xmrig | cd40b857c2fd6acd4ccec1fae17394238c366de117996badbda8df57ed343af0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
Size

2.2MB
MD5

683d7e72a365ac93c5ecbf2223fde2e3
SHA1

07262df2fe077aabea49af5d5622bfc588d85cdf
SHA256

cd40b857c2fd6acd4ccec1fae17394238c366de117996badbda8df57ed343af0
SHA512

678d8d8829337c2e8a3999203e04a60a57908093e747400ce101840aaad2ba2786a6152129b2802249f3e2a31706c5d923d1947ae715b9fdd3d091a3f65a431e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9j:NABc

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3596-35-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp	xmrig
behavioral2/memory/1112-36-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp	xmrig
behavioral2/memory/1960-37-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp	xmrig
behavioral2/memory/2320-38-0x00007FF72F7F0000-0x00007FF72FBE2000-memory.dmp	xmrig
behavioral2/memory/2388-39-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	xmrig
behavioral2/memory/2088-46-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp	xmrig
behavioral2/memory/1712-59-0x00007FF6EB470000-0x00007FF6EB862000-memory.dmp	xmrig
behavioral2/memory/4924-61-0x00007FF6D7E10000-0x00007FF6D8202000-memory.dmp	xmrig
behavioral2/memory/2388-66-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	xmrig
behavioral2/memory/3516-68-0x00007FF688A30000-0x00007FF688E22000-memory.dmp	xmrig
behavioral2/memory/2992-76-0x00007FF6903E0000-0x00007FF6907D2000-memory.dmp	xmrig
behavioral2/memory/988-82-0x00007FF7A3820000-0x00007FF7A3C12000-memory.dmp	xmrig
behavioral2/memory/4948-88-0x00007FF7F1680000-0x00007FF7F1A72000-memory.dmp	xmrig
behavioral2/memory/872-94-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp	xmrig
behavioral2/memory/1144-109-0x00007FF6734F0000-0x00007FF6738E2000-memory.dmp	xmrig
behavioral2/memory/2456-118-0x00007FF7272B0000-0x00007FF7276A2000-memory.dmp	xmrig
behavioral2/memory/3128-132-0x00007FF652EB0000-0x00007FF6532A2000-memory.dmp	xmrig
behavioral2/memory/2340-134-0x00007FF6CA5C0000-0x00007FF6CA9B2000-memory.dmp	xmrig
behavioral2/memory/3184-136-0x00007FF6128C0000-0x00007FF612CB2000-memory.dmp	xmrig
behavioral2/memory/2388-140-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	xmrig
behavioral2/memory/4860-149-0x00007FF7F9020000-0x00007FF7F9412000-memory.dmp	xmrig
behavioral2/memory/220-150-0x00007FF6226A0000-0x00007FF622A92000-memory.dmp	xmrig
behavioral2/memory/1832-197-0x00007FF778210000-0x00007FF778602000-memory.dmp	xmrig
behavioral2/memory/4332-199-0x00007FF7E0750000-0x00007FF7E0B42000-memory.dmp	xmrig
behavioral2/memory/4500-195-0x00007FF628AC0000-0x00007FF628EB2000-memory.dmp	xmrig
behavioral2/memory/872-571-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp	xmrig
behavioral2/memory/1960-1005-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp	xmrig
behavioral2/memory/1112-968-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp	xmrig
behavioral2/memory/3596-966-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp	xmrig
behavioral2/memory/2320-909-0x00007FF72F7F0000-0x00007FF72FBE2000-memory.dmp	xmrig
behavioral2/memory/2088-1339-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp	xmrig
behavioral2/memory/4924-1444-0x00007FF6D7E10000-0x00007FF6D8202000-memory.dmp	xmrig
behavioral2/memory/1712-1436-0x00007FF6EB470000-0x00007FF6EB862000-memory.dmp	xmrig
behavioral2/memory/3516-1471-0x00007FF688A30000-0x00007FF688E22000-memory.dmp	xmrig
behavioral2/memory/2992-1497-0x00007FF6903E0000-0x00007FF6907D2000-memory.dmp	xmrig
behavioral2/memory/988-1546-0x00007FF7A3820000-0x00007FF7A3C12000-memory.dmp	xmrig
behavioral2/memory/872-1569-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp	xmrig
behavioral2/memory/4948-1568-0x00007FF7F1680000-0x00007FF7F1A72000-memory.dmp	xmrig
behavioral2/memory/1144-1690-0x00007FF6734F0000-0x00007FF6738E2000-memory.dmp	xmrig
behavioral2/memory/3128-1818-0x00007FF652EB0000-0x00007FF6532A2000-memory.dmp	xmrig
behavioral2/memory/4860-1866-0x00007FF7F9020000-0x00007FF7F9412000-memory.dmp	xmrig
behavioral2/memory/220-1916-0x00007FF6226A0000-0x00007FF622A92000-memory.dmp	xmrig
behavioral2/memory/3184-1826-0x00007FF6128C0000-0x00007FF612CB2000-memory.dmp	xmrig
behavioral2/memory/2340-1822-0x00007FF6CA5C0000-0x00007FF6CA9B2000-memory.dmp	xmrig
behavioral2/memory/2656-1684-0x00007FF6A2370000-0x00007FF6A2762000-memory.dmp	xmrig
behavioral2/memory/720-1681-0x00007FF735900000-0x00007FF735CF2000-memory.dmp	xmrig
behavioral2/memory/2456-1693-0x00007FF7272B0000-0x00007FF7276A2000-memory.dmp	xmrig
behavioral2/memory/1832-1937-0x00007FF778210000-0x00007FF778602000-memory.dmp	xmrig
behavioral2/memory/4332-1936-0x00007FF7E0750000-0x00007FF7E0B42000-memory.dmp	xmrig
behavioral2/memory/4500-1935-0x00007FF628AC0000-0x00007FF628EB2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4204	powershell.exe
7	4204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2320	MkWwWWu.exe
3596	sZznUib.exe
1112	BVwPByv.exe
1960	XQShQqQ.exe
2088	XkxDRyE.exe
1712	RJpfNeR.exe
4924	xyPPoCI.exe
3516	DWvsypp.exe
2992	LlYuGQr.exe
988	oOyUCRl.exe
4948	yEwepFp.exe
872	PpEHevo.exe
720	iURvfUJ.exe
1144	vZPYhME.exe
2656	wUtbeMY.exe
2456	UvkHGyq.exe
3128	NFrAZex.exe
2340	JIABtjC.exe
3184	FWnHglA.exe
4860	VDipaHs.exe
220	wFiLZDg.exe
4500	RJhZjyd.exe
1832	DZbxwbK.exe
4332	DYchtCr.exe
3900	SBsmluc.exe
892	xjRwRst.exe
1432	ZXuIcQi.exe
4692	VDcKDtX.exe
528	iUgOFqw.exe
1480	xvCXvgF.exe
1976	JUVJTSc.exe
4880	cCYSZvE.exe
1996	RAsBsbW.exe
1008	uuaVkEP.exe
1808	AwyNlbq.exe
4644	GlJytUh.exe
1220	jIprdUB.exe
4940	amUbDqO.exe
3608	jbNvNgZ.exe
5068	RRvafBb.exe
3120	BrlKFzI.exe
624	CfKWllz.exe
4560	bXhEBai.exe
4476	RTfAuxZ.exe
608	anmNHOV.exe
836	vHsnaIX.exe
4424	elJBdCf.exe
4976	jfIKHPK.exe
2168	pJmXdAX.exe
4988	QhlyFzn.exe
3248	KrPsRIC.exe
5056	EMIrBGs.exe
1860	sCWyikM.exe
800	BRWpmmA.exe
4636	XNhBZmz.exe
2268	mfBpSLL.exe
4396	Itogmwb.exe
3276	wzwTsNd.exe
2652	NBprgBx.exe
1616	DQpehqu.exe
1972	XPOXUaF.exe
4400	CRXnMyY.exe
4088	UawLkBE.exe
2192	PEmDwtF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2388-0-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	upx
behavioral2/files/0x000800000002326c-6.dat	upx
behavioral2/files/0x0009000000023272-12.dat	upx
behavioral2/files/0x0008000000023271-11.dat	upx
behavioral2/files/0x0008000000023273-30.dat	upx
behavioral2/memory/3596-35-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp	upx
behavioral2/memory/1112-36-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp	upx
behavioral2/memory/1960-37-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp	upx
behavioral2/memory/2320-38-0x00007FF72F7F0000-0x00007FF72FBE2000-memory.dmp	upx
behavioral2/files/0x0008000000023274-42.dat	upx
behavioral2/memory/2388-39-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	upx
behavioral2/memory/2088-46-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp	upx
behavioral2/files/0x0007000000023275-49.dat	upx
behavioral2/files/0x0007000000023276-57.dat	upx
behavioral2/memory/1712-59-0x00007FF6EB470000-0x00007FF6EB862000-memory.dmp	upx
behavioral2/memory/4924-61-0x00007FF6D7E10000-0x00007FF6D8202000-memory.dmp	upx
behavioral2/files/0x0007000000023277-63.dat	upx
behavioral2/memory/2388-66-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	upx
behavioral2/memory/3516-68-0x00007FF688A30000-0x00007FF688E22000-memory.dmp	upx
behavioral2/files/0x0007000000023278-73.dat	upx
behavioral2/memory/2992-76-0x00007FF6903E0000-0x00007FF6907D2000-memory.dmp	upx
behavioral2/files/0x0007000000023279-78.dat	upx
behavioral2/memory/988-82-0x00007FF7A3820000-0x00007FF7A3C12000-memory.dmp	upx
behavioral2/files/0x000700000002327a-86.dat	upx
behavioral2/memory/4948-88-0x00007FF7F1680000-0x00007FF7F1A72000-memory.dmp	upx
behavioral2/files/0x000700000002327c-92.dat	upx
behavioral2/memory/872-94-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp	upx
behavioral2/files/0x000700000002327d-97.dat	upx
behavioral2/memory/720-99-0x00007FF735900000-0x00007FF735CF2000-memory.dmp	upx
behavioral2/files/0x000700000002327e-104.dat	upx
behavioral2/files/0x000700000002327f-107.dat	upx
behavioral2/memory/1144-109-0x00007FF6734F0000-0x00007FF6738E2000-memory.dmp	upx
behavioral2/memory/2656-111-0x00007FF6A2370000-0x00007FF6A2762000-memory.dmp	upx
behavioral2/files/0x0007000000023280-116.dat	upx
behavioral2/memory/2456-118-0x00007FF7272B0000-0x00007FF7276A2000-memory.dmp	upx
behavioral2/files/0x0007000000023281-121.dat	upx
behavioral2/files/0x0007000000023282-126.dat	upx
behavioral2/files/0x0007000000023283-131.dat	upx
behavioral2/memory/3128-132-0x00007FF652EB0000-0x00007FF6532A2000-memory.dmp	upx
behavioral2/memory/2340-134-0x00007FF6CA5C0000-0x00007FF6CA9B2000-memory.dmp	upx
behavioral2/memory/3184-136-0x00007FF6128C0000-0x00007FF612CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023284-142.dat	upx
behavioral2/memory/2388-140-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp	upx
behavioral2/files/0x0007000000023285-147.dat	upx
behavioral2/memory/4860-149-0x00007FF7F9020000-0x00007FF7F9412000-memory.dmp	upx
behavioral2/memory/220-150-0x00007FF6226A0000-0x00007FF622A92000-memory.dmp	upx
behavioral2/files/0x0007000000023286-154.dat	upx
behavioral2/files/0x0007000000023287-158.dat	upx
behavioral2/files/0x0007000000023288-164.dat	upx
behavioral2/files/0x0007000000023289-169.dat	upx
behavioral2/files/0x000700000002328a-173.dat	upx
behavioral2/files/0x000700000002328b-178.dat	upx
behavioral2/files/0x000700000002328c-184.dat	upx
behavioral2/files/0x000700000002328d-194.dat	upx
behavioral2/memory/1832-197-0x00007FF778210000-0x00007FF778602000-memory.dmp	upx
behavioral2/memory/4332-199-0x00007FF7E0750000-0x00007FF7E0B42000-memory.dmp	upx
behavioral2/memory/4500-195-0x00007FF628AC0000-0x00007FF628EB2000-memory.dmp	upx
behavioral2/files/0x000700000002328e-203.dat	upx
behavioral2/files/0x000700000002328f-208.dat	upx
behavioral2/files/0x0007000000023290-213.dat	upx
behavioral2/memory/872-571-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp	upx
behavioral2/memory/1960-1005-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp	upx
behavioral2/memory/1112-968-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp	upx
behavioral2/memory/3596-966-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vMNkhlS.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\RAsBsbW.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\BRWpmmA.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\LXxicUl.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\xgImKpM.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\XrOopXP.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\eSAZmsw.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\VDedIId.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\pgoFsxm.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\eaeIKiz.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\MyJPHcA.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\UBEvQah.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\pJmXdAX.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\aDZFTiI.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\kIqHFTn.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\UawLkBE.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\eSrzgLt.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\fkEdrzQ.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ptPEtRb.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\GMShmlW.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\eGEvIdd.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\bYEOOLb.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\fTLwZcn.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\mwpJgSI.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\CHiQgOw.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\wvMJLKd.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\qwmUqer.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\tDXTrzQ.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\SJHJHQQ.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\jmTIXQw.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ZTeJsAX.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\whkHmqP.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\uOErrjx.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\LsvvfNE.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\xtagYCO.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\azKBqeu.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\GVQGnLX.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\LDDRYno.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\tYJVPDZ.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\aGRYNfJ.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\NglyrCg.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\OITkQPn.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\NDlfjBP.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\kcfGMZw.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\mtGaRwH.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\tZulLbA.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\wLzbhBG.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\JpzpCgt.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ViOsgFr.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\dfSyBTs.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\yVsCiTn.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\TFtWLll.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\keNiJxk.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\IOqYsCb.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ARQdxVp.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ZXuIcQi.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\uslArxm.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\ArGyxlR.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\csGNBSz.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\bOrozOu.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\MpWCcwo.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\vxNUXRz.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\eFVbwTn.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
File created	C:\Windows\System\TmrzKoy.exe	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeLockMemoryPrivilege	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4204	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	90
PID 2388 wrote to memory of 4204	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	90
PID 2388 wrote to memory of 2320	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	91
PID 2388 wrote to memory of 2320	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	91
PID 2388 wrote to memory of 3596	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	92
PID 2388 wrote to memory of 3596	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	92
PID 2388 wrote to memory of 1112	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	93
PID 2388 wrote to memory of 1112	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	93
PID 2388 wrote to memory of 1960	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	94
PID 2388 wrote to memory of 1960	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	94
PID 2388 wrote to memory of 2088	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	95
PID 2388 wrote to memory of 2088	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	95
PID 2388 wrote to memory of 1712	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	96
PID 2388 wrote to memory of 1712	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	96
PID 2388 wrote to memory of 4924	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	97
PID 2388 wrote to memory of 4924	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	97
PID 2388 wrote to memory of 3516	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	98
PID 2388 wrote to memory of 3516	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	98
PID 2388 wrote to memory of 2992	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	99
PID 2388 wrote to memory of 2992	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	99
PID 2388 wrote to memory of 988	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	100
PID 2388 wrote to memory of 988	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	100
PID 2388 wrote to memory of 4948	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	101
PID 2388 wrote to memory of 4948	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	101
PID 2388 wrote to memory of 872	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	102
PID 2388 wrote to memory of 872	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	102
PID 2388 wrote to memory of 720	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	103
PID 2388 wrote to memory of 720	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	103
PID 2388 wrote to memory of 1144	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	104
PID 2388 wrote to memory of 1144	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	104
PID 2388 wrote to memory of 2656	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	105
PID 2388 wrote to memory of 2656	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	105
PID 2388 wrote to memory of 2456	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	106
PID 2388 wrote to memory of 2456	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	106
PID 2388 wrote to memory of 3128	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	107
PID 2388 wrote to memory of 3128	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	107
PID 2388 wrote to memory of 2340	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	108
PID 2388 wrote to memory of 2340	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	108
PID 2388 wrote to memory of 3184	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	109
PID 2388 wrote to memory of 3184	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	109
PID 2388 wrote to memory of 4860	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	110
PID 2388 wrote to memory of 4860	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	110
PID 2388 wrote to memory of 220	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	111
PID 2388 wrote to memory of 220	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	111
PID 2388 wrote to memory of 4500	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	112
PID 2388 wrote to memory of 4500	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	112
PID 2388 wrote to memory of 1832	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	113
PID 2388 wrote to memory of 1832	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	113
PID 2388 wrote to memory of 4332	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	114
PID 2388 wrote to memory of 4332	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	114
PID 2388 wrote to memory of 3900	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	115
PID 2388 wrote to memory of 3900	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	115
PID 2388 wrote to memory of 892	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	116
PID 2388 wrote to memory of 892	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	116
PID 2388 wrote to memory of 1432	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	117
PID 2388 wrote to memory of 1432	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	117
PID 2388 wrote to memory of 4692	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	118
PID 2388 wrote to memory of 4692	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	118
PID 2388 wrote to memory of 528	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	119
PID 2388 wrote to memory of 528	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	119
PID 2388 wrote to memory of 1480	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	120
PID 2388 wrote to memory of 1480	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	120
PID 2388 wrote to memory of 1976	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	121
PID 2388 wrote to memory of 1976	2388	683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe	121

