xmrig | fb9ffe1cf6539e27fed3957ab405232d28e7d78959cf1ae66f7910f181b96344

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
Size

2.0MB
MD5

63ef1f5c38d4119c9befc9a3c737792f
SHA1

b46ca61be9d4c8027f343e86436a2bdf68a04543
SHA256

fb9ffe1cf6539e27fed3957ab405232d28e7d78959cf1ae66f7910f181b96344
SHA512

67fb1aa212a39d78bfbbfdb8a5d4d9bdd15fa12f24979eac9226b3291571d4ded086e6a12f085d636a739a9e4ee46dec643c2b49e007263972b1e0bb5364f621
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMe:NABG

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2628-263-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2624-261-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/1964-259-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2960-257-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2520-255-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2420-253-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2652-250-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2664-249-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2752-247-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2708-245-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2808-176-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2684-155-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2808-3521-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2664-3524-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2960-3557-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2708-3593-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2752-3631-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2684-3757-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2420-3814-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2624-3815-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2628-3828-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2652-3886-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/1964-3959-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2520-3983-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3060 powershell.exe

pid	process
3060	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

DOzXDuA.exeDNYDjlh.exeszMiFWQ.exeOFxebdS.exeUOUFfSG.exerrqZRts.exeCCzJFUV.exeaPOGhPb.execaKJuop.exeJvzUBVw.exeGvUwTuB.exewwqGfab.exeWxoiEoV.exeZrxEQOd.exeHOBvkDD.exegGRnhhI.exeNMVKOus.exeivCGnZU.exeLvmCgsE.exeOUnMdoC.exeCUeZXyd.exeAdNSJmF.exejZuDAvQ.exeRFdhyPz.exeAJvDnkO.exeDvlbBFS.exeLCeMKEg.exeYlCdiRs.exeozClxEY.exeiahzxKG.exePWNBWdo.exewThhpOv.exeZsVjWIn.exeMVXvGuR.exeNEqOoIE.exeDLcOHON.exekesAShX.exeWeqPSyB.exerIMjwvo.exenQLWXfJ.exeaKlszyw.exegqWJfKy.exeFnItHqt.exelCrXpGm.exeJesguMN.exeavPwoSM.exewBYKpQU.exeXCoKuSE.exeZSrFtNk.exeInOWNEH.exewxlCTfu.exeEvssyiO.exehSszgdY.exeGHSevuL.exeTrYDCif.exesUFJorz.exereiqyKS.exeSdVXSzF.exeUTIDZUx.exectliPft.exeFOUyRtf.exeseOWGBl.exehHIkyhb.exexKckNXW.exe

pid	process
2684	DOzXDuA.exe
2808	DNYDjlh.exe
2708	szMiFWQ.exe
2752	OFxebdS.exe
2664	UOUFfSG.exe
2652	rrqZRts.exe
2420	CCzJFUV.exe
2520	aPOGhPb.exe
2960	caKJuop.exe
1964	JvzUBVw.exe
2624	GvUwTuB.exe
2628	wwqGfab.exe
2772	WxoiEoV.exe
2780	ZrxEQOd.exe
2792	HOBvkDD.exe
804	gGRnhhI.exe
332	NMVKOus.exe
2152	ivCGnZU.exe
380	LvmCgsE.exe
988	OUnMdoC.exe
596	CUeZXyd.exe
2188	AdNSJmF.exe
1448	jZuDAvQ.exe
1348	RFdhyPz.exe
2920	AJvDnkO.exe
2940	DvlbBFS.exe
892	LCeMKEg.exe
2084	YlCdiRs.exe
1716	ozClxEY.exe
2068	iahzxKG.exe
1508	PWNBWdo.exe
1628	wThhpOv.exe
1712	ZsVjWIn.exe
1324	MVXvGuR.exe
2232	NEqOoIE.exe
1068	DLcOHON.exe
2832	kesAShX.exe
860	WeqPSyB.exe
1072	rIMjwvo.exe
1672	nQLWXfJ.exe
3044	aKlszyw.exe
1472	gqWJfKy.exe
1596	FnItHqt.exe
2240	lCrXpGm.exe
900	JesguMN.exe
2868	avPwoSM.exe
1644	wBYKpQU.exe
564	XCoKuSE.exe
2856	ZSrFtNk.exe
608	InOWNEH.exe
1440	wxlCTfu.exe
1608	EvssyiO.exe
1656	hSszgdY.exe
1536	GHSevuL.exe
1540	TrYDCif.exe
2688	sUFJorz.exe
1696	reiqyKS.exe
2616	SdVXSzF.exe
2748	UTIDZUx.exe
2120	ctliPft.exe
1584	FOUyRtf.exe
1796	seOWGBl.exe
2956	hHIkyhb.exe
268	xKckNXW.exe

Loads dropped DLL 64 IoCs

Processes:

63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe

pid	process
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2044-0-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
\Windows\system\DOzXDuA.exe	upx
C:\Windows\system\szMiFWQ.exe	upx
C:\Windows\system\OFxebdS.exe	upx
C:\Windows\system\UOUFfSG.exe	upx
C:\Windows\system\rrqZRts.exe	upx
C:\Windows\system\CCzJFUV.exe	upx
C:\Windows\system\aPOGhPb.exe	upx
C:\Windows\system\JvzUBVw.exe	upx
C:\Windows\system\HOBvkDD.exe	upx
C:\Windows\system\NMVKOus.exe	upx
C:\Windows\system\ivCGnZU.exe	upx
C:\Windows\system\jZuDAvQ.exe	upx
\Windows\system\nQLWXfJ.exe	upx
behavioral1/memory/2628-263-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2624-261-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/1964-259-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2960-257-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2520-255-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2420-253-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2652-250-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2664-249-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2752-247-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2708-245-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2808-176-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
C:\Windows\system\ozClxEY.exe	upx
\Windows\system\rIMjwvo.exe	upx
behavioral1/memory/2684-155-0x000000013F510000-0x000000013F902000-memory.dmp	upx
\Windows\system\WeqPSyB.exe	upx
\Windows\system\kesAShX.exe	upx
C:\Windows\system\DvlbBFS.exe	upx
\Windows\system\PWNBWdo.exe	upx
\Windows\system\iahzxKG.exe	upx
C:\Windows\system\YlCdiRs.exe	upx
C:\Windows\system\LCeMKEg.exe	upx
C:\Windows\system\RFdhyPz.exe	upx
C:\Windows\system\AJvDnkO.exe	upx
C:\Windows\system\AdNSJmF.exe	upx
C:\Windows\system\CUeZXyd.exe	upx
C:\Windows\system\OUnMdoC.exe	upx
C:\Windows\system\LvmCgsE.exe	upx
C:\Windows\system\gGRnhhI.exe	upx
C:\Windows\system\ZrxEQOd.exe	upx
C:\Windows\system\WxoiEoV.exe	upx
C:\Windows\system\wwqGfab.exe	upx
C:\Windows\system\GvUwTuB.exe	upx
C:\Windows\system\caKJuop.exe	upx
C:\Windows\system\DNYDjlh.exe	upx
behavioral1/memory/2808-3521-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2664-3524-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2960-3557-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2708-3593-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2752-3631-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2684-3757-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2420-3814-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2624-3815-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2628-3828-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2652-3886-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/1964-3959-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2520-3983-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\XveIvVA.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\YosNWXK.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\Gzodyqq.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\TGWVnTg.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\CHEQBTw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\JVJKgle.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\hYOpFIb.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\slQoSRs.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\YSGpsjp.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\LbYbffd.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\UpqknPC.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\obhSzQw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\mGsoRYC.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\pYYsjSO.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\CSHoaQL.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\nKOoelK.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\BqIKXPC.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\leldEON.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\iVdoCUd.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\XKbUHPw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\LXgXnow.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\RVbZwTn.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\bBbZFMj.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\KXXFtHh.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\vKNyxhl.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\afrgEAR.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\xWCsWfy.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\HNyoksx.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\omeRtcH.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\wYJtwJZ.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\JxUnOSB.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\JYDRMYT.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\nzbQjOW.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\KzXKHiX.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\jHPFHUq.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\cAGmmEB.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\QqAjZNV.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\kHdDcJn.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\rOwDqmu.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\dIkInAb.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\arttBYi.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\EvSYnPw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\GVaQYSA.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\yBbhnJw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\reiqyKS.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\OYlqWsq.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\CMqHvCf.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\RULDTro.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\vnTIXaw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\OXpbQna.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\vlBPkIo.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\TLnPwii.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\cLravZB.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\xhWGIbw.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\TdymcUU.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\SXhdtqQ.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\dpRJXsP.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\biinKmJ.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\KhcmhhK.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\frNTrxj.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\yYetNNB.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\qSoismi.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\vOccxEs.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
File created	C:\Windows\System\MyjAsMB.exe	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

3060 powershell.exe

pid	process
3060	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
Token: SeDebugPrivilege	3060	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe

description	pid	process	target process
PID 2044 wrote to memory of 3060	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	powershell.exe
PID 2044 wrote to memory of 3060	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	powershell.exe
PID 2044 wrote to memory of 3060	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	powershell.exe
PID 2044 wrote to memory of 2684	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DOzXDuA.exe
PID 2044 wrote to memory of 2684	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DOzXDuA.exe
PID 2044 wrote to memory of 2684	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DOzXDuA.exe
PID 2044 wrote to memory of 2708	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	szMiFWQ.exe
PID 2044 wrote to memory of 2708	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	szMiFWQ.exe
PID 2044 wrote to memory of 2708	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	szMiFWQ.exe
PID 2044 wrote to memory of 2808	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DNYDjlh.exe
PID 2044 wrote to memory of 2808	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DNYDjlh.exe
PID 2044 wrote to memory of 2808	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	DNYDjlh.exe
PID 2044 wrote to memory of 2752	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OFxebdS.exe
PID 2044 wrote to memory of 2752	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OFxebdS.exe
PID 2044 wrote to memory of 2752	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OFxebdS.exe
PID 2044 wrote to memory of 2664	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	UOUFfSG.exe
PID 2044 wrote to memory of 2664	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	UOUFfSG.exe
PID 2044 wrote to memory of 2664	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	UOUFfSG.exe
PID 2044 wrote to memory of 2652	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	rrqZRts.exe
PID 2044 wrote to memory of 2652	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	rrqZRts.exe
PID 2044 wrote to memory of 2652	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	rrqZRts.exe
PID 2044 wrote to memory of 2420	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	CCzJFUV.exe
PID 2044 wrote to memory of 2420	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	CCzJFUV.exe
PID 2044 wrote to memory of 2420	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	CCzJFUV.exe
PID 2044 wrote to memory of 2520	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	aPOGhPb.exe
PID 2044 wrote to memory of 2520	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	aPOGhPb.exe
PID 2044 wrote to memory of 2520	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	aPOGhPb.exe
PID 2044 wrote to memory of 2960	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	caKJuop.exe
PID 2044 wrote to memory of 2960	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	caKJuop.exe
PID 2044 wrote to memory of 2960	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	caKJuop.exe
PID 2044 wrote to memory of 1964	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	JvzUBVw.exe
PID 2044 wrote to memory of 1964	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	JvzUBVw.exe
PID 2044 wrote to memory of 1964	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	JvzUBVw.exe
PID 2044 wrote to memory of 2624	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	GvUwTuB.exe
PID 2044 wrote to memory of 2624	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	GvUwTuB.exe
PID 2044 wrote to memory of 2624	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	GvUwTuB.exe
PID 2044 wrote to memory of 2628	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	wwqGfab.exe
PID 2044 wrote to memory of 2628	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	wwqGfab.exe
PID 2044 wrote to memory of 2628	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	wwqGfab.exe
PID 2044 wrote to memory of 2772	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	WxoiEoV.exe
PID 2044 wrote to memory of 2772	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	WxoiEoV.exe
PID 2044 wrote to memory of 2772	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	WxoiEoV.exe
PID 2044 wrote to memory of 2780	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ZrxEQOd.exe
PID 2044 wrote to memory of 2780	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ZrxEQOd.exe
PID 2044 wrote to memory of 2780	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ZrxEQOd.exe
PID 2044 wrote to memory of 2792	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	HOBvkDD.exe
PID 2044 wrote to memory of 2792	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	HOBvkDD.exe
PID 2044 wrote to memory of 2792	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	HOBvkDD.exe
PID 2044 wrote to memory of 804	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	gGRnhhI.exe
PID 2044 wrote to memory of 804	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	gGRnhhI.exe
PID 2044 wrote to memory of 804	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	gGRnhhI.exe
PID 2044 wrote to memory of 332	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	NMVKOus.exe
PID 2044 wrote to memory of 332	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	NMVKOus.exe
PID 2044 wrote to memory of 332	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	NMVKOus.exe
PID 2044 wrote to memory of 2152	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ivCGnZU.exe
PID 2044 wrote to memory of 2152	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ivCGnZU.exe
PID 2044 wrote to memory of 2152	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	ivCGnZU.exe
PID 2044 wrote to memory of 380	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	LvmCgsE.exe
PID 2044 wrote to memory of 380	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	LvmCgsE.exe
PID 2044 wrote to memory of 380	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	LvmCgsE.exe
PID 2044 wrote to memory of 988	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OUnMdoC.exe
PID 2044 wrote to memory of 988	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OUnMdoC.exe
PID 2044 wrote to memory of 988	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	OUnMdoC.exe
PID 2044 wrote to memory of 596	2044	63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe	CUeZXyd.exe

