xmrig | 1ff712cf14f1145847736c0f85477694dac016e92dc00c468b18fff3158ecd5d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
Size

1.8MB
MD5

025e72eb305ffe02d5ccd17bdadbdc7b
SHA1

fe71673126435d851ab48be8b151567f5cf6d6d4
SHA256

1ff712cf14f1145847736c0f85477694dac016e92dc00c468b18fff3158ecd5d
SHA512

c16eae621237a7558b7d2376bb0815581327caed255372fd4d0df34c4bac7ab252eb75cc96cb3a63a6832f487fde0725a0bd7ebeb9849aafbf63d23aaf5e9006
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zX:Lz071uv4BPMkibTIA5lCx7kvRWa4puBT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4080-262-0x00007FF753A70000-0x00007FF753E62000-memory.dmp	xmrig
behavioral2/memory/2828-255-0x00007FF654760000-0x00007FF654B52000-memory.dmp	xmrig
behavioral2/memory/1628-328-0x00007FF6C9260000-0x00007FF6C9652000-memory.dmp	xmrig
behavioral2/memory/64-420-0x00007FF631520000-0x00007FF631912000-memory.dmp	xmrig
behavioral2/memory/3540-432-0x00007FF6ACC60000-0x00007FF6AD052000-memory.dmp	xmrig
behavioral2/memory/3096-436-0x00007FF66CBA0000-0x00007FF66CF92000-memory.dmp	xmrig
behavioral2/memory/2664-441-0x00007FF688290000-0x00007FF688682000-memory.dmp	xmrig
behavioral2/memory/1924-446-0x00007FF778B70000-0x00007FF778F62000-memory.dmp	xmrig
behavioral2/memory/1292-447-0x00007FF67B0C0000-0x00007FF67B4B2000-memory.dmp	xmrig
behavioral2/memory/4588-445-0x00007FF68E5C0000-0x00007FF68E9B2000-memory.dmp	xmrig
behavioral2/memory/3152-444-0x00007FF712FE0000-0x00007FF7133D2000-memory.dmp	xmrig
behavioral2/memory/1840-443-0x00007FF61FE70000-0x00007FF620262000-memory.dmp	xmrig
behavioral2/memory/1596-442-0x00007FF685460000-0x00007FF685852000-memory.dmp	xmrig
behavioral2/memory/512-440-0x00007FF79DAD0000-0x00007FF79DEC2000-memory.dmp	xmrig
behavioral2/memory/2344-439-0x00007FF785E60000-0x00007FF786252000-memory.dmp	xmrig
behavioral2/memory/2980-438-0x00007FF7E2B90000-0x00007FF7E2F82000-memory.dmp	xmrig
behavioral2/memory/4512-437-0x00007FF688BA0000-0x00007FF688F92000-memory.dmp	xmrig
behavioral2/memory/2872-435-0x00007FF722370000-0x00007FF722762000-memory.dmp	xmrig
behavioral2/memory/2196-434-0x00007FF61C9C0000-0x00007FF61CDB2000-memory.dmp	xmrig
behavioral2/memory/1128-433-0x00007FF7AFE80000-0x00007FF7B0272000-memory.dmp	xmrig
behavioral2/memory/1892-431-0x00007FF604B40000-0x00007FF604F32000-memory.dmp	xmrig
behavioral2/memory/2332-430-0x00007FF6CC840000-0x00007FF6CCC32000-memory.dmp	xmrig
behavioral2/memory/2036-408-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	xmrig
behavioral2/memory/4084-364-0x00007FF67A5E0000-0x00007FF67A9D2000-memory.dmp	xmrig
behavioral2/memory/1924-3738-0x00007FF778B70000-0x00007FF778F62000-memory.dmp	xmrig
behavioral2/memory/1628-3737-0x00007FF6C9260000-0x00007FF6C9652000-memory.dmp	xmrig
behavioral2/memory/2828-3742-0x00007FF654760000-0x00007FF654B52000-memory.dmp	xmrig
behavioral2/memory/4084-3744-0x00007FF67A5E0000-0x00007FF67A9D2000-memory.dmp	xmrig
behavioral2/memory/2036-3748-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	xmrig
behavioral2/memory/3540-3770-0x00007FF6ACC60000-0x00007FF6AD052000-memory.dmp	xmrig
behavioral2/memory/2344-3793-0x00007FF785E60000-0x00007FF786252000-memory.dmp	xmrig
behavioral2/memory/4588-3808-0x00007FF68E5C0000-0x00007FF68E9B2000-memory.dmp	xmrig
behavioral2/memory/3152-3842-0x00007FF712FE0000-0x00007FF7133D2000-memory.dmp	xmrig
behavioral2/memory/2980-3795-0x00007FF7E2B90000-0x00007FF7E2F82000-memory.dmp	xmrig
behavioral2/memory/1840-3791-0x00007FF61FE70000-0x00007FF620262000-memory.dmp	xmrig
behavioral2/memory/512-3784-0x00007FF79DAD0000-0x00007FF79DEC2000-memory.dmp	xmrig
behavioral2/memory/1596-3787-0x00007FF685460000-0x00007FF685852000-memory.dmp	xmrig
behavioral2/memory/1292-3783-0x00007FF67B0C0000-0x00007FF67B4B2000-memory.dmp	xmrig
behavioral2/memory/1128-3773-0x00007FF7AFE80000-0x00007FF7B0272000-memory.dmp	xmrig
behavioral2/memory/2664-3778-0x00007FF688290000-0x00007FF688682000-memory.dmp	xmrig
behavioral2/memory/64-3767-0x00007FF631520000-0x00007FF631912000-memory.dmp	xmrig
behavioral2/memory/1892-3764-0x00007FF604B40000-0x00007FF604F32000-memory.dmp	xmrig
behavioral2/memory/2196-3763-0x00007FF61C9C0000-0x00007FF61CDB2000-memory.dmp	xmrig
behavioral2/memory/2872-3761-0x00007FF722370000-0x00007FF722762000-memory.dmp	xmrig
behavioral2/memory/3096-3758-0x00007FF66CBA0000-0x00007FF66CF92000-memory.dmp	xmrig
behavioral2/memory/4512-3755-0x00007FF688BA0000-0x00007FF688F92000-memory.dmp	xmrig
behavioral2/memory/2332-3769-0x00007FF6CC840000-0x00007FF6CCC32000-memory.dmp	xmrig
behavioral2/memory/4612-4140-0x00007FF71AC20000-0x00007FF71B012000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1924	BpMoJYy.exe
2828	NoYPlOE.exe
4080	xtvCzJj.exe
1628	WzshkYP.exe
4084	zSJFUEG.exe
2036	zMJimel.exe
64	VRHmFKB.exe
2332	LOgkSYh.exe
1892	KiXIHwX.exe
3540	OzlMLst.exe
1128	rnSyoKV.exe
2196	BJFFzfZ.exe
2872	JbnJgla.exe
3096	qaAFTpt.exe
4512	wLwcjpM.exe
2980	foFRtre.exe
2344	xrJPCZA.exe
512	jgNHKLt.exe
2664	dQYiwAh.exe
1292	WMKFOBp.exe
1596	FpcCcXp.exe
1840	ybuZdbL.exe
3152	dPUqBnN.exe
4588	XKLFEGC.exe
436	AlxemAK.exe
1652	HpbfhLf.exe
4420	iibNZia.exe
2948	WfAwBwG.exe
2276	nqSEMcu.exe
1288	AdxONUG.exe
1136	xyKSaVk.exe
3448	xspqvjd.exe
4464	kRXuSRw.exe
4596	AcpVLBA.exe
1052	KTVPxfZ.exe
1344	reytsbD.exe
3944	GObHEOI.exe
3196	pnuwsZq.exe
3864	sJexEQj.exe
2128	zWmFeUV.exe
4356	DYSqQFK.exe
440	LcIuIbX.exe
2088	HwsiTiG.exe
4808	whHRJJH.exe
3404	lfLTAhk.exe
2052	sPfFKIZ.exe
2636	UkcQbrz.exe
1108	lDtgvIC.exe
2864	IZeaWCE.exe
4312	QgfMJTv.exe
4536	enqNHPR.exe
1604	HDBkQmm.exe
3588	yHjsHHM.exe
3084	fvJbTIA.exe
1708	xhOGxZg.exe
2312	JcEebJW.exe
3852	WzenINW.exe
3796	eBmehJs.exe
3572	RsSgFDS.exe
2252	xnLOIpx.exe
3960	FwakaPB.exe
4648	vDwwtiv.exe
2848	zvoKAGb.exe
4580	HmJmZSM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4612-0-0x00007FF71AC20000-0x00007FF71B012000-memory.dmp	upx
behavioral2/files/0x0007000000023445-9.dat	upx
behavioral2/files/0x00090000000233e1-8.dat	upx
behavioral2/files/0x0007000000023446-14.dat	upx
behavioral2/files/0x0007000000023448-20.dat	upx
behavioral2/files/0x0007000000023453-137.dat	upx
behavioral2/files/0x000700000002344f-86.dat	upx
behavioral2/files/0x000700000002344e-80.dat	upx
behavioral2/files/0x0007000000023457-108.dat	upx
behavioral2/files/0x0007000000023450-101.dat	upx
behavioral2/files/0x0007000000023456-75.dat	upx
behavioral2/files/0x0007000000023455-74.dat	upx
behavioral2/files/0x0007000000023454-73.dat	upx
behavioral2/files/0x000700000002344c-72.dat	upx
behavioral2/memory/4080-262-0x00007FF753A70000-0x00007FF753E62000-memory.dmp	upx
behavioral2/memory/2828-255-0x00007FF654760000-0x00007FF654B52000-memory.dmp	upx
behavioral2/files/0x000700000002346c-204.dat	upx
behavioral2/files/0x000700000002346b-200.dat	upx
behavioral2/files/0x000700000002345e-194.dat	upx
behavioral2/files/0x000700000002346a-191.dat	upx
behavioral2/files/0x0007000000023468-182.dat	upx
behavioral2/files/0x0007000000023459-177.dat	upx
behavioral2/files/0x0007000000023458-173.dat	upx
behavioral2/files/0x0007000000023465-172.dat	upx
behavioral2/files/0x0007000000023461-161.dat	upx
behavioral2/files/0x0007000000023464-160.dat	upx
behavioral2/memory/1628-328-0x00007FF6C9260000-0x00007FF6C9652000-memory.dmp	upx
behavioral2/files/0x000700000002345f-155.dat	upx
behavioral2/files/0x0007000000023460-154.dat	upx
behavioral2/files/0x000700000002345d-144.dat	upx
behavioral2/files/0x000700000002345c-143.dat	upx
behavioral2/files/0x0007000000023469-188.dat	upx
behavioral2/files/0x000700000002345b-140.dat	upx
behavioral2/files/0x0007000000023467-180.dat	upx
behavioral2/files/0x000700000002345a-134.dat	upx
behavioral2/files/0x0007000000023451-125.dat	upx
behavioral2/files/0x0007000000023452-123.dat	upx
behavioral2/files/0x000700000002344d-98.dat	upx
behavioral2/files/0x000700000002344b-91.dat	upx
behavioral2/files/0x000700000002344a-63.dat	upx
behavioral2/files/0x0007000000023447-47.dat	upx
behavioral2/files/0x0007000000023449-32.dat	upx
behavioral2/memory/64-420-0x00007FF631520000-0x00007FF631912000-memory.dmp	upx
behavioral2/memory/3540-432-0x00007FF6ACC60000-0x00007FF6AD052000-memory.dmp	upx
behavioral2/memory/3096-436-0x00007FF66CBA0000-0x00007FF66CF92000-memory.dmp	upx
behavioral2/memory/2664-441-0x00007FF688290000-0x00007FF688682000-memory.dmp	upx
behavioral2/memory/1924-446-0x00007FF778B70000-0x00007FF778F62000-memory.dmp	upx
behavioral2/memory/1292-447-0x00007FF67B0C0000-0x00007FF67B4B2000-memory.dmp	upx
behavioral2/memory/4588-445-0x00007FF68E5C0000-0x00007FF68E9B2000-memory.dmp	upx
behavioral2/memory/3152-444-0x00007FF712FE0000-0x00007FF7133D2000-memory.dmp	upx
behavioral2/memory/1840-443-0x00007FF61FE70000-0x00007FF620262000-memory.dmp	upx
behavioral2/memory/1596-442-0x00007FF685460000-0x00007FF685852000-memory.dmp	upx
behavioral2/memory/512-440-0x00007FF79DAD0000-0x00007FF79DEC2000-memory.dmp	upx
behavioral2/memory/2344-439-0x00007FF785E60000-0x00007FF786252000-memory.dmp	upx
behavioral2/memory/2980-438-0x00007FF7E2B90000-0x00007FF7E2F82000-memory.dmp	upx
behavioral2/memory/4512-437-0x00007FF688BA0000-0x00007FF688F92000-memory.dmp	upx
behavioral2/memory/2872-435-0x00007FF722370000-0x00007FF722762000-memory.dmp	upx
behavioral2/memory/2196-434-0x00007FF61C9C0000-0x00007FF61CDB2000-memory.dmp	upx
behavioral2/memory/1128-433-0x00007FF7AFE80000-0x00007FF7B0272000-memory.dmp	upx
behavioral2/memory/1892-431-0x00007FF604B40000-0x00007FF604F32000-memory.dmp	upx
behavioral2/memory/2332-430-0x00007FF6CC840000-0x00007FF6CCC32000-memory.dmp	upx
behavioral2/memory/2036-408-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp	upx
behavioral2/memory/4084-364-0x00007FF67A5E0000-0x00007FF67A9D2000-memory.dmp	upx
behavioral2/memory/1924-3738-0x00007FF778B70000-0x00007FF778F62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PXGBeBy.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\eEYmsXU.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\unJPCOF.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\ycUdQKP.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\gRUjvOZ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\OAETDxW.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\JCigguO.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\YkgpZkG.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\YlfeedK.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\dSutPNw.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\MQwfvLT.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\GgbEGVE.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\NOUDPLu.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\wLAaRoZ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\iqjIEAt.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\PsyQfoo.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\QSEhavY.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\XfJAQWn.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\uRzbdCN.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\sToHYYc.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\kPxehlv.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\SDknKas.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\mQYtpPh.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\qKGRvee.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\OSUalVz.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\yspnNZI.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\XEBIaCQ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\kkxRExX.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\Uhqxpeg.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\ijSsskJ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\ZnwMZKV.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\BHuMehR.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\AhglVuu.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\liNGEDP.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\xdliijw.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\TmXRPEn.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\NNSGNCP.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\HVlIAEA.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\CtjNYZK.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\iuofpuR.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\XwILoht.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\IekJgkk.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\PkURQIX.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\jseCRVJ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\ZGqyafv.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\GvMzhNQ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\uVMToNE.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\dgkpWQQ.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\JrAXkZE.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\xJNdIJP.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\JqPCGSv.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\xcvOumE.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\hEDJeiB.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\ADgRllb.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\JECbeQl.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\lzyERSP.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\kkPbZss.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\WbXUCND.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\nzyGqkm.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\XFosIUN.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\jzTBtPh.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\uVNgHWK.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\XrppFVx.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
File created	C:\Windows\System\GuWCuFW.exe	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3728	powershell.exe
3728	powershell.exe
3728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeLockMemoryPrivilege	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3728	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	85
PID 4612 wrote to memory of 3728	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	85
PID 4612 wrote to memory of 1924	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	86
PID 4612 wrote to memory of 1924	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	86
PID 4612 wrote to memory of 2828	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	87
PID 4612 wrote to memory of 2828	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	87
PID 4612 wrote to memory of 4080	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	88
PID 4612 wrote to memory of 4080	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	88
PID 4612 wrote to memory of 2036	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	89
PID 4612 wrote to memory of 2036	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	89
PID 4612 wrote to memory of 1628	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	90
PID 4612 wrote to memory of 1628	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	90
PID 4612 wrote to memory of 4084	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	91
PID 4612 wrote to memory of 4084	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	91
PID 4612 wrote to memory of 64	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	92
PID 4612 wrote to memory of 64	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	92
PID 4612 wrote to memory of 2196	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	93
PID 4612 wrote to memory of 2196	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	93
PID 4612 wrote to memory of 2332	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	94
PID 4612 wrote to memory of 2332	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	94
PID 4612 wrote to memory of 1892	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	95
PID 4612 wrote to memory of 1892	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	95
PID 4612 wrote to memory of 3540	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	96
PID 4612 wrote to memory of 3540	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	96
PID 4612 wrote to memory of 1128	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	97
PID 4612 wrote to memory of 1128	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	97
PID 4612 wrote to memory of 2872	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	98
PID 4612 wrote to memory of 2872	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	98
PID 4612 wrote to memory of 3096	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	99
PID 4612 wrote to memory of 3096	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	99
PID 4612 wrote to memory of 4512	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	100
PID 4612 wrote to memory of 4512	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	100
PID 4612 wrote to memory of 2980	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	101
PID 4612 wrote to memory of 2980	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	101
PID 4612 wrote to memory of 2344	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	102
PID 4612 wrote to memory of 2344	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	102
PID 4612 wrote to memory of 512	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	103
