xmrig | 6b41553166b9bdc53176a4a2f7c4dfa92cdd0290674825fa9d6d73cb1205a8f3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
Size

1.8MB
MD5

d4e79ca3302990680ffa54b74ee68fe7
SHA1

10b451d72dc2c0bed365d5fb234e8178e62f0348
SHA256

6b41553166b9bdc53176a4a2f7c4dfa92cdd0290674825fa9d6d73cb1205a8f3
SHA512

18b1f71676e7e6479bac39fb355bc92de8bb9a041bfde9bb0e7871d09ccdf677f6a47adb0e3998ba554351b53946caebf7ca8207ae18faccf9df2c9dff933b1c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz66JBjM:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral2/memory/3832-275-0x00007FF758EA0000-0x00007FF759292000-memory.dmp	xmrig
behavioral2/memory/4396-339-0x00007FF626F20000-0x00007FF627312000-memory.dmp	xmrig
behavioral2/memory/1592-86-0x00007FF736C50000-0x00007FF737042000-memory.dmp	xmrig
behavioral2/memory/3044-417-0x00007FF760E80000-0x00007FF761272000-memory.dmp	xmrig
behavioral2/memory/3052-523-0x00007FF7B37A0000-0x00007FF7B3B92000-memory.dmp	xmrig
behavioral2/memory/876-555-0x00007FF69A9E0000-0x00007FF69ADD2000-memory.dmp	xmrig
behavioral2/memory/3504-1137-0x00007FF78F3C0000-0x00007FF78F7B2000-memory.dmp	xmrig
behavioral2/memory/4240-1183-0x00007FF6DE2F0000-0x00007FF6DE6E2000-memory.dmp	xmrig
behavioral2/memory/1028-1616-0x00007FF71CD10000-0x00007FF71D102000-memory.dmp	xmrig
behavioral2/memory/2276-1615-0x00007FF7DA770000-0x00007FF7DAB62000-memory.dmp	xmrig
behavioral2/memory/2936-1563-0x00007FF69FC30000-0x00007FF6A0022000-memory.dmp	xmrig
behavioral2/memory/3976-1560-0x00007FF7F49A0000-0x00007FF7F4D92000-memory.dmp	xmrig
behavioral2/memory/2232-1556-0x00007FF740600000-0x00007FF7409F2000-memory.dmp	xmrig
behavioral2/memory/1076-1502-0x00007FF72C680000-0x00007FF72CA72000-memory.dmp	xmrig
behavioral2/memory/2460-1497-0x00007FF721F40000-0x00007FF722332000-memory.dmp	xmrig
behavioral2/memory/3668-1496-0x00007FF6100E0000-0x00007FF6104D2000-memory.dmp	xmrig
behavioral2/memory/2116-1430-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp	xmrig
behavioral2/memory/708-1130-0x00007FF7D76E0000-0x00007FF7D7AD2000-memory.dmp	xmrig
behavioral2/memory/4992-966-0x00007FF783E50000-0x00007FF784242000-memory.dmp	xmrig
behavioral2/memory/2564-962-0x00007FF6F3CC0000-0x00007FF6F40B2000-memory.dmp	xmrig
behavioral2/memory/3380-829-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp	xmrig
behavioral2/memory/1360-820-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp	xmrig
behavioral2/memory/952-640-0x00007FF673090000-0x00007FF673482000-memory.dmp	xmrig
behavioral2/memory/5088-563-0x00007FF7DFF40000-0x00007FF7E0332000-memory.dmp	xmrig
behavioral2/memory/3052-4564-0x00007FF7B37A0000-0x00007FF7B3B92000-memory.dmp	xmrig
behavioral2/memory/4992-4808-0x00007FF783E50000-0x00007FF784242000-memory.dmp	xmrig
behavioral2/memory/3504-4828-0x00007FF78F3C0000-0x00007FF78F7B2000-memory.dmp	xmrig
behavioral2/memory/2232-4864-0x00007FF740600000-0x00007FF7409F2000-memory.dmp	xmrig
behavioral2/memory/4240-4872-0x00007FF6DE2F0000-0x00007FF6DE6E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1592	FvnkCoh.exe
3976	vwsEcEP.exe
2936	hdphAQi.exe
3832	AjgLhWZ.exe
4396	zGNoeLM.exe
3044	HAHNMBg.exe
3052	zOZvaUS.exe
876	vvTmNTa.exe
5088	REAFnzn.exe
952	BMZylzz.exe
1360	WdrzVkE.exe
2276	YXEsOgO.exe
3380	AVbbkMH.exe
2564	IsZNXjQ.exe
1028	zPpIyby.exe
4992	GKhLabJ.exe
708	RIpiPtH.exe
3504	tDnCLgs.exe
4240	bPtsTNO.exe
2116	DneKAWm.exe
3668	ypOoiSl.exe
2460	nZgBlrj.exe
1076	likFyok.exe
2232	RirmQCE.exe
4464	IOIJfxF.exe
3564	HOIMuNa.exe
1224	wWKSVSa.exe
4776	tSHYWje.exe
1512	lXKpmdc.exe
3880	cytpSsM.exe
368	lFPMuUL.exe
3808	hYcUFwj.exe
1952	XVDkJqS.exe
3352	atiGQIG.exe
4260	UdaXkKY.exe
3112	ervTHBI.exe
2320	YImnFTH.exe
4392	SWTQbcy.exe
1992	SBsKLeS.exe
2592	wuTLxxI.exe
3652	NYmvBHL.exe
3972	vSvmYfm.exe
1628	OPMWsrM.exe
540	MRiWsSe.exe
4264	ONARLHn.exe
3476	IYZRVmu.exe
3120	eLobXLx.exe
404	ZCDboTT.exe
1700	puYMMta.exe
3292	cICOLaX.exe
2528	bjWNSgo.exe
3484	nQGxhdT.exe
2656	KtVpfJx.exe
680	IOfygTH.exe
3620	SeULIJn.exe
4596	mSQyqnI.exe
4400	aNcjShH.exe
1112	vQumOVB.exe
4480	eqirjPc.exe
5104	doMefGb.exe
4384	SEPqYWa.exe
4336	BdpnDqa.exe
764	wWLgQFR.exe
5080	wMvCtoM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1208-0-0x00007FF610280000-0x00007FF610672000-memory.dmp	upx
behavioral2/files/0x0007000000023429-12.dat	upx
behavioral2/files/0x0008000000023424-7.dat	upx
behavioral2/files/0x0007000000023428-10.dat	upx
behavioral2/files/0x000700000002342a-28.dat	upx
behavioral2/files/0x000700000002342f-39.dat	upx
behavioral2/files/0x000700000002343e-111.dat	upx
behavioral2/files/0x000700000002343f-112.dat	upx
behavioral2/files/0x0007000000023451-208.dat	upx
behavioral2/files/0x0007000000023450-203.dat	upx
behavioral2/memory/3832-275-0x00007FF758EA0000-0x00007FF759292000-memory.dmp	upx
behavioral2/files/0x000700000002344f-201.dat	upx
behavioral2/files/0x000700000002344e-196.dat	upx
behavioral2/files/0x0007000000023438-193.dat	upx
behavioral2/files/0x0007000000023439-191.dat	upx
behavioral2/files/0x000700000002344c-189.dat	upx
behavioral2/files/0x000700000002344b-187.dat	upx
behavioral2/files/0x0007000000023442-184.dat	upx
behavioral2/files/0x0007000000023437-178.dat	upx
behavioral2/files/0x0007000000023436-175.dat	upx
behavioral2/files/0x000700000002344a-174.dat	upx
behavioral2/files/0x0007000000023449-165.dat	upx
behavioral2/files/0x0007000000023448-162.dat	upx
behavioral2/files/0x0007000000023440-160.dat	upx
behavioral2/files/0x0007000000023447-152.dat	upx
behavioral2/files/0x0007000000023433-150.dat	upx
behavioral2/files/0x0007000000023445-139.dat	upx
behavioral2/files/0x000700000002343a-202.dat	upx
behavioral2/files/0x0007000000023444-200.dat	upx
behavioral2/files/0x0007000000023443-132.dat	upx
behavioral2/files/0x0007000000023441-126.dat	upx
behavioral2/files/0x0007000000023435-121.dat	upx
behavioral2/files/0x0007000000023434-118.dat	upx
behavioral2/files/0x000700000002343b-115.dat	upx
behavioral2/files/0x0007000000023446-145.dat	upx
behavioral2/files/0x0007000000023432-138.dat	upx
behavioral2/memory/4396-339-0x00007FF626F20000-0x00007FF627312000-memory.dmp	upx
