xmrig | 1b4c17af087c8a75a5ecafe81cbc3468b0833a9ed1f5fd1892cda6dacb921651

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240729-en
resource tags

arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
Size

2.0MB
MD5

02cbadfb57fd5226e5ab17813869039b
SHA1

b0a6f75cba68aa58ed15b26cc312c3367a4d351d
SHA256

1b4c17af087c8a75a5ecafe81cbc3468b0833a9ed1f5fd1892cda6dacb921651
SHA512

db86d7a28147865fa5910558bce1017a819675c24bde22961935ac07b545d303b7d4a7360df7dc9c9063de660c51c33ff4fed7afa98e5257e60987bf0aee5db4
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1nfl:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/2980-431-0x00007FF756380000-0x00007FF756772000-memory.dmp	xmrig
behavioral2/memory/3160-446-0x00007FF7CF7D0000-0x00007FF7CFBC2000-memory.dmp	xmrig
behavioral2/memory/3416-462-0x00007FF6ACF60000-0x00007FF6AD352000-memory.dmp	xmrig
behavioral2/memory/320-492-0x00007FF69A600000-0x00007FF69A9F2000-memory.dmp	xmrig
behavioral2/memory/1488-511-0x00007FF6CC1D0000-0x00007FF6CC5C2000-memory.dmp	xmrig
behavioral2/memory/3232-514-0x00007FF704A10000-0x00007FF704E02000-memory.dmp	xmrig
behavioral2/memory/2684-513-0x00007FF694140000-0x00007FF694532000-memory.dmp	xmrig
behavioral2/memory/1732-512-0x00007FF67FA30000-0x00007FF67FE22000-memory.dmp	xmrig
behavioral2/memory/1112-496-0x00007FF7BE840000-0x00007FF7BEC32000-memory.dmp	xmrig
behavioral2/memory/3912-491-0x00007FF6E4B20000-0x00007FF6E4F12000-memory.dmp	xmrig
behavioral2/memory/1420-490-0x00007FF6A9D10000-0x00007FF6AA102000-memory.dmp	xmrig
behavioral2/memory/4960-475-0x00007FF687AB0000-0x00007FF687EA2000-memory.dmp	xmrig
behavioral2/memory/5084-456-0x00007FF6AD9A0000-0x00007FF6ADD92000-memory.dmp	xmrig
behavioral2/memory/3580-455-0x00007FF7B9B90000-0x00007FF7B9F82000-memory.dmp	xmrig
behavioral2/memory/1908-404-0x00007FF67E180000-0x00007FF67E572000-memory.dmp	xmrig
behavioral2/memory/1188-379-0x00007FF7434C0000-0x00007FF7438B2000-memory.dmp	xmrig
behavioral2/memory/4740-356-0x00007FF72CA80000-0x00007FF72CE72000-memory.dmp	xmrig
behavioral2/memory/2240-355-0x00007FF79DF60000-0x00007FF79E352000-memory.dmp	xmrig
behavioral2/memory/848-318-0x00007FF70ED50000-0x00007FF70F142000-memory.dmp	xmrig
behavioral2/memory/1736-288-0x00007FF72A850000-0x00007FF72AC42000-memory.dmp	xmrig
behavioral2/memory/4116-249-0x00007FF692040000-0x00007FF692432000-memory.dmp	xmrig
behavioral2/memory/4816-257-0x00007FF7E2730000-0x00007FF7E2B22000-memory.dmp	xmrig
behavioral2/memory/1264-217-0x00007FF7AD8F0000-0x00007FF7ADCE2000-memory.dmp	xmrig
behavioral2/memory/3492-76-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	xmrig
behavioral2/memory/1736-4747-0x00007FF72A850000-0x00007FF72AC42000-memory.dmp	xmrig
behavioral2/memory/848-4744-0x00007FF70ED50000-0x00007FF70F142000-memory.dmp	xmrig
behavioral2/memory/4816-4759-0x00007FF7E2730000-0x00007FF7E2B22000-memory.dmp	xmrig
behavioral2/memory/2684-4765-0x00007FF694140000-0x00007FF694532000-memory.dmp	xmrig
behavioral2/memory/1908-4778-0x00007FF67E180000-0x00007FF67E572000-memory.dmp	xmrig
behavioral2/memory/4960-4774-0x00007FF687AB0000-0x00007FF687EA2000-memory.dmp	xmrig
behavioral2/memory/3160-4782-0x00007FF7CF7D0000-0x00007FF7CFBC2000-memory.dmp	xmrig
behavioral2/memory/3416-4788-0x00007FF6ACF60000-0x00007FF6AD352000-memory.dmp	xmrig
behavioral2/memory/1188-4770-0x00007FF7434C0000-0x00007FF7438B2000-memory.dmp	xmrig
behavioral2/memory/4740-4764-0x00007FF72CA80000-0x00007FF72CE72000-memory.dmp	xmrig
behavioral2/memory/1420-4808-0x00007FF6A9D10000-0x00007FF6AA102000-memory.dmp	xmrig
behavioral2/memory/3912-4811-0x00007FF6E4B20000-0x00007FF6E4F12000-memory.dmp	xmrig
behavioral2/memory/2240-4815-0x00007FF79DF60000-0x00007FF79E352000-memory.dmp	xmrig
behavioral2/memory/320-4834-0x00007FF69A600000-0x00007FF69A9F2000-memory.dmp	xmrig
behavioral2/memory/4940-4993-0x00007FF7DC730000-0x00007FF7DCB22000-memory.dmp	xmrig
behavioral2/memory/1488-4823-0x00007FF6CC1D0000-0x00007FF6CC5C2000-memory.dmp	xmrig
behavioral2/memory/1112-4819-0x00007FF7BE840000-0x00007FF7BEC32000-memory.dmp	xmrig
behavioral2/memory/2980-4805-0x00007FF756380000-0x00007FF756772000-memory.dmp	xmrig
behavioral2/memory/5084-4800-0x00007FF6AD9A0000-0x00007FF6ADD92000-memory.dmp	xmrig
behavioral2/memory/3232-4798-0x00007FF704A10000-0x00007FF704E02000-memory.dmp	xmrig
behavioral2/memory/3580-4794-0x00007FF7B9B90000-0x00007FF7B9F82000-memory.dmp	xmrig
behavioral2/memory/3492-4742-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3664	powershell.exe
7	3664	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3664	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3492	fsJxZoR.exe
1732	Swvpprm.exe
1264	pYBazbC.exe
4116	IxzyLwJ.exe
4816	inwkgla.exe
1736	achDTcf.exe
848	qHuCfsQ.exe
2240	zgauoiM.exe
4740	gZPQCVD.exe
1188	dfczktv.exe
1908	uSxNxZS.exe
2980	zJasKTw.exe
2684	vfINxPb.exe
3160	tgDEsnn.exe
3580	iFwqAid.exe
5084	hjaGzlZ.exe
3232	xxcnSCD.exe
3416	Tfuruof.exe
4960	nxuXkgh.exe
1420	xEPlOUQ.exe
3912	vwzinUR.exe
320	TtOhNMp.exe
1112	BnXLulR.exe
1488	QzmEqxj.exe
4392	UcEuIsc.exe
4088	sgsOrCN.exe
4408	UyhRCfW.exe
1900	ItXeRGe.exe
2236	flZKdbb.exe
4244	SpzQomE.exe
4428	RGPTIOU.exe
2636	wqbTTyo.exe
3604	aIKjAkT.exe
3368	KtKJnPM.exe
2996	cumiubb.exe
4400	XLQFPMA.exe
3540	PbMwxwB.exe
2628	ZVCYWqF.exe
3536	jnWdKRv.exe
2984	YILsSfO.exe
2280	jkPSpiF.exe
1172	CtroqJL.exe
4232	pnHbNzo.exe
3468	FzoByFv.exe
4336	itWdNjy.exe
3520	ybrCPEw.exe
4796	mXBClCh.exe
1364	ioFCKYy.exe
324	mrsrPXM.exe
4036	LqYmbmh.exe
4524	ZUoYcSk.exe
4112	biVnKyq.exe
4736	BWnHmRg.exe
3648	dichMDO.exe
4008	MyoreHv.exe
4380	lYWdfQt.exe
312	tRbxZju.exe
2136	bymRqmg.exe
5044	nLboGKe.exe
4300	wUQXmfI.exe
4156	xXhjeGK.exe
4636	hfmZVci.exe
924	ngIoAwS.exe
1464	VybGrpW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x00007FF7DC730000-0x00007FF7DCB22000-memory.dmp	upx
behavioral2/files/0x00070000000235b0-30.dat	upx
behavioral2/files/0x00070000000235be-90.dat	upx
behavioral2/files/0x00070000000235c6-113.dat	upx
behavioral2/files/0x00070000000235ce-178.dat	upx
behavioral2/memory/2980-431-0x00007FF756380000-0x00007FF756772000-memory.dmp	upx
behavioral2/memory/3160-446-0x00007FF7CF7D0000-0x00007FF7CFBC2000-memory.dmp	upx
behavioral2/memory/3416-462-0x00007FF6ACF60000-0x00007FF6AD352000-memory.dmp	upx
behavioral2/memory/320-492-0x00007FF69A600000-0x00007FF69A9F2000-memory.dmp	upx
behavioral2/memory/1488-511-0x00007FF6CC1D0000-0x00007FF6CC5C2000-memory.dmp	upx
behavioral2/memory/3232-514-0x00007FF704A10000-0x00007FF704E02000-memory.dmp	upx
behavioral2/memory/2684-513-0x00007FF694140000-0x00007FF694532000-memory.dmp	upx
behavioral2/memory/1732-512-0x00007FF67FA30000-0x00007FF67FE22000-memory.dmp	upx
behavioral2/memory/1112-496-0x00007FF7BE840000-0x00007FF7BEC32000-memory.dmp	upx
behavioral2/memory/3912-491-0x00007FF6E4B20000-0x00007FF6E4F12000-memory.dmp	upx
behavioral2/memory/1420-490-0x00007FF6A9D10000-0x00007FF6AA102000-memory.dmp	upx
behavioral2/memory/4960-475-0x00007FF687AB0000-0x00007FF687EA2000-memory.dmp	upx
behavioral2/memory/5084-456-0x00007FF6AD9A0000-0x00007FF6ADD92000-memory.dmp	upx
behavioral2/memory/3580-455-0x00007FF7B9B90000-0x00007FF7B9F82000-memory.dmp	upx
behavioral2/memory/1908-404-0x00007FF67E180000-0x00007FF67E572000-memory.dmp	upx
behavioral2/memory/1188-379-0x00007FF7434C0000-0x00007FF7438B2000-memory.dmp	upx
behavioral2/memory/4740-356-0x00007FF72CA80000-0x00007FF72CE72000-memory.dmp	upx
behavioral2/memory/2240-355-0x00007FF79DF60000-0x00007FF79E352000-memory.dmp	upx
behavioral2/memory/848-318-0x00007FF70ED50000-0x00007FF70F142000-memory.dmp	upx
behavioral2/memory/1736-288-0x00007FF72A850000-0x00007FF72AC42000-memory.dmp	upx
behavioral2/memory/4116-249-0x00007FF692040000-0x00007FF692432000-memory.dmp	upx
behavioral2/memory/4816-257-0x00007FF7E2730000-0x00007FF7E2B22000-memory.dmp	upx
behavioral2/files/0x00070000000235d2-189.dat	upx
behavioral2/files/0x00070000000235d1-188.dat	upx
behavioral2/memory/1264-217-0x00007FF7AD8F0000-0x00007FF7ADCE2000-memory.dmp	upx
behavioral2/files/0x00070000000235cf-180.dat	upx
behavioral2/files/0x00070000000235cd-175.dat	upx
behavioral2/files/0x00070000000235cc-172.dat	upx
behavioral2/files/0x00070000000235c4-171.dat	upx
behavioral2/files/0x00070000000235c3-169.dat	upx
behavioral2/files/0x00070000000235cb-168.dat	upx
behavioral2/files/0x00070000000235ca-162.dat	upx
behavioral2/files/0x00080000000235ad-159.dat	upx
behavioral2/files/0x00070000000235c1-154.dat	upx
behavioral2/files/0x00070000000235c0-148.dat	upx
behavioral2/files/0x00070000000235c9-147.dat	upx
behavioral2/files/0x00070000000235d0-187.dat	upx
behavioral2/files/0x00070000000235bb-133.dat	upx
behavioral2/files/0x00070000000235bd-129.dat	upx
behavioral2/files/0x00070000000235b4-128.dat	upx
behavioral2/files/0x00070000000235bc-119.dat	upx
behavioral2/files/0x00070000000235c7-118.dat	upx
behavioral2/files/0x00070000000235b8-117.dat	upx
behavioral2/files/0x00070000000235c8-146.dat	upx
behavioral2/files/0x00070000000235c5-114.dat	upx
behavioral2/files/0x00070000000235ba-108.dat	upx
behavioral2/files/0x00070000000235c2-107.dat	upx
behavioral2/files/0x00070000000235b7-99.dat	upx
behavioral2/files/0x00070000000235bf-97.dat	upx
behavioral2/files/0x00070000000235b6-86.dat	upx
behavioral2/files/0x00070000000235b5-83.dat	upx
behavioral2/files/0x00070000000235b9-78.dat	upx
behavioral2/memory/3492-76-0x00007FF789800000-0x00007FF789BF2000-memory.dmp	upx
behavioral2/files/0x00070000000235b3-40.dat	upx
behavioral2/files/0x00070000000235b2-35.dat	upx
behavioral2/files/0x00070000000235b1-24.dat	upx
behavioral2/files/0x00080000000235af-23.dat	upx
behavioral2/files/0x00080000000235ac-31.dat	upx
behavioral2/files/0x000a000000023597-11.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oRNOScw.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ToDNajg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\XHsMsop.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jJguTeY.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\BjMPsPf.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\RAMvgMU.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\qJeBDKe.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\KesPvUP.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\vguRCrU.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jvhgGBt.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\wBXWvxa.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\UBVvGPx.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\xkndyTt.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ukflNuY.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\aMsYaXp.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\UkxfSew.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\TNaPNux.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\EMNlqxE.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\gnWueoO.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\HSYcCpA.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\VNOcVnj.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\tdwHaiI.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\lqZfJHf.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\QzmEqxj.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\yghhhGq.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jldPfRx.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\LrxTkjV.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\hyCKDTq.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\snQGbFl.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\sIEQWDr.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\TnYymLY.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\cTMotWe.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\OnlSDOt.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\LkyqZgX.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\YkRsYDS.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\pxhsIGP.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ulYHtpg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\FnUgWdd.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\FzaaHIU.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\JlIgCjP.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\WWjRRFh.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\TiNDQMw.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\eZisbvI.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\fUYzzhL.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\lYOadgh.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\JqzAKzc.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\TYAEphj.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\UmYmgCA.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\nreJBDo.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\JvWgvsg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\kXnXDgy.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\dugMhHY.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\vSsIHfM.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\dCQkmQm.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\sEeHXly.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\QlnlIfx.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\CuJTEkk.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\kzdUpEO.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ZKUCmlG.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\OKvsSaS.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\oYSTAah.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\iLjiAbm.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\yBbULkp.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\qYFeskR.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeLockMemoryPrivilege	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3664	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	85
PID 4940 wrote to memory of 3664	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	85
PID 4940 wrote to memory of 3492	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	86
PID 4940 wrote to memory of 3492	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	86
PID 4940 wrote to memory of 1264	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	87
PID 4940 wrote to memory of 1264	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	87
PID 4940 wrote to memory of 1732	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	88
PID 4940 wrote to memory of 1732	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	88
PID 4940 wrote to memory of 4816	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	89
PID 4940 wrote to memory of 4816	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	89
PID 4940 wrote to memory of 4116	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	90
PID 4940 wrote to memory of 4116	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	90
PID 4940 wrote to memory of 1736	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	91
PID 4940 wrote to memory of 1736	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	91
PID 4940 wrote to memory of 848	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	92
PID 4940 wrote to memory of 848	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	92
PID 4940 wrote to memory of 2240	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	93
PID 4940 wrote to memory of 2240	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	93
PID 4940 wrote to memory of 4740	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	94
PID 4940 wrote to memory of 4740	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	94
PID 4940 wrote to memory of 1188	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	95
PID 4940 wrote to memory of 1188	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	95
PID 4940 wrote to memory of 1908	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	96
PID 4940 wrote to memory of 1908	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	96
PID 4940 wrote to memory of 2980	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	97
PID 4940 wrote to memory of 2980	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	97
PID 4940 wrote to memory of 2684	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	98
PID 4940 wrote to memory of 2684	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	98
PID 4940 wrote to memory of 3160	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	99
PID 4940 wrote to memory of 3160	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	99
PID 4940 wrote to memory of 3580	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	100
PID 4940 wrote to memory of 3580	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	100
PID 4940 wrote to memory of 5084	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	101
PID 4940 wrote to memory of 5084	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	101
PID 4940 wrote to memory of 3232	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	102
PID 4940 wrote to memory of 3232	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	102
PID 4940 wrote to memory of 3416	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	103
PID 4940 wrote to memory of 3416	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	103
