xmrig | 98a9d5596e122db5acf66c761f86f9cc410bbdc154bc3b99b623d188f1372768

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
Size

2.2MB
MD5

24d0a5b1c66a8716b897ab1db55304e0
SHA1

aef3141221522a824a16550dcb6587165fac6081
SHA256

98a9d5596e122db5acf66c761f86f9cc410bbdc154bc3b99b623d188f1372768
SHA512

dbbf35986612af0cdc9d9835a2bd21b4c34ffad3a1964a765ff6213967e8ae27aaab57a8ee940129b981112fef8cd24002ef865dc97d0f6f406195a055a28c0f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbRh:NABP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1724-200-0x00007FF66EDF0000-0x00007FF66F1E2000-memory.dmp	xmrig
behavioral2/memory/3168-202-0x00007FF73F520000-0x00007FF73F912000-memory.dmp	xmrig
behavioral2/memory/408-221-0x00007FF6A8B80000-0x00007FF6A8F72000-memory.dmp	xmrig
behavioral2/memory/2852-225-0x00007FF626B80000-0x00007FF626F72000-memory.dmp	xmrig
behavioral2/memory/4768-241-0x00007FF660A20000-0x00007FF660E12000-memory.dmp	xmrig
behavioral2/memory/3188-247-0x00007FF7FDA00000-0x00007FF7FDDF2000-memory.dmp	xmrig
behavioral2/memory/5036-246-0x00007FF6A9560000-0x00007FF6A9952000-memory.dmp	xmrig
behavioral2/memory/2968-244-0x00007FF7847D0000-0x00007FF784BC2000-memory.dmp	xmrig
behavioral2/memory/5072-243-0x00007FF607050000-0x00007FF607442000-memory.dmp	xmrig
behavioral2/memory/4996-242-0x00007FF764C90000-0x00007FF765082000-memory.dmp	xmrig
behavioral2/memory/3124-240-0x00007FF75E3D0000-0x00007FF75E7C2000-memory.dmp	xmrig
behavioral2/memory/2088-239-0x00007FF625140000-0x00007FF625532000-memory.dmp	xmrig
behavioral2/memory/3856-238-0x00007FF7C4440000-0x00007FF7C4832000-memory.dmp	xmrig
behavioral2/memory/388-237-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	xmrig
behavioral2/memory/1876-233-0x00007FF79B240000-0x00007FF79B632000-memory.dmp	xmrig
behavioral2/memory/2948-224-0x00007FF6E1090000-0x00007FF6E1482000-memory.dmp	xmrig
behavioral2/memory/4300-219-0x00007FF785C00000-0x00007FF785FF2000-memory.dmp	xmrig
behavioral2/memory/2944-199-0x00007FF6629F0000-0x00007FF662DE2000-memory.dmp	xmrig
behavioral2/memory/2140-198-0x00007FF7F66C0000-0x00007FF7F6AB2000-memory.dmp	xmrig
behavioral2/memory/5092-183-0x00007FF777C10000-0x00007FF778002000-memory.dmp	xmrig
behavioral2/memory/3608-139-0x00007FF700E10000-0x00007FF701202000-memory.dmp	xmrig
behavioral2/memory/3860-110-0x00007FF66C0E0000-0x00007FF66C4D2000-memory.dmp	xmrig
behavioral2/memory/1844-81-0x00007FF6C2EB0000-0x00007FF6C32A2000-memory.dmp	xmrig
behavioral2/memory/428-51-0x00007FF774C90000-0x00007FF775082000-memory.dmp	xmrig
behavioral2/memory/5092-3905-0x00007FF777C10000-0x00007FF778002000-memory.dmp	xmrig
behavioral2/memory/2140-3925-0x00007FF7F66C0000-0x00007FF7F6AB2000-memory.dmp	xmrig
behavioral2/memory/2944-3895-0x00007FF6629F0000-0x00007FF662DE2000-memory.dmp	xmrig
behavioral2/memory/3168-3929-0x00007FF73F520000-0x00007FF73F912000-memory.dmp	xmrig
behavioral2/memory/3856-3939-0x00007FF7C4440000-0x00007FF7C4832000-memory.dmp	xmrig
behavioral2/memory/4300-3936-0x00007FF785C00000-0x00007FF785FF2000-memory.dmp	xmrig
behavioral2/memory/408-3944-0x00007FF6A8B80000-0x00007FF6A8F72000-memory.dmp	xmrig
behavioral2/memory/1724-3931-0x00007FF66EDF0000-0x00007FF66F1E2000-memory.dmp	xmrig
behavioral2/memory/5036-3962-0x00007FF6A9560000-0x00007FF6A9952000-memory.dmp	xmrig
behavioral2/memory/4768-3957-0x00007FF660A20000-0x00007FF660E12000-memory.dmp	xmrig
behavioral2/memory/2948-3974-0x00007FF6E1090000-0x00007FF6E1482000-memory.dmp	xmrig
behavioral2/memory/2088-4020-0x00007FF625140000-0x00007FF625532000-memory.dmp	xmrig
behavioral2/memory/3188-4026-0x00007FF7FDA00000-0x00007FF7FDDF2000-memory.dmp	xmrig
behavioral2/memory/2852-4038-0x00007FF626B80000-0x00007FF626F72000-memory.dmp	xmrig
behavioral2/memory/5072-4029-0x00007FF607050000-0x00007FF607442000-memory.dmp	xmrig
behavioral2/memory/3124-4015-0x00007FF75E3D0000-0x00007FF75E7C2000-memory.dmp	xmrig
behavioral2/memory/2968-3999-0x00007FF7847D0000-0x00007FF784BC2000-memory.dmp	xmrig
behavioral2/memory/4996-3996-0x00007FF764C90000-0x00007FF765082000-memory.dmp	xmrig
behavioral2/memory/388-3991-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	3296	powershell.exe
5	3296	powershell.exe
7	3296	powershell.exe
8	3296	powershell.exe
10	3296	powershell.exe
11	3296	powershell.exe
13	3296	powershell.exe
16	3296	powershell.exe
17	3296	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3296	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
428	EpYhLZQ.exe
1844	vPVfTcV.exe
3860	Jnygmqg.exe
3608	LwRtCIM.exe
5092	vDxcJnC.exe
2140	DOTRIcQ.exe
2944	koIfifh.exe
1724	IiVlKCy.exe
3168	jpnneHo.exe
4300	CHnWPCt.exe
5036	xnHBVar.exe
408	vHvymXK.exe
2948	sRSbsJE.exe
2852	aOBIPnG.exe
1876	GmLldbI.exe
388	tJdxiqb.exe
3856	LJNjeAc.exe
2088	OwIkkWn.exe
3124	FEWUDKQ.exe
3188	rYFenrz.exe
4768	rQLOEXo.exe
4996	uPzxXqt.exe
5072	nbdEkVl.exe
2968	bBTXEzk.exe
1572	USuWcvU.exe
4476	hxfFpic.exe
3052	JCIxOjr.exe
4252	PXqUqtm.exe
5052	tGhbfZn.exe
1296	qufhxod.exe
5024	aOyuaKB.exe
4100	MWsTMwp.exe
1452	eTqoySM.exe
948	eMkbcQJ.exe
4544	yMllXaU.exe
1664	uoioAdd.exe
3892	MkydxjP.exe
2608	gcVfjyN.exe
2340	UuJaiyU.exe
400	SsjvwTc.exe
4524	npSXVbw.exe
1880	mLyoSWj.exe
4436	lSXKKJx.exe
4260	IhqXUjQ.exe
2392	TpTgPav.exe
3588	UozAtcT.exe
516	aMnDIny.exe
548	LaOHlRF.exe
3212	fNxXgzN.exe
3804	JXwsqQP.exe
3752	ioLGuRu.exe
372	xaBXNrS.exe
1632	nxNoYDp.exe
3136	gLjARlg.exe
4684	KJpXsmW.exe
2844	sFvIrXA.exe
4504	ZplMFZt.exe
4160	CcEymuN.exe
2648	kPxHlnw.exe
3560	XMcseQW.exe
3340	zbtUDNx.exe
2696	oKwBAoo.exe
4396	RrGmLvk.exe
3640	GNYlrKo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF7896D0000-0x00007FF789AC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-23.dat	upx
behavioral2/files/0x000a000000023b92-66.dat	upx
behavioral2/files/0x000a000000023ba0-128.dat	upx
behavioral2/files/0x000a000000023ba3-155.dat	upx
behavioral2/memory/1724-200-0x00007FF66EDF0000-0x00007FF66F1E2000-memory.dmp	upx
behavioral2/memory/3168-202-0x00007FF73F520000-0x00007FF73F912000-memory.dmp	upx
behavioral2/memory/408-221-0x00007FF6A8B80000-0x00007FF6A8F72000-memory.dmp	upx
behavioral2/memory/2852-225-0x00007FF626B80000-0x00007FF626F72000-memory.dmp	upx
behavioral2/memory/4768-241-0x00007FF660A20000-0x00007FF660E12000-memory.dmp	upx
behavioral2/memory/3188-247-0x00007FF7FDA00000-0x00007FF7FDDF2000-memory.dmp	upx
behavioral2/memory/5036-246-0x00007FF6A9560000-0x00007FF6A9952000-memory.dmp	upx
behavioral2/memory/2968-244-0x00007FF7847D0000-0x00007FF784BC2000-memory.dmp	upx
behavioral2/memory/5072-243-0x00007FF607050000-0x00007FF607442000-memory.dmp	upx
behavioral2/memory/4996-242-0x00007FF764C90000-0x00007FF765082000-memory.dmp	upx
behavioral2/memory/3124-240-0x00007FF75E3D0000-0x00007FF75E7C2000-memory.dmp	upx
behavioral2/memory/2088-239-0x00007FF625140000-0x00007FF625532000-memory.dmp	upx
behavioral2/memory/3856-238-0x00007FF7C4440000-0x00007FF7C4832000-memory.dmp	upx
behavioral2/memory/388-237-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	upx
behavioral2/memory/1876-233-0x00007FF79B240000-0x00007FF79B632000-memory.dmp	upx
behavioral2/memory/2948-224-0x00007FF6E1090000-0x00007FF6E1482000-memory.dmp	upx
behavioral2/memory/4300-219-0x00007FF785C00000-0x00007FF785FF2000-memory.dmp	upx
behavioral2/memory/2944-199-0x00007FF6629F0000-0x00007FF662DE2000-memory.dmp	upx
behavioral2/memory/2140-198-0x00007FF7F66C0000-0x00007FF7F6AB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-196.dat	upx
behavioral2/files/0x000a000000023baa-195.dat	upx
behavioral2/files/0x000a000000023b9f-189.dat	upx
behavioral2/files/0x000a000000023ba9-188.dat	upx
behavioral2/files/0x000b000000023b85-187.dat	upx
behavioral2/memory/5092-183-0x00007FF777C10000-0x00007FF778002000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-182.dat	upx
behavioral2/files/0x000a000000023ba8-180.dat	upx
behavioral2/files/0x000a000000023ba7-177.dat	upx
behavioral2/files/0x000a000000023ba6-176.dat	upx
behavioral2/files/0x000a000000023b9b-170.dat	upx
behavioral2/files/0x000a000000023ba5-167.dat	upx
behavioral2/files/0x000a000000023b94-166.dat	upx
behavioral2/files/0x000a000000023ba4-162.dat	upx
behavioral2/files/0x000a000000023b98-159.dat	upx
behavioral2/files/0x000a000000023b9e-152.dat	upx
behavioral2/files/0x000a000000023ba2-151.dat	upx
behavioral2/files/0x000b000000023b99-144.dat	upx
behavioral2/memory/3608-139-0x00007FF700E10000-0x00007FF701202000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-132.dat	upx
behavioral2/files/0x000b000000023b9a-130.dat	upx
behavioral2/files/0x000a000000023b9d-119.dat	upx
behavioral2/files/0x000a000000023b96-116.dat	upx
behavioral2/files/0x000a000000023ba1-147.dat	upx
behavioral2/files/0x000a000000023b95-113.dat	upx
behavioral2/files/0x000a000000023b91-111.dat	upx
behavioral2/memory/3860-110-0x00007FF66C0E0000-0x00007FF66C4D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-95.dat	upx
behavioral2/files/0x000a000000023b8c-83.dat	upx
behavioral2/memory/1844-81-0x00007FF6C2EB0000-0x00007FF6C32A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-63.dat	upx
behavioral2/files/0x000a000000023b8f-62.dat	upx
behavioral2/memory/428-51-0x00007FF774C90000-0x00007FF775082000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-60.dat	upx
behavioral2/files/0x000a000000023b8a-54.dat	upx
behavioral2/files/0x000a000000023b8d-36.dat	upx
behavioral2/files/0x000a000000023b89-31.dat	upx
behavioral2/files/0x000a000000023b88-18.dat	upx
behavioral2/files/0x000d000000023b10-9.dat	upx
behavioral2/memory/5092-3905-0x00007FF777C10000-0x00007FF778002000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kCjxENr.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\dTAMpHk.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\dSPQocW.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\rCCDhxh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\IadPNzN.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\SDmNoKu.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vEZmANs.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\wQuxAee.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\bHcocTe.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\wRLTWal.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\hEhDwNr.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\FXTRaYM.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\PXqyfLv.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\sDhCcAe.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\KYLyLWw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ZJCJCfd.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\thMTmRj.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\AOAYXIY.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\FBAWhSX.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\QrczEql.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\mqjVljh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\jPdtDnD.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ZswCkGh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\mzFMyuC.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vDBFevT.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\KScTcEa.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\srUWsjj.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\fAGEluW.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\JnlMLHx.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\fQbyjvJ.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\yLweLBh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ZBZnrBi.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\HGgisud.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\MjPPtUV.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\bGpbenv.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vtQieYw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\JiBFwDt.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\rlOIJKJ.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ZnUWGoJ.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\MoVoYEv.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\tAbXngm.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\mLlwxps.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ytMzapn.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vlQmiTs.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\CGdcHAx.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\xsZvuJB.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\DBApRTV.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\kMpOCoV.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\JqsKVvB.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ElgXbov.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\nMZnQTw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\zEfDxrH.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\nHoKUyA.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vrmqfTI.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\lZyRhvy.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\SYrbcRp.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\yTWvxPM.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\YgkPiVf.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\EeIOxIi.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\jihGLeX.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\EJNWWus.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\kbtkYVB.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\rQgxCEy.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\yLdRDcb.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3296	powershell.exe
3296	powershell.exe
3296	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeLockMemoryPrivilege	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3296	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	85
PID 1448 wrote to memory of 3296	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	85
PID 1448 wrote to memory of 428	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	86
PID 1448 wrote to memory of 428	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	86
PID 1448 wrote to memory of 1844	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	87
PID 1448 wrote to memory of 1844	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	87
PID 1448 wrote to memory of 3860	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	88
PID 1448 wrote to memory of 3860	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	88
PID 1448 wrote to memory of 3608	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	89
PID 1448 wrote to memory of 3608	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	89
PID 1448 wrote to memory of 5092	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	90
PID 1448 wrote to memory of 5092	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	90
PID 1448 wrote to memory of 2140	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	91
PID 1448 wrote to memory of 2140	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	91
PID 1448 wrote to memory of 2944	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	92
PID 1448 wrote to memory of 2944	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	92
PID 1448 wrote to memory of 1724	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	93
PID 1448 wrote to memory of 1724	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	93
PID 1448 wrote to memory of 3168	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	94
PID 1448 wrote to memory of 3168	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	94
PID 1448 wrote to memory of 4300	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	95
PID 1448 wrote to memory of 4300	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	95
PID 1448 wrote to memory of 5036	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	96
PID 1448 wrote to memory of 5036	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	96
PID 1448 wrote to memory of 408	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	97
PID 1448 wrote to memory of 408	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	97
PID 1448 wrote to memory of 2948	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	98
PID 1448 wrote to memory of 2948	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	98
PID 1448 wrote to memory of 2852	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	99
PID 1448 wrote to memory of 2852	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	99
PID 1448 wrote to memory of 1876	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	100
PID 1448 wrote to memory of 1876	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	100
PID 1448 wrote to memory of 388	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	101
PID 1448 wrote to memory of 388	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	101
PID 1448 wrote to memory of 3856	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	102
PID 1448 wrote to memory of 3856	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	102
PID 1448 wrote to memory of 2088	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	103
PID 1448 wrote to memory of 2088	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	103
PID 1448 wrote to memory of 3124	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	104
