xmrig | 978a987773971765146f833f0bcdd1949515e3265bcb7008afa8a61423eee11d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
Size 2.0MB
Sample240603-pywkraeh21
SHA256 978a987773971765146f833f0bcdd1949515e3265bcb7008afa8a61423eee11d
MD5 91d42bf59806a9092dd32db035a1e769
SHA1 19b207cbe2058fd6eecfcca77057fa61fce8b291
SHA512 a1f045381804e4c1a2857a0e970dc733fec723319929d68ffe35e188606eb5c762aa0ccf9ef931cbf694ce78a6f718fb88e307cf6ff0b37cf53d54066cf4f44e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/1728-168-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/3052-167-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2692-166-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2960-164-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2532-159-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2472-157-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2508-155-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2488-153-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2776-151-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2752-140-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2604-24-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1728-3883-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2508-3880-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2604-3799-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2488-4022-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2532-4050-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/1952-4272-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2960-4294-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2692-4320-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2472-4963-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3052	SOoGCrK.exe
2604	AMnikxA.exe
1728	acxakzg.exe
2752	pXzSReG.exe
2776	XWWfxFp.exe
2488	eUWPOzx.exe
2508	bfrQjnx.exe
2472	KNIfQfP.exe
2532	pJSuRtd.exe
2960	SpQVfYH.exe
2692	opBLzAT.exe
3056	WBwDDtH.exe
2024	bqBflpu.exe
2828	DcuyZwn.exe
2980	KAuNvQR.exe
2936	NQjTQrh.exe
2908	hZGQPGI.exe
1340	uTpVneB.exe
2348	USbaVXl.exe
1304	foDoYkR.exe
1040	ZLWxMvX.exe
2004	Sitjwla.exe
340	OhvQrSL.exe
2992	usMjTnG.exe
2708	VAXGrfI.exe
1644	zmzhbMd.exe
1528	NyUkQiF.exe
620	AWQucSh.exe
1812	cxfpozJ.exe
416	aDpXoRl.exe
2412	aLaewar.exe
2168	YyLHryZ.exe
996	RNDkhIs.exe
1300	mSkVwnR.exe
1556	hiINuLp.exe
1524	XVcnAkl.exe
1880	RQCasBe.exe
1628	JciQTgf.exe
2432	ooKhfIw.exe
1160	fjFezcL.exe
2644	JbeGwGI.exe
1016	WuVwlit.exe
2148	rLKUPha.exe
1520	BZZAgfM.exe
2264	LCElIFz.exe
1272	lChwIRA.exe
2396	ybbxJuM.exe
1760	fEJvvut.exe
2244	ivGTzbh.exe
2360	DTQWxzP.exe
2408	cghcuBQ.exe
2224	PvGPSCM.exe
1832	isWmqmD.exe
2212	XZTRnxv.exe
1708	AehmnOI.exe
2028	lNIwlSv.exe
1608	KcdVcpU.exe
1724	eoPCjlx.exe
1096	leiIbsO.exe
2584	rjebJFj.exe
2744	MZyeXuC.exe
584	bJUfTds.exe
2436	TOYDhbp.exe
2504	yIxkqTD.exe