PID 4940 wrote to memory of 4960	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	104
PID 4940 wrote to memory of 4960	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	104
PID 4940 wrote to memory of 1420	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	105
PID 4940 wrote to memory of 1420	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	105
PID 4940 wrote to memory of 3912	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	106
PID 4940 wrote to memory of 3912	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	106
PID 4940 wrote to memory of 320	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	107
PID 4940 wrote to memory of 320	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	107
PID 4940 wrote to memory of 1112	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	108
PID 4940 wrote to memory of 1112	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	108
PID 4940 wrote to memory of 1488	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	109
PID 4940 wrote to memory of 1488	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	109
PID 4940 wrote to memory of 4392	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	110
PID 4940 wrote to memory of 4392	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	110
PID 4940 wrote to memory of 4088	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	111
PID 4940 wrote to memory of 4088	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	111
PID 4940 wrote to memory of 4408	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	112
PID 4940 wrote to memory of 4408	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	112
PID 4940 wrote to memory of 1900	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	113
PID 4940 wrote to memory of 1900	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	113
PID 4940 wrote to memory of 2236	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	114
PID 4940 wrote to memory of 2236	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	114
PID 4940 wrote to memory of 4244	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	115
PID 4940 wrote to memory of 4244	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	115
PID 4940 wrote to memory of 4428	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	116
PID 4940 wrote to memory of 4428	4940	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3664" "2964" "2912" "2968" "0" "0" "2972" "0" "0" "0" "0" "0"
    3⤵
    PID:12428
- C:\Windows\System\fsJxZoR.exe
  C:\Windows\System\fsJxZoR.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\pYBazbC.exe
  C:\Windows\System\pYBazbC.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\Swvpprm.exe
  C:\Windows\System\Swvpprm.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\inwkgla.exe
  C:\Windows\System\inwkgla.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\IxzyLwJ.exe
  C:\Windows\System\IxzyLwJ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\achDTcf.exe
  C:\Windows\System\achDTcf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\qHuCfsQ.exe
  C:\Windows\System\qHuCfsQ.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\zgauoiM.exe
  C:\Windows\System\zgauoiM.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\gZPQCVD.exe
  C:\Windows\System\gZPQCVD.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\dfczktv.exe
  C:\Windows\System\dfczktv.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\uSxNxZS.exe
  C:\Windows\System\uSxNxZS.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\zJasKTw.exe
  C:\Windows\System\zJasKTw.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\vfINxPb.exe
  C:\Windows\System\vfINxPb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\tgDEsnn.exe
  C:\Windows\System\tgDEsnn.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\iFwqAid.exe
  C:\Windows\System\iFwqAid.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\hjaGzlZ.exe
  C:\Windows\System\hjaGzlZ.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xxcnSCD.exe
  C:\Windows\System\xxcnSCD.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\Tfuruof.exe
  C:\Windows\System\Tfuruof.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\nxuXkgh.exe
  C:\Windows\System\nxuXkgh.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\xEPlOUQ.exe
  C:\Windows\System\xEPlOUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\vwzinUR.exe
  C:\Windows\System\vwzinUR.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\TtOhNMp.exe
  C:\Windows\System\TtOhNMp.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\BnXLulR.exe
  C:\Windows\System\BnXLulR.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\QzmEqxj.exe
  C:\Windows\System\QzmEqxj.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\UcEuIsc.exe
  C:\Windows\System\UcEuIsc.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\sgsOrCN.exe
  C:\Windows\System\sgsOrCN.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\UyhRCfW.exe
  C:\Windows\System\UyhRCfW.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ItXeRGe.exe
  C:\Windows\System\ItXeRGe.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\flZKdbb.exe
  C:\Windows\System\flZKdbb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SpzQomE.exe
  C:\Windows\System\SpzQomE.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\RGPTIOU.exe
  C:\Windows\System\RGPTIOU.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\wqbTTyo.exe
  C:\Windows\System\wqbTTyo.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aIKjAkT.exe
  C:\Windows\System\aIKjAkT.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\KtKJnPM.exe
  C:\Windows\System\KtKJnPM.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\cumiubb.exe
  C:\Windows\System\cumiubb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\XLQFPMA.exe
  C:\Windows\System\XLQFPMA.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\PbMwxwB.exe
  C:\Windows\System\PbMwxwB.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\ZVCYWqF.exe
  C:\Windows\System\ZVCYWqF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\jnWdKRv.exe
  C:\Windows\System\jnWdKRv.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\YILsSfO.exe
  C:\Windows\System\YILsSfO.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\jkPSpiF.exe
  C:\Windows\System\jkPSpiF.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\CtroqJL.exe
  C:\Windows\System\CtroqJL.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\pnHbNzo.exe
  C:\Windows\System\pnHbNzo.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\FzoByFv.exe
  C:\Windows\System\FzoByFv.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\itWdNjy.exe
  C:\Windows\System\itWdNjy.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ybrCPEw.exe
  C:\Windows\System\ybrCPEw.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\mXBClCh.exe
  C:\Windows\System\mXBClCh.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\xXhjeGK.exe
  C:\Windows\System\xXhjeGK.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ioFCKYy.exe
  C:\Windows\System\ioFCKYy.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\mrsrPXM.exe
  C:\Windows\System\mrsrPXM.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\LqYmbmh.exe
  C:\Windows\System\LqYmbmh.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\ZUoYcSk.exe
  C:\Windows\System\ZUoYcSk.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\biVnKyq.exe
  C:\Windows\System\biVnKyq.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\BWnHmRg.exe
  C:\Windows\System\BWnHmRg.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\dichMDO.exe
  C:\Windows\System\dichMDO.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\MyoreHv.exe
  C:\Windows\System\MyoreHv.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\lYWdfQt.exe
  C:\Windows\System\lYWdfQt.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\tRbxZju.exe
  C:\Windows\System\tRbxZju.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\bymRqmg.exe
  C:\Windows\System\bymRqmg.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\nLboGKe.exe
  C:\Windows\System\nLboGKe.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\wUQXmfI.exe
  C:\Windows\System\wUQXmfI.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\hfmZVci.exe
  C:\Windows\System\hfmZVci.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ngIoAwS.exe
  C:\Windows\System\ngIoAwS.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\VybGrpW.exe
  C:\Windows\System\VybGrpW.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\zUonDiY.exe
  C:\Windows\System\zUonDiY.exe
  2⤵
  PID:1904
- C:\Windows\System\zsRAukj.exe
  C:\Windows\System\zsRAukj.exe
  2⤵
  PID:2356
- C:\Windows\System\CNdtGhB.exe
  C:\Windows\System\CNdtGhB.exe
  2⤵
  PID:5040
- C:\Windows\System\hntFnsM.exe
  C:\Windows\System\hntFnsM.exe
  2⤵
  PID:4564
- C:\Windows\System\mNsIlGi.exe
  C:\Windows\System\mNsIlGi.exe
  2⤵
  PID:3528
- C:\Windows\System\bXgfuRx.exe
  C:\Windows\System\bXgfuRx.exe
  2⤵
  PID:1148
- C:\Windows\System\InGkhaQ.exe
  C:\Windows\System\InGkhaQ.exe
  2⤵
  PID:4412
- C:\Windows\System\IwIuyYA.exe
  C:\Windows\System\IwIuyYA.exe
  2⤵
  PID:1056
- C:\Windows\System\nqsvSbX.exe
  C:\Windows\System\nqsvSbX.exe
  2⤵
  PID:2044
- C:\Windows\System\NPLhpMW.exe
  C:\Windows\System\NPLhpMW.exe
  2⤵
  PID:4852
- C:\Windows\System\jsDjDKF.exe
  C:\Windows\System\jsDjDKF.exe
  2⤵
  PID:4516
- C:\Windows\System\JEVEzYJ.exe
  C:\Windows\System\JEVEzYJ.exe
  2⤵
  PID:2088
- C:\Windows\System\ysfQklD.exe
  C:\Windows\System\ysfQklD.exe
  2⤵
  PID:3660
- C:\Windows\System\RAMvgMU.exe
  C:\Windows\System\RAMvgMU.exe
  2⤵
  PID:4440
- C:\Windows\System\SlRrOhX.exe
  C:\Windows\System\SlRrOhX.exe
  2⤵
  PID:2644
- C:\Windows\System\OvVvxCg.exe
  C:\Windows\System\OvVvxCg.exe
  2⤵
  PID:1200
- C:\Windows\System\QKItGWu.exe
  C:\Windows\System\QKItGWu.exe
  2⤵
  PID:5028
- C:\Windows\System\LKONafz.exe
  C:\Windows\System\LKONafz.exe
  2⤵
  PID:3968
- C:\Windows\System\uuCFijp.exe
  C:\Windows\System\uuCFijp.exe
  2⤵
  PID:2488
- C:\Windows\System\yconxkJ.exe
  C:\Windows\System\yconxkJ.exe
  2⤵
  PID:2608
- C:\Windows\System\GyXPlkj.exe
  C:\Windows\System\GyXPlkj.exe
  2⤵
  PID:1280
- C:\Windows\System\LiTdlxo.exe
  C:\Windows\System\LiTdlxo.exe
  2⤵
  PID:4956
- C:\Windows\System\vfmmDWW.exe
  C:\Windows\System\vfmmDWW.exe
  2⤵
  PID:5144
- C:\Windows\System\EWYBtfG.exe
  C:\Windows\System\EWYBtfG.exe
  2⤵
  PID:5160
- C:\Windows\System\sgwhbVt.exe
  C:\Windows\System\sgwhbVt.exe
  2⤵
  PID:5220
- C:\Windows\System\nzNeNRv.exe
  C:\Windows\System\nzNeNRv.exe
  2⤵
  PID:5236
- C:\Windows\System\MogkBFE.exe
  C:\Windows\System\MogkBFE.exe
  2⤵
  PID:5260
- C:\Windows\System\mnJiZeF.exe
  C:\Windows\System\mnJiZeF.exe
  2⤵
  PID:5284
- C:\Windows\System\kkERcAq.exe
  C:\Windows\System\kkERcAq.exe
  2⤵
  PID:5308
- C:\Windows\System\uIaYvqy.exe
  C:\Windows\System\uIaYvqy.exe
  2⤵
  PID:5324
- C:\Windows\System\HspjooC.exe
  C:\Windows\System\HspjooC.exe
  2⤵
  PID:5348
- C:\Windows\System\aghilsx.exe
  C:\Windows\System\aghilsx.exe
  2⤵
  PID:5368
- C:\Windows\System\WVaWTxJ.exe
  C:\Windows\System\WVaWTxJ.exe
  2⤵
  PID:5388
- C:\Windows\System\BEwNgkY.exe
  C:\Windows\System\BEwNgkY.exe
  2⤵
  PID:5416
- C:\Windows\System\kmjYFiQ.exe
  C:\Windows\System\kmjYFiQ.exe
  2⤵
  PID:5436
- C:\Windows\System\vkzoYGw.exe
  C:\Windows\System\vkzoYGw.exe
  2⤵
  PID:5452
- C:\Windows\System\FYRaoxD.exe
  C:\Windows\System\FYRaoxD.exe
  2⤵
  PID:5576
- C:\Windows\System\LiqhmPZ.exe
  C:\Windows\System\LiqhmPZ.exe
  2⤵
  PID:5596
- C:\Windows\System\rHpyLQH.exe
  C:\Windows\System\rHpyLQH.exe
  2⤵
  PID:5620
- C:\Windows\System\rgayTau.exe
  C:\Windows\System\rgayTau.exe
  2⤵
  PID:5644
- C:\Windows\System\ZGXvhho.exe
  C:\Windows\System\ZGXvhho.exe
  2⤵
  PID:5664
- C:\Windows\System\ySTOPqf.exe
  C:\Windows\System\ySTOPqf.exe
  2⤵
  PID:5756
- C:\Windows\System\GfctTPU.exe
  C:\Windows\System\GfctTPU.exe
  2⤵
  PID:5784
- C:\Windows\System\iqeTkbx.exe
  C:\Windows\System\iqeTkbx.exe
  2⤵
  PID:5808
- C:\Windows\System\nhumLZi.exe
  C:\Windows\System\nhumLZi.exe
  2⤵
  PID:5840
- C:\Windows\System\bXLkLWJ.exe
  C:\Windows\System\bXLkLWJ.exe
  2⤵
  PID:5864
- C:\Windows\System\WufktAd.exe
  C:\Windows\System\WufktAd.exe
  2⤵
  PID:5884
- C:\Windows\System\mVQDwkm.exe
  C:\Windows\System\mVQDwkm.exe
  2⤵
  PID:5912
- C:\Windows\System\aDioXLA.exe
  C:\Windows\System\aDioXLA.exe
  2⤵
  PID:5936
- C:\Windows\System\zVCndEn.exe
  C:\Windows\System\zVCndEn.exe
  2⤵
  PID:6056
- C:\Windows\System\YSGGIdv.exe
  C:\Windows\System\YSGGIdv.exe
  2⤵
  PID:6072
- C:\Windows\System\HWeXZNK.exe
  C:\Windows\System\HWeXZNK.exe
  2⤵
  PID:6092
- C:\Windows\System\CFsHoua.exe
  C:\Windows\System\CFsHoua.exe
  2⤵
  PID:6116
- C:\Windows\System\VOBvowU.exe
  C:\Windows\System\VOBvowU.exe
  2⤵
  PID:6132
- C:\Windows\System\tVBzcxv.exe
  C:\Windows\System\tVBzcxv.exe
  2⤵
  PID:1088
- C:\Windows\System\dkMNDBx.exe
  C:\Windows\System\dkMNDBx.exe
  2⤵
  PID:3424
- C:\Windows\System\jRpruDu.exe
  C:\Windows\System\jRpruDu.exe
  2⤵
  PID:3440
- C:\Windows\System\EKMcEFx.exe
  C:\Windows\System\EKMcEFx.exe
  2⤵
  PID:5024
- C:\Windows\System\TxdUNfY.exe
  C:\Windows\System\TxdUNfY.exe
  2⤵
  PID:4804
- C:\Windows\System\kVQHuAl.exe
  C:\Windows\System\kVQHuAl.exe
  2⤵
  PID:5360
- C:\Windows\System\zLRcIQK.exe
  C:\Windows\System\zLRcIQK.exe
  2⤵
  PID:5408
- C:\Windows\System\YuxgslE.exe
  C:\Windows\System\YuxgslE.exe
  2⤵
  PID:4328
- C:\Windows\System\CVTxeim.exe
  C:\Windows\System\CVTxeim.exe
  2⤵
  PID:5684
- C:\Windows\System\HyVRcpc.exe
  C:\Windows\System\HyVRcpc.exe
  2⤵
  PID:5444
- C:\Windows\System\YwZbYGo.exe
  C:\Windows\System\YwZbYGo.exe
  2⤵
  PID:5524
- C:\Windows\System\galxKhn.exe
  C:\Windows\System\galxKhn.exe
  2⤵
  PID:5900
- C:\Windows\System\YZPNnQx.exe
  C:\Windows\System\YZPNnQx.exe
  2⤵
  PID:6084
- C:\Windows\System\GDZYKGj.exe
  C:\Windows\System\GDZYKGj.exe
  2⤵
  PID:4840
- C:\Windows\System\HcoNpOZ.exe
  C:\Windows\System\HcoNpOZ.exe
  2⤵
  PID:5732
- C:\Windows\System\lqFBcek.exe
  C:\Windows\System\lqFBcek.exe
  2⤵
  PID:5860
- C:\Windows\System\EQocSuw.exe
  C:\Windows\System\EQocSuw.exe
  2⤵
  PID:6100
- C:\Windows\System\VXKSWLv.exe
  C:\Windows\System\VXKSWLv.exe
  2⤵
  PID:5396
- C:\Windows\System\TsjHuzO.exe
  C:\Windows\System\TsjHuzO.exe
  2⤵
  PID:2528
- C:\Windows\System\FdHPnQy.exe
  C:\Windows\System\FdHPnQy.exe
  2⤵
  PID:4512
- C:\Windows\System\wpMtKlb.exe
  C:\Windows\System\wpMtKlb.exe
  2⤵
  PID:2272
- C:\Windows\System\QvLBszH.exe
  C:\Windows\System\QvLBszH.exe
  2⤵
  PID:6112
- C:\Windows\System\cbVTxLq.exe
  C:\Windows\System\cbVTxLq.exe
  2⤵
  PID:5872
- C:\Windows\System\dkbVEcN.exe
  C:\Windows\System\dkbVEcN.exe
  2⤵
  PID:6392
- C:\Windows\System\ClclnXh.exe
  C:\Windows\System\ClclnXh.exe
  2⤵
  PID:6428
- C:\Windows\System\DGQHEat.exe
  C:\Windows\System\DGQHEat.exe
  2⤵
  PID:6452
- C:\Windows\System\cUSkMBW.exe
  C:\Windows\System\cUSkMBW.exe
  2⤵
  PID:6480
- C:\Windows\System\mnruaoB.exe
  C:\Windows\System\mnruaoB.exe
  2⤵
  PID:6500
- C:\Windows\System\gqjjCHe.exe
  C:\Windows\System\gqjjCHe.exe
  2⤵
  PID:6528
- C:\Windows\System\okTADeB.exe
  C:\Windows\System\okTADeB.exe
  2⤵
  PID:6544
- C:\Windows\System\wumwEqT.exe
  C:\Windows\System\wumwEqT.exe
  2⤵
  PID:6568
- C:\Windows\System\cUeSBwO.exe
  C:\Windows\System\cUeSBwO.exe
  2⤵
  PID:6596
- C:\Windows\System\TySWjCI.exe
  C:\Windows\System\TySWjCI.exe
  2⤵
  PID:6612
- C:\Windows\System\SYqxdRr.exe
  C:\Windows\System\SYqxdRr.exe
  2⤵
  PID:6632
- C:\Windows\System\sJmixBN.exe
  C:\Windows\System\sJmixBN.exe
  2⤵
  PID:6656
- C:\Windows\System\NWFoIxj.exe
  C:\Windows\System\NWFoIxj.exe
  2⤵
  PID:6680
- C:\Windows\System\IROvVDN.exe
  C:\Windows\System\IROvVDN.exe
  2⤵
  PID:6696
- C:\Windows\System\GSNvRhA.exe
  C:\Windows\System\GSNvRhA.exe
  2⤵
  PID:6712
- C:\Windows\System\diWQAhr.exe
  C:\Windows\System\diWQAhr.exe
  2⤵
  PID:6732
- C:\Windows\System\fbXuxVE.exe
  C:\Windows\System\fbXuxVE.exe
  2⤵
  PID:6756
- C:\Windows\System\fnWNQBE.exe
  C:\Windows\System\fnWNQBE.exe
  2⤵
  PID:6776
- C:\Windows\System\QIPhnjT.exe
  C:\Windows\System\QIPhnjT.exe
  2⤵
  PID:6796
- C:\Windows\System\cbwTVVL.exe
  C:\Windows\System\cbwTVVL.exe
  2⤵
  PID:6820
- C:\Windows\System\wumIzlP.exe
  C:\Windows\System\wumIzlP.exe
  2⤵
  PID:6840
- C:\Windows\System\sdjZUkY.exe
  C:\Windows\System\sdjZUkY.exe
  2⤵
  PID:6864
- C:\Windows\System\YHnXQLh.exe
  C:\Windows\System\YHnXQLh.exe
  2⤵
  PID:6884
- C:\Windows\System\pkhnUHn.exe
  C:\Windows\System\pkhnUHn.exe
  2⤵
  PID:6904
- C:\Windows\System\hEdrqyB.exe
  C:\Windows\System\hEdrqyB.exe
  2⤵
  PID:6924
- C:\Windows\System\VBaIANz.exe
  C:\Windows\System\VBaIANz.exe
  2⤵
  PID:6952
- C:\Windows\System\WfukVVH.exe
  C:\Windows\System\WfukVVH.exe
  2⤵
  PID:6968
- C:\Windows\System\owlnojE.exe
  C:\Windows\System\owlnojE.exe
  2⤵
  PID:6992
- C:\Windows\System\WKXHCYc.exe
  C:\Windows\System\WKXHCYc.exe
  2⤵
  PID:7012
- C:\Windows\System\ixaDiwu.exe
  C:\Windows\System\ixaDiwu.exe
  2⤵
  PID:7032
- C:\Windows\System\sBrzwvj.exe
  C:\Windows\System\sBrzwvj.exe
  2⤵
  PID:7052
- C:\Windows\System\TrbXiHH.exe