C:\Users\Admin\AppData\Local\Temp\683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\683d7e72a365ac93c5ecbf2223fde2e3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System\MkWwWWu.exe
  C:\Windows\System\MkWwWWu.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\sZznUib.exe
  C:\Windows\System\sZznUib.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\BVwPByv.exe
  C:\Windows\System\BVwPByv.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\XQShQqQ.exe
  C:\Windows\System\XQShQqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\XkxDRyE.exe
  C:\Windows\System\XkxDRyE.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\RJpfNeR.exe
  C:\Windows\System\RJpfNeR.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\xyPPoCI.exe
  C:\Windows\System\xyPPoCI.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\DWvsypp.exe
  C:\Windows\System\DWvsypp.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\LlYuGQr.exe
  C:\Windows\System\LlYuGQr.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\oOyUCRl.exe
  C:\Windows\System\oOyUCRl.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\yEwepFp.exe
  C:\Windows\System\yEwepFp.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\PpEHevo.exe
  C:\Windows\System\PpEHevo.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\iURvfUJ.exe
  C:\Windows\System\iURvfUJ.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\vZPYhME.exe
  C:\Windows\System\vZPYhME.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\wUtbeMY.exe
  C:\Windows\System\wUtbeMY.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\UvkHGyq.exe
  C:\Windows\System\UvkHGyq.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\NFrAZex.exe
  C:\Windows\System\NFrAZex.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\JIABtjC.exe
  C:\Windows\System\JIABtjC.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\FWnHglA.exe
  C:\Windows\System\FWnHglA.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\VDipaHs.exe
  C:\Windows\System\VDipaHs.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\wFiLZDg.exe
  C:\Windows\System\wFiLZDg.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\RJhZjyd.exe
  C:\Windows\System\RJhZjyd.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\DZbxwbK.exe
  C:\Windows\System\DZbxwbK.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\DYchtCr.exe
  C:\Windows\System\DYchtCr.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\SBsmluc.exe
  C:\Windows\System\SBsmluc.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\xjRwRst.exe
  C:\Windows\System\xjRwRst.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\ZXuIcQi.exe
  C:\Windows\System\ZXuIcQi.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\VDcKDtX.exe
  C:\Windows\System\VDcKDtX.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\iUgOFqw.exe
  C:\Windows\System\iUgOFqw.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\xvCXvgF.exe
  C:\Windows\System\xvCXvgF.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\JUVJTSc.exe
  C:\Windows\System\JUVJTSc.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\cCYSZvE.exe
  C:\Windows\System\cCYSZvE.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\RAsBsbW.exe
  C:\Windows\System\RAsBsbW.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\uuaVkEP.exe
  C:\Windows\System\uuaVkEP.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\AwyNlbq.exe
  C:\Windows\System\AwyNlbq.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\GlJytUh.exe
  C:\Windows\System\GlJytUh.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\jIprdUB.exe
  C:\Windows\System\jIprdUB.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\amUbDqO.exe
  C:\Windows\System\amUbDqO.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jbNvNgZ.exe
  C:\Windows\System\jbNvNgZ.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\RRvafBb.exe
  C:\Windows\System\RRvafBb.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\BrlKFzI.exe
  C:\Windows\System\BrlKFzI.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\CfKWllz.exe
  C:\Windows\System\CfKWllz.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\bXhEBai.exe
  C:\Windows\System\bXhEBai.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\RTfAuxZ.exe
  C:\Windows\System\RTfAuxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\anmNHOV.exe
  C:\Windows\System\anmNHOV.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\vHsnaIX.exe
  C:\Windows\System\vHsnaIX.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\elJBdCf.exe
  C:\Windows\System\elJBdCf.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\jfIKHPK.exe
  C:\Windows\System\jfIKHPK.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\pJmXdAX.exe
  C:\Windows\System\pJmXdAX.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\QhlyFzn.exe
  C:\Windows\System\QhlyFzn.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\KrPsRIC.exe
  C:\Windows\System\KrPsRIC.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\EMIrBGs.exe
  C:\Windows\System\EMIrBGs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\sCWyikM.exe
  C:\Windows\System\sCWyikM.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\BRWpmmA.exe
  C:\Windows\System\BRWpmmA.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\XNhBZmz.exe
  C:\Windows\System\XNhBZmz.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\mfBpSLL.exe
  C:\Windows\System\mfBpSLL.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\Itogmwb.exe
  C:\Windows\System\Itogmwb.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wzwTsNd.exe
  C:\Windows\System\wzwTsNd.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\NBprgBx.exe
  C:\Windows\System\NBprgBx.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\DQpehqu.exe
  C:\Windows\System\DQpehqu.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\XPOXUaF.exe
  C:\Windows\System\XPOXUaF.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\CRXnMyY.exe
  C:\Windows\System\CRXnMyY.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\PEmDwtF.exe
  C:\Windows\System\PEmDwtF.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\UawLkBE.exe
  C:\Windows\System\UawLkBE.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\gcpdTsH.exe
  C:\Windows\System\gcpdTsH.exe
  2⤵
  PID:4944
- C:\Windows\System\aEzyJzT.exe
  C:\Windows\System\aEzyJzT.exe
  2⤵
  PID:4588
- C:\Windows\System\aunhdgJ.exe
  C:\Windows\System\aunhdgJ.exe
  2⤵
  PID:4296
- C:\Windows\System\vaBHiBf.exe
  C:\Windows\System\vaBHiBf.exe
  2⤵
  PID:1160
- C:\Windows\System\muFxLXe.exe
  C:\Windows\System\muFxLXe.exe
  2⤵
  PID:764
- C:\Windows\System\yyTwVEo.exe
  C:\Windows\System\yyTwVEo.exe
  2⤵
  PID:1460
- C:\Windows\System\gGqvcQV.exe
  C:\Windows\System\gGqvcQV.exe
  2⤵
  PID:3532
- C:\Windows\System\VUYsVzb.exe
  C:\Windows\System\VUYsVzb.exe
  2⤵
  PID:856
- C:\Windows\System\wLzbhBG.exe
  C:\Windows\System\wLzbhBG.exe
  2⤵
  PID:5140
- C:\Windows\System\lwcPgLK.exe
  C:\Windows\System\lwcPgLK.exe
  2⤵
  PID:5172
- C:\Windows\System\rMOffLS.exe
  C:\Windows\System\rMOffLS.exe
  2⤵
  PID:5188
- C:\Windows\System\FMCZwgN.exe
  C:\Windows\System\FMCZwgN.exe
  2⤵
  PID:5236
- C:\Windows\System\RwLmfNt.exe
  C:\Windows\System\RwLmfNt.exe
  2⤵
  PID:5252
- C:\Windows\System\zbywgRU.exe
  C:\Windows\System\zbywgRU.exe
  2⤵
  PID:5284
- C:\Windows\System\xAbhiME.exe
  C:\Windows\System\xAbhiME.exe
  2⤵
  PID:5324
- C:\Windows\System\deqMKut.exe
  C:\Windows\System\deqMKut.exe
  2⤵
  PID:5344
- C:\Windows\System\hOTtOXs.exe
  C:\Windows\System\hOTtOXs.exe
  2⤵
  PID:5392
- C:\Windows\System\PLlruar.exe
  C:\Windows\System\PLlruar.exe
  2⤵
  PID:5420
- C:\Windows\System\gttPrWO.exe
  C:\Windows\System\gttPrWO.exe
  2⤵
  PID:5452
- C:\Windows\System\oYMfmzW.exe
  C:\Windows\System\oYMfmzW.exe
  2⤵
  PID:5500
- C:\Windows\System\bOrozOu.exe
  C:\Windows\System\bOrozOu.exe
  2⤵
  PID:5524
- C:\Windows\System\hXQzHrN.exe
  C:\Windows\System\hXQzHrN.exe
  2⤵
  PID:5572
- C:\Windows\System\WrrXply.exe
  C:\Windows\System\WrrXply.exe
  2⤵
  PID:5600
- C:\Windows\System\ptPEtRb.exe
  C:\Windows\System\ptPEtRb.exe
  2⤵
  PID:5660
- C:\Windows\System\nVaRGol.exe
  C:\Windows\System\nVaRGol.exe
  2⤵
  PID:5680
- C:\Windows\System\yOpHZBp.exe
  C:\Windows\System\yOpHZBp.exe
  2⤵
  PID:5708
- C:\Windows\System\gjaywYu.exe
  C:\Windows\System\gjaywYu.exe
  2⤵
  PID:5724
- C:\Windows\System\tlzzfTP.exe
  C:\Windows\System\tlzzfTP.exe
  2⤵
  PID:5744
- C:\Windows\System\JwHFeBF.exe
  C:\Windows\System\JwHFeBF.exe
  2⤵
  PID:5776
- C:\Windows\System\azKBqeu.exe
  C:\Windows\System\azKBqeu.exe
  2⤵
  PID:5832
- C:\Windows\System\rRAxIda.exe
  C:\Windows\System\rRAxIda.exe
  2⤵
  PID:5864
- C:\Windows\System\rXDeRHQ.exe
  C:\Windows\System\rXDeRHQ.exe
  2⤵
  PID:5896
- C:\Windows\System\CUmCAKY.exe
  C:\Windows\System\CUmCAKY.exe
  2⤵
  PID:5928
- C:\Windows\System\NWwGJDA.exe
  C:\Windows\System\NWwGJDA.exe
  2⤵
  PID:5952
- C:\Windows\System\bqKpMOO.exe
  C:\Windows\System\bqKpMOO.exe
  2⤵
  PID:5972
- C:\Windows\System\jAABJkV.exe
  C:\Windows\System\jAABJkV.exe
  2⤵
  PID:6000
- C:\Windows\System\ntccUaO.exe
  C:\Windows\System\ntccUaO.exe
  2⤵
  PID:6020
- C:\Windows\System\AvOcqJy.exe
  C:\Windows\System\AvOcqJy.exe
  2⤵
  PID:6056
- C:\Windows\System\CVlGZBh.exe
  C:\Windows\System\CVlGZBh.exe
  2⤵
  PID:6088
- C:\Windows\System\yvZumcH.exe
  C:\Windows\System\yvZumcH.exe
  2⤵
  PID:6124
- C:\Windows\System\eYTueLt.exe
  C:\Windows\System\eYTueLt.exe
  2⤵
  PID:5124
- C:\Windows\System\XJvIMHg.exe
  C:\Windows\System\XJvIMHg.exe
  2⤵
  PID:5216
- C:\Windows\System\lXfwggf.exe
  C:\Windows\System\lXfwggf.exe
  2⤵
  PID:5196
- C:\Windows\System\jNrqxBp.exe
  C:\Windows\System\jNrqxBp.exe
  2⤵
  PID:5304
- C:\Windows\System\rAUOmVa.exe
  C:\Windows\System\rAUOmVa.exe
  2⤵
  PID:5320
- C:\Windows\System\TMRhlQl.exe
  C:\Windows\System\TMRhlQl.exe
  2⤵
  PID:5400
- C:\Windows\System\xtrAYOk.exe
  C:\Windows\System\xtrAYOk.exe
  2⤵
  PID:5416
- C:\Windows\System\zkFmJip.exe
  C:\Windows\System\zkFmJip.exe
  2⤵
  PID:5560
- C:\Windows\System\yadmROG.exe
  C:\Windows\System\yadmROG.exe
  2⤵
  PID:5588
- C:\Windows\System\clcKyba.exe
  C:\Windows\System\clcKyba.exe
  2⤵
  PID:5704
- C:\Windows\System\svaOabO.exe
  C:\Windows\System\svaOabO.exe
  2⤵
  PID:5736
- C:\Windows\System\UhaRXbP.exe
  C:\Windows\System\UhaRXbP.exe
  2⤵
  PID:5804
- C:\Windows\System\fudhZuG.exe
  C:\Windows\System\fudhZuG.exe
  2⤵
  PID:5872
- C:\Windows\System\eLNLxZh.exe
  C:\Windows\System\eLNLxZh.exe
  2⤵
  PID:5912
- C:\Windows\System\JpzpCgt.exe
  C:\Windows\System\JpzpCgt.exe
  2⤵
  PID:5996
- C:\Windows\System\jVZhpEB.exe
  C:\Windows\System\jVZhpEB.exe
  2⤵
  PID:6044
- C:\Windows\System\lQzmDFT.exe
  C:\Windows\System\lQzmDFT.exe
  2⤵
  PID:6100
- C:\Windows\System\SmuFBdd.exe
  C:\Windows\System\SmuFBdd.exe
  2⤵
  PID:212
- C:\Windows\System\YhJRxCl.exe
  C:\Windows\System\YhJRxCl.exe
  2⤵
  PID:5260
- C:\Windows\System\ygKJwfJ.exe
  C:\Windows\System\ygKJwfJ.exe
  2⤵
  PID:5516
- C:\Windows\System\oUeEQLk.exe
  C:\Windows\System\oUeEQLk.exe
  2⤵
  PID:5520
- C:\Windows\System\PIBrjzM.exe
  C:\Windows\System\PIBrjzM.exe
  2⤵
  PID:5860
- C:\Windows\System\VldvHUn.exe
  C:\Windows\System\VldvHUn.exe
  2⤵
  PID:5960
- C:\Windows\System\keNiJxk.exe
  C:\Windows\System\keNiJxk.exe
  2⤵
  PID:5964
- C:\Windows\System\LknLUEy.exe
  C:\Windows\System\LknLUEy.exe
  2⤵
  PID:696
- C:\Windows\System\MqhIkMq.exe
  C:\Windows\System\MqhIkMq.exe
  2⤵
  PID:5316
- C:\Windows\System\spZfjZz.exe
  C:\Windows\System\spZfjZz.exe
  2⤵
  PID:1728
- C:\Windows\System\qZgDwlT.exe
  C:\Windows\System\qZgDwlT.exe
  2⤵
  PID:5180
- C:\Windows\System\OWahgZT.exe
  C:\Windows\System\OWahgZT.exe
  2⤵
  PID:6292
- C:\Windows\System\pPZdaBs.exe
  C:\Windows\System\pPZdaBs.exe
  2⤵
  PID:6308
- C:\Windows\System\xKMQcwL.exe
  C:\Windows\System\xKMQcwL.exe
  2⤵
  PID:6324
- C:\Windows\System\IbfKbsZ.exe
  C:\Windows\System\IbfKbsZ.exe
  2⤵
  PID:6340
- C:\Windows\System\zFzNmtu.exe
  C:\Windows\System\zFzNmtu.exe
  2⤵
  PID:6356
- C:\Windows\System\ClHxpEX.exe
  C:\Windows\System\ClHxpEX.exe
  2⤵
  PID:6388
- C:\Windows\System\ViOsgFr.exe
  C:\Windows\System\ViOsgFr.exe
  2⤵
  PID:6424
- C:\Windows\System\SJHJHQQ.exe
  C:\Windows\System\SJHJHQQ.exe
  2⤵
  PID:6448
- C:\Windows\System\EPmFFWY.exe
  C:\Windows\System\EPmFFWY.exe
  2⤵
  PID:6464
- C:\Windows\System\eSAZmsw.exe
  C:\Windows\System\eSAZmsw.exe
  2⤵
  PID:6516
- C:\Windows\System\uslArxm.exe
  C:\Windows\System\uslArxm.exe
  2⤵
  PID:6532
- C:\Windows\System\qGiLItA.exe
  C:\Windows\System\qGiLItA.exe
  2⤵
  PID:6552
- C:\Windows\System\YUSUkGk.exe
  C:\Windows\System\YUSUkGk.exe
  2⤵
  PID:6572
- C:\Windows\System\FUpVvMA.exe
  C:\Windows\System\FUpVvMA.exe
  2⤵
  PID:6588
- C:\Windows\System\MpWCcwo.exe
  C:\Windows\System\MpWCcwo.exe
  2⤵
  PID:6608
- C:\Windows\System\shuiiZi.exe
  C:\Windows\System\shuiiZi.exe
  2⤵
  PID:6632
- C:\Windows\System\eJADjVs.exe
  C:\Windows\System\eJADjVs.exe
  2⤵
  PID:6656
- C:\Windows\System\gKfFITf.exe
  C:\Windows\System\gKfFITf.exe
  2⤵
  PID:6676
- C:\Windows\System\MxUGSiP.exe
  C:\Windows\System\MxUGSiP.exe
  2⤵
  PID:6704
- C:\Windows\System\QMfyUED.exe
  C:\Windows\System\QMfyUED.exe
  2⤵
  PID:6724
- C:\Windows\System\TZAljwo.exe
  C:\Windows\System\TZAljwo.exe
  2⤵
  PID:6744
- C:\Windows\System\gzXiPhR.exe
  C:\Windows\System\gzXiPhR.exe
  2⤵
  PID:6812
- C:\Windows\System\LaRgPBG.exe
  C:\Windows\System\LaRgPBG.exe
  2⤵
  PID:6840
- C:\Windows\System\WTmdivw.exe
  C:\Windows\System\WTmdivw.exe
  2⤵
  PID:6856
- C:\Windows\System\ItAXFJu.exe
  C:\Windows\System\ItAXFJu.exe
  2⤵
  PID:6880
- C:\Windows\System\JEPQqlq.exe
  C:\Windows\System\JEPQqlq.exe
  2⤵
  PID:6896
- C:\Windows\System\SijpxOx.exe
  C:\Windows\System\SijpxOx.exe
  2⤵
  PID:6936
- C:\Windows\System\jmTIXQw.exe
  C:\Windows\System\jmTIXQw.exe
  2⤵
  PID:6956
- C:\Windows\System\SowcofE.exe
  C:\Windows\System\SowcofE.exe
  2⤵
  PID:6980
- C:\Windows\System\SgeJQit.exe
  C:\Windows\System\SgeJQit.exe
  2⤵
  PID:7000
- C:\Windows\System\PKQziGC.exe
  C:\Windows\System\PKQziGC.exe
  2⤵
  PID:7020
- C:\Windows\System\kWruSJp.exe
  C:\Windows\System\kWruSJp.exe
  2⤵
  PID:7072
- C:\Windows\System\npMEjMX.exe
  C:\Windows\System\npMEjMX.exe
  2⤵
  PID:7096
- C:\Windows\System\ZAQyZDX.exe
  C:\Windows\System\ZAQyZDX.exe
  2⤵
  PID:7128
- C:\Windows\System\GLaFVIi.exe
  C:\Windows\System\GLaFVIi.exe
  2⤵
  PID:7152
- C:\Windows\System\DEhXDTa.exe
  C:\Windows\System\DEhXDTa.exe
  2⤵
  PID:6152
- C:\Windows\System\AgUOSKg.exe
  C:\Windows\System\AgUOSKg.exe
  2⤵
  PID:6188
- C:\Windows\System\UxVleko.exe
  C:\Windows\System\UxVleko.exe
  2⤵
  PID:6232
- C:\Windows\System\fkpBHiw.exe
  C:\Windows\System\fkpBHiw.exe
  2⤵
  PID:6264
- C:\Windows\System\fTeYAcb.exe
  C:\Windows\System\fTeYAcb.exe
  2⤵
  PID:6364
- C:\Windows\System\ZQEesYf.exe
  C:\Windows\System\ZQEesYf.exe
  2⤵
  PID:6320
- C:\Windows\System\BEpNcWt.exe
  C:\Windows\System\BEpNcWt.exe
  2⤵
  PID:6400
- C:\Windows\System\fthbXlr.exe
  C:\Windows\System\fthbXlr.exe
  2⤵
  PID:6456
- C:\Windows\System\hQcNZyU.exe
  C:\Windows\System\hQcNZyU.exe
  2⤵
  PID:6444
- C:\Windows\System\qXkthDM.exe
  C:\Windows\System\qXkthDM.exe
  2⤵
  PID:6616
- C:\Windows\System\YfUJlIB.exe
  C:\Windows\System\YfUJlIB.exe
  2⤵
  PID:6644
- C:\Windows\System\iIsPPHh.exe
  C:\Windows\System\iIsPPHh.exe
  2⤵
  PID:6540
- C:\Windows\System\yXHZmeD.exe
  C:\Windows\System\yXHZmeD.exe
  2⤵
  PID:6668
- C:\Windows\System\igxwrBM.exe
  C:\Windows\System\igxwrBM.exe
  2⤵
  PID:6808
- C:\Windows\System\fukaFeE.exe
  C:\Windows\System\fukaFeE.exe
  2⤵
  PID:6916
- C:\Windows\System\DNpPznp.exe
  C:\Windows\System\DNpPznp.exe
  2⤵
  PID:6820
- C:\Windows\System\IheJrWG.exe
  C:\Windows\System\IheJrWG.exe
  2⤵
  PID:6872
- C:\Windows\System\suHgdUI.exe
  C:\Windows\System\suHgdUI.exe
  2⤵
  PID:6888
- C:\Windows\System\wuDLMeM.exe
  C:\Windows\System\wuDLMeM.exe
  2⤵
  PID:7104
- C:\Windows\System\rjeaFjp.exe
  C:\Windows\System\rjeaFjp.exe
  2⤵
  PID:7160
- C:\Windows\System\zAHaZGx.exe
  C:\Windows\System\zAHaZGx.exe
  2⤵
  PID:6624
- C:\Windows\System\qLkwjRv.exe
  C:\Windows\System\qLkwjRv.exe
  2⤵
  PID:6336
- C:\Windows\System\OGjxwVm.exe
  C:\Windows\System\OGjxwVm.exe
  2⤵
  PID:6384
- C:\Windows\System\WXgQmjn.exe
  C:\Windows\System\WXgQmjn.exe
  2⤵
  PID:6500
- C:\Windows\System\xYIkQCA.exe
  C:\Windows\System\xYIkQCA.exe
  2⤵
  PID:6760
- C:\Windows\System\IwtliuK.exe
  C:\Windows\System\IwtliuK.exe
  2⤵
  PID:7172
- C:\Windows\System\TpEpmVM.exe
  C:\Windows\System\TpEpmVM.exe
  2⤵
  PID:7196
- C:\Windows\System\eSrzgLt.exe
  C:\Windows\System\eSrzgLt.exe
  2⤵
  PID:7216
- C:\Windows\System\kDuwLEY.exe