behavioral2/memory/1592-86-0x00007FF736C50000-0x00007FF737042000-memory.dmp	upx
behavioral2/files/0x000700000002342d-64.dat	upx
behavioral2/files/0x0007000000023430-53.dat	upx
behavioral2/files/0x000700000002342e-72.dat	upx
behavioral2/files/0x0007000000023431-49.dat	upx
behavioral2/files/0x000700000002342c-62.dat	upx
behavioral2/files/0x000700000002342b-56.dat	upx
behavioral2/memory/3044-417-0x00007FF760E80000-0x00007FF761272000-memory.dmp	upx
behavioral2/memory/3052-523-0x00007FF7B37A0000-0x00007FF7B3B92000-memory.dmp	upx
behavioral2/memory/876-555-0x00007FF69A9E0000-0x00007FF69ADD2000-memory.dmp	upx
behavioral2/memory/3504-1137-0x00007FF78F3C0000-0x00007FF78F7B2000-memory.dmp	upx
behavioral2/memory/4240-1183-0x00007FF6DE2F0000-0x00007FF6DE6E2000-memory.dmp	upx
behavioral2/memory/1028-1616-0x00007FF71CD10000-0x00007FF71D102000-memory.dmp	upx
behavioral2/memory/2276-1615-0x00007FF7DA770000-0x00007FF7DAB62000-memory.dmp	upx
behavioral2/memory/2936-1563-0x00007FF69FC30000-0x00007FF6A0022000-memory.dmp	upx
behavioral2/memory/3976-1560-0x00007FF7F49A0000-0x00007FF7F4D92000-memory.dmp	upx
behavioral2/memory/2232-1556-0x00007FF740600000-0x00007FF7409F2000-memory.dmp	upx
behavioral2/memory/1076-1502-0x00007FF72C680000-0x00007FF72CA72000-memory.dmp	upx
behavioral2/memory/2460-1497-0x00007FF721F40000-0x00007FF722332000-memory.dmp	upx
behavioral2/memory/3668-1496-0x00007FF6100E0000-0x00007FF6104D2000-memory.dmp	upx
behavioral2/memory/2116-1430-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp	upx
behavioral2/memory/708-1130-0x00007FF7D76E0000-0x00007FF7D7AD2000-memory.dmp	upx
behavioral2/memory/4992-966-0x00007FF783E50000-0x00007FF784242000-memory.dmp	upx
behavioral2/memory/2564-962-0x00007FF6F3CC0000-0x00007FF6F40B2000-memory.dmp	upx
behavioral2/memory/3380-829-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp	upx
behavioral2/memory/1360-820-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp	upx
behavioral2/memory/952-640-0x00007FF673090000-0x00007FF673482000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tlsmYlg.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\zzzIydD.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ExOAomp.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\OXXZfnV.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\lHZacDP.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\beVeRNW.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\oaJtLTe.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\LaQYRkb.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\BHgLfJK.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\UQkAnhB.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\OclTTnV.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\KYPiNCH.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\KtiVsiY.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\SwtbabM.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\hsyPihy.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\AOfPEpH.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\zpnYnvq.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\pAOdnMM.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\LsUngRx.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\VmuRnFC.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\eHkDSAv.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ikADSrT.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\pIksiKT.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\PYWlSxW.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\wgghkae.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ytXKCex.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\GbhCWCD.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\lYKlRUd.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\RvBEcFx.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\mNCFjHm.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\vrEgQyR.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\XSnZdBc.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\cqNRntZ.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ngFKIKn.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\SDdeySA.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\KGwMmVr.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\mDkvXTg.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\IIRKPBB.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\uivPaVZ.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\gCLhsDM.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\TlncOkV.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\NbShyxv.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\whRxSHH.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\aySwdGV.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\TYWdXmy.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\YLFaRKc.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\kGCRNxI.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\knjBhaR.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\DkDBdTE.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\SiloJHr.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\GQcvxMF.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\nvOdyGc.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\tDCVIIz.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\zCHrRZa.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\yUdFGqy.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\zGTGIIi.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\cjTkPCx.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ZFeXLwX.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\PLgfGov.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\GYTGWkK.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\ewTevSn.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\XVfuoZA.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\GLcspqX.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
File created	C:\Windows\System\hViSjuO.exe	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeLockMemoryPrivilege	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	12732	dwm.exe