PID 4612 wrote to memory of 512	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	103
PID 4612 wrote to memory of 2664	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	104
PID 4612 wrote to memory of 2664	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	104
PID 4612 wrote to memory of 1292	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	105
PID 4612 wrote to memory of 1292	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	105
PID 4612 wrote to memory of 1596	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	106
PID 4612 wrote to memory of 1596	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	106
PID 4612 wrote to memory of 1840	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	107
PID 4612 wrote to memory of 1840	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	107
PID 4612 wrote to memory of 3152	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	108
PID 4612 wrote to memory of 3152	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	108
PID 4612 wrote to memory of 4588	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	109
PID 4612 wrote to memory of 4588	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	109
PID 4612 wrote to memory of 436	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	110
PID 4612 wrote to memory of 436	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	110
PID 4612 wrote to memory of 1652	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	111
PID 4612 wrote to memory of 1652	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	111
PID 4612 wrote to memory of 4420	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	112
PID 4612 wrote to memory of 4420	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	112
PID 4612 wrote to memory of 2948	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	113
PID 4612 wrote to memory of 2948	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	113
PID 4612 wrote to memory of 2276	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	114
PID 4612 wrote to memory of 2276	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	114
PID 4612 wrote to memory of 1288	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	115
PID 4612 wrote to memory of 1288	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	115
PID 4612 wrote to memory of 1136	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	116
PID 4612 wrote to memory of 1136	4612	025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025e72eb305ffe02d5ccd17bdadbdc7b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3728
- C:\Windows\System\BpMoJYy.exe
  C:\Windows\System\BpMoJYy.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\NoYPlOE.exe
  C:\Windows\System\NoYPlOE.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\xtvCzJj.exe
  C:\Windows\System\xtvCzJj.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\zMJimel.exe
  C:\Windows\System\zMJimel.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\WzshkYP.exe
  C:\Windows\System\WzshkYP.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\zSJFUEG.exe
  C:\Windows\System\zSJFUEG.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\VRHmFKB.exe
  C:\Windows\System\VRHmFKB.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\BJFFzfZ.exe
  C:\Windows\System\BJFFzfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LOgkSYh.exe
  C:\Windows\System\LOgkSYh.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\KiXIHwX.exe
  C:\Windows\System\KiXIHwX.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\OzlMLst.exe
  C:\Windows\System\OzlMLst.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\rnSyoKV.exe
  C:\Windows\System\rnSyoKV.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\JbnJgla.exe
  C:\Windows\System\JbnJgla.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\qaAFTpt.exe
  C:\Windows\System\qaAFTpt.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\wLwcjpM.exe
  C:\Windows\System\wLwcjpM.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\foFRtre.exe
  C:\Windows\System\foFRtre.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\xrJPCZA.exe
  C:\Windows\System\xrJPCZA.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\jgNHKLt.exe
  C:\Windows\System\jgNHKLt.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\dQYiwAh.exe
  C:\Windows\System\dQYiwAh.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\WMKFOBp.exe
  C:\Windows\System\WMKFOBp.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\FpcCcXp.exe
  C:\Windows\System\FpcCcXp.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ybuZdbL.exe
  C:\Windows\System\ybuZdbL.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\dPUqBnN.exe
  C:\Windows\System\dPUqBnN.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\XKLFEGC.exe
  C:\Windows\System\XKLFEGC.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\AlxemAK.exe
  C:\Windows\System\AlxemAK.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\HpbfhLf.exe
  C:\Windows\System\HpbfhLf.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\iibNZia.exe
  C:\Windows\System\iibNZia.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\WfAwBwG.exe
  C:\Windows\System\WfAwBwG.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\nqSEMcu.exe
  C:\Windows\System\nqSEMcu.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\AdxONUG.exe
  C:\Windows\System\AdxONUG.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\xyKSaVk.exe
  C:\Windows\System\xyKSaVk.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\xspqvjd.exe
  C:\Windows\System\xspqvjd.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\HwsiTiG.exe
  C:\Windows\System\HwsiTiG.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\kRXuSRw.exe
  C:\Windows\System\kRXuSRw.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\AcpVLBA.exe
  C:\Windows\System\AcpVLBA.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\KTVPxfZ.exe
  C:\Windows\System\KTVPxfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\reytsbD.exe
  C:\Windows\System\reytsbD.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\GObHEOI.exe
  C:\Windows\System\GObHEOI.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\pnuwsZq.exe
  C:\Windows\System\pnuwsZq.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\sJexEQj.exe
  C:\Windows\System\sJexEQj.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\zWmFeUV.exe
  C:\Windows\System\zWmFeUV.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\DYSqQFK.exe
  C:\Windows\System\DYSqQFK.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\LcIuIbX.exe
  C:\Windows\System\LcIuIbX.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\whHRJJH.exe
  C:\Windows\System\whHRJJH.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\lfLTAhk.exe
  C:\Windows\System\lfLTAhk.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\sPfFKIZ.exe
  C:\Windows\System\sPfFKIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\UkcQbrz.exe
  C:\Windows\System\UkcQbrz.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\lDtgvIC.exe
  C:\Windows\System\lDtgvIC.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\IZeaWCE.exe
  C:\Windows\System\IZeaWCE.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\QgfMJTv.exe
  C:\Windows\System\QgfMJTv.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\enqNHPR.exe
  C:\Windows\System\enqNHPR.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\HDBkQmm.exe
  C:\Windows\System\HDBkQmm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\yHjsHHM.exe
  C:\Windows\System\yHjsHHM.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\fvJbTIA.exe
  C:\Windows\System\fvJbTIA.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\xhOGxZg.exe
  C:\Windows\System\xhOGxZg.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JcEebJW.exe
  C:\Windows\System\JcEebJW.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WzenINW.exe
  C:\Windows\System\WzenINW.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\eBmehJs.exe
  C:\Windows\System\eBmehJs.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\RsSgFDS.exe
  C:\Windows\System\RsSgFDS.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\xnLOIpx.exe
  C:\Windows\System\xnLOIpx.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\FwakaPB.exe
  C:\Windows\System\FwakaPB.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\vDwwtiv.exe
  C:\Windows\System\vDwwtiv.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\zvoKAGb.exe
  C:\Windows\System\zvoKAGb.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\HmJmZSM.exe
  C:\Windows\System\HmJmZSM.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\NyjrJUS.exe
  C:\Windows\System\NyjrJUS.exe
  2⤵
  PID:116
- C:\Windows\System\YJihUUc.exe
  C:\Windows\System\YJihUUc.exe
  2⤵
  PID:5052
- C:\Windows\System\GZKONTl.exe
  C:\Windows\System\GZKONTl.exe
  2⤵
  PID:2720
- C:\Windows\System\xeInJUJ.exe
  C:\Windows\System\xeInJUJ.exe
  2⤵
  PID:3040
- C:\Windows\System\QvDWTFK.exe
  C:\Windows\System\QvDWTFK.exe
  2⤵
  PID:2116
- C:\Windows\System\BLInJyV.exe
  C:\Windows\System\BLInJyV.exe
  2⤵
  PID:4640
- C:\Windows\System\gREAgdq.exe
  C:\Windows\System\gREAgdq.exe
  2⤵
  PID:2804
- C:\Windows\System\DOofQsM.exe
  C:\Windows\System\DOofQsM.exe
  2⤵
  PID:1632
- C:\Windows\System\kcZaozW.exe
  C:\Windows\System\kcZaozW.exe
  2⤵
  PID:3216
- C:\Windows\System\xvuzvdu.exe
  C:\Windows\System\xvuzvdu.exe
  2⤵
  PID:5124
- C:\Windows\System\fHaMhfp.exe
  C:\Windows\System\fHaMhfp.exe
  2⤵
  PID:5144
- C:\Windows\System\LdSqyCk.exe
  C:\Windows\System\LdSqyCk.exe
  2⤵
  PID:5168
- C:\Windows\System\GJjiJbF.exe
  C:\Windows\System\GJjiJbF.exe
  2⤵
  PID:5192
- C:\Windows\System\wqNxoKZ.exe
  C:\Windows\System\wqNxoKZ.exe
  2⤵
  PID:5208
- C:\Windows\System\zgtIJuP.exe
  C:\Windows\System\zgtIJuP.exe
  2⤵
  PID:5224
- C:\Windows\System\qaBlzwj.exe
  C:\Windows\System\qaBlzwj.exe
  2⤵
  PID:5240
- C:\Windows\System\yNtygEd.exe
  C:\Windows\System\yNtygEd.exe
  2⤵
  PID:5264
- C:\Windows\System\bBUnvzv.exe
  C:\Windows\System\bBUnvzv.exe
  2⤵
  PID:5284
- C:\Windows\System\mSOOqBr.exe
  C:\Windows\System\mSOOqBr.exe
  2⤵
  PID:5320
- C:\Windows\System\HdoHpYt.exe
  C:\Windows\System\HdoHpYt.exe
  2⤵
  PID:5348
- C:\Windows\System\gwStQNE.exe
  C:\Windows\System\gwStQNE.exe
  2⤵
  PID:5372
- C:\Windows\System\xddevhD.exe
  C:\Windows\System\xddevhD.exe
  2⤵
  PID:5392
- C:\Windows\System\ycxNvTv.exe
  C:\Windows\System\ycxNvTv.exe
  2⤵
  PID:5408
- C:\Windows\System\TqTgOlx.exe
  C:\Windows\System\TqTgOlx.exe
  2⤵
  PID:5432
- C:\Windows\System\vNQBqwk.exe
  C:\Windows\System\vNQBqwk.exe
  2⤵
  PID:5448
- C:\Windows\System\AaoFxvo.exe
  C:\Windows\System\AaoFxvo.exe
  2⤵
  PID:5468
- C:\Windows\System\NeeNaBM.exe
  C:\Windows\System\NeeNaBM.exe
  2⤵
  PID:5492
- C:\Windows\System\ZMlQxtn.exe
  C:\Windows\System\ZMlQxtn.exe
  2⤵
  PID:5512
- C:\Windows\System\VojjiBm.exe
  C:\Windows\System\VojjiBm.exe
  2⤵
  PID:5528
- C:\Windows\System\dYcDQZf.exe
  C:\Windows\System\dYcDQZf.exe
  2⤵
  PID:5556
- C:\Windows\System\kNctquB.exe
  C:\Windows\System\kNctquB.exe
  2⤵
  PID:5576
- C:\Windows\System\JJgfShm.exe
  C:\Windows\System\JJgfShm.exe
  2⤵
  PID:5592
- C:\Windows\System\OJpXsEG.exe
  C:\Windows\System\OJpXsEG.exe
  2⤵
  PID:5612
- C:\Windows\System\fksKTFx.exe
  C:\Windows\System\fksKTFx.exe
  2⤵
  PID:5632
- C:\Windows\System\GhLjkBj.exe
  C:\Windows\System\GhLjkBj.exe
  2⤵
  PID:5684
- C:\Windows\System\npjtxvh.exe
  C:\Windows\System\npjtxvh.exe
  2⤵
  PID:5708
- C:\Windows\System\thefmoQ.exe
  C:\Windows\System\thefmoQ.exe
  2⤵
  PID:5724
- C:\Windows\System\MgBGSqb.exe
  C:\Windows\System\MgBGSqb.exe
  2⤵
  PID:5748
- C:\Windows\System\WBrCqgg.exe
  C:\Windows\System\WBrCqgg.exe
  2⤵
  PID:5932
- C:\Windows\System\cfkkGnq.exe
  C:\Windows\System\cfkkGnq.exe
  2⤵
  PID:5948
- C:\Windows\System\VeFvPTL.exe
  C:\Windows\System\VeFvPTL.exe
  2⤵
  PID:5964
- C:\Windows\System\tJrJlrg.exe
  C:\Windows\System\tJrJlrg.exe
  2⤵
  PID:5980
- C:\Windows\System\ybPqVwt.exe
  C:\Windows\System\ybPqVwt.exe
  2⤵
  PID:6140
- C:\Windows\System\Wtnkrds.exe
  C:\Windows\System\Wtnkrds.exe
  2⤵
  PID:3976
- C:\Windows\System\jOGlTOX.exe
  C:\Windows\System\jOGlTOX.exe
  2⤵
  PID:1952
- C:\Windows\System\VicUSQe.exe
  C:\Windows\System\VicUSQe.exe
  2⤵
  PID:3044
- C:\Windows\System\LPglOhW.exe
  C:\Windows\System\LPglOhW.exe
  2⤵
  PID:4704
- C:\Windows\System\nwmcxyy.exe
  C:\Windows\System\nwmcxyy.exe
  2⤵
  PID:4696
- C:\Windows\System\dQgmUvr.exe
  C:\Windows\System\dQgmUvr.exe
  2⤵
  PID:3568
- C:\Windows\System\QyViIWx.exe
  C:\Windows\System\QyViIWx.exe
  2⤵
  PID:2968
- C:\Windows\System\cKLnvDr.exe
  C:\Windows\System\cKLnvDr.exe
  2⤵
  PID:1160
- C:\Windows\System\IVpDwzN.exe
  C:\Windows\System\IVpDwzN.exe
  2⤵
  PID:5108
- C:\Windows\System\sRKXequ.exe
  C:\Windows\System\sRKXequ.exe
  2⤵
  PID:4576
- C:\Windows\System\KVvViXU.exe
  C:\Windows\System\KVvViXU.exe
  2⤵
  PID:2200
- C:\Windows\System\oVREKBw.exe
  C:\Windows\System\oVREKBw.exe
  2⤵
  PID:4520
- C:\Windows\System\JubYjHK.exe
  C:\Windows\System\JubYjHK.exe
  2⤵
  PID:5016
- C:\Windows\System\GVJtDIx.exe
  C:\Windows\System\GVJtDIx.exe
  2⤵
  PID:3956
- C:\Windows\System\LiEURFI.exe
  C:\Windows\System\LiEURFI.exe
  2⤵
  PID:5092
- C:\Windows\System\DkmwdyK.exe
  C:\Windows\System\DkmwdyK.exe
  2⤵
  PID:5420
- C:\Windows\System\NaslsyP.exe
  C:\Windows\System\NaslsyP.exe
  2⤵
  PID:5360
- C:\Windows\System\ssWNCWl.exe
  C:\Windows\System\ssWNCWl.exe
  2⤵
  PID:5424
- C:\Windows\System\lsGIrza.exe
  C:\Windows\System\lsGIrza.exe
  2⤵
  PID:2180
- C:\Windows\System\KjEHthm.exe
  C:\Windows\System\KjEHthm.exe
  2⤵
  PID:5328
- C:\Windows\System\WuezUNk.exe
  C:\Windows\System\WuezUNk.exe
  2⤵
  PID:5416
- C:\Windows\System\YprFnap.exe
  C:\Windows\System\YprFnap.exe
  2⤵
  PID:5476
- C:\Windows\System\rtqkbfN.exe
  C:\Windows\System\rtqkbfN.exe
  2⤵
  PID:5520
- C:\Windows\System\aMbWzFM.exe
  C:\Windows\System\aMbWzFM.exe
  2⤵
  PID:5544
- C:\Windows\System\qlAqKcF.exe
  C:\Windows\System\qlAqKcF.exe
  2⤵
  PID:2920
- C:\Windows\System\BKoLdgi.exe
  C:\Windows\System\BKoLdgi.exe
  2⤵
  PID:5620
- C:\Windows\System\XtAnjzU.exe
  C:\Windows\System\XtAnjzU.exe
  2⤵
  PID:5676
- C:\Windows\System\HhRNcwp.exe
  C:\Windows\System\HhRNcwp.exe
  2⤵
  PID:5716
- C:\Windows\System\blKBYeX.exe
  C:\Windows\System\blKBYeX.exe
  2⤵
  PID:5736
- C:\Windows\System\suwfLWJ.exe
  C:\Windows\System\suwfLWJ.exe
  2⤵
  PID:3836
- C:\Windows\System\PfkaUje.exe
  C:\Windows\System\PfkaUje.exe
  2⤵
  PID:1552
- C:\Windows\System\NtiQCoA.exe
  C:\Windows\System\NtiQCoA.exe
  2⤵
  PID:5784
- C:\Windows\System\PcOUOua.exe
  C:\Windows\System\PcOUOua.exe
  2⤵
  PID:1996
- C:\Windows\System\MCRehPh.exe
  C:\Windows\System\MCRehPh.exe
  2⤵
  PID:6024
- C:\Windows\System\KXvvSlo.exe
  C:\Windows\System\KXvvSlo.exe
  2⤵
  PID:5956
- C:\Windows\System\wrPmZie.exe
  C:\Windows\System\wrPmZie.exe
  2⤵
  PID:5912
- C:\Windows\System\zfQZxrB.exe
  C:\Windows\System\zfQZxrB.exe
  2⤵
  PID:6076
- C:\Windows\System\SdELHeM.exe
  C:\Windows\System\SdELHeM.exe
  2⤵
  PID:6116
- C:\Windows\System\opRgsMd.exe
  C:\Windows\System\opRgsMd.exe
  2⤵
  PID:620
- C:\Windows\System\gnqHscd.exe
  C:\Windows\System\gnqHscd.exe
  2⤵
  PID:1356
- C:\Windows\System\LcLgRqL.exe
  C:\Windows\System\LcLgRqL.exe
  2⤵
  PID:1204
- C:\Windows\System\NmTzLBx.exe
  C:\Windows\System\NmTzLBx.exe
  2⤵
  PID:3972
- C:\Windows\System\wcSBTye.exe
  C:\Windows\System\wcSBTye.exe
  2⤵
  PID:3556
- C:\Windows\System\qfgKWqA.exe
  C:\Windows\System\qfgKWqA.exe
  2⤵
  PID:6168
- C:\Windows\System\EaekhSa.exe
  C:\Windows\System\EaekhSa.exe
  2⤵
  PID:6184
- C:\Windows\System\pxcLEXx.exe
  C:\Windows\System\pxcLEXx.exe
  2⤵
  PID:6200
- C:\Windows\System\UPXDtAa.exe
  C:\Windows\System\UPXDtAa.exe
  2⤵
  PID:6224
- C:\Windows\System\aRYQypC.exe
  C:\Windows\System\aRYQypC.exe
  2⤵
  PID:6252
- C:\Windows\System\XxLCIyD.exe
  C:\Windows\System\XxLCIyD.exe
  2⤵
  PID:6268
- C:\Windows\System\VdiBRSr.exe
  C:\Windows\System\VdiBRSr.exe
  2⤵
  PID:6288
- C:\Windows\System\NjzWlGX.exe
  C:\Windows\System\NjzWlGX.exe
  2⤵
  PID:6316
- C:\Windows\System\bJWTsmL.exe
  C:\Windows\System\bJWTsmL.exe
  2⤵
  PID:6348
- C:\Windows\System\GRmslxd.exe
  C:\Windows\System\GRmslxd.exe
  2⤵
  PID:6488
- C:\Windows\System\SIbxvET.exe
  C:\Windows\System\SIbxvET.exe
  2⤵
  PID:6504
- C:\Windows\System\saAaEKO.exe
  C:\Windows\System\saAaEKO.exe
  2⤵
  PID:6528
- C:\Windows\System\mCAFbmi.exe
  C:\Windows\System\mCAFbmi.exe
  2⤵
  PID:6556
- C:\Windows\System\phZJztQ.exe
  C:\Windows\System\phZJztQ.exe
  2⤵
  PID:6572
- C:\Windows\System\IgMoUzT.exe
  C:\Windows\System\IgMoUzT.exe
  2⤵
  PID:6592
- C:\Windows\System\OSzTNEQ.exe
  C:\Windows\System\OSzTNEQ.exe
  2⤵
  PID:6616
- C:\Windows\System\GExGeqF.exe
  C:\Windows\System\GExGeqF.exe
  2⤵
  PID:6636
- C:\Windows\System\AJSIFAu.exe
  C:\Windows\System\AJSIFAu.exe
  2⤵
  PID:6660
- C:\Windows\System\ALfTFxU.exe
  C:\Windows\System\ALfTFxU.exe
  2⤵
  PID:6684
- C:\Windows\System\dQVIVFi.exe
  C:\Windows\System\dQVIVFi.exe
  2⤵
  PID:6708
- C:\Windows\System\jIYDeFP.exe
  C:\Windows\System\jIYDeFP.exe