  C:\Windows\System\kDuwLEY.exe
  2⤵
  PID:7236
- C:\Windows\System\rtdJsXD.exe
  C:\Windows\System\rtdJsXD.exe
  2⤵
  PID:7264
- C:\Windows\System\HVXoATK.exe
  C:\Windows\System\HVXoATK.exe
  2⤵
  PID:7292
- C:\Windows\System\leGGBSE.exe
  C:\Windows\System\leGGBSE.exe
  2⤵
  PID:7312
- C:\Windows\System\XVEYgZC.exe
  C:\Windows\System\XVEYgZC.exe
  2⤵
  PID:7332
- C:\Windows\System\dYyETCQ.exe
  C:\Windows\System\dYyETCQ.exe
  2⤵
  PID:7352
- C:\Windows\System\fAUNgSn.exe
  C:\Windows\System\fAUNgSn.exe
  2⤵
  PID:7372
- C:\Windows\System\YHALETk.exe
  C:\Windows\System\YHALETk.exe
  2⤵
  PID:7392
- C:\Windows\System\ShgGCpN.exe
  C:\Windows\System\ShgGCpN.exe
  2⤵
  PID:7416
- C:\Windows\System\QXDLOML.exe
  C:\Windows\System\QXDLOML.exe
  2⤵
  PID:7436
- C:\Windows\System\gkKDCRn.exe
  C:\Windows\System\gkKDCRn.exe
  2⤵
  PID:7504
- C:\Windows\System\wkHFpNa.exe
  C:\Windows\System\wkHFpNa.exe
  2⤵
  PID:7532
- C:\Windows\System\LlcKyFy.exe
  C:\Windows\System\LlcKyFy.exe
  2⤵
  PID:7560
- C:\Windows\System\RxlACku.exe
  C:\Windows\System\RxlACku.exe
  2⤵
  PID:7576
- C:\Windows\System\ALViOPt.exe
  C:\Windows\System\ALViOPt.exe
  2⤵
  PID:7592
- C:\Windows\System\xgQQzNl.exe
  C:\Windows\System\xgQQzNl.exe
  2⤵
  PID:7616
- C:\Windows\System\MPPCLtj.exe
  C:\Windows\System\MPPCLtj.exe
  2⤵
  PID:7644
- C:\Windows\System\yKYtvwC.exe
  C:\Windows\System\yKYtvwC.exe
  2⤵
  PID:7664
- C:\Windows\System\GMShmlW.exe
  C:\Windows\System\GMShmlW.exe
  2⤵
  PID:7684
- C:\Windows\System\dvsmUkt.exe
  C:\Windows\System\dvsmUkt.exe
  2⤵
  PID:7700
- C:\Windows\System\vBCPmce.exe
  C:\Windows\System\vBCPmce.exe
  2⤵
  PID:7720
- C:\Windows\System\yKxnVWY.exe
  C:\Windows\System\yKxnVWY.exe
  2⤵
  PID:7740
- C:\Windows\System\fCWzEiI.exe
  C:\Windows\System\fCWzEiI.exe
  2⤵
  PID:7760
- C:\Windows\System\DHpEEqK.exe
  C:\Windows\System\DHpEEqK.exe
  2⤵
  PID:7784
- C:\Windows\System\vxNUXRz.exe
  C:\Windows\System\vxNUXRz.exe
  2⤵
  PID:7804
- C:\Windows\System\oKmByIH.exe
  C:\Windows\System\oKmByIH.exe
  2⤵
  PID:7824
- C:\Windows\System\cQCtnDC.exe
  C:\Windows\System\cQCtnDC.exe
  2⤵
  PID:7852
- C:\Windows\System\tDZnPhu.exe
  C:\Windows\System\tDZnPhu.exe
  2⤵
  PID:7872
- C:\Windows\System\UDNGEwn.exe
  C:\Windows\System\UDNGEwn.exe
  2⤵
  PID:7896
- C:\Windows\System\BVOTQuN.exe
  C:\Windows\System\BVOTQuN.exe
  2⤵
  PID:7916
- C:\Windows\System\HpuoxNd.exe
  C:\Windows\System\HpuoxNd.exe
  2⤵
  PID:7944
- C:\Windows\System\kRfGGRx.exe
  C:\Windows\System\kRfGGRx.exe
  2⤵
  PID:7964
- C:\Windows\System\nARDDVM.exe
  C:\Windows\System\nARDDVM.exe
  2⤵
  PID:7988
- C:\Windows\System\MWOsLWE.exe
  C:\Windows\System\MWOsLWE.exe
  2⤵
  PID:8008
- C:\Windows\System\UBpBFyG.exe
  C:\Windows\System\UBpBFyG.exe
  2⤵
  PID:8024
- C:\Windows\System\OlaBmdd.exe
  C:\Windows\System\OlaBmdd.exe
  2⤵
  PID:8048
- C:\Windows\System\gmSirPR.exe
  C:\Windows\System\gmSirPR.exe
  2⤵
  PID:8068
- C:\Windows\System\qplYAet.exe
  C:\Windows\System\qplYAet.exe
  2⤵
  PID:8092
- C:\Windows\System\aDZFTiI.exe
  C:\Windows\System\aDZFTiI.exe
  2⤵
  PID:8112
- C:\Windows\System\bjakgUg.exe
  C:\Windows\System\bjakgUg.exe
  2⤵
  PID:8132
- C:\Windows\System\mlRzHpe.exe
  C:\Windows\System\mlRzHpe.exe
  2⤵
  PID:8152
- C:\Windows\System\bdCCcoE.exe
  C:\Windows\System\bdCCcoE.exe
  2⤵
  PID:8168
- C:\Windows\System\SRMCYie.exe
  C:\Windows\System\SRMCYie.exe
  2⤵
  PID:6224
- C:\Windows\System\LGmUvur.exe
  C:\Windows\System\LGmUvur.exe
  2⤵
  PID:7056
- C:\Windows\System\etwTHeG.exe
  C:\Windows\System\etwTHeG.exe
  2⤵
  PID:7016
- C:\Windows\System\AAjaNZa.exe
  C:\Windows\System\AAjaNZa.exe
  2⤵
  PID:7148
- C:\Windows\System\JPuUrBw.exe
  C:\Windows\System\JPuUrBw.exe
  2⤵
  PID:6992
- C:\Windows\System\ZYejSft.exe
  C:\Windows\System\ZYejSft.exe
  2⤵
  PID:7180
- C:\Windows\System\OgMaNoB.exe
  C:\Windows\System\OgMaNoB.exe
  2⤵
  PID:7244
- C:\Windows\System\SQberAR.exe
  C:\Windows\System\SQberAR.exe
  2⤵
  PID:6348
- C:\Windows\System\SMOfFto.exe
  C:\Windows\System\SMOfFto.exe
  2⤵
  PID:7344
- C:\Windows\System\bxbqmRO.exe
  C:\Windows\System\bxbqmRO.exe
  2⤵
  PID:7388
- C:\Windows\System\CHVAMXr.exe
  C:\Windows\System\CHVAMXr.exe
  2⤵
  PID:7364
- C:\Windows\System\adRUERY.exe
  C:\Windows\System\adRUERY.exe
  2⤵
  PID:7500
- C:\Windows\System\PElYbjb.exe
  C:\Windows\System\PElYbjb.exe
  2⤵
  PID:7544
- C:\Windows\System\LXxicUl.exe
  C:\Windows\System\LXxicUl.exe
  2⤵
  PID:7428
- C:\Windows\System\LEELhjn.exe
  C:\Windows\System\LEELhjn.exe
  2⤵
  PID:7776
- C:\Windows\System\oYLPkWe.exe
  C:\Windows\System\oYLPkWe.exe
  2⤵
  PID:7588
- C:\Windows\System\PVEsVaK.exe
  C:\Windows\System\PVEsVaK.exe
  2⤵
  PID:7932
- C:\Windows\System\WcqmiLt.exe
  C:\Windows\System\WcqmiLt.exe
  2⤵
  PID:7732
- C:\Windows\System\KIFlLPf.exe
  C:\Windows\System\KIFlLPf.exe
  2⤵
  PID:7972
- C:\Windows\System\IFfNRik.exe
  C:\Windows\System\IFfNRik.exe
  2⤵
  PID:8060
- C:\Windows\System\eThufOj.exe
  C:\Windows\System\eThufOj.exe
  2⤵
  PID:7868
- C:\Windows\System\VibvQRG.exe
  C:\Windows\System\VibvQRG.exe
  2⤵
  PID:7908
- C:\Windows\System\cmAOTAQ.exe
  C:\Windows\System\cmAOTAQ.exe
  2⤵
  PID:7676
- C:\Windows\System\kmyImNY.exe
  C:\Windows\System\kmyImNY.exe
  2⤵
  PID:8512
- C:\Windows\System\UCMwmMO.exe
  C:\Windows\System\UCMwmMO.exe
  2⤵
  PID:8536
- C:\Windows\System\gKABymp.exe
  C:\Windows\System\gKABymp.exe
  2⤵
  PID:8556
- C:\Windows\System\rdGgjbD.exe
  C:\Windows\System\rdGgjbD.exe
  2⤵
  PID:8576
- C:\Windows\System\myddYCf.exe
  C:\Windows\System\myddYCf.exe
  2⤵
  PID:8596
- C:\Windows\System\ZZKluMT.exe
  C:\Windows\System\ZZKluMT.exe
  2⤵
  PID:8616
- C:\Windows\System\LRfSCpY.exe
  C:\Windows\System\LRfSCpY.exe
  2⤵
  PID:8640
- C:\Windows\System\tJwoGJH.exe
  C:\Windows\System\tJwoGJH.exe
  2⤵
  PID:8656
- C:\Windows\System\ZOFwWxh.exe
  C:\Windows\System\ZOFwWxh.exe
  2⤵
  PID:8672
- C:\Windows\System\MDPamcb.exe
  C:\Windows\System\MDPamcb.exe
  2⤵
  PID:8700
- C:\Windows\System\GVQGnLX.exe
  C:\Windows\System\GVQGnLX.exe
  2⤵
  PID:8724
- C:\Windows\System\OOLAKBk.exe
  C:\Windows\System\OOLAKBk.exe
  2⤵
  PID:8760
- C:\Windows\System\gWDSxkR.exe
  C:\Windows\System\gWDSxkR.exe
  2⤵
  PID:8796
- C:\Windows\System\kAQmjjl.exe
  C:\Windows\System\kAQmjjl.exe
  2⤵
  PID:8892
- C:\Windows\System\mpcWybG.exe
  C:\Windows\System\mpcWybG.exe
  2⤵
  PID:8908
- C:\Windows\System\ekUjRPS.exe
  C:\Windows\System\ekUjRPS.exe
  2⤵
  PID:8928
- C:\Windows\System\eFVbwTn.exe
  C:\Windows\System\eFVbwTn.exe
  2⤵
  PID:8944
- C:\Windows\System\uWEahWz.exe
  C:\Windows\System\uWEahWz.exe
  2⤵
  PID:8960
- C:\Windows\System\VtozfxV.exe
  C:\Windows\System\VtozfxV.exe
  2⤵
  PID:8984
- C:\Windows\System\XIRcmvV.exe
  C:\Windows\System\XIRcmvV.exe
  2⤵
  PID:9012
- C:\Windows\System\DjhNMOq.exe
  C:\Windows\System\DjhNMOq.exe
  2⤵
  PID:9040
- C:\Windows\System\OITkQPn.exe
  C:\Windows\System\OITkQPn.exe
  2⤵
  PID:9056
- C:\Windows\System\EqmQwXd.exe
  C:\Windows\System\EqmQwXd.exe
  2⤵
  PID:9088
- C:\Windows\System\yocMExw.exe
  C:\Windows\System\yocMExw.exe
  2⤵
  PID:9108
- C:\Windows\System\hYCuvPH.exe
  C:\Windows\System\hYCuvPH.exe
  2⤵
  PID:9128
- C:\Windows\System\dlWKUWt.exe
  C:\Windows\System\dlWKUWt.exe
  2⤵
  PID:9148
- C:\Windows\System\mZrWRvR.exe
  C:\Windows\System\mZrWRvR.exe
  2⤵
  PID:7608
- C:\Windows\System\KzRiYFq.exe
  C:\Windows\System\KzRiYFq.exe
  2⤵
  PID:7328
- C:\Windows\System\WtHkxAw.exe
  C:\Windows\System\WtHkxAw.exe
  2⤵
  PID:7524
- C:\Windows\System\ZTIWZAd.exe
  C:\Windows\System\ZTIWZAd.exe
  2⤵
  PID:7728
- C:\Windows\System\NlAvRVg.exe
  C:\Windows\System\NlAvRVg.exe
  2⤵
  PID:7144
- C:\Windows\System\wrOhBbw.exe
  C:\Windows\System\wrOhBbw.exe
  2⤵
  PID:6584
- C:\Windows\System\GKpGXMQ.exe
  C:\Windows\System\GKpGXMQ.exe
  2⤵
  PID:7092
- C:\Windows\System\WTvWmcS.exe
  C:\Windows\System\WTvWmcS.exe
  2⤵
  PID:7540
- C:\Windows\System\cjJbosZ.exe
  C:\Windows\System\cjJbosZ.exe
  2⤵
  PID:7768
- C:\Windows\System\nLVIKmo.exe
  C:\Windows\System\nLVIKmo.exe
  2⤵
  PID:8020
- C:\Windows\System\CBpLBBn.exe
  C:\Windows\System\CBpLBBn.exe
  2⤵
  PID:8104
- C:\Windows\System\xXaNass.exe
  C:\Windows\System\xXaNass.exe
  2⤵
  PID:6972
- C:\Windows\System\ylIKzCI.exe
  C:\Windows\System\ylIKzCI.exe
  2⤵
  PID:8320
- C:\Windows\System\sATnvzr.exe
  C:\Windows\System\sATnvzr.exe
  2⤵
  PID:8376
- C:\Windows\System\OVVEfXo.exe
  C:\Windows\System\OVVEfXo.exe
  2⤵
  PID:8400
- C:\Windows\System\eGEvIdd.exe
  C:\Windows\System\eGEvIdd.exe
  2⤵
  PID:3304
- C:\Windows\System\NSTigMd.exe
  C:\Windows\System\NSTigMd.exe
  2⤵
  PID:8664
- C:\Windows\System\xBvJReI.exe
  C:\Windows\System\xBvJReI.exe
  2⤵
  PID:8612
- C:\Windows\System\ByBozqu.exe
  C:\Windows\System\ByBozqu.exe
  2⤵
  PID:9124
- C:\Windows\System\DpFpwTF.exe
  C:\Windows\System\DpFpwTF.exe
  2⤵
  PID:8164
- C:\Windows\System\YGPWrvT.exe
  C:\Windows\System\YGPWrvT.exe
  2⤵
  PID:9000
- C:\Windows\System\eGhQVXt.exe
  C:\Windows\System\eGhQVXt.exe
  2⤵
  PID:9008
- C:\Windows\System\TmrzKoy.exe
  C:\Windows\System\TmrzKoy.exe
  2⤵
  PID:7424
- C:\Windows\System\UHsseWB.exe
  C:\Windows\System\UHsseWB.exe
  2⤵
  PID:8340
- C:\Windows\System\GChyUtu.exe
  C:\Windows\System\GChyUtu.exe
  2⤵
  PID:9168
- C:\Windows\System\IHiKfdn.exe
  C:\Windows\System\IHiKfdn.exe
  2⤵
  PID:8256
- C:\Windows\System\bLQqHUA.exe
  C:\Windows\System\bLQqHUA.exe
  2⤵
  PID:8384
- C:\Windows\System\vFNdQwW.exe
  C:\Windows\System\vFNdQwW.exe
  2⤵
  PID:9184
- C:\Windows\System\QVNplxI.exe
  C:\Windows\System\QVNplxI.exe
  2⤵
  PID:7612
- C:\Windows\System\JcEuzLb.exe
  C:\Windows\System\JcEuzLb.exe
  2⤵
  PID:3260
- C:\Windows\System\fkEdrzQ.exe
  C:\Windows\System\fkEdrzQ.exe
  2⤵
  PID:8748
- C:\Windows\System\DUGYaNz.exe
  C:\Windows\System\DUGYaNz.exe
  2⤵
  PID:4544
- C:\Windows\System\kekpPNJ.exe
  C:\Windows\System\kekpPNJ.exe
  2⤵
  PID:8868
- C:\Windows\System\zjMRQAC.exe
  C:\Windows\System\zjMRQAC.exe
  2⤵
  PID:7432
- C:\Windows\System\zhESksE.exe
  C:\Windows\System\zhESksE.exe
  2⤵
  PID:9052
- C:\Windows\System\eWQhnvt.exe
  C:\Windows\System\eWQhnvt.exe
  2⤵
  PID:8952
- C:\Windows\System\drBaSLr.exe
  C:\Windows\System\drBaSLr.exe
  2⤵
  PID:7844
- C:\Windows\System\LAhRbDh.exe
  C:\Windows\System\LAhRbDh.exe
  2⤵
  PID:4724
- C:\Windows\System\WMsOLrv.exe
  C:\Windows\System\WMsOLrv.exe
  2⤵
  PID:4008
- C:\Windows\System\LERsBDT.exe
  C:\Windows\System\LERsBDT.exe
  2⤵
  PID:7892
- C:\Windows\System\VDedIId.exe
  C:\Windows\System\VDedIId.exe
  2⤵
  PID:8624
- C:\Windows\System\vaeghdj.exe
  C:\Windows\System\vaeghdj.exe
  2⤵
  PID:9300
- C:\Windows\System\NNviroc.exe
  C:\Windows\System\NNviroc.exe
  2⤵
  PID:9316
- C:\Windows\System\UAvsLCf.exe
  C:\Windows\System\UAvsLCf.exe
  2⤵
  PID:9332
- C:\Windows\System\PqcgPfA.exe
  C:\Windows\System\PqcgPfA.exe
  2⤵
  PID:9356
- C:\Windows\System\ylFfzHD.exe
  C:\Windows\System\ylFfzHD.exe
  2⤵
  PID:9372
- C:\Windows\System\CHiQgOw.exe
  C:\Windows\System\CHiQgOw.exe
  2⤵
  PID:9484
- C:\Windows\System\vONqrZw.exe
  C:\Windows\System\vONqrZw.exe
  2⤵
  PID:9504
- C:\Windows\System\ChwRerK.exe
  C:\Windows\System\ChwRerK.exe
  2⤵
  PID:9524
- C:\Windows\System\pgoFsxm.exe
  C:\Windows\System\pgoFsxm.exe
  2⤵
  PID:9556
- C:\Windows\System\vMNkhlS.exe
  C:\Windows\System\vMNkhlS.exe
  2⤵
  PID:9584
- C:\Windows\System\wvMJLKd.exe
  C:\Windows\System\wvMJLKd.exe
  2⤵
  PID:9604
- C:\Windows\System\YQtSSdn.exe
  C:\Windows\System\YQtSSdn.exe
  2⤵
  PID:9628
- C:\Windows\System\SqgSzjm.exe
  C:\Windows\System\SqgSzjm.exe
  2⤵
  PID:9648
- C:\Windows\System\ETbgluQ.exe
  C:\Windows\System\ETbgluQ.exe
  2⤵
  PID:9668
- C:\Windows\System\pNSFkUS.exe
  C:\Windows\System\pNSFkUS.exe
  2⤵
  PID:9708
- C:\Windows\System\bDTemUH.exe
  C:\Windows\System\bDTemUH.exe
  2⤵
  PID:9776
- C:\Windows\System\IpGrAPX.exe
  C:\Windows\System\IpGrAPX.exe
  2⤵
  PID:9820
- C:\Windows\System\DbJpwES.exe
  C:\Windows\System\DbJpwES.exe
  2⤵
  PID:9844
- C:\Windows\System\CgWLywZ.exe
  C:\Windows\System\CgWLywZ.exe
  2⤵
  PID:9864
- C:\Windows\System\BjauOkg.exe
  C:\Windows\System\BjauOkg.exe
  2⤵
  PID:9884
- C:\Windows\System\AmaNqgO.exe
  C:\Windows\System\AmaNqgO.exe
  2⤵
  PID:9904
- C:\Windows\System\bYEOOLb.exe
  C:\Windows\System\bYEOOLb.exe
  2⤵
  PID:9924
- C:\Windows\System\AKlZeoh.exe
  C:\Windows\System\AKlZeoh.exe
  2⤵
  PID:9964
- C:\Windows\System\tDYtAqp.exe
  C:\Windows\System\tDYtAqp.exe
  2⤵
  PID:9980
- C:\Windows\System\sgCimKl.exe
  C:\Windows\System\sgCimKl.exe
  2⤵
  PID:10008
- C:\Windows\System\GpQtHvA.exe
  C:\Windows\System\GpQtHvA.exe
  2⤵
  PID:10028
- C:\Windows\System\vQAvAnN.exe
  C:\Windows\System\vQAvAnN.exe
  2⤵
  PID:10048
- C:\Windows\System\bcjbOxm.exe
  C:\Windows\System\bcjbOxm.exe
  2⤵
  PID:10072
- C:\Windows\System\ZCsBcDC.exe
  C:\Windows\System\ZCsBcDC.exe
  2⤵
  PID:10096
- C:\Windows\System\kIqHFTn.exe
  C:\Windows\System\kIqHFTn.exe
  2⤵
  PID:10128
- C:\Windows\System\DpfHLcU.exe
  C:\Windows\System\DpfHLcU.exe
  2⤵
  PID:10152
- C:\Windows\System\xplSuuI.exe
  C:\Windows\System\xplSuuI.exe
  2⤵
  PID:10180
- C:\Windows\System\tqeRzaO.exe
  C:\Windows\System\tqeRzaO.exe
  2⤵
  PID:10232
- C:\Windows\System\EaaroKb.exe
  C:\Windows\System\EaaroKb.exe
  2⤵
  PID:7660
- C:\Windows\System\IRFfYWD.exe
  C:\Windows\System\IRFfYWD.exe
  2⤵
  PID:2208
- C:\Windows\System\qsAsBsM.exe
  C:\Windows\System\qsAsBsM.exe
  2⤵
  PID:8684
- C:\Windows\System\JCVtYYy.exe
  C:\Windows\System\JCVtYYy.exe
  2⤵
  PID:9272
- C:\Windows\System\dfSyBTs.exe
  C:\Windows\System\dfSyBTs.exe
  2⤵
  PID:9240
- C:\Windows\System\ArGyxlR.exe
  C:\Windows\System\ArGyxlR.exe
  2⤵
  PID:7816
- C:\Windows\System\rvDBhFB.exe
  C:\Windows\System\rvDBhFB.exe
  2⤵
  PID:1276
- C:\Windows\System\IfGpcaq.exe
  C:\Windows\System\IfGpcaq.exe
  2⤵
  PID:4572
- C:\Windows\System\hXLPRJM.exe
  C:\Windows\System\hXLPRJM.exe
  2⤵
  PID:9412
- C:\Windows\System\SBaqAUv.exe
  C:\Windows\System\SBaqAUv.exe
  2⤵
  PID:5164
- C:\Windows\System\ImxwHPe.exe
  C:\Windows\System\ImxwHPe.exe
  2⤵
  PID:6148
- C:\Windows\System\UQdKuUK.exe
  C:\Windows\System\UQdKuUK.exe
  2⤵
  PID:9308
- C:\Windows\System\obBYALT.exe
  C:\Windows\System\obBYALT.exe
  2⤵
  PID:9532
- C:\Windows\System\kFajfCJ.exe
  C:\Windows\System\kFajfCJ.exe
  2⤵
  PID:9616
- C:\Windows\System\zeWjEPy.exe
  C:\Windows\System\zeWjEPy.exe
  2⤵
  PID:9548
- C:\Windows\System\PKAnJjA.exe
  C:\Windows\System\PKAnJjA.exe
  2⤵
  PID:9920
- C:\Windows\System\eaeIKiz.exe
  C:\Windows\System\eaeIKiz.exe
  2⤵
  PID:9880
- C:\Windows\System\nIysnJs.exe
  C:\Windows\System\nIysnJs.exe
  2⤵
  PID:9960
- C:\Windows\System\ypfHFOu.exe
  C:\Windows\System\ypfHFOu.exe
  2⤵
  PID:10160
- C:\Windows\System\elUmhkc.exe
  C:\Windows\System\elUmhkc.exe
  2⤵
  PID:10064
- C:\Windows\System\Plifqhm.exe
  C:\Windows\System\Plifqhm.exe
  2⤵
  PID:10124
- C:\Windows\System\urGtESC.exe
  C:\Windows\System\urGtESC.exe
  2⤵
  PID:6488
- C:\Windows\System\JglmUyG.exe
  C:\Windows\System\JglmUyG.exe
  2⤵
  PID:8180
- C:\Windows\System\KbgwvZs.exe
  C:\Windows\System\KbgwvZs.exe
  2⤵
  PID:9352
- C:\Windows\System\MWkAskx.exe
  C:\Windows\System\MWkAskx.exe
  2⤵
  PID:8936
- C:\Windows\System\LEMTJkq.exe
  C:\Windows\System\LEMTJkq.exe
  2⤵
  PID:9936
- C:\Windows\System\NDlfjBP.exe
  C:\Windows\System\NDlfjBP.exe
  2⤵
  PID:9916
- C:\Windows\System\ZTeJsAX.exe
  C:\Windows\System\ZTeJsAX.exe
  2⤵
  PID:9592
- C:\Windows\System\whkHmqP.exe
  C:\Windows\System\whkHmqP.exe
  2⤵
  PID:9228
- C:\Windows\System\dtNmMAZ.exe
  C:\Windows\System\dtNmMAZ.exe
  2⤵
  PID:9720
- C:\Windows\System\ZrvmfVC.exe
  C:\Windows\System\ZrvmfVC.exe
  2⤵
  PID:9516
- C:\Windows\System\RiYHyur.exe
  C:\Windows\System\RiYHyur.exe
  2⤵
  PID:10216
- C:\Windows\System\rsVpqMP.exe
  C:\Windows\System\rsVpqMP.exe
  2⤵
  PID:9196
- C:\Windows\System\MtMCKwS.exe
  C:\Windows\System\MtMCKwS.exe
  2⤵
  PID:8712
- C:\Windows\System\IsbNmhc.exe
  C:\Windows\System\IsbNmhc.exe
  2⤵
  PID:8708
- C:\Windows\System\RqAvsHt.exe
  C:\Windows\System\RqAvsHt.exe
  2⤵
  PID:9312
- C:\Windows\System\MtLvpUJ.exe
  C:\Windows\System\MtLvpUJ.exe
  2⤵
  PID:10244
- C:\Windows\System\YVJHwkT.exe
  C:\Windows\System\YVJHwkT.exe
  2⤵
  PID:10264
- C:\Windows\System\cCdcBVr.exe
  C:\Windows\System\cCdcBVr.exe
  2⤵
  PID:10284
- C:\Windows\System\IWmJRlf.exe
  C:\Windows\System\IWmJRlf.exe
  2⤵
  PID:10348
- C:\Windows\System\shbvhJh.exe
  C:\Windows\System\shbvhJh.exe
  2⤵
  PID:10368
- C:\Windows\System\FkCvGRs.exe
  C:\Windows\System\FkCvGRs.exe
  2⤵
  PID:10404
- C:\Windows\System\yVsCiTn.exe
  C:\Windows\System\yVsCiTn.exe
  2⤵
  PID:10420
- C:\Windows\System\REshSCI.exe