  C:\Windows\System\TrbXiHH.exe
  2⤵
  PID:7076
- C:\Windows\System\SIEEqjK.exe
  C:\Windows\System\SIEEqjK.exe
  2⤵
  PID:7092
- C:\Windows\System\XUzjAWu.exe
  C:\Windows\System\XUzjAWu.exe
  2⤵
  PID:7132
- C:\Windows\System\CVjvTIU.exe
  C:\Windows\System\CVjvTIU.exe
  2⤵
  PID:7156
- C:\Windows\System\zwZUUWG.exe
  C:\Windows\System\zwZUUWG.exe
  2⤵
  PID:5992
- C:\Windows\System\TBQmAck.exe
  C:\Windows\System\TBQmAck.exe
  2⤵
  PID:1948
- C:\Windows\System\ASoNyJo.exe
  C:\Windows\System\ASoNyJo.exe
  2⤵
  PID:5228
- C:\Windows\System\VVuhxHp.exe
  C:\Windows\System\VVuhxHp.exe
  2⤵
  PID:5740
- C:\Windows\System\HSIYsFP.exe
  C:\Windows\System\HSIYsFP.exe
  2⤵
  PID:1572
- C:\Windows\System\LmdpRbJ.exe
  C:\Windows\System\LmdpRbJ.exe
  2⤵
  PID:2008
- C:\Windows\System\MWdKrCg.exe
  C:\Windows\System\MWdKrCg.exe
  2⤵
  PID:4368
- C:\Windows\System\lqYreLR.exe
  C:\Windows\System\lqYreLR.exe
  2⤵
  PID:3636
- C:\Windows\System\TievscL.exe
  C:\Windows\System\TievscL.exe
  2⤵
  PID:5012
- C:\Windows\System\COhLgXq.exe
  C:\Windows\System\COhLgXq.exe
  2⤵
  PID:2472
- C:\Windows\System\GbrXVPl.exe
  C:\Windows\System\GbrXVPl.exe
  2⤵
  PID:2676
- C:\Windows\System\XEfPBkA.exe
  C:\Windows\System\XEfPBkA.exe
  2⤵
  PID:2816
- C:\Windows\System\xYZkrOW.exe
  C:\Windows\System\xYZkrOW.exe
  2⤵
  PID:1740
- C:\Windows\System\TFtRamm.exe
  C:\Windows\System\TFtRamm.exe
  2⤵
  PID:784
- C:\Windows\System\bCULuay.exe
  C:\Windows\System\bCULuay.exe
  2⤵
  PID:3012
- C:\Windows\System\cbbcDDk.exe
  C:\Windows\System\cbbcDDk.exe
  2⤵
  PID:6444
- C:\Windows\System\OwEFAJU.exe
  C:\Windows\System\OwEFAJU.exe
  2⤵
  PID:6416
- C:\Windows\System\EjaWXnd.exe
  C:\Windows\System\EjaWXnd.exe
  2⤵
  PID:6408
- C:\Windows\System\NDmghHo.exe
  C:\Windows\System\NDmghHo.exe
  2⤵
  PID:3820
- C:\Windows\System\MPnpIWW.exe
  C:\Windows\System\MPnpIWW.exe
  2⤵
  PID:3532
- C:\Windows\System\ERQKOpm.exe
  C:\Windows\System\ERQKOpm.exe
  2⤵
  PID:6508
- C:\Windows\System\cqsEAFe.exe
  C:\Windows\System\cqsEAFe.exe
  2⤵
  PID:6552
- C:\Windows\System\stMaStp.exe
  C:\Windows\System\stMaStp.exe
  2⤵
  PID:6608
- C:\Windows\System\ZhAeKrj.exe
  C:\Windows\System\ZhAeKrj.exe
  2⤵
  PID:6692
- C:\Windows\System\gOFpECu.exe
  C:\Windows\System\gOFpECu.exe
  2⤵
  PID:6792
- C:\Windows\System\QmXISYN.exe
  C:\Windows\System\QmXISYN.exe
  2⤵
  PID:6828
- C:\Windows\System\LJmbOYO.exe
  C:\Windows\System\LJmbOYO.exe
  2⤵
  PID:6808
- C:\Windows\System\BHiDgVV.exe
  C:\Windows\System\BHiDgVV.exe
  2⤵
  PID:6784
- C:\Windows\System\KVodWBW.exe
  C:\Windows\System\KVodWBW.exe
  2⤵
  PID:7064
- C:\Windows\System\vtHYOmO.exe
  C:\Windows\System\vtHYOmO.exe
  2⤵
  PID:6932
- C:\Windows\System\cvgNUUX.exe
  C:\Windows\System\cvgNUUX.exe
  2⤵
  PID:7040
- C:\Windows\System\LHDHUEN.exe
  C:\Windows\System\LHDHUEN.exe
  2⤵
  PID:6196
- C:\Windows\System\ZvDZSqS.exe
  C:\Windows\System\ZvDZSqS.exe
  2⤵
  PID:6964
- C:\Windows\System\wHnGYxS.exe
  C:\Windows\System\wHnGYxS.exe
  2⤵
  PID:6980
- C:\Windows\System\yBbULkp.exe
  C:\Windows\System\yBbULkp.exe
  2⤵
  PID:6988
- C:\Windows\System\TlsSZbe.exe
  C:\Windows\System\TlsSZbe.exe
  2⤵
  PID:5536
- C:\Windows\System\NdRkYsi.exe
  C:\Windows\System\NdRkYsi.exe
  2⤵
  PID:2908
- C:\Windows\System\TGidTZE.exe
  C:\Windows\System\TGidTZE.exe
  2⤵
  PID:3708
- C:\Windows\System\srRgBoV.exe
  C:\Windows\System\srRgBoV.exe
  2⤵
  PID:7152
- C:\Windows\System\kFQEOQm.exe
  C:\Windows\System\kFQEOQm.exe
  2⤵
  PID:1276
- C:\Windows\System\OvaZWfG.exe
  C:\Windows\System\OvaZWfG.exe
  2⤵
  PID:1436
- C:\Windows\System\DKmLFaS.exe
  C:\Windows\System\DKmLFaS.exe
  2⤵
  PID:2036
- C:\Windows\System\ycNKqnM.exe
  C:\Windows\System\ycNKqnM.exe
  2⤵
  PID:7196
- C:\Windows\System\vpPqTmj.exe
  C:\Windows\System\vpPqTmj.exe
  2⤵
  PID:7224
- C:\Windows\System\gvBuCTW.exe
  C:\Windows\System\gvBuCTW.exe
  2⤵
  PID:7244
- C:\Windows\System\YwiRizS.exe
  C:\Windows\System\YwiRizS.exe
  2⤵
  PID:7272
- C:\Windows\System\IyUEuMH.exe
  C:\Windows\System\IyUEuMH.exe
  2⤵
  PID:7292
- C:\Windows\System\xDdQmLk.exe
  C:\Windows\System\xDdQmLk.exe
  2⤵
  PID:7312
- C:\Windows\System\KywtzPp.exe
  C:\Windows\System\KywtzPp.exe
  2⤵
  PID:7332
- C:\Windows\System\eWAOGYs.exe
  C:\Windows\System\eWAOGYs.exe
  2⤵
  PID:7364
- C:\Windows\System\fenmtAu.exe
  C:\Windows\System\fenmtAu.exe
  2⤵
  PID:7388
- C:\Windows\System\emKRkza.exe
  C:\Windows\System\emKRkza.exe
  2⤵
  PID:7408
- C:\Windows\System\JXiMGNV.exe
  C:\Windows\System\JXiMGNV.exe
  2⤵
  PID:7432
- C:\Windows\System\tuNgkJy.exe
  C:\Windows\System\tuNgkJy.exe
  2⤵
  PID:7452
- C:\Windows\System\wmOxnNY.exe
  C:\Windows\System\wmOxnNY.exe
  2⤵
  PID:7476
- C:\Windows\System\fQmhpFv.exe
  C:\Windows\System\fQmhpFv.exe
  2⤵
  PID:7496
- C:\Windows\System\IuaTazA.exe
  C:\Windows\System\IuaTazA.exe
  2⤵
  PID:7516
- C:\Windows\System\Mlrlqfs.exe
  C:\Windows\System\Mlrlqfs.exe
  2⤵
  PID:7544
- C:\Windows\System\hKkJHxf.exe
  C:\Windows\System\hKkJHxf.exe
  2⤵
  PID:7568
- C:\Windows\System\vKBsbLF.exe
  C:\Windows\System\vKBsbLF.exe
  2⤵
  PID:7584
- C:\Windows\System\yBsPtmL.exe
  C:\Windows\System\yBsPtmL.exe
  2⤵
  PID:7604
- C:\Windows\System\SVQyQPP.exe
  C:\Windows\System\SVQyQPP.exe
  2⤵
  PID:7624
- C:\Windows\System\BQFIOCS.exe
  C:\Windows\System\BQFIOCS.exe
  2⤵
  PID:7640
- C:\Windows\System\aIbfkrQ.exe
  C:\Windows\System\aIbfkrQ.exe
  2⤵
  PID:7664
- C:\Windows\System\wdnarWQ.exe
  C:\Windows\System\wdnarWQ.exe
  2⤵
  PID:7680
- C:\Windows\System\nwPwYOz.exe
  C:\Windows\System\nwPwYOz.exe
  2⤵
  PID:7700
- C:\Windows\System\KIXYhOy.exe
  C:\Windows\System\KIXYhOy.exe
  2⤵
  PID:7724
- C:\Windows\System\QYYPATg.exe
  C:\Windows\System\QYYPATg.exe
  2⤵
  PID:7744
- C:\Windows\System\QzHYZWX.exe
  C:\Windows\System\QzHYZWX.exe
  2⤵
  PID:7788
- C:\Windows\System\CWjxBsl.exe
  C:\Windows\System\CWjxBsl.exe
  2⤵
  PID:7812
- C:\Windows\System\PDvudiK.exe
  C:\Windows\System\PDvudiK.exe
  2⤵
  PID:7832
- C:\Windows\System\EtQYtmE.exe
  C:\Windows\System\EtQYtmE.exe
  2⤵
  PID:7856
- C:\Windows\System\rcVwtAD.exe
  C:\Windows\System\rcVwtAD.exe
  2⤵
  PID:7880
- C:\Windows\System\bUexsyZ.exe
  C:\Windows\System\bUexsyZ.exe
  2⤵
  PID:7904
- C:\Windows\System\woixvBx.exe
  C:\Windows\System\woixvBx.exe
  2⤵
  PID:7924
- C:\Windows\System\aDhAvXb.exe
  C:\Windows\System\aDhAvXb.exe
  2⤵
  PID:7952
- C:\Windows\System\eUiQDEA.exe
  C:\Windows\System\eUiQDEA.exe
  2⤵
  PID:7968
- C:\Windows\System\HmHDGVc.exe
  C:\Windows\System\HmHDGVc.exe
  2⤵
  PID:7988
- C:\Windows\System\EMYUKZO.exe
  C:\Windows\System\EMYUKZO.exe
  2⤵
  PID:8016
- C:\Windows\System\ZklSvYZ.exe
  C:\Windows\System\ZklSvYZ.exe
  2⤵
  PID:8032
- C:\Windows\System\hJNsXHw.exe
  C:\Windows\System\hJNsXHw.exe
  2⤵
  PID:8052
- C:\Windows\System\gXeylOU.exe
  C:\Windows\System\gXeylOU.exe
  2⤵
  PID:8072
- C:\Windows\System\WHMnRPd.exe
  C:\Windows\System\WHMnRPd.exe
  2⤵
  PID:8096
- C:\Windows\System\edGDMRA.exe
  C:\Windows\System\edGDMRA.exe
  2⤵
  PID:8116
- C:\Windows\System\rNJnoet.exe
  C:\Windows\System\rNJnoet.exe
  2⤵
  PID:8136
- C:\Windows\System\EvOOEaR.exe
  C:\Windows\System\EvOOEaR.exe
  2⤵
  PID:8160
- C:\Windows\System\VXbptKl.exe
  C:\Windows\System\VXbptKl.exe
  2⤵
  PID:8184
- C:\Windows\System\omiZInG.exe
  C:\Windows\System\omiZInG.exe
  2⤵
  PID:6628
- C:\Windows\System\TVglqLa.exe
  C:\Windows\System\TVglqLa.exe
  2⤵
  PID:6640
- C:\Windows\System\SWnxuxW.exe
  C:\Windows\System\SWnxuxW.exe
  2⤵
  PID:7008
- C:\Windows\System\uDUcyIE.exe
  C:\Windows\System\uDUcyIE.exe
  2⤵
  PID:5000
- C:\Windows\System\fUYzzhL.exe
  C:\Windows\System\fUYzzhL.exe
  2⤵
  PID:4612
- C:\Windows\System\aaTzAFh.exe
  C:\Windows\System\aaTzAFh.exe
  2⤵
  PID:7140
- C:\Windows\System\JvWAgaY.exe
  C:\Windows\System\JvWAgaY.exe
  2⤵
  PID:2944
- C:\Windows\System\TcvTkAe.exe
  C:\Windows\System\TcvTkAe.exe
  2⤵
  PID:6900
- C:\Windows\System\DbSyVWu.exe
  C:\Windows\System\DbSyVWu.exe
  2⤵
  PID:1848
- C:\Windows\System\cqycfWG.exe
  C:\Windows\System\cqycfWG.exe
  2⤵
  PID:7524
- C:\Windows\System\BZDXGzI.exe
  C:\Windows\System\BZDXGzI.exe
  2⤵
  PID:5640
- C:\Windows\System\GyztNtb.exe
  C:\Windows\System\GyztNtb.exe
  2⤵
  PID:6492
- C:\Windows\System\PSbpJzz.exe
  C:\Windows\System\PSbpJzz.exe
  2⤵
  PID:7620
- C:\Windows\System\hLBfOqC.exe
  C:\Windows\System\hLBfOqC.exe
  2⤵
  PID:7636
- C:\Windows\System\elxeRSn.exe
  C:\Windows\System\elxeRSn.exe
  2⤵
  PID:7688
- C:\Windows\System\FUuwfZb.exe
  C:\Windows\System\FUuwfZb.exe
  2⤵
  PID:7288
- C:\Windows\System\NkabITX.exe
  C:\Windows\System\NkabITX.exe
  2⤵
  PID:7048
- C:\Windows\System\NFQtTFD.exe
  C:\Windows\System\NFQtTFD.exe
  2⤵
  PID:7448
- C:\Windows\System\suAxaHO.exe
  C:\Windows\System\suAxaHO.exe
  2⤵
  PID:7488
- C:\Windows\System\YSEMcKN.exe
  C:\Windows\System\YSEMcKN.exe
  2⤵
  PID:7536
- C:\Windows\System\VQsmdCu.exe
  C:\Windows\System\VQsmdCu.exe
  2⤵
  PID:7892
- C:\Windows\System\GWsghJH.exe
  C:\Windows\System\GWsghJH.exe
  2⤵
  PID:7940
- C:\Windows\System\zUkqqnU.exe
  C:\Windows\System\zUkqqnU.exe
  2⤵
  PID:7996
- C:\Windows\System\mWoBQmd.exe
  C:\Windows\System\mWoBQmd.exe
  2⤵
  PID:7236
- C:\Windows\System\plnSyzT.exe
  C:\Windows\System\plnSyzT.exe
  2⤵
  PID:8092
- C:\Windows\System\KiOdHQz.exe
  C:\Windows\System\KiOdHQz.exe
  2⤵
  PID:8196
- C:\Windows\System\OlnhvGD.exe
  C:\Windows\System\OlnhvGD.exe
  2⤵
  PID:8216
- C:\Windows\System\KKMXYkO.exe
  C:\Windows\System\KKMXYkO.exe
  2⤵
  PID:8240
- C:\Windows\System\dVPgetS.exe
  C:\Windows\System\dVPgetS.exe
  2⤵
  PID:8256
- C:\Windows\System\MAGdIEx.exe
  C:\Windows\System\MAGdIEx.exe
  2⤵
  PID:8276
- C:\Windows\System\yVfaOym.exe
  C:\Windows\System\yVfaOym.exe
  2⤵
  PID:8308
- C:\Windows\System\UhHbmgd.exe
  C:\Windows\System\UhHbmgd.exe
  2⤵
  PID:8328
- C:\Windows\System\wDqWlet.exe
  C:\Windows\System\wDqWlet.exe
  2⤵
  PID:8348
- C:\Windows\System\BeJOzWI.exe
  C:\Windows\System\BeJOzWI.exe
  2⤵
  PID:8372
- C:\Windows\System\pSPKGaK.exe
  C:\Windows\System\pSPKGaK.exe
  2⤵
  PID:8396
- C:\Windows\System\HtOaoPd.exe
  C:\Windows\System\HtOaoPd.exe
  2⤵
  PID:8424
- C:\Windows\System\LGSbuYb.exe
  C:\Windows\System\LGSbuYb.exe
  2⤵
  PID:8440
- C:\Windows\System\QxlLGeJ.exe
  C:\Windows\System\QxlLGeJ.exe
  2⤵
  PID:8468
- C:\Windows\System\wDqGNpg.exe
  C:\Windows\System\wDqGNpg.exe
  2⤵
  PID:8492
- C:\Windows\System\lspqYtu.exe
  C:\Windows\System\lspqYtu.exe
  2⤵
  PID:8512
- C:\Windows\System\plWeuUa.exe
  C:\Windows\System\plWeuUa.exe
  2⤵
  PID:8532
- C:\Windows\System\narmBia.exe
  C:\Windows\System\narmBia.exe
  2⤵
  PID:8552
- C:\Windows\System\BCtOZEB.exe
  C:\Windows\System\BCtOZEB.exe
  2⤵
  PID:8576
- C:\Windows\System\ItdTBLn.exe
  C:\Windows\System\ItdTBLn.exe
  2⤵
  PID:8592
- C:\Windows\System\djdYOyH.exe
  C:\Windows\System\djdYOyH.exe
  2⤵
  PID:8616
- C:\Windows\System\YuDjrGB.exe
  C:\Windows\System\YuDjrGB.exe
  2⤵
  PID:8640
- C:\Windows\System\qXDzYna.exe
  C:\Windows\System\qXDzYna.exe
  2⤵
  PID:8656
- C:\Windows\System\vIvFjQY.exe
  C:\Windows\System\vIvFjQY.exe
  2⤵
  PID:8680
- C:\Windows\System\eUAtKys.exe
  C:\Windows\System\eUAtKys.exe
  2⤵
  PID:8700
- C:\Windows\System\AaiPxiI.exe
  C:\Windows\System\AaiPxiI.exe
  2⤵
  PID:8716
- C:\Windows\System\cVjDHtP.exe
  C:\Windows\System\cVjDHtP.exe
  2⤵
  PID:8736
- C:\Windows\System\hflXmfX.exe
  C:\Windows\System\hflXmfX.exe
  2⤵
  PID:8752
- C:\Windows\System\WEEghAW.exe
  C:\Windows\System\WEEghAW.exe
  2⤵
  PID:8772
- C:\Windows\System\unXoUPt.exe
  C:\Windows\System\unXoUPt.exe
  2⤵
  PID:8796
- C:\Windows\System\pHgHyTr.exe
  C:\Windows\System\pHgHyTr.exe
  2⤵
  PID:8816
- C:\Windows\System\jWtJhmz.exe
  C:\Windows\System\jWtJhmz.exe
  2⤵
  PID:8840
- C:\Windows\System\AHcAsbV.exe
  C:\Windows\System\AHcAsbV.exe
  2⤵
  PID:8860
- C:\Windows\System\JvYwFnE.exe
  C:\Windows\System\JvYwFnE.exe
  2⤵
  PID:8880
- C:\Windows\System\adnKRFS.exe
  C:\Windows\System\adnKRFS.exe
  2⤵
  PID:8908
- C:\Windows\System\CDLKSvI.exe
  C:\Windows\System\CDLKSvI.exe
  2⤵
  PID:8928
- C:\Windows\System\STYTUrD.exe
  C:\Windows\System\STYTUrD.exe
  2⤵
  PID:8952
- C:\Windows\System\agCoHbq.exe
  C:\Windows\System\agCoHbq.exe
  2⤵
  PID:8976
- C:\Windows\System\uotAUTX.exe
  C:\Windows\System\uotAUTX.exe
  2⤵
  PID:8992
- C:\Windows\System\ciPCPOO.exe
  C:\Windows\System\ciPCPOO.exe
  2⤵
  PID:9012
- C:\Windows\System\mFMAvsr.exe
  C:\Windows\System\mFMAvsr.exe
  2⤵
  PID:9032
- C:\Windows\System\esWOLkW.exe
  C:\Windows\System\esWOLkW.exe
  2⤵
  PID:9052
- C:\Windows\System\TwQenyF.exe
  C:\Windows\System\TwQenyF.exe
  2⤵
  PID:9080
- C:\Windows\System\YsZJBEv.exe
  C:\Windows\System\YsZJBEv.exe
  2⤵
  PID:9104
- C:\Windows\System\RBMxhwl.exe
  C:\Windows\System\RBMxhwl.exe
  2⤵
  PID:9124
- C:\Windows\System\CJmdIdq.exe
  C:\Windows\System\CJmdIdq.exe
  2⤵
  PID:9144
- C:\Windows\System\RxLzwyZ.exe
  C:\Windows\System\RxLzwyZ.exe
  2⤵
  PID:9164
- C:\Windows\System\LHMiqWU.exe
  C:\Windows\System\LHMiqWU.exe
  2⤵
  PID:9188
- C:\Windows\System\hCmlXxx.exe
  C:\Windows\System\hCmlXxx.exe
  2⤵
  PID:6516
- C:\Windows\System\LGqsmpW.exe
  C:\Windows\System\LGqsmpW.exe
  2⤵
  PID:7088
- C:\Windows\System\pqwvaNt.exe
  C:\Windows\System\pqwvaNt.exe
  2⤵
  PID:7356
- C:\Windows\System\daQSASy.exe
  C:\Windows\System\daQSASy.exe
  2⤵
  PID:7400
- C:\Windows\System\UsBndtQ.exe
  C:\Windows\System\UsBndtQ.exe
  2⤵
  PID:7460
- C:\Windows\System\kzNPoKZ.exe
  C:\Windows\System\kzNPoKZ.exe
  2⤵
  PID:7552
- C:\Windows\System\PFqEmZa.exe
  C:\Windows\System\PFqEmZa.exe
  2⤵
  PID:7828
- C:\Windows\System\MWRhwpB.exe
  C:\Windows\System\MWRhwpB.exe
  2⤵
  PID:7672
- C:\Windows\System\xKoGrnf.exe
  C:\Windows\System\xKoGrnf.exe
  2⤵
  PID:7732
- C:\Windows\System\RTQqWIg.exe
  C:\Windows\System\RTQqWIg.exe
  2⤵
  PID:3464
- C:\Windows\System\LgpGVAA.exe
  C:\Windows\System\LgpGVAA.exe
  2⤵
  PID:8388
- C:\Windows\System\UbeygDM.exe
  C:\Windows\System\UbeygDM.exe
  2⤵
  PID:6404
- C:\Windows\System\EtKpOpt.exe
  C:\Windows\System\EtKpOpt.exe
  2⤵
  PID:8508
- C:\Windows\System\UgLJcoS.exe
  C:\Windows\System\UgLJcoS.exe
  2⤵
  PID:7592
- C:\Windows\System\vhjpqWT.exe
  C:\Windows\System\vhjpqWT.exe
  2⤵
  PID:9220
- C:\Windows\System\mXXgYHg.exe
  C:\Windows\System\mXXgYHg.exe
  2⤵
  PID:9236
- C:\Windows\System\QhqMEMA.exe
  C:\Windows\System\QhqMEMA.exe
  2⤵
  PID:9260
- C:\Windows\System\XGyuXHF.exe
  C:\Windows\System\XGyuXHF.exe
  2⤵
  PID:9276
- C:\Windows\System\SnFGxis.exe
  C:\Windows\System\SnFGxis.exe
  2⤵
  PID:9300
- C:\Windows\System\jRlYzxY.exe
  C:\Windows\System\jRlYzxY.exe
  2⤵
  PID:9324
- C:\Windows\System\WtOMUGz.exe
  C:\Windows\System\WtOMUGz.exe
  2⤵
  PID:9344
- C:\Windows\System\fUTRcHA.exe
  C:\Windows\System\fUTRcHA.exe
  2⤵
  PID:9364
- C:\Windows\System\gdMtaRb.exe
  C:\Windows\System\gdMtaRb.exe
  2⤵
  PID:9384
- C:\Windows\System\xofaQxB.exe
  C:\Windows\System\xofaQxB.exe
  2⤵
  PID:9408
- C:\Windows\System\XWLfaTd.exe
  C:\Windows\System\XWLfaTd.exe
  2⤵
  PID:9428
- C:\Windows\System\bpZWMAM.exe
  C:\Windows\System\bpZWMAM.exe
  2⤵
  PID:9448
- C:\Windows\System\meEKkCG.exe
  C:\Windows\System\meEKkCG.exe
  2⤵
  PID:9468
- C:\Windows\System\RwLybuK.exe
  C:\Windows\System\RwLybuK.exe
  2⤵
  PID:9492
- C:\Windows\System\JQlosNx.exe
  C:\Windows\System\JQlosNx.exe
  2⤵
  PID:9528
- C:\Windows\System\VvieUqg.exe
  C:\Windows\System\VvieUqg.exe
  2⤵
  PID:9548
- C:\Windows\System\KVKfZRW.exe
  C:\Windows\System\KVKfZRW.exe
  2⤵
  PID:9572
- C:\Windows\System\ZZfKoiv.exe
  C:\Windows\System\ZZfKoiv.exe
  2⤵
  PID:9592
- C:\Windows\System\LduBVxz.exe
  C:\Windows\System\LduBVxz.exe
  2⤵
  PID:9608
- C:\Windows\System\jxlHTUk.exe
  C:\Windows\System\jxlHTUk.exe
  2⤵
  PID:9636
- C:\Windows\System\jGYQASI.exe
  C:\Windows\System\jGYQASI.exe
  2⤵
  PID:9660
- C:\Windows\System\tkwhvta.exe
  C:\Windows\System\tkwhvta.exe
  2⤵
  PID:9688
- C:\Windows\System\jQfKbnu.exe
  C:\Windows\System\jQfKbnu.exe
  2⤵
  PID:9704
- C:\Windows\System\XvXqKEE.exe
  C:\Windows\System\XvXqKEE.exe
  2⤵
  PID:9736
- C:\Windows\System\gVNSnKb.exe
  C:\Windows\System\gVNSnKb.exe
  2⤵
  PID:9752
- C:\Windows\System\VihdbBq.exe
  C:\Windows\System\VihdbBq.exe
  2⤵
  PID:9772
- C:\Windows\System\glEuHrv.exe
  C:\Windows\System\glEuHrv.exe
  2⤵
  PID:9792
- C:\Windows\System\LVqDITl.exe
  C:\Windows\System\LVqDITl.exe
  2⤵
  PID:9824
- C:\Windows\System\XIlEGVH.exe
  C:\Windows\System\XIlEGVH.exe
  2⤵
  PID:9840
- C:\Windows\System\RZsEOuk.exe
  C:\Windows\System\RZsEOuk.exe
  2⤵
  PID:9860
- C:\Windows\System\AslxFRR.exe
  C:\Windows\System\AslxFRR.exe
  2⤵
  PID:9884
- C:\Windows\System\JMcEGOH.exe
  C:\Windows\System\JMcEGOH.exe
  2⤵
  PID:9912
- C:\Windows\System\rojkVzF.exe
  C:\Windows\System\rojkVzF.exe
  2⤵
  PID:9932
- C:\Windows\System\HBRNMGf.exe
  C:\Windows\System\HBRNMGf.exe
  2⤵
  PID:9948
- C:\Windows\System\rYaCySv.exe
  C:\Windows\System\rYaCySv.exe
  2⤵
  PID:9968
- C:\Windows\System\yhNjGNh.exe
  C:\Windows\System\yhNjGNh.exe
  2⤵
  PID:9996
- C:\Windows\System\QGrSpJb.exe
  C:\Windows\System\QGrSpJb.exe
  2⤵
  PID:10016
- C:\Windows\System\txSUXtu.exe