  2⤵
  PID:6724
- C:\Windows\System\ADgRllb.exe
  C:\Windows\System\ADgRllb.exe
  2⤵
  PID:6740
- C:\Windows\System\ihkkZUn.exe
  C:\Windows\System\ihkkZUn.exe
  2⤵
  PID:6764
- C:\Windows\System\hyOKEHG.exe
  C:\Windows\System\hyOKEHG.exe
  2⤵
  PID:6788
- C:\Windows\System\MGsknzP.exe
  C:\Windows\System\MGsknzP.exe
  2⤵
  PID:6812
- C:\Windows\System\XdeAPte.exe
  C:\Windows\System\XdeAPte.exe
  2⤵
  PID:6836
- C:\Windows\System\tkOsYXS.exe
  C:\Windows\System\tkOsYXS.exe
  2⤵
  PID:6856
- C:\Windows\System\OYGoeif.exe
  C:\Windows\System\OYGoeif.exe
  2⤵
  PID:6876
- C:\Windows\System\LVmRDsp.exe
  C:\Windows\System\LVmRDsp.exe
  2⤵
  PID:6900
- C:\Windows\System\wAKxVLC.exe
  C:\Windows\System\wAKxVLC.exe
  2⤵
  PID:6924
- C:\Windows\System\jTAthWA.exe
  C:\Windows\System\jTAthWA.exe
  2⤵
  PID:6940
- C:\Windows\System\cFNSytS.exe
  C:\Windows\System\cFNSytS.exe
  2⤵
  PID:6972
- C:\Windows\System\KGrcwUy.exe
  C:\Windows\System\KGrcwUy.exe
  2⤵
  PID:6988
- C:\Windows\System\nAZarqy.exe
  C:\Windows\System\nAZarqy.exe
  2⤵
  PID:7096
- C:\Windows\System\fxhawbs.exe
  C:\Windows\System\fxhawbs.exe
  2⤵
  PID:7132
- C:\Windows\System\BahyETY.exe
  C:\Windows\System\BahyETY.exe
  2⤵
  PID:7152
- C:\Windows\System\eONDNDm.exe
  C:\Windows\System\eONDNDm.exe
  2⤵
  PID:2068
- C:\Windows\System\tZGfpCI.exe
  C:\Windows\System\tZGfpCI.exe
  2⤵
  PID:2248
- C:\Windows\System\BOQlWij.exe
  C:\Windows\System\BOQlWij.exe
  2⤵
  PID:5340
- C:\Windows\System\XqpJjXb.exe
  C:\Windows\System\XqpJjXb.exe
  2⤵
  PID:5828
- C:\Windows\System\skMObKM.exe
  C:\Windows\System\skMObKM.exe
  2⤵
  PID:5624
- C:\Windows\System\SdlwWlg.exe
  C:\Windows\System\SdlwWlg.exe
  2⤵
  PID:5756
- C:\Windows\System\HgncnEC.exe
  C:\Windows\System\HgncnEC.exe
  2⤵
  PID:4148
- C:\Windows\System\ZBFyuDa.exe
  C:\Windows\System\ZBFyuDa.exe
  2⤵
  PID:5808
- C:\Windows\System\OyzmJNo.exe
  C:\Windows\System\OyzmJNo.exe
  2⤵
  PID:5972
- C:\Windows\System\HxlHUkD.exe
  C:\Windows\System\HxlHUkD.exe
  2⤵
  PID:5916
- C:\Windows\System\XwrZzjX.exe
  C:\Windows\System\XwrZzjX.exe
  2⤵
  PID:6136
- C:\Windows\System\MothvIB.exe
  C:\Windows\System\MothvIB.exe
  2⤵
  PID:6908
- C:\Windows\System\FqXsTFX.exe
  C:\Windows\System\FqXsTFX.exe
  2⤵
  PID:32
- C:\Windows\System\EEHeYxz.exe
  C:\Windows\System\EEHeYxz.exe
  2⤵
  PID:6176
- C:\Windows\System\wmXvEXs.exe
  C:\Windows\System\wmXvEXs.exe
  2⤵
  PID:6220
- C:\Windows\System\BSQRUWf.exe
  C:\Windows\System\BSQRUWf.exe
  2⤵
  PID:6280
- C:\Windows\System\pmVdjut.exe
  C:\Windows\System\pmVdjut.exe
  2⤵
  PID:6312
- C:\Windows\System\vwXIQBP.exe
  C:\Windows\System\vwXIQBP.exe
  2⤵
  PID:6360
- C:\Windows\System\MffbxjC.exe
  C:\Windows\System\MffbxjC.exe
  2⤵
  PID:6036
- C:\Windows\System\wSpEikB.exe
  C:\Windows\System\wSpEikB.exe
  2⤵
  PID:5988
- C:\Windows\System\GnyWHZK.exe
  C:\Windows\System\GnyWHZK.exe
  2⤵
  PID:6100
- C:\Windows\System\tnhVyyo.exe
  C:\Windows\System\tnhVyyo.exe
  2⤵
  PID:7180
- C:\Windows\System\mNtasoq.exe
  C:\Windows\System\mNtasoq.exe
  2⤵
  PID:7200
- C:\Windows\System\KUQQUzX.exe
  C:\Windows\System\KUQQUzX.exe
  2⤵
  PID:7220
- C:\Windows\System\xTwXtoo.exe
  C:\Windows\System\xTwXtoo.exe
  2⤵
  PID:7244
- C:\Windows\System\jTCajwL.exe
  C:\Windows\System\jTCajwL.exe
  2⤵
  PID:7268
- C:\Windows\System\fzuyhBN.exe
  C:\Windows\System\fzuyhBN.exe
  2⤵
  PID:7288
- C:\Windows\System\zYWrIec.exe
  C:\Windows\System\zYWrIec.exe
  2⤵
  PID:7308
- C:\Windows\System\zHDyDZE.exe
  C:\Windows\System\zHDyDZE.exe
  2⤵
  PID:7328
- C:\Windows\System\bAvQvXf.exe
  C:\Windows\System\bAvQvXf.exe
  2⤵
  PID:7348
- C:\Windows\System\zMQmbRd.exe
  C:\Windows\System\zMQmbRd.exe
  2⤵
  PID:7372
- C:\Windows\System\prNxYGN.exe
  C:\Windows\System\prNxYGN.exe
  2⤵
  PID:7388
- C:\Windows\System\oTcEuTg.exe
  C:\Windows\System\oTcEuTg.exe
  2⤵
  PID:7412
- C:\Windows\System\MjxfHuB.exe
  C:\Windows\System\MjxfHuB.exe
  2⤵
  PID:7440
- C:\Windows\System\adQYWdY.exe
  C:\Windows\System\adQYWdY.exe
  2⤵
  PID:7456
- C:\Windows\System\MkiTUii.exe
  C:\Windows\System\MkiTUii.exe
  2⤵
  PID:7484
- C:\Windows\System\NSVzLVF.exe
  C:\Windows\System\NSVzLVF.exe
  2⤵
  PID:7504
- C:\Windows\System\FMPVHGH.exe
  C:\Windows\System\FMPVHGH.exe
  2⤵
  PID:7520
- C:\Windows\System\AUWCnjg.exe
  C:\Windows\System\AUWCnjg.exe
  2⤵
  PID:7540
- C:\Windows\System\KXyvkVD.exe
  C:\Windows\System\KXyvkVD.exe
  2⤵
  PID:7688
- C:\Windows\System\XWXYvFS.exe
  C:\Windows\System\XWXYvFS.exe
  2⤵
  PID:7708
- C:\Windows\System\NCcLCeB.exe
  C:\Windows\System\NCcLCeB.exe
  2⤵
  PID:7728
- C:\Windows\System\heJOlne.exe
  C:\Windows\System\heJOlne.exe
  2⤵
  PID:7744
- C:\Windows\System\vWOqdKR.exe
  C:\Windows\System\vWOqdKR.exe
  2⤵
  PID:7760
- C:\Windows\System\PULzXnM.exe
  C:\Windows\System\PULzXnM.exe
  2⤵
  PID:7784
- C:\Windows\System\LlucHeO.exe
  C:\Windows\System\LlucHeO.exe
  2⤵
  PID:7864
- C:\Windows\System\iqDlJyA.exe
  C:\Windows\System\iqDlJyA.exe
  2⤵
  PID:7880
- C:\Windows\System\PHXchxR.exe
  C:\Windows\System\PHXchxR.exe
  2⤵
  PID:7904
- C:\Windows\System\KhMHrsi.exe
  C:\Windows\System\KhMHrsi.exe
  2⤵
  PID:7928
- C:\Windows\System\uZdQGnV.exe
  C:\Windows\System\uZdQGnV.exe
  2⤵
  PID:7948
- C:\Windows\System\nDVPWvw.exe
  C:\Windows\System\nDVPWvw.exe
  2⤵
  PID:7968
- C:\Windows\System\oTpBXpE.exe
  C:\Windows\System\oTpBXpE.exe
  2⤵
  PID:7988
- C:\Windows\System\aPxFeYb.exe
  C:\Windows\System\aPxFeYb.exe
  2⤵
  PID:8008
- C:\Windows\System\AtEAEir.exe
  C:\Windows\System\AtEAEir.exe
  2⤵
  PID:8032
- C:\Windows\System\ZhdcWSn.exe
  C:\Windows\System\ZhdcWSn.exe
  2⤵
  PID:8084
- C:\Windows\System\BNNnJjS.exe
  C:\Windows\System\BNNnJjS.exe
  2⤵
  PID:8156
- C:\Windows\System\UeUgfTI.exe
  C:\Windows\System\UeUgfTI.exe
  2⤵
  PID:8176
- C:\Windows\System\UUnkUCe.exe
  C:\Windows\System\UUnkUCe.exe
  2⤵
  PID:6460
- C:\Windows\System\xDFYXDk.exe
  C:\Windows\System\xDFYXDk.exe
  2⤵
  PID:6500
- C:\Windows\System\XqYUIPH.exe
  C:\Windows\System\XqYUIPH.exe
  2⤵
  PID:6564
- C:\Windows\System\QMbHzVG.exe
  C:\Windows\System\QMbHzVG.exe
  2⤵
  PID:6588
- C:\Windows\System\XoRTfSk.exe
  C:\Windows\System\XoRTfSk.exe
  2⤵
  PID:6632
- C:\Windows\System\jBudqdJ.exe
  C:\Windows\System\jBudqdJ.exe
  2⤵
  PID:6680
- C:\Windows\System\teUgjGu.exe
  C:\Windows\System\teUgjGu.exe
  2⤵
  PID:6732
- C:\Windows\System\XsrHctP.exe
  C:\Windows\System\XsrHctP.exe
  2⤵
  PID:6776
- C:\Windows\System\lCtqIBH.exe
  C:\Windows\System\lCtqIBH.exe
  2⤵
  PID:6820
- C:\Windows\System\fwhWuUN.exe
  C:\Windows\System\fwhWuUN.exe
  2⤵
  PID:6916
- C:\Windows\System\gNpZImL.exe
  C:\Windows\System\gNpZImL.exe
  2⤵
  PID:5660
- C:\Windows\System\qBZnLjV.exe
  C:\Windows\System\qBZnLjV.exe
  2⤵
  PID:7000
- C:\Windows\System\jgnZIPy.exe
  C:\Windows\System\jgnZIPy.exe
  2⤵
  PID:7124
- C:\Windows\System\mtIWEtS.exe
  C:\Windows\System\mtIWEtS.exe
  2⤵
  PID:5380
- C:\Windows\System\kjLhAsQ.exe
  C:\Windows\System\kjLhAsQ.exe
  2⤵
  PID:5732
- C:\Windows\System\hcWCWqc.exe
  C:\Windows\System\hcWCWqc.exe
  2⤵
  PID:1044
- C:\Windows\System\cOfOhPj.exe
  C:\Windows\System\cOfOhPj.exe
  2⤵
  PID:7944
- C:\Windows\System\jmSHcvc.exe
  C:\Windows\System\jmSHcvc.exe
  2⤵
  PID:8028
- C:\Windows\System\qAqBsfc.exe
  C:\Windows\System\qAqBsfc.exe
  2⤵
  PID:8204
- C:\Windows\System\jVJxjOH.exe
  C:\Windows\System\jVJxjOH.exe
  2⤵
  PID:8228
- C:\Windows\System\XzmkgCf.exe
  C:\Windows\System\XzmkgCf.exe
  2⤵
  PID:8252
- C:\Windows\System\wXLEXgo.exe
  C:\Windows\System\wXLEXgo.exe
  2⤵
  PID:8272
- C:\Windows\System\ykKskiR.exe
  C:\Windows\System\ykKskiR.exe
  2⤵
  PID:8288
- C:\Windows\System\aimKDNi.exe
  C:\Windows\System\aimKDNi.exe
  2⤵
  PID:8308
- C:\Windows\System\japaDvG.exe
  C:\Windows\System\japaDvG.exe
  2⤵
  PID:8332
- C:\Windows\System\OSGQBRP.exe
  C:\Windows\System\OSGQBRP.exe
  2⤵
  PID:8356
- C:\Windows\System\VVceoyY.exe
  C:\Windows\System\VVceoyY.exe
  2⤵
  PID:8372
- C:\Windows\System\jEFpSvG.exe
  C:\Windows\System\jEFpSvG.exe
  2⤵
  PID:8396
- C:\Windows\System\lyodXDn.exe
  C:\Windows\System\lyodXDn.exe
  2⤵
  PID:8420
- C:\Windows\System\Grannlq.exe
  C:\Windows\System\Grannlq.exe
  2⤵
  PID:8444
- C:\Windows\System\vTHVsyS.exe
  C:\Windows\System\vTHVsyS.exe
  2⤵
  PID:8468
- C:\Windows\System\yimDLBL.exe
  C:\Windows\System\yimDLBL.exe
  2⤵
  PID:8500
- C:\Windows\System\LoFPztn.exe
  C:\Windows\System\LoFPztn.exe
  2⤵
  PID:8524
- C:\Windows\System\HLIQrrn.exe
  C:\Windows\System\HLIQrrn.exe
  2⤵
  PID:8540
- C:\Windows\System\ZGQmDto.exe
  C:\Windows\System\ZGQmDto.exe
  2⤵
  PID:8652
- C:\Windows\System\fsXnZCm.exe
  C:\Windows\System\fsXnZCm.exe
  2⤵
  PID:8668
- C:\Windows\System\XWLAkGc.exe
  C:\Windows\System\XWLAkGc.exe
  2⤵
  PID:8684
- C:\Windows\System\BPpAJyg.exe
  C:\Windows\System\BPpAJyg.exe
  2⤵
  PID:8700
- C:\Windows\System\cuBbmNB.exe
  C:\Windows\System\cuBbmNB.exe
  2⤵
  PID:8724
- C:\Windows\System\MMfoZxw.exe
  C:\Windows\System\MMfoZxw.exe
  2⤵
  PID:8748
- C:\Windows\System\SjIBdhW.exe
  C:\Windows\System\SjIBdhW.exe
  2⤵
  PID:8784
- C:\Windows\System\GMkHkeL.exe
  C:\Windows\System\GMkHkeL.exe
  2⤵
  PID:8804
- C:\Windows\System\zKuqwEb.exe
  C:\Windows\System\zKuqwEb.exe
  2⤵
  PID:8836
- C:\Windows\System\fBVBETh.exe
  C:\Windows\System\fBVBETh.exe
  2⤵
  PID:8860
- C:\Windows\System\tGbONIn.exe
  C:\Windows\System\tGbONIn.exe
  2⤵
  PID:8880
- C:\Windows\System\LNRtRmf.exe
  C:\Windows\System\LNRtRmf.exe
  2⤵
  PID:8896
- C:\Windows\System\SXbnMla.exe
  C:\Windows\System\SXbnMla.exe
  2⤵
  PID:8920
- C:\Windows\System\zIJaKcr.exe
  C:\Windows\System\zIJaKcr.exe
  2⤵
  PID:8940
- C:\Windows\System\esYnrvR.exe
  C:\Windows\System\esYnrvR.exe
  2⤵
  PID:8964
- C:\Windows\System\sDhImkl.exe
  C:\Windows\System\sDhImkl.exe
  2⤵
  PID:8988
- C:\Windows\System\kuJvLrw.exe
  C:\Windows\System\kuJvLrw.exe
  2⤵
  PID:9188
- C:\Windows\System\aJWfCvZ.exe
  C:\Windows\System\aJWfCvZ.exe
  2⤵
  PID:9208
- C:\Windows\System\CZUwcpn.exe
  C:\Windows\System\CZUwcpn.exe
  2⤵
  PID:5384
- C:\Windows\System\EhjGCqC.exe
  C:\Windows\System\EhjGCqC.exe
  2⤵
  PID:6260
- C:\Windows\System\WNTbttx.exe
  C:\Windows\System\WNTbttx.exe
  2⤵
  PID:6344
- C:\Windows\System\ehzgTfK.exe
  C:\Windows\System\ehzgTfK.exe
  2⤵
  PID:1748
- C:\Windows\System\rtXZoRV.exe
  C:\Windows\System\rtXZoRV.exe
  2⤵
  PID:7188
- C:\Windows\System\aEkuQQx.exe
  C:\Windows\System\aEkuQQx.exe
  2⤵
  PID:7228
- C:\Windows\System\DBIrrfF.exe
  C:\Windows\System\DBIrrfF.exe
  2⤵
  PID:7260
- C:\Windows\System\HozRCka.exe
  C:\Windows\System\HozRCka.exe
  2⤵
  PID:7316
- C:\Windows\System\rjtFFPl.exe
  C:\Windows\System\rjtFFPl.exe
  2⤵
  PID:7344
- C:\Windows\System\IIofGgb.exe
  C:\Windows\System\IIofGgb.exe
  2⤵
  PID:7408
- C:\Windows\System\jlGtiJp.exe
  C:\Windows\System\jlGtiJp.exe
  2⤵
  PID:7464
- C:\Windows\System\Dbxauac.exe
  C:\Windows\System\Dbxauac.exe
  2⤵
  PID:7516
- C:\Windows\System\bpZKcop.exe
  C:\Windows\System\bpZKcop.exe
  2⤵
  PID:7796
- C:\Windows\System\cbkzpVb.exe
  C:\Windows\System\cbkzpVb.exe
  2⤵
  PID:8000
- C:\Windows\System\MgEZEfv.exe
  C:\Windows\System\MgEZEfv.exe
  2⤵
  PID:4676
- C:\Windows\System\KAHrkzy.exe
  C:\Windows\System\KAHrkzy.exe
  2⤵
  PID:7696
- C:\Windows\System\cDsZDDK.exe
  C:\Windows\System\cDsZDDK.exe
  2⤵
  PID:7716
- C:\Windows\System\ejfBCKB.exe
  C:\Windows\System\ejfBCKB.exe
  2⤵
  PID:7756
- C:\Windows\System\jcuXaJn.exe
  C:\Windows\System\jcuXaJn.exe
  2⤵
  PID:3036
- C:\Windows\System\Odbuwkl.exe
  C:\Windows\System\Odbuwkl.exe
  2⤵
  PID:7872
- C:\Windows\System\gAMgQoC.exe
  C:\Windows\System\gAMgQoC.exe
  2⤵
  PID:7916
- C:\Windows\System\TdlLduz.exe
  C:\Windows\System\TdlLduz.exe
  2⤵
  PID:8040
- C:\Windows\System\JSuonAe.exe
  C:\Windows\System\JSuonAe.exe
  2⤵
  PID:8352
- C:\Windows\System\gwPOZuE.exe
  C:\Windows\System\gwPOZuE.exe
  2⤵
  PID:6668
- C:\Windows\System\TNQPGtb.exe
  C:\Windows\System\TNQPGtb.exe
  2⤵
  PID:6748
- C:\Windows\System\oCJWLpU.exe
  C:\Windows\System\oCJWLpU.exe
  2⤵
  PID:6848
- C:\Windows\System\cpHPSmb.exe
  C:\Windows\System\cpHPSmb.exe
  2⤵
  PID:6980
- C:\Windows\System\hkvTfLx.exe
  C:\Windows\System\hkvTfLx.exe
  2⤵
  PID:7148
- C:\Windows\System\sVFbypf.exe
  C:\Windows\System\sVFbypf.exe
  2⤵
  PID:5312
- C:\Windows\System\canJlta.exe
  C:\Windows\System\canJlta.exe
  2⤵
  PID:8024
- C:\Windows\System\yxADLFj.exe
  C:\Windows\System\yxADLFj.exe
  2⤵
  PID:8220
- C:\Windows\System\ltxcwCK.exe
  C:\Windows\System\ltxcwCK.exe
  2⤵
  PID:8268
- C:\Windows\System\gosOrjE.exe
  C:\Windows\System\gosOrjE.exe
  2⤵
  PID:8316
- C:\Windows\System\UNrfPHA.exe
  C:\Windows\System\UNrfPHA.exe
  2⤵
  PID:8404
- C:\Windows\System\YRcHIzb.exe
  C:\Windows\System\YRcHIzb.exe
  2⤵
  PID:8440
- C:\Windows\System\paeKzCc.exe
  C:\Windows\System\paeKzCc.exe
  2⤵
  PID:8516
- C:\Windows\System\CYcmglc.exe
  C:\Windows\System\CYcmglc.exe
  2⤵
  PID:8552
- C:\Windows\System\pplRUoE.exe
  C:\Windows\System\pplRUoE.exe
  2⤵
  PID:6324
- C:\Windows\System\yaUzwHf.exe
  C:\Windows\System\yaUzwHf.exe
  2⤵
  PID:7300
- C:\Windows\System\oaJdrFY.exe
  C:\Windows\System\oaJdrFY.exe
  2⤵
  PID:7452
- C:\Windows\System\DpTWUNf.exe
  C:\Windows\System\DpTWUNf.exe
  2⤵
  PID:7548
- C:\Windows\System\laYHzBF.exe
  C:\Windows\System\laYHzBF.exe
  2⤵
  PID:9224
- C:\Windows\System\ZEcNYze.exe
  C:\Windows\System\ZEcNYze.exe
  2⤵
  PID:9240
- C:\Windows\System\qMeYTzb.exe
  C:\Windows\System\qMeYTzb.exe
  2⤵
  PID:9256
- C:\Windows\System\exdaoBx.exe
  C:\Windows\System\exdaoBx.exe
  2⤵
  PID:9276
- C:\Windows\System\dfVHxmx.exe
  C:\Windows\System\dfVHxmx.exe
  2⤵
  PID:9304
- C:\Windows\System\KMBMbjD.exe
  C:\Windows\System\KMBMbjD.exe
  2⤵
  PID:9324
- C:\Windows\System\iSjDBzS.exe
  C:\Windows\System\iSjDBzS.exe
  2⤵
  PID:9348
- C:\Windows\System\GvCYeaL.exe
  C:\Windows\System\GvCYeaL.exe
  2⤵
  PID:9364
- C:\Windows\System\iTngnrR.exe
  C:\Windows\System\iTngnrR.exe
  2⤵
  PID:9392
- C:\Windows\System\BQgeZqx.exe
  C:\Windows\System\BQgeZqx.exe
  2⤵
  PID:9420
- C:\Windows\System\hBkXQts.exe
  C:\Windows\System\hBkXQts.exe
  2⤵
  PID:9440
- C:\Windows\System\PjoKcvS.exe
  C:\Windows\System\PjoKcvS.exe
  2⤵
  PID:9464
- C:\Windows\System\mbnmFDy.exe
  C:\Windows\System\mbnmFDy.exe
  2⤵
  PID:9484
- C:\Windows\System\aVvLGWf.exe
  C:\Windows\System\aVvLGWf.exe
  2⤵
  PID:9504
- C:\Windows\System\xUxNuAI.exe
  C:\Windows\System\xUxNuAI.exe
  2⤵
  PID:9528
- C:\Windows\System\bfZzyPX.exe
  C:\Windows\System\bfZzyPX.exe
  2⤵
  PID:9560
- C:\Windows\System\FIVqpvF.exe
  C:\Windows\System\FIVqpvF.exe
  2⤵
  PID:9584
- C:\Windows\System\nqXoYaN.exe
  C:\Windows\System\nqXoYaN.exe
  2⤵
  PID:9608
- C:\Windows\System\geShlYY.exe
  C:\Windows\System\geShlYY.exe
  2⤵
  PID:9632
- C:\Windows\System\avAhGmk.exe
  C:\Windows\System\avAhGmk.exe
  2⤵
  PID:9648
- C:\Windows\System\YrXGPyF.exe
  C:\Windows\System\YrXGPyF.exe
  2⤵
  PID:9676
- C:\Windows\System\JQVSzrd.exe
  C:\Windows\System\JQVSzrd.exe
  2⤵
  PID:9732
- C:\Windows\System\CsllqTe.exe
  C:\Windows\System\CsllqTe.exe
  2⤵
  PID:9884
- C:\Windows\System\gQBUVJI.exe
  C:\Windows\System\gQBUVJI.exe
  2⤵
  PID:9908
- C:\Windows\System\puIYZlL.exe
  C:\Windows\System\puIYZlL.exe
  2⤵
  PID:9928
- C:\Windows\System\riKqALR.exe
  C:\Windows\System\riKqALR.exe
  2⤵
  PID:9952
- C:\Windows\System\coMRTwy.exe
  C:\Windows\System\coMRTwy.exe
  2⤵
  PID:9976
- C:\Windows\System\sSuYTGN.exe
  C:\Windows\System\sSuYTGN.exe
  2⤵
  PID:9996
- C:\Windows\System\WxqtpJD.exe
  C:\Windows\System\WxqtpJD.exe
  2⤵
  PID:10028
- C:\Windows\System\ekUuKXt.exe
  C:\Windows\System\ekUuKXt.exe
  2⤵
  PID:10044
- C:\Windows\System\PfpqQDb.exe
  C:\Windows\System\PfpqQDb.exe
  2⤵
  PID:10068
- C:\Windows\System\ghFNVdT.exe
  C:\Windows\System\ghFNVdT.exe
  2⤵
  PID:10096
- C:\Windows\System\nvAbLyt.exe
  C:\Windows\System\nvAbLyt.exe
  2⤵
  PID:10112
- C:\Windows\System\lgHEgcF.exe
  C:\Windows\System\lgHEgcF.exe
  2⤵
  PID:10128
- C:\Windows\System\zmUdQvl.exe
  C:\Windows\System\zmUdQvl.exe
  2⤵
  PID:10148
- C:\Windows\System\CgraWeC.exe
  C:\Windows\System\CgraWeC.exe
  2⤵
  PID:10168
- C:\Windows\System\AWOWvNs.exe
  C:\Windows\System\AWOWvNs.exe
  2⤵
  PID:10192
- C:\Windows\System\ufsnNfl.exe
  C:\Windows\System\ufsnNfl.exe
  2⤵
  PID:10208
- C:\Windows\System\npvKnbb.exe
  C:\Windows\System\npvKnbb.exe
  2⤵
  PID:10224
- C:\Windows\System\TSCkCiA.exe
  C:\Windows\System\TSCkCiA.exe
  2⤵
  PID:7776
- C:\Windows\System\yKJkQCD.exe
  C:\Windows\System\yKJkQCD.exe
  2⤵
  PID:8608
- C:\Windows\System\GCyZsim.exe
  C:\Windows\System\GCyZsim.exe
  2⤵
  PID:8680
- C:\Windows\System\WMyKmkP.exe
  C:\Windows\System\WMyKmkP.exe
  2⤵
  PID:8732
- C:\Windows\System\GEAgKZu.exe
  C:\Windows\System\GEAgKZu.exe
  2⤵
  PID:8764
- C:\Windows\System\odgFoOS.exe
  C:\Windows\System\odgFoOS.exe
  2⤵
  PID:8820
- C:\Windows\System\SrfUMWL.exe
  C:\Windows\System\SrfUMWL.exe
  2⤵
  PID:8852
- C:\Windows\System\iEOXkBj.exe
  C:\Windows\System\iEOXkBj.exe
  2⤵
  PID:8972
- C:\Windows\System\wKIEnlC.exe
  C:\Windows\System\wKIEnlC.exe
  2⤵
  PID:8936
- C:\Windows\System\KFQIrQJ.exe
  C:\Windows\System\KFQIrQJ.exe