C:\Users\Admin\AppData\Local\Temp\63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ef1f5c38d4119c9befc9a3c737792f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\System\DOzXDuA.exe
  C:\Windows\System\DOzXDuA.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\szMiFWQ.exe
  C:\Windows\System\szMiFWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\DNYDjlh.exe
  C:\Windows\System\DNYDjlh.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\OFxebdS.exe
  C:\Windows\System\OFxebdS.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\UOUFfSG.exe
  C:\Windows\System\UOUFfSG.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\rrqZRts.exe
  C:\Windows\System\rrqZRts.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\CCzJFUV.exe
  C:\Windows\System\CCzJFUV.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\aPOGhPb.exe
  C:\Windows\System\aPOGhPb.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\caKJuop.exe
  C:\Windows\System\caKJuop.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\JvzUBVw.exe
  C:\Windows\System\JvzUBVw.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\GvUwTuB.exe
  C:\Windows\System\GvUwTuB.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wwqGfab.exe
  C:\Windows\System\wwqGfab.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\WxoiEoV.exe
  C:\Windows\System\WxoiEoV.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ZrxEQOd.exe
  C:\Windows\System\ZrxEQOd.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\HOBvkDD.exe
  C:\Windows\System\HOBvkDD.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\gGRnhhI.exe
  C:\Windows\System\gGRnhhI.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\NMVKOus.exe
  C:\Windows\System\NMVKOus.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\ivCGnZU.exe
  C:\Windows\System\ivCGnZU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\LvmCgsE.exe
  C:\Windows\System\LvmCgsE.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\OUnMdoC.exe
  C:\Windows\System\OUnMdoC.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\CUeZXyd.exe
  C:\Windows\System\CUeZXyd.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\AdNSJmF.exe
  C:\Windows\System\AdNSJmF.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jZuDAvQ.exe
  C:\Windows\System\jZuDAvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\RFdhyPz.exe
  C:\Windows\System\RFdhyPz.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\AJvDnkO.exe
  C:\Windows\System\AJvDnkO.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\DvlbBFS.exe
  C:\Windows\System\DvlbBFS.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\LCeMKEg.exe
  C:\Windows\System\LCeMKEg.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\kesAShX.exe
  C:\Windows\System\kesAShX.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\YlCdiRs.exe
  C:\Windows\System\YlCdiRs.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\WeqPSyB.exe
  C:\Windows\System\WeqPSyB.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\ozClxEY.exe
  C:\Windows\System\ozClxEY.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\rIMjwvo.exe
  C:\Windows\System\rIMjwvo.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\iahzxKG.exe
  C:\Windows\System\iahzxKG.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\nQLWXfJ.exe
  C:\Windows\System\nQLWXfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\PWNBWdo.exe
  C:\Windows\System\PWNBWdo.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\aKlszyw.exe
  C:\Windows\System\aKlszyw.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\wThhpOv.exe
  C:\Windows\System\wThhpOv.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\gqWJfKy.exe
  C:\Windows\System\gqWJfKy.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\ZsVjWIn.exe
  C:\Windows\System\ZsVjWIn.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\FnItHqt.exe
  C:\Windows\System\FnItHqt.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\MVXvGuR.exe
  C:\Windows\System\MVXvGuR.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\lCrXpGm.exe
  C:\Windows\System\lCrXpGm.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\NEqOoIE.exe
  C:\Windows\System\NEqOoIE.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\JesguMN.exe
  C:\Windows\System\JesguMN.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\DLcOHON.exe
  C:\Windows\System\DLcOHON.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\avPwoSM.exe
  C:\Windows\System\avPwoSM.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\wBYKpQU.exe
  C:\Windows\System\wBYKpQU.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\XCoKuSE.exe
  C:\Windows\System\XCoKuSE.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\ZSrFtNk.exe
  C:\Windows\System\ZSrFtNk.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\InOWNEH.exe
  C:\Windows\System\InOWNEH.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\wxlCTfu.exe
  C:\Windows\System\wxlCTfu.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\EvssyiO.exe
  C:\Windows\System\EvssyiO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\hSszgdY.exe
  C:\Windows\System\hSszgdY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GHSevuL.exe
  C:\Windows\System\GHSevuL.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\TrYDCif.exe
  C:\Windows\System\TrYDCif.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\sUFJorz.exe
  C:\Windows\System\sUFJorz.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\reiqyKS.exe
  C:\Windows\System\reiqyKS.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\SdVXSzF.exe
  C:\Windows\System\SdVXSzF.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\UTIDZUx.exe
  C:\Windows\System\UTIDZUx.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ctliPft.exe
  C:\Windows\System\ctliPft.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\FOUyRtf.exe
  C:\Windows\System\FOUyRtf.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\seOWGBl.exe
  C:\Windows\System\seOWGBl.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\hHIkyhb.exe
  C:\Windows\System\hHIkyhb.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\xKckNXW.exe
  C:\Windows\System\xKckNXW.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\JmkrZGF.exe
  C:\Windows\System\JmkrZGF.exe
  2⤵
  PID:1412
- C:\Windows\System\uUJDltr.exe
  C:\Windows\System\uUJDltr.exe
  2⤵
  PID:1480
- C:\Windows\System\QPuZRGs.exe
  C:\Windows\System\QPuZRGs.exe
  2⤵
  PID:2900
- C:\Windows\System\luCsMUx.exe
  C:\Windows\System\luCsMUx.exe
  2⤵
  PID:2448
- C:\Windows\System\TURKzaO.exe
  C:\Windows\System\TURKzaO.exe
  2⤵
  PID:1112
- C:\Windows\System\QOTCTTL.exe
  C:\Windows\System\QOTCTTL.exe
  2⤵
  PID:2756
- C:\Windows\System\tVuswkn.exe
  C:\Windows\System\tVuswkn.exe
  2⤵
  PID:1960
- C:\Windows\System\HdYUaff.exe
  C:\Windows\System\HdYUaff.exe
  2⤵
  PID:996
- C:\Windows\System\LxqwNZa.exe
  C:\Windows\System\LxqwNZa.exe
  2⤵
  PID:2904
- C:\Windows\System\DBUhBok.exe
  C:\Windows\System\DBUhBok.exe
  2⤵
  PID:2088
- C:\Windows\System\AQbcANd.exe
  C:\Windows\System\AQbcANd.exe
  2⤵
  PID:2496
- C:\Windows\System\QOGSpMO.exe
  C:\Windows\System\QOGSpMO.exe
  2⤵
  PID:2764
- C:\Windows\System\slQoSRs.exe
  C:\Windows\System\slQoSRs.exe
  2⤵
  PID:2236
- C:\Windows\System\PkQTNbz.exe
  C:\Windows\System\PkQTNbz.exe
  2⤵
  PID:356
- C:\Windows\System\BidMqrL.exe
  C:\Windows\System\BidMqrL.exe
  2⤵
  PID:992
- C:\Windows\System\soVEckT.exe
  C:\Windows\System\soVEckT.exe
  2⤵
  PID:1800
- C:\Windows\System\blcHPuW.exe
  C:\Windows\System\blcHPuW.exe
  2⤵
  PID:280
- C:\Windows\System\xNINwtO.exe
  C:\Windows\System\xNINwtO.exe
  2⤵
  PID:628
- C:\Windows\System\dxTptlV.exe
  C:\Windows\System\dxTptlV.exe
  2⤵
  PID:1244
- C:\Windows\System\PcYWPeI.exe
  C:\Windows\System\PcYWPeI.exe
  2⤵
  PID:1920
- C:\Windows\System\qyngeLG.exe
  C:\Windows\System\qyngeLG.exe
  2⤵
  PID:1580
- C:\Windows\System\JxNBcFI.exe
  C:\Windows\System\JxNBcFI.exe
  2⤵
  PID:2824
- C:\Windows\System\DKtJCSY.exe
  C:\Windows\System\DKtJCSY.exe
  2⤵
  PID:1484
- C:\Windows\System\lEQWRMq.exe
  C:\Windows\System\lEQWRMq.exe
  2⤵
  PID:1096
- C:\Windows\System\pBKlxbw.exe
  C:\Windows\System\pBKlxbw.exe
  2⤵
  PID:1708
- C:\Windows\System\dLcASOK.exe
  C:\Windows\System\dLcASOK.exe
  2⤵
  PID:1012
- C:\Windows\System\sJOXhdU.exe
  C:\Windows\System\sJOXhdU.exe
  2⤵
  PID:2284
- C:\Windows\System\xJrymBr.exe
  C:\Windows\System\xJrymBr.exe
  2⤵
  PID:2976
- C:\Windows\System\gWzOZTy.exe
  C:\Windows\System\gWzOZTy.exe
  2⤵
  PID:2220
- C:\Windows\System\QJldfKI.exe
  C:\Windows\System\QJldfKI.exe
  2⤵
  PID:2768
- C:\Windows\System\WTYLtpx.exe
  C:\Windows\System\WTYLtpx.exe
  2⤵
  PID:984
- C:\Windows\System\YSHiATl.exe
  C:\Windows\System\YSHiATl.exe
  2⤵
  PID:1200
- C:\Windows\System\SxQUWyr.exe
  C:\Windows\System\SxQUWyr.exe
  2⤵
  PID:2040
- C:\Windows\System\LhPuGHA.exe
  C:\Windows\System\LhPuGHA.exe
  2⤵
  PID:1636
- C:\Windows\System\TcTmvoP.exe
  C:\Windows\System\TcTmvoP.exe
  2⤵
  PID:2216
- C:\Windows\System\iuMYiGS.exe
  C:\Windows\System\iuMYiGS.exe
  2⤵
  PID:1224
- C:\Windows\System\rMAUumd.exe
  C:\Windows\System\rMAUumd.exe
  2⤵
  PID:2580
- C:\Windows\System\HJiYnIY.exe
  C:\Windows\System\HJiYnIY.exe
  2⤵
  PID:1732
- C:\Windows\System\XAYmOki.exe
  C:\Windows\System\XAYmOki.exe
  2⤵
  PID:2668
- C:\Windows\System\dxOecDF.exe
  C:\Windows\System\dxOecDF.exe
  2⤵
  PID:2304
- C:\Windows\System\DGLCuGc.exe
  C:\Windows\System\DGLCuGc.exe
  2⤵
  PID:3020
- C:\Windows\System\MiNtSsg.exe
  C:\Windows\System\MiNtSsg.exe
  2⤵
  PID:1740
- C:\Windows\System\TvlyLSD.exe
  C:\Windows\System\TvlyLSD.exe
  2⤵
  PID:2736
- C:\Windows\System\JUoXQch.exe
  C:\Windows\System\JUoXQch.exe
  2⤵
  PID:2288
- C:\Windows\System\fjPftYp.exe
  C:\Windows\System\fjPftYp.exe
  2⤵
  PID:1900
- C:\Windows\System\bOfYNaj.exe
  C:\Windows\System\bOfYNaj.exe
  2⤵
  PID:2884
- C:\Windows\System\oUStWED.exe
  C:\Windows\System\oUStWED.exe
  2⤵
  PID:1912
- C:\Windows\System\bjqMPEl.exe
  C:\Windows\System\bjqMPEl.exe
  2⤵
  PID:112
- C:\Windows\System\dtwYIep.exe
  C:\Windows\System\dtwYIep.exe
  2⤵
  PID:1744
- C:\Windows\System\eBjkcOJ.exe
  C:\Windows\System\eBjkcOJ.exe
  2⤵
  PID:2632
- C:\Windows\System\pmybDyv.exe
  C:\Windows\System\pmybDyv.exe
  2⤵
  PID:2472
- C:\Windows\System\CSHoaQL.exe
  C:\Windows\System\CSHoaQL.exe
  2⤵
  PID:1956
- C:\Windows\System\ljCPJmv.exe
  C:\Windows\System\ljCPJmv.exe
  2⤵
  PID:2948
- C:\Windows\System\ICDDNRa.exe
  C:\Windows\System\ICDDNRa.exe
  2⤵
  PID:2816
- C:\Windows\System\apLJZIs.exe
  C:\Windows\System\apLJZIs.exe
  2⤵
  PID:2148
- C:\Windows\System\mTXYyGj.exe
  C:\Windows\System\mTXYyGj.exe
  2⤵
  PID:928
- C:\Windows\System\wsxUZDx.exe
  C:\Windows\System\wsxUZDx.exe
  2⤵
  PID:576
- C:\Windows\System\wwBlNkz.exe
  C:\Windows\System\wwBlNkz.exe
  2⤵
  PID:2928
- C:\Windows\System\uAlTCdX.exe
  C:\Windows\System\uAlTCdX.exe
  2⤵
  PID:1148
- C:\Windows\System\RFjgYlu.exe
  C:\Windows\System\RFjgYlu.exe
  2⤵
  PID:3080
- C:\Windows\System\bgktrsR.exe
  C:\Windows\System\bgktrsR.exe
  2⤵
  PID:3096
- C:\Windows\System\SPkELfp.exe
  C:\Windows\System\SPkELfp.exe
  2⤵
  PID:3112
- C:\Windows\System\dTpgNCm.exe
  C:\Windows\System\dTpgNCm.exe
  2⤵
  PID:3128
- C:\Windows\System\jipMFWF.exe
  C:\Windows\System\jipMFWF.exe
  2⤵
  PID:3144
- C:\Windows\System\uspucKg.exe
  C:\Windows\System\uspucKg.exe
  2⤵
  PID:3160
- C:\Windows\System\ZJpGzXO.exe
  C:\Windows\System\ZJpGzXO.exe
  2⤵
  PID:3356
- C:\Windows\System\zRztRjs.exe
  C:\Windows\System\zRztRjs.exe
  2⤵
  PID:3372
- C:\Windows\System\fdrKufC.exe
  C:\Windows\System\fdrKufC.exe
  2⤵
  PID:3388
- C:\Windows\System\fHROFtl.exe
  C:\Windows\System\fHROFtl.exe
  2⤵
  PID:3404
- C:\Windows\System\YUpGNpE.exe
  C:\Windows\System\YUpGNpE.exe
  2⤵
  PID:3440
- C:\Windows\System\GiGDdKj.exe
  C:\Windows\System\GiGDdKj.exe
  2⤵
  PID:3456
- C:\Windows\System\KTFzjdn.exe
  C:\Windows\System\KTFzjdn.exe
  2⤵
  PID:3496
- C:\Windows\System\KXqLhvm.exe
  C:\Windows\System\KXqLhvm.exe
  2⤵
  PID:3516
- C:\Windows\System\XAsUMNA.exe
  C:\Windows\System\XAsUMNA.exe
  2⤵
  PID:3540
- C:\Windows\System\bFLxdPN.exe
  C:\Windows\System\bFLxdPN.exe
  2⤵
  PID:3560
- C:\Windows\System\wmhhruf.exe
  C:\Windows\System\wmhhruf.exe
  2⤵
  PID:3584
- C:\Windows\System\wOycjgz.exe
  C:\Windows\System\wOycjgz.exe
  2⤵
  PID:3604
- C:\Windows\System\DkzyYqX.exe
  C:\Windows\System\DkzyYqX.exe
  2⤵
  PID:3620
- C:\Windows\System\jMGZdbJ.exe
  C:\Windows\System\jMGZdbJ.exe
  2⤵
  PID:3640
- C:\Windows\System\YfrvXuO.exe
  C:\Windows\System\YfrvXuO.exe
  2⤵
  PID:3660
- C:\Windows\System\wUkoAEh.exe
  C:\Windows\System\wUkoAEh.exe
  2⤵
  PID:3684
- C:\Windows\System\yEkvnVU.exe
  C:\Windows\System\yEkvnVU.exe
  2⤵
  PID:3704
- C:\Windows\System\UOuVAFh.exe
  C:\Windows\System\UOuVAFh.exe
  2⤵
  PID:3720
- C:\Windows\System\TeBAJxL.exe
  C:\Windows\System\TeBAJxL.exe
  2⤵
  PID:3740
- C:\Windows\System\zxWVBWM.exe
  C:\Windows\System\zxWVBWM.exe
  2⤵
  PID:3764
- C:\Windows\System\IEBXFod.exe
  C:\Windows\System\IEBXFod.exe
  2⤵
  PID:3784
- C:\Windows\System\JxUnOSB.exe
  C:\Windows\System\JxUnOSB.exe
  2⤵
  PID:3800
- C:\Windows\System\RLxfrdV.exe
  C:\Windows\System\RLxfrdV.exe
  2⤵
  PID:3824
- C:\Windows\System\kNdKoHh.exe
  C:\Windows\System\kNdKoHh.exe
  2⤵
  PID:3840
- C:\Windows\System\AAFObim.exe
  C:\Windows\System\AAFObim.exe
  2⤵
  PID:3856
- C:\Windows\System\mYUMfdZ.exe
  C:\Windows\System\mYUMfdZ.exe
  2⤵
  PID:3872
- C:\Windows\System\NzFYYqu.exe
  C:\Windows\System\NzFYYqu.exe
  2⤵
  PID:3888
- C:\Windows\System\uoaoPks.exe
  C:\Windows\System\uoaoPks.exe
  2⤵
  PID:3908
- C:\Windows\System\hPvnwTB.exe
  C:\Windows\System\hPvnwTB.exe
  2⤵
  PID:3924
- C:\Windows\System\fvDeHvo.exe
  C:\Windows\System\fvDeHvo.exe
  2⤵
  PID:3940
- C:\Windows\System\OCBmypK.exe
  C:\Windows\System\OCBmypK.exe
