xmrig | 1315d453bcf830762a05bba3a17659927b50fd95ee270ba17cd02e24dfba1672

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
Size

1.9MB
MD5

20ddccc50edec52f67a9a64a4c2ccf34
SHA1

bb9b36d74d3edd73e5892ac8af0ec1b4d895c9d7
SHA256

1315d453bcf830762a05bba3a17659927b50fd95ee270ba17cd02e24dfba1672
SHA512

c4dca5217cf0ca77450a0bbcc1ccd4ee81ae7aab86d920cfc005e258c4d92240b9341373cbc45ce497d40982ad0de42de7cb45b26ed5fb34fe87218e29693445
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uk:NAB1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/4884-507-0x00007FF6E0930000-0x00007FF6E0D22000-memory.dmp	xmrig
behavioral2/memory/1824-570-0x00007FF77A640000-0x00007FF77AA32000-memory.dmp	xmrig
behavioral2/memory/3148-717-0x00007FF704210000-0x00007FF704602000-memory.dmp	xmrig
behavioral2/memory/2800-749-0x00007FF6E4160000-0x00007FF6E4552000-memory.dmp	xmrig
behavioral2/memory/1580-761-0x00007FF7EEB10000-0x00007FF7EEF02000-memory.dmp	xmrig
behavioral2/memory/3716-770-0x00007FF6B8570000-0x00007FF6B8962000-memory.dmp	xmrig
behavioral2/memory/3528-771-0x00007FF6A11B0000-0x00007FF6A15A2000-memory.dmp	xmrig
behavioral2/memory/3880-769-0x00007FF6E7AC0000-0x00007FF6E7EB2000-memory.dmp	xmrig
behavioral2/memory/2744-768-0x00007FF69B070000-0x00007FF69B462000-memory.dmp	xmrig
behavioral2/memory/2896-767-0x00007FF65BAB0000-0x00007FF65BEA2000-memory.dmp	xmrig
behavioral2/memory/4172-766-0x00007FF63E7D0000-0x00007FF63EBC2000-memory.dmp	xmrig
behavioral2/memory/820-765-0x00007FF7EFB50000-0x00007FF7EFF42000-memory.dmp	xmrig
behavioral2/memory/3384-764-0x00007FF72F8C0000-0x00007FF72FCB2000-memory.dmp	xmrig
behavioral2/memory/1196-763-0x00007FF61FA40000-0x00007FF61FE32000-memory.dmp	xmrig
behavioral2/memory/3264-762-0x00007FF6D8A90000-0x00007FF6D8E82000-memory.dmp	xmrig
behavioral2/memory/3884-760-0x00007FF6BE800000-0x00007FF6BEBF2000-memory.dmp	xmrig
behavioral2/memory/2320-759-0x00007FF6985C0000-0x00007FF6989B2000-memory.dmp	xmrig
behavioral2/memory/3328-416-0x00007FF6EF640000-0x00007FF6EFA32000-memory.dmp	xmrig
behavioral2/memory/3228-341-0x00007FF736280000-0x00007FF736672000-memory.dmp	xmrig
behavioral2/memory/2040-292-0x00007FF6AE0B0000-0x00007FF6AE4A2000-memory.dmp	xmrig
behavioral2/memory/3716-4402-0x00007FF6B8570000-0x00007FF6B8962000-memory.dmp	xmrig
behavioral2/memory/2320-4406-0x00007FF6985C0000-0x00007FF6989B2000-memory.dmp	xmrig
behavioral2/memory/3148-4419-0x00007FF704210000-0x00007FF704602000-memory.dmp	xmrig
behavioral2/memory/2800-4415-0x00007FF6E4160000-0x00007FF6E4552000-memory.dmp	xmrig
behavioral2/memory/1824-4412-0x00007FF77A640000-0x00007FF77AA32000-memory.dmp	xmrig
behavioral2/memory/3228-4422-0x00007FF736280000-0x00007FF736672000-memory.dmp	xmrig
behavioral2/memory/4884-4438-0x00007FF6E0930000-0x00007FF6E0D22000-memory.dmp	xmrig
behavioral2/memory/3384-4462-0x00007FF72F8C0000-0x00007FF72FCB2000-memory.dmp	xmrig
behavioral2/memory/4172-4465-0x00007FF63E7D0000-0x00007FF63EBC2000-memory.dmp	xmrig
behavioral2/memory/1580-4476-0x00007FF7EEB10000-0x00007FF7EEF02000-memory.dmp	xmrig
behavioral2/memory/2896-4478-0x00007FF65BAB0000-0x00007FF65BEA2000-memory.dmp	xmrig
behavioral2/memory/3884-4474-0x00007FF6BE800000-0x00007FF6BEBF2000-memory.dmp	xmrig
behavioral2/memory/1196-4452-0x00007FF61FA40000-0x00007FF61FE32000-memory.dmp	xmrig
behavioral2/memory/2744-4456-0x00007FF69B070000-0x00007FF69B462000-memory.dmp	xmrig
behavioral2/memory/3528-4444-0x00007FF6A11B0000-0x00007FF6A15A2000-memory.dmp	xmrig
behavioral2/memory/3264-4448-0x00007FF6D8A90000-0x00007FF6D8E82000-memory.dmp	xmrig
behavioral2/memory/820-4430-0x00007FF7EFB50000-0x00007FF7EFF42000-memory.dmp	xmrig
behavioral2/memory/3328-4434-0x00007FF6EF640000-0x00007FF6EFA32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2388	powershell.exe
11	2388	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5060	gDriXye.exe
3204	APAcbzZ.exe
4448	XFYMKRm.exe
1412	DKojHan.exe
2040	ZBWInCR.exe
3880	UMivQMH.exe
3716	LJGgCdt.exe
3228	JIQiOLf.exe
3328	VoHVfwV.exe
3528	Rapjyog.exe
4884	LuGfpNb.exe
1824	oGeWtIE.exe
3148	tSVizuL.exe
2800	dKJGSeB.exe
2320	reJJTtV.exe
3884	zBgEpwi.exe
1580	tetWXUy.exe
3264	JwQbUwx.exe
1196	bmDpNOY.exe
3384	ghblxNJ.exe
820	dAGKMJD.exe
4172	YLyYicA.exe
2896	YbjHitA.exe
2744	pPafOkA.exe
1188	XsjCCkm.exe
464	hMVggyG.exe
4528	LWYdzrp.exe
3452	wWyLYrP.exe
1656	UrcGCbA.exe
5016	MDCqNkn.exe
2672	AcyhDys.exe
1240	qkrslfF.exe
5056	nuenqvW.exe
1728	rauTkns.exe
1304	DCrgLKP.exe
3224	dqGAZmg.exe
380	cVLQcNF.exe
4080	ZmPiwhz.exe
2480	vynBMpy.exe
3812	LBLdMYi.exe
3252	cehIjGS.exe
2704	eGdeASE.exe
456	FXmbQGR.exe
4964	jUgRCXj.exe
4092	zddSEnG.exe
4744	rbWbMAx.exe
4056	JRfeczG.exe
2268	BmWhzwa.exe
4024	ItqteRV.exe
1868	DnbZvnj.exe
1792	JKpILJW.exe
3460	nGeQGpc.exe
220	ivlMTDd.exe
4480	SaNCOvk.exe
4548	TlNAsWt.exe
556	ttrdlXY.exe
116	sdJhNmr.exe
208	nAsLbIf.exe
4340	ZiGLjla.exe
400	ngLayTe.exe
1772	dikQWke.exe
3980	hOmDuFN.exe
544	ZjXHexC.exe
4260	WqEbmGN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2440-0-0x00007FF6DF340000-0x00007FF6DF732000-memory.dmp	upx
behavioral2/files/0x000e000000023b9d-5.dat	upx
behavioral2/files/0x000a000000023bab-8.dat	upx
behavioral2/files/0x000a000000023bac-7.dat	upx
behavioral2/memory/3204-17-0x00007FF738B10000-0x00007FF738F02000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-33.dat	upx
behavioral2/files/0x0031000000023bbe-98.dat	upx
behavioral2/files/0x000a000000023bd0-201.dat	upx
behavioral2/memory/4884-507-0x00007FF6E0930000-0x00007FF6E0D22000-memory.dmp	upx
behavioral2/memory/1824-570-0x00007FF77A640000-0x00007FF77AA32000-memory.dmp	upx
behavioral2/memory/3148-717-0x00007FF704210000-0x00007FF704602000-memory.dmp	upx
behavioral2/memory/2800-749-0x00007FF6E4160000-0x00007FF6E4552000-memory.dmp	upx
behavioral2/memory/1580-761-0x00007FF7EEB10000-0x00007FF7EEF02000-memory.dmp	upx
behavioral2/memory/3716-770-0x00007FF6B8570000-0x00007FF6B8962000-memory.dmp	upx
behavioral2/memory/3528-771-0x00007FF6A11B0000-0x00007FF6A15A2000-memory.dmp	upx
behavioral2/memory/3880-769-0x00007FF6E7AC0000-0x00007FF6E7EB2000-memory.dmp	upx
behavioral2/memory/2744-768-0x00007FF69B070000-0x00007FF69B462000-memory.dmp	upx
behavioral2/memory/2896-767-0x00007FF65BAB0000-0x00007FF65BEA2000-memory.dmp	upx
behavioral2/memory/4172-766-0x00007FF63E7D0000-0x00007FF63EBC2000-memory.dmp	upx
behavioral2/memory/820-765-0x00007FF7EFB50000-0x00007FF7EFF42000-memory.dmp	upx
behavioral2/memory/3384-764-0x00007FF72F8C0000-0x00007FF72FCB2000-memory.dmp	upx
behavioral2/memory/1196-763-0x00007FF61FA40000-0x00007FF61FE32000-memory.dmp	upx
behavioral2/memory/3264-762-0x00007FF6D8A90000-0x00007FF6D8E82000-memory.dmp	upx
behavioral2/memory/3884-760-0x00007FF6BE800000-0x00007FF6BEBF2000-memory.dmp	upx
behavioral2/memory/2320-759-0x00007FF6985C0000-0x00007FF6989B2000-memory.dmp	upx
behavioral2/memory/3328-416-0x00007FF6EF640000-0x00007FF6EFA32000-memory.dmp	upx
behavioral2/memory/3228-341-0x00007FF736280000-0x00007FF736672000-memory.dmp	upx
behavioral2/memory/2040-292-0x00007FF6AE0B0000-0x00007FF6AE4A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-206.dat	upx
behavioral2/files/0x000a000000023bcf-200.dat	upx
behavioral2/files/0x000a000000023bc6-199.dat	upx
behavioral2/files/0x000a000000023bce-195.dat	upx
behavioral2/files/0x000a000000023bc5-193.dat	upx
behavioral2/files/0x000a000000023bcd-189.dat	upx
behavioral2/files/0x000a000000023bcc-188.dat	upx
behavioral2/files/0x000a000000023bcb-185.dat	upx
behavioral2/files/0x000a000000023bc3-180.dat	upx
behavioral2/files/0x0031000000023bbd-176.dat	upx
behavioral2/files/0x0031000000023bbc-170.dat	upx
behavioral2/files/0x000a000000023bb4-167.dat	upx
behavioral2/files/0x000a000000023bba-164.dat	upx
behavioral2/files/0x000a000000023bc1-161.dat	upx
behavioral2/files/0x000a000000023bca-157.dat	upx
behavioral2/files/0x000a000000023bc0-156.dat	upx
behavioral2/files/0x000a000000023bc9-155.dat	upx
behavioral2/files/0x000a000000023bc8-150.dat	upx
behavioral2/files/0x000a000000023bb7-143.dat	upx
behavioral2/files/0x000a000000023bb8-140.dat	upx
behavioral2/files/0x000a000000023bb6-132.dat	upx
behavioral2/files/0x000a000000023bc4-120.dat	upx
behavioral2/files/0x000a000000023bc2-115.dat	upx
behavioral2/files/0x000a000000023bb0-112.dat	upx
behavioral2/files/0x000a000000023bb3-105.dat	upx
behavioral2/files/0x000a000000023bbf-104.dat	upx
behavioral2/files/0x000a000000023bb2-93.dat	upx
behavioral2/files/0x000a000000023bb5-117.dat	upx
behavioral2/files/0x000a000000023bbb-86.dat	upx
behavioral2/files/0x000a000000023bb1-79.dat	upx
behavioral2/files/0x000a000000023bb9-108.dat	upx
behavioral2/memory/1412-51-0x00007FF624920000-0x00007FF624D12000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-29.dat	upx
behavioral2/files/0x000a000000023bad-37.dat	upx
behavioral2/memory/4448-20-0x00007FF72B290000-0x00007FF72B682000-memory.dmp	upx
behavioral2/memory/5060-10-0x00007FF7897B0000-0x00007FF789BA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DZRwplT.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\rrSfIpR.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\iFfewbq.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\EQAgfEj.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\BTipvMh.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\mXpSVFx.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\KMnKWEF.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\vdfeZXi.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\UHpnrwD.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\EAgaBvQ.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\OUkvJkP.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\xDjSMPv.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\rXVIDsb.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\RHAsVvm.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\dCzpxIc.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\zoPxyYW.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\RdBnwZt.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\TMkTAXH.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\eQIrppQ.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\WpayKmP.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\ntweTJD.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\GOkdKsC.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\wMrWZsv.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\kiIgORW.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\UMhuJkY.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\FSHInGI.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\bUiMDzD.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\VuFQbjD.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\GbPxejo.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\GXGxQXN.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\eXLoYMK.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\PFMgaaZ.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\gEGLcjU.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\cRQODak.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\Gouafgw.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\cLKgTPP.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\cqHCHut.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\HXlazfB.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\EBRdHXS.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\uJpmDmD.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\CfBtqTk.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\sBtaRCL.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\TMbSgAY.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\PSedNsH.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\sOMhLgl.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\opNoKNQ.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\XYrccua.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\JaFJJcs.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\PGeavnp.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\VjnCJHa.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\WqEbmGN.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\XRLlxHd.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\MPYEYZX.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\enoXYEo.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\QSmeoZe.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\SZjoNSI.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\GyItJpf.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\JIQiOLf.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\HwlcMgx.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\uALysRB.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\TjdFOXb.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\IOuWCBn.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\ylYfDAk.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
File created	C:\Windows\System\fRILpCX.exe	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeLockMemoryPrivilege	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2388	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	84
PID 2440 wrote to memory of 2388	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	84
PID 2440 wrote to memory of 5060	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	85
PID 2440 wrote to memory of 5060	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	85
PID 2440 wrote to memory of 3204	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	86
PID 2440 wrote to memory of 3204	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	86
PID 2440 wrote to memory of 4448	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	87
PID 2440 wrote to memory of 4448	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	87
PID 2440 wrote to memory of 1412	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	88
PID 2440 wrote to memory of 1412	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	88
PID 2440 wrote to memory of 2040	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	89
PID 2440 wrote to memory of 2040	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	89
PID 2440 wrote to memory of 3880	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	90
PID 2440 wrote to memory of 3880	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	90
PID 2440 wrote to memory of 3528	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	91
PID 2440 wrote to memory of 3528	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	91
PID 2440 wrote to memory of 3716	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	92
PID 2440 wrote to memory of 3716	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	92
PID 2440 wrote to memory of 3228	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	93
PID 2440 wrote to memory of 3228	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	93
PID 2440 wrote to memory of 3328	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	94
PID 2440 wrote to memory of 3328	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	94
PID 2440 wrote to memory of 4884	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	95
PID 2440 wrote to memory of 4884	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	95
PID 2440 wrote to memory of 1824	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	96
PID 2440 wrote to memory of 1824	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	96
PID 2440 wrote to memory of 3148	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	97
PID 2440 wrote to memory of 3148	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	97
PID 2440 wrote to memory of 820	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	98
PID 2440 wrote to memory of 820	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	98
PID 2440 wrote to memory of 2800	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	99
PID 2440 wrote to memory of 2800	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	99
PID 2440 wrote to memory of 2320	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	100
PID 2440 wrote to memory of 2320	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	100
PID 2440 wrote to memory of 3884	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	101
PID 2440 wrote to memory of 3884	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	101
PID 2440 wrote to memory of 1580	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	102
PID 2440 wrote to memory of 1580	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	102
PID 2440 wrote to memory of 3264	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	103
PID 2440 wrote to memory of 3264	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	103
PID 2440 wrote to memory of 1196	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	104
PID 2440 wrote to memory of 1196	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	104
PID 2440 wrote to memory of 3384	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	105
PID 2440 wrote to memory of 3384	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	105
PID 2440 wrote to memory of 4172	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	106