Token: SeChangeNotifyPrivilege	12732	dwm.exe
Token: 33	12732	dwm.exe
Token: SeIncBasePriorityPrivilege	12732	dwm.exe
Token: SeCreateGlobalPrivilege	13528	dwm.exe
Token: SeChangeNotifyPrivilege	13528	dwm.exe
Token: 33	13528	dwm.exe
Token: SeIncBasePriorityPrivilege	13528	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3460	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	84
PID 1208 wrote to memory of 3460	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	84
PID 1208 wrote to memory of 1592	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	85
PID 1208 wrote to memory of 1592	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	85
PID 1208 wrote to memory of 3976	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	86
PID 1208 wrote to memory of 3976	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	86
PID 1208 wrote to memory of 2936	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	87
PID 1208 wrote to memory of 2936	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	87
PID 1208 wrote to memory of 3832	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	88
PID 1208 wrote to memory of 3832	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	88
PID 1208 wrote to memory of 4396	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	89
PID 1208 wrote to memory of 4396	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	89
PID 1208 wrote to memory of 3044	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	90
PID 1208 wrote to memory of 3044	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	90
PID 1208 wrote to memory of 3052	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	91
PID 1208 wrote to memory of 3052	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	91
PID 1208 wrote to memory of 876	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	92
PID 1208 wrote to memory of 876	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	92
PID 1208 wrote to memory of 5088	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	93
PID 1208 wrote to memory of 5088	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	93
PID 1208 wrote to memory of 952	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	94
PID 1208 wrote to memory of 952	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	94
PID 1208 wrote to memory of 1360	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	95
PID 1208 wrote to memory of 1360	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	95
PID 1208 wrote to memory of 2276	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	96
PID 1208 wrote to memory of 2276	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	96
PID 1208 wrote to memory of 3380	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	97
PID 1208 wrote to memory of 3380	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	97
PID 1208 wrote to memory of 2564	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	98
PID 1208 wrote to memory of 2564	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	98
PID 1208 wrote to memory of 1028	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	99
PID 1208 wrote to memory of 1028	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	99
PID 1208 wrote to memory of 4992	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	100
PID 1208 wrote to memory of 4992	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	100
PID 1208 wrote to memory of 708	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	101
PID 1208 wrote to memory of 708	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	101
PID 1208 wrote to memory of 3504	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	102
PID 1208 wrote to memory of 3504	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	102
PID 1208 wrote to memory of 4240	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	103
PID 1208 wrote to memory of 4240	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	103
PID 1208 wrote to memory of 2116	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	104
PID 1208 wrote to memory of 2116	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	104
PID 1208 wrote to memory of 3668	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	105
PID 1208 wrote to memory of 3668	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	105
PID 1208 wrote to memory of 2460	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	106
PID 1208 wrote to memory of 2460	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	106
PID 1208 wrote to memory of 1076	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	107
PID 1208 wrote to memory of 1076	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	107
PID 1208 wrote to memory of 1512	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	108
PID 1208 wrote to memory of 1512	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	108
PID 1208 wrote to memory of 2232	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	109
PID 1208 wrote to memory of 2232	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	109
PID 1208 wrote to memory of 1952	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	110
PID 1208 wrote to memory of 1952	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	110
PID 1208 wrote to memory of 4464	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	111
PID 1208 wrote to memory of 4464	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	111
PID 1208 wrote to memory of 2320	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	112
PID 1208 wrote to memory of 2320	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	112
PID 1208 wrote to memory of 3564	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	113
PID 1208 wrote to memory of 3564	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	113
PID 1208 wrote to memory of 1224	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	114
PID 1208 wrote to memory of 1224	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	114
PID 1208 wrote to memory of 4776	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	115