  C:\Windows\System\REshSCI.exe
  2⤵
  PID:10496
- C:\Windows\System\pCrzYKQ.exe
  C:\Windows\System\pCrzYKQ.exe
  2⤵
  PID:10524
- C:\Windows\System\XAjcTwu.exe
  C:\Windows\System\XAjcTwu.exe
  2⤵
  PID:10560
- C:\Windows\System\fmCZCdf.exe
  C:\Windows\System\fmCZCdf.exe
  2⤵
  PID:10588
- C:\Windows\System\ZNhSJXx.exe
  C:\Windows\System\ZNhSJXx.exe
  2⤵
  PID:10608
- C:\Windows\System\WopuQdH.exe
  C:\Windows\System\WopuQdH.exe
  2⤵
  PID:10624
- C:\Windows\System\rdumLVb.exe
  C:\Windows\System\rdumLVb.exe
  2⤵
  PID:10640
- C:\Windows\System\befsPGb.exe
  C:\Windows\System\befsPGb.exe
  2⤵
  PID:10656
- C:\Windows\System\IdvwkYG.exe
  C:\Windows\System\IdvwkYG.exe
  2⤵
  PID:10676
- C:\Windows\System\NaPxbKD.exe
  C:\Windows\System\NaPxbKD.exe
  2⤵
  PID:10704
- C:\Windows\System\uTjIhMy.exe
  C:\Windows\System\uTjIhMy.exe
  2⤵
  PID:10724
- C:\Windows\System\ToaaYcH.exe
  C:\Windows\System\ToaaYcH.exe
  2⤵
  PID:10744
- C:\Windows\System\aUhlfPL.exe
  C:\Windows\System\aUhlfPL.exe
  2⤵
  PID:10768
- C:\Windows\System\xaxwNwK.exe
  C:\Windows\System\xaxwNwK.exe
  2⤵
  PID:10808
- C:\Windows\System\GOljdHo.exe
  C:\Windows\System\GOljdHo.exe
  2⤵
  PID:10824
- C:\Windows\System\WxTTTJp.exe
  C:\Windows\System\WxTTTJp.exe
  2⤵
  PID:10844
- C:\Windows\System\TFtWLll.exe
  C:\Windows\System\TFtWLll.exe
  2⤵
  PID:10864
- C:\Windows\System\bUVYKhT.exe
  C:\Windows\System\bUVYKhT.exe
  2⤵
  PID:10892
- C:\Windows\System\aygqZCP.exe
  C:\Windows\System\aygqZCP.exe
  2⤵
  PID:10912
- C:\Windows\System\cQUuVRc.exe
  C:\Windows\System\cQUuVRc.exe
  2⤵
  PID:10936
- C:\Windows\System\BzEKfuQ.exe
  C:\Windows\System\BzEKfuQ.exe
  2⤵
  PID:10956
- C:\Windows\System\ZHBwjVF.exe
  C:\Windows\System\ZHBwjVF.exe
  2⤵
  PID:10976
- C:\Windows\System\PNpBkAe.exe
  C:\Windows\System\PNpBkAe.exe
  2⤵
  PID:10996
- C:\Windows\System\faJQirY.exe
  C:\Windows\System\faJQirY.exe
  2⤵
  PID:11080
- C:\Windows\System\bFTAyHe.exe
  C:\Windows\System\bFTAyHe.exe
  2⤵
  PID:11104
- C:\Windows\System\iXRrJKv.exe
  C:\Windows\System\iXRrJKv.exe
  2⤵
  PID:11124
- C:\Windows\System\dUxmDff.exe
  C:\Windows\System\dUxmDff.exe
  2⤵
  PID:11152
- C:\Windows\System\KQURHke.exe
  C:\Windows\System\KQURHke.exe
  2⤵
  PID:11172
- C:\Windows\System\cDHJvyH.exe
  C:\Windows\System\cDHJvyH.exe
  2⤵
  PID:11196
- C:\Windows\System\vpFnrSw.exe
  C:\Windows\System\vpFnrSw.exe
  2⤵
  PID:11216
- C:\Windows\System\xgImKpM.exe
  C:\Windows\System\xgImKpM.exe
  2⤵
  PID:11232
- C:\Windows\System\VFhFyzg.exe
  C:\Windows\System\VFhFyzg.exe
  2⤵
  PID:11260
- C:\Windows\System\MyJPHcA.exe
  C:\Windows\System\MyJPHcA.exe
  2⤵
  PID:100
- C:\Windows\System\CVwLsyj.exe
  C:\Windows\System\CVwLsyj.exe
  2⤵
  PID:10376
- C:\Windows\System\LMvTBjC.exe
  C:\Windows\System\LMvTBjC.exe
  2⤵
  PID:10632
- C:\Windows\System\LDDRYno.exe
  C:\Windows\System\LDDRYno.exe
  2⤵
  PID:10740
- C:\Windows\System\fTLwZcn.exe
  C:\Windows\System\fTLwZcn.exe
  2⤵
  PID:10652
- C:\Windows\System\sZIDvVT.exe
  C:\Windows\System\sZIDvVT.exe
  2⤵
  PID:10884
- C:\Windows\System\AFxzdWS.exe
  C:\Windows\System\AFxzdWS.exe
  2⤵
  PID:10904
- C:\Windows\System\crjRjnx.exe
  C:\Windows\System\crjRjnx.exe
  2⤵
  PID:10860
- C:\Windows\System\uiIzvwS.exe
  C:\Windows\System\uiIzvwS.exe
  2⤵
  PID:10888
- C:\Windows\System\ToaPzTD.exe
  C:\Windows\System\ToaPzTD.exe
  2⤵
  PID:10948
- C:\Windows\System\ICrnLtO.exe
  C:\Windows\System\ICrnLtO.exe
  2⤵
  PID:10972
- C:\Windows\System\lxGLKQZ.exe
  C:\Windows\System\lxGLKQZ.exe
  2⤵
  PID:10260
- C:\Windows\System\dWZrxeC.exe
  C:\Windows\System\dWZrxeC.exe
  2⤵
  PID:11036
- C:\Windows\System\IWVgJTk.exe
  C:\Windows\System\IWVgJTk.exe
  2⤵
  PID:11256
- C:\Windows\System\csGNBSz.exe
  C:\Windows\System\csGNBSz.exe
  2⤵
  PID:11224
- C:\Windows\System\upKgmvP.exe
  C:\Windows\System\upKgmvP.exe
  2⤵
  PID:11096
- C:\Windows\System\FuHDVbP.exe
  C:\Windows\System\FuHDVbP.exe
  2⤵
  PID:11160
- C:\Windows\System\csNHAEe.exe
  C:\Windows\System\csNHAEe.exe
  2⤵
  PID:10648
- C:\Windows\System\WLCRlPi.exe
  C:\Windows\System\WLCRlPi.exe
  2⤵
  PID:10568
- C:\Windows\System\QgTIenx.exe
  C:\Windows\System\QgTIenx.exe
  2⤵
  PID:10636
- C:\Windows\System\OFLFhAz.exe
  C:\Windows\System\OFLFhAz.exe
  2⤵
  PID:4596
- C:\Windows\System\PDHQNKE.exe
  C:\Windows\System\PDHQNKE.exe
  2⤵
  PID:11012
- C:\Windows\System\UBEvQah.exe
  C:\Windows\System\UBEvQah.exe
  2⤵
  PID:11088
- C:\Windows\System\VhHdsov.exe
  C:\Windows\System\VhHdsov.exe
  2⤵
  PID:11052
- C:\Windows\System\TDgkWtM.exe
  C:\Windows\System\TDgkWtM.exe
  2⤵
  PID:11284
- C:\Windows\System\ymjZxqb.exe
  C:\Windows\System\ymjZxqb.exe
  2⤵
  PID:11312
- C:\Windows\System\MEmmuGU.exe
  C:\Windows\System\MEmmuGU.exe
  2⤵
  PID:11520
- C:\Windows\System\NLEpidZ.exe
  C:\Windows\System\NLEpidZ.exe
  2⤵
  PID:11536
- C:\Windows\System\ARykxRY.exe
  C:\Windows\System\ARykxRY.exe
  2⤵
  PID:11552
- C:\Windows\System\DfoYqjx.exe
  C:\Windows\System\DfoYqjx.exe
  2⤵
  PID:11576
- C:\Windows\System\yfRVPJz.exe
  C:\Windows\System\yfRVPJz.exe
  2⤵
  PID:11592
- C:\Windows\System\hsExgVX.exe
  C:\Windows\System\hsExgVX.exe
  2⤵
  PID:11612
- C:\Windows\System\HGQKWzf.exe
  C:\Windows\System\HGQKWzf.exe
  2⤵
  PID:11632
- C:\Windows\System\QYxOBxQ.exe
  C:\Windows\System\QYxOBxQ.exe
  2⤵
  PID:11668
- C:\Windows\System\LSIkEfU.exe
  C:\Windows\System\LSIkEfU.exe
  2⤵
  PID:11688
- C:\Windows\System\PBBiGUk.exe
  C:\Windows\System\PBBiGUk.exe
  2⤵
  PID:11712
- C:\Windows\System\XrOopXP.exe
  C:\Windows\System\XrOopXP.exe
  2⤵
  PID:11728
- C:\Windows\System\PlREoXS.exe
  C:\Windows\System\PlREoXS.exe
  2⤵
  PID:11748
- C:\Windows\System\sFYQuSN.exe
  C:\Windows\System\sFYQuSN.exe
  2⤵
  PID:11764
- C:\Windows\System\tYJVPDZ.exe
  C:\Windows\System\tYJVPDZ.exe
  2⤵
  PID:11780
- C:\Windows\System\vshLPfY.exe
  C:\Windows\System\vshLPfY.exe
  2⤵
  PID:11800
- C:\Windows\System\nLgzkeW.exe
  C:\Windows\System\nLgzkeW.exe
  2⤵
  PID:11816
- C:\Windows\System\rEhJEqq.exe
  C:\Windows\System\rEhJEqq.exe
  2⤵
  PID:11832
- C:\Windows\System\seisYfv.exe
  C:\Windows\System\seisYfv.exe
  2⤵
  PID:11868
- C:\Windows\System\mxZjyId.exe
  C:\Windows\System\mxZjyId.exe
  2⤵
  PID:11892
- C:\Windows\System\ifVMsEC.exe
  C:\Windows\System\ifVMsEC.exe
  2⤵
  PID:11916
- C:\Windows\System\RjwWdST.exe
  C:\Windows\System\RjwWdST.exe
  2⤵
  PID:11932
- C:\Windows\System\JzxRFiO.exe
  C:\Windows\System\JzxRFiO.exe
  2⤵
  PID:11948
- C:\Windows\System\ZsNoHlm.exe
  C:\Windows\System\ZsNoHlm.exe
  2⤵
  PID:11968
- C:\Windows\System\aGRYNfJ.exe
  C:\Windows\System\aGRYNfJ.exe
  2⤵
  PID:11992
- C:\Windows\System\EgntLeJ.exe
  C:\Windows\System\EgntLeJ.exe
  2⤵
  PID:12016
- C:\Windows\System\CzajNjR.exe
  C:\Windows\System\CzajNjR.exe
  2⤵
  PID:12036
- C:\Windows\System\VmYOhKV.exe
  C:\Windows\System\VmYOhKV.exe
  2⤵
  PID:12052
- C:\Windows\System\NglyrCg.exe
  C:\Windows\System\NglyrCg.exe
  2⤵
  PID:12076
- C:\Windows\System\UDomrLh.exe
  C:\Windows\System\UDomrLh.exe
  2⤵
  PID:12092
- C:\Windows\System\tKYsRxv.exe
  C:\Windows\System\tKYsRxv.exe
  2⤵
  PID:12108
- C:\Windows\System\psMnAJI.exe
  C:\Windows\System\psMnAJI.exe
  2⤵
  PID:12124
- C:\Windows\System\yNVusqv.exe
  C:\Windows\System\yNVusqv.exe
  2⤵
  PID:12140
- C:\Windows\System\ExnTpYX.exe
  C:\Windows\System\ExnTpYX.exe
  2⤵
  PID:12156
- C:\Windows\System\RRTDJyp.exe
  C:\Windows\System\RRTDJyp.exe
  2⤵
  PID:12196
- C:\Windows\System\IOqYsCb.exe
  C:\Windows\System\IOqYsCb.exe
  2⤵
  PID:12212
- C:\Windows\System\UrKQaBV.exe
  C:\Windows\System\UrKQaBV.exe
  2⤵
  PID:12232
- C:\Windows\System\gwFtafx.exe
  C:\Windows\System\gwFtafx.exe
  2⤵
  PID:12260
- C:\Windows\System\nlaFkbe.exe
  C:\Windows\System\nlaFkbe.exe
  2⤵
  PID:10696
- C:\Windows\System\nQYkpSt.exe
  C:\Windows\System\nQYkpSt.exe
  2⤵
  PID:5048
- C:\Windows\System\BegOXiT.exe
  C:\Windows\System\BegOXiT.exe
  2⤵
  PID:11512
- C:\Windows\System\ErAwoXg.exe
  C:\Windows\System\ErAwoXg.exe
  2⤵
  PID:224
- C:\Windows\System\ynrohxM.exe
  C:\Windows\System\ynrohxM.exe
  2⤵
  PID:11568
- C:\Windows\System\nBhTdzv.exe
  C:\Windows\System\nBhTdzv.exe
  2⤵
  PID:11628
- C:\Windows\System\UIRAIXo.exe
  C:\Windows\System\UIRAIXo.exe
  2⤵
  PID:11648
- C:\Windows\System\ygCEmPc.exe
  C:\Windows\System\ygCEmPc.exe
  2⤵
  PID:11652
- C:\Windows\System\eTUJYVf.exe
  C:\Windows\System\eTUJYVf.exe
  2⤵
  PID:11808
- C:\Windows\System\caDdfWD.exe
  C:\Windows\System\caDdfWD.exe
  2⤵
  PID:11928
- C:\Windows\System\oOwjGZs.exe
  C:\Windows\System\oOwjGZs.exe
  2⤵
  PID:11976
- C:\Windows\System\AVPOvOQ.exe
  C:\Windows\System\AVPOvOQ.exe
  2⤵
  PID:12088
- C:\Windows\System\DfTyBVl.exe
  C:\Windows\System\DfTyBVl.exe
  2⤵
  PID:11864
- C:\Windows\System\EnVpaHM.exe
  C:\Windows\System\EnVpaHM.exe
  2⤵
  PID:12168
- C:\Windows\System\XTJcKfV.exe
  C:\Windows\System\XTJcKfV.exe
  2⤵
  PID:11884
- C:\Windows\System\OmqqZHM.exe
  C:\Windows\System\OmqqZHM.exe
  2⤵
  PID:11908
- C:\Windows\System\LxFtshb.exe
  C:\Windows\System\LxFtshb.exe
  2⤵
  PID:11944
- C:\Windows\System\YlHlXhF.exe
  C:\Windows\System\YlHlXhF.exe
  2⤵
  PID:11720
- C:\Windows\System\DxEeVrN.exe
  C:\Windows\System\DxEeVrN.exe
  2⤵
  PID:12028
- C:\Windows\System\FFReZkA.exe
  C:\Windows\System\FFReZkA.exe
  2⤵
  PID:12048
- C:\Windows\System\xVogygF.exe
  C:\Windows\System\xVogygF.exe
  2⤵
  PID:12188
- C:\Windows\System\BtYDDKy.exe
  C:\Windows\System\BtYDDKy.exe
  2⤵
  PID:11980
- C:\Windows\System\rOEhBiq.exe
  C:\Windows\System\rOEhBiq.exe
  2⤵
  PID:12024
- C:\Windows\System\gKJAktT.exe
  C:\Windows\System\gKJAktT.exe
  2⤵
  PID:12072
- C:\Windows\System\bUwkVWC.exe
  C:\Windows\System\bUwkVWC.exe
  2⤵
  PID:11324
- C:\Windows\System\kcfGMZw.exe
  C:\Windows\System\kcfGMZw.exe
  2⤵
  PID:12244
- C:\Windows\System\myAmfMj.exe
  C:\Windows\System\myAmfMj.exe
  2⤵
  PID:12296
- C:\Windows\System\fHKJRCL.exe
  C:\Windows\System\fHKJRCL.exe
  2⤵
  PID:12320
- C:\Windows\System\dcEruLx.exe
  C:\Windows\System\dcEruLx.exe
  2⤵
  PID:12344
- C:\Windows\System\RSgDHpF.exe
  C:\Windows\System\RSgDHpF.exe
  2⤵
  PID:12372
- C:\Windows\System\BVluXHn.exe
  C:\Windows\System\BVluXHn.exe
  2⤵
  PID:12388
- C:\Windows\System\YJaJzwG.exe
  C:\Windows\System\YJaJzwG.exe
  2⤵
  PID:12408
- C:\Windows\System\JSzDVgb.exe
  C:\Windows\System\JSzDVgb.exe
  2⤵
  PID:12428
- C:\Windows\System\YwHQOJB.exe
  C:\Windows\System\YwHQOJB.exe
  2⤵
  PID:12448
- C:\Windows\System\uvhAGVc.exe
  C:\Windows\System\uvhAGVc.exe
  2⤵
  PID:12472
- C:\Windows\System\eFBKFgn.exe
  C:\Windows\System\eFBKFgn.exe
  2⤵
  PID:12500
- C:\Windows\System\wXLkwSi.exe
  C:\Windows\System\wXLkwSi.exe
  2⤵
  PID:12516
- C:\Windows\System\OSAFEvg.exe
  C:\Windows\System\OSAFEvg.exe
  2⤵
  PID:12544
- C:\Windows\System\nCgXpIq.exe
  C:\Windows\System\nCgXpIq.exe
  2⤵
  PID:12564
- C:\Windows\System\KHnCkEi.exe
  C:\Windows\System\KHnCkEi.exe
  2⤵
  PID:12584
- C:\Windows\System\cDRRxda.exe
  C:\Windows\System\cDRRxda.exe
  2⤵
  PID:12604
- C:\Windows\System\AWCImQX.exe
  C:\Windows\System\AWCImQX.exe
  2⤵
  PID:12620
- C:\Windows\System\zeWsqSB.exe
  C:\Windows\System\zeWsqSB.exe
  2⤵
  PID:12636
- C:\Windows\System\SdnfUPD.exe
  C:\Windows\System\SdnfUPD.exe
  2⤵
  PID:12652
- C:\Windows\System\MwXMlhg.exe
  C:\Windows\System\MwXMlhg.exe
  2⤵
  PID:12668
- C:\Windows\System\NdPAQeO.exe
  C:\Windows\System\NdPAQeO.exe
  2⤵
  PID:12684
- C:\Windows\System\mwpJgSI.exe
  C:\Windows\System\mwpJgSI.exe
  2⤵
  PID:12828
- C:\Windows\System\xqIEYaC.exe
  C:\Windows\System\xqIEYaC.exe
  2⤵
  PID:12844
- C:\Windows\System\lYlXvSU.exe
  C:\Windows\System\lYlXvSU.exe
  2⤵
  PID:12868
- C:\Windows\System\VnRrrfB.exe
  C:\Windows\System\VnRrrfB.exe
  2⤵
  PID:12884
- C:\Windows\System\PyzTDiE.exe
  C:\Windows\System\PyzTDiE.exe
  2⤵
  PID:12900
- C:\Windows\System\kanmmIg.exe
  C:\Windows\System\kanmmIg.exe
  2⤵
  PID:12916
- C:\Windows\System\KholVTo.exe
  C:\Windows\System\KholVTo.exe
  2⤵
  PID:12932
- C:\Windows\System\qwmUqer.exe
  C:\Windows\System\qwmUqer.exe
  2⤵
  PID:12952
- C:\Windows\System\AlkGPFZ.exe
  C:\Windows\System\AlkGPFZ.exe
  2⤵
  PID:12972
- C:\Windows\System\NwMSBdb.exe
  C:\Windows\System\NwMSBdb.exe
  2⤵
  PID:12988
- C:\Windows\System\jwsvjIJ.exe
  C:\Windows\System\jwsvjIJ.exe
  2⤵
  PID:13252
- C:\Windows\System\dTBcrIE.exe
  C:\Windows\System\dTBcrIE.exe
  2⤵
  PID:13280
- C:\Windows\System\cRrtJmB.exe
  C:\Windows\System\cRrtJmB.exe
  2⤵
  PID:13296
- C:\Windows\System\iChBwTE.exe
  C:\Windows\System\iChBwTE.exe
  2⤵
  PID:3656
- C:\Windows\System\CWPhoJK.exe
  C:\Windows\System\CWPhoJK.exe
  2⤵
  PID:11280
- C:\Windows\System\xunGwak.exe
  C:\Windows\System\xunGwak.exe
  2⤵
  PID:12120
- C:\Windows\System\wlGqyys.exe
  C:\Windows\System\wlGqyys.exe
  2⤵
  PID:12308
- C:\Windows\System\RzKXyNi.exe
  C:\Windows\System\RzKXyNi.exe
  2⤵
  PID:12924
- C:\Windows\System\lXBZsvX.exe
  C:\Windows\System\lXBZsvX.exe
  2⤵
  PID:12964
- C:\Windows\System\Farmglr.exe
  C:\Windows\System\Farmglr.exe
  2⤵
  PID:12364
- C:\Windows\System\EhvbteC.exe
  C:\Windows\System\EhvbteC.exe
  2⤵
  PID:12404
- C:\Windows\System\wOIWjVp.exe
  C:\Windows\System\wOIWjVp.exe
  2⤵
  PID:12444
- C:\Windows\System\rgXAGpm.exe
  C:\Windows\System\rgXAGpm.exe
  2⤵
  PID:3856
- C:\Windows\System\sqYuSde.exe
  C:\Windows\System\sqYuSde.exe
  2⤵
  PID:12616
- C:\Windows\System\rXKxRDk.exe
  C:\Windows\System\rXKxRDk.exe
  2⤵
  PID:12692
- C:\Windows\System\ARQdxVp.exe
  C:\Windows\System\ARQdxVp.exe
  2⤵
  PID:12856
- C:\Windows\System\KerNnLc.exe
  C:\Windows\System\KerNnLc.exe
  2⤵
  PID:12980
- C:\Windows\System\pbBcupN.exe
  C:\Windows\System\pbBcupN.exe
  2⤵
  PID:12772
- C:\Windows\System\yWLCwGF.exe
  C:\Windows\System\yWLCwGF.exe
  2⤵
  PID:12836
- C:\Windows\System\LsvvfNE.exe
  C:\Windows\System\LsvvfNE.exe
  2⤵
  PID:60
- C:\Windows\System\oRDOEsP.exe
  C:\Windows\System\oRDOEsP.exe
  2⤵
  PID:13108
- C:\Windows\System\RlaFVtB.exe
  C:\Windows\System\RlaFVtB.exe
  2⤵
  PID:13020
- C:\Windows\System\wEtSwej.exe
  C:\Windows\System\wEtSwej.exe
  2⤵
  PID:12984
- C:\Windows\System\YCbaDVs.exe
  C:\Windows\System\YCbaDVs.exe
  2⤵
  PID:4584
- C:\Windows\System\SDtIRYC.exe
  C:\Windows\System\SDtIRYC.exe
  2⤵
  PID:13196
- C:\Windows\System\VwbNSst.exe
  C:\Windows\System\VwbNSst.exe
  2⤵
  PID:2964
- C:\Windows\System\QddVEhD.exe
  C:\Windows\System\QddVEhD.exe
  2⤵
  PID:11772
- C:\Windows\System\XDdjXLE.exe
  C:\Windows\System\XDdjXLE.exe
  2⤵
  PID:3976
- C:\Windows\System\dJQRunn.exe
  C:\Windows\System\dJQRunn.exe
  2⤵
  PID:13292
- C:\Windows\System\svmPjZB.exe
  C:\Windows\System\svmPjZB.exe
  2⤵
  PID:4272
- C:\Windows\System\IZFzuwp.exe
  C:\Windows\System\IZFzuwp.exe
  2⤵
  PID:12420
- C:\Windows\System\uOErrjx.exe
  C:\Windows\System\uOErrjx.exe
  2⤵
  PID:11704
- C:\Windows\System\hJoXkdY.exe
  C:\Windows\System\hJoXkdY.exe
  2⤵
  PID:12572
- C:\Windows\System\odhCfcX.exe
  C:\Windows\System\odhCfcX.exe
  2⤵
  PID:11144
- C:\Windows\System\lnqjUKc.exe
  C:\Windows\System\lnqjUKc.exe
  2⤵
  PID:448
- C:\Windows\System\BylSgrn.exe
  C:\Windows\System\BylSgrn.exe
  2⤵
  PID:13092
- C:\Windows\System\oxPGQDK.exe
  C:\Windows\System\oxPGQDK.exe
  2⤵
  PID:964
- C:\Windows\System\iRPMIqF.exe
  C:\Windows\System\iRPMIqF.exe
  2⤵
  PID:10412
- C:\Windows\System\qjuIKmD.exe
  C:\Windows\System\qjuIKmD.exe
  2⤵
  PID:10620
- C:\Windows\System\TNlZiAY.exe
  C:\Windows\System\TNlZiAY.exe
  2⤵
  PID:11860
- C:\Windows\System\xtagYCO.exe
  C:\Windows\System\xtagYCO.exe
  2⤵
  PID:12352
- C:\Windows\System\zOiPHyI.exe
  C:\Windows\System\zOiPHyI.exe
  2⤵
  PID:12700
- C:\Windows\System\mtGaRwH.exe
  C:\Windows\System\mtGaRwH.exe
  2⤵
  PID:4432
- C:\Windows\System\gsJwqOw.exe
  C:\Windows\System\gsJwqOw.exe
  2⤵
  PID:12808
- C:\Windows\System\tOdztFX.exe
  C:\Windows\System\tOdztFX.exe
  2⤵
  PID:12744
- C:\Windows\System\tsItZHx.exe
  C:\Windows\System\tsItZHx.exe
  2⤵
  PID:13328
- C:\Windows\System\tDXTrzQ.exe
  C:\Windows\System\tDXTrzQ.exe
  2⤵
  PID:13348
- C:\Windows\System\YTkmRpT.exe
  C:\Windows\System\YTkmRpT.exe
  2⤵
  PID:13368
- C:\Windows\System\kpLYOCU.exe
  C:\Windows\System\kpLYOCU.exe
  2⤵
  PID:13392
- C:\Windows\System\tZulLbA.exe
  C:\Windows\System\tZulLbA.exe
  2⤵
  PID:13416
- C:\Windows\System\evOgsaA.exe
  C:\Windows\System\evOgsaA.exe
  2⤵
  PID:13432
- C:\Windows\System\FWROYVJ.exe
  C:\Windows\System\FWROYVJ.exe
  2⤵
  PID:13564
- C:\Windows\System\iiPwrNK.exe
  C:\Windows\System\iiPwrNK.exe
  2⤵
  PID:13596
- C:\Windows\System\OnbMZPb.exe
  C:\Windows\System\OnbMZPb.exe
  2⤵
  PID:13620
- C:\Windows\System\VFErkVj.exe
  C:\Windows\System\VFErkVj.exe
  2⤵
  PID:13644
- C:\Windows\System\KICyRWk.exe
  C:\Windows\System\KICyRWk.exe