  C:\Windows\System\txSUXtu.exe
  2⤵
  PID:10036
- C:\Windows\System\bVMAEDi.exe
  C:\Windows\System\bVMAEDi.exe
  2⤵
  PID:10064
- C:\Windows\System\bxGgjNm.exe
  C:\Windows\System\bxGgjNm.exe
  2⤵
  PID:10080
- C:\Windows\System\oCzZOOW.exe
  C:\Windows\System\oCzZOOW.exe
  2⤵
  PID:10104
- C:\Windows\System\oRyIYkD.exe
  C:\Windows\System\oRyIYkD.exe
  2⤵
  PID:10124
- C:\Windows\System\XDSbPSO.exe
  C:\Windows\System\XDSbPSO.exe
  2⤵
  PID:10144
- C:\Windows\System\jdeNPWe.exe
  C:\Windows\System\jdeNPWe.exe
  2⤵
  PID:10168
- C:\Windows\System\PdYuSQC.exe
  C:\Windows\System\PdYuSQC.exe
  2⤵
  PID:10192
- C:\Windows\System\BocJspd.exe
  C:\Windows\System\BocJspd.exe
  2⤵
  PID:7840
- C:\Windows\System\VPaIqGs.exe
  C:\Windows\System\VPaIqGs.exe
  2⤵
  PID:7872
- C:\Windows\System\NbNyUxR.exe
  C:\Windows\System\NbNyUxR.exe
  2⤵
  PID:8652
- C:\Windows\System\WwXiEoX.exe
  C:\Windows\System\WwXiEoX.exe
  2⤵
  PID:7124
- C:\Windows\System\EKcnoCb.exe
  C:\Windows\System\EKcnoCb.exe
  2⤵
  PID:8688
- C:\Windows\System\izdMeUH.exe
  C:\Windows\System\izdMeUH.exe
  2⤵
  PID:8000
- C:\Windows\System\gqZaqyX.exe
  C:\Windows\System\gqZaqyX.exe
  2⤵
  PID:8048
- C:\Windows\System\UqEyPIX.exe
  C:\Windows\System\UqEyPIX.exe
  2⤵
  PID:8128
- C:\Windows\System\QxpqIks.exe
  C:\Windows\System\QxpqIks.exe
  2⤵
  PID:8968
- C:\Windows\System\CPIxQed.exe
  C:\Windows\System\CPIxQed.exe
  2⤵
  PID:6708
- C:\Windows\System\rKZaUmu.exe
  C:\Windows\System\rKZaUmu.exe
  2⤵
  PID:8272
- C:\Windows\System\txKACGo.exe
  C:\Windows\System\txKACGo.exe
  2⤵
  PID:1712
- C:\Windows\System\EIjowTO.exe
  C:\Windows\System\EIjowTO.exe
  2⤵
  PID:8364
- C:\Windows\System\gmjlfoo.exe
  C:\Windows\System\gmjlfoo.exe
  2⤵
  PID:9204
- C:\Windows\System\SHPCtbp.exe
  C:\Windows\System\SHPCtbp.exe
  2⤵
  PID:6852
- C:\Windows\System\ShKUBzd.exe
  C:\Windows\System\ShKUBzd.exe
  2⤵
  PID:8588
- C:\Windows\System\Qaivocu.exe
  C:\Windows\System\Qaivocu.exe
  2⤵
  PID:8624
- C:\Windows\System\oOXUyvx.exe
  C:\Windows\System\oOXUyvx.exe
  2⤵
  PID:9392
- C:\Windows\System\ZEyfhEQ.exe
  C:\Windows\System\ZEyfhEQ.exe
  2⤵
  PID:10248
- C:\Windows\System\JXxFZMR.exe
  C:\Windows\System\JXxFZMR.exe
  2⤵
  PID:10272
- C:\Windows\System\iYwUgeW.exe
  C:\Windows\System\iYwUgeW.exe
  2⤵
  PID:10300
- C:\Windows\System\OQtmDdv.exe
  C:\Windows\System\OQtmDdv.exe
  2⤵
  PID:10320
- C:\Windows\System\luxWOVL.exe
  C:\Windows\System\luxWOVL.exe
  2⤵
  PID:10344
- C:\Windows\System\BLIwAyf.exe
  C:\Windows\System\BLIwAyf.exe
  2⤵
  PID:10360
- C:\Windows\System\buWAjWx.exe
  C:\Windows\System\buWAjWx.exe
  2⤵
  PID:10380
- C:\Windows\System\zWzLoFV.exe
  C:\Windows\System\zWzLoFV.exe
  2⤵
  PID:10400
- C:\Windows\System\ojkRRjs.exe
  C:\Windows\System\ojkRRjs.exe
  2⤵
  PID:10424
- C:\Windows\System\zRnreMc.exe
  C:\Windows\System\zRnreMc.exe
  2⤵
  PID:10448
- C:\Windows\System\MfRjxVa.exe
  C:\Windows\System\MfRjxVa.exe
  2⤵
  PID:10476
- C:\Windows\System\mfjrFNb.exe
  C:\Windows\System\mfjrFNb.exe
  2⤵
  PID:10496
- C:\Windows\System\neIUnYs.exe
  C:\Windows\System\neIUnYs.exe
  2⤵
  PID:10520
- C:\Windows\System\mMsazSo.exe
  C:\Windows\System\mMsazSo.exe
  2⤵
  PID:10600
- C:\Windows\System\tciWrZR.exe
  C:\Windows\System\tciWrZR.exe
  2⤵
  PID:10628
- C:\Windows\System\jSGmZMk.exe
  C:\Windows\System\jSGmZMk.exe
  2⤵
  PID:10648
- C:\Windows\System\KQDFgTu.exe
  C:\Windows\System\KQDFgTu.exe
  2⤵
  PID:10676
- C:\Windows\System\BAJeZJQ.exe
  C:\Windows\System\BAJeZJQ.exe
  2⤵
  PID:10700
- C:\Windows\System\bGXsYiD.exe
  C:\Windows\System\bGXsYiD.exe
  2⤵
  PID:10720
- C:\Windows\System\QcRrgmd.exe
  C:\Windows\System\QcRrgmd.exe
  2⤵
  PID:10736
- C:\Windows\System\NzpxDFb.exe
  C:\Windows\System\NzpxDFb.exe
  2⤵
  PID:10764
- C:\Windows\System\MFCpHam.exe
  C:\Windows\System\MFCpHam.exe
  2⤵
  PID:10784
- C:\Windows\System\SWnvOYK.exe
  C:\Windows\System\SWnvOYK.exe
  2⤵
  PID:10808
- C:\Windows\System\CtsqwUZ.exe
  C:\Windows\System\CtsqwUZ.exe
  2⤵
  PID:10832
- C:\Windows\System\RDitmKm.exe
  C:\Windows\System\RDitmKm.exe
  2⤵
  PID:10860
- C:\Windows\System\yDluUar.exe
  C:\Windows\System\yDluUar.exe
  2⤵
  PID:10884
- C:\Windows\System\bVuyjsP.exe
  C:\Windows\System\bVuyjsP.exe
  2⤵
  PID:10904
- C:\Windows\System\YhgiyXv.exe
  C:\Windows\System\YhgiyXv.exe
  2⤵
  PID:10924
- C:\Windows\System\aVLNuzP.exe
  C:\Windows\System\aVLNuzP.exe
  2⤵
  PID:10960
- C:\Windows\System\JSCZuKE.exe
  C:\Windows\System\JSCZuKE.exe
  2⤵
  PID:10992
- C:\Windows\System\hBTpXlO.exe
  C:\Windows\System\hBTpXlO.exe
  2⤵
  PID:11008
- C:\Windows\System\nBVvFDw.exe
  C:\Windows\System\nBVvFDw.exe
  2⤵
  PID:11032
- C:\Windows\System\PcFbSaA.exe
  C:\Windows\System\PcFbSaA.exe
  2⤵
  PID:11064
- C:\Windows\System\vXnwQeQ.exe
  C:\Windows\System\vXnwQeQ.exe
  2⤵
  PID:11096
- C:\Windows\System\IYLuVgU.exe
  C:\Windows\System\IYLuVgU.exe
  2⤵
  PID:11120
- C:\Windows\System\VtBYdCX.exe
  C:\Windows\System\VtBYdCX.exe
  2⤵
  PID:11148
- C:\Windows\System\hUZzyLx.exe
  C:\Windows\System\hUZzyLx.exe
  2⤵
  PID:11172
- C:\Windows\System\MmkBbdd.exe
  C:\Windows\System\MmkBbdd.exe
  2⤵
  PID:11200
- C:\Windows\System\vZEmaGB.exe
  C:\Windows\System\vZEmaGB.exe
  2⤵
  PID:11220
- C:\Windows\System\xIqzuiy.exe
  C:\Windows\System\xIqzuiy.exe
  2⤵
  PID:11240
- C:\Windows\System\sJjwxfL.exe
  C:\Windows\System\sJjwxfL.exe
  2⤵
  PID:11256
- C:\Windows\System\wpnrHXV.exe
  C:\Windows\System\wpnrHXV.exe
  2⤵
  PID:9508
- C:\Windows\System\FhrgleU.exe
  C:\Windows\System\FhrgleU.exe
  2⤵
  PID:8728
- C:\Windows\System\EPxBYcv.exe
  C:\Windows\System\EPxBYcv.exe
  2⤵
  PID:8748
- C:\Windows\System\RtEieMy.exe
  C:\Windows\System\RtEieMy.exe
  2⤵
  PID:9544
- C:\Windows\System\uBEChTh.exe
  C:\Windows\System\uBEChTh.exe
  2⤵
  PID:8920
- C:\Windows\System\deOhgGx.exe
  C:\Windows\System\deOhgGx.exe
  2⤵
  PID:8944
- C:\Windows\System\qJeBDKe.exe
  C:\Windows\System\qJeBDKe.exe
  2⤵
  PID:8988
- C:\Windows\System\TTgnKKW.exe
  C:\Windows\System\TTgnKKW.exe
  2⤵
  PID:9156
- C:\Windows\System\cbckrMY.exe
  C:\Windows\System\cbckrMY.exe
  2⤵
  PID:7328
- C:\Windows\System\malFZdZ.exe
  C:\Windows\System\malFZdZ.exe
  2⤵
  PID:7780
- C:\Windows\System\LnVSbwG.exe
  C:\Windows\System\LnVSbwG.exe
  2⤵
  PID:8356
- C:\Windows\System\GcyNEaT.exe
  C:\Windows\System\GcyNEaT.exe
  2⤵
  PID:8632
- C:\Windows\System\DIZVVwo.exe
  C:\Windows\System\DIZVVwo.exe
  2⤵
  PID:9232
- C:\Windows\System\uyWiZzI.exe
  C:\Windows\System\uyWiZzI.exe
  2⤵
  PID:11280
- C:\Windows\System\yiemqha.exe
  C:\Windows\System\yiemqha.exe
  2⤵
  PID:11300
- C:\Windows\System\BokoEqB.exe
  C:\Windows\System\BokoEqB.exe
  2⤵
  PID:11336
- C:\Windows\System\AtbdleX.exe
  C:\Windows\System\AtbdleX.exe
  2⤵
  PID:11376
- C:\Windows\System\JvWgvsg.exe
  C:\Windows\System\JvWgvsg.exe
  2⤵
  PID:11396
- C:\Windows\System\SBFDodI.exe
  C:\Windows\System\SBFDodI.exe
  2⤵
  PID:11416
- C:\Windows\System\kXnXDgy.exe
  C:\Windows\System\kXnXDgy.exe
  2⤵
  PID:11436
- C:\Windows\System\goYsGKM.exe
  C:\Windows\System\goYsGKM.exe
  2⤵
  PID:11460
- C:\Windows\System\fDBciyZ.exe
  C:\Windows\System\fDBciyZ.exe
  2⤵
  PID:11480
- C:\Windows\System\pLtGlLA.exe
  C:\Windows\System\pLtGlLA.exe
  2⤵
  PID:12016
- C:\Windows\System\czpPLEb.exe
  C:\Windows\System\czpPLEb.exe
  2⤵
  PID:12036
- C:\Windows\System\PSlDikM.exe
  C:\Windows\System\PSlDikM.exe
  2⤵
  PID:12056
- C:\Windows\System\AizuvkB.exe
  C:\Windows\System\AizuvkB.exe
  2⤵
  PID:12080
- C:\Windows\System\HWLvaAE.exe
  C:\Windows\System\HWLvaAE.exe
  2⤵
  PID:12104
- C:\Windows\System\gQlLceC.exe
  C:\Windows\System\gQlLceC.exe
  2⤵
  PID:12144
- C:\Windows\System\EqjhhjI.exe
  C:\Windows\System\EqjhhjI.exe
  2⤵
  PID:12168
- C:\Windows\System\XGeXhAP.exe
  C:\Windows\System\XGeXhAP.exe
  2⤵
  PID:12200
- C:\Windows\System\WMKLIju.exe
  C:\Windows\System\WMKLIju.exe
  2⤵
  PID:12220
- C:\Windows\System\MYVELYj.exe
  C:\Windows\System\MYVELYj.exe
  2⤵
  PID:12264
- C:\Windows\System\TaUWdYl.exe
  C:\Windows\System\TaUWdYl.exe
  2⤵
  PID:12280
- C:\Windows\System\PfdSpfj.exe
  C:\Windows\System\PfdSpfj.exe
  2⤵
  PID:10028
- C:\Windows\System\Evkrhjz.exe
  C:\Windows\System\Evkrhjz.exe
  2⤵
  PID:9900
- C:\Windows\System\zjZneOE.exe
  C:\Windows\System\zjZneOE.exe
  2⤵
  PID:10224
- C:\Windows\System\JRZGHPZ.exe
  C:\Windows\System\JRZGHPZ.exe
  2⤵
  PID:9116
- C:\Windows\System\lkQiMly.exe
  C:\Windows\System\lkQiMly.exe
  2⤵
  PID:9476
- C:\Windows\System\rRaGIdy.exe
  C:\Windows\System\rRaGIdy.exe
  2⤵
  PID:7176
- C:\Windows\System\ZwQoYIy.exe
  C:\Windows\System\ZwQoYIy.exe
  2⤵
  PID:10488
- C:\Windows\System\KIxirzF.exe
  C:\Windows\System\KIxirzF.exe
  2⤵
  PID:9816
- C:\Windows\System\eYZPapk.exe
  C:\Windows\System\eYZPapk.exe
  2⤵
  PID:9976
- C:\Windows\System\UBxFSdq.exe
  C:\Windows\System\UBxFSdq.exe
  2⤵
  PID:10076
- C:\Windows\System\LPfaDUp.exe
  C:\Windows\System\LPfaDUp.exe
  2⤵
  PID:10152
- C:\Windows\System\EepGYeu.exe
  C:\Windows\System\EepGYeu.exe
  2⤵
  PID:7020
- C:\Windows\System\ZyOtxDJ.exe
  C:\Windows\System\ZyOtxDJ.exe
  2⤵
  PID:7752
- C:\Windows\System\KSHXLuI.exe
  C:\Windows\System\KSHXLuI.exe
  2⤵
  PID:7868
- C:\Windows\System\aGjYfxX.exe
  C:\Windows\System\aGjYfxX.exe
  2⤵
  PID:6580
- C:\Windows\System\JmYwFSE.exe
  C:\Windows\System\JmYwFSE.exe
  2⤵
  PID:9620
- C:\Windows\System\bIYSOyq.exe
  C:\Windows\System\bIYSOyq.exe
  2⤵
  PID:11364
- C:\Windows\System\cnBqiVG.exe
  C:\Windows\System\cnBqiVG.exe
  2⤵
  PID:11432
- C:\Windows\System\DNndTyY.exe
  C:\Windows\System\DNndTyY.exe
  2⤵
  PID:10336
- C:\Windows\System\DDEKfPA.exe
  C:\Windows\System\DDEKfPA.exe
  2⤵
  PID:9296
- C:\Windows\System\LsueNhf.exe
  C:\Windows\System\LsueNhf.exe
  2⤵
  PID:7600
- C:\Windows\System\PrfAcps.exe
  C:\Windows\System\PrfAcps.exe
  2⤵
  PID:7232
- C:\Windows\System\kGidCHu.exe
  C:\Windows\System\kGidCHu.exe
  2⤵
  PID:9728
- C:\Windows\System\YNCQFTv.exe
  C:\Windows\System\YNCQFTv.exe
  2⤵
  PID:8324
- C:\Windows\System\CdzlNih.exe
  C:\Windows\System\CdzlNih.exe
  2⤵
  PID:10976
- C:\Windows\System\WIIVCKm.exe
  C:\Windows\System\WIIVCKm.exe
  2⤵
  PID:11156
- C:\Windows\System\pQipiPS.exe
  C:\Windows\System\pQipiPS.exe
  2⤵
  PID:11184
- C:\Windows\System\osZQieZ.exe
  C:\Windows\System\osZQieZ.exe
  2⤵
  PID:11216
- C:\Windows\System\ccnUuNj.exe
  C:\Windows\System\ccnUuNj.exe
  2⤵
  PID:11248
- C:\Windows\System\ZwbcrbJ.exe
  C:\Windows\System\ZwbcrbJ.exe
  2⤵
  PID:8712
- C:\Windows\System\IXozvyX.exe
  C:\Windows\System\IXozvyX.exe
  2⤵
  PID:9268
- C:\Windows\System\FYdTADo.exe
  C:\Windows\System\FYdTADo.exe
  2⤵
  PID:8936
- C:\Windows\System\bOmugRh.exe
  C:\Windows\System\bOmugRh.exe
  2⤵
  PID:11788
- C:\Windows\System\TufiGfm.exe
  C:\Windows\System\TufiGfm.exe
  2⤵
  PID:9340
- C:\Windows\System\wjsswQa.exe
  C:\Windows\System\wjsswQa.exe
  2⤵
  PID:9380
- C:\Windows\System\RfRmiXX.exe
  C:\Windows\System\RfRmiXX.exe
  2⤵
  PID:10256
- C:\Windows\System\EjwlugP.exe
  C:\Windows\System\EjwlugP.exe
  2⤵
  PID:10292
- C:\Windows\System\cssUORl.exe
  C:\Windows\System\cssUORl.exe
  2⤵
  PID:11468
- C:\Windows\System\cenchoR.exe
  C:\Windows\System\cenchoR.exe
  2⤵
  PID:10420
- C:\Windows\System\bbjjpwO.exe
  C:\Windows\System\bbjjpwO.exe
  2⤵
  PID:1604
- C:\Windows\System\qGQCmLA.exe
  C:\Windows\System\qGQCmLA.exe
  2⤵
  PID:10532
- C:\Windows\System\qNRcZwo.exe
  C:\Windows\System\qNRcZwo.exe
  2⤵
  PID:10596
- C:\Windows\System\pJxGddM.exe
  C:\Windows\System\pJxGddM.exe
  2⤵
  PID:10640
- C:\Windows\System\kVSUIwn.exe
  C:\Windows\System\kVSUIwn.exe
  2⤵
  PID:10688
- C:\Windows\System\DWHVXfi.exe
  C:\Windows\System\DWHVXfi.exe
  2⤵
  PID:10732
- C:\Windows\System\CGigXTP.exe
  C:\Windows\System\CGigXTP.exe
  2⤵
  PID:10780
- C:\Windows\System\hYNryri.exe
  C:\Windows\System\hYNryri.exe
  2⤵
  PID:10840
- C:\Windows\System\APLkrZv.exe
  C:\Windows\System\APLkrZv.exe
  2⤵
  PID:11640
- C:\Windows\System\InDCuYD.exe
  C:\Windows\System\InDCuYD.exe
  2⤵
  PID:5548
- C:\Windows\System\bzYgDLC.exe
  C:\Windows\System\bzYgDLC.exe
  2⤵
  PID:10948
- C:\Windows\System\nPaRwMH.exe
  C:\Windows\System\nPaRwMH.exe
  2⤵
  PID:12088
- C:\Windows\System\yWetsBx.exe
  C:\Windows\System\yWetsBx.exe
  2⤵
  PID:11004
- C:\Windows\System\dUQcxwL.exe
  C:\Windows\System\dUQcxwL.exe
  2⤵
  PID:11056
- C:\Windows\System\sSOJIlU.exe
  C:\Windows\System\sSOJIlU.exe
  2⤵
  PID:11104
- C:\Windows\System\LdlMzph.exe
  C:\Windows\System\LdlMzph.exe
  2⤵
  PID:9060
- C:\Windows\System\GhfTzfv.exe
  C:\Windows\System\GhfTzfv.exe
  2⤵
  PID:12296
- C:\Windows\System\uIESBRQ.exe
  C:\Windows\System\uIESBRQ.exe
  2⤵
  PID:12316
- C:\Windows\System\cSSIzer.exe
  C:\Windows\System\cSSIzer.exe
  2⤵
  PID:12336
- C:\Windows\System\oiwNJtY.exe
  C:\Windows\System\oiwNJtY.exe
  2⤵
  PID:12360
- C:\Windows\System\pvKiuUk.exe
  C:\Windows\System\pvKiuUk.exe
  2⤵
  PID:12384
- C:\Windows\System\RQwfjTg.exe
  C:\Windows\System\RQwfjTg.exe
  2⤵
  PID:12412
- C:\Windows\System\OCoInAz.exe
  C:\Windows\System\OCoInAz.exe
  2⤵
  PID:12432
- C:\Windows\System\cwifyJv.exe
  C:\Windows\System\cwifyJv.exe
  2⤵
  PID:12452
- C:\Windows\System\lfbuLcu.exe
  C:\Windows\System\lfbuLcu.exe
  2⤵
  PID:12476
- C:\Windows\System\cEfzoEw.exe
  C:\Windows\System\cEfzoEw.exe
  2⤵
  PID:12504
- C:\Windows\System\JRATduJ.exe
  C:\Windows\System\JRATduJ.exe
  2⤵
  PID:12528
- C:\Windows\System\dltsMAc.exe
  C:\Windows\System\dltsMAc.exe
  2⤵
  PID:12548
- C:\Windows\System\ztlGVdP.exe
  C:\Windows\System\ztlGVdP.exe
  2⤵
  PID:12564
- C:\Windows\System\YWuKOBl.exe
  C:\Windows\System\YWuKOBl.exe
  2⤵
  PID:12592
- C:\Windows\System\ToTkACF.exe
  C:\Windows\System\ToTkACF.exe
  2⤵
  PID:12616
- C:\Windows\System\gKZClut.exe
  C:\Windows\System\gKZClut.exe
  2⤵
  PID:12640
- C:\Windows\System\YoAIZrb.exe
  C:\Windows\System\YoAIZrb.exe
  2⤵
  PID:12660
- C:\Windows\System\mnOYEGx.exe
  C:\Windows\System\mnOYEGx.exe
  2⤵
  PID:12688
- C:\Windows\System\bhJjgbN.exe
  C:\Windows\System\bhJjgbN.exe
  2⤵
  PID:12708
- C:\Windows\System\TgtGXGN.exe
  C:\Windows\System\TgtGXGN.exe
  2⤵
  PID:13268
- C:\Windows\System\bNagkQn.exe
  C:\Windows\System\bNagkQn.exe
  2⤵
  PID:12352
- C:\Windows\System\CmIAhUy.exe
  C:\Windows\System\CmIAhUy.exe
  2⤵
  PID:12344
- C:\Windows\System\bZISKIx.exe
  C:\Windows\System\bZISKIx.exe
  2⤵
  PID:8524
- C:\Windows\System\pIRxyti.exe
  C:\Windows\System\pIRxyti.exe
  2⤵
  PID:13228
- C:\Windows\System\awhJySt.exe
  C:\Windows\System\awhJySt.exe
  2⤵
  PID:11868
- C:\Windows\System\pARbxlo.exe
  C:\Windows\System\pARbxlo.exe
  2⤵
  PID:12216
- C:\Windows\System\FONjHkL.exe
  C:\Windows\System\FONjHkL.exe
  2⤵
  PID:13092
- C:\Windows\System\VfIBBuR.exe
  C:\Windows\System\VfIBBuR.exe
  2⤵
  PID:12604
- C:\Windows\System\bFesqCy.exe
  C:\Windows\System\bFesqCy.exe
  2⤵
  PID:12632
- C:\Windows\System\ZRVSsFU.exe
  C:\Windows\System\ZRVSsFU.exe
  2⤵
  PID:12652
- C:\Windows\System\EsLyfwY.exe
  C:\Windows\System\EsLyfwY.exe
  2⤵
  PID:12768
- C:\Windows\System\TUerXii.exe
  C:\Windows\System\TUerXii.exe
  2⤵
  PID:5676
- C:\Windows\System\EuZzZyK.exe
  C:\Windows\System\EuZzZyK.exe
  2⤵
  PID:9784
- C:\Windows\System\HyOlLgD.exe
  C:\Windows\System\HyOlLgD.exe
  2⤵
  PID:12656
- C:\Windows\System\RzxOBwl.exe
  C:\Windows\System\RzxOBwl.exe
  2⤵
  PID:680
- C:\Windows\System\eGVqKQM.exe
  C:\Windows\System\eGVqKQM.exe
  2⤵
  PID:10444
- C:\Windows\System\ESBmWbF.exe
  C:\Windows\System\ESBmWbF.exe
  2⤵
  PID:12024
- C:\Windows\System\tAXaKMN.exe
  C:\Windows\System\tAXaKMN.exe
  2⤵
  PID:12892
- C:\Windows\System\eMaRrwP.exe
  C:\Windows\System\eMaRrwP.exe
  2⤵
  PID:8252
- C:\Windows\System\oazytYr.exe
  C:\Windows\System\oazytYr.exe
  2⤵
  PID:12368
- C:\Windows\System\uJmksUj.exe
  C:\Windows\System\uJmksUj.exe
  2⤵
  PID:8404
- C:\Windows\System\BWFUehw.exe
  C:\Windows\System\BWFUehw.exe
  2⤵
  PID:12696
- C:\Windows\System\mGKuLPp.exe
  C:\Windows\System\mGKuLPp.exe
  2⤵
  PID:1808
- C:\Windows\System\lkREDFv.exe
  C:\Windows\System\lkREDFv.exe
  2⤵
  PID:12820
- C:\Windows\System\zqAOYkZ.exe
  C:\Windows\System\zqAOYkZ.exe
  2⤵
  PID:5156
- C:\Windows\System\syEYydV.exe
  C:\Windows\System\syEYydV.exe
  2⤵
  PID:9440
- C:\Windows\System\KlsFgQp.exe
  C:\Windows\System\KlsFgQp.exe
  2⤵
  PID:12560
- C:\Windows\System\TNaPNux.exe
  C:\Windows\System\TNaPNux.exe
  2⤵
  PID:9940
- C:\Windows\System\tOxrqrh.exe
  C:\Windows\System\tOxrqrh.exe
  2⤵
  PID:9436
- C:\Windows\System\XbWIzdk.exe
  C:\Windows\System\XbWIzdk.exe
  2⤵
  PID:12888
- C:\Windows\System\TPtwArp.exe
  C:\Windows\System\TPtwArp.exe
  2⤵
  PID:7580
- C:\Windows\System\ocyPVON.exe
  C:\Windows\System\ocyPVON.exe
  2⤵
  PID:13292
- C:\Windows\System\quigywl.exe
  C:\Windows\System\quigywl.exe
  2⤵
  PID:12924
- C:\Windows\System\FBpMsaM.exe
  C:\Windows\System\FBpMsaM.exe
  2⤵
  PID:11168
- C:\Windows\System\JPYWXmp.exe
  C:\Windows\System\JPYWXmp.exe
  2⤵
  PID:12472
- C:\Windows\System\fzOlOAD.exe
  C:\Windows\System\fzOlOAD.exe
  2⤵
  PID:9564
- C:\Windows\System\ExZgaTt.exe
  C:\Windows\System\ExZgaTt.exe
  2⤵
  PID:2668
- C:\Windows\System\KTIImHK.exe