PID 1448 wrote to memory of 3124	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	104
PID 1448 wrote to memory of 3188	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	105
PID 1448 wrote to memory of 3188	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	105
PID 1448 wrote to memory of 4768	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	106
PID 1448 wrote to memory of 4768	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	106
PID 1448 wrote to memory of 4996	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	107
PID 1448 wrote to memory of 4996	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	107
PID 1448 wrote to memory of 5072	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	108
PID 1448 wrote to memory of 5072	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	108
PID 1448 wrote to memory of 2968	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	109
PID 1448 wrote to memory of 2968	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	109
PID 1448 wrote to memory of 1572	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	110
PID 1448 wrote to memory of 1572	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	110
PID 1448 wrote to memory of 4476	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	111
PID 1448 wrote to memory of 4476	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	111
PID 1448 wrote to memory of 3052	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	112
PID 1448 wrote to memory of 3052	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	112
PID 1448 wrote to memory of 4252	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	113
PID 1448 wrote to memory of 4252	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	113
PID 1448 wrote to memory of 5052	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	114
PID 1448 wrote to memory of 5052	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	114
PID 1448 wrote to memory of 1296	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	115
PID 1448 wrote to memory of 1296	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	115
PID 1448 wrote to memory of 5024	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	116
PID 1448 wrote to memory of 5024	1448	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\System\EpYhLZQ.exe
  C:\Windows\System\EpYhLZQ.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\vPVfTcV.exe
  C:\Windows\System\vPVfTcV.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\Jnygmqg.exe
  C:\Windows\System\Jnygmqg.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\LwRtCIM.exe
  C:\Windows\System\LwRtCIM.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\vDxcJnC.exe
  C:\Windows\System\vDxcJnC.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\DOTRIcQ.exe
  C:\Windows\System\DOTRIcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\koIfifh.exe
  C:\Windows\System\koIfifh.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\IiVlKCy.exe
  C:\Windows\System\IiVlKCy.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\jpnneHo.exe
  C:\Windows\System\jpnneHo.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\CHnWPCt.exe
  C:\Windows\System\CHnWPCt.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\xnHBVar.exe
  C:\Windows\System\xnHBVar.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\vHvymXK.exe
  C:\Windows\System\vHvymXK.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\sRSbsJE.exe
  C:\Windows\System\sRSbsJE.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\aOBIPnG.exe
  C:\Windows\System\aOBIPnG.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\GmLldbI.exe
  C:\Windows\System\GmLldbI.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\tJdxiqb.exe
  C:\Windows\System\tJdxiqb.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\LJNjeAc.exe
  C:\Windows\System\LJNjeAc.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\OwIkkWn.exe
  C:\Windows\System\OwIkkWn.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\FEWUDKQ.exe
  C:\Windows\System\FEWUDKQ.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\rYFenrz.exe
  C:\Windows\System\rYFenrz.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\rQLOEXo.exe
  C:\Windows\System\rQLOEXo.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\uPzxXqt.exe
  C:\Windows\System\uPzxXqt.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\nbdEkVl.exe
  C:\Windows\System\nbdEkVl.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\bBTXEzk.exe
  C:\Windows\System\bBTXEzk.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\USuWcvU.exe
  C:\Windows\System\USuWcvU.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\hxfFpic.exe
  C:\Windows\System\hxfFpic.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\JCIxOjr.exe
  C:\Windows\System\JCIxOjr.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\PXqUqtm.exe
  C:\Windows\System\PXqUqtm.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\tGhbfZn.exe
  C:\Windows\System\tGhbfZn.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\qufhxod.exe
  C:\Windows\System\qufhxod.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\aOyuaKB.exe
  C:\Windows\System\aOyuaKB.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\MWsTMwp.exe
  C:\Windows\System\MWsTMwp.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\eTqoySM.exe
  C:\Windows\System\eTqoySM.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\eMkbcQJ.exe
  C:\Windows\System\eMkbcQJ.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\yMllXaU.exe
  C:\Windows\System\yMllXaU.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\uoioAdd.exe
  C:\Windows\System\uoioAdd.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\MkydxjP.exe
  C:\Windows\System\MkydxjP.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\gcVfjyN.exe
  C:\Windows\System\gcVfjyN.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\UuJaiyU.exe
  C:\Windows\System\UuJaiyU.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\SsjvwTc.exe
  C:\Windows\System\SsjvwTc.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\npSXVbw.exe
  C:\Windows\System\npSXVbw.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\mLyoSWj.exe
  C:\Windows\System\mLyoSWj.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\lSXKKJx.exe
  C:\Windows\System\lSXKKJx.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\IhqXUjQ.exe
  C:\Windows\System\IhqXUjQ.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\TpTgPav.exe
  C:\Windows\System\TpTgPav.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\UozAtcT.exe
  C:\Windows\System\UozAtcT.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\aMnDIny.exe
  C:\Windows\System\aMnDIny.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\LaOHlRF.exe
  C:\Windows\System\LaOHlRF.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\fNxXgzN.exe
  C:\Windows\System\fNxXgzN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\JXwsqQP.exe
  C:\Windows\System\JXwsqQP.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\ioLGuRu.exe
  C:\Windows\System\ioLGuRu.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\xaBXNrS.exe
  C:\Windows\System\xaBXNrS.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\nxNoYDp.exe
  C:\Windows\System\nxNoYDp.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\gLjARlg.exe
  C:\Windows\System\gLjARlg.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\KJpXsmW.exe
  C:\Windows\System\KJpXsmW.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\sFvIrXA.exe
  C:\Windows\System\sFvIrXA.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ZplMFZt.exe
  C:\Windows\System\ZplMFZt.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\zbtUDNx.exe
  C:\Windows\System\zbtUDNx.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\CcEymuN.exe
  C:\Windows\System\CcEymuN.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\kPxHlnw.exe
  C:\Windows\System\kPxHlnw.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\XMcseQW.exe
  C:\Windows\System\XMcseQW.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\GNYlrKo.exe
  C:\Windows\System\GNYlrKo.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\oKwBAoo.exe
  C:\Windows\System\oKwBAoo.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\RrGmLvk.exe
  C:\Windows\System\RrGmLvk.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\mKRaEVY.exe
  C:\Windows\System\mKRaEVY.exe
  2⤵
  PID:760
- C:\Windows\System\eTVpUFG.exe
  C:\Windows\System\eTVpUFG.exe
  2⤵
  PID:4368
- C:\Windows\System\qTQHrXe.exe
  C:\Windows\System\qTQHrXe.exe
  2⤵
  PID:3992
- C:\Windows\System\jAAPWfZ.exe
  C:\Windows\System\jAAPWfZ.exe
  2⤵
  PID:4632
- C:\Windows\System\gmNNHvx.exe
  C:\Windows\System\gmNNHvx.exe
  2⤵
  PID:4660
- C:\Windows\System\iIwVVpu.exe
  C:\Windows\System\iIwVVpu.exe
  2⤵
  PID:3708
- C:\Windows\System\xLqocXO.exe
  C:\Windows\System\xLqocXO.exe
  2⤵
  PID:4940
- C:\Windows\System\ZVYnahn.exe
  C:\Windows\System\ZVYnahn.exe
  2⤵
  PID:4596
- C:\Windows\System\xYbwdBu.exe
  C:\Windows\System\xYbwdBu.exe
  2⤵
  PID:4356
- C:\Windows\System\TFRpHRQ.exe
  C:\Windows\System\TFRpHRQ.exe
  2⤵
  PID:4144
- C:\Windows\System\EumSIGZ.exe
  C:\Windows\System\EumSIGZ.exe
  2⤵
  PID:4296
- C:\Windows\System\kWcQTKh.exe
  C:\Windows\System\kWcQTKh.exe
  2⤵
  PID:1796
- C:\Windows\System\qSDBgFf.exe
  C:\Windows\System\qSDBgFf.exe
  2⤵
  PID:2332
- C:\Windows\System\MBkOQIx.exe
  C:\Windows\System\MBkOQIx.exe
  2⤵
  PID:1668
- C:\Windows\System\KVeQQOG.exe
  C:\Windows\System\KVeQQOG.exe
  2⤵
  PID:4264
- C:\Windows\System\qNrrzLX.exe
  C:\Windows\System\qNrrzLX.exe
  2⤵
  PID:4464
- C:\Windows\System\KEEdfWY.exe
  C:\Windows\System\KEEdfWY.exe
  2⤵
  PID:4620
- C:\Windows\System\ialjUuf.exe
  C:\Windows\System\ialjUuf.exe
  2⤵
  PID:3948
- C:\Windows\System\ZgGOZIT.exe
  C:\Windows\System\ZgGOZIT.exe
  2⤵
  PID:1912
- C:\Windows\System\jAgSFHX.exe
  C:\Windows\System\jAgSFHX.exe
  2⤵
  PID:2452
- C:\Windows\System\IwDkodh.exe
  C:\Windows\System\IwDkodh.exe
  2⤵
  PID:5140
- C:\Windows\System\iDmmQUg.exe
  C:\Windows\System\iDmmQUg.exe
  2⤵
  PID:5164
- C:\Windows\System\vNfbwFs.exe
  C:\Windows\System\vNfbwFs.exe
  2⤵
  PID:5188
- C:\Windows\System\ZHHqrhR.exe
  C:\Windows\System\ZHHqrhR.exe
  2⤵
  PID:5236
- C:\Windows\System\eQQVVsQ.exe
  C:\Windows\System\eQQVVsQ.exe
  2⤵
  PID:5252
- C:\Windows\System\MGiLqNr.exe
  C:\Windows\System\MGiLqNr.exe
  2⤵
  PID:5272
- C:\Windows\System\FRNxRse.exe
  C:\Windows\System\FRNxRse.exe
  2⤵
  PID:5296
- C:\Windows\System\HlbQhnr.exe
  C:\Windows\System\HlbQhnr.exe
  2⤵
  PID:5316
- C:\Windows\System\TyrQCHt.exe
  C:\Windows\System\TyrQCHt.exe
  2⤵
  PID:5336
- C:\Windows\System\nMZBgoa.exe
  C:\Windows\System\nMZBgoa.exe
  2⤵
  PID:5356
- C:\Windows\System\MDTlxIv.exe
  C:\Windows\System\MDTlxIv.exe
  2⤵
  PID:5388
- C:\Windows\System\MkPCmTw.exe
  C:\Windows\System\MkPCmTw.exe
  2⤵
  PID:5404
- C:\Windows\System\SGVVuRA.exe
  C:\Windows\System\SGVVuRA.exe
  2⤵
  PID:5436
- C:\Windows\System\hHTmGwe.exe
  C:\Windows\System\hHTmGwe.exe
  2⤵
  PID:5456
- C:\Windows\System\mbuZUOS.exe
  C:\Windows\System\mbuZUOS.exe
  2⤵
  PID:5484
- C:\Windows\System\FKfCvDa.exe
  C:\Windows\System\FKfCvDa.exe
  2⤵
  PID:5504
- C:\Windows\System\aAIVhlo.exe
  C:\Windows\System\aAIVhlo.exe
  2⤵
  PID:5524
- C:\Windows\System\QFwjCZX.exe
  C:\Windows\System\QFwjCZX.exe
  2⤵
  PID:5544
- C:\Windows\System\ZxgJFrz.exe
  C:\Windows\System\ZxgJFrz.exe
  2⤵
  PID:5564
- C:\Windows\System\GuqtfCb.exe
  C:\Windows\System\GuqtfCb.exe
  2⤵
  PID:5588
- C:\Windows\System\egaepKk.exe
  C:\Windows\System\egaepKk.exe
  2⤵
  PID:5612
- C:\Windows\System\dllbAfo.exe
  C:\Windows\System\dllbAfo.exe
  2⤵
  PID:5632
- C:\Windows\System\xyrzcgT.exe
  C:\Windows\System\xyrzcgT.exe
  2⤵
  PID:5652
- C:\Windows\System\UMLwRCw.exe
  C:\Windows\System\UMLwRCw.exe
  2⤵
  PID:5676
- C:\Windows\System\QorQrha.exe
  C:\Windows\System\QorQrha.exe
  2⤵
  PID:5708
- C:\Windows\System\mHqwQCg.exe
  C:\Windows\System\mHqwQCg.exe
  2⤵
  PID:5728
- C:\Windows\System\QlUWpJP.exe
  C:\Windows\System\QlUWpJP.exe
  2⤵
  PID:5752
- C:\Windows\System\BHOZfYR.exe
  C:\Windows\System\BHOZfYR.exe
  2⤵
  PID:5772
- C:\Windows\System\xmSKgBe.exe
  C:\Windows\System\xmSKgBe.exe
  2⤵
  PID:5796
- C:\Windows\System\wEIRbjE.exe
  C:\Windows\System\wEIRbjE.exe
  2⤵
  PID:5820
- C:\Windows\System\ZjjtYHB.exe
  C:\Windows\System\ZjjtYHB.exe
  2⤵
  PID:5844
- C:\Windows\System\cYWAiyR.exe
  C:\Windows\System\cYWAiyR.exe
  2⤵
  PID:5860
- C:\Windows\System\RqCFaPQ.exe
  C:\Windows\System\RqCFaPQ.exe
  2⤵
  PID:5888
- C:\Windows\System\bhYdpvW.exe
  C:\Windows\System\bhYdpvW.exe
  2⤵
  PID:5912
- C:\Windows\System\aDbxNmW.exe
  C:\Windows\System\aDbxNmW.exe
  2⤵
  PID:5936
- C:\Windows\System\lGiIhFN.exe
  C:\Windows\System\lGiIhFN.exe
  2⤵
  PID:5956
- C:\Windows\System\ebMFzQS.exe
  C:\Windows\System\ebMFzQS.exe
  2⤵
  PID:5976
- C:\Windows\System\vRmFiZf.exe
  C:\Windows\System\vRmFiZf.exe
  2⤵
  PID:5996
- C:\Windows\System\DsyazwT.exe
  C:\Windows\System\DsyazwT.exe
  2⤵
  PID:6020
- C:\Windows\System\URaylGW.exe
  C:\Windows\System\URaylGW.exe
  2⤵
  PID:6048
- C:\Windows\System\IDNiJew.exe
  C:\Windows\System\IDNiJew.exe
  2⤵
  PID:6064
- C:\Windows\System\gXOsfPn.exe
  C:\Windows\System\gXOsfPn.exe
  2⤵
  PID:6092
- C:\Windows\System\ANoltFa.exe
  C:\Windows\System\ANoltFa.exe
  2⤵
  PID:6112
- C:\Windows\System\iVSVLge.exe
  C:\Windows\System\iVSVLge.exe
  2⤵
  PID:6140
- C:\Windows\System\XvCYfDf.exe
  C:\Windows\System\XvCYfDf.exe
  2⤵
  PID:2540
- C:\Windows\System\rcwhKxJ.exe
  C:\Windows\System\rcwhKxJ.exe
  2⤵
  PID:4488
- C:\Windows\System\dwEATvx.exe
  C:\Windows\System\dwEATvx.exe
  2⤵
  PID:3384
- C:\Windows\System\oIEtTQq.exe
  C:\Windows\System\oIEtTQq.exe
  2⤵
  PID:1752
- C:\Windows\System\PithNIh.exe
  C:\Windows\System\PithNIh.exe
  2⤵
  PID:5156
- C:\Windows\System\gmpVbHw.exe
  C:\Windows\System\gmpVbHw.exe
  2⤵
  PID:5196
- C:\Windows\System\mrBNpUb.exe
  C:\Windows\System\mrBNpUb.exe
  2⤵
  PID:5220
- C:\Windows\System\QKerVAK.exe
  C:\Windows\System\QKerVAK.exe
  2⤵
  PID:4000
- C:\Windows\System\wrfpqpP.exe
  C:\Windows\System\wrfpqpP.exe
  2⤵
  PID:5260
- C:\Windows\System\XcunwfL.exe
  C:\Windows\System\XcunwfL.exe
  2⤵
  PID:3400
- C:\Windows\System\cPgbQSF.exe
  C:\Windows\System\cPgbQSF.exe
  2⤵
  PID:3528
- C:\Windows\System\BRvjOPz.exe
  C:\Windows\System\BRvjOPz.exe
  2⤵
  PID:5400
- C:\Windows\System\KIPvYDr.exe
  C:\Windows\System\KIPvYDr.exe
  2⤵
  PID:5596
- C:\Windows\System\mfLgYjk.exe
  C:\Windows\System\mfLgYjk.exe
  2⤵
  PID:5376
- C:\Windows\System\hkGCAsK.exe
  C:\Windows\System\hkGCAsK.exe
  2⤵
  PID:5964
- C:\Windows\System\MHdkzLF.exe
  C:\Windows\System\MHdkzLF.exe
  2⤵
  PID:5720
- C:\Windows\System\OvAEfDk.exe
  C:\Windows\System\OvAEfDk.exe
  2⤵
  PID:5832
- C:\Windows\System\HutpRdp.exe
  C:\Windows\System\HutpRdp.exe
  2⤵
  PID:884
- C:\Windows\System\TWhzfuQ.exe
  C:\Windows\System\TWhzfuQ.exe
  2⤵
  PID:5876
- C:\Windows\System\MUsHZoa.exe
  C:\Windows\System\MUsHZoa.exe
  2⤵
  PID:5148
- C:\Windows\System\zmPEcvj.exe
  C:\Windows\System\zmPEcvj.exe
  2⤵
  PID:5952
- C:\Windows\System\rbaDvFP.exe
  C:\Windows\System\rbaDvFP.exe
  2⤵
  PID:5532
- C:\Windows\System\XrtzuZy.exe
  C:\Windows\System\XrtzuZy.exe
  2⤵
  PID:5744
- C:\Windows\System\AihwFnz.exe
  C:\Windows\System\AihwFnz.exe
  2⤵
  PID:6168
- C:\Windows\System\fSYsXnP.exe
  C:\Windows\System\fSYsXnP.exe
  2⤵
  PID:6196
- C:\Windows\System\YVJgTrH.exe
  C:\Windows\System\YVJgTrH.exe
  2⤵
  PID:6224
- C:\Windows\System\zZkQFEL.exe
  C:\Windows\System\zZkQFEL.exe
  2⤵
  PID:6240
- C:\Windows\System\PXwBlny.exe
  C:\Windows\System\PXwBlny.exe
  2⤵
  PID:6264
- C:\Windows\System\PHRrMJI.exe
  C:\Windows\System\PHRrMJI.exe
  2⤵
  PID:6292
- C:\Windows\System\sOMeVbX.exe
  C:\Windows\System\sOMeVbX.exe
  2⤵
  PID:6308
- C:\Windows\System\OnZpmMp.exe
  C:\Windows\System\OnZpmMp.exe
  2⤵
  PID:6328
- C:\Windows\System\WPkzpak.exe
  C:\Windows\System\WPkzpak.exe
  2⤵
  PID:6364
- C:\Windows\System\ClJPweW.exe
  C:\Windows\System\ClJPweW.exe
  2⤵
  PID:6388
- C:\Windows\System\VTFMQVR.exe
  C:\Windows\System\VTFMQVR.exe
  2⤵
  PID:6412
- C:\Windows\System\sLCQdXS.exe
  C:\Windows\System\sLCQdXS.exe
  2⤵
  PID:6436
- C:\Windows\System\MkekXLN.exe
  C:\Windows\System\MkekXLN.exe
  2⤵
  PID:6452
- C:\Windows\System\ThREWbj.exe
  C:\Windows\System\ThREWbj.exe
  2⤵
  PID:6476
- C:\Windows\System\hcQAgWB.exe
  C:\Windows\System\hcQAgWB.exe
  2⤵
  PID:6500
- C:\Windows\System\CEDBzxd.exe
  C:\Windows\System\CEDBzxd.exe
  2⤵
  PID:6520
- C:\Windows\System\ABnrXBu.exe
  C:\Windows\System\ABnrXBu.exe
  2⤵
  PID:6544
- C:\Windows\System\knLhTKj.exe
  C:\Windows\System\knLhTKj.exe
  2⤵
  PID:6568
- C:\Windows\System\JesxXXS.exe
  C:\Windows\System\JesxXXS.exe
  2⤵
  PID:6600
- C:\Windows\System\ycjmJip.exe
  C:\Windows\System\ycjmJip.exe
  2⤵
  PID:6616
- C:\Windows\System\ZPCVSAQ.exe
  C:\Windows\System\ZPCVSAQ.exe
  2⤵
  PID:6636
- C:\Windows\System\XSLfGcC.exe
  C:\Windows\System\XSLfGcC.exe
  2⤵
  PID:6668
- C:\Windows\System\kSfhQuJ.exe
  C:\Windows\System\kSfhQuJ.exe
  2⤵
  PID:6700
- C:\Windows\System\muLNwBf.exe