  2⤵
  PID:9032
- C:\Windows\System\KKeuPuy.exe
  C:\Windows\System\KKeuPuy.exe
  2⤵
  PID:6236
- C:\Windows\System\zgbQPGn.exe
  C:\Windows\System\zgbQPGn.exe
  2⤵
  PID:7212
- C:\Windows\System\osHiCKh.exe
  C:\Windows\System\osHiCKh.exe
  2⤵
  PID:9284
- C:\Windows\System\vOKvusU.exe
  C:\Windows\System\vOKvusU.exe
  2⤵
  PID:9316
- C:\Windows\System\rHCHcnX.exe
  C:\Windows\System\rHCHcnX.exe
  2⤵
  PID:9384
- C:\Windows\System\KqkBfZU.exe
  C:\Windows\System\KqkBfZU.exe
  2⤵
  PID:7888
- C:\Windows\System\SwUduaq.exe
  C:\Windows\System\SwUduaq.exe
  2⤵
  PID:9476
- C:\Windows\System\bwwJJea.exe
  C:\Windows\System\bwwJJea.exe
  2⤵
  PID:9656
- C:\Windows\System\IeILLJN.exe
  C:\Windows\System\IeILLJN.exe
  2⤵
  PID:9168
- C:\Windows\System\iNgXHXK.exe
  C:\Windows\System\iNgXHXK.exe
  2⤵
  PID:9748
- C:\Windows\System\sXbEudE.exe
  C:\Windows\System\sXbEudE.exe
  2⤵
  PID:9752
- C:\Windows\System\uHSzvQT.exe
  C:\Windows\System\uHSzvQT.exe
  2⤵
  PID:9204
- C:\Windows\System\fQwaBfQ.exe
  C:\Windows\System\fQwaBfQ.exe
  2⤵
  PID:8200
- C:\Windows\System\ESeUSRl.exe
  C:\Windows\System\ESeUSRl.exe
  2⤵
  PID:7356
- C:\Windows\System\CuMmEwo.exe
  C:\Windows\System\CuMmEwo.exe
  2⤵
  PID:4724
- C:\Windows\System\gWqkRPb.exe
  C:\Windows\System\gWqkRPb.exe
  2⤵
  PID:9332
- C:\Windows\System\stPuLAX.exe
  C:\Windows\System\stPuLAX.exe
  2⤵
  PID:10256
- C:\Windows\System\fRkxkCQ.exe
  C:\Windows\System\fRkxkCQ.exe
  2⤵
  PID:10276
- C:\Windows\System\NsmXzox.exe
  C:\Windows\System\NsmXzox.exe
  2⤵
  PID:10304
- C:\Windows\System\xhgyHiP.exe
  C:\Windows\System\xhgyHiP.exe
  2⤵
  PID:10324
- C:\Windows\System\EMwQhAx.exe
  C:\Windows\System\EMwQhAx.exe
  2⤵
  PID:10344
- C:\Windows\System\txEITfN.exe
  C:\Windows\System\txEITfN.exe
  2⤵
  PID:10364
- C:\Windows\System\JbPwKbi.exe
  C:\Windows\System\JbPwKbi.exe
  2⤵
  PID:10388
- C:\Windows\System\bVpSwGt.exe
  C:\Windows\System\bVpSwGt.exe
  2⤵
  PID:10412
- C:\Windows\System\biOgjTe.exe
  C:\Windows\System\biOgjTe.exe
  2⤵
  PID:10428
- C:\Windows\System\AIYHPhg.exe
  C:\Windows\System\AIYHPhg.exe
  2⤵
  PID:10452
- C:\Windows\System\HZoBZws.exe
  C:\Windows\System\HZoBZws.exe
  2⤵
  PID:10484
- C:\Windows\System\VMZWWZl.exe
  C:\Windows\System\VMZWWZl.exe
  2⤵
  PID:10500
- C:\Windows\System\pZkWNPK.exe
  C:\Windows\System\pZkWNPK.exe
  2⤵
  PID:10516
- C:\Windows\System\qZSfqlZ.exe
  C:\Windows\System\qZSfqlZ.exe
  2⤵
  PID:10560
- C:\Windows\System\vnBFsTM.exe
  C:\Windows\System\vnBFsTM.exe
  2⤵
  PID:10580
- C:\Windows\System\LHVJKoB.exe
  C:\Windows\System\LHVJKoB.exe
  2⤵
  PID:10604
- C:\Windows\System\qdZxLbI.exe
  C:\Windows\System\qdZxLbI.exe
  2⤵
  PID:10620
- C:\Windows\System\mrFULGC.exe
  C:\Windows\System\mrFULGC.exe
  2⤵
  PID:10636
- C:\Windows\System\SfOKSZV.exe
  C:\Windows\System\SfOKSZV.exe
  2⤵
  PID:10652
- C:\Windows\System\qOYEsRG.exe
  C:\Windows\System\qOYEsRG.exe
  2⤵
  PID:10680
- C:\Windows\System\djyTJKh.exe
  C:\Windows\System\djyTJKh.exe
  2⤵
  PID:10700
- C:\Windows\System\ZveKEBw.exe
  C:\Windows\System\ZveKEBw.exe
  2⤵
  PID:10724
- C:\Windows\System\DypsqmS.exe
  C:\Windows\System\DypsqmS.exe
  2⤵
  PID:10748
- C:\Windows\System\OMZFyDy.exe
  C:\Windows\System\OMZFyDy.exe
  2⤵
  PID:10772
- C:\Windows\System\WeDWDGS.exe
  C:\Windows\System\WeDWDGS.exe
  2⤵
  PID:10796
- C:\Windows\System\TTEmvum.exe
  C:\Windows\System\TTEmvum.exe
  2⤵
  PID:10824
- C:\Windows\System\YQZiQWu.exe
  C:\Windows\System\YQZiQWu.exe
  2⤵
  PID:10844
- C:\Windows\System\jAqhKUm.exe
  C:\Windows\System\jAqhKUm.exe
  2⤵
  PID:10864
- C:\Windows\System\UYMElPr.exe
  C:\Windows\System\UYMElPr.exe
  2⤵
  PID:10912
- C:\Windows\System\bDsWjNr.exe
  C:\Windows\System\bDsWjNr.exe
  2⤵
  PID:10940
- C:\Windows\System\iGHdVRO.exe
  C:\Windows\System\iGHdVRO.exe
  2⤵
  PID:10960
- C:\Windows\System\GYJaRmm.exe
  C:\Windows\System\GYJaRmm.exe
  2⤵
  PID:10980
- C:\Windows\System\qqFfZEe.exe
  C:\Windows\System\qqFfZEe.exe
  2⤵
  PID:11008
- C:\Windows\System\VxmYyVy.exe
  C:\Windows\System\VxmYyVy.exe
  2⤵
  PID:11032
- C:\Windows\System\BneISeu.exe
  C:\Windows\System\BneISeu.exe
  2⤵
  PID:11052
- C:\Windows\System\KkqFIxl.exe
  C:\Windows\System\KkqFIxl.exe
  2⤵
  PID:11088
- C:\Windows\System\HPJYUqu.exe
  C:\Windows\System\HPJYUqu.exe
  2⤵
  PID:11108
- C:\Windows\System\Qmhizqc.exe
  C:\Windows\System\Qmhizqc.exe
  2⤵
  PID:11128
- C:\Windows\System\sIfKEVv.exe
  C:\Windows\System\sIfKEVv.exe
  2⤵
  PID:11152
- C:\Windows\System\oOvyrtJ.exe
  C:\Windows\System\oOvyrtJ.exe
  2⤵
  PID:11172
- C:\Windows\System\rTtQGdl.exe
  C:\Windows\System\rTtQGdl.exe
  2⤵
  PID:11192
- C:\Windows\System\UrECJNe.exe
  C:\Windows\System\UrECJNe.exe
  2⤵
  PID:11212
- C:\Windows\System\tEgCxCO.exe
  C:\Windows\System\tEgCxCO.exe
  2⤵
  PID:11228
- C:\Windows\System\LcFmybS.exe
  C:\Windows\System\LcFmybS.exe
  2⤵
  PID:9920
- C:\Windows\System\COUquuz.exe
  C:\Windows\System\COUquuz.exe
  2⤵
  PID:7896
- C:\Windows\System\PZlmhzz.exe
  C:\Windows\System\PZlmhzz.exe
  2⤵
  PID:9988
- C:\Windows\System\uCGKUWN.exe
  C:\Windows\System\uCGKUWN.exe
  2⤵
  PID:10060
- C:\Windows\System\HVOgJKJ.exe
  C:\Windows\System\HVOgJKJ.exe
  2⤵
  PID:10188
- C:\Windows\System\GmEZsiS.exe
  C:\Windows\System\GmEZsiS.exe
  2⤵
  PID:2916
- C:\Windows\System\mOagoKJ.exe
  C:\Windows\System\mOagoKJ.exe
  2⤵
  PID:6760
- C:\Windows\System\wZHIzjJ.exe
  C:\Windows\System\wZHIzjJ.exe
  2⤵
  PID:7172
- C:\Windows\System\DFwhmLL.exe
  C:\Windows\System\DFwhmLL.exe
  2⤵
  PID:8456
- C:\Windows\System\DnpCiwP.exe
  C:\Windows\System\DnpCiwP.exe
  2⤵
  PID:8548
- C:\Windows\System\bAlckzk.exe
  C:\Windows\System\bAlckzk.exe
  2⤵
  PID:7256
- C:\Windows\System\ekjHZRQ.exe
  C:\Windows\System\ekjHZRQ.exe
  2⤵
  PID:7536
- C:\Windows\System\ikuFQsD.exe
  C:\Windows\System\ikuFQsD.exe
  2⤵
  PID:7120
- C:\Windows\System\NeLLVhQ.exe
  C:\Windows\System\NeLLVhQ.exe
  2⤵
  PID:9180
- C:\Windows\System\IaykiNi.exe
  C:\Windows\System\IaykiNi.exe
  2⤵
  PID:2520
- C:\Windows\System\DMWNeIL.exe
  C:\Windows\System\DMWNeIL.exe
  2⤵
  PID:9436
- C:\Windows\System\pcCYBRW.exe
  C:\Windows\System\pcCYBRW.exe
  2⤵
  PID:9524
- C:\Windows\System\zHFPIPf.exe
  C:\Windows\System\zHFPIPf.exe
  2⤵
  PID:10036
- C:\Windows\System\gSHYOdk.exe
  C:\Windows\System\gSHYOdk.exe
  2⤵
  PID:9552
- C:\Windows\System\rbXrIEx.exe
  C:\Windows\System\rbXrIEx.exe
  2⤵
  PID:9576
- C:\Windows\System\irFQcKj.exe
  C:\Windows\System\irFQcKj.exe
  2⤵
  PID:2388
- C:\Windows\System\aUBfuHo.exe
  C:\Windows\System\aUBfuHo.exe
  2⤵
  PID:10204
- C:\Windows\System\eSKeMTt.exe
  C:\Windows\System\eSKeMTt.exe
  2⤵
  PID:9692
- C:\Windows\System\nssaDCk.exe
  C:\Windows\System\nssaDCk.exe
  2⤵
  PID:9708
- C:\Windows\System\eLatIXP.exe
  C:\Windows\System\eLatIXP.exe
  2⤵
  PID:2296
- C:\Windows\System\Ahfudhl.exe
  C:\Windows\System\Ahfudhl.exe
  2⤵
  PID:8872
- C:\Windows\System\wtOYKFT.exe
  C:\Windows\System\wtOYKFT.exe
  2⤵
  PID:9784
- C:\Windows\System\jPGxfJZ.exe
  C:\Windows\System\jPGxfJZ.exe
  2⤵
  PID:5404
- C:\Windows\System\IXgiJBD.exe
  C:\Windows\System\IXgiJBD.exe
  2⤵
  PID:7676
- C:\Windows\System\iyabgGv.exe
  C:\Windows\System\iyabgGv.exe
  2⤵
  PID:8264
- C:\Windows\System\xTjrNbl.exe
  C:\Windows\System\xTjrNbl.exe
  2⤵
  PID:9892
- C:\Windows\System\bkRKXUw.exe
  C:\Windows\System\bkRKXUw.exe
  2⤵
  PID:10332
- C:\Windows\System\kZGlOVZ.exe
  C:\Windows\System\kZGlOVZ.exe
  2⤵
  PID:11272
- C:\Windows\System\rmKcqnL.exe
  C:\Windows\System\rmKcqnL.exe
  2⤵
  PID:11300
- C:\Windows\System\PWzDsQh.exe
  C:\Windows\System\PWzDsQh.exe
  2⤵
  PID:11316
- C:\Windows\System\sClGMJp.exe
  C:\Windows\System\sClGMJp.exe
  2⤵
  PID:11340
- C:\Windows\System\ozOupAU.exe
  C:\Windows\System\ozOupAU.exe
  2⤵
  PID:11360
- C:\Windows\System\zmymGzg.exe
  C:\Windows\System\zmymGzg.exe
  2⤵
  PID:11384
- C:\Windows\System\iIPmdYg.exe
  C:\Windows\System\iIPmdYg.exe
  2⤵
  PID:11404
- C:\Windows\System\JgfwEDd.exe
  C:\Windows\System\JgfwEDd.exe
  2⤵
  PID:11428
- C:\Windows\System\RlfWAas.exe
  C:\Windows\System\RlfWAas.exe
  2⤵
  PID:11448
- C:\Windows\System\VzLXksA.exe
  C:\Windows\System\VzLXksA.exe
  2⤵
  PID:11468
- C:\Windows\System\PkiUAXG.exe
  C:\Windows\System\PkiUAXG.exe
  2⤵
  PID:11488
- C:\Windows\System\MzXxmkF.exe
  C:\Windows\System\MzXxmkF.exe
  2⤵
  PID:11512
- C:\Windows\System\arHQspM.exe
  C:\Windows\System\arHQspM.exe
  2⤵
  PID:11528
- C:\Windows\System\upbpxOs.exe
  C:\Windows\System\upbpxOs.exe
  2⤵
  PID:11552
- C:\Windows\System\oEmXixY.exe
  C:\Windows\System\oEmXixY.exe
  2⤵
  PID:11572
- C:\Windows\System\QfhpTFr.exe
  C:\Windows\System\QfhpTFr.exe
  2⤵
  PID:11592
- C:\Windows\System\vCtUqkF.exe
  C:\Windows\System\vCtUqkF.exe
  2⤵
  PID:11612
- C:\Windows\System\GmGQvyM.exe
  C:\Windows\System\GmGQvyM.exe
  2⤵
  PID:11636
- C:\Windows\System\zwAkIyW.exe
  C:\Windows\System\zwAkIyW.exe
  2⤵
  PID:11656
- C:\Windows\System\OXwmxtR.exe
  C:\Windows\System\OXwmxtR.exe
  2⤵
  PID:11680
- C:\Windows\System\kRGDqiG.exe
  C:\Windows\System\kRGDqiG.exe
  2⤵
  PID:11700
- C:\Windows\System\gHPiqNL.exe
  C:\Windows\System\gHPiqNL.exe
  2⤵
  PID:11728
- C:\Windows\System\FXzSMEn.exe
  C:\Windows\System\FXzSMEn.exe
  2⤵
  PID:11744
- C:\Windows\System\fYiEfyQ.exe
  C:\Windows\System\fYiEfyQ.exe
  2⤵
  PID:11768
- C:\Windows\System\GleAdzK.exe
  C:\Windows\System\GleAdzK.exe
  2⤵
  PID:11792
- C:\Windows\System\gVbrAot.exe
  C:\Windows\System\gVbrAot.exe
  2⤵
  PID:11816
- C:\Windows\System\xtblxEf.exe
  C:\Windows\System\xtblxEf.exe
  2⤵
  PID:11836
- C:\Windows\System\KpWMbeL.exe
  C:\Windows\System\KpWMbeL.exe
  2⤵
  PID:11884
- C:\Windows\System\fDWdEPo.exe
  C:\Windows\System\fDWdEPo.exe
  2⤵
  PID:8888
- C:\Windows\System\RvyCHAh.exe
  C:\Windows\System\RvyCHAh.exe
  2⤵
  PID:4820
- C:\Windows\System\LGQXPHe.exe
  C:\Windows\System\LGQXPHe.exe
  2⤵
  PID:11776
- C:\Windows\System\zVpuziQ.exe
  C:\Windows\System\zVpuziQ.exe
  2⤵
  PID:1144
- C:\Windows\System\EmYrVVK.exe
  C:\Windows\System\EmYrVVK.exe
  2⤵
  PID:10596
- C:\Windows\System\CtjnCaa.exe
  C:\Windows\System\CtjnCaa.exe
  2⤵
  PID:1408
- C:\Windows\System\gYFrbki.exe
  C:\Windows\System\gYFrbki.exe
  2⤵
  PID:10832
- C:\Windows\System\ehOLEEY.exe
  C:\Windows\System\ehOLEEY.exe
  2⤵
  PID:10696
- C:\Windows\System\ZeKytoz.exe
  C:\Windows\System\ZeKytoz.exe
  2⤵
  PID:10976
- C:\Windows\System\QBAwEsL.exe
  C:\Windows\System\QBAwEsL.exe
  2⤵
  PID:9792
- C:\Windows\System\XQndXUA.exe
  C:\Windows\System\XQndXUA.exe
  2⤵
  PID:11948
- C:\Windows\System\fbngCKU.exe
  C:\Windows\System\fbngCKU.exe
  2⤵
  PID:11284
- C:\Windows\System\qjVTyAj.exe
  C:\Windows\System\qjVTyAj.exe
  2⤵
  PID:11324
- C:\Windows\System\WUlCiXF.exe
  C:\Windows\System\WUlCiXF.exe
  2⤵
  PID:11424
- C:\Windows\System\TrGdbEv.exe
  C:\Windows\System\TrGdbEv.exe
  2⤵
  PID:11444
- C:\Windows\System\cCdpPSv.exe
  C:\Windows\System\cCdpPSv.exe
  2⤵
  PID:11588
- C:\Windows\System\QSMWmBO.exe
  C:\Windows\System\QSMWmBO.exe
  2⤵
  PID:11788
- C:\Windows\System\EscmolQ.exe
  C:\Windows\System\EscmolQ.exe
  2⤵
  PID:8392
- C:\Windows\System\InRuFpV.exe
  C:\Windows\System\InRuFpV.exe
  2⤵
  PID:8436
- C:\Windows\System\VOnHMbN.exe
  C:\Windows\System\VOnHMbN.exe
  2⤵
  PID:4624
- C:\Windows\System\BwUtLcp.exe
  C:\Windows\System\BwUtLcp.exe
  2⤵
  PID:9356
- C:\Windows\System\HXKKwJF.exe
  C:\Windows\System\HXKKwJF.exe
  2⤵
  PID:9544
- C:\Windows\System\wYFLcsu.exe
  C:\Windows\System\wYFLcsu.exe
  2⤵
  PID:9684
- C:\Windows\System\SSiHbhT.exe
  C:\Windows\System\SSiHbhT.exe
  2⤵
  PID:8844
- C:\Windows\System\kGseRHS.exe
  C:\Windows\System\kGseRHS.exe
  2⤵
  PID:11160
- C:\Windows\System\tvuYYHt.exe
  C:\Windows\System\tvuYYHt.exe
  2⤵
  PID:11356
- C:\Windows\System\WVheAMk.exe
  C:\Windows\System\WVheAMk.exe
  2⤵
  PID:11464
- C:\Windows\System\JdGTdne.exe
  C:\Windows\System\JdGTdne.exe
  2⤵
  PID:11484
- C:\Windows\System\gbGhFRz.exe
  C:\Windows\System\gbGhFRz.exe
  2⤵
  PID:12092
- C:\Windows\System\ZnDemIg.exe
  C:\Windows\System\ZnDemIg.exe
  2⤵
  PID:12304
- C:\Windows\System\Sbwmvfs.exe
  C:\Windows\System\Sbwmvfs.exe
  2⤵
  PID:12320
- C:\Windows\System\uxNVDoV.exe
  C:\Windows\System\uxNVDoV.exe
  2⤵
  PID:12336
- C:\Windows\System\gzfJxPc.exe
  C:\Windows\System\gzfJxPc.exe
  2⤵
  PID:12356
- C:\Windows\System\wOdWKOZ.exe
  C:\Windows\System\wOdWKOZ.exe
  2⤵
  PID:12380
- C:\Windows\System\PkpAbqD.exe
  C:\Windows\System\PkpAbqD.exe
  2⤵
  PID:12404
- C:\Windows\System\HwmRfjo.exe
  C:\Windows\System\HwmRfjo.exe
  2⤵
  PID:12436
- C:\Windows\System\GxlRuNC.exe
  C:\Windows\System\GxlRuNC.exe
  2⤵
  PID:12464
- C:\Windows\System\JoFXpKr.exe
  C:\Windows\System\JoFXpKr.exe
  2⤵
  PID:12488
- C:\Windows\System\gBJurPI.exe
  C:\Windows\System\gBJurPI.exe
  2⤵
  PID:12508
- C:\Windows\System\jNmQhbv.exe
  C:\Windows\System\jNmQhbv.exe
  2⤵
  PID:12528
- C:\Windows\System\pxMxljm.exe
  C:\Windows\System\pxMxljm.exe
  2⤵
  PID:12544
- C:\Windows\System\JzZDkLR.exe
  C:\Windows\System\JzZDkLR.exe
  2⤵
  PID:12560
- C:\Windows\System\YXDRjkA.exe
  C:\Windows\System\YXDRjkA.exe
  2⤵
  PID:12584
- C:\Windows\System\UKJRMMT.exe
  C:\Windows\System\UKJRMMT.exe
  2⤵
  PID:12608
- C:\Windows\System\ySRoHvm.exe
  C:\Windows\System\ySRoHvm.exe
  2⤵
  PID:12632
- C:\Windows\System\gIJcVdm.exe
  C:\Windows\System\gIJcVdm.exe
  2⤵
  PID:12656
- C:\Windows\System\OpQoVgO.exe
  C:\Windows\System\OpQoVgO.exe
  2⤵
  PID:12692
- C:\Windows\System\fHgdugU.exe
  C:\Windows\System\fHgdugU.exe
  2⤵
  PID:12716
- C:\Windows\System\DTtEUxp.exe
  C:\Windows\System\DTtEUxp.exe
  2⤵
  PID:12732
- C:\Windows\System\rXlVcHK.exe
  C:\Windows\System\rXlVcHK.exe
  2⤵
  PID:12756
- C:\Windows\System\vAzcdxe.exe
  C:\Windows\System\vAzcdxe.exe
  2⤵
  PID:12780
- C:\Windows\System\komrkra.exe
  C:\Windows\System\komrkra.exe
  2⤵
  PID:12804
- C:\Windows\System\kgrMehd.exe
  C:\Windows\System\kgrMehd.exe
  2⤵
  PID:12828
- C:\Windows\System\sRvuiQT.exe
  C:\Windows\System\sRvuiQT.exe
  2⤵
  PID:12848
- C:\Windows\System\rfMWmBc.exe
  C:\Windows\System\rfMWmBc.exe
  2⤵
  PID:12328
- C:\Windows\System\ePTjprG.exe
  C:\Windows\System\ePTjprG.exe
  2⤵
  PID:1724
- C:\Windows\System\KkTlDHL.exe
  C:\Windows\System\KkTlDHL.exe
  2⤵
  PID:12988
- C:\Windows\System\YKHHlIf.exe
  C:\Windows\System\YKHHlIf.exe
  2⤵
  PID:12444
- C:\Windows\System\qxavwPr.exe
  C:\Windows\System\qxavwPr.exe
  2⤵
  PID:11020
- C:\Windows\System\afQNABW.exe
  C:\Windows\System\afQNABW.exe
  2⤵
  PID:10296
- C:\Windows\System\VeeNHkn.exe
  C:\Windows\System\VeeNHkn.exe
  2⤵
  PID:12456
- C:\Windows\System\MswvScX.exe
  C:\Windows\System\MswvScX.exe
  2⤵
  PID:12500
- C:\Windows\System\rHnNwFM.exe
  C:\Windows\System\rHnNwFM.exe
  2⤵
  PID:12600
- C:\Windows\System\RjVwEeQ.exe
  C:\Windows\System\RjVwEeQ.exe
  2⤵
  PID:12676
- C:\Windows\System\BUezqya.exe
  C:\Windows\System\BUezqya.exe
  2⤵
  PID:13172
- C:\Windows\System\Riuahbu.exe
  C:\Windows\System\Riuahbu.exe
  2⤵
  PID:12948
- C:\Windows\System\RCYdYUz.exe
  C:\Windows\System\RCYdYUz.exe
  2⤵
  PID:13136
- C:\Windows\System\vAaLUax.exe
  C:\Windows\System\vAaLUax.exe
  2⤵
  PID:13092
- C:\Windows\System\hcXyPbs.exe
  C:\Windows\System\hcXyPbs.exe
  2⤵
  PID:13284
- C:\Windows\System\MWvJmdU.exe
  C:\Windows\System\MWvJmdU.exe
  2⤵
  PID:13140
- C:\Windows\System\uCBsseR.exe
  C:\Windows\System\uCBsseR.exe
  2⤵
  PID:13268
- C:\Windows\System\rdllOfa.exe
  C:\Windows\System\rdllOfa.exe
  2⤵
  PID:13308
- C:\Windows\System\SxIfZHK.exe
  C:\Windows\System\SxIfZHK.exe
  2⤵
  PID:13224
- C:\Windows\System\vtVROhL.exe
  C:\Windows\System\vtVROhL.exe
  2⤵
  PID:13244
- C:\Windows\System\VjZHljI.exe
  C:\Windows\System\VjZHljI.exe
  2⤵
  PID:12252
- C:\Windows\System\GjdjyBC.exe
  C:\Windows\System\GjdjyBC.exe
  2⤵
  PID:12516
- C:\Windows\System\UiLgqNm.exe
  C:\Windows\System\UiLgqNm.exe
  2⤵
  PID:884
- C:\Windows\System\LjwEFjb.exe
  C:\Windows\System\LjwEFjb.exe
  2⤵
  PID:1096
- C:\Windows\System\MRbJthJ.exe
  C:\Windows\System\MRbJthJ.exe
  2⤵
  PID:8676
- C:\Windows\System\uzzNXpU.exe
  C:\Windows\System\uzzNXpU.exe
  2⤵
  PID:7432
- C:\Windows\System\ttECbam.exe
  C:\Windows\System\ttECbam.exe
  2⤵
  PID:1192
- C:\Windows\System\wAxKqwv.exe
  C:\Windows\System\wAxKqwv.exe
  2⤵
  PID:10108
- C:\Windows\System\nMghDzj.exe
  C:\Windows\System\nMghDzj.exe
  2⤵
  PID:6720
- C:\Windows\System\TzjPInp.exe
  C:\Windows\System\TzjPInp.exe
  2⤵
  PID:3576
- C:\Windows\System\VZrpaDi.exe
  C:\Windows\System\VZrpaDi.exe
  2⤵
  PID:12872
- C:\Windows\System\CVOADSC.exe
  C:\Windows\System\CVOADSC.exe
  2⤵
  PID:11420
- C:\Windows\System\ZsCxrJE.exe
  C:\Windows\System\ZsCxrJE.exe
  2⤵
  PID:12944
- C:\Windows\System\dripHcd.exe
  C:\Windows\System\dripHcd.exe
  2⤵
  PID:12524
- C:\Windows\System\biXUSmX.exe
  C:\Windows\System\biXUSmX.exe
  2⤵
  PID:11068
- C:\Windows\System\wHHNecW.exe
  C:\Windows\System\wHHNecW.exe
  2⤵
  PID:2260
- C:\Windows\System\FiMbiot.exe
  C:\Windows\System\FiMbiot.exe
  2⤵
  PID:2192
- C:\Windows\System\RIOyWNx.exe
  C:\Windows\System\RIOyWNx.exe
  2⤵
  PID:3460
- C:\Windows\System\ConVbMl.exe
  C:\Windows\System\ConVbMl.exe
  2⤵