  C:\Windows\System\KTIImHK.exe
  2⤵
  PID:10620
- C:\Windows\System\UmzDOvL.exe
  C:\Windows\System\UmzDOvL.exe
  2⤵
  PID:12748
- C:\Windows\System\cTMotWe.exe
  C:\Windows\System\cTMotWe.exe
  2⤵
  PID:8296
- C:\Windows\System\wvPJCcc.exe
  C:\Windows\System\wvPJCcc.exe
  2⤵
  PID:7512
- C:\Windows\System\VnviZcM.exe
  C:\Windows\System\VnviZcM.exe
  2⤵
  PID:5500
- C:\Windows\System\osfiaoo.exe
  C:\Windows\System\osfiaoo.exe
  2⤵
  PID:11292
- C:\Windows\System\DjEMDhz.exe
  C:\Windows\System\DjEMDhz.exe
  2⤵
  PID:9228
- C:\Windows\System\cYQFqEP.exe
  C:\Windows\System\cYQFqEP.exe
  2⤵
  PID:10776
- C:\Windows\System\RyvAXbm.exe
  C:\Windows\System\RyvAXbm.exe
  2⤵
  PID:12048
- C:\Windows\System\sdywunX.exe
  C:\Windows\System\sdywunX.exe
  2⤵
  PID:7148
- C:\Windows\System\MMAwcfQ.exe
  C:\Windows\System\MMAwcfQ.exe
  2⤵
  PID:12800
- C:\Windows\System\rQXQEtv.exe
  C:\Windows\System\rQXQEtv.exe
  2⤵
  PID:5796
- C:\Windows\System\NgiNbCZ.exe
  C:\Windows\System\NgiNbCZ.exe
  2⤵
  PID:13260
- C:\Windows\System\bcFdpJM.exe
  C:\Windows\System\bcFdpJM.exe
  2⤵
  PID:12792
- C:\Windows\System\vrBwRlh.exe
  C:\Windows\System\vrBwRlh.exe
  2⤵
  PID:13072
- C:\Windows\System\UyqFQPq.exe
  C:\Windows\System\UyqFQPq.exe
  2⤵
  PID:8900
- C:\Windows\System\WUqPNXP.exe
  C:\Windows\System\WUqPNXP.exe
  2⤵
  PID:13140
- C:\Windows\System\VLndrXi.exe
  C:\Windows\System\VLndrXi.exe
  2⤵
  PID:12160
- C:\Windows\System\CdLAfoW.exe
  C:\Windows\System\CdLAfoW.exe
  2⤵
  PID:11488
- C:\Windows\System\cHbEhRa.exe
  C:\Windows\System\cHbEhRa.exe
  2⤵
  PID:12784
- C:\Windows\System\MhPagpP.exe
  C:\Windows\System\MhPagpP.exe
  2⤵
  PID:13188
- C:\Windows\System\QMdLKnG.exe
  C:\Windows\System\QMdLKnG.exe
  2⤵
  PID:12988
- C:\Windows\System\qtHKzlB.exe
  C:\Windows\System\qtHKzlB.exe
  2⤵
  PID:8824
- C:\Windows\System\ufAeTgR.exe
  C:\Windows\System\ufAeTgR.exe
  2⤵
  PID:12928
- C:\Windows\System\veMjfDk.exe
  C:\Windows\System\veMjfDk.exe
  2⤵
  PID:12468
- C:\Windows\System\tYUvxyi.exe
  C:\Windows\System\tYUvxyi.exe
  2⤵
  PID:2776
- C:\Windows\System\YyfLjiN.exe
  C:\Windows\System\YyfLjiN.exe
  2⤵
  PID:12448
- C:\Windows\System\rOCSECZ.exe
  C:\Windows\System\rOCSECZ.exe
  2⤵
  PID:5212
- C:\Windows\System\yGvorzg.exe
  C:\Windows\System\yGvorzg.exe
  2⤵
  PID:8888
- C:\Windows\System\AveUImg.exe
  C:\Windows\System\AveUImg.exe
  2⤵
  PID:4212
- C:\Windows\System\AZLIwHf.exe
  C:\Windows\System\AZLIwHf.exe
  2⤵
  PID:12936
- C:\Windows\System\TbvCJti.exe
  C:\Windows\System\TbvCJti.exe
  2⤵
  PID:10284
- C:\Windows\System\oKaoOIT.exe
  C:\Windows\System\oKaoOIT.exe
  2⤵
  PID:12976
- C:\Windows\System\RMmzcIb.exe
  C:\Windows\System\RMmzcIb.exe
  2⤵
  PID:11732
- C:\Windows\System\akDlEzK.exe
  C:\Windows\System\akDlEzK.exe
  2⤵
  PID:10416
- C:\Windows\System\kNFYqSM.exe
  C:\Windows\System\kNFYqSM.exe
  2⤵
  PID:10588
- C:\Windows\System\ZnrTMSg.exe
  C:\Windows\System\ZnrTMSg.exe
  2⤵
  PID:11456
- C:\Windows\System\tfZOTnn.exe
  C:\Windows\System\tfZOTnn.exe
  2⤵
  PID:10636
- C:\Windows\System\GpfSiUX.exe
  C:\Windows\System\GpfSiUX.exe
  2⤵
  PID:11296
- C:\Windows\System\eaoAhRh.exe
  C:\Windows\System\eaoAhRh.exe
  2⤵
  PID:10440
- C:\Windows\System\zLJtmGn.exe
  C:\Windows\System\zLJtmGn.exe
  2⤵
  PID:9724
- C:\Windows\System\dnOHwXn.exe
  C:\Windows\System\dnOHwXn.exe
  2⤵
  PID:10052
- C:\Windows\System\cogfRJb.exe
  C:\Windows\System\cogfRJb.exe
  2⤵
  PID:10288
- C:\Windows\System\NESArCa.exe
  C:\Windows\System\NESArCa.exe
  2⤵
  PID:12952
- C:\Windows\System\QgUqwyC.exe
  C:\Windows\System\QgUqwyC.exe
  2⤵
  PID:12776
- C:\Windows\System\kqEoRpD.exe
  C:\Windows\System\kqEoRpD.exe
  2⤵
  PID:13136
- C:\Windows\System\jyLjGce.exe
  C:\Windows\System\jyLjGce.exe
  2⤵
  PID:11452
- C:\Windows\System\nbNNYQD.exe
  C:\Windows\System\nbNNYQD.exe
  2⤵
  PID:12900
- C:\Windows\System\DAzjzJt.exe
  C:\Windows\System\DAzjzJt.exe
  2⤵
  PID:3392
- C:\Windows\System\rdVNyjY.exe
  C:\Windows\System\rdVNyjY.exe
  2⤵
  PID:3036
- C:\Windows\System\nbeesEW.exe
  C:\Windows\System\nbeesEW.exe
  2⤵
  PID:2032
- C:\Windows\System\dmJtkOa.exe
  C:\Windows\System\dmJtkOa.exe
  2⤵
  PID:6216
- C:\Windows\System\BRlJxSr.exe
  C:\Windows\System\BRlJxSr.exe
  2⤵
  PID:6340
- C:\Windows\System\QLWmUTL.exe
  C:\Windows\System\QLWmUTL.exe
  2⤵
  PID:9048
- C:\Windows\System\iuwEXNS.exe
  C:\Windows\System\iuwEXNS.exe
  2⤵
  PID:11512
- C:\Windows\System\BAMpAMW.exe
  C:\Windows\System\BAMpAMW.exe
  2⤵
  PID:11084
- C:\Windows\System\yKZbPVN.exe
  C:\Windows\System\yKZbPVN.exe
  2⤵
  PID:12492
- C:\Windows\System\lpFlVqd.exe
  C:\Windows\System\lpFlVqd.exe
  2⤵
  PID:12584
- C:\Windows\System\ibGxasA.exe
  C:\Windows\System\ibGxasA.exe
  2⤵
  PID:11028
- C:\Windows\System\bzTRAnz.exe
  C:\Windows\System\bzTRAnz.exe
  2⤵
  PID:6344
- C:\Windows\System\GhdUAIh.exe
  C:\Windows\System\GhdUAIh.exe
  2⤵
  PID:9316
- C:\Windows\System\TWWYaqJ.exe
  C:\Windows\System\TWWYaqJ.exe
  2⤵
  PID:9004
- C:\Windows\System\WLeZvnX.exe
  C:\Windows\System\WLeZvnX.exe
  2⤵
  PID:10516
- C:\Windows\System\nnWYAuV.exe
  C:\Windows\System\nnWYAuV.exe
  2⤵
  PID:11552
- C:\Windows\System\GqBSWmH.exe
  C:\Windows\System\GqBSWmH.exe
  2⤵
  PID:13308
- C:\Windows\System\CxtEkGm.exe
  C:\Windows\System\CxtEkGm.exe
  2⤵
  PID:5104
- C:\Windows\System\JRvysXa.exe
  C:\Windows\System\JRvysXa.exe
  2⤵
  PID:6176
- C:\Windows\System\PllpwIS.exe
  C:\Windows\System\PllpwIS.exe
  2⤵
  PID:3188
- C:\Windows\System\xVrMODN.exe
  C:\Windows\System\xVrMODN.exe
  2⤵
  PID:3220
- C:\Windows\System\SKAsFeA.exe
  C:\Windows\System\SKAsFeA.exe
  2⤵
  PID:13224
- C:\Windows\System\dCyknQO.exe
  C:\Windows\System\dCyknQO.exe
  2⤵
  PID:1928
- C:\Windows\System\ekkgNtc.exe
  C:\Windows\System\ekkgNtc.exe
  2⤵
  PID:10120
- C:\Windows\System\aiLVLKt.exe
  C:\Windows\System\aiLVLKt.exe
  2⤵
  PID:1156
- C:\Windows\System\PPkrjpb.exe
  C:\Windows\System\PPkrjpb.exe
  2⤵
  PID:6128
- C:\Windows\System\uDEQGbQ.exe
  C:\Windows\System\uDEQGbQ.exe
  2⤵
  PID:948
- C:\Windows\System\BOtMNso.exe
  C:\Windows\System\BOtMNso.exe
  2⤵
  PID:9376
- C:\Windows\System\YcdxjaD.exe
  C:\Windows\System\YcdxjaD.exe
  2⤵
  PID:10312
- C:\Windows\System\EmfJRzf.exe
  C:\Windows\System\EmfJRzf.exe
  2⤵
  PID:5152
- C:\Windows\System\nWpcuXi.exe
  C:\Windows\System\nWpcuXi.exe
  2⤵
  PID:6368
- C:\Windows\System\nTEBRnj.exe
  C:\Windows\System\nTEBRnj.exe
  2⤵
  PID:6232
- C:\Windows\System\LLPHPDL.exe
  C:\Windows\System\LLPHPDL.exe
  2⤵
  PID:13328
- C:\Windows\System\hNPIKqx.exe
  C:\Windows\System\hNPIKqx.exe
  2⤵
  PID:13344
- C:\Windows\System\RGDaYbL.exe
  C:\Windows\System\RGDaYbL.exe
  2⤵
  PID:13368
- C:\Windows\System\NCNKeRU.exe
  C:\Windows\System\NCNKeRU.exe
  2⤵
  PID:13388
- C:\Windows\System\ugroatq.exe
  C:\Windows\System\ugroatq.exe
  2⤵
  PID:13404
- C:\Windows\System\mZUrRKn.exe
  C:\Windows\System\mZUrRKn.exe
  2⤵
  PID:13420
- C:\Windows\System\CbaYpSc.exe
  C:\Windows\System\CbaYpSc.exe
  2⤵
  PID:13436
- C:\Windows\System\lftleXO.exe
  C:\Windows\System\lftleXO.exe
  2⤵
  PID:13452
- C:\Windows\System\TtPDbWf.exe
  C:\Windows\System\TtPDbWf.exe
  2⤵
  PID:13468
- C:\Windows\System\XtoLqxh.exe
  C:\Windows\System\XtoLqxh.exe
  2⤵
  PID:13484
- C:\Windows\System\EVhBFyY.exe
  C:\Windows\System\EVhBFyY.exe
  2⤵
  PID:13500
- C:\Windows\System\eDoxXNP.exe
  C:\Windows\System\eDoxXNP.exe
  2⤵
  PID:13516
- C:\Windows\System\amtpNJR.exe
  C:\Windows\System\amtpNJR.exe
  2⤵
  PID:13532
- C:\Windows\System\MnszFSY.exe
  C:\Windows\System\MnszFSY.exe
  2⤵
  PID:13548
- C:\Windows\System\JeTPBmr.exe
  C:\Windows\System\JeTPBmr.exe
  2⤵
  PID:13564
- C:\Windows\System\HqJVqJR.exe
  C:\Windows\System\HqJVqJR.exe
  2⤵
  PID:13580
- C:\Windows\System\HOJkZTs.exe
  C:\Windows\System\HOJkZTs.exe
  2⤵
  PID:13600
- C:\Windows\System\qdbdVzC.exe
  C:\Windows\System\qdbdVzC.exe
  2⤵
  PID:13616
- C:\Windows\System\GrOBRPF.exe
  C:\Windows\System\GrOBRPF.exe
  2⤵
  PID:13632
- C:\Windows\System\XrIRQDU.exe
  C:\Windows\System\XrIRQDU.exe
  2⤵
  PID:13648
- C:\Windows\System\KAVCtiB.exe
  C:\Windows\System\KAVCtiB.exe
  2⤵
  PID:13668
- C:\Windows\System\FJzFySM.exe
  C:\Windows\System\FJzFySM.exe
  2⤵
  PID:13684
- C:\Windows\System\VMYonPU.exe
  C:\Windows\System\VMYonPU.exe
  2⤵
  PID:13700
- C:\Windows\System\tsAuUtj.exe
  C:\Windows\System\tsAuUtj.exe
  2⤵
  PID:13716
- C:\Windows\System\YtnpJgH.exe
  C:\Windows\System\YtnpJgH.exe
  2⤵
  PID:13732
- C:\Windows\System\SzhsgGx.exe
  C:\Windows\System\SzhsgGx.exe
  2⤵
  PID:13748
- C:\Windows\System\BZYspZc.exe
  C:\Windows\System\BZYspZc.exe
  2⤵
  PID:13764
- C:\Windows\System\JVbOUfc.exe
  C:\Windows\System\JVbOUfc.exe
  2⤵
  PID:13780
- C:\Windows\System\NQIwUHC.exe
  C:\Windows\System\NQIwUHC.exe
  2⤵
  PID:13796
- C:\Windows\System\uOJmkXz.exe
  C:\Windows\System\uOJmkXz.exe
  2⤵
  PID:13812
- C:\Windows\System\GkDsaPm.exe
  C:\Windows\System\GkDsaPm.exe
  2⤵
  PID:13828
- C:\Windows\System\czOyfUq.exe
  C:\Windows\System\czOyfUq.exe
  2⤵
  PID:13844
- C:\Windows\System\krMKoam.exe
  C:\Windows\System\krMKoam.exe
  2⤵
  PID:13860
- C:\Windows\System\dmkkloG.exe
  C:\Windows\System\dmkkloG.exe
  2⤵
  PID:13876
- C:\Windows\System\ZdUefGp.exe
  C:\Windows\System\ZdUefGp.exe
  2⤵
  PID:13892
- C:\Windows\System\dbisAnU.exe
  C:\Windows\System\dbisAnU.exe
  2⤵
  PID:13908
- C:\Windows\System\iiUnyli.exe
  C:\Windows\System\iiUnyli.exe
  2⤵
  PID:13924
- C:\Windows\System\XJDxCQx.exe
  C:\Windows\System\XJDxCQx.exe
  2⤵
  PID:13940
- C:\Windows\System\AXZccdw.exe
  C:\Windows\System\AXZccdw.exe
  2⤵
  PID:13956
- C:\Windows\System\lSXMszc.exe
  C:\Windows\System\lSXMszc.exe
  2⤵
  PID:13972
- C:\Windows\System\vNNdTXf.exe
  C:\Windows\System\vNNdTXf.exe
  2⤵
  PID:13988
- C:\Windows\System\xbcYPJf.exe
  C:\Windows\System\xbcYPJf.exe
  2⤵
  PID:14004
- C:\Windows\System\OjNqlzV.exe
  C:\Windows\System\OjNqlzV.exe
  2⤵
  PID:14020
- C:\Windows\System\XkhghyS.exe
  C:\Windows\System\XkhghyS.exe
  2⤵
  PID:14036
- C:\Windows\System\zsloslS.exe
  C:\Windows\System\zsloslS.exe
  2⤵
  PID:14052
- C:\Windows\System\pKwoeHi.exe
  C:\Windows\System\pKwoeHi.exe
  2⤵
  PID:14068
- C:\Windows\System\FdLhowK.exe
  C:\Windows\System\FdLhowK.exe
  2⤵
  PID:14084
- C:\Windows\System\JDIdLwu.exe
  C:\Windows\System\JDIdLwu.exe
  2⤵
  PID:14100
- C:\Windows\System\uaEqrKV.exe
  C:\Windows\System\uaEqrKV.exe
  2⤵
  PID:14116
- C:\Windows\System\nIFuKtl.exe
  C:\Windows\System\nIFuKtl.exe
  2⤵
  PID:14132
- C:\Windows\System\fbSrIhj.exe
  C:\Windows\System\fbSrIhj.exe
  2⤵
  PID:14148
- C:\Windows\System\edblzTt.exe
  C:\Windows\System\edblzTt.exe
  2⤵
  PID:14164
- C:\Windows\System\EMNlqxE.exe
  C:\Windows\System\EMNlqxE.exe
  2⤵
  PID:14180
- C:\Windows\System\tKwhxEs.exe
  C:\Windows\System\tKwhxEs.exe
  2⤵
  PID:14196
- C:\Windows\System\kUVNSXK.exe
  C:\Windows\System\kUVNSXK.exe
  2⤵
  PID:14212
- C:\Windows\System\GJAyxRG.exe
  C:\Windows\System\GJAyxRG.exe
  2⤵
  PID:14228
- C:\Windows\System\COiXyvw.exe
  C:\Windows\System\COiXyvw.exe
  2⤵
  PID:14244
- C:\Windows\System\zbRqyCX.exe
  C:\Windows\System\zbRqyCX.exe
  2⤵
  PID:14260
- C:\Windows\System\uqyfCuw.exe
  C:\Windows\System\uqyfCuw.exe
  2⤵
  PID:14276
- C:\Windows\System\mmuaJWG.exe
  C:\Windows\System\mmuaJWG.exe
  2⤵
  PID:14292
- C:\Windows\System\OQhfkaH.exe
  C:\Windows\System\OQhfkaH.exe
  2⤵
  PID:14308
- C:\Windows\System\rxrgPSE.exe
  C:\Windows\System\rxrgPSE.exe
  2⤵
  PID:14324
- C:\Windows\System\oRNOScw.exe
  C:\Windows\System\oRNOScw.exe
  2⤵
  PID:13324
- C:\Windows\System\rsKgnBw.exe
  C:\Windows\System\rsKgnBw.exe
  2⤵
  PID:13364
- C:\Windows\System\JxAvyZk.exe
  C:\Windows\System\JxAvyZk.exe
  2⤵
  PID:13400
- C:\Windows\System\AFRqenb.exe
  C:\Windows\System\AFRqenb.exe
  2⤵
  PID:13428
- C:\Windows\System\EkculbP.exe
  C:\Windows\System\EkculbP.exe
  2⤵
  PID:13464
- C:\Windows\System\cINseVe.exe
  C:\Windows\System\cINseVe.exe
  2⤵
  PID:13496
- C:\Windows\System\hSWBDpa.exe
  C:\Windows\System\hSWBDpa.exe
  2⤵
  PID:13528
- C:\Windows\System\HFwAcOE.exe
  C:\Windows\System\HFwAcOE.exe
  2⤵
  PID:13560
- C:\Windows\System\lPyIUeq.exe
  C:\Windows\System\lPyIUeq.exe
  2⤵
  PID:13596
- C:\Windows\System\GRjHgCz.exe
  C:\Windows\System\GRjHgCz.exe
  2⤵
  PID:13628
- C:\Windows\System\rCcUUAU.exe
  C:\Windows\System\rCcUUAU.exe
  2⤵
  PID:13660
- C:\Windows\System\iXooMmN.exe
  C:\Windows\System\iXooMmN.exe
  2⤵
  PID:13696
- C:\Windows\System\LjOAFAM.exe
  C:\Windows\System\LjOAFAM.exe
  2⤵
  PID:13728
- C:\Windows\System\bRWkbGv.exe
  C:\Windows\System\bRWkbGv.exe
  2⤵
  PID:13760
- C:\Windows\System\yghhhGq.exe
  C:\Windows\System\yghhhGq.exe
  2⤵
  PID:13792
- C:\Windows\System\CvqnfVP.exe
  C:\Windows\System\CvqnfVP.exe
  2⤵
  PID:13824
- C:\Windows\System\iUZYJWH.exe
  C:\Windows\System\iUZYJWH.exe
  2⤵
  PID:13856
- C:\Windows\System\CbMkcxD.exe
  C:\Windows\System\CbMkcxD.exe
  2⤵
  PID:13884
- C:\Windows\System\EKrMYAX.exe
  C:\Windows\System\EKrMYAX.exe
  2⤵
  PID:13920
- C:\Windows\System\ArBuIRx.exe
  C:\Windows\System\ArBuIRx.exe
  2⤵
  PID:13952
- C:\Windows\System\VhAbXmT.exe
  C:\Windows\System\VhAbXmT.exe
  2⤵
  PID:14000
- C:\Windows\System\NeIksye.exe
  C:\Windows\System\NeIksye.exe
  2⤵
  PID:14028
- C:\Windows\System\zksshPV.exe
  C:\Windows\System\zksshPV.exe
  2⤵
  PID:14076
- C:\Windows\System\zupAGoT.exe
  C:\Windows\System\zupAGoT.exe
  2⤵
  PID:14144
- C:\Windows\System\dNKgnGt.exe
  C:\Windows\System\dNKgnGt.exe
  2⤵
  PID:14188
- C:\Windows\System\ZEzgVBd.exe
  C:\Windows\System\ZEzgVBd.exe
  2⤵
  PID:14240
- C:\Windows\System\DeAxNkR.exe
  C:\Windows\System\DeAxNkR.exe
  2⤵
  PID:14272
- C:\Windows\System\pUPcVFb.exe
  C:\Windows\System\pUPcVFb.exe
  2⤵
  PID:14304
- C:\Windows\System\BuDJdQn.exe
  C:\Windows\System\BuDJdQn.exe
  2⤵
  PID:14332
- C:\Windows\System\YensSRr.exe
  C:\Windows\System\YensSRr.exe
  2⤵
  PID:13384
- C:\Windows\System\vPuxmfa.exe
  C:\Windows\System\vPuxmfa.exe
  2⤵
  PID:13448
- C:\Windows\System\qxByVwd.exe
  C:\Windows\System\qxByVwd.exe
  2⤵
  PID:13512
- C:\Windows\System\KQYfdyy.exe
  C:\Windows\System\KQYfdyy.exe
  2⤵
  PID:13612
- C:\Windows\System\KipqNIx.exe
  C:\Windows\System\KipqNIx.exe
  2⤵
  PID:13756
- C:\Windows\System\zKyeqQU.exe
  C:\Windows\System\zKyeqQU.exe
  2⤵
  PID:13840
- C:\Windows\System\ZKhyyuk.exe
  C:\Windows\System\ZKhyyuk.exe
  2⤵
  PID:3172
- C:\Windows\System\mGJrqyC.exe
  C:\Windows\System\mGJrqyC.exe
  2⤵
  PID:1652
- C:\Windows\System\EzEZseJ.exe
  C:\Windows\System\EzEZseJ.exe
  2⤵
  PID:14112
- C:\Windows\System\rhlFnXc.exe
  C:\Windows\System\rhlFnXc.exe
  2⤵
  PID:14224
- C:\Windows\System\kStNBgs.exe
  C:\Windows\System\kStNBgs.exe
  2⤵
  PID:13592
- C:\Windows\System\uTMjcRW.exe
  C:\Windows\System\uTMjcRW.exe
  2⤵
  PID:13360
- C:\Windows\System\zzkfIqQ.exe
  C:\Windows\System\zzkfIqQ.exe
  2⤵
  PID:13416
- C:\Windows\System\rVsUwcP.exe
  C:\Windows\System\rVsUwcP.exe
  2⤵
  PID:13692
- C:\Windows\System\NmJGkcJ.exe
  C:\Windows\System\NmJGkcJ.exe
  2⤵
  PID:13916
- C:\Windows\System\YAsEckU.exe
  C:\Windows\System\YAsEckU.exe
  2⤵
  PID:5068
- C:\Windows\System\FuOQnwP.exe
  C:\Windows\System\FuOQnwP.exe
  2⤵
  PID:14172
- C:\Windows\System\EJoMCjb.exe
  C:\Windows\System\EJoMCjb.exe
  2⤵
  PID:13340
- C:\Windows\System\tXVxCfu.exe
  C:\Windows\System\tXVxCfu.exe
  2⤵
  PID:13556
- C:\Windows\System\hMlYECA.exe
  C:\Windows\System\hMlYECA.exe
  2⤵
  PID:14060
- C:\Windows\System\vdRZhqm.exe
  C:\Windows\System\vdRZhqm.exe
  2⤵
  PID:14320
- C:\Windows\System\JpOPtwt.exe
  C:\Windows\System\JpOPtwt.exe
  2⤵
  PID:14108
- C:\Windows\System\dmuOnUH.exe
  C:\Windows\System\dmuOnUH.exe
  2⤵
  PID:13544
- C:\Windows\System\PVkJoIl.exe
  C:\Windows\System\PVkJoIl.exe
  2⤵
  PID:14288
- C:\Windows\System\fCgKClW.exe
  C:\Windows\System\fCgKClW.exe
  2⤵
  PID:14352
- C:\Windows\System\ocNIRPq.exe
  C:\Windows\System\ocNIRPq.exe
  2⤵
  PID:14368
- C:\Windows\System\raYHxIx.exe
  C:\Windows\System\raYHxIx.exe
  2⤵
  PID:14384
- C:\Windows\System\cMqdzqD.exe
  C:\Windows\System\cMqdzqD.exe
  2⤵
  PID:14400
- C:\Windows\System\XUNLoNH.exe
  C:\Windows\System\XUNLoNH.exe
  2⤵
  PID:14416
- C:\Windows\System\lVhXCel.exe
  C:\Windows\System\lVhXCel.exe
  2⤵
  PID:14432
- C:\Windows\System\oODHzju.exe
  C:\Windows\System\oODHzju.exe
  2⤵
  PID:14448
- C:\Windows\System\hZjTfTt.exe
  C:\Windows\System\hZjTfTt.exe
  2⤵
  PID:14464
- C:\Windows\System\uPDFltu.exe
  C:\Windows\System\uPDFltu.exe
  2⤵
  PID:14480
- C:\Windows\System\wFyIkPj.exe
  C:\Windows\System\wFyIkPj.exe
  2⤵
  PID:14496
- C:\Windows\System\INLYJTv.exe
  C:\Windows\System\INLYJTv.exe
  2⤵
  PID:14512
- C:\Windows\System\SOXDAhO.exe
  C:\Windows\System\SOXDAhO.exe
  2⤵
  PID:14528
- C:\Windows\System\jEehYrM.exe
  C:\Windows\System\jEehYrM.exe
  2⤵
  PID:14544
- C:\Windows\System\NIJnGgv.exe
  C:\Windows\System\NIJnGgv.exe
  2⤵
  PID:14560
- C:\Windows\System\jHtrwtM.exe
  C:\Windows\System\jHtrwtM.exe
  2⤵
  PID:14576
- C:\Windows\System\uxhDXcx.exe
  C:\Windows\System\uxhDXcx.exe
  2⤵
  PID:14592
- C:\Windows\System\OfAfGXl.exe
  C:\Windows\System\OfAfGXl.exe
  2⤵