  2⤵
  PID:13664
- C:\Windows\System\pLaczWR.exe
  C:\Windows\System\pLaczWR.exe
  2⤵
  PID:13680
- C:\Windows\System\wSxbsPF.exe
  C:\Windows\System\wSxbsPF.exe
  2⤵
  PID:13704
- C:\Windows\System\blSFwJu.exe
  C:\Windows\System\blSFwJu.exe
  2⤵
  PID:13728
- C:\Windows\System\UgyoehU.exe
  C:\Windows\System\UgyoehU.exe
  2⤵
  PID:13764
- C:\Windows\System\OsSgipd.exe
  C:\Windows\System\OsSgipd.exe
  2⤵
  PID:13784
- C:\Windows\System\LjRSaub.exe
  C:\Windows\System\LjRSaub.exe
  2⤵
  PID:13804
- C:\Windows\System\RyDiojn.exe
  C:\Windows\System\RyDiojn.exe
  2⤵
  PID:13820
- C:\Windows\System\mnBtNXJ.exe
  C:\Windows\System\mnBtNXJ.exe
  2⤵
  PID:13840
- C:\Windows\System\WYrZsCM.exe
  C:\Windows\System\WYrZsCM.exe
  2⤵
  PID:13860
- C:\Windows\System\YChyqpN.exe
  C:\Windows\System\YChyqpN.exe
  2⤵
  PID:13884
- C:\Windows\System\mreruSI.exe
  C:\Windows\System\mreruSI.exe
  2⤵
  PID:13908
- C:\Windows\System\rnyZggf.exe
  C:\Windows\System\rnyZggf.exe
  2⤵
  PID:13924
- C:\Windows\System\WHuRkus.exe
  C:\Windows\System\WHuRkus.exe
  2⤵
  PID:13944
- C:\Windows\System\nwlrSHg.exe
  C:\Windows\System\nwlrSHg.exe
  2⤵
  PID:13968
- C:\Windows\System\izvxymo.exe
  C:\Windows\System\izvxymo.exe
  2⤵
  PID:13988
- C:\Windows\System\kMcsTXg.exe
  C:\Windows\System\kMcsTXg.exe
  2⤵
  PID:14068
- C:\Windows\System\XEjmUhK.exe
  C:\Windows\System\XEjmUhK.exe
  2⤵
  PID:14100
- C:\Windows\System\DpwVgRV.exe
  C:\Windows\System\DpwVgRV.exe
  2⤵
  PID:13364
- C:\Windows\System\yXbUmmp.exe
  C:\Windows\System\yXbUmmp.exe
  2⤵
  PID:13428
- C:\Windows\System\saywOFd.exe
  C:\Windows\System\saywOFd.exe
  2⤵
  PID:10876
- C:\Windows\System\rvqeMJr.exe
  C:\Windows\System\rvqeMJr.exe
  2⤵
  PID:14020
- C:\Windows\System\XliKkal.exe
  C:\Windows\System\XliKkal.exe
  2⤵
  PID:13760
- C:\Windows\System\xeosfQD.exe
  C:\Windows\System\xeosfQD.exe
  2⤵
  PID:13696
- C:\Windows\System\JRJCMXT.exe
  C:\Windows\System\JRJCMXT.exe
  2⤵
  PID:14012
- C:\Windows\System\eBUMFMn.exe
  C:\Windows\System\eBUMFMn.exe
  2⤵
  PID:13848
- C:\Windows\System\attAuYM.exe
  C:\Windows\System\attAuYM.exe
  2⤵
  PID:14260
- C:\Windows\System\spoHVLI.exe
  C:\Windows\System\spoHVLI.exe
  2⤵
  PID:14076
- C:\Windows\System\wbsOdCr.exe
  C:\Windows\System\wbsOdCr.exe
  2⤵
  PID:14316
- C:\Windows\System\NADNyEN.exe
  C:\Windows\System\NADNyEN.exe
  2⤵
  PID:13168
- C:\Windows\System\TjgwIWi.exe
  C:\Windows\System\TjgwIWi.exe
  2⤵
  PID:12184
- C:\Windows\System\TXlEKwT.exe
  C:\Windows\System\TXlEKwT.exe
  2⤵
  PID:13456
- C:\Windows\System\aJuVYuq.exe
  C:\Windows\System\aJuVYuq.exe
  2⤵
  PID:13628
- C:\Windows\System\mbTDkDp.exe
  C:\Windows\System\mbTDkDp.exe
  2⤵
  PID:13512
- C:\Windows\System\WwsWzUM.exe
  C:\Windows\System\WwsWzUM.exe
  2⤵
  PID:3916
- C:\Windows\System\ripVvyw.exe
  C:\Windows\System\ripVvyw.exe
  2⤵
  PID:13780
- C:\Windows\System\woyQwBm.exe
  C:\Windows\System\woyQwBm.exe
  2⤵
  PID:2920
- C:\Windows\System\OjLwvFx.exe
  C:\Windows\System\OjLwvFx.exe
  2⤵
  PID:14332
- C:\Windows\System\oIUQziG.exe
  C:\Windows\System\oIUQziG.exe
  2⤵
  PID:14040
- C:\Windows\System\exKfPDt.exe
  C:\Windows\System\exKfPDt.exe
  2⤵
  PID:700
- C:\Windows\System\FnPVbyr.exe
  C:\Windows\System\FnPVbyr.exe
  2⤵
  PID:11684
- C:\Windows\System\gnrDGdo.exe
  C:\Windows\System\gnrDGdo.exe
  2⤵
  PID:13004
- C:\Windows\System\bcBDpUM.exe
  C:\Windows\System\bcBDpUM.exe
  2⤵
  PID:12044
- C:\Windows\System\hNNjmkY.exe
  C:\Windows\System\hNNjmkY.exe
  2⤵
  PID:14184
- C:\Windows\System\QQxeTLq.exe
  C:\Windows\System\QQxeTLq.exe
  2⤵
  PID:2200
- C:\Windows\System\ZojFdLz.exe
  C:\Windows\System\ZojFdLz.exe
  2⤵
  PID:3592
- C:\Windows\System\LSWlprD.exe
  C:\Windows\System\LSWlprD.exe
  2⤵
  PID:13940
- C:\Windows\System\jABIiXA.exe
  C:\Windows\System\jABIiXA.exe
  2⤵
  PID:3496
- C:\Windows\System\NokBwYI.exe
  C:\Windows\System\NokBwYI.exe
  2⤵
  PID:13264
- C:\Windows\System\XtFYePd.exe
  C:\Windows\System\XtFYePd.exe
  2⤵
  PID:14292
- C:\Windows\System\VdgQCvm.exe
  C:\Windows\System\VdgQCvm.exe
  2⤵
  PID:14108
- C:\Windows\System\ONVebJP.exe
  C:\Windows\System\ONVebJP.exe
  2⤵
  PID:3300
- C:\Windows\System\vmUFlld.exe
  C:\Windows\System\vmUFlld.exe
  2⤵
  PID:13896
- C:\Windows\System\FveUzom.exe
  C:\Windows\System\FveUzom.exe
  2⤵
  PID:5332
- C:\Windows\System\OZUmYHb.exe
  C:\Windows\System\OZUmYHb.exe
  2⤵
  PID:2392
- C:\Windows\System\xQaYhlL.exe
  C:\Windows\System\xQaYhlL.exe
  2⤵
  PID:2916
- C:\Windows\System\QOGNNmN.exe
  C:\Windows\System\QOGNNmN.exe
  2⤵
  PID:13636
- C:\Windows\System\rDKrjXw.exe
  C:\Windows\System\rDKrjXw.exe
  2⤵
  PID:5476
- C:\Windows\System\rwDROGm.exe
  C:\Windows\System\rwDROGm.exe
  2⤵
  PID:1004
- C:\Windows\System\caxphGp.exe
  C:\Windows\System\caxphGp.exe
  2⤵
  PID:5264
- C:\Windows\System\XGynLXR.exe
  C:\Windows\System\XGynLXR.exe
  2⤵
  PID:5796
- C:\Windows\System\wEgOifF.exe
  C:\Windows\System\wEgOifF.exe
  2⤵
  PID:4156
- C:\Windows\System\vYHifma.exe
  C:\Windows\System\vYHifma.exe
  2⤵
  PID:4504
- C:\Windows\System\swAFtjB.exe
  C:\Windows\System\swAFtjB.exe
  2⤵
  PID:3756
- C:\Windows\System\GqbvuPQ.exe
  C:\Windows\System\GqbvuPQ.exe
  2⤵
  PID:5756
- C:\Windows\System\iCWbgRg.exe
  C:\Windows\System\iCWbgRg.exe
  2⤵
  PID:4688
- C:\Windows\System\WeMhQBa.exe
  C:\Windows\System\WeMhQBa.exe
  2⤵
  PID:5508
- C:\Windows\System\fKXdqsK.exe
  C:\Windows\System\fKXdqsK.exe
  2⤵
  PID:5948
- C:\Windows\System\wKjGAyT.exe
  C:\Windows\System\wKjGAyT.exe
  2⤵
  PID:13128
- C:\Windows\System\fbThXKD.exe
  C:\Windows\System\fbThXKD.exe
  2⤵
  PID:4064
- C:\Windows\System\WuyigNE.exe
  C:\Windows\System\WuyigNE.exe
  2⤵
  PID:14216
- C:\Windows\System\IwJXoId.exe
  C:\Windows\System\IwJXoId.exe
  2⤵
  PID:2712
- C:\Windows\System\DFPEQUi.exe
  C:\Windows\System\DFPEQUi.exe
  2⤵
  PID:5220
- C:\Windows\System\NktJYMn.exe
  C:\Windows\System\NktJYMn.exe
  2⤵
  PID:5408
- C:\Windows\System\BiGQekM.exe
  C:\Windows\System\BiGQekM.exe
  2⤵
  PID:5356
- C:\Windows\System\yacONPJ.exe
  C:\Windows\System\yacONPJ.exe
  2⤵
  PID:1792
- C:\Windows\System\uyMSUnK.exe
  C:\Windows\System\uyMSUnK.exe
  2⤵
  PID:14048
- C:\Windows\System\rGnSfGl.exe
  C:\Windows\System\rGnSfGl.exe
  2⤵
  PID:6064
- C:\Windows\System\GmkiFcd.exe
  C:\Windows\System\GmkiFcd.exe
  2⤵
  PID:13716
- C:\Windows\System\HBZRbzr.exe
  C:\Windows\System\HBZRbzr.exe
  2⤵
  PID:13856
- C:\Windows\System\oIJCzHq.exe
  C:\Windows\System\oIJCzHq.exe
  2⤵
  PID:5856
- C:\Windows\System\HeUPamV.exe
  C:\Windows\System\HeUPamV.exe
  2⤵
  PID:1888
- C:\Windows\System\uvNiRAQ.exe
  C:\Windows\System\uvNiRAQ.exe
  2⤵
  PID:14176
- C:\Windows\System\lfWhxzb.exe
  C:\Windows\System\lfWhxzb.exe
  2⤵
  PID:376
- C:\Windows\System\oScWZUH.exe
  C:\Windows\System\oScWZUH.exe
  2⤵
  PID:5488
- C:\Windows\System\bmxkwWL.exe
  C:\Windows\System\bmxkwWL.exe
  2⤵
  PID:5696
- C:\Windows\System\ktNgeBH.exe
  C:\Windows\System\ktNgeBH.exe
  2⤵
  PID:13464
- C:\Windows\System\QBOOlge.exe
  C:\Windows\System\QBOOlge.exe
  2⤵
  PID:11624
- C:\Windows\System\oWJcJag.exe
  C:\Windows\System\oWJcJag.exe
  2⤵
  PID:3884
- C:\Windows\System\FnHjYba.exe
  C:\Windows\System\FnHjYba.exe
  2⤵
  PID:1652
- C:\Windows\System\oTAkYey.exe
  C:\Windows\System\oTAkYey.exe
  2⤵
  PID:5732
- C:\Windows\System\wKfdpfA.exe
  C:\Windows\System\wKfdpfA.exe
  2⤵
  PID:14360
- C:\Windows\System\qwLISbe.exe
  C:\Windows\System\qwLISbe.exe
  2⤵
  PID:14376
- C:\Windows\System\KETLKcU.exe
  C:\Windows\System\KETLKcU.exe
  2⤵
  PID:14396
- C:\Windows\System\JOawPGw.exe
  C:\Windows\System\JOawPGw.exe
  2⤵
  PID:14412
- C:\Windows\System\CsqzXmk.exe
  C:\Windows\System\CsqzXmk.exe
  2⤵
  PID:14440
- C:\Windows\System\cmhQPIp.exe
  C:\Windows\System\cmhQPIp.exe
  2⤵
  PID:14576
- C:\Windows\System\iZKcQFR.exe
  C:\Windows\System\iZKcQFR.exe
  2⤵
  PID:15292
- C:\Windows\System\oMVRPLH.exe
  C:\Windows\System\oMVRPLH.exe
  2⤵
  PID:15308
- C:\Windows\System\BLFidcQ.exe
  C:\Windows\System\BLFidcQ.exe
  2⤵
  PID:15324
- C:\Windows\System\AxuFnVI.exe
  C:\Windows\System\AxuFnVI.exe
  2⤵
  PID:15340
- C:\Windows\System\EDayGMv.exe
  C:\Windows\System\EDayGMv.exe
  2⤵
  PID:15356
- C:\Windows\System\zbosWov.exe
  C:\Windows\System\zbosWov.exe
  2⤵
  PID:5496
- C:\Windows\System\ALGEUpO.exe
  C:\Windows\System\ALGEUpO.exe
  2⤵
  PID:2116
- C:\Windows\System\bibiNBZ.exe
  C:\Windows\System\bibiNBZ.exe
  2⤵
  PID:4652
- C:\Windows\System\aRHJcUl.exe
  C:\Windows\System\aRHJcUl.exe
  2⤵
  PID:5404
- C:\Windows\System\kaPXQlP.exe
  C:\Windows\System\kaPXQlP.exe
  2⤵
  PID:5292
- C:\Windows\System\SKUFPLJ.exe
  C:\Windows\System\SKUFPLJ.exe
  2⤵
  PID:5376
- C:\Windows\System\yKtXvBY.exe
  C:\Windows\System\yKtXvBY.exe
  2⤵
  PID:5784
- C:\Windows\System\aOLxdlk.exe
  C:\Windows\System\aOLxdlk.exe
  2⤵
  PID:5840
- C:\Windows\System\CbFeLjc.exe
  C:\Windows\System\CbFeLjc.exe
  2⤵
  PID:11364
- C:\Windows\System\hozTrOM.exe
  C:\Windows\System\hozTrOM.exe
  2⤵
  PID:2328
- C:\Windows\System\DEYvrSq.exe
  C:\Windows\System\DEYvrSq.exe
  2⤵
  PID:6116
- C:\Windows\System\CsNUzEP.exe
  C:\Windows\System\CsNUzEP.exe
  2⤵
  PID:5980
- C:\Windows\System\GGxesXH.exe
  C:\Windows\System\GGxesXH.exe
  2⤵
  PID:12792
- C:\Windows\System\DJNgcYW.exe
  C:\Windows\System\DJNgcYW.exe
  2⤵
  PID:5360
- C:\Windows\System\puNkAhf.exe
  C:\Windows\System\puNkAhf.exe
  2⤵
  PID:3204
- C:\Windows\System\WEjHaDK.exe
  C:\Windows\System\WEjHaDK.exe
  2⤵
  PID:1924
- C:\Windows\System\mTJlefy.exe
  C:\Windows\System\mTJlefy.exe
  2⤵
  PID:13800
- C:\Windows\System\MDignXQ.exe
  C:\Windows\System\MDignXQ.exe
  2⤵
  PID:14328
- C:\Windows\System\mwjHvet.exe
  C:\Windows\System\mwjHvet.exe
  2⤵
  PID:14352
- C:\Windows\System\NiTauRo.exe
  C:\Windows\System\NiTauRo.exe
  2⤵
  PID:14640
- C:\Windows\System\LfOsVfs.exe
  C:\Windows\System\LfOsVfs.exe
  2⤵
  PID:14496
- C:\Windows\System\skxEAwS.exe
  C:\Windows\System\skxEAwS.exe
  2⤵
  PID:4020
- C:\Windows\System\BQfPAeo.exe
  C:\Windows\System\BQfPAeo.exe
  2⤵
  PID:14768
- C:\Windows\System\sfEmeTo.exe
  C:\Windows\System\sfEmeTo.exe
  2⤵
  PID:14696
- C:\Windows\System\aMvZvFU.exe
  C:\Windows\System\aMvZvFU.exe
  2⤵
  PID:14872
- C:\Windows\System\HRTzIoO.exe
  C:\Windows\System\HRTzIoO.exe
  2⤵
  PID:14988
- C:\Windows\System\sWOuZLi.exe
  C:\Windows\System\sWOuZLi.exe
  2⤵
  PID:7084
- C:\Windows\System\hQBiVtB.exe
  C:\Windows\System\hQBiVtB.exe
  2⤵
  PID:15004
- C:\Windows\System\TPbxrVL.exe
  C:\Windows\System\TPbxrVL.exe
  2⤵
  PID:7044
- C:\Windows\System\wrOtfIm.exe
  C:\Windows\System\wrOtfIm.exe
  2⤵
  PID:12816
- C:\Windows\System\CmgCHZz.exe
  C:\Windows\System\CmgCHZz.exe
  2⤵
  PID:7060
- C:\Windows\System\kgOZSim.exe
  C:\Windows\System\kgOZSim.exe
  2⤵
  PID:6604
- C:\Windows\System\CbeqvUH.exe
  C:\Windows\System\CbeqvUH.exe
  2⤵
  PID:15036
- C:\Windows\System\sVzjRnB.exe
  C:\Windows\System\sVzjRnB.exe
  2⤵
  PID:15040
- C:\Windows\System\XlkXEuV.exe
  C:\Windows\System\XlkXEuV.exe
  2⤵
  PID:15020
- C:\Windows\System\jxumRzr.exe
  C:\Windows\System\jxumRzr.exe
  2⤵
  PID:6256
- C:\Windows\System\UnoXjtK.exe
  C:\Windows\System\UnoXjtK.exe
  2⤵
  PID:15060
- C:\Windows\System\PPAJSdR.exe
  C:\Windows\System\PPAJSdR.exe
  2⤵
  PID:10164
- C:\Windows\System\RusdEOu.exe
  C:\Windows\System\RusdEOu.exe
  2⤵
  PID:15088
- C:\Windows\System\GYhRJnD.exe
  C:\Windows\System\GYhRJnD.exe
  2⤵
  PID:15108
- C:\Windows\System\umSKgTn.exe
  C:\Windows\System\umSKgTn.exe
  2⤵
  PID:6648
- C:\Windows\System\gFpYqXp.exe
  C:\Windows\System\gFpYqXp.exe
  2⤵
  PID:6436
- C:\Windows\System\ohmNRqi.exe
  C:\Windows\System\ohmNRqi.exe
  2⤵
  PID:15100
- C:\Windows\System\kYwSblJ.exe
  C:\Windows\System\kYwSblJ.exe
  2⤵
  PID:15092
- C:\Windows\System\cKLMFUU.exe
  C:\Windows\System\cKLMFUU.exe
  2⤵
  PID:6780
- C:\Windows\System\KJIJGmo.exe
  C:\Windows\System\KJIJGmo.exe
  2⤵
  PID:15120
- C:\Windows\System\JWgZarQ.exe
  C:\Windows\System\JWgZarQ.exe
  2⤵
  PID:15136
- C:\Windows\System\eEbTLzv.exe
  C:\Windows\System\eEbTLzv.exe
  2⤵
  PID:6832
- C:\Windows\System\kmEGEJO.exe
  C:\Windows\System\kmEGEJO.exe
  2⤵
  PID:15248
- C:\Windows\System\danospU.exe
  C:\Windows\System\danospU.exe
  2⤵
  PID:7748
- C:\Windows\System\sJQkUcw.exe
  C:\Windows\System\sJQkUcw.exe
  2⤵
  PID:6696
- C:\Windows\System\CjTbzTq.exe
  C:\Windows\System\CjTbzTq.exe
  2⤵
  PID:15316
- C:\Windows\System\tYsMxhz.exe
  C:\Windows\System\tYsMxhz.exe
  2⤵
  PID:7288
- C:\Windows\System\CnvJrqS.exe
  C:\Windows\System\CnvJrqS.exe
  2⤵
  PID:15352
- C:\Windows\System\hpTSSpl.exe
  C:\Windows\System\hpTSSpl.exe
  2⤵
  PID:15216
- C:\Windows\System\MVnzeJV.exe
  C:\Windows\System\MVnzeJV.exe
  2⤵
  PID:7832
- C:\Windows\System\GTpEkma.exe
  C:\Windows\System\GTpEkma.exe
  2⤵
  PID:15260
- C:\Windows\System\wiHWZlb.exe
  C:\Windows\System\wiHWZlb.exe
  2⤵
  PID:15264
- C:\Windows\System\SwyWowi.exe
  C:\Windows\System\SwyWowi.exe
  2⤵
  PID:14552
- C:\Windows\System\lBEbjGU.exe
  C:\Windows\System\lBEbjGU.exe
  2⤵
  PID:7628
- C:\Windows\System\paPIXEN.exe
  C:\Windows\System\paPIXEN.exe
  2⤵
  PID:7568
- C:\Windows\System\UIoNyFO.exe
  C:\Windows\System\UIoNyFO.exe
  2⤵
  PID:8016
- C:\Windows\System\PaLYKWs.exe
  C:\Windows\System\PaLYKWs.exe
  2⤵
  PID:7796
- C:\Windows\System\ZGhQbTU.exe
  C:\Windows\System\ZGhQbTU.exe
  2⤵
  PID:3564
- C:\Windows\System\kYqYohG.exe
  C:\Windows\System\kYqYohG.exe
  2⤵
  PID:8260
- C:\Windows\System\OoJNrCJ.exe
  C:\Windows\System\OoJNrCJ.exe
  2⤵
  PID:13904
- C:\Windows\System\goStMVK.exe
  C:\Windows\System\goStMVK.exe
  2⤵
  PID:5828
- C:\Windows\System\CNOZqEv.exe
  C:\Windows\System\CNOZqEv.exe
  2⤵
  PID:4048
- C:\Windows\System\rLBsggI.exe
  C:\Windows\System\rLBsggI.exe
  2⤵
  PID:5128
- C:\Windows\System\adREDVj.exe
  C:\Windows\System\adREDVj.exe
  2⤵
  PID:13960
- C:\Windows\System\MlaHpOq.exe
  C:\Windows\System\MlaHpOq.exe
  2⤵
  PID:4844
- C:\Windows\System\VCquNfM.exe
  C:\Windows\System\VCquNfM.exe
  2⤵
  PID:14348
- C:\Windows\System\txhQYDM.exe
  C:\Windows\System\txhQYDM.exe
  2⤵
  PID:13336
- C:\Windows\System\MAspbhM.exe
  C:\Windows\System\MAspbhM.exe
  2⤵
  PID:6968
- C:\Windows\System\HqeGmxU.exe
  C:\Windows\System\HqeGmxU.exe
  2⤵
  PID:14624
- C:\Windows\System\jRsWNQN.exe
  C:\Windows\System\jRsWNQN.exe
  2⤵
  PID:8304
- C:\Windows\System\cXsFfNC.exe
  C:\Windows\System\cXsFfNC.exe
  2⤵
  PID:8336
- C:\Windows\System\gbmqxQx.exe
  C:\Windows\System\gbmqxQx.exe
  2⤵
  PID:8472
- C:\Windows\System\AXhofjd.exe
  C:\Windows\System\AXhofjd.exe
  2⤵
  PID:15068
- C:\Windows\System\BbdLSUO.exe
  C:\Windows\System\BbdLSUO.exe
  2⤵
  PID:8372
- C:\Windows\System\ldgAzmQ.exe
  C:\Windows\System\ldgAzmQ.exe
  2⤵
  PID:8380
- C:\Windows\System\EDyFklk.exe
  C:\Windows\System\EDyFklk.exe
  2⤵
  PID:6876
- C:\Windows\System\trfNxOJ.exe
  C:\Windows\System\trfNxOJ.exe
  2⤵
  PID:15124
- C:\Windows\System\bKWEtfo.exe
  C:\Windows\System\bKWEtfo.exe
  2⤵
  PID:8484
- C:\Windows\System\TVsTGtd.exe
  C:\Windows\System\TVsTGtd.exe
  2⤵
  PID:14812
- C:\Windows\System\slZSDiS.exe
  C:\Windows\System\slZSDiS.exe
  2⤵
  PID:8680
- C:\Windows\System\bvgpqqm.exe
  C:\Windows\System\bvgpqqm.exe
  2⤵
  PID:8456
- C:\Windows\System\hhxfHCi.exe
  C:\Windows\System\hhxfHCi.exe
  2⤵
  PID:1764
- C:\Windows\System\SizMBwR.exe
  C:\Windows\System\SizMBwR.exe
  2⤵
  PID:15080
- C:\Windows\System\Fcafjgw.exe
  C:\Windows\System\Fcafjgw.exe
  2⤵
  PID:8752
- C:\Windows\System\HRCeoaP.exe
  C:\Windows\System\HRCeoaP.exe
  2⤵
  PID:7140
- C:\Windows\System\jkcRFCn.exe
  C:\Windows\System\jkcRFCn.exe
  2⤵
  PID:7008
- C:\Windows\System\xNVTzFW.exe
  C:\Windows\System\xNVTzFW.exe
  2⤵
  PID:14796
- C:\Windows\System\lMHokAW.exe
  C:\Windows\System\lMHokAW.exe
  2⤵
  PID:14408
- C:\Windows\System\eQYWoLP.exe
  C:\Windows\System\eQYWoLP.exe
  2⤵
  PID:6640
- C:\Windows\System\hVUMPrm.exe
  C:\Windows\System\hVUMPrm.exe
  2⤵
  PID:8832
- C:\Windows\System\twoCFeZ.exe
  C:\Windows\System\twoCFeZ.exe
  2⤵
  PID:8888
- C:\Windows\System\UlCXeEV.exe
  C:\Windows\System\UlCXeEV.exe
  2⤵
  PID:15220
- C:\Windows\System\erwqnft.exe
  C:\Windows\System\erwqnft.exe
  2⤵
  PID:15172
- C:\Windows\System\cuccVNC.exe
  C:\Windows\System\cuccVNC.exe
  2⤵
  PID:8860
- C:\Windows\System\EJAVoNG.exe
  C:\Windows\System\EJAVoNG.exe
  2⤵
  PID:14556
- C:\Windows\System\wokFTVP.exe
  C:\Windows\System\wokFTVP.exe
  2⤵
  PID:7064
- C:\Windows\System\RvqvZbp.exe
  C:\Windows\System\RvqvZbp.exe
  2⤵
  PID:4340
- C:\Windows\System\vqChMRk.exe
  C:\Windows\System\vqChMRk.exe
  2⤵
  PID:15280
- C:\Windows\System\CZdVOWz.exe
  C:\Windows\System\CZdVOWz.exe
  2⤵
  PID:7248
- C:\Windows\System\zdoLubE.exe
  C:\Windows\System\zdoLubE.exe