  2⤵
  PID:3956
- C:\Windows\System\hPotIjp.exe
  C:\Windows\System\hPotIjp.exe
  2⤵
  PID:3972
- C:\Windows\System\MmWMYCj.exe
  C:\Windows\System\MmWMYCj.exe
  2⤵
  PID:3988
- C:\Windows\System\cLPtrKW.exe
  C:\Windows\System\cLPtrKW.exe
  2⤵
  PID:4004
- C:\Windows\System\iNcIXpW.exe
  C:\Windows\System\iNcIXpW.exe
  2⤵
  PID:4020
- C:\Windows\System\XdxUWAq.exe
  C:\Windows\System\XdxUWAq.exe
  2⤵
  PID:4036
- C:\Windows\System\IutCYqb.exe
  C:\Windows\System\IutCYqb.exe
  2⤵
  PID:4052
- C:\Windows\System\gHgoPzL.exe
  C:\Windows\System\gHgoPzL.exe
  2⤵
  PID:4068
- C:\Windows\System\OXWsNzV.exe
  C:\Windows\System\OXWsNzV.exe
  2⤵
  PID:4084
- C:\Windows\System\WYnNPGY.exe
  C:\Windows\System\WYnNPGY.exe
  2⤵
  PID:2228
- C:\Windows\System\QfOleYK.exe
  C:\Windows\System\QfOleYK.exe
  2⤵
  PID:2028
- C:\Windows\System\rfLFZDh.exe
  C:\Windows\System\rfLFZDh.exe
  2⤵
  PID:856
- C:\Windows\System\YuDWnwf.exe
  C:\Windows\System\YuDWnwf.exe
  2⤵
  PID:1668
- C:\Windows\System\ZExaxsU.exe
  C:\Windows\System\ZExaxsU.exe
  2⤵
  PID:1684
- C:\Windows\System\nLunIXX.exe
  C:\Windows\System\nLunIXX.exe
  2⤵
  PID:2680
- C:\Windows\System\GetrINY.exe
  C:\Windows\System\GetrINY.exe
  2⤵
  PID:3008
- C:\Windows\System\EJlUAlO.exe
  C:\Windows\System\EJlUAlO.exe
  2⤵
  PID:1880
- C:\Windows\System\zkSDEcr.exe
  C:\Windows\System\zkSDEcr.exe
  2⤵
  PID:2724
- C:\Windows\System\CgOIjiL.exe
  C:\Windows\System\CgOIjiL.exe
  2⤵
  PID:2352
- C:\Windows\System\ugUeavb.exe
  C:\Windows\System\ugUeavb.exe
  2⤵
  PID:952
- C:\Windows\System\cbyfTXZ.exe
  C:\Windows\System\cbyfTXZ.exe
  2⤵
  PID:3092
- C:\Windows\System\XgHhVVb.exe
  C:\Windows\System\XgHhVVb.exe
  2⤵
  PID:3124
- C:\Windows\System\lEtbsRS.exe
  C:\Windows\System\lEtbsRS.exe
  2⤵
  PID:1496
- C:\Windows\System\UVqOluH.exe
  C:\Windows\System\UVqOluH.exe
  2⤵
  PID:2276
- C:\Windows\System\WbntXcC.exe
  C:\Windows\System\WbntXcC.exe
  2⤵
  PID:2908
- C:\Windows\System\rQkBJKf.exe
  C:\Windows\System\rQkBJKf.exe
  2⤵
  PID:1892
- C:\Windows\System\wPzYHLi.exe
  C:\Windows\System\wPzYHLi.exe
  2⤵
  PID:1416
- C:\Windows\System\JKwgmEh.exe
  C:\Windows\System\JKwgmEh.exe
  2⤵
  PID:2376
- C:\Windows\System\cgGCSQi.exe
  C:\Windows\System\cgGCSQi.exe
  2⤵
  PID:2500
- C:\Windows\System\gypypag.exe
  C:\Windows\System\gypypag.exe
  2⤵
  PID:3076
- C:\Windows\System\LOjCqyg.exe
  C:\Windows\System\LOjCqyg.exe
  2⤵
  PID:3140
- C:\Windows\System\XSSkdYE.exe
  C:\Windows\System\XSSkdYE.exe
  2⤵
  PID:3188
- C:\Windows\System\dIcxlwI.exe
  C:\Windows\System\dIcxlwI.exe
  2⤵
  PID:3204
- C:\Windows\System\jlDoZPx.exe
  C:\Windows\System\jlDoZPx.exe
  2⤵
  PID:3220
- C:\Windows\System\lrqjtzR.exe
  C:\Windows\System\lrqjtzR.exe
  2⤵
  PID:3236
- C:\Windows\System\igKHpur.exe
  C:\Windows\System\igKHpur.exe
  2⤵
  PID:3252
- C:\Windows\System\IIRPhAR.exe
  C:\Windows\System\IIRPhAR.exe
  2⤵
  PID:3268
- C:\Windows\System\oTTHzDU.exe
  C:\Windows\System\oTTHzDU.exe
  2⤵
  PID:3284
- C:\Windows\System\XsnyFUb.exe
  C:\Windows\System\XsnyFUb.exe
  2⤵
  PID:3300
- C:\Windows\System\LTGFGQi.exe
  C:\Windows\System\LTGFGQi.exe
  2⤵
  PID:3316
- C:\Windows\System\JSwoMDM.exe
  C:\Windows\System\JSwoMDM.exe
  2⤵
  PID:3332
- C:\Windows\System\FTStjJH.exe
  C:\Windows\System\FTStjJH.exe
  2⤵
  PID:2260
- C:\Windows\System\ATlZGlQ.exe
  C:\Windows\System\ATlZGlQ.exe
  2⤵
  PID:1372
- C:\Windows\System\HfBoAvO.exe
  C:\Windows\System\HfBoAvO.exe
  2⤵
  PID:1648
- C:\Windows\System\GotjSVx.exe
  C:\Windows\System\GotjSVx.exe
  2⤵
  PID:3380
- C:\Windows\System\gnXNzGm.exe
  C:\Windows\System\gnXNzGm.exe
  2⤵
  PID:3416
- C:\Windows\System\rbLFbhF.exe
  C:\Windows\System\rbLFbhF.exe
  2⤵
  PID:3432
- C:\Windows\System\zxThpNR.exe
  C:\Windows\System\zxThpNR.exe
  2⤵
  PID:3464
- C:\Windows\System\GTjAZaB.exe
  C:\Windows\System\GTjAZaB.exe
  2⤵
  PID:3484
- C:\Windows\System\YazYDmf.exe
  C:\Windows\System\YazYDmf.exe
  2⤵
  PID:3448
- C:\Windows\System\hzmSOau.exe
  C:\Windows\System\hzmSOau.exe
  2⤵
  PID:3508
- C:\Windows\System\klIDvoq.exe
  C:\Windows\System\klIDvoq.exe
  2⤵
  PID:2380
- C:\Windows\System\xvChQEp.exe
  C:\Windows\System\xvChQEp.exe
  2⤵
  PID:3528
- C:\Windows\System\JZMnCpZ.exe
  C:\Windows\System\JZMnCpZ.exe
  2⤵
  PID:3556
- C:\Windows\System\TFpJDAo.exe
  C:\Windows\System\TFpJDAo.exe
  2⤵
  PID:3572
- C:\Windows\System\rnLATOZ.exe
  C:\Windows\System\rnLATOZ.exe
  2⤵
  PID:3612
- C:\Windows\System\LTFDvzN.exe
  C:\Windows\System\LTFDvzN.exe
  2⤵
  PID:3648
- C:\Windows\System\vOccxEs.exe
  C:\Windows\System\vOccxEs.exe
  2⤵
  PID:3668
- C:\Windows\System\EdAyOkC.exe
  C:\Windows\System\EdAyOkC.exe
  2⤵
  PID:3692
- C:\Windows\System\SJsjVgp.exe
  C:\Windows\System\SJsjVgp.exe
  2⤵
  PID:3716
- C:\Windows\System\UzspbrG.exe
  C:\Windows\System\UzspbrG.exe
  2⤵
  PID:3756
- C:\Windows\System\lzXsUTH.exe
  C:\Windows\System\lzXsUTH.exe
  2⤵
  PID:3816
- C:\Windows\System\OjatbNh.exe
  C:\Windows\System\OjatbNh.exe
  2⤵
  PID:3848
- C:\Windows\System\zFmUdic.exe
  C:\Windows\System\zFmUdic.exe
  2⤵
  PID:3868
- C:\Windows\System\ROdIQeL.exe
  C:\Windows\System\ROdIQeL.exe
  2⤵
  PID:3916
- C:\Windows\System\nrvZTgZ.exe
  C:\Windows\System\nrvZTgZ.exe
  2⤵
  PID:3936
- C:\Windows\System\ahabGMe.exe
  C:\Windows\System\ahabGMe.exe
  2⤵
  PID:3964
- C:\Windows\System\KahtXOS.exe
  C:\Windows\System\KahtXOS.exe
  2⤵
  PID:2932
- C:\Windows\System\oKnjYWg.exe
  C:\Windows\System\oKnjYWg.exe
  2⤵
  PID:2172
- C:\Windows\System\xzXyqpE.exe
  C:\Windows\System\xzXyqpE.exe
  2⤵
  PID:2160
- C:\Windows\System\FydciSN.exe
  C:\Windows\System\FydciSN.exe
  2⤵
  PID:880
- C:\Windows\System\cdIKJAr.exe
  C:\Windows\System\cdIKJAr.exe
  2⤵
  PID:2556
- C:\Windows\System\YXHYQlm.exe
  C:\Windows\System\YXHYQlm.exe
  2⤵
  PID:2672
- C:\Windows\System\TSPvlOO.exe
  C:\Windows\System\TSPvlOO.exe
  2⤵
  PID:3108
- C:\Windows\System\lQJyCrN.exe
  C:\Windows\System\lQJyCrN.exe
  2⤵
  PID:3228
- C:\Windows\System\YvSsSaX.exe
  C:\Windows\System\YvSsSaX.exe
  2⤵
  PID:3292
- C:\Windows\System\WqXhDlb.exe
  C:\Windows\System\WqXhDlb.exe
  2⤵
  PID:2984
- C:\Windows\System\wOEiZUP.exe
  C:\Windows\System\wOEiZUP.exe
  2⤵
  PID:3428
- C:\Windows\System\izqpIRq.exe
  C:\Windows\System\izqpIRq.exe
  2⤵
  PID:3504
- C:\Windows\System\IPINjzU.exe
  C:\Windows\System\IPINjzU.exe
  2⤵
  PID:3580
- C:\Windows\System\LDeFLwz.exe
  C:\Windows\System\LDeFLwz.exe
  2⤵
  PID:3676
- C:\Windows\System\BxzlFXc.exe
  C:\Windows\System\BxzlFXc.exe
  2⤵
  PID:3812
- C:\Windows\System\LQwaCJh.exe
  C:\Windows\System\LQwaCJh.exe
  2⤵
  PID:3900
- C:\Windows\System\tbRnNzQ.exe
  C:\Windows\System\tbRnNzQ.exe
  2⤵
  PID:3276
- C:\Windows\System\wvWzJnS.exe
  C:\Windows\System\wvWzJnS.exe
  2⤵
  PID:3344
- C:\Windows\System\uGdwsGj.exe
  C:\Windows\System\uGdwsGj.exe
  2⤵
  PID:3652
- C:\Windows\System\mADSdRM.exe
  C:\Windows\System\mADSdRM.exe
  2⤵
  PID:3808
- C:\Windows\System\NkJcTMc.exe
  C:\Windows\System\NkJcTMc.exe
  2⤵
  PID:2212
- C:\Windows\System\WLezIIt.exe
  C:\Windows\System\WLezIIt.exe
  2⤵
  PID:3180
- C:\Windows\System\lnbOqBT.exe
  C:\Windows\System\lnbOqBT.exe
  2⤵
  PID:1276
- C:\Windows\System\kvsYUtQ.exe
  C:\Windows\System\kvsYUtQ.exe
  2⤵
  PID:3712
- C:\Windows\System\xwpbQao.exe
  C:\Windows\System\xwpbQao.exe
  2⤵
  PID:4060
- C:\Windows\System\zecPunH.exe
  C:\Windows\System\zecPunH.exe
  2⤵
  PID:3028
- C:\Windows\System\lFJVxbK.exe
  C:\Windows\System\lFJVxbK.exe
  2⤵
  PID:1572
- C:\Windows\System\PTxLhCo.exe
  C:\Windows\System\PTxLhCo.exe
  2⤵
  PID:1456
- C:\Windows\System\tLjcjjA.exe
  C:\Windows\System\tLjcjjA.exe
  2⤵
  PID:2588
- C:\Windows\System\tuBMpQb.exe
  C:\Windows\System\tuBMpQb.exe
  2⤵
  PID:3156
- C:\Windows\System\qtkTaBx.exe
  C:\Windows\System\qtkTaBx.exe
  2⤵
  PID:1436
- C:\Windows\System\JSiZSig.exe
  C:\Windows\System\JSiZSig.exe
  2⤵
  PID:2452
- C:\Windows\System\zMHywHL.exe
  C:\Windows\System\zMHywHL.exe
  2⤵
  PID:2936
- C:\Windows\System\Yoecxoj.exe
  C:\Windows\System\Yoecxoj.exe
  2⤵
  PID:3196
- C:\Windows\System\GnfNTvY.exe
  C:\Windows\System\GnfNTvY.exe
  2⤵
  PID:3480
- C:\Windows\System\tAJSNjQ.exe
  C:\Windows\System\tAJSNjQ.exe
  2⤵
  PID:2368
- C:\Windows\System\XJnXtXq.exe
  C:\Windows\System\XJnXtXq.exe
  2⤵
  PID:3280
- C:\Windows\System\CBNvjGY.exe
  C:\Windows\System\CBNvjGY.exe
  2⤵
  PID:3748
- C:\Windows\System\qeSzphK.exe
  C:\Windows\System\qeSzphK.exe
  2⤵
  PID:2072
- C:\Windows\System\ZTljzrU.exe
  C:\Windows\System\ZTljzrU.exe
  2⤵
  PID:3172
- C:\Windows\System\paOdLJS.exe
  C:\Windows\System\paOdLJS.exe
  2⤵
  PID:2560
- C:\Windows\System\rKhefRK.exe
  C:\Windows\System\rKhefRK.exe
  2⤵
  PID:3524
- C:\Windows\System\ldlAjSK.exe
  C:\Windows\System\ldlAjSK.exe
  2⤵
  PID:3400
- C:\Windows\System\twPjkxp.exe
  C:\Windows\System\twPjkxp.exe
  2⤵
  PID:3796
- C:\Windows\System\bZwcbzI.exe
  C:\Windows\System\bZwcbzI.exe
  2⤵
  PID:3176
- C:\Windows\System\lcCeOwY.exe
  C:\Windows\System\lcCeOwY.exe
  2⤵
  PID:3636
- C:\Windows\System\XuidvlL.exe
  C:\Windows\System\XuidvlL.exe
  2⤵
  PID:2316
- C:\Windows\System\MuGSjvM.exe
  C:\Windows\System\MuGSjvM.exe
  2⤵
  PID:3352
- C:\Windows\System\Vsfjgtr.exe
  C:\Windows\System\Vsfjgtr.exe
  2⤵
  PID:3984
- C:\Windows\System\EeUORAZ.exe
  C:\Windows\System\EeUORAZ.exe
  2⤵
  PID:2456
- C:\Windows\System\xhXffCL.exe
  C:\Windows\System\xhXffCL.exe
  2⤵
  PID:2700
- C:\Windows\System\ZxhPmZy.exe
  C:\Windows\System\ZxhPmZy.exe
  2⤵
  PID:2608
- C:\Windows\System\zHihRzj.exe
  C:\Windows\System\zHihRzj.exe
  2⤵
  PID:3056
- C:\Windows\System\WoaosNI.exe
  C:\Windows\System\WoaosNI.exe
  2⤵
  PID:1860
- C:\Windows\System\tjHNrlZ.exe
  C:\Windows\System\tjHNrlZ.exe
  2⤵
  PID:2464
- C:\Windows\System\JTJHRNb.exe
  C:\Windows\System\JTJHRNb.exe
  2⤵
  PID:2164
- C:\Windows\System\aJuvVdm.exe
  C:\Windows\System\aJuvVdm.exe
  2⤵
  PID:3836
- C:\Windows\System\qirLnss.exe
  C:\Windows\System\qirLnss.exe
  2⤵
  PID:3696
- C:\Windows\System\AySNstN.exe
  C:\Windows\System\AySNstN.exe
  2⤵
  PID:3548
- C:\Windows\System\JKNCTTq.exe
  C:\Windows\System\JKNCTTq.exe
  2⤵
  PID:2124
- C:\Windows\System\SdNFNtP.exe
  C:\Windows\System\SdNFNtP.exe
  2⤵
  PID:2600
- C:\Windows\System\RCHowJo.exe
  C:\Windows\System\RCHowJo.exe
  2⤵
  PID:1972
- C:\Windows\System\wKedPWw.exe
  C:\Windows\System\wKedPWw.exe
  2⤵
  PID:2912
- C:\Windows\System\WfxwWYF.exe
  C:\Windows\System\WfxwWYF.exe
  2⤵
  PID:2476
- C:\Windows\System\eqRrJhy.exe
  C:\Windows\System\eqRrJhy.exe
  2⤵
  PID:1228
- C:\Windows\System\CeeCDLh.exe
  C:\Windows\System\CeeCDLh.exe
  2⤵
  PID:2536
- C:\Windows\System\kiUdsFu.exe
  C:\Windows\System\kiUdsFu.exe
  2⤵
  PID:2988
- C:\Windows\System\YBNBBNp.exe
  C:\Windows\System\YBNBBNp.exe
  2⤵
  PID:2804
- C:\Windows\System\kpZUoVE.exe
  C:\Windows\System\kpZUoVE.exe
  2⤵
  PID:3904
- C:\Windows\System\fWHqnyy.exe
  C:\Windows\System\fWHqnyy.exe
  2⤵
  PID:4080
- C:\Windows\System\UOXpsYf.exe
  C:\Windows\System\UOXpsYf.exe
  2⤵
  PID:4116
- C:\Windows\System\UPKBYpb.exe
  C:\Windows\System\UPKBYpb.exe
  2⤵
  PID:4136
- C:\Windows\System\CEMyWgW.exe
  C:\Windows\System\CEMyWgW.exe
  2⤵
  PID:4152
- C:\Windows\System\zMXzETd.exe
  C:\Windows\System\zMXzETd.exe
  2⤵
  PID:4168
- C:\Windows\System\UIiEQhf.exe
  C:\Windows\System\UIiEQhf.exe
  2⤵
  PID:4184
- C:\Windows\System\sWiXdTv.exe
  C:\Windows\System\sWiXdTv.exe
  2⤵
  PID:4204
- C:\Windows\System\SifGPRx.exe
  C:\Windows\System\SifGPRx.exe
  2⤵
  PID:4220
- C:\Windows\System\GdSwOqY.exe
  C:\Windows\System\GdSwOqY.exe
  2⤵
  PID:4236
- C:\Windows\System\mdVbAWz.exe
  C:\Windows\System\mdVbAWz.exe
  2⤵
  PID:4252
- C:\Windows\System\IsPmrXr.exe
  C:\Windows\System\IsPmrXr.exe
  2⤵
  PID:4268
- C:\Windows\System\VuMaSdx.exe
  C:\Windows\System\VuMaSdx.exe
  2⤵
  PID:4284
- C:\Windows\System\IqpVkbR.exe
  C:\Windows\System\IqpVkbR.exe
  2⤵
  PID:4304
- C:\Windows\System\utSNiyu.exe
  C:\Windows\System\utSNiyu.exe
  2⤵
  PID:4320
- C:\Windows\System\hLRqaul.exe
  C:\Windows\System\hLRqaul.exe
  2⤵
  PID:4336
- C:\Windows\System\yylcxrj.exe
  C:\Windows\System\yylcxrj.exe
  2⤵
  PID:4356
- C:\Windows\System\LcmjfeB.exe
  C:\Windows\System\LcmjfeB.exe
  2⤵
  PID:4372
- C:\Windows\System\vlObcIZ.exe
  C:\Windows\System\vlObcIZ.exe
  2⤵
  PID:4388
- C:\Windows\System\SPmnRpK.exe
  C:\Windows\System\SPmnRpK.exe
  2⤵
  PID:4404
- C:\Windows\System\mEgkibL.exe
  C:\Windows\System\mEgkibL.exe
  2⤵
  PID:4420
- C:\Windows\System\pWHoivO.exe
  C:\Windows\System\pWHoivO.exe
  2⤵
  PID:4436
- C:\Windows\System\XhnBBOV.exe
  C:\Windows\System\XhnBBOV.exe
  2⤵
  PID:4452
- C:\Windows\System\CPsUVyn.exe
  C:\Windows\System\CPsUVyn.exe
  2⤵
  PID:4468
- C:\Windows\System\KnAXRvK.exe
  C:\Windows\System\KnAXRvK.exe
  2⤵
  PID:4484
- C:\Windows\System\KxoEnfy.exe
  C:\Windows\System\KxoEnfy.exe
  2⤵
  PID:4504
- C:\Windows\System\BHKVlHy.exe
  C:\Windows\System\BHKVlHy.exe
  2⤵
  PID:4524
- C:\Windows\System\oJUFizg.exe
  C:\Windows\System\oJUFizg.exe
  2⤵
  PID:4540
- C:\Windows\System\RFCreHz.exe
  C:\Windows\System\RFCreHz.exe
  2⤵
  PID:4556
- C:\Windows\System\vbIVjqW.exe
  C:\Windows\System\vbIVjqW.exe
  2⤵
  PID:4572
- C:\Windows\System\JoNdjaM.exe
  C:\Windows\System\JoNdjaM.exe
  2⤵
  PID:4592
- C:\Windows\System\itjlfYP.exe
  C:\Windows\System\itjlfYP.exe
  2⤵
  PID:4608
- C:\Windows\System\qTLdsed.exe
  C:\Windows\System\qTLdsed.exe
  2⤵
  PID:4624
- C:\Windows\System\QqAjZNV.exe
  C:\Windows\System\QqAjZNV.exe
  2⤵
  PID:4640
- C:\Windows\System\yDiJRII.exe
  C:\Windows\System\yDiJRII.exe
  2⤵
  PID:4656
- C:\Windows\System\EcPKLQZ.exe
  C:\Windows\System\EcPKLQZ.exe
  2⤵
  PID:4676
- C:\Windows\System\LhdfNLf.exe
  C:\Windows\System\LhdfNLf.exe
  2⤵
  PID:4692
- C:\Windows\System\IBUoJRp.exe
  C:\Windows\System\IBUoJRp.exe
  2⤵
  PID:4708
- C:\Windows\System\EgKttNd.exe