  PID:14608
- C:\Windows\System\dqgAfCH.exe
  C:\Windows\System\dqgAfCH.exe
  2⤵
  PID:14624
- C:\Windows\System\UljXjdS.exe
  C:\Windows\System\UljXjdS.exe
  2⤵
  PID:14640
- C:\Windows\System\oyMmZKb.exe
  C:\Windows\System\oyMmZKb.exe
  2⤵
  PID:14656
- C:\Windows\System\bUCysRw.exe
  C:\Windows\System\bUCysRw.exe
  2⤵
  PID:14676
- C:\Windows\System\ngEpdXn.exe
  C:\Windows\System\ngEpdXn.exe
  2⤵
  PID:14692
- C:\Windows\System\cXiLnHV.exe
  C:\Windows\System\cXiLnHV.exe
  2⤵
  PID:14708
- C:\Windows\System\xuHlcAK.exe
  C:\Windows\System\xuHlcAK.exe
  2⤵
  PID:14724
- C:\Windows\System\SLbtzdA.exe
  C:\Windows\System\SLbtzdA.exe
  2⤵
  PID:14748
- C:\Windows\System\zEyhJwH.exe
  C:\Windows\System\zEyhJwH.exe
  2⤵
  PID:14764
- C:\Windows\System\CSIDWGH.exe
  C:\Windows\System\CSIDWGH.exe
  2⤵
  PID:15212
- C:\Windows\System\Pmaidzn.exe
  C:\Windows\System\Pmaidzn.exe
  2⤵
  PID:14604
- C:\Windows\System\InSDLFl.exe
  C:\Windows\System\InSDLFl.exe
  2⤵
  PID:14652
- C:\Windows\System\gYBpGBn.exe
  C:\Windows\System\gYBpGBn.exe
  2⤵
  PID:14688
- C:\Windows\System\JDwSjYi.exe
  C:\Windows\System\JDwSjYi.exe
  2⤵
  PID:14732
- C:\Windows\System\yMFDsUZ.exe
  C:\Windows\System\yMFDsUZ.exe
  2⤵
  PID:14784
- C:\Windows\System\HSYcCpA.exe
  C:\Windows\System\HSYcCpA.exe
  2⤵
  PID:14776
- C:\Windows\System\FqATOhO.exe
  C:\Windows\System\FqATOhO.exe
  2⤵
  PID:14804
- C:\Windows\System\MSYnOad.exe
  C:\Windows\System\MSYnOad.exe
  2⤵
  PID:14832
- C:\Windows\System\qENNRzJ.exe
  C:\Windows\System\qENNRzJ.exe
  2⤵
  PID:3212
- C:\Windows\System\FSODOKA.exe
  C:\Windows\System\FSODOKA.exe
  2⤵
  PID:14884
- C:\Windows\System\osqaxqY.exe
  C:\Windows\System\osqaxqY.exe
  2⤵
  PID:14908
- C:\Windows\System\muWhWmZ.exe
  C:\Windows\System\muWhWmZ.exe
  2⤵
  PID:14924
- C:\Windows\System\YNvGGSS.exe
  C:\Windows\System\YNvGGSS.exe
  2⤵
  PID:3272
- C:\Windows\System\erFMRNN.exe
  C:\Windows\System\erFMRNN.exe
  2⤵
  PID:3280
- C:\Windows\System\BMgGvFp.exe
  C:\Windows\System\BMgGvFp.exe
  2⤵
  PID:14948
- C:\Windows\System\JrRigGM.exe
  C:\Windows\System\JrRigGM.exe
  2⤵
  PID:14980
- C:\Windows\System\pcQJofn.exe
  C:\Windows\System\pcQJofn.exe
  2⤵
  PID:15000
- C:\Windows\System\oqDpvpZ.exe
  C:\Windows\System\oqDpvpZ.exe
  2⤵
  PID:15020
- C:\Windows\System\ELkGPNT.exe
  C:\Windows\System\ELkGPNT.exe
  2⤵
  PID:15052
- C:\Windows\System\BRYcoGh.exe
  C:\Windows\System\BRYcoGh.exe
  2⤵
  PID:15080
- C:\Windows\System\JJWHwef.exe
  C:\Windows\System\JJWHwef.exe
  2⤵
  PID:15112
- C:\Windows\System\CXhcMEt.exe
  C:\Windows\System\CXhcMEt.exe
  2⤵
  PID:3904
- C:\Windows\System\XjCguNC.exe
  C:\Windows\System\XjCguNC.exe
  2⤵
  PID:15144
- C:\Windows\System\YecvMrY.exe
  C:\Windows\System\YecvMrY.exe
  2⤵
  PID:4168
- C:\Windows\System\RpLkDIn.exe
  C:\Windows\System\RpLkDIn.exe
  2⤵
  PID:15176
- C:\Windows\System\bIMQIYV.exe
  C:\Windows\System\bIMQIYV.exe
  2⤵
  PID:15200
- C:\Windows\System\zQlKemI.exe
  C:\Windows\System\zQlKemI.exe
  2⤵
  PID:15228
- C:\Windows\System\YpGnUkR.exe
  C:\Windows\System\YpGnUkR.exe
  2⤵
  PID:15260
- C:\Windows\System\fmdChxA.exe
  C:\Windows\System\fmdChxA.exe
  2⤵
  PID:15276
- C:\Windows\System\xLupYIH.exe
  C:\Windows\System\xLupYIH.exe
  2⤵
  PID:15308
- C:\Windows\System\hNnIPzc.exe
  C:\Windows\System\hNnIPzc.exe
  2⤵
  PID:15336
- C:\Windows\System\OlKXawn.exe
  C:\Windows\System\OlKXawn.exe
  2⤵
  PID:15352
- C:\Windows\System\TOOGbQw.exe
  C:\Windows\System\TOOGbQw.exe
  2⤵
  PID:14360
- C:\Windows\System\gkEmOeJ.exe
  C:\Windows\System\gkEmOeJ.exe
  2⤵
  PID:13576
- C:\Windows\System\QRLayQY.exe
  C:\Windows\System\QRLayQY.exe
  2⤵
  PID:14160
- C:\Windows\System\BWhDaoB.exe
  C:\Windows\System\BWhDaoB.exe
  2⤵
  PID:14140
- C:\Windows\System\ZKOFVMf.exe
  C:\Windows\System\ZKOFVMf.exe
  2⤵
  PID:14440
- C:\Windows\System\DwwZwel.exe
  C:\Windows\System\DwwZwel.exe
  2⤵
  PID:14472
- C:\Windows\System\QkIREXY.exe
  C:\Windows\System\QkIREXY.exe
  2⤵
  PID:14508
- C:\Windows\System\kpsqtzz.exe
  C:\Windows\System\kpsqtzz.exe
  2⤵
  PID:14540
- C:\Windows\System\XQeeXVj.exe
  C:\Windows\System\XQeeXVj.exe
  2⤵
  PID:516
- C:\Windows\System\PImeLLn.exe
  C:\Windows\System\PImeLLn.exe
  2⤵
  PID:13352
- C:\Windows\System\bMwtSWN.exe
  C:\Windows\System\bMwtSWN.exe
  2⤵
  PID:6252
- C:\Windows\System\mvTGGzx.exe
  C:\Windows\System\mvTGGzx.exe
  2⤵
  PID:3184
- C:\Windows\System\LvUVLhD.exe
  C:\Windows\System\LvUVLhD.exe
  2⤵
  PID:13356
- C:\Windows\System\ZuTZjyj.exe
  C:\Windows\System\ZuTZjyj.exe
  2⤵
  PID:3932
- C:\Windows\System\XQLYEQj.exe
  C:\Windows\System\XQLYEQj.exe
  2⤵
  PID:2344
- C:\Windows\System\FvQcyqQ.exe
  C:\Windows\System\FvQcyqQ.exe
  2⤵
  PID:14648
- C:\Windows\System\HMQotHP.exe
  C:\Windows\System\HMQotHP.exe
  2⤵
  PID:14636
- C:\Windows\System\ICOznrr.exe
  C:\Windows\System\ICOznrr.exe
  2⤵
  PID:14792
- C:\Windows\System\JaAjISI.exe
  C:\Windows\System\JaAjISI.exe
  2⤵
  PID:14812
- C:\Windows\System\GeWvJzj.exe
  C:\Windows\System\GeWvJzj.exe
  2⤵
  PID:14824
- C:\Windows\System\EMjsWqk.exe
  C:\Windows\System\EMjsWqk.exe
  2⤵
  PID:14820
- C:\Windows\System\oDDTLbC.exe
  C:\Windows\System\oDDTLbC.exe
  2⤵
  PID:14864
- C:\Windows\System\GIKGFkq.exe
  C:\Windows\System\GIKGFkq.exe
  2⤵
  PID:14892
- C:\Windows\System\qqEpBEc.exe
  C:\Windows\System\qqEpBEc.exe
  2⤵
  PID:3264
- C:\Windows\System\OdqvoFJ.exe
  C:\Windows\System\OdqvoFJ.exe
  2⤵
  PID:13712
- C:\Windows\System\HYBXHqg.exe
  C:\Windows\System\HYBXHqg.exe
  2⤵
  PID:2332
- C:\Windows\System\GRiglry.exe
  C:\Windows\System\GRiglry.exe
  2⤵
  PID:4420
- C:\Windows\System\VFkmKgI.exe
  C:\Windows\System\VFkmKgI.exe
  2⤵
  PID:14960
- C:\Windows\System\SSbFXyT.exe
  C:\Windows\System\SSbFXyT.exe
  2⤵
  PID:14976
- C:\Windows\System\smdXiMN.exe
  C:\Windows\System\smdXiMN.exe
  2⤵
  PID:15008
- C:\Windows\System\ZMJGaAH.exe
  C:\Windows\System\ZMJGaAH.exe
  2⤵
  PID:1576
- C:\Windows\System\ElodVLM.exe
  C:\Windows\System\ElodVLM.exe
  2⤵
  PID:1632
- C:\Windows\System\qKyAWWm.exe
  C:\Windows\System\qKyAWWm.exe
  2⤵
  PID:15164
- C:\Windows\System\TZOzBdM.exe
  C:\Windows\System\TZOzBdM.exe
  2⤵
  PID:4456
- C:\Windows\System\mODpSDD.exe
  C:\Windows\System\mODpSDD.exe
  2⤵
  PID:4448
- C:\Windows\System\fFAZlGe.exe
  C:\Windows\System\fFAZlGe.exe
  2⤵
  PID:4472
- C:\Windows\System\JczPvvn.exe
  C:\Windows\System\JczPvvn.exe
  2⤵
  PID:4720
- C:\Windows\System\YAAgjVu.exe
  C:\Windows\System\YAAgjVu.exe
  2⤵
  PID:856
- C:\Windows\System\JtFExtI.exe
  C:\Windows\System\JtFExtI.exe
  2⤵
  PID:15332
- C:\Windows\System\NSJNuUv.exe
  C:\Windows\System\NSJNuUv.exe
  2⤵
  PID:15292
- C:\Windows\System\beSzkss.exe
  C:\Windows\System\beSzkss.exe
  2⤵
  PID:4404
- C:\Windows\System\URYzQZA.exe
  C:\Windows\System\URYzQZA.exe
  2⤵
  PID:6204
- C:\Windows\System\hGJkLEl.exe
  C:\Windows\System\hGJkLEl.exe
  2⤵
  PID:14376
- C:\Windows\System\TEDCrfo.exe
  C:\Windows\System\TEDCrfo.exe
  2⤵
  PID:2328
- C:\Windows\System\iEJnFCD.exe
  C:\Windows\System\iEJnFCD.exe
  2⤵
  PID:14860
- C:\Windows\System\DAXZygw.exe
  C:\Windows\System\DAXZygw.exe
  2⤵
  PID:14456
- C:\Windows\System\vYcXbZs.exe
  C:\Windows\System\vYcXbZs.exe
  2⤵
  PID:4696
- C:\Windows\System\uNibMSv.exe
  C:\Windows\System\uNibMSv.exe
  2⤵
  PID:1268
- C:\Windows\System\kRybQXe.exe
  C:\Windows\System\kRybQXe.exe
  2⤵
  PID:6304
- C:\Windows\System\aTlicaP.exe
  C:\Windows\System\aTlicaP.exe
  2⤵
  PID:6360
- C:\Windows\System\mTUpeAa.exe
  C:\Windows\System\mTUpeAa.exe
  2⤵
  PID:1532
- C:\Windows\System\PvPhijx.exe
  C:\Windows\System\PvPhijx.exe
  2⤵
  PID:3608
- C:\Windows\System\bajNEjg.exe
  C:\Windows\System\bajNEjg.exe
  2⤵
  PID:14568
- C:\Windows\System\HbMcNUm.exe
  C:\Windows\System\HbMcNUm.exe
  2⤵
  PID:3216
- C:\Windows\System\KVFPYTW.exe
  C:\Windows\System\KVFPYTW.exe
  2⤵
  PID:2792
- C:\Windows\System\xMwgoWp.exe
  C:\Windows\System\xMwgoWp.exe
  2⤵
  PID:14600
- C:\Windows\System\NUZoUkA.exe
  C:\Windows\System\NUZoUkA.exe
  2⤵
  PID:14704
- C:\Windows\System\HpixMAK.exe
  C:\Windows\System\HpixMAK.exe
  2⤵
  PID:5200
- C:\Windows\System\ERglydZ.exe
  C:\Windows\System\ERglydZ.exe
  2⤵
  PID:5216
- C:\Windows\System\BEPJiII.exe
  C:\Windows\System\BEPJiII.exe
  2⤵
  PID:4620
- C:\Windows\System\YUuAXnw.exe
  C:\Windows\System\YUuAXnw.exe
  2⤵
  PID:5336
- C:\Windows\System\kpaYXig.exe
  C:\Windows\System\kpaYXig.exe
  2⤵
  PID:4728
- C:\Windows\System\mNCQPav.exe
  C:\Windows\System\mNCQPav.exe
  2⤵
  PID:14904
- C:\Windows\System\XVuEagn.exe
  C:\Windows\System\XVuEagn.exe
  2⤵
  PID:2632
- C:\Windows\System\yQBjRac.exe
  C:\Windows\System\yQBjRac.exe
  2⤵
  PID:4176
- C:\Windows\System\zmfjkeo.exe
  C:\Windows\System\zmfjkeo.exe
  2⤵
  PID:3296
- C:\Windows\System\nYQIQxM.exe
  C:\Windows\System\nYQIQxM.exe
  2⤵
  PID:5472
- C:\Windows\System\AayYjBa.exe
  C:\Windows\System\AayYjBa.exe
  2⤵
  PID:5704
- C:\Windows\System\xVAMviH.exe
  C:\Windows\System\xVAMviH.exe
  2⤵
  PID:4844
- C:\Windows\System\STnAXFr.exe
  C:\Windows\System\STnAXFr.exe
  2⤵
  PID:4032
- C:\Windows\System\wcrUkgx.exe
  C:\Windows\System\wcrUkgx.exe
  2⤵
  PID:6240
- C:\Windows\System\CXZqvAS.exe
  C:\Windows\System\CXZqvAS.exe
  2⤵
  PID:15068
- C:\Windows\System\bFUMFfl.exe
  C:\Windows\System\bFUMFfl.exe
  2⤵
  PID:3044
- C:\Windows\System\olHdfir.exe
  C:\Windows\System\olHdfir.exe
  2⤵
  PID:14392
- C:\Windows\System\ieNXstA.exe
  C:\Windows\System\ieNXstA.exe
  2⤵
  PID:1072
- C:\Windows\System\bRehcVP.exe
  C:\Windows\System\bRehcVP.exe
  2⤵
  PID:5968
- C:\Windows\System\peJsnLf.exe
  C:\Windows\System\peJsnLf.exe
  2⤵
  PID:5720
- C:\Windows\System\ojqFAVg.exe
  C:\Windows\System\ojqFAVg.exe
  2⤵
  PID:15220
- C:\Windows\System\yLUnnAr.exe
  C:\Windows\System\yLUnnAr.exe
  2⤵
  PID:908
- C:\Windows\System\RoOhmKC.exe
  C:\Windows\System\RoOhmKC.exe
  2⤵
  PID:15244
- C:\Windows\System\ivaIXum.exe
  C:\Windows\System\ivaIXum.exe
  2⤵
  PID:15252
- C:\Windows\System\CHOyUSB.exe
  C:\Windows\System\CHOyUSB.exe
  2⤵
  PID:2624
- C:\Windows\System\wvcdlvA.exe
  C:\Windows\System\wvcdlvA.exe
  2⤵
  PID:5412
- C:\Windows\System\xutjWLA.exe
  C:\Windows\System\xutjWLA.exe
  2⤵
  PID:1560
- C:\Windows\System\RfEdxTX.exe
  C:\Windows\System\RfEdxTX.exe
  2⤵
  PID:1660
- C:\Windows\System\uopJGRA.exe
  C:\Windows\System\uopJGRA.exe
  2⤵
  PID:14524
- C:\Windows\System\JrkaYcO.exe
  C:\Windows\System\JrkaYcO.exe
  2⤵
  PID:436
- C:\Windows\System\cFwZfVu.exe
  C:\Windows\System\cFwZfVu.exe
  2⤵
  PID:4100
- C:\Windows\System\MjGzqtZ.exe
  C:\Windows\System\MjGzqtZ.exe
  2⤵
  PID:2620
- C:\Windows\System\pUnWGmq.exe
  C:\Windows\System\pUnWGmq.exe
  2⤵
  PID:15288
- C:\Windows\System\mdjXcjR.exe
  C:\Windows\System\mdjXcjR.exe
  2⤵
  PID:14220
- C:\Windows\System\zJfAFWP.exe
  C:\Windows\System\zJfAFWP.exe
  2⤵
  PID:15348
- C:\Windows\System\ndiVRpe.exe
  C:\Windows\System\ndiVRpe.exe
  2⤵
  PID:5832
- C:\Windows\System\WHfDhCE.exe
  C:\Windows\System\WHfDhCE.exe
  2⤵
  PID:1384
- C:\Windows\System\kXEdibH.exe
  C:\Windows\System\kXEdibH.exe
  2⤵
  PID:5584
- C:\Windows\System\MlqOSAa.exe
  C:\Windows\System\MlqOSAa.exe
  2⤵
  PID:5188
- C:\Windows\System\LYkORbP.exe
  C:\Windows\System\LYkORbP.exe
  2⤵
  PID:5532
- C:\Windows\System\yoKJsfP.exe
  C:\Windows\System\yoKJsfP.exe
  2⤵
  PID:6028
- C:\Windows\System\iTTJpaY.exe
  C:\Windows\System\iTTJpaY.exe
  2⤵
  PID:4304
- C:\Windows\System\JnJtNXt.exe
  C:\Windows\System\JnJtNXt.exe
  2⤵
  PID:5208
- C:\Windows\System\jGJEIhb.exe
  C:\Windows\System\jGJEIhb.exe
  2⤵
  PID:5540
- C:\Windows\System\cxuQQCh.exe
  C:\Windows\System\cxuQQCh.exe
  2⤵
  PID:6080
- C:\Windows\System\VBfQpgQ.exe
  C:\Windows\System\VBfQpgQ.exe
  2⤵
  PID:5048
- C:\Windows\System\clmfSgO.exe
  C:\Windows\System\clmfSgO.exe
  2⤵
  PID:5132
- C:\Windows\System\WzlkOmI.exe
  C:\Windows\System\WzlkOmI.exe
  2⤵
  PID:5192
- C:\Windows\System\rhtJLAW.exe
  C:\Windows\System\rhtJLAW.exe
  2⤵
  PID:14796
- C:\Windows\System\fPsVxPG.exe
  C:\Windows\System\fPsVxPG.exe
  2⤵
  PID:15208
- C:\Windows\System\nHEKpiW.exe
  C:\Windows\System\nHEKpiW.exe
  2⤵
  PID:1144
- C:\Windows\System\skIjBKj.exe
  C:\Windows\System\skIjBKj.exe
  2⤵
  PID:2320
- C:\Windows\System\pgMNyfD.exe
  C:\Windows\System\pgMNyfD.exe
  2⤵
  PID:14928
- C:\Windows\System\UYxOpEp.exe
  C:\Windows\System\UYxOpEp.exe
  2⤵
  PID:3292
- C:\Windows\System\ctlPvms.exe
  C:\Windows\System\ctlPvms.exe
  2⤵
  PID:5380
- C:\Windows\System\DqHhsQt.exe
  C:\Windows\System\DqHhsQt.exe
  2⤵
  PID:5696
- C:\Windows\System\EmQKzbs.exe
  C:\Windows\System\EmQKzbs.exe
  2⤵
  PID:5708
- C:\Windows\System\ZxDhxfK.exe
  C:\Windows\System\ZxDhxfK.exe
  2⤵
  PID:15040
- C:\Windows\System\pWjImWI.exe
  C:\Windows\System\pWjImWI.exe
  2⤵
  PID:2836
- C:\Windows\System\xwsCVco.exe
  C:\Windows\System\xwsCVco.exe
  2⤵
  PID:456
- C:\Windows\System\amFdCSE.exe
  C:\Windows\System\amFdCSE.exe
  2⤵
  PID:2224
- C:\Windows\System\lZNoscF.exe
  C:\Windows\System\lZNoscF.exe
  2⤵
  PID:14956
- C:\Windows\System\fBLqsKX.exe
  C:\Windows\System\fBLqsKX.exe
  2⤵
  PID:15076
- C:\Windows\System\iGjYlNv.exe
  C:\Windows\System\iGjYlNv.exe
  2⤵
  PID:4268
- C:\Windows\System\EfFQFIm.exe
  C:\Windows\System\EfFQFIm.exe
  2⤵
  PID:15048
- C:\Windows\System\uhKzgSi.exe
  C:\Windows\System\uhKzgSi.exe
  2⤵
  PID:5932
- C:\Windows\System\assoCMX.exe
  C:\Windows\System\assoCMX.exe
  2⤵
  PID:1456
- C:\Windows\System\ErTZmIm.exe
  C:\Windows\System\ErTZmIm.exe
  2⤵
  PID:14380
- C:\Windows\System\VhwgSYa.exe
  C:\Windows\System\VhwgSYa.exe
  2⤵
  PID:5252
- C:\Windows\System\HiqRCYE.exe
  C:\Windows\System\HiqRCYE.exe
  2⤵
  PID:5952
- C:\Windows\System\icCebWT.exe
  C:\Windows\System\icCebWT.exe
  2⤵
  PID:15120
- C:\Windows\System\oYSfLWB.exe
  C:\Windows\System\oYSfLWB.exe
  2⤵
  PID:2920
- C:\Windows\System\GGBSYat.exe
  C:\Windows\System\GGBSYat.exe
  2⤵
  PID:5276
- C:\Windows\System\MyrRhDx.exe
  C:\Windows\System\MyrRhDx.exe
  2⤵
  PID:14552
- C:\Windows\System\YcrcuSb.exe
  C:\Windows\System\YcrcuSb.exe
  2⤵
  PID:15224
- C:\Windows\System\uRGFCYo.exe
  C:\Windows\System\uRGFCYo.exe
  2⤵
  PID:5204
- C:\Windows\System\mSlmGEa.exe
  C:\Windows\System\mSlmGEa.exe
  2⤵
  PID:15188
- C:\Windows\System\spToRld.exe
  C:\Windows\System\spToRld.exe
  2⤵
  PID:2184
- C:\Windows\System\hLVOsyF.exe
  C:\Windows\System\hLVOsyF.exe
  2⤵
  PID:13808
- C:\Windows\System\oWJJXxX.exe
  C:\Windows\System\oWJJXxX.exe
  2⤵
  PID:2692
- C:\Windows\System\IgKLhML.exe
  C:\Windows\System\IgKLhML.exe
  2⤵
  PID:14876
- C:\Windows\System\PzZINtP.exe
  C:\Windows\System\PzZINtP.exe
  2⤵
  PID:5904
- C:\Windows\System\vkCuHvI.exe
  C:\Windows\System\vkCuHvI.exe
  2⤵
  PID:5948
- C:\Windows\System\OKPgsgq.exe
  C:\Windows\System\OKPgsgq.exe
  2⤵
  PID:5836
- C:\Windows\System\uzJezpm.exe
  C:\Windows\System\uzJezpm.exe
  2⤵
  PID:5780
- C:\Windows\System\FGAVbDq.exe
  C:\Windows\System\FGAVbDq.exe
  2⤵
  PID:5480
- C:\Windows\System\WQbmJzl.exe
  C:\Windows\System\WQbmJzl.exe
  2⤵
  PID:14492
- C:\Windows\System\vdypdNC.exe
  C:\Windows\System\vdypdNC.exe
  2⤵
  PID:5488
- C:\Windows\System\bqrrDUR.exe
  C:\Windows\System\bqrrDUR.exe
  2⤵
  PID:6192
- C:\Windows\System\oPuLOpw.exe
  C:\Windows\System\oPuLOpw.exe
  2⤵
  PID:14092
- C:\Windows\System\xguhIed.exe
  C:\Windows\System\xguhIed.exe
  2⤵
  PID:14664
- C:\Windows\System\VAmQJjd.exe
  C:\Windows\System\VAmQJjd.exe
  2⤵
  PID:2780
- C:\Windows\System\pYOnxpK.exe
  C:\Windows\System\pYOnxpK.exe
  2⤵
  PID:1724
- C:\Windows\System\czOQULM.exe
  C:\Windows\System\czOQULM.exe
  2⤵
  PID:5320
- C:\Windows\System\DHXNhoY.exe
  C:\Windows\System\DHXNhoY.exe
  2⤵
  PID:15088
- C:\Windows\System\YIAoiHd.exe
  C:\Windows\System\YIAoiHd.exe
  2⤵
  PID:4980
- C:\Windows\System\DAfkmRf.exe
  C:\Windows\System\DAfkmRf.exe
  2⤵
  PID:5956
- C:\Windows\System\gpqJGMA.exe
  C:\Windows\System\gpqJGMA.exe
  2⤵
  PID:6104
- C:\Windows\System\cBvUyXo.exe
  C:\Windows\System\cBvUyXo.exe
  2⤵
  PID:3752
- C:\Windows\System\XopHOUQ.exe
  C:\Windows\System\XopHOUQ.exe
  2⤵
  PID:2580
- C:\Windows\System\pgnWIVs.exe
  C:\Windows\System\pgnWIVs.exe
  2⤵
  PID:5468
- C:\Windows\System\PusNnkN.exe
  C:\Windows\System\PusNnkN.exe
  2⤵
  PID:5512
- C:\Windows\System\FseIeWV.exe
  C:\Windows\System\FseIeWV.exe
  2⤵
  PID:2384
- C:\Windows\System\tGwEhts.exe
  C:\Windows\System\tGwEhts.exe
  2⤵
  PID:2428
- C:\Windows\System\xwbtpAE.exe
  C:\Windows\System\xwbtpAE.exe
  2⤵
  PID:6068
- C:\Windows\System\YjSBrrN.exe
  C:\Windows\System\YjSBrrN.exe
  2⤵
  PID:2808
- C:\Windows\System\KXvcWDf.exe
  C:\Windows\System\KXvcWDf.exe
  2⤵
  PID:15044
- C:\Windows\System\FAAUiOK.exe
  C:\Windows\System\FAAUiOK.exe
  2⤵
  PID:14964
- C:\Windows\System\BxkxsAk.exe
  C:\Windows\System\BxkxsAk.exe
  2⤵
  PID:6200
- C:\Windows\System\dPJFDTn.exe
  C:\Windows\System\dPJFDTn.exe
  2⤵
  PID:5376
- C:\Windows\System\NHVxioy.exe
  C:\Windows\System\NHVxioy.exe
  2⤵
  PID:4712
- C:\Windows\System\WrYOkxh.exe
  C:\Windows\System\WrYOkxh.exe
  2⤵
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rlxjjg4h.frk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BnXLulR.exe

