad28a43cf116d47ec29a05464b08d329567b780c67a0661367db82e695978052b49c9abcbbd5b9138c745add8ba2f842

Download Submit
C:\Windows\System\vgqSMya.exe

Filesize
2.7MB

MD5
6e89b54403ce47e501bf91fb71cb6d54

SHA1
63fea23dd56a64552926efad50596af74d16949c

SHA256
9e56a8ee17bc0fcf2bc537266d71a88ca4eb3133a129538063f803eeac0da740

SHA512
6a1437ea3f89302bf6ec0aed5e31f12c3d734d6e8606ce7d01d8a0f04819b18ae923bb23558e31c6a154915c7d014a823c97ab2a31b113f896d106ed936ecfee

Download Submit
C:\Windows\System\xEGkydt.exe

Filesize
2.7MB

MD5
e73dbf74c804fae11fcea79d9ab54672

SHA1
1fb356f58ca5f5bc5ea714a8a93f088dab577ae8

SHA256
26b9e6ca26b2d8804c89ec1f186aef9f5dea662e692d6311622e3afc6a8f3af8

SHA512
a998dfbf5146c119cc2ad9e137c15d2684f5b8c2f2791ae2586c04036f902c0950adc577e694d6983e7edf4e2b43e004dfbc24f7fb07f2b30cb2f43dc3e2a325

Download Submit
C:\Windows\System\xHdVZic.exe

Filesize
2.7MB

MD5
60c0f9fa1ee6ec60eca026c7daed550f

SHA1
579791e58320e1e1c69deffd3143007d7013d4a3

SHA256
c79145936e9e6a814423c6bce438fe504acf423b18daf67483023ea9c0fb048f

SHA512
4caffbcf745ac4c696c281f96381c4df406628b9e436b1cd9f6411cd9db03f5d4bd41bb044e45c69d5c1d07a248ad0c1e9b0e37557e0d0c345ea6ed09cc002ca

Download Submit
C:\Windows\System\xsofqUw.exe

Filesize
2.7MB

MD5
15a11c6340749e673d609287c7c0301a

SHA1
5fb6c51be87c7227353de14d1924d7559a3a432f

SHA256
b8dc5766a31b6261d348656d7732587e089ccea97eeae974a8d910a4ebe517ab

SHA512
c2425fb47a06190d7f9c1c831027e6e8d2b7d9ce4078b8047b3dc53ca06359fefb2882ca5a05d6d7554836c340eeeb26fa93ef3612db6d31628e06f5f4693c36

Download Submit
C:\Windows\System\zEQBfxi.exe

Filesize
2.7MB

MD5
85a5bf8b33cd3aff517e520c7f1a305c

SHA1
1e63ee1f8c5fb595f00e90bcf65ebf2a95cd0613

SHA256
1500f5f4497a214b5fb559ebbfc946ead77c042f5ceee751a1ad717db25dd924

SHA512
acfcc89a92f3fcc1e7aeaad707557fe0a48c40ff1660d7f9724d9ca2422756d9bd66945b7fc2cf7bb7c60dde3e24943374a467ec1b231a5209c392754033170b

Download Submit
memory/464-3539-0x00007FF6D0B50000-0x00007FF6D0F42000-memory.dmp

Filesize
3.9MB

Download
memory/464-328-0x00007FF6D0B50000-0x00007FF6D0F42000-memory.dmp

Filesize
3.9MB

Download
memory/1072-327-0x00007FF6BD7C0000-0x00007FF6BDBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-3502-0x00007FF6BD7C0000-0x00007FF6BDBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-89-0x00007FF7971C0000-0x00007FF7975B2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3465-0x00007FF7971C0000-0x00007FF7975B2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-3480-0x00007FF697980000-0x00007FF697D72000-memory.dmp