  C:\Windows\System\EgKttNd.exe
  2⤵
  PID:4724
- C:\Windows\System\PInhRef.exe
  C:\Windows\System\PInhRef.exe
  2⤵
  PID:4740
- C:\Windows\System\xYhUCBo.exe
  C:\Windows\System\xYhUCBo.exe
  2⤵
  PID:4760
- C:\Windows\System\egimqiX.exe
  C:\Windows\System\egimqiX.exe
  2⤵
  PID:4780
- C:\Windows\System\CNmAQhF.exe
  C:\Windows\System\CNmAQhF.exe
  2⤵
  PID:4796
- C:\Windows\System\wPtgoGK.exe
  C:\Windows\System\wPtgoGK.exe
  2⤵
  PID:4812
- C:\Windows\System\PHBwhBf.exe
  C:\Windows\System\PHBwhBf.exe
  2⤵
  PID:4828
- C:\Windows\System\toKjjsT.exe
  C:\Windows\System\toKjjsT.exe
  2⤵
  PID:4848
- C:\Windows\System\tCNJSFl.exe
  C:\Windows\System\tCNJSFl.exe
  2⤵
  PID:4864
- C:\Windows\System\SnlIWWR.exe
  C:\Windows\System\SnlIWWR.exe
  2⤵
  PID:4880
- C:\Windows\System\bGFlgdz.exe
  C:\Windows\System\bGFlgdz.exe
  2⤵
  PID:4896
- C:\Windows\System\atabvlo.exe
  C:\Windows\System\atabvlo.exe
  2⤵
  PID:4912
- C:\Windows\System\WGOVqLs.exe
  C:\Windows\System\WGOVqLs.exe
  2⤵
  PID:4928
- C:\Windows\System\nelXDpr.exe
  C:\Windows\System\nelXDpr.exe
  2⤵
  PID:4948
- C:\Windows\System\APKIVhy.exe
  C:\Windows\System\APKIVhy.exe
  2⤵
  PID:4964
- C:\Windows\System\HfmXsrZ.exe
  C:\Windows\System\HfmXsrZ.exe
  2⤵
  PID:4980
- C:\Windows\System\puvUsKs.exe
  C:\Windows\System\puvUsKs.exe
  2⤵
  PID:4996
- C:\Windows\System\AfIrEBC.exe
  C:\Windows\System\AfIrEBC.exe
  2⤵
  PID:5016
- C:\Windows\System\ZcQCyhN.exe
  C:\Windows\System\ZcQCyhN.exe
  2⤵
  PID:5032
- C:\Windows\System\bDHNsvd.exe
  C:\Windows\System\bDHNsvd.exe
  2⤵
  PID:5048
- C:\Windows\System\FoehchN.exe
  C:\Windows\System\FoehchN.exe
  2⤵
  PID:5064
- C:\Windows\System\XzObqjE.exe
  C:\Windows\System\XzObqjE.exe
  2⤵
  PID:5080
- C:\Windows\System\GffnDPS.exe
  C:\Windows\System\GffnDPS.exe
  2⤵
  PID:5096
- C:\Windows\System\XFCZLIL.exe
  C:\Windows\System\XFCZLIL.exe
  2⤵
  PID:5112
- C:\Windows\System\rxIepbH.exe
  C:\Windows\System\rxIepbH.exe
  2⤵
  PID:3328
- C:\Windows\System\nuByWez.exe
  C:\Windows\System\nuByWez.exe
  2⤵
  PID:4124
- C:\Windows\System\SXhdtqQ.exe
  C:\Windows\System\SXhdtqQ.exe
  2⤵
  PID:4192
- C:\Windows\System\YLyVxyX.exe
  C:\Windows\System\YLyVxyX.exe
  2⤵
  PID:4492
- C:\Windows\System\EdPSgiO.exe
  C:\Windows\System\EdPSgiO.exe
  2⤵
  PID:4276
- C:\Windows\System\HaleutO.exe
  C:\Windows\System\HaleutO.exe
  2⤵
  PID:4176
- C:\Windows\System\ResROZh.exe
  C:\Windows\System\ResROZh.exe
  2⤵
  PID:4532
- C:\Windows\System\DNegaGZ.exe
  C:\Windows\System\DNegaGZ.exe
  2⤵
  PID:4668
- C:\Windows\System\xbpESJu.exe
  C:\Windows\System\xbpESJu.exe
  2⤵
  PID:4620
- C:\Windows\System\Wfadzen.exe
  C:\Windows\System\Wfadzen.exe
  2⤵
  PID:4684
- C:\Windows\System\uYqIooB.exe
  C:\Windows\System\uYqIooB.exe
  2⤵
  PID:4876
- C:\Windows\System\ntnNbra.exe
  C:\Windows\System\ntnNbra.exe
  2⤵
  PID:4856
- C:\Windows\System\KfKFnWt.exe
  C:\Windows\System\KfKFnWt.exe
  2⤵
  PID:4924
- C:\Windows\System\bksTbTy.exe
  C:\Windows\System\bksTbTy.exe
  2⤵
  PID:5076
- C:\Windows\System\muIuivu.exe
  C:\Windows\System\muIuivu.exe
  2⤵
  PID:5108
- C:\Windows\System\OXlQUwS.exe
  C:\Windows\System\OXlQUwS.exe
  2⤵
  PID:2744
- C:\Windows\System\jMwXDxG.exe
  C:\Windows\System\jMwXDxG.exe
  2⤵
  PID:4344
- C:\Windows\System\sBXNRQz.exe
  C:\Windows\System\sBXNRQz.exe
  2⤵
  PID:2412
- C:\Windows\System\hLEJtDU.exe
  C:\Windows\System\hLEJtDU.exe
  2⤵
  PID:2404
- C:\Windows\System\KiZYmzh.exe
  C:\Windows\System\KiZYmzh.exe
  2⤵
  PID:4316
- C:\Windows\System\MJOLkIV.exe
  C:\Windows\System\MJOLkIV.exe
  2⤵
  PID:2436
- C:\Windows\System\BUGvMAh.exe
  C:\Windows\System\BUGvMAh.exe
  2⤵
  PID:4148
- C:\Windows\System\QXhrfSx.exe
  C:\Windows\System\QXhrfSx.exe
  2⤵
  PID:4616
- C:\Windows\System\mFOhQgo.exe
  C:\Windows\System\mFOhQgo.exe
  2⤵
  PID:4836
- C:\Windows\System\LVsPYMb.exe
  C:\Windows\System\LVsPYMb.exe
  2⤵
  PID:4368
- C:\Windows\System\omTZbbv.exe
  C:\Windows\System\omTZbbv.exe
  2⤵
  PID:4752
- C:\Windows\System\exxmgvO.exe
  C:\Windows\System\exxmgvO.exe
  2⤵
  PID:4956
- C:\Windows\System\gRBiAgG.exe
  C:\Windows\System\gRBiAgG.exe
  2⤵
  PID:5044
- C:\Windows\System\fsvalSu.exe
  C:\Windows\System\fsvalSu.exe
  2⤵
  PID:4892
- C:\Windows\System\zJIitrb.exe
  C:\Windows\System\zJIitrb.exe
  2⤵
  PID:5056
- C:\Windows\System\FyYVfyf.exe
  C:\Windows\System\FyYVfyf.exe
  2⤵
  PID:5092
- C:\Windows\System\GJyJxDQ.exe
  C:\Windows\System\GJyJxDQ.exe
  2⤵
  PID:4260
- C:\Windows\System\elZHigI.exe
  C:\Windows\System\elZHigI.exe
  2⤵
  PID:4064
- C:\Windows\System\LapAGMI.exe
  C:\Windows\System\LapAGMI.exe
  2⤵
  PID:4332
- C:\Windows\System\UXPGpqh.exe
  C:\Windows\System\UXPGpqh.exe
  2⤵
  PID:4396
- C:\Windows\System\XyRBvFR.exe
  C:\Windows\System\XyRBvFR.exe
  2⤵
  PID:4464
- C:\Windows\System\KPuGdQA.exe
  C:\Windows\System\KPuGdQA.exe
  2⤵
  PID:3968
- C:\Windows\System\Yhnkmcq.exe
  C:\Windows\System\Yhnkmcq.exe
  2⤵
  PID:4500
- C:\Windows\System\vtqzNmc.exe
  C:\Windows\System\vtqzNmc.exe
  2⤵
  PID:4444
- C:\Windows\System\rAcpcmX.exe
  C:\Windows\System\rAcpcmX.exe
  2⤵
  PID:4352
- C:\Windows\System\QncjrXZ.exe
  C:\Windows\System\QncjrXZ.exe
  2⤵
  PID:4664
- C:\Windows\System\ISznQjz.exe
  C:\Windows\System\ISznQjz.exe
  2⤵
  PID:4732
- C:\Windows\System\fdCjVFP.exe
  C:\Windows\System\fdCjVFP.exe
  2⤵
  PID:4824
- C:\Windows\System\XuRXdyb.exe
  C:\Windows\System\XuRXdyb.exe
  2⤵
  PID:4584
- C:\Windows\System\nKOoelK.exe
  C:\Windows\System\nKOoelK.exe
  2⤵
  PID:5012
- C:\Windows\System\iwVokIt.exe
  C:\Windows\System\iwVokIt.exe
  2⤵
  PID:4720
- C:\Windows\System\LnZnFLU.exe
  C:\Windows\System\LnZnFLU.exe
  2⤵
  PID:4992
- C:\Windows\System\RYHTxNf.exe
  C:\Windows\System\RYHTxNf.exe
  2⤵
  PID:4200
- C:\Windows\System\LkoYxjH.exe
  C:\Windows\System\LkoYxjH.exe
  2⤵
  PID:4232
- C:\Windows\System\WJlAnMj.exe
  C:\Windows\System\WJlAnMj.exe
  2⤵
  PID:4300
- C:\Windows\System\mopKkjt.exe
  C:\Windows\System\mopKkjt.exe
  2⤵
  PID:4432
- C:\Windows\System\TbbLJHf.exe
  C:\Windows\System\TbbLJHf.exe
  2⤵
  PID:4364
- C:\Windows\System\nYOByll.exe
  C:\Windows\System\nYOByll.exe
  2⤵
  PID:864
- C:\Windows\System\jhOfMzA.exe
  C:\Windows\System\jhOfMzA.exe
  2⤵
  PID:4480
- C:\Windows\System\XFxQrUT.exe
  C:\Windows\System\XFxQrUT.exe
  2⤵
  PID:4768
- C:\Windows\System\UDRkaqI.exe
  C:\Windows\System\UDRkaqI.exe
  2⤵
  PID:4128
- C:\Windows\System\rGSxGVv.exe
  C:\Windows\System\rGSxGVv.exe
  2⤵
  PID:3732
- C:\Windows\System\SInDWYE.exe
  C:\Windows\System\SInDWYE.exe
  2⤵
  PID:4872
- C:\Windows\System\eSPTEhA.exe
  C:\Windows\System\eSPTEhA.exe
  2⤵
  PID:5024
- C:\Windows\System\FNhEzAH.exe
  C:\Windows\System\FNhEzAH.exe
  2⤵
  PID:3424
- C:\Windows\System\AgeoLgz.exe
  C:\Windows\System\AgeoLgz.exe
  2⤵
  PID:4460
- C:\Windows\System\kXhrcIA.exe
  C:\Windows\System\kXhrcIA.exe
  2⤵
  PID:4144
- C:\Windows\System\UEIkQju.exe
  C:\Windows\System\UEIkQju.exe
  2⤵
  PID:4636
- C:\Windows\System\HKKfwXY.exe
  C:\Windows\System\HKKfwXY.exe
  2⤵
  PID:1512
- C:\Windows\System\ghlxiUN.exe
  C:\Windows\System\ghlxiUN.exe
  2⤵
  PID:4988
- C:\Windows\System\NuizXLw.exe
  C:\Windows\System\NuizXLw.exe
  2⤵
  PID:4228
- C:\Windows\System\oZybCpm.exe
  C:\Windows\System\oZybCpm.exe
  2⤵
  PID:4700
- C:\Windows\System\BEieOIo.exe
  C:\Windows\System\BEieOIo.exe
  2⤵
  PID:4380
- C:\Windows\System\DGAzdQu.exe
  C:\Windows\System\DGAzdQu.exe
  2⤵
  PID:4820
- C:\Windows\System\MFGcHQZ.exe
  C:\Windows\System\MFGcHQZ.exe
  2⤵
  PID:4216
- C:\Windows\System\tISaosv.exe
  C:\Windows\System\tISaosv.exe
  2⤵
  PID:4112
- C:\Windows\System\OtHqmJX.exe
  C:\Windows\System\OtHqmJX.exe
  2⤵
  PID:4944
- C:\Windows\System\wvHdPEG.exe
  C:\Windows\System\wvHdPEG.exe
  2⤵
  PID:5128
- C:\Windows\System\mLGyjJM.exe
  C:\Windows\System\mLGyjJM.exe
  2⤵
  PID:5144
- C:\Windows\System\BApsCEb.exe
  C:\Windows\System\BApsCEb.exe
  2⤵
  PID:5160
- C:\Windows\System\JxfLAij.exe
  C:\Windows\System\JxfLAij.exe
  2⤵
  PID:5176
- C:\Windows\System\BogGAaY.exe
  C:\Windows\System\BogGAaY.exe
  2⤵
  PID:5192
- C:\Windows\System\zSENrWQ.exe
  C:\Windows\System\zSENrWQ.exe
  2⤵
  PID:5208
- C:\Windows\System\gzLDKKX.exe
  C:\Windows\System\gzLDKKX.exe
  2⤵
  PID:5224
- C:\Windows\System\ELRGety.exe
  C:\Windows\System\ELRGety.exe
  2⤵
  PID:5244
- C:\Windows\System\psJLcne.exe
  C:\Windows\System\psJLcne.exe
  2⤵
  PID:5364
- C:\Windows\System\tquPpiM.exe
  C:\Windows\System\tquPpiM.exe
  2⤵
  PID:5384
- C:\Windows\System\nevcxDL.exe
  C:\Windows\System\nevcxDL.exe
  2⤵
  PID:5400
- C:\Windows\System\KwKkEfc.exe
  C:\Windows\System\KwKkEfc.exe
  2⤵
  PID:5416
- C:\Windows\System\jQBTcVk.exe
  C:\Windows\System\jQBTcVk.exe
  2⤵
  PID:5432
- C:\Windows\System\dWhQTZg.exe
  C:\Windows\System\dWhQTZg.exe
  2⤵
  PID:5448
- C:\Windows\System\AgpvEMA.exe
  C:\Windows\System\AgpvEMA.exe
  2⤵
  PID:5464
- C:\Windows\System\qzxtWhE.exe
  C:\Windows\System\qzxtWhE.exe
  2⤵
  PID:5484
- C:\Windows\System\PhmPaNu.exe
  C:\Windows\System\PhmPaNu.exe
  2⤵
  PID:5500
- C:\Windows\System\lwexNFK.exe
  C:\Windows\System\lwexNFK.exe
  2⤵
  PID:5516
- C:\Windows\System\hWSVVYB.exe
  C:\Windows\System\hWSVVYB.exe
  2⤵
  PID:5676
- C:\Windows\System\XBAOBol.exe
  C:\Windows\System\XBAOBol.exe
  2⤵
  PID:5692
- C:\Windows\System\wgdLWSQ.exe
  C:\Windows\System\wgdLWSQ.exe
  2⤵
  PID:5708
- C:\Windows\System\PRylrem.exe
  C:\Windows\System\PRylrem.exe
  2⤵
  PID:5724
- C:\Windows\System\VfLtwcb.exe
  C:\Windows\System\VfLtwcb.exe
  2⤵
  PID:5744
- C:\Windows\System\QeTxhmM.exe
  C:\Windows\System\QeTxhmM.exe
  2⤵
  PID:5760
- C:\Windows\System\rzTbMEE.exe
  C:\Windows\System\rzTbMEE.exe
  2⤵
  PID:5776
- C:\Windows\System\CxviWSb.exe
  C:\Windows\System\CxviWSb.exe
  2⤵
  PID:5792
- C:\Windows\System\yJAXrOM.exe
  C:\Windows\System\yJAXrOM.exe
  2⤵
  PID:5812
- C:\Windows\System\zkcRbxm.exe
  C:\Windows\System\zkcRbxm.exe
  2⤵
  PID:5828
- C:\Windows\System\oCfbbhy.exe
  C:\Windows\System\oCfbbhy.exe
  2⤵
  PID:5844
- C:\Windows\System\eCBTduS.exe
  C:\Windows\System\eCBTduS.exe
  2⤵
  PID:5864
- C:\Windows\System\vmNtNls.exe
  C:\Windows\System\vmNtNls.exe
  2⤵
  PID:5880
- C:\Windows\System\ipdKQHO.exe
  C:\Windows\System\ipdKQHO.exe
  2⤵
  PID:5896
- C:\Windows\System\pztzsXd.exe
  C:\Windows\System\pztzsXd.exe
  2⤵
  PID:5912
- C:\Windows\System\ADHYgoZ.exe
  C:\Windows\System\ADHYgoZ.exe
  2⤵
  PID:5932
- C:\Windows\System\oxvFmpg.exe
  C:\Windows\System\oxvFmpg.exe
  2⤵
  PID:5948
- C:\Windows\System\RoquDUL.exe
  C:\Windows\System\RoquDUL.exe
  2⤵
  PID:5964
- C:\Windows\System\gTpnltg.exe
  C:\Windows\System\gTpnltg.exe
  2⤵
  PID:5980
- C:\Windows\System\sxkazEv.exe
  C:\Windows\System\sxkazEv.exe
  2⤵
  PID:6000
- C:\Windows\System\LATbMgK.exe
  C:\Windows\System\LATbMgK.exe
  2⤵
  PID:6016
- C:\Windows\System\AQVvZPO.exe
  C:\Windows\System\AQVvZPO.exe
  2⤵
  PID:6036
- C:\Windows\System\GyuhDIh.exe
  C:\Windows\System\GyuhDIh.exe
  2⤵
  PID:6052
- C:\Windows\System\hAlZxyH.exe
  C:\Windows\System\hAlZxyH.exe
  2⤵
  PID:6068
- C:\Windows\System\MEsNFFa.exe
  C:\Windows\System\MEsNFFa.exe
  2⤵
  PID:6088
- C:\Windows\System\eynNqUz.exe
  C:\Windows\System\eynNqUz.exe
  2⤵
  PID:6108
- C:\Windows\System\iQVxbIh.exe
  C:\Windows\System\iQVxbIh.exe
  2⤵
  PID:6124
- C:\Windows\System\XFuiksh.exe
  C:\Windows\System\XFuiksh.exe
  2⤵
  PID:6140
- C:\Windows\System\jDFFxdc.exe
  C:\Windows\System\jDFFxdc.exe
  2⤵
  PID:4808
- C:\Windows\System\reAYxpp.exe
  C:\Windows\System\reAYxpp.exe
  2⤵
  PID:5172
- C:\Windows\System\yfLvkPl.exe
  C:\Windows\System\yfLvkPl.exe
  2⤵
  PID:5232
- C:\Windows\System\XeqPxsH.exe
  C:\Windows\System\XeqPxsH.exe
  2⤵
  PID:5188
- C:\Windows\System\bCqEfil.exe
  C:\Windows\System\bCqEfil.exe
  2⤵
  PID:5256
- C:\Windows\System\BnuItbB.exe
  C:\Windows\System\BnuItbB.exe
  2⤵
  PID:5268
- C:\Windows\System\fnBfCMY.exe
  C:\Windows\System\fnBfCMY.exe
  2⤵
  PID:5280
- C:\Windows\System\XAbpacP.exe
  C:\Windows\System\XAbpacP.exe
  2⤵
  PID:5292
- C:\Windows\System\XWOLUhe.exe
  C:\Windows\System\XWOLUhe.exe
  2⤵
  PID:5328
- C:\Windows\System\jaKVvar.exe
  C:\Windows\System\jaKVvar.exe
  2⤵
  PID:5340
- C:\Windows\System\uBAhCcP.exe
  C:\Windows\System\uBAhCcP.exe
  2⤵
  PID:5344
- C:\Windows\System\mcibmtu.exe
  C:\Windows\System\mcibmtu.exe
  2⤵
  PID:5380
- C:\Windows\System\tJGXdfF.exe
  C:\Windows\System\tJGXdfF.exe
  2⤵
  PID:5472
- C:\Windows\System\MeggidN.exe
  C:\Windows\System\MeggidN.exe
  2⤵
  PID:5480
- C:\Windows\System\heooYTB.exe
  C:\Windows\System\heooYTB.exe
  2⤵
  PID:5544
- C:\Windows\System\ONtorqr.exe
  C:\Windows\System\ONtorqr.exe
  2⤵
  PID:5428
- C:\Windows\System\uPCEmKG.exe
  C:\Windows\System\uPCEmKG.exe
  2⤵
  PID:5548
- C:\Windows\System\UwfnWND.exe
  C:\Windows\System\UwfnWND.exe
  2⤵
  PID:5564
- C:\Windows\System\njznQyC.exe
  C:\Windows\System\njznQyC.exe
  2⤵
  PID:5580
- C:\Windows\System\ilyvrlz.exe
  C:\Windows\System\ilyvrlz.exe
  2⤵
  PID:5596
- C:\Windows\System\QDVFaEu.exe
  C:\Windows\System\QDVFaEu.exe
  2⤵
  PID:5616
- C:\Windows\System\AtZzYcR.exe
  C:\Windows\System\AtZzYcR.exe
  2⤵
  PID:5632
- C:\Windows\System\AvyHuLh.exe
  C:\Windows\System\AvyHuLh.exe
  2⤵
  PID:5648
- C:\Windows\System\pLuaFwj.exe
  C:\Windows\System\pLuaFwj.exe
  2⤵
  PID:5664
- C:\Windows\System\vAEOtdk.exe
  C:\Windows\System\vAEOtdk.exe
  2⤵
  PID:5752
- C:\Windows\System\hqNjkfX.exe
  C:\Windows\System\hqNjkfX.exe
  2⤵
  PID:5700
- C:\Windows\System\IlwBrXS.exe
  C:\Windows\System\IlwBrXS.exe
  2⤵
  PID:5784
- C:\Windows\System\mVIJWFX.exe
  C:\Windows\System\mVIJWFX.exe
  2⤵
  PID:5788
- C:\Windows\System\Ffvcbwp.exe
  C:\Windows\System\Ffvcbwp.exe
  2⤵
  PID:5988
- C:\Windows\System\XXogxCo.exe
  C:\Windows\System\XXogxCo.exe
  2⤵
  PID:5124
- C:\Windows\System\OmVTymQ.exe
  C:\Windows\System\OmVTymQ.exe
  2⤵
  PID:5892