PID 1208 wrote to memory of 4776	1208	d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4e79ca3302990680ffa54b74ee68fe7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System\FvnkCoh.exe
  C:\Windows\System\FvnkCoh.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\vwsEcEP.exe
  C:\Windows\System\vwsEcEP.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\hdphAQi.exe
  C:\Windows\System\hdphAQi.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\AjgLhWZ.exe
  C:\Windows\System\AjgLhWZ.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\zGNoeLM.exe
  C:\Windows\System\zGNoeLM.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\HAHNMBg.exe
  C:\Windows\System\HAHNMBg.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\zOZvaUS.exe
  C:\Windows\System\zOZvaUS.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\vvTmNTa.exe
  C:\Windows\System\vvTmNTa.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\REAFnzn.exe
  C:\Windows\System\REAFnzn.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\BMZylzz.exe
  C:\Windows\System\BMZylzz.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\WdrzVkE.exe
  C:\Windows\System\WdrzVkE.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\YXEsOgO.exe
  C:\Windows\System\YXEsOgO.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\AVbbkMH.exe
  C:\Windows\System\AVbbkMH.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\IsZNXjQ.exe
  C:\Windows\System\IsZNXjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zPpIyby.exe
  C:\Windows\System\zPpIyby.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\GKhLabJ.exe
  C:\Windows\System\GKhLabJ.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\RIpiPtH.exe
  C:\Windows\System\RIpiPtH.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\tDnCLgs.exe
  C:\Windows\System\tDnCLgs.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\bPtsTNO.exe
  C:\Windows\System\bPtsTNO.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\DneKAWm.exe
  C:\Windows\System\DneKAWm.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ypOoiSl.exe
  C:\Windows\System\ypOoiSl.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\nZgBlrj.exe
  C:\Windows\System\nZgBlrj.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\likFyok.exe
  C:\Windows\System\likFyok.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\lXKpmdc.exe
  C:\Windows\System\lXKpmdc.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\RirmQCE.exe
  C:\Windows\System\RirmQCE.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\XVDkJqS.exe
  C:\Windows\System\XVDkJqS.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\IOIJfxF.exe
  C:\Windows\System\IOIJfxF.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\YImnFTH.exe
  C:\Windows\System\YImnFTH.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\HOIMuNa.exe
  C:\Windows\System\HOIMuNa.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\wWKSVSa.exe
  C:\Windows\System\wWKSVSa.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\tSHYWje.exe
  C:\Windows\System\tSHYWje.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\cytpSsM.exe
  C:\Windows\System\cytpSsM.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\lFPMuUL.exe
  C:\Windows\System\lFPMuUL.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\hYcUFwj.exe
  C:\Windows\System\hYcUFwj.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\atiGQIG.exe
  C:\Windows\System\atiGQIG.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\UdaXkKY.exe
  C:\Windows\System\UdaXkKY.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\cICOLaX.exe
  C:\Windows\System\cICOLaX.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\ervTHBI.exe
  C:\Windows\System\ervTHBI.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\SWTQbcy.exe
  C:\Windows\System\SWTQbcy.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\SBsKLeS.exe
  C:\Windows\System\SBsKLeS.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\wuTLxxI.exe
  C:\Windows\System\wuTLxxI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\mSQyqnI.exe
  C:\Windows\System\mSQyqnI.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\NYmvBHL.exe
  C:\Windows\System\NYmvBHL.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\vSvmYfm.exe
  C:\Windows\System\vSvmYfm.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\OPMWsrM.exe
  C:\Windows\System\OPMWsrM.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\MRiWsSe.exe
  C:\Windows\System\MRiWsSe.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ONARLHn.exe
  C:\Windows\System\ONARLHn.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\IYZRVmu.exe
  C:\Windows\System\IYZRVmu.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\eLobXLx.exe
  C:\Windows\System\eLobXLx.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\wWLgQFR.exe
  C:\Windows\System\wWLgQFR.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\ZCDboTT.exe
  C:\Windows\System\ZCDboTT.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\puYMMta.exe
  C:\Windows\System\puYMMta.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\bjWNSgo.exe
  C:\Windows\System\bjWNSgo.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\nQGxhdT.exe
  C:\Windows\System\nQGxhdT.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\KtVpfJx.exe
  C:\Windows\System\KtVpfJx.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\YXaXYhR.exe
  C:\Windows\System\YXaXYhR.exe
  2⤵
  PID:4548
- C:\Windows\System\IOfygTH.exe
  C:\Windows\System\IOfygTH.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\SeULIJn.exe
  C:\Windows\System\SeULIJn.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\aNcjShH.exe
  C:\Windows\System\aNcjShH.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\vQumOVB.exe
  C:\Windows\System\vQumOVB.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\qTVkWxg.exe
  C:\Windows\System\qTVkWxg.exe
  2⤵
  PID:1336
- C:\Windows\System\eqirjPc.exe
  C:\Windows\System\eqirjPc.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\doMefGb.exe