Filesize
2.0MB

MD5
f458094a49a3230e0b0262deb3aecdd9

SHA1
e96f08a69da47c2db872bf7aed8b92d20311a081

SHA256
471c9bab0d9c14f189b160e7d8a68195dd5191a72d7762c85183c3dfd647daea

SHA512
06f1cc259f0963afc1a2086733aad615b678977aa8b09097775dca2af2ea6814d7e86cc11dcdec92a1ea755b653afdfd08683a7620f5aa00b83a0ed1bb5cbb77

Download Submit
C:\Windows\System\ItXeRGe.exe

Filesize
2.0MB

MD5
50da7304c7d71b022a4076ab97c6bcd8

SHA1
042798078b4bec5d9475d78e35f77f747f8815f1

SHA256
66bc2a20bda3e300a749d130328b440c3aaf476f57049dbcea27e190ff29b38c

SHA512
000a7b954551a3a4e9da074e66d6f78baafef5e92fdf4002d446cfea173c8b2fa1e565162c053e86bb0dd34650ff39b86866ab2df78b1d9e33c4ab3d66b2dba8

Download Submit
C:\Windows\System\IxzyLwJ.exe

Filesize
2.0MB

MD5
ce634fe47d015e6d2d63902b02abdf31

SHA1
76c7ee49dcf2c69393787a415dcfe23d2e39dac1

SHA256
118b9ee2376fa90c29d739027155beda1a668421227c2b63db160d0033da4a41

SHA512
634fdd38302fc19f9b16459d04a55b48867252be20444c513a36c964636ce9bdd4a0af2a91365988473b211c13a41487ee7bb968ae1185f98cce3fc56dc914b4

Download Submit
C:\Windows\System\KtKJnPM.exe

Filesize
2.0MB

MD5
365ace21c99f6da604dc9ba3121cea38

SHA1
57d0a98f3e9f96e93d90ca006074a7d80fc4b6a8

SHA256
0febb669eeaed68a18ae4fa0fc78a1f387958d423c5159e35ac0dde0add9a8df

SHA512
da15f7f2b2b29de6380db45d4f1e48f7c1607b4fdc44cbd477468f2e37a47d3e1c6f71bb15e7b4337036801e01c35f28c9525fd4e5f77e11c00ed9fd9f8301a8

Download Submit
C:\Windows\System\PbMwxwB.exe

Filesize
2.0MB

MD5
c6e89b4586493704f70e4f01a14460c0

SHA1
d76db032adbda15874bf886781e16fa920afbd86

SHA256
0f7c52d5b3317313b1c738b9dd06a0d261bae029575c4a6ebabebab38cd2f64b

SHA512
febebe1fa79b341c68f4fcf6648e8149a169236412c2f648665a5721f272228037ba299e4c4a6c4ade1aff676d421181053b3e4ef6f1d7a178b3c015edd60128

Download Submit
C:\Windows\System\QzmEqxj.exe

Filesize
2.0MB

MD5
9b79139a172e42fb1766c5ece15f6aec

SHA1
1e253326e5411394f6721c0312f4e03db48135d2

SHA256
6c5028a18f5fa6080f6b538f2ef331bb0ae059073a87d312cb9d4a728e7d22eb

SHA512
f406d99fa8f1b600e20e339f4895c6c53bcc9505407d8429a950ac7f62753786c85ce5052c4659577961ce58a70350412659bcb398fc4ebebc5ea47635fc4834

Download Submit
C:\Windows\System\RGPTIOU.exe

Filesize
2.0MB

MD5
8eac8dfdb88284d5f3daa2dd46302dfc

SHA1
415f5a6964b9484d814808defbceb4226c789892

SHA256
1434f722f2898329e8e360725edbec571d243f34fd0db873cfed1a9e9e9253be

SHA512
7561fb49f190b7e15e12d27f54b4ef97ee40a70597ef5f9596c5999bf86dead754cb354b40aad84202b5419f750fbaa743b8ba21a3f910be86d914cafe338d21

Download Submit
C:\Windows\System\SpzQomE.exe

Filesize
2.0MB

MD5
4dd8dd6c092817e71d665989025dd882

SHA1
eee4049cd3dc16fd77fef6ed1df5ddc9237fe739

SHA256
166582a558278351aae96715d0076f7334c9799d2d3e393331e55ff68b837471

SHA512
f7c8e2eb667bad9b0812fae66afcae80876de3ab7da39479cbc79610147ef4902d4df6a7b4af7dfbef981bfdf2e01bed6fcb16ab5f51c3bd85503a919373c755

Download Submit
C:\Windows\System\Swvpprm.exe

Filesize
2.0MB

MD5
a96089ef4313f0aea09eb05f2cc8282d

SHA1
b189d76e6430ec98f85a34c90424cff201efd53a

SHA256
a0f9af1b30c4da96995d734f89595320c71025b50e7354bbec1072731797cf1e

SHA512
48cde203f86cb0eaae46bfae20f128a11cda3cdf3d5a8c4a3b71cb2a0fbc3ae2cd1163f234f17ddf0395a304132d05adcafc2526e547803ea31c7edc18f389ee

Download Submit
C:\Windows\System\Tfuruof.exe

Filesize
2.0MB

MD5
951d45492e30dd3315c906bb47cf27c4

SHA1
d4ee872c0e33d101e00fada135c5624984ff29bc

SHA256
7bd98061f635385e8398939fec1eafc7ecb1f75fb36a6170a5fd59c314c484f1

SHA512
b898bed997864136b5e275a15bd6bf3dda55ccba45f486a40d6b6c6cc81c6ebdb36ab8ec5c43c2543627d460324eea9109d117b29236871ca587246b1a557236