  2⤵
  PID:7456
- C:\Windows\System\sEzvurE.exe
  C:\Windows\System\sEzvurE.exe
  2⤵
  PID:2596
- C:\Windows\System\kVxZSSV.exe
  C:\Windows\System\kVxZSSV.exe
  2⤵
  PID:5444
- C:\Windows\System\kpWajmp.exe
  C:\Windows\System\kpWajmp.exe
  2⤵
  PID:7696
- C:\Windows\System\BreXbim.exe
  C:\Windows\System\BreXbim.exe
  2⤵
  PID:8508
- C:\Windows\System\jzWLZPu.exe
  C:\Windows\System\jzWLZPu.exe
  2⤵
  PID:768
- C:\Windows\System\dHXncdf.exe
  C:\Windows\System\dHXncdf.exe
  2⤵
  PID:8940
- C:\Windows\System\OYkRpue.exe
  C:\Windows\System\OYkRpue.exe
  2⤵
  PID:7452
- C:\Windows\System\vAjRQaO.exe
  C:\Windows\System\vAjRQaO.exe
  2⤵
  PID:8652
- C:\Windows\System\lbNCDch.exe
  C:\Windows\System\lbNCDch.exe
  2⤵
  PID:9144
- C:\Windows\System\IUifcga.exe
  C:\Windows\System\IUifcga.exe
  2⤵
  PID:8056
- C:\Windows\System\FXcVENL.exe
  C:\Windows\System\FXcVENL.exe
  2⤵
  PID:14120
- C:\Windows\System\iyGJYjC.exe
  C:\Windows\System\iyGJYjC.exe
  2⤵
  PID:9004
- C:\Windows\System\hmczvIw.exe
  C:\Windows\System\hmczvIw.exe
  2⤵
  PID:13288
- C:\Windows\System\WGUbHbI.exe
  C:\Windows\System\WGUbHbI.exe
  2⤵
  PID:12180
- C:\Windows\System\fDcaADj.exe
  C:\Windows\System\fDcaADj.exe
  2⤵
  PID:1380
- C:\Windows\System\CtgrBLk.exe
  C:\Windows\System\CtgrBLk.exe
  2⤵
  PID:8076
- C:\Windows\System\JVBHZNk.exe
  C:\Windows\System\JVBHZNk.exe
  2⤵
  PID:6948
- C:\Windows\System\lVcDDwA.exe
  C:\Windows\System\lVcDDwA.exe
  2⤵
  PID:6480
- C:\Windows\System\paJhmVB.exe
  C:\Windows\System\paJhmVB.exe
  2⤵
  PID:6628
- C:\Windows\System\skWdHio.exe
  C:\Windows\System\skWdHio.exe
  2⤵
  PID:13140
- C:\Windows\System\KJtBbir.exe
  C:\Windows\System\KJtBbir.exe
  2⤵
  PID:8224
- C:\Windows\System\ULhIRVE.exe
  C:\Windows\System\ULhIRVE.exe
  2⤵
  PID:7572
- C:\Windows\System\SFeoKDO.exe
  C:\Windows\System\SFeoKDO.exe
  2⤵
  PID:7228
- C:\Windows\System\MvUdDSW.exe
  C:\Windows\System\MvUdDSW.exe
  2⤵
  PID:8392
- C:\Windows\System\eurdsXg.exe
  C:\Windows\System\eurdsXg.exe
  2⤵
  PID:15152
- C:\Windows\System\scvuLdn.exe
  C:\Windows\System\scvuLdn.exe
  2⤵
  PID:8428
- C:\Windows\System\iVsGqan.exe
  C:\Windows\System\iVsGqan.exe
  2⤵
  PID:8216
- C:\Windows\System\MblqmcF.exe
  C:\Windows\System\MblqmcF.exe
  2⤵
  PID:8608
- C:\Windows\System\ZZcNYuv.exe
  C:\Windows\System\ZZcNYuv.exe
  2⤵
  PID:7080
- C:\Windows\System\wurFaZv.exe
  C:\Windows\System\wurFaZv.exe
  2⤵
  PID:9476
- C:\Windows\System\GumdkhQ.exe
  C:\Windows\System\GumdkhQ.exe
  2⤵
  PID:7404
- C:\Windows\System\bYBKway.exe
  C:\Windows\System\bYBKway.exe
  2⤵
  PID:9388
- C:\Windows\System\kyuOJEi.exe
  C:\Windows\System\kyuOJEi.exe
  2⤵
  PID:9572
- C:\Windows\System\GFydYCP.exe
  C:\Windows\System\GFydYCP.exe
  2⤵
  PID:8864
- C:\Windows\System\mtTnoTI.exe
  C:\Windows\System\mtTnoTI.exe
  2⤵
  PID:6228
- C:\Windows\System\uIRIMNe.exe
  C:\Windows\System\uIRIMNe.exe
  2⤵
  PID:9760
- C:\Windows\System\WtNzYBy.exe
  C:\Windows\System\WtNzYBy.exe
  2⤵
  PID:9468
- C:\Windows\System\oLrhkjp.exe
  C:\Windows\System\oLrhkjp.exe
  2⤵
  PID:7324
- C:\Windows\System\dGhvQkq.exe
  C:\Windows\System\dGhvQkq.exe
  2⤵
  PID:6260
- C:\Windows\System\IwGtDWb.exe
  C:\Windows\System\IwGtDWb.exe
  2⤵
  PID:15140
- C:\Windows\System\NVarQSV.exe
  C:\Windows\System\NVarQSV.exe
  2⤵
  PID:8388
- C:\Windows\System\yBEjQKo.exe
  C:\Windows\System\yBEjQKo.exe
  2⤵
  PID:9180
- C:\Windows\System\DhkSWrp.exe
  C:\Windows\System\DhkSWrp.exe
  2⤵
  PID:8308
- C:\Windows\System\JpjVKpz.exe
  C:\Windows\System\JpjVKpz.exe
  2⤵
  PID:3080
- C:\Windows\System\wrZBWiG.exe
  C:\Windows\System\wrZBWiG.exe
  2⤵
  PID:9800
- C:\Windows\System\psHzrky.exe
  C:\Windows\System\psHzrky.exe
  2⤵
  PID:10172
- C:\Windows\System\sTVoEEO.exe
  C:\Windows\System\sTVoEEO.exe
  2⤵
  PID:4084
- C:\Windows\System\ePpNDEo.exe
  C:\Windows\System\ePpNDEo.exe
  2⤵
  PID:9324
- C:\Windows\System\kvsqvyt.exe
  C:\Windows\System\kvsqvyt.exe
  2⤵
  PID:8900
- C:\Windows\System\KnaBsJx.exe
  C:\Windows\System\KnaBsJx.exe
  2⤵
  PID:9520
- C:\Windows\System\PLHDYpw.exe
  C:\Windows\System\PLHDYpw.exe
  2⤵
  PID:9120
- C:\Windows\System\YwiPNDy.exe
  C:\Windows\System\YwiPNDy.exe
  2⤵
  PID:7276
- C:\Windows\System\oTMxKpQ.exe
  C:\Windows\System\oTMxKpQ.exe
  2⤵
  PID:11564
- C:\Windows\System\kOiqOfK.exe
  C:\Windows\System\kOiqOfK.exe
  2⤵
  PID:6496
- C:\Windows\System\qAZuXEj.exe
  C:\Windows\System\qAZuXEj.exe
  2⤵
  PID:5908
- C:\Windows\System\EeBOhgo.exe
  C:\Windows\System\EeBOhgo.exe
  2⤵
  PID:8184
- C:\Windows\System\vsPJLtJ.exe
  C:\Windows\System\vsPJLtJ.exe
  2⤵
  PID:9932
- C:\Windows\System\ObsbMlq.exe
  C:\Windows\System\ObsbMlq.exe
  2⤵
  PID:15164
- C:\Windows\System\LAiQmtl.exe
  C:\Windows\System\LAiQmtl.exe
  2⤵
  PID:10204
- C:\Windows\System\XkPCIOl.exe
  C:\Windows\System\XkPCIOl.exe
  2⤵
  PID:9912
- C:\Windows\System\YqAcnjP.exe
  C:\Windows\System\YqAcnjP.exe
  2⤵
  PID:9804
- C:\Windows\System\veKPbWM.exe
  C:\Windows\System\veKPbWM.exe
  2⤵
  PID:7528
- C:\Windows\System\MciJBbs.exe
  C:\Windows\System\MciJBbs.exe
  2⤵
  PID:10220
- C:\Windows\System\RWMxEqN.exe
  C:\Windows\System\RWMxEqN.exe
  2⤵
  PID:1248
- C:\Windows\System\eWawXxL.exe
  C:\Windows\System\eWawXxL.exe
  2⤵
  PID:7340
- C:\Windows\System\dxEMQgS.exe
  C:\Windows\System\dxEMQgS.exe
  2⤵
  PID:8740
- C:\Windows\System\UWdLWHk.exe
  C:\Windows\System\UWdLWHk.exe
  2⤵
  PID:4164
- C:\Windows\System\brXCGQM.exe
  C:\Windows\System\brXCGQM.exe
  2⤵
  PID:7632
- C:\Windows\System\AWUjjyP.exe
  C:\Windows\System\AWUjjyP.exe
  2⤵
  PID:10136
- C:\Windows\System\ckEqyHR.exe
  C:\Windows\System\ckEqyHR.exe
  2⤵
  PID:15348
- C:\Windows\System\qpzAxAr.exe
  C:\Windows\System\qpzAxAr.exe
  2⤵
  PID:14388
- C:\Windows\System\hXboBDS.exe
  C:\Windows\System\hXboBDS.exe
  2⤵
  PID:9084
- C:\Windows\System\EhmBBlY.exe
  C:\Windows\System\EhmBBlY.exe
  2⤵
  PID:10176
- C:\Windows\System\Ywfrlir.exe
  C:\Windows\System\Ywfrlir.exe
  2⤵
  PID:10468
- C:\Windows\System\hXOIQcL.exe
  C:\Windows\System\hXOIQcL.exe
  2⤵
  PID:8848
- C:\Windows\System\cTXuZgE.exe
  C:\Windows\System\cTXuZgE.exe
  2⤵
  PID:9596
- C:\Windows\System\wZVnajh.exe
  C:\Windows\System\wZVnajh.exe
  2⤵
  PID:8828
- C:\Windows\System\trWGJhu.exe
  C:\Windows\System\trWGJhu.exe
  2⤵
  PID:10584
- C:\Windows\System\mdeHNpV.exe
  C:\Windows\System\mdeHNpV.exe
  2⤵
  PID:10492
- C:\Windows\System\TCmWCsw.exe
  C:\Windows\System\TCmWCsw.exe
  2⤵
  PID:14996
- C:\Windows\System\ycXVhsq.exe
  C:\Windows\System\ycXVhsq.exe
  2⤵
  PID:8344
- C:\Windows\System\vXbPyLN.exe
  C:\Windows\System\vXbPyLN.exe
  2⤵
  PID:10112
- C:\Windows\System\QjsEqYs.exe
  C:\Windows\System\QjsEqYs.exe
  2⤵
  PID:10296
- C:\Windows\System\ZDmcMNq.exe
  C:\Windows\System\ZDmcMNq.exe
  2⤵
  PID:5208
- C:\Windows\System\hUAxekI.exe
  C:\Windows\System\hUAxekI.exe
  2⤵
  PID:4628
- C:\Windows\System\Exaacbr.exe
  C:\Windows\System\Exaacbr.exe
  2⤵
  PID:9700
- C:\Windows\System\uwcEMKj.exe
  C:\Windows\System\uwcEMKj.exe
  2⤵
  PID:10756
- C:\Windows\System\mSHOASS.exe
  C:\Windows\System\mSHOASS.exe
  2⤵
  PID:10604
- C:\Windows\System\iubgbdT.exe
  C:\Windows\System\iubgbdT.exe
  2⤵
  PID:10104
- C:\Windows\System\zKXagrb.exe
  C:\Windows\System\zKXagrb.exe
  2⤵
  PID:7756
- C:\Windows\System\JwEPtsd.exe
  C:\Windows\System\JwEPtsd.exe
  2⤵
  PID:10788
- C:\Windows\System\wZXthcf.exe
  C:\Windows\System\wZXthcf.exe
  2⤵
  PID:2008
- C:\Windows\System\WemdmOu.exe
  C:\Windows\System\WemdmOu.exe
  2⤵
  PID:6848
- C:\Windows\System\aEgrpxI.exe
  C:\Windows\System\aEgrpxI.exe
  2⤵
  PID:9756
- C:\Windows\System\EOXXUQh.exe
  C:\Windows\System\EOXXUQh.exe
  2⤵
  PID:10456
- C:\Windows\System\tiLUaza.exe
  C:\Windows\System\tiLUaza.exe
  2⤵
  PID:8564
- C:\Windows\System\WagGzFe.exe
  C:\Windows\System\WagGzFe.exe
  2⤵
  PID:13076
- C:\Windows\System\WsekCAy.exe
  C:\Windows\System\WsekCAy.exe
  2⤵
  PID:9192
- C:\Windows\System\PAjPCXR.exe
  C:\Windows\System\PAjPCXR.exe
  2⤵
  PID:10208
- C:\Windows\System\nAfDoja.exe
  C:\Windows\System\nAfDoja.exe
  2⤵
  PID:7088
- C:\Windows\System\jTKEKNa.exe
  C:\Windows\System\jTKEKNa.exe
  2⤵
  PID:9328
- C:\Windows\System\GoeYXia.exe
  C:\Windows\System\GoeYXia.exe
  2⤵
  PID:2124
- C:\Windows\System\IjOyMSl.exe
  C:\Windows\System\IjOyMSl.exe
  2⤵
  PID:10600
- C:\Windows\System\wKnUvCZ.exe
  C:\Windows\System\wKnUvCZ.exe
  2⤵
  PID:5132
- C:\Windows\System\bHYWSMG.exe
  C:\Windows\System\bHYWSMG.exe
  2⤵
  PID:9416
- C:\Windows\System\DTpxjDW.exe
  C:\Windows\System\DTpxjDW.exe
  2⤵
  PID:9072
- C:\Windows\System\TVDanMk.exe
  C:\Windows\System\TVDanMk.exe
  2⤵
  PID:10836
- C:\Windows\System\skTvdtR.exe
  C:\Windows\System\skTvdtR.exe
  2⤵
  PID:10148
- C:\Windows\System\QEKYAoR.exe
  C:\Windows\System\QEKYAoR.exe
  2⤵
  PID:9424
- C:\Windows\System\JQpNEKJ.exe
  C:\Windows\System\JQpNEKJ.exe
  2⤵
  PID:8088
- C:\Windows\System\cvqAGlZ.exe
  C:\Windows\System\cvqAGlZ.exe
  2⤵
  PID:8436
- C:\Windows\System\kwRSROU.exe
  C:\Windows\System\kwRSROU.exe
  2⤵
  PID:6580
- C:\Windows\System\CEaxNvL.exe
  C:\Windows\System\CEaxNvL.exe
  2⤵
  PID:9428
- C:\Windows\System\nZWlzBs.exe
  C:\Windows\System\nZWlzBs.exe
  2⤵
  PID:10880
- C:\Windows\System\cCrOLNc.exe
  C:\Windows\System\cCrOLNc.exe
  2⤵
  PID:11004
- C:\Windows\System\kHHHpSX.exe
  C:\Windows\System\kHHHpSX.exe
  2⤵
  PID:2384
- C:\Windows\System\HUJiNlh.exe
  C:\Windows\System\HUJiNlh.exe
  2⤵
  PID:4372
- C:\Windows\System\kUlVXtc.exe
  C:\Windows\System\kUlVXtc.exe
  2⤵
  PID:11028
- C:\Windows\System\lPJmcrO.exe
  C:\Windows\System\lPJmcrO.exe
  2⤵
  PID:13592
- C:\Windows\System\gYtKFXJ.exe
  C:\Windows\System\gYtKFXJ.exe
  2⤵
  PID:15372
- C:\Windows\System\SskZhMe.exe
  C:\Windows\System\SskZhMe.exe
  2⤵
  PID:15388
- C:\Windows\System\bLcxqhq.exe
  C:\Windows\System\bLcxqhq.exe
  2⤵
  PID:15564
- C:\Windows\System\BMEKnjG.exe
  C:\Windows\System\BMEKnjG.exe
  2⤵
  PID:15580
- C:\Windows\System\nrwShFT.exe
  C:\Windows\System\nrwShFT.exe
  2⤵
  PID:15604
- C:\Windows\System\uFnkEGo.exe
  C:\Windows\System\uFnkEGo.exe
  2⤵
  PID:15632
- C:\Windows\System\UKUbVub.exe
  C:\Windows\System\UKUbVub.exe
  2⤵
  PID:15652
- C:\Windows\System\nuCJnkJ.exe
  C:\Windows\System\nuCJnkJ.exe
  2⤵
  PID:15672
- C:\Windows\System\HgwYbop.exe
  C:\Windows\System\HgwYbop.exe
  2⤵
  PID:15700
- C:\Windows\System\dHkWroj.exe
  C:\Windows\System\dHkWroj.exe
  2⤵
  PID:15728
- C:\Windows\System\FPemSbz.exe
  C:\Windows\System\FPemSbz.exe
  2⤵
  PID:15748
- C:\Windows\System\TEZePDC.exe
  C:\Windows\System\TEZePDC.exe
  2⤵
  PID:15776
- C:\Windows\System\izesqSH.exe
  C:\Windows\System\izesqSH.exe
  2⤵
  PID:15804
- C:\Windows\System\ehLJacC.exe
  C:\Windows\System\ehLJacC.exe
  2⤵
  PID:15828
- C:\Windows\System\KqNjOfW.exe
  C:\Windows\System\KqNjOfW.exe
  2⤵
  PID:15856
- C:\Windows\System\DZxLhiY.exe
  C:\Windows\System\DZxLhiY.exe
  2⤵
  PID:15884
- C:\Windows\System\KQQBYbZ.exe
  C:\Windows\System\KQQBYbZ.exe
  2⤵
  PID:16024
- C:\Windows\System\dOJzfzL.exe
  C:\Windows\System\dOJzfzL.exe
  2⤵
  PID:10344
- C:\Windows\System\KgrkGFh.exe
  C:\Windows\System\KgrkGFh.exe
  2⤵
  PID:4620
- C:\Windows\System\wUcaerh.exe
  C:\Windows\System\wUcaerh.exe
  2⤵
  PID:10532
- C:\Windows\System\MkPOqba.exe
  C:\Windows\System\MkPOqba.exe
  2⤵
  PID:11424
- C:\Windows\System\aZHFjVt.exe
  C:\Windows\System\aZHFjVt.exe
  2⤵
  PID:11452
- C:\Windows\System\beBvtmq.exe
  C:\Windows\System\beBvtmq.exe
  2⤵
  PID:11404
- C:\Windows\System\fDnFNFU.exe
  C:\Windows\System\fDnFNFU.exe
  2⤵
  PID:1296
- C:\Windows\System\ULsfdgP.exe
  C:\Windows\System\ULsfdgP.exe
  2⤵
  PID:10672
- C:\Windows\System\JrYbhjl.exe
  C:\Windows\System\JrYbhjl.exe
  2⤵
  PID:11436
- C:\Windows\System\qREfpHj.exe
  C:\Windows\System\qREfpHj.exe
  2⤵
  PID:11488
- C:\Windows\System\zFLNPLa.exe
  C:\Windows\System\zFLNPLa.exe
  2⤵
  PID:11428
- C:\Windows\System\ZiJHYll.exe
  C:\Windows\System\ZiJHYll.exe
  2⤵
  PID:10572
- C:\Windows\System\fZHjrCL.exe
  C:\Windows\System\fZHjrCL.exe
  2⤵
  PID:15284
- C:\Windows\System\bgvqOnp.exe
  C:\Windows\System\bgvqOnp.exe
  2⤵
  PID:10212
- C:\Windows\System\ffhYReN.exe
  C:\Windows\System\ffhYReN.exe
  2⤵
  PID:15628
- C:\Windows\System\nHweUMF.exe
  C:\Windows\System\nHweUMF.exe
  2⤵
  PID:15784
- C:\Windows\System\vuusuUW.exe
  C:\Windows\System\vuusuUW.exe
  2⤵
  PID:15820
- C:\Windows\System\sAKnQDo.exe
  C:\Windows\System\sAKnQDo.exe
  2⤵
  PID:11676
- C:\Windows\System\rdkaykm.exe
  C:\Windows\System\rdkaykm.exe
  2⤵
  PID:16020
- C:\Windows\System\RxXLzhW.exe
  C:\Windows\System\RxXLzhW.exe
  2⤵
  PID:16064
- C:\Windows\System\SoyXVsU.exe
  C:\Windows\System\SoyXVsU.exe
  2⤵
  PID:15744
- C:\Windows\System\IjueZlY.exe
  C:\Windows\System\IjueZlY.exe
  2⤵
  PID:15768
- C:\Windows\System\gSaNMkD.exe
  C:\Windows\System\gSaNMkD.exe
  2⤵
  PID:16036
- C:\Windows\System\bEGVvvB.exe
  C:\Windows\System\bEGVvvB.exe
  2⤵
  PID:16072
- C:\Windows\System\uhpqJfO.exe
  C:\Windows\System\uhpqJfO.exe
  2⤵
  PID:16280
- C:\Windows\System\MzSTPgm.exe
  C:\Windows\System\MzSTPgm.exe
  2⤵
  PID:5232
- C:\Windows\System\IEwRKeU.exe
  C:\Windows\System\IEwRKeU.exe
  2⤵
  PID:10196
- C:\Windows\System\EccRLKs.exe
  C:\Windows\System\EccRLKs.exe
  2⤵
  PID:11480
- C:\Windows\System\kzLECdl.exe
  C:\Windows\System\kzLECdl.exe
  2⤵
  PID:11824
- C:\Windows\System\AyWOQdu.exe
  C:\Windows\System\AyWOQdu.exe
  2⤵
  PID:16324
- C:\Windows\System\kqMRsZl.exe
  C:\Windows\System\kqMRsZl.exe
  2⤵
  PID:11344
- C:\Windows\System\zlsgFSt.exe
  C:\Windows\System\zlsgFSt.exe
  2⤵
  PID:10820
- C:\Windows\System\HfshPuf.exe
  C:\Windows\System\HfshPuf.exe
  2⤵
  PID:10444
- C:\Windows\System\xMIANgU.exe
  C:\Windows\System\xMIANgU.exe
  2⤵
  PID:10684
- C:\Windows\System\yfAAlgh.exe
  C:\Windows\System\yfAAlgh.exe
  2⤵
  PID:11572
- C:\Windows\System\hvDysfv.exe
  C:\Windows\System\hvDysfv.exe
  2⤵
  PID:11680
- C:\Windows\System\JLQRfFe.exe
  C:\Windows\System\JLQRfFe.exe
  2⤵
  PID:4068
- C:\Windows\System\FFElnuf.exe
  C:\Windows\System\FFElnuf.exe
  2⤵
  PID:12740
- C:\Windows\System\RKqgEzn.exe
  C:\Windows\System\RKqgEzn.exe
  2⤵
  PID:16320
- C:\Windows\System\FqGMpYJ.exe
  C:\Windows\System\FqGMpYJ.exe
  2⤵
  PID:16380
- C:\Windows\System\tVaFvJD.exe
  C:\Windows\System\tVaFvJD.exe
  2⤵
  PID:10308
- C:\Windows\System\dSdhqqg.exe
  C:\Windows\System\dSdhqqg.exe
  2⤵
  PID:10548
- C:\Windows\System\BTWqnjz.exe
  C:\Windows\System\BTWqnjz.exe
  2⤵
  PID:11228
- C:\Windows\System\bFMediF.exe
  C:\Windows\System\bFMediF.exe
  2⤵
  PID:12820
- C:\Windows\System\JlDULEA.exe
  C:\Windows\System\JlDULEA.exe
  2⤵
  PID:11460
- C:\Windows\System\zghWJbR.exe
  C:\Windows\System\zghWJbR.exe
  2⤵
  PID:8736
- C:\Windows\System\ZVMKBYG.exe
  C:\Windows\System\ZVMKBYG.exe
  2⤵
  PID:12748
- C:\Windows\System\XXmZfNF.exe
  C:\Windows\System\XXmZfNF.exe
  2⤵
  PID:10320
- C:\Windows\System\ivAAgbb.exe
  C:\Windows\System\ivAAgbb.exe
  2⤵
  PID:11180
- C:\Windows\System\xiKIlLr.exe
  C:\Windows\System\xiKIlLr.exe
  2⤵
  PID:10056
- C:\Windows\System\DNKuxZK.exe
  C:\Windows\System\DNKuxZK.exe
  2⤵
  PID:15576
- C:\Windows\System\iZMzFxT.exe
  C:\Windows\System\iZMzFxT.exe
  2⤵
  PID:11464
- C:\Windows\System\dSSlxkX.exe
  C:\Windows\System\dSSlxkX.exe
  2⤵
  PID:10796
- C:\Windows\System\fDGSQdg.exe
  C:\Windows\System\fDGSQdg.exe
  2⤵
  PID:15384
- C:\Windows\System\kjMlFGf.exe
  C:\Windows\System\kjMlFGf.exe
  2⤵
  PID:15416
- C:\Windows\System\tHtSQaz.exe
  C:\Windows\System\tHtSQaz.exe
  2⤵
  PID:12804
- C:\Windows\System\GbBQmEz.exe
  C:\Windows\System\GbBQmEz.exe
  2⤵
  PID:15688
- C:\Windows\System\BxetHLV.exe
  C:\Windows\System\BxetHLV.exe
  2⤵
  PID:15868
- C:\Windows\System\ebuXGey.exe
  C:\Windows\System\ebuXGey.exe
  2⤵
  PID:15876
- C:\Windows\System\eesGFqv.exe
  C:\Windows\System\eesGFqv.exe
  2⤵
  PID:16076
- C:\Windows\System\Xanpzhz.exe
  C:\Windows\System\Xanpzhz.exe
  2⤵
  PID:15664
- C:\Windows\System\IJjGoTR.exe
  C:\Windows\System\IJjGoTR.exe
  2⤵
  PID:5716
- C:\Windows\System\mkhSxOW.exe
  C:\Windows\System\mkhSxOW.exe
  2⤵
  PID:16184
- C:\Windows\System\jxuYMGv.exe
  C:\Windows\System\jxuYMGv.exe
  2⤵
  PID:16008
- C:\Windows\System\YSiOMOz.exe
  C:\Windows\System\YSiOMOz.exe
  2⤵
  PID:12864
- C:\Windows\System\VSlBmBz.exe
  C:\Windows\System\VSlBmBz.exe
  2⤵
  PID:13104
- C:\Windows\System\fyjBZkd.exe
  C:\Windows\System\fyjBZkd.exe
  2⤵
  PID:16120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:7232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=6236295053504 --process=260 /prefetch:7 --thread=14112
1⤵
PID:11272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g5z0ikf3.zrq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BVwPByv.exe