  C:\Windows\System\doMefGb.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\SEPqYWa.exe
  C:\Windows\System\SEPqYWa.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\BdpnDqa.exe
  C:\Windows\System\BdpnDqa.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\trccWjK.exe
  C:\Windows\System\trccWjK.exe
  2⤵
  PID:4424
- C:\Windows\System\wMvCtoM.exe
  C:\Windows\System\wMvCtoM.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\DkqiJIn.exe
  C:\Windows\System\DkqiJIn.exe
  2⤵
  PID:4404
- C:\Windows\System\FTaoggn.exe
  C:\Windows\System\FTaoggn.exe
  2⤵
  PID:4360
- C:\Windows\System\AgwFJkc.exe
  C:\Windows\System\AgwFJkc.exe
  2⤵
  PID:4544
- C:\Windows\System\AuunAlu.exe
  C:\Windows\System\AuunAlu.exe
  2⤵
  PID:2212
- C:\Windows\System\YHvpXzL.exe
  C:\Windows\System\YHvpXzL.exe
  2⤵
  PID:2256
- C:\Windows\System\MsAFiPW.exe
  C:\Windows\System\MsAFiPW.exe
  2⤵
  PID:5040
- C:\Windows\System\ZLIAwcx.exe
  C:\Windows\System\ZLIAwcx.exe
  2⤵
  PID:2840
- C:\Windows\System\ZxneFoM.exe
  C:\Windows\System\ZxneFoM.exe
  2⤵
  PID:316
- C:\Windows\System\YremXoZ.exe
  C:\Windows\System\YremXoZ.exe
  2⤵
  PID:1272
- C:\Windows\System\djtgAZs.exe
  C:\Windows\System\djtgAZs.exe
  2⤵
  PID:3328
- C:\Windows\System\pZacwti.exe
  C:\Windows\System\pZacwti.exe
  2⤵
  PID:1684
- C:\Windows\System\bLFXTLv.exe
  C:\Windows\System\bLFXTLv.exe
  2⤵
  PID:3904
- C:\Windows\System\tqZjiVG.exe
  C:\Windows\System\tqZjiVG.exe
  2⤵
  PID:1296
- C:\Windows\System\FFGCTfF.exe
  C:\Windows\System\FFGCTfF.exe
  2⤵
  PID:4704
- C:\Windows\System\qFVLrXC.exe
  C:\Windows\System\qFVLrXC.exe
  2⤵
  PID:3272
- C:\Windows\System\yzqwAbR.exe
  C:\Windows\System\yzqwAbR.exe
  2⤵
  PID:2360
- C:\Windows\System\YNtoptb.exe
  C:\Windows\System\YNtoptb.exe
  2⤵
  PID:2640
- C:\Windows\System\apbnLvC.exe
  C:\Windows\System\apbnLvC.exe
  2⤵
  PID:3536
- C:\Windows\System\IYblBdd.exe
  C:\Windows\System\IYblBdd.exe
  2⤵
  PID:940
- C:\Windows\System\DmoCHun.exe
  C:\Windows\System\DmoCHun.exe
  2⤵
  PID:2176
- C:\Windows\System\sXCVZhp.exe
  C:\Windows\System\sXCVZhp.exe
  2⤵
  PID:1212
- C:\Windows\System\cvmsuON.exe
  C:\Windows\System\cvmsuON.exe
  2⤵
  PID:5128
- C:\Windows\System\yJcsihp.exe
  C:\Windows\System\yJcsihp.exe
  2⤵
  PID:5148
- C:\Windows\System\PrSvqOi.exe
  C:\Windows\System\PrSvqOi.exe
  2⤵
  PID:5168
- C:\Windows\System\ekIeCDh.exe
  C:\Windows\System\ekIeCDh.exe
  2⤵
  PID:5204
- C:\Windows\System\IIvCMTe.exe
  C:\Windows\System\IIvCMTe.exe
  2⤵
  PID:5232
- C:\Windows\System\LbWvOZa.exe
  C:\Windows\System\LbWvOZa.exe
  2⤵
  PID:5248
- C:\Windows\System\SFinCzk.exe
  C:\Windows\System\SFinCzk.exe
  2⤵
  PID:5264
- C:\Windows\System\BkQhCZp.exe
  C:\Windows\System\BkQhCZp.exe
  2⤵
  PID:5288
- C:\Windows\System\snkeeoE.exe
  C:\Windows\System\snkeeoE.exe
  2⤵
  PID:5304
- C:\Windows\System\DoVEHxP.exe
  C:\Windows\System\DoVEHxP.exe
  2⤵
  PID:5328
- C:\Windows\System\ENALxuV.exe
  C:\Windows\System\ENALxuV.exe
  2⤵
  PID:5344
- C:\Windows\System\KtDCnVq.exe
  C:\Windows\System\KtDCnVq.exe
  2⤵
  PID:5372
- C:\Windows\System\noBYfdp.exe
  C:\Windows\System\noBYfdp.exe
  2⤵
  PID:5400
- C:\Windows\System\BDueIJc.exe
  C:\Windows\System\BDueIJc.exe
  2⤵
  PID:5420
- C:\Windows\System\swFseEx.exe
  C:\Windows\System\swFseEx.exe
  2⤵
  PID:5440
- C:\Windows\System\qGvNtcg.exe
  C:\Windows\System\qGvNtcg.exe
  2⤵
  PID:5456
- C:\Windows\System\btjUVot.exe
  C:\Windows\System\btjUVot.exe
  2⤵
  PID:5476
- C:\Windows\System\LoNGTZG.exe
  C:\Windows\System\LoNGTZG.exe
  2⤵
  PID:5500
- C:\Windows\System\aATBNsz.exe
  C:\Windows\System\aATBNsz.exe
  2⤵
  PID:5520
- C:\Windows\System\ANqRyuz.exe
  C:\Windows\System\ANqRyuz.exe
  2⤵
  PID:5536
- C:\Windows\System\nWaXVyq.exe
  C:\Windows\System\nWaXVyq.exe
  2⤵
  PID:5552
- C:\Windows\System\WYEbLfu.exe
  C:\Windows\System\WYEbLfu.exe
  2⤵
  PID:5576
- C:\Windows\System\iiDajIw.exe
  C:\Windows\System\iiDajIw.exe
  2⤵
  PID:5592
- C:\Windows\System\prizjYb.exe
  C:\Windows\System\prizjYb.exe
  2⤵
  PID:5620
- C:\Windows\System\BUIuqTT.exe
  C:\Windows\System\BUIuqTT.exe
  2⤵
  PID:5644
- C:\Windows\System\QNJJMjA.exe
  C:\Windows\System\QNJJMjA.exe
  2⤵
  PID:5672
- C:\Windows\System\IDjXBMb.exe
  C:\Windows\System\IDjXBMb.exe
  2⤵
  PID:5692
- C:\Windows\System\IAhVJue.exe
  C:\Windows\System\IAhVJue.exe
  2⤵
  PID:5708
- C:\Windows\System\omZCuKs.exe
  C:\Windows\System\omZCuKs.exe
  2⤵
  PID:5732
- C:\Windows\System\CLAbQdd.exe
  C:\Windows\System\CLAbQdd.exe
  2⤵
  PID:5760
- C:\Windows\System\EPCfyTN.exe
  C:\Windows\System\EPCfyTN.exe
  2⤵
  PID:5776
- C:\Windows\System\CkzfgHP.exe
  C:\Windows\System\CkzfgHP.exe
  2⤵
  PID:5796
- C:\Windows\System\AVmNALq.exe
  C:\Windows\System\AVmNALq.exe
  2⤵
  PID:5812
- C:\Windows\System\HFnEbsM.exe
  C:\Windows\System\HFnEbsM.exe
  2⤵
  PID:5836
- C:\Windows\System\DpMrUfP.exe
  C:\Windows\System\DpMrUfP.exe
  2⤵
  PID:5856
- C:\Windows\System\pjVnYVN.exe
  C:\Windows\System\pjVnYVN.exe
  2⤵
  PID:5880
- C:\Windows\System\dOLKAFR.exe
  C:\Windows\System\dOLKAFR.exe
  2⤵
  PID:5896
- C:\Windows\System\CVjBuhG.exe
  C:\Windows\System\CVjBuhG.exe
  2⤵
  PID:5916
- C:\Windows\System\RAdwuLV.exe
  C:\Windows\System\RAdwuLV.exe
  2⤵
  PID:5936
- C:\Windows\System\wuczvDt.exe
  C:\Windows\System\wuczvDt.exe
  2⤵
  PID:5960
- C:\Windows\System\ublprQG.exe
  C:\Windows\System\ublprQG.exe
  2⤵
  PID:5976
- C:\Windows\System\vEVotfO.exe
  C:\Windows\System\vEVotfO.exe
  2⤵
  PID:6028
- C:\Windows\System\CcVjTAI.exe
  C:\Windows\System\CcVjTAI.exe
  2⤵
  PID:6048
- C:\Windows\System\XdSUUdN.exe
  C:\Windows\System\XdSUUdN.exe
  2⤵
  PID:6088
- C:\Windows\System\GbYTebo.exe
  C:\Windows\System\GbYTebo.exe
  2⤵
  PID:6112
- C:\Windows\System\iUauhtl.exe
  C:\Windows\System\iUauhtl.exe
  2⤵
  PID:6132
- C:\Windows\System\mHtIZxC.exe
  C:\Windows\System\mHtIZxC.exe
  2⤵
  PID:1900
- C:\Windows\System\TiSsKfe.exe
  C:\Windows\System\TiSsKfe.exe
  2⤵
  PID:3964
- C:\Windows\System\PZxUrtl.exe
  C:\Windows\System\PZxUrtl.exe
  2⤵
  PID:3692
- C:\Windows\System\YhidPPl.exe
  C:\Windows\System\YhidPPl.exe