- C:\Windows\System\eIqgZyv.exe
  C:\Windows\System\eIqgZyv.exe
  2⤵
  PID:5928
- C:\Windows\System\sxmZLUP.exe
  C:\Windows\System\sxmZLUP.exe
  2⤵
  PID:6096
- C:\Windows\System\Bnxlafm.exe
  C:\Windows\System\Bnxlafm.exe
  2⤵
  PID:5324
- C:\Windows\System\hrCMXkZ.exe
  C:\Windows\System\hrCMXkZ.exe
  2⤵
  PID:5508
- C:\Windows\System\OcpdFfD.exe
  C:\Windows\System\OcpdFfD.exe
  2⤵
  PID:6060
- C:\Windows\System\zmgfbtp.exe
  C:\Windows\System\zmgfbtp.exe
  2⤵
  PID:5624
- C:\Windows\System\fhZPkax.exe
  C:\Windows\System\fhZPkax.exe
  2⤵
  PID:5660
- C:\Windows\System\AaTogyM.exe
  C:\Windows\System\AaTogyM.exe
  2⤵
  PID:5288
- C:\Windows\System\BbmWVXG.exe
  C:\Windows\System\BbmWVXG.exe
  2⤵
  PID:6156
- C:\Windows\System\GiZXrEr.exe
  C:\Windows\System\GiZXrEr.exe
  2⤵
  PID:6172
- C:\Windows\System\oNthWlC.exe
  C:\Windows\System\oNthWlC.exe
  2⤵
  PID:6192
- C:\Windows\System\WiQkCPA.exe
  C:\Windows\System\WiQkCPA.exe
  2⤵
  PID:6216
- C:\Windows\System\RDaBfIV.exe
  C:\Windows\System\RDaBfIV.exe
  2⤵
  PID:6232
- C:\Windows\System\SHdTGot.exe
  C:\Windows\System\SHdTGot.exe
  2⤵
  PID:6248
- C:\Windows\System\wCiyPTD.exe
  C:\Windows\System\wCiyPTD.exe
  2⤵
  PID:6264
- C:\Windows\System\CTUjSzu.exe
  C:\Windows\System\CTUjSzu.exe
  2⤵
  PID:6280
- C:\Windows\System\sdZUSnf.exe
  C:\Windows\System\sdZUSnf.exe
  2⤵
  PID:6296
- C:\Windows\System\RfmIRWt.exe
  C:\Windows\System\RfmIRWt.exe
  2⤵
  PID:6312
- C:\Windows\System\wBRPpJT.exe
  C:\Windows\System\wBRPpJT.exe
  2⤵
  PID:6328
- C:\Windows\System\rvUdciV.exe
  C:\Windows\System\rvUdciV.exe
  2⤵
  PID:6344
- C:\Windows\System\IHDNJTi.exe
  C:\Windows\System\IHDNJTi.exe
  2⤵
  PID:6360
- C:\Windows\System\kHdDcJn.exe
  C:\Windows\System\kHdDcJn.exe
  2⤵
  PID:6376
- C:\Windows\System\tzVbpmu.exe
  C:\Windows\System\tzVbpmu.exe
  2⤵
  PID:6392
- C:\Windows\System\IqNquHI.exe
  C:\Windows\System\IqNquHI.exe
  2⤵
  PID:6408
- C:\Windows\System\ksxpdXK.exe
  C:\Windows\System\ksxpdXK.exe
  2⤵
  PID:6428
- C:\Windows\System\NmbdjMz.exe
  C:\Windows\System\NmbdjMz.exe
  2⤵
  PID:6444
- C:\Windows\System\DRDfWRS.exe
  C:\Windows\System\DRDfWRS.exe
  2⤵
  PID:6460
- C:\Windows\System\phezIQL.exe
  C:\Windows\System\phezIQL.exe
  2⤵
  PID:6480
- C:\Windows\System\EXChdmF.exe
  C:\Windows\System\EXChdmF.exe
  2⤵
  PID:6496
- C:\Windows\System\NbIdvVE.exe
  C:\Windows\System\NbIdvVE.exe
  2⤵
  PID:6512
- C:\Windows\System\dpRJXsP.exe
  C:\Windows\System\dpRJXsP.exe
  2⤵
  PID:6528
- C:\Windows\System\tHlwdoa.exe
  C:\Windows\System\tHlwdoa.exe
  2⤵
  PID:6544
- C:\Windows\System\tGAiIDa.exe
  C:\Windows\System\tGAiIDa.exe
  2⤵
  PID:6560
- C:\Windows\System\wrwLGlV.exe
  C:\Windows\System\wrwLGlV.exe
  2⤵
  PID:6576
- C:\Windows\System\isDkmZL.exe
  C:\Windows\System\isDkmZL.exe
  2⤵
  PID:6592
- C:\Windows\System\bhfvAsY.exe
  C:\Windows\System\bhfvAsY.exe
  2⤵
  PID:6608
- C:\Windows\System\HsZvJFZ.exe
  C:\Windows\System\HsZvJFZ.exe
  2⤵
  PID:6624
- C:\Windows\System\zhuQbEp.exe
  C:\Windows\System\zhuQbEp.exe
  2⤵
  PID:6708
- C:\Windows\System\iOoeOhe.exe
  C:\Windows\System\iOoeOhe.exe
  2⤵
  PID:6768
- C:\Windows\System\IRRiTof.exe
  C:\Windows\System\IRRiTof.exe
  2⤵
  PID:6784
- C:\Windows\System\fRiFvHD.exe
  C:\Windows\System\fRiFvHD.exe
  2⤵
  PID:6800
- C:\Windows\System\vVPMfLe.exe
  C:\Windows\System\vVPMfLe.exe
  2⤵
  PID:6820
- C:\Windows\System\lwqeqdM.exe
  C:\Windows\System\lwqeqdM.exe
  2⤵
  PID:6836
- C:\Windows\System\OamjguC.exe
  C:\Windows\System\OamjguC.exe
  2⤵
  PID:6852
- C:\Windows\System\eBXvKfv.exe
  C:\Windows\System\eBXvKfv.exe
  2⤵
  PID:6868
- C:\Windows\System\ZPDzErD.exe
  C:\Windows\System\ZPDzErD.exe
  2⤵
  PID:6884
- C:\Windows\System\fopQaUC.exe
  C:\Windows\System\fopQaUC.exe
  2⤵
  PID:6900
- C:\Windows\System\rZJITvq.exe
  C:\Windows\System\rZJITvq.exe
  2⤵
  PID:6916
- C:\Windows\System\diGdOGG.exe
  C:\Windows\System\diGdOGG.exe
  2⤵
  PID:6932
- C:\Windows\System\AWsQiGu.exe
  C:\Windows\System\AWsQiGu.exe
  2⤵
  PID:6972
- C:\Windows\System\CBXPcZC.exe
  C:\Windows\System\CBXPcZC.exe
  2⤵
  PID:6992
- C:\Windows\System\ogREDSq.exe
  C:\Windows\System\ogREDSq.exe
  2⤵
  PID:7008
- C:\Windows\System\JqOwJGl.exe
  C:\Windows\System\JqOwJGl.exe
  2⤵
  PID:7024
- C:\Windows\System\JRExyls.exe
  C:\Windows\System\JRExyls.exe
  2⤵
  PID:7044
- C:\Windows\System\AydZDFD.exe
  C:\Windows\System\AydZDFD.exe
  2⤵
  PID:7060
- C:\Windows\System\lRQnVNV.exe
  C:\Windows\System\lRQnVNV.exe
  2⤵
  PID:7076
- C:\Windows\System\bSygrQN.exe
  C:\Windows\System\bSygrQN.exe
  2⤵
  PID:7092
- C:\Windows\System\rOwDqmu.exe
  C:\Windows\System\rOwDqmu.exe
  2⤵
  PID:7108
- C:\Windows\System\FTBNoab.exe
  C:\Windows\System\FTBNoab.exe
  2⤵
  PID:7124
- C:\Windows\System\BSJYqSL.exe
  C:\Windows\System\BSJYqSL.exe
  2⤵
  PID:7140
- C:\Windows\System\mubjokk.exe
  C:\Windows\System\mubjokk.exe
  2⤵
  PID:7156
- C:\Windows\System\SPvzSqw.exe
  C:\Windows\System\SPvzSqw.exe
  2⤵
  PID:5716
- C:\Windows\System\hTZbdnA.exe
  C:\Windows\System\hTZbdnA.exe
  2⤵
  PID:6136
- C:\Windows\System\VSxyxYb.exe
  C:\Windows\System\VSxyxYb.exe
  2⤵
  PID:5308
- C:\Windows\System\sjtBeFW.exe
  C:\Windows\System\sjtBeFW.exe
  2⤵
  PID:5588
- C:\Windows\System\OqScdne.exe
  C:\Windows\System\OqScdne.exe
  2⤵
  PID:5992
- C:\Windows\System\bVMgbtC.exe
  C:\Windows\System\bVMgbtC.exe
  2⤵
  PID:6180
- C:\Windows\System\kxZiTSY.exe
  C:\Windows\System\kxZiTSY.exe
  2⤵
  PID:6260
- C:\Windows\System\FTBRqOS.exe
  C:\Windows\System\FTBRqOS.exe
  2⤵
  PID:6320
- C:\Windows\System\BIZBGDA.exe
  C:\Windows\System\BIZBGDA.exe
  2⤵
  PID:6520
- C:\Windows\System\xjlqTcV.exe
  C:\Windows\System\xjlqTcV.exe
  2⤵
  PID:6384
- C:\Windows\System\DnJhXrq.exe
  C:\Windows\System\DnJhXrq.exe
  2⤵
  PID:6584
- C:\Windows\System\TMNcJzq.exe
  C:\Windows\System\TMNcJzq.exe
  2⤵
  PID:6452
- C:\Windows\System\hdBWuTw.exe
  C:\Windows\System\hdBWuTw.exe
  2⤵
  PID:6256
- C:\Windows\System\YbjMHNC.exe
  C:\Windows\System\YbjMHNC.exe
  2⤵
  PID:6648
- C:\Windows\System\WlqzyAw.exe
  C:\Windows\System\WlqzyAw.exe
  2⤵
  PID:6644
- C:\Windows\System\aXUKdqY.exe
  C:\Windows\System\aXUKdqY.exe
  2⤵
  PID:5804
- C:\Windows\System\GntfWpg.exe
  C:\Windows\System\GntfWpg.exe
  2⤵
  PID:5904
- C:\Windows\System\iwxNSUQ.exe
  C:\Windows\System\iwxNSUQ.exe
  2⤵
  PID:5972
- C:\Windows\System\zzYomxk.exe
  C:\Windows\System\zzYomxk.exe
  2⤵
  PID:6048
- C:\Windows\System\IwkiLKs.exe
  C:\Windows\System\IwkiLKs.exe
  2⤵
  PID:5136
- C:\Windows\System\QkFlnaL.exe
  C:\Windows\System\QkFlnaL.exe
  2⤵
  PID:5168
- C:\Windows\System\VzBEPcv.exe
  C:\Windows\System\VzBEPcv.exe
  2⤵
  PID:5220
- C:\Windows\System\qARsDTZ.exe
  C:\Windows\System\qARsDTZ.exe
  2⤵
  PID:5320
- C:\Windows\System\eaPdfKo.exe
  C:\Windows\System\eaPdfKo.exe
  2⤵
  PID:5440
- C:\Windows\System\PQSFjeE.exe
  C:\Windows\System\PQSFjeE.exe
  2⤵
  PID:5460
- C:\Windows\System\uvWVxOq.exe
  C:\Windows\System\uvWVxOq.exe
  2⤵
  PID:5576
- C:\Windows\System\nDJILZr.exe
  C:\Windows\System\nDJILZr.exe
  2⤵
  PID:5640
- C:\Windows\System\NfcSfgB.exe
  C:\Windows\System\NfcSfgB.exe
  2⤵
  PID:5824
- C:\Windows\System\AMWdUuU.exe
  C:\Windows\System\AMWdUuU.exe
  2⤵
  PID:6024
- C:\Windows\System\dqFewwh.exe
  C:\Windows\System\dqFewwh.exe
  2⤵
  PID:5376
- C:\Windows\System\OkUfYOV.exe
  C:\Windows\System\OkUfYOV.exe
  2⤵
  PID:5628
- C:\Windows\System\FQTNWFZ.exe
  C:\Windows\System\FQTNWFZ.exe
  2⤵
  PID:6168
- C:\Windows\System\KxgsPld.exe
  C:\Windows\System\KxgsPld.exe
  2⤵
  PID:6240
- C:\Windows\System\eJNODfT.exe
  C:\Windows\System\eJNODfT.exe
  2⤵
  PID:6304
- C:\Windows\System\CYZfloe.exe
  C:\Windows\System\CYZfloe.exe
  2⤵
  PID:6372
- C:\Windows\System\obUIKJz.exe
  C:\Windows\System\obUIKJz.exe
  2⤵
  PID:6436
- C:\Windows\System\iTRHaXu.exe
  C:\Windows\System\iTRHaXu.exe
  2⤵
  PID:6468
- C:\Windows\System\kQvbvSd.exe
  C:\Windows\System\kQvbvSd.exe
  2⤵
  PID:6540
- C:\Windows\System\QvVdwPr.exe
  C:\Windows\System\QvVdwPr.exe
  2⤵
  PID:6600
- C:\Windows\System\yUYOzCe.exe
  C:\Windows\System\yUYOzCe.exe
  2⤵
  PID:5840
- C:\Windows\System\WDtwRSy.exe
  C:\Windows\System\WDtwRSy.exe
  2⤵
  PID:6680
- C:\Windows\System\IKNmXmw.exe
  C:\Windows\System\IKNmXmw.exe
  2⤵
  PID:6696
- C:\Windows\System\ZFyYhBc.exe
  C:\Windows\System\ZFyYhBc.exe
  2⤵
  PID:6720
- C:\Windows\System\IHHubMj.exe
  C:\Windows\System\IHHubMj.exe
  2⤵
  PID:6828
- C:\Windows\System\oYqGRDb.exe
  C:\Windows\System\oYqGRDb.exe
  2⤵
  PID:6740
- C:\Windows\System\qBmvKdz.exe
  C:\Windows\System\qBmvKdz.exe
  2⤵
  PID:6756
- C:\Windows\System\mQybCmE.exe
  C:\Windows\System\mQybCmE.exe
  2⤵
  PID:6860
- C:\Windows\System\ZdfPSqB.exe
  C:\Windows\System\ZdfPSqB.exe
  2⤵
  PID:6924
- C:\Windows\System\otUvRHs.exe
  C:\Windows\System\otUvRHs.exe
  2⤵
  PID:6808
- C:\Windows\System\ozLucGP.exe
  C:\Windows\System\ozLucGP.exe
  2⤵
  PID:6876
- C:\Windows\System\vaGkEoi.exe
  C:\Windows\System\vaGkEoi.exe
  2⤵
  PID:6928
- C:\Windows\System\JzGZIhx.exe
  C:\Windows\System\JzGZIhx.exe
  2⤵
  PID:6980
- C:\Windows\System\weAhqFp.exe
  C:\Windows\System\weAhqFp.exe
  2⤵
  PID:6964
- C:\Windows\System\KwTQfai.exe
  C:\Windows\System\KwTQfai.exe
  2⤵
  PID:7020
- C:\Windows\System\FVZSmhC.exe
  C:\Windows\System\FVZSmhC.exe
  2⤵
  PID:7000
- C:\Windows\System\DiGUsvw.exe
  C:\Windows\System\DiGUsvw.exe
  2⤵
  PID:7040
- C:\Windows\System\qNYwQSh.exe
  C:\Windows\System\qNYwQSh.exe
  2⤵
  PID:7120
- C:\Windows\System\hcXoFIt.exe
  C:\Windows\System\hcXoFIt.exe
  2⤵
  PID:7152
- C:\Windows\System\aiarNLH.exe
  C:\Windows\System\aiarNLH.exe
  2⤵
  PID:7132
- C:\Windows\System\SBAjsfQ.exe
  C:\Windows\System\SBAjsfQ.exe
  2⤵
  PID:5512
- C:\Windows\System\IYBSvar.exe
  C:\Windows\System\IYBSvar.exe
  2⤵
  PID:5920
- C:\Windows\System\NTxexlI.exe
  C:\Windows\System\NTxexlI.exe
  2⤵
  PID:6148
- C:\Windows\System\qUIpLHv.exe
  C:\Windows\System\qUIpLHv.exe
  2⤵
  PID:6420
- C:\Windows\System\ZOVFrBf.exe
  C:\Windows\System\ZOVFrBf.exe
  2⤵
  PID:6588
- C:\Windows\System\mmTeaYS.exe
  C:\Windows\System\mmTeaYS.exe
  2⤵
  PID:6636
- C:\Windows\System\sjNPUrh.exe
  C:\Windows\System\sjNPUrh.exe
  2⤵
  PID:6416
- C:\Windows\System\mVJBBbz.exe
  C:\Windows\System\mVJBBbz.exe
  2⤵
  PID:5732
- C:\Windows\System\DWGjSWl.exe
  C:\Windows\System\DWGjSWl.exe
  2⤵
  PID:5944
- C:\Windows\System\FYEBbVV.exe
  C:\Windows\System\FYEBbVV.exe
  2⤵
  PID:6080
- C:\Windows\System\IXXfpAU.exe
  C:\Windows\System\IXXfpAU.exe
  2⤵
  PID:6044
- C:\Windows\System\wLSfPCb.exe
  C:\Windows\System\wLSfPCb.exe
  2⤵
  PID:5300
- C:\Windows\System\UwYsodr.exe
  C:\Windows\System\UwYsodr.exe
  2⤵
  PID:5572
- C:\Windows\System\xNHjOuE.exe
  C:\Windows\System\xNHjOuE.exe
  2⤵
  PID:5684
- C:\Windows\System\DFHShUx.exe
  C:\Windows\System\DFHShUx.exe
  2⤵
  PID:6084
- C:\Windows\System\qSfhcsu.exe
  C:\Windows\System\qSfhcsu.exe
  2⤵
  PID:6164
- C:\Windows\System\HLtMpNe.exe
  C:\Windows\System\HLtMpNe.exe
  2⤵
  PID:6208
- C:\Windows\System\MgmfYIg.exe
  C:\Windows\System\MgmfYIg.exe
  2⤵
  PID:6536
- C:\Windows\System\jHGXCmo.exe
  C:\Windows\System\jHGXCmo.exe
  2⤵
  PID:6568
- C:\Windows\System\GtjztMN.exe
  C:\Windows\System\GtjztMN.exe
  2⤵
  PID:6688
- C:\Windows\System\TqzcJWi.exe
  C:\Windows\System\TqzcJWi.exe
  2⤵
  PID:6792
- C:\Windows\System\kVyjIIZ.exe
  C:\Windows\System\kVyjIIZ.exe
  2⤵
  PID:6892
- C:\Windows\System\uEzKYLa.exe
  C:\Windows\System\uEzKYLa.exe
  2⤵
  PID:6676
- C:\Windows\System\vlBPkIo.exe
  C:\Windows\System\vlBPkIo.exe
  2⤵
  PID:5528
- C:\Windows\System\MwoCPIS.exe
  C:\Windows\System\MwoCPIS.exe
  2⤵
  PID:6736
- C:\Windows\System\UPqXkMg.exe
  C:\Windows\System\UPqXkMg.exe
  2⤵
  PID:7052
- C:\Windows\System\VwWwjnp.exe
  C:\Windows\System\VwWwjnp.exe
  2⤵
  PID:6956
- C:\Windows\System\uqpFtnN.exe
  C:\Windows\System\uqpFtnN.exe
  2⤵
  PID:7164
- C:\Windows\System\MzIdWlt.exe
  C:\Windows\System\MzIdWlt.exe
  2⤵
  PID:6224
- C:\Windows\System\WMMGoEb.exe
  C:\Windows\System\WMMGoEb.exe
  2⤵
  PID:6988
- C:\Windows\System\bzRhdcS.exe
  C:\Windows\System\bzRhdcS.exe
  2⤵
  PID:7004
- C:\Windows\System\FzumeTE.exe
  C:\Windows\System\FzumeTE.exe
  2⤵
  PID:5252
- C:\Windows\System\PShsnVA.exe
  C:\Windows\System\PShsnVA.exe
  2⤵
  PID:7100
- C:\Windows\System\QuSSFPK.exe
  C:\Windows\System\QuSSFPK.exe
  2⤵
  PID:6012
- C:\Windows\System\KdgFsUh.exe
  C:\Windows\System\KdgFsUh.exe
  2⤵
  PID:5856
- C:\Windows\System\JcttHGw.exe
  C:\Windows\System\JcttHGw.exe
  2⤵
  PID:6660
- C:\Windows\System\mfvgjaf.exe
  C:\Windows\System\mfvgjaf.exe
  2⤵
  PID:5140
- C:\Windows\System\tpsmMlv.exe
  C:\Windows\System\tpsmMlv.exe
  2⤵
  PID:5476
- C:\Windows\System\vRLtygo.exe
  C:\Windows\System\vRLtygo.exe
  2⤵
  PID:6504
- C:\Windows\System\fdVidRg.exe
  C:\Windows\System\fdVidRg.exe
  2⤵
  PID:6440
- C:\Windows\System\kdGvAuY.exe
  C:\Windows\System\kdGvAuY.exe
  2⤵
  PID:6752
- C:\Windows\System\tHsVpkc.exe
  C:\Windows\System\tHsVpkc.exe
  2⤵
  PID:7072
- C:\Windows\System\ZWiqeQI.exe
  C:\Windows\System\ZWiqeQI.exe
  2⤵
  PID:6848
- C:\Windows\System\LSsMXUj.exe
  C:\Windows\System\LSsMXUj.exe
  2⤵
  PID:6704
- C:\Windows\System\czUZFYE.exe
  C:\Windows\System\czUZFYE.exe
  2⤵
  PID:6776
- C:\Windows\System\oHdPLde.exe
  C:\Windows\System\oHdPLde.exe
  2⤵
  PID:5940
- C:\Windows\System\nanfyBW.exe
  C:\Windows\System\nanfyBW.exe
  2⤵
  PID:5552
- C:\Windows\System\ljqKYvw.exe
  C:\Windows\System\ljqKYvw.exe
  2⤵
  PID:4804
- C:\Windows\System\jqjsLkz.exe
  C:\Windows\System\jqjsLkz.exe
  2⤵
  PID:6672
- C:\Windows\System\yoTRCCP.exe
  C:\Windows\System\yoTRCCP.exe
  2⤵
  PID:6200
- C:\Windows\System\bheUgik.exe
  C:\Windows\System\bheUgik.exe
  2⤵
  PID:6780
- C:\Windows\System\fefMbGT.exe
  C:\Windows\System\fefMbGT.exe
  2⤵
  PID:5524
- C:\Windows\System\QzIqMyu.exe
  C:\Windows\System\QzIqMyu.exe