PID 2440 wrote to memory of 4172	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	106
PID 2440 wrote to memory of 5016	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	107
PID 2440 wrote to memory of 5016	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	107
PID 2440 wrote to memory of 1240	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	108
PID 2440 wrote to memory of 1240	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	108
PID 2440 wrote to memory of 2896	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	109
PID 2440 wrote to memory of 2896	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	109
PID 2440 wrote to memory of 2744	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	110
PID 2440 wrote to memory of 2744	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	110
PID 2440 wrote to memory of 1188	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	111
PID 2440 wrote to memory of 1188	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	111
PID 2440 wrote to memory of 464	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	112
PID 2440 wrote to memory of 464	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	112
PID 2440 wrote to memory of 380	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	113
PID 2440 wrote to memory of 380	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	113
PID 2440 wrote to memory of 4528	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	114
PID 2440 wrote to memory of 4528	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	114
PID 2440 wrote to memory of 3452	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	115
PID 2440 wrote to memory of 3452	2440	20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20ddccc50edec52f67a9a64a4c2ccf34_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System\gDriXye.exe
  C:\Windows\System\gDriXye.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\APAcbzZ.exe
  C:\Windows\System\APAcbzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\XFYMKRm.exe
  C:\Windows\System\XFYMKRm.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\DKojHan.exe
  C:\Windows\System\DKojHan.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\ZBWInCR.exe
  C:\Windows\System\ZBWInCR.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\UMivQMH.exe
  C:\Windows\System\UMivQMH.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\Rapjyog.exe
  C:\Windows\System\Rapjyog.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\LJGgCdt.exe
  C:\Windows\System\LJGgCdt.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\JIQiOLf.exe
  C:\Windows\System\JIQiOLf.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\VoHVfwV.exe
  C:\Windows\System\VoHVfwV.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\LuGfpNb.exe
  C:\Windows\System\LuGfpNb.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\oGeWtIE.exe
  C:\Windows\System\oGeWtIE.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\tSVizuL.exe
  C:\Windows\System\tSVizuL.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\dAGKMJD.exe
  C:\Windows\System\dAGKMJD.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\dKJGSeB.exe
  C:\Windows\System\dKJGSeB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\reJJTtV.exe
  C:\Windows\System\reJJTtV.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\zBgEpwi.exe
  C:\Windows\System\zBgEpwi.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\tetWXUy.exe
  C:\Windows\System\tetWXUy.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\JwQbUwx.exe
  C:\Windows\System\JwQbUwx.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\bmDpNOY.exe
  C:\Windows\System\bmDpNOY.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\ghblxNJ.exe
  C:\Windows\System\ghblxNJ.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\YLyYicA.exe
  C:\Windows\System\YLyYicA.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\MDCqNkn.exe
  C:\Windows\System\MDCqNkn.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\qkrslfF.exe
  C:\Windows\System\qkrslfF.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\YbjHitA.exe
  C:\Windows\System\YbjHitA.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\pPafOkA.exe
  C:\Windows\System\pPafOkA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\XsjCCkm.exe
  C:\Windows\System\XsjCCkm.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\hMVggyG.exe
  C:\Windows\System\hMVggyG.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\cVLQcNF.exe
  C:\Windows\System\cVLQcNF.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\LWYdzrp.exe
  C:\Windows\System\LWYdzrp.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\wWyLYrP.exe
  C:\Windows\System\wWyLYrP.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\UrcGCbA.exe
  C:\Windows\System\UrcGCbA.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\AcyhDys.exe
  C:\Windows\System\AcyhDys.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\nuenqvW.exe
  C:\Windows\System\nuenqvW.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\rauTkns.exe
  C:\Windows\System\rauTkns.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\DCrgLKP.exe
  C:\Windows\System\DCrgLKP.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\dqGAZmg.exe
  C:\Windows\System\dqGAZmg.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\ZmPiwhz.exe
  C:\Windows\System\ZmPiwhz.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\vynBMpy.exe
  C:\Windows\System\vynBMpy.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\LBLdMYi.exe
  C:\Windows\System\LBLdMYi.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\cehIjGS.exe
  C:\Windows\System\cehIjGS.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\eGdeASE.exe
  C:\Windows\System\eGdeASE.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\FXmbQGR.exe
  C:\Windows\System\FXmbQGR.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\jUgRCXj.exe
  C:\Windows\System\jUgRCXj.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\zddSEnG.exe
  C:\Windows\System\zddSEnG.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\rbWbMAx.exe
  C:\Windows\System\rbWbMAx.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\JRfeczG.exe
  C:\Windows\System\JRfeczG.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\BmWhzwa.exe
  C:\Windows\System\BmWhzwa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ItqteRV.exe
  C:\Windows\System\ItqteRV.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\tezADFu.exe
  C:\Windows\System\tezADFu.exe
  2⤵
  PID:408
- C:\Windows\System\DnbZvnj.exe
  C:\Windows\System\DnbZvnj.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\JKpILJW.exe
  C:\Windows\System\JKpILJW.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\nGeQGpc.exe
  C:\Windows\System\nGeQGpc.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ivlMTDd.exe
  C:\Windows\System\ivlMTDd.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\SaNCOvk.exe
  C:\Windows\System\SaNCOvk.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\TlNAsWt.exe
  C:\Windows\System\TlNAsWt.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ttrdlXY.exe
  C:\Windows\System\ttrdlXY.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\sdJhNmr.exe
  C:\Windows\System\sdJhNmr.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\nAsLbIf.exe
  C:\Windows\System\nAsLbIf.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ZiGLjla.exe
  C:\Windows\System\ZiGLjla.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\ngLayTe.exe
  C:\Windows\System\ngLayTe.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\dikQWke.exe
  C:\Windows\System\dikQWke.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\hOmDuFN.exe
  C:\Windows\System\hOmDuFN.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\ZjXHexC.exe
  C:\Windows\System\ZjXHexC.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\WqEbmGN.exe
  C:\Windows\System\WqEbmGN.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\ikNstNu.exe
  C:\Windows\System\ikNstNu.exe
  2⤵
  PID:1632
- C:\Windows\System\GPdcELq.exe
  C:\Windows\System\GPdcELq.exe
  2⤵
  PID:2716
- C:\Windows\System\lYPUeZi.exe
  C:\Windows\System\lYPUeZi.exe
  2⤵
  PID:4728
- C:\Windows\System\fVcufTI.exe
  C:\Windows\System\fVcufTI.exe
  2⤵
  PID:2120
- C:\Windows\System\JxdcbpK.exe
  C:\Windows\System\JxdcbpK.exe
  2⤵
  PID:8
- C:\Windows\System\zdBxEYR.exe
  C:\Windows\System\zdBxEYR.exe
  2⤵
  PID:2396
- C:\Windows\System\omVnbaw.exe
  C:\Windows\System\omVnbaw.exe
  2⤵
  PID:2684
- C:\Windows\System\nWdbdZR.exe
  C:\Windows\System\nWdbdZR.exe
  2⤵
  PID:772
- C:\Windows\System\osXOaEz.exe
  C:\Windows\System\osXOaEz.exe
  2⤵
  PID:2720
- C:\Windows\System\NiHItAR.exe
  C:\Windows\System\NiHItAR.exe
  2⤵
  PID:1608
- C:\Windows\System\MGjCeQf.exe
  C:\Windows\System\MGjCeQf.exe
  2⤵
  PID:2196
- C:\Windows\System\HPeHALn.exe
  C:\Windows\System\HPeHALn.exe
  2⤵
  PID:2692
- C:\Windows\System\tDMlvvG.exe
  C:\Windows\System\tDMlvvG.exe
  2⤵
  PID:4160
- C:\Windows\System\GGIqKGD.exe
  C:\Windows\System\GGIqKGD.exe
  2⤵
  PID:5136
- C:\Windows\System\cqWLEdf.exe
  C:\Windows\System\cqWLEdf.exe
  2⤵
  PID:5188
- C:\Windows\System\daLGPsY.exe
  C:\Windows\System\daLGPsY.exe
  2⤵
  PID:5208
- C:\Windows\System\PEOFxir.exe
  C:\Windows\System\PEOFxir.exe
  2⤵
  PID:5240
- C:\Windows\System\WoaAETK.exe
  C:\Windows\System\WoaAETK.exe
  2⤵
  PID:5264
- C:\Windows\System\OAzwewc.exe
  C:\Windows\System\OAzwewc.exe
  2⤵
  PID:5292
- C:\Windows\System\pgkdsUW.exe
  C:\Windows\System\pgkdsUW.exe
  2⤵
  PID:5316
- C:\Windows\System\VeDZBem.exe
  C:\Windows\System\VeDZBem.exe
  2⤵
  PID:5340
- C:\Windows\System\PhLNHWJ.exe
  C:\Windows\System\PhLNHWJ.exe
  2⤵
  PID:5360
- C:\Windows\System\fBSiPvD.exe
  C:\Windows\System\fBSiPvD.exe
  2⤵
  PID:5376
- C:\Windows\System\vDvtSre.exe
  C:\Windows\System\vDvtSre.exe
  2⤵
  PID:5392
- C:\Windows\System\totcikL.exe
  C:\Windows\System\totcikL.exe
  2⤵
  PID:5412
- C:\Windows\System\eQAuEbs.exe
  C:\Windows\System\eQAuEbs.exe
  2⤵
  PID:5432
- C:\Windows\System\lHiCWsZ.exe
  C:\Windows\System\lHiCWsZ.exe
  2⤵
  PID:5456
- C:\Windows\System\DOTYBZs.exe
  C:\Windows\System\DOTYBZs.exe
  2⤵
  PID:5476
- C:\Windows\System\EzdJLmZ.exe
  C:\Windows\System\EzdJLmZ.exe
  2⤵
  PID:5496
- C:\Windows\System\kfwjLjc.exe
  C:\Windows\System\kfwjLjc.exe
  2⤵
  PID:5512
- C:\Windows\System\MyfhHgm.exe
  C:\Windows\System\MyfhHgm.exe
  2⤵
  PID:5536
- C:\Windows\System\WZXwcBY.exe
  C:\Windows\System\WZXwcBY.exe
  2⤵
  PID:5620
- C:\Windows\System\PSHWmqc.exe
  C:\Windows\System\PSHWmqc.exe
  2⤵
  PID:5636
- C:\Windows\System\AHrXcdO.exe
  C:\Windows\System\AHrXcdO.exe
  2⤵
  PID:5668
- C:\Windows\System\ySVXUMK.exe
  C:\Windows\System\ySVXUMK.exe
  2⤵
  PID:5716
- C:\Windows\System\yKjEWVq.exe
  C:\Windows\System\yKjEWVq.exe
  2⤵
  PID:5744
- C:\Windows\System\rBMZBce.exe
  C:\Windows\System\rBMZBce.exe
  2⤵
  PID:5760
- C:\Windows\System\ogRXZSy.exe
  C:\Windows\System\ogRXZSy.exe
  2⤵
  PID:5780
- C:\Windows\System\CEbffAa.exe
  C:\Windows\System\CEbffAa.exe
  2⤵
  PID:5804
- C:\Windows\System\RrMpXMa.exe
  C:\Windows\System\RrMpXMa.exe
  2⤵
  PID:5824
- C:\Windows\System\xmrwnAN.exe
  C:\Windows\System\xmrwnAN.exe
  2⤵
  PID:5848
- C:\Windows\System\TmRFlrq.exe
  C:\Windows\System\TmRFlrq.exe
  2⤵
  PID:5864
- C:\Windows\System\isbtrQQ.exe
  C:\Windows\System\isbtrQQ.exe
  2⤵
  PID:5888
- C:\Windows\System\HEiDUYH.exe
  C:\Windows\System\HEiDUYH.exe
  2⤵
  PID:5916
- C:\Windows\System\KJkXHfu.exe
  C:\Windows\System\KJkXHfu.exe
  2⤵
  PID:5932
- C:\Windows\System\aKBfqic.exe
  C:\Windows\System\aKBfqic.exe
  2⤵
  PID:5952
- C:\Windows\System\SShryxo.exe
  C:\Windows\System\SShryxo.exe
  2⤵
  PID:6028
- C:\Windows\System\uPhEWoo.exe
  C:\Windows\System\uPhEWoo.exe
  2⤵
  PID:6056
- C:\Windows\System\Fukpwyo.exe
  C:\Windows\System\Fukpwyo.exe
  2⤵
  PID:6072
- C:\Windows\System\aeuxbWy.exe
  C:\Windows\System\aeuxbWy.exe
  2⤵
  PID:6096
- C:\Windows\System\dRQhNZW.exe
  C:\Windows\System\dRQhNZW.exe
  2⤵
  PID:4408
- C:\Windows\System\ruBNmyQ.exe
  C:\Windows\System\ruBNmyQ.exe
  2⤵
  PID:920
- C:\Windows\System\nEZjEey.exe
  C:\Windows\System\nEZjEey.exe
  2⤵
  PID:392
- C:\Windows\System\XjvggZs.exe
  C:\Windows\System\XjvggZs.exe
  2⤵
  PID:3176
- C:\Windows\System\eBkhYhk.exe
  C:\Windows\System\eBkhYhk.exe
  2⤵
  PID:4364
- C:\Windows\System\CRBrhqV.exe
  C:\Windows\System\CRBrhqV.exe
  2⤵
  PID:3788
- C:\Windows\System\TmzHZnQ.exe
  C:\Windows\System\TmzHZnQ.exe
  2⤵
  PID:3792
- C:\Windows\System\VxUsKAB.exe
  C:\Windows\System\VxUsKAB.exe
  2⤵
  PID:4508
- C:\Windows\System\whQctsv.exe
  C:\Windows\System\whQctsv.exe
  2⤵
  PID:2868
- C:\Windows\System\UgbFSKX.exe
  C:\Windows\System\UgbFSKX.exe
  2⤵
  PID:2132
- C:\Windows\System\sQfUuQQ.exe
  C:\Windows\System\sQfUuQQ.exe
  2⤵
  PID:4524
- C:\Windows\System\RZPVEYe.exe
  C:\Windows\System\RZPVEYe.exe
  2⤵
  PID:5388
- C:\Windows\System\JDMDDUj.exe
  C:\Windows\System\JDMDDUj.exe
  2⤵
  PID:5508
- C:\Windows\System\thwMRLu.exe
  C:\Windows\System\thwMRLu.exe
  2⤵
  PID:4320
- C:\Windows\System\HzDesDV.exe
  C:\Windows\System\HzDesDV.exe
  2⤵
  PID:3524
- C:\Windows\System\JWQLMNY.exe
  C:\Windows\System\JWQLMNY.exe
  2⤵
  PID:3732
- C:\Windows\System\lVFRkiJ.exe
  C:\Windows\System\lVFRkiJ.exe
  2⤵
  PID:3876
- C:\Windows\System\oSOiUkJ.exe
  C:\Windows\System\oSOiUkJ.exe
  2⤵
  PID:880
- C:\Windows\System\XxxJCnM.exe
  C:\Windows\System\XxxJCnM.exe
  2⤵
  PID:5280
- C:\Windows\System\OLFDRKH.exe
  C:\Windows\System\OLFDRKH.exe
  2⤵
  PID:5724
- C:\Windows\System\gYsIZuh.exe
  C:\Windows\System\gYsIZuh.exe
  2⤵
  PID:5900
- C:\Windows\System\DWdchzz.exe
  C:\Windows\System\DWdchzz.exe
  2⤵
  PID:5532
- C:\Windows\System\mcXBCPD.exe
  C:\Windows\System\mcXBCPD.exe
  2⤵
  PID:6164
- C:\Windows\System\vChvIid.exe
  C:\Windows\System\vChvIid.exe
  2⤵
  PID:6204
- C:\Windows\System\lFzueKe.exe
  C:\Windows\System\lFzueKe.exe
  2⤵
  PID:6228
- C:\Windows\System\eMcXjXy.exe
  C:\Windows\System\eMcXjXy.exe
  2⤵
  PID:6248
- C:\Windows\System\nRURmLq.exe
  C:\Windows\System\nRURmLq.exe
  2⤵
  PID:6272
- C:\Windows\System\bpWpKAp.exe
  C:\Windows\System\bpWpKAp.exe
  2⤵
  PID:6288
- C:\Windows\System\FnDOLQF.exe
  C:\Windows\System\FnDOLQF.exe
  2⤵
  PID:6316
- C:\Windows\System\juazSxg.exe
  C:\Windows\System\juazSxg.exe
  2⤵
  PID:6332
- C:\Windows\System\YmLlsGm.exe
  C:\Windows\System\YmLlsGm.exe
  2⤵
  PID:6348
- C:\Windows\System\LBWaeJi.exe
  C:\Windows\System\LBWaeJi.exe
  2⤵
  PID:6364
- C:\Windows\System\PRSPSTl.exe
  C:\Windows\System\PRSPSTl.exe
  2⤵
  PID:6380
- C:\Windows\System\dppfcme.exe
  C:\Windows\System\dppfcme.exe
  2⤵
  PID:6400
- C:\Windows\System\GkyWEAY.exe
  C:\Windows\System\GkyWEAY.exe
  2⤵
  PID:6420
- C:\Windows\System\SHeERRb.exe
  C:\Windows\System\SHeERRb.exe
  2⤵
  PID:6452
- C:\Windows\System\gYclGeo.exe
  C:\Windows\System\gYclGeo.exe
  2⤵
  PID:6476
- C:\Windows\System\zzLzHHJ.exe
  C:\Windows\System\zzLzHHJ.exe
  2⤵
  PID:6504
- C:\Windows\System\gOaCHzP.exe
  C:\Windows\System\gOaCHzP.exe
  2⤵
  PID:6524
- C:\Windows\System\wlCAMYJ.exe
  C:\Windows\System\wlCAMYJ.exe
  2⤵
  PID:6556
- C:\Windows\System\rZxXEQl.exe
  C:\Windows\System\rZxXEQl.exe
  2⤵
  PID:6572
- C:\Windows\System\BXAmUgb.exe
  C:\Windows\System\BXAmUgb.exe
  2⤵
  PID:6596
- C:\Windows\System\mgBKnbh.exe
  C:\Windows\System\mgBKnbh.exe
  2⤵
  PID:6616
- C:\Windows\System\VEwaHhy.exe
  C:\Windows\System\VEwaHhy.exe
  2⤵
  PID:6632
- C:\Windows\System\IvKmtxV.exe
  C:\Windows\System\IvKmtxV.exe
  2⤵
  PID:6656
- C:\Windows\System\bdCoUoh.exe
  C:\Windows\System\bdCoUoh.exe
  2⤵
  PID:6676
- C:\Windows\System\GjJXQPh.exe
  C:\Windows\System\GjJXQPh.exe
  2⤵
  PID:6696
- C:\Windows\System\lEeQDaB.exe
  C:\Windows\System\lEeQDaB.exe
  2⤵
  PID:6720
- C:\Windows\System\SgXykPi.exe
  C:\Windows\System\SgXykPi.exe
  2⤵
  PID:6736
- C:\Windows\System\rYkpQbn.exe
  C:\Windows\System\rYkpQbn.exe
  2⤵
  PID:6756
- C:\Windows\System\uWUAmZd.exe
  C:\Windows\System\uWUAmZd.exe
  2⤵
  PID:6772
- C:\Windows\System\qKepCEG.exe
  C:\Windows\System\qKepCEG.exe
  2⤵
  PID:6796
- C:\Windows\System\EJGjFQA.exe
  C:\Windows\System\EJGjFQA.exe
  2⤵
  PID:6816
- C:\Windows\System\UAJGuvv.exe
  C:\Windows\System\UAJGuvv.exe
  2⤵
  PID:6836
- C:\Windows\System\vPKoMFA.exe
  C:\Windows\System\vPKoMFA.exe
  2⤵
  PID:6852
- C:\Windows\System\MPulUqy.exe
  C:\Windows\System\MPulUqy.exe
  2⤵
  PID:6876
- C:\Windows\System\GGcNTXV.exe
  C:\Windows\System\GGcNTXV.exe
  2⤵
  PID:6892
- C:\Windows\System\DkUVSjD.exe
  C:\Windows\System\DkUVSjD.exe
  2⤵
  PID:6916
- C:\Windows\System\zGSudLt.exe
  C:\Windows\System\zGSudLt.exe
  2⤵
  PID:6932
- C:\Windows\System\drWxzyb.exe
  C:\Windows\System\drWxzyb.exe
  2⤵
  PID:6968
- C:\Windows\System\XsBAtZh.exe
  C:\Windows\System\XsBAtZh.exe
  2⤵
  PID:6984
- C:\Windows\System\lJmPHUM.exe
  C:\Windows\System\lJmPHUM.exe
  2⤵
  PID:7012
- C:\Windows\System\QMNFeSB.exe
  C:\Windows\System\QMNFeSB.exe
  2⤵
  PID:7028
- C:\Windows\System\lSWPngj.exe
  C:\Windows\System\lSWPngj.exe
  2⤵
  PID:7052
- C:\Windows\System\OreaLSP.exe