  C:\Windows\System\muLNwBf.exe
  2⤵
  PID:6720
- C:\Windows\System\oWttSip.exe
  C:\Windows\System\oWttSip.exe
  2⤵
  PID:6748
- C:\Windows\System\XjhxTgp.exe
  C:\Windows\System\XjhxTgp.exe
  2⤵
  PID:6772
- C:\Windows\System\ZLrxbnC.exe
  C:\Windows\System\ZLrxbnC.exe
  2⤵
  PID:6796
- C:\Windows\System\icFPpEq.exe
  C:\Windows\System\icFPpEq.exe
  2⤵
  PID:6812
- C:\Windows\System\DqJdBCA.exe
  C:\Windows\System\DqJdBCA.exe
  2⤵
  PID:6840
- C:\Windows\System\lknZZDx.exe
  C:\Windows\System\lknZZDx.exe
  2⤵
  PID:6860
- C:\Windows\System\SfbXneY.exe
  C:\Windows\System\SfbXneY.exe
  2⤵
  PID:6880
- C:\Windows\System\ahtCAzO.exe
  C:\Windows\System\ahtCAzO.exe
  2⤵
  PID:6904
- C:\Windows\System\DjEDEuU.exe
  C:\Windows\System\DjEDEuU.exe
  2⤵
  PID:6936
- C:\Windows\System\Igwvmwb.exe
  C:\Windows\System\Igwvmwb.exe
  2⤵
  PID:6968
- C:\Windows\System\ptjmVyR.exe
  C:\Windows\System\ptjmVyR.exe
  2⤵
  PID:6988
- C:\Windows\System\fZvMhua.exe
  C:\Windows\System\fZvMhua.exe
  2⤵
  PID:7008
- C:\Windows\System\IDMhaCr.exe
  C:\Windows\System\IDMhaCr.exe
  2⤵
  PID:7032
- C:\Windows\System\cWqDQUU.exe
  C:\Windows\System\cWqDQUU.exe
  2⤵
  PID:7060
- C:\Windows\System\hMGfpCB.exe
  C:\Windows\System\hMGfpCB.exe
  2⤵
  PID:7080
- C:\Windows\System\EvgtpUX.exe
  C:\Windows\System\EvgtpUX.exe
  2⤵
  PID:7100
- C:\Windows\System\ZGFSTww.exe
  C:\Windows\System\ZGFSTww.exe
  2⤵
  PID:7124
- C:\Windows\System\pUNjUuh.exe
  C:\Windows\System\pUNjUuh.exe
  2⤵
  PID:7140
- C:\Windows\System\jAGgImA.exe
  C:\Windows\System\jAGgImA.exe
  2⤵
  PID:7164
- C:\Windows\System\SvYYwsN.exe
  C:\Windows\System\SvYYwsN.exe
  2⤵
  PID:4404
- C:\Windows\System\UEFwvHx.exe
  C:\Windows\System\UEFwvHx.exe
  2⤵
  PID:3088
- C:\Windows\System\FEwbzXa.exe
  C:\Windows\System\FEwbzXa.exe
  2⤵
  PID:5620
- C:\Windows\System\rXMaEOx.exe
  C:\Windows\System\rXMaEOx.exe
  2⤵
  PID:5684
- C:\Windows\System\jhNHrTC.exe
  C:\Windows\System\jhNHrTC.exe
  2⤵
  PID:4948
- C:\Windows\System\NILVVOe.exe
  C:\Windows\System\NILVVOe.exe
  2⤵
  PID:5852
- C:\Windows\System\rBtrFGw.exe
  C:\Windows\System\rBtrFGw.exe
  2⤵
  PID:5128
- C:\Windows\System\spOYJqM.exe
  C:\Windows\System\spOYJqM.exe
  2⤵
  PID:6184
- C:\Windows\System\rVleEyb.exe
  C:\Windows\System\rVleEyb.exe
  2⤵
  PID:5228
- C:\Windows\System\WciizVE.exe
  C:\Windows\System\WciizVE.exe
  2⤵
  PID:6316
- C:\Windows\System\ApjrgiM.exe
  C:\Windows\System\ApjrgiM.exe
  2⤵
  PID:5088
- C:\Windows\System\laUItYG.exe
  C:\Windows\System\laUItYG.exe
  2⤵
  PID:5364
- C:\Windows\System\VjDaWXC.exe
  C:\Windows\System\VjDaWXC.exe
  2⤵
  PID:5928
- C:\Windows\System\NLdYTQg.exe
  C:\Windows\System\NLdYTQg.exe
  2⤵
  PID:6484
- C:\Windows\System\GKJccYD.exe
  C:\Windows\System\GKJccYD.exe
  2⤵
  PID:6532
- C:\Windows\System\DEsSeIk.exe
  C:\Windows\System\DEsSeIk.exe
  2⤵
  PID:5880
- C:\Windows\System\KRYbIGJ.exe
  C:\Windows\System\KRYbIGJ.exe
  2⤵
  PID:5948
- C:\Windows\System\YzZJTrw.exe
  C:\Windows\System\YzZJTrw.exe
  2⤵
  PID:5292
- C:\Windows\System\wdZTQRH.exe
  C:\Windows\System\wdZTQRH.exe
  2⤵
  PID:6360
- C:\Windows\System\vWHFQzU.exe
  C:\Windows\System\vWHFQzU.exe
  2⤵
  PID:6400
- C:\Windows\System\rVgPesv.exe
  C:\Windows\System\rVgPesv.exe
  2⤵
  PID:6916
- C:\Windows\System\WSvQwAv.exe
  C:\Windows\System\WSvQwAv.exe
  2⤵
  PID:6592
- C:\Windows\System\pnNYEst.exe
  C:\Windows\System\pnNYEst.exe
  2⤵
  PID:6980
- C:\Windows\System\TNzvYZY.exe
  C:\Windows\System\TNzvYZY.exe
  2⤵
  PID:7000
- C:\Windows\System\bfXWwPo.exe
  C:\Windows\System\bfXWwPo.exe
  2⤵
  PID:6688
- C:\Windows\System\rBbTEMx.exe
  C:\Windows\System\rBbTEMx.exe
  2⤵
  PID:7088
- C:\Windows\System\iiVNArw.exe
  C:\Windows\System\iiVNArw.exe
  2⤵
  PID:6780
- C:\Windows\System\qLsXomK.exe
  C:\Windows\System\qLsXomK.exe
  2⤵
  PID:6832
- C:\Windows\System\EwhyBRN.exe
  C:\Windows\System\EwhyBRN.exe
  2⤵
  PID:7180
- C:\Windows\System\KcwUvEh.exe
  C:\Windows\System\KcwUvEh.exe
  2⤵
  PID:7200
- C:\Windows\System\iTeCMUk.exe
  C:\Windows\System\iTeCMUk.exe
  2⤵
  PID:7224
- C:\Windows\System\oRfFWwN.exe
  C:\Windows\System\oRfFWwN.exe
  2⤵
  PID:7252
- C:\Windows\System\ARRpauL.exe
  C:\Windows\System\ARRpauL.exe
  2⤵
  PID:7276
- C:\Windows\System\StpTSkM.exe
  C:\Windows\System\StpTSkM.exe
  2⤵
  PID:7296
- C:\Windows\System\FQKpyty.exe
  C:\Windows\System\FQKpyty.exe
  2⤵
  PID:7324
- C:\Windows\System\SMGxfol.exe
  C:\Windows\System\SMGxfol.exe
  2⤵
  PID:7344
- C:\Windows\System\EXwlSpq.exe
  C:\Windows\System\EXwlSpq.exe
  2⤵
  PID:7368
- C:\Windows\System\MOQHbPv.exe
  C:\Windows\System\MOQHbPv.exe
  2⤵
  PID:7392
- C:\Windows\System\LBFhLQp.exe
  C:\Windows\System\LBFhLQp.exe
  2⤵
  PID:7416
- C:\Windows\System\YcqRTPm.exe
  C:\Windows\System\YcqRTPm.exe
  2⤵
  PID:7436
- C:\Windows\System\aryNjXp.exe
  C:\Windows\System\aryNjXp.exe
  2⤵
  PID:7468
- C:\Windows\System\aBuDMbW.exe
  C:\Windows\System\aBuDMbW.exe
  2⤵
  PID:7492
- C:\Windows\System\kNWYPCA.exe
  C:\Windows\System\kNWYPCA.exe
  2⤵
  PID:7520
- C:\Windows\System\LoYTHvM.exe
  C:\Windows\System\LoYTHvM.exe
  2⤵
  PID:7544
- C:\Windows\System\gauoKru.exe
  C:\Windows\System\gauoKru.exe
  2⤵
  PID:7568
- C:\Windows\System\WmHgkoi.exe
  C:\Windows\System\WmHgkoi.exe
  2⤵
  PID:7584
- C:\Windows\System\VLQJDwI.exe
  C:\Windows\System\VLQJDwI.exe
  2⤵
  PID:7608
- C:\Windows\System\QbmfoNx.exe
  C:\Windows\System\QbmfoNx.exe
  2⤵
  PID:7628
- C:\Windows\System\wOHYLdE.exe
  C:\Windows\System\wOHYLdE.exe
  2⤵
  PID:7648
- C:\Windows\System\ZjRjnAu.exe
  C:\Windows\System\ZjRjnAu.exe
  2⤵
  PID:7676
- C:\Windows\System\rgwjnqb.exe
  C:\Windows\System\rgwjnqb.exe
  2⤵
  PID:7700
- C:\Windows\System\kszRTvy.exe
  C:\Windows\System\kszRTvy.exe
  2⤵
  PID:7720
- C:\Windows\System\iyRVdvV.exe
  C:\Windows\System\iyRVdvV.exe
  2⤵
  PID:7744
- C:\Windows\System\QTqlyks.exe
  C:\Windows\System\QTqlyks.exe
  2⤵
  PID:7776
- C:\Windows\System\aNSVMZv.exe
  C:\Windows\System\aNSVMZv.exe
  2⤵
  PID:7804
- C:\Windows\System\VKWAROt.exe
  C:\Windows\System\VKWAROt.exe
  2⤵
  PID:7828
- C:\Windows\System\UjgdTwW.exe
  C:\Windows\System\UjgdTwW.exe
  2⤵
  PID:7856
- C:\Windows\System\IIjdmVf.exe
  C:\Windows\System\IIjdmVf.exe
  2⤵
  PID:7876
- C:\Windows\System\iYOODxJ.exe
  C:\Windows\System\iYOODxJ.exe
  2⤵
  PID:7896
- C:\Windows\System\WxaPBLe.exe
  C:\Windows\System\WxaPBLe.exe
  2⤵
  PID:7928
- C:\Windows\System\cVSWoYn.exe
  C:\Windows\System\cVSWoYn.exe
  2⤵
  PID:7948
- C:\Windows\System\unnlQIg.exe
  C:\Windows\System\unnlQIg.exe
  2⤵
  PID:7976
- C:\Windows\System\kYNSzPb.exe
  C:\Windows\System\kYNSzPb.exe
  2⤵
  PID:7996
- C:\Windows\System\cYEmaZN.exe
  C:\Windows\System\cYEmaZN.exe
  2⤵
  PID:8024
- C:\Windows\System\uAGeFzq.exe
  C:\Windows\System\uAGeFzq.exe
  2⤵
  PID:8044
- C:\Windows\System\FbjrxPb.exe
  C:\Windows\System\FbjrxPb.exe
  2⤵
  PID:8072
- C:\Windows\System\QASHGTA.exe
  C:\Windows\System\QASHGTA.exe
  2⤵
  PID:8092
- C:\Windows\System\qJwoyPx.exe
  C:\Windows\System\qJwoyPx.exe
  2⤵
  PID:8112
- C:\Windows\System\QEzeMIB.exe
  C:\Windows\System\QEzeMIB.exe
  2⤵
  PID:8136
- C:\Windows\System\YUnLFYT.exe
  C:\Windows\System\YUnLFYT.exe
  2⤵
  PID:8160
- C:\Windows\System\yXrpGxr.exe
  C:\Windows\System\yXrpGxr.exe
  2⤵
  PID:8180
- C:\Windows\System\kgCwDDi.exe
  C:\Windows\System\kgCwDDi.exe
  2⤵
  PID:6132
- C:\Windows\System\sZhXzap.exe
  C:\Windows\System\sZhXzap.exe
  2⤵
  PID:6080
- C:\Windows\System\LrabzBE.exe
  C:\Windows\System\LrabzBE.exe
  2⤵
  PID:6212
- C:\Windows\System\MDBWYAq.exe
  C:\Windows\System\MDBWYAq.exe
  2⤵
  PID:5672
- C:\Windows\System\PsmHliv.exe
  C:\Windows\System\PsmHliv.exe
  2⤵
  PID:6588
- C:\Windows\System\qpNWDzc.exe
  C:\Windows\System\qpNWDzc.exe
  2⤵
  PID:7108
- C:\Windows\System\XYRyAjY.exe
  C:\Windows\System\XYRyAjY.exe
  2⤵
  PID:6012
- C:\Windows\System\KkPEEce.exe
  C:\Windows\System\KkPEEce.exe
  2⤵
  PID:7172
- C:\Windows\System\aPWKznb.exe
  C:\Windows\System\aPWKznb.exe
  2⤵
  PID:7272
- C:\Windows\System\UylZeDY.exe
  C:\Windows\System\UylZeDY.exe
  2⤵
  PID:5184
- C:\Windows\System\NmvHjoJ.exe
  C:\Windows\System\NmvHjoJ.exe
  2⤵
  PID:2112
- C:\Windows\System\nenAViz.exe
  C:\Windows\System\nenAViz.exe
  2⤵
  PID:7356
- C:\Windows\System\IVpMkeN.exe
  C:\Windows\System\IVpMkeN.exe
  2⤵
  PID:8108
- C:\Windows\System\DGlMAMg.exe
  C:\Windows\System\DGlMAMg.exe
  2⤵
  PID:8264
- C:\Windows\System\CBAXPNL.exe
  C:\Windows\System\CBAXPNL.exe
  2⤵
  PID:8284
- C:\Windows\System\jcPFmKP.exe
  C:\Windows\System\jcPFmKP.exe
  2⤵
  PID:8316
- C:\Windows\System\pUQlujK.exe
  C:\Windows\System\pUQlujK.exe
  2⤵
  PID:8348
- C:\Windows\System\dSZysju.exe
  C:\Windows\System\dSZysju.exe
  2⤵
  PID:8380
- C:\Windows\System\PqCpFkD.exe
  C:\Windows\System\PqCpFkD.exe
  2⤵
  PID:8440
- C:\Windows\System\PqoVDgq.exe
  C:\Windows\System\PqoVDgq.exe
  2⤵
  PID:8460
- C:\Windows\System\bPxxVMp.exe
  C:\Windows\System\bPxxVMp.exe
  2⤵
  PID:8484
- C:\Windows\System\GYFrakM.exe
  C:\Windows\System\GYFrakM.exe
  2⤵
  PID:8508
- C:\Windows\System\onofyJc.exe
  C:\Windows\System\onofyJc.exe
  2⤵
  PID:8536
- C:\Windows\System\WdEeWIR.exe
  C:\Windows\System\WdEeWIR.exe
  2⤵
  PID:8560
- C:\Windows\System\YhwMUwy.exe
  C:\Windows\System\YhwMUwy.exe
  2⤵
  PID:8600
- C:\Windows\System\ngzxPCQ.exe
  C:\Windows\System\ngzxPCQ.exe
  2⤵
  PID:8620
- C:\Windows\System\xGKXvPO.exe
  C:\Windows\System\xGKXvPO.exe
  2⤵
  PID:8648
- C:\Windows\System\WkBZGiH.exe
  C:\Windows\System\WkBZGiH.exe
  2⤵
  PID:8676
- C:\Windows\System\XzAHhIw.exe
  C:\Windows\System\XzAHhIw.exe
  2⤵
  PID:8696
- C:\Windows\System\htumcHK.exe
  C:\Windows\System\htumcHK.exe
  2⤵
  PID:8720
- C:\Windows\System\ShPFrhA.exe
  C:\Windows\System\ShPFrhA.exe
  2⤵
  PID:8744
- C:\Windows\System\abwGRoO.exe
  C:\Windows\System\abwGRoO.exe
  2⤵
  PID:8768
- C:\Windows\System\UrfMurm.exe
  C:\Windows\System\UrfMurm.exe
  2⤵
  PID:8792
- C:\Windows\System\kUoOdFy.exe
  C:\Windows\System\kUoOdFy.exe
  2⤵
  PID:8820
- C:\Windows\System\HwLtozI.exe
  C:\Windows\System\HwLtozI.exe
  2⤵
  PID:8844
- C:\Windows\System\Imogrgm.exe
  C:\Windows\System\Imogrgm.exe
  2⤵
  PID:8984
- C:\Windows\System\lRuBMmT.exe
  C:\Windows\System\lRuBMmT.exe
  2⤵
  PID:9000
- C:\Windows\System\uKXBWDI.exe
  C:\Windows\System\uKXBWDI.exe
  2⤵
  PID:9032
- C:\Windows\System\ewEmHGR.exe
  C:\Windows\System\ewEmHGR.exe
  2⤵
  PID:9060
- C:\Windows\System\fndheHF.exe
  C:\Windows\System\fndheHF.exe
  2⤵
  PID:9080
- C:\Windows\System\pRPcdoK.exe
  C:\Windows\System\pRPcdoK.exe
  2⤵
  PID:9104
- C:\Windows\System\dSIgBtw.exe
  C:\Windows\System\dSIgBtw.exe
  2⤵
  PID:9132
- C:\Windows\System\wgWKuri.exe
  C:\Windows\System\wgWKuri.exe
  2⤵
  PID:9164
- C:\Windows\System\sKPjJFK.exe
  C:\Windows\System\sKPjJFK.exe
  2⤵
  PID:9180
- C:\Windows\System\PtPByRy.exe
  C:\Windows\System\PtPByRy.exe
  2⤵
  PID:9204
- C:\Windows\System\TArEkTf.exe
  C:\Windows\System\TArEkTf.exe
  2⤵
  PID:8060
- C:\Windows\System\rgKhZoR.exe
  C:\Windows\System\rgKhZoR.exe
  2⤵
  PID:7028
- C:\Windows\System\UiAsMkC.exe
  C:\Windows\System\UiAsMkC.exe
  2⤵
  PID:7884
- C:\Windows\System\HZlWgNV.exe
  C:\Windows\System\HZlWgNV.exe
  2⤵
  PID:7076
- C:\Windows\System\jEskgNX.exe
  C:\Windows\System\jEskgNX.exe
  2⤵
  PID:7820
- C:\Windows\System\QFcqodL.exe
  C:\Windows\System\QFcqodL.exe
  2⤵
  PID:6300
- C:\Windows\System\FbQYCOv.exe
  C:\Windows\System\FbQYCOv.exe
  2⤵
  PID:7484
- C:\Windows\System\omszMVX.exe
  C:\Windows\System\omszMVX.exe
  2⤵
  PID:7600
- C:\Windows\System\QztjAam.exe
  C:\Windows\System\QztjAam.exe
  2⤵
  PID:8388
- C:\Windows\System\FPgIgYl.exe
  C:\Windows\System\FPgIgYl.exe
  2⤵
  PID:7788
- C:\Windows\System\icRWkiz.exe
  C:\Windows\System\icRWkiz.exe
  2⤵
  PID:6276
- C:\Windows\System\ErUHccO.exe
  C:\Windows\System\ErUHccO.exe
  2⤵
  PID:8372
- C:\Windows\System\zSIwSbp.exe
  C:\Windows\System\zSIwSbp.exe
  2⤵
  PID:6236
- C:\Windows\System\aGmrYFB.exe
  C:\Windows\System\aGmrYFB.exe
  2⤵
  PID:8452
- C:\Windows\System\qNHrUSL.exe
  C:\Windows\System\qNHrUSL.exe
  2⤵
  PID:6428
- C:\Windows\System\BJtuTmU.exe
  C:\Windows\System\BJtuTmU.exe
  2⤵
  PID:8736
- C:\Windows\System\WCFRSCf.exe
  C:\Windows\System\WCFRSCf.exe
  2⤵
  PID:8992
- C:\Windows\System\eFiWxqN.exe
  C:\Windows\System\eFiWxqN.exe
  2⤵
  PID:8516
- C:\Windows\System\VkboRmi.exe
  C:\Windows\System\VkboRmi.exe
  2⤵
  PID:8548
- C:\Windows\System\RkgGkJl.exe
  C:\Windows\System\RkgGkJl.exe
  2⤵
  PID:8612
- C:\Windows\System\zbFofVk.exe
  C:\Windows\System\zbFofVk.exe
  2⤵
  PID:8644
- C:\Windows\System\oAkvYGT.exe
  C:\Windows\System\oAkvYGT.exe
  2⤵
  PID:8932
- C:\Windows\System\mezzMeR.exe
  C:\Windows\System\mezzMeR.exe
  2⤵
  PID:8856
- C:\Windows\System\ippUTen.exe
  C:\Windows\System\ippUTen.exe
  2⤵
  PID:7020
- C:\Windows\System\yyBCeVy.exe
  C:\Windows\System\yyBCeVy.exe
  2⤵
  PID:9076
- C:\Windows\System\gnUvNnh.exe
  C:\Windows\System\gnUvNnh.exe
  2⤵
  PID:7696
- C:\Windows\System\nFKpmFv.exe
  C:\Windows\System\nFKpmFv.exe
  2⤵
  PID:8196
- C:\Windows\System\qTfgUJo.exe
  C:\Windows\System\qTfgUJo.exe
  2⤵
  PID:8052
- C:\Windows\System\QtaesHs.exe
  C:\Windows\System\QtaesHs.exe
  2⤵
  PID:9220
- C:\Windows\System\OpTCWed.exe
  C:\Windows\System\OpTCWed.exe
  2⤵
  PID:9240
- C:\Windows\System\wdwAlTB.exe
  C:\Windows\System\wdwAlTB.exe
  2⤵
  PID:9264
- C:\Windows\System\JoFfdAJ.exe
  C:\Windows\System\JoFfdAJ.exe
  2⤵
  PID:9292
- C:\Windows\System\kjPZwlz.exe
  C:\Windows\System\kjPZwlz.exe
  2⤵
  PID:9308
- C:\Windows\System\QAMYCyc.exe
  C:\Windows\System\QAMYCyc.exe
  2⤵
  PID:9324
- C:\Windows\System\dgSujqD.exe
  C:\Windows\System\dgSujqD.exe
  2⤵
  PID:9340
- C:\Windows\System\YTpCTQG.exe
  C:\Windows\System\YTpCTQG.exe
  2⤵
  PID:9356
- C:\Windows\System\mrblgaW.exe
  C:\Windows\System\mrblgaW.exe
  2⤵
  PID:9376
- C:\Windows\System\zXrgoxQ.exe
  C:\Windows\System\zXrgoxQ.exe
  2⤵
  PID:9396
- C:\Windows\System\BwfcKkw.exe
  C:\Windows\System\BwfcKkw.exe
  2⤵
  PID:9420
- C:\Windows\System\JoPElPj.exe
  C:\Windows\System\JoPElPj.exe
  2⤵
  PID:9444
- C:\Windows\System\wXbEVFX.exe
  C:\Windows\System\wXbEVFX.exe
  2⤵
  PID:9472
- C:\Windows\System\NbCUQjf.exe
  C:\Windows\System\NbCUQjf.exe
  2⤵
  PID:9492
- C:\Windows\System\SPcWaaB.exe
  C:\Windows\System\SPcWaaB.exe
  2⤵
  PID:9512
- C:\Windows\System\XCMuOzw.exe
  C:\Windows\System\XCMuOzw.exe
  2⤵
  PID:9536
- C:\Windows\System\DxhnEZP.exe
  C:\Windows\System\DxhnEZP.exe
  2⤵
  PID:9560
- C:\Windows\System\ojcfKIX.exe
  C:\Windows\System\ojcfKIX.exe
  2⤵
  PID:9584
- C:\Windows\System\hGMQPfJ.exe
  C:\Windows\System\hGMQPfJ.exe
  2⤵
  PID:9600
- C:\Windows\System\IxQpdeD.exe
  C:\Windows\System\IxQpdeD.exe
  2⤵
  PID:9628
- C:\Windows\System\jjVYcWC.exe
  C:\Windows\System\jjVYcWC.exe
  2⤵
  PID:9652
- C:\Windows\System\XVaezrP.exe
  C:\Windows\System\XVaezrP.exe
  2⤵
  PID:9672
- C:\Windows\System\RcRjqxe.exe
  C:\Windows\System\RcRjqxe.exe
  2⤵
  PID:9696
- C:\Windows\System\vgfppKQ.exe
  C:\Windows\System\vgfppKQ.exe
  2⤵
  PID:9720
- C:\Windows\System\AqVlyWg.exe
  C:\Windows\System\AqVlyWg.exe
  2⤵
  PID:9748
- C:\Windows\System\RphwyBR.exe
  C:\Windows\System\RphwyBR.exe
  2⤵
  PID:9764
- C:\Windows\System\VgSzrmG.exe
  C:\Windows\System\VgSzrmG.exe
  2⤵
  PID:9788
- C:\Windows\System\gPqcfDl.exe
  C:\Windows\System\gPqcfDl.exe
  2⤵
  PID:9808
- C:\Windows\System\QeRuHMC.exe
  C:\Windows\System\QeRuHMC.exe
  2⤵
  PID:9828
- C:\Windows\System\sohGFHo.exe
  C:\Windows\System\sohGFHo.exe
  2⤵
  PID:9856
- C:\Windows\System\lvnHzrO.exe
  C:\Windows\System\lvnHzrO.exe
  2⤵
  PID:9876
- C:\Windows\System\YRMjeOz.exe
  C:\Windows\System\YRMjeOz.exe
  2⤵
  PID:9896
- C:\Windows\System\UjEyPxw.exe
  C:\Windows\System\UjEyPxw.exe
  2⤵
  PID:9916
- C:\Windows\System\ncsNbFe.exe
  C:\Windows\System\ncsNbFe.exe
  2⤵
  PID:9944
- C:\Windows\System\SJVDIIS.exe
  C:\Windows\System\SJVDIIS.exe
  2⤵
  PID:9968
- C:\Windows\System\SGFAmtJ.exe
  C:\Windows\System\SGFAmtJ.exe
  2⤵
  PID:9988
- C:\Windows\System\rwlMpSE.exe
  C:\Windows\System\rwlMpSE.exe
  2⤵
  PID:10012
- C:\Windows\System\cmuQYZz.exe
  C:\Windows\System\cmuQYZz.exe
  2⤵
  PID:10032
- C:\Windows\System\amoXVZA.exe
  C:\Windows\System\amoXVZA.exe
  2⤵
  PID:10064
- C:\Windows\System\bivODUH.exe
  C:\Windows\System\bivODUH.exe
  2⤵
  PID:10084
- C:\Windows\System\JumnmKF.exe
  C:\Windows\System\JumnmKF.exe
  2⤵
  PID:10104
- C:\Windows\System\oaJTUzZ.exe
  C:\Windows\System\oaJTUzZ.exe
  2⤵
  PID:10124
- C:\Windows\System\rImgmSq.exe
  C:\Windows\System\rImgmSq.exe
  2⤵
  PID:10148
- C:\Windows\System\aWHswxa.exe
  C:\Windows\System\aWHswxa.exe
  2⤵
  PID:10172
- C:\Windows\System\tdxtWJk.exe
  C:\Windows\System\tdxtWJk.exe
  2⤵
  PID:10192
- C:\Windows\System\LYodhfD.exe
  C:\Windows\System\LYodhfD.exe
  2⤵
  PID:10212
- C:\Windows\System\IDjmYOj.exe
  C:\Windows\System\IDjmYOj.exe
  2⤵
  PID:10236
- C:\Windows\System\arTaWjR.exe
  C:\Windows\System\arTaWjR.exe
  2⤵
  PID:8712
- C:\Windows\System\rClDvSc.exe
  C:\Windows\System\rClDvSc.exe
  2⤵
  PID:8328
- C:\Windows\System\zcKfylW.exe
  C:\Windows\System\zcKfylW.exe
  2⤵