Filesize
2.2MB

MD5
13af5cc3ce699f7b033bc3405f179e13

SHA1
8a260f900a36853ee9ded1a5e55deb8246596897

SHA256
f76d04c2b9e2419696163f3933c60d04fdd4d7b6f44975bca9459ed1312cf0e6

SHA512
5a60f8a938843103926d2048af7aaa0c5bd25c4882caf1b947f0c8feea33c789ddbf91aa0674fa563f690b01669ac20d060f298aebbfc0461d84b00e9bb86625

Download Submit
C:\Windows\System\DWvsypp.exe

Filesize
2.2MB

MD5
d6f77210e39ef6ad0ca765e7ba5ebf9b

SHA1
e67475e7213b4516e06becec67cc7dbe7b56032e

SHA256
1c38c98ed54d211004c7bd97e25a57af86cacd09cd5c5029fed3d552f62b08a7

SHA512
4af5572f277f2eb5a7ed42473cbfcece53a2ddc802de693b48f15e1960be9e748b7cbb049705b89fd4c79c86b9e1be06cfec21606210f28ed514a4ae9110fbd1

Download Submit
C:\Windows\System\DYchtCr.exe

Filesize
2.2MB

MD5
b406bbfb56867259db0d276a6e6460f8

SHA1
842fb93169ec660e6c0760c5d8ab46264dbb3c94

SHA256
4e86930b9a1cf53aa10b5d51e3194c6847876086109e6932a35bade250cd830b

SHA512
ffe356f1644f930ab33e14566245650792a21155745b9c8274e931ed1fb1c0341a9157ea9e61f09062ba448bf239497863f3f09ef6b56def6d1780d50ee5af75

Download Submit
C:\Windows\System\DZbxwbK.exe

Filesize
2.2MB

MD5
3076db11cc803f1688daf8c68f80633c

SHA1
a2375068da22265aae7e71661198b324beed9bc6

SHA256
bbeaa729827eb662b8b6ae48926eaa22d393b3697b5605a042c1ca82a6f13b7d

SHA512
55b1779d4079956826fcaf398bb66ba7d35ef98bb98c3ba009d27c5a5f9e339db006ff1a51ebf08e2cfef7f203360595038e1a3aa52bd850ebec9cda328b8861