  C:\Windows\System\OreaLSP.exe
  2⤵
  PID:7068
- C:\Windows\System\DrsMXls.exe
  C:\Windows\System\DrsMXls.exe
  2⤵
  PID:7100
- C:\Windows\System\qfkGJYh.exe
  C:\Windows\System\qfkGJYh.exe
  2⤵
  PID:7124
- C:\Windows\System\JUIHeNl.exe
  C:\Windows\System\JUIHeNl.exe
  2⤵
  PID:7144
- C:\Windows\System\EmzTyEO.exe
  C:\Windows\System\EmzTyEO.exe
  2⤵
  PID:5176
- C:\Windows\System\ZVuxJbi.exe
  C:\Windows\System\ZVuxJbi.exe
  2⤵
  PID:2240
- C:\Windows\System\ysFiwMU.exe
  C:\Windows\System\ysFiwMU.exe
  2⤵
  PID:5632
- C:\Windows\System\kLovCkh.exe
  C:\Windows\System\kLovCkh.exe
  2⤵
  PID:2144
- C:\Windows\System\xihKGoZ.exe
  C:\Windows\System\xihKGoZ.exe
  2⤵
  PID:5660
- C:\Windows\System\ogQnAxz.exe
  C:\Windows\System\ogQnAxz.exe
  2⤵
  PID:4072
- C:\Windows\System\CMDxaUn.exe
  C:\Windows\System\CMDxaUn.exe
  2⤵
  PID:5304
- C:\Windows\System\ffDTtJg.exe
  C:\Windows\System\ffDTtJg.exe
  2⤵
  PID:5332
- C:\Windows\System\lViVuGC.exe
  C:\Windows\System\lViVuGC.exe
  2⤵
  PID:7252
- C:\Windows\System\iyiqDoS.exe
  C:\Windows\System\iyiqDoS.exe
  2⤵
  PID:7268
- C:\Windows\System\MqqeAhH.exe
  C:\Windows\System\MqqeAhH.exe
  2⤵
  PID:7284
- C:\Windows\System\gyqXdhZ.exe
  C:\Windows\System\gyqXdhZ.exe
  2⤵
  PID:7300
- C:\Windows\System\SNGPaAS.exe
  C:\Windows\System\SNGPaAS.exe
  2⤵
  PID:7316
- C:\Windows\System\gsqFjjZ.exe
  C:\Windows\System\gsqFjjZ.exe
  2⤵
  PID:7332
- C:\Windows\System\rEleBCU.exe
  C:\Windows\System\rEleBCU.exe
  2⤵
  PID:7348
- C:\Windows\System\zNbptoG.exe
  C:\Windows\System\zNbptoG.exe
  2⤵
  PID:7364
- C:\Windows\System\ofdfBWZ.exe
  C:\Windows\System\ofdfBWZ.exe
  2⤵
  PID:7380
- C:\Windows\System\daTRLve.exe
  C:\Windows\System\daTRLve.exe
  2⤵
  PID:7396
- C:\Windows\System\MScablZ.exe
  C:\Windows\System\MScablZ.exe
  2⤵
  PID:7412
- C:\Windows\System\ILfTzHg.exe
  C:\Windows\System\ILfTzHg.exe
  2⤵
  PID:7428
- C:\Windows\System\gEFXaaq.exe
  C:\Windows\System\gEFXaaq.exe
  2⤵
  PID:7448
- C:\Windows\System\fjadwqT.exe
  C:\Windows\System\fjadwqT.exe
  2⤵
  PID:7468
- C:\Windows\System\yuqwMfT.exe
  C:\Windows\System\yuqwMfT.exe
  2⤵
  PID:7500
- C:\Windows\System\nfWdFCs.exe
  C:\Windows\System\nfWdFCs.exe
  2⤵
  PID:7568
- C:\Windows\System\xmdcAdc.exe
  C:\Windows\System\xmdcAdc.exe
  2⤵
  PID:7716
- C:\Windows\System\wynMsHA.exe
  C:\Windows\System\wynMsHA.exe
  2⤵
  PID:7736
- C:\Windows\System\xOcouGg.exe
  C:\Windows\System\xOcouGg.exe
  2⤵
  PID:7752
- C:\Windows\System\wDebKCt.exe
  C:\Windows\System\wDebKCt.exe
  2⤵
  PID:7768
- C:\Windows\System\atHOODu.exe
  C:\Windows\System\atHOODu.exe
  2⤵
  PID:7784
- C:\Windows\System\oeqbTPF.exe
  C:\Windows\System\oeqbTPF.exe
  2⤵
  PID:7800
- C:\Windows\System\ShRnXMe.exe
  C:\Windows\System\ShRnXMe.exe
  2⤵
  PID:7824
- C:\Windows\System\ozcLnRi.exe
  C:\Windows\System\ozcLnRi.exe
  2⤵
  PID:7840
- C:\Windows\System\ETvbuYP.exe
  C:\Windows\System\ETvbuYP.exe
  2⤵
  PID:7864
- C:\Windows\System\FyRBCcs.exe
  C:\Windows\System\FyRBCcs.exe
  2⤵
  PID:7888
- C:\Windows\System\jlKDOtf.exe
  C:\Windows\System\jlKDOtf.exe
  2⤵
  PID:7908
- C:\Windows\System\uslJpZl.exe
  C:\Windows\System\uslJpZl.exe
  2⤵
  PID:7928
- C:\Windows\System\GSfkpYN.exe
  C:\Windows\System\GSfkpYN.exe
  2⤵
  PID:7952
- C:\Windows\System\bLtjNCD.exe
  C:\Windows\System\bLtjNCD.exe
  2⤵
  PID:7976
- C:\Windows\System\avPqSEO.exe
  C:\Windows\System\avPqSEO.exe
  2⤵
  PID:8004
- C:\Windows\System\wAveOsY.exe
  C:\Windows\System\wAveOsY.exe
  2⤵
  PID:8020
- C:\Windows\System\TJrRVMI.exe
  C:\Windows\System\TJrRVMI.exe
  2⤵
  PID:8044
- C:\Windows\System\oIYnkgO.exe
  C:\Windows\System\oIYnkgO.exe
  2⤵
  PID:8068
- C:\Windows\System\JRozgIc.exe
  C:\Windows\System\JRozgIc.exe
  2⤵
  PID:8096
- C:\Windows\System\ivVTjij.exe
  C:\Windows\System\ivVTjij.exe
  2⤵
  PID:8112
- C:\Windows\System\cuLyfcz.exe
  C:\Windows\System\cuLyfcz.exe
  2⤵
  PID:8136
- C:\Windows\System\ALVNAQK.exe
  C:\Windows\System\ALVNAQK.exe
  2⤵
  PID:8156
- C:\Windows\System\LvLXDTB.exe
  C:\Windows\System\LvLXDTB.exe
  2⤵
  PID:8188
- C:\Windows\System\qnlDGnb.exe
  C:\Windows\System\qnlDGnb.exe
  2⤵
  PID:5948
- C:\Windows\System\yPjaQbG.exe
  C:\Windows\System\yPjaQbG.exe
  2⤵
  PID:6624
- C:\Windows\System\wLlsZLp.exe
  C:\Windows\System\wLlsZLp.exe
  2⤵
  PID:6844
- C:\Windows\System\FNFCTcm.exe
  C:\Windows\System\FNFCTcm.exe
  2⤵
  PID:6924
- C:\Windows\System\FVOHRhB.exe
  C:\Windows\System\FVOHRhB.exe
  2⤵
  PID:7008
- C:\Windows\System\MYQqHXg.exe
  C:\Windows\System\MYQqHXg.exe
  2⤵
  PID:7684
- C:\Windows\System\bVqDNOB.exe
  C:\Windows\System\bVqDNOB.exe
  2⤵
  PID:7744
- C:\Windows\System\FfqSHfk.exe
  C:\Windows\System\FfqSHfk.exe
  2⤵
  PID:7796
- C:\Windows\System\BSujsDK.exe
  C:\Windows\System\BSujsDK.exe
  2⤵
  PID:7852
- C:\Windows\System\HrZXHpg.exe
  C:\Windows\System\HrZXHpg.exe
  2⤵
  PID:7880
- C:\Windows\System\HRDjSMA.exe
  C:\Windows\System\HRDjSMA.exe
  2⤵
  PID:7940
- C:\Windows\System\TebzWOY.exe
  C:\Windows\System\TebzWOY.exe
  2⤵
  PID:7992
- C:\Windows\System\UKaPSEv.exe
  C:\Windows\System\UKaPSEv.exe
  2⤵
  PID:8076
- C:\Windows\System\qhzgtNF.exe
  C:\Windows\System\qhzgtNF.exe
  2⤵
  PID:8120
- C:\Windows\System\aBsZPAp.exe
  C:\Windows\System\aBsZPAp.exe
  2⤵
  PID:8152
- C:\Windows\System\WGNRdig.exe
  C:\Windows\System\WGNRdig.exe
  2⤵
  PID:5944
- C:\Windows\System\KEXSzZe.exe
  C:\Windows\System\KEXSzZe.exe
  2⤵
  PID:6188
- C:\Windows\System\yYWEplX.exe
  C:\Windows\System\yYWEplX.exe
  2⤵
  PID:6256
- C:\Windows\System\SnhsNUT.exe
  C:\Windows\System\SnhsNUT.exe
  2⤵
  PID:6300
- C:\Windows\System\RzxcUfD.exe
  C:\Windows\System\RzxcUfD.exe
  2⤵
  PID:6888
- C:\Windows\System\tWJFAeI.exe
  C:\Windows\System\tWJFAeI.exe
  2⤵
  PID:7040
- C:\Windows\System\XzcvDJw.exe
  C:\Windows\System\XzcvDJw.exe
  2⤵
  PID:2024
- C:\Windows\System\HWKLMGU.exe
  C:\Windows\System\HWKLMGU.exe
  2⤵
  PID:3052
- C:\Windows\System\kLPCRzS.exe
  C:\Windows\System\kLPCRzS.exe
  2⤵
  PID:3704
- C:\Windows\System\TJBsaii.exe
  C:\Windows\System\TJBsaii.exe
  2⤵
  PID:8224
- C:\Windows\System\sLoyvzY.exe
  C:\Windows\System\sLoyvzY.exe
  2⤵
  PID:8244
- C:\Windows\System\JXPrhLU.exe
  C:\Windows\System\JXPrhLU.exe
  2⤵
  PID:8264
- C:\Windows\System\hzdZHNs.exe
  C:\Windows\System\hzdZHNs.exe
  2⤵
  PID:8296
- C:\Windows\System\vveZotR.exe
  C:\Windows\System\vveZotR.exe
  2⤵
  PID:8320
- C:\Windows\System\YYBoUTe.exe
  C:\Windows\System\YYBoUTe.exe
  2⤵
  PID:8344
- C:\Windows\System\FkyxzyE.exe
  C:\Windows\System\FkyxzyE.exe
  2⤵
  PID:8368
- C:\Windows\System\xHffDDo.exe
  C:\Windows\System\xHffDDo.exe
  2⤵
  PID:8384
- C:\Windows\System\SlMzdMF.exe
  C:\Windows\System\SlMzdMF.exe
  2⤵
  PID:8404
- C:\Windows\System\Qbpsrsz.exe
  C:\Windows\System\Qbpsrsz.exe
  2⤵
  PID:8668
- C:\Windows\System\EqsqaEe.exe
  C:\Windows\System\EqsqaEe.exe
  2⤵
  PID:8684
- C:\Windows\System\OsFlbvr.exe
  C:\Windows\System\OsFlbvr.exe
  2⤵
  PID:8700
- C:\Windows\System\YRTPBoe.exe
  C:\Windows\System\YRTPBoe.exe
  2⤵
  PID:8716
- C:\Windows\System\dlynqmH.exe
  C:\Windows\System\dlynqmH.exe
  2⤵
  PID:8732
- C:\Windows\System\lndBiwC.exe
  C:\Windows\System\lndBiwC.exe
  2⤵
  PID:8748
- C:\Windows\System\YOUcqww.exe
  C:\Windows\System\YOUcqww.exe
  2⤵
  PID:8764
- C:\Windows\System\cotxUeg.exe
  C:\Windows\System\cotxUeg.exe
  2⤵
  PID:8780
- C:\Windows\System\BxwAGyv.exe
  C:\Windows\System\BxwAGyv.exe
  2⤵
  PID:8796
- C:\Windows\System\WQWiObc.exe
  C:\Windows\System\WQWiObc.exe
  2⤵
  PID:8812
- C:\Windows\System\CYyhwZE.exe
  C:\Windows\System\CYyhwZE.exe
  2⤵
  PID:8828
- C:\Windows\System\BjqOrma.exe
  C:\Windows\System\BjqOrma.exe
  2⤵
  PID:8844
- C:\Windows\System\uQHSVYs.exe
  C:\Windows\System\uQHSVYs.exe
  2⤵
  PID:8860
- C:\Windows\System\gdYNnsK.exe
  C:\Windows\System\gdYNnsK.exe
  2⤵
  PID:8876
- C:\Windows\System\fxZAlFd.exe
  C:\Windows\System\fxZAlFd.exe
  2⤵
  PID:8892
- C:\Windows\System\HigyYaR.exe
  C:\Windows\System\HigyYaR.exe
  2⤵
  PID:8908
- C:\Windows\System\DoHrYtd.exe
  C:\Windows\System\DoHrYtd.exe
  2⤵
  PID:8924
- C:\Windows\System\IUKYWrI.exe
  C:\Windows\System\IUKYWrI.exe
  2⤵
  PID:8940
- C:\Windows\System\xtgivWF.exe
  C:\Windows\System\xtgivWF.exe
  2⤵
  PID:8960
- C:\Windows\System\AAwzQVH.exe
  C:\Windows\System\AAwzQVH.exe
  2⤵
  PID:8980
- C:\Windows\System\XyEGBGm.exe
  C:\Windows\System\XyEGBGm.exe
  2⤵
  PID:8996
- C:\Windows\System\gTPGIfq.exe
  C:\Windows\System\gTPGIfq.exe
  2⤵
  PID:9012
- C:\Windows\System\kigjJTz.exe
  C:\Windows\System\kigjJTz.exe
  2⤵
  PID:9028
- C:\Windows\System\wzJutUf.exe
  C:\Windows\System\wzJutUf.exe
  2⤵
  PID:9044
- C:\Windows\System\CgPmnfN.exe
  C:\Windows\System\CgPmnfN.exe
  2⤵
  PID:9196
- C:\Windows\System\sqwHgOM.exe
  C:\Windows\System\sqwHgOM.exe
  2⤵
  PID:6220
- C:\Windows\System\gsrohkz.exe
  C:\Windows\System\gsrohkz.exe
  2⤵
  PID:7700
- C:\Windows\System\SCQBpBg.exe
  C:\Windows\System\SCQBpBg.exe
  2⤵
  PID:7872
- C:\Windows\System\fjSlPpg.exe
  C:\Windows\System\fjSlPpg.exe
  2⤵
  PID:7968
- C:\Windows\System\wTzCRos.exe
  C:\Windows\System\wTzCRos.exe
  2⤵
  PID:8104
- C:\Windows\System\BXxWPmZ.exe
  C:\Windows\System\BXxWPmZ.exe
  2⤵
  PID:6156
- C:\Windows\System\sTDNinx.exe
  C:\Windows\System\sTDNinx.exe
  2⤵
  PID:5504
- C:\Windows\System\fGYmIBd.exe
  C:\Windows\System\fGYmIBd.exe
  2⤵
  PID:5520
- C:\Windows\System\eqrdvxb.exe
  C:\Windows\System\eqrdvxb.exe
  2⤵
  PID:8232
- C:\Windows\System\mokPHLX.exe
  C:\Windows\System\mokPHLX.exe
  2⤵
  PID:8416
- C:\Windows\System\GoYXfTK.exe
  C:\Windows\System\GoYXfTK.exe
  2⤵
  PID:3700
- C:\Windows\System\UuujznT.exe
  C:\Windows\System\UuujznT.exe
  2⤵
  PID:8528
- C:\Windows\System\GYNOGAu.exe
  C:\Windows\System\GYNOGAu.exe
  2⤵
  PID:9056
- C:\Windows\System\ZzYqBtz.exe
  C:\Windows\System\ZzYqBtz.exe
  2⤵
  PID:8872
- C:\Windows\System\fdwcBFa.exe
  C:\Windows\System\fdwcBFa.exe
  2⤵
  PID:8916
- C:\Windows\System\PQqHufK.exe
  C:\Windows\System\PQqHufK.exe
  2⤵
  PID:8988
- C:\Windows\System\WJeGKGB.exe
  C:\Windows\System\WJeGKGB.exe
  2⤵
  PID:9008
- C:\Windows\System\KSCrgEh.exe
  C:\Windows\System\KSCrgEh.exe
  2⤵
  PID:9040
- C:\Windows\System\WcrtWgy.exe
  C:\Windows\System\WcrtWgy.exe
  2⤵
  PID:1668
- C:\Windows\System\jSDdCZw.exe
  C:\Windows\System\jSDdCZw.exe
  2⤵
  PID:9084
- C:\Windows\System\lZQMsee.exe
  C:\Windows\System\lZQMsee.exe
  2⤵
  PID:9140
- C:\Windows\System\wEJElBf.exe
  C:\Windows\System\wEJElBf.exe
  2⤵
  PID:9188
- C:\Windows\System\oiBGsTb.exe
  C:\Windows\System\oiBGsTb.exe
  2⤵
  PID:7668
- C:\Windows\System\ovXfKSO.exe
  C:\Windows\System\ovXfKSO.exe
  2⤵
  PID:7960
- C:\Windows\System\kwTSkfa.exe
  C:\Windows\System\kwTSkfa.exe
  2⤵
  PID:6012
- C:\Windows\System\LYlERmg.exe
  C:\Windows\System\LYlERmg.exe
  2⤵
  PID:440
- C:\Windows\System\bmXUggW.exe
  C:\Windows\System\bmXUggW.exe
  2⤵
  PID:6172
- C:\Windows\System\nbalHXv.exe
  C:\Windows\System\nbalHXv.exe
  2⤵
  PID:8032
- C:\Windows\System\LFsEZbR.exe
  C:\Windows\System\LFsEZbR.exe
  2⤵
  PID:8256
- C:\Windows\System\tZVzvCa.exe
  C:\Windows\System\tZVzvCa.exe
  2⤵
  PID:3016
- C:\Windows\System\UtiSvtp.exe
  C:\Windows\System\UtiSvtp.exe
  2⤵
  PID:8376
- C:\Windows\System\qPDIlYM.exe
  C:\Windows\System\qPDIlYM.exe
  2⤵
  PID:8508
- C:\Windows\System\lSmJywi.exe
  C:\Windows\System\lSmJywi.exe
  2⤵
  PID:8680
- C:\Windows\System\qpcJXoQ.exe
  C:\Windows\System\qpcJXoQ.exe
  2⤵
  PID:5096
- C:\Windows\System\lZeChff.exe
  C:\Windows\System\lZeChff.exe
  2⤵
  PID:2748
- C:\Windows\System\JzbFxfk.exe
  C:\Windows\System\JzbFxfk.exe
  2⤵
  PID:872
- C:\Windows\System\tVqAqMp.exe
  C:\Windows\System\tVqAqMp.exe
  2⤵
  PID:3124
- C:\Windows\System\MsIQtRY.exe
  C:\Windows\System\MsIQtRY.exe
  2⤵
  PID:4948
- C:\Windows\System\yRfJVtt.exe
  C:\Windows\System\yRfJVtt.exe
  2⤵
  PID:5408
- C:\Windows\System\HZfjSCM.exe
  C:\Windows\System\HZfjSCM.exe
  2⤵
  PID:5872
- C:\Windows\System\IQsYkCv.exe
  C:\Windows\System\IQsYkCv.exe
  2⤵
  PID:7172
- C:\Windows\System\XYvfYXn.exe
  C:\Windows\System\XYvfYXn.exe
  2⤵
  PID:3092
- C:\Windows\System\dpewoLq.exe
  C:\Windows\System\dpewoLq.exe
  2⤵
  PID:7464
- C:\Windows\System\reqAlzc.exe
  C:\Windows\System\reqAlzc.exe
  2⤵
  PID:8856
- C:\Windows\System\WgsEluY.exe
  C:\Windows\System\WgsEluY.exe
  2⤵
  PID:8028
- C:\Windows\System\GtzsUjW.exe
  C:\Windows\System\GtzsUjW.exe
  2⤵
  PID:8948
- C:\Windows\System\jhntjmc.exe
  C:\Windows\System\jhntjmc.exe
  2⤵
  PID:9024
- C:\Windows\System\kubqmrY.exe
  C:\Windows\System\kubqmrY.exe
  2⤵
  PID:9036
- C:\Windows\System\SFZgPzq.exe
  C:\Windows\System\SFZgPzq.exe
  2⤵
  PID:5020
- C:\Windows\System\POtcVPD.exe
  C:\Windows\System\POtcVPD.exe
  2⤵
  PID:1068
- C:\Windows\System\tHbziOq.exe
  C:\Windows\System\tHbziOq.exe
  2⤵
  PID:624
- C:\Windows\System\sSONcmz.exe
  C:\Windows\System\sSONcmz.exe
  2⤵
  PID:6216
- C:\Windows\System\jtzBJLy.exe
  C:\Windows\System\jtzBJLy.exe
  2⤵
  PID:7664
- C:\Windows\System\OhhVjnZ.exe
  C:\Windows\System\OhhVjnZ.exe
  2⤵
  PID:3008
- C:\Windows\System\oVvRNUx.exe
  C:\Windows\System\oVvRNUx.exe
  2⤵
  PID:9100
- C:\Windows\System\PdQVsBG.exe
  C:\Windows\System\PdQVsBG.exe
  2⤵
  PID:3656
- C:\Windows\System\CxZqxux.exe
  C:\Windows\System\CxZqxux.exe
  2⤵
  PID:9224
- C:\Windows\System\fembeXp.exe
  C:\Windows\System\fembeXp.exe
  2⤵
  PID:9244
- C:\Windows\System\RBwAgps.exe
  C:\Windows\System\RBwAgps.exe
  2⤵
  PID:9268
- C:\Windows\System\uVHMicE.exe
  C:\Windows\System\uVHMicE.exe
  2⤵
  PID:9292
- C:\Windows\System\KshOoTk.exe
  C:\Windows\System\KshOoTk.exe
  2⤵
  PID:9312
- C:\Windows\System\nUroUvx.exe
  C:\Windows\System\nUroUvx.exe
  2⤵
  PID:9332
- C:\Windows\System\OxhKkRq.exe
  C:\Windows\System\OxhKkRq.exe
  2⤵
  PID:9360
- C:\Windows\System\QQteqBN.exe
  C:\Windows\System\QQteqBN.exe
  2⤵
  PID:9388
- C:\Windows\System\BnXDbpa.exe
  C:\Windows\System\BnXDbpa.exe
  2⤵
  PID:9408
- C:\Windows\System\jJfoIPf.exe
  C:\Windows\System\jJfoIPf.exe
  2⤵
  PID:9428
- C:\Windows\System\qbZVkIc.exe
  C:\Windows\System\qbZVkIc.exe
  2⤵
  PID:9444
- C:\Windows\System\hrvlGfi.exe
  C:\Windows\System\hrvlGfi.exe
  2⤵
  PID:9464
- C:\Windows\System\DEeqwAw.exe
  C:\Windows\System\DEeqwAw.exe
  2⤵
  PID:9484
- C:\Windows\System\tmNxfOO.exe
  C:\Windows\System\tmNxfOO.exe
  2⤵
  PID:9504
- C:\Windows\System\jvUXeZX.exe
  C:\Windows\System\jvUXeZX.exe
  2⤵
  PID:9524
- C:\Windows\System\NhmwCio.exe
  C:\Windows\System\NhmwCio.exe
  2⤵
  PID:9540
- C:\Windows\System\aYcGVbO.exe
  C:\Windows\System\aYcGVbO.exe
  2⤵
  PID:9564
- C:\Windows\System\PFBJZxC.exe
  C:\Windows\System\PFBJZxC.exe
  2⤵
  PID:9580
- C:\Windows\System\KYalLAV.exe
  C:\Windows\System\KYalLAV.exe
  2⤵
  PID:9604
- C:\Windows\System\ZmrrGlv.exe
  C:\Windows\System\ZmrrGlv.exe
  2⤵
  PID:9620
- C:\Windows\System\VztrAVe.exe
  C:\Windows\System\VztrAVe.exe
  2⤵
  PID:9644
- C:\Windows\System\vNhabVA.exe
  C:\Windows\System\vNhabVA.exe
  2⤵
  PID:9676
- C:\Windows\System\HjhGpJy.exe
  C:\Windows\System\HjhGpJy.exe
  2⤵
  PID:9696
- C:\Windows\System\SlzGGJa.exe
  C:\Windows\System\SlzGGJa.exe
  2⤵
  PID:9724
- C:\Windows\System\OozqxFG.exe
  C:\Windows\System\OozqxFG.exe
  2⤵
  PID:9744
- C:\Windows\System\YXRJTmG.exe
  C:\Windows\System\YXRJTmG.exe
  2⤵
  PID:9764
- C:\Windows\System\kHEtkvP.exe
  C:\Windows\System\kHEtkvP.exe
  2⤵
  PID:9788
- C:\Windows\System\xuNvzBH.exe
  C:\Windows\System\xuNvzBH.exe
  2⤵
  PID:9808
- C:\Windows\System\EpxdSLp.exe
  C:\Windows\System\EpxdSLp.exe
  2⤵
  PID:9832
- C:\Windows\System\ocEDNCL.exe
  C:\Windows\System\ocEDNCL.exe
  2⤵
  PID:9852
- C:\Windows\System\DkBpBZe.exe
  C:\Windows\System\DkBpBZe.exe
  2⤵
  PID:9872
- C:\Windows\System\RLnIVyc.exe
  C:\Windows\System\RLnIVyc.exe
  2⤵
  PID:9888
- C:\Windows\System\wZwlDTp.exe
  C:\Windows\System\wZwlDTp.exe
  2⤵
  PID:9904
- C:\Windows\System\BiRCgIg.exe
  C:\Windows\System\BiRCgIg.exe
  2⤵
  PID:9924
- C:\Windows\System\gbdOpwq.exe
  C:\Windows\System\gbdOpwq.exe
  2⤵
  PID:9948
- C:\Windows\System\VSnbwqn.exe
  C:\Windows\System\VSnbwqn.exe
  2⤵
  PID:9972
- C:\Windows\System\hxTckTo.exe
  C:\Windows\System\hxTckTo.exe
  2⤵
  PID:9996
- C:\Windows\System\zPOICia.exe
  C:\Windows\System\zPOICia.exe
  2⤵
  PID:10016
- C:\Windows\System\PJSUzAt.exe
  C:\Windows\System\PJSUzAt.exe
  2⤵
  PID:10036
- C:\Windows\System\JjjYxTf.exe
  C:\Windows\System\JjjYxTf.exe
  2⤵
  PID:10060
- C:\Windows\System\PBNfDVR.exe
  C:\Windows\System\PBNfDVR.exe
  2⤵
  PID:10080
- C:\Windows\System\OEdoVPi.exe
  C:\Windows\System\OEdoVPi.exe
  2⤵
  PID:10100
- C:\Windows\System\bYiVrFg.exe
  C:\Windows\System\bYiVrFg.exe
  2⤵
  PID:10124
- C:\Windows\System\nUojaMm.exe
  C:\Windows\System\nUojaMm.exe
  2⤵
  PID:10144
- C:\Windows\System\geIlWZd.exe
  C:\Windows\System\geIlWZd.exe
  2⤵
  PID:10172
- C:\Windows\System\lJrhnzZ.exe
  C:\Windows\System\lJrhnzZ.exe
  2⤵
  PID:10192
- C:\Windows\System\ogOzFfW.exe
  C:\Windows\System\ogOzFfW.exe
  2⤵
  PID:10216
- C:\Windows\System\qjtdnOs.exe
  C:\Windows\System\qjtdnOs.exe