  PID:8908
- C:\Windows\System\WQvVztI.exe
  C:\Windows\System\WQvVztI.exe
  2⤵
  PID:9236
- C:\Windows\System\gScFyTC.exe
  C:\Windows\System\gScFyTC.exe
  2⤵
  PID:9284
- C:\Windows\System\fHRVjaj.exe
  C:\Windows\System\fHRVjaj.exe
  2⤵
  PID:9336
- C:\Windows\System\NsslNDB.exe
  C:\Windows\System\NsslNDB.exe
  2⤵
  PID:6788
- C:\Windows\System\AOAYXIY.exe
  C:\Windows\System\AOAYXIY.exe
  2⤵
  PID:9552
- C:\Windows\System\ZiKeCqJ.exe
  C:\Windows\System\ZiKeCqJ.exe
  2⤵
  PID:9620
- C:\Windows\System\wWzObLx.exe
  C:\Windows\System\wWzObLx.exe
  2⤵
  PID:8504
- C:\Windows\System\NGvlfVp.exe
  C:\Windows\System\NGvlfVp.exe
  2⤵
  PID:3676
- C:\Windows\System\LAwTAPC.exe
  C:\Windows\System\LAwTAPC.exe
  2⤵
  PID:9772
- C:\Windows\System\JKldPDr.exe
  C:\Windows\System\JKldPDr.exe
  2⤵
  PID:9044
- C:\Windows\System\iUpjvZH.exe
  C:\Windows\System\iUpjvZH.exe
  2⤵
  PID:9348
- C:\Windows\System\vrKLRSP.exe
  C:\Windows\System\vrKLRSP.exe
  2⤵
  PID:9452
- C:\Windows\System\vPXeigf.exe
  C:\Windows\System\vPXeigf.exe
  2⤵
  PID:9544
- C:\Windows\System\cenZdLO.exe
  C:\Windows\System\cenZdLO.exe
  2⤵
  PID:7912
- C:\Windows\System\ihdxrLk.exe
  C:\Windows\System\ihdxrLk.exe
  2⤵
  PID:10028
- C:\Windows\System\bzMCqaN.exe
  C:\Windows\System\bzMCqaN.exe
  2⤵
  PID:10052
- C:\Windows\System\gdEXeEL.exe
  C:\Windows\System\gdEXeEL.exe
  2⤵
  PID:9304
- C:\Windows\System\iGNPBWw.exe
  C:\Windows\System\iGNPBWw.exe
  2⤵
  PID:4644
- C:\Windows\System\RMhbrFO.exe
  C:\Windows\System\RMhbrFO.exe
  2⤵
  PID:9388
- C:\Windows\System\MSDoJuv.exe
  C:\Windows\System\MSDoJuv.exe
  2⤵
  PID:9484
- C:\Windows\System\jYuYCUH.exe
  C:\Windows\System\jYuYCUH.exe
  2⤵
  PID:9592
- C:\Windows\System\BZMRZda.exe
  C:\Windows\System\BZMRZda.exe
  2⤵
  PID:9488
- C:\Windows\System\oefCkYn.exe
  C:\Windows\System\oefCkYn.exe
  2⤵
  PID:6612
- C:\Windows\System\fnRLBTA.exe
  C:\Windows\System\fnRLBTA.exe
  2⤵
  PID:10076
- C:\Windows\System\ewwqtVw.exe
  C:\Windows\System\ewwqtVw.exe
  2⤵
  PID:10116
- C:\Windows\System\XczHqcQ.exe
  C:\Windows\System\XczHqcQ.exe
  2⤵
  PID:5492
- C:\Windows\System\mzVbDHV.exe
  C:\Windows\System\mzVbDHV.exe
  2⤵
  PID:10244
- C:\Windows\System\TFUETEI.exe
  C:\Windows\System\TFUETEI.exe
  2⤵
  PID:10264
- C:\Windows\System\boUWxlQ.exe
  C:\Windows\System\boUWxlQ.exe
  2⤵
  PID:10284
- C:\Windows\System\oBbiYas.exe
  C:\Windows\System\oBbiYas.exe
  2⤵
  PID:10308
- C:\Windows\System\WwNMtYI.exe
  C:\Windows\System\WwNMtYI.exe
  2⤵
  PID:10328
- C:\Windows\System\rzfUjrA.exe
  C:\Windows\System\rzfUjrA.exe
  2⤵
  PID:10348
- C:\Windows\System\OKppsTE.exe
  C:\Windows\System\OKppsTE.exe
  2⤵
  PID:10372
- C:\Windows\System\NrhUvBF.exe
  C:\Windows\System\NrhUvBF.exe
  2⤵
  PID:10396
- C:\Windows\System\IUxKWGc.exe
  C:\Windows\System\IUxKWGc.exe
  2⤵
  PID:10420
- C:\Windows\System\lbYyHUf.exe
  C:\Windows\System\lbYyHUf.exe
  2⤵
  PID:10444
- C:\Windows\System\oNmFgRi.exe
  C:\Windows\System\oNmFgRi.exe
  2⤵
  PID:10468
- C:\Windows\System\gHuVlhC.exe
  C:\Windows\System\gHuVlhC.exe
  2⤵
  PID:10496
- C:\Windows\System\KTdDESX.exe
  C:\Windows\System\KTdDESX.exe
  2⤵
  PID:10516
- C:\Windows\System\evIQHxR.exe
  C:\Windows\System\evIQHxR.exe
  2⤵
  PID:10536
- C:\Windows\System\MoysLXL.exe
  C:\Windows\System\MoysLXL.exe
  2⤵
  PID:10560
- C:\Windows\System\HcXLwtV.exe
  C:\Windows\System\HcXLwtV.exe
  2⤵
  PID:10584
- C:\Windows\System\XFAvHCO.exe
  C:\Windows\System\XFAvHCO.exe
  2⤵
  PID:10608
- C:\Windows\System\kdoVEEx.exe
  C:\Windows\System\kdoVEEx.exe
  2⤵
  PID:10628
- C:\Windows\System\cGmAGwW.exe
  C:\Windows\System\cGmAGwW.exe
  2⤵
  PID:10652
- C:\Windows\System\CqYpUzG.exe
  C:\Windows\System\CqYpUzG.exe
  2⤵
  PID:10672
- C:\Windows\System\NycHWNF.exe
  C:\Windows\System\NycHWNF.exe
  2⤵
  PID:10696
- C:\Windows\System\upjRHrd.exe
  C:\Windows\System\upjRHrd.exe
  2⤵
  PID:10720
- C:\Windows\System\aiXtDHQ.exe
  C:\Windows\System\aiXtDHQ.exe
  2⤵
  PID:10744
- C:\Windows\System\ZuwxJbo.exe
  C:\Windows\System\ZuwxJbo.exe
  2⤵
  PID:10780
- C:\Windows\System\UNcoFec.exe
  C:\Windows\System\UNcoFec.exe
  2⤵
  PID:10804
- C:\Windows\System\rrMJPBu.exe
  C:\Windows\System\rrMJPBu.exe
  2⤵
  PID:10824
- C:\Windows\System\QitDVAt.exe
  C:\Windows\System\QitDVAt.exe
  2⤵
  PID:10852
- C:\Windows\System\ucgUTDC.exe
  C:\Windows\System\ucgUTDC.exe
  2⤵
  PID:10876
- C:\Windows\System\kFIfwqQ.exe
  C:\Windows\System\kFIfwqQ.exe
  2⤵
  PID:10900
- C:\Windows\System\JesVqqn.exe
  C:\Windows\System\JesVqqn.exe
  2⤵
  PID:10920
- C:\Windows\System\PjMzlHK.exe
  C:\Windows\System\PjMzlHK.exe
  2⤵
  PID:10948
- C:\Windows\System\ACjiTPd.exe
  C:\Windows\System\ACjiTPd.exe
  2⤵
  PID:10976
- C:\Windows\System\lCHADCB.exe
  C:\Windows\System\lCHADCB.exe
  2⤵
  PID:10992
- C:\Windows\System\ybLoiqO.exe
  C:\Windows\System\ybLoiqO.exe
  2⤵
  PID:11012
- C:\Windows\System\XCHPdIu.exe
  C:\Windows\System\XCHPdIu.exe
  2⤵
  PID:11036
- C:\Windows\System\CkOjoCd.exe
  C:\Windows\System\CkOjoCd.exe
  2⤵
  PID:11052
- C:\Windows\System\QbZGBIl.exe
  C:\Windows\System\QbZGBIl.exe
  2⤵
  PID:11072
- C:\Windows\System\sucYOKC.exe
  C:\Windows\System\sucYOKC.exe
  2⤵
  PID:11088
- C:\Windows\System\swKFZHt.exe
  C:\Windows\System\swKFZHt.exe
  2⤵
  PID:11104
- C:\Windows\System\zCbgrVr.exe
  C:\Windows\System\zCbgrVr.exe
  2⤵
  PID:11120
- C:\Windows\System\VhBOKzj.exe
  C:\Windows\System\VhBOKzj.exe
  2⤵
  PID:11144
- C:\Windows\System\rpaCJEt.exe
  C:\Windows\System\rpaCJEt.exe
  2⤵
  PID:11200
- C:\Windows\System\jiycOYd.exe
  C:\Windows\System\jiycOYd.exe
  2⤵
  PID:11220
- C:\Windows\System\XKPKPnT.exe
  C:\Windows\System\XKPKPnT.exe
  2⤵
  PID:11244
- C:\Windows\System\bDFIDqu.exe
  C:\Windows\System\bDFIDqu.exe
  2⤵
  PID:9884
- C:\Windows\System\fnLLhiv.exe
  C:\Windows\System\fnLLhiv.exe
  2⤵
  PID:9956
- C:\Windows\System\RqAadEj.exe
  C:\Windows\System\RqAadEj.exe
  2⤵
  PID:9572
- C:\Windows\System\XLqXpyd.exe
  C:\Windows\System\XLqXpyd.exe
  2⤵
  PID:10184
- C:\Windows\System\rpbdqrD.exe
  C:\Windows\System\rpbdqrD.exe
  2⤵
  PID:9272
- C:\Windows\System\EZztqhH.exe
  C:\Windows\System\EZztqhH.exe
  2⤵
  PID:9320
- C:\Windows\System\oAcRUcv.exe
  C:\Windows\System\oAcRUcv.exe
  2⤵
  PID:9796
- C:\Windows\System\tOiQGcG.exe
  C:\Windows\System\tOiQGcG.exe
  2⤵
  PID:10208
- C:\Windows\System\uTEPFXi.exe
  C:\Windows\System\uTEPFXi.exe
  2⤵
  PID:9024
- C:\Windows\System\wxdCVAk.exe
  C:\Windows\System\wxdCVAk.exe
  2⤵
  PID:9280
- C:\Windows\System\FzDoHAD.exe
  C:\Windows\System\FzDoHAD.exe
  2⤵
  PID:10544
- C:\Windows\System\zgLASbC.exe
  C:\Windows\System\zgLASbC.exe
  2⤵
  PID:10736
- C:\Windows\System\FQtmLOf.exe
  C:\Windows\System\FQtmLOf.exe
  2⤵
  PID:9428
- C:\Windows\System\ilZHEGv.exe
  C:\Windows\System\ilZHEGv.exe
  2⤵
  PID:9824
- C:\Windows\System\tMDCvzu.exe
  C:\Windows\System\tMDCvzu.exe
  2⤵
  PID:11280
- C:\Windows\System\BsunuCg.exe
  C:\Windows\System\BsunuCg.exe
  2⤵
  PID:11300
- C:\Windows\System\hLCegKJ.exe
  C:\Windows\System\hLCegKJ.exe
  2⤵
  PID:11324
- C:\Windows\System\ArkrUfH.exe
  C:\Windows\System\ArkrUfH.exe
  2⤵
  PID:11344
- C:\Windows\System\hRpSdgh.exe
  C:\Windows\System\hRpSdgh.exe
  2⤵
  PID:11364
- C:\Windows\System\lMbbCOM.exe
  C:\Windows\System\lMbbCOM.exe
  2⤵
  PID:11380
- C:\Windows\System\lyBKOfe.exe
  C:\Windows\System\lyBKOfe.exe
  2⤵
  PID:11400
- C:\Windows\System\MBJLKAF.exe
  C:\Windows\System\MBJLKAF.exe
  2⤵
  PID:11420
- C:\Windows\System\PxSoNJv.exe
  C:\Windows\System\PxSoNJv.exe
  2⤵
  PID:11440
- C:\Windows\System\XRdRHwg.exe
  C:\Windows\System\XRdRHwg.exe
  2⤵
  PID:11464
- C:\Windows\System\nMNMWyd.exe
  C:\Windows\System\nMNMWyd.exe
  2⤵
  PID:11484
- C:\Windows\System\enjdGbz.exe
  C:\Windows\System\enjdGbz.exe
  2⤵
  PID:11504
- C:\Windows\System\JzilIHk.exe
  C:\Windows\System\JzilIHk.exe
  2⤵
  PID:11528
- C:\Windows\System\mJvsHaS.exe
  C:\Windows\System\mJvsHaS.exe
  2⤵
  PID:11548
- C:\Windows\System\alWByFy.exe
  C:\Windows\System\alWByFy.exe
  2⤵
  PID:11568
- C:\Windows\System\qChlXBs.exe
  C:\Windows\System\qChlXBs.exe
  2⤵
  PID:11588
- C:\Windows\System\QeJINVg.exe
  C:\Windows\System\QeJINVg.exe
  2⤵
  PID:11616
- C:\Windows\System\DDIwQIq.exe
  C:\Windows\System\DDIwQIq.exe
  2⤵
  PID:11636
- C:\Windows\System\igoYzWb.exe
  C:\Windows\System\igoYzWb.exe
  2⤵
  PID:11656
- C:\Windows\System\MANUGPk.exe
  C:\Windows\System\MANUGPk.exe
  2⤵
  PID:11676
- C:\Windows\System\GqNEoIt.exe
  C:\Windows\System\GqNEoIt.exe
  2⤵
  PID:11700
- C:\Windows\System\WkgYbtV.exe
  C:\Windows\System\WkgYbtV.exe
  2⤵
  PID:11720
- C:\Windows\System\hwABeLO.exe
  C:\Windows\System\hwABeLO.exe
  2⤵
  PID:11740
- C:\Windows\System\WkHnLIj.exe
  C:\Windows\System\WkHnLIj.exe
  2⤵
  PID:11768
- C:\Windows\System\OZeHnHm.exe
  C:\Windows\System\OZeHnHm.exe
  2⤵
  PID:11784
- C:\Windows\System\FlfahFO.exe
  C:\Windows\System\FlfahFO.exe
  2⤵
  PID:11808
- C:\Windows\System\pzKCEMc.exe
  C:\Windows\System\pzKCEMc.exe
  2⤵
  PID:11832
- C:\Windows\System\WAzSFUA.exe
  C:\Windows\System\WAzSFUA.exe
  2⤵
  PID:11852
- C:\Windows\System\ZZnFNJO.exe
  C:\Windows\System\ZZnFNJO.exe
  2⤵
  PID:11876
- C:\Windows\System\dKBtVGt.exe
  C:\Windows\System\dKBtVGt.exe
  2⤵
  PID:11892
- C:\Windows\System\tlZduAr.exe
  C:\Windows\System\tlZduAr.exe
  2⤵
  PID:11908
- C:\Windows\System\IxOSrZa.exe
  C:\Windows\System\IxOSrZa.exe
  2⤵
  PID:11924
- C:\Windows\System\aGaAowl.exe
  C:\Windows\System\aGaAowl.exe
  2⤵
  PID:11940
- C:\Windows\System\agsGaeS.exe
  C:\Windows\System\agsGaeS.exe
  2⤵
  PID:11960
- C:\Windows\System\eiJTXiV.exe
  C:\Windows\System\eiJTXiV.exe
  2⤵
  PID:11980
- C:\Windows\System\ReXjSPs.exe
  C:\Windows\System\ReXjSPs.exe
  2⤵
  PID:11996
- C:\Windows\System\NjMtRSH.exe
  C:\Windows\System\NjMtRSH.exe
  2⤵
  PID:12020
- C:\Windows\System\CNUUPer.exe
  C:\Windows\System\CNUUPer.exe
  2⤵
  PID:12056
- C:\Windows\System\GKxjVxy.exe
  C:\Windows\System\GKxjVxy.exe
  2⤵
  PID:12072
- C:\Windows\System\QPKCrQu.exe
  C:\Windows\System\QPKCrQu.exe
  2⤵
  PID:10688
- C:\Windows\System\pBrNxUE.exe
  C:\Windows\System\pBrNxUE.exe
  2⤵
  PID:10756
- C:\Windows\System\sMAUzEy.exe
  C:\Windows\System\sMAUzEy.exe
  2⤵
  PID:10252
- C:\Windows\System\Eekjaef.exe
  C:\Windows\System\Eekjaef.exe
  2⤵
  PID:9392
- C:\Windows\System\KgSudRA.exe
  C:\Windows\System\KgSudRA.exe
  2⤵
  PID:11308
- C:\Windows\System\oSZlwVE.exe
  C:\Windows\System\oSZlwVE.exe
  2⤵
  PID:11360
- C:\Windows\System\uODEPYY.exe
  C:\Windows\System\uODEPYY.exe
  2⤵
  PID:11100
- C:\Windows\System\LijnzSr.exe
  C:\Windows\System\LijnzSr.exe
  2⤵
  PID:10260
- C:\Windows\System\yDSiddH.exe
  C:\Windows\System\yDSiddH.exe
  2⤵
  PID:11436
- C:\Windows\System\GbRRUFV.exe
  C:\Windows\System\GbRRUFV.exe
  2⤵
  PID:10592
- C:\Windows\System\jfaHlLp.exe
  C:\Windows\System\jfaHlLp.exe
  2⤵
  PID:10144
- C:\Windows\System\cKOAHkJ.exe
  C:\Windows\System\cKOAHkJ.exe
  2⤵
  PID:8492
- C:\Windows\System\oUjJNsD.exe
  C:\Windows\System\oUjJNsD.exe
  2⤵
  PID:10840
- C:\Windows\System\SXnrhpS.exe
  C:\Windows\System\SXnrhpS.exe
  2⤵
  PID:10932
- C:\Windows\System\bLJdxrL.exe
  C:\Windows\System\bLJdxrL.exe
  2⤵
  PID:11296
- C:\Windows\System\ztlsruT.exe
  C:\Windows\System\ztlsruT.exe
  2⤵
  PID:12136
- C:\Windows\System\IFvmnTP.exe
  C:\Windows\System\IFvmnTP.exe
  2⤵
  PID:12140
- C:\Windows\System\IMnrEGa.exe
  C:\Windows\System\IMnrEGa.exe
  2⤵
  PID:10984
- C:\Windows\System\LMJqIRK.exe
  C:\Windows\System\LMJqIRK.exe
  2⤵
  PID:12208
- C:\Windows\System\hbOgnae.exe
  C:\Windows\System\hbOgnae.exe
  2⤵
  PID:12088
- C:\Windows\System\aPQPqLd.exe
  C:\Windows\System\aPQPqLd.exe
  2⤵
  PID:11520
- C:\Windows\System\VShIjcM.exe
  C:\Windows\System\VShIjcM.exe
  2⤵
  PID:11260
- C:\Windows\System\xGGZORn.exe
  C:\Windows\System\xGGZORn.exe
  2⤵
  PID:10004
- C:\Windows\System\OfCdikk.exe
  C:\Windows\System\OfCdikk.exe
  2⤵
  PID:12312
- C:\Windows\System\WmHlPBw.exe
  C:\Windows\System\WmHlPBw.exe
  2⤵
  PID:12336
- C:\Windows\System\UrKlywv.exe
  C:\Windows\System\UrKlywv.exe
  2⤵
  PID:12360
- C:\Windows\System\qkcIgWa.exe
  C:\Windows\System\qkcIgWa.exe
  2⤵
  PID:12392
- C:\Windows\System\IFVVgwA.exe
  C:\Windows\System\IFVVgwA.exe
  2⤵
  PID:12416
- C:\Windows\System\kXpIppV.exe
  C:\Windows\System\kXpIppV.exe
  2⤵
  PID:12436
- C:\Windows\System\XsVVVYa.exe
  C:\Windows\System\XsVVVYa.exe
  2⤵
  PID:12456
- C:\Windows\System\zfpcYjk.exe
  C:\Windows\System\zfpcYjk.exe
  2⤵
  PID:12480
- C:\Windows\System\skKdIwO.exe
  C:\Windows\System\skKdIwO.exe
  2⤵
  PID:12504
- C:\Windows\System\XyltJpo.exe
  C:\Windows\System\XyltJpo.exe
  2⤵
  PID:12536
- C:\Windows\System\oiNmoAk.exe
  C:\Windows\System\oiNmoAk.exe
  2⤵
  PID:12556
- C:\Windows\System\IzGjVSC.exe
  C:\Windows\System\IzGjVSC.exe
  2⤵
  PID:12576
- C:\Windows\System\FKTOkUz.exe
  C:\Windows\System\FKTOkUz.exe
  2⤵
  PID:12596
- C:\Windows\System\uSUfTUa.exe
  C:\Windows\System\uSUfTUa.exe
  2⤵
  PID:12632
- C:\Windows\System\ueGcJjB.exe
  C:\Windows\System\ueGcJjB.exe
  2⤵
  PID:12664
- C:\Windows\System\PrSJecd.exe
  C:\Windows\System\PrSJecd.exe
  2⤵
  PID:12688
- C:\Windows\System\gSEEAhG.exe
  C:\Windows\System\gSEEAhG.exe
  2⤵
  PID:12712
- C:\Windows\System\pbVGvlm.exe
  C:\Windows\System\pbVGvlm.exe
  2⤵
  PID:12732
- C:\Windows\System\zOEjUnO.exe
  C:\Windows\System\zOEjUnO.exe
  2⤵
  PID:12756
- C:\Windows\System\ERWdAar.exe
  C:\Windows\System\ERWdAar.exe
  2⤵
  PID:12780
- C:\Windows\System\FUScdOs.exe
  C:\Windows\System\FUScdOs.exe
  2⤵
  PID:12812
- C:\Windows\System\poeJuii.exe
  C:\Windows\System\poeJuii.exe
  2⤵
  PID:12832
- C:\Windows\System\aREfdcs.exe
  C:\Windows\System\aREfdcs.exe
  2⤵
  PID:12860
- C:\Windows\System\ZkDosnh.exe
  C:\Windows\System\ZkDosnh.exe
  2⤵
  PID:12892
- C:\Windows\System\cSVYqEt.exe
  C:\Windows\System\cSVYqEt.exe
  2⤵
  PID:12928
- C:\Windows\System\CVFDaNu.exe
  C:\Windows\System\CVFDaNu.exe
  2⤵
  PID:12944
- C:\Windows\System\VTjqWsg.exe
  C:\Windows\System\VTjqWsg.exe
  2⤵
  PID:12972
- C:\Windows\System\zSRVHRy.exe
  C:\Windows\System\zSRVHRy.exe
  2⤵
  PID:12996
- C:\Windows\System\vXVooHk.exe
  C:\Windows\System\vXVooHk.exe
  2⤵
  PID:10568
- C:\Windows\System\ZLZFPTB.exe
  C:\Windows\System\ZLZFPTB.exe
  2⤵
  PID:11452
- C:\Windows\System\wsBfXbx.exe
  C:\Windows\System\wsBfXbx.exe
  2⤵
  PID:11492
- C:\Windows\System\JkunaJh.exe
  C:\Windows\System\JkunaJh.exe
  2⤵
  PID:11624
- C:\Windows\System\zYypPFN.exe
  C:\Windows\System\zYypPFN.exe
  2⤵
  PID:11584
- C:\Windows\System\EyMmaVv.exe
  C:\Windows\System\EyMmaVv.exe
  2⤵
  PID:10964
- C:\Windows\System\LaOytVI.exe
  C:\Windows\System\LaOytVI.exe
  2⤵
  PID:11668
- C:\Windows\System\kHOHzOW.exe
  C:\Windows\System\kHOHzOW.exe
  2⤵
  PID:12296
- C:\Windows\System\rkSjZuS.exe
  C:\Windows\System\rkSjZuS.exe
  2⤵
  PID:12348
- C:\Windows\System\rSSEwTD.exe
  C:\Windows\System\rSSEwTD.exe
  2⤵
  PID:12404
- C:\Windows\System\UuzxGeQ.exe
  C:\Windows\System\UuzxGeQ.exe
  2⤵
  PID:3632
- C:\Windows\System\wxPRybF.exe
  C:\Windows\System\wxPRybF.exe
  2⤵
  PID:11844
- C:\Windows\System\lYFjwjN.exe
  C:\Windows\System\lYFjwjN.exe
  2⤵
  PID:12588
- C:\Windows\System\wioDfKP.exe
  C:\Windows\System\wioDfKP.exe
  2⤵
  PID:10440
- C:\Windows\System\NqmqHOx.exe
  C:\Windows\System\NqmqHOx.exe
  2⤵
  PID:12740
- C:\Windows\System\VCWiPRU.exe
  C:\Windows\System\VCWiPRU.exe
  2⤵
  PID:12824
- C:\Windows\System\XSRqXSd.exe
  C:\Windows\System\XSRqXSd.exe
  2⤵
  PID:12884
- C:\Windows\System\hMSDjPQ.exe
  C:\Windows\System\hMSDjPQ.exe
  2⤵
  PID:12244
- C:\Windows\System\woKtmSG.exe
  C:\Windows\System\woKtmSG.exe
  2⤵
  PID:11112
- C:\Windows\System\yNGzbMB.exe
  C:\Windows\System\yNGzbMB.exe
  2⤵
  PID:13072
- C:\Windows\System\TjBuoQt.exe
  C:\Windows\System\TjBuoQt.exe
  2⤵
  PID:10916
- C:\Windows\System\zJBFJGG.exe
  C:\Windows\System\zJBFJGG.exe
  2⤵
  PID:11356
- C:\Windows\System\zYWlEqj.exe
  C:\Windows\System\zYWlEqj.exe
  2⤵
  PID:13088
- C:\Windows\System\ssRZtEw.exe
  C:\Windows\System\ssRZtEw.exe
  2⤵
  PID:13176
- C:\Windows\System\VdmDzfi.exe
  C:\Windows\System\VdmDzfi.exe
  2⤵
  PID:3396
- C:\Windows\System\tYWvxYA.exe
  C:\Windows\System\tYWvxYA.exe
  2⤵
  PID:9616
- C:\Windows\System\ohLdCWE.exe
  C:\Windows\System\ohLdCWE.exe
  2⤵
  PID:11968
- C:\Windows\System\cWSMuUb.exe
  C:\Windows\System\cWSMuUb.exe
  2⤵
  PID:12988
- C:\Windows\System\LAiVWjO.exe
  C:\Windows\System\LAiVWjO.exe
  2⤵
  PID:13044
- C:\Windows\System\qLIDKnx.exe
  C:\Windows\System\qLIDKnx.exe
  2⤵
  PID:11132
- C:\Windows\System\CpZBjUZ.exe
  C:\Windows\System\CpZBjUZ.exe
  2⤵
  PID:11004
- C:\Windows\System\EIIsyeg.exe
  C:\Windows\System\EIIsyeg.exe
  2⤵
  PID:13268
- C:\Windows\System\jXZOgTy.exe
  C:\Windows\System\jXZOgTy.exe
  2⤵
  PID:13064
- C:\Windows\System\AvjpQFc.exe
  C:\Windows\System\AvjpQFc.exe
  2⤵
  PID:11684
- C:\Windows\System\qlPtokO.exe
  C:\Windows\System\qlPtokO.exe
  2⤵
  PID:10872
- C:\Windows\System\leSWhVQ.exe
  C:\Windows\System\leSWhVQ.exe
  2⤵
  PID:11820
- C:\Windows\System\jRBplwO.exe
  C:\Windows\System\jRBplwO.exe
  2⤵
  PID:11396
- C:\Windows\System\VnKyetX.exe