Loads dropped DLL 64 IoCs

pid	Process
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1952-1-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x0007000000015cd5-12.dat	upx
behavioral1/files/0x0008000000015cba-13.dat	upx
behavioral1/files/0x00080000000122cd-3.dat	upx
behavioral1/files/0x003800000001566b-27.dat	upx
behavioral1/files/0x0007000000015ce1-33.dat	upx
behavioral1/files/0x0008000000015d07-38.dat	upx
behavioral1/files/0x0008000000016117-43.dat	upx
behavioral1/files/0x000600000001661c-67.dat	upx
behavioral1/files/0x0006000000016572-61.dat	upx
behavioral1/files/0x0006000000016d1e-105.dat	upx
behavioral1/files/0x0006000000016d90-121.dat	upx
behavioral1/files/0x0006000000016da7-125.dat	upx
behavioral1/files/0x0006000000016eb2-187.dat	upx
behavioral1/files/0x0006000000016e94-183.dat	upx
behavioral1/files/0x0006000000016dbf-179.dat	upx
behavioral1/files/0x003800000001567f-175.dat	upx
behavioral1/files/0x0006000000016dbb-172.dat	upx
behavioral1/memory/1728-168-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/3052-167-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2692-166-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2960-164-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2532-159-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2472-157-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2508-155-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2488-153-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2776-151-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2752-140-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0006000000016d3a-113.dat	upx
behavioral1/files/0x0006000000016d7e-117.dat	upx
behavioral1/files/0x0006000000016d26-109.dat	upx
behavioral1/files/0x0006000000016d0d-101.dat	upx
behavioral1/files/0x0006000000016ce4-97.dat	upx
behavioral1/files/0x0006000000016cb7-93.dat	upx
behavioral1/files/0x0006000000016c6b-89.dat	upx
behavioral1/files/0x0006000000016c63-85.dat	upx
behavioral1/files/0x0006000000016c4a-81.dat	upx
behavioral1/files/0x0006000000016a9a-77.dat	upx
behavioral1/files/0x0006000000016843-73.dat	upx
behavioral1/files/0x00060000000164b2-64.dat	upx
behavioral1/files/0x000600000001630b-52.dat	upx
behavioral1/files/0x00070000000161e7-49.dat	upx
behavioral1/files/0x0007000000004e76-36.dat	upx
behavioral1/memory/2604-24-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1728-3883-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2508-3880-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2604-3799-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2488-4022-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2532-4050-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/1952-4272-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2960-4294-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2692-4320-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2472-4963-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wFYcgFa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\jPLHiKx.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\ooBTdRm.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\JnDYzux.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\jAKBoNz.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\acwZgXA.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\ewRNOPI.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\WUhioqd.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\rPpYKgm.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\MubLxmt.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\QAkphqU.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\mGjVvAX.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\JxnfrTi.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\wUKwZfy.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\nhhKifN.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\DSUZFJi.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\YAQJfDw.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\ExzmLzP.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\pIkaiDa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\ksnjVAJ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\WoVcLgm.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\cXqWhzJ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\GVoEnWa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\wmFSADT.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\cafusEh.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\lEoDHwT.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\DpEWemH.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\uliFltp.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\nqEtRQO.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\XwDCcxS.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\nByaxyx.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\UYtPLNq.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\KsMmiyN.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\JbnXPvI.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\jvLaoFN.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\urFYQIF.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\qASnUvq.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\RCDeiQn.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\nMSJlkc.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\lHnjYLZ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\zTcdIvt.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\TNluIFA.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\uZIlGNc.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\EFVAequ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\bjBFCgA.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\dcNqZLa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\QAnobDa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\JDjmhfr.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\wLyQrmv.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\ivGTzbh.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\FxqaXNy.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\btVNAnr.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\SnAeQDa.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\PuGwBsF.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\fqpRvJY.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\zefBvbB.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\pAtpaFx.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\YDhlfhJ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\XLueeRU.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\BZjZBAQ.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\AUtqJWI.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\YjFchep.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\kuEDChT.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
File created	C:\Windows\System\mxlTbnl.exe	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2192	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	29
PID 1952 wrote to memory of 2192	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	29
PID 1952 wrote to memory of 2192	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	29
PID 1952 wrote to memory of 3052	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	30
PID 1952 wrote to memory of 3052	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	30
PID 1952 wrote to memory of 3052	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1728	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	31
PID 1952 wrote to memory of 1728	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	31
PID 1952 wrote to memory of 1728	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	31
PID 1952 wrote to memory of 2604	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2604	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2604	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2752	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	33
PID 1952 wrote to memory of 2752	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	33
PID 1952 wrote to memory of 2752	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	33
PID 1952 wrote to memory of 2776	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	34
PID 1952 wrote to memory of 2776	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	34
PID 1952 wrote to memory of 2776	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	34
PID 1952 wrote to memory of 2488	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2488	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2488	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2508	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	36
PID 1952 wrote to memory of 2508	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	36
PID 1952 wrote to memory of 2508	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	36
PID 1952 wrote to memory of 2472	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	37
PID 1952 wrote to memory of 2472	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	37
PID 1952 wrote to memory of 2472	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	37
PID 1952 wrote to memory of 2532	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	38
PID 1952 wrote to memory of 2532	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	38
PID 1952 wrote to memory of 2532	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	38
PID 1952 wrote to memory of 3056	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	39
PID 1952 wrote to memory of 3056	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	39
PID 1952 wrote to memory of 3056	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	39
PID 1952 wrote to memory of 2960	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	40
PID 1952 wrote to memory of 2960	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	40
PID 1952 wrote to memory of 2960	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	40
PID 1952 wrote to memory of 2024	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	41
PID 1952 wrote to memory of 2024	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	41
PID 1952 wrote to memory of 2024	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	41
PID 1952 wrote to memory of 2692	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	42
PID 1952 wrote to memory of 2692	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	42
PID 1952 wrote to memory of 2692	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	42
PID 1952 wrote to memory of 2828	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	43
PID 1952 wrote to memory of 2828	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	43
PID 1952 wrote to memory of 2828	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	43
PID 1952 wrote to memory of 2980	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	44
PID 1952 wrote to memory of 2980	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	44
PID 1952 wrote to memory of 2980	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	44
PID 1952 wrote to memory of 2936	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	45
PID 1952 wrote to memory of 2936	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	45
PID 1952 wrote to memory of 2936	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	45
PID 1952 wrote to memory of 2908	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	46
PID 1952 wrote to memory of 2908	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	46
PID 1952 wrote to memory of 2908	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	46
PID 1952 wrote to memory of 1340	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	47
PID 1952 wrote to memory of 1340	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	47
PID 1952 wrote to memory of 1340	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	47
PID 1952 wrote to memory of 2348	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	48
PID 1952 wrote to memory of 2348	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	48
PID 1952 wrote to memory of 2348	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	48
PID 1952 wrote to memory of 1304	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	49
PID 1952 wrote to memory of 1304	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	49
PID 1952 wrote to memory of 1304	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	49
PID 1952 wrote to memory of 1040	1952	91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91d42bf59806a9092dd32db035a1e769_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System\SOoGCrK.exe
  C:\Windows\System\SOoGCrK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\acxakzg.exe
  C:\Windows\System\acxakzg.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\AMnikxA.exe
  C:\Windows\System\AMnikxA.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\pXzSReG.exe
  C:\Windows\System\pXzSReG.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\XWWfxFp.exe
  C:\Windows\System\XWWfxFp.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\eUWPOzx.exe
  C:\Windows\System\eUWPOzx.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\bfrQjnx.exe
  C:\Windows\System\bfrQjnx.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\KNIfQfP.exe
  C:\Windows\System\KNIfQfP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\pJSuRtd.exe
  C:\Windows\System\pJSuRtd.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\WBwDDtH.exe
  C:\Windows\System\WBwDDtH.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\SpQVfYH.exe
  C:\Windows\System\SpQVfYH.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\bqBflpu.exe
  C:\Windows\System\bqBflpu.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\opBLzAT.exe
  C:\Windows\System\opBLzAT.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DcuyZwn.exe
  C:\Windows\System\DcuyZwn.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\KAuNvQR.exe
  C:\Windows\System\KAuNvQR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\NQjTQrh.exe
  C:\Windows\System\NQjTQrh.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\hZGQPGI.exe
  C:\Windows\System\hZGQPGI.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\uTpVneB.exe
  C:\Windows\System\uTpVneB.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\USbaVXl.exe
  C:\Windows\System\USbaVXl.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\foDoYkR.exe
  C:\Windows\System\foDoYkR.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\ZLWxMvX.exe
  C:\Windows\System\ZLWxMvX.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\Sitjwla.exe
  C:\Windows\System\Sitjwla.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\OhvQrSL.exe
  C:\Windows\System\OhvQrSL.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\usMjTnG.exe
  C:\Windows\System\usMjTnG.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\VAXGrfI.exe
  C:\Windows\System\VAXGrfI.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\zmzhbMd.exe
  C:\Windows\System\zmzhbMd.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\NyUkQiF.exe
  C:\Windows\System\NyUkQiF.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\AWQucSh.exe
  C:\Windows\System\AWQucSh.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\cxfpozJ.exe
  C:\Windows\System\cxfpozJ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\aDpXoRl.exe
  C:\Windows\System\aDpXoRl.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\aLaewar.exe
  C:\Windows\System\aLaewar.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\YyLHryZ.exe
  C:\Windows\System\YyLHryZ.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\RNDkhIs.exe
  C:\Windows\System\RNDkhIs.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\mSkVwnR.exe
  C:\Windows\System\mSkVwnR.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\hiINuLp.exe
  C:\Windows\System\hiINuLp.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\XVcnAkl.exe
  C:\Windows\System\XVcnAkl.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\RQCasBe.exe
  C:\Windows\System\RQCasBe.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\JciQTgf.exe
  C:\Windows\System\JciQTgf.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ooKhfIw.exe
  C:\Windows\System\ooKhfIw.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\fjFezcL.exe
  C:\Windows\System\fjFezcL.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\JbeGwGI.exe
  C:\Windows\System\JbeGwGI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\WuVwlit.exe
  C:\Windows\System\WuVwlit.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\rLKUPha.exe
  C:\Windows\System\rLKUPha.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\BZZAgfM.exe
  C:\Windows\System\BZZAgfM.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\LCElIFz.exe
  C:\Windows\System\LCElIFz.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\lChwIRA.exe
  C:\Windows\System\lChwIRA.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ybbxJuM.exe
  C:\Windows\System\ybbxJuM.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\fEJvvut.exe
  C:\Windows\System\fEJvvut.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ivGTzbh.exe
  C:\Windows\System\ivGTzbh.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\DTQWxzP.exe
  C:\Windows\System\DTQWxzP.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\cghcuBQ.exe
  C:\Windows\System\cghcuBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\PvGPSCM.exe
  C:\Windows\System\PvGPSCM.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\isWmqmD.exe
  C:\Windows\System\isWmqmD.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\XZTRnxv.exe
  C:\Windows\System\XZTRnxv.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\AehmnOI.exe
  C:\Windows\System\AehmnOI.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\lNIwlSv.exe
  C:\Windows\System\lNIwlSv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\KcdVcpU.exe
  C:\Windows\System\KcdVcpU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\eoPCjlx.exe
  C:\Windows\System\eoPCjlx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\leiIbsO.exe
  C:\Windows\System\leiIbsO.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\rjebJFj.exe
  C:\Windows\System\rjebJFj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\MZyeXuC.exe
  C:\Windows\System\MZyeXuC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\bJUfTds.exe
  C:\Windows\System\bJUfTds.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\TOYDhbp.exe
  C:\Windows\System\TOYDhbp.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\yIxkqTD.exe
  C:\Windows\System\yIxkqTD.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EYZlTxp.exe
  C:\Windows\System\EYZlTxp.exe
  2⤵
  PID:2512
- C:\Windows\System\zOXFwHO.exe
  C:\Windows\System\zOXFwHO.exe
  2⤵
  PID:2084
- C:\Windows\System\bYGpOcx.exe
  C:\Windows\System\bYGpOcx.exe
  2⤵
  PID:2720
- C:\Windows\System\lshzstk.exe
  C:\Windows\System\lshzstk.exe
  2⤵
  PID:2964
- C:\Windows\System\ShMOayO.exe
  C:\Windows\System\ShMOayO.exe
  2⤵
  PID:2448
- C:\Windows\System\lPikJFR.exe
  C:\Windows\System\lPikJFR.exe
  2⤵
  PID:2272
- C:\Windows\System\xluXrWq.exe