  2⤵
  PID:4388
- C:\Windows\System\UIrWzpj.exe
  C:\Windows\System\UIrWzpj.exe
  2⤵
  PID:844
- C:\Windows\System\mwPqWuB.exe
  C:\Windows\System\mwPqWuB.exe
  2⤵
  PID:4908
- C:\Windows\System\aobVijK.exe
  C:\Windows\System\aobVijK.exe
  2⤵
  PID:904
- C:\Windows\System\orlVEhA.exe
  C:\Windows\System\orlVEhA.exe
  2⤵
  PID:4268
- C:\Windows\System\NofPLev.exe
  C:\Windows\System\NofPLev.exe
  2⤵
  PID:3696
- C:\Windows\System\McILnDe.exe
  C:\Windows\System\McILnDe.exe
  2⤵
  PID:1364
- C:\Windows\System\nPZQqUy.exe
  C:\Windows\System\nPZQqUy.exe
  2⤵
  PID:5140
- C:\Windows\System\KqiAfXy.exe
  C:\Windows\System\KqiAfXy.exe
  2⤵
  PID:5180
- C:\Windows\System\FVjMlVG.exe
  C:\Windows\System\FVjMlVG.exe
  2⤵
  PID:2748
- C:\Windows\System\erdUMnI.exe
  C:\Windows\System\erdUMnI.exe
  2⤵
  PID:4308
- C:\Windows\System\sfguGtG.exe
  C:\Windows\System\sfguGtG.exe
  2⤵
  PID:4004
- C:\Windows\System\WPIfYZr.exe
  C:\Windows\System\WPIfYZr.exe
  2⤵
  PID:4340
- C:\Windows\System\mnbYIXJ.exe
  C:\Windows\System\mnbYIXJ.exe
  2⤵
  PID:1892
- C:\Windows\System\CVTUeVv.exe
  C:\Windows\System\CVTUeVv.exe
  2⤵
  PID:5516
- C:\Windows\System\NgXEnJm.exe
  C:\Windows\System\NgXEnJm.exe
  2⤵
  PID:2104
- C:\Windows\System\pXprYVV.exe
  C:\Windows\System\pXprYVV.exe
  2⤵
  PID:5584
- C:\Windows\System\FfPgPgd.exe
  C:\Windows\System\FfPgPgd.exe
  2⤵
  PID:5656
- C:\Windows\System\pNYkpne.exe
  C:\Windows\System\pNYkpne.exe
  2⤵
  PID:5688
- C:\Windows\System\LRqEDhZ.exe
  C:\Windows\System\LRqEDhZ.exe
  2⤵
  PID:5804
- C:\Windows\System\zlUNaKW.exe
  C:\Windows\System\zlUNaKW.exe
  2⤵
  PID:5164
- C:\Windows\System\wVuYcVy.exe
  C:\Windows\System\wVuYcVy.exe
  2⤵
  PID:5912
- C:\Windows\System\tCPQTHP.exe
  C:\Windows\System\tCPQTHP.exe
  2⤵
  PID:5972
- C:\Windows\System\nygXSeY.exe
  C:\Windows\System\nygXSeY.exe
  2⤵
  PID:428
- C:\Windows\System\ASRInrU.exe
  C:\Windows\System\ASRInrU.exe
  2⤵
  PID:6156
- C:\Windows\System\dzmzItt.exe
  C:\Windows\System\dzmzItt.exe
  2⤵
  PID:6172
- C:\Windows\System\UDCeaLk.exe
  C:\Windows\System\UDCeaLk.exe
  2⤵
  PID:6188
- C:\Windows\System\WnFtJjc.exe
  C:\Windows\System\WnFtJjc.exe
  2⤵
  PID:6212
- C:\Windows\System\ZUQikLZ.exe
  C:\Windows\System\ZUQikLZ.exe
  2⤵
  PID:6228
- C:\Windows\System\yvxKkkX.exe
  C:\Windows\System\yvxKkkX.exe
  2⤵
  PID:6260
- C:\Windows\System\tWDMVbA.exe
  C:\Windows\System\tWDMVbA.exe
  2⤵
  PID:6276
- C:\Windows\System\bwSoQRW.exe
  C:\Windows\System\bwSoQRW.exe
  2⤵
  PID:6292
- C:\Windows\System\TZNlFgt.exe
  C:\Windows\System\TZNlFgt.exe
  2⤵
  PID:6312
- C:\Windows\System\uahmZlV.exe
  C:\Windows\System\uahmZlV.exe
  2⤵
  PID:6332
- C:\Windows\System\yMAyPEF.exe
  C:\Windows\System\yMAyPEF.exe
  2⤵
  PID:6352
- C:\Windows\System\PcbTLTS.exe
  C:\Windows\System\PcbTLTS.exe
  2⤵
  PID:6368
- C:\Windows\System\ZwMolDG.exe
  C:\Windows\System\ZwMolDG.exe
  2⤵
  PID:6396
- C:\Windows\System\OnQdnQt.exe
  C:\Windows\System\OnQdnQt.exe
  2⤵
  PID:6416
- C:\Windows\System\FlPAXHK.exe
  C:\Windows\System\FlPAXHK.exe
  2⤵
  PID:6436
- C:\Windows\System\NiOPdlQ.exe
  C:\Windows\System\NiOPdlQ.exe
  2⤵
  PID:6456
- C:\Windows\System\UzWqFJB.exe
  C:\Windows\System\UzWqFJB.exe
  2⤵
  PID:6472
- C:\Windows\System\OXQHTsJ.exe
  C:\Windows\System\OXQHTsJ.exe
  2⤵
  PID:6492
- C:\Windows\System\puxgYpL.exe
  C:\Windows\System\puxgYpL.exe
  2⤵
  PID:6516
- C:\Windows\System\scIHkon.exe
  C:\Windows\System\scIHkon.exe
  2⤵
  PID:6532
- C:\Windows\System\jzQkXnj.exe
  C:\Windows\System\jzQkXnj.exe
  2⤵
  PID:6548
- C:\Windows\System\ciauEnm.exe
  C:\Windows\System\ciauEnm.exe
  2⤵
  PID:6576
- C:\Windows\System\YsTGcCa.exe
  C:\Windows\System\YsTGcCa.exe
  2⤵
  PID:6592
- C:\Windows\System\lMwJfsh.exe
  C:\Windows\System\lMwJfsh.exe
  2⤵
  PID:7040
- C:\Windows\System\PexZkwQ.exe
  C:\Windows\System\PexZkwQ.exe
  2⤵
  PID:7072
- C:\Windows\System\vgkerZW.exe
  C:\Windows\System\vgkerZW.exe
  2⤵
  PID:7088
- C:\Windows\System\dPuJNYp.exe
  C:\Windows\System\dPuJNYp.exe
  2⤵
  PID:7104
- C:\Windows\System\ggGsANx.exe
  C:\Windows\System\ggGsANx.exe
  2⤵
  PID:6100
- C:\Windows\System\iOGkvxc.exe
  C:\Windows\System\iOGkvxc.exe
  2⤵
  PID:6128
- C:\Windows\System\iMBfkSD.exe
  C:\Windows\System\iMBfkSD.exe
  2⤵
  PID:5508
- C:\Windows\System\ubpBDBT.exe
  C:\Windows\System\ubpBDBT.exe
  2⤵
  PID:5528
- C:\Windows\System\cfIobEX.exe
  C:\Windows\System\cfIobEX.exe
  2⤵
  PID:5612
- C:\Windows\System\TfqoujV.exe
  C:\Windows\System\TfqoujV.exe
  2⤵
  PID:812
- C:\Windows\System\vQzsilR.exe
  C:\Windows\System\vQzsilR.exe
  2⤵
  PID:5628
- C:\Windows\System\JXUbGIr.exe
  C:\Windows\System\JXUbGIr.exe
  2⤵
  PID:5212
- C:\Windows\System\uJZeWir.exe
  C:\Windows\System\uJZeWir.exe
  2⤵
  PID:5256
- C:\Windows\System\BdDRAsK.exe
  C:\Windows\System\BdDRAsK.exe
  2⤵
  PID:5284
- C:\Windows\System\lESrRIT.exe
  C:\Windows\System\lESrRIT.exe
  2⤵
  PID:6168
- C:\Windows\System\iniiuEz.exe
  C:\Windows\System\iniiuEz.exe
  2⤵
  PID:5356
- C:\Windows\System\rHlUUBs.exe
  C:\Windows\System\rHlUUBs.exe
  2⤵
  PID:5392
- C:\Windows\System\xRpSoCk.exe
  C:\Windows\System\xRpSoCk.exe
  2⤵
  PID:2668
- C:\Windows\System\ueCRmqg.exe
  C:\Windows\System\ueCRmqg.exe
  2⤵
  PID:5448
- C:\Windows\System\oGZINIg.exe
  C:\Windows\System\oGZINIg.exe
  2⤵
  PID:1980
- C:\Windows\System\aLUiIRT.exe
  C:\Windows\System\aLUiIRT.exe
  2⤵
  PID:5560
- C:\Windows\System\wxOMIoG.exe
  C:\Windows\System\wxOMIoG.exe
  2⤵
  PID:5704
- C:\Windows\System\sVghOjw.exe
  C:\Windows\System\sVghOjw.exe
  2⤵
  PID:2904
- C:\Windows\System\JGfGFmJ.exe
  C:\Windows\System\JGfGFmJ.exe
  2⤵
  PID:5876
- C:\Windows\System\RamnUIQ.exe
  C:\Windows\System\RamnUIQ.exe
  2⤵
  PID:5744
- C:\Windows\System\KNMxJIt.exe
  C:\Windows\System\KNMxJIt.exe
  2⤵
  PID:6384
- C:\Windows\System\POUzToZ.exe
  C:\Windows\System\POUzToZ.exe
  2⤵
  PID:3148
- C:\Windows\System\eyQdDgR.exe
  C:\Windows\System\eyQdDgR.exe
  2⤵
  PID:2484
- C:\Windows\System\mUhtWvj.exe
  C:\Windows\System\mUhtWvj.exe
  2⤵
  PID:5156
- C:\Windows\System\VLwuOgg.exe