  C:\Windows\System\VnKyetX.exe
  2⤵
  PID:13144
- C:\Windows\System\QXtAXtk.exe
  C:\Windows\System\QXtAXtk.exe
  2⤵
  PID:13164
- C:\Windows\System\iUbFEOx.exe
  C:\Windows\System\iUbFEOx.exe
  2⤵
  PID:13308
- C:\Windows\System\dPOTHKp.exe
  C:\Windows\System\dPOTHKp.exe
  2⤵
  PID:12368
- C:\Windows\System\dlpfAWg.exe
  C:\Windows\System\dlpfAWg.exe
  2⤵
  PID:10816
- C:\Windows\System\kwWcgjO.exe
  C:\Windows\System\kwWcgjO.exe
  2⤵
  PID:12880
- C:\Windows\System\CQVkVbr.exe
  C:\Windows\System\CQVkVbr.exe
  2⤵
  PID:11932
- C:\Windows\System\AMwQvWg.exe
  C:\Windows\System\AMwQvWg.exe
  2⤵
  PID:12704
- C:\Windows\System\kqqXPoY.exe
  C:\Windows\System\kqqXPoY.exe
  2⤵
  PID:12584
- C:\Windows\System\hGzRQfR.exe
  C:\Windows\System\hGzRQfR.exe
  2⤵
  PID:12028
- C:\Windows\System\sCecLXq.exe
  C:\Windows\System\sCecLXq.exe
  2⤵
  PID:4600
- C:\Windows\System\EgpCArt.exe
  C:\Windows\System\EgpCArt.exe
  2⤵
  PID:1984
- C:\Windows\System\UGkzzDa.exe
  C:\Windows\System\UGkzzDa.exe
  2⤵
  PID:412
- C:\Windows\System\KBnWhRO.exe
  C:\Windows\System\KBnWhRO.exe
  2⤵
  PID:1736
- C:\Windows\System\xrEYcOQ.exe
  C:\Windows\System\xrEYcOQ.exe
  2⤵
  PID:12216
- C:\Windows\System\XEPxsQN.exe
  C:\Windows\System\XEPxsQN.exe
  2⤵
  PID:12500
- C:\Windows\System\wSUBXhY.exe
  C:\Windows\System\wSUBXhY.exe
  2⤵
  PID:10316
- C:\Windows\System\LDoyKkY.exe
  C:\Windows\System\LDoyKkY.exe
  2⤵
  PID:2724
- C:\Windows\System\RHgopIB.exe
  C:\Windows\System\RHgopIB.exe
  2⤵
  PID:12176
- C:\Windows\System\MmafyBp.exe
  C:\Windows\System\MmafyBp.exe
  2⤵
  PID:11780
- C:\Windows\System\KAddXyH.exe
  C:\Windows\System\KAddXyH.exe
  2⤵
  PID:10908
- C:\Windows\System\JfMhYmP.exe
  C:\Windows\System\JfMhYmP.exe
  2⤵
  PID:10388
- C:\Windows\System\ZdkHpji.exe
  C:\Windows\System\ZdkHpji.exe
  2⤵
  PID:3508
- C:\Windows\System\LyljeIq.exe
  C:\Windows\System\LyljeIq.exe
  2⤵
  PID:11796
- C:\Windows\System\UBrxoTq.exe
  C:\Windows\System\UBrxoTq.exe
  2⤵
  PID:4332
- C:\Windows\System\GJdIRhd.exe
  C:\Windows\System\GJdIRhd.exe
  2⤵
  PID:10256
- C:\Windows\System\idkVaJI.exe
  C:\Windows\System\idkVaJI.exe
  2⤵
  PID:12848
- C:\Windows\System\cIDqLPG.exe
  C:\Windows\System\cIDqLPG.exe
  2⤵
  PID:60
- C:\Windows\System\FxVxZiM.exe
  C:\Windows\System\FxVxZiM.exe
  2⤵
  PID:1252
- C:\Windows\System\NflzVlU.exe
  C:\Windows\System\NflzVlU.exe
  2⤵
  PID:2396
- C:\Windows\System\qIdtAGb.exe
  C:\Windows\System\qIdtAGb.exe
  2⤵
  PID:13184
- C:\Windows\System\lnaSgKK.exe
  C:\Windows\System\lnaSgKK.exe
  2⤵
  PID:12676
- C:\Windows\System\mbeqSDI.exe
  C:\Windows\System\mbeqSDI.exe
  2⤵
  PID:12432
- C:\Windows\System\pSRmrQD.exe
  C:\Windows\System\pSRmrQD.exe
  2⤵
  PID:3300
- C:\Windows\System\zUhPpeb.exe
  C:\Windows\System\zUhPpeb.exe
  2⤵
  PID:2092
- C:\Windows\System\qIxiyJg.exe
  C:\Windows\System\qIxiyJg.exe
  2⤵
  PID:4556
- C:\Windows\System\SoAvJjd.exe
  C:\Windows\System\SoAvJjd.exe
  2⤵
  PID:12224
- C:\Windows\System\yrHhdDB.exe
  C:\Windows\System\yrHhdDB.exe
  2⤵
  PID:4176
- C:\Windows\System\waFkISP.exe
  C:\Windows\System\waFkISP.exe
  2⤵
  PID:4692
- C:\Windows\System\Gkwsfgk.exe
  C:\Windows\System\Gkwsfgk.exe
  2⤵
  PID:2528
- C:\Windows\System\nllORrG.exe
  C:\Windows\System\nllORrG.exe
  2⤵
  PID:12840
- C:\Windows\System\VHSgFKf.exe
  C:\Windows\System\VHSgFKf.exe
  2⤵
  PID:4148
- C:\Windows\System\lToxGLm.exe
  C:\Windows\System\lToxGLm.exe
  2⤵
  PID:9260
- C:\Windows\System\aPMfoFD.exe
  C:\Windows\System\aPMfoFD.exe
  2⤵
  PID:2348
- C:\Windows\System\xUkrMmU.exe
  C:\Windows\System\xUkrMmU.exe
  2⤵
  PID:3156
- C:\Windows\System\ktYNyhw.exe
  C:\Windows\System\ktYNyhw.exe
  2⤵
  PID:3260
- C:\Windows\System\hvODPZx.exe
  C:\Windows\System\hvODPZx.exe
  2⤵
  PID:2372
- C:\Windows\System\pMBRNup.exe
  C:\Windows\System\pMBRNup.exe
  2⤵
  PID:2704
- C:\Windows\System\rtOqJAN.exe
  C:\Windows\System\rtOqJAN.exe
  2⤵
  PID:4748
- C:\Windows\System\TczzjjU.exe
  C:\Windows\System\TczzjjU.exe
  2⤵
  PID:1560
- C:\Windows\System\EcTrmZy.exe
  C:\Windows\System\EcTrmZy.exe
  2⤵
  PID:768
- C:\Windows\System\DKqNzul.exe
  C:\Windows\System\DKqNzul.exe
  2⤵
  PID:1404
- C:\Windows\System\PgvDMnq.exe
  C:\Windows\System\PgvDMnq.exe
  2⤵
  PID:4824
- C:\Windows\System\sPvRnBh.exe
  C:\Windows\System\sPvRnBh.exe
  2⤵
  PID:13324
- C:\Windows\System\LNpaEVs.exe
  C:\Windows\System\LNpaEVs.exe
  2⤵
  PID:13356
- C:\Windows\System\cfayHFh.exe
  C:\Windows\System\cfayHFh.exe
  2⤵
  PID:13396
- C:\Windows\System\OvheZZB.exe
  C:\Windows\System\OvheZZB.exe
  2⤵
  PID:13416
- C:\Windows\System\KTRUWjD.exe
  C:\Windows\System\KTRUWjD.exe
  2⤵
  PID:13448
- C:\Windows\System\jxXAyMQ.exe
  C:\Windows\System\jxXAyMQ.exe
  2⤵
  PID:13468
- C:\Windows\System\xOHOeHy.exe
  C:\Windows\System\xOHOeHy.exe
  2⤵
  PID:13492
- C:\Windows\System\EWaNrDN.exe
  C:\Windows\System\EWaNrDN.exe
  2⤵
  PID:13528
- C:\Windows\System\psFtwZt.exe
  C:\Windows\System\psFtwZt.exe
  2⤵
  PID:13560
- C:\Windows\System\ZGkCvSM.exe
  C:\Windows\System\ZGkCvSM.exe
  2⤵
  PID:13584
- C:\Windows\System\exAJpjC.exe
  C:\Windows\System\exAJpjC.exe
  2⤵
  PID:13616
- C:\Windows\System\VUUYIkZ.exe
  C:\Windows\System\VUUYIkZ.exe
  2⤵
  PID:13644
- C:\Windows\System\xzkrXYz.exe
  C:\Windows\System\xzkrXYz.exe
  2⤵
  PID:13668
- C:\Windows\System\umGDIVx.exe
  C:\Windows\System\umGDIVx.exe
  2⤵
  PID:13712
- C:\Windows\System\DQqJkGa.exe
  C:\Windows\System\DQqJkGa.exe
  2⤵
  PID:13744
- C:\Windows\System\dkFwjMv.exe
  C:\Windows\System\dkFwjMv.exe
  2⤵
  PID:13772
- C:\Windows\System\AmzpNeP.exe
  C:\Windows\System\AmzpNeP.exe
  2⤵
  PID:13856
- C:\Windows\System\HFIfEcU.exe
  C:\Windows\System\HFIfEcU.exe
  2⤵
  PID:13876
- C:\Windows\System\aJpZqgf.exe
  C:\Windows\System\aJpZqgf.exe
  2⤵
  PID:13892
- C:\Windows\System\enIwskJ.exe
  C:\Windows\System\enIwskJ.exe
  2⤵
  PID:13908
- C:\Windows\System\fNgbEuY.exe
  C:\Windows\System\fNgbEuY.exe
  2⤵
  PID:13948
- C:\Windows\System\ARsZJJD.exe
  C:\Windows\System\ARsZJJD.exe
  2⤵
  PID:14032
- C:\Windows\System\OlItbDp.exe
  C:\Windows\System\OlItbDp.exe
  2⤵
  PID:14048
- C:\Windows\System\YnahwyZ.exe
  C:\Windows\System\YnahwyZ.exe
  2⤵
  PID:14064
- C:\Windows\System\tYRqgDs.exe
  C:\Windows\System\tYRqgDs.exe
  2⤵
  PID:14084
- C:\Windows\System\aDKlFbH.exe
  C:\Windows\System\aDKlFbH.exe
  2⤵
  PID:14100
- C:\Windows\System\KjCKhOk.exe
  C:\Windows\System\KjCKhOk.exe
  2⤵
  PID:14212
- C:\Windows\System\twilCtf.exe
  C:\Windows\System\twilCtf.exe
  2⤵
  PID:14228
- C:\Windows\System\kpTdZAT.exe
  C:\Windows\System\kpTdZAT.exe
  2⤵
  PID:14244
- C:\Windows\System\sDyZHWx.exe
  C:\Windows\System\sDyZHWx.exe
  2⤵
  PID:14260
- C:\Windows\System\iseiOCE.exe
  C:\Windows\System\iseiOCE.exe
  2⤵
  PID:14280
- C:\Windows\System\vHSQYpF.exe
  C:\Windows\System\vHSQYpF.exe
  2⤵
  PID:10392
- C:\Windows\System\qDSsstH.exe
  C:\Windows\System\qDSsstH.exe
  2⤵
  PID:2028
- C:\Windows\System\coaUSJY.exe
  C:\Windows\System\coaUSJY.exe
  2⤵
  PID:13764
- C:\Windows\System\NTShQhz.exe
  C:\Windows\System\NTShQhz.exe
  2⤵
  PID:11648
- C:\Windows\System\htWeoCn.exe
  C:\Windows\System\htWeoCn.exe
  2⤵
  PID:2288
- C:\Windows\System\IwDNgLH.exe
  C:\Windows\System\IwDNgLH.exe
  2⤵
  PID:2212
- C:\Windows\System\paITbPj.exe
  C:\Windows\System\paITbPj.exe
  2⤵
  PID:4576
- C:\Windows\System\VdIHybU.exe
  C:\Windows\System\VdIHybU.exe
  2⤵
  PID:1936
- C:\Windows\System\KGYsmYJ.exe
  C:\Windows\System\KGYsmYJ.exe
  2⤵
  PID:2420
- C:\Windows\System\PbcTTge.exe
  C:\Windows\System\PbcTTge.exe
  2⤵
  PID:13424
- C:\Windows\System\xuykfPo.exe
  C:\Windows\System\xuykfPo.exe
  2⤵
  PID:13460
- C:\Windows\System\YwIczJn.exe
  C:\Windows\System\YwIczJn.exe
  2⤵
  PID:13752
- C:\Windows\System\TYGzyUh.exe
  C:\Windows\System\TYGzyUh.exe
  2⤵
  PID:13248
- C:\Windows\System\lLsgzid.exe
  C:\Windows\System\lLsgzid.exe
  2⤵
  PID:6036
- C:\Windows\System\NbpdrYx.exe
  C:\Windows\System\NbpdrYx.exe
  2⤵
  PID:5836
- C:\Windows\System\TskKXac.exe
  C:\Windows\System\TskKXac.exe
  2⤵
  PID:6008
- C:\Windows\System\aqbHOwy.exe
  C:\Windows\System\aqbHOwy.exe
  2⤵
  PID:5372
- C:\Windows\System\zkROGuZ.exe
  C:\Windows\System\zkROGuZ.exe
  2⤵
  PID:5420
- C:\Windows\System\sslVcoE.exe
  C:\Windows\System\sslVcoE.exe
  2⤵
  PID:5972
- C:\Windows\System\YqFTEHT.exe
  C:\Windows\System\YqFTEHT.exe
  2⤵
  PID:5764
- C:\Windows\System\obHNRhF.exe
  C:\Windows\System\obHNRhF.exe
  2⤵
  PID:13872
- C:\Windows\System\MZqzwpX.exe
  C:\Windows\System\MZqzwpX.exe
  2⤵
  PID:13920
- C:\Windows\System\TvGjWDE.exe
  C:\Windows\System\TvGjWDE.exe
  2⤵
  PID:13976
- C:\Windows\System\xuLioec.exe
  C:\Windows\System\xuLioec.exe
  2⤵
  PID:13988
- C:\Windows\System\KiDjztO.exe
  C:\Windows\System\KiDjztO.exe
  2⤵
  PID:14132
- C:\Windows\System\AfAahTS.exe
  C:\Windows\System\AfAahTS.exe
  2⤵
  PID:14152
- C:\Windows\System\wdSKyuk.exe
  C:\Windows\System\wdSKyuk.exe
  2⤵
  PID:972
- C:\Windows\System\iIWADYE.exe
  C:\Windows\System\iIWADYE.exe
  2⤵
  PID:4560
- C:\Windows\System\ehvnPPy.exe
  C:\Windows\System\ehvnPPy.exe
  2⤵
  PID:14080
- C:\Windows\System\HcZCOnj.exe
  C:\Windows\System\HcZCOnj.exe
  2⤵
  PID:14256
- C:\Windows\System\MuIyMCc.exe
  C:\Windows\System\MuIyMCc.exe
  2⤵
  PID:14180
- C:\Windows\System\wktWkGS.exe
  C:\Windows\System\wktWkGS.exe
  2⤵
  PID:14308
- C:\Windows\System\lAHUWBo.exe
  C:\Windows\System\lAHUWBo.exe
  2⤵
  PID:10644
- C:\Windows\System\ahoFLEx.exe
  C:\Windows\System\ahoFLEx.exe
  2⤵
  PID:3896
- C:\Windows\System\UJMrBmY.exe
  C:\Windows\System\UJMrBmY.exe
  2⤵
  PID:4912
- C:\Windows\System\aWsCmJU.exe
  C:\Windows\System\aWsCmJU.exe
  2⤵
  PID:744
- C:\Windows\System\ZzQLJAC.exe
  C:\Windows\System\ZzQLJAC.exe
  2⤵
  PID:1892
- C:\Windows\System\WItDJwj.exe
  C:\Windows\System\WItDJwj.exe
  2⤵
  PID:4344
- C:\Windows\System\xplYsuX.exe
  C:\Windows\System\xplYsuX.exe
  2⤵
  PID:3032
- C:\Windows\System\JgbArJu.exe
  C:\Windows\System\JgbArJu.exe
  2⤵
  PID:13412
- C:\Windows\System\UpHeDyv.exe
  C:\Windows\System\UpHeDyv.exe
  2⤵
  PID:13572
- C:\Windows\System\bhXPWog.exe
  C:\Windows\System\bhXPWog.exe
  2⤵
  PID:13736
- C:\Windows\System\uiEEFjx.exe
  C:\Windows\System\uiEEFjx.exe
  2⤵
  PID:12700
- C:\Windows\System\ZqaKEHN.exe
  C:\Windows\System\ZqaKEHN.exe
  2⤵
  PID:5416
- C:\Windows\System\RyzEssJ.exe
  C:\Windows\System\RyzEssJ.exe
  2⤵
  PID:5760
- C:\Windows\System\pBPsuPa.exe
  C:\Windows\System\pBPsuPa.exe
  2⤵
  PID:6100
- C:\Windows\System\MotoTLM.exe
  C:\Windows\System\MotoTLM.exe
  2⤵
  PID:5328
- C:\Windows\System\AqXjhqk.exe
  C:\Windows\System\AqXjhqk.exe
  2⤵
  PID:2752
- C:\Windows\System\NgIrspL.exe
  C:\Windows\System\NgIrspL.exe
  2⤵
  PID:5424
- C:\Windows\System\XOCJoHB.exe
  C:\Windows\System\XOCJoHB.exe
  2⤵
  PID:6032
- C:\Windows\System\sKmcMye.exe
  C:\Windows\System\sKmcMye.exe
  2⤵
  PID:5280
- C:\Windows\System\KvHyALA.exe
  C:\Windows\System\KvHyALA.exe
  2⤵
  PID:5540
- C:\Windows\System\srogFHU.exe
  C:\Windows\System\srogFHU.exe
  2⤵
  PID:5884
- C:\Windows\System\XjoTEiD.exe
  C:\Windows\System\XjoTEiD.exe
  2⤵
  PID:13940
- C:\Windows\System\tSUfKck.exe
  C:\Windows\System\tSUfKck.exe
  2⤵
  PID:14112
- C:\Windows\System\fGjopFz.exe
  C:\Windows\System\fGjopFz.exe
  2⤵
  PID:14144
- C:\Windows\System\PHvXdzn.exe
  C:\Windows\System\PHvXdzn.exe
  2⤵
  PID:3556
- C:\Windows\System\AqpOYIX.exe
  C:\Windows\System\AqpOYIX.exe
  2⤵
  PID:2896
- C:\Windows\System\RGevwoT.exe
  C:\Windows\System\RGevwoT.exe
  2⤵
  PID:13884
- C:\Windows\System\rwmqldd.exe
  C:\Windows\System\rwmqldd.exe
  2⤵
  PID:4496
- C:\Windows\System\oKWbglb.exe
  C:\Windows\System\oKWbglb.exe
  2⤵
  PID:4060
- C:\Windows\System\ToHaZta.exe
  C:\Windows\System\ToHaZta.exe
  2⤵
  PID:6408
- C:\Windows\System\HTRNKqw.exe
  C:\Windows\System\HTRNKqw.exe
  2⤵
  PID:5332
- C:\Windows\System\xJyDcuC.exe
  C:\Windows\System\xJyDcuC.exe
  2⤵
  PID:13596
- C:\Windows\System\rxWrjmK.exe
  C:\Windows\System\rxWrjmK.exe
  2⤵
  PID:5716
- C:\Windows\System\YcPVBVm.exe
  C:\Windows\System\YcPVBVm.exe
  2⤵
  PID:5288
- C:\Windows\System\eJQnPkG.exe
  C:\Windows\System\eJQnPkG.exe
  2⤵
  PID:6648
- C:\Windows\System\OeOOaLJ.exe
  C:\Windows\System\OeOOaLJ.exe
  2⤵
  PID:6676
- C:\Windows\System\DPIsEUl.exe
  C:\Windows\System\DPIsEUl.exe
  2⤵
  PID:5608
- C:\Windows\System\WfTtKOa.exe
  C:\Windows\System\WfTtKOa.exe
  2⤵
  PID:4916
- C:\Windows\System\KKzFZDD.exe
  C:\Windows\System\KKzFZDD.exe
  2⤵
  PID:5868
- C:\Windows\System\YyItfKE.exe
  C:\Windows\System\YyItfKE.exe
  2⤵
  PID:6756
- C:\Windows\System\VpQmXfm.exe
  C:\Windows\System\VpQmXfm.exe
  2⤵
  PID:6464
- C:\Windows\System\TEOAKpQ.exe
  C:\Windows\System\TEOAKpQ.exe
  2⤵
  PID:3192
- C:\Windows\System\aSBJHbN.exe
  C:\Windows\System\aSBJHbN.exe
  2⤵
  PID:2216
- C:\Windows\System\UNJdTAb.exe
  C:\Windows\System\UNJdTAb.exe
  2⤵
  PID:13840
- C:\Windows\System\dVLjRDV.exe
  C:\Windows\System\dVLjRDV.exe
  2⤵
  PID:1976
- C:\Windows\System\UrglKEo.exe
  C:\Windows\System\UrglKEo.exe
  2⤵
  PID:5704
- C:\Windows\System\xWnZlpk.exe
  C:\Windows\System\xWnZlpk.exe
  2⤵
  PID:14140
- C:\Windows\System\BbTlpRF.exe
  C:\Windows\System\BbTlpRF.exe
  2⤵
  PID:6124
- C:\Windows\System\GqjKbod.exe
  C:\Windows\System\GqjKbod.exe
  2⤵
  PID:4448
- C:\Windows\System\ClmmBjC.exe
  C:\Windows\System\ClmmBjC.exe
  2⤵
  PID:14312
- C:\Windows\System\OatKIcM.exe
  C:\Windows\System\OatKIcM.exe
  2⤵
  PID:14208
- C:\Windows\System\EzWMHso.exe
  C:\Windows\System\EzWMHso.exe
  2⤵
  PID:14252
- C:\Windows\System\nnRupxq.exe
  C:\Windows\System\nnRupxq.exe
  2⤵
  PID:968
- C:\Windows\System\yjyVucp.exe
  C:\Windows\System\yjyVucp.exe
  2⤵
  PID:3176
- C:\Windows\System\txspYNZ.exe
  C:\Windows\System\txspYNZ.exe
  2⤵
  PID:7056
- C:\Windows\System\SAHfFZB.exe
  C:\Windows\System\SAHfFZB.exe
  2⤵
  PID:7920
- C:\Windows\System\rUfGjhA.exe
  C:\Windows\System\rUfGjhA.exe
  2⤵
  PID:5816
- C:\Windows\System\iyXZIBk.exe
  C:\Windows\System\iyXZIBk.exe
  2⤵
  PID:6584
- C:\Windows\System\cBCLcbI.exe
  C:\Windows\System\cBCLcbI.exe
  2⤵
  PID:1260
- C:\Windows\System\ksXsBYv.exe
  C:\Windows\System\ksXsBYv.exe
  2⤵
  PID:940
- C:\Windows\System\Eqhqbuc.exe
  C:\Windows\System\Eqhqbuc.exe
  2⤵
  PID:6004
- C:\Windows\System\WXpkCuB.exe
  C:\Windows\System\WXpkCuB.exe
  2⤵
  PID:13392
- C:\Windows\System\UeDCXZn.exe
  C:\Windows\System\UeDCXZn.exe
  2⤵
  PID:13836
- C:\Windows\System\ytgtsrg.exe
  C:\Windows\System\ytgtsrg.exe
  2⤵
  PID:2064
- C:\Windows\System\mSthcgI.exe
  C:\Windows\System\mSthcgI.exe
  2⤵
  PID:6396
- C:\Windows\System\IEyIWZz.exe
  C:\Windows\System\IEyIWZz.exe
  2⤵
  PID:6732
- C:\Windows\System\dvAKYsT.exe
  C:\Windows\System\dvAKYsT.exe
  2⤵
  PID:7488
- C:\Windows\System\AfjAhWC.exe
  C:\Windows\System\AfjAhWC.exe
  2⤵
  PID:7916
- C:\Windows\System\fuqMjEv.exe
  C:\Windows\System\fuqMjEv.exe
  2⤵
  PID:13932
- C:\Windows\System\QqxJoNZ.exe
  C:\Windows\System\QqxJoNZ.exe
  2⤵
  PID:7564
- C:\Windows\System\YPXPLWw.exe
  C:\Windows\System\YPXPLWw.exe
  2⤵
  PID:13780
- C:\Windows\System\tghsupe.exe
  C:\Windows\System\tghsupe.exe
  2⤵
  PID:452
- C:\Windows\System\iZuughj.exe
  C:\Windows\System\iZuughj.exe
  2⤵
  PID:6824
- C:\Windows\System\GfJHVXn.exe
  C:\Windows\System\GfJHVXn.exe
  2⤵
  PID:7176
- C:\Windows\System\ohpqkBu.exe
  C:\Windows\System\ohpqkBu.exe
  2⤵
  PID:7740
- C:\Windows\System\UQBfjNQ.exe
  C:\Windows\System\UQBfjNQ.exe
  2⤵
  PID:1280
- C:\Windows\System\LoxMMtp.exe
  C:\Windows\System\LoxMMtp.exe
  2⤵
  PID:7728
- C:\Windows\System\SePsLLc.exe
  C:\Windows\System\SePsLLc.exe
  2⤵
  PID:6380
- C:\Windows\System\xuVrUuW.exe
  C:\Windows\System\xuVrUuW.exe
  2⤵
  PID:13608
- C:\Windows\System\kOsHBns.exe
  C:\Windows\System\kOsHBns.exe
  2⤵
  PID:840
- C:\Windows\System\jCdXzXm.exe
  C:\Windows\System\jCdXzXm.exe
  2⤵
  PID:5736
- C:\Windows\System\dqCxBgo.exe
  C:\Windows\System\dqCxBgo.exe
  2⤵
  PID:6716
- C:\Windows\System\NAwqcjs.exe
  C:\Windows\System\NAwqcjs.exe
  2⤵
  PID:6856
- C:\Windows\System\cOBFXSC.exe
  C:\Windows\System\cOBFXSC.exe
  2⤵
  PID:7216
- C:\Windows\System\TTvClLv.exe
  C:\Windows\System\TTvClLv.exe
  2⤵
  PID:6288
- C:\Windows\System\HGKfBHF.exe
  C:\Windows\System\HGKfBHF.exe
  2⤵
  PID:5444
- C:\Windows\System\KxvuvSM.exe
  C:\Windows\System\KxvuvSM.exe
  2⤵
  PID:7460
- C:\Windows\System\ExtWykc.exe
  C:\Windows\System\ExtWykc.exe
  2⤵
  PID:6348
- C:\Windows\System\YSJEeLk.exe
  C:\Windows\System\YSJEeLk.exe
  2⤵
  PID:7048
- C:\Windows\System\IKMgZHV.exe
  C:\Windows\System\IKMgZHV.exe
  2⤵
  PID:7604
- C:\Windows\System\LToRXDH.exe
  C:\Windows\System\LToRXDH.exe
  2⤵
  PID:6424
- C:\Windows\System\EbYXiHc.exe
  C:\Windows\System\EbYXiHc.exe
  2⤵
  PID:7656
- C:\Windows\System\YIbbKZw.exe
  C:\Windows\System\YIbbKZw.exe
  2⤵
  PID:7712
- C:\Windows\System\KcmVrZL.exe
  C:\Windows\System\KcmVrZL.exe
  2⤵
  PID:7792
- C:\Windows\System\vgwwwMc.exe
  C:\Windows\System\vgwwwMc.exe
  2⤵
  PID:6056
- C:\Windows\System\HjIFXua.exe
  C:\Windows\System\HjIFXua.exe
  2⤵
  PID:6492
- C:\Windows\System\pcUZSGp.exe
  C:\Windows\System\pcUZSGp.exe
  2⤵
  PID:6680