  C:\Windows\System\xluXrWq.exe
  2⤵
  PID:704
- C:\Windows\System\HTwLurx.exe
  C:\Windows\System\HTwLurx.exe
  2⤵
  PID:1720
- C:\Windows\System\RnWJfnd.exe
  C:\Windows\System\RnWJfnd.exe
  2⤵
  PID:1692
- C:\Windows\System\AWfrlAs.exe
  C:\Windows\System\AWfrlAs.exe
  2⤵
  PID:492
- C:\Windows\System\AgOgcek.exe
  C:\Windows\System\AgOgcek.exe
  2⤵
  PID:1636
- C:\Windows\System\ZDQSjfG.exe
  C:\Windows\System\ZDQSjfG.exe
  2⤵
  PID:2280
- C:\Windows\System\OSAtyTX.exe
  C:\Windows\System\OSAtyTX.exe
  2⤵
  PID:2556
- C:\Windows\System\DaVyldG.exe
  C:\Windows\System\DaVyldG.exe
  2⤵
  PID:2344
- C:\Windows\System\osSGCxh.exe
  C:\Windows\System\osSGCxh.exe
  2⤵
  PID:2312
- C:\Windows\System\ofjNbzB.exe
  C:\Windows\System\ofjNbzB.exe
  2⤵
  PID:2300
- C:\Windows\System\QEvWdEE.exe
  C:\Windows\System\QEvWdEE.exe
  2⤵
  PID:2176
- C:\Windows\System\YMgGpco.exe
  C:\Windows\System\YMgGpco.exe
  2⤵
  PID:2136
- C:\Windows\System\CrBROHN.exe
  C:\Windows\System\CrBROHN.exe
  2⤵
  PID:1364
- C:\Windows\System\JcvyDVx.exe
  C:\Windows\System\JcvyDVx.exe
  2⤵
  PID:1568
- C:\Windows\System\hxfpJCo.exe
  C:\Windows\System\hxfpJCo.exe
  2⤵
  PID:1404
- C:\Windows\System\iiyABie.exe
  C:\Windows\System\iiyABie.exe
  2⤵
  PID:1672
- C:\Windows\System\XJvsSWG.exe
  C:\Windows\System\XJvsSWG.exe
  2⤵
  PID:1676
- C:\Windows\System\RFMtTuE.exe
  C:\Windows\System\RFMtTuE.exe
  2⤵
  PID:712
- C:\Windows\System\ywMSIxq.exe
  C:\Windows\System\ywMSIxq.exe
  2⤵
  PID:2172
- C:\Windows\System\YELIkKA.exe
  C:\Windows\System\YELIkKA.exe
  2⤵
  PID:1740
- C:\Windows\System\NZAXTbR.exe
  C:\Windows\System\NZAXTbR.exe
  2⤵
  PID:2856
- C:\Windows\System\gpsTogK.exe
  C:\Windows\System\gpsTogK.exe
  2⤵
  PID:1800
- C:\Windows\System\bafKdsG.exe
  C:\Windows\System\bafKdsG.exe
  2⤵
  PID:2424
- C:\Windows\System\nXhrCPe.exe
  C:\Windows\System\nXhrCPe.exe
  2⤵
  PID:1136
- C:\Windows\System\UASfiaX.exe
  C:\Windows\System\UASfiaX.exe
  2⤵
  PID:1620
- C:\Windows\System\HYfuQQR.exe
  C:\Windows\System\HYfuQQR.exe
  2⤵
  PID:2612
- C:\Windows\System\DwOUeoW.exe
  C:\Windows\System\DwOUeoW.exe
  2⤵
  PID:2740
- C:\Windows\System\gcJmyVv.exe
  C:\Windows\System\gcJmyVv.exe
  2⤵
  PID:2232
- C:\Windows\System\JcXCCxu.exe
  C:\Windows\System\JcXCCxu.exe
  2⤵
  PID:2944
- C:\Windows\System\GLZxgVa.exe
  C:\Windows\System\GLZxgVa.exe
  2⤵
  PID:2956
- C:\Windows\System\PrhtUsx.exe
  C:\Windows\System\PrhtUsx.exe
  2⤵
  PID:2968
- C:\Windows\System\YvCqDcu.exe
  C:\Windows\System\YvCqDcu.exe
  2⤵
  PID:240
- C:\Windows\System\VMlDeLC.exe
  C:\Windows\System\VMlDeLC.exe
  2⤵
  PID:324
- C:\Windows\System\WHkTwaQ.exe
  C:\Windows\System\WHkTwaQ.exe
  2⤵
  PID:2324
- C:\Windows\System\qgJwZsy.exe
  C:\Windows\System\qgJwZsy.exe
  2⤵
  PID:1444
- C:\Windows\System\zCNgyFo.exe
  C:\Windows\System\zCNgyFo.exe
  2⤵
  PID:2816
- C:\Windows\System\EKJwcrm.exe
  C:\Windows\System\EKJwcrm.exe
  2⤵
  PID:960
- C:\Windows\System\VkUbNQS.exe
  C:\Windows\System\VkUbNQS.exe
  2⤵
  PID:2860
- C:\Windows\System\xwXKxLM.exe
  C:\Windows\System\xwXKxLM.exe
  2⤵
  PID:1884
- C:\Windows\System\RvAGDJt.exe
  C:\Windows\System\RvAGDJt.exe
  2⤵
  PID:928
- C:\Windows\System\XXdvmcL.exe
  C:\Windows\System\XXdvmcL.exe
  2⤵
  PID:1764
- C:\Windows\System\pmvRGDL.exe
  C:\Windows\System\pmvRGDL.exe
  2⤵
  PID:992
- C:\Windows\System\xbBHRus.exe
  C:\Windows\System\xbBHRus.exe
  2⤵
  PID:2420
- C:\Windows\System\CudSAQK.exe
  C:\Windows\System\CudSAQK.exe
  2⤵
  PID:1616
- C:\Windows\System\ffuRqDl.exe
  C:\Windows\System\ffuRqDl.exe
  2⤵
  PID:3088
- C:\Windows\System\NARWGEw.exe
  C:\Windows\System\NARWGEw.exe
  2⤵
  PID:3104
- C:\Windows\System\hhtqzhi.exe
  C:\Windows\System\hhtqzhi.exe
  2⤵
  PID:3120
- C:\Windows\System\zZyLdku.exe
  C:\Windows\System\zZyLdku.exe
  2⤵
  PID:3136
- C:\Windows\System\KsxFFyM.exe
  C:\Windows\System\KsxFFyM.exe
  2⤵
  PID:3152
- C:\Windows\System\ZEcELPF.exe
  C:\Windows\System\ZEcELPF.exe
  2⤵
  PID:3168
- C:\Windows\System\ZcBHLIP.exe
  C:\Windows\System\ZcBHLIP.exe
  2⤵
  PID:3184
- C:\Windows\System\Vxptkki.exe
  C:\Windows\System\Vxptkki.exe
  2⤵
  PID:3200
- C:\Windows\System\YtOrWJV.exe
  C:\Windows\System\YtOrWJV.exe
  2⤵
  PID:3216
- C:\Windows\System\NJaOkTW.exe
  C:\Windows\System\NJaOkTW.exe
  2⤵
  PID:3232
- C:\Windows\System\sXVQOWc.exe
  C:\Windows\System\sXVQOWc.exe
  2⤵
  PID:3248
- C:\Windows\System\GcgJcqT.exe
  C:\Windows\System\GcgJcqT.exe
  2⤵
  PID:3264
- C:\Windows\System\BDHFfNB.exe
  C:\Windows\System\BDHFfNB.exe
  2⤵
  PID:3280
- C:\Windows\System\shjLChO.exe
  C:\Windows\System\shjLChO.exe
  2⤵
  PID:3296
- C:\Windows\System\ZfKedTT.exe
  C:\Windows\System\ZfKedTT.exe
  2⤵
  PID:3312
- C:\Windows\System\dWvFEQc.exe
  C:\Windows\System\dWvFEQc.exe
  2⤵
  PID:3328
- C:\Windows\System\beYojUj.exe
  C:\Windows\System\beYojUj.exe
  2⤵
  PID:3344
- C:\Windows\System\QmceRjA.exe
  C:\Windows\System\QmceRjA.exe
  2⤵
  PID:3360
- C:\Windows\System\nbkFHJf.exe
  C:\Windows\System\nbkFHJf.exe
  2⤵
  PID:3376
- C:\Windows\System\LrUvOaX.exe
  C:\Windows\System\LrUvOaX.exe
  2⤵
  PID:3392
- C:\Windows\System\Hbewxdt.exe
  C:\Windows\System\Hbewxdt.exe
  2⤵
  PID:3408
- C:\Windows\System\nwCnIdK.exe
  C:\Windows\System\nwCnIdK.exe
  2⤵
  PID:3424
- C:\Windows\System\grmCTZw.exe
  C:\Windows\System\grmCTZw.exe
  2⤵
  PID:3440
- C:\Windows\System\oCYkaEi.exe
  C:\Windows\System\oCYkaEi.exe
  2⤵
  PID:3456
- C:\Windows\System\riOvYtn.exe
  C:\Windows\System\riOvYtn.exe
  2⤵
  PID:3472
- C:\Windows\System\PdjMfAc.exe
  C:\Windows\System\PdjMfAc.exe
  2⤵
  PID:3488
- C:\Windows\System\wiacwYg.exe
  C:\Windows\System\wiacwYg.exe
  2⤵
  PID:3504
- C:\Windows\System\dxgPClI.exe
  C:\Windows\System\dxgPClI.exe
  2⤵
  PID:3520
- C:\Windows\System\NpqpIBH.exe
  C:\Windows\System\NpqpIBH.exe
  2⤵
  PID:3536
- C:\Windows\System\wRrDXtm.exe
  C:\Windows\System\wRrDXtm.exe
  2⤵
  PID:3552
- C:\Windows\System\rBMXlBm.exe
  C:\Windows\System\rBMXlBm.exe
  2⤵
  PID:3568
- C:\Windows\System\fpEAGLL.exe
  C:\Windows\System\fpEAGLL.exe
  2⤵
  PID:3584
- C:\Windows\System\OgpwEHq.exe
  C:\Windows\System\OgpwEHq.exe
  2⤵
  PID:3600
- C:\Windows\System\PRIrXAQ.exe
  C:\Windows\System\PRIrXAQ.exe
  2⤵
  PID:3616
- C:\Windows\System\ymPhTbV.exe
  C:\Windows\System\ymPhTbV.exe
  2⤵
  PID:3632
- C:\Windows\System\BvYyDns.exe
  C:\Windows\System\BvYyDns.exe
  2⤵
  PID:3648
- C:\Windows\System\DJUGCNT.exe
  C:\Windows\System\DJUGCNT.exe
  2⤵
  PID:3664
- C:\Windows\System\qyzHbZX.exe
  C:\Windows\System\qyzHbZX.exe
  2⤵
  PID:3680
- C:\Windows\System\zaRvanb.exe
  C:\Windows\System\zaRvanb.exe
  2⤵
  PID:3764
- C:\Windows\System\OhtTYWY.exe
  C:\Windows\System\OhtTYWY.exe
  2⤵
  PID:3800
- C:\Windows\System\LcqVDRZ.exe
  C:\Windows\System\LcqVDRZ.exe
  2⤵
  PID:3816
- C:\Windows\System\fNcdmWi.exe
  C:\Windows\System\fNcdmWi.exe
  2⤵
  PID:3832
- C:\Windows\System\zWNapDl.exe
  C:\Windows\System\zWNapDl.exe
  2⤵
  PID:3848
- C:\Windows\System\UVlhdjK.exe
  C:\Windows\System\UVlhdjK.exe
  2⤵
  PID:3864
- C:\Windows\System\OyjlRmG.exe
  C:\Windows\System\OyjlRmG.exe
  2⤵
  PID:3880
- C:\Windows\System\sFKFIXu.exe
  C:\Windows\System\sFKFIXu.exe
  2⤵
  PID:3896
- C:\Windows\System\wThbpLH.exe
  C:\Windows\System\wThbpLH.exe
  2⤵
  PID:3912
- C:\Windows\System\XSgMTZW.exe
  C:\Windows\System\XSgMTZW.exe
  2⤵
  PID:3928
- C:\Windows\System\GIoflMM.exe
  C:\Windows\System\GIoflMM.exe
  2⤵
  PID:3944
- C:\Windows\System\hxqlOIV.exe
  C:\Windows\System\hxqlOIV.exe
  2⤵
  PID:3960
- C:\Windows\System\SUeFlnl.exe
  C:\Windows\System\SUeFlnl.exe
  2⤵
  PID:3976
- C:\Windows\System\iwpWJnP.exe
  C:\Windows\System\iwpWJnP.exe
  2⤵
  PID:3992
- C:\Windows\System\ERFnfcb.exe
  C:\Windows\System\ERFnfcb.exe
  2⤵
  PID:4008
- C:\Windows\System\qVGZQuD.exe
  C:\Windows\System\qVGZQuD.exe
  2⤵
  PID:4024
- C:\Windows\System\nuCIjNC.exe
  C:\Windows\System\nuCIjNC.exe
  2⤵
  PID:4040
- C:\Windows\System\GeAJLBM.exe
  C:\Windows\System\GeAJLBM.exe
  2⤵
  PID:4056
- C:\Windows\System\uXqvAGe.exe
  C:\Windows\System\uXqvAGe.exe
  2⤵
  PID:4088
- C:\Windows\System\wFYcgFa.exe
  C:\Windows\System\wFYcgFa.exe
  2⤵
  PID:2848
- C:\Windows\System\QmUStqJ.exe
  C:\Windows\System\QmUStqJ.exe
  2⤵
  PID:3116
- C:\Windows\System\CxYzfIY.exe
  C:\Windows\System\CxYzfIY.exe
  2⤵
  PID:3148
- C:\Windows\System\lkcDIyx.exe
  C:\Windows\System\lkcDIyx.exe
  2⤵
  PID:3208
- C:\Windows\System\IITfBtC.exe
  C:\Windows\System\IITfBtC.exe
  2⤵
  PID:3256
- C:\Windows\System\zogdGBi.exe
  C:\Windows\System\zogdGBi.exe
  2⤵
  PID:3272
- C:\Windows\System\DAZJjCC.exe
  C:\Windows\System\DAZJjCC.exe
  2⤵
  PID:3304
- C:\Windows\System\sqOWhay.exe
  C:\Windows\System\sqOWhay.exe
  2⤵
  PID:3356
- C:\Windows\System\neYIOpF.exe
  C:\Windows\System\neYIOpF.exe
  2⤵
  PID:3388
- C:\Windows\System\ZeKikyK.exe
  C:\Windows\System\ZeKikyK.exe
  2⤵
  PID:3400
- C:\Windows\System\aDOaUfs.exe
  C:\Windows\System\aDOaUfs.exe
  2⤵
  PID:3436
- C:\Windows\System\sLSiIQi.exe
  C:\Windows\System\sLSiIQi.exe
  2⤵
  PID:3564
- C:\Windows\System\PHiTNRx.exe
  C:\Windows\System\PHiTNRx.exe
  2⤵
  PID:3628
- C:\Windows\System\MUDIEFN.exe
  C:\Windows\System\MUDIEFN.exe
  2⤵
  PID:3772
- C:\Windows\System\iiBJQIN.exe
  C:\Windows\System\iiBJQIN.exe
  2⤵
  PID:2636
- C:\Windows\System\gHuJawj.exe
  C:\Windows\System\gHuJawj.exe
  2⤵
  PID:604
- C:\Windows\System\TDTkVxr.exe
  C:\Windows\System\TDTkVxr.exe
  2⤵
  PID:2496
- C:\Windows\System\RVHTYfb.exe
  C:\Windows\System\RVHTYfb.exe
  2⤵
  PID:1836
- C:\Windows\System\QJtriaA.exe
  C:\Windows\System\QJtriaA.exe
  2⤵
  PID:3720
- C:\Windows\System\vVuEPqL.exe
  C:\Windows\System\vVuEPqL.exe
  2⤵
  PID:3736
- C:\Windows\System\keDDmdt.exe
  C:\Windows\System\keDDmdt.exe
  2⤵
  PID:3748
- C:\Windows\System\zAXaxnQ.exe
  C:\Windows\System\zAXaxnQ.exe
  2⤵
  PID:3808
- C:\Windows\System\dKxoTyL.exe
  C:\Windows\System\dKxoTyL.exe
  2⤵
  PID:2616
- C:\Windows\System\pYkLQKN.exe
  C:\Windows\System\pYkLQKN.exe
  2⤵
  PID:3860
- C:\Windows\System\bpDPvAe.exe
  C:\Windows\System\bpDPvAe.exe
  2⤵
  PID:2012
- C:\Windows\System\JUrJfCt.exe
  C:\Windows\System\JUrJfCt.exe
  2⤵
  PID:3956
- C:\Windows\System\dwCoQiD.exe
  C:\Windows\System\dwCoQiD.exe
  2⤵
  PID:4016
- C:\Windows\System\ZqykRqQ.exe
  C:\Windows\System\ZqykRqQ.exe
  2⤵
  PID:2484
- C:\Windows\System\oIkzyft.exe
  C:\Windows\System\oIkzyft.exe
  2⤵
  PID:3844
- C:\Windows\System\uLeJhtR.exe
  C:\Windows\System\uLeJhtR.exe
  2⤵
  PID:3904
- C:\Windows\System\lpIknJU.exe
  C:\Windows\System\lpIknJU.exe
  2⤵
  PID:3968
- C:\Windows\System\ozdvkwW.exe
  C:\Windows\System\ozdvkwW.exe
  2⤵
  PID:2088
- C:\Windows\System\QUHVYsh.exe
  C:\Windows\System\QUHVYsh.exe
  2⤵
  PID:3160
- C:\Windows\System\FxqaXNy.exe
  C:\Windows\System\FxqaXNy.exe
  2⤵
  PID:4064
- C:\Windows\System\UysCZAp.exe
  C:\Windows\System\UysCZAp.exe
  2⤵
  PID:3212
- C:\Windows\System\aGHyfQl.exe
  C:\Windows\System\aGHyfQl.exe
  2⤵
  PID:2008
- C:\Windows\System\uXIpiYf.exe
  C:\Windows\System\uXIpiYf.exe
  2⤵
  PID:2520
- C:\Windows\System\FuWOeSj.exe
  C:\Windows\System\FuWOeSj.exe
  2⤵
  PID:3320
- C:\Windows\System\FooNfgX.exe
  C:\Windows\System\FooNfgX.exe
  2⤵
  PID:3064
- C:\Windows\System\swwbBFH.exe
  C:\Windows\System\swwbBFH.exe
  2⤵
  PID:852
- C:\Windows\System\ZMKmgXZ.exe
  C:\Windows\System\ZMKmgXZ.exe
  2⤵
  PID:2352
- C:\Windows\System\FqyaQwA.exe
  C:\Windows\System\FqyaQwA.exe
  2⤵
  PID:2932
- C:\Windows\System\QJinXTW.exe
  C:\Windows\System\QJinXTW.exe
  2⤵
  PID:1516
- C:\Windows\System\qnFKEnu.exe
  C:\Windows\System\qnFKEnu.exe
  2⤵
  PID:2608
- C:\Windows\System\JWxlrWj.exe
  C:\Windows\System\JWxlrWj.exe
  2⤵
  PID:3196
- C:\Windows\System\MluDilK.exe
  C:\Windows\System\MluDilK.exe
  2⤵
  PID:3324
- C:\Windows\System\mNfabGs.exe
  C:\Windows\System\mNfabGs.exe
  2⤵
  PID:2768
- C:\Windows\System\vqmXCAS.exe
  C:\Windows\System\vqmXCAS.exe
  2⤵
  PID:2568
- C:\Windows\System\nflaBPl.exe
  C:\Windows\System\nflaBPl.exe
  2⤵
  PID:3500
- C:\Windows\System\RVvjCvc.exe
  C:\Windows\System\RVvjCvc.exe
  2⤵
  PID:3548
- C:\Windows\System\YYCtvTs.exe
  C:\Windows\System\YYCtvTs.exe
  2⤵
  PID:2120
- C:\Windows\System\MNAqFJA.exe
  C:\Windows\System\MNAqFJA.exe
  2⤵
  PID:3696
- C:\Windows\System\fZLsMHj.exe
  C:\Windows\System\fZLsMHj.exe
  2⤵
  PID:3580
- C:\Windows\System\pQJvGyv.exe
  C:\Windows\System\pQJvGyv.exe
  2⤵
  PID:3644
- C:\Windows\System\QweVkRZ.exe
  C:\Windows\System\QweVkRZ.exe
  2⤵
  PID:1972
- C:\Windows\System\pMQEgMu.exe
  C:\Windows\System\pMQEgMu.exe
  2⤵
  PID:3784
- C:\Windows\System\sBMngDj.exe
  C:\Windows\System\sBMngDj.exe
  2⤵
  PID:316
- C:\Windows\System\MVnQRMV.exe
  C:\Windows\System\MVnQRMV.exe
  2⤵
  PID:3712
- C:\Windows\System\UpGUExv.exe
  C:\Windows\System\UpGUExv.exe
  2⤵
  PID:332
- C:\Windows\System\gTKiyun.exe
  C:\Windows\System\gTKiyun.exe
  2⤵
  PID:2732
- C:\Windows\System\wDXjzvR.exe
  C:\Windows\System\wDXjzvR.exe
  2⤵
  PID:3560
- C:\Windows\System\TOKaXZF.exe
  C:\Windows\System\TOKaXZF.exe
  2⤵
  PID:1592
- C:\Windows\System\WZlFIDJ.exe
  C:\Windows\System\WZlFIDJ.exe
  2⤵
  PID:2524
- C:\Windows\System\iMTzkrI.exe
  C:\Windows\System\iMTzkrI.exe
  2⤵
  PID:3760
- C:\Windows\System\LDwjfps.exe
  C:\Windows\System\LDwjfps.exe
  2⤵
  PID:3892
- C:\Windows\System\lrITRWD.exe
  C:\Windows\System\lrITRWD.exe
  2⤵
  PID:3924
- C:\Windows\System\yYEqYDW.exe
  C:\Windows\System\yYEqYDW.exe
  2⤵
  PID:2016
- C:\Windows\System\VnQpYXO.exe
  C:\Windows\System\VnQpYXO.exe
  2⤵
  PID:4052
- C:\Windows\System\JRaxYwp.exe
  C:\Windows\System\JRaxYwp.exe
  2⤵
  PID:2760
- C:\Windows\System\ZGUZMbq.exe
  C:\Windows\System\ZGUZMbq.exe
  2⤵
  PID:4084
- C:\Windows\System\tJUlWNn.exe
  C:\Windows\System\tJUlWNn.exe
  2⤵
  PID:2500
- C:\Windows\System\mPgPwnb.exe
  C:\Windows\System\mPgPwnb.exe
  2⤵
  PID:3384
- C:\Windows\System\NdgwtCi.exe
  C:\Windows\System\NdgwtCi.exe
  2⤵
  PID:1204
- C:\Windows\System\eVeTBUS.exe
  C:\Windows\System\eVeTBUS.exe
  2⤵
  PID:1864
- C:\Windows\System\dyrocNx.exe
  C:\Windows\System\dyrocNx.exe
  2⤵
  PID:4036
- C:\Windows\System\lAUWhmD.exe
  C:\Windows\System\lAUWhmD.exe
  2⤵
  PID:896
- C:\Windows\System\ScQLGkl.exe
  C:\Windows\System\ScQLGkl.exe
  2⤵
  PID:2052
- C:\Windows\System\mCJHrSS.exe
  C:\Windows\System\mCJHrSS.exe
  2⤵
  PID:2260
- C:\Windows\System\pSYcftT.exe
  C:\Windows\System\pSYcftT.exe
  2⤵
  PID:2364
- C:\Windows\System\nRUUhzj.exe
  C:\Windows\System\nRUUhzj.exe
  2⤵
  PID:3084
- C:\Windows\System\gokvzJw.exe
  C:\Windows\System\gokvzJw.exe
  2⤵
  PID:3260
- C:\Windows\System\PqwimGO.exe
  C:\Windows\System\PqwimGO.exe
  2⤵
  PID:3352
- C:\Windows\System\GSmyOqI.exe
  C:\Windows\System\GSmyOqI.exe
  2⤵
  PID:3464
- C:\Windows\System\FxJuwXQ.exe
  C:\Windows\System\FxJuwXQ.exe
  2⤵
  PID:1876
- C:\Windows\System\hhuayJt.exe
  C:\Windows\System\hhuayJt.exe
  2⤵
  PID:2296
- C:\Windows\System\ARezDLX.exe
  C:\Windows\System\ARezDLX.exe
  2⤵
  PID:3596
- C:\Windows\System\PkDgiyf.exe
  C:\Windows\System\PkDgiyf.exe
  2⤵
  PID:3068
- C:\Windows\System\BufaZIY.exe
  C:\Windows\System\BufaZIY.exe
  2⤵
  PID:2880
- C:\Windows\System\ZWoCjkv.exe
  C:\Windows\System\ZWoCjkv.exe
  2⤵
  PID:1432
- C:\Windows\System\RkZUqns.exe
  C:\Windows\System\RkZUqns.exe
  2⤵
  PID:1536
- C:\Windows\System\vHRrgan.exe
  C:\Windows\System\vHRrgan.exe
  2⤵
  PID:1828
- C:\Windows\System\azvWynk.exe
  C:\Windows\System\azvWynk.exe
  2⤵
  PID:2676
- C:\Windows\System\fvzjrOA.exe
  C:\Windows\System\fvzjrOA.exe
  2⤵
  PID:1756
- C:\Windows\System\FxXmgMq.exe
  C:\Windows\System\FxXmgMq.exe
  2⤵
  PID:3080
- C:\Windows\System\MQmMrPX.exe
  C:\Windows\System\MQmMrPX.exe
  2⤵
  PID:1044
- C:\Windows\System\jvLaoFN.exe
  C:\Windows\System\jvLaoFN.exe
  2⤵
  PID:1640
- C:\Windows\System\tlrXrzl.exe
  C:\Windows\System\tlrXrzl.exe
  2⤵
  PID:3708
- C:\Windows\System\TEOxlAd.exe
  C:\Windows\System\TEOxlAd.exe
  2⤵
  PID:2220
- C:\Windows\System\WERYduA.exe
  C:\Windows\System\WERYduA.exe
  2⤵
  PID:1288
- C:\Windows\System\CFdlImw.exe
  C:\Windows\System\CFdlImw.exe
  2⤵
  PID:3100
- C:\Windows\System\evZLEzd.exe
  C:\Windows\System\evZLEzd.exe
  2⤵
  PID:3484
- C:\Windows\System\nBMghVf.exe
  C:\Windows\System\nBMghVf.exe
  2⤵
  PID:1940
- C:\Windows\System\ETuvsdc.exe
  C:\Windows\System\ETuvsdc.exe
  2⤵
  PID:1612
- C:\Windows\System\vnSKFsN.exe
  C:\Windows\System\vnSKFsN.exe
  2⤵
  PID:4000
- C:\Windows\System\yAoagpV.exe
  C:\Windows\System\yAoagpV.exe
  2⤵
  PID:2772
- C:\Windows\System\dBfSBXO.exe
  C:\Windows\System\dBfSBXO.exe
  2⤵
  PID:3888
- C:\Windows\System\vdJlcjl.exe
  C:\Windows\System\vdJlcjl.exe
  2⤵
  PID:2200
- C:\Windows\System\GGnIkZB.exe
  C:\Windows\System\GGnIkZB.exe
  2⤵
  PID:3688
- C:\Windows\System\lVSjePf.exe
  C:\Windows\System\lVSjePf.exe
  2⤵
  PID:1776
- C:\Windows\System\kNlonBc.exe
  C:\Windows\System\kNlonBc.exe
  2⤵
  PID:2928
- C:\Windows\System\fIbaLXq.exe
  C:\Windows\System\fIbaLXq.exe
  2⤵
  PID:1668
- C:\Windows\System\kTGShJk.exe
  C:\Windows\System\kTGShJk.exe
  2⤵
  PID:3544
- C:\Windows\System\mOjRrfb.exe
  C:\Windows\System\mOjRrfb.exe
  2⤵
  PID:3496
- C:\Windows\System\ULTQuoX.exe
  C:\Windows\System\ULTQuoX.exe
  2⤵
  PID:2184
- C:\Windows\System\gHUUOyR.exe
  C:\Windows\System\gHUUOyR.exe
  2⤵
  PID:2292
- C:\Windows\System\iZiVrHZ.exe
  C:\Windows\System\iZiVrHZ.exe
  2⤵
  PID:3028
- C:\Windows\System\jMvkbEZ.exe
  C:\Windows\System\jMvkbEZ.exe
  2⤵
  PID:3448
- C:\Windows\System\KuKiYPi.exe
  C:\Windows\System\KuKiYPi.exe
  2⤵
  PID:2308
- C:\Windows\System\iwXHcXd.exe
  C:\Windows\System\iwXHcXd.exe
  2⤵
  PID:2216
- C:\Windows\System\WCmyapZ.exe
  C:\Windows\System\WCmyapZ.exe
  2⤵
  PID:3144
- C:\Windows\System\aqOUpIU.exe
  C:\Windows\System\aqOUpIU.exe
  2⤵
  PID:2164
- C:\Windows\System\nlSckqm.exe
  C:\Windows\System\nlSckqm.exe
  2⤵
  PID:2792
- C:\Windows\System\iMvpBye.exe
  C:\Windows\System\iMvpBye.exe
  2⤵
  PID:1696
- C:\Windows\System\XqPrimB.exe
  C:\Windows\System\XqPrimB.exe
  2⤵
  PID:1564
- C:\Windows\System\UAGlyVR.exe
  C:\Windows\System\UAGlyVR.exe
  2⤵
  PID:4100
- C:\Windows\System\zasmhkP.exe
  C:\Windows\System\zasmhkP.exe
  2⤵
  PID:4116
- C:\Windows\System\ojAFkuC.exe
  C:\Windows\System\ojAFkuC.exe
  2⤵
  PID:4132
- C:\Windows\System\jweKMwu.exe
  C:\Windows\System\jweKMwu.exe
  2⤵
  PID:4148
- C:\Windows\System\eGRsNLJ.exe
  C:\Windows\System\eGRsNLJ.exe
  2⤵
  PID:4164
- C:\Windows\System\sjTMRbu.exe
  C:\Windows\System\sjTMRbu.exe
  2⤵
  PID:4180
- C:\Windows\System\icxqcgj.exe
  C:\Windows\System\icxqcgj.exe
  2⤵
  PID:4196
- C:\Windows\System\OyAmqGV.exe
  C:\Windows\System\OyAmqGV.exe
  2⤵
  PID:4212
- C:\Windows\System\wxggWhS.exe
  C:\Windows\System\wxggWhS.exe
  2⤵
  PID:4228
- C:\Windows\System\jmVXgkV.exe
  C:\Windows\System\jmVXgkV.exe
  2⤵
  PID:4244
- C:\Windows\System\dNlcJVM.exe
  C:\Windows\System\dNlcJVM.exe
  2⤵
  PID:4260
- C:\Windows\System\awxUGEl.exe
  C:\Windows\System\awxUGEl.exe
  2⤵
  PID:4276
- C:\Windows\System\WtZVNpB.exe
  C:\Windows\System\WtZVNpB.exe
  2⤵
  PID:4292
- C:\Windows\System\KUlkKnb.exe
  C:\Windows\System\KUlkKnb.exe