  PID:12052
- C:\Windows\System\EMdwiVX.exe
  C:\Windows\System\EMdwiVX.exe
  2⤵
  PID:8908
- C:\Windows\System\hTDZsNN.exe
  C:\Windows\System\hTDZsNN.exe
  2⤵
  PID:11648
- C:\Windows\System\EYVfrlq.exe
  C:\Windows\System\EYVfrlq.exe
  2⤵
  PID:4524
- C:\Windows\System\FOamhIU.exe
  C:\Windows\System\FOamhIU.exe
  2⤵
  PID:11564
- C:\Windows\System\wRDYcXJ.exe
  C:\Windows\System\wRDYcXJ.exe
  2⤵
  PID:648
- C:\Windows\System\iDHCTXI.exe
  C:\Windows\System\iDHCTXI.exe
  2⤵
  PID:11880
- C:\Windows\System\jIYErsI.exe
  C:\Windows\System\jIYErsI.exe
  2⤵
  PID:13004
- C:\Windows\System\UAukdOl.exe
  C:\Windows\System\UAukdOl.exe
  2⤵
  PID:12580
- C:\Windows\System\zSYnbwr.exe
  C:\Windows\System\zSYnbwr.exe
  2⤵
  PID:13196
- C:\Windows\System\JdGZJRr.exe
  C:\Windows\System\JdGZJRr.exe
  2⤵
  PID:13120
- C:\Windows\System\cScaAVM.exe
  C:\Windows\System\cScaAVM.exe
  2⤵
  PID:8520
- C:\Windows\System\NGiGPIo.exe
  C:\Windows\System\NGiGPIo.exe
  2⤵
  PID:13112
- C:\Windows\System\TDBFUJJ.exe
  C:\Windows\System\TDBFUJJ.exe
  2⤵
  PID:11460
- C:\Windows\System\FJeChEY.exe
  C:\Windows\System\FJeChEY.exe
  2⤵
  PID:6960
- C:\Windows\System\IJpAaqr.exe
  C:\Windows\System\IJpAaqr.exe
  2⤵
  PID:10372
- C:\Windows\System\kZFgofI.exe
  C:\Windows\System\kZFgofI.exe
  2⤵
  PID:224
- C:\Windows\System\XoGlgOE.exe
  C:\Windows\System\XoGlgOE.exe
  2⤵
  PID:11332
- C:\Windows\System\kaVXBGU.exe
  C:\Windows\System\kaVXBGU.exe
  2⤵
  PID:5164
- C:\Windows\System\eEPUxhB.exe
  C:\Windows\System\eEPUxhB.exe
  2⤵
  PID:12628
- C:\Windows\System\lcxwfdI.exe
  C:\Windows\System\lcxwfdI.exe
  2⤵
  PID:12344
- C:\Windows\System\wmNnWtW.exe
  C:\Windows\System\wmNnWtW.exe
  2⤵
  PID:10784
- C:\Windows\System\Ahzcqcl.exe
  C:\Windows\System\Ahzcqcl.exe
  2⤵
  PID:5296
- C:\Windows\System\yTxAssh.exe
  C:\Windows\System\yTxAssh.exe
  2⤵
  PID:12504
- C:\Windows\System\OKSHZtc.exe
  C:\Windows\System\OKSHZtc.exe
  2⤵
  PID:548
- C:\Windows\System\dqUMJFI.exe
  C:\Windows\System\dqUMJFI.exe
  2⤵
  PID:9828
- C:\Windows\System\lpMJJuD.exe
  C:\Windows\System\lpMJJuD.exe
  2⤵
  PID:11832
- C:\Windows\System\LoOqqig.exe
  C:\Windows\System\LoOqqig.exe
  2⤵
  PID:2264
- C:\Windows\System\rBAHgYR.exe
  C:\Windows\System\rBAHgYR.exe
  2⤵
  PID:12540
- C:\Windows\System\enOlLgQ.exe
  C:\Windows\System\enOlLgQ.exe
  2⤵
  PID:4012
- C:\Windows\System\gmQAzAb.exe
  C:\Windows\System\gmQAzAb.exe
  2⤵
  PID:12772
- C:\Windows\System\GrwgkHK.exe
  C:\Windows\System\GrwgkHK.exe
  2⤵
  PID:12240
- C:\Windows\System\rOIijjh.exe
  C:\Windows\System\rOIijjh.exe
  2⤵
  PID:2004
- C:\Windows\System\THQaymK.exe
  C:\Windows\System\THQaymK.exe
  2⤵
  PID:5236
- C:\Windows\System\qiAdozg.exe
  C:\Windows\System\qiAdozg.exe
  2⤵
  PID:968
- C:\Windows\System\UqlkiUs.exe
  C:\Windows\System\UqlkiUs.exe
  2⤵
  PID:4800
- C:\Windows\System\AGSqzBE.exe
  C:\Windows\System\AGSqzBE.exe
  2⤵
  PID:3292
- C:\Windows\System\JOXhwIC.exe
  C:\Windows\System\JOXhwIC.exe
  2⤵
  PID:856
- C:\Windows\System\oblzjGy.exe
  C:\Windows\System\oblzjGy.exe
  2⤵
  PID:540
- C:\Windows\System\ObPkldy.exe
  C:\Windows\System\ObPkldy.exe
  2⤵
  PID:2336
- C:\Windows\System\VmtPxIs.exe
  C:\Windows\System\VmtPxIs.exe
  2⤵
  PID:13184
- C:\Windows\System\CvCVmbz.exe
  C:\Windows\System\CvCVmbz.exe
  2⤵
  PID:4844
- C:\Windows\System\EExDttf.exe
  C:\Windows\System\EExDttf.exe
  2⤵
  PID:5852
- C:\Windows\System\lohhAJN.exe
  C:\Windows\System\lohhAJN.exe
  2⤵
  PID:4924
- C:\Windows\System\UWViMhn.exe
  C:\Windows\System\UWViMhn.exe
  2⤵
  PID:4428
- C:\Windows\System\LdvSFCb.exe
  C:\Windows\System\LdvSFCb.exe
  2⤵
  PID:1972
- C:\Windows\System\SpxxWEf.exe
  C:\Windows\System\SpxxWEf.exe
  2⤵
  PID:4424
- C:\Windows\System\izkuYXg.exe
  C:\Windows\System\izkuYXg.exe
  2⤵
  PID:2144
- C:\Windows\System\sTLGBso.exe
  C:\Windows\System\sTLGBso.exe
  2⤵
  PID:5132
- C:\Windows\System\zobxmZT.exe
  C:\Windows\System\zobxmZT.exe
  2⤵
  PID:3712
- C:\Windows\System\NILkLQP.exe
  C:\Windows\System\NILkLQP.exe
  2⤵
  PID:1124
- C:\Windows\System\LYPayNV.exe
  C:\Windows\System\LYPayNV.exe
  2⤵
  PID:2460
- C:\Windows\System\qdThbnd.exe
  C:\Windows\System\qdThbnd.exe
  2⤵
  PID:4716
- C:\Windows\System\dsDpjbc.exe
  C:\Windows\System\dsDpjbc.exe
  2⤵
  PID:1728
- C:\Windows\System\SqZKaet.exe
  C:\Windows\System\SqZKaet.exe
  2⤵
  PID:5820
- C:\Windows\System\OqacbQl.exe
  C:\Windows\System\OqacbQl.exe
  2⤵
  PID:5428
- C:\Windows\System\EdxSyId.exe
  C:\Windows\System\EdxSyId.exe
  2⤵
  PID:5188
- C:\Windows\System\CmNoEfn.exe
  C:\Windows\System\CmNoEfn.exe
  2⤵
  PID:2532
- C:\Windows\System\XODGBrj.exe
  C:\Windows\System\XODGBrj.exe
  2⤵
  PID:5344
- C:\Windows\System\CCPJPjU.exe
  C:\Windows\System\CCPJPjU.exe
  2⤵
  PID:5836
- C:\Windows\System\AqrxsNL.exe
  C:\Windows\System\AqrxsNL.exe
  2⤵
  PID:6016
- C:\Windows\System\thjRpNV.exe
  C:\Windows\System\thjRpNV.exe
  2⤵
  PID:3664
- C:\Windows\System\loCTmua.exe
  C:\Windows\System\loCTmua.exe
  2⤵
  PID:5644
- C:\Windows\System\FWWCkKE.exe
  C:\Windows\System\FWWCkKE.exe
  2⤵
  PID:6112
- C:\Windows\System\iVyzAKO.exe
  C:\Windows\System\iVyzAKO.exe
  2⤵
  PID:5812
- C:\Windows\System\TlJQAPo.exe
  C:\Windows\System\TlJQAPo.exe
  2⤵
  PID:532
- C:\Windows\System\fytZphn.exe
  C:\Windows\System\fytZphn.exe
  2⤵
  PID:5668
- C:\Windows\System\fdYvFTx.exe
  C:\Windows\System\fdYvFTx.exe
  2⤵
  PID:4928
- C:\Windows\System\rmpRfzR.exe
  C:\Windows\System\rmpRfzR.exe
  2⤵
  PID:744
- C:\Windows\System\GzSduTr.exe
  C:\Windows\System\GzSduTr.exe
  2⤵
  PID:3652
- C:\Windows\System\OZQBofb.exe
  C:\Windows\System\OZQBofb.exe
  2⤵
  PID:2176
- C:\Windows\System\foylRbh.exe
  C:\Windows\System\foylRbh.exe
  2⤵
  PID:6012
- C:\Windows\System\UoHYtOd.exe
  C:\Windows\System\UoHYtOd.exe
  2⤵
  PID:4212
- C:\Windows\System\FSPFXVD.exe
  C:\Windows\System\FSPFXVD.exe
  2⤵
  PID:7008
- C:\Windows\System\sIgkShf.exe
  C:\Windows\System\sIgkShf.exe
  2⤵
  PID:11584
- C:\Windows\System\yahfucB.exe
  C:\Windows\System\yahfucB.exe
  2⤵
  PID:3280
- C:\Windows\System\qJTchQj.exe
  C:\Windows\System\qJTchQj.exe
  2⤵
  PID:4384
- C:\Windows\System\jdoAWyh.exe
  C:\Windows\System\jdoAWyh.exe
  2⤵
  PID:5816
- C:\Windows\System\MuZYiFh.exe
  C:\Windows\System\MuZYiFh.exe
  2⤵
  PID:5400
- C:\Windows\System\XXCAjnX.exe
  C:\Windows\System\XXCAjnX.exe
  2⤵
  PID:1476
- C:\Windows\System\pdZjSJP.exe
  C:\Windows\System\pdZjSJP.exe
  2⤵
  PID:6340
- C:\Windows\System\eYPTfwi.exe
  C:\Windows\System\eYPTfwi.exe
  2⤵
  PID:3368
- C:\Windows\System\PqiJpfe.exe
  C:\Windows\System\PqiJpfe.exe
  2⤵
  PID:5884
- C:\Windows\System\jsSoOci.exe
  C:\Windows\System\jsSoOci.exe
  2⤵
  PID:1832
- C:\Windows\System\uVMToNE.exe
  C:\Windows\System\uVMToNE.exe
  2⤵
  PID:5876
- C:\Windows\System\XJhQrum.exe
  C:\Windows\System\XJhQrum.exe
  2⤵
  PID:5020
- C:\Windows\System\FxweUUw.exe
  C:\Windows\System\FxweUUw.exe
  2⤵
  PID:5332
- C:\Windows\System\QJMVccw.exe
  C:\Windows\System\QJMVccw.exe
  2⤵
  PID:3888
- C:\Windows\System\uCNchkQ.exe
  C:\Windows\System\uCNchkQ.exe
  2⤵
  PID:4872
- C:\Windows\System\vguROnV.exe
  C:\Windows\System\vguROnV.exe
  2⤵
  PID:1460
- C:\Windows\System\JcWDggp.exe
  C:\Windows\System\JcWDggp.exe
  2⤵
  PID:672
- C:\Windows\System\JsUQqwL.exe
  C:\Windows\System\JsUQqwL.exe
  2⤵
  PID:2228
- C:\Windows\System\UcAZDCo.exe
  C:\Windows\System\UcAZDCo.exe
  2⤵
  PID:536
- C:\Windows\System\bnCJTyo.exe
  C:\Windows\System\bnCJTyo.exe
  2⤵
  PID:6384
- C:\Windows\System\bQmqoRn.exe
  C:\Windows\System\bQmqoRn.exe
  2⤵
  PID:6132
- C:\Windows\System\hNAxSsD.exe
  C:\Windows\System\hNAxSsD.exe
  2⤵
  PID:1776
- C:\Windows\System\EaGdTWU.exe
  C:\Windows\System\EaGdTWU.exe
  2⤵
  PID:4444
- C:\Windows\System\ccuJDrD.exe
  C:\Windows\System\ccuJDrD.exe
  2⤵
  PID:6240
- C:\Windows\System\URWtqNh.exe
  C:\Windows\System\URWtqNh.exe
  2⤵
  PID:6192
- C:\Windows\System\xngszMN.exe
  C:\Windows\System\xngszMN.exe
  2⤵
  PID:5904
- C:\Windows\System\lwfoGNi.exe
  C:\Windows\System\lwfoGNi.exe
  2⤵
  PID:6552
- C:\Windows\System\bLxHnYZ.exe
  C:\Windows\System\bLxHnYZ.exe
  2⤵
  PID:6104
- C:\Windows\System\MkTDyck.exe
  C:\Windows\System\MkTDyck.exe
  2⤵
  PID:6008
- C:\Windows\System\qyfkMqJ.exe
  C:\Windows\System\qyfkMqJ.exe
  2⤵
  PID:7112
- C:\Windows\System\GtTrBhJ.exe
  C:\Windows\System\GtTrBhJ.exe
  2⤵
  PID:7072
- C:\Windows\System\VZnEBaP.exe
  C:\Windows\System\VZnEBaP.exe
  2⤵
  PID:888
- C:\Windows\System\LzqIPqK.exe
  C:\Windows\System\LzqIPqK.exe
  2⤵
  PID:5460
- C:\Windows\System\QVQYtBR.exe
  C:\Windows\System\QVQYtBR.exe
  2⤵
  PID:2780
- C:\Windows\System\pXQUnfa.exe
  C:\Windows\System\pXQUnfa.exe
  2⤵
  PID:6244
- C:\Windows\System\lMUHwfn.exe
  C:\Windows\System\lMUHwfn.exe
  2⤵
  PID:6404
- C:\Windows\System\yNvKkln.exe
  C:\Windows\System\yNvKkln.exe
  2⤵
  PID:10956
- C:\Windows\System\YimqWfG.exe
  C:\Windows\System\YimqWfG.exe
  2⤵
  PID:7780
- C:\Windows\System\BXPrcdJ.exe
  C:\Windows\System\BXPrcdJ.exe
  2⤵
  PID:8056
- C:\Windows\System\BwMTvZH.exe
  C:\Windows\System\BwMTvZH.exe
  2⤵
  PID:7660
- C:\Windows\System\LJTQNaT.exe
  C:\Windows\System\LJTQNaT.exe
  2⤵
  PID:7824
- C:\Windows\System\wJlZboG.exe
  C:\Windows\System\wJlZboG.exe
  2⤵
  PID:8104
- C:\Windows\System\wubIIJX.exe
  C:\Windows\System\wubIIJX.exe
  2⤵
  PID:5280
- C:\Windows\System\AgVojoM.exe
  C:\Windows\System\AgVojoM.exe
  2⤵
  PID:8140
- C:\Windows\System\uQJsBkS.exe
  C:\Windows\System\uQJsBkS.exe
  2⤵
  PID:7596
- C:\Windows\System\ybNHGKL.exe
  C:\Windows\System\ybNHGKL.exe
  2⤵
  PID:8020
- C:\Windows\System\IECZmEa.exe
  C:\Windows\System\IECZmEa.exe
  2⤵
  PID:3952
- C:\Windows\System\lbhezPs.exe
  C:\Windows\System\lbhezPs.exe
  2⤵
  PID:7076
- C:\Windows\System\cSxSifY.exe
  C:\Windows\System\cSxSifY.exe
  2⤵
  PID:3012
- C:\Windows\System\GUjowuU.exe
  C:\Windows\System\GUjowuU.exe
  2⤵
  PID:7108
- C:\Windows\System\LfHZZST.exe
  C:\Windows\System\LfHZZST.exe
  2⤵
  PID:6952
- C:\Windows\System\PejjYOp.exe
  C:\Windows\System\PejjYOp.exe
  2⤵
  PID:5276
- C:\Windows\System\TLDVoIx.exe
  C:\Windows\System\TLDVoIx.exe
  2⤵
  PID:8216
- C:\Windows\System\DgnHisa.exe
  C:\Windows\System\DgnHisa.exe
  2⤵
  PID:3488
- C:\Windows\System\LRCfxbH.exe
  C:\Windows\System\LRCfxbH.exe
  2⤵
  PID:8408
- C:\Windows\System\yYPCkYb.exe
  C:\Windows\System\yYPCkYb.exe
  2⤵
  PID:8780
- C:\Windows\System\HfKnERk.exe
  C:\Windows\System\HfKnERk.exe
  2⤵
  PID:7336
- C:\Windows\System\aJbLlDE.exe
  C:\Windows\System\aJbLlDE.exe
  2⤵
  PID:8708
- C:\Windows\System\AvPresp.exe
  C:\Windows\System\AvPresp.exe
  2⤵
  PID:4296
- C:\Windows\System\vUJDZjk.exe
  C:\Windows\System\vUJDZjk.exe
  2⤵
  PID:8076
- C:\Windows\System\ERawmVF.exe
  C:\Windows\System\ERawmVF.exe
  2⤵
  PID:9092
- C:\Windows\System\wdaGXbc.exe
  C:\Windows\System\wdaGXbc.exe
  2⤵
  PID:8976
- C:\Windows\System\ClSUEmY.exe
  C:\Windows\System\ClSUEmY.exe
  2⤵
  PID:7936
- C:\Windows\System\toDSARK.exe
  C:\Windows\System\toDSARK.exe
  2⤵
  PID:8136
- C:\Windows\System\dTqZsig.exe
  C:\Windows\System\dTqZsig.exe
  2⤵
  PID:6824
- C:\Windows\System\GAWMTRU.exe
  C:\Windows\System\GAWMTRU.exe
  2⤵
  PID:8564
- C:\Windows\System\UUtBOUJ.exe
  C:\Windows\System\UUtBOUJ.exe
  2⤵
  PID:8284
- C:\Windows\System\qGMvCtG.exe
  C:\Windows\System\qGMvCtG.exe
  2⤵
  PID:8324
- C:\Windows\System\gvteOXV.exe
  C:\Windows\System\gvteOXV.exe
  2⤵
  PID:7384
- C:\Windows\System\ciAUMcA.exe
  C:\Windows\System\ciAUMcA.exe
  2⤵
  PID:2584
- C:\Windows\System\wZDVeYX.exe
  C:\Windows\System\wZDVeYX.exe
  2⤵
  PID:8624
- C:\Windows\System\SXAkXoQ.exe
  C:\Windows\System\SXAkXoQ.exe
  2⤵
  PID:7580
- C:\Windows\System\mwxykYn.exe
  C:\Windows\System\mwxykYn.exe
  2⤵
  PID:8492
- C:\Windows\System\xUwumnQ.exe
  C:\Windows\System\xUwumnQ.exe
  2⤵
  PID:9700
- C:\Windows\System\fJeKFPw.exe
  C:\Windows\System\fJeKFPw.exe
  2⤵
  PID:9116
- C:\Windows\System\xtYUXfE.exe
  C:\Windows\System\xtYUXfE.exe
  2⤵
  PID:4900
- C:\Windows\System\LGVzSVu.exe
  C:\Windows\System\LGVzSVu.exe
  2⤵
  PID:2348
- C:\Windows\System\IkSnGYW.exe
  C:\Windows\System\IkSnGYW.exe
  2⤵
  PID:6056
- C:\Windows\System\ErbuAAq.exe
  C:\Windows\System\ErbuAAq.exe
  2⤵
  PID:9852
- C:\Windows\System\ZNgrOpi.exe
  C:\Windows\System\ZNgrOpi.exe
  2⤵
  PID:10008
- C:\Windows\System\JzlXFVw.exe
  C:\Windows\System\JzlXFVw.exe
  2⤵
  PID:13188
- C:\Windows\System\SPKohpb.exe
  C:\Windows\System\SPKohpb.exe
  2⤵
  PID:4988
- C:\Windows\System\fSHgWFg.exe
  C:\Windows\System\fSHgWFg.exe
  2⤵
  PID:9596
- C:\Windows\System\dNJQkOU.exe
  C:\Windows\System\dNJQkOU.exe
  2⤵
  PID:7828
- C:\Windows\System\OARNuZd.exe
  C:\Windows\System\OARNuZd.exe
  2⤵
  PID:6472
- C:\Windows\System\mSirtyP.exe
  C:\Windows\System\mSirtyP.exe
  2⤵
  PID:8300
- C:\Windows\System\xjwGxBl.exe
  C:\Windows\System\xjwGxBl.exe
  2⤵
  PID:9832
- C:\Windows\System\RhEaOcf.exe
  C:\Windows\System\RhEaOcf.exe
  2⤵
  PID:9880
- C:\Windows\System\lDhFUbf.exe
  C:\Windows\System\lDhFUbf.exe
  2⤵
  PID:10292
- C:\Windows\System\ZqbnWMF.exe
  C:\Windows\System\ZqbnWMF.exe
  2⤵
  PID:6892
- C:\Windows\System\ZVWGyWE.exe
  C:\Windows\System\ZVWGyWE.exe
  2⤵
  PID:3916
- C:\Windows\System\DcqudFB.exe
  C:\Windows\System\DcqudFB.exe
  2⤵
  PID:4316
- C:\Windows\System\ZnRUvOf.exe
  C:\Windows\System\ZnRUvOf.exe
  2⤵
  PID:7396
- C:\Windows\System\YBGEQQd.exe
  C:\Windows\System\YBGEQQd.exe
  2⤵
  PID:6772
- C:\Windows\System\WUyueGl.exe
  C:\Windows\System\WUyueGl.exe
  2⤵
  PID:7160
- C:\Windows\System\oUByCzY.exe
  C:\Windows\System\oUByCzY.exe
  2⤵
  PID:10888
- C:\Windows\System\rxViBQK.exe
  C:\Windows\System\rxViBQK.exe
  2⤵
  PID:9236
- C:\Windows\System\orECzzj.exe
  C:\Windows\System\orECzzj.exe
  2⤵
  PID:10264
- C:\Windows\System\DLGCajZ.exe
  C:\Windows\System\DLGCajZ.exe
  2⤵
  PID:8636
- C:\Windows\System\sLMoCoJ.exe
  C:\Windows\System\sLMoCoJ.exe
  2⤵
  PID:4436
- C:\Windows\System\utmpsIi.exe
  C:\Windows\System\utmpsIi.exe
  2⤵
  PID:8572
- C:\Windows\System\DMSqDtR.exe
  C:\Windows\System\DMSqDtR.exe
  2⤵
  PID:8016
- C:\Windows\System\wHzetCd.exe
  C:\Windows\System\wHzetCd.exe
  2⤵
  PID:7500
- C:\Windows\System\ieCriJP.exe
  C:\Windows\System\ieCriJP.exe
  2⤵
  PID:7552
- C:\Windows\System\zYFgmdY.exe
  C:\Windows\System\zYFgmdY.exe
  2⤵
  PID:5088
- C:\Windows\System\wofiLyC.exe
  C:\Windows\System\wofiLyC.exe
  2⤵
  PID:7012
- C:\Windows\System\QVWjkbt.exe
  C:\Windows\System\QVWjkbt.exe
  2⤵
  PID:10092
- C:\Windows\System\QQdgWys.exe
  C:\Windows\System\QQdgWys.exe
  2⤵
  PID:10808
- C:\Windows\System\HnncGQS.exe
  C:\Windows\System\HnncGQS.exe
  2⤵
  PID:9704
- C:\Windows\System\nvDHWsy.exe
  C:\Windows\System\nvDHWsy.exe
  2⤵
  PID:8952
- C:\Windows\System\AwsGPfq.exe
  C:\Windows\System\AwsGPfq.exe
  2⤵
  PID:10892
- C:\Windows\System\vddtPvt.exe
  C:\Windows\System\vddtPvt.exe
  2⤵
  PID:11140
- C:\Windows\System\Hwaazdh.exe
  C:\Windows\System\Hwaazdh.exe
  2⤵
  PID:9836
- C:\Windows\System\jMqFUpn.exe
  C:\Windows\System\jMqFUpn.exe
  2⤵
  PID:4824
- C:\Windows\System\HjVVtHX.exe
  C:\Windows\System\HjVVtHX.exe
  2⤵
  PID:6044
- C:\Windows\System\tSBYqsd.exe
  C:\Windows\System\tSBYqsd.exe
  2⤵
  PID:8576
- C:\Windows\System\GjUePmi.exe
  C:\Windows\System\GjUePmi.exe
  2⤵
  PID:8736
- C:\Windows\System\fNntMCO.exe
  C:\Windows\System\fNntMCO.exe
  2⤵
  PID:11288
- C:\Windows\System\cPKqHEs.exe
  C:\Windows\System\cPKqHEs.exe
  2⤵
  PID:11972
- C:\Windows\System\ZEBSdss.exe
  C:\Windows\System\ZEBSdss.exe
  2⤵
  PID:11560
- C:\Windows\System\UupxgCm.exe
  C:\Windows\System\UupxgCm.exe
  2⤵
  PID:10948
- C:\Windows\System\UqmAvWd.exe
  C:\Windows\System\UqmAvWd.exe
  2⤵
  PID:9148
- C:\Windows\System\iIQdCVi.exe
  C:\Windows\System\iIQdCVi.exe
  2⤵
  PID:7404
- C:\Windows\System\pEHqroP.exe
  C:\Windows\System\pEHqroP.exe
  2⤵
  PID:8760
- C:\Windows\System\WawklHi.exe
  C:\Windows\System\WawklHi.exe
  2⤵
  PID:8824
- C:\Windows\System\ntMAIgQ.exe
  C:\Windows\System\ntMAIgQ.exe
  2⤵
  PID:12024
- C:\Windows\System\kjBKzWZ.exe
  C:\Windows\System\kjBKzWZ.exe
  2⤵
  PID:12048
- C:\Windows\System\cbntFsn.exe
  C:\Windows\System\cbntFsn.exe
  2⤵
  PID:12096
- C:\Windows\System\xcDWGxW.exe
  C:\Windows\System\xcDWGxW.exe
  2⤵
  PID:10780
- C:\Windows\System\tDQiSFC.exe
  C:\Windows\System\tDQiSFC.exe
  2⤵
  PID:10968
- C:\Windows\System\DtnZDDZ.exe
  C:\Windows\System\DtnZDDZ.exe
  2⤵
  PID:10660
- C:\Windows\System\iGvjmlQ.exe
  C:\Windows\System\iGvjmlQ.exe
  2⤵
  PID:216
- C:\Windows\System\nMmfqof.exe
  C:\Windows\System\nMmfqof.exe
  2⤵
  PID:11240
- C:\Windows\System\CYONNWZ.exe
  C:\Windows\System\CYONNWZ.exe
  2⤵
  PID:9964
- C:\Windows\System\ASiFoSC.exe
  C:\Windows\System\ASiFoSC.exe
  2⤵
  PID:8996
- C:\Windows\System\QsOntMI.exe
  C:\Windows\System\QsOntMI.exe
  2⤵
  PID:11084
- C:\Windows\System\HFnxQxE.exe
  C:\Windows\System\HFnxQxE.exe
  2⤵
  PID:7816
- C:\Windows\System\ohXWlNV.exe
  C:\Windows\System\ohXWlNV.exe
  2⤵
  PID:8364
- C:\Windows\System\ShqRRSA.exe
  C:\Windows\System\ShqRRSA.exe
  2⤵
  PID:10716
- C:\Windows\System\kAdoaqr.exe
  C:\Windows\System\kAdoaqr.exe
  2⤵
  PID:7848
- C:\Windows\System\JPyCSpv.exe
  C:\Windows\System\JPyCSpv.exe