- C:\Windows\System\UiFvfai.exe
  C:\Windows\System\UiFvfai.exe
  2⤵
  PID:6876
- C:\Windows\System\eVMeYum.exe
  C:\Windows\System\eVMeYum.exe
  2⤵
  PID:6664
- C:\Windows\System\lzQIqTq.exe
  C:\Windows\System\lzQIqTq.exe
  2⤵
  PID:7964
- C:\Windows\System\ynscCZN.exe
  C:\Windows\System\ynscCZN.exe
  2⤵
  PID:7264
- C:\Windows\System\zHDAsFA.exe
  C:\Windows\System\zHDAsFA.exe
  2⤵
  PID:7972
- C:\Windows\System\BHbwmmR.exe
  C:\Windows\System\BHbwmmR.exe
  2⤵
  PID:2460
- C:\Windows\System\ZTzGuRF.exe
  C:\Windows\System\ZTzGuRF.exe
  2⤵
  PID:8436
- C:\Windows\System\qWUGcTG.exe
  C:\Windows\System\qWUGcTG.exe
  2⤵
  PID:8368
- C:\Windows\System\EEBkOmP.exe
  C:\Windows\System\EEBkOmP.exe
  2⤵
  PID:7376
- C:\Windows\System\WdxUhrn.exe
  C:\Windows\System\WdxUhrn.exe
  2⤵
  PID:6324
- C:\Windows\System\SrVibTi.exe
  C:\Windows\System\SrVibTi.exe
  2⤵
  PID:6952
- C:\Windows\System\zqEzkrN.exe
  C:\Windows\System\zqEzkrN.exe
  2⤵
  PID:8144
- C:\Windows\System\jdRfdpF.exe
  C:\Windows\System\jdRfdpF.exe
  2⤵
  PID:7552
- C:\Windows\System\gpNYQFt.exe
  C:\Windows\System\gpNYQFt.exe
  2⤵
  PID:7692
- C:\Windows\System\nMCqGZD.exe
  C:\Windows\System\nMCqGZD.exe
  2⤵
  PID:8520
- C:\Windows\System\yGPjYCR.exe
  C:\Windows\System\yGPjYCR.exe
  2⤵
  PID:8556
- C:\Windows\System\SHuLELf.exe
  C:\Windows\System\SHuLELf.exe
  2⤵
  PID:9012
- C:\Windows\System\YkWhtdF.exe
  C:\Windows\System\YkWhtdF.exe
  2⤵
  PID:8188
- C:\Windows\System\yszqRWB.exe
  C:\Windows\System\yszqRWB.exe
  2⤵
  PID:6872
- C:\Windows\System\MeVtrHf.exe
  C:\Windows\System\MeVtrHf.exe
  2⤵
  PID:8200
- C:\Windows\System\FEWvjFe.exe
  C:\Windows\System\FEWvjFe.exe
  2⤵
  PID:7072
- C:\Windows\System\AAMmrKq.exe
  C:\Windows\System\AAMmrKq.exe
  2⤵
  PID:5180
- C:\Windows\System\iPLNsAH.exe
  C:\Windows\System\iPLNsAH.exe
  2⤵
  PID:7644
- C:\Windows\System\yoAiUue.exe
  C:\Windows\System\yoAiUue.exe
  2⤵
  PID:8864
- C:\Windows\System\cepcyyZ.exe
  C:\Windows\System\cepcyyZ.exe
  2⤵
  PID:6044
- C:\Windows\System\ixVDQwJ.exe
  C:\Windows\System\ixVDQwJ.exe
  2⤵
  PID:8308
- C:\Windows\System\LYSbIvO.exe
  C:\Windows\System\LYSbIvO.exe
  2⤵
  PID:7068
- C:\Windows\System\KHHjKgT.exe
  C:\Windows\System\KHHjKgT.exe
  2⤵
  PID:7232
- C:\Windows\System\srzMphy.exe
  C:\Windows\System\srzMphy.exe
  2⤵
  PID:7136
- C:\Windows\System\rTXRFWr.exe
  C:\Windows\System\rTXRFWr.exe
  2⤵
  PID:8884
- C:\Windows\System\MlPkbyD.exe
  C:\Windows\System\MlPkbyD.exe
  2⤵
  PID:9052
- C:\Windows\System\ZyxspHg.exe
  C:\Windows\System\ZyxspHg.exe
  2⤵
  PID:7424
- C:\Windows\System\CDVNYLQ.exe
  C:\Windows\System\CDVNYLQ.exe
  2⤵
  PID:8532
- C:\Windows\System\mgDSjPP.exe
  C:\Windows\System\mgDSjPP.exe
  2⤵
  PID:6376
- C:\Windows\System\kaRRGXK.exe
  C:\Windows\System\kaRRGXK.exe
  2⤵
  PID:8740
- C:\Windows\System\LkMSctu.exe
  C:\Windows\System\LkMSctu.exe
  2⤵
  PID:8888
- C:\Windows\System\mmgDfkE.exe
  C:\Windows\System\mmgDfkE.exe
  2⤵
  PID:7732
- C:\Windows\System\ZBselRF.exe
  C:\Windows\System\ZBselRF.exe
  2⤵
  PID:6164
- C:\Windows\System\lDjjSqP.exe
  C:\Windows\System\lDjjSqP.exe
  2⤵
  PID:9020
- C:\Windows\System\KcrpIzq.exe
  C:\Windows\System\KcrpIzq.exe
  2⤵
  PID:7580
- C:\Windows\System\eQKrkRk.exe
  C:\Windows\System\eQKrkRk.exe
  2⤵
  PID:7432
- C:\Windows\System\igrIzQk.exe
  C:\Windows\System\igrIzQk.exe
  2⤵
  PID:8480
- C:\Windows\System\UwQdoLc.exe
  C:\Windows\System\UwQdoLc.exe
  2⤵
  PID:8664
- C:\Windows\System\rbBbqqU.exe
  C:\Windows\System\rbBbqqU.exe
  2⤵
  PID:7924
- C:\Windows\System\wgkIyZt.exe
  C:\Windows\System\wgkIyZt.exe
  2⤵
  PID:8980
- C:\Windows\System\EkevJyL.exe
  C:\Windows\System\EkevJyL.exe
  2⤵
  PID:8584
- C:\Windows\System\mnrrdmp.exe
  C:\Windows\System\mnrrdmp.exe
  2⤵
  PID:7192
- C:\Windows\System\BoNBemi.exe
  C:\Windows\System\BoNBemi.exe
  2⤵
  PID:7688
- C:\Windows\System\lttPehS.exe
  C:\Windows\System\lttPehS.exe
  2⤵
  PID:7796
- C:\Windows\System\ZRCVEEB.exe
  C:\Windows\System\ZRCVEEB.exe
  2⤵
  PID:8588
- C:\Windows\System\MfXXkjw.exe
  C:\Windows\System\MfXXkjw.exe
  2⤵
  PID:9732
- C:\Windows\System\YalDOOu.exe
  C:\Windows\System\YalDOOu.exe
  2⤵
  PID:6088
- C:\Windows\System\JLGfboV.exe
  C:\Windows\System\JLGfboV.exe
  2⤵
  PID:6176
- C:\Windows\System\KBUTsrv.exe
  C:\Windows\System\KBUTsrv.exe
  2⤵
  PID:9040
- C:\Windows\System\JeyzTAO.exe
  C:\Windows\System\JeyzTAO.exe
  2⤵
  PID:8100
- C:\Windows\System\YdoLkPI.exe
  C:\Windows\System\YdoLkPI.exe
  2⤵
  PID:7428
- C:\Windows\System\fNUNhnz.exe
  C:\Windows\System\fNUNhnz.exe
  2⤵
  PID:8404
- C:\Windows\System\mRfdqYg.exe
  C:\Windows\System\mRfdqYg.exe
  2⤵
  PID:7508
- C:\Windows\System\GfQYGhJ.exe
  C:\Windows\System\GfQYGhJ.exe
  2⤵
  PID:7360
- C:\Windows\System\SuPfHOv.exe
  C:\Windows\System\SuPfHOv.exe
  2⤵
  PID:7840
- C:\Windows\System\XeKOgTN.exe
  C:\Windows\System\XeKOgTN.exe
  2⤵
  PID:9640
- C:\Windows\System\DABdOBd.exe
  C:\Windows\System\DABdOBd.exe
  2⤵
  PID:5268
- C:\Windows\System\SSoEtEO.exe
  C:\Windows\System\SSoEtEO.exe
  2⤵
  PID:9300
- C:\Windows\System\Isgqzcd.exe
  C:\Windows\System\Isgqzcd.exe
  2⤵
  PID:7404
- C:\Windows\System\USigBVv.exe
  C:\Windows\System\USigBVv.exe
  2⤵
  PID:9192
- C:\Windows\System\OPqBRvY.exe
  C:\Windows\System\OPqBRvY.exe
  2⤵
  PID:8660
- C:\Windows\System\pYOHcFL.exe
  C:\Windows\System\pYOHcFL.exe
  2⤵
  PID:8968
- C:\Windows\System\JriJIPI.exe
  C:\Windows\System\JriJIPI.exe
  2⤵
  PID:7940
- C:\Windows\System\pILPzNb.exe
  C:\Windows\System\pILPzNb.exe
  2⤵
  PID:8872
- C:\Windows\System\sZSQrHX.exe
  C:\Windows\System\sZSQrHX.exe
  2⤵
  PID:8120
- C:\Windows\System\UyJrBFh.exe
  C:\Windows\System\UyJrBFh.exe
  2⤵
  PID:11140
- C:\Windows\System\BZFMtbM.exe
  C:\Windows\System\BZFMtbM.exe
  2⤵
  PID:11164
- C:\Windows\System\nilSfwV.exe
  C:\Windows\System\nilSfwV.exe
  2⤵
  PID:7784
- C:\Windows\System\pvPilnr.exe
  C:\Windows\System\pvPilnr.exe
  2⤵
  PID:10456
- C:\Windows\System\VOxhlvE.exe
  C:\Windows\System\VOxhlvE.exe
  2⤵
  PID:8688
- C:\Windows\System\DnpMYoK.exe
  C:\Windows\System\DnpMYoK.exe
  2⤵
  PID:9680
- C:\Windows\System\PGvapJu.exe
  C:\Windows\System\PGvapJu.exe
  2⤵
  PID:8420
- C:\Windows\System\CaIhfhz.exe
  C:\Windows\System\CaIhfhz.exe
  2⤵
  PID:10136
- C:\Windows\System\BuAbAxO.exe
  C:\Windows\System\BuAbAxO.exe
  2⤵
  PID:6892
- C:\Windows\System\ccGwlkc.exe
  C:\Windows\System\ccGwlkc.exe
  2⤵
  PID:9952
- C:\Windows\System\GMJpWbM.exe
  C:\Windows\System\GMJpWbM.exe
  2⤵
  PID:9996
- C:\Windows\System\vGKKFgS.exe
  C:\Windows\System\vGKKFgS.exe
  2⤵
  PID:10160
- C:\Windows\System\otOUDjl.exe
  C:\Windows\System\otOUDjl.exe
  2⤵
  PID:11212
- C:\Windows\System\pNlYRnp.exe
  C:\Windows\System\pNlYRnp.exe
  2⤵
  PID:9688
- C:\Windows\System\mHCiFGH.exe
  C:\Windows\System\mHCiFGH.exe
  2⤵
  PID:10336
- C:\Windows\System\JhxchlV.exe
  C:\Windows\System\JhxchlV.exe
  2⤵
  PID:7044
- C:\Windows\System\xmFUnfe.exe
  C:\Windows\System\xmFUnfe.exe
  2⤵
  PID:11176
- C:\Windows\System\JdQBeXg.exe
  C:\Windows\System\JdQBeXg.exe
  2⤵
  PID:10864
- C:\Windows\System\itWBSvx.exe
  C:\Windows\System\itWBSvx.exe
  2⤵
  PID:9924
- C:\Windows\System\fKQyOxr.exe
  C:\Windows\System\fKQyOxr.exe
  2⤵
  PID:11136
- C:\Windows\System\qZdmxUb.exe
  C:\Windows\System\qZdmxUb.exe
  2⤵
  PID:11864
- C:\Windows\System\yPLzJsk.exe
  C:\Windows\System\yPLzJsk.exe
  2⤵
  PID:9960
- C:\Windows\System\lqhuTws.exe
  C:\Windows\System\lqhuTws.exe
  2⤵
  PID:9460
- C:\Windows\System\qTRiWby.exe
  C:\Windows\System\qTRiWby.exe
  2⤵
  PID:8956
- C:\Windows\System\LJqMqSX.exe
  C:\Windows\System\LJqMqSX.exe
  2⤵
  PID:10480
- C:\Windows\System\AMRgLUp.exe
  C:\Windows\System\AMRgLUp.exe
  2⤵
  PID:12264
- C:\Windows\System\XXWoLxi.exe
  C:\Windows\System\XXWoLxi.exe
  2⤵
  PID:8408
- C:\Windows\System\ivXWMmY.exe
  C:\Windows\System\ivXWMmY.exe
  2⤵
  PID:11664
- C:\Windows\System\fJMfclW.exe
  C:\Windows\System\fJMfclW.exe
  2⤵
  PID:9912
- C:\Windows\System\NUQgfNd.exe
  C:\Windows\System\NUQgfNd.exe
  2⤵
  PID:11192
- C:\Windows\System\zWsodrh.exe
  C:\Windows\System\zWsodrh.exe
  2⤵
  PID:11460
- C:\Windows\System\Fhfhnhv.exe
  C:\Windows\System\Fhfhnhv.exe
  2⤵
  PID:8340
- C:\Windows\System\SsOAXml.exe
  C:\Windows\System\SsOAXml.exe
  2⤵
  PID:11828
- C:\Windows\System\rblDmPm.exe
  C:\Windows\System\rblDmPm.exe
  2⤵
  PID:11048
- C:\Windows\System\sqalBjV.exe
  C:\Windows\System\sqalBjV.exe
  2⤵
  PID:12272
- C:\Windows\System\OlFdagt.exe
  C:\Windows\System\OlFdagt.exe
  2⤵
  PID:12108
- C:\Windows\System\YJUTYub.exe
  C:\Windows\System\YJUTYub.exe
  2⤵
  PID:14352
- C:\Windows\System\teSasYK.exe
  C:\Windows\System\teSasYK.exe
  2⤵
  PID:14376
- C:\Windows\System\wqknjVZ.exe
  C:\Windows\System\wqknjVZ.exe
  2⤵
  PID:14404
- C:\Windows\System\xMCQgSN.exe
  C:\Windows\System\xMCQgSN.exe
  2⤵
  PID:14432
- C:\Windows\System\cOxpTPX.exe
  C:\Windows\System\cOxpTPX.exe
  2⤵
  PID:14452
- C:\Windows\System\APzBwzu.exe
  C:\Windows\System\APzBwzu.exe
  2⤵
  PID:14484
- C:\Windows\System\VbEmdzX.exe
  C:\Windows\System\VbEmdzX.exe
  2⤵
  PID:14520
- C:\Windows\System\sIzXdRI.exe
  C:\Windows\System\sIzXdRI.exe
  2⤵
  PID:14540
- C:\Windows\System\lEUBZwW.exe
  C:\Windows\System\lEUBZwW.exe
  2⤵
  PID:14564
- C:\Windows\System\aBYHAfs.exe
  C:\Windows\System\aBYHAfs.exe
  2⤵
  PID:14592
- C:\Windows\System\ThflrPj.exe
  C:\Windows\System\ThflrPj.exe
  2⤵
  PID:14620
- C:\Windows\System\ocALwVf.exe
  C:\Windows\System\ocALwVf.exe
  2⤵
  PID:14664
- C:\Windows\System\ujIuMrX.exe
  C:\Windows\System\ujIuMrX.exe
  2⤵
  PID:14700
- C:\Windows\System\jaiNaVx.exe
  C:\Windows\System\jaiNaVx.exe
  2⤵
  PID:14732
- C:\Windows\System\HwiGFEB.exe
  C:\Windows\System\HwiGFEB.exe
  2⤵
  PID:14756
- C:\Windows\System\ZRGSztv.exe
  C:\Windows\System\ZRGSztv.exe
  2⤵
  PID:14792
- C:\Windows\System\xRGdVkW.exe
  C:\Windows\System\xRGdVkW.exe
  2⤵
  PID:14824
- C:\Windows\System\rZTeBGZ.exe
  C:\Windows\System\rZTeBGZ.exe
  2⤵
  PID:14852
- C:\Windows\System\PlXsGLe.exe
  C:\Windows\System\PlXsGLe.exe
  2⤵
  PID:14872
- C:\Windows\System\oDwbeOm.exe
  C:\Windows\System\oDwbeOm.exe
  2⤵
  PID:14900
- C:\Windows\System\xOqdRhh.exe
  C:\Windows\System\xOqdRhh.exe
  2⤵
  PID:14924
- C:\Windows\System\QcYMzrG.exe
  C:\Windows\System\QcYMzrG.exe
  2⤵
  PID:15008
- C:\Windows\System\qUlmOSZ.exe
  C:\Windows\System\qUlmOSZ.exe
  2⤵
  PID:15032
- C:\Windows\System\uLUCAQI.exe
  C:\Windows\System\uLUCAQI.exe
  2⤵
  PID:15060
- C:\Windows\System\DHKSOPZ.exe
  C:\Windows\System\DHKSOPZ.exe
  2⤵
  PID:15080
- C:\Windows\System\fMIEsAP.exe
  C:\Windows\System\fMIEsAP.exe
  2⤵
  PID:15108
- C:\Windows\System\ffPzHox.exe
  C:\Windows\System\ffPzHox.exe
  2⤵
  PID:15248
- C:\Windows\System\NalIryu.exe
  C:\Windows\System\NalIryu.exe
  2⤵
  PID:15272
- C:\Windows\System\XeBmFdv.exe
  C:\Windows\System\XeBmFdv.exe
  2⤵
  PID:15292
- C:\Windows\System\dLshKoj.exe
  C:\Windows\System\dLshKoj.exe
  2⤵
  PID:15328
- C:\Windows\System\YzLkHTI.exe
  C:\Windows\System\YzLkHTI.exe
  2⤵
  PID:15348
- C:\Windows\System\XbNqOvC.exe
  C:\Windows\System\XbNqOvC.exe
  2⤵
  PID:11316
- C:\Windows\System\CVkkuMr.exe
  C:\Windows\System\CVkkuMr.exe
  2⤵
  PID:100
- C:\Windows\System\iYOLphx.exe
  C:\Windows\System\iYOLphx.exe
  2⤵
  PID:12172
- C:\Windows\System\ixyKgfB.exe
  C:\Windows\System\ixyKgfB.exe
  2⤵
  PID:14384
- C:\Windows\System\uuZpPJb.exe
  C:\Windows\System\uuZpPJb.exe
  2⤵
  PID:10716
- C:\Windows\System\ruwRHMT.exe
  C:\Windows\System\ruwRHMT.exe
  2⤵
  PID:10100
- C:\Windows\System\PlMSZvI.exe
  C:\Windows\System\PlMSZvI.exe
  2⤵
  PID:8240
- C:\Windows\System\TMQfrTd.exe
  C:\Windows\System\TMQfrTd.exe
  2⤵
  PID:11560
- C:\Windows\System\mNukrGZ.exe
  C:\Windows\System\mNukrGZ.exe
  2⤵
  PID:10788
- C:\Windows\System\RZwODdJ.exe
  C:\Windows\System\RZwODdJ.exe
  2⤵
  PID:10164
- C:\Windows\System\imKJDOK.exe
  C:\Windows\System\imKJDOK.exe
  2⤵
  PID:9408
- C:\Windows\System\ygvUMBv.exe
  C:\Windows\System\ygvUMBv.exe
  2⤵
  PID:14392
- C:\Windows\System\LuAPoiY.exe
  C:\Windows\System\LuAPoiY.exe
  2⤵
  PID:12048
- C:\Windows\System\EaXSzaI.exe
  C:\Windows\System\EaXSzaI.exe
  2⤵
  PID:10464
- C:\Windows\System\qKDTIZj.exe
  C:\Windows\System\qKDTIZj.exe
  2⤵
  PID:14504
- C:\Windows\System\OLOhSlq.exe
  C:\Windows\System\OLOhSlq.exe
  2⤵
  PID:10604
- C:\Windows\System\PEQmdFg.exe
  C:\Windows\System\PEQmdFg.exe
  2⤵
  PID:10344
- C:\Windows\System\GxTlOpt.exe
  C:\Windows\System\GxTlOpt.exe
  2⤵
  PID:14884
- C:\Windows\System\BRksXPT.exe
  C:\Windows\System\BRksXPT.exe
  2⤵
  PID:14912
- C:\Windows\System\RpUhmiU.exe
  C:\Windows\System\RpUhmiU.exe
  2⤵
  PID:11388
- C:\Windows\System\WeykWJq.exe
  C:\Windows\System\WeykWJq.exe
  2⤵
  PID:14708
- C:\Windows\System\tuqyTZs.exe
  C:\Windows\System\tuqyTZs.exe
  2⤵
  PID:10556
- C:\Windows\System\NRkbZRF.exe
  C:\Windows\System\NRkbZRF.exe
  2⤵
  PID:14512
- C:\Windows\System\urocCMs.exe
  C:\Windows\System\urocCMs.exe
  2⤵
  PID:14608
- C:\Windows\System\agEgHoM.exe
  C:\Windows\System\agEgHoM.exe
  2⤵
  PID:14932
- C:\Windows\System\QoqyWQS.exe
  C:\Windows\System\QoqyWQS.exe
  2⤵
  PID:14776
- C:\Windows\System\fiBtjAm.exe
  C:\Windows\System\fiBtjAm.exe
  2⤵
  PID:14864
- C:\Windows\System\TbMIxqh.exe
  C:\Windows\System\TbMIxqh.exe
  2⤵
  PID:15024
- C:\Windows\System\PTELeuC.exe
  C:\Windows\System\PTELeuC.exe
  2⤵
  PID:9528
- C:\Windows\System\jPVeiGV.exe
  C:\Windows\System\jPVeiGV.exe
  2⤵
  PID:15068
- C:\Windows\System\ToeoetM.exe
  C:\Windows\System\ToeoetM.exe
  2⤵
  PID:13220
- C:\Windows\System\EnarRKm.exe
  C:\Windows\System\EnarRKm.exe
  2⤵
  PID:15240
- C:\Windows\System\rwkEifS.exe
  C:\Windows\System\rwkEifS.exe
  2⤵
  PID:15300
- C:\Windows\System\yJiknii.exe
  C:\Windows\System\yJiknii.exe
  2⤵
  PID:13148
- C:\Windows\System\GqkYkUL.exe
  C:\Windows\System\GqkYkUL.exe
  2⤵
  PID:12516
- C:\Windows\System\DdRVKFs.exe
  C:\Windows\System\DdRVKFs.exe
  2⤵
  PID:13240
- C:\Windows\System\YsAVYnK.exe
  C:\Windows\System\YsAVYnK.exe
  2⤵
  PID:10460
- C:\Windows\System\aiWULUb.exe
  C:\Windows\System\aiWULUb.exe
  2⤵
  PID:12820
- C:\Windows\System\cyRVSNm.exe
  C:\Windows\System\cyRVSNm.exe
  2⤵
  PID:5284
- C:\Windows\System\nVFakOk.exe
  C:\Windows\System\nVFakOk.exe
  2⤵
  PID:14576
- C:\Windows\System\SkuWXpz.exe
  C:\Windows\System\SkuWXpz.exe
  2⤵
  PID:10484
- C:\Windows\System\QoDzqbo.exe
  C:\Windows\System\QoDzqbo.exe
  2⤵
  PID:9440
- C:\Windows\System\TCvxbPE.exe
  C:\Windows\System\TCvxbPE.exe
  2⤵
  PID:9888
- C:\Windows\System\BoghVLU.exe
  C:\Windows\System\BoghVLU.exe
  2⤵
  PID:14476
- C:\Windows\System\rTHvQEL.exe
  C:\Windows\System\rTHvQEL.exe
  2⤵
  PID:14648
- C:\Windows\System\rCejghL.exe
  C:\Windows\System\rCejghL.exe
  2⤵
  PID:11256
- C:\Windows\System\OCOQUrz.exe
  C:\Windows\System\OCOQUrz.exe
  2⤵
  PID:10232
- C:\Windows\System\ZyzbgbE.exe
  C:\Windows\System\ZyzbgbE.exe
  2⤵
  PID:14528
- C:\Windows\System\zJaGtBx.exe
  C:\Windows\System\zJaGtBx.exe
  2⤵
  PID:12964
- C:\Windows\System\WznqgYd.exe
  C:\Windows\System\WznqgYd.exe
  2⤵
  PID:12888
- C:\Windows\System\MBcixhZ.exe
  C:\Windows\System\MBcixhZ.exe
  2⤵
  PID:10476
- C:\Windows\System\LGcRLzp.exe
  C:\Windows\System\LGcRLzp.exe
  2⤵
  PID:13108
- C:\Windows\System\bumFnto.exe
  C:\Windows\System\bumFnto.exe
  2⤵
  PID:11736
- C:\Windows\System\borkjaS.exe
  C:\Windows\System\borkjaS.exe
  2⤵
  PID:12444
- C:\Windows\System\JqdaDbT.exe
  C:\Windows\System\JqdaDbT.exe
  2⤵
  PID:15208
- C:\Windows\System\SxrMbXj.exe
  C:\Windows\System\SxrMbXj.exe
  2⤵
  PID:11800
- C:\Windows\System\RAzNQvX.exe
  C:\Windows\System\RAzNQvX.exe
  2⤵
  PID:15028
- C:\Windows\System\GpypzXs.exe
  C:\Windows\System\GpypzXs.exe
  2⤵
  PID:12772
- C:\Windows\System\xywqhYj.exe
  C:\Windows\System\xywqhYj.exe
  2⤵
  PID:15160
- C:\Windows\System\BWfSxVW.exe
  C:\Windows\System\BWfSxVW.exe
  2⤵
  PID:14632
- C:\Windows\System\XKmNDdJ.exe
  C:\Windows\System\XKmNDdJ.exe
  2⤵
  PID:15172
- C:\Windows\System\xHoUTQd.exe
  C:\Windows\System\xHoUTQd.exe
  2⤵
  PID:12872
- C:\Windows\System\DoKDSer.exe
  C:\Windows\System\DoKDSer.exe
  2⤵
  PID:12196
- C:\Windows\System\vUEKbCX.exe
  C:\Windows\System\vUEKbCX.exe
  2⤵
  PID:14560
- C:\Windows\System\doMQleU.exe
  C:\Windows\System\doMQleU.exe
  2⤵
  PID:11020
- C:\Windows\System\AyqbCGz.exe
  C:\Windows\System\AyqbCGz.exe
  2⤵
  PID:12992
- C:\Windows\System\ZesAbdr.exe
  C:\Windows\System\ZesAbdr.exe
  2⤵
  PID:11848
- C:\Windows\System\NQdgDdT.exe
  C:\Windows\System\NQdgDdT.exe
  2⤵
  PID:12968
- C:\Windows\System\PxcmGvj.exe
  C:\Windows\System\PxcmGvj.exe
  2⤵
  PID:13252
- C:\Windows\System\srUWsjj.exe
  C:\Windows\System\srUWsjj.exe
  2⤵
  PID:10512
- C:\Windows\System\BqVcNUQ.exe
  C:\Windows\System\BqVcNUQ.exe
  2⤵
  PID:11080
- C:\Windows\System\aDAIEdG.exe
  C:\Windows\System\aDAIEdG.exe
  2⤵
  PID:15096
- C:\Windows\System\gVjhqgS.exe
  C:\Windows\System\gVjhqgS.exe
  2⤵
  PID:12372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYH0CKVD\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jmxuok1c.2jk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CHnWPCt.exe