  2⤵
  PID:8904
- C:\Windows\System\PtiRmpY.exe
  C:\Windows\System\PtiRmpY.exe
  2⤵
  PID:9068
- C:\Windows\System\gNaemjZ.exe
  C:\Windows\System\gNaemjZ.exe
  2⤵
  PID:5560
- C:\Windows\System\tSPndON.exe
  C:\Windows\System\tSPndON.exe
  2⤵
  PID:9220
- C:\Windows\System\zBYVYiC.exe
  C:\Windows\System\zBYVYiC.exe
  2⤵
  PID:6004
- C:\Windows\System\zOoUziR.exe
  C:\Windows\System\zOoUziR.exe
  2⤵
  PID:5676
- C:\Windows\System\XIKwZWt.exe
  C:\Windows\System\XIKwZWt.exe
  2⤵
  PID:8148
- C:\Windows\System\nIPFNwd.exe
  C:\Windows\System\nIPFNwd.exe
  2⤵
  PID:980
- C:\Windows\System\UYzizWM.exe
  C:\Windows\System\UYzizWM.exe
  2⤵
  PID:9532
- C:\Windows\System\fiqWsQf.exe
  C:\Windows\System\fiqWsQf.exe
  2⤵
  PID:9324
- C:\Windows\System\jdhZDBl.exe
  C:\Windows\System\jdhZDBl.exe
  2⤵
  PID:9760
- C:\Windows\System\YlNTPRQ.exe
  C:\Windows\System\YlNTPRQ.exe
  2⤵
  PID:9804
- C:\Windows\System\HknRjuG.exe
  C:\Windows\System\HknRjuG.exe
  2⤵
  PID:9476
- C:\Windows\System\luSoAus.exe
  C:\Windows\System\luSoAus.exe
  2⤵
  PID:9496
- C:\Windows\System\WrzWgGh.exe
  C:\Windows\System\WrzWgGh.exe
  2⤵
  PID:9932
- C:\Windows\System\iepFtrq.exe
  C:\Windows\System\iepFtrq.exe
  2⤵
  PID:9300
- C:\Windows\System\uYtlhcR.exe
  C:\Windows\System\uYtlhcR.exe
  2⤵
  PID:9628
- C:\Windows\System\ctDNIKa.exe
  C:\Windows\System\ctDNIKa.exe
  2⤵
  PID:10072
- C:\Windows\System\VMdqymV.exe
  C:\Windows\System\VMdqymV.exe
  2⤵
  PID:9396
- C:\Windows\System\OrRnyjU.exe
  C:\Windows\System\OrRnyjU.exe
  2⤵
  PID:9780
- C:\Windows\System\WoBStoq.exe
  C:\Windows\System\WoBStoq.exe
  2⤵
  PID:10224
- C:\Windows\System\aStVyCZ.exe
  C:\Windows\System\aStVyCZ.exe
  2⤵
  PID:10248
- C:\Windows\System\chBJGUQ.exe
  C:\Windows\System\chBJGUQ.exe
  2⤵
  PID:10272
- C:\Windows\System\aOIGiDq.exe
  C:\Windows\System\aOIGiDq.exe
  2⤵
  PID:10296
- C:\Windows\System\PxrzTWT.exe
  C:\Windows\System\PxrzTWT.exe
  2⤵
  PID:10316
- C:\Windows\System\IbYWScd.exe
  C:\Windows\System\IbYWScd.exe
  2⤵
  PID:10348
- C:\Windows\System\Avshtdj.exe
  C:\Windows\System\Avshtdj.exe
  2⤵
  PID:10364
- C:\Windows\System\almbBxa.exe
  C:\Windows\System\almbBxa.exe
  2⤵
  PID:10388
- C:\Windows\System\fuPEAjQ.exe
  C:\Windows\System\fuPEAjQ.exe
  2⤵
  PID:10416
- C:\Windows\System\jPOsNaT.exe
  C:\Windows\System\jPOsNaT.exe
  2⤵
  PID:10432
- C:\Windows\System\zVLUqQv.exe
  C:\Windows\System\zVLUqQv.exe
  2⤵
  PID:10452
- C:\Windows\System\nZkqJDS.exe
  C:\Windows\System\nZkqJDS.exe
  2⤵
  PID:10472
- C:\Windows\System\dzUhaax.exe
  C:\Windows\System\dzUhaax.exe
  2⤵
  PID:10492
- C:\Windows\System\vJQAPnR.exe
  C:\Windows\System\vJQAPnR.exe
  2⤵
  PID:10520
- C:\Windows\System\cqKewTM.exe
  C:\Windows\System\cqKewTM.exe
  2⤵
  PID:10540
- C:\Windows\System\KiBxoUn.exe
  C:\Windows\System\KiBxoUn.exe
  2⤵
  PID:10560
- C:\Windows\System\jdqoJQv.exe
  C:\Windows\System\jdqoJQv.exe
  2⤵
  PID:10580
- C:\Windows\System\wwdnBFc.exe
  C:\Windows\System\wwdnBFc.exe
  2⤵
  PID:10604
- C:\Windows\System\inNKgRJ.exe
  C:\Windows\System\inNKgRJ.exe
  2⤵
  PID:10632
- C:\Windows\System\AEUpZBT.exe
  C:\Windows\System\AEUpZBT.exe
  2⤵
  PID:10652
- C:\Windows\System\VneLYix.exe
  C:\Windows\System\VneLYix.exe
  2⤵
  PID:10672
- C:\Windows\System\giDKQZR.exe
  C:\Windows\System\giDKQZR.exe
  2⤵
  PID:10696
- C:\Windows\System\yJpBUTN.exe
  C:\Windows\System\yJpBUTN.exe
  2⤵
  PID:10720
- C:\Windows\System\hQaAXKD.exe
  C:\Windows\System\hQaAXKD.exe
  2⤵
  PID:10736
- C:\Windows\System\dUtEYDu.exe
  C:\Windows\System\dUtEYDu.exe
  2⤵
  PID:10764
- C:\Windows\System\CrjFmwX.exe
  C:\Windows\System\CrjFmwX.exe
  2⤵
  PID:10784
- C:\Windows\System\xMhagfQ.exe
  C:\Windows\System\xMhagfQ.exe
  2⤵
  PID:10804
- C:\Windows\System\UWkYBxh.exe
  C:\Windows\System\UWkYBxh.exe
  2⤵
  PID:10848
- C:\Windows\System\pwdXVJN.exe
  C:\Windows\System\pwdXVJN.exe
  2⤵
  PID:10876
- C:\Windows\System\uZPPOcw.exe
  C:\Windows\System\uZPPOcw.exe
  2⤵
  PID:10896
- C:\Windows\System\DgCrdhD.exe
  C:\Windows\System\DgCrdhD.exe
  2⤵
  PID:10920
- C:\Windows\System\MWEagEl.exe
  C:\Windows\System\MWEagEl.exe
  2⤵
  PID:10940
- C:\Windows\System\gcatPKw.exe
  C:\Windows\System\gcatPKw.exe
  2⤵
  PID:10960
- C:\Windows\System\wSaCwpi.exe
  C:\Windows\System\wSaCwpi.exe
  2⤵
  PID:10980
- C:\Windows\System\moupEQH.exe
  C:\Windows\System\moupEQH.exe
  2⤵
  PID:11000
- C:\Windows\System\UcMLjFx.exe
  C:\Windows\System\UcMLjFx.exe
  2⤵
  PID:11024
- C:\Windows\System\mtbvzmR.exe
  C:\Windows\System\mtbvzmR.exe
  2⤵
  PID:11040
- C:\Windows\System\HnKJgXQ.exe
  C:\Windows\System\HnKJgXQ.exe
  2⤵
  PID:11068
- C:\Windows\System\SoZEwUi.exe
  C:\Windows\System\SoZEwUi.exe
  2⤵
  PID:11092
- C:\Windows\System\ctjujyj.exe
  C:\Windows\System\ctjujyj.exe
  2⤵
  PID:11112
- C:\Windows\System\SJbheqN.exe
  C:\Windows\System\SJbheqN.exe
  2⤵
  PID:11132
- C:\Windows\System\bhZUvFb.exe
  C:\Windows\System\bhZUvFb.exe
  2⤵
  PID:11156
- C:\Windows\System\sxtfcbX.exe
  C:\Windows\System\sxtfcbX.exe
  2⤵
  PID:11180
- C:\Windows\System\MCGeISD.exe
  C:\Windows\System\MCGeISD.exe
  2⤵
  PID:11204
- C:\Windows\System\BnLhyya.exe
  C:\Windows\System\BnLhyya.exe
  2⤵
  PID:11228
- C:\Windows\System\navPnVp.exe
  C:\Windows\System\navPnVp.exe
  2⤵
  PID:11248
- C:\Windows\System\MjRUTNP.exe
  C:\Windows\System\MjRUTNP.exe
  2⤵
  PID:9880
- C:\Windows\System\YIAkfjb.exe
  C:\Windows\System\YIAkfjb.exe
  2⤵
  PID:9900
- C:\Windows\System\xYhqDxV.exe
  C:\Windows\System\xYhqDxV.exe
  2⤵
  PID:9576
- C:\Windows\System\LlNnuSl.exe
  C:\Windows\System\LlNnuSl.exe
  2⤵
  PID:9988
- C:\Windows\System\BNXwmPs.exe
  C:\Windows\System\BNXwmPs.exe
  2⤵
  PID:10032
- C:\Windows\System\FzhhPLq.exe
  C:\Windows\System\FzhhPLq.exe
  2⤵
  PID:9688
- C:\Windows\System\CrfUygy.exe
  C:\Windows\System\CrfUygy.exe
  2⤵
  PID:9732
- C:\Windows\System\GOVAlry.exe
  C:\Windows\System\GOVAlry.exe
  2⤵
  PID:10160
- C:\Windows\System\GyhgzhZ.exe
  C:\Windows\System\GyhgzhZ.exe
  2⤵
  PID:9420
- C:\Windows\System\vYTkdqG.exe
  C:\Windows\System\vYTkdqG.exe
  2⤵
  PID:10308
- C:\Windows\System\EUPRBCO.exe
  C:\Windows\System\EUPRBCO.exe
  2⤵
  PID:10344
- C:\Windows\System\PoWMpMV.exe
  C:\Windows\System\PoWMpMV.exe
  2⤵
  PID:3500
- C:\Windows\System\YJcEByq.exe
  C:\Windows\System\YJcEByq.exe
  2⤵
  PID:9460
- C:\Windows\System\yDukxAf.exe
  C:\Windows\System\yDukxAf.exe
  2⤵
  PID:9572
- C:\Windows\System\QczvELz.exe
  C:\Windows\System\QczvELz.exe
  2⤵
  PID:10536
- C:\Windows\System\hcMACMY.exe
  C:\Windows\System\hcMACMY.exe
  2⤵
  PID:10048
- C:\Windows\System\DfEjzBu.exe
  C:\Windows\System\DfEjzBu.exe
  2⤵
  PID:10092
- C:\Windows\System\XCmMKEG.exe
  C:\Windows\System\XCmMKEG.exe
  2⤵
  PID:9864
- C:\Windows\System\wadMhxg.exe
  C:\Windows\System\wadMhxg.exe
  2⤵
  PID:9264
- C:\Windows\System\nKMuZNI.exe
  C:\Windows\System\nKMuZNI.exe
  2⤵
  PID:10200
- C:\Windows\System\KemrUyv.exe
  C:\Windows\System\KemrUyv.exe
  2⤵
  PID:10228
- C:\Windows\System\ryhKUme.exe
  C:\Windows\System\ryhKUme.exe
  2⤵
  PID:10208
- C:\Windows\System\sHZXxyE.exe
  C:\Windows\System\sHZXxyE.exe
  2⤵
  PID:11268
- C:\Windows\System\sDYGlZR.exe
  C:\Windows\System\sDYGlZR.exe
  2⤵
  PID:11288
- C:\Windows\System\WdRxbys.exe
  C:\Windows\System\WdRxbys.exe
  2⤵
  PID:11304
- C:\Windows\System\lcnWEmv.exe
  C:\Windows\System\lcnWEmv.exe
  2⤵
  PID:11320
- C:\Windows\System\MFZIHUY.exe
  C:\Windows\System\MFZIHUY.exe
  2⤵
  PID:11336
- C:\Windows\System\yqaQbEJ.exe
  C:\Windows\System\yqaQbEJ.exe
  2⤵
  PID:11360
- C:\Windows\System\WCdUpeV.exe
  C:\Windows\System\WCdUpeV.exe
  2⤵
  PID:11380
- C:\Windows\System\uOeQUjN.exe
  C:\Windows\System\uOeQUjN.exe
  2⤵
  PID:11404
- C:\Windows\System\WFfEjdk.exe
  C:\Windows\System\WFfEjdk.exe
  2⤵
  PID:11424
- C:\Windows\System\WhCecwR.exe
  C:\Windows\System\WhCecwR.exe
  2⤵
  PID:11444
- C:\Windows\System\gxnNNDF.exe
  C:\Windows\System\gxnNNDF.exe
  2⤵
  PID:11472
- C:\Windows\System\tQgQAnA.exe
  C:\Windows\System\tQgQAnA.exe
  2⤵
  PID:11496
- C:\Windows\System\cPIdHlw.exe
  C:\Windows\System\cPIdHlw.exe
  2⤵
  PID:11524
- C:\Windows\System\qyOQiYp.exe
  C:\Windows\System\qyOQiYp.exe
  2⤵
  PID:11548
- C:\Windows\System\TEQmBqm.exe
  C:\Windows\System\TEQmBqm.exe
  2⤵
  PID:11572
- C:\Windows\System\fYiHNTF.exe
  C:\Windows\System\fYiHNTF.exe
  2⤵
  PID:11588
- C:\Windows\System\MnIrAGX.exe
  C:\Windows\System\MnIrAGX.exe
  2⤵
  PID:11612
- C:\Windows\System\ggWyiCv.exe
  C:\Windows\System\ggWyiCv.exe
  2⤵
  PID:11628
- C:\Windows\System\oERjfTW.exe
  C:\Windows\System\oERjfTW.exe
  2⤵
  PID:11648
- C:\Windows\System\qdJcgLd.exe
  C:\Windows\System\qdJcgLd.exe
  2⤵
  PID:11668
- C:\Windows\System\vbkaQWS.exe
  C:\Windows\System\vbkaQWS.exe
  2⤵
  PID:11692
- C:\Windows\System\oCFuAnv.exe
  C:\Windows\System\oCFuAnv.exe
  2⤵
  PID:11712
- C:\Windows\System\gsJuzqB.exe
  C:\Windows\System\gsJuzqB.exe
  2⤵
  PID:11732
- C:\Windows\System\fyuAVOM.exe
  C:\Windows\System\fyuAVOM.exe
  2⤵
  PID:11756
- C:\Windows\System\yvTULjo.exe
  C:\Windows\System\yvTULjo.exe
  2⤵
  PID:11776
- C:\Windows\System\NQFCQKo.exe
  C:\Windows\System\NQFCQKo.exe
  2⤵
  PID:11800
- C:\Windows\System\UAYpUJg.exe
  C:\Windows\System\UAYpUJg.exe
  2⤵
  PID:11820
- C:\Windows\System\dejYlrL.exe
  C:\Windows\System\dejYlrL.exe
  2⤵
  PID:11844
- C:\Windows\System\cVwLXsh.exe
  C:\Windows\System\cVwLXsh.exe
  2⤵
  PID:11868
- C:\Windows\System\iAPeDDD.exe
  C:\Windows\System\iAPeDDD.exe
  2⤵
  PID:11896
- C:\Windows\System\XEgKhid.exe
  C:\Windows\System\XEgKhid.exe
  2⤵
  PID:11920
- C:\Windows\System\GmsFXHW.exe
  C:\Windows\System\GmsFXHW.exe
  2⤵
  PID:11940
- C:\Windows\System\swUESMl.exe
  C:\Windows\System\swUESMl.exe
  2⤵
  PID:11964
- C:\Windows\System\AcVbkPM.exe
  C:\Windows\System\AcVbkPM.exe
  2⤵
  PID:11984
- C:\Windows\System\FazrJpR.exe
  C:\Windows\System\FazrJpR.exe
  2⤵
  PID:12008
- C:\Windows\System\FKZdkKp.exe
  C:\Windows\System\FKZdkKp.exe
  2⤵
  PID:12028
- C:\Windows\System\wZtCqlM.exe
  C:\Windows\System\wZtCqlM.exe
  2⤵
  PID:12052
- C:\Windows\System\SdMJiMc.exe
  C:\Windows\System\SdMJiMc.exe
  2⤵
  PID:12072
- C:\Windows\System\YAecpUK.exe
  C:\Windows\System\YAecpUK.exe
  2⤵
  PID:12096
- C:\Windows\System\pLhZPiI.exe
  C:\Windows\System\pLhZPiI.exe
  2⤵
  PID:12116
- C:\Windows\System\DMbaSdf.exe
  C:\Windows\System\DMbaSdf.exe
  2⤵
  PID:12136
- C:\Windows\System\wVjNQXE.exe
  C:\Windows\System\wVjNQXE.exe
  2⤵
  PID:12156
- C:\Windows\System\sPZUVzK.exe
  C:\Windows\System\sPZUVzK.exe
  2⤵
  PID:12180
- C:\Windows\System\rXVIDsb.exe
  C:\Windows\System\rXVIDsb.exe
  2⤵
  PID:12200
- C:\Windows\System\kGFrZqA.exe
  C:\Windows\System\kGFrZqA.exe
  2⤵
  PID:12220
- C:\Windows\System\fKmjCpL.exe
  C:\Windows\System\fKmjCpL.exe
  2⤵
  PID:12240
- C:\Windows\System\IOXlLhM.exe
  C:\Windows\System\IOXlLhM.exe
  2⤵
  PID:12264
- C:\Windows\System\BRXeEYU.exe
  C:\Windows\System\BRXeEYU.exe
  2⤵
  PID:10916
- C:\Windows\System\RfgkfCX.exe
  C:\Windows\System\RfgkfCX.exe
  2⤵
  PID:10396
- C:\Windows\System\mozqVHp.exe
  C:\Windows\System\mozqVHp.exe
  2⤵
  PID:10992
- C:\Windows\System\inpWoNc.exe
  C:\Windows\System\inpWoNc.exe
  2⤵
  PID:11200
- C:\Windows\System\KjqIpDV.exe
  C:\Windows\System\KjqIpDV.exe
  2⤵
  PID:10500
- C:\Windows\System\DIJEbov.exe
  C:\Windows\System\DIJEbov.exe
  2⤵
  PID:9600
- C:\Windows\System\xPPLLll.exe
  C:\Windows\System\xPPLLll.exe
  2⤵
  PID:9304
- C:\Windows\System\ItTdCjQ.exe
  C:\Windows\System\ItTdCjQ.exe
  2⤵
  PID:10688
- C:\Windows\System\jHcQphB.exe
  C:\Windows\System\jHcQphB.exe
  2⤵
  PID:3508
- C:\Windows\System\KBlPFBE.exe
  C:\Windows\System\KBlPFBE.exe
  2⤵
  PID:9992
- C:\Windows\System\XDfCwPm.exe
  C:\Windows\System\XDfCwPm.exe
  2⤵
  PID:10800
- C:\Windows\System\YksDTCb.exe
  C:\Windows\System\YksDTCb.exe
  2⤵
  PID:10264
- C:\Windows\System\LSgvLdH.exe
  C:\Windows\System\LSgvLdH.exe
  2⤵
  PID:10892
- C:\Windows\System\oaZSgLk.exe
  C:\Windows\System\oaZSgLk.exe
  2⤵
  PID:10244
- C:\Windows\System\yLZiyiy.exe
  C:\Windows\System\yLZiyiy.exe
  2⤵
  PID:11348
- C:\Windows\System\ehuctND.exe
  C:\Windows\System\ehuctND.exe
  2⤵
  PID:11420
- C:\Windows\System\quhjZTU.exe
  C:\Windows\System\quhjZTU.exe
  2⤵
  PID:10424
- C:\Windows\System\WnwxOGM.exe
  C:\Windows\System\WnwxOGM.exe
  2⤵
  PID:11036
- C:\Windows\System\eNrLzbl.exe
  C:\Windows\System\eNrLzbl.exe
  2⤵
  PID:10468
- C:\Windows\System\XNjHaKx.exe
  C:\Windows\System\XNjHaKx.exe
  2⤵
  PID:11540
- C:\Windows\System\gsNFQBi.exe
  C:\Windows\System\gsNFQBi.exe
  2⤵
  PID:11568
- C:\Windows\System\OqbgByD.exe
  C:\Windows\System\OqbgByD.exe
  2⤵
  PID:4280
- C:\Windows\System\oPHiHFd.exe
  C:\Windows\System\oPHiHFd.exe
  2⤵
  PID:12296
- C:\Windows\System\znBLEmI.exe
  C:\Windows\System\znBLEmI.exe
  2⤵
  PID:12316
- C:\Windows\System\SLmDTEZ.exe
  C:\Windows\System\SLmDTEZ.exe
  2⤵
  PID:12340
- C:\Windows\System\egKZuIm.exe
  C:\Windows\System\egKZuIm.exe
  2⤵
  PID:12364
- C:\Windows\System\aUzAVaa.exe
  C:\Windows\System\aUzAVaa.exe
  2⤵
  PID:12388
- C:\Windows\System\YBtqkOk.exe
  C:\Windows\System\YBtqkOk.exe
  2⤵
  PID:12412
- C:\Windows\System\ojwEYWg.exe
  C:\Windows\System\ojwEYWg.exe
  2⤵
  PID:12432
- C:\Windows\System\yRZaVuV.exe
  C:\Windows\System\yRZaVuV.exe
  2⤵
  PID:12456
- C:\Windows\System\clkUyjU.exe
  C:\Windows\System\clkUyjU.exe
  2⤵
  PID:12476
- C:\Windows\System\JRtrtZk.exe
  C:\Windows\System\JRtrtZk.exe
  2⤵
  PID:12496
- C:\Windows\System\HQrBEKg.exe
  C:\Windows\System\HQrBEKg.exe
  2⤵
  PID:12516
- C:\Windows\System\qEEoyVz.exe
  C:\Windows\System\qEEoyVz.exe
  2⤵
  PID:12536
- C:\Windows\System\xsImQFr.exe
  C:\Windows\System\xsImQFr.exe
  2⤵
  PID:12560
- C:\Windows\System\ZEKMrGv.exe
  C:\Windows\System\ZEKMrGv.exe
  2⤵
  PID:12584
- C:\Windows\System\brYPLri.exe
  C:\Windows\System\brYPLri.exe
  2⤵
  PID:12604
- C:\Windows\System\iUOQwrP.exe
  C:\Windows\System\iUOQwrP.exe
  2⤵
  PID:12624
- C:\Windows\System\aiwWzVy.exe
  C:\Windows\System\aiwWzVy.exe
  2⤵
  PID:12648
- C:\Windows\System\giUSaKv.exe
  C:\Windows\System\giUSaKv.exe
  2⤵
  PID:12672
- C:\Windows\System\bxSElII.exe
  C:\Windows\System\bxSElII.exe
  2⤵
  PID:12692
- C:\Windows\System\mKWcOYe.exe
  C:\Windows\System\mKWcOYe.exe
  2⤵
  PID:12716
- C:\Windows\System\yCFButJ.exe
  C:\Windows\System\yCFButJ.exe
  2⤵
  PID:12736
- C:\Windows\System\RRKFUYk.exe
  C:\Windows\System\RRKFUYk.exe
  2⤵
  PID:12756
- C:\Windows\System\JivsPhr.exe
  C:\Windows\System\JivsPhr.exe
  2⤵
  PID:12776
- C:\Windows\System\TusNSiy.exe
  C:\Windows\System\TusNSiy.exe
  2⤵
  PID:12796
- C:\Windows\System\wzvAuBq.exe
  C:\Windows\System\wzvAuBq.exe
  2⤵
  PID:12816
- C:\Windows\System\iqgwjOT.exe
  C:\Windows\System\iqgwjOT.exe
  2⤵
  PID:12840
- C:\Windows\System\qHwDuWL.exe
  C:\Windows\System\qHwDuWL.exe
  2⤵
  PID:12864
- C:\Windows\System\FsObvkI.exe
  C:\Windows\System\FsObvkI.exe
  2⤵
  PID:12888
- C:\Windows\System\vMTtojo.exe
  C:\Windows\System\vMTtojo.exe
  2⤵
  PID:12908
- C:\Windows\System\soZgLBz.exe
  C:\Windows\System\soZgLBz.exe
  2⤵
  PID:12932
- C:\Windows\System\GFYiDKG.exe
  C:\Windows\System\GFYiDKG.exe
  2⤵
  PID:12956
- C:\Windows\System\RqrSrER.exe
  C:\Windows\System\RqrSrER.exe
  2⤵
  PID:12512
- C:\Windows\System\JdGwRdW.exe
  C:\Windows\System\JdGwRdW.exe
  2⤵
  PID:12580
- C:\Windows\System\fBQbcKa.exe
  C:\Windows\System\fBQbcKa.exe
  2⤵
  PID:12668
- C:\Windows\System\ztvtVtS.exe
  C:\Windows\System\ztvtVtS.exe
  2⤵
  PID:13288
- C:\Windows\System\lgiinxZ.exe
  C:\Windows\System\lgiinxZ.exe
  2⤵
  PID:1132
- C:\Windows\System\ZUnNQcK.exe
  C:\Windows\System\ZUnNQcK.exe
  2⤵
  PID:13068
- C:\Windows\System\CENCVKc.exe
  C:\Windows\System\CENCVKc.exe
  2⤵
  PID:12944
- C:\Windows\System\wQFtWVc.exe
  C:\Windows\System\wQFtWVc.exe
  2⤵
  PID:12356
- C:\Windows\System\JCugNgd.exe
  C:\Windows\System\JCugNgd.exe
  2⤵
  PID:12704
- C:\Windows\System\lIfaFln.exe
  C:\Windows\System\lIfaFln.exe
  2⤵
  PID:12444
- C:\Windows\System\iLFBsIP.exe
  C:\Windows\System\iLFBsIP.exe
  2⤵
  PID:4048
- C:\Windows\System\KCStAXS.exe
  C:\Windows\System\KCStAXS.exe
  2⤵
  PID:4720
- C:\Windows\System\AehYuXJ.exe
  C:\Windows\System\AehYuXJ.exe
  2⤵
  PID:968
- C:\Windows\System\CWabhdq.exe
  C:\Windows\System\CWabhdq.exe
  2⤵
  PID:11864
- C:\Windows\System\zTgnuXU.exe
  C:\Windows\System\zTgnuXU.exe
  2⤵
  PID:12232
- C:\Windows\System\flUJxZg.exe
  C:\Windows\System\flUJxZg.exe
  2⤵
  PID:11216
- C:\Windows\System\kqEOwIx.exe
  C:\Windows\System\kqEOwIx.exe
  2⤵
  PID:11128
- C:\Windows\System\tJerRvx.exe
  C:\Windows\System\tJerRvx.exe
  2⤵
  PID:10864
- C:\Windows\System\cEbGnwf.exe
  C:\Windows\System\cEbGnwf.exe
  2⤵
  PID:10888
- C:\Windows\System\aWHscRA.exe
  C:\Windows\System\aWHscRA.exe
  2⤵
  PID:11188
- C:\Windows\System\mEvCWJF.exe
  C:\Windows\System\mEvCWJF.exe
  2⤵
  PID:10904
- C:\Windows\System\QNuyawW.exe
  C:\Windows\System\QNuyawW.exe
  2⤵
  PID:9708
- C:\Windows\System\aCwguxl.exe
  C:\Windows\System\aCwguxl.exe
  2⤵
  PID:6812