  2⤵
  PID:4308
- C:\Windows\System\zmgbTtg.exe
  C:\Windows\System\zmgbTtg.exe
  2⤵
  PID:4324
- C:\Windows\System\GpCnwPH.exe
  C:\Windows\System\GpCnwPH.exe
  2⤵
  PID:4344
- C:\Windows\System\blDcXUp.exe
  C:\Windows\System\blDcXUp.exe
  2⤵
  PID:4360
- C:\Windows\System\sELTLWl.exe
  C:\Windows\System\sELTLWl.exe
  2⤵
  PID:4376
- C:\Windows\System\JsNjWrf.exe
  C:\Windows\System\JsNjWrf.exe
  2⤵
  PID:4392
- C:\Windows\System\jpwSjUD.exe
  C:\Windows\System\jpwSjUD.exe
  2⤵
  PID:4408
- C:\Windows\System\VhulLRy.exe
  C:\Windows\System\VhulLRy.exe
  2⤵
  PID:4424
- C:\Windows\System\stbZsBi.exe
  C:\Windows\System\stbZsBi.exe
  2⤵
  PID:4440
- C:\Windows\System\MsILQAW.exe
  C:\Windows\System\MsILQAW.exe
  2⤵
  PID:4456
- C:\Windows\System\iWumziA.exe
  C:\Windows\System\iWumziA.exe
  2⤵
  PID:4472
- C:\Windows\System\QYDlhrx.exe
  C:\Windows\System\QYDlhrx.exe
  2⤵
  PID:4488
- C:\Windows\System\lgBTiWo.exe
  C:\Windows\System\lgBTiWo.exe
  2⤵
  PID:4504
- C:\Windows\System\mCbzISP.exe
  C:\Windows\System\mCbzISP.exe
  2⤵
  PID:4520
- C:\Windows\System\beNSNgv.exe
  C:\Windows\System\beNSNgv.exe
  2⤵
  PID:4536
- C:\Windows\System\vzEUcfP.exe
  C:\Windows\System\vzEUcfP.exe
  2⤵
  PID:4552
- C:\Windows\System\LIdkKJT.exe
  C:\Windows\System\LIdkKJT.exe
  2⤵
  PID:4568
- C:\Windows\System\MWsUaEx.exe
  C:\Windows\System\MWsUaEx.exe
  2⤵
  PID:4584
- C:\Windows\System\vkhitao.exe
  C:\Windows\System\vkhitao.exe
  2⤵
  PID:4600
- C:\Windows\System\nNmXEHA.exe
  C:\Windows\System\nNmXEHA.exe
  2⤵
  PID:4616
- C:\Windows\System\KcdxEXY.exe
  C:\Windows\System\KcdxEXY.exe
  2⤵
  PID:4632
- C:\Windows\System\RFrRDza.exe
  C:\Windows\System\RFrRDza.exe
  2⤵
  PID:4648
- C:\Windows\System\PPHycfp.exe
  C:\Windows\System\PPHycfp.exe
  2⤵
  PID:4664
- C:\Windows\System\iGkLPWk.exe
  C:\Windows\System\iGkLPWk.exe
  2⤵
  PID:4680
- C:\Windows\System\qNEcCkE.exe
  C:\Windows\System\qNEcCkE.exe
  2⤵
  PID:4696
- C:\Windows\System\PemMHnO.exe
  C:\Windows\System\PemMHnO.exe
  2⤵
  PID:4716
- C:\Windows\System\PpnLuzv.exe
  C:\Windows\System\PpnLuzv.exe
  2⤵
  PID:4732
- C:\Windows\System\vTYSyAM.exe
  C:\Windows\System\vTYSyAM.exe
  2⤵
  PID:4748
- C:\Windows\System\plvvRYx.exe
  C:\Windows\System\plvvRYx.exe
  2⤵
  PID:4764
- C:\Windows\System\QMqpsAV.exe
  C:\Windows\System\QMqpsAV.exe
  2⤵
  PID:4780
- C:\Windows\System\MNiiFgg.exe
  C:\Windows\System\MNiiFgg.exe
  2⤵
  PID:4796
- C:\Windows\System\DVDVQqn.exe
  C:\Windows\System\DVDVQqn.exe
  2⤵
  PID:4812
- C:\Windows\System\DPnDFaG.exe
  C:\Windows\System\DPnDFaG.exe
  2⤵
  PID:4828
- C:\Windows\System\hWsynhA.exe
  C:\Windows\System\hWsynhA.exe
  2⤵
  PID:4844
- C:\Windows\System\YOyBVxK.exe
  C:\Windows\System\YOyBVxK.exe
  2⤵
  PID:4860
- C:\Windows\System\bXNNtqY.exe
  C:\Windows\System\bXNNtqY.exe
  2⤵
  PID:4876
- C:\Windows\System\EqskiMc.exe
  C:\Windows\System\EqskiMc.exe
  2⤵
  PID:4896
- C:\Windows\System\myylCen.exe
  C:\Windows\System\myylCen.exe
  2⤵
  PID:4916
- C:\Windows\System\TzMlLaz.exe
  C:\Windows\System\TzMlLaz.exe
  2⤵
  PID:4936
- C:\Windows\System\gdRtpGj.exe
  C:\Windows\System\gdRtpGj.exe
  2⤵
  PID:4952
- C:\Windows\System\RklthqH.exe
  C:\Windows\System\RklthqH.exe
  2⤵
  PID:4972
- C:\Windows\System\fpWwewp.exe
  C:\Windows\System\fpWwewp.exe
  2⤵
  PID:4988
- C:\Windows\System\PfUFTEc.exe
  C:\Windows\System\PfUFTEc.exe
  2⤵
  PID:5008
- C:\Windows\System\taOrauw.exe
  C:\Windows\System\taOrauw.exe
  2⤵
  PID:5024
- C:\Windows\System\vZXfokf.exe
  C:\Windows\System\vZXfokf.exe
  2⤵
  PID:5040
- C:\Windows\System\WzelQqN.exe
  C:\Windows\System\WzelQqN.exe
  2⤵
  PID:5056
- C:\Windows\System\kEvrNIh.exe
  C:\Windows\System\kEvrNIh.exe
  2⤵
  PID:5072
- C:\Windows\System\gdViDNT.exe
  C:\Windows\System\gdViDNT.exe
  2⤵
  PID:5088
- C:\Windows\System\TsPYHFQ.exe
  C:\Windows\System\TsPYHFQ.exe
  2⤵
  PID:5104
- C:\Windows\System\PEBnbOb.exe
  C:\Windows\System\PEBnbOb.exe
  2⤵
  PID:3480
- C:\Windows\System\uehyclN.exe
  C:\Windows\System\uehyclN.exe
  2⤵
  PID:4124
- C:\Windows\System\FIsEVId.exe
  C:\Windows\System\FIsEVId.exe
  2⤵
  PID:4188
- C:\Windows\System\PDqUZeD.exe
  C:\Windows\System\PDqUZeD.exe
  2⤵
  PID:4252
- C:\Windows\System\fgjKUmY.exe
  C:\Windows\System\fgjKUmY.exe
  2⤵
  PID:4316
- C:\Windows\System\LrbyXTU.exe
  C:\Windows\System\LrbyXTU.exe
  2⤵
  PID:4108
- C:\Windows\System\diqkEFd.exe
  C:\Windows\System\diqkEFd.exe
  2⤵
  PID:2112
- C:\Windows\System\JiAFsiq.exe
  C:\Windows\System\JiAFsiq.exe
  2⤵
  PID:4332
- C:\Windows\System\hOrxRNa.exe
  C:\Windows\System\hOrxRNa.exe
  2⤵
  PID:3292
- C:\Windows\System\qDAIlhm.exe
  C:\Windows\System\qDAIlhm.exe
  2⤵
  PID:4208
- C:\Windows\System\gsMykGn.exe
  C:\Windows\System\gsMykGn.exe
  2⤵
  PID:1508
- C:\Windows\System\BKuPplr.exe
  C:\Windows\System\BKuPplr.exe
  2⤵
  PID:4080
- C:\Windows\System\WopMLuN.exe
  C:\Windows\System\WopMLuN.exe
  2⤵
  PID:4388
- C:\Windows\System\QDpiojU.exe
  C:\Windows\System\QDpiojU.exe
  2⤵
  PID:4448
- C:\Windows\System\aPmpCwH.exe
  C:\Windows\System\aPmpCwH.exe
  2⤵
  PID:4484
- C:\Windows\System\PGiVeoB.exe
  C:\Windows\System\PGiVeoB.exe
  2⤵
  PID:4368
- C:\Windows\System\BvuFytm.exe
  C:\Windows\System\BvuFytm.exe
  2⤵
  PID:4516
- C:\Windows\System\TcemkPt.exe
  C:\Windows\System\TcemkPt.exe
  2⤵
  PID:4500
- C:\Windows\System\ShKUIaW.exe
  C:\Windows\System\ShKUIaW.exe
  2⤵
  PID:4564
- C:\Windows\System\qQaGVUD.exe
  C:\Windows\System\qQaGVUD.exe
  2⤵
  PID:4592
- C:\Windows\System\zmVzdeP.exe
  C:\Windows\System\zmVzdeP.exe
  2⤵
  PID:4644
- C:\Windows\System\YFAtliT.exe
  C:\Windows\System\YFAtliT.exe
  2⤵
  PID:4532
- C:\Windows\System\ZLENdXg.exe
  C:\Windows\System\ZLENdXg.exe
  2⤵
  PID:4656
- C:\Windows\System\BYhQNuX.exe
  C:\Windows\System\BYhQNuX.exe
  2⤵
  PID:4712
- C:\Windows\System\BUfyzKD.exe
  C:\Windows\System\BUfyzKD.exe
  2⤵
  PID:4776
- C:\Windows\System\bwWgcBf.exe
  C:\Windows\System\bwWgcBf.exe
  2⤵
  PID:4840
- C:\Windows\System\ZGXJoeS.exe
  C:\Windows\System\ZGXJoeS.exe
  2⤵
  PID:4908
- C:\Windows\System\hbklTIx.exe
  C:\Windows\System\hbklTIx.exe
  2⤵
  PID:4948
- C:\Windows\System\vrRzewg.exe
  C:\Windows\System\vrRzewg.exe
  2⤵
  PID:5020
- C:\Windows\System\yFNdFNL.exe
  C:\Windows\System\yFNdFNL.exe
  2⤵
  PID:5084
- C:\Windows\System\leKLbei.exe
  C:\Windows\System\leKLbei.exe
  2⤵
  PID:4160
- C:\Windows\System\OacsNNz.exe
  C:\Windows\System\OacsNNz.exe
  2⤵
  PID:4204
- C:\Windows\System\dqkYFyB.exe
  C:\Windows\System\dqkYFyB.exe
  2⤵
  PID:4272
- C:\Windows\System\oHjsudG.exe
  C:\Windows\System\oHjsudG.exe
  2⤵
  PID:4480
- C:\Windows\System\VDjnRJc.exe
  C:\Windows\System\VDjnRJc.exe
  2⤵
  PID:4372
- C:\Windows\System\okrTuJO.exe
  C:\Windows\System\okrTuJO.exe
  2⤵
  PID:4560
- C:\Windows\System\vWvdLzz.exe
  C:\Windows\System\vWvdLzz.exe
  2⤵
  PID:4772
- C:\Windows\System\ZtGqLTe.exe
  C:\Windows\System\ZtGqLTe.exe
  2⤵
  PID:4984
- C:\Windows\System\KpqSJTx.exe
  C:\Windows\System\KpqSJTx.exe
  2⤵
  PID:2204
- C:\Windows\System\sCkffFD.exe
  C:\Windows\System\sCkffFD.exe
  2⤵
  PID:4852
- C:\Windows\System\giACnrH.exe
  C:\Windows\System\giACnrH.exe
  2⤵
  PID:4892
- C:\Windows\System\CLaWOEM.exe
  C:\Windows\System\CLaWOEM.exe
  2⤵
  PID:4628
- C:\Windows\System\WRZQQeP.exe
  C:\Windows\System\WRZQQeP.exe
  2⤵
  PID:5000
- C:\Windows\System\WGrkMmC.exe
  C:\Windows\System\WGrkMmC.exe
  2⤵
  PID:4836
- C:\Windows\System\TJhawUk.exe
  C:\Windows\System\TJhawUk.exe
  2⤵
  PID:4792
- C:\Windows\System\KKhBJJD.exe
  C:\Windows\System\KKhBJJD.exe
  2⤵
  PID:4468
- C:\Windows\System\YDmGLGd.exe
  C:\Windows\System\YDmGLGd.exe
  2⤵
  PID:4932
- C:\Windows\System\fYCQJrm.exe
  C:\Windows\System\fYCQJrm.exe
  2⤵
  PID:4384
- C:\Windows\System\nXBpIKN.exe
  C:\Windows\System\nXBpIKN.exe
  2⤵
  PID:4980
- C:\Windows\System\HTNPgJd.exe
  C:\Windows\System\HTNPgJd.exe
  2⤵
  PID:4576
- C:\Windows\System\SJPUgWB.exe
  C:\Windows\System\SJPUgWB.exe
  2⤵
  PID:4420
- C:\Windows\System\rprarfL.exe
  C:\Windows\System\rprarfL.exe
  2⤵
  PID:3676
- C:\Windows\System\nkfZIeK.exe
  C:\Windows\System\nkfZIeK.exe
  2⤵
  PID:1256
- C:\Windows\System\zTUvNMa.exe
  C:\Windows\System\zTUvNMa.exe
  2⤵
  PID:3744
- C:\Windows\System\KqEQKUx.exe
  C:\Windows\System\KqEQKUx.exe
  2⤵
  PID:5068
- C:\Windows\System\YteaUNE.exe
  C:\Windows\System\YteaUNE.exe
  2⤵
  PID:5004
- C:\Windows\System\CjhyERz.exe
  C:\Windows\System\CjhyERz.exe
  2⤵
  PID:4888
- C:\Windows\System\LxUEMMV.exe
  C:\Windows\System\LxUEMMV.exe
  2⤵
  PID:4288
- C:\Windows\System\EDHDFyb.exe
  C:\Windows\System\EDHDFyb.exe
  2⤵
  PID:4872
- C:\Windows\System\vFJSuzX.exe
  C:\Windows\System\vFJSuzX.exe
  2⤵
  PID:4268
- C:\Windows\System\QmEXQSf.exe
  C:\Windows\System\QmEXQSf.exe
  2⤵
  PID:5132
- C:\Windows\System\cdbFynF.exe
  C:\Windows\System\cdbFynF.exe
  2⤵
  PID:5152
- C:\Windows\System\JYVfPph.exe
  C:\Windows\System\JYVfPph.exe
  2⤵
  PID:5168
- C:\Windows\System\dafoeRy.exe
  C:\Windows\System\dafoeRy.exe
  2⤵
  PID:5184
- C:\Windows\System\YxbzThH.exe
  C:\Windows\System\YxbzThH.exe
  2⤵
  PID:5200
- C:\Windows\System\MwjfPPh.exe
  C:\Windows\System\MwjfPPh.exe
  2⤵
  PID:5216
- C:\Windows\System\AzAKTAO.exe
  C:\Windows\System\AzAKTAO.exe
  2⤵
  PID:5236
- C:\Windows\System\amlxCrK.exe
  C:\Windows\System\amlxCrK.exe
  2⤵
  PID:5256
- C:\Windows\System\IQIPkLe.exe
  C:\Windows\System\IQIPkLe.exe
  2⤵
  PID:5276
- C:\Windows\System\LhrGanr.exe
  C:\Windows\System\LhrGanr.exe
  2⤵
  PID:5296
- C:\Windows\System\DnUxlqT.exe
  C:\Windows\System\DnUxlqT.exe
  2⤵
  PID:5316
- C:\Windows\System\HEgSTFe.exe
  C:\Windows\System\HEgSTFe.exe
  2⤵
  PID:5332
- C:\Windows\System\YIpaLZA.exe
  C:\Windows\System\YIpaLZA.exe
  2⤵
  PID:5348
- C:\Windows\System\FliRuTT.exe
  C:\Windows\System\FliRuTT.exe
  2⤵
  PID:5364
- C:\Windows\System\qOPpChg.exe
  C:\Windows\System\qOPpChg.exe
  2⤵
  PID:5380
- C:\Windows\System\iTcyYkn.exe
  C:\Windows\System\iTcyYkn.exe
  2⤵
  PID:5396
- C:\Windows\System\dDfYRMo.exe
  C:\Windows\System\dDfYRMo.exe
  2⤵
  PID:5412
- C:\Windows\System\TqrIBms.exe
  C:\Windows\System\TqrIBms.exe
  2⤵
  PID:5428
- C:\Windows\System\zNsgmpw.exe
  C:\Windows\System\zNsgmpw.exe
  2⤵
  PID:5444
- C:\Windows\System\JjuVRxA.exe
  C:\Windows\System\JjuVRxA.exe
  2⤵
  PID:5460
- C:\Windows\System\LSgpUwe.exe
  C:\Windows\System\LSgpUwe.exe
  2⤵
  PID:5476
- C:\Windows\System\vnZUuui.exe
  C:\Windows\System\vnZUuui.exe
  2⤵
  PID:5492
- C:\Windows\System\WLDkgAo.exe
  C:\Windows\System\WLDkgAo.exe
  2⤵
  PID:5508
- C:\Windows\System\vtibFaH.exe
  C:\Windows\System\vtibFaH.exe
  2⤵
  PID:5524
- C:\Windows\System\OXwnrKk.exe
  C:\Windows\System\OXwnrKk.exe
  2⤵
  PID:5540
- C:\Windows\System\rkdYPlB.exe
  C:\Windows\System\rkdYPlB.exe
  2⤵
  PID:5556
- C:\Windows\System\JXoHkhw.exe
  C:\Windows\System\JXoHkhw.exe
  2⤵
  PID:5672
- C:\Windows\System\daZfSAU.exe
  C:\Windows\System\daZfSAU.exe
  2⤵
  PID:5704
- C:\Windows\System\KRqYEWK.exe
  C:\Windows\System\KRqYEWK.exe
  2⤵
  PID:5796
- C:\Windows\System\frUkCro.exe
  C:\Windows\System\frUkCro.exe
  2⤵
  PID:5848
- C:\Windows\System\bLOUSyE.exe
  C:\Windows\System\bLOUSyE.exe
  2⤵
  PID:6008
- C:\Windows\System\VYARVps.exe
  C:\Windows\System\VYARVps.exe
  2⤵
  PID:6064
- C:\Windows\System\ZLqfcal.exe
  C:\Windows\System\ZLqfcal.exe
  2⤵
  PID:5468
- C:\Windows\System\acwZgXA.exe
  C:\Windows\System\acwZgXA.exe
  2⤵
  PID:4356
- C:\Windows\System\COsxAHD.exe
  C:\Windows\System\COsxAHD.exe
  2⤵
  PID:4612
- C:\Windows\System\fAOYHqY.exe
  C:\Windows\System\fAOYHqY.exe
  2⤵
  PID:4156
- C:\Windows\System\ewRNOPI.exe
  C:\Windows\System\ewRNOPI.exe
  2⤵
  PID:5520
- C:\Windows\System\QfiQkjy.exe
  C:\Windows\System\QfiQkjy.exe
  2⤵
  PID:5636
- C:\Windows\System\tEbwZfN.exe
  C:\Windows\System\tEbwZfN.exe
  2⤵
  PID:5652
- C:\Windows\System\dhWSuFy.exe
  C:\Windows\System\dhWSuFy.exe
  2⤵
  PID:5728
- C:\Windows\System\ruVOOhD.exe
  C:\Windows\System\ruVOOhD.exe
  2⤵
  PID:5752
- C:\Windows\System\VPoKpjk.exe
  C:\Windows\System\VPoKpjk.exe
  2⤵
  PID:5768
- C:\Windows\System\yAsatUI.exe
  C:\Windows\System\yAsatUI.exe
  2⤵
  PID:5836
- C:\Windows\System\PCfbQvY.exe
  C:\Windows\System\PCfbQvY.exe
  2⤵
  PID:5984
- C:\Windows\System\dDyihHK.exe
  C:\Windows\System\dDyihHK.exe
  2⤵
  PID:6000
- C:\Windows\System\OZagoIr.exe
  C:\Windows\System\OZagoIr.exe
  2⤵
  PID:6040
- C:\Windows\System\zPSHOyH.exe
  C:\Windows\System\zPSHOyH.exe
  2⤵
  PID:6048
- C:\Windows\System\PMHQcHG.exe
  C:\Windows\System\PMHQcHG.exe
  2⤵
  PID:6140
- C:\Windows\System\zhfsYVG.exe
  C:\Windows\System\zhfsYVG.exe
  2⤵
  PID:2652
- C:\Windows\System\WKvphTf.exe
  C:\Windows\System\WKvphTf.exe
  2⤵
  PID:6088
- C:\Windows\System\ceWVHRE.exe
  C:\Windows\System\ceWVHRE.exe
  2⤵
  PID:6100
- C:\Windows\System\pBfxYBe.exe
  C:\Windows\System\pBfxYBe.exe
  2⤵
  PID:6124
- C:\Windows\System\hGRmaPN.exe
  C:\Windows\System\hGRmaPN.exe
  2⤵
  PID:4808
- C:\Windows\System\BtxMNwg.exe
  C:\Windows\System\BtxMNwg.exe
  2⤵
  PID:5128
- C:\Windows\System\DprqaTP.exe
  C:\Windows\System\DprqaTP.exe
  2⤵
  PID:5312
- C:\Windows\System\esLyBIZ.exe
  C:\Windows\System\esLyBIZ.exe
  2⤵
  PID:5272
- C:\Windows\System\RkfhzDN.exe
  C:\Windows\System\RkfhzDN.exe
  2⤵
  PID:5340
- C:\Windows\System\Btnirsd.exe
  C:\Windows\System\Btnirsd.exe
  2⤵
  PID:4964
- C:\Windows\System\QIHuAuf.exe
  C:\Windows\System\QIHuAuf.exe
  2⤵
  PID:4924
- C:\Windows\System\sdybTpm.exe
  C:\Windows\System\sdybTpm.exe
  2⤵
  PID:4688
- C:\Windows\System\xudTUlQ.exe
  C:\Windows\System\xudTUlQ.exe
  2⤵
  PID:5144
- C:\Windows\System\MVTuHki.exe
  C:\Windows\System\MVTuHki.exe
  2⤵
  PID:5248
- C:\Windows\System\BYPeTmL.exe
  C:\Windows\System\BYPeTmL.exe
  2⤵
  PID:5420
- C:\Windows\System\vHnXBKR.exe
  C:\Windows\System\vHnXBKR.exe
  2⤵
  PID:5252
- C:\Windows\System\TksdQAc.exe
  C:\Windows\System\TksdQAc.exe
  2⤵
  PID:5424
- C:\Windows\System\hdxOUYu.exe
  C:\Windows\System\hdxOUYu.exe
  2⤵
  PID:5356
- C:\Windows\System\GYBNlUZ.exe
  C:\Windows\System\GYBNlUZ.exe
  2⤵
  PID:5516
- C:\Windows\System\dfiANaV.exe
  C:\Windows\System\dfiANaV.exe
  2⤵
  PID:5328
- C:\Windows\System\cXqWhzJ.exe
  C:\Windows\System\cXqWhzJ.exe
  2⤵
  PID:5288
- C:\Windows\System\iaTaolC.exe
  C:\Windows\System\iaTaolC.exe
  2⤵
  PID:5484
- C:\Windows\System\ElDMyOf.exe
  C:\Windows\System\ElDMyOf.exe
  2⤵
  PID:5576
- C:\Windows\System\NiYXQzD.exe
  C:\Windows\System\NiYXQzD.exe
  2⤵
  PID:5596
- C:\Windows\System\vjfrHJm.exe
  C:\Windows\System\vjfrHJm.exe
  2⤵
  PID:5608
- C:\Windows\System\qWGyxEr.exe
  C:\Windows\System\qWGyxEr.exe
  2⤵
  PID:5624
- C:\Windows\System\VprhXno.exe
  C:\Windows\System\VprhXno.exe
  2⤵
  PID:5632
- C:\Windows\System\rmqIOqq.exe
  C:\Windows\System\rmqIOqq.exe
  2⤵
  PID:5736
- C:\Windows\System\bMAlfgl.exe
  C:\Windows\System\bMAlfgl.exe
  2⤵
  PID:2340
- C:\Windows\System\kLsHslq.exe
  C:\Windows\System\kLsHslq.exe
  2⤵
  PID:5824
- C:\Windows\System\ZnFHrJq.exe
  C:\Windows\System\ZnFHrJq.exe
  2⤵
  PID:5668
- C:\Windows\System\yObGFbi.exe
  C:\Windows\System\yObGFbi.exe
  2⤵
  PID:5720
- C:\Windows\System\GMJEigD.exe
  C:\Windows\System\GMJEigD.exe
  2⤵
  PID:1848
- C:\Windows\System\UAYdrLg.exe
  C:\Windows\System\UAYdrLg.exe
  2⤵
  PID:6028
- C:\Windows\System\TNGATGD.exe
  C:\Windows\System\TNGATGD.exe
  2⤵
  PID:5772
- C:\Windows\System\ZvUDxca.exe
  C:\Windows\System\ZvUDxca.exe
  2⤵
  PID:5948
- C:\Windows\System\hZojnad.exe
  C:\Windows\System\hZojnad.exe
  2⤵
  PID:5892
- C:\Windows\System\XItkdda.exe
  C:\Windows\System\XItkdda.exe
  2⤵
  PID:5908
- C:\Windows\System\cZzFkkT.exe
  C:\Windows\System\cZzFkkT.exe
  2⤵
  PID:6132
- C:\Windows\System\ILfiKAe.exe
  C:\Windows\System\ILfiKAe.exe
  2⤵
  PID:5164
- C:\Windows\System\MPhXmjJ.exe
  C:\Windows\System\MPhXmjJ.exe
  2⤵
  PID:5944
- C:\Windows\System\UeyzJlv.exe
  C:\Windows\System\UeyzJlv.exe
  2⤵
  PID:2664
- C:\Windows\System\JjbLViW.exe
  C:\Windows\System\JjbLViW.exe
  2⤵
  PID:5856
- C:\Windows\System\mzAKbCK.exe
  C:\Windows\System\mzAKbCK.exe
  2⤵
  PID:5872
- C:\Windows\System\rrqHbeE.exe
  C:\Windows\System\rrqHbeE.exe
  2⤵
  PID:5884
- C:\Windows\System\UXmCykj.exe
  C:\Windows\System\UXmCykj.exe
  2⤵
  PID:5916
- C:\Windows\System\zTPckDG.exe
  C:\Windows\System\zTPckDG.exe
  2⤵
  PID:6024
- C:\Windows\System\YGZPJxd.exe
  C:\Windows\System\YGZPJxd.exe
  2⤵
  PID:6016
- C:\Windows\System\iHyjdaY.exe
  C:\Windows\System\iHyjdaY.exe
  2⤵
  PID:6108
- C:\Windows\System\NhCBkiN.exe
  C:\Windows\System\NhCBkiN.exe
  2⤵
  PID:4968
- C:\Windows\System\nzesCkT.exe
  C:\Windows\System\nzesCkT.exe
  2⤵
  PID:5568
- C:\Windows\System\WpqASXp.exe
  C:\Windows\System\WpqASXp.exe
  2⤵
  PID:5748
- C:\Windows\System\yzqlBDW.exe
  C:\Windows\System\yzqlBDW.exe
  2⤵
  PID:5684
- C:\Windows\System\oANWsUp.exe
  C:\Windows\System\oANWsUp.exe
  2⤵
  PID:5764
- C:\Windows\System\KrZEFXr.exe
  C:\Windows\System\KrZEFXr.exe
  2⤵
  PID:5212
- C:\Windows\System\CoCQcpF.exe
  C:\Windows\System\CoCQcpF.exe
  2⤵
  PID:6104
- C:\Windows\System\lJqjJXB.exe
  C:\Windows\System\lJqjJXB.exe
  2⤵
  PID:5880
- C:\Windows\System\uUcWEFi.exe
  C:\Windows\System\uUcWEFi.exe
  2⤵
  PID:5968
- C:\Windows\System\ypTlOjT.exe
  C:\Windows\System\ypTlOjT.exe
  2⤵
  PID:4176
- C:\Windows\System\HpBGNuV.exe
  C:\Windows\System\HpBGNuV.exe
  2⤵
  PID:5868
- C:\Windows\System\mBxcApk.exe
  C:\Windows\System\mBxcApk.exe
  2⤵
  PID:5740
- C:\Windows\System\JwCvPqu.exe
  C:\Windows\System\JwCvPqu.exe
  2⤵
  PID:5816
- C:\Windows\System\tYBSHmL.exe
  C:\Windows\System\tYBSHmL.exe
  2⤵
  PID:5680
- C:\Windows\System\TLkGNnc.exe
  C:\Windows\System\TLkGNnc.exe
  2⤵
  PID:6092
- C:\Windows\System\UIgLvPJ.exe
  C:\Windows\System\UIgLvPJ.exe
  2⤵
  PID:5980
- C:\Windows\System\QOXtInv.exe
  C:\Windows\System\QOXtInv.exe
  2⤵
  PID:5032
- C:\Windows\System\gWnrJwz.exe
  C:\Windows\System\gWnrJwz.exe
  2⤵
  PID:5904
- C:\Windows\System\UYrCjIs.exe
  C:\Windows\System\UYrCjIs.exe
  2⤵
  PID:1584
- C:\Windows\System\KmHBCPz.exe
  C:\Windows\System\KmHBCPz.exe
  2⤵
  PID:5208
- C:\Windows\System\bsOjjht.exe
  C:\Windows\System\bsOjjht.exe
  2⤵
  PID:5292
- C:\Windows\System\aEOJbya.exe
  C:\Windows\System\aEOJbya.exe
  2⤵
  PID:5180
- C:\Windows\System\dxQYZtG.exe
  C:\Windows\System\dxQYZtG.exe
  2⤵
  PID:5644
- C:\Windows\System\hopMItE.exe
  C:\Windows\System\hopMItE.exe
  2⤵
  PID:5996
- C:\Windows\System\VPZqwZZ.exe
  C:\Windows\System\VPZqwZZ.exe
  2⤵
  PID:5792
- C:\Windows\System\SfjlEqH.exe
  C:\Windows\System\SfjlEqH.exe
  2⤵
  PID:5604
- C:\Windows\System\enMFdbQ.exe
  C:\Windows\System\enMFdbQ.exe
  2⤵
  PID:5628
- C:\Windows\System\waZuNpb.exe
  C:\Windows\System\waZuNpb.exe
  2⤵
  PID:640
- C:\Windows\System\opMFYWR.exe
  C:\Windows\System\opMFYWR.exe
  2⤵
  PID:5924
- C:\Windows\System\MYZCJQg.exe
  C:\Windows\System\MYZCJQg.exe
  2⤵
  PID:6120
- C:\Windows\System\axCSGQm.exe
  C:\Windows\System\axCSGQm.exe
  2⤵
  PID:5548
- C:\Windows\System\IosHneX.exe
  C:\Windows\System\IosHneX.exe
  2⤵
  PID:5828
- C:\Windows\System\wwWEZRg.exe
  C:\Windows\System\wwWEZRg.exe
  2⤵