Download Submit
C:\Windows\System\TtOhNMp.exe

Filesize
2.0MB

MD5
14787ef5718da46db50c2815b4dd9f6a

SHA1
3484e629f10e72abc1bcf67cb1cb3e2ba0819a2b

SHA256
a5e8c83ff20d2cb0935ef3f4f3bcd327faa32b5843f468095a1402337baed1dd

SHA512
596ab9bd064770778a794b583f30cba92c456228560d57b1b686cd92844c457ce99229240bc4998fc6c9f2cef0a90fc56a13356c87d69fe18f45b1454499094f

Download Submit
C:\Windows\System\UcEuIsc.exe

Filesize
2.0MB

MD5
7c6852354109d974f1dd4f5dd27a7248

SHA1
7acf38078d662b6233c6e3a583e17d94881272f6

SHA256
e025ffda8965751bb07c916bcc482503b70d6bef2c98420266afe3e8901171e3

SHA512
cfabdc75e499db8914cb6697ebfe2b84d8f5e8e603998e9af03eaaffc6e6f3d60e054b7a9330a79865606b1b5bb36bd695fb507c97da81238bea38e9cfeec8b3

Download Submit
C:\Windows\System\UyhRCfW.exe

Filesize
2.0MB

MD5
77ca9576edb9730693a3e18886e7fb9f

SHA1
cd3eb4238b8e3f0b6f8f6c42f4b314c80047eb5c

SHA256
dbcd94cff972c872cf025ac7c3ae27c9db87fa93b0417423e0d76a50ab981419

SHA512
38b241fb94ec47b75bff42724e7963d9b3273e58f517a5c21ee5dd3f95c4d22de9ee634e40a9bfe057256d337916285793ea6a7b14258f8d3030918ab29bc20d

Download Submit
C:\Windows\System\XLQFPMA.exe

Filesize
2.0MB

MD5
127bfaaa2446b8a04eb9ff9d674312d5

SHA1
e3fdcd779f26a4da810980c44738225fa7360fe6

SHA256
448fef4328090b85ba495e81153e842af7d83c9647c12d5bd524c2cacf5830ff

SHA512
645acf9ea02fdf89cd1062129904f31e516501cb0047dbf3d7bc99fdeb4dbece05e8f5cf54d9c5f37fdcb050fbd4e249a04c8027d89c9cac6f48e026ce317f58

Download Submit
C:\Windows\System\ZVCYWqF.exe

Filesize
2.0MB

MD5
4c1f76216246389acfa1d2f34a4a7b5b

SHA1
a3629cac08d68cde11a8b5fd6d7462db81e2e3de

SHA256
11da0a8aa1b9c04b2113c83305ac558fe57ed1642bf9ff71e6e2192b388d5fa6

SHA512
0f3f9ed06e5b143b5b9a2f5f58069fb0e124f982c82d03104c04cb3b6a719afc8a6b599b8da5726b30db7a8218e263815c2618501243814c81a742575cac869c

Download Submit
C:\Windows\System\aIKjAkT.exe

Filesize
2.0MB

MD5
067f347abff588d771e3358287a492d6

SHA1
02ad7e5a7aeae2e004fb4799f57d1e5045f8f105

SHA256
95ac67f97dedf2c52578689dcb7db508591abaaf15c0335dae269cbb905f4888

SHA512
c9ce95de54247592714ae42cee5f9316b37b50d10536b0822822d11b1c348e965fbcb9fa86d341553e68f3c555a991d16ddd367deb02064081407e63c7506a94

Download Submit
C:\Windows\System\achDTcf.exe

Filesize
2.0MB

MD5
015e3710826349f22d20d69e703c07df

SHA1
3691dc0a4874195c3f90051bb1fc28581d5b1cad

SHA256
20725774c7a8ba915e1da22e7a74f3bfbd07dea1b2c375e22769b79d96574a4e

SHA512
4bd9215e709e7e62ddfd818c5e9625dd1625d6be2aa87835acfda1aca266b0e5bdf623f59f760b6422c531b2585a432c826984cefc53859ad4e1a8daa6761646

Download Submit
C:\Windows\System\cumiubb.exe

Filesize
2.0MB

MD5
07e379db5168f75e7d0467063f86c24b

SHA1
0b8e9ff534d23305972b5a4896a318e64c69406a

SHA256
e31460b46f3ff4a5cdf4617d1c721c6e3426e226ed41df799968ec091b6b7915

SHA512
aa3ba8f9076b6186637a6f036ee1ce46be8a934d151d8a2c30b2febfa3a9d5c247dee6eae826bb1ce967a3af9c09755ff8cc040937b3a460ace5fba9aa285243

Download Submit
C:\Windows\System\dfczktv.exe

Filesize
2.0MB

MD5
dbaaf77f75f9caa01b984c3428f55cad

SHA1
91edde9a0cd213fdf9a4194477ae569cfe2bde67

SHA256
723c9f4e00a7b6c636818cc264743a804c0e025672b35f0c120b3a4325e2dca8

SHA512
605de00a85b333dc6db7a2886e0dafa7b81d42a9d7d9b9a3e6c30d1bbc45846fb0aa644edd2ddfe8c7009971d2d631bf4895e0869b47c9315a47774bf17bc4a6

Download Submit
C:\Windows\System\flZKdbb.exe

Filesize
2.0MB

MD5
d2fcf6cc9cb3beb1fca9a9081fda4674

SHA1
f196c8443674131ff890dd4da11fe58d4467fe30

SHA256
e6ed650db4815c68f78a3989646333268cbcf04bb1f605b0caa85faf19a8ec5d

SHA512
22954caea9c34f6ae1124f469ce1809fa6084836b347e3c4ff99fe361391a8023526c966d0b858db72e33d12f1988ca4de9727ed7ad669bbda270c09a588a28c

Download Submit
C:\Windows\System\fsJxZoR.exe

Filesize
2.0MB

MD5
ff892429f5da915d0cd01e98068a16d6

SHA1
a3f93e3564e4813d0ecb3d9cd00773b46421d30b

SHA256
6927dfd8b48b4b5595674752b28683101408273745e52fb48ed6b3b2e7535333

SHA512
d94da95f12669e4659fcf98a93cd0a562bf5e9d671e38e18d02fad57380cfbf3b36e549cb6dae0ab8dacf1b9780bf8e55f285807478f7cef2e8d548e35a2da91

Download Submit
C:\Windows\System\gZPQCVD.exe

Filesize
2.0MB

MD5
5a93b84f8e98256951f4e766c2bff4aa

SHA1
d95cc73460b4b0e17718f3594717058dd1c77dea

SHA256
37f8a9d357d462f8f2b221b8d58363478192b87012e12483b37667f6f04daea6

SHA512
cdc6275c0c62610158ca195225ec5501631ec5a4cf96d5df9b463b0fdcd1442763e3a81c02879cd826e0bbf23cc01e8e2d2b151b5f9321b8c6e2413899ce09f2

Download Submit
C:\Windows\System\hjaGzlZ.exe

Filesize
2.0MB

MD5
90bfaaf49203c6cdbc2cc189162fa0fa

SHA1
198baacb08482f5fe63db4c4188efdce13da5370

SHA256
f0b503ab42f6ba497621d3bc7af1d7b4e128d89e95fda4e2e54e13f6c1418eee

SHA512
6b22851d3d0b0d098ba501d72541cc699c9baf5e946c40b406d3252c55fee267e20845a487011df343e0fb6e832365da19ee797cfe7fc675dfea2abafb7671a6

Download Submit
C:\Windows\System\iFwqAid.exe

Filesize
2.0MB

MD5
f7c374db3630029e69a42461fc1b056c

SHA1
e6c6be77accf978fd5df00906f8abeace175cffd

SHA256
afb086a8e8a6c5309c9975afeaa3f468096b48d15edf9d1e89814cd30ec7e1ee

SHA512
f7de6a3e783db15ee8b0f1ddd0b6ed26155538fad7ef361e0a52c31a711bd7146a44f8cabef633b774f533c7bb1536cf7e4c955e093b11a3ad090f2db6cb4f1f

Download Submit
C:\Windows\System\inwkgla.exe

Filesize
2.0MB

MD5
d5449a888f1216108ba8b26ec14c8243

SHA1
b5ac071fa80ebb7a6ed3b2c49cfdf09e8cc69641

SHA256
2aa3e0897745af4e18b82214f3e525f86a3848dc28ab3cffe500813c11216aa3

SHA512
7fb139c034932c2d81550760c1cd498cbda6ae55098a2f3e97f596eba059002bc0543c5f5de7ea0fd2753bb849410276a74aee0e84ed36b269e8db062b56daf2

Download Submit
C:\Windows\System\jnWdKRv.exe

Filesize
2.0MB

MD5
5478ea8888ee648f88e345e2005656b1

SHA1
78b9dac433dec7908466dc55dfa1bfc76ab471aa

SHA256
ac55800b7d1616e2bed11818dfd6a273993bea15dc280e5add122abb5ab3fb8f

SHA512
d04139eb809181d096cb9e07ce8934685d70ac3b26cb22508a04953b0d2f0ddca8dd898f7ff57ec5ab18e9f9ad92ab39312cba78a32bc3c5559a240321d4f4fa

Download Submit
C:\Windows\System\kkuwoOK.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\nxuXkgh.exe

Filesize
2.0MB

MD5
081107843a9d2cedf55207366a67e224

SHA1
4c74cb450440a97b0e049b2ae7d302f7654ef316

SHA256
8621d218f060db189b02ecce21143e63ee9eee7fba6c2de07a2c3b6fe7915370

SHA512
a066ab54fe113d03641025e96c7dab01885f1e299f3bff60e274be3ae10f52edea0361357e29c3584a18c540923322612dbe00f875a6e47559ee58e9b96b3fd8

Download Submit
C:\Windows\System\pYBazbC.exe

Filesize
2.0MB

MD5
b54ff236f9b1251ed27e02153ac3eadd

SHA1
02a2a92aeb571368300a74b7cee988d556ec81d9

SHA256
82cec6222ce3778780dc7430a94f490e09345868464f285136185dda75567535

SHA512
b20deccbb84a491db6795ab613b47272912fec9e38102bd657165034eef28ecba48e975ddbb5275dc4948b61413a8a8960b7d764ada57e1573890a9677f57141

Download Submit
C:\Windows\System\qHuCfsQ.exe

Filesize
2.0MB

MD5
2d679e733415b6983174362ca5e07af6

SHA1
a0b0cb1e400686241fd6491e13fec401b25b8909

SHA256
b3504e949962cf67ec34414d28a7c94802524f4ebab1f711fc13938dfe075d37

SHA512
cba05060c8fb3c38ffbab2a9ec34d75180578baf223756462a36586dcaeb1088a9ef550fce882ae1f411421286b7d6568ab38b764c131bb1449b3d974ba21926

Download Submit
C:\Windows\System\sgsOrCN.exe

Filesize
2.0MB

MD5
3388ef25679bd9d4ccc6ca04831a9fa2

SHA1
b4a283e58911f377388c875b0b203e22eebe26e3

SHA256
6367bf1893cb99728f7668589e1fa94eccf706c11e489b23094f5ac80e724e2e

SHA512
6d57a48c5266c1861a4efc7c2d08a5d17fad083de560e87eb507599de53e38a186c31b1a29db07f60bdf61974a5013408ee652114afeac1a4de863466ec3d169

Download Submit
C:\Windows\System\tgDEsnn.exe

Filesize
2.0MB

MD5
0505d8be1942415029d4f6ea76e28b26

SHA1
05c6a5016bed5232a1bcfe1b55235548839e61ed

SHA256
df6518efd8da504bff2b948d9a06131f1340dd5a9dd4dd2f0029976afbe494a6

SHA512
29bcf7d5778396b6bcf66d1d43c51069ab4bca238d36684ebadcaa2c2060518fa3271f2c88926c3760deba3e4a954fa6fe9336e50f947a5040c5928d71c04658

Download Submit
C:\Windows\System\uSxNxZS.exe

Filesize
2.0MB

MD5
abee79c1604c23216cc729fdf92a0bb5

SHA1
b267303031db4460a5589898648f091e76981c6f

SHA256
fed0eb207cd74f79685e9b5db15692fa7f541e96595820304c23cc738044a5eb

SHA512
ffc40562461d805d22f8e204db361526dd8459f69ffd0303317f7407c2a5fae5d6eca43408be094cb63ac941cb1e7be67232ef5860e3df4c5f7d9b180b09cf8f

Download Submit
C:\Windows\System\vfINxPb.exe

Filesize
2.0MB

MD5
789a0274466712c4141d4d58e188e10c

SHA1
745437b57facbe059a2bd75c9d1cfe6bc6dbd300

SHA256
8d19b79c3a9c00716c7ed848729faa69e288209152b467a82ee45a08693463c1

SHA512
4ad71d750861bd2495ec171abe1b9d50e49cf84d1612349d8827390e4e6819f725b947eb3a1c9c0621fbc296a5be2122bceaa69355a1aacbb6bfbf66f47908d5

Download Submit
C:\Windows\System\vwzinUR.exe

Filesize
2.0MB

MD5
81b59f6ad947e5d14ed89f37ebc59708

SHA1
90d0702e10661cdf0bc633b26e39dc6bb71f88b2

SHA256
7517f01ef1c34ea6f89a270f67acd8fc69b54f1eb5ae8676462f2d6ae5ffec03

SHA512
9b677b9b31785c7964c3c685e25b9f66c345cbf3f0b62fcca6186921efdb030d30eae7ec33b225cb2dac958a27212bb05500775de7d7eb84eb4c009055b93b67

Download Submit
C:\Windows\System\wqbTTyo.exe

Filesize
2.0MB

MD5
ab80cfd25d2187a93b7bbf4cb35776e4

SHA1
10972faf2997400ba9aa533aa90402b02149eb4e

SHA256
d3dd711de67b48bdc20765bd57f53b3f6e23d44442157fbaf9e36a8fba9dbfc7

SHA512
0c88b1e395c488ab1f8e2516544a7a76f0bb1c3cbb4d1f681e6e90b317f48e703ba47303b6f53a6c5bef008ef1eb4cd8ef75ad1ad5f9c64bf1811adef7e6b31e

Download Submit
C:\Windows\System\xEPlOUQ.exe

Filesize
2.0MB

MD5
7ab7ef133219563dbe3e614cc4c899d8

SHA1
7eeaf44c48bdd8eca5eadd85c5b54ab328344d26

SHA256
c5e0fbf8188d4fe9ff1526229831783d3b315efb08f20024c4bfb09e46f6fa98

SHA512
ec2525e9a6b96f32b0d48ac5a77d066c7f98346d9c6bc42ce214f7cfa9230364d2fa50e6a55c505002bcf978dab3fde63838ec08f22e1163f8022108fc9d1ab4

Download Submit
C:\Windows\System\xxcnSCD.exe

Filesize
2.0MB

MD5
1f177d64752baab8007fd56023aa64d2

SHA1
0dc9a0931f91896c49bf70da67eec5abb57f525c

SHA256
a340e15dcf619738647f2469d5f430e5c13f404510c1f484af800b2cb4e8bf77

SHA512
f869ed3f6fb5e0eae255df446c60f490bbde96ee7e0c6385d62eacd07cac175a42ac60b5b4b412dd2e17cd5d985f10be65f97736e5c937940973d6c8fd67d084

Download Submit
C:\Windows\System\zJasKTw.exe

Filesize
2.0MB

MD5
38406ec29bcdee8e0a3be9669d33dbcd

SHA1
ef049929ff5cf0f801ee83626ff5939a29601a82

SHA256
7ced20c44ac1e4204a0f2661232e98e7f92f055b1e72ae868f23313ce3dd6a8e

SHA512
58a4b50a9ff01a0f94238266cf1996fdf19a58f867e942d0c81e6a19af98188d471b4d2818a756508e9a143b655ba5ccb350b60e36c7d17abec0f515c7ac0a37

Download Submit
C:\Windows\System\zgauoiM.exe

Filesize
2.0MB

MD5
a38b25342c403a9e69a2d4b2863ee4c9

SHA1
5e43d97d8f63cf0876d42df70addb4d4b4092f03

SHA256
af42776114f452b865747a4bde86a2cd322cead11703fdbb17c931ffa8e6467f

SHA512
c0ab1516d805ac44694fed0b07dc9c4d88dea95f4363985898722cdfcde0d516fdf653b225b017fb88e35d76096887243c68998add92b06d9fcc85fbf1cecc7a

Download Submit
memory/320-492-0x00007FF69A600000-0x00007FF69A9F2000-memory.dmp

Filesize
3.9MB

Download
memory/320-4834-0x00007FF69A600000-0x00007FF69A9F2000-memory.dmp

Filesize
3.9MB

Download
memory/848-4744-0x00007FF70ED50000-0x00007FF70F142000-memory.dmp

Filesize
3.9MB

Download
memory/848-318-0x00007FF70ED50000-0x00007FF70F142000-memory.dmp

Filesize
3.9MB

Download
memory/1112-4819-0x00007FF7BE840000-0x00007FF7BEC32000-memory.dmp

Filesize
3.9MB

Download
memory/1112-496-0x00007FF7BE840000-0x00007FF7BEC32000-memory.dmp

Filesize
3.9MB

Download
memory/1188-4770-0x00007FF7434C0000-0x00007FF7438B2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-379-0x00007FF7434C0000-0x00007FF7438B2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-217-0x00007FF7AD8F0000-0x00007FF7ADCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-4808-0x00007FF6A9D10000-0x00007FF6AA102000-memory.dmp

Filesize
3.9MB

Download
memory/1420-490-0x00007FF6A9D10000-0x00007FF6AA102000-memory.dmp

Filesize
3.9MB

Download
memory/1488-4823-0x00007FF6CC1D0000-0x00007FF6CC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-511-0x00007FF6CC1D0000-0x00007FF6CC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-512-0x00007FF67FA30000-0x00007FF67FE22000-memory.dmp

Filesize
3.9MB

Download
memory/1736-288-0x00007FF72A850000-0x00007FF72AC42000-memory.dmp

Filesize
3.9MB

Download
memory/1736-4747-0x00007FF72A850000-0x00007FF72AC42000-memory.dmp

Filesize
3.9MB

Download
memory/1908-404-0x00007FF67E180000-0x00007FF67E572000-memory.dmp

Filesize
3.9MB

Download
memory/1908-4778-0x00007FF67E180000-0x00007FF67E572000-memory.dmp

Filesize
3.9MB

Download
memory/2240-4815-0x00007FF79DF60000-0x00007FF79E352000-memory.dmp

Filesize
3.9MB

Download
memory/2240-355-0x00007FF79DF60000-0x00007FF79E352000-memory.dmp

Filesize
3.9MB

Download
memory/2684-513-0x00007FF694140000-0x00007FF694532000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4765-0x00007FF694140000-0x00007FF694532000-memory.dmp

Filesize
3.9MB

Download
memory/2980-4805-0x00007FF756380000-0x00007FF756772000-memory.dmp

Filesize
3.9MB

Download
memory/2980-431-0x00007FF756380000-0x00007FF756772000-memory.dmp

Filesize
3.9MB

Download
memory/3160-4782-0x00007FF7CF7D0000-0x00007FF7CFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-446-0x00007FF7CF7D0000-0x00007FF7CFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-514-0x00007FF704A10000-0x00007FF704E02000-memory.dmp

Filesize
3.9MB

Download
memory/3232-4798-0x00007FF704A10000-0x00007FF704E02000-memory.dmp

Filesize
3.9MB

Download
memory/3416-462-0x00007FF6ACF60000-0x00007FF6AD352000-memory.dmp

Filesize
3.9MB

Download
memory/3416-4788-0x00007FF6ACF60000-0x00007FF6AD352000-memory.dmp

Filesize
3.9MB

Download
memory/3492-76-0x00007FF789800000-0x00007FF789BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-4742-0x00007FF789800000-0x00007FF789BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-455-0x00007FF7B9B90000-0x00007FF7B9F82000-memory.dmp

Filesize
3.9MB

Download
memory/3580-4794-0x00007FF7B9B90000-0x00007FF7B9F82000-memory.dmp

Filesize
3.9MB

Download
memory/3664-145-0x00007FF8241D0000-0x00007FF824C91000-memory.dmp

Filesize
10.8MB

Download
memory/3664-204-0x000001AA87750000-0x000001AA87772000-memory.dmp

Filesize
136KB

Download
memory/3664-10-0x00007FF8241D3000-0x00007FF8241D5000-memory.dmp

Filesize
8KB

Download
memory/3664-58-0x00007FF8241D0000-0x00007FF824C91000-memory.dmp

Filesize
10.8MB

Download
memory/3664-527-0x000001AAA2640000-0x000001AAA2DE6000-memory.dmp

Filesize
7.6MB

Download
memory/3912-491-0x00007FF6E4B20000-0x00007FF6E4F12000-memory.dmp

Filesize
3.9MB

Download
memory/3912-4811-0x00007FF6E4B20000-0x00007FF6E4F12000-memory.dmp

Filesize
3.9MB

Download
memory/4116-249-0x00007FF692040000-0x00007FF692432000-memory.dmp

Filesize
3.9MB

Download
memory/4740-4764-0x00007FF72CA80000-0x00007FF72CE72000-memory.dmp

Filesize
3.9MB

Download
memory/4740-356-0x00007FF72CA80000-0x00007FF72CE72000-memory.dmp

Filesize
3.9MB

Download
memory/4816-4759-0x00007FF7E2730000-0x00007FF7E2B22000-memory.dmp

Filesize
3.9MB

Download
memory/4816-257-0x00007FF7E2730000-0x00007FF7E2B22000-memory.dmp

Filesize
3.9MB

Download
memory/4940-1-0x0000013528450000-0x0000013528460000-memory.dmp

Filesize
64KB

Download
memory/4940-4993-0x00007FF7DC730000-0x00007FF7DCB22000-memory.dmp

Filesize
3.9MB

Download
memory/4940-0-0x00007FF7DC730000-0x00007FF7DCB22000-memory.dmp

Filesize
3.9MB

Download
memory/4960-475-0x00007FF687AB0000-0x00007FF687EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-4774-0x00007FF687AB0000-0x00007FF687EA2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-4800-0x00007FF6AD9A0000-0x00007FF6ADD92000-memory.dmp

Filesize
3.9MB

Download
memory/5084-456-0x00007FF6AD9A0000-0x00007FF6ADD92000-memory.dmp

Filesize
3.9MB

Download