  2⤵
  PID:10872
- C:\Windows\System\jqHtPiR.exe
  C:\Windows\System\jqHtPiR.exe
  2⤵
  PID:12160
- C:\Windows\System\CJJuoOb.exe
  C:\Windows\System\CJJuoOb.exe
  2⤵
  PID:12056
- C:\Windows\System\HMfXftx.exe
  C:\Windows\System\HMfXftx.exe
  2⤵
  PID:2536
- C:\Windows\System\zGQbmLg.exe
  C:\Windows\System\zGQbmLg.exe
  2⤵
  PID:9160
- C:\Windows\System\SjEGpBl.exe
  C:\Windows\System\SjEGpBl.exe
  2⤵
  PID:11916
- C:\Windows\System\kIVCsRM.exe
  C:\Windows\System\kIVCsRM.exe
  2⤵
  PID:10376
- C:\Windows\System\QXfzEGp.exe
  C:\Windows\System\QXfzEGp.exe
  2⤵
  PID:11920
- C:\Windows\System\olgvjca.exe
  C:\Windows\System\olgvjca.exe
  2⤵
  PID:11800
- C:\Windows\System\lDPEelx.exe
  C:\Windows\System\lDPEelx.exe
  2⤵
  PID:10952
- C:\Windows\System\hRyaYjk.exe
  C:\Windows\System\hRyaYjk.exe
  2⤵
  PID:7296
- C:\Windows\System\ikTGGUB.exe
  C:\Windows\System\ikTGGUB.exe
  2⤵
  PID:11936
- C:\Windows\System\jcQNtHV.exe
  C:\Windows\System\jcQNtHV.exe
  2⤵
  PID:9776
- C:\Windows\System\CNTTXHc.exe
  C:\Windows\System\CNTTXHc.exe
  2⤵
  PID:11856
- C:\Windows\System\eZgwpYn.exe
  C:\Windows\System\eZgwpYn.exe
  2⤵
  PID:10744
- C:\Windows\System\hAlIvKO.exe
  C:\Windows\System\hAlIvKO.exe
  2⤵
  PID:7672
- C:\Windows\System\hWzYdPq.exe
  C:\Windows\System\hWzYdPq.exe
  2⤵
  PID:9452
- C:\Windows\System\cfIXPbJ.exe
  C:\Windows\System\cfIXPbJ.exe
  2⤵
  PID:12936
- C:\Windows\System\hxSjAVw.exe
  C:\Windows\System\hxSjAVw.exe
  2⤵
  PID:8612
- C:\Windows\System\zoQyJkd.exe
  C:\Windows\System\zoQyJkd.exe
  2⤵
  PID:11984
- C:\Windows\System\tmfbmLu.exe
  C:\Windows\System\tmfbmLu.exe
  2⤵
  PID:12472
- C:\Windows\System\juwheJk.exe
  C:\Windows\System\juwheJk.exe
  2⤵
  PID:11756
- C:\Windows\System\MWPZULt.exe
  C:\Windows\System\MWPZULt.exe
  2⤵
  PID:11824
- C:\Windows\System\xASGkjD.exe
  C:\Windows\System\xASGkjD.exe
  2⤵
  PID:8384
- C:\Windows\System\xjiLRXc.exe
  C:\Windows\System\xjiLRXc.exe
  2⤵
  PID:9572
- C:\Windows\System\gBwPsLF.exe
  C:\Windows\System\gBwPsLF.exe
  2⤵
  PID:3896
- C:\Windows\System\ENoHIFD.exe
  C:\Windows\System\ENoHIFD.exe
  2⤵
  PID:9024
- C:\Windows\System\qpEtLgF.exe
  C:\Windows\System\qpEtLgF.exe
  2⤵
  PID:12080
- C:\Windows\System\VjXgUpl.exe
  C:\Windows\System\VjXgUpl.exe
  2⤵
  PID:8892
- C:\Windows\System\QAmlUAI.exe
  C:\Windows\System\QAmlUAI.exe
  2⤵
  PID:9428
- C:\Windows\System\xITykuo.exe
  C:\Windows\System\xITykuo.exe
  2⤵
  PID:6808
- C:\Windows\System\CGwQFKp.exe
  C:\Windows\System\CGwQFKp.exe
  2⤵
  PID:964
- C:\Windows\System\nvMyxIw.exe
  C:\Windows\System\nvMyxIw.exe
  2⤵
  PID:9916
- C:\Windows\System\SrDXNgd.exe
  C:\Windows\System\SrDXNgd.exe
  2⤵
  PID:9100
- C:\Windows\System\EsvqexJ.exe
  C:\Windows\System\EsvqexJ.exe
  2⤵
  PID:11168
- C:\Windows\System\ZUumJRU.exe
  C:\Windows\System\ZUumJRU.exe
  2⤵
  PID:13132
- C:\Windows\System\AKCzffk.exe
  C:\Windows\System\AKCzffk.exe
  2⤵
  PID:2516
- C:\Windows\System\DFfctKZ.exe
  C:\Windows\System\DFfctKZ.exe
  2⤵
  PID:10644
- C:\Windows\System\MFyuqqQ.exe
  C:\Windows\System\MFyuqqQ.exe
  2⤵
  PID:10248
- C:\Windows\System\ahmSMLb.exe
  C:\Windows\System\ahmSMLb.exe
  2⤵
  PID:12152
- C:\Windows\System\owBRYWX.exe
  C:\Windows\System\owBRYWX.exe
  2⤵
  PID:12844
- C:\Windows\System\RRhWSKF.exe
  C:\Windows\System\RRhWSKF.exe
  2⤵
  PID:12960
- C:\Windows\System\UOTCXrT.exe
  C:\Windows\System\UOTCXrT.exe
  2⤵
  PID:10552
- C:\Windows\System\gJZRcYL.exe
  C:\Windows\System\gJZRcYL.exe
  2⤵
  PID:11828
- C:\Windows\System\ThvffxI.exe
  C:\Windows\System\ThvffxI.exe
  2⤵
  PID:13220
- C:\Windows\System\ysHguxl.exe
  C:\Windows\System\ysHguxl.exe
  2⤵
  PID:10760
- C:\Windows\System\mrfvosb.exe
  C:\Windows\System\mrfvosb.exe
  2⤵
  PID:11620
- C:\Windows\System\yHMdlHG.exe
  C:\Windows\System\yHMdlHG.exe
  2⤵
  PID:12276
- C:\Windows\System\IIDHmvC.exe
  C:\Windows\System\IIDHmvC.exe
  2⤵
  PID:7088
- C:\Windows\System\fFVKBat.exe
  C:\Windows\System\fFVKBat.exe
  2⤵
  PID:13016
- C:\Windows\System\taJeBiJ.exe
  C:\Windows\System\taJeBiJ.exe
  2⤵
  PID:12368
- C:\Windows\System\zoEGFKm.exe
  C:\Windows\System\zoEGFKm.exe
  2⤵
  PID:6484
- C:\Windows\System\CJegnxF.exe
  C:\Windows\System\CJegnxF.exe
  2⤵
  PID:9176
- C:\Windows\System\IjPnXky.exe
  C:\Windows\System\IjPnXky.exe
  2⤵
  PID:8328
- C:\Windows\System\UuiZLOt.exe
  C:\Windows\System\UuiZLOt.exe
  2⤵
  PID:12104
- C:\Windows\System\sNZKKba.exe
  C:\Windows\System\sNZKKba.exe
  2⤵
  PID:10084
- C:\Windows\System\yDIRRZk.exe
  C:\Windows\System\yDIRRZk.exe
  2⤵
  PID:9516
- C:\Windows\System\yVKlusj.exe
  C:\Windows\System\yVKlusj.exe
  2⤵
  PID:6196
- C:\Windows\System\PcFLPbM.exe
  C:\Windows\System\PcFLPbM.exe
  2⤵
  PID:1800
- C:\Windows\System\bpcsoqE.exe
  C:\Windows\System\bpcsoqE.exe
  2⤵
  PID:11256
- C:\Windows\System\dWsLvMd.exe
  C:\Windows\System\dWsLvMd.exe
  2⤵
  PID:10460
- C:\Windows\System\mjKUQCE.exe
  C:\Windows\System\mjKUQCE.exe
  2⤵
  PID:12864
- C:\Windows\System\uLVsdSC.exe
  C:\Windows\System\uLVsdSC.exe
  2⤵
  PID:12284
- C:\Windows\System\NetYtOe.exe
  C:\Windows\System\NetYtOe.exe
  2⤵
  PID:3872
- C:\Windows\System\LSMUPNL.exe
  C:\Windows\System\LSMUPNL.exe
  2⤵
  PID:11752
- C:\Windows\System\WbSiwwh.exe
  C:\Windows\System\WbSiwwh.exe
  2⤵
  PID:10396
- C:\Windows\System\HxEteUj.exe
  C:\Windows\System\HxEteUj.exe
  2⤵
  PID:10668
- C:\Windows\System\MbeGaRM.exe
  C:\Windows\System\MbeGaRM.exe
  2⤵
  PID:11124
- C:\Windows\System\SXZoKyo.exe
  C:\Windows\System\SXZoKyo.exe
  2⤵
  PID:12376
- C:\Windows\System\aMnfbcK.exe
  C:\Windows\System\aMnfbcK.exe
  2⤵
  PID:13260
- C:\Windows\System\CclIWba.exe
  C:\Windows\System\CclIWba.exe
  2⤵
  PID:6520
- C:\Windows\System\SIfDzMe.exe
  C:\Windows\System\SIfDzMe.exe
  2⤵
  PID:12188
- C:\Windows\System\iuofpuR.exe
  C:\Windows\System\iuofpuR.exe
  2⤵
  PID:11044
- C:\Windows\System\JLLucNr.exe
  C:\Windows\System\JLLucNr.exe
  2⤵
  PID:8592
- C:\Windows\System\hZObtYT.exe
  C:\Windows\System\hZObtYT.exe
  2⤵
  PID:10860
- C:\Windows\System\eLzfAca.exe
  C:\Windows\System\eLzfAca.exe
  2⤵
  PID:11348
- C:\Windows\System\DsZliQU.exe
  C:\Windows\System\DsZliQU.exe
  2⤵
  PID:7840
- C:\Windows\System\iWEKtcB.exe
  C:\Windows\System\iWEKtcB.exe
  2⤵
  PID:11504
- C:\Windows\System\NYwmAcq.exe
  C:\Windows\System\NYwmAcq.exe
  2⤵
  PID:10720
- C:\Windows\System\knbfZqj.exe
  C:\Windows\System\knbfZqj.exe
  2⤵
  PID:11872
- C:\Windows\System\UjCaBnH.exe
  C:\Windows\System\UjCaBnH.exe
  2⤵
  PID:8380
- C:\Windows\System\pjszucy.exe
  C:\Windows\System\pjszucy.exe
  2⤵
  PID:12704
- C:\Windows\System\MvWClst.exe
  C:\Windows\System\MvWClst.exe
  2⤵
  PID:3172
- C:\Windows\System\upkMREI.exe
  C:\Windows\System\upkMREI.exe
  2⤵
  PID:10436
- C:\Windows\System\JCwEzPy.exe
  C:\Windows\System\JCwEzPy.exe
  2⤵
  PID:13208
- C:\Windows\System\BXtLzSY.exe
  C:\Windows\System\BXtLzSY.exe
  2⤵
  PID:9968
- C:\Windows\System\RQOnGlp.exe
  C:\Windows\System\RQOnGlp.exe
  2⤵
  PID:12984
- C:\Windows\System\AtLINvN.exe
  C:\Windows\System\AtLINvN.exe
  2⤵
  PID:9720
- C:\Windows\System\czCGRBo.exe
  C:\Windows\System\czCGRBo.exe
  2⤵
  PID:12352
- C:\Windows\System\XieIAex.exe
  C:\Windows\System\XieIAex.exe
  2⤵
  PID:10448
- C:\Windows\System\WntaMUQ.exe
  C:\Windows\System\WntaMUQ.exe
  2⤵
  PID:6884
- C:\Windows\System\OdPdBap.exe
  C:\Windows\System\OdPdBap.exe
  2⤵
  PID:12316
- C:\Windows\System\oJuQgCz.exe
  C:\Windows\System\oJuQgCz.exe
  2⤵
  PID:8120
- C:\Windows\System\ksSyasJ.exe
  C:\Windows\System\ksSyasJ.exe
  2⤵
  PID:10064
- C:\Windows\System\xSjNgnY.exe
  C:\Windows\System\xSjNgnY.exe
  2⤵
  PID:9592
- C:\Windows\System\iQtsEWW.exe
  C:\Windows\System\iQtsEWW.exe
  2⤵
  PID:11696
- C:\Windows\System\GcjKJnY.exe
  C:\Windows\System\GcjKJnY.exe
  2⤵
  PID:10088
- C:\Windows\System\PBObfJR.exe
  C:\Windows\System\PBObfJR.exe
  2⤵
  PID:12884
- C:\Windows\System\jPagTzu.exe
  C:\Windows\System\jPagTzu.exe
  2⤵
  PID:13084
- C:\Windows\System\itoypPp.exe
  C:\Windows\System\itoypPp.exe
  2⤵
  PID:12480
- C:\Windows\System\KvMjPyO.exe
  C:\Windows\System\KvMjPyO.exe
  2⤵
  PID:12084
- C:\Windows\System\CaUlHPt.exe
  C:\Windows\System\CaUlHPt.exe
  2⤵
  PID:11048
- C:\Windows\System\nTWyhuR.exe
  C:\Windows\System\nTWyhuR.exe
  2⤵
  PID:1912
- C:\Windows\System\EPKbZkE.exe
  C:\Windows\System\EPKbZkE.exe
  2⤵
  PID:4940
- C:\Windows\System\WXzaTuN.exe
  C:\Windows\System\WXzaTuN.exe
  2⤵
  PID:3648
- C:\Windows\System\IUeovLS.exe
  C:\Windows\System\IUeovLS.exe
  2⤵
  PID:9600
- C:\Windows\System\cOpVtOs.exe
  C:\Windows\System\cOpVtOs.exe
  2⤵
  PID:12596
- C:\Windows\System\aTBJJXJ.exe
  C:\Windows\System\aTBJJXJ.exe
  2⤵
  PID:10572
- C:\Windows\System\TeLNCgQ.exe
  C:\Windows\System\TeLNCgQ.exe
  2⤵
  PID:5136
- C:\Windows\System\IbrWPuP.exe
  C:\Windows\System\IbrWPuP.exe
  2⤵
  PID:12396
- C:\Windows\System\oSotnAJ.exe
  C:\Windows\System\oSotnAJ.exe
  2⤵
  PID:11040
- C:\Windows\System\QaHobGV.exe
  C:\Windows\System\QaHobGV.exe
  2⤵
  PID:11624
- C:\Windows\System\hraoJXN.exe
  C:\Windows\System\hraoJXN.exe
  2⤵
  PID:1592
- C:\Windows\System\JjgItpi.exe
  C:\Windows\System\JjgItpi.exe
  2⤵
  PID:12644
- C:\Windows\System\qbBQUkg.exe
  C:\Windows\System\qbBQUkg.exe
  2⤵
  PID:11100
- C:\Windows\System\JxqFGol.exe
  C:\Windows\System\JxqFGol.exe
  2⤵
  PID:13388
- C:\Windows\System\ktYFsmU.exe
  C:\Windows\System\ktYFsmU.exe
  2⤵
  PID:13420
- C:\Windows\System\DAqGprh.exe
  C:\Windows\System\DAqGprh.exe
  2⤵
  PID:13448
- C:\Windows\System\bakCuWB.exe
  C:\Windows\System\bakCuWB.exe
  2⤵
  PID:13476
- C:\Windows\System\AHRudhd.exe
  C:\Windows\System\AHRudhd.exe
  2⤵
  PID:13504
- C:\Windows\System\VLOeRgH.exe
  C:\Windows\System\VLOeRgH.exe
  2⤵
  PID:13532
- C:\Windows\System\wFUqOom.exe
  C:\Windows\System\wFUqOom.exe
  2⤵
  PID:13548
- C:\Windows\System\yDJXgEc.exe
  C:\Windows\System\yDJXgEc.exe
  2⤵
  PID:13588
- C:\Windows\System\hTTjxMa.exe
  C:\Windows\System\hTTjxMa.exe
  2⤵
  PID:13616
- C:\Windows\System\FlLhpEY.exe
  C:\Windows\System\FlLhpEY.exe
  2⤵
  PID:13644
- C:\Windows\System\QnSkyOS.exe
  C:\Windows\System\QnSkyOS.exe
  2⤵
  PID:13672
- C:\Windows\System\YwSAYPU.exe
  C:\Windows\System\YwSAYPU.exe
  2⤵
  PID:13700
- C:\Windows\System\rXwwPbS.exe
  C:\Windows\System\rXwwPbS.exe
  2⤵
  PID:13728
- C:\Windows\System\MxHLKzR.exe
  C:\Windows\System\MxHLKzR.exe
  2⤵
  PID:13756
- C:\Windows\System\MLgRgvR.exe
  C:\Windows\System\MLgRgvR.exe
  2⤵
  PID:13784
- C:\Windows\System\QesaRJN.exe
  C:\Windows\System\QesaRJN.exe
  2⤵
  PID:13812
- C:\Windows\System\CAeHnFh.exe
  C:\Windows\System\CAeHnFh.exe
  2⤵
  PID:13844
- C:\Windows\System\rAIAaqm.exe
  C:\Windows\System\rAIAaqm.exe
  2⤵
  PID:13872
- C:\Windows\System\JTKBGOa.exe
  C:\Windows\System\JTKBGOa.exe
  2⤵
  PID:13888
- C:\Windows\System\OAwPApX.exe
  C:\Windows\System\OAwPApX.exe
  2⤵
  PID:13924
- C:\Windows\System\gXGzCrU.exe
  C:\Windows\System\gXGzCrU.exe
  2⤵
  PID:13956
- C:\Windows\System\fRwdsXj.exe
  C:\Windows\System\fRwdsXj.exe
  2⤵
  PID:13984
- C:\Windows\System\bVtMBim.exe
  C:\Windows\System\bVtMBim.exe
  2⤵
  PID:14016
- C:\Windows\System\lNuHvEn.exe
  C:\Windows\System\lNuHvEn.exe
  2⤵
  PID:14044
- C:\Windows\System\WEDLzOp.exe
  C:\Windows\System\WEDLzOp.exe
  2⤵
  PID:14072
- C:\Windows\System\UbNeuCL.exe
  C:\Windows\System\UbNeuCL.exe
  2⤵
  PID:14100
- C:\Windows\System\xgJDxhJ.exe
  C:\Windows\System\xgJDxhJ.exe
  2⤵
  PID:14128
- C:\Windows\System\aKHVmAT.exe
  C:\Windows\System\aKHVmAT.exe
  2⤵
  PID:14156
- C:\Windows\System\FBDOLGV.exe
  C:\Windows\System\FBDOLGV.exe
  2⤵
  PID:14184
- C:\Windows\System\IFKKqrv.exe
  C:\Windows\System\IFKKqrv.exe
  2⤵
  PID:14212
- C:\Windows\System\ATXToKw.exe
  C:\Windows\System\ATXToKw.exe
  2⤵
  PID:14240
- C:\Windows\System\TaPznCt.exe
  C:\Windows\System\TaPznCt.exe
  2⤵
  PID:14268
- C:\Windows\System\YDYgvDF.exe
  C:\Windows\System\YDYgvDF.exe
  2⤵
  PID:14288
- C:\Windows\System\XBrCwMA.exe
  C:\Windows\System\XBrCwMA.exe
  2⤵
  PID:14316
- C:\Windows\System\MZqDuOi.exe
  C:\Windows\System\MZqDuOi.exe
  2⤵
  PID:13336
- C:\Windows\System\FabqQYG.exe
  C:\Windows\System\FabqQYG.exe
  2⤵
  PID:10884
- C:\Windows\System\IEfJiox.exe
  C:\Windows\System\IEfJiox.exe
  2⤵
  PID:9848
- C:\Windows\System\OvuUCuD.exe
  C:\Windows\System\OvuUCuD.exe
  2⤵
  PID:13376
- C:\Windows\System\zNlAEby.exe
  C:\Windows\System\zNlAEby.exe
  2⤵
  PID:13428
- C:\Windows\System\BTfDiKz.exe
  C:\Windows\System\BTfDiKz.exe
  2⤵
  PID:13492
- C:\Windows\System\ieaTBjd.exe
  C:\Windows\System\ieaTBjd.exe
  2⤵
  PID:13564
- C:\Windows\System\VmNdxIK.exe
  C:\Windows\System\VmNdxIK.exe
  2⤵
  PID:13736
- C:\Windows\System\Eryyvcl.exe
  C:\Windows\System\Eryyvcl.exe
  2⤵
  PID:13780
- C:\Windows\System\qXixzFk.exe
  C:\Windows\System\qXixzFk.exe
  2⤵
  PID:13832
- C:\Windows\System\LtaIaLI.exe
  C:\Windows\System\LtaIaLI.exe
  2⤵
  PID:13904
- C:\Windows\System\dOCxXZs.exe
  C:\Windows\System\dOCxXZs.exe
  2⤵
  PID:13972
- C:\Windows\System\lvvrVTa.exe
  C:\Windows\System\lvvrVTa.exe
  2⤵
  PID:14040
- C:\Windows\System\qumHNAh.exe
  C:\Windows\System\qumHNAh.exe
  2⤵
  PID:14124
- C:\Windows\System\rymcWfe.exe
  C:\Windows\System\rymcWfe.exe
  2⤵
  PID:14200
- C:\Windows\System\yYBcGzS.exe
  C:\Windows\System\yYBcGzS.exe
  2⤵
  PID:14264
- C:\Windows\System\xVqtLnB.exe
  C:\Windows\System\xVqtLnB.exe
  2⤵
  PID:13328
- C:\Windows\System\kYovtHE.exe
  C:\Windows\System\kYovtHE.exe
  2⤵
  PID:13332
- C:\Windows\System\IxwViNn.exe
  C:\Windows\System\IxwViNn.exe
  2⤵
  PID:13484
- C:\Windows\System\jymVfoj.exe
  C:\Windows\System\jymVfoj.exe
  2⤵
  PID:13652
- C:\Windows\System\YOVioQr.exe
  C:\Windows\System\YOVioQr.exe
  2⤵
  PID:13724
- C:\Windows\System\HvLqEYs.exe
  C:\Windows\System\HvLqEYs.exe
  2⤵
  PID:13716
- C:\Windows\System\UudEbVC.exe
  C:\Windows\System\UudEbVC.exe
  2⤵
  PID:13896
- C:\Windows\System\uTmzohT.exe
  C:\Windows\System\uTmzohT.exe
  2⤵
  PID:14032
- C:\Windows\System\FEhOyuN.exe
  C:\Windows\System\FEhOyuN.exe
  2⤵
  PID:14172
- C:\Windows\System\TzpIJNv.exe
  C:\Windows\System\TzpIJNv.exe
  2⤵
  PID:14304
- C:\Windows\System\sPVrcbe.exe
  C:\Windows\System\sPVrcbe.exe
  2⤵
  PID:12996
- C:\Windows\System\zMqDhCW.exe
  C:\Windows\System\zMqDhCW.exe
  2⤵
  PID:4904
- C:\Windows\System\pACWtlM.exe
  C:\Windows\System\pACWtlM.exe
  2⤵
  PID:13640
- C:\Windows\System\XgWsBZJ.exe
  C:\Windows\System\XgWsBZJ.exe
  2⤵
  PID:13800
- C:\Windows\System\jkhCAka.exe
  C:\Windows\System\jkhCAka.exe
  2⤵
  PID:14080
- C:\Windows\System\goJrgXz.exe
  C:\Windows\System\goJrgXz.exe
  2⤵
  PID:14280
- C:\Windows\System\dWqXoYP.exe
  C:\Windows\System\dWqXoYP.exe
  2⤵
  PID:12788
- C:\Windows\System\rANPKXz.exe
  C:\Windows\System\rANPKXz.exe
  2⤵
  PID:14012
- C:\Windows\System\VEAWglY.exe
  C:\Windows\System\VEAWglY.exe
  2⤵
  PID:8172
- C:\Windows\System\PzpsDOC.exe
  C:\Windows\System\PzpsDOC.exe
  2⤵
  PID:13880
- C:\Windows\System\rYJLCqJ.exe
  C:\Windows\System\rYJLCqJ.exe
  2⤵
  PID:14356
- C:\Windows\System\sndtbXz.exe
  C:\Windows\System\sndtbXz.exe
  2⤵
  PID:14384
- C:\Windows\System\KrvIAgG.exe
  C:\Windows\System\KrvIAgG.exe
  2⤵
  PID:14412
- C:\Windows\System\nwEvXQj.exe
  C:\Windows\System\nwEvXQj.exe
  2⤵
  PID:14440
- C:\Windows\System\BDjDFhz.exe
  C:\Windows\System\BDjDFhz.exe
  2⤵
  PID:14468
- C:\Windows\System\Mtqfztm.exe
  C:\Windows\System\Mtqfztm.exe
  2⤵
  PID:14496
- C:\Windows\System\rciESxe.exe
  C:\Windows\System\rciESxe.exe
  2⤵
  PID:14528
- C:\Windows\System\Fimlnlx.exe
  C:\Windows\System\Fimlnlx.exe
  2⤵
  PID:14556
- C:\Windows\System\fuxfAYS.exe
  C:\Windows\System\fuxfAYS.exe
  2⤵
  PID:14572
- C:\Windows\System\EHQAKOu.exe
  C:\Windows\System\EHQAKOu.exe
  2⤵
  PID:14600
- C:\Windows\System\vyTRlvo.exe
  C:\Windows\System\vyTRlvo.exe
  2⤵
  PID:14624
- C:\Windows\System\iHPxFDH.exe
  C:\Windows\System\iHPxFDH.exe
  2⤵
  PID:14668
- C:\Windows\System\YGCJXsx.exe
  C:\Windows\System\YGCJXsx.exe
  2⤵
  PID:14752
- C:\Windows\System\MuqeRti.exe
  C:\Windows\System\MuqeRti.exe
  2⤵
  PID:14780
- C:\Windows\System\VGQTNTT.exe
  C:\Windows\System\VGQTNTT.exe
  2⤵
  PID:14812
- C:\Windows\System\sKBZhXY.exe
  C:\Windows\System\sKBZhXY.exe
  2⤵
  PID:14844
- C:\Windows\System\rDSiqpF.exe
  C:\Windows\System\rDSiqpF.exe
  2⤵
  PID:14876
- C:\Windows\System\sfaFTsn.exe
  C:\Windows\System\sfaFTsn.exe
  2⤵
  PID:14904
- C:\Windows\System\GukBITw.exe
  C:\Windows\System\GukBITw.exe
  2⤵
  PID:14932
- C:\Windows\System\jKvSmdr.exe
  C:\Windows\System\jKvSmdr.exe
  2⤵
  PID:14948
- C:\Windows\System\ErjWOlT.exe
  C:\Windows\System\ErjWOlT.exe
  2⤵
  PID:14980
- C:\Windows\System\UvlTwqD.exe
  C:\Windows\System\UvlTwqD.exe
  2⤵
  PID:14996
- C:\Windows\System\zumWMfv.exe
  C:\Windows\System\zumWMfv.exe
  2⤵
  PID:15024
- C:\Windows\System\KILYpBV.exe
  C:\Windows\System\KILYpBV.exe
  2⤵
  PID:15076
- C:\Windows\System\sSkomUW.exe
  C:\Windows\System\sSkomUW.exe
  2⤵
  PID:15104
- C:\Windows\System\CuUPuvs.exe
  C:\Windows\System\CuUPuvs.exe
  2⤵
  PID:15132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jexut1nl.xen.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AcpVLBA.exe