Filesize
3.9MB

Download
memory/1784-270-0x00007FF697980000-0x00007FF697D72000-memory.dmp

Filesize
3.9MB

Download
memory/1836-3477-0x00007FF6252B0000-0x00007FF6256A2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-224-0x00007FF6252B0000-0x00007FF6256A2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-3564-0x00007FF6A61B0000-0x00007FF6A65A2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-319-0x00007FF6A61B0000-0x00007FF6A65A2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-326-0x00007FF7D55C0000-0x00007FF7D59B2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-3499-0x00007FF7D55C0000-0x00007FF7D59B2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-3515-0x00007FF663870000-0x00007FF663C62000-memory.dmp

Filesize
3.9MB

Download
memory/2148-309-0x00007FF663870000-0x00007FF663C62000-memory.dmp

Filesize
3.9MB

Download
memory/2188-3457-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-214-0x00007FF629FF0000-0x00007FF62A3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-3493-0x00007FF7D2FC0000-0x00007FF7D33B2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-317-0x00007FF7D2FC0000-0x00007FF7D33B2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-325-0x00007FF680600000-0x00007FF6809F2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3453-0x00007FF680600000-0x00007FF6809F2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-322-0x00007FF7CCA10000-0x00007FF7CCE02000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3490-0x00007FF7CCA10000-0x00007FF7CCE02000-memory.dmp

Filesize
3.9MB

Download
memory/2672-275-0x00007FF7853F0000-0x00007FF7857E2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-3512-0x00007FF7853F0000-0x00007FF7857E2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-291-0x00007FF68FB30000-0x00007FF68FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3509-0x00007FF68FB30000-0x00007FF68FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2936-3461-0x00007FF659DC0000-0x00007FF65A1B2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-118-0x00007FF659DC0000-0x00007FF65A1B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-320-0x00007FF74EAC0000-0x00007FF74EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-3557-0x00007FF74EAC0000-0x00007FF74EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3424-13-0x00007FF630940000-0x00007FF630D32000-memory.dmp

Filesize
3.9MB

Download
memory/3600-323-0x00007FF605920000-0x00007FF605D12000-memory.dmp

Filesize
3.9MB

Download
memory/3600-3488-0x00007FF605920000-0x00007FF605D12000-memory.dmp

Filesize
3.9MB

Download
memory/4104-318-0x00007FF73B9F0000-0x00007FF73BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-3506-0x00007FF73B9F0000-0x00007FF73BDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-14-0x00007FFC95BC3000-0x00007FFC95BC5000-memory.dmp

Filesize
8KB

Download
memory/4488-67-0x00007FFC95BC0000-0x00007FFC96681000-memory.dmp

Filesize
10.8MB

Download
memory/4488-201-0x00007FFC95BC0000-0x00007FFC96681000-memory.dmp

Filesize
10.8MB

Download
memory/4488-239-0x000001DF71970000-0x000001DF71992000-memory.dmp

Filesize
136KB

Download
memory/4488-394-0x000001DF72A60000-0x000001DF73206000-memory.dmp

Filesize
7.6MB

Download
memory/4512-321-0x00007FF763BA0000-0x00007FF763F92000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3486-0x00007FF763BA0000-0x00007FF763F92000-memory.dmp

Filesize
3.9MB

Download
memory/4576-324-0x00007FF79C260000-0x00007FF79C652000-memory.dmp

Filesize
3.9MB

Download
memory/4736-0-0x00007FF6E5A20000-0x00007FF6E5E12000-memory.dmp

Filesize
3.9MB

Download
memory/4736-1-0x00000147DE3D0000-0x00000147DE3E0000-memory.dmp

Filesize
64KB

Download
memory/4744-288-0x00007FF716CD0000-0x00007FF7170C2000-memory.dmp

Filesize
3.9MB

Download
memory/4744-3498-0x00007FF716CD0000-0x00007FF7170C2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-264-0x00007FF61A580000-0x00007FF61A972000-memory.dmp

Filesize
3.9MB

Download
memory/4956-3472-0x00007FF61A580000-0x00007FF61A972000-memory.dmp

Filesize
3.9MB

Download
memory/5036-307-0x00007FF67CEA0000-0x00007FF67D292000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3508-0x00007FF67CEA0000-0x00007FF67D292000-memory.dmp

Filesize
3.9MB

Download