- C:\Windows\System\PnuHUpJ.exe
  C:\Windows\System\PnuHUpJ.exe
  2⤵
  PID:11284
- C:\Windows\System\bZzpIbI.exe
  C:\Windows\System\bZzpIbI.exe
  2⤵
  PID:11744
- C:\Windows\System\zqCAUNa.exe
  C:\Windows\System\zqCAUNa.exe
  2⤵
  PID:11836
- C:\Windows\System\aaGaIBd.exe
  C:\Windows\System\aaGaIBd.exe
  2⤵
  PID:4796
- C:\Windows\System\krdYcoG.exe
  C:\Windows\System\krdYcoG.exe
  2⤵
  PID:11464
- C:\Windows\System\wZeMMWp.exe
  C:\Windows\System\wZeMMWp.exe
  2⤵
  PID:9516
- C:\Windows\System\NKeFrkk.exe
  C:\Windows\System\NKeFrkk.exe
  2⤵
  PID:11084
- C:\Windows\System\SkgNaMG.exe
  C:\Windows\System\SkgNaMG.exe
  2⤵
  PID:12112
- C:\Windows\System\StZTSfF.exe
  C:\Windows\System\StZTSfF.exe
  2⤵
  PID:12312
- C:\Windows\System\ZceakbD.exe
  C:\Windows\System\ZceakbD.exe
  2⤵
  PID:12148
- C:\Windows\System\TVLKbCW.exe
  C:\Windows\System\TVLKbCW.exe
  2⤵
  PID:13232
- C:\Windows\System\dUerdnP.exe
  C:\Windows\System\dUerdnP.exe
  2⤵
  PID:13056
- C:\Windows\System\zuMTUYf.exe
  C:\Windows\System\zuMTUYf.exe
  2⤵
  PID:12188
- C:\Windows\System\mUdowYC.exe
  C:\Windows\System\mUdowYC.exe
  2⤵
  PID:11688
- C:\Windows\System\RXfhhyx.exe
  C:\Windows\System\RXfhhyx.exe
  2⤵
  PID:11708
- C:\Windows\System\gRyITOr.exe
  C:\Windows\System\gRyITOr.exe
  2⤵
  PID:12832
- C:\Windows\System\VjdhFcL.exe
  C:\Windows\System\VjdhFcL.exe
  2⤵
  PID:10708
- C:\Windows\System\tYFflpu.exe
  C:\Windows\System\tYFflpu.exe
  2⤵
  PID:1120
- C:\Windows\System\PUumOcT.exe
  C:\Windows\System\PUumOcT.exe
  2⤵
  PID:13140
- C:\Windows\System\YdgFHtE.exe
  C:\Windows\System\YdgFHtE.exe
  2⤵
  PID:13296
- C:\Windows\System\RgvNIhV.exe
  C:\Windows\System\RgvNIhV.exe
  2⤵
  PID:12992
- C:\Windows\System\BDvIAhh.exe
  C:\Windows\System\BDvIAhh.exe
  2⤵
  PID:3572
- C:\Windows\System\RHAsVvm.exe
  C:\Windows\System\RHAsVvm.exe
  2⤵
  PID:9348
- C:\Windows\System\maWDGIk.exe
  C:\Windows\System\maWDGIk.exe
  2⤵
  PID:13224
- C:\Windows\System\hNjiLat.exe
  C:\Windows\System\hNjiLat.exe
  2⤵
  PID:13132
- C:\Windows\System\yolQZrn.exe
  C:\Windows\System\yolQZrn.exe
  2⤵
  PID:13244
- C:\Windows\System\rjMBZNj.exe
  C:\Windows\System\rjMBZNj.exe
  2⤵
  PID:3540
- C:\Windows\System\YifINIH.exe
  C:\Windows\System\YifINIH.exe
  2⤵
  PID:12064
- C:\Windows\System\JVyAosi.exe
  C:\Windows\System\JVyAosi.exe
  2⤵
  PID:13308
- C:\Windows\System\kUERqin.exe
  C:\Windows\System\kUERqin.exe
  2⤵
  PID:10952
- C:\Windows\System\AvQzAOg.exe
  C:\Windows\System\AvQzAOg.exe
  2⤵
  PID:11244
- C:\Windows\System\wFWuhhb.exe
  C:\Windows\System\wFWuhhb.exe
  2⤵
  PID:1136
- C:\Windows\System\cWFcVkt.exe
  C:\Windows\System\cWFcVkt.exe
  2⤵
  PID:11892
- C:\Windows\System\atLZedA.exe
  C:\Windows\System\atLZedA.exe
  2⤵
  PID:13236
- C:\Windows\System\AqlkJQJ.exe
  C:\Windows\System\AqlkJQJ.exe
  2⤵
  PID:10448
- C:\Windows\System\TUsQztQ.exe
  C:\Windows\System\TUsQztQ.exe
  2⤵
  PID:11172
- C:\Windows\System\QLjvNDp.exe
  C:\Windows\System\QLjvNDp.exe
  2⤵
  PID:12948
- C:\Windows\System\mdTCmLg.exe
  C:\Windows\System\mdTCmLg.exe
  2⤵
  PID:13020
- C:\Windows\System\JdyfIrs.exe
  C:\Windows\System\JdyfIrs.exe
  2⤵
  PID:11300
- C:\Windows\System\nEdRBbK.exe
  C:\Windows\System\nEdRBbK.exe
  2⤵
  PID:1160
- C:\Windows\System\XuPPAVz.exe
  C:\Windows\System\XuPPAVz.exe
  2⤵
  PID:1564
- C:\Windows\System\xLZcVte.exe
  C:\Windows\System\xLZcVte.exe
  2⤵
  PID:5372
- C:\Windows\System\RkqSGoF.exe
  C:\Windows\System\RkqSGoF.exe
  2⤵
  PID:4532
- C:\Windows\System\XmSJxvX.exe
  C:\Windows\System\XmSJxvX.exe
  2⤵
  PID:8560
- C:\Windows\System\bojRROx.exe
  C:\Windows\System\bojRROx.exe
  2⤵
  PID:8756
- C:\Windows\System\ArqlElJ.exe
  C:\Windows\System\ArqlElJ.exe
  2⤵
  PID:2696
- C:\Windows\System\VBdKeHu.exe
  C:\Windows\System\VBdKeHu.exe
  2⤵
  PID:11932
- C:\Windows\System\OftiwUZ.exe
  C:\Windows\System\OftiwUZ.exe
  2⤵
  PID:10844
- C:\Windows\System\HueuMzv.exe
  C:\Windows\System\HueuMzv.exe
  2⤵
  PID:3612
- C:\Windows\System\LCyKkNk.exe
  C:\Windows\System\LCyKkNk.exe
  2⤵
  PID:11440
- C:\Windows\System\YaXVbFQ.exe
  C:\Windows\System\YaXVbFQ.exe
  2⤵
  PID:8740
- C:\Windows\System\RdKrNcw.exe
  C:\Windows\System\RdKrNcw.exe
  2⤵
  PID:10444
- C:\Windows\System\buUKxlV.exe
  C:\Windows\System\buUKxlV.exe
  2⤵
  PID:13284
- C:\Windows\System\DrfYROv.exe
  C:\Windows\System\DrfYROv.exe
  2⤵
  PID:2052
- C:\Windows\System\vQvTKZQ.exe
  C:\Windows\System\vQvTKZQ.exe
  2⤵
  PID:4628
- C:\Windows\System\TRjulfV.exe
  C:\Windows\System\TRjulfV.exe
  2⤵
  PID:1172
- C:\Windows\System\upVZRyO.exe
  C:\Windows\System\upVZRyO.exe
  2⤵
  PID:6324
- C:\Windows\System\IbBlHHv.exe
  C:\Windows\System\IbBlHHv.exe
  2⤵
  PID:3536
- C:\Windows\System\ORzwSLB.exe
  C:\Windows\System\ORzwSLB.exe
  2⤵
  PID:11316
- C:\Windows\System\jnvBAmc.exe
  C:\Windows\System\jnvBAmc.exe
  2⤵
  PID:12808
- C:\Windows\System\IAMZcNx.exe
  C:\Windows\System\IAMZcNx.exe
  2⤵
  PID:1964
- C:\Windows\System\fZwyAno.exe
  C:\Windows\System\fZwyAno.exe
  2⤵
  PID:8292
- C:\Windows\System\JqMXqpF.exe
  C:\Windows\System\JqMXqpF.exe
  2⤵
  PID:10304
- C:\Windows\System\ccAmELU.exe
  C:\Windows\System\ccAmELU.exe
  2⤵
  PID:10136
- C:\Windows\System\gnxzSWS.exe
  C:\Windows\System\gnxzSWS.exe
  2⤵
  PID:8220
- C:\Windows\System\LFTwLyg.exe
  C:\Windows\System\LFTwLyg.exe
  2⤵
  PID:3568
- C:\Windows\System\bXBCTmI.exe
  C:\Windows\System\bXBCTmI.exe
  2⤵
  PID:6948
- C:\Windows\System\acaYyTX.exe
  C:\Windows\System\acaYyTX.exe
  2⤵
  PID:13320
- C:\Windows\System\OSslxUV.exe
  C:\Windows\System\OSslxUV.exe
  2⤵
  PID:13336
- C:\Windows\System\bcNcodu.exe
  C:\Windows\System\bcNcodu.exe
  2⤵
  PID:13356
- C:\Windows\System\YEMJwos.exe
  C:\Windows\System\YEMJwos.exe
  2⤵
  PID:13376
- C:\Windows\System\XCYiOUm.exe
  C:\Windows\System\XCYiOUm.exe
  2⤵
  PID:13392
- C:\Windows\System\IpiTaHW.exe
  C:\Windows\System\IpiTaHW.exe
  2⤵
  PID:13408
- C:\Windows\System\UxTJjNl.exe
  C:\Windows\System\UxTJjNl.exe
  2⤵
  PID:13428
- C:\Windows\System\sFvaqVr.exe
  C:\Windows\System\sFvaqVr.exe
  2⤵
  PID:13444
- C:\Windows\System\lbprObt.exe
  C:\Windows\System\lbprObt.exe
  2⤵
  PID:13460
- C:\Windows\System\TyqvFsi.exe
  C:\Windows\System\TyqvFsi.exe
  2⤵
  PID:13476
- C:\Windows\System\cnajfDB.exe
  C:\Windows\System\cnajfDB.exe
  2⤵
  PID:13492
- C:\Windows\System\VfAztQo.exe
  C:\Windows\System\VfAztQo.exe
  2⤵
  PID:13508
- C:\Windows\System\VktBSKG.exe
  C:\Windows\System\VktBSKG.exe
  2⤵
  PID:13524
- C:\Windows\System\RRBPheL.exe
  C:\Windows\System\RRBPheL.exe
  2⤵
  PID:13540
- C:\Windows\System\pRcFsYW.exe
  C:\Windows\System\pRcFsYW.exe
  2⤵
  PID:13556
- C:\Windows\System\qidJvtW.exe
  C:\Windows\System\qidJvtW.exe
  2⤵
  PID:13572
- C:\Windows\System\SmuNANH.exe
  C:\Windows\System\SmuNANH.exe
  2⤵
  PID:13588
- C:\Windows\System\yBUBebG.exe
  C:\Windows\System\yBUBebG.exe
  2⤵
  PID:13604
- C:\Windows\System\PMfOScJ.exe
  C:\Windows\System\PMfOScJ.exe
  2⤵
  PID:13620
- C:\Windows\System\raJKFMm.exe
  C:\Windows\System\raJKFMm.exe
  2⤵
  PID:13636
- C:\Windows\System\nUMmVeW.exe
  C:\Windows\System\nUMmVeW.exe
  2⤵
  PID:13656
- C:\Windows\System\oMmDXGJ.exe
  C:\Windows\System\oMmDXGJ.exe
  2⤵
  PID:13672
- C:\Windows\System\WbYLrLc.exe
  C:\Windows\System\WbYLrLc.exe
  2⤵
  PID:13688
- C:\Windows\System\UedQjbi.exe
  C:\Windows\System\UedQjbi.exe
  2⤵
  PID:13704
- C:\Windows\System\FBjhsRY.exe
  C:\Windows\System\FBjhsRY.exe
  2⤵
  PID:13720
- C:\Windows\System\fkKNqJu.exe
  C:\Windows\System\fkKNqJu.exe
  2⤵
  PID:13736
- C:\Windows\System\MHsowQp.exe
  C:\Windows\System\MHsowQp.exe
  2⤵
  PID:13752
- C:\Windows\System\aXaAXwr.exe
  C:\Windows\System\aXaAXwr.exe
  2⤵
  PID:13768
- C:\Windows\System\UzQmtmO.exe
  C:\Windows\System\UzQmtmO.exe
  2⤵
  PID:13784
- C:\Windows\System\zdPkoOJ.exe
  C:\Windows\System\zdPkoOJ.exe
  2⤵
  PID:13800
- C:\Windows\System\UXJzeCs.exe
  C:\Windows\System\UXJzeCs.exe
  2⤵
  PID:13816
- C:\Windows\System\LxgvYDE.exe
  C:\Windows\System\LxgvYDE.exe
  2⤵
  PID:13832
- C:\Windows\System\FCxUTUn.exe
  C:\Windows\System\FCxUTUn.exe
  2⤵
  PID:13848
- C:\Windows\System\yApfito.exe
  C:\Windows\System\yApfito.exe
  2⤵
  PID:13864
- C:\Windows\System\BGrtPuD.exe
  C:\Windows\System\BGrtPuD.exe
  2⤵
  PID:13880
- C:\Windows\System\vxvfpDP.exe
  C:\Windows\System\vxvfpDP.exe
  2⤵
  PID:13896
- C:\Windows\System\wOqumaA.exe
  C:\Windows\System\wOqumaA.exe
  2⤵
  PID:13920
- C:\Windows\System\ROWySrh.exe
  C:\Windows\System\ROWySrh.exe
  2⤵
  PID:13936
- C:\Windows\System\NkiXBvr.exe
  C:\Windows\System\NkiXBvr.exe
  2⤵
  PID:13956
- C:\Windows\System\rOqsggd.exe
  C:\Windows\System\rOqsggd.exe
  2⤵
  PID:13976
- C:\Windows\System\gzMqSrk.exe
  C:\Windows\System\gzMqSrk.exe
  2⤵
  PID:13992
- C:\Windows\System\LnvCvuM.exe
  C:\Windows\System\LnvCvuM.exe
  2⤵
  PID:14008
- C:\Windows\System\ZxJcPmy.exe
  C:\Windows\System\ZxJcPmy.exe
  2⤵
  PID:14024
- C:\Windows\System\PqMvevJ.exe
  C:\Windows\System\PqMvevJ.exe
  2⤵
  PID:14040
- C:\Windows\System\DzGlgXW.exe
  C:\Windows\System\DzGlgXW.exe
  2⤵
  PID:14056
- C:\Windows\System\CPSBJIL.exe
  C:\Windows\System\CPSBJIL.exe
  2⤵
  PID:14072
- C:\Windows\System\gtdaVQj.exe
  C:\Windows\System\gtdaVQj.exe
  2⤵
  PID:14092
- C:\Windows\System\qGsecpf.exe
  C:\Windows\System\qGsecpf.exe
  2⤵
  PID:14108
- C:\Windows\System\YjOoTvg.exe
  C:\Windows\System\YjOoTvg.exe
  2⤵
  PID:14124
- C:\Windows\System\gkTGUXo.exe
  C:\Windows\System\gkTGUXo.exe
  2⤵
  PID:14140
- C:\Windows\System\zWqmiXM.exe
  C:\Windows\System\zWqmiXM.exe
  2⤵
  PID:14156
- C:\Windows\System\HVHSsvS.exe
  C:\Windows\System\HVHSsvS.exe
  2⤵
  PID:14176
- C:\Windows\System\OeffCdC.exe
  C:\Windows\System\OeffCdC.exe
  2⤵
  PID:14192
- C:\Windows\System\Ugzhdnt.exe
  C:\Windows\System\Ugzhdnt.exe
  2⤵
  PID:14208
- C:\Windows\System\tFqxSuG.exe
  C:\Windows\System\tFqxSuG.exe
  2⤵
  PID:14224
- C:\Windows\System\nSYTJfV.exe
  C:\Windows\System\nSYTJfV.exe
  2⤵
  PID:14248
- C:\Windows\System\ZoYsNif.exe
  C:\Windows\System\ZoYsNif.exe
  2⤵
  PID:14264
- C:\Windows\System\bHjrIuE.exe
  C:\Windows\System\bHjrIuE.exe
  2⤵
  PID:14280
- C:\Windows\System\sHlnqiC.exe
  C:\Windows\System\sHlnqiC.exe
  2⤵
  PID:14296
- C:\Windows\System\HDyGWmu.exe
  C:\Windows\System\HDyGWmu.exe
  2⤵
  PID:14312
- C:\Windows\System\gTaxFCc.exe
  C:\Windows\System\gTaxFCc.exe
  2⤵
  PID:14328
- C:\Windows\System\EQAgfEj.exe
  C:\Windows\System\EQAgfEj.exe
  2⤵
  PID:13328
- C:\Windows\System\VbwNjto.exe
  C:\Windows\System\VbwNjto.exe
  2⤵
  PID:13384
- C:\Windows\System\XszqpOJ.exe
  C:\Windows\System\XszqpOJ.exe
  2⤵
  PID:13420
- C:\Windows\System\gbSvVQe.exe
  C:\Windows\System\gbSvVQe.exe
  2⤵
  PID:13452
- C:\Windows\System\stmsbsp.exe
  C:\Windows\System\stmsbsp.exe
  2⤵
  PID:11488
- C:\Windows\System\irWqObj.exe
  C:\Windows\System\irWqObj.exe
  2⤵
  PID:13500
- C:\Windows\System\sErAhND.exe
  C:\Windows\System\sErAhND.exe
  2⤵
  PID:13536
- C:\Windows\System\aQDxejr.exe
  C:\Windows\System\aQDxejr.exe
  2⤵
  PID:13580
- C:\Windows\System\xeAVfiM.exe
  C:\Windows\System\xeAVfiM.exe
  2⤵
  PID:13612
- C:\Windows\System\cctwwHL.exe
  C:\Windows\System\cctwwHL.exe
  2⤵
  PID:13648
- C:\Windows\System\dzvgYfU.exe
  C:\Windows\System\dzvgYfU.exe
  2⤵
  PID:13680
- C:\Windows\System\OiAdxak.exe
  C:\Windows\System\OiAdxak.exe
  2⤵
  PID:13712
- C:\Windows\System\tDdxVok.exe
  C:\Windows\System\tDdxVok.exe
  2⤵
  PID:13744
- C:\Windows\System\XUcclkF.exe
  C:\Windows\System\XUcclkF.exe
  2⤵
  PID:13776
- C:\Windows\System\rPUNDrV.exe
  C:\Windows\System\rPUNDrV.exe
  2⤵
  PID:13808
- C:\Windows\System\CJbgPzs.exe
  C:\Windows\System\CJbgPzs.exe
  2⤵
  PID:13840
- C:\Windows\System\sBtYoOM.exe
  C:\Windows\System\sBtYoOM.exe
  2⤵
  PID:13872
- C:\Windows\System\MJhUphB.exe
  C:\Windows\System\MJhUphB.exe
  2⤵
  PID:13904
- C:\Windows\System\yxZzLZM.exe
  C:\Windows\System\yxZzLZM.exe
  2⤵
  PID:13948
- C:\Windows\System\IIBFeRX.exe
  C:\Windows\System\IIBFeRX.exe
  2⤵
  PID:13984
- C:\Windows\System\DvjNtXq.exe
  C:\Windows\System\DvjNtXq.exe
  2⤵
  PID:14016
- C:\Windows\System\KQabPzA.exe
  C:\Windows\System\KQabPzA.exe
  2⤵
  PID:14048
- C:\Windows\System\lghILfw.exe
  C:\Windows\System\lghILfw.exe
  2⤵
  PID:14084
- C:\Windows\System\AlPBklC.exe
  C:\Windows\System\AlPBklC.exe
  2⤵
  PID:14116
- C:\Windows\System\lUTNfVc.exe
  C:\Windows\System\lUTNfVc.exe
  2⤵
  PID:14148
- C:\Windows\System\HCqocFZ.exe
  C:\Windows\System\HCqocFZ.exe
  2⤵
  PID:14184
- C:\Windows\System\TQGebBD.exe
  C:\Windows\System\TQGebBD.exe
  2⤵
  PID:14216
- C:\Windows\System\YUBdjJd.exe
  C:\Windows\System\YUBdjJd.exe
  2⤵
  PID:14236
- C:\Windows\System\MHGVJSg.exe
  C:\Windows\System\MHGVJSg.exe
  2⤵
  PID:14240
- C:\Windows\System\jUIHQHC.exe
  C:\Windows\System\jUIHQHC.exe
  2⤵
  PID:14292
- C:\Windows\System\BTpwNsm.exe
  C:\Windows\System\BTpwNsm.exe
  2⤵
  PID:14324
- C:\Windows\System\TkiSvHH.exe
  C:\Windows\System\TkiSvHH.exe
  2⤵
  PID:13372
- C:\Windows\System\QdDCzUc.exe
  C:\Windows\System\QdDCzUc.exe
  2⤵
  PID:13436
- C:\Windows\System\YiBiRXk.exe
  C:\Windows\System\YiBiRXk.exe
  2⤵
  PID:13504
- C:\Windows\System\QeABJyZ.exe
  C:\Windows\System\QeABJyZ.exe
  2⤵
  PID:13568
- C:\Windows\System\NiYGeua.exe
  C:\Windows\System\NiYGeua.exe
  2⤵
  PID:13632
- C:\Windows\System\IdLKxTh.exe
  C:\Windows\System\IdLKxTh.exe
  2⤵
  PID:13732
- C:\Windows\System\AfMvdiR.exe
  C:\Windows\System\AfMvdiR.exe
  2⤵
  PID:13796
- C:\Windows\System\mtNRqiq.exe
  C:\Windows\System\mtNRqiq.exe
  2⤵
  PID:13860
- C:\Windows\System\ssufcSs.exe
  C:\Windows\System\ssufcSs.exe
  2⤵
  PID:13932
- C:\Windows\System\AbHfakX.exe
  C:\Windows\System\AbHfakX.exe
  2⤵
  PID:14032
- C:\Windows\System\JqZkUxH.exe
  C:\Windows\System\JqZkUxH.exe
  2⤵
  PID:14100
- C:\Windows\System\vhqhrYQ.exe
  C:\Windows\System\vhqhrYQ.exe
  2⤵
  PID:14168
- C:\Windows\System\FNMFCdS.exe
  C:\Windows\System\FNMFCdS.exe
  2⤵
  PID:14244
- C:\Windows\System\CkUGFrB.exe
  C:\Windows\System\CkUGFrB.exe
  2⤵
  PID:14276
- C:\Windows\System\SZVPTEJ.exe
  C:\Windows\System\SZVPTEJ.exe
  2⤵
  PID:13316
- C:\Windows\System\JxBGRSs.exe
  C:\Windows\System\JxBGRSs.exe
  2⤵
  PID:13468
- C:\Windows\System\jRXjZms.exe
  C:\Windows\System\jRXjZms.exe
  2⤵
  PID:13596
- C:\Windows\System\uBPeekm.exe
  C:\Windows\System\uBPeekm.exe
  2⤵
  PID:13764
- C:\Windows\System\AECSTZh.exe
  C:\Windows\System\AECSTZh.exe
  2⤵
  PID:14000
- C:\Windows\System\xUuCUlt.exe
  C:\Windows\System\xUuCUlt.exe
  2⤵
  PID:14204
- C:\Windows\System\PaQHBrD.exe
  C:\Windows\System\PaQHBrD.exe
  2⤵
  PID:14308
- C:\Windows\System\ONXyNmz.exe
  C:\Windows\System\ONXyNmz.exe
  2⤵
  PID:13552
- C:\Windows\System\fOttIQE.exe
  C:\Windows\System\fOttIQE.exe
  2⤵
  PID:13828
- C:\Windows\System\WrNkvvX.exe
  C:\Windows\System\WrNkvvX.exe
  2⤵
  PID:13972
- C:\Windows\System\KoMvtGQ.exe
  C:\Windows\System\KoMvtGQ.exe
  2⤵
  PID:13968
- C:\Windows\System\vSxIlLp.exe
  C:\Windows\System\vSxIlLp.exe
  2⤵
  PID:2668
- C:\Windows\System\ZMSFIpp.exe
  C:\Windows\System\ZMSFIpp.exe
  2⤵
  PID:4624
- C:\Windows\System\sopBtoZ.exe
  C:\Windows\System\sopBtoZ.exe
  2⤵
  PID:4712
- C:\Windows\System\yjcdlWF.exe
  C:\Windows\System\yjcdlWF.exe
  2⤵
  PID:4552
- C:\Windows\System\lEOONok.exe
  C:\Windows\System\lEOONok.exe
  2⤵
  PID:2460
- C:\Windows\System\MkgXcHW.exe
  C:\Windows\System\MkgXcHW.exe
  2⤵
  PID:3444
- C:\Windows\System\kGerGwb.exe
  C:\Windows\System\kGerGwb.exe
  2⤵
  PID:2880
- C:\Windows\System\duvLFfa.exe
  C:\Windows\System\duvLFfa.exe
  2⤵
  PID:13916
- C:\Windows\System\hGbQiuR.exe
  C:\Windows\System\hGbQiuR.exe
  2⤵
  PID:13696
- C:\Windows\System\bvhdWxi.exe
  C:\Windows\System\bvhdWxi.exe
  2⤵
  PID:632
- C:\Windows\System\RetaGff.exe
  C:\Windows\System\RetaGff.exe
  2⤵
  PID:4432
- C:\Windows\System\YUiXyAa.exe
  C:\Windows\System\YUiXyAa.exe
  2⤵
  PID:4360
- C:\Windows\System\xFHKQOf.exe
  C:\Windows\System\xFHKQOf.exe
  2⤵
  PID:5092
- C:\Windows\System\WeEgdwQ.exe
  C:\Windows\System\WeEgdwQ.exe
  2⤵
  PID:1008
- C:\Windows\System\KPFHzbB.exe
  C:\Windows\System\KPFHzbB.exe
  2⤵
  PID:13440
- C:\Windows\System\VirdTVI.exe
  C:\Windows\System\VirdTVI.exe
  2⤵
  PID:8660
- C:\Windows\System\gqBVASA.exe
  C:\Windows\System\gqBVASA.exe
  2⤵
  PID:4572
- C:\Windows\System\ktFeJlx.exe
  C:\Windows\System\ktFeJlx.exe
  2⤵
  PID:4588
- C:\Windows\System\JuDLkHr.exe
  C:\Windows\System\JuDLkHr.exe
  2⤵
  PID:4888
- C:\Windows\System\XvMXDAG.exe
  C:\Windows\System\XvMXDAG.exe
  2⤵
  PID:4264
- C:\Windows\System\JhyhAlg.exe
  C:\Windows\System\JhyhAlg.exe
  2⤵
  PID:3296
- C:\Windows\System\MfzSueY.exe
  C:\Windows\System\MfzSueY.exe
  2⤵
  PID:4348
- C:\Windows\System\ENAlsna.exe
  C:\Windows\System\ENAlsna.exe
  2⤵
  PID:13344
- C:\Windows\System\bZYofTc.exe
  C:\Windows\System\bZYofTc.exe
  2⤵
  PID:14352
- C:\Windows\System\RvJyGUL.exe
  C:\Windows\System\RvJyGUL.exe
  2⤵
  PID:14392
- C:\Windows\System\EwhhkPv.exe
  C:\Windows\System\EwhhkPv.exe
  2⤵
  PID:14408
- C:\Windows\System\RKiAlPB.exe