  2⤵
  PID:7068
- C:\Windows\System\Cgxrvwa.exe
  C:\Windows\System\Cgxrvwa.exe
  2⤵
  PID:6912
- C:\Windows\System\GvctuvI.exe
  C:\Windows\System\GvctuvI.exe
  2⤵
  PID:6356
- C:\Windows\System\nyPgKhb.exe
  C:\Windows\System\nyPgKhb.exe
  2⤵
  PID:6368
- C:\Windows\System\Kpnpeyd.exe
  C:\Windows\System\Kpnpeyd.exe
  2⤵
  PID:6632
- C:\Windows\System\IDTJxXw.exe
  C:\Windows\System\IDTJxXw.exe
  2⤵
  PID:5772
- C:\Windows\System\avcrTLZ.exe
  C:\Windows\System\avcrTLZ.exe
  2⤵
  PID:7180
- C:\Windows\System\onABTWu.exe
  C:\Windows\System\onABTWu.exe
  2⤵
  PID:7196
- C:\Windows\System\EgrMYdG.exe
  C:\Windows\System\EgrMYdG.exe
  2⤵
  PID:7212
- C:\Windows\System\OUwIPoj.exe
  C:\Windows\System\OUwIPoj.exe
  2⤵
  PID:7228
- C:\Windows\System\cbzNOGv.exe
  C:\Windows\System\cbzNOGv.exe
  2⤵
  PID:7244
- C:\Windows\System\pyoDWWy.exe
  C:\Windows\System\pyoDWWy.exe
  2⤵
  PID:7260
- C:\Windows\System\TxAwkFr.exe
  C:\Windows\System\TxAwkFr.exe
  2⤵
  PID:7276
- C:\Windows\System\DPQqcgd.exe
  C:\Windows\System\DPQqcgd.exe
  2⤵
  PID:7292
- C:\Windows\System\btdquNg.exe
  C:\Windows\System\btdquNg.exe
  2⤵
  PID:7308
- C:\Windows\System\FGmTgLE.exe
  C:\Windows\System\FGmTgLE.exe
  2⤵
  PID:7324
- C:\Windows\System\TBcSLxB.exe
  C:\Windows\System\TBcSLxB.exe
  2⤵
  PID:7368
- C:\Windows\System\VEfkLXi.exe
  C:\Windows\System\VEfkLXi.exe
  2⤵
  PID:7388
- C:\Windows\System\YQihLJR.exe
  C:\Windows\System\YQihLJR.exe
  2⤵
  PID:7404
- C:\Windows\System\inRDKqq.exe
  C:\Windows\System\inRDKqq.exe
  2⤵
  PID:7420
- C:\Windows\System\QDVbdSg.exe
  C:\Windows\System\QDVbdSg.exe
  2⤵
  PID:7436
- C:\Windows\System\IzcnUpR.exe
  C:\Windows\System\IzcnUpR.exe
  2⤵
  PID:7452
- C:\Windows\System\ZnHKRso.exe
  C:\Windows\System\ZnHKRso.exe
  2⤵
  PID:7468
- C:\Windows\System\JnRhFRS.exe
  C:\Windows\System\JnRhFRS.exe
  2⤵
  PID:7484
- C:\Windows\System\mkwzbVP.exe
  C:\Windows\System\mkwzbVP.exe
  2⤵
  PID:7500
- C:\Windows\System\FBpEnFn.exe
  C:\Windows\System\FBpEnFn.exe
  2⤵
  PID:7516
- C:\Windows\System\zjiVaal.exe
  C:\Windows\System\zjiVaal.exe
  2⤵
  PID:7532
- C:\Windows\System\PIJAJOZ.exe
  C:\Windows\System\PIJAJOZ.exe
  2⤵
  PID:7548
- C:\Windows\System\oqYGgLK.exe
  C:\Windows\System\oqYGgLK.exe
  2⤵
  PID:7564
- C:\Windows\System\FAKpswF.exe
  C:\Windows\System\FAKpswF.exe
  2⤵
  PID:7580
- C:\Windows\System\tCEtbzk.exe
  C:\Windows\System\tCEtbzk.exe
  2⤵
  PID:7596
- C:\Windows\System\YSGpsjp.exe
  C:\Windows\System\YSGpsjp.exe
  2⤵
  PID:7612
- C:\Windows\System\zXCtdiy.exe
  C:\Windows\System\zXCtdiy.exe
  2⤵
  PID:7628
- C:\Windows\System\eyTGaDR.exe
  C:\Windows\System\eyTGaDR.exe
  2⤵
  PID:7644
- C:\Windows\System\aIfsRhf.exe
  C:\Windows\System\aIfsRhf.exe
  2⤵
  PID:7660
- C:\Windows\System\SCGvWzu.exe
  C:\Windows\System\SCGvWzu.exe
  2⤵
  PID:7676
- C:\Windows\System\CsLXOdP.exe
  C:\Windows\System\CsLXOdP.exe
  2⤵
  PID:7692
- C:\Windows\System\hWqfNxp.exe
  C:\Windows\System\hWqfNxp.exe
  2⤵
  PID:7708
- C:\Windows\System\pMaPLrs.exe
  C:\Windows\System\pMaPLrs.exe
  2⤵
  PID:7724
- C:\Windows\System\rUKjimd.exe
  C:\Windows\System\rUKjimd.exe
  2⤵
  PID:7740
- C:\Windows\System\IKodTWQ.exe
  C:\Windows\System\IKodTWQ.exe
  2⤵
  PID:7756
- C:\Windows\System\LCibFaU.exe
  C:\Windows\System\LCibFaU.exe
  2⤵
  PID:7772
- C:\Windows\System\KTyDshG.exe
  C:\Windows\System\KTyDshG.exe
  2⤵
  PID:7792
- C:\Windows\System\OmmUSeP.exe
  C:\Windows\System\OmmUSeP.exe
  2⤵
  PID:7808
- C:\Windows\System\iqckHHT.exe
  C:\Windows\System\iqckHHT.exe
  2⤵
  PID:7824
- C:\Windows\System\ZeUJMrf.exe
  C:\Windows\System\ZeUJMrf.exe
  2⤵
  PID:7840
- C:\Windows\System\JPGvIAI.exe
  C:\Windows\System\JPGvIAI.exe
  2⤵
  PID:7856
- C:\Windows\System\QNjAWGW.exe
  C:\Windows\System\QNjAWGW.exe
  2⤵
  PID:7872
- C:\Windows\System\WdITynA.exe
  C:\Windows\System\WdITynA.exe
  2⤵
  PID:7888
- C:\Windows\System\YYklZOc.exe
  C:\Windows\System\YYklZOc.exe
  2⤵
  PID:7904
- C:\Windows\System\iKEuzPk.exe
  C:\Windows\System\iKEuzPk.exe
  2⤵
  PID:7920
- C:\Windows\System\DbZQDWT.exe
  C:\Windows\System\DbZQDWT.exe
  2⤵
  PID:7936
- C:\Windows\System\dDmQMGx.exe
  C:\Windows\System\dDmQMGx.exe
  2⤵
  PID:7952
- C:\Windows\System\qARQLEh.exe
  C:\Windows\System\qARQLEh.exe
  2⤵
  PID:7968
- C:\Windows\System\JQGYqeh.exe
  C:\Windows\System\JQGYqeh.exe
  2⤵
  PID:7984
- C:\Windows\System\uVeRNRi.exe
  C:\Windows\System\uVeRNRi.exe
  2⤵
  PID:8000
- C:\Windows\System\ZgrwJKE.exe
  C:\Windows\System\ZgrwJKE.exe
  2⤵
  PID:8016
- C:\Windows\System\xKFOHRA.exe
  C:\Windows\System\xKFOHRA.exe
  2⤵
  PID:8032
- C:\Windows\System\fLEaFrs.exe
  C:\Windows\System\fLEaFrs.exe
  2⤵
  PID:8048
- C:\Windows\System\IhCHkxt.exe
  C:\Windows\System\IhCHkxt.exe
  2⤵
  PID:8064
- C:\Windows\System\CtxBJaz.exe
  C:\Windows\System\CtxBJaz.exe
  2⤵
  PID:8080
- C:\Windows\System\WZSHSjQ.exe
  C:\Windows\System\WZSHSjQ.exe
  2⤵
  PID:8104
- C:\Windows\System\vnvkXbT.exe
  C:\Windows\System\vnvkXbT.exe
  2⤵
  PID:8120
- C:\Windows\System\eBfmcwR.exe
  C:\Windows\System\eBfmcwR.exe
  2⤵
  PID:8136
- C:\Windows\System\ZURIsWZ.exe
  C:\Windows\System\ZURIsWZ.exe
  2⤵
  PID:8152
- C:\Windows\System\EHiCeBa.exe
  C:\Windows\System\EHiCeBa.exe
  2⤵
  PID:8168
- C:\Windows\System\pfjGrOK.exe
  C:\Windows\System\pfjGrOK.exe
  2⤵
  PID:8184
- C:\Windows\System\JAALRqS.exe
  C:\Windows\System\JAALRqS.exe
  2⤵
  PID:5672
- C:\Windows\System\oonwqKg.exe
  C:\Windows\System\oonwqKg.exe
  2⤵
  PID:7088
- C:\Windows\System\SAfuvPH.exe
  C:\Windows\System\SAfuvPH.exe
  2⤵
  PID:7224
- C:\Windows\System\xgRvoeq.exe
  C:\Windows\System\xgRvoeq.exe
  2⤵
  PID:7268
- C:\Windows\System\wGAnIej.exe
  C:\Windows\System\wGAnIej.exe
  2⤵
  PID:7316
- C:\Windows\System\gtwsxPG.exe
  C:\Windows\System\gtwsxPG.exe
  2⤵
  PID:7252
- C:\Windows\System\hJTijLr.exe
  C:\Windows\System\hJTijLr.exe
  2⤵
  PID:7340
- C:\Windows\System\biinKmJ.exe
  C:\Windows\System\biinKmJ.exe
  2⤵
  PID:7356
- C:\Windows\System\oobvgFk.exe
  C:\Windows\System\oobvgFk.exe
  2⤵
  PID:7376
- C:\Windows\System\ZFerrRy.exe
  C:\Windows\System\ZFerrRy.exe
  2⤵
  PID:7432
- C:\Windows\System\CXuojVS.exe
  C:\Windows\System\CXuojVS.exe
  2⤵
  PID:7496
- C:\Windows\System\xyCChCm.exe
  C:\Windows\System\xyCChCm.exe
  2⤵
  PID:7556
- C:\Windows\System\lFNEouA.exe
  C:\Windows\System\lFNEouA.exe
  2⤵
  PID:7620
- C:\Windows\System\hzPfcDQ.exe
  C:\Windows\System\hzPfcDQ.exe
  2⤵
  PID:7608
- C:\Windows\System\jwHvajI.exe
  C:\Windows\System\jwHvajI.exe
  2⤵
  PID:7480
- C:\Windows\System\FdhsAOB.exe
  C:\Windows\System\FdhsAOB.exe
  2⤵
  PID:7656
- C:\Windows\System\ebxBseb.exe
  C:\Windows\System\ebxBseb.exe
  2⤵
  PID:7572
- C:\Windows\System\BzqlTFH.exe
  C:\Windows\System\BzqlTFH.exe
  2⤵
  PID:7688
- C:\Windows\System\dXykklg.exe
  C:\Windows\System\dXykklg.exe
  2⤵
  PID:7716
- C:\Windows\System\RVnkxAz.exe
  C:\Windows\System\RVnkxAz.exe
  2⤵
  PID:7752
- C:\Windows\System\LKOFbzi.exe
  C:\Windows\System\LKOFbzi.exe
  2⤵
  PID:7788
- C:\Windows\System\vKDtvGU.exe
  C:\Windows\System\vKDtvGU.exe
  2⤵
  PID:7816
- C:\Windows\System\gbTpNNU.exe
  C:\Windows\System\gbTpNNU.exe
  2⤵
  PID:7852
- C:\Windows\System\sCgEWvl.exe
  C:\Windows\System\sCgEWvl.exe
  2⤵
  PID:7916
- C:\Windows\System\wxccUhx.exe
  C:\Windows\System\wxccUhx.exe
  2⤵
  PID:7980
- C:\Windows\System\iFBBmmC.exe
  C:\Windows\System\iFBBmmC.exe
  2⤵
  PID:8044
- C:\Windows\System\PlxywWp.exe
  C:\Windows\System\PlxywWp.exe
  2⤵
  PID:8060
- C:\Windows\System\DYeAwYu.exe
  C:\Windows\System\DYeAwYu.exe
  2⤵
  PID:8092
- C:\Windows\System\QPnoWwy.exe
  C:\Windows\System\QPnoWwy.exe
  2⤵
  PID:8096
- C:\Windows\System\CgVBveU.exe
  C:\Windows\System\CgVBveU.exe
  2⤵
  PID:7900
- C:\Windows\System\riBRizC.exe
  C:\Windows\System\riBRizC.exe
  2⤵
  PID:8116
- C:\Windows\System\UwhImiQ.exe
  C:\Windows\System\UwhImiQ.exe
  2⤵
  PID:8176
- C:\Windows\System\YeouqjX.exe
  C:\Windows\System\YeouqjX.exe
  2⤵
  PID:8160
- C:\Windows\System\FRYWUJc.exe
  C:\Windows\System\FRYWUJc.exe
  2⤵
  PID:8164
- C:\Windows\System\bJIpAhH.exe
  C:\Windows\System\bJIpAhH.exe
  2⤵
  PID:7348
- C:\Windows\System\zefahUm.exe
  C:\Windows\System\zefahUm.exe
  2⤵
  PID:7400
- C:\Windows\System\qThXuLu.exe
  C:\Windows\System\qThXuLu.exe
  2⤵
  PID:7412
- C:\Windows\System\wtNEUWl.exe
  C:\Windows\System\wtNEUWl.exe
  2⤵
  PID:7592
- C:\Windows\System\sTIEDhw.exe
  C:\Windows\System\sTIEDhw.exe
  2⤵
  PID:7320
- C:\Windows\System\SJaiStS.exe
  C:\Windows\System\SJaiStS.exe
  2⤵
  PID:7476
- C:\Windows\System\TDupaSM.exe
  C:\Windows\System\TDupaSM.exe
  2⤵
  PID:7540
- C:\Windows\System\KrtWtRS.exe
  C:\Windows\System\KrtWtRS.exe
  2⤵
  PID:7748
- C:\Windows\System\zqFCPRR.exe
  C:\Windows\System\zqFCPRR.exe
  2⤵
  PID:7912
- C:\Windows\System\ovUJetV.exe
  C:\Windows\System\ovUJetV.exe
  2⤵
  PID:8088
- C:\Windows\System\YqwZzLR.exe
  C:\Windows\System\YqwZzLR.exe
  2⤵
  PID:7964
- C:\Windows\System\hSFxaxe.exe
  C:\Windows\System\hSFxaxe.exe
  2⤵
  PID:7336
- C:\Windows\System\eNUCAgb.exe
  C:\Windows\System\eNUCAgb.exe
  2⤵
  PID:7188
- C:\Windows\System\qoScIud.exe
  C:\Windows\System\qoScIud.exe
  2⤵
  PID:7492
- C:\Windows\System\aVxuSlR.exe
  C:\Windows\System\aVxuSlR.exe
  2⤵
  PID:7700
- C:\Windows\System\bOwqsUv.exe
  C:\Windows\System\bOwqsUv.exe
  2⤵
  PID:7720
- C:\Windows\System\TyMxNSD.exe
  C:\Windows\System\TyMxNSD.exe
  2⤵
  PID:8148
- C:\Windows\System\sYWjLUV.exe
  C:\Windows\System\sYWjLUV.exe
  2⤵
  PID:7848
- C:\Windows\System\DySzKYR.exe
  C:\Windows\System\DySzKYR.exe
  2⤵
  PID:8212
- C:\Windows\System\uETKWVL.exe
  C:\Windows\System\uETKWVL.exe
  2⤵
  PID:8228
- C:\Windows\System\hwBMwNI.exe
  C:\Windows\System\hwBMwNI.exe
  2⤵
  PID:8244
- C:\Windows\System\gdbDijH.exe
  C:\Windows\System\gdbDijH.exe
  2⤵
  PID:8260
- C:\Windows\System\qhfVZsd.exe
  C:\Windows\System\qhfVZsd.exe
  2⤵
  PID:8360
- C:\Windows\System\XNkXSjX.exe
  C:\Windows\System\XNkXSjX.exe
  2⤵
  PID:8380
- C:\Windows\System\yenaSLV.exe
  C:\Windows\System\yenaSLV.exe
  2⤵
  PID:8396
- C:\Windows\System\JIrwexR.exe
  C:\Windows\System\JIrwexR.exe
  2⤵
  PID:8412
- C:\Windows\System\hctDHwI.exe
  C:\Windows\System\hctDHwI.exe
  2⤵
  PID:8432
- C:\Windows\System\qPCTwbC.exe
  C:\Windows\System\qPCTwbC.exe
  2⤵
  PID:8448
- C:\Windows\System\EsXtGvV.exe
  C:\Windows\System\EsXtGvV.exe
  2⤵
  PID:8464
- C:\Windows\System\ScEFWkT.exe
  C:\Windows\System\ScEFWkT.exe
  2⤵
  PID:8480
- C:\Windows\System\vtxixVQ.exe
  C:\Windows\System\vtxixVQ.exe
  2⤵
  PID:8496
- C:\Windows\System\Yzxkmxr.exe
  C:\Windows\System\Yzxkmxr.exe
  2⤵
  PID:8516
- C:\Windows\System\ZyKkwiz.exe
  C:\Windows\System\ZyKkwiz.exe
  2⤵
  PID:8536
- C:\Windows\System\jvliudd.exe
  C:\Windows\System\jvliudd.exe
  2⤵
  PID:8552
- C:\Windows\System\ppudshD.exe
  C:\Windows\System\ppudshD.exe
  2⤵
  PID:8568
- C:\Windows\System\LJYrTPg.exe
  C:\Windows\System\LJYrTPg.exe
  2⤵
  PID:8584
- C:\Windows\System\XmPVkqS.exe
  C:\Windows\System\XmPVkqS.exe
  2⤵
  PID:8600
- C:\Windows\System\MFqfytL.exe
  C:\Windows\System\MFqfytL.exe
  2⤵
  PID:8620
- C:\Windows\System\eghqUhQ.exe
  C:\Windows\System\eghqUhQ.exe
  2⤵
  PID:8640
- C:\Windows\System\jKiwVYa.exe
  C:\Windows\System\jKiwVYa.exe
  2⤵
  PID:8656
- C:\Windows\System\nXOnhYQ.exe
  C:\Windows\System\nXOnhYQ.exe
  2⤵
  PID:8676
- C:\Windows\System\hSOStzO.exe
  C:\Windows\System\hSOStzO.exe
  2⤵
  PID:8696
- C:\Windows\System\mFrBvzR.exe
  C:\Windows\System\mFrBvzR.exe
  2⤵
  PID:8712
- C:\Windows\System\NfyPLhG.exe
  C:\Windows\System\NfyPLhG.exe
  2⤵
  PID:8788
- C:\Windows\System\gHvURTc.exe
  C:\Windows\System\gHvURTc.exe
  2⤵
  PID:8808
- C:\Windows\System\IXTFliW.exe
  C:\Windows\System\IXTFliW.exe
  2⤵
  PID:8828
- C:\Windows\System\cChvLym.exe
  C:\Windows\System\cChvLym.exe
  2⤵
  PID:8844
- C:\Windows\System\UdNAYuD.exe
  C:\Windows\System\UdNAYuD.exe
  2⤵
  PID:8860
- C:\Windows\System\YXmSzeo.exe
  C:\Windows\System\YXmSzeo.exe
  2⤵
  PID:8876
- C:\Windows\System\DyaWbxz.exe
  C:\Windows\System\DyaWbxz.exe
  2⤵
  PID:8892
- C:\Windows\System\ePlaHHh.exe
  C:\Windows\System\ePlaHHh.exe
  2⤵
  PID:8908
- C:\Windows\System\HQXbdXU.exe
  C:\Windows\System\HQXbdXU.exe
  2⤵
  PID:8924
- C:\Windows\System\GoJBghX.exe
  C:\Windows\System\GoJBghX.exe
  2⤵
  PID:8940
- C:\Windows\System\KKYSNPp.exe
  C:\Windows\System\KKYSNPp.exe
  2⤵
  PID:8960
- C:\Windows\System\fYmCPwQ.exe
  C:\Windows\System\fYmCPwQ.exe
  2⤵
  PID:8980
- C:\Windows\System\thIWfhy.exe
  C:\Windows\System\thIWfhy.exe
  2⤵
  PID:8996
- C:\Windows\System\mvNPvkq.exe
  C:\Windows\System\mvNPvkq.exe
  2⤵
  PID:9012
- C:\Windows\System\bMNZSjb.exe
  C:\Windows\System\bMNZSjb.exe
  2⤵
  PID:9028
- C:\Windows\System\MVayLQz.exe
  C:\Windows\System\MVayLQz.exe
  2⤵
  PID:9044
- C:\Windows\System\dmgtGnc.exe
  C:\Windows\System\dmgtGnc.exe
  2⤵
  PID:9060
- C:\Windows\System\rYCknHG.exe
  C:\Windows\System\rYCknHG.exe
  2⤵
  PID:9076
- C:\Windows\System\HVRhRpS.exe
  C:\Windows\System\HVRhRpS.exe
  2⤵
  PID:9092
- C:\Windows\System\iVdoCUd.exe
  C:\Windows\System\iVdoCUd.exe
  2⤵
  PID:9108
- C:\Windows\System\haDfFXG.exe
  C:\Windows\System\haDfFXG.exe
  2⤵
  PID:9124
- C:\Windows\System\XKbUHPw.exe
  C:\Windows\System\XKbUHPw.exe
  2⤵
  PID:9140
- C:\Windows\System\tHkpoBG.exe
  C:\Windows\System\tHkpoBG.exe
  2⤵
  PID:9156
- C:\Windows\System\GPflyDm.exe
  C:\Windows\System\GPflyDm.exe
  2⤵
  PID:9172
- C:\Windows\System\LNiXzME.exe
  C:\Windows\System\LNiXzME.exe
  2⤵
  PID:9188
- C:\Windows\System\LuisvJR.exe
  C:\Windows\System\LuisvJR.exe
  2⤵
  PID:9204
- C:\Windows\System\vPnnHvj.exe
  C:\Windows\System\vPnnHvj.exe
  2⤵
  PID:7672
- C:\Windows\System\WvXmQLz.exe
  C:\Windows\System\WvXmQLz.exe
  2⤵
  PID:8220
- C:\Windows\System\MElFztx.exe
  C:\Windows\System\MElFztx.exe
  2⤵
  PID:7284
- C:\Windows\System\SyAchmb.exe