  PID:5264
- C:\Windows\System\faqagas.exe
  C:\Windows\System\faqagas.exe
  2⤵
  PID:5940
- C:\Windows\System\mscszBM.exe
  C:\Windows\System\mscszBM.exe
  2⤵
  PID:5536
- C:\Windows\System\UribEJS.exe
  C:\Windows\System\UribEJS.exe
  2⤵
  PID:5268
- C:\Windows\System\ASarTKv.exe
  C:\Windows\System\ASarTKv.exe
  2⤵
  PID:5372
- C:\Windows\System\KKJbjgN.exe
  C:\Windows\System\KKJbjgN.exe
  2⤵
  PID:4960
- C:\Windows\System\THYElnL.exe
  C:\Windows\System\THYElnL.exe
  2⤵
  PID:6136
- C:\Windows\System\oahMesB.exe
  C:\Windows\System\oahMesB.exe
  2⤵
  PID:6160
- C:\Windows\System\irAGDeD.exe
  C:\Windows\System\irAGDeD.exe
  2⤵
  PID:6176
- C:\Windows\System\GdSbsGg.exe
  C:\Windows\System\GdSbsGg.exe
  2⤵
  PID:6192
- C:\Windows\System\YunlQDb.exe
  C:\Windows\System\YunlQDb.exe
  2⤵
  PID:6208
- C:\Windows\System\tobidqk.exe
  C:\Windows\System\tobidqk.exe
  2⤵
  PID:6228
- C:\Windows\System\bbeoARb.exe
  C:\Windows\System\bbeoARb.exe
  2⤵
  PID:6244
- C:\Windows\System\WUhioqd.exe
  C:\Windows\System\WUhioqd.exe
  2⤵
  PID:6260
- C:\Windows\System\euOdjIk.exe
  C:\Windows\System\euOdjIk.exe
  2⤵
  PID:6276
- C:\Windows\System\slYkjBm.exe
  C:\Windows\System\slYkjBm.exe
  2⤵
  PID:6292
- C:\Windows\System\PRwDQxk.exe
  C:\Windows\System\PRwDQxk.exe
  2⤵
  PID:6312
- C:\Windows\System\SmhuJOU.exe
  C:\Windows\System\SmhuJOU.exe
  2⤵
  PID:6328
- C:\Windows\System\PCFoALa.exe
  C:\Windows\System\PCFoALa.exe
  2⤵
  PID:6344
- C:\Windows\System\ZGHcoEr.exe
  C:\Windows\System\ZGHcoEr.exe
  2⤵
  PID:6368
- C:\Windows\System\PmWNGaY.exe
  C:\Windows\System\PmWNGaY.exe
  2⤵
  PID:6384
- C:\Windows\System\gChZUFe.exe
  C:\Windows\System\gChZUFe.exe
  2⤵
  PID:6400
- C:\Windows\System\wisMIgg.exe
  C:\Windows\System\wisMIgg.exe
  2⤵
  PID:6420
- C:\Windows\System\eSVqnuj.exe
  C:\Windows\System\eSVqnuj.exe
  2⤵
  PID:6436
- C:\Windows\System\zHBWWbV.exe
  C:\Windows\System\zHBWWbV.exe
  2⤵
  PID:6452
- C:\Windows\System\cdoqXGA.exe
  C:\Windows\System\cdoqXGA.exe
  2⤵
  PID:6472
- C:\Windows\System\tUmWvCE.exe
  C:\Windows\System\tUmWvCE.exe
  2⤵
  PID:6488
- C:\Windows\System\PKLVnhl.exe
  C:\Windows\System\PKLVnhl.exe
  2⤵
  PID:6504
- C:\Windows\System\fotOfcm.exe
  C:\Windows\System\fotOfcm.exe
  2⤵
  PID:6524
- C:\Windows\System\sujQeNd.exe
  C:\Windows\System\sujQeNd.exe
  2⤵
  PID:6540
- C:\Windows\System\DlPHrdy.exe
  C:\Windows\System\DlPHrdy.exe
  2⤵
  PID:6556
- C:\Windows\System\XpRHOTy.exe
  C:\Windows\System\XpRHOTy.exe
  2⤵
  PID:6576
- C:\Windows\System\QGeFumf.exe
  C:\Windows\System\QGeFumf.exe
  2⤵
  PID:6592
- C:\Windows\System\nhhKifN.exe
  C:\Windows\System\nhhKifN.exe
  2⤵
  PID:6608
- C:\Windows\System\GVoEnWa.exe
  C:\Windows\System\GVoEnWa.exe
  2⤵
  PID:6624
- C:\Windows\System\WvArJKq.exe
  C:\Windows\System\WvArJKq.exe
  2⤵
  PID:6640
- C:\Windows\System\nWhOBFr.exe
  C:\Windows\System\nWhOBFr.exe
  2⤵
  PID:6656
- C:\Windows\System\RiadcZF.exe
  C:\Windows\System\RiadcZF.exe
  2⤵
  PID:6676
- C:\Windows\System\WPWsHYa.exe
  C:\Windows\System\WPWsHYa.exe
  2⤵
  PID:6692
- C:\Windows\System\UrFQYbn.exe
  C:\Windows\System\UrFQYbn.exe
  2⤵
  PID:6708
- C:\Windows\System\pTCOejM.exe
  C:\Windows\System\pTCOejM.exe
  2⤵
  PID:6724
- C:\Windows\System\dzralqs.exe
  C:\Windows\System\dzralqs.exe
  2⤵
  PID:6740
- C:\Windows\System\JntppWO.exe
  C:\Windows\System\JntppWO.exe
  2⤵
  PID:6756
- C:\Windows\System\GFpEEfo.exe
  C:\Windows\System\GFpEEfo.exe
  2⤵
  PID:6772
- C:\Windows\System\rZrhkIP.exe
  C:\Windows\System\rZrhkIP.exe
  2⤵
  PID:6816
- C:\Windows\System\lICFzQc.exe
  C:\Windows\System\lICFzQc.exe
  2⤵
  PID:6832
- C:\Windows\System\DXWpUCt.exe
  C:\Windows\System\DXWpUCt.exe
  2⤵
  PID:6848
- C:\Windows\System\DqPFKiR.exe
  C:\Windows\System\DqPFKiR.exe
  2⤵
  PID:6864
- C:\Windows\System\zYCJCDs.exe
  C:\Windows\System\zYCJCDs.exe
  2⤵
  PID:6948
- C:\Windows\System\jvEqwBY.exe
  C:\Windows\System\jvEqwBY.exe
  2⤵
  PID:6964
- C:\Windows\System\YXpPike.exe
  C:\Windows\System\YXpPike.exe
  2⤵
  PID:6980
- C:\Windows\System\bTRrECw.exe
  C:\Windows\System\bTRrECw.exe
  2⤵
  PID:6996
- C:\Windows\System\UVLojmg.exe
  C:\Windows\System\UVLojmg.exe
  2⤵
  PID:7012
- C:\Windows\System\qjvLtFe.exe
  C:\Windows\System\qjvLtFe.exe
  2⤵
  PID:7028
- C:\Windows\System\rWlJfhp.exe
  C:\Windows\System\rWlJfhp.exe
  2⤵
  PID:7044
- C:\Windows\System\DDmEqUl.exe
  C:\Windows\System\DDmEqUl.exe
  2⤵
  PID:7060
- C:\Windows\System\OXGhRTG.exe
  C:\Windows\System\OXGhRTG.exe
  2⤵
  PID:7076
- C:\Windows\System\vIImhSl.exe
  C:\Windows\System\vIImhSl.exe
  2⤵
  PID:7092
- C:\Windows\System\adlKrxv.exe
  C:\Windows\System\adlKrxv.exe
  2⤵
  PID:7108
- C:\Windows\System\xEaGQzu.exe
  C:\Windows\System\xEaGQzu.exe
  2⤵
  PID:7124
- C:\Windows\System\fvVSWYq.exe
  C:\Windows\System\fvVSWYq.exe
  2⤵
  PID:7140
- C:\Windows\System\IGPKLjd.exe
  C:\Windows\System\IGPKLjd.exe
  2⤵
  PID:7156
- C:\Windows\System\JpKPJBN.exe
  C:\Windows\System\JpKPJBN.exe
  2⤵
  PID:4220
- C:\Windows\System\HYxJNhq.exe
  C:\Windows\System\HYxJNhq.exe
  2⤵
  PID:6156
- C:\Windows\System\ZbRGhQO.exe
  C:\Windows\System\ZbRGhQO.exe
  2⤵
  PID:6220
- C:\Windows\System\fIgxJPq.exe
  C:\Windows\System\fIgxJPq.exe
  2⤵
  PID:6252
- C:\Windows\System\prUUgcw.exe
  C:\Windows\System\prUUgcw.exe
  2⤵
  PID:6320
- C:\Windows\System\cfGFhtq.exe
  C:\Windows\System\cfGFhtq.exe
  2⤵
  PID:6360
- C:\Windows\System\FmLPXlG.exe
  C:\Windows\System\FmLPXlG.exe
  2⤵
  PID:6392
- C:\Windows\System\abNCMEX.exe
  C:\Windows\System\abNCMEX.exe
  2⤵
  PID:6496
- C:\Windows\System\OJMLPJq.exe
  C:\Windows\System\OJMLPJq.exe
  2⤵
  PID:6600
- C:\Windows\System\unyJcIS.exe
  C:\Windows\System\unyJcIS.exe
  2⤵
  PID:6664
- C:\Windows\System\jqYSpBA.exe
  C:\Windows\System\jqYSpBA.exe
  2⤵
  PID:6704
- C:\Windows\System\XxKXxQi.exe
  C:\Windows\System\XxKXxQi.exe
  2⤵
  PID:6768
- C:\Windows\System\nKHfiqh.exe
  C:\Windows\System\nKHfiqh.exe
  2⤵
  PID:6168
- C:\Windows\System\vWTqRHS.exe
  C:\Windows\System\vWTqRHS.exe
  2⤵
  PID:6052
- C:\Windows\System\idhveco.exe
  C:\Windows\System\idhveco.exe
  2⤵
  PID:6304
- C:\Windows\System\FjAxBEY.exe
  C:\Windows\System\FjAxBEY.exe
  2⤵
  PID:6200
- C:\Windows\System\anWivBE.exe
  C:\Windows\System\anWivBE.exe
  2⤵
  PID:6412
- C:\Windows\System\YEDEvaH.exe
  C:\Windows\System\YEDEvaH.exe
  2⤵
  PID:6380
- C:\Windows\System\vtmxUYi.exe
  C:\Windows\System\vtmxUYi.exe
  2⤵
  PID:6448
- C:\Windows\System\FsxORRF.exe
  C:\Windows\System\FsxORRF.exe
  2⤵
  PID:6520
- C:\Windows\System\zohBeYi.exe
  C:\Windows\System\zohBeYi.exe
  2⤵
  PID:6588
- C:\Windows\System\ePMiykf.exe
  C:\Windows\System\ePMiykf.exe
  2⤵
  PID:6824
- C:\Windows\System\GxglBzF.exe
  C:\Windows\System\GxglBzF.exe
  2⤵
  PID:6688
- C:\Windows\System\BfWCPrl.exe
  C:\Windows\System\BfWCPrl.exe
  2⤵
  PID:6748
- C:\Windows\System\dKxPlHw.exe
  C:\Windows\System\dKxPlHw.exe
  2⤵
  PID:6796
- C:\Windows\System\DlfPEmF.exe
  C:\Windows\System\DlfPEmF.exe
  2⤵
  PID:6808
- C:\Windows\System\fHflqtY.exe
  C:\Windows\System\fHflqtY.exe
  2⤵
  PID:6872
- C:\Windows\System\fItWUxg.exe
  C:\Windows\System\fItWUxg.exe
  2⤵
  PID:6888
- C:\Windows\System\lTaFaUj.exe
  C:\Windows\System\lTaFaUj.exe
  2⤵
  PID:6988
- C:\Windows\System\jScpdnl.exe
  C:\Windows\System\jScpdnl.exe
  2⤵
  PID:7024
- C:\Windows\System\nWoFWnm.exe
  C:\Windows\System\nWoFWnm.exe
  2⤵
  PID:7088
- C:\Windows\System\fcxMMIt.exe
  C:\Windows\System\fcxMMIt.exe
  2⤵
  PID:7152
- C:\Windows\System\WRtyLTt.exe
  C:\Windows\System\WRtyLTt.exe
  2⤵
  PID:5820
- C:\Windows\System\nuuYmVG.exe
  C:\Windows\System\nuuYmVG.exe
  2⤵
  PID:6432
- C:\Windows\System\iSBNFLt.exe
  C:\Windows\System\iSBNFLt.exe
  2⤵
  PID:7180
- C:\Windows\System\jkJOcOa.exe
  C:\Windows\System\jkJOcOa.exe
  2⤵
  PID:7196
- C:\Windows\System\sUCsZal.exe
  C:\Windows\System\sUCsZal.exe
  2⤵
  PID:7216
- C:\Windows\System\KkrzWgx.exe
  C:\Windows\System\KkrzWgx.exe
  2⤵
  PID:7232
- C:\Windows\System\SmKlQoo.exe
  C:\Windows\System\SmKlQoo.exe
  2⤵
  PID:7252
- C:\Windows\System\xEVKHbk.exe
  C:\Windows\System\xEVKHbk.exe
  2⤵
  PID:7276
- C:\Windows\System\GITacia.exe
  C:\Windows\System\GITacia.exe
  2⤵
  PID:7292
- C:\Windows\System\BQYtmIS.exe
  C:\Windows\System\BQYtmIS.exe
  2⤵
  PID:7308
- C:\Windows\System\ZmQGvfU.exe
  C:\Windows\System\ZmQGvfU.exe
  2⤵
  PID:7324
- C:\Windows\System\cWrttUb.exe
  C:\Windows\System\cWrttUb.exe
  2⤵
  PID:7340
- C:\Windows\System\JAIFFsJ.exe
  C:\Windows\System\JAIFFsJ.exe
  2⤵
  PID:7356
- C:\Windows\System\dFZTyQT.exe
  C:\Windows\System\dFZTyQT.exe
  2⤵
  PID:7372
- C:\Windows\System\SbtlOlm.exe
  C:\Windows\System\SbtlOlm.exe
  2⤵
  PID:7400
- C:\Windows\System\OPugEqS.exe
  C:\Windows\System\OPugEqS.exe
  2⤵
  PID:7416
- C:\Windows\System\PxUnBgN.exe
  C:\Windows\System\PxUnBgN.exe
  2⤵
  PID:7436
- C:\Windows\System\ELUbYSm.exe
  C:\Windows\System\ELUbYSm.exe
  2⤵
  PID:7452
- C:\Windows\System\keTVlRy.exe
  C:\Windows\System\keTVlRy.exe
  2⤵
  PID:7472
- C:\Windows\System\yuywdyn.exe
  C:\Windows\System\yuywdyn.exe
  2⤵
  PID:7488
- C:\Windows\System\mtqpces.exe
  C:\Windows\System\mtqpces.exe
  2⤵
  PID:7504
- C:\Windows\System\jOUOjbo.exe
  C:\Windows\System\jOUOjbo.exe
  2⤵
  PID:7520
- C:\Windows\System\VSBPAvG.exe
  C:\Windows\System\VSBPAvG.exe
  2⤵
  PID:7536
- C:\Windows\System\gBgOOya.exe
  C:\Windows\System\gBgOOya.exe
  2⤵
  PID:7560
- C:\Windows\System\lFTXiUK.exe
  C:\Windows\System\lFTXiUK.exe
  2⤵
  PID:7576
- C:\Windows\System\upqlfcx.exe
  C:\Windows\System\upqlfcx.exe
  2⤵
  PID:7592
- C:\Windows\System\NDhEBGY.exe
  C:\Windows\System\NDhEBGY.exe
  2⤵
  PID:7608
- C:\Windows\System\IRJiIdr.exe
  C:\Windows\System\IRJiIdr.exe
  2⤵
  PID:7624
- C:\Windows\System\Xytcpli.exe
  C:\Windows\System\Xytcpli.exe
  2⤵
  PID:7644
- C:\Windows\System\DnoxJhq.exe
  C:\Windows\System\DnoxJhq.exe
  2⤵
  PID:7664
- C:\Windows\System\uSWCOVu.exe
  C:\Windows\System\uSWCOVu.exe
  2⤵
  PID:7680
- C:\Windows\System\GwuaEnz.exe
  C:\Windows\System\GwuaEnz.exe
  2⤵
  PID:7696
- C:\Windows\System\XmyXdlY.exe
  C:\Windows\System\XmyXdlY.exe
  2⤵
  PID:7712
- C:\Windows\System\rfajkia.exe
  C:\Windows\System\rfajkia.exe
  2⤵
  PID:7728
- C:\Windows\System\nUwklEt.exe
  C:\Windows\System\nUwklEt.exe
  2⤵
  PID:7744
- C:\Windows\System\DEOGXEC.exe
  C:\Windows\System\DEOGXEC.exe
  2⤵
  PID:7764
- C:\Windows\System\CyeBiJl.exe
  C:\Windows\System\CyeBiJl.exe
  2⤵
  PID:7868
- C:\Windows\System\DorOgNo.exe
  C:\Windows\System\DorOgNo.exe
  2⤵
  PID:7884
- C:\Windows\System\yYsYdQw.exe
  C:\Windows\System\yYsYdQw.exe
  2⤵
  PID:7900
- C:\Windows\System\DSUZFJi.exe
  C:\Windows\System\DSUZFJi.exe
  2⤵
  PID:7916
- C:\Windows\System\TwqUKjz.exe
  C:\Windows\System\TwqUKjz.exe
  2⤵
  PID:7932
- C:\Windows\System\JkCamyb.exe
  C:\Windows\System\JkCamyb.exe
  2⤵
  PID:7948
- C:\Windows\System\PRzKONC.exe
  C:\Windows\System\PRzKONC.exe
  2⤵
  PID:7964
- C:\Windows\System\sfStFyz.exe
  C:\Windows\System\sfStFyz.exe
  2⤵
  PID:7980
- C:\Windows\System\zYlIIeE.exe
  C:\Windows\System\zYlIIeE.exe
  2⤵
  PID:7996
- C:\Windows\System\VVAjiUO.exe
  C:\Windows\System\VVAjiUO.exe
  2⤵
  PID:8012
- C:\Windows\System\srlYhHi.exe
  C:\Windows\System\srlYhHi.exe
  2⤵
  PID:8028
- C:\Windows\System\lyRptvs.exe
  C:\Windows\System\lyRptvs.exe
  2⤵
  PID:8044
- C:\Windows\System\OVbBVxv.exe
  C:\Windows\System\OVbBVxv.exe
  2⤵
  PID:8060
- C:\Windows\System\mjYZItT.exe
  C:\Windows\System\mjYZItT.exe
  2⤵
  PID:8076
- C:\Windows\System\kgjrYks.exe
  C:\Windows\System\kgjrYks.exe
  2⤵
  PID:8120
- C:\Windows\System\wfdxLTw.exe
  C:\Windows\System\wfdxLTw.exe
  2⤵
  PID:8168
- C:\Windows\System\MlAqNGb.exe
  C:\Windows\System\MlAqNGb.exe
  2⤵
  PID:8184
- C:\Windows\System\iedPCgm.exe
  C:\Windows\System\iedPCgm.exe
  2⤵
  PID:6636
- C:\Windows\System\htqnRyY.exe
  C:\Windows\System\htqnRyY.exe
  2⤵
  PID:5140
- C:\Windows\System\vehTKOi.exe
  C:\Windows\System\vehTKOi.exe
  2⤵
  PID:6516
- C:\Windows\System\YkMEvSb.exe
  C:\Windows\System\YkMEvSb.exe
  2⤵
  PID:6716
- C:\Windows\System\NaoLNiV.exe
  C:\Windows\System\NaoLNiV.exe
  2⤵
  PID:6892
- C:\Windows\System\ofTZHNs.exe
  C:\Windows\System\ofTZHNs.exe
  2⤵
  PID:7264
- C:\Windows\System\JEqNdIu.exe
  C:\Windows\System\JEqNdIu.exe
  2⤵
  PID:7336
- C:\Windows\System\jOhxGmz.exe
  C:\Windows\System\jOhxGmz.exe
  2⤵
  PID:7412
- C:\Windows\System\mTenMAv.exe
  C:\Windows\System\mTenMAv.exe
  2⤵
  PID:7484
- C:\Windows\System\yiUBPti.exe
  C:\Windows\System\yiUBPti.exe
  2⤵
  PID:7548
- C:\Windows\System\sKmsJRt.exe
  C:\Windows\System\sKmsJRt.exe
  2⤵
  PID:7620
- C:\Windows\System\dCrGjlm.exe
  C:\Windows\System\dCrGjlm.exe
  2⤵
  PID:7688
- C:\Windows\System\gHBQOAO.exe
  C:\Windows\System\gHBQOAO.exe
  2⤵
  PID:7224
- C:\Windows\System\FxCZXeE.exe
  C:\Windows\System\FxCZXeE.exe
  2⤵
  PID:6652
- C:\Windows\System\LxaAnYW.exe
  C:\Windows\System\LxaAnYW.exe
  2⤵
  PID:6912
- C:\Windows\System\vyyRKgM.exe
  C:\Windows\System\vyyRKgM.exe
  2⤵
  PID:5776
- C:\Windows\System\payxCtj.exe
  C:\Windows\System\payxCtj.exe
  2⤵
  PID:7104
- C:\Windows\System\JevVxmz.exe
  C:\Windows\System\JevVxmz.exe
  2⤵
  PID:7432
- C:\Windows\System\wFYrKKn.exe
  C:\Windows\System\wFYrKKn.exe
  2⤵
  PID:7496
- C:\Windows\System\GVwmKYV.exe
  C:\Windows\System\GVwmKYV.exe
  2⤵
  PID:7568
- C:\Windows\System\HgsaUKd.exe
  C:\Windows\System\HgsaUKd.exe
  2⤵
  PID:7632
- C:\Windows\System\sZoLZkI.exe
  C:\Windows\System\sZoLZkI.exe
  2⤵
  PID:6908
- C:\Windows\System\urQujpZ.exe
  C:\Windows\System\urQujpZ.exe
  2⤵
  PID:6932
- C:\Windows\System\SAuxIaT.exe
  C:\Windows\System\SAuxIaT.exe
  2⤵
  PID:6972
- C:\Windows\System\VKOrOYh.exe
  C:\Windows\System\VKOrOYh.exe
  2⤵
  PID:7036
- C:\Windows\System\QdTvTJs.exe
  C:\Windows\System\QdTvTJs.exe
  2⤵
  PID:5784
- C:\Windows\System\FtJXoac.exe
  C:\Windows\System\FtJXoac.exe
  2⤵
  PID:7056
- C:\Windows\System\KLjbfWH.exe
  C:\Windows\System\KLjbfWH.exe
  2⤵
  PID:6840
- C:\Windows\System\mMVqagj.exe
  C:\Windows\System\mMVqagj.exe
  2⤵
  PID:6684
- C:\Windows\System\fXvdPLY.exe
  C:\Windows\System\fXvdPLY.exe
  2⤵
  PID:6444
- C:\Windows\System\NiNPAuC.exe
  C:\Windows\System\NiNPAuC.exe
  2⤵
  PID:6300
- C:\Windows\System\KCOePob.exe
  C:\Windows\System\KCOePob.exe
  2⤵
  PID:5488
- C:\Windows\System\XFvIsdq.exe
  C:\Windows\System\XFvIsdq.exe
  2⤵
  PID:6564
- C:\Windows\System\KlTsfqr.exe
  C:\Windows\System\KlTsfqr.exe
  2⤵
  PID:6288
- C:\Windows\System\HuehiHq.exe
  C:\Windows\System\HuehiHq.exe
  2⤵
  PID:7176
- C:\Windows\System\CJiQTWS.exe
  C:\Windows\System\CJiQTWS.exe
  2⤵
  PID:7240
- C:\Windows\System\DClhQBj.exe
  C:\Windows\System\DClhQBj.exe
  2⤵
  PID:7288
- C:\Windows\System\ZemMauS.exe
  C:\Windows\System\ZemMauS.exe
  2⤵
  PID:7384
- C:\Windows\System\YsrTQWC.exe
  C:\Windows\System\YsrTQWC.exe
  2⤵
  PID:7636
- C:\Windows\System\uuvyKSW.exe
  C:\Windows\System\uuvyKSW.exe
  2⤵
  PID:7708
- C:\Windows\System\EqCmzxO.exe
  C:\Windows\System\EqCmzxO.exe
  2⤵
  PID:7772
- C:\Windows\System\xShDwBZ.exe
  C:\Windows\System\xShDwBZ.exe
  2⤵
  PID:7800
- C:\Windows\System\RxhWVch.exe
  C:\Windows\System\RxhWVch.exe
  2⤵
  PID:7348
- C:\Windows\System\OrPALEc.exe
  C:\Windows\System\OrPALEc.exe
  2⤵
  PID:7908
- C:\Windows\System\NVVyaES.exe
  C:\Windows\System\NVVyaES.exe
  2⤵
  PID:7940
- C:\Windows\System\zdwLZRU.exe
  C:\Windows\System\zdwLZRU.exe
  2⤵
  PID:7972
- C:\Windows\System\ftdhLrV.exe
  C:\Windows\System\ftdhLrV.exe
  2⤵
  PID:8036
- C:\Windows\System\wjUhiHq.exe
  C:\Windows\System\wjUhiHq.exe
  2⤵
  PID:7960
- C:\Windows\System\aTsagwd.exe
  C:\Windows\System\aTsagwd.exe
  2⤵
  PID:8052
- C:\Windows\System\HnRsYmw.exe
  C:\Windows\System\HnRsYmw.exe
  2⤵
  PID:8128
- C:\Windows\System\yJVAufm.exe
  C:\Windows\System\yJVAufm.exe
  2⤵
  PID:8144
- C:\Windows\System\BMfjIIj.exe
  C:\Windows\System\BMfjIIj.exe
  2⤵
  PID:8160
- C:\Windows\System\aEUsMgV.exe
  C:\Windows\System\aEUsMgV.exe
  2⤵
  PID:6336
- C:\Windows\System\EOcTPrQ.exe
  C:\Windows\System\EOcTPrQ.exe
  2⤵
  PID:7304
- C:\Windows\System\sOrJqPj.exe
  C:\Windows\System\sOrJqPj.exe
  2⤵
  PID:6784
- C:\Windows\System\SCqiNPj.exe
  C:\Windows\System\SCqiNPj.exe
  2⤵
  PID:7228
- C:\Windows\System\GNVTgbl.exe
  C:\Windows\System\GNVTgbl.exe
  2⤵
  PID:8096
- C:\Windows\System\tuWfOkg.exe
  C:\Windows\System\tuWfOkg.exe
  2⤵
  PID:8176
- C:\Windows\System\zwxQUjh.exe
  C:\Windows\System\zwxQUjh.exe
  2⤵
  PID:6620
- C:\Windows\System\pkweQQB.exe
  C:\Windows\System\pkweQQB.exe
  2⤵
  PID:6356
- C:\Windows\System\JtbNXxh.exe
  C:\Windows\System\JtbNXxh.exe
  2⤵
  PID:7260
- C:\Windows\System\weiGYqq.exe
  C:\Windows\System\weiGYqq.exe
  2⤵
  PID:7544
- C:\Windows\System\vHiWKhp.exe
  C:\Windows\System\vHiWKhp.exe
  2⤵
  PID:7660
- C:\Windows\System\KedIyRJ.exe
  C:\Windows\System\KedIyRJ.exe
  2⤵
  PID:7652
- C:\Windows\System\qqeZUaQ.exe
  C:\Windows\System\qqeZUaQ.exe
  2⤵
  PID:7468
- C:\Windows\System\bWJYTRq.exe
  C:\Windows\System\bWJYTRq.exe
  2⤵
  PID:6928
- C:\Windows\System\IcPYQeX.exe
  C:\Windows\System\IcPYQeX.exe
  2⤵
  PID:7792
- C:\Windows\System\gGHUKjl.exe
  C:\Windows\System\gGHUKjl.exe
  2⤵
  PID:7528
- C:\Windows\System\kHQfGcA.exe
  C:\Windows\System\kHQfGcA.exe
  2⤵
  PID:6924
- C:\Windows\System\sJmErhR.exe
  C:\Windows\System\sJmErhR.exe
  2⤵
  PID:7068
- C:\Windows\System\LxpaZhv.exe
  C:\Windows\System\LxpaZhv.exe
  2⤵
  PID:6780
- C:\Windows\System\zPXhpRD.exe
  C:\Windows\System\zPXhpRD.exe
  2⤵
  PID:6584
- C:\Windows\System\VpcHGQv.exe
  C:\Windows\System\VpcHGQv.exe
  2⤵
  PID:6552
- C:\Windows\System\cjNcRvY.exe
  C:\Windows\System\cjNcRvY.exe
  2⤵
  PID:6568
- C:\Windows\System\yGSVVmx.exe
  C:\Windows\System\yGSVVmx.exe
  2⤵
  PID:7248
- C:\Windows\System\XxXNWKa.exe
  C:\Windows\System\XxXNWKa.exe
  2⤵
  PID:7212
- C:\Windows\System\WPQFGpG.exe
  C:\Windows\System\WPQFGpG.exe
  2⤵
  PID:7424
- C:\Windows\System\yvypYxw.exe
  C:\Windows\System\yvypYxw.exe
  2⤵
  PID:7320
- C:\Windows\System\WiTVYNU.exe
  C:\Windows\System\WiTVYNU.exe
  2⤵
  PID:8008
- C:\Windows\System\FzAhnCL.exe
  C:\Windows\System\FzAhnCL.exe
  2⤵
  PID:8140
- C:\Windows\System\IZCBjqX.exe
  C:\Windows\System\IZCBjqX.exe
  2⤵
  PID:7944
- C:\Windows\System\jYBgHws.exe
  C:\Windows\System\jYBgHws.exe
  2⤵
  PID:8092
- C:\Windows\System\jxcQpvr.exe
  C:\Windows\System\jxcQpvr.exe
  2⤵
  PID:7192
- C:\Windows\System\VszguoO.exe
  C:\Windows\System\VszguoO.exe
  2⤵
  PID:6804
- C:\Windows\System\vPArlll.exe
  C:\Windows\System\vPArlll.exe
  2⤵
  PID:7788
- C:\Windows\System\vqPjdKI.exe
  C:\Windows\System\vqPjdKI.exe
  2⤵
  PID:7148
- C:\Windows\System\IcpVXaO.exe
  C:\Windows\System\IcpVXaO.exe
  2⤵
  PID:8040
- C:\Windows\System\dbatnWf.exe
  C:\Windows\System\dbatnWf.exe
  2⤵
  PID:8152
- C:\Windows\System\IJYKEfR.exe
  C:\Windows\System\IJYKEfR.exe
  2⤵
  PID:7368
- C:\Windows\System\RhRMgdJ.exe
  C:\Windows\System\RhRMgdJ.exe
  2⤵
  PID:6956
- C:\Windows\System\uqGyTLH.exe
  C:\Windows\System\uqGyTLH.exe
  2⤵
  PID:7796
- C:\Windows\System\JTWuzOg.exe
  C:\Windows\System\JTWuzOg.exe
  2⤵
  PID:7428