  C:\Windows\System\RKiAlPB.exe
  2⤵
  PID:14424
- C:\Windows\System\rqpOxvS.exe
  C:\Windows\System\rqpOxvS.exe
  2⤵
  PID:14440
- C:\Windows\System\kSPgLqQ.exe
  C:\Windows\System\kSPgLqQ.exe
  2⤵
  PID:14456
- C:\Windows\System\pQdAThy.exe
  C:\Windows\System\pQdAThy.exe
  2⤵
  PID:14472
- C:\Windows\System\mawUSRi.exe
  C:\Windows\System\mawUSRi.exe
  2⤵
  PID:14488
- C:\Windows\System\vruJFtW.exe
  C:\Windows\System\vruJFtW.exe
  2⤵
  PID:14504
- C:\Windows\System\OdnvwXn.exe
  C:\Windows\System\OdnvwXn.exe
  2⤵
  PID:14520
- C:\Windows\System\utIZbnk.exe
  C:\Windows\System\utIZbnk.exe
  2⤵
  PID:14536
- C:\Windows\System\svJicpy.exe
  C:\Windows\System\svJicpy.exe
  2⤵
  PID:14552
- C:\Windows\System\nNYlVlW.exe
  C:\Windows\System\nNYlVlW.exe
  2⤵
  PID:14568
- C:\Windows\System\zfpyFmm.exe
  C:\Windows\System\zfpyFmm.exe
  2⤵
  PID:14584
- C:\Windows\System\guqireR.exe
  C:\Windows\System\guqireR.exe
  2⤵
  PID:14600
- C:\Windows\System\QdpjLig.exe
  C:\Windows\System\QdpjLig.exe
  2⤵
  PID:14616
- C:\Windows\System\ILqdReA.exe
  C:\Windows\System\ILqdReA.exe
  2⤵
  PID:14632
- C:\Windows\System\AZmnhCF.exe
  C:\Windows\System\AZmnhCF.exe
  2⤵
  PID:14648
- C:\Windows\System\xHmXWHl.exe
  C:\Windows\System\xHmXWHl.exe
  2⤵
  PID:14664
- C:\Windows\System\WsEOHmS.exe
  C:\Windows\System\WsEOHmS.exe
  2⤵
  PID:14680
- C:\Windows\System\ZiNbHGo.exe
  C:\Windows\System\ZiNbHGo.exe
  2⤵
  PID:14696
- C:\Windows\System\MsUyROF.exe
  C:\Windows\System\MsUyROF.exe
  2⤵
  PID:14712
- C:\Windows\System\dPNgqix.exe
  C:\Windows\System\dPNgqix.exe
  2⤵
  PID:14728
- C:\Windows\System\HkLAUoB.exe
  C:\Windows\System\HkLAUoB.exe
  2⤵
  PID:14748
- C:\Windows\System\OwbWZAg.exe
  C:\Windows\System\OwbWZAg.exe
  2⤵
  PID:14768
- C:\Windows\System\YrbfhAU.exe
  C:\Windows\System\YrbfhAU.exe
  2⤵
  PID:14784
- C:\Windows\System\ZthsMsf.exe
  C:\Windows\System\ZthsMsf.exe
  2⤵
  PID:14804
- C:\Windows\System\jTsFEID.exe
  C:\Windows\System\jTsFEID.exe
  2⤵
  PID:14824
- C:\Windows\System\JwgovLj.exe
  C:\Windows\System\JwgovLj.exe
  2⤵
  PID:14844
- C:\Windows\System\DCEJekv.exe
  C:\Windows\System\DCEJekv.exe
  2⤵
  PID:14860
- C:\Windows\System\wsxmhbj.exe
  C:\Windows\System\wsxmhbj.exe
  2⤵
  PID:14888
- C:\Windows\System\MZkvcFZ.exe
  C:\Windows\System\MZkvcFZ.exe
  2⤵
  PID:14920
- C:\Windows\System\bFSxoQC.exe
  C:\Windows\System\bFSxoQC.exe
  2⤵
  PID:14956
- C:\Windows\System\jyJgjfl.exe
  C:\Windows\System\jyJgjfl.exe
  2⤵
  PID:14976
- C:\Windows\System\UdMbQJa.exe
  C:\Windows\System\UdMbQJa.exe
  2⤵
  PID:14992
- C:\Windows\System\DwfQAxz.exe
  C:\Windows\System\DwfQAxz.exe
  2⤵
  PID:15008
- C:\Windows\System\AsCmVQN.exe
  C:\Windows\System\AsCmVQN.exe
  2⤵
  PID:15024
- C:\Windows\System\SBMYpoz.exe
  C:\Windows\System\SBMYpoz.exe
  2⤵
  PID:15044
- C:\Windows\System\TZFmCwr.exe
  C:\Windows\System\TZFmCwr.exe
  2⤵
  PID:15060
- C:\Windows\System\xplgKuX.exe
  C:\Windows\System\xplgKuX.exe
  2⤵
  PID:15088
- C:\Windows\System\ToPytgr.exe
  C:\Windows\System\ToPytgr.exe
  2⤵
  PID:15104
- C:\Windows\System\ZiosEvg.exe
  C:\Windows\System\ZiosEvg.exe
  2⤵
  PID:15120
- C:\Windows\System\tsiGTju.exe
  C:\Windows\System\tsiGTju.exe
  2⤵
  PID:15136
- C:\Windows\System\xzYmjUZ.exe
  C:\Windows\System\xzYmjUZ.exe
  2⤵
  PID:15156
- C:\Windows\System\MDCGzsg.exe
  C:\Windows\System\MDCGzsg.exe
  2⤵
  PID:15172
- C:\Windows\System\aWCYcSi.exe
  C:\Windows\System\aWCYcSi.exe
  2⤵
  PID:15188
- C:\Windows\System\aEYVolj.exe
  C:\Windows\System\aEYVolj.exe
  2⤵
  PID:15204
- C:\Windows\System\EvfQIMC.exe
  C:\Windows\System\EvfQIMC.exe
  2⤵
  PID:15220
- C:\Windows\System\pcZVPbF.exe
  C:\Windows\System\pcZVPbF.exe
  2⤵
  PID:15236
- C:\Windows\System\DYjMnGI.exe
  C:\Windows\System\DYjMnGI.exe
  2⤵
  PID:15252
- C:\Windows\System\fuFDggo.exe
  C:\Windows\System\fuFDggo.exe
  2⤵
  PID:15268
- C:\Windows\System\YcziskP.exe
  C:\Windows\System\YcziskP.exe
  2⤵
  PID:15284
- C:\Windows\System\BMMlVMy.exe
  C:\Windows\System\BMMlVMy.exe
  2⤵
  PID:15300
- C:\Windows\System\jmvaEir.exe
  C:\Windows\System\jmvaEir.exe
  2⤵
  PID:15316
- C:\Windows\System\nMUAfgB.exe
  C:\Windows\System\nMUAfgB.exe
  2⤵
  PID:15332
- C:\Windows\System\NJHDCuL.exe
  C:\Windows\System\NJHDCuL.exe
  2⤵
  PID:15348
- C:\Windows\System\cPjRXvi.exe
  C:\Windows\System\cPjRXvi.exe
  2⤵
  PID:3240
- C:\Windows\System\mkJyzCt.exe
  C:\Windows\System\mkJyzCt.exe
  2⤵
  PID:5336
- C:\Windows\System\bTTKiCO.exe
  C:\Windows\System\bTTKiCO.exe
  2⤵
  PID:5700
- C:\Windows\System\cQqzSOa.exe
  C:\Windows\System\cQqzSOa.exe
  2⤵
  PID:5684
- C:\Windows\System\UDHdGKI.exe
  C:\Windows\System\UDHdGKI.exe
  2⤵
  PID:4732
- C:\Windows\System\fRILpCX.exe
  C:\Windows\System\fRILpCX.exe
  2⤵
  PID:5552
- C:\Windows\System\NLppnVn.exe
  C:\Windows\System\NLppnVn.exe
  2⤵
  PID:5648
- C:\Windows\System\qyQrxMs.exe
  C:\Windows\System\qyQrxMs.exe
  2⤵
  PID:5248
- C:\Windows\System\kTnLYsF.exe
  C:\Windows\System\kTnLYsF.exe
  2⤵
  PID:5604
- C:\Windows\System\WAxKUZO.exe
  C:\Windows\System\WAxKUZO.exe
  2⤵
  PID:5812
- C:\Windows\System\AGrPJDS.exe
  C:\Windows\System\AGrPJDS.exe
  2⤵
  PID:5124
- C:\Windows\System\GIJGKsJ.exe
  C:\Windows\System\GIJGKsJ.exe
  2⤵
  PID:7088
- C:\Windows\System\yUngIDY.exe
  C:\Windows\System\yUngIDY.exe
  2⤵
  PID:1040
- C:\Windows\System\WJlfQIc.exe
  C:\Windows\System\WJlfQIc.exe
  2⤵
  PID:7092
- C:\Windows\System\GvIWLNd.exe
  C:\Windows\System\GvIWLNd.exe
  2⤵
  PID:6832
- C:\Windows\System\bRvLniT.exe
  C:\Windows\System\bRvLniT.exe
  2⤵
  PID:6396
- C:\Windows\System\DnJWMHd.exe
  C:\Windows\System\DnJWMHd.exe
  2⤵
  PID:5612
- C:\Windows\System\yKPwYKy.exe
  C:\Windows\System\yKPwYKy.exe
  2⤵
  PID:1768
- C:\Windows\System\GApKrpj.exe
  C:\Windows\System\GApKrpj.exe
  2⤵
  PID:2472
- C:\Windows\System\DhytVFS.exe
  C:\Windows\System\DhytVFS.exe
  2⤵
  PID:6092
- C:\Windows\System\RqeyTZC.exe
  C:\Windows\System\RqeyTZC.exe
  2⤵
  PID:5616
- C:\Windows\System\bkwXrKc.exe
  C:\Windows\System\bkwXrKc.exe
  2⤵
  PID:5452
- C:\Windows\System\qkCMYga.exe
  C:\Windows\System\qkCMYga.exe
  2⤵
  PID:6000
- C:\Windows\System\pNLxjqG.exe
  C:\Windows\System\pNLxjqG.exe
  2⤵
  PID:5144
- C:\Windows\System\NLysVWN.exe
  C:\Windows\System\NLysVWN.exe
  2⤵
  PID:14500
- C:\Windows\System\yrpOiEF.exe
  C:\Windows\System\yrpOiEF.exe
  2⤵
  PID:3724
- C:\Windows\System\bCyjwIz.exe
  C:\Windows\System\bCyjwIz.exe
  2⤵
  PID:14596
- C:\Windows\System\MHSGqdz.exe
  C:\Windows\System\MHSGqdz.exe
  2⤵
  PID:3936
- C:\Windows\System\wxwjxLP.exe
  C:\Windows\System\wxwjxLP.exe
  2⤵
  PID:14672
- C:\Windows\System\XkNXZiH.exe
  C:\Windows\System\XkNXZiH.exe
  2⤵
  PID:3492
- C:\Windows\System\YpkeSCZ.exe
  C:\Windows\System\YpkeSCZ.exe
  2⤵
  PID:14320
- C:\Windows\System\ACzHTVz.exe
  C:\Windows\System\ACzHTVz.exe
  2⤵
  PID:5420
- C:\Windows\System\ruXVkPr.exe
  C:\Windows\System\ruXVkPr.exe
  2⤵
  PID:7084
- C:\Windows\System\QhFmLEU.exe
  C:\Windows\System\QhFmLEU.exe
  2⤵
  PID:3916
- C:\Windows\System\ghEtScq.exe
  C:\Windows\System\ghEtScq.exe
  2⤵
  PID:3740
- C:\Windows\System\foFXRDZ.exe
  C:\Windows\System\foFXRDZ.exe
  2⤵
  PID:4112
- C:\Windows\System\JUjGOMz.exe
  C:\Windows\System\JUjGOMz.exe
  2⤵
  PID:14812
- C:\Windows\System\nLSpfPa.exe
  C:\Windows\System\nLSpfPa.exe
  2⤵
  PID:14560
- C:\Windows\System\ZpelbcA.exe
  C:\Windows\System\ZpelbcA.exe
  2⤵
  PID:5088
- C:\Windows\System\qNYGXhp.exe
  C:\Windows\System\qNYGXhp.exe
  2⤵
  PID:4492
- C:\Windows\System\tRCCEAZ.exe
  C:\Windows\System\tRCCEAZ.exe
  2⤵
  PID:6644
- C:\Windows\System\AMmdZWZ.exe
  C:\Windows\System\AMmdZWZ.exe
  2⤵
  PID:14376
- C:\Windows\System\WHyJRtA.exe
  C:\Windows\System\WHyJRtA.exe
  2⤵
  PID:14400
- C:\Windows\System\szlNZUw.exe
  C:\Windows\System\szlNZUw.exe
  2⤵
  PID:14416
- C:\Windows\System\simhTYC.exe
  C:\Windows\System\simhTYC.exe
  2⤵
  PID:14484
- C:\Windows\System\EuXZYig.exe
  C:\Windows\System\EuXZYig.exe
  2⤵
  PID:6912
- C:\Windows\System\yIiqZFk.exe
  C:\Windows\System\yIiqZFk.exe
  2⤵
  PID:7004
- C:\Windows\System\gYWNBhI.exe
  C:\Windows\System\gYWNBhI.exe
  2⤵
  PID:7164
- C:\Windows\System\JsBpALb.exe
  C:\Windows\System\JsBpALb.exe
  2⤵
  PID:14724
- C:\Windows\System\jzOjnyS.exe
  C:\Windows\System\jzOjnyS.exe
  2⤵
  PID:7228
- C:\Windows\System\ZllAxwL.exe
  C:\Windows\System\ZllAxwL.exe
  2⤵
  PID:14760
- C:\Windows\System\FVvueEs.exe
  C:\Windows\System\FVvueEs.exe
  2⤵
  PID:14876
- C:\Windows\System\SxoLZPA.exe
  C:\Windows\System\SxoLZPA.exe
  2⤵
  PID:7236
- C:\Windows\System\JnIryGs.exe
  C:\Windows\System\JnIryGs.exe
  2⤵
  PID:14868
- C:\Windows\System\TipuFBh.exe
  C:\Windows\System\TipuFBh.exe
  2⤵
  PID:7204
- C:\Windows\System\qJZOFLu.exe
  C:\Windows\System\qJZOFLu.exe
  2⤵
  PID:14948
- C:\Windows\System\SLmRwiQ.exe
  C:\Windows\System\SLmRwiQ.exe
  2⤵
  PID:15004
- C:\Windows\System\tEenAbl.exe
  C:\Windows\System\tEenAbl.exe
  2⤵
  PID:14964
- C:\Windows\System\cBUjuvN.exe
  C:\Windows\System\cBUjuvN.exe
  2⤵
  PID:15076
- C:\Windows\System\mpxysSS.exe
  C:\Windows\System\mpxysSS.exe
  2⤵
  PID:15056
- C:\Windows\System\hyiCxxb.exe
  C:\Windows\System\hyiCxxb.exe
  2⤵
  PID:15144
- C:\Windows\System\XAScmJP.exe
  C:\Windows\System\XAScmJP.exe
  2⤵
  PID:15180
- C:\Windows\System\clBlLod.exe
  C:\Windows\System\clBlLod.exe
  2⤵
  PID:15216
- C:\Windows\System\tfjoBEB.exe
  C:\Windows\System\tfjoBEB.exe
  2⤵
  PID:15244
- C:\Windows\System\ctaTukx.exe
  C:\Windows\System\ctaTukx.exe
  2⤵
  PID:15292
- C:\Windows\System\cdVvjyM.exe
  C:\Windows\System\cdVvjyM.exe
  2⤵
  PID:15328
- C:\Windows\System\TGfwtyf.exe
  C:\Windows\System\TGfwtyf.exe
  2⤵
  PID:4788
- C:\Windows\System\aQJDiVj.exe
  C:\Windows\System\aQJDiVj.exe
  2⤵
  PID:5736
- C:\Windows\System\oQiDuNQ.exe
  C:\Windows\System\oQiDuNQ.exe
  2⤵
  PID:4568
- C:\Windows\System\OqJDKSa.exe
  C:\Windows\System\OqJDKSa.exe
  2⤵
  PID:5912
- C:\Windows\System\hNmLJcB.exe
  C:\Windows\System\hNmLJcB.exe
  2⤵
  PID:6388
- C:\Windows\System\gYafuDh.exe
  C:\Windows\System\gYafuDh.exe
  2⤵
  PID:6500
- C:\Windows\System\TObYJsW.exe
  C:\Windows\System\TObYJsW.exe
  2⤵
  PID:5312
- C:\Windows\System\znybHiS.exe
  C:\Windows\System\znybHiS.exe
  2⤵
  PID:5472
- C:\Windows\System\ChILhht.exe
  C:\Windows\System\ChILhht.exe
  2⤵
  PID:5688
- C:\Windows\System\CUwWzSX.exe
  C:\Windows\System\CUwWzSX.exe
  2⤵
  PID:5596
- C:\Windows\System\PBcdlvh.exe
  C:\Windows\System\PBcdlvh.exe
  2⤵
  PID:7644
- C:\Windows\System\FhVcwhA.exe
  C:\Windows\System\FhVcwhA.exe
  2⤵
  PID:5168
- C:\Windows\System\OhmJBvt.exe
  C:\Windows\System\OhmJBvt.exe
  2⤵
  PID:5152
- C:\Windows\System\JZvPuil.exe
  C:\Windows\System\JZvPuil.exe
  2⤵
  PID:5800
- C:\Windows\System\HsLYGzh.exe
  C:\Windows\System\HsLYGzh.exe
  2⤵
  PID:6436
- C:\Windows\System\NyvFFJs.exe
  C:\Windows\System\NyvFFJs.exe
  2⤵
  PID:6184
- C:\Windows\System\HXVNDRO.exe
  C:\Windows\System\HXVNDRO.exe
  2⤵
  PID:7924
- C:\Windows\System\QqTXSef.exe
  C:\Windows\System\QqTXSef.exe
  2⤵
  PID:7996
- C:\Windows\System\WNYeaez.exe
  C:\Windows\System\WNYeaez.exe
  2⤵
  PID:8040
- C:\Windows\System\UaddEnK.exe
  C:\Windows\System\UaddEnK.exe
  2⤵
  PID:6512
- C:\Windows\System\GQHVulC.exe
  C:\Windows\System\GQHVulC.exe
  2⤵
  PID:6544
- C:\Windows\System\fhmUJcv.exe
  C:\Windows\System\fhmUJcv.exe
  2⤵
  PID:6492
- C:\Windows\System\OUopcAK.exe
  C:\Windows\System\OUopcAK.exe
  2⤵
  PID:6516
- C:\Windows\System\cVxxlzr.exe
  C:\Windows\System\cVxxlzr.exe
  2⤵
  PID:15148
- C:\Windows\System\DmvSNQk.exe
  C:\Windows\System\DmvSNQk.exe
  2⤵
  PID:8888
- C:\Windows\System\lRMynNP.exe
  C:\Windows\System\lRMynNP.exe
  2⤵
  PID:14512
- C:\Windows\System\dnkuAsn.exe
  C:\Windows\System\dnkuAsn.exe
  2⤵
  PID:5984
- C:\Windows\System\wbtNNfN.exe
  C:\Windows\System\wbtNNfN.exe
  2⤵
  PID:14592
- C:\Windows\System\SGLQwXM.exe
  C:\Windows\System\SGLQwXM.exe
  2⤵
  PID:14612
- C:\Windows\System\ihmHSUK.exe
  C:\Windows\System\ihmHSUK.exe
  2⤵
  PID:4896
- C:\Windows\System\ewFmHdN.exe
  C:\Windows\System\ewFmHdN.exe
  2⤵
  PID:8676
- C:\Windows\System\HxnxCgj.exe
  C:\Windows\System\HxnxCgj.exe
  2⤵
  PID:2912
- C:\Windows\System\VuZsDLJ.exe
  C:\Windows\System\VuZsDLJ.exe
  2⤵
  PID:904
- C:\Windows\System\bLyRPTR.exe
  C:\Windows\System\bLyRPTR.exe
  2⤵
  PID:14704
- C:\Windows\System\JTCUqhc.exe
  C:\Windows\System\JTCUqhc.exe
  2⤵
  PID:14360
- C:\Windows\System\MYdYfMu.exe
  C:\Windows\System\MYdYfMu.exe
  2⤵
  PID:6444
- C:\Windows\System\dxcCCGH.exe
  C:\Windows\System\dxcCCGH.exe
  2⤵
  PID:6728
- C:\Windows\System\lpjyqrB.exe
  C:\Windows\System\lpjyqrB.exe
  2⤵
  PID:6768
- C:\Windows\System\hevMivA.exe
  C:\Windows\System\hevMivA.exe
  2⤵
  PID:1080
- C:\Windows\System\stiZVZe.exe
  C:\Windows\System\stiZVZe.exe
  2⤵
  PID:6784
- C:\Windows\System\SiiXlZT.exe
  C:\Windows\System\SiiXlZT.exe
  2⤵
  PID:6804
- C:\Windows\System\EZUODcD.exe
  C:\Windows\System\EZUODcD.exe
  2⤵
  PID:3080
- C:\Windows\System\kWuszYh.exe
  C:\Windows\System\kWuszYh.exe
  2⤵
  PID:2424
- C:\Windows\System\IkwLmma.exe
  C:\Windows\System\IkwLmma.exe
  2⤵
  PID:6900
- C:\Windows\System\gZaSRLj.exe
  C:\Windows\System\gZaSRLj.exe
  2⤵
  PID:5404
- C:\Windows\System\BgaIANR.exe
  C:\Windows\System\BgaIANR.exe
  2⤵
  PID:14544
- C:\Windows\System\IKWmixP.exe
  C:\Windows\System\IKWmixP.exe
  2⤵
  PID:14548
- C:\Windows\System\kKgGeWD.exe
  C:\Windows\System\kKgGeWD.exe
  2⤵
  PID:7576
- C:\Windows\System\PaOkqYw.exe
  C:\Windows\System\PaOkqYw.exe
  2⤵
  PID:14656
- C:\Windows\System\sVOOapA.exe
  C:\Windows\System\sVOOapA.exe
  2⤵
  PID:14388
- C:\Windows\System\CeqHtiH.exe
  C:\Windows\System\CeqHtiH.exe
  2⤵
  PID:14372
- C:\Windows\System\MSNgeBq.exe
  C:\Windows\System\MSNgeBq.exe
  2⤵
  PID:6708
- C:\Windows\System\soFvrVt.exe
  C:\Windows\System\soFvrVt.exe
  2⤵
  PID:6976
- C:\Windows\System\QnGKdoO.exe
  C:\Windows\System\QnGKdoO.exe
  2⤵
  PID:14468
- C:\Windows\System\pqNzQEA.exe
  C:\Windows\System\pqNzQEA.exe
  2⤵
  PID:14892
- C:\Windows\System\qytubIF.exe
  C:\Windows\System\qytubIF.exe
  2⤵
  PID:7552
- C:\Windows\System\uhkMizL.exe
  C:\Windows\System\uhkMizL.exe
  2⤵
  PID:7532
- C:\Windows\System\aMbSyMi.exe
  C:\Windows\System\aMbSyMi.exe
  2⤵
  PID:14916
- C:\Windows\System\MrDnfzz.exe
  C:\Windows\System\MrDnfzz.exe
  2⤵
  PID:7488
- C:\Windows\System\wOTXzWr.exe
  C:\Windows\System\wOTXzWr.exe
  2⤵
  PID:6992
- C:\Windows\System\XZylHpb.exe
  C:\Windows\System\XZylHpb.exe
  2⤵
  PID:6392
- C:\Windows\System\tqpYGUM.exe
  C:\Windows\System\tqpYGUM.exe
  2⤵
  PID:14764
- C:\Windows\System\djbaIbY.exe
  C:\Windows\System\djbaIbY.exe
  2⤵
  PID:5896
- C:\Windows\System\UdmctnJ.exe
  C:\Windows\System\UdmctnJ.exe
  2⤵
  PID:14968
- C:\Windows\System\kmObQUs.exe
  C:\Windows\System\kmObQUs.exe
  2⤵
  PID:2064
- C:\Windows\System\XiMLuJz.exe
  C:\Windows\System\XiMLuJz.exe
  2⤵
  PID:14936
- C:\Windows\System\IhVkzga.exe
  C:\Windows\System\IhVkzga.exe
  2⤵
  PID:14908
- C:\Windows\System\yYcEJVp.exe
  C:\Windows\System\yYcEJVp.exe
  2⤵
  PID:15068
- C:\Windows\System\kicsttR.exe
  C:\Windows\System\kicsttR.exe
  2⤵
  PID:7108
- C:\Windows\System\svGYelr.exe
  C:\Windows\System\svGYelr.exe
  2⤵
  PID:14988
- C:\Windows\System\HdeLxSM.exe
  C:\Windows\System\HdeLxSM.exe
  2⤵
  PID:15072
- C:\Windows\System\LqGefzx.exe
  C:\Windows\System\LqGefzx.exe
  2⤵
  PID:6136
- C:\Windows\System\gUDhIFQ.exe
  C:\Windows\System\gUDhIFQ.exe
  2⤵
  PID:15128
- C:\Windows\System\qzTPdQb.exe
  C:\Windows\System\qzTPdQb.exe
  2⤵
  PID:15084
- C:\Windows\System\oZmOHTD.exe
  C:\Windows\System\oZmOHTD.exe
  2⤵
  PID:7604
- C:\Windows\System\GtTPYRo.exe
  C:\Windows\System\GtTPYRo.exe
  2⤵
  PID:15264
- C:\Windows\System\WWRHohv.exe
  C:\Windows\System\WWRHohv.exe
  2⤵
  PID:15276
- C:\Windows\System\URqFUoq.exe
  C:\Windows\System\URqFUoq.exe
  2⤵
  PID:15312
- C:\Windows\System\NqKjjyc.exe
  C:\Windows\System\NqKjjyc.exe
  2⤵
  PID:7152
- C:\Windows\System\IwcpLpE.exe
  C:\Windows\System\IwcpLpE.exe
  2⤵
  PID:7176
- C:\Windows\System\BiTmxdV.exe
  C:\Windows\System\BiTmxdV.exe
  2⤵
  PID:15356
- C:\Windows\System\VFYQRzX.exe
  C:\Windows\System\VFYQRzX.exe
  2⤵
  PID:5308
- C:\Windows\System\OnuGiTX.exe
  C:\Windows\System\OnuGiTX.exe
  2⤵
  PID:5752
- C:\Windows\System\qpMxMsU.exe
  C:\Windows\System\qpMxMsU.exe
  2⤵
  PID:5384
- C:\Windows\System\WSsBQkn.exe
  C:\Windows\System\WSsBQkn.exe
  2⤵
  PID:6640
- C:\Windows\System\mpQwjwd.exe
  C:\Windows\System\mpQwjwd.exe
  2⤵
  PID:5444
- C:\Windows\System\xtEbZxU.exe
  C:\Windows\System\xtEbZxU.exe
  2⤵
  PID:3188
- C:\Windows\System\gRQwYvb.exe
  C:\Windows\System\gRQwYvb.exe
  2⤵
  PID:7000
- C:\Windows\System\ALuSBGy.exe
  C:\Windows\System\ALuSBGy.exe
  2⤵
  PID:6464
- C:\Windows\System\NlyJgiF.exe
  C:\Windows\System\NlyJgiF.exe
  2⤵
  PID:6432
- C:\Windows\System\eXEFQGy.exe
  C:\Windows\System\eXEFQGy.exe
  2⤵
  PID:8000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbyqhfur.iay.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APAcbzZ.exe