  C:\Windows\System\SyAchmb.exe
  2⤵
  PID:7528
- C:\Windows\System\DCzOgDk.exe
  C:\Windows\System\DCzOgDk.exe
  2⤵
  PID:7800
- C:\Windows\System\mEqQoAA.exe
  C:\Windows\System\mEqQoAA.exe
  2⤵
  PID:8024
- C:\Windows\System\PmyTbvj.exe
  C:\Windows\System\PmyTbvj.exe
  2⤵
  PID:7236
- C:\Windows\System\GNcEIfI.exe
  C:\Windows\System\GNcEIfI.exe
  2⤵
  PID:8112
- C:\Windows\System\HWfUBTN.exe
  C:\Windows\System\HWfUBTN.exe
  2⤵
  PID:7864
- C:\Windows\System\IxxUCTe.exe
  C:\Windows\System\IxxUCTe.exe
  2⤵
  PID:8204
- C:\Windows\System\GeJTzoE.exe
  C:\Windows\System\GeJTzoE.exe
  2⤵
  PID:8240
- C:\Windows\System\WlBQdjk.exe
  C:\Windows\System\WlBQdjk.exe
  2⤵
  PID:8284
- C:\Windows\System\KOBcdwm.exe
  C:\Windows\System\KOBcdwm.exe
  2⤵
  PID:8308
- C:\Windows\System\pCoMatx.exe
  C:\Windows\System\pCoMatx.exe
  2⤵
  PID:8320
- C:\Windows\System\OuLMMZX.exe
  C:\Windows\System\OuLMMZX.exe
  2⤵
  PID:8332
- C:\Windows\System\doNXeSa.exe
  C:\Windows\System\doNXeSa.exe
  2⤵
  PID:8336
- C:\Windows\System\bzcBnqB.exe
  C:\Windows\System\bzcBnqB.exe
  2⤵
  PID:8404
- C:\Windows\System\rrzlzwq.exe
  C:\Windows\System\rrzlzwq.exe
  2⤵
  PID:8472
- C:\Windows\System\cSGPnnz.exe
  C:\Windows\System\cSGPnnz.exe
  2⤵
  PID:8544
- C:\Windows\System\sEmqNJW.exe
  C:\Windows\System\sEmqNJW.exe
  2⤵
  PID:8612
- C:\Windows\System\XgwDHcV.exe
  C:\Windows\System\XgwDHcV.exe
  2⤵
  PID:8548
- C:\Windows\System\SwBlRrX.exe
  C:\Windows\System\SwBlRrX.exe
  2⤵
  PID:8684
- C:\Windows\System\KZPxNIR.exe
  C:\Windows\System\KZPxNIR.exe
  2⤵
  PID:8628
- C:\Windows\System\gItfDeV.exe
  C:\Windows\System\gItfDeV.exe
  2⤵
  PID:8524
- C:\Windows\System\XlLVdZF.exe
  C:\Windows\System\XlLVdZF.exe
  2⤵
  PID:8428
- C:\Windows\System\ghHASIk.exe
  C:\Windows\System\ghHASIk.exe
  2⤵
  PID:8668
- C:\Windows\System\ArxJUqr.exe
  C:\Windows\System\ArxJUqr.exe
  2⤵
  PID:8392
- C:\Windows\System\xxvQpUv.exe
  C:\Windows\System\xxvQpUv.exe
  2⤵
  PID:8592
- C:\Windows\System\MNitBAm.exe
  C:\Windows\System\MNitBAm.exe
  2⤵
  PID:8728
- C:\Windows\System\rBLuPCM.exe
  C:\Windows\System\rBLuPCM.exe
  2⤵
  PID:8744
- C:\Windows\System\CjpGeuM.exe
  C:\Windows\System\CjpGeuM.exe
  2⤵
  PID:8760
- C:\Windows\System\sAcHCqy.exe
  C:\Windows\System\sAcHCqy.exe
  2⤵
  PID:8776
- C:\Windows\System\RGpVsDK.exe
  C:\Windows\System\RGpVsDK.exe
  2⤵
  PID:8824
- C:\Windows\System\vsUAweP.exe
  C:\Windows\System\vsUAweP.exe
  2⤵
  PID:8796
- C:\Windows\System\ToZKzBR.exe
  C:\Windows\System\ToZKzBR.exe
  2⤵
  PID:8868
- C:\Windows\System\ZcXEarS.exe
  C:\Windows\System\ZcXEarS.exe
  2⤵
  PID:8872
- C:\Windows\System\pIPmrhU.exe
  C:\Windows\System\pIPmrhU.exe
  2⤵
  PID:8920
- C:\Windows\System\IVitJvK.exe
  C:\Windows\System\IVitJvK.exe
  2⤵
  PID:8900
- C:\Windows\System\NytPmLV.exe
  C:\Windows\System\NytPmLV.exe
  2⤵
  PID:8992
- C:\Windows\System\AIENaAW.exe
  C:\Windows\System\AIENaAW.exe
  2⤵
  PID:9056
- C:\Windows\System\oKeQsEH.exe
  C:\Windows\System\oKeQsEH.exe
  2⤵
  PID:9040
- C:\Windows\System\iLxcszA.exe
  C:\Windows\System\iLxcszA.exe
  2⤵
  PID:9152
- C:\Windows\System\QvPpxiz.exe
  C:\Windows\System\QvPpxiz.exe
  2⤵
  PID:9008
- C:\Windows\System\rDcJVmc.exe
  C:\Windows\System\rDcJVmc.exe
  2⤵
  PID:9132
- C:\Windows\System\FWmwdne.exe
  C:\Windows\System\FWmwdne.exe
  2⤵
  PID:9212
- C:\Windows\System\XgKNbaB.exe
  C:\Windows\System\XgKNbaB.exe
  2⤵
  PID:8252
- C:\Windows\System\GMzZvNt.exe
  C:\Windows\System\GMzZvNt.exe
  2⤵
  PID:7364
- C:\Windows\System\rjfRtqE.exe
  C:\Windows\System\rjfRtqE.exe
  2⤵
  PID:8200
- C:\Windows\System\JLbNAFa.exe
  C:\Windows\System\JLbNAFa.exe
  2⤵
  PID:8328
- C:\Windows\System\GGVxYgQ.exe
  C:\Windows\System\GGVxYgQ.exe
  2⤵
  PID:9200
- C:\Windows\System\dKZcLiq.exe
  C:\Windows\System\dKZcLiq.exe
  2⤵
  PID:7524
- C:\Windows\System\ONfnWPT.exe
  C:\Windows\System\ONfnWPT.exe
  2⤵
  PID:8636
- C:\Windows\System\zbwHmiS.exe
  C:\Windows\System\zbwHmiS.exe
  2⤵
  PID:8704
- C:\Windows\System\NDzRnTE.exe
  C:\Windows\System\NDzRnTE.exe
  2⤵
  PID:7640
- C:\Windows\System\igXxOpK.exe
  C:\Windows\System\igXxOpK.exe
  2⤵
  PID:7996
- C:\Windows\System\GCHGUkT.exe
  C:\Windows\System\GCHGUkT.exe
  2⤵
  PID:8144
- C:\Windows\System\PPDQHrU.exe
  C:\Windows\System\PPDQHrU.exe
  2⤵
  PID:8608
- C:\Windows\System\WmaTUVa.exe
  C:\Windows\System\WmaTUVa.exe
  2⤵
  PID:8340
- C:\Windows\System\WcUKFHn.exe
  C:\Windows\System\WcUKFHn.exe
  2⤵
  PID:8560
- C:\Windows\System\vLpVBoa.exe
  C:\Windows\System\vLpVBoa.exe
  2⤵
  PID:8596
- C:\Windows\System\FipwAyI.exe
  C:\Windows\System\FipwAyI.exe
  2⤵
  PID:8772
- C:\Windows\System\mbbElqH.exe
  C:\Windows\System\mbbElqH.exe
  2⤵
  PID:8804
- C:\Windows\System\ZpjCvKx.exe
  C:\Windows\System\ZpjCvKx.exe
  2⤵
  PID:8836
- C:\Windows\System\WEwYYtx.exe
  C:\Windows\System\WEwYYtx.exe
  2⤵
  PID:9088
- C:\Windows\System\ulXFnAj.exe
  C:\Windows\System\ulXFnAj.exe
  2⤵
  PID:9120
- C:\Windows\System\VaMSQIc.exe
  C:\Windows\System\VaMSQIc.exe
  2⤵
  PID:9004
- C:\Windows\System\KGeGUcJ.exe
  C:\Windows\System\KGeGUcJ.exe
  2⤵
  PID:8304
- C:\Windows\System\LXFcSWR.exe
  C:\Windows\System\LXFcSWR.exe
  2⤵
  PID:8456
- C:\Windows\System\woCIkNN.exe
  C:\Windows\System\woCIkNN.exe
  2⤵
  PID:8756
- C:\Windows\System\srfkgTT.exe
  C:\Windows\System\srfkgTT.exe
  2⤵
  PID:8632
- C:\Windows\System\EcLplmN.exe
  C:\Windows\System\EcLplmN.exe
  2⤵
  PID:8652
- C:\Windows\System\aYBphys.exe
  C:\Windows\System\aYBphys.exe
  2⤵
  PID:8740
- C:\Windows\System\JVBVUeu.exe
  C:\Windows\System\JVBVUeu.exe
  2⤵
  PID:8856
- C:\Windows\System\pUWBHjg.exe
  C:\Windows\System\pUWBHjg.exe
  2⤵
  PID:9052
- C:\Windows\System\WuDUZEW.exe
  C:\Windows\System\WuDUZEW.exe
  2⤵
  PID:8888
- C:\Windows\System\aoogdji.exe
  C:\Windows\System\aoogdji.exe
  2⤵
  PID:9168
- C:\Windows\System\QLpCQQm.exe
  C:\Windows\System\QLpCQQm.exe
  2⤵
  PID:9136
- C:\Windows\System\wIBFCeB.exe
  C:\Windows\System\wIBFCeB.exe
  2⤵
  PID:9224
- C:\Windows\System\IrbhntC.exe
  C:\Windows\System\IrbhntC.exe
  2⤵
  PID:9240
- C:\Windows\System\zjFMVTW.exe
  C:\Windows\System\zjFMVTW.exe
  2⤵
  PID:9256
- C:\Windows\System\LiPFTcI.exe
  C:\Windows\System\LiPFTcI.exe
  2⤵
  PID:9276
- C:\Windows\System\wVIOvYq.exe
  C:\Windows\System\wVIOvYq.exe
  2⤵
  PID:9292
- C:\Windows\System\XveIvVA.exe
  C:\Windows\System\XveIvVA.exe
  2⤵
  PID:9308
- C:\Windows\System\GaUpCiH.exe
  C:\Windows\System\GaUpCiH.exe
  2⤵
  PID:9324
- C:\Windows\System\ZaJzRbm.exe
  C:\Windows\System\ZaJzRbm.exe
  2⤵
  PID:9344
- C:\Windows\System\UlkZDBC.exe
  C:\Windows\System\UlkZDBC.exe
  2⤵
  PID:9360
- C:\Windows\System\ZaYfUaa.exe
  C:\Windows\System\ZaYfUaa.exe
  2⤵
  PID:9376
- C:\Windows\System\iKeNWRs.exe
  C:\Windows\System\iKeNWRs.exe
  2⤵
  PID:9392
- C:\Windows\System\JTMGPAv.exe
  C:\Windows\System\JTMGPAv.exe
  2⤵
  PID:9412
- C:\Windows\System\kzgukfZ.exe
  C:\Windows\System\kzgukfZ.exe
  2⤵
  PID:9428
- C:\Windows\System\uTTMWGD.exe
  C:\Windows\System\uTTMWGD.exe
  2⤵
  PID:9444
- C:\Windows\System\aYyaYQj.exe
  C:\Windows\System\aYyaYQj.exe
  2⤵
  PID:9460
- C:\Windows\System\oOzPyMV.exe
  C:\Windows\System\oOzPyMV.exe
  2⤵
  PID:9480
- C:\Windows\System\zCaMNGk.exe
  C:\Windows\System\zCaMNGk.exe
  2⤵
  PID:9496
- C:\Windows\System\bAmQWrz.exe
  C:\Windows\System\bAmQWrz.exe
  2⤵
  PID:9512
- C:\Windows\System\JOARlLl.exe
  C:\Windows\System\JOARlLl.exe
  2⤵
  PID:9528
- C:\Windows\System\AeyEyDQ.exe
  C:\Windows\System\AeyEyDQ.exe
  2⤵
  PID:9544
- C:\Windows\System\vCCfiUf.exe
  C:\Windows\System\vCCfiUf.exe
  2⤵
  PID:9564
- C:\Windows\System\gSdtPVs.exe
  C:\Windows\System\gSdtPVs.exe
  2⤵
  PID:9580
- C:\Windows\System\wxfjnvQ.exe
  C:\Windows\System\wxfjnvQ.exe
  2⤵
  PID:9596
- C:\Windows\System\MlItBjM.exe
  C:\Windows\System\MlItBjM.exe
  2⤵
  PID:9612
- C:\Windows\System\vusirNn.exe
  C:\Windows\System\vusirNn.exe
  2⤵
  PID:9628
- C:\Windows\System\Tbxurif.exe
  C:\Windows\System\Tbxurif.exe
  2⤵
  PID:9648
- C:\Windows\System\ccYenpW.exe
  C:\Windows\System\ccYenpW.exe
  2⤵
  PID:9664
- C:\Windows\System\QNYUDBL.exe
  C:\Windows\System\QNYUDBL.exe
  2⤵
  PID:9680
- C:\Windows\System\zPKliNX.exe
  C:\Windows\System\zPKliNX.exe
  2⤵
  PID:9708
- C:\Windows\System\lJfAxZO.exe
  C:\Windows\System\lJfAxZO.exe
  2⤵
  PID:9724
- C:\Windows\System\fZtWOhP.exe
  C:\Windows\System\fZtWOhP.exe
  2⤵
  PID:9740
- C:\Windows\System\aFSphFO.exe
  C:\Windows\System\aFSphFO.exe
  2⤵
  PID:9756
- C:\Windows\System\QiNJqst.exe
  C:\Windows\System\QiNJqst.exe
  2⤵
  PID:9776
- C:\Windows\System\AGbWTQt.exe
  C:\Windows\System\AGbWTQt.exe
  2⤵
  PID:9792
- C:\Windows\System\zhthuwk.exe
  C:\Windows\System\zhthuwk.exe
  2⤵
  PID:9808
- C:\Windows\System\BsnZJaS.exe
  C:\Windows\System\BsnZJaS.exe
  2⤵
  PID:9824
- C:\Windows\System\UPIzCJr.exe
  C:\Windows\System\UPIzCJr.exe
  2⤵
  PID:9840
- C:\Windows\System\WsctSFL.exe
  C:\Windows\System\WsctSFL.exe
  2⤵
  PID:9856
- C:\Windows\System\YfoMXGI.exe
  C:\Windows\System\YfoMXGI.exe
  2⤵
  PID:9872
- C:\Windows\System\dpDTypK.exe
  C:\Windows\System\dpDTypK.exe
  2⤵
  PID:9888
- C:\Windows\System\cmbRaIZ.exe
  C:\Windows\System\cmbRaIZ.exe
  2⤵
  PID:9904
- C:\Windows\System\GcDpDvu.exe
  C:\Windows\System\GcDpDvu.exe
  2⤵
  PID:9924
- C:\Windows\System\IJNkjNv.exe
  C:\Windows\System\IJNkjNv.exe
  2⤵
  PID:9940
- C:\Windows\System\AZLJlwi.exe
  C:\Windows\System\AZLJlwi.exe
  2⤵
  PID:9960
- C:\Windows\System\SlEMDDN.exe
  C:\Windows\System\SlEMDDN.exe
  2⤵
  PID:9976
- C:\Windows\System\YfXaoWN.exe
  C:\Windows\System\YfXaoWN.exe
  2⤵
  PID:9992
- C:\Windows\System\xsFLOwo.exe
  C:\Windows\System\xsFLOwo.exe
  2⤵
  PID:10008
- C:\Windows\System\VpOKtxd.exe
  C:\Windows\System\VpOKtxd.exe
  2⤵
  PID:10024
- C:\Windows\System\AUlZiLw.exe
  C:\Windows\System\AUlZiLw.exe
  2⤵
  PID:10040
- C:\Windows\System\KXIkcFM.exe
  C:\Windows\System\KXIkcFM.exe
  2⤵
  PID:10056
- C:\Windows\System\IZaUCyX.exe
  C:\Windows\System\IZaUCyX.exe
  2⤵
  PID:10072
- C:\Windows\System\BtNFioA.exe
  C:\Windows\System\BtNFioA.exe
  2⤵
  PID:10088
- C:\Windows\System\vjIKUaH.exe
  C:\Windows\System\vjIKUaH.exe
  2⤵
  PID:10120
- C:\Windows\System\aJSwsZg.exe
  C:\Windows\System\aJSwsZg.exe
  2⤵
  PID:10136
- C:\Windows\System\IZIZegb.exe
  C:\Windows\System\IZIZegb.exe
  2⤵
  PID:10152
- C:\Windows\System\AwFpJXF.exe
  C:\Windows\System\AwFpJXF.exe
  2⤵
  PID:10168
- C:\Windows\System\oaKWrpi.exe
  C:\Windows\System\oaKWrpi.exe
  2⤵
  PID:10184
- C:\Windows\System\cUJTNhG.exe
  C:\Windows\System\cUJTNhG.exe
  2⤵
  PID:10200
- C:\Windows\System\VpJKoWp.exe
  C:\Windows\System\VpJKoWp.exe
  2⤵
  PID:10216
- C:\Windows\System\tlCwagb.exe
  C:\Windows\System\tlCwagb.exe
  2⤵
  PID:10232
- C:\Windows\System\apuehPc.exe
  C:\Windows\System\apuehPc.exe
  2⤵
  PID:8916
- C:\Windows\System\oPcsPRY.exe
  C:\Windows\System\oPcsPRY.exe
  2⤵
  PID:7820
- C:\Windows\System\TzCOkRQ.exe
  C:\Windows\System\TzCOkRQ.exe
  2⤵
  PID:8724
- C:\Windows\System\kfCnMQU.exe
  C:\Windows\System\kfCnMQU.exe
  2⤵
  PID:8508
- C:\Windows\System\MGjVkVh.exe
  C:\Windows\System\MGjVkVh.exe
  2⤵
  PID:8648
- C:\Windows\System\KzXKHiX.exe
  C:\Windows\System\KzXKHiX.exe
  2⤵
  PID:1000
- C:\Windows\System\lEyWRJQ.exe
  C:\Windows\System\lEyWRJQ.exe
  2⤵
  PID:8224
- C:\Windows\System\DZxyGsy.exe
  C:\Windows\System\DZxyGsy.exe
  2⤵
  PID:9264
- C:\Windows\System\vVZOnlw.exe
  C:\Windows\System\vVZOnlw.exe
  2⤵
  PID:9352
- C:\Windows\System\XBRvdCI.exe
  C:\Windows\System\XBRvdCI.exe
  2⤵
  PID:9284
- C:\Windows\System\itPRfeI.exe
  C:\Windows\System\itPRfeI.exe
  2⤵
  PID:9272
- C:\Windows\System\JbSlhfm.exe
  C:\Windows\System\JbSlhfm.exe
  2⤵
  PID:9340
- C:\Windows\System\zOAyIOF.exe
  C:\Windows\System\zOAyIOF.exe
  2⤵
  PID:9408
- C:\Windows\System\LZikzRq.exe
  C:\Windows\System\LZikzRq.exe
  2⤵
  PID:9476
- C:\Windows\System\ULEjJdt.exe
  C:\Windows\System\ULEjJdt.exe
  2⤵
  PID:9540
- C:\Windows\System\VyfaBKB.exe
  C:\Windows\System\VyfaBKB.exe
  2⤵
  PID:9608
- C:\Windows\System\bomIAft.exe
  C:\Windows\System\bomIAft.exe
  2⤵
  PID:9672
- C:\Windows\System\hcPZbIn.exe
  C:\Windows\System\hcPZbIn.exe
  2⤵
  PID:9424
- C:\Windows\System\YEnhjHC.exe
  C:\Windows\System\YEnhjHC.exe
  2⤵
  PID:9748
- C:\Windows\System\kKZhAJH.exe
  C:\Windows\System\kKZhAJH.exe
  2⤵
  PID:9784
- C:\Windows\System\vrzMzFJ.exe
  C:\Windows\System\vrzMzFJ.exe
  2⤵
  PID:9492
- C:\Windows\System\YjcuUAT.exe
  C:\Windows\System\YjcuUAT.exe
  2⤵
  PID:9556
- C:\Windows\System\AKQuCoy.exe
  C:\Windows\System\AKQuCoy.exe
  2⤵
  PID:9620
- C:\Windows\System\ocABHCH.exe
  C:\Windows\System\ocABHCH.exe
  2⤵
  PID:9696
- C:\Windows\System\zGJspSN.exe
  C:\Windows\System\zGJspSN.exe
  2⤵
  PID:9736
- C:\Windows\System\fBMjbQo.exe
  C:\Windows\System\fBMjbQo.exe
  2⤵
  PID:9816
- C:\Windows\System\AvajjfC.exe
  C:\Windows\System\AvajjfC.exe
  2⤵
  PID:9880
- C:\Windows\System\igNTBOb.exe
  C:\Windows\System\igNTBOb.exe
  2⤵
  PID:9864
- C:\Windows\System\LXIZjuk.exe
  C:\Windows\System\LXIZjuk.exe
  2⤵
  PID:9800
- C:\Windows\System\dTMqFSf.exe
  C:\Windows\System\dTMqFSf.exe
  2⤵
  PID:9920
- C:\Windows\System\DXtHSnE.exe
  C:\Windows\System\DXtHSnE.exe
  2⤵
  PID:9984
- C:\Windows\System\iZIClRo.exe
  C:\Windows\System\iZIClRo.exe
  2⤵
  PID:10048
- C:\Windows\System\HqXusjY.exe
  C:\Windows\System\HqXusjY.exe
  2⤵
  PID:10128
- C:\Windows\System\fNQsXGi.exe
  C:\Windows\System\fNQsXGi.exe
  2⤵
  PID:10192
- C:\Windows\System\VfIdiPX.exe
  C:\Windows\System\VfIdiPX.exe
  2⤵
  PID:8988
- C:\Windows\System\imTaOkd.exe
  C:\Windows\System\imTaOkd.exe
  2⤵
  PID:8904
- C:\Windows\System\LorXUgN.exe
  C:\Windows\System\LorXUgN.exe
  2⤵
  PID:9316
- C:\Windows\System\yffvIzf.exe
  C:\Windows\System\yffvIzf.exe
  2⤵
  PID:9468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJvDnkO.exe