Filesize
2.2MB

MD5
15c3423a9de1d5989f11505d6cfee477

SHA1
3e79d7bc94d7a885a6921c40d46b8b6157f77aa7

SHA256
8e9202830f92018cc87384ae2a15cb492fd87aee84de521a5a36f752d12dcc06

SHA512
a0cfd158631482266a2968069faf79c9ad357fc38259f9b04f5b41f43ee44b0a5dca1cfdbc504b1dc4b0b8b7310057123c9424836380065f454ba6113d6aed4b

Download Submit
C:\Windows\System\DOTRIcQ.exe

Filesize
2.2MB

MD5
3009b3e29370465c206154de2a1ee849

SHA1
6360d28a168001f5264c6e892b18879762610981

SHA256
375cd780e8346b7572091ec84e0de59cd7d4906ac6bc16d47fb8b85f9b7cdb97

SHA512
bc798d186807048e6352e3f0eeeb7e50900b1c4c4ad8162c49cdd883d2508a3470a2a8e78e86c5da10157f279cb901a89afd3a4aeb993dd6460ea5da9b0d1159

Download Submit
C:\Windows\System\EpYhLZQ.exe

Filesize
2.2MB

MD5
c208112d175ff1f356c05c145b19760f

SHA1
3788c543ed21375f3b5316080dea1ac3d51f7af6

SHA256
e9a7becf9332c465f453e6bc6d03abd63412ece37697acaf66680c8b4908b764

SHA512
dd15971b3907575e895bb931945aa9ba37f2183e2500e600805f30218a9ced023715acc181204df32af2740eacb5b87a29b63f2f4ad3e166f1b4f6fde379e961

Download Submit
C:\Windows\System\FEWUDKQ.exe

Filesize
2.2MB

MD5
033091c69ebf1626b0f563f3674ec929

SHA1
e9c4b1b097fb40f52f7d53d862d3da87a46abb06

SHA256
87d138e1105f0544a8dad070486d2f878038e5928193f10065fae1a351af0071

SHA512
eaa3936399cf15a4d581721d8785b8668ddc3b20c36a9d784278619fff6bc52402efe833be03b31fdd5821325b42ecd122c53a4dd2f7f9a17040428122682804

Download Submit
C:\Windows\System\GmLldbI.exe

Filesize
2.2MB

MD5
274816de2c44a19d21f73019579b6de3

SHA1
8bb0996b1a508886d718726e35fa4d9cbf777460

SHA256
296f714ba5abe009c576fdda666c8ce294a72d1e1f244da3442a79ff26361ee0

SHA512
9b73da4254348f4b2b40165dab5b8b2ca0ff69ce551539da5ac40981dcd0fbee175aaf89912b39756cc1f30555e9567795d9a98c5edb362d017119080fffa6c3

Download Submit
C:\Windows\System\HwahBOy.exe

Filesize
8B

MD5
d6349613f683bded6d69a7d02ace4275

SHA1
1627fabfdfae3cac338500241f4e9e969ee50ac5

SHA256
4a54b14258d08729a6205b09d8643680d1fcbeb6eaed5e636cae813e537ac662

SHA512
d83aa606a1ca4c9ad32d8a91f5b2cf833fc395e62b938477a618ca3509fa52443c5e33121c0988fd90e65d2855a59276136a584d3f8258054273372e5fbf3292

Download Submit
C:\Windows\System\IiVlKCy.exe

Filesize
2.2MB

MD5
bd742111391dfd8a774ac52038ab47c7

SHA1
85bccfb473c64ca72488ef9ee7b87cbe9cc13851

SHA256
4bd2e6f9a51aa80f43f5bdc1c723dcc527e50c7858e356d547e58782a6f9f68a

SHA512
8bcf1023fbca414033e7e13a14eeb028790f90d5acc92dda5b59c106a24f750f3db8e58d7ed5d534075842a94b51d176aac5e8b0f774e9d369fe480e4025024a

Download Submit
C:\Windows\System\JCIxOjr.exe

Filesize
2.2MB

MD5
30349f1b47a6875e2ac44246ddc20ba1

SHA1
40c6f46d08d4c1e5843fb282836df50ae65c354b

SHA256
b53e264dcb76dfbde43801e6a32bb58bfd544deda4917ef9668ec1f8b6d94c81

SHA512
d0db07a956ddc53c98e76232c734d994fcb4868d4004a0c98a25a213171bbef085880eafd4b4f530db82d89272f390f83d904625807dc9a791e9926aa799a0f1

Download Submit
C:\Windows\System\Jnygmqg.exe

Filesize
2.2MB

MD5
c525b4dee5621cff372918ece9b5a082

SHA1
6d41cdf2c7722f48716653c788b2cd8643e8a8cf

SHA256
ffd3f84412e3fc76456b8014c99d484412745b4c72ab8e5a1618ba21c47ee09a

SHA512
f3210945362a533d1b100183f8200b2c4a9a6f7d5937887d5cf5a45fd3772c21e49735d1b0733bead91b3463b442970641c8220d11131ea7333a67cc51e4fb50

Download Submit
C:\Windows\System\LJNjeAc.exe

Filesize
2.2MB

MD5
06474da92c6b562d5d95e2c2805bf413

SHA1
edb40b5c4408932768f5506ffbc5bb6f89bc6224

SHA256
292810774a3ccb7f7ec366c7aac5722e5a195164060db48b1921c31c033d12b7

SHA512
e332f70d933aff29cb1e792694cdb34849cea8bdee123a6366339acbddb7783149a702d313ca747266ae272616a7632acbee0951f76aa6e111f6f1d7ec853a8e