Filesize
1.9MB

MD5
a710861c515b6e8d542921f63f9e3bf9

SHA1
6a024624a441fe9bb0976a69b567914e5594da2d

SHA256
7fab5c6826643fdb72d2153114087c4dea856631906985ce48e23a53f1ef609d

SHA512
8c23b84fbbf3c1e44c741edfb52df2b8195549f31192257dd1faf3ef2c56d7b1092503d64531db859c0d5b1470f5cf1135a2374301cabf893b508d79b03776d0

Download Submit
C:\Windows\System\AcyhDys.exe

Filesize
1.9MB

MD5
cc74a212b9e25d9b3470a0eeccab012d

SHA1
e25653cbca53cd041bae330d002ec80c7defe403

SHA256
f55e116b1a6c30b927d835543aeb64cde549073dc67d209b30e9dc7b36af937d

SHA512
c57f6c131135497ad78942eb45edf4d3bfdfcbd2d7cfa3894f18c90866a83ed7a681b2d667ff4dee5ca0421b2fdd7887b20c94d063d4928a8b1393aca44b2898

Download Submit
C:\Windows\System\DCrgLKP.exe

Filesize
1.9MB

MD5
cfaded10ff81c76066e6dd5f205c3f78

SHA1
c1cf728d0e0519fb704e37bd7ab9a5ccbc3fd430

SHA256
7a8468f03e3b6a528726276abb9d1fc7059c2e5277169a0c7afd2d5b5f3b513a

SHA512
16d0eb5f819514811ae8238c9a6d32e323082de9c18139171d358d9629ffea1eced11b838f06f793f8c4ea120082cd13ab9d3cfb182a645a9efef5bbe7081d43

Download Submit
C:\Windows\System\DKojHan.exe

Filesize
1.9MB

MD5
2907619b3b36c489e629e9be7f821c94

SHA1
d18a13f138183c1bca9a0aff782a487b39660ddc

SHA256
075bded6064d395b20b7fc0d47938c2ff858a5c766c55252d8900e4223c0d53d

SHA512
192b4ad91e3405d635608fefb3f970a43006cdb61de4f4b1f9628cf85d187ee17236b3cd02f07ec5f5e11379b4ec385577278bcd3c3d780506804d4e04cf90e9

Download Submit
C:\Windows\System\JIQiOLf.exe

Filesize
1.9MB

MD5
8f620cbebb7bfca6cf3c382aa503b734

SHA1
6b3769ef1660793b5cb643c96926a8e2609bcf77

SHA256
a843a0ffb83c8afd5b1caddbb2862027810b29c41d18a25c9d144c11470a2cb3

SHA512
b14e3c09efcf002d9c9a70d039e66299704952a1bc7824791ae586267ae18a30306d72020a037cc84fe739348304ec1fd05b1aec4d8a3783ac7e4f52406a24b0

Download Submit
C:\Windows\System\JwQbUwx.exe

Filesize
1.9MB

MD5
fd68bf6f3860854915fb0d506010da48

SHA1
8955739f6a51e9feff1d21144c5444fb4c189672

SHA256
60b2916ce076e1f564ea8581f615fd39e44217394607879e8c9f07b7685356d3

SHA512
708c92e549fe14f3a51e2a768e84d1f96fb29cfbb2462577a1a637f654cae44bcf09b18dc6296b06eaf11ec39c9ae74b79ccb3c6bb92eda4b81a74906d2ed5ed

Download Submit
C:\Windows\System\LJGgCdt.exe

Filesize
1.9MB

MD5
30231c710cfa67af9afa5f8d3625ce87

SHA1
ab5e76e6bda1ae3545b4ef1a26b25bd62eabea2b

SHA256
651c23adf6cc3d64da6cde20b10ec548dad8123011f5a303ce590e447fcd0c6d

SHA512
268bc0e093074dd2002e8a2a0fc4384b1f752bdbfe75c9484aaa925766f21c8582e8aa66d0ea7d50e1381413b44839bbfd7e941748e89eaa5d2bef762060018b

Download Submit
C:\Windows\System\LWYdzrp.exe

Filesize
1.9MB

MD5
f59cc19bd433543ea12928b8ae2a77f7

SHA1
cb03af2350bff25894fe346ea99dca1ac4c78bbf

SHA256
a92b6c6ff85470b228c1a8ff89d56a51560913cbd3ce81da776cc333e08069c9

SHA512
81657268cd8bb20f86904463056da4eea3478ad56f053f90babf35b86414206ed48a7742a52018a396acdff08617299228c32e1d1b5420fe0e6718956a5f1484

Download Submit
C:\Windows\System\LuGfpNb.exe

Filesize
1.9MB

MD5
c0581f04739bc44499dab3907000f691

SHA1
2dad4859af91161785c91aab0547de159c05036d

SHA256
1b41b55bdab89a783fa1f47d6a616bcb965dec8f315f2d9803b2630bbf00a3a6

SHA512
88479ea0f6613b913ee3deb4534486e5294e881ea923cd6ae2291425004f5ea53fde991ce2c4e1e83f72e7562b5e091d60492816017378a9adaa276f37dadaaf

Download Submit
C:\Windows\System\MDCqNkn.exe

Filesize
1.9MB

MD5
f1ce49ca0c4870c58d20f0ba8e47a94d

SHA1
1aae72dde8a37f70bfc5433270249a39e3749923

SHA256
fbdf2f618a70c33c4e02478e0499b17d657471cb559d6975e3d3e3521e7eb0ec

SHA512
fd8660a50fb8f18d54a64fa0602d9e179f2041a6023e144694a9d6cf32b42e44ccc5edd6b32dd43d7bedb8c21d0de904e9439b8a7d02178d1702ac999746e179