Filesize
2.1MB

MD5
b2a03d36e53ae3ef241f2335cc499504

SHA1
b88e8529990c07025878448b2816d5ac0d66cef0

SHA256
675e32c39ad4cddc856681ea1846c9067fd20e427f19993ec2ca86e688e2ed12

SHA512
7ed6269d622ae84f5b9ab0c758534fbd680ef20dd774679f1068d2513d8a9f2159017f54b8c7308eadfc831c6ea858909daebdcb147be6f56be6637e379042c3

Download Submit
C:\Windows\system\AdNSJmF.exe

Filesize
2.1MB

MD5
6e0401219acd998c557782539fae04a0

SHA1
4d8cb90ba4a6563ab192fddf51071d5313218f53

SHA256
56141f0f619ad18fdda13d4e6c3065e5320d9659a0a471dbdf29159416bc098d

SHA512
71359c9b63b58da89c9544ab4fadfd34b86572013a30305cb4ba0aa13b287742612248f63449a0d99fcbf48b013781b7662610b895e4c20cf0f2fea55ce016ff

Download Submit
C:\Windows\system\CCzJFUV.exe

Filesize
2.0MB

MD5
37ee973e1351223e52e1582d14fa59fd

SHA1
dbdb29e5a151d4aa07f3e1ca504e6b53dba5dafd

SHA256
174918babe9120065e944eff41fcf0bcbc3c3117dcdcaffe4c2300865cf67e74

SHA512
44f03c6eb984873653ec17752890a67fd10ce00b1e5788296821ea6836de65e941eaa4ce6403206ca837e7276de6b4a01dcc30720de21453452b9d84c285aad6

Download Submit
C:\Windows\system\CUeZXyd.exe

Filesize
2.1MB

MD5
76166ec583318412aef2af9c01ff9953

SHA1
0baf52cc718e816919adf779eb762f34aa83a9d6

SHA256
f3d176701bf1c9e182f47495f3143380573acaf07e13b294fcb444da40d8c7bb

SHA512
906ae65bd0bdb02ac7ff01c4f32977aa6a05973f187a7436515139bf16600e3a1473807a2e5af0c46ce230a5f45ca1978938fb79498219bca685b845dfef6176

Download Submit
C:\Windows\system\DNYDjlh.exe

Filesize
2.0MB

MD5
32378e5ba51b9e62fba534e40e5989e8

SHA1
ea2c4fc61718ff9230909fb84b129ea42f92e6f2

SHA256
3d88b92c72e7634ba3107db9764abafc460ccd4c178547d654d8782f66a44105

SHA512
f95dcaf27e6cd3cb9ac3f4cf74cc27a1cd5e55da99748cce1d6176b9c0742b03ce5b1ef6171432b79861a416f0e6735614339c015adc7de191b922a6ea8ba757

Download Submit
C:\Windows\system\DvlbBFS.exe

Filesize
2.1MB

MD5
a7931ea15654b215a8743ba46f4df3ca

SHA1
06aeda0d0f0c177085c43e768131555b740b20a0

SHA256
13af15fe71caf3ab70c4f2b6679da21f1cfd36cc3d324a6ec333d3c3a8400eda

SHA512
75fb17388dcfecdcf46c62db6389e93b6864ac82fbf5ee9f9e078447ee3401772e940d36d940f824b2e2b6bb2f433dbef17ae96996fdf6abd50ada49461eaccd

Download Submit
C:\Windows\system\GvUwTuB.exe

Filesize
2.0MB

MD5
5bc2e322081baa4e3363f96bb456ff30

SHA1
e8ffd79d74a22fab767681b2ffa1218f94083da1

SHA256
a28daf305f045a36ca376cd7dd8f37f8c2971ce64da69deeef80fc656d030eb0

SHA512
33f0053fda29a556fc3f2403c6d2b05a7c2d18ca2170378ecf593b27f8c0a12220c7e00adf41916ba4b9b986fffbc57da033d19a02842171637ea5c2b3ffbdd3

Download Submit
C:\Windows\system\HOBvkDD.exe

Filesize
2.1MB

MD5
f8693aebc8f94dd6f415d73ca3eac309

SHA1
c87e17e2da1af448e22e9abcf82fbca3e97f0549

SHA256
a0aa732ce3a46ee68f4e7fff4c568f0fa98bd96a748d45a4871938b677da0bee

SHA512
b9ce65c28c625c961afafd15f3de1ef44c81f340150e88b6f2182bd1a3690b0a317b434344ce1a6cc9f25f3e1d70fd45c9c9156ea1b97ee3be39c1003563b42d

Download Submit
C:\Windows\system\JvzUBVw.exe

Filesize
2.0MB

MD5
1f5c97016d0cadcbe67121acc143bce5

SHA1
590263ef393cc3d9787ffeff9d52820e474cc64e

SHA256
fa9a1a4afcc260a64339ea857fac001579b754fdb41ef7378791f01dc7bc8cf6

SHA512
d603ff8cf8c9f2b4d4764d9bb53dfb6aad68df0cd326fc7ba6795df30d2da7faf23b4dc39b73e6f522dce14bc2732348400c14db70ed2a0454d2fadae24e402b

Download Submit
C:\Windows\system\LCeMKEg.exe

Filesize
2.1MB

MD5
1c65b6f4370cd471990f953ac9306ed5

SHA1
422e3f01706704cfb9741657306186e25a658510

SHA256
1bd91cbde9a5952c5a41bd3038512e95fb9ce74101e37991302e007c4fba05d4

SHA512
859f17775c0fde0c66a5885056a4617af207c94a8e9a899e7dd1cafe05289c5f1bf7ca40a9e8654c56b9b02503185f47f25a29c23ce6da2f61b86d8f88300f38

Download Submit
C:\Windows\system\LvmCgsE.exe

Filesize
2.1MB

MD5
106f420f0e7babd86f08a5b5dfc5749f

SHA1
862ce29067ff87b9e5fda26df35a8a14ada95265

SHA256
22321e8e720bf082e69ce39a058cee0a0aa7599dddd1bbdc833cb0bdc2f5cd58

SHA512
3d1b3ab192ea84894ad4417ceaecfd289e059b6fec468b2ea4b115b6b0976431fb3bbbf1ed911bb3cfac1b298f1973efa33f7c1f396df324109967429aef4267

Download Submit
C:\Windows\system\NMVKOus.exe

Filesize
2.1MB

MD5
6fed17e9f29ed18dce18d1ec2c385d44

SHA1
461a12ef582ae5aa7ba2acd47969229ad894ed1c

SHA256
50c101d5c3e26d607a510cd645aeac9f6f774035d731065bb8b07603055242ce

SHA512
92b08e489d2cb451ba208658588c19163965867b6613b5cd4628dd2f3e3dd1cb09c1c900f1170061521c4b0d5ebdf7b8a969c8abd97477af2f372db847cea75e

Download Submit
C:\Windows\system\OFxebdS.exe

Filesize
2.0MB

MD5
bf6feeab20012922b15fd9f93af4799c

SHA1
9c25943be6f3e7bb07a34e66cef0c4a94a226bcd

SHA256
863889e003b5ee6817c585c2282ebf0c23fe58334d4f95d642294be657c3b1d7

SHA512
09a243309114077c27af8769b69102be88c2ccac4c6c5dce83f3448594cd48bbb8c64fa94d14feb65105f7c414bf54f84891d17ae6e1d00eaba9af01e4254f73

Download Submit
C:\Windows\system\OUnMdoC.exe

Filesize
2.1MB

MD5
9297b745afdea470c94a64bbd3a252b9

SHA1
492956361344c4c79a936bc0589e07a8ac0b3467

SHA256
58a8eca034c37cf4a873371e63863bbab8a7c2525eff099e27b1226b7f20da34

SHA512
c7e59ec7ff7c313b1960f3f8e57062ce03f1b202ee855de68c1d2c4c8f021ff8b61bb43eddf41b7e0a129bf4a44d859bf756760fc3dc9a9a47a272fef8959eba

Download Submit
C:\Windows\system\RFdhyPz.exe

Filesize
2.1MB

MD5
1e8f28ff54ad787ade12b3b4bcc82db2

SHA1
a6b95dc6b988d0d02a61947d28480fcc5892c3ca

SHA256
ef0cd13595ce9f174d00355feaf55985b0561ca99bfd651c1240b2c371a90dd2

SHA512
e8798da9e7bb160e12478e8404ce71c6e8fd4dd057752ba2c7fb2d428522138aa9ed8243e83c023605f77a984c91ecc39b70f899fff8ce0e20427efc5eb02cfd

Download Submit
C:\Windows\system\UOUFfSG.exe

Filesize
2.0MB

MD5
f80f239cba96bb741be47b34a3d32bb2

SHA1
2b85d9a2fd5c556e161c756ac24119f47ff35454

SHA256
66957018167f4d8138b123eeb3cbf8f6b16d1ea79de659c1961d9f3cd9fbdde6

SHA512
998f0cfa7283ae789748e3012ff08470cafc35f52d88fa59ef9526b0a12df86de6f4704b8503a8c7f16e416269f3fa80c8c9f07934e264766485822259dd5652

Download Submit
C:\Windows\system\WxoiEoV.exe

Filesize
2.1MB

MD5
c839fe3cd8ed4e87de6bf3e319db0036

SHA1
6b87fe584b186a8483bcea75b1560d34319b5723

SHA256
a913c54d91eb527cf8dfb60cd3570779bc6073d3ad45257391fc01efbba5b99c

SHA512
d463056e36297cbe20e0d30e0f5b495caed9babd2046568aea3030903edd80e63686a58df0e7b3671d82a17843cb8f5d55ffb6fc00fd40039707b90947fe21bd

Download Submit
C:\Windows\system\YlCdiRs.exe

Filesize
2.1MB

MD5
e2d4d758f7cea9d47d5df0047d433220

SHA1
4b5bb37dffa545850153d43664850910d8c16365

SHA256
b83804fea0b02af0a71f55b43e41e9ed7119da8a65cddd7a001666211b407732

SHA512
59769a6006c120e3ce3edabab72deb4b12cbffa10f48817f334b53717ed64ca568eafc187c7688c691f40296c57ab6bcb0e4449fc572e563136c46d6c4461c9e

Download Submit
C:\Windows\system\ZrxEQOd.exe

Filesize
2.1MB

MD5
22e112f851eca4cc53f6e0c2f6c16d96

SHA1
576d78359f78fbd631ae65bb2530a8d6dc6d1d1d

SHA256
16314ba352295281461c3943abd8aad950bc6ba4cceb6f1c6bf2e0ae8e763912

SHA512
7a4749bad1d592c25fd80a772558795eb44d650becb387134c07c04e2b7d3045bc30488ae242a9b576ef313146842333681750e7d589be8392113fa79ec0d320

Download Submit
C:\Windows\system\aPOGhPb.exe

Filesize
2.0MB

MD5
255e4592992fdafeb5c490a66f4761ba

SHA1
ac742d6b5d73e1a04256b13467787832e24a1d64

SHA256
1af2533a7ab502c75d9e72239a53e08776d5fed5aacf8638db4e3dbc4c136cf2

SHA512
f6477782b1fcedc2b2e60b295191ab6c1a1463fd2d69c4d1bfc3c9863cc7e8bfe456c656e3e93ba5f2a6be0c35987d72fe2d096bf78156c9d24b1a77967b353e

Download Submit
C:\Windows\system\caKJuop.exe

Filesize
2.0MB

MD5
310f20e7cc4c690f385c7656c4a5df90

SHA1
14eed803e92492158a42bf82b7d6923ada66e5cc

SHA256
98ce7561101b529f1f5f0434b422f6ae9f637db953021c39c6d020e03ea068cf

SHA512
39eeed970c988e54ec09839340fdc8cf7e079b82c1e786d3705604366b6a140bcbb6800f70517832ece0353b48afe7ba6cb03762ecf3fe8d5b7a5934973c409c

Download Submit
C:\Windows\system\gGRnhhI.exe

Filesize
2.1MB

MD5
4557e722fb1d1dbdc11e8d6132093d18

SHA1
a36df0b9ed2ef822208de50354169ab070810b17

SHA256
e503093c60472749615d30ff66d680f1847414a3e30f94222221ca5a18373a35

SHA512
f09a9355424be010f3facd86c07e97a2be819b2ddb19e8ac567bf84b3994ec1a13f51e4e98c1f600e518e1431ce41e1c118f0dcd7d8298efaf66884f3d740f31

Download Submit
C:\Windows\system\ivCGnZU.exe

Filesize
2.1MB

MD5
4b35022ab53d9e5a26b005071e7c7c5b

SHA1
dec1680fd8f4b5153493af2a259dc59df6381741

SHA256
318b959b5651342cb7511f0bc47369e0d05015dba7d40c03cf21987172b1aba6

SHA512
c962232b6cf730cc4cf130208f749f71961bbd59de88222c24cb2d3bb043633b747f1808a335c55fba632688d6f1a976dd21a931025becf5611199927ea570b6

Download Submit
C:\Windows\system\jZuDAvQ.exe

Filesize
2.1MB

MD5
46e80cce9ea513e7879d9aaa69e4921b

SHA1
4e63cb152cbdbea955e5f5651d5ad81a3c5b0326

SHA256
f7321c77e0eaad2ea9d34b7c9ac641917f3d622838a51645614575a385ce655f

SHA512
32de3767bc56feff5b7583eab763ae673f04abb264637ea1e57affe31a84256725e6ae7d2506aba128d84a4d1a4de2a368e30ee4377049801890c0dd1db4abd7

Download Submit
C:\Windows\system\ozClxEY.exe

Filesize
2.1MB

MD5
8e7fde849e0f3e283f3c4a865606303e

SHA1
f45dba6aba65777b77348e0eb713d7073ff2750c

SHA256
9f417bbeaad2aa28f4c762c087a1e02be1e23f3d78a5ae0789672f93ffef32d5

SHA512
e5b8f22da8a6aafce7f237726738b3414b619a3177ce4565a5148c626909cd6ac27ba0f6db1dce2aad9342060a6130c02063978d90b69cc92e16e4661b134623

Download Submit
C:\Windows\system\rrqZRts.exe

Filesize
2.0MB

MD5
430ffb025e4376a56a9af5e778ce0113

SHA1
fa3020f296c3ca8c74855fa48ba6c6d882eef6f7

SHA256
dc6fbd0df55adfa8a72b95c30ed1e456cfb5f1ff2e943dfafa65b795cb5c0fdf

SHA512
27a5cf84d4605a02cc313370bc5c6505e81c3f0b40e7ae1d1728a0ce9a7169b5a772c55bffa2f1e06154ae834e78e81cc40764d0fff4263ced54d434b061813e

Download Submit
C:\Windows\system\szMiFWQ.exe

Filesize
2.0MB

MD5
d62e07addc4cdfcffa79faffe00cf6c4

SHA1
e7784a1bf64d3ac01ee1b0e37d99b81fd344de11

SHA256
14cfa54251f4fe27269e6521e73c7ac85a2d5cc585869d829c7ab50cccdc46d3

SHA512
d56c7bd5037ff402865e311112a6d42b1e84071a5781f105003554b029f4e8de8b3ffe184cab268a193f1723101d45de61a323e1fc85ab273dbd7e312d40d9d8

Download Submit
C:\Windows\system\wwqGfab.exe

Filesize
2.1MB

MD5
8be005b4375c8443e2cf6748817766a3

SHA1
3c54f6cbda26a66b5cf40273e3141106ee0ce738

SHA256
5362d6e0f1590eef66fcc7d8c83ec17436e4f2907748c53e7e8facb7f49754da

SHA512
0d22eee04aa8e05ffcc81c86a4be0ce559384aaad83de386db5a2907269fd64252d410d18bc23f99c3fab1acd0724f32e3e931427b88c9935906e83044796a7c

Download Submit
\Windows\system\DOzXDuA.exe

Filesize
2.0MB

MD5
6adcab6d34f87ca7d32f3e0967ad15a5

SHA1
ee440c7b978df03204b5924867048ddf66023660

SHA256
c6d6902d7b522acaa9c838b335c27e3f4f4c7d6e0054ccda5414c0595bf7884b

SHA512
b1ea2eca1c45972f96bbce6d7a5f3b8981ac073c804654a87152a31967626094bad8b41b1271431603ab696b94c5c5a8edc3ee136054922ec78f9b1e3712c2a0

Download Submit
\Windows\system\PWNBWdo.exe

Filesize
2.1MB

MD5
9f61b6b6abe2c21b19251ffda33c1443

SHA1
43be519b43b18ece4183f90cf47def4a74db7874

SHA256
a969dc91d771ab3a950fcd6cf5d0e22904185be61463835020d9aa302f25a72a

SHA512
ab205e172bbd2536176c703b44a5f801df2fa067a76e0c6851187803f9b8e71e2df0ec9609b6fc693c1a3c780f64370ca636c88a549ee50c1629cf093dced1df

Download Submit
\Windows\system\WeqPSyB.exe

Filesize
2.1MB

MD5
854608def6e7fad7d31ccba70018d014

SHA1
209ac76de87c56b2c0a59fb2902ba543323ed3a9

SHA256
5a61f4e1642fefed8f3fdbb4b23fdaa081c31867d068ecae5241fe8ebe97dc44

SHA512
a08ab58fab5d3b30a2a4ee58895bc8967c8f710640a7bc35e64c10cdc02abe87fd41760485f72e80249231daca208bcc1cb4e2aca35c927433e43777b430af0b

Download Submit
\Windows\system\iahzxKG.exe

Filesize
2.1MB

MD5
62ae25bb3e8ed5a5f6eba4a1f9154b83

SHA1
1f8fda46b27d3e03b392bcf590d36ba0266b8d59

SHA256
78d01c073ddb1edb11c37b363da744bce647558fc3184208327597786d70545c

SHA512
6028d047b36b6959c2db58e632dfdf80fd32f60cd45c913def3b4df1ee424037987849a21ad486ff631ab5c8fadebf574bd2517276a26f2500c7403b25b537fa

Download Submit
\Windows\system\kesAShX.exe

Filesize
2.1MB

MD5
0b9456b65ac69758e3bbf31867e6ef72

SHA1
ea70828fa95583e1da1eb9bb1f6339fe472fd872

SHA256
c2b9c218aba16503889859d09e2441901ce9c2c3f3fb782aa64bfd27add4f586

SHA512
5e2f7bd8e414b3bdf321f8eeca2098badc279c0af29f1118b441c3b9e24ad0340796f088cd0558c04e1fb64e0997fbf41af12e3f4aaa8ada7e29ce71905c09a2

Download Submit
\Windows\system\nQLWXfJ.exe

Filesize
2.1MB

MD5
97b272e5a5594bfa911e026f4785fc6c

SHA1
e69464299aa8f5cb73dc9ed60abb2252c389ef08

SHA256
a893f7913317610761318dd872925c66290c9413909ab6e3201c3a7834d7b559

SHA512
c76aa78fda25a8ca20b16f4cc11dac4fd4446a2f548799c216f1be626850ede4a05ad934246b1431d91ae675137bc7f64fb06f5244bec051b69bb86e60d68e45

Download Submit
\Windows\system\rIMjwvo.exe

Filesize
2.1MB

MD5
991753f34009ff1e6d73bd700aa89b23

SHA1
edd29e95f52097684b1d6e77d294140df65dc974

SHA256
801d20b21d55c2a1253aae3318f199fc43ab894c72d58a1e0b52ff19201667be

SHA512
ea581f77521e570dfe93733712f4f1431cd270d35ed67a35955177e079b75f60a0572a623062165638a285bbf56f65bc5b1d6908ec848304a394fe8d5a2cfed3

Download Submit
memory/1964-259-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-3959-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-262-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2044-264-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2044-13-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2044-246-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-0-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2044-260-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-248-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2044-258-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-256-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2044-252-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2044-254-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-3814-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2420-253-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2520-255-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3983-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-3815-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-261-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-3828-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2628-263-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2652-3886-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2652-250-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2664-249-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3524-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2684-155-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2684-3757-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2708-245-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-3593-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-247-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-3631-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-3521-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-176-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-3557-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2960-257-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/3060-244-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/3060-133-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/3060-134-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/3060-177-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download