  C:\Windows\System\VLwuOgg.exe
  2⤵
  PID:740
- C:\Windows\System\jcAdbSg.exe
  C:\Windows\System\jcAdbSg.exe
  2⤵
  PID:5652
- C:\Windows\System\AWEwnKk.exe
  C:\Windows\System\AWEwnKk.exe
  2⤵
  PID:552
- C:\Windows\System\qCmlgSn.exe
  C:\Windows\System\qCmlgSn.exe
  2⤵
  PID:4452
- C:\Windows\System\uEJivpo.exe
  C:\Windows\System\uEJivpo.exe
  2⤵
  PID:6236
- C:\Windows\System\DVRpwKu.exe
  C:\Windows\System\DVRpwKu.exe
  2⤵
  PID:6240
- C:\Windows\System\BzKTzho.exe
  C:\Windows\System\BzKTzho.exe
  2⤵
  PID:6164
- C:\Windows\System\dMZyzvN.exe
  C:\Windows\System\dMZyzvN.exe
  2⤵
  PID:5768
- C:\Windows\System\ArxVNCO.exe
  C:\Windows\System\ArxVNCO.exe
  2⤵
  PID:1080
- C:\Windows\System\TuNqCmf.exe
  C:\Windows\System\TuNqCmf.exe
  2⤵
  PID:5096
- C:\Windows\System\UevYipE.exe
  C:\Windows\System\UevYipE.exe
  2⤵
  PID:6404
- C:\Windows\System\IGtYNEp.exe
  C:\Windows\System\IGtYNEp.exe
  2⤵
  PID:6480
- C:\Windows\System\ovyoUeQ.exe
  C:\Windows\System\ovyoUeQ.exe
  2⤵
  PID:6572
- C:\Windows\System\uoEssYE.exe
  C:\Windows\System\uoEssYE.exe
  2⤵
  PID:6672
- C:\Windows\System\AVswkMW.exe
  C:\Windows\System\AVswkMW.exe
  2⤵
  PID:6712
- C:\Windows\System\fVcefnP.exe
  C:\Windows\System\fVcefnP.exe
  2⤵
  PID:6756
- C:\Windows\System\LNITCwy.exe
  C:\Windows\System\LNITCwy.exe
  2⤵
  PID:6328
- C:\Windows\System\auAKGie.exe
  C:\Windows\System\auAKGie.exe
  2⤵
  PID:6344
- C:\Windows\System\PJLCWSO.exe
  C:\Windows\System\PJLCWSO.exe
  2⤵
  PID:7180
- C:\Windows\System\QYiUfVH.exe
  C:\Windows\System\QYiUfVH.exe
  2⤵
  PID:7204
- C:\Windows\System\ORWAYYm.exe
  C:\Windows\System\ORWAYYm.exe
  2⤵
  PID:7220
- C:\Windows\System\yTbnHmY.exe
  C:\Windows\System\yTbnHmY.exe
  2⤵
  PID:7248
- C:\Windows\System\NgTAIpb.exe
  C:\Windows\System\NgTAIpb.exe
  2⤵
  PID:7268
- C:\Windows\System\uxOIKLo.exe
  C:\Windows\System\uxOIKLo.exe
  2⤵
  PID:7284
- C:\Windows\System\SFuoSJK.exe
  C:\Windows\System\SFuoSJK.exe
  2⤵
  PID:7308
- C:\Windows\System\YEDSWzG.exe
  C:\Windows\System\YEDSWzG.exe
  2⤵
  PID:7328
- C:\Windows\System\oadNYCj.exe
  C:\Windows\System\oadNYCj.exe
  2⤵
  PID:7352
- C:\Windows\System\ipKBzGy.exe
  C:\Windows\System\ipKBzGy.exe
  2⤵
  PID:7368
- C:\Windows\System\zYYyXHN.exe
  C:\Windows\System\zYYyXHN.exe
  2⤵
  PID:7396
- C:\Windows\System\vyyOmya.exe
  C:\Windows\System\vyyOmya.exe
  2⤵
  PID:7412
- C:\Windows\System\HSTwWMM.exe
  C:\Windows\System\HSTwWMM.exe
  2⤵
  PID:7436
- C:\Windows\System\zgnQyiD.exe
  C:\Windows\System\zgnQyiD.exe
  2⤵
  PID:7456
- C:\Windows\System\BrXloXQ.exe
  C:\Windows\System\BrXloXQ.exe
  2⤵
  PID:7480
- C:\Windows\System\NxkzhZz.exe
  C:\Windows\System\NxkzhZz.exe
  2⤵
  PID:7496
- C:\Windows\System\leIhPZA.exe
  C:\Windows\System\leIhPZA.exe
  2⤵
  PID:7520
- C:\Windows\System\PMVcxlE.exe
  C:\Windows\System\PMVcxlE.exe
  2⤵
  PID:7544
- C:\Windows\System\GLsqJIe.exe
  C:\Windows\System\GLsqJIe.exe
  2⤵
  PID:7564
- C:\Windows\System\WFrZHIy.exe
  C:\Windows\System\WFrZHIy.exe
  2⤵
  PID:7588
- C:\Windows\System\lbtxFZc.exe
  C:\Windows\System\lbtxFZc.exe
  2⤵
  PID:7608
- C:\Windows\System\KYVxcyW.exe
  C:\Windows\System\KYVxcyW.exe
  2⤵
  PID:7628
- C:\Windows\System\IyodMsG.exe
  C:\Windows\System\IyodMsG.exe
  2⤵
  PID:7648
- C:\Windows\System\ApzYaoY.exe
  C:\Windows\System\ApzYaoY.exe
  2⤵
  PID:7672
- C:\Windows\System\fuvlMEz.exe
  C:\Windows\System\fuvlMEz.exe
  2⤵
  PID:7692
- C:\Windows\System\MXooOWI.exe
  C:\Windows\System\MXooOWI.exe
  2⤵
  PID:7712
- C:\Windows\System\XSWfrEC.exe
  C:\Windows\System\XSWfrEC.exe
  2⤵
  PID:7736
- C:\Windows\System\POFUOXh.exe
  C:\Windows\System\POFUOXh.exe
  2⤵
  PID:7752
- C:\Windows\System\ThVgXiN.exe
  C:\Windows\System\ThVgXiN.exe
  2⤵
  PID:7780
- C:\Windows\System\ljqEHag.exe
  C:\Windows\System\ljqEHag.exe
  2⤵
  PID:7804
- C:\Windows\System\JPypjee.exe
  C:\Windows\System\JPypjee.exe
  2⤵
  PID:7820
- C:\Windows\System\xWaQgBo.exe
  C:\Windows\System\xWaQgBo.exe
  2⤵
  PID:7840
- C:\Windows\System\EXuoTNO.exe
  C:\Windows\System\EXuoTNO.exe
  2⤵
  PID:7860
- C:\Windows\System\cNChcUT.exe
  C:\Windows\System\cNChcUT.exe
  2⤵
  PID:7880
- C:\Windows\System\asgySCU.exe
  C:\Windows\System\asgySCU.exe
  2⤵
  PID:7980
- C:\Windows\System\WemUHYX.exe
  C:\Windows\System\WemUHYX.exe
  2⤵
  PID:8000
- C:\Windows\System\IoeXXPQ.exe
  C:\Windows\System\IoeXXPQ.exe
  2⤵
  PID:8020
- C:\Windows\System\cGfOAFD.exe
  C:\Windows\System\cGfOAFD.exe
  2⤵
  PID:8048
- C:\Windows\System\EAlceGg.exe
  C:\Windows\System\EAlceGg.exe
  2⤵
  PID:8068
- C:\Windows\System\ZbqcFTx.exe
  C:\Windows\System\ZbqcFTx.exe
  2⤵
  PID:8092
- C:\Windows\System\xWvZwmB.exe
  C:\Windows\System\xWvZwmB.exe
  2⤵
  PID:8108
- C:\Windows\System\xhhMKqm.exe
  C:\Windows\System\xhhMKqm.exe
  2⤵
  PID:8132
- C:\Windows\System\gvqhAxB.exe
  C:\Windows\System\gvqhAxB.exe
  2⤵
  PID:8160
- C:\Windows\System\QGBaLwX.exe
  C:\Windows\System\QGBaLwX.exe
  2⤵
  PID:8180
- C:\Windows\System\KmlMZIS.exe
  C:\Windows\System\KmlMZIS.exe
  2⤵
  PID:6484
- C:\Windows\System\vsHkcyr.exe
  C:\Windows\System\vsHkcyr.exe
  2⤵
  PID:7056
- C:\Windows\System\hkdHXuS.exe
  C:\Windows\System\hkdHXuS.exe
  2⤵
  PID:5008
- C:\Windows\System\guvOegL.exe
  C:\Windows\System\guvOegL.exe
  2⤵
  PID:5600
- C:\Windows\System\BFRvGAX.exe
  C:\Windows\System\BFRvGAX.exe
  2⤵
  PID:5784
- C:\Windows\System\dczAzSI.exe
  C:\Windows\System\dczAzSI.exe
  2⤵
  PID:4076
- C:\Windows\System\jTeMbCV.exe
  C:\Windows\System\jTeMbCV.exe
  2⤵
  PID:8208
- C:\Windows\System\XybqLhC.exe
  C:\Windows\System\XybqLhC.exe
  2⤵
  PID:8232
- C:\Windows\System\miCfhha.exe
  C:\Windows\System\miCfhha.exe
  2⤵
  PID:8256
- C:\Windows\System\TtEXszM.exe
  C:\Windows\System\TtEXszM.exe
  2⤵
  PID:8276
- C:\Windows\System\SifDIkC.exe
  C:\Windows\System\SifDIkC.exe
  2⤵
  PID:8300
- C:\Windows\System\ITGeDpu.exe
  C:\Windows\System\ITGeDpu.exe
  2⤵
  PID:8324
- C:\Windows\System\qwSGZAj.exe
  C:\Windows\System\qwSGZAj.exe
  2⤵
  PID:8344
- C:\Windows\System\XmVgUXK.exe
  C:\Windows\System\XmVgUXK.exe