Download Submit
C:\Windows\System\FWnHglA.exe

Filesize
2.2MB

MD5
4c1fd53624604b36fac4d04263acafe8

SHA1
6dd9df51f920be3cbb379e8d084e0c8a05c2d8f7

SHA256
4994a2a03b572d7fa0bb7e97a4cebfac1abf5a9ac4822bbfb5999777a43910b5

SHA512
f46eb29ff49d5b0f89bcb59427f6e784328d26bbc2342d4e6d11d6a7c6758d7c085b79446081f88221310b6e25a88735c0ab7fab8b124b377900d7529644db99

Download Submit
C:\Windows\System\JIABtjC.exe

Filesize
2.2MB

MD5
286a0aa13d6cce10f4e3ce7d97635db8

SHA1
39f7a85f2e3ba81eb3846eb9494d62e2b6cb56b5

SHA256
8623bad5a77d524ecd237386edab5c2051b189ed98281fd6579960e4bac8d196

SHA512
500fd90c257109f9a49ab676745757a2a3d1d66d8cdd9fb78b12d41c79105a9e94d4daea68159c3dba79482ac1f9848ba89e37aef22790e321d3804187f27f45

Download Submit
C:\Windows\System\JUVJTSc.exe

Filesize
2.2MB

MD5
21726b6dfd9875eb3fe6470cce83ce6a

SHA1
24e3bb5e071fdceb611a06072443fbd16206eafb

SHA256
6be7406b6e1051aa6751e086f84a8552c4e1d2e40a384bd2dd513366de84260a

SHA512
9461807a041871b61c9759f3ba1ce0abae634377bf1b25bc7d7463e010db3c0d556a7bb42eaa14405b70283a9db1415aea4a2e0679a876a0e5a91bc944e590d0

Download Submit
C:\Windows\System\LlYuGQr.exe

Filesize
2.2MB

MD5
858e02520a822d4b87e04f881edc5874

SHA1
585298f24fc70bb3d309624b2b960fb865566be0

SHA256
b818df266ab513213754dc9c561260b5b7516323d10fd9fef22728aaac654e35

SHA512
ffdf0b7cc61415d7bf04b705080f51be0d5271add2a5fa5021120b2404c0dbb891c4ba3fe8837703812b1dfc1d5553f2edd77f3523f23af217ea04a92c8f2dc9

Download Submit
C:\Windows\System\MkWwWWu.exe

Filesize
2.2MB

MD5
6ee4995ab5897f4744adc01eccca9aa3

SHA1
340da23e664bbb78a90b1a048383d32524c851c5

SHA256
f184fa1df844421bce2f52a5d8a8d0b60385f6abe377fe808a856831599f235b

SHA512
a395693388bb3e80cf9f5bfd86b6339f725533099dbd8de7a21e13091be662bd4726e8cdb6463b054920905191aa8cabdf7914df9cdc411661d0c81be7a8d1b4

Download Submit
C:\Windows\System\NFrAZex.exe

Filesize
2.2MB

MD5
71cd2c9c69e95a78e50f4df8588a647f

SHA1
85faf88bfd09cc3a193f6818f70d06a91ab3f7ca

SHA256
fe1d635cf7c363ebe375c09a4fee577046b67b50b7ad45dfd14569471f751059

SHA512
c0d0f7421231fb9658a0be180387024d9ba9fcca26e21ce63c2638b5cf56326b7e3ef0a4a4aa86bec2fdebc6d384b843e79048720e565d0a3a2f021d08822aef

Download Submit
C:\Windows\System\PpEHevo.exe

Filesize
2.2MB

MD5
c0bfd1e48fe7fafc1aac2cfdf2b66119

SHA1
96a2d65730598a756efca2381e0f1135374aa2fa

SHA256
1c10b81c32a1c98830879efa2f877a7c926373b897742d5e2cb78a80768e3227

SHA512
6dbdd09d6d96670083a80ced17ca7d4023d0e821c5841a3a535cb4b2c37088d6d1c2781daa9582a6e4924bdf758dd5e3e28173b48b307a5b5c3c22c88f47d3c1

Download Submit
C:\Windows\System\RJhZjyd.exe

Filesize
2.2MB

MD5
1bf386f4958269504801affa9f67c21f

SHA1
6e5a4dedd3d96110bcfa5bfff3323c81eefcc9e0

SHA256
ad02f10d9add50f738f9f6b8f0c73cf6ce0011193f5e96d1ff62599b0330c67c

SHA512
9c9d2b8778ad82a5dc852fedb7ae34dd2cb299e41f6dc07d5b4557aabf8e779bfe708ffaef3dcc59dec41f42e7bf991a0648d757c6c585e6dd7ea3cf1d960a80

Download Submit
C:\Windows\System\RJpfNeR.exe

Filesize
2.2MB

MD5
f6e5cee74008420ff5ded7e0e67dd7c5

SHA1
a294259b7f90818e0f5e514e2460858bc9fa9e81

SHA256
9d6e62d9c0c9ad63a3579661d932a156e5bbffc3d0171790d80e5d42860e86df

SHA512
d08691d14d777fbec8ac31c2073b540dd40145b197612ecff1a3eb673bafcffaed0601f242a6f093387b3ace21db37e0ea09a84584f6f99415568a7a8b03c2e1

Download Submit
C:\Windows\System\SBsmluc.exe

Filesize
2.2MB

MD5
2aa37de28a4a66b05f0be60a7100434d

SHA1
bb06a8f5a1eedc8fc7d3c8246d70009f1e6bf0fc

SHA256
9f42fa3d920d277764a665b20f157859d0663916a081e64b86decef105a9d74f

SHA512
7a769040c31ea076023fe4565b289a8153f2cfb1a93e5bf775aec91cdc6b93b43e955f5cd1e8b6d3856b0b8adefe45abd3af51acbd2eb15dfe92945293d6ac7b

Download Submit
C:\Windows\System\UvkHGyq.exe

Filesize
2.2MB

MD5
3702693d4179883dfc878e93ff8c4324

SHA1
a9093edc4c4d6021867d718a40eb47fd8ef32df4

SHA256
babcf48b21841624405b06c9a06716f2770562f33dc456ab3e4aa012adc089f4

SHA512
ccb2d1245b4e19bd3da4b08b2de9bf85ee6e785e544f5dc783be010080804ca4a33528ff445be5452cc595df8a5523e506856ce54be340fc5574c506c1ccc1f7

Download Submit
C:\Windows\System\VDcKDtX.exe

Filesize
2.2MB

MD5
cb68f03013067028a26f992840535423

SHA1
47fbe20349e8918c5ff8b3133b7137845d7c1ed0

SHA256
3d066f375e76c7cb9d4868a82432eb14674071c394fe2ba01b23c320c76392e5

SHA512
f79ea28dd7765dabbed0af44fc9ca3fec181c8dde43e1bb6afb74aba1d561b090989b51018d61e95c769727df0ce9a9276546314d53b221ba92d49fb76d58827

Download Submit
C:\Windows\System\VDipaHs.exe

Filesize
2.2MB

MD5
32fc862cba605ec05283b0656de44d3d

SHA1
765581547e488ae6e16087ecabfedd708a8d9665

SHA256
8bc29eb687063b545a03c823ffc3aa7fbde648866a6483a21b90168bd17955e6

SHA512
def9beebbaf812940b556f949c211a3ba9dec9538c2a7784dc8ed768dc8095b4778e263d33aca3731a0016979d7100820da3ab0bd7982c61a9f345e6f9be9342

Download Submit
C:\Windows\System\XQShQqQ.exe

Filesize
2.2MB

MD5
661e1c9b46c6d2328f2b43442921c7ce

SHA1
95b02b10e6c834e6f91fb1804483b34e388d35a8

SHA256
af29b48184538d47089d4cfc954b2f26e45448dc1fbb1a13979080082506903a

SHA512
fe4292911c9167cee126e6d8486b61bc9e0f1437cf0d769a14f7e36a503acc45fb7b78ded0cfde37986109e7a37c736da0b979a12744fbf56bb656f0d1b8f76d

Download Submit
C:\Windows\System\XkxDRyE.exe

Filesize
2.2MB

MD5
520f8e43da9b1e182e7794dfd8c98ed2

SHA1
a6eeffadd4ac33b67a5e91416411229e03ae8b6d

SHA256
91c54cccd8752858acdb042ecec033a9811b61502e42f53b726a70699ef0d994

SHA512
395da8198274c65f59ce747d14d65d166698afcebc1521c5802202c8ac858f3783874451d7fb233fbdf208c7168d62c6bc060d895486b5d387e9798ed2046507

Download Submit
C:\Windows\System\ZXuIcQi.exe

Filesize
2.2MB

MD5
4ee8af6c0dfa1c4759b15aae3b14f73f

SHA1
819b5d44efac176bcf9cded571e107753b179982

SHA256
d3bfbe8986d564dc5fdcc9a46c0f0881c261c15c8b7530ac24bd2d6f92f3c9df

SHA512
1480ad4e85e0a1676c1f4c9af54bec4590099cf470f21444686c791d25f7ef940b7691d2f350703cee1c2eddb4a29e524b2d58805f412150a80d08a890e23e5d

Download Submit
C:\Windows\System\cCYSZvE.exe

Filesize
2.2MB

MD5
6748bd4ade480e7c628da66047e038b0

SHA1
a758fd702f1dd8bbad5d5ea0ebff6ce9ccdf735a

SHA256
56dbaa139b7799e782d7f54d09f890a4669662fce997b643fcb8a9fd0362f517

SHA512
7a93adbf417f7ee2f923df58ba8bef0a120aa8245b7a8b3bdce505b6ebeca6f1780426fb716e6a4f2f9921f724f0fd978b7fee5f08861b5b8d0f8b571a944bb0

Download Submit
C:\Windows\System\iURvfUJ.exe

Filesize
2.2MB

MD5
283dd2c516e4f7618c569c2b94eb3b79

SHA1
1459cfbbf43b9b608c82f78b5d5f08048baaf721

SHA256
aa946bdb6330a45a15c116f9fd81b049a7699dd34c6f5cd4ca2fff9c16fafa5f

SHA512
11cb92e5f7ba8fb335fb234756a7f32cc065ba3f362b1264e13c93ffce48ce73fa7159366fc03b54aabd258aa5e2f3e31e2fff42c4ec341e433fc6aa2e5bb347

Download Submit
C:\Windows\System\iUgOFqw.exe

Filesize
2.2MB

MD5
e0f46cbbd992a67dda4c65d1bc8ff5ba

SHA1
3d70cb99cfa2b571b80f4c6e3eaf3a2cf42d23d8

SHA256
9dfaed950319148908c382d4ef058e20c3b4247b22f1a56a633c099d82069fcf

SHA512
4607ff1b85550b8df6a4666ed6db1464ba6459bd64448c1900871610d38ddddbf6d7283025730f071c5bc273cefcbefe55452ae5a848d71a48bc6f9ca4c9dc53

Download Submit
C:\Windows\System\oOyUCRl.exe

Filesize
2.2MB

MD5
c8070be961c870c96693d9925e936489

SHA1
f739fc0452fa90901dd26d3d01b73ba597037210

SHA256
989243a7091c23dd89f294f8dddf1129b417239e0d0126668c9ce22938c53587

SHA512
e626fe27ce571ae2141c7af710de800349fe6232e930c90cc9a0e297c9d0508d42b89ace6c0b8bd248462e4f77aae9ea4517c27dd1e2dfacc4aa127a4ffc3da3

Download Submit
C:\Windows\System\sZznUib.exe

Filesize
2.2MB

MD5
a542980e3bcdd65c00d8c06160db2ed5

SHA1
0a1a5f94ddfde7964d2138528e5b0618c4a35a06

SHA256
f8a10f69eff5fbaff60d781c7b42a745db0248f6c71eb9a1ce237df2b470266a

SHA512
1c89de46fdfb786e6671651750c4ed42d2dd858220a63273ed66a48b778b88ea00785cb74fe230a8b473afd601b0bc15d60ba05b27f9a1fc1e3bd4e644db9c32

Download Submit
C:\Windows\System\vZPYhME.exe

Filesize
2.2MB

MD5
853e775b641c9d11df9bce434648edfc

SHA1
6df571709593e45a407ea6b18267184ff4eaba19

SHA256
b1c09c79382bf7341686afca93617199ddd5d965f05d85dcbe0fdd18c9628dcc

SHA512
c55d51eb7fc0eff57ee302eeec943801ff8e059ca2cd099ea04310ff91f4cd969f65c3c50d1c60e5f7beac116101b3319cecfd4fd11d656eed71ff9761bbbe13

Download Submit
C:\Windows\System\wFiLZDg.exe

Filesize
2.2MB

MD5
38a4806a798a49edc47ba1658de547b6

SHA1
f5c9aaf2dece00b81cc1100f62e9ad228160a4fc

SHA256
2cb1a63dea5135c83247a272fe0f8c0f26f3dfee08e8079192191d60a6234e6a

SHA512
d7aedc42e59b004f102683937280ff9d313826c21796cdee9bcae31a3be9174f79fe05d3f59723a33e9a31c7adbe8fca02894d06853dcac64931fa734612c350

Download Submit
C:\Windows\System\wUtbeMY.exe

Filesize
2.2MB

MD5
1dffd4773bc2991e07d086f55d4b6074

SHA1
8184df7aeda1bd143aa9e01397dba3a86ae2b4e5

SHA256
9b98bc051512e9ddc9b4f7bafc8b000c2d3d35df430f2340bc2f1d6f47952db4

SHA512
5d204b1f19ea8d18c03580d8f09b94c31b772fc9c94964605ba2768134cf2d54bd56308b1c4182adaef4beb4b73d2ea5625d4d57bf069edf65f92c4f5d79873c

Download Submit
C:\Windows\System\xjRwRst.exe

Filesize
2.2MB

MD5
37c4558a524b40642624530178e9a938

SHA1
ab139ac7ad4efc1d8b8156b85737ec2c0b3eb440

SHA256
61e22c2665078d860f44c2055ea52eeb47e58cdb5d8931ff4c9b82e28804839b

SHA512
d59aae08bb80febf73ca973910dc069a97afe2115ca78359d759b161ec501276d45821fe363d41fda7a9ebd988fb8d57b04a765af7a19939e2990dd0c4f75502

Download Submit
C:\Windows\System\xvCXvgF.exe

Filesize
2.2MB

MD5
38eb8eaed2d88c3c7ac32b1b2d52d8f5

SHA1
cee008b999f7729c5637ff7484a2f5d108146b9d

SHA256
8dde34fd0b8e06181363d90e26f320ca2dd2bef47b2b38d2c61ab7cc52bbc7b3

SHA512
8719db0aaa0805afaf6c4afd1949a6197a07a7e81bd5cb6841e944975b5ed46071cbf6725e29c935039b321f9d317cf5998c40136decfa0bd20500c396c71f40

Download Submit
C:\Windows\System\xyPPoCI.exe

Filesize
2.2MB

MD5
e1217f4cc21dc065a5bd64b9ba3f4377

SHA1
f3fd39fc5479d67efa0bf6d03b54452ab7d30ce1

SHA256
1dc7e90967eec88767a2c2afac17bce9cd6f1ab2862089da9d22e0ec7c0e6a2a

SHA512
be907df785bced33d141d1d1a5fd494014cc19fcda0703fafddeaea7f324392c70cd3479eb140f6103b4a6c808c6199289fe42bd12f9200f8c2eddf5340a1915

Download Submit
C:\Windows\System\yEwepFp.exe

Filesize
2.2MB

MD5
d3677586fc259cf5d2c26fecf1a4d39a

SHA1
7fd17a199b8b28501417e2b7235e2a5cd8c3d060

SHA256
5c088155c9c43ff458153ea28daf5854cc563f220b44c58bdbd79167bdbe2c88

SHA512
07a36be47999ac20cf1ccbb3c0057aef8d397cbaba33debb9be6c9e4d6fbff6d6f4a11b1163e01c8c65dbb7ee564b215414a60cc5a9bd402ef134d624ea15955

Download Submit
memory/220-150-0x00007FF6226A0000-0x00007FF622A92000-memory.dmp

Filesize
3.9MB

Download
memory/220-1916-0x00007FF6226A0000-0x00007FF622A92000-memory.dmp

Filesize
3.9MB

Download
memory/720-99-0x00007FF735900000-0x00007FF735CF2000-memory.dmp

Filesize
3.9MB

Download
memory/720-1681-0x00007FF735900000-0x00007FF735CF2000-memory.dmp

Filesize
3.9MB

Download
memory/872-1569-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp

Filesize
3.9MB

Download
memory/872-571-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp

Filesize
3.9MB

Download
memory/872-94-0x00007FF76BF30000-0x00007FF76C322000-memory.dmp

Filesize
3.9MB

Download
memory/988-1546-0x00007FF7A3820000-0x00007FF7A3C12000-memory.dmp

Filesize
3.9MB

Download
memory/988-82-0x00007FF7A3820000-0x00007FF7A3C12000-memory.dmp

Filesize
3.9MB

Download
memory/1112-36-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp

Filesize
3.9MB

Download
memory/1112-968-0x00007FF6C52B0000-0x00007FF6C56A2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-109-0x00007FF6734F0000-0x00007FF6738E2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-1690-0x00007FF6734F0000-0x00007FF6738E2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-1436-0x00007FF6EB470000-0x00007FF6EB862000-memory.dmp

Filesize
3.9MB

Download
memory/1712-59-0x00007FF6EB470000-0x00007FF6EB862000-memory.dmp

Filesize
3.9MB

Download
memory/1832-1937-0x00007FF778210000-0x00007FF778602000-memory.dmp

Filesize
3.9MB

Download
memory/1832-197-0x00007FF778210000-0x00007FF778602000-memory.dmp

Filesize
3.9MB

Download
memory/1960-1005-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-37-0x00007FF75E5E0000-0x00007FF75E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-46-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp

Filesize
3.9MB

Download
memory/2088-1339-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp

Filesize
3.9MB

Download
memory/2320-909-0x00007FF72F7F0000-0x00007FF72FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-38-0x00007FF72F7F0000-0x00007FF72FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-1822-0x00007FF6CA5C0000-0x00007FF6CA9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-134-0x00007FF6CA5C0000-0x00007FF6CA9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-140-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp

Filesize
3.9MB

Download
memory/2388-39-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp

Filesize
3.9MB

Download
memory/2388-66-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp

Filesize
3.9MB

Download
memory/2388-0-0x00007FF7C6CA0000-0x00007FF7C7092000-memory.dmp

Filesize
3.9MB

Download
memory/2388-1-0x000001ACD4F90000-0x000001ACD4FA0000-memory.dmp

Filesize
64KB

Download
memory/2456-1693-0x00007FF7272B0000-0x00007FF7276A2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-118-0x00007FF7272B0000-0x00007FF7276A2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-1684-0x00007FF6A2370000-0x00007FF6A2762000-memory.dmp

Filesize
3.9MB

Download
memory/2656-111-0x00007FF6A2370000-0x00007FF6A2762000-memory.dmp

Filesize
3.9MB

Download
memory/2992-76-0x00007FF6903E0000-0x00007FF6907D2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-1497-0x00007FF6903E0000-0x00007FF6907D2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-132-0x00007FF652EB0000-0x00007FF6532A2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-1818-0x00007FF652EB0000-0x00007FF6532A2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-1826-0x00007FF6128C0000-0x00007FF612CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-136-0x00007FF6128C0000-0x00007FF612CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3516-1471-0x00007FF688A30000-0x00007FF688E22000-memory.dmp

Filesize
3.9MB

Download
memory/3516-68-0x00007FF688A30000-0x00007FF688E22000-memory.dmp

Filesize
3.9MB

Download
memory/3596-35-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp

Filesize
3.9MB

Download
memory/3596-966-0x00007FF72B850000-0x00007FF72BC42000-memory.dmp

Filesize
3.9MB

Download
memory/4204-179-0x0000016C00000000-0x0000016C007A6000-memory.dmp

Filesize
7.6MB

Download
memory/4204-9-0x0000016BFCEE0000-0x0000016BFCF02000-memory.dmp

Filesize
136KB

Download
memory/4204-34-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/4204-75-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/4204-3-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Filesize
8KB

Download
memory/4204-72-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Filesize
8KB

Download
memory/4332-1936-0x00007FF7E0750000-0x00007FF7E0B42000-memory.dmp

Filesize
3.9MB

Download
memory/4332-199-0x00007FF7E0750000-0x00007FF7E0B42000-memory.dmp

Filesize
3.9MB

Download
memory/4500-1935-0x00007FF628AC0000-0x00007FF628EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-195-0x00007FF628AC0000-0x00007FF628EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-149-0x00007FF7F9020000-0x00007FF7F9412000-memory.dmp

Filesize
3.9MB

Download
memory/4860-1866-0x00007FF7F9020000-0x00007FF7F9412000-memory.dmp

Filesize
3.9MB

Download
memory/4924-61-0x00007FF6D7E10000-0x00007FF6D8202000-memory.dmp

Filesize
3.9MB

Download
memory/4924-1444-0x00007FF6D7E10000-0x00007FF6D8202000-memory.dmp

Filesize
3.9MB

Download
memory/4948-1568-0x00007FF7F1680000-0x00007FF7F1A72000-memory.dmp

Filesize
3.9MB

Download
memory/4948-88-0x00007FF7F1680000-0x00007FF7F1A72000-memory.dmp

Filesize
3.9MB

Download