Download Submit
C:\Windows\System\LwRtCIM.exe

Filesize
2.2MB

MD5
41def86101718fa1c6e7872e8d913b5b

SHA1
14fa061ae19e1ef2e5dcfdb6235cae32c2385006

SHA256
bcb19c9edfb6c49847e62153ef9e547ccbb895f657c0d96746597eac9327a8cd

SHA512
cf01d26118247f7786616a2f68c6ace1ff52042989e01f23ac00ee92e911bcda459c878daa6b21f9cf99c5cabe964d775c9a5c5720baa2c9e42e3b162a8eeced

Download Submit
C:\Windows\System\MWsTMwp.exe

Filesize
2.2MB

MD5
e554c798c2987c0503c5cfb6acc75e9b

SHA1
0609cb21bdd8c5fc2f9304eb8972c5a3b8ec79ef

SHA256
30b7e68108fd111b2d205ce7844421deedd708bf7510e548e8e25d24294c3a70

SHA512
02a11dafab7ebbe027c42283ef26416780cb382601c71ab577508a598bf175ecc313f67c12dbef23d78cbc5e71b4ace27267761dd70ee79c0aa8a2b4d16cb0c0

Download Submit
C:\Windows\System\MkydxjP.exe

Filesize
2.2MB

MD5
8b7bee8cfce41c79323e1e9324405358

SHA1
5ecd3851d01f108aa843d1c30871935ddd9a2a43

SHA256
d6bde807d43a56d94b166d06c4c3189382e7f34c4460a18779ddb1be30af6220

SHA512
ef3e8ec30c869de040a4883265cc1cb55231e0089652304f06f584f95c6f98f617a6790b1e4e9bf1f88367e37ccbd853903a0d0057a6f5d3c460d46b123b440a

Download Submit
C:\Windows\System\OwIkkWn.exe

Filesize
2.2MB

MD5
3cdd83fc2eadc1a6d69d0edc14d66817

SHA1
f02709472a35dfb6a49c06431b75169113505c99

SHA256
a67550cbeaf720f738b7bda225c6aea108fee1f83cdd717968ec7ab94c002d65

SHA512
f1a849771dbc6433ff1aa76d270c671b8b9cbf607dd35c7e3110e8aeb8b2d2574f3fa2dfe743d688e864f0ed0402eb86e9efb7b9e98ad7c54a30f9b0332d265f

Download Submit
C:\Windows\System\PXqUqtm.exe

Filesize
2.2MB

MD5
ea50e7c745ef11af3527d2c1a4f8fa21

SHA1
067c5579d9b926f55b312a3b52b6841a1bafcb12

SHA256
fa0c13859cccb9f9b022152011ef3c2241a849d7d6eedbc567df875d6727b6bf

SHA512
27d699b69f2b7c4a91110d182e4303d8e4d38948c579be6945ec0413369fc3e234e4800fcc3da8929a62e7b1e3e1de33bf4b2982bd42bbdfafb8023331ff45e8

Download Submit
C:\Windows\System\USuWcvU.exe

Filesize
2.2MB

MD5
956b9d1f7b25b0b4b625c7401041c0f6

SHA1
3732b73174c2b440a86a0e06d26b46c8e6843256

SHA256
86f9b30193c49e0485bfd9e18407b27d6e99f06afa0bd5852516d5c0bfdade9c

SHA512
e29dc850d378d59a80fac7ce68422ac735e3bfd2d9fc5714fdba78db7d5ef99a76232c04b39f448e51a4e29e0d92b564dd6f19133c41aba02b73655f8fa5d292

Download Submit
C:\Windows\System\aOBIPnG.exe

Filesize
2.2MB

MD5
fef0caa4144f993e18ef16211e3f8ac8

SHA1
0a5729b772c8b3674fa19c40622c72bc5484a923

SHA256
6556b86654e813d37f2cf6a9a4c871ba094f9341cf6bd777358195582733122b

SHA512
36aae885c37ada564dc2836946896e5d080b90920af93f2e305db91f04e3a0e92c4ec5633d033129fc350890739a9e563cfba00b2d3daa829e390c9c31164117

Download Submit
C:\Windows\System\aOyuaKB.exe

Filesize
2.2MB

MD5
835373dd6199bc83126b46b150c34d8b

SHA1
b009bec45410a5e0df967a1cc83d6f11842e82be

SHA256
d19404c79e308f94eae56485307c0feea0199365cd19d8d62d9c7dfd1b36620f

SHA512
af6389c211653d5e2811b6c356aacf47c06568b0ee6a9ac8b3a911b4ea82a7c196964d04056db9aae0b4423ba8a317ee883242ba483a2221a1408b4535d258c5

Download Submit
C:\Windows\System\bBTXEzk.exe

Filesize
2.2MB

MD5
e035ee51a74263bf6598f345a660ee0d

SHA1
f5fe6e49c8facfaaaee735f3517fc061cc82e026

SHA256
bae4e8c512ba5ff82ba53e819ea1d55b2805eb1de3dc357b41ad3bec0c9985e8

SHA512
211c80439ea7e21f922bf39149e302f8b15fe315011bed88e9d1ef49e77d45c1b3d5b507e9839c2154e35b90dac3e093004d4f6da029b8674fd6213b285a4b07

Download Submit
C:\Windows\System\eMkbcQJ.exe

Filesize
2.2MB

MD5
feb026e9f1a5bb72a01f203bb1d7c953

SHA1
3409712b8b06427e07271e7cad20d9fdac55253d

SHA256
30db2186cbbb85d8eece96fc3d5ce1d499c9ea39e7c152a3d3ee3937e05b7a9b

SHA512
ded8aa0bc401f71a9493e5437ca1bb8559119782ed6229c3b35197e9440feca63380fad0d94dffaf2c2eae5abb4c74fa08ac9acb37c5f20000a29c353060f1d6

Download Submit
C:\Windows\System\eTqoySM.exe

Filesize
2.2MB

MD5
ebc8cd023cd1707c8babf829686f91f6

SHA1
4de03f6cacf28235067b1990330665d9ad674ef7

SHA256
a9d2fe5509a1c91ec3d6701251499c0b4c820d28b702f0e80737a65077cae94f

SHA512
1648a437d21174318a4d6ed6cb735552621553f721ddbc3d94934b5be0103492a78980cf0c6ca824108363a4e3b20807845eef947e19284b853b92581062c377

Download Submit
C:\Windows\System\gcVfjyN.exe

Filesize
2.2MB

MD5
9ac574b46a4c888bdaf151976cd0b203

SHA1
ec3a835552dd55c1485e726d41038ab416eac70b

SHA256
81d5b59c8d4fcace43d1bf2667e6fab674dbb72b2a38b3bcb5a8bd948079e234

SHA512
9d611cdd27c9254fc4776299636ec2bcdcdd5050cb618e3c52b95c66184577f1a90265e3f11c0bec03ade6c3bb0e44b83bcd5719919679305a349729982503ab

Download Submit
C:\Windows\System\hxfFpic.exe

Filesize
2.2MB

MD5
b46e171a9ed3b3c21bf49e1b61609079

SHA1
47abad8109dfd2618691e3a4ffa98c3507d173a7

SHA256
91db24802a73ebda2e516428b29167bdf5ccdd28f271b09662a13ec4a619ddf0

SHA512
d670b43917cbc6027c3eaf26239ea6dc1fb97a246527a3482a3f5cc6ea49f4a2bfc46210349677b9b1bff8aeb8369938621cc10377a8fc4451300c9d0f9ad6b7

Download Submit
C:\Windows\System\jpnneHo.exe

Filesize
2.2MB

MD5
441b5c560df6b8d641952c790c64e23a

SHA1
4362977b427d0fe84f6d131567372f8eea780bb9

SHA256
22bcfc2d82ad4fd7e4552cafb4343db0aad28dbab804a94e091c5e63d0190287

SHA512
5c97d88e82162351ba41987fdb08040f4793fb7534e3331b8910f428157c8149628d5e6a94d804895347e1a30a60f55d7d0caf0efd2ba1af5d4713445ce6bf48

Download Submit
C:\Windows\System\koIfifh.exe

Filesize
2.2MB

MD5
f3fdef9a86da2c4120f88db0162a3463

SHA1
b6deee4d879042e5190a1e3f9c5866d9bd35155b

SHA256
8a679d0838c2419bbc60b8c43bec1ef4fe7130cf06c3dbd25a0b9bbc4168c44b

SHA512
6b4fa32303342fe6f11c0e61c44d5cb97bd937d1a030e9172ef376116dbbba17484bfe2eb158115209fce52a1085eb82362431c984c496cceadddcc6ad559b58

Download Submit
C:\Windows\System\lhaTWvO.exe

Filesize
18B

MD5
9fa2f2bc2c83847fc483e3e7b126834c

SHA1
8b6462d325e2f1ce3be472e3b52dd110ec77edc6

SHA256
2cfeba3b82f25cdebb02f8d4e5a1f9c8b06dd44b398a3a1e6c4b2e3889cd64d2

SHA512
cdf8d08cfa397a3c63f4ef05a58f2b05a8fdc5e71478c30ce0b29540695413920edc291f08e9c0e713496591adc5707c1c01f6e7f0baaad502181c860050f52f

Download Submit
C:\Windows\System\nbdEkVl.exe

Filesize
2.2MB

MD5
75bd5080bc4844d3cecab8473b03bc0c

SHA1
9c820b5ab2ff7c316ee4da79747ccccf5c92a23b

SHA256
3a494cd7379b49eadab9da1898fa2301317b3df389272c436a133e0810c7c67e

SHA512
e24f5c222155ec836c56fe105dd6b363f89fd317bbef2268462ca81ef856350d5a9511c52a04fa8b3d1d7c49214e3e06d31baa94bbc4c550d5a0ee1887a0339f

Download Submit
C:\Windows\System\qufhxod.exe

Filesize
2.2MB

MD5
ab09e1cdb42d279c3541297b252904ec

SHA1
927b635739f4b1751e71e38e428f7e837b56a7b7

SHA256
437baf1b8587751e9dfe4f189de76ed8e03b04b8ca0eb5f56d3a3f0ac68afc99

SHA512
18692d8776e960d7215ba982c1aa5a8196c022d72e5a75a47ebb15189d523e94bcebd1cbeff5a0e62a8373a55e59f2e86a6a8741b4e076664330e522066df036

Download Submit
C:\Windows\System\rQLOEXo.exe

Filesize
2.2MB

MD5
bc30d35e75275c823f8050e0b9f6fa16

SHA1
e11758fb9488af9cb2d7acd214ee6c22f6be0d10

SHA256
beb9d21ff36b52cd68e9b17b5cee45f033cace9e14b7dc048b42826e63d5ed77

SHA512
6f088155958acee7719392bfcd53f40f8ecbecf27f0fa2566bcd7f389a2e35f781ea58cae68c8b57b9ff984d20d84ae7573b119a8b0d4776b3d4364cdc7d2a12

Download Submit
C:\Windows\System\rYFenrz.exe

Filesize
2.2MB

MD5
e74e6e80231616fbbde48a0eac871dd9

SHA1
572c02876264f90451856cb3b4b85d2d63e2854b

SHA256
c1db486f7d105a4e745e969ec81e5ce48362347cceefb88b855db5cc286df521

SHA512
cf7d04fb34925fa357d1dd79b49efa1702ae281f71a6c870a79a9e5b38563d9156574e545821160a08b9766b5bd35cbe72cf9917a943bbba57c106870a3bb139

Download Submit
C:\Windows\System\sRSbsJE.exe

Filesize
2.2MB

MD5
5d48c129679cb4207adbbb76b1c90588

SHA1
b32556ac0809e436dc21d6ee38239ffa47bc3554

SHA256
2c7b9c4ee042ca572a23521a8d46cec97e892ddb827e4b50e43a4d1a7f4dbb6e

SHA512
a4c84f1c6d6503331575e0425d8d8a176d77821e06789e9a99a592659fd84bdd38a8bd6eaeb7029806180e628faf779da182dfa340ef4bc863c7ec8c59c8cb93

Download Submit
C:\Windows\System\tGhbfZn.exe

Filesize
2.2MB

MD5
de751bfe30e7bdd44ad3dbb9bc379b51

SHA1
0d298e3e75539cb6653d7e0c42f24b4472021004

SHA256
c546f19aa3015675425002d28964b8357cd860e217049640e8d782c1a7414c95

SHA512
103aa07c727826b0f1e15e057ec507a5357624f543f964b7cb56452aeef63e4d8809d226c0493c4a7ff543137ed4f7715c99a69aa2606a850f392273d8cb5aea

Download Submit
C:\Windows\System\tJdxiqb.exe

Filesize
2.2MB

MD5
59e50550249fdb323ee013b451a3a497

SHA1
e716f633a2b4c4b3336ecf0bb3fc3d392299cb6d

SHA256
e6da243271718ef709c3827ead30295b8239310bffee5ec4fa63e50b6b9fa461

SHA512
13c3e5b9af71099ed05ddfbd4ef973c04930fd08f6e263a469e554a993b81796db04d8272b2980789788b361a4e6ec661bf35019c78c336be1fa1f512d9febfc

Download Submit
C:\Windows\System\uPzxXqt.exe

Filesize
2.2MB

MD5
d7acf884d6c7f7c9cee628f33e6b7719

SHA1
8923b539a93569f13202d497317a7466a469c46f

SHA256
b7bdc317e9d4a0dc6079f05795e2c2860eff26a9e6f0fe33a368266afeac8750

SHA512
78f7775d502b1e57441faf993879fcd8a1be2d53d7c223d345eba1e0c62182fd49e5beac9cc68791bb0dc31bc00638a8162fb3465b2db5de121523f1249d77e3

Download Submit
C:\Windows\System\uoioAdd.exe

Filesize
2.2MB

MD5
476fa4ff43c2d6d9d8bf59aee15bdad9

SHA1
7c3e76d2759e4af85669eb7fec342df22b72f293

SHA256
377e89a896572783f032ff70f58a4de316e9126657d90e2cefacde9088e7e8e8

SHA512
5e52a8f04b4701ed0b90b1767416d96e412912fe9369c123476f12e5cbe67f20b842e6176c20105b0e5883e5911c97ed961dc580d92577384cfc5ac28813d722

Download Submit
C:\Windows\System\vDxcJnC.exe

Filesize
2.2MB

MD5
0b023b1aa2ac85bf1664b39e137e6cc1

SHA1
a9dda256a49fa706449b72aac04940269c57a4ba

SHA256
e87bbd4d31bd896464283dd78e18cc771963cddbde855f11e2eb82cda091fcc5

SHA512
92ba70c2e35798b635a558a55abcdf0c93f288cb8599ca0124bac8556c911968b3ce6461a529d7214b7b0a878ec1bbb56bd8b70a6b34478f166987363c407d40

Download Submit
C:\Windows\System\vHvymXK.exe

Filesize
2.2MB

MD5
07c441cbb4af1c317e50a05ecb226f4d

SHA1
4cb86474fac975c793d007ad040456a47d0db459

SHA256
a1dc1152d7bea869fbc68cbc1910bd688b0645f6bcec913ef51664aa3c2e2dc7

SHA512
9b33aaa47c645b9b792cde4406756d6065146655ef01b1ab2031082ee2b5ec3fc647023fce9d26577ffc131ebf019f4439a3e5d28e0fb298e43f7400c14ed162

Download Submit
C:\Windows\System\vPVfTcV.exe

Filesize
2.2MB

MD5
d3966023a9a5d50b124f905a337830d6

SHA1
2f669636376180f22d00f5270ccace93349e7153

SHA256
73d5199a1b7992037a503a24845661675194b376b6d04564efa8c383eadf1edb

SHA512
c90d16d8d8a66e5239f8697b20bbbf359dc2d80ce38aa48a11548fafbf06015f9f8d0e909b1433a0b991b53fd33b57cf0b3e21649a6a376a2debbfd5739e892f

Download Submit
C:\Windows\System\xnHBVar.exe

Filesize
2.2MB

MD5
a58f304aaf5eb0256df0b3d6b94ea6a7

SHA1
b95ccd5656a95d00bd74b4eab492407ec808a458

SHA256
ef0c0ef6d441a1b947aea7f8d462478542192b7544c55f9db98ecae48a655851

SHA512
325e3909b5f259c19da86b589c0964569ef9f177eb9d6cc8927a7c51679fe663cda8ec7c094671f2eb57a14f3c31f72942d100d1bac19ad23a769fca4bc768e5

Download Submit
C:\Windows\System\yMllXaU.exe

Filesize
2.2MB

MD5
6119c8109e6508f603f11a966199bc0c

SHA1
cf070f0078dc33ec9abe751adb757be56ef02b2e

SHA256
b5c68e37c78c0e87318abb58495bcf54e21dea792b0debce7df18c8baf87d6ae

SHA512
c181a078d43883077d00a3d40138d128f7646b07c6e045dcc552727719d6045dc44fa50e3cff405d8fc8cc4bebe1885254802f492986a2587328f693ded36b63

Download Submit
memory/388-3991-0x00007FF65D460000-0x00007FF65D852000-memory.dmp

Filesize
3.9MB

Download
memory/388-237-0x00007FF65D460000-0x00007FF65D852000-memory.dmp

Filesize
3.9MB

Download
memory/408-3944-0x00007FF6A8B80000-0x00007FF6A8F72000-memory.dmp

Filesize
3.9MB

Download
memory/408-221-0x00007FF6A8B80000-0x00007FF6A8F72000-memory.dmp

Filesize
3.9MB

Download
memory/428-51-0x00007FF774C90000-0x00007FF775082000-memory.dmp

Filesize
3.9MB

Download
memory/1448-0-0x00007FF7896D0000-0x00007FF789AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-1-0x000002364B590000-0x000002364B5A0000-memory.dmp

Filesize
64KB

Download
memory/1724-3931-0x00007FF66EDF0000-0x00007FF66F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-200-0x00007FF66EDF0000-0x00007FF66F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-81-0x00007FF6C2EB0000-0x00007FF6C32A2000-memory.dmp

Filesize
3.9MB

Download
memory/1876-233-0x00007FF79B240000-0x00007FF79B632000-memory.dmp

Filesize
3.9MB

Download
memory/2088-4020-0x00007FF625140000-0x00007FF625532000-memory.dmp

Filesize
3.9MB

Download
memory/2088-239-0x00007FF625140000-0x00007FF625532000-memory.dmp

Filesize
3.9MB

Download
memory/2140-198-0x00007FF7F66C0000-0x00007FF7F6AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-3925-0x00007FF7F66C0000-0x00007FF7F6AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-225-0x00007FF626B80000-0x00007FF626F72000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4038-0x00007FF626B80000-0x00007FF626F72000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3895-0x00007FF6629F0000-0x00007FF662DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-199-0x00007FF6629F0000-0x00007FF662DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-3974-0x00007FF6E1090000-0x00007FF6E1482000-memory.dmp

Filesize
3.9MB

Download
memory/2948-224-0x00007FF6E1090000-0x00007FF6E1482000-memory.dmp

Filesize
3.9MB

Download
memory/2968-244-0x00007FF7847D0000-0x00007FF784BC2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-3999-0x00007FF7847D0000-0x00007FF784BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-240-0x00007FF75E3D0000-0x00007FF75E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-4015-0x00007FF75E3D0000-0x00007FF75E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-3929-0x00007FF73F520000-0x00007FF73F912000-memory.dmp

Filesize
3.9MB

Download
memory/3168-202-0x00007FF73F520000-0x00007FF73F912000-memory.dmp

Filesize
3.9MB

Download
memory/3188-247-0x00007FF7FDA00000-0x00007FF7FDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3188-4026-0x00007FF7FDA00000-0x00007FF7FDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-48-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download
memory/3296-5-0x00007FF850093000-0x00007FF850095000-memory.dmp

Filesize
8KB

Download
memory/3296-245-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download
memory/3296-5303-0x00007FF850093000-0x00007FF850095000-memory.dmp

Filesize
8KB

Download
memory/3296-6977-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download
memory/3296-78-0x000001C567AB0000-0x000001C567AD2000-memory.dmp

Filesize
136KB

Download
memory/3296-248-0x000001C569110000-0x000001C5698B6000-memory.dmp

Filesize
7.6MB

Download
memory/3608-139-0x00007FF700E10000-0x00007FF701202000-memory.dmp

Filesize
3.9MB

Download
memory/3856-238-0x00007FF7C4440000-0x00007FF7C4832000-memory.dmp

Filesize
3.9MB

Download
memory/3856-3939-0x00007FF7C4440000-0x00007FF7C4832000-memory.dmp

Filesize
3.9MB

Download
memory/3860-110-0x00007FF66C0E0000-0x00007FF66C4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-219-0x00007FF785C00000-0x00007FF785FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-3936-0x00007FF785C00000-0x00007FF785FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-3957-0x00007FF660A20000-0x00007FF660E12000-memory.dmp

Filesize
3.9MB

Download
memory/4768-241-0x00007FF660A20000-0x00007FF660E12000-memory.dmp

Filesize
3.9MB

Download
memory/4996-3996-0x00007FF764C90000-0x00007FF765082000-memory.dmp

Filesize
3.9MB

Download
memory/4996-242-0x00007FF764C90000-0x00007FF765082000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3962-0x00007FF6A9560000-0x00007FF6A9952000-memory.dmp

Filesize
3.9MB

Download
memory/5036-246-0x00007FF6A9560000-0x00007FF6A9952000-memory.dmp

Filesize
3.9MB

Download
memory/5072-4029-0x00007FF607050000-0x00007FF607442000-memory.dmp

Filesize
3.9MB

Download
memory/5072-243-0x00007FF607050000-0x00007FF607442000-memory.dmp

Filesize
3.9MB

Download
memory/5092-3905-0x00007FF777C10000-0x00007FF778002000-memory.dmp

Filesize
3.9MB

Download
memory/5092-183-0x00007FF777C10000-0x00007FF778002000-memory.dmp

Filesize
3.9MB

Download