- C:\Windows\System\inwkQKt.exe
  C:\Windows\System\inwkQKt.exe
  2⤵
  PID:7392
- C:\Windows\System\PXCxkjv.exe
  C:\Windows\System\PXCxkjv.exe
  2⤵
  PID:6844
- C:\Windows\System\bCEBIZG.exe
  C:\Windows\System\bCEBIZG.exe
  2⤵
  PID:6880
- C:\Windows\System\ImUogEH.exe
  C:\Windows\System\ImUogEH.exe
  2⤵
  PID:7912
- C:\Windows\System\PCvTSlX.exe
  C:\Windows\System\PCvTSlX.exe
  2⤵
  PID:6240
- C:\Windows\System\KxCHgES.exe
  C:\Windows\System\KxCHgES.exe
  2⤵
  PID:7464
- C:\Windows\System\pygYniX.exe
  C:\Windows\System\pygYniX.exe
  2⤵
  PID:7616
- C:\Windows\System\oOFqxbt.exe
  C:\Windows\System\oOFqxbt.exe
  2⤵
  PID:7516
- C:\Windows\System\dGaZIkN.exe
  C:\Windows\System\dGaZIkN.exe
  2⤵
  PID:8136
- C:\Windows\System\IQjfNLQ.exe
  C:\Windows\System\IQjfNLQ.exe
  2⤵
  PID:6284
- C:\Windows\System\oLiXaXZ.exe
  C:\Windows\System\oLiXaXZ.exe
  2⤵
  PID:7008
- C:\Windows\System\eBgzPIy.exe
  C:\Windows\System\eBgzPIy.exe
  2⤵
  PID:7804
- C:\Windows\System\lDRqDBU.exe
  C:\Windows\System\lDRqDBU.exe
  2⤵
  PID:7812
- C:\Windows\System\vfMvXcL.exe
  C:\Windows\System\vfMvXcL.exe
  2⤵
  PID:7928
- C:\Windows\System\uRqXNiV.exe
  C:\Windows\System\uRqXNiV.exe
  2⤵
  PID:6428
- C:\Windows\System\ECVsOSk.exe
  C:\Windows\System\ECVsOSk.exe
  2⤵
  PID:7784
- C:\Windows\System\wLixTPX.exe
  C:\Windows\System\wLixTPX.exe
  2⤵
  PID:7724
- C:\Windows\System\RsQlxbU.exe
  C:\Windows\System\RsQlxbU.exe
  2⤵
  PID:7552
- C:\Windows\System\CrUehOD.exe
  C:\Windows\System\CrUehOD.exe
  2⤵
  PID:7352
- C:\Windows\System\UMESDZc.exe
  C:\Windows\System\UMESDZc.exe
  2⤵
  PID:8020
- C:\Windows\System\xPKfyGF.exe
  C:\Windows\System\xPKfyGF.exe
  2⤵
  PID:7448
- C:\Windows\System\zHnyVfL.exe
  C:\Windows\System\zHnyVfL.exe
  2⤵
  PID:7880
- C:\Windows\System\XrtziWn.exe
  C:\Windows\System\XrtziWn.exe
  2⤵
  PID:8208
- C:\Windows\System\WhWYKkp.exe
  C:\Windows\System\WhWYKkp.exe
  2⤵
  PID:8224
- C:\Windows\System\JvspVMb.exe
  C:\Windows\System\JvspVMb.exe
  2⤵
  PID:8240
- C:\Windows\System\GbQskZT.exe
  C:\Windows\System\GbQskZT.exe
  2⤵
  PID:8256
- C:\Windows\System\sWVjQul.exe
  C:\Windows\System\sWVjQul.exe
  2⤵
  PID:8272
- C:\Windows\System\CnGsuar.exe
  C:\Windows\System\CnGsuar.exe
  2⤵
  PID:8288
- C:\Windows\System\yavRdGH.exe
  C:\Windows\System\yavRdGH.exe
  2⤵
  PID:8304
- C:\Windows\System\TTHRVpQ.exe
  C:\Windows\System\TTHRVpQ.exe
  2⤵
  PID:8320
- C:\Windows\System\edwzclC.exe
  C:\Windows\System\edwzclC.exe
  2⤵
  PID:8336
- C:\Windows\System\McixRKN.exe
  C:\Windows\System\McixRKN.exe
  2⤵
  PID:8352
- C:\Windows\System\qmKWHOn.exe
  C:\Windows\System\qmKWHOn.exe
  2⤵
  PID:8368
- C:\Windows\System\JkoInQh.exe
  C:\Windows\System\JkoInQh.exe
  2⤵
  PID:8384
- C:\Windows\System\xAsZXtF.exe
  C:\Windows\System\xAsZXtF.exe
  2⤵
  PID:8400
- C:\Windows\System\bhEKohP.exe
  C:\Windows\System\bhEKohP.exe
  2⤵
  PID:8416
- C:\Windows\System\KPVOTkk.exe
  C:\Windows\System\KPVOTkk.exe
  2⤵
  PID:8432
- C:\Windows\System\BhMWujn.exe
  C:\Windows\System\BhMWujn.exe
  2⤵
  PID:8448
- C:\Windows\System\iSopSzk.exe
  C:\Windows\System\iSopSzk.exe
  2⤵
  PID:8464
- C:\Windows\System\CKOeggN.exe
  C:\Windows\System\CKOeggN.exe
  2⤵
  PID:8480
- C:\Windows\System\miWEePt.exe
  C:\Windows\System\miWEePt.exe
  2⤵
  PID:8496
- C:\Windows\System\dTUMira.exe
  C:\Windows\System\dTUMira.exe
  2⤵
  PID:8512
- C:\Windows\System\hDbIqGv.exe
  C:\Windows\System\hDbIqGv.exe
  2⤵
  PID:8528
- C:\Windows\System\wwXdEmA.exe
  C:\Windows\System\wwXdEmA.exe
  2⤵
  PID:8544
- C:\Windows\System\QpfKQMP.exe
  C:\Windows\System\QpfKQMP.exe
  2⤵
  PID:8560
- C:\Windows\System\jYOxNfh.exe
  C:\Windows\System\jYOxNfh.exe
  2⤵
  PID:8576
- C:\Windows\System\KuYVFhf.exe
  C:\Windows\System\KuYVFhf.exe
  2⤵
  PID:8592
- C:\Windows\System\AwSmeyx.exe
  C:\Windows\System\AwSmeyx.exe
  2⤵
  PID:8608
- C:\Windows\System\GaxpxSE.exe
  C:\Windows\System\GaxpxSE.exe
  2⤵
  PID:8644
- C:\Windows\System\MhRqKmU.exe
  C:\Windows\System\MhRqKmU.exe
  2⤵
  PID:8660
- C:\Windows\System\NJkvalp.exe
  C:\Windows\System\NJkvalp.exe
  2⤵
  PID:8676
- C:\Windows\System\fnSaflQ.exe
  C:\Windows\System\fnSaflQ.exe
  2⤵
  PID:8696
- C:\Windows\System\alenWVq.exe
  C:\Windows\System\alenWVq.exe
  2⤵
  PID:8712
- C:\Windows\System\RGURrNR.exe
  C:\Windows\System\RGURrNR.exe
  2⤵
  PID:8728
- C:\Windows\System\lhsBqEs.exe
  C:\Windows\System\lhsBqEs.exe
  2⤵
  PID:8748
- C:\Windows\System\wMJQIUa.exe
  C:\Windows\System\wMJQIUa.exe
  2⤵
  PID:8764
- C:\Windows\System\NyWxqBu.exe
  C:\Windows\System\NyWxqBu.exe
  2⤵
  PID:8780
- C:\Windows\System\VisceVl.exe
  C:\Windows\System\VisceVl.exe
  2⤵
  PID:8796
- C:\Windows\System\OPrDIVm.exe
  C:\Windows\System\OPrDIVm.exe
  2⤵
  PID:8812
- C:\Windows\System\iepZpjf.exe
  C:\Windows\System\iepZpjf.exe
  2⤵
  PID:8828
- C:\Windows\System\aFybrBA.exe
  C:\Windows\System\aFybrBA.exe
  2⤵
  PID:8844
- C:\Windows\System\CKdKwfJ.exe
  C:\Windows\System\CKdKwfJ.exe
  2⤵
  PID:8860
- C:\Windows\System\orqWKla.exe
  C:\Windows\System\orqWKla.exe
  2⤵
  PID:8876
- C:\Windows\System\IESadyn.exe
  C:\Windows\System\IESadyn.exe
  2⤵
  PID:8892
- C:\Windows\System\seFXZGf.exe
  C:\Windows\System\seFXZGf.exe
  2⤵
  PID:8912
- C:\Windows\System\hSESFsK.exe
  C:\Windows\System\hSESFsK.exe
  2⤵
  PID:8928
- C:\Windows\System\BoUxCny.exe
  C:\Windows\System\BoUxCny.exe
  2⤵
  PID:8944
- C:\Windows\System\LNRGNZX.exe
  C:\Windows\System\LNRGNZX.exe
  2⤵
  PID:8960
- C:\Windows\System\qbzZScj.exe
  C:\Windows\System\qbzZScj.exe
  2⤵
  PID:8976
- C:\Windows\System\uieUqKs.exe
  C:\Windows\System\uieUqKs.exe
  2⤵
  PID:8996
- C:\Windows\System\DJUvDql.exe
  C:\Windows\System\DJUvDql.exe
  2⤵
  PID:9012
- C:\Windows\System\IBlbBrj.exe
  C:\Windows\System\IBlbBrj.exe
  2⤵
  PID:9028
- C:\Windows\System\JdVWwzc.exe
  C:\Windows\System\JdVWwzc.exe
  2⤵
  PID:9044
- C:\Windows\System\Dxyvxmw.exe
  C:\Windows\System\Dxyvxmw.exe
  2⤵
  PID:9060
- C:\Windows\System\LARRSwi.exe
  C:\Windows\System\LARRSwi.exe
  2⤵
  PID:9076
- C:\Windows\System\YAQJfDw.exe
  C:\Windows\System\YAQJfDw.exe
  2⤵
  PID:9096
- C:\Windows\System\qVMPdcE.exe
  C:\Windows\System\qVMPdcE.exe
  2⤵
  PID:9112
- C:\Windows\System\qGLVgiH.exe
  C:\Windows\System\qGLVgiH.exe
  2⤵
  PID:9132
- C:\Windows\System\hBSTJhg.exe
  C:\Windows\System\hBSTJhg.exe
  2⤵
  PID:9156
- C:\Windows\System\lyPefwS.exe
  C:\Windows\System\lyPefwS.exe
  2⤵
  PID:6340
- C:\Windows\System\lHnjYLZ.exe
  C:\Windows\System\lHnjYLZ.exe
  2⤵
  PID:8236
- C:\Windows\System\kbqLcql.exe
  C:\Windows\System\kbqLcql.exe
  2⤵
  PID:8268
- C:\Windows\System\pOsWoUv.exe
  C:\Windows\System\pOsWoUv.exe
  2⤵
  PID:8280
- C:\Windows\System\qgKvTRO.exe
  C:\Windows\System\qgKvTRO.exe
  2⤵
  PID:8360
- C:\Windows\System\HYpyqDL.exe
  C:\Windows\System\HYpyqDL.exe
  2⤵
  PID:8344
- C:\Windows\System\vYmCQgx.exe
  C:\Windows\System\vYmCQgx.exe
  2⤵
  PID:8460
- C:\Windows\System\ZYcyqag.exe
  C:\Windows\System\ZYcyqag.exe
  2⤵
  PID:8488
- C:\Windows\System\bIZbbDD.exe
  C:\Windows\System\bIZbbDD.exe
  2⤵
  PID:8440
- C:\Windows\System\ClIfShO.exe
  C:\Windows\System\ClIfShO.exe
  2⤵
  PID:8520
- C:\Windows\System\ufqEwVf.exe
  C:\Windows\System\ufqEwVf.exe
  2⤵
  PID:8552
- C:\Windows\System\PTrgMVx.exe
  C:\Windows\System\PTrgMVx.exe
  2⤵
  PID:8540
- C:\Windows\System\zfcyyRP.exe
  C:\Windows\System\zfcyyRP.exe
  2⤵
  PID:8600
- C:\Windows\System\fZuVSgX.exe
  C:\Windows\System\fZuVSgX.exe
  2⤵
  PID:8636
- C:\Windows\System\oUAUhNj.exe
  C:\Windows\System\oUAUhNj.exe
  2⤵
  PID:8788
- C:\Windows\System\AFljzbw.exe
  C:\Windows\System\AFljzbw.exe
  2⤵
  PID:9164
- C:\Windows\System\GZsnLHL.exe
  C:\Windows\System\GZsnLHL.exe
  2⤵
  PID:9092
- C:\Windows\System\QOHPORe.exe
  C:\Windows\System\QOHPORe.exe
  2⤵
  PID:9052
- C:\Windows\System\bNhqaQd.exe
  C:\Windows\System\bNhqaQd.exe
  2⤵
  PID:8984
- C:\Windows\System\CLmSits.exe
  C:\Windows\System\CLmSits.exe
  2⤵
  PID:8920
- C:\Windows\System\wIOYVul.exe
  C:\Windows\System\wIOYVul.exe
  2⤵
  PID:8856
- C:\Windows\System\daPZERr.exe
  C:\Windows\System\daPZERr.exe
  2⤵
  PID:9192
- C:\Windows\System\rAkaEEi.exe
  C:\Windows\System\rAkaEEi.exe
  2⤵
  PID:9196
- C:\Windows\System\JTkLQae.exe
  C:\Windows\System\JTkLQae.exe
  2⤵
  PID:9200
- C:\Windows\System\xfSqLgw.exe
  C:\Windows\System\xfSqLgw.exe
  2⤵
  PID:8708
- C:\Windows\System\cVLEajG.exe
  C:\Windows\System\cVLEajG.exe
  2⤵
  PID:8772
- C:\Windows\System\voUEZWr.exe
  C:\Windows\System\voUEZWr.exe
  2⤵
  PID:8836
- C:\Windows\System\ruzJMBe.exe
  C:\Windows\System\ruzJMBe.exe
  2⤵
  PID:8868
- C:\Windows\System\jwWVSji.exe
  C:\Windows\System\jwWVSji.exe
  2⤵
  PID:8940
- C:\Windows\System\KJritmB.exe
  C:\Windows\System\KJritmB.exe
  2⤵
  PID:9008
- C:\Windows\System\IvsYvXs.exe
  C:\Windows\System\IvsYvXs.exe
  2⤵
  PID:9072
- C:\Windows\System\cxtitBp.exe
  C:\Windows\System\cxtitBp.exe
  2⤵
  PID:9144
- C:\Windows\System\eRXdMJu.exe
  C:\Windows\System\eRXdMJu.exe
  2⤵
  PID:8204
- C:\Windows\System\wgQucwa.exe
  C:\Windows\System\wgQucwa.exe
  2⤵
  PID:8392
- C:\Windows\System\wBqersl.exe
  C:\Windows\System\wBqersl.exe
  2⤵
  PID:8316
- C:\Windows\System\MovbqJg.exe
  C:\Windows\System\MovbqJg.exe
  2⤵
  PID:8424
- C:\Windows\System\kHSDTiw.exe
  C:\Windows\System\kHSDTiw.exe
  2⤵
  PID:8444
- C:\Windows\System\gXnMiQL.exe
  C:\Windows\System\gXnMiQL.exe
  2⤵
  PID:8588
- C:\Windows\System\XafcoNo.exe
  C:\Windows\System\XafcoNo.exe
  2⤵
  PID:8692
- C:\Windows\System\MvmaIzx.exe
  C:\Windows\System\MvmaIzx.exe
  2⤵
  PID:8252
- C:\Windows\System\OtBuvSg.exe
  C:\Windows\System\OtBuvSg.exe
  2⤵
  PID:8584
- C:\Windows\System\QvGCzPv.exe
  C:\Windows\System\QvGCzPv.exe
  2⤵
  PID:8756
- C:\Windows\System\wuQlKJf.exe
  C:\Windows\System\wuQlKJf.exe
  2⤵
  PID:8824
- C:\Windows\System\TGmanzQ.exe
  C:\Windows\System\TGmanzQ.exe
  2⤵
  PID:9056
- C:\Windows\System\MoGtkxQ.exe
  C:\Windows\System\MoGtkxQ.exe
  2⤵
  PID:8924
- C:\Windows\System\IKROACO.exe
  C:\Windows\System\IKROACO.exe
  2⤵
  PID:8884
- C:\Windows\System\vstXFED.exe
  C:\Windows\System\vstXFED.exe
  2⤵
  PID:9180
- C:\Windows\System\ELdlBsf.exe
  C:\Windows\System\ELdlBsf.exe
  2⤵
  PID:8744
- C:\Windows\System\WOTkwJF.exe
  C:\Windows\System\WOTkwJF.exe
  2⤵
  PID:8624
- C:\Windows\System\vcyWWfO.exe
  C:\Windows\System\vcyWWfO.exe
  2⤵
  PID:9004
- C:\Windows\System\MQMiyWe.exe
  C:\Windows\System\MQMiyWe.exe
  2⤵
  PID:8216
- C:\Windows\System\qjFHJMQ.exe
  C:\Windows\System\qjFHJMQ.exe
  2⤵
  PID:8328
- C:\Windows\System\fvEbuOw.exe
  C:\Windows\System\fvEbuOw.exe
  2⤵
  PID:8568
- C:\Windows\System\RKlJsXl.exe
  C:\Windows\System\RKlJsXl.exe
  2⤵
  PID:8632
- C:\Windows\System\lMeMSSp.exe
  C:\Windows\System\lMeMSSp.exe
  2⤵
  PID:8740
- C:\Windows\System\QvfzuHI.exe
  C:\Windows\System\QvfzuHI.exe
  2⤵
  PID:9040
- C:\Windows\System\VAGKfjH.exe
  C:\Windows\System\VAGKfjH.exe
  2⤵
  PID:8380
- C:\Windows\System\fHcaccf.exe
  C:\Windows\System\fHcaccf.exe
  2⤵
  PID:9212
- C:\Windows\System\VGrfYtk.exe
  C:\Windows\System\VGrfYtk.exe
  2⤵
  PID:8972
- C:\Windows\System\bGJNsbW.exe
  C:\Windows\System\bGJNsbW.exe
  2⤵
  PID:8652
- C:\Windows\System\URSoPbq.exe
  C:\Windows\System\URSoPbq.exe
  2⤵
  PID:9124
- C:\Windows\System\mcQWYqD.exe
  C:\Windows\System\mcQWYqD.exe
  2⤵
  PID:8804
- C:\Windows\System\fJjRuTF.exe
  C:\Windows\System\fJjRuTF.exe
  2⤵
  PID:8908
- C:\Windows\System\VjAcBxp.exe
  C:\Windows\System\VjAcBxp.exe
  2⤵
  PID:8200
- C:\Windows\System\GUqKqkr.exe
  C:\Windows\System\GUqKqkr.exe
  2⤵
  PID:8108
- C:\Windows\System\cXpKRAT.exe
  C:\Windows\System\cXpKRAT.exe
  2⤵
  PID:8952
- C:\Windows\System\xtCuqvu.exe
  C:\Windows\System\xtCuqvu.exe
  2⤵
  PID:8992
- C:\Windows\System\PLhDllt.exe
  C:\Windows\System\PLhDllt.exe
  2⤵
  PID:7284
- C:\Windows\System\tnIvPGW.exe
  C:\Windows\System\tnIvPGW.exe
  2⤵
  PID:9232
- C:\Windows\System\JWQMPfk.exe
  C:\Windows\System\JWQMPfk.exe
  2⤵
  PID:9248
- C:\Windows\System\GDSUozB.exe
  C:\Windows\System\GDSUozB.exe
  2⤵
  PID:9264
- C:\Windows\System\dYmZBXt.exe
  C:\Windows\System\dYmZBXt.exe
  2⤵
  PID:9280
- C:\Windows\System\XrJFNBO.exe
  C:\Windows\System\XrJFNBO.exe
  2⤵
  PID:9300
- C:\Windows\System\MWigGbJ.exe
  C:\Windows\System\MWigGbJ.exe
  2⤵
  PID:9316
- C:\Windows\System\QGEBcOT.exe
  C:\Windows\System\QGEBcOT.exe
  2⤵
  PID:9332
- C:\Windows\System\KNayyXJ.exe
  C:\Windows\System\KNayyXJ.exe
  2⤵
  PID:9352
- C:\Windows\System\urUgSaM.exe
  C:\Windows\System\urUgSaM.exe
  2⤵
  PID:9368
- C:\Windows\System\PohjShq.exe
  C:\Windows\System\PohjShq.exe
  2⤵
  PID:9388
- C:\Windows\System\ULfWvwU.exe
  C:\Windows\System\ULfWvwU.exe
  2⤵
  PID:9404
- C:\Windows\System\ichidzy.exe
  C:\Windows\System\ichidzy.exe
  2⤵
  PID:9420
- C:\Windows\System\cQfyfEl.exe
  C:\Windows\System\cQfyfEl.exe
  2⤵
  PID:9436
- C:\Windows\System\kSyYtUx.exe
  C:\Windows\System\kSyYtUx.exe
  2⤵
  PID:9452
- C:\Windows\System\AMsVNEa.exe
  C:\Windows\System\AMsVNEa.exe
  2⤵
  PID:9468
- C:\Windows\System\oOlZCDu.exe
  C:\Windows\System\oOlZCDu.exe
  2⤵
  PID:9484
- C:\Windows\System\sezpqRN.exe
  C:\Windows\System\sezpqRN.exe
  2⤵
  PID:9500
- C:\Windows\System\LhTCeZw.exe
  C:\Windows\System\LhTCeZw.exe
  2⤵
  PID:9516
- C:\Windows\System\sRhpKgc.exe
  C:\Windows\System\sRhpKgc.exe
  2⤵
  PID:9532
- C:\Windows\System\zeCcZBJ.exe
  C:\Windows\System\zeCcZBJ.exe
  2⤵
  PID:9548
- C:\Windows\System\bUfIfjl.exe
  C:\Windows\System\bUfIfjl.exe
  2⤵
  PID:9564
- C:\Windows\System\RvflhVE.exe
  C:\Windows\System\RvflhVE.exe
  2⤵
  PID:9580
- C:\Windows\System\knHwEeh.exe
  C:\Windows\System\knHwEeh.exe
  2⤵
  PID:9596
- C:\Windows\System\YfjVMMv.exe
  C:\Windows\System\YfjVMMv.exe
  2⤵
  PID:9612
- C:\Windows\System\rXbNMmU.exe
  C:\Windows\System\rXbNMmU.exe
  2⤵
  PID:9628
- C:\Windows\System\MDbcfAh.exe
  C:\Windows\System\MDbcfAh.exe
  2⤵
  PID:9644
- C:\Windows\System\uvOtqye.exe
  C:\Windows\System\uvOtqye.exe
  2⤵
  PID:9664
- C:\Windows\System\XbBSxiv.exe
  C:\Windows\System\XbBSxiv.exe
  2⤵
  PID:9680
- C:\Windows\System\PDsGPzK.exe
  C:\Windows\System\PDsGPzK.exe
  2⤵
  PID:9696
- C:\Windows\System\QVSPnYg.exe
  C:\Windows\System\QVSPnYg.exe
  2⤵
  PID:9712
- C:\Windows\System\eEGbLPf.exe
  C:\Windows\System\eEGbLPf.exe
  2⤵
  PID:9728
- C:\Windows\System\uZGWIbu.exe
  C:\Windows\System\uZGWIbu.exe
  2⤵
  PID:9744
- C:\Windows\System\RWwcHPq.exe
  C:\Windows\System\RWwcHPq.exe
  2⤵
  PID:9760
- C:\Windows\System\WJFeIeg.exe
  C:\Windows\System\WJFeIeg.exe
  2⤵
  PID:9776
- C:\Windows\System\QHTJowh.exe
  C:\Windows\System\QHTJowh.exe
  2⤵
  PID:9792
- C:\Windows\System\gRPIhfH.exe
  C:\Windows\System\gRPIhfH.exe
  2⤵
  PID:9808
- C:\Windows\System\QLNvoQp.exe
  C:\Windows\System\QLNvoQp.exe
  2⤵
  PID:9824
- C:\Windows\System\tcKkrVd.exe
  C:\Windows\System\tcKkrVd.exe
  2⤵
  PID:9840
- C:\Windows\System\AACyiuy.exe
  C:\Windows\System\AACyiuy.exe
  2⤵
  PID:9856
- C:\Windows\System\IXxUslZ.exe
  C:\Windows\System\IXxUslZ.exe
  2⤵
  PID:9872
- C:\Windows\System\wpupNAF.exe
  C:\Windows\System\wpupNAF.exe
  2⤵
  PID:9888
- C:\Windows\System\KQhXCfa.exe
  C:\Windows\System\KQhXCfa.exe
  2⤵
  PID:9904
- C:\Windows\System\MslFjVH.exe
  C:\Windows\System\MslFjVH.exe
  2⤵
  PID:9920
- C:\Windows\System\mhCFvMj.exe
  C:\Windows\System\mhCFvMj.exe
  2⤵
  PID:9936
- C:\Windows\System\ktEBpLi.exe
  C:\Windows\System\ktEBpLi.exe
  2⤵
  PID:9952
- C:\Windows\System\UAwZelu.exe
  C:\Windows\System\UAwZelu.exe
  2⤵
  PID:9968
- C:\Windows\System\htKXGSz.exe
  C:\Windows\System\htKXGSz.exe
  2⤵
  PID:9984
- C:\Windows\System\vzeHSgV.exe
  C:\Windows\System\vzeHSgV.exe
  2⤵
  PID:10000
- C:\Windows\System\mdfZjBy.exe
  C:\Windows\System\mdfZjBy.exe
  2⤵
  PID:10016
- C:\Windows\System\IOivrkW.exe
  C:\Windows\System\IOivrkW.exe
  2⤵
  PID:10032
- C:\Windows\System\cLPaUyI.exe
  C:\Windows\System\cLPaUyI.exe
  2⤵
  PID:10048
- C:\Windows\System\GYkKtxr.exe
  C:\Windows\System\GYkKtxr.exe
  2⤵
  PID:10064
- C:\Windows\System\dUDbeBq.exe
  C:\Windows\System\dUDbeBq.exe
  2⤵
  PID:10080
- C:\Windows\System\GhhzPer.exe
  C:\Windows\System\GhhzPer.exe
  2⤵
  PID:10096
- C:\Windows\System\cVbzGus.exe
  C:\Windows\System\cVbzGus.exe
  2⤵
  PID:10112
- C:\Windows\System\VFxbLVM.exe
  C:\Windows\System\VFxbLVM.exe
  2⤵
  PID:10128
- C:\Windows\System\tSyyjRA.exe
  C:\Windows\System\tSyyjRA.exe
  2⤵
  PID:10144
- C:\Windows\System\uJtAZzx.exe
  C:\Windows\System\uJtAZzx.exe
  2⤵
  PID:10160
- C:\Windows\System\tWYfCHD.exe
  C:\Windows\System\tWYfCHD.exe
  2⤵
  PID:10176
- C:\Windows\System\zxxhxrS.exe
  C:\Windows\System\zxxhxrS.exe
  2⤵
  PID:10196
- C:\Windows\System\vmdASoa.exe
  C:\Windows\System\vmdASoa.exe
  2⤵
  PID:9272
- C:\Windows\System\EdrBqSa.exe
  C:\Windows\System\EdrBqSa.exe
  2⤵
  PID:9340
- C:\Windows\System\smSRNcI.exe
  C:\Windows\System\smSRNcI.exe
  2⤵
  PID:9384
- C:\Windows\System\doubfxb.exe
  C:\Windows\System\doubfxb.exe
  2⤵
  PID:9172
- C:\Windows\System\eiDIGxV.exe
  C:\Windows\System\eiDIGxV.exe
  2⤵
  PID:9256
- C:\Windows\System\ilcTNfL.exe
  C:\Windows\System\ilcTNfL.exe
  2⤵
  PID:9296
- C:\Windows\System\tamkeCQ.exe
  C:\Windows\System\tamkeCQ.exe
  2⤵
  PID:9412
- C:\Windows\System\yryxgqT.exe
  C:\Windows\System\yryxgqT.exe
  2⤵
  PID:9400
- C:\Windows\System\fMZhBLp.exe
  C:\Windows\System\fMZhBLp.exe
  2⤵
  PID:9480
- C:\Windows\System\ICumKyJ.exe
  C:\Windows\System\ICumKyJ.exe
  2⤵
  PID:9512
- C:\Windows\System\cMfuzkD.exe
  C:\Windows\System\cMfuzkD.exe
  2⤵
  PID:9492
- C:\Windows\System\pMGrCQz.exe
  C:\Windows\System\pMGrCQz.exe
  2⤵
  PID:9528
- C:\Windows\System\vlkfurC.exe
  C:\Windows\System\vlkfurC.exe
  2⤵
  PID:9604
- C:\Windows\System\TZcvrVz.exe
  C:\Windows\System\TZcvrVz.exe
  2⤵
  PID:9620
- C:\Windows\System\dveVSeM.exe
  C:\Windows\System\dveVSeM.exe
  2⤵
  PID:9652
- C:\Windows\System\zqoqoQF.exe
  C:\Windows\System\zqoqoQF.exe
  2⤵
  PID:9708
- C:\Windows\System\iUbctvp.exe
  C:\Windows\System\iUbctvp.exe
  2⤵
  PID:9772
- C:\Windows\System\mkEJrsN.exe
  C:\Windows\System\mkEJrsN.exe
  2⤵
  PID:9864
- C:\Windows\System\inmcrKL.exe
  C:\Windows\System\inmcrKL.exe
  2⤵
  PID:9348
- C:\Windows\System\lfYyMNq.exe
  C:\Windows\System\lfYyMNq.exe
  2⤵
  PID:9964
- C:\Windows\System\prrfSoR.exe
  C:\Windows\System\prrfSoR.exe
  2⤵
  PID:9996
- C:\Windows\System\KxHFqMg.exe
  C:\Windows\System\KxHFqMg.exe
  2⤵
  PID:10028
- C:\Windows\System\RKuCXAh.exe
  C:\Windows\System\RKuCXAh.exe
  2⤵
  PID:10120
- C:\Windows\System\BpKZiON.exe
  C:\Windows\System\BpKZiON.exe
  2⤵
  PID:10156
- C:\Windows\System\BPJwppB.exe
  C:\Windows\System\BPJwppB.exe
  2⤵
  PID:10044
- C:\Windows\System\zURicrC.exe
  C:\Windows\System\zURicrC.exe
  2⤵
  PID:10076
- C:\Windows\System\tOkcyDE.exe
  C:\Windows\System\tOkcyDE.exe
  2⤵
  PID:10140
- C:\Windows\System\AIYOyea.exe
  C:\Windows\System\AIYOyea.exe
  2⤵
  PID:10184
- C:\Windows\System\ZxnZBCO.exe
  C:\Windows\System\ZxnZBCO.exe
  2⤵
  PID:9752
- C:\Windows\System\CSIFahA.exe
  C:\Windows\System\CSIFahA.exe
  2⤵
  PID:10012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AMnikxA.exe