Download Submit
C:\Windows\System\Rapjyog.exe

Filesize
1.9MB

MD5
839ed25c9a75cce97dc614490288ee95

SHA1
fc7270089a10794f2105741683b00326fa1f728f

SHA256
c5c4baf7cafc07fe2895257d4466c635fa607008da9b32b1699e642fe2e6a812

SHA512
a7e2a63f74c1f6a044e86c6889ffa5fcaa84f93f8a6a612d785453718b6ba1ab5a066395dcc7f3633e743428e3d36a21f90b5b4ecd4448162c4885e1ec63ec95

Download Submit
C:\Windows\System\UMivQMH.exe

Filesize
1.9MB

MD5
377192f51cffd1420d72bb3ec6ebf6af

SHA1
40abca4c684b83d8957e5e27e128c53f8d4f0dc9

SHA256
2936e6e120299109c509bb77e7f59d8a1137882c66bcaa8aa13659f349866ca0

SHA512
6c88b59f10ef0c2eb6a26da1ded9f8a1f160e0684ee8d7deae252bd34858a87437ce1f9dfe39efa853085d540e72fb8d429b31aec5233b02f240cd23964a8ae3

Download Submit
C:\Windows\System\UrcGCbA.exe

Filesize
1.9MB

MD5
0d363cf3932749d43939d96b3d49ac7f

SHA1
bb2e91f89319524fa735a61b49520832eda2719e

SHA256
233f93ae346b26efc12b7dc28219f458b63c7713783a08799b967769619c2865

SHA512
77987d2cf2b114a595e349cc9901a0663e5f96c78b49991bd17af4b6b245105dcfe611914475b9f5a948f35f58b0f6dd3059017e20627e9603f144f8c18a9c29

Download Submit
C:\Windows\System\VoHVfwV.exe

Filesize
1.9MB

MD5
8bcd2cd5520a57c834f6ba94719e27a0

SHA1
1276063edabde0ac77fe82d1de44a831ce9e495f

SHA256
d2ebd2546baa78359cc5e1f23c3b59cd6d279f01918cccf6b054280d51c18c95

SHA512
42c3fd2234171237d8a4a6909ccce12f13afdf1fd87571219c207aba9197d013670764aa49f50b0435871c8740bd2e5f4b45cb8f65c2b862ea9506443f85ea01

Download Submit
C:\Windows\System\XFYMKRm.exe

Filesize
1.9MB

MD5
225c39fc12fcfb581c00ef03aaff186c

SHA1
747b30c5f943217cbb6838a1a0401a564fc925aa

SHA256
735a90e713005fa931f9fefeb814a1723a282a225022a39142afdf61cf9d0340

SHA512
a979f5f77f0178b4ef8c4b53be16a20a42007b114c9332bf14bc08c61ca3df970b5a083f2da0ac9ea9be7d799b52f57ad34d966f7bc963f599ca30046a3b1012

Download Submit
C:\Windows\System\XsjCCkm.exe

Filesize
1.9MB

MD5
faf4d442d248d10b75a92b3567b76201

SHA1
40726130318d4faa73b5ad5948377c899b93dfbc

SHA256
47a08b0673147bed840a5178144d7daf06bd42212e741211dd2037a590f5f6af

SHA512
30cd220ef2fda15408a80249b3ac28b8fa55d466fe627baedb50cbb3a4393d86b6440618962224887e11f5129a5c08b29f5807d746d51a445eb6ccbe11843be5

Download Submit
C:\Windows\System\YLyYicA.exe

Filesize
1.9MB

MD5
515dab210c76eed4c202b074d85ffe63

SHA1
25aae49b90a65bc10552084fc434045b4e652a4e

SHA256
9315a2defe7acafdfb143f2668503a7e6b2125fb256041e7e215f52a973663b2

SHA512
53f8eb4dc4c521a700ae463b2f13c3097734b5a3afac5cd440253f4d22d810fa30cd08bdc8e389e1c426b9f1a8c6867cfab9911455cbbd98a57de20b853f8632

Download Submit
C:\Windows\System\YbjHitA.exe

Filesize
1.9MB

MD5
d09784d92e8cb795ad44830b7b33b71c

SHA1
4955bfb0d173393a6d0cddcfacb11aab017f1417

SHA256
896b6d2ff11e9b397adf4b45ba91312ec40d882f8de29109ae8ad20342195db7

SHA512
17990b44bf3d5c81d2772911f71025f7078f3981744dba103698439f6df6fc1f0d0069f0ae334d45ffd37cc0a940a1f4374dce53ce9c53d075c6d5960954bcb9

Download Submit
C:\Windows\System\ZBWInCR.exe

Filesize
1.9MB

MD5
1ac75c13d6f3c4afa984f325e18dd7ba

SHA1
2eb2138f77bc2e32a7478ee86d0869485f39c242

SHA256
52bb6c40334e607c7fca45e9d6172862e41d274eb5f636e9186d6e73e5321b6c

SHA512
bf7dc3cbba008db66696a0cf389c14247a741b5fc8c4c7805dff53d030088cf780d04311ff96c54f28845cba04c6b48c9b4284ae09e10227d2705fd8b8d01177

Download Submit
C:\Windows\System\ZmPiwhz.exe

Filesize
1.9MB

MD5
ae9207679655332003c12c81ba73de92

SHA1
cdc96e19c6fccfc378a91497735aebfeaa21330b

SHA256
5a9738f4c0b13236ff8c2c4839e87612e292257a6e32dd082b055640c1ef7ba2

SHA512
356a81c708a9adc7de8b96384b285ffa6043f6fa455e1e1c33c0bfd806e765e56c4e2f3cf984cc345105daff103d38828ac43961d55355c05ed0ffd6b7806d2a

Download Submit
C:\Windows\System\bmDpNOY.exe

Filesize
1.9MB

MD5
738e4924d14205291450626009e96342

SHA1
3153056766acfb81fd7c70bec301d3d33f6b730e

SHA256
884c9ee2e64dbc0332cae2369de791b7a8cb78954a9eba45a321d8c4fc2e1d6b

SHA512
db1e63e99ff79a0c01a92822332daa400da644cf7985cf199301f36a1440daf339f6d4b181cbd9e8091736232cc93c58cd0295f45724411a0f7a0925d8110292

Download Submit
C:\Windows\System\cVLQcNF.exe

Filesize
1.9MB

MD5
640261ad86e040c650925565c04f7411

SHA1
ec549d6eafcf696752228ef95324d18aec5e050b

SHA256
d4508636d4cc2f98b3565ea869fdc0028378c15ca5218c9e4ebcbea3f2de241a

SHA512
deb644683af45eda23f8e26d0fcd4ec60845ba740a98c3e13429604ddd45c7895e425ba60167f8d5f9823a2a6c668b74520f996532294867198478affb52d1df

Download Submit
C:\Windows\System\dAGKMJD.exe

Filesize
1.9MB

MD5
5e0ef26f668cbefc3fbde773d18f2999

SHA1
12f2670de90d78c45b1240e01c78f35d7137d9de

SHA256
76c1b2e57ab2269190b4cdb0b2bc96d353b5a5ecb2567959399e1f2ca94b6594

SHA512
8bf5cf45b1cf3df785d034a80799fc909491a84df28396b40c83284519644dae927857ae420ab874159d3a6325974a0c852c6f360494c20285a44cc1cd914a81

Download Submit
C:\Windows\System\dKJGSeB.exe

Filesize
1.9MB

MD5
760ea0e6c5bcdfd239528c0275c117cd

SHA1
ff31eccd0f8e012c1802a30824460a692c256ab8

SHA256
79e1dbf06b39c4e49cc74cf043cb653e333bf7b0b3e1e122550ce231faa71083

SHA512
6ce1de0806f4881b9e208cabb1d17a46de8ebfa3059dcb438e270e086b19fadb4c2590843d3ac0ba47c60ea140254474691b4572a4e6d8b3bc5376c3ad52bdc1

Download Submit
C:\Windows\System\dqGAZmg.exe

Filesize
1.9MB

MD5
49ffb44c59278f8c1350efc5fd1b97e3

SHA1
74ece6df4b9c239cf42236c98cbd6f5de12e40e1

SHA256
6fd72893840595e5564c6951310450733536f69eb53cd119d4f8ce442280627c

SHA512
2379bd2633bc3842599668c217081dfa9c918c3ee44ac0bec447eeb6b1d7dfef9ed58f9186dfabb81eb2aedcb4c3d39ee86198d1fb69f39ee8ec0082b356ed44

Download Submit
C:\Windows\System\gDriXye.exe

Filesize
1.9MB

MD5
f6043b560a2f154cfaee2761dd0b696c

SHA1
95a98313e0764a7eb9d9cd665b5b0bf3abd7a5b8

SHA256
f7d48970db4fa05fec817a55910e427e96207bf99c43ee26a5e6dfa1ead383be

SHA512
302e33589ff65eb97009602732db9a23f7389074aedc9a46692e5bf608651fe106b903d185424cbef6275337f756c1f697cb91b7bfb260e644d86e669de3f234

Download Submit
C:\Windows\System\ghblxNJ.exe

Filesize
1.9MB

MD5
2c86d75a23fe186ea7c43f1896112bc5

SHA1
c76a1bf1d4a6057a305d6f383b6e9a5498c07d6d

SHA256
88873d1a9ea13b11d7cd62882e7f62da8bae39a0e3413e9ca3bff78496f04ca8

SHA512
eff79ebf015d81a5d5655084bdc9c63c82caabc765f161381e72c55b4396792eb0501ba3c0f4b1eef9c6fde81e712148a0a438f2886f6d7def7153c995fb2f99

Download Submit
C:\Windows\System\hMVggyG.exe

Filesize
1.9MB

MD5
45576c0518881f2778480464f01550d9

SHA1
6442788961e005c49256004c8386539ecec2549a

SHA256
48f0bb3b69cb46046edc4a5c7d1133012816a169f73090a97c783e15c31a50a8

SHA512
bee7e01d00482c2762cae5ba57c921652939739ece15d2f1b016467c5441f02e54e93d94d0755c9c50e9c601cb7122aaa8fd5341021758517035da5ce20c7dc3

Download Submit
C:\Windows\System\nuenqvW.exe

Filesize
1.9MB

MD5
6a5b04cd1abfc7a30daa97539537b81c

SHA1
2acc16f4ec08d87efc30723694817a387387eb3b

SHA256
054bcbb4610e92b283bf610c33c319b103d5aa5dd872c855000a79cd8a5eae48

SHA512
0b06d3c26c9cdb53498da6da4cb2e064e00177aa791343803c35e63efb24a8e94ffee817677cddb8c73d6aaa40131655508be9ab7a77dc9c3a56fafe7e1be111

Download Submit
C:\Windows\System\oGeWtIE.exe

Filesize
1.9MB

MD5
6acf6d28ccdba197f6fcc7af913c4fe6

SHA1
3d2fb53dd90553a7ed4d7b00a9bc00c410713e13

SHA256
98f92fba866ac266d8028fa4f16c49b0be884d32b46a0933be43616935034b32

SHA512
c9c22cc40749deb7f1b2eb88cd4feae20adf1850b38e8463bea0d1246dbaf8558efcd6227552dfa6b32cd6f3b0140df2fc55eca58947c5a38abbb5463052a700

Download Submit
C:\Windows\System\pPafOkA.exe

Filesize
1.9MB

MD5
3baa35f1e654916deadb52c89f4fee72

SHA1
37dead85340db20dfe327a17ac841a1e8412395a

SHA256
48778a52600efe486aa72659fcc78233afe9b10a02480574ec0441a63e71495e

SHA512
e0f989edf10b2211ee1ac4572f7e5f1b8abe81163ea2b32349f096bb55cbfedaf4f4b9f86026c8754efb11559944c3081a7eaf46f1df067b87d662a6648e3fdf

Download Submit
C:\Windows\System\qkrslfF.exe

Filesize
1.9MB

MD5
9014272cf89db72039f8fff91dd87403

SHA1
69aa997b134c863841e247e25b29ddb0b0fa48da

SHA256
097829911e80e7e0c724ae6c153b28c4a26d61dcbcaf2377fd5720c525ccff92

SHA512
1d137f49e27d1c4100e9b6f3ccfe3f9e0ad7063af1ebedd8920dde8cc8240f4bc6bdf321403414e510d187d836a07b79f44c5e2adda23bbf74cd1917fc1e247c

Download Submit
C:\Windows\System\rauTkns.exe

Filesize
1.9MB

MD5
3aecf69021673910ac42f5910e5e0cb8

SHA1
1ac3127c3fc80add448829d3f6f645be843b526e

SHA256
2008252b2ba47fe23d8d3903aa4ed17ae3e72e3aa9424dddcbf049fc7cda496f

SHA512
c48b0f98a84567c56d31e6e2c08547d03433cfafd35217503434708d22226f7a2c51162c0c62543a639fe30cf0b6028bc19bb84b68325d154a1587507fc28968

Download Submit
C:\Windows\System\reJJTtV.exe

Filesize
1.9MB

MD5
c221a01116a88144748ca468f87fa047

SHA1
edefce50b033109472b8420f4ed5168f0e730d60

SHA256
246effa4f884c8f1314143ed73f73df95ae9b1f5c87f9efef5b5dfe143529092

SHA512
eac14250be5491dbddce6225fb653eefa165a427adf2c88ee8dd03781d320348275e8c6ddc9df30d5cd01fbd870aff5ed00ea5e7ea2e73ee6b0d0fcf478ca659

Download Submit
C:\Windows\System\tSVizuL.exe

Filesize
1.9MB

MD5
c095d742b7ba432a56e4abb6b506faf8

SHA1
e686fe0f8c3031e41a9937a347d6449cbe7afd83

SHA256
5bbe13ecb4f63ef6f73aeee4baa3247060f749953089712b8eafc50dda8f13bb

SHA512
15daaed5fce6ceb4df857754d7cce2db06d9949a671b2f23b93ca2d110fa22fe6d2884cb3a5bb28a7ec15b58e7df5f61bfbe662ab3171739fd94a8e0bc9b66b6

Download Submit
C:\Windows\System\tetWXUy.exe

Filesize
1.9MB

MD5
c3f370c8589e0c5d1d05f6d822b49d15

SHA1
73d1577424e022c8f473f1fab677048c757d90e8

SHA256
21223bf93f776b1f7c8c593b95ca673e4fc5199bb7b319e8310f01deed241a6d

SHA512
709baeca35884aabee74486aa52431b6b638fe3b26118cbc43c0a28d16e206d580681de3fdf902bd5f5a63507d38ea10d0af83ee726f3c2800317f2da34c6a0b

Download Submit
C:\Windows\System\vTuuxpw.exe

Filesize
8B

MD5
3fa896e6e03a6c36944841b51d39e0d4

SHA1
4aefb55d27e72ef2d47403b0c8ce06d172004a35

SHA256
400669c3a4cce9fc0e15e111795da46968d6aa425fadb66d6e8c94b8a55f448d

SHA512
612aa9da451a214208d9de281e4424e86a677aa7a795a809d046b92d6bba85793ab2e58fb70475807546f0c1e5ee525dd22de24b67b42735f5d59a71d847dc4f

Download Submit
C:\Windows\System\vynBMpy.exe

Filesize
1.9MB

MD5
80e58394190839c8f7d769d45ca09bcd

SHA1
5d47ab9689be3d536dfcf0f55631569a472fbc05

SHA256
cf7888eaefef5e1a4eac47a5de9f7cff4738512fa01abf3169e108696d49fbf6

SHA512
8287adb6bc6635c7a7c35ecbb4ef85f219bbc749870b9fc2df5e642ee1dabb0abfd6265eab5354d35c8ea4f32af02b9fc36a9228a2dc18686f98b69a587cb8b0

Download Submit
C:\Windows\System\wWyLYrP.exe

Filesize
1.9MB

MD5
e3725ac43fe48f78bb8a35b2713b547a

SHA1
23f73aead7deeab2dca1dfa2ce7f396f77694a8a

SHA256
c894fd67be1f36723d4d65277cd41b1a85f78abc8d277fe2d13147d0dea87a52

SHA512
6e79ac46a434db5cab9b1355d3bc2e69953fcfb11328f7b1e7b1c71c07d261f36f670d9127131931311482d1bb91ecb39af0634768f63f2e1f1402313c39582b

Download Submit
C:\Windows\System\zBgEpwi.exe

Filesize
1.9MB

MD5
f59fbcf9beff39d55188fdb10e80dd60

SHA1
609d1c5d810721cf10d5c938df84bc6001684db3

SHA256
45f4344f1089063804c22f40ddb94a13507757e0dcfbaf39a285e7f391d22715

SHA512
1e892ea93ab313860baa1f6c4356d6ab3f5e633b003cf5fe14429540b4a4f4b748d48bc1837869953045b4ea9c29231cfab9aa26188bfdb169afbe1a2ccacfd5

Download Submit
memory/820-765-0x00007FF7EFB50000-0x00007FF7EFF42000-memory.dmp

Filesize
3.9MB

Download
memory/820-4430-0x00007FF7EFB50000-0x00007FF7EFF42000-memory.dmp

Filesize
3.9MB

Download
memory/1196-763-0x00007FF61FA40000-0x00007FF61FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1196-4452-0x00007FF61FA40000-0x00007FF61FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1412-51-0x00007FF624920000-0x00007FF624D12000-memory.dmp

Filesize
3.9MB

Download
memory/1580-761-0x00007FF7EEB10000-0x00007FF7EEF02000-memory.dmp

Filesize
3.9MB

Download
memory/1580-4476-0x00007FF7EEB10000-0x00007FF7EEF02000-memory.dmp

Filesize
3.9MB

Download
memory/1824-4412-0x00007FF77A640000-0x00007FF77AA32000-memory.dmp

Filesize
3.9MB

Download
memory/1824-570-0x00007FF77A640000-0x00007FF77AA32000-memory.dmp

Filesize
3.9MB

Download
memory/2040-292-0x00007FF6AE0B0000-0x00007FF6AE4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-4406-0x00007FF6985C0000-0x00007FF6989B2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-759-0x00007FF6985C0000-0x00007FF6989B2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-797-0x0000024AA7B70000-0x0000024AA7B92000-memory.dmp

Filesize
136KB

Download
memory/2388-126-0x00007FF9B0EF0000-0x00007FF9B19B1000-memory.dmp

Filesize
10.8MB

Download
memory/2388-36-0x00007FF9B0EF3000-0x00007FF9B0EF5000-memory.dmp

Filesize
8KB

Download
memory/2388-248-0x00007FF9B0EF0000-0x00007FF9B19B1000-memory.dmp

Filesize
10.8MB

Download
memory/2388-1001-0x0000024AA90B0000-0x0000024AA9856000-memory.dmp

Filesize
7.6MB

Download
memory/2440-0-0x00007FF6DF340000-0x00007FF6DF732000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1-0x000002168B9B0000-0x000002168B9C0000-memory.dmp

Filesize
64KB

Download
memory/2744-768-0x00007FF69B070000-0x00007FF69B462000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4456-0x00007FF69B070000-0x00007FF69B462000-memory.dmp

Filesize
3.9MB

Download
memory/2800-749-0x00007FF6E4160000-0x00007FF6E4552000-memory.dmp

Filesize
3.9MB

Download
memory/2800-4415-0x00007FF6E4160000-0x00007FF6E4552000-memory.dmp

Filesize
3.9MB

Download
memory/2896-4478-0x00007FF65BAB0000-0x00007FF65BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-767-0x00007FF65BAB0000-0x00007FF65BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-4419-0x00007FF704210000-0x00007FF704602000-memory.dmp

Filesize
3.9MB

Download
memory/3148-717-0x00007FF704210000-0x00007FF704602000-memory.dmp

Filesize
3.9MB

Download
memory/3204-17-0x00007FF738B10000-0x00007FF738F02000-memory.dmp

Filesize
3.9MB

Download
memory/3228-4422-0x00007FF736280000-0x00007FF736672000-memory.dmp

Filesize
3.9MB

Download
memory/3228-341-0x00007FF736280000-0x00007FF736672000-memory.dmp

Filesize
3.9MB

Download
memory/3264-4448-0x00007FF6D8A90000-0x00007FF6D8E82000-memory.dmp

Filesize
3.9MB

Download
memory/3264-762-0x00007FF6D8A90000-0x00007FF6D8E82000-memory.dmp

Filesize
3.9MB

Download
memory/3328-4434-0x00007FF6EF640000-0x00007FF6EFA32000-memory.dmp

Filesize
3.9MB

Download
memory/3328-416-0x00007FF6EF640000-0x00007FF6EFA32000-memory.dmp

Filesize
3.9MB

Download
memory/3384-764-0x00007FF72F8C0000-0x00007FF72FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-4462-0x00007FF72F8C0000-0x00007FF72FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-4444-0x00007FF6A11B0000-0x00007FF6A15A2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-771-0x00007FF6A11B0000-0x00007FF6A15A2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-4402-0x00007FF6B8570000-0x00007FF6B8962000-memory.dmp

Filesize
3.9MB

Download
memory/3716-770-0x00007FF6B8570000-0x00007FF6B8962000-memory.dmp

Filesize
3.9MB

Download
memory/3880-769-0x00007FF6E7AC0000-0x00007FF6E7EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-4474-0x00007FF6BE800000-0x00007FF6BEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-760-0x00007FF6BE800000-0x00007FF6BEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-4465-0x00007FF63E7D0000-0x00007FF63EBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-766-0x00007FF63E7D0000-0x00007FF63EBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-20-0x00007FF72B290000-0x00007FF72B682000-memory.dmp

Filesize
3.9MB

Download
memory/4884-4438-0x00007FF6E0930000-0x00007FF6E0D22000-memory.dmp

Filesize
3.9MB

Download
memory/4884-507-0x00007FF6E0930000-0x00007FF6E0D22000-memory.dmp

Filesize
3.9MB

Download
memory/5060-10-0x00007FF7897B0000-0x00007FF789BA2000-memory.dmp

Filesize
3.9MB

Download