Filesize
1.8MB

MD5
46cb08a8965bfdc7df58715019732bdd

SHA1
cb8136f8803787b7136564e7ad5475d0dbcc373b

SHA256
4499f2b1d951855f2c1f6beae7a90a930e8fb0e7da8982b4c11eb3f5d081903f

SHA512
3ef22084642823416f0ad12f702aa09f3c7d1e99041f179930bc2724b91c3959d006dd9ee4e5a22694dfdf2cee5e48e39adeae14a67b4547f29df095a794240d

Download Submit
C:\Windows\System\AdxONUG.exe

Filesize
1.8MB

MD5
119a07be3cdb4b425433f24e550f0760

SHA1
a7370321885ca6d93013fc086a33d96a4760164d

SHA256
aeb39998a302334b5ad20ad9b0eb095ef42449a6b11828124f922a44dadded9e

SHA512
5f1822be2c8b1f16a78558fc8f3856095ba0703de6815bf9d9ca86cb95a37c39bee22efd2371676c2a04d4bf7720ba7a24b8cb7bea94d3d070f813480c7ead42

Download Submit
C:\Windows\System\AlxemAK.exe

Filesize
1.8MB

MD5
0c5a7172a8b77946b8fd2669369972e9

SHA1
0bc9e0cf515b23e108e35cda28e959c799abd77d

SHA256
ecb3bb8afcdd5560a432a7c845c5e75fe5ffe78faccc9ca4e875d4481f4a2d47

SHA512
08717eb4de0a9bed6f33f7d01bec62bd00255d40678f70e057123c582e097f9f2706eb8831ac77bb99e05b584dacf80e57acc6cc47ec24630991a2f5758e8690

Download Submit
C:\Windows\System\BJFFzfZ.exe

Filesize
1.8MB

MD5
398317aa9b7ae68ac27a50e73a7fdbed

SHA1
ebb7fab182cc1dc412dcfa4aa22f58f62960e222

SHA256
1562ce0261dfabfa3fdac091c55008b10b3def17d42aa20c3c289f803c907f09

SHA512
9e8ff60dac7e6abd1b8080a10bf24f6980d40d032860273fa23b23427a7e8b9a680a15deb87dd898c25f9c4ebe991028c9a0bd774ac91a7ffe2475f67a9a578c

Download Submit
C:\Windows\System\BpMoJYy.exe

Filesize
1.8MB

MD5
ba7ba1c777e20c742a81b5b5b224158b

SHA1
ce86171d6721e18d06b320db9740ca1023c3db42

SHA256
fbfaf5655390ccfcb7abfc401675c5e913c7d1101c72b3371c67603a423e3b65

SHA512
285c69931679d2b4bd69a2952210b85dafd949709be0d56b480e2aba69bcfe668c69400578fc5f6aa95670341b24126f9702209df32630ca6e03b95026115721

Download Submit
C:\Windows\System\FpcCcXp.exe

Filesize
1.8MB

MD5
c059b8123ffd746a46e99720bcc417ad

SHA1
be5285e926d202f5daf7fe0eb09acbf649c702e9

SHA256
d538978d16591723efefc2531bf44c72e2f333076225444fb075da8ffe8df7bb

SHA512
d33cdf0693b5f3eb9c855fb3371cb0a6095e841185c5a888cc69eabd2786c4d21a7c232bbc93c014b2c209986571c02a93229ef19da7b096f75b1756c736850b

Download Submit
C:\Windows\System\GObHEOI.exe

Filesize
1.8MB

MD5
cf3cdda2bc4051bf237cc46766514a6c

SHA1
d0eb383b1913e5de09b93e675b8d7619d5eb6c31

SHA256
970caf2a9524d2516fb2afffd617c8d4a216b325d7734234866f002984164bf0

SHA512
ab6711c285af715ae52b5feec4a32e7260f986a6d05a28873f20c4d3406207188507fc2d82b64432b744cae4c0e7d7aa54c44617bc1fbcdc3f8639c99e176080

Download Submit
C:\Windows\System\HpbfhLf.exe

Filesize
1.8MB

MD5
eea6f2a59972bde50de5cfe465e74f6d

SHA1
e152f5524fa76e42e4eddb9818354f9692f9a5d9

SHA256
a0d17d7a2babbf665fcbb81ce399729049fc5d9471215e858bced3d8424d67c7

SHA512
51cfaee6158d1f7b866e85c416e60e2f2c7a36d77cfb1c4de898919cdba1efb06fdf6979d9407697bc24d35b721e6edb6005c0d2efe8b70dca1d5141e9ad08ac

Download Submit
C:\Windows\System\JbnJgla.exe

Filesize
1.8MB

MD5
f481b8ee1c220fa2a3ecefb77a436afe

SHA1
9e6b0f6bd53b1cfb7687d503e19bde8b641c694f

SHA256
78fd8eab1e7039a523e12a82f432defef46327de2f8a5decd806ba961ce7708f

SHA512
be95ebfb4296f98b91a130b5ed5a4b9b6e65df20f097d23df4f84eb0332347d30b62cd7023a43f42644779270a753a47ba2f3c2309ebe0d55892ddee8c9393b9

Download Submit
C:\Windows\System\KTVPxfZ.exe

Filesize
1.8MB

MD5
6bb656ddf1844789ef8da9f8f32a1b96

SHA1
af2fe1223263142671b9d8a2e55682a723096f40

SHA256
555ae9c1b21f719b651d5d20f44ff9bbb0fac4d1225cc6ad34e071e7c92aab82

SHA512
115f5bff9eb811ee1e08d46e3b0f493fbdaffb135f0da50eb9ce50f77d2acaaf765755d270bdc8bd019b2e1f3dd8e29f62b4d70e83df745da452427ff01f0611