Path C:\Windows\system\AMnikxA.exe
Size 2.0MB
SHA256 1f67ac87020a23297a688e81f9a4df867c132f3e0adb7285c55092fb0fba0f8a
MD5 1c266ae7254a6c27ab77920f1650db3d
SHA1 b6f57f66c28ff6ed331c285d9a095dd77e0934d5
SHA512 fd642ce78cc70939a69581e6e4046083cfa36448f277bb795e8a616245f2bd518dd514b4d0dc3995002df279001b3b598c0d52e28833dbd704aefc42d5129cc7
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AWQucSh.exe

Path C:\Windows\system\AWQucSh.exe
Size 2.0MB
SHA256 68abb563c367afcd4a7e19f67b44b7b3abd06eb7611a2df3d6ca27dbd7dd7ec6
MD5 c1d1f7270bc8ab5967b76fc820b1f07f
SHA1 af60039b133607da918b7e94791d80acc671afb7
SHA512 ed2ef7e7be1472422f0f3035f8fe93f54812b1ff5533a23522e9e09a60bd89dbbb3e1e079ea3f66f2d6f41c03125b6b11bfd2bc2795f88c9b65247edb9157e5f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMr:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DcuyZwn.exe

Path C:\Windows\system\DcuyZwn.exe
Size 2.0MB
SHA256 d09f6775436a5cbf274ff3ba2da1e7852907aeaaa5b0e726119b9bc23abdd4fd
MD5 b91f8d800d721cd97aff4818c2d9dd11
SHA1 7864fcb73d10319e1955dffcd16705fa7c4bb273
SHA512 acff92e710e4e7b62207d86aef3995793d7284fd3451faea5d3a7205c29536d0c9cf0ebc40916a6ff402bab979ab64aacd53786f941286c850cb38b6da12b9f8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMh:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