Download Submit
C:\Windows\System\KiXIHwX.exe

Filesize
1.8MB

MD5
b7df0933daa7dd158449a5a574b0e6cc

SHA1
6b718f453b3bb3b5e2355fe1a5eed317d0c5f5b1

SHA256
296c9d3e9fa45430276fc0a6c837190e765e175a5b062de62038ff6e24a08c4d

SHA512
eb0d4dcddbfa31beac3dfe9a957672a1ec6b13279d889764855957607788aee03d76d1bcd61d986aedb1441161f23d4741446d281c83c28942fc518e35620b75

Download Submit
C:\Windows\System\LOgkSYh.exe

Filesize
1.8MB

MD5
2fcffdfccbff8d1d2bcc11742bf53ce2

SHA1
7d2b50ed8b54d386b1827812eef3b7c98c20ec07

SHA256
f78d95220bc39a8f93b5c6f4ac36506d6a2ba6211810921149c6b04fe222b678

SHA512
76990edb296a1a490d0df592022b12348e7808d86229b6b2a1b51dbf7cfac5aa0df948678997d436524ea377ecc4515077d3d003e3689967fa26ffc778b80648

Download Submit
C:\Windows\System\NoYPlOE.exe

Filesize
1.8MB

MD5
1250efa247edd595bdf6711420ab6bad

SHA1
363d6a93b4a436ef3a7ace0c56d0c90266e50df2

SHA256
b7a7c8b1b4851723167d0acc55c317332b4cea5957d702f24452c18515065987

SHA512
162b2540a64c19da425a885bb48d34cd39ba2465ed3c2ed20bb849e4b8fd32c6d2490e27d0395d0bc8b5b5256a2f1a10b6c54572a3848705232abbd06f41b743

Download Submit
C:\Windows\System\OzlMLst.exe

Filesize
1.8MB

MD5
f1f6cc051ef424dc284c34ad3c116caa

SHA1
d01a2711f01804a5a262488cbffde2996a78aa55

SHA256
6e174b036157ee601544c48122784e8c9ef85f203c47f3427159dd40738f9827

SHA512
7764e38f73e39d7e2e840f3639e5f48cce698da19702079a0f37b00fd9142e77eb218f58dfa615d4572d46471739f009ea88b4b9fcf50344fefa6e4eb9c98273

Download Submit
C:\Windows\System\VRHmFKB.exe

Filesize
1.8MB

MD5
bb62038bb5ef01debc7cb5e58a3b1481

SHA1
f8a9101ead1de1c1371624668cc1718d65840645

SHA256
f8ed7b7f419d8671b63f1ee80570352a0d6b88b4f96b917fa7942322d451ffa0

SHA512
622bbc0378aad9874aaae530f886ca91683f586ac0317cd88cf3e876c50f141a4258f6efecd31e7725614633f497f991324e632a412a70c8cbd433fc9f765d23

Download Submit
C:\Windows\System\WMKFOBp.exe

Filesize
1.8MB

MD5
7e7ee9998e4765a040a1601dd31cedc1

SHA1
83cb9913b09b7d5408d101b8f00a39a1f09b1f4e

SHA256
a684e7a1c24f27f7deb0fc424c8ac7c140328ea8844b3abc47660439c10a3867

SHA512
1869c5fbde489a42e18e879faea2c3903b2ba6797bbc81504f3d4003aba2a243caa5d2fb4a5c4e06896fba73cf6d33299bc98cfd592c3ba91be22f2a65a9e049

Download Submit
C:\Windows\System\WfAwBwG.exe

Filesize
1.8MB

MD5
ae05f9afd86781af6fa761ade7e6cf1b

SHA1
80fc7521b2103991bbe6c368afa1891d8de6a1bb

SHA256
02092337df686268e0ed82d128a08e528d58d2789d8183a151d5372b0ac00103

SHA512
80b44175e18c86f189757e6df8f947e255e67880e621cfeaac19e0d4af758b37d0f4de33e39efca14784a550379e32a686b2c581c775ed7d1340b495f74bdca6

Download Submit
C:\Windows\System\WzshkYP.exe

Filesize
1.8MB

MD5
3bc4ab79596264601434a1c82a25661b

SHA1
776f3e229f38b1449a0ce89f5aea49739bc8f160

SHA256
16775904bebe9b7a15269a14ab00a27ed7db12d85006d41cf4ae4d190a78bed3

SHA512
64cfb9092082abf486c00641e0dde75ae887128a94c48275dc48169df29d60fe0dd8efe121109d7ad0d909ec70242f7951e78bdd36f43cec6d5619380372278f

Download Submit
C:\Windows\System\XKLFEGC.exe

Filesize
1.8MB

MD5
2667dccac3e66b1f90a5546bbf9a93e3

SHA1
aa8a9403cae07665996083d91f5c5ec684194f2d

SHA256
950b52ca755fd90dd08116ffad7220e05fa87ce11c331fd61473fa53e9701b44

SHA512
803a7428b869ad476d26a4813210d478605ef25049f2a790a3b49fa8dd5d69487934e9bf39db298e99a05fa06781c76d6d1be992da94242a7d5770c1a7e8ac78

Download Submit
C:\Windows\System\dPUqBnN.exe

Filesize
1.8MB

MD5
e31cb905aeb32ddc91c846cbac5a8312

SHA1
937af83c2816c2e05b362a89d44a9a6dfe04aff6

SHA256
6435371ad1fe9333015946685413f01f9b7e060088a0fd83797d209ee6f53531

SHA512
8565fadfd4962f6fa4baac2b44cfc6e01b65681866354ee20fe83042380fe67fb1a7500e2435519bb89c29167290e644fd2cd2e83af142e6d4a139de7392c0ca

Download Submit
C:\Windows\System\dQYiwAh.exe

Filesize
1.8MB

MD5
c54834ef5b892b113a8a36b03aa3b0ff

SHA1
53860e32760fabe87848c8f75075f53c2ef1e341

SHA256
b38485f6d35e716f9dc2aa501b34b69c1223aa619a0c7e03f4839ecc5f5d71fe

SHA512
b245d281f9ddcc371f86f32e150bbb4345081609f838d35c97676957b16881045a7b8284f574558e1149b830da8513fde0c3e4e989ca96e76fb089b3441c51a5

Download Submit
C:\Windows\System\eCxtzen.exe

Filesize
18B

MD5
0f74d26e324b3e4ca82621930feb3f71

SHA1
51c6fa90586c9009cc733bd2843df60120221d7c

SHA256
fd7091421895dbcf3ff7ed5b13b38b3963999338b6384ef6aea7e3d35f76533b

SHA512
4138922aed63819f2a910844c95c594cb337f1a54724135c8e61e94f0fb0e215db86c537da9be91f8c7625d109830aca6217c6d58a22b0f4be237d3c65bc9b67

Download Submit
C:\Windows\System\foFRtre.exe

Filesize
1.8MB

MD5
84adf74fdf828bdca4efc58d2fa32d61

SHA1
d27d5ea1c36a963645cf6a3f4e30440c587f03b3

SHA256
4ed141f4d0a52673b935d24d688124eef1d210540e5eae1622757b13949acc00

SHA512
8120dc1f05e70098087823e32b744e7133d1420e1f8af019a3ce00d075ef8df4afd9685f6d0b40d0319cb6694dde2289699166cf4eb10ae83bfa4123666a11fd

Download Submit
C:\Windows\System\iibNZia.exe

Filesize
1.8MB

MD5
e924bc6fbd9a2c13e3b43cbb87f6b212

SHA1
3cad20e48da6b68ac746deb08d4e8ac0fad538b0

SHA256
3fcc110fad8aa0ee849aadf0d6dccdabd4d46e1be1a339c7bf11e502b6c637f1

SHA512
ff5ccc5a7c32cc2a47ca71a4c488c98c3d2cb8b1deb3f3c7fa62e734a299b10ee399dd90baf21245647e58c728b50e877a294fdfcc6b38ea0d19b15d95757a24

Download Submit
C:\Windows\System\jgNHKLt.exe

Filesize
1.8MB

MD5
519aa46ea63362c1d1df4ce71b5e163c

SHA1
f173fc3f98ef622833293741469c85f08fcffcc9

SHA256
5dcd90e54e4a5c9fd8ca7afea2878a5fadbacb8f757f10a0bbd341389366059c

SHA512
030e91823e4d52d034d78acfc83237a2b9fcc803b3f6aabd3c0454b2933380662b1613cdc470ace37a6cf60e47a9a922e469d06ccb87fc83a818c66513fc8fbd

Download Submit
C:\Windows\System\kRXuSRw.exe

Filesize
1.8MB

MD5
1f21d4f466e502e0a42bb4e69a5a9b32

SHA1
b34ffa8952a609aa033be71b835bfab2350ad4f8

SHA256
a529e38bc6e3a3985713c6af91a6766039d4bd82671af20d3780e1aa73c9044e

SHA512
3acf43d68e11457a7a476953abd28d78b1f75f831e60eb7b50a584c5d65c5f10b5c0fd886bc00575e6633a06651c5bcbb8b9491fecac1927dcec083ddca49dc1

Download Submit
C:\Windows\System\nqSEMcu.exe

Filesize
1.8MB

MD5
d383c6f722426504b66245bb33c60942

SHA1
d69bd7b4674cd20eceb76ef89bfdf77473609bbc

SHA256
5701ddd0c28c2ce99d5041d02be1e058d8bcba97187e914a1cd02c17ea770180

SHA512
8b1d513b4b5d1a8d4f32f345674e131f680d93dd13ae6d166927164046ef840f344d46131704283a671a3d3060fbbf4e8dad79692bcc6fd8404a8edd043276dd

Download Submit
C:\Windows\System\pnuwsZq.exe

Filesize
1.8MB

MD5
655884c0c7f0f589d0b551ba18b5f622

SHA1
f131e6a1bf3d4095fd48aa8e2f6c84e44b533c37

SHA256
ccbe848aa76eb25bd617cd4ba04601140b0136ee8756ac6eb9174759a8b61282

SHA512
d722d9b490d38c7e8cbca957a948fe0d5aa3ec71997281115af4bf395631f624cd7973fe95c65c40112d9cc5071c8de7ce118e686cbcaba2f2a3fa3b422be7de

Download Submit
C:\Windows\System\qaAFTpt.exe

Filesize
1.8MB

MD5
d66aa65e1641708b2c58541597ce85ac

SHA1
667193c022f174821918488d6897ef6977247f0e

SHA256
d5f1c0bd4e94a8c37558082f12d97ee945a7d8d6cb56a6bbfe55ddd081c9f416

SHA512
e4065421ae151227c20e00bdeb27a2350d292de0883c361814f929a0285ad3faff5bee4691ed41e4646ac78d8ef9308373689be3045880723bf4b6397005eac3

Download Submit
C:\Windows\System\reytsbD.exe

Filesize
1.8MB

MD5
82e249ac7bdc0d87629039ffaff757fc

SHA1
c8a02b835abb1e7a1eaac4bc633babc5c824d50f

SHA256
5fa788e2103bb3c2bf67ea81a110ca9897e441e39e4a258b9de6170dac51bac0

SHA512
c5a47ead6e6003a09ccef8ae50705919ad38d1e230c4b12436e7250fea34cff8df1330733020897d41e70edb87ede6bac81d929fbc315b8b7f9d2f3269a0d584

Download Submit
C:\Windows\System\rnSyoKV.exe

Filesize
1.8MB

MD5
6c35b408cf4e100b4c56465149bb4dd4

SHA1
cdfcaa804092e54e95057a655fc750390a441db0

SHA256
13a8cf8e61a045a2ddfb764f08d1b4e6fe977076ba68af10f7cfae6b65f0d4ec

SHA512
686ddb1dccf6d2448ad43ec308e816b10db42332b70674eb94fe69fe7f8da44f74d3eaf0a371ffa9578c0f4829de668e0b6569ed084b069af7e880f4e07e75be

Download Submit
C:\Windows\System\vRGGCKj.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\wLwcjpM.exe

Filesize
1.8MB

MD5
133be942323053a5dbea71b7f692918e

SHA1
fec4f63d3ab10afb830bde96bf64280fb39c748c

SHA256
6bae055cd8a979099f00af642965963359708057589007b2cf0cb86f1838f840

SHA512
08b12ee416b93321c90c983cb631c1b3a9a2863b16bf76415ce48de743d92bd82346b4af6e2a2e0e29ad761e1e2a108b9753f9dfdd145b2cabc483f0a4504289

Download Submit
C:\Windows\System\xrJPCZA.exe

Filesize
1.8MB

MD5
b6feea9e97676e40a4f645ab14bf40e3

SHA1
d0456d2e5e3bd7a7e75b3895fcfad7298b96ee1b

SHA256
cd54452890f3fbfb3eb63da269f1f5d9add84f9b9def45ff1945a6b5ce228288

SHA512
760757d07298e930357e7cddb2f7d7b5033ce46c9ec4edd93184d55f6e91cb3c07fe44becdacd5acc921c0b4f6dc007dddfbae6a1789bd0b4f02cfdc30dc767f

Download Submit
C:\Windows\System\xspqvjd.exe

Filesize
1.8MB

MD5
1625248e941824c51c5d63c62371359f

SHA1
71e5442472fbc31c159fc401d9a373c47fdca29b

SHA256
062614e9eecce053377b35155e1b1393dc43aa6097bcaf65b8b1a6829f437396

SHA512
d95bc42fcd7154cbab429ab76d15c43f259e6feeafa3eabf50ffa4e192c1c34f086273ae971642999d6a5c6ddced5a652a20f2a033304c0df8083ebea741d538

Download Submit
C:\Windows\System\xtvCzJj.exe

Filesize
1.8MB

MD5
2da64993ff3f1dfb13253ad215d0fe05

SHA1
2594394893bf0e01121d4446b335b95b7561d6bc

SHA256
792633e97cb8a5fe95fe7710f0f0b8ca4d4d543d5cee9a0a012100262c1fdaeb

SHA512
35b102874d8fd23297adc8a4985b234f86ceea50cfc099d7ed65349a6ac6bc42df69cd84f0c6a8c36c2ebbb09881547f44570a10afcb0d642cf6f3b28534e45c

Download Submit
C:\Windows\System\xyKSaVk.exe

Filesize
1.8MB

MD5
f554ccdcbd48cac951700dcb14842059

SHA1
d84f017b494cdd58ec9c3d7a227c9b902d060457

SHA256
f87878061c14d71818eb88568f06fcfc3c9dfcb258228d1c902cfa4278e393e5

SHA512
e2f9a06638fbba07bf15af648f2bcf43bd4140fdf076ba7689c36d942b6221e59bb71bd004b23caaa71b45c48f60a77c9945978df2d94bbd1e132a9680d5c16b

Download Submit
C:\Windows\System\ybuZdbL.exe

Filesize
1.8MB

MD5
84270d9c4ab65ced4c60f6dc1c58f806

SHA1
aa8a41e95fbdc298ed8ef0d6fdeefdf93e010f0d

SHA256
2c7295205c706bc8ce7f4f4626a50ade6a90fc92f15ce765aecdf45926bb3c37

SHA512
80fd9bbc4f55030c9186aa598faf53e4f15e20423f084ad4d6cf8fedd833e6ec79f7f322e6c3439d4cde34b9923723d1f842762ccf53e819c790ee66e5bf82c0

Download Submit
C:\Windows\System\zMJimel.exe

Filesize
1.8MB

MD5
e804b18b95c0c3d55f5406d209660587

SHA1
81c687e6e8f8a7046fabe4e74aae82b5ba14e442

SHA256
34e3bc4169c2eaf779cfbb61f9876a46e90c79f932326cbba2b7792bdc2c0fa0

SHA512
b4fbbb344f70199eb6251464237b2fcc508d5f8fb760b00270235887ee09a1e0b7b440cf2f3ea62b41f037189b2fc019d18e9e023f09a0a0b48d90b661332f11

Download Submit
C:\Windows\System\zSJFUEG.exe

Filesize
1.8MB

MD5
19e23d20f3f7c614ec7932bfa55a4bdd

SHA1
456586771a81d317667238528f32ee2afe95deb0

SHA256
3019dd9d601aeb8aa86e70a871f4a95dd01685331e9785ab7dbe0458651d46a6

SHA512
756973666a60d74c882fc7e8155af384eefd7d2bb5e6d765149afd443ce73a451a65526c828bcab6841fc8ab0b0270cff853bdf50f1977492a9889fd2adfc82e

Download Submit
memory/64-3767-0x00007FF631520000-0x00007FF631912000-memory.dmp

Filesize
3.9MB

Download
memory/64-420-0x00007FF631520000-0x00007FF631912000-memory.dmp

Filesize
3.9MB

Download
memory/512-3784-0x00007FF79DAD0000-0x00007FF79DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/512-440-0x00007FF79DAD0000-0x00007FF79DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3773-0x00007FF7AFE80000-0x00007FF7B0272000-memory.dmp

Filesize
3.9MB

Download
memory/1128-433-0x00007FF7AFE80000-0x00007FF7B0272000-memory.dmp

Filesize
3.9MB

Download
memory/1292-3783-0x00007FF67B0C0000-0x00007FF67B4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-447-0x00007FF67B0C0000-0x00007FF67B4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-442-0x00007FF685460000-0x00007FF685852000-memory.dmp

Filesize
3.9MB

Download
memory/1596-3787-0x00007FF685460000-0x00007FF685852000-memory.dmp

Filesize
3.9MB

Download
memory/1628-328-0x00007FF6C9260000-0x00007FF6C9652000-memory.dmp

Filesize
3.9MB

Download
memory/1628-3737-0x00007FF6C9260000-0x00007FF6C9652000-memory.dmp

Filesize
3.9MB

Download
memory/1840-3791-0x00007FF61FE70000-0x00007FF620262000-memory.dmp

Filesize
3.9MB

Download
memory/1840-443-0x00007FF61FE70000-0x00007FF620262000-memory.dmp

Filesize
3.9MB

Download
memory/1892-431-0x00007FF604B40000-0x00007FF604F32000-memory.dmp

Filesize
3.9MB

Download
memory/1892-3764-0x00007FF604B40000-0x00007FF604F32000-memory.dmp

Filesize
3.9MB

Download
memory/1924-446-0x00007FF778B70000-0x00007FF778F62000-memory.dmp

Filesize
3.9MB

Download
memory/1924-3738-0x00007FF778B70000-0x00007FF778F62000-memory.dmp

Filesize
3.9MB

Download
memory/2036-408-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp

Filesize
3.9MB

Download
memory/2036-3748-0x00007FF70DD50000-0x00007FF70E142000-memory.dmp

Filesize
3.9MB

Download
memory/2196-434-0x00007FF61C9C0000-0x00007FF61CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-3763-0x00007FF61C9C0000-0x00007FF61CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-3769-0x00007FF6CC840000-0x00007FF6CCC32000-memory.dmp

Filesize
3.9MB

Download
memory/2332-430-0x00007FF6CC840000-0x00007FF6CCC32000-memory.dmp

Filesize
3.9MB

Download
memory/2344-439-0x00007FF785E60000-0x00007FF786252000-memory.dmp

Filesize
3.9MB

Download
memory/2344-3793-0x00007FF785E60000-0x00007FF786252000-memory.dmp

Filesize
3.9MB

Download
memory/2664-441-0x00007FF688290000-0x00007FF688682000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3778-0x00007FF688290000-0x00007FF688682000-memory.dmp

Filesize
3.9MB

Download
memory/2828-255-0x00007FF654760000-0x00007FF654B52000-memory.dmp

Filesize
3.9MB

Download
memory/2828-3742-0x00007FF654760000-0x00007FF654B52000-memory.dmp

Filesize
3.9MB

Download
memory/2872-435-0x00007FF722370000-0x00007FF722762000-memory.dmp

Filesize
3.9MB

Download
memory/2872-3761-0x00007FF722370000-0x00007FF722762000-memory.dmp

Filesize
3.9MB

Download
memory/2980-438-0x00007FF7E2B90000-0x00007FF7E2F82000-memory.dmp

Filesize
3.9MB

Download
memory/2980-3795-0x00007FF7E2B90000-0x00007FF7E2F82000-memory.dmp

Filesize
3.9MB

Download
memory/3096-3758-0x00007FF66CBA0000-0x00007FF66CF92000-memory.dmp

Filesize
3.9MB

Download
memory/3096-436-0x00007FF66CBA0000-0x00007FF66CF92000-memory.dmp

Filesize
3.9MB

Download
memory/3152-3842-0x00007FF712FE0000-0x00007FF7133D2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-444-0x00007FF712FE0000-0x00007FF7133D2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-3770-0x00007FF6ACC60000-0x00007FF6AD052000-memory.dmp

Filesize
3.9MB

Download
memory/3540-432-0x00007FF6ACC60000-0x00007FF6AD052000-memory.dmp

Filesize
3.9MB

Download
memory/3728-185-0x00007FFCB9F50000-0x00007FFCBAA11000-memory.dmp

Filesize
10.8MB

Download
memory/3728-124-0x000001EE7A7A0000-0x000001EE7A7C2000-memory.dmp

Filesize
136KB

Download
memory/3728-7-0x00007FFCB9F53000-0x00007FFCB9F55000-memory.dmp

Filesize
8KB

Download
memory/3728-65-0x00007FFCB9F50000-0x00007FFCBAA11000-memory.dmp

Filesize
10.8MB

Download
memory/4080-262-0x00007FF753A70000-0x00007FF753E62000-memory.dmp

Filesize
3.9MB

Download
memory/4084-3744-0x00007FF67A5E0000-0x00007FF67A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-364-0x00007FF67A5E0000-0x00007FF67A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3755-0x00007FF688BA0000-0x00007FF688F92000-memory.dmp

Filesize
3.9MB

Download
memory/4512-437-0x00007FF688BA0000-0x00007FF688F92000-memory.dmp

Filesize
3.9MB

Download
memory/4588-445-0x00007FF68E5C0000-0x00007FF68E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-3808-0x00007FF68E5C0000-0x00007FF68E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4612-0-0x00007FF71AC20000-0x00007FF71B012000-memory.dmp

Filesize
3.9MB

Download
memory/4612-1-0x000001F586BB0000-0x000001F586BC0000-memory.dmp

Filesize
64KB

Download
memory/4612-4140-0x00007FF71AC20000-0x00007FF71B012000-memory.dmp

Filesize
3.9MB

Download