KAuNvQR.exe

Path C:\Windows\system\KAuNvQR.exe
Size 2.0MB
SHA256 e45b1bd1cea9d2122e948fa442de55a1fbe5ab4d6d0811724884a9ff89fa7df0
MD5 c1c351f8e733409fc0aa1822f17eb21a
SHA1 0e2eecc3d6fae26fb5e934b0642f036513c80b09
SHA512 0e25ebdc3917f473b605088151444ae0d94baf6b1bb93a4e2ee3d7ad3c08dd8e1db6fcaa4f33706ced2762198db98c0de998dbe175e33a9f5912b5127521992e
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMF:NABN
MD5 SHA1 SHA512 SSDEEP

Submit Download

NQjTQrh.exe

Path C:\Windows\system\NQjTQrh.exe
Size 2.0MB
SHA256 37ee9783b65948fc3b8e1d5875eab3b8ddb98dca30a3c1de696ea7dd8564e719
MD5 29c5ef5c93d6baf3c8e6cd2de38e42d8
SHA1 1793b27e778ba107f1559efdf45be538200a5a7e
SHA512 d1d75c5ef668026e0d0aa66622cd31e74863c8c0d9ef708e196f3e227831d57686a82916cd93b517960319abfd579910479131d1c9f7899fa3b3ef48829b0202
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMs:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

NpbbUzg.exe

Path C:\Windows\system\NpbbUzg.exe
Size 8B
SHA256 fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01
MD5 3f9cfe8a165fbe5ed357bf4fb6550d1a
SHA1 d1f76cef8b11f404ce3021901f1968e523167625
SHA512 7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce
MD5 SHA1 SHA512

Submit Download

NyUkQiF.exe

Path C:\Windows\system\NyUkQiF.exe
Size 2.0MB
SHA256 14176407674c14ee6a33e4ea712e51861ba51390d2813b4dd9f90b113197a198
MD5 3629bdf7c363d41a3528c473470ea714
SHA1 44a362d9c4238c3653d6060b33ef20275f77c92e
SHA512 89b4913cc24bebe8f4bf30653e34661a467beba5dc74f233a302689e13e547cdbe108b558725082dbbd62663d1cfe4ff1fe243a67494f0f17bf9e5f718948f16
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMs:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OhvQrSL.exe

Path C:\Windows\system\OhvQrSL.exe
Size 2.0MB
SHA256 d1cb41a4593f90c3a2421312f164e4fd02ff4df7df2adc3ef90321938091f41a
MD5 3e0b691ff2940617a36a193702ea792f
SHA1 28237f7b349fd09c531a9a3616d5802ef6ac694a
SHA512 f233af8427dbca1e4e24dc87eaf0b6b7d47ae7d4aaa5c44260260a6bf25e98cd9045aabbbe503e1c40526d523667029156cd5e85c9935a6b143b004655efe8ae
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sitjwla.exe

Path C:\Windows\system\Sitjwla.exe
Size 2.0MB
SHA256 009115f40e0d5424e2f8437da97baa894e46dff935e110b27a2ffd37f92a82bb
MD5 013f20a3076a362a1c73eb34682e9de9
SHA1 5cf342d635a5f1390ac9d7afe3882cf455cdc447
SHA512 4d1b23b745f27673ac8a822355706c89414d86bcb141a6ebbf8087de8e4ed34335f3d63385f053c300c6539228d208b773482cfae90766c38a6611ef07e2c794
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMo:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpQVfYH.exe

Path C:\Windows\system\SpQVfYH.exe
Size 2.0MB
SHA256 e39484816ca34029ab7c4311a16d81a54e13d9babcf9b4e51649f9b30a28f3cc
MD5 4f6cde5b5159dfd2157766127c794084
SHA1 cefe6518ae48be95109ac0ea5cbf40a67bca0847
SHA512 70a19768f42e6811fd971274725ed0b3d2a4ccbfc16ace7017095ba9f2677ff324b5fa5f29996bcd0a788c454e96f624858988e76826ebd4e94896941033b601
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMN:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

USbaVXl.exe

Path C:\Windows\system\USbaVXl.exe
Size 2.0MB
SHA256 faa408d8e065041c560f93b91db5c41e90df0e265124076af9f7f87539b5a137
MD5 fd511000a1dd3f55fa7e8f6e6a14129d
SHA1 70ca33d9d7820c4d7465c6805a60bc5c1cd8851a
SHA512 90058d07b484bcc58cb06ba1c343676c0de0a80c2cbc77785e7136854999f0498c9afce7927ed0daeaa5464ee6eaddfc4e35777bd86cad3b436614f9a77a9425
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMa:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

VAXGrfI.exe

Path C:\Windows\system\VAXGrfI.exe
Size 2.0MB
SHA256 1fe14db07a04a1a83f06920025c7c5257a398c960233f3e44756ac74a43d5b3b
MD5 47199866e959257ed56164f05270cd39
SHA1 81bf31465a68dfd84168ef38f952c96bb6dcd240
SHA512 365d8070db4b5610ef4afb3fec8be90105bb22c5bd78721e14814db6ba53370cb0b832e83905cfab1f72466908894d29b9bcd888dbd3941a998907a031819189
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMx:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XWWfxFp.exe

Path C:\Windows\system\XWWfxFp.exe
Size 2.0MB
SHA256 1c4c9499d10163fbfefa8d1d0e92332e9f54164fcc8be0bf34dbbe15b33d63d1
MD5 925c0af62eaaf65e00d6dbc414816d57
SHA1 cac2927f3d1f47e06a26cb0109d9298899e49075
SHA512 6ac30c93dd3058d5f632d62a940cdba087963d0ea77276a358196e8f3f3a7c3a99d2865023ed681fec9c8b51927ed98a81130f68d0fe68efc29e9df332f35c11
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM3:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

YyLHryZ.exe

Path C:\Windows\system\YyLHryZ.exe
Size 2.0MB
SHA256 e36508fd24c5fe9c6957e59017f42154e61bbec11de5a845c9d406dc413c6890
MD5 f93becd0d7dd724c38361b18097686d7
SHA1 e6376a71fc4230e6d96191a2da790225e927a3fd
SHA512 52fc91277feecb048abd2d072ba7649e8c14c804f5e55322dbe1a97330a8a8a8b8791e6f2b9f3d199748d25c95e970bc306c817e77c35ad5c56569797107c9e8
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMv8:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZLWxMvX.exe

Path C:\Windows\system\ZLWxMvX.exe
Size 2.0MB
SHA256 8fb9dfbfde5c56568e723240e83e0f961f9536692daf938274b5f228c01cf224
MD5 eb770011a85fe9f0a16bb5f847d80762
SHA1 4be0c9598d4b38d3114953c8e58a4de47210cac1
SHA512 c87b5bd16c419085a97f90a9034241c524fb604d2c2d33a6036b308d02ca707ef391eb9e5aabf87407582051d07e14ecd5414c71ee24accd7a846b8af0e14a69
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMgs:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

aDpXoRl.exe

Path C:\Windows\system\aDpXoRl.exe
Size 2.0MB
SHA256 1800e99f681a8ace839db594fe7d400c830eed424be28ddeb5f642dd9095a6b5
MD5 751f2a971d1de94cfcc5f1c8ca3a52a8
SHA1 d3eb35e6dce3a52f316e4ccc1ac712d0b6096de8
SHA512 f53fe8a5fe97e41292f9b676702eea1494923814e7aa17b31f767978ba59e8745b2229269d1c6ef4abe405e0e3d935ff02d848f75617e3e16638e4afd73b41f5
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMy:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLaewar.exe

Path C:\Windows\system\aLaewar.exe
Size 2.0MB
SHA256 b3c5c181ae80118954fdff9e14335415badcb5ccc8e6966275b0036f9f0d7fbc
MD5 f7fd319f1a894b0ec4a3ea9ef73e803a
SHA1 7761780d993e23ac10dcf652de15d0be6fbe3829
SHA512 cab61333e280448c9f8b1d113bd19c21309982d9360dbdb57bfb287d786f473a5dfb5dde719bba6c400eb6353e2d2b6f20f95de6247027c00bafaffa9e613354
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

acxakzg.exe

Path C:\Windows\system\acxakzg.exe
Size 2.0MB
SHA256 2a729d02311633aff1aa2232478aea20105fb9f42af49fd688f9e2697a448e35
MD5 9bbb964faeb1b59eeac0d482617b5bcb
SHA1 4d8e7dc313a3c6c3bb6f12edb5f350b657ec5ee2
SHA512 1da214eda02513c7f9d4b84165a07cda976221618a58d7a50c4ad7386d2b2d921e00687f78bbb65a06be4cc3718c0d76839c27f65f2102524da3d7f3ff76c184
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cxfpozJ.exe

Path C:\Windows\system\cxfpozJ.exe
Size 2.0MB
SHA256 ead36aba69974fd5080835854d3d5e8b540946950cb21f16d7669afba1d7c4eb
MD5 a761ebc3d740f49766ae0359e59a7b05
SHA1 dd04985af730d51b640060a479e2c118c5fe7a0f
SHA512 6c4e3c723b553b4522ea5afe2f9da670343e78437a690b8136df46feb48419e4f56725b6f52c2d568981cef81ff5955a41827941883c479b40d7b44ae2a33ae9
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMn:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

eUWPOzx.exe

Path C:\Windows\system\eUWPOzx.exe
Size 2.0MB
SHA256 0a5b55df7f0ffa81f92fbe03114c35e7c961580daf54d40a6a9c09b5dfe8de27
MD5 1a01e6218b302429ec46beaafeb3c83c
SHA1 da8916f1388c60572bc4ff49c70e56ab0de577d3
SHA512 62beb2a29c4e6509ecaefcd2e5b93cbd958e1e5af8c3dd9c61f55b0189728a61c51bef8d26ce3b6c328a450b0da5865a54467aec30d06d3ca8d5d2ce34333642
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

foDoYkR.exe

Path C:\Windows\system\foDoYkR.exe
Size 2.0MB
SHA256 ada21173b5862a32a3acc7431273424f86b6783ec7040e415148d6f04825f7e6
MD5 a10dd8588d8a390f1dbaf48d1724793e
SHA1 9c8a1cb091bbff4412cae833b954bf9e5f33ee2a
SHA512 6d10ac9f0f5f962bbff7bff4e94eb9d92966b9870ef947555e16f9309ad08f82f24ef313f848ac88cb5faeba951972fef74199cd6880eca552a7f413e0b04169
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMe:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

hZGQPGI.exe

Path C:\Windows\system\hZGQPGI.exe
Size 2.0MB
SHA256 d59230e0a9442c66b540e96406c952d4ce20db680f6e57b39de715760f1db300
MD5 57e33cb33f510d6b61c2396a86e6c4e3
SHA1 ae60296f0a6f94f5468f8eb78c1a2fcdf3074b17
SHA512 3092cd22a058f67ab3d3627da910a7751eae792406d37566df37dbb94f45b58a43e7738153ab4abc371711b9eb5f41499e4d235cf9d9cf2ba2a66b564249951f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMh:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

opBLzAT.exe

Path C:\Windows\system\opBLzAT.exe
Size 2.0MB
SHA256 9cea6c54f2f679d787dd87954bee980a085eb4a79ef373f9a44bc0928eeebad1
MD5 e7ed0c07e9b39977d11a868651a7ca1a
SHA1 1e939e387ed6be26748641ba7006ac23ed420d0d
SHA512 11a76da41f70509b6f374f4827b4ddab263b25647194b2c8ea01555eb15191511a94731becb947e39ef8273692180e48adfc0d12851aed6c0df8641c093a0df3
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMW:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pJSuRtd.exe

Path C:\Windows\system\pJSuRtd.exe
Size 2.0MB
SHA256 f1e2a1c2063b28346d37d009abea70783340fab222c0756c1565abacf106f26b
MD5 21dc9451a6634799524b764e63d9bd54
SHA1 b2f059303eb95f1cb4e9b0091e30f51470dbef0e
SHA512 cdda1dea314cbbe4f87ae768c34959c74db0f71ef8cdff792924cdc0bbaec7104a7ba772194d9f718bb4876d613bcc23a9dc1f20b2bcfc95ae073ab16970621c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMQ:NABY
MD5 SHA1 SHA512 SSDEEP

Submit Download

pXzSReG.exe

Path C:\Windows\system\pXzSReG.exe
Size 2.0MB
SHA256 0f18198a25f089e0bc69fbb12ca4390ef8bd15cc909a48d5e14b307e3e476f42
MD5 2963b09faba6a72f2a2a170a872cd9e6
SHA1 3f1c2f74a1d7d3824e14d8b035e6dc4c4426a7a9
SHA512 b83031e0f702c06c1be94a8f8dd68e43cb33110f1837be412d1c6e84ea0d4fe719d856729c7d1a97c46cdbe5a10bb8e826e5ec4fff13a4b335b81f6a76de07eb
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMF:NABN
MD5 SHA1 SHA512 SSDEEP

Submit Download

uTpVneB.exe

Path C:\Windows\system\uTpVneB.exe
Size 2.0MB
SHA256 b38fdc5a8af67b9ac070a92a5c0f2bea8a642d273a1d366b8f3ad1f84772b401
MD5 2a8affdea7515c65e049b809159ecf79
SHA1 06e838cdc0c177fe5366d4bd47d79ae11630d7c5
SHA512 359aace7faf9f5be913bb10f02c3fed88892fb6d8def5880a4284a0af288c579ea9a8d7ccfef358da5b9f04c92c20c866a2ac16a7a3c32f3570d1891df828168
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMt:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

usMjTnG.exe

Path C:\Windows\system\usMjTnG.exe
Size 2.0MB
SHA256 c20efcb0dd23be87c9f59654a5a96385c6fc41a6dc23a6b3ba7778da690b0c4c
MD5 5cc55e5b50f1384e546e2633771f6942
SHA1 d214d4f7438298d52469a3f5d20535ca44b54ada
SHA512 f23228b3d8b71f8013bf0255278773d4dda3b99fa724cfd6251ff089e050a1997d99cc13949df38b66698aa973e481255de2ae116c0b621ab8eecf8e1dcffa64
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMx:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmzhbMd.exe

Path C:\Windows\system\zmzhbMd.exe
Size 2.0MB
SHA256 09df6ffc5eaa487e2428f964e9510785a77eeab13da75001c9ea8345e6a9fa76
MD5 bb3875ebee9b11ded21926d8e9d38ede
SHA1 462f9274a9629233145ad8954245252ee4180a60
SHA512 abab3d03b68e80ca2c0cc3d99ef2da9ffccd4974e646bcc74717394b10678229c0890df006ca88ae239afd761919a2b1d96f469314a67528228d8a50c8cf686b
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMA:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

KNIfQfP.exe

Path \Windows\system\KNIfQfP.exe
Size 2.0MB
SHA256 450d47658c897097f2d3adedd8e686f761bd781a2b3eeafd089c1654056ac592
MD5 78ca6940d2e6655f1bd2de9579ef8cdd
SHA1 4eeab3f99283c31fc3355833e69d89f4f99627b3
SHA512 e7a239567665585fd39d94d40ff46d27e7076501be6644a48ab5675fcbe8220072dae5d2931285b28c0b4fe9960f62a5de9b6e1358b749f05fb0401e40e67d01
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMm:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SOoGCrK.exe

Path \Windows\system\SOoGCrK.exe
Size 2.0MB
SHA256 993fb387efcd8b9ca0ffe25b201b0111962a0cd273be119800c8bc28d39480a1
MD5 5b17f8fcce8bccedda7df3539b93f27b
SHA1 ac1a1412fcfb257869934d13c676b7801b2f3bee
SHA512 555e036d9241d714be4c7e14765c17cb9c72307ae5a41982bfb7a7a3395b504767a61d22c712d659fe3a6af6f7761c22fdf06436f84023a2a8f16812e2bd3c6a
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM6:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WBwDDtH.exe

Path \Windows\system\WBwDDtH.exe
Size 2.0MB
SHA256 3bb34ef2ca3aa2aa0a92a31bb26a904461a321633a36d395b0205c92ef5636bb
MD5 ca4fb7440e6044919c420bcde2419475
SHA1 d182b60dc2b10faf4f715bf12f4c94ded69f4c72
SHA512 9f1b38c07614f5788d57bce2800d09fa2498bfa78ffc0c45b5a069322d78ae1e0266a1955f0cbb191eed33d0538f86a177c8e2fd3a47ab601d7966d0a559787c
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMk:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bfrQjnx.exe

Path \Windows\system\bfrQjnx.exe
Size 2.0MB
SHA256 d77a3d4681685defe1b8464b0d12990b5ab4fbe9ae8d34cffe4bd0004d30d701
MD5 c2f4da9d1ef5ad2b727bb9619ebfe7d3
SHA1 8bed4cf6e2475d8f1e1d070abd0bfbd9cad7454a
SHA512 9d5cdbc4a549a05ebfe74bb29483b8a9e1d88db03531c55efb3db8ee06fc8537536eddc972239fd0b88f7d38bb82f07ad2a8e39080d7cf06607f17ea49baea5f
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM1:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bqBflpu.exe

Path \Windows\system\bqBflpu.exe
Size 2.0MB
SHA256 da58166103daf0e34b55115887b564f7e948aa30db14edc80c8685694a6fdec4
MD5 b90243f05d2963e90c563761f607f468
SHA1 588740a26f40bfc97169506d4e20615bd0ef638d
SHA512 5b46689e6d3c796c0040a0df8eefcf99636ee4c48d249254a88d4f2e555c5c88986e576f67996a6ab8b0347a1b2fb25a722729520f3dba9efc1d4128eecc5416
SSDEEP 49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM/:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1728-168-0x000000013F950000-0x000000013FD42000-memory.dmp

Download

memory/1728-3883-0x000000013F950000-0x000000013FD42000-memory.dmp

Download

memory/1952-23-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Download

memory/1952-152-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Download

memory/1952-4272-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Download

memory/1952-150-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Download

memory/1952-4275-0x0000000003470000-0x0000000003862000-memory.dmp

Download

memory/1952-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

memory/1952-158-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Download

memory/1952-25-0x0000000003250000-0x0000000003642000-memory.dmp

Download

memory/1952-160-0x0000000003470000-0x0000000003862000-memory.dmp

Download

memory/1952-154-0x0000000003470000-0x0000000003862000-memory.dmp

Download

memory/1952-156-0x0000000003470000-0x0000000003862000-memory.dmp

Download

memory/1952-163-0x000000013F0A0000-0x000000013F492000-memory.dmp

Download

memory/1952-161-0x000000013F060000-0x000000013F452000-memory.dmp

Download

memory/1952-165-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Download

memory/1952-1-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Download

memory/2192-162-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Download

memory/2192-127-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Download

memory/2192-702-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Download

memory/2192-129-0x0000000001F70000-0x0000000001F78000-memory.dmp

Download

memory/2192-26-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmp

Download

memory/2192-60-0x000000001B5A0000-0x000000001B882000-memory.dmp

Download

memory/2472-4963-0x000000013FA70000-0x000000013FE62000-memory.dmp

Download

memory/2472-157-0x000000013FA70000-0x000000013FE62000-memory.dmp

Download

memory/2488-153-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Download

memory/2488-4022-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Download

memory/2508-3880-0x000000013F510000-0x000000013F902000-memory.dmp

Download

memory/2508-155-0x000000013F510000-0x000000013F902000-memory.dmp

Download

memory/2532-159-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Download

memory/2532-4050-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Download

memory/2604-24-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Download

memory/2604-3799-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Download

memory/2692-4320-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Download

memory/2692-166-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Download

memory/2752-140-0x000000013F710000-0x000000013FB02000-memory.dmp

Download

memory/2776-151-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Download

memory/2960-164-0x000000013F060000-0x000000013F452000-memory.dmp

Download

memory/2960-4294-0x000000013F060000-0x000000013F452000-memory.dmp

Download

memory/3052-167-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Download