  2⤵
  PID:8372
- C:\Windows\System\sHvPKlq.exe
  C:\Windows\System\sHvPKlq.exe
  2⤵
  PID:8388
- C:\Windows\System\CHOPBUd.exe
  C:\Windows\System\CHOPBUd.exe
  2⤵
  PID:8420
- C:\Windows\System\tcvPQbE.exe
  C:\Windows\System\tcvPQbE.exe
  2⤵
  PID:8440
- C:\Windows\System\QuraKTD.exe
  C:\Windows\System\QuraKTD.exe
  2⤵
  PID:8468
- C:\Windows\System\eTSKAzL.exe
  C:\Windows\System\eTSKAzL.exe
  2⤵
  PID:8488
- C:\Windows\System\rSQLaKx.exe
  C:\Windows\System\rSQLaKx.exe
  2⤵
  PID:8516
- C:\Windows\System\tizUYNn.exe
  C:\Windows\System\tizUYNn.exe
  2⤵
  PID:8536
- C:\Windows\System\JJtngfU.exe
  C:\Windows\System\JJtngfU.exe
  2⤵
  PID:8560
- C:\Windows\System\xjHGRga.exe
  C:\Windows\System\xjHGRga.exe
  2⤵
  PID:8584
- C:\Windows\System\gqxcqgy.exe
  C:\Windows\System\gqxcqgy.exe
  2⤵
  PID:8604
- C:\Windows\System\RRZMTwZ.exe
  C:\Windows\System\RRZMTwZ.exe
  2⤵
  PID:8632
- C:\Windows\System\IJoQSlk.exe
  C:\Windows\System\IJoQSlk.exe
  2⤵
  PID:8652
- C:\Windows\System\DeKtOvz.exe
  C:\Windows\System\DeKtOvz.exe
  2⤵
  PID:8684
- C:\Windows\System\anksXgf.exe
  C:\Windows\System\anksXgf.exe
  2⤵
  PID:8704
- C:\Windows\System\OpetNyO.exe
  C:\Windows\System\OpetNyO.exe
  2⤵
  PID:8728
- C:\Windows\System\lJMRoKM.exe
  C:\Windows\System\lJMRoKM.exe
  2⤵
  PID:8756
- C:\Windows\System\pTSWvzq.exe
  C:\Windows\System\pTSWvzq.exe
  2⤵
  PID:8784
- C:\Windows\System\cvLhGkQ.exe
  C:\Windows\System\cvLhGkQ.exe
  2⤵
  PID:8804
- C:\Windows\System\bWCyUMd.exe
  C:\Windows\System\bWCyUMd.exe
  2⤵
  PID:8832
- C:\Windows\System\aTfoumu.exe
  C:\Windows\System\aTfoumu.exe
  2⤵
  PID:8852
- C:\Windows\System\bgkNxmi.exe
  C:\Windows\System\bgkNxmi.exe
  2⤵
  PID:8868
- C:\Windows\System\jWUeyPj.exe
  C:\Windows\System\jWUeyPj.exe
  2⤵
  PID:8888
- C:\Windows\System\mXhMmJA.exe
  C:\Windows\System\mXhMmJA.exe
  2⤵
  PID:8908
- C:\Windows\System\WJrPWAb.exe
  C:\Windows\System\WJrPWAb.exe
  2⤵
  PID:8928
- C:\Windows\System\gxISMdq.exe
  C:\Windows\System\gxISMdq.exe
  2⤵
  PID:8952
- C:\Windows\System\MOnPgXd.exe
  C:\Windows\System\MOnPgXd.exe
  2⤵
  PID:8972
- C:\Windows\System\bbyqAJo.exe
  C:\Windows\System\bbyqAJo.exe
  2⤵
  PID:8988
- C:\Windows\System\DXUeuAa.exe
  C:\Windows\System\DXUeuAa.exe
  2⤵
  PID:9004
- C:\Windows\System\rnoPguF.exe
  C:\Windows\System\rnoPguF.exe
  2⤵
  PID:9020
- C:\Windows\System\PfDTCZT.exe
  C:\Windows\System\PfDTCZT.exe
  2⤵
  PID:9036
- C:\Windows\System\ysBeqLV.exe
  C:\Windows\System\ysBeqLV.exe
  2⤵
  PID:9052
- C:\Windows\System\gnnvfTt.exe
  C:\Windows\System\gnnvfTt.exe
  2⤵
  PID:9068
- C:\Windows\System\GmPiaJF.exe
  C:\Windows\System\GmPiaJF.exe
  2⤵
  PID:9084
- C:\Windows\System\ufDXIdX.exe
  C:\Windows\System\ufDXIdX.exe
  2⤵
  PID:9100
- C:\Windows\System\ewTevSn.exe
  C:\Windows\System\ewTevSn.exe
  2⤵
  PID:9116
- C:\Windows\System\ParapOD.exe
  C:\Windows\System\ParapOD.exe
  2⤵
  PID:9140
- C:\Windows\System\yhYbwLD.exe
  C:\Windows\System\yhYbwLD.exe
  2⤵
  PID:9156
- C:\Windows\System\DUzqSBN.exe
  C:\Windows\System\DUzqSBN.exe
  2⤵
  PID:9184
- C:\Windows\System\JZqeCvk.exe
  C:\Windows\System\JZqeCvk.exe
  2⤵
  PID:9208
- C:\Windows\System\PYqFLCC.exe
  C:\Windows\System\PYqFLCC.exe
  2⤵
  PID:1108
- C:\Windows\System\utjzdar.exe
  C:\Windows\System\utjzdar.exe
  2⤵
  PID:6224
- C:\Windows\System\mxaWwrk.exe
  C:\Windows\System\mxaWwrk.exe
  2⤵
  PID:848
- C:\Windows\System\NndUses.exe
  C:\Windows\System\NndUses.exe
  2⤵
  PID:6768
- C:\Windows\System\KutGVEo.exe
  C:\Windows\System\KutGVEo.exe
  2⤵
  PID:7176
- C:\Windows\System\eDGWcfS.exe
  C:\Windows\System\eDGWcfS.exe
  2⤵
  PID:7240
- C:\Windows\System\meGpKda.exe
  C:\Windows\System\meGpKda.exe
  2⤵
  PID:7336
- C:\Windows\System\NwHbMKX.exe
  C:\Windows\System\NwHbMKX.exe
  2⤵
  PID:6556
- C:\Windows\System\KVvrGDY.exe
  C:\Windows\System\KVvrGDY.exe
  2⤵
  PID:7504
- C:\Windows\System\ekcZgCw.exe
  C:\Windows\System\ekcZgCw.exe
  2⤵
  PID:7604
- C:\Windows\System\YYWtIUO.exe
  C:\Windows\System\YYWtIUO.exe
  2⤵
  PID:7684
- C:\Windows\System\IawlmqP.exe
  C:\Windows\System\IawlmqP.exe
  2⤵
  PID:7768
- C:\Windows\System\TuIGCSJ.exe
  C:\Windows\System\TuIGCSJ.exe
  2⤵
  PID:7828
- C:\Windows\System\fxdlrrE.exe
  C:\Windows\System\fxdlrrE.exe
  2⤵
  PID:7868
- C:\Windows\System\PIgaYJh.exe
  C:\Windows\System\PIgaYJh.exe
  2⤵
  PID:7896
- C:\Windows\System\gQWtOCo.exe
  C:\Windows\System\gQWtOCo.exe
  2⤵
  PID:6996
- C:\Windows\System\lHbtWkt.exe
  C:\Windows\System\lHbtWkt.exe
  2⤵
  PID:8040
- C:\Windows\System\nJIOEbQ.exe
  C:\Windows\System\nJIOEbQ.exe
  2⤵
  PID:8140
- C:\Windows\System\jxNiytz.exe
  C:\Windows\System\jxNiytz.exe
  2⤵
  PID:8172
- C:\Windows\System\ERxqugk.exe
  C:\Windows\System\ERxqugk.exe
  2⤵
  PID:6120
- C:\Windows\System\USLfyeZ.exe
  C:\Windows\System\USLfyeZ.exe
  2⤵
  PID:3432
- C:\Windows\System\NCACFVq.exe
  C:\Windows\System\NCACFVq.exe
  2⤵
  PID:1464
- C:\Windows\System\ZRhTXME.exe
  C:\Windows\System\ZRhTXME.exe
  2⤵
  PID:8248
- C:\Windows\System\QqOkeME.exe
  C:\Windows\System\QqOkeME.exe
  2⤵
  PID:6196
- C:\Windows\System\yHbRRGv.exe
  C:\Windows\System\yHbRRGv.exe
  2⤵
  PID:5820
- C:\Windows\System\edkCexa.exe
  C:\Windows\System\edkCexa.exe
  2⤵
  PID:6428
- C:\Windows\System\cRAXTsI.exe
  C:\Windows\System\cRAXTsI.exe
  2⤵
  PID:8380
- C:\Windows\System\bDIJAZS.exe
  C:\Windows\System\bDIJAZS.exe
  2⤵
  PID:6604
- C:\Windows\System\YNzSLAV.exe
  C:\Windows\System\YNzSLAV.exe
  2⤵
  PID:8436
- C:\Windows\System\VJjHieA.exe
  C:\Windows\System\VJjHieA.exe
  2⤵
  PID:8460
- C:\Windows\System\ZTLauRM.exe
  C:\Windows\System\ZTLauRM.exe
  2⤵
  PID:7256
- C:\Windows\System\leXGPml.exe
  C:\Windows\System\leXGPml.exe
  2⤵
  PID:7276
- C:\Windows\System\NmyTsYB.exe
  C:\Windows\System\NmyTsYB.exe
  2⤵
  PID:8592
- C:\Windows\System\mExsvMb.exe
  C:\Windows\System\mExsvMb.exe
  2⤵
  PID:7376
- C:\Windows\System\RpTQqLr.exe
  C:\Windows\System\RpTQqLr.exe
  2⤵
  PID:8668
- C:\Windows\System\bGFqauP.exe
  C:\Windows\System\bGFqauP.exe
  2⤵
  PID:7516
- C:\Windows\System\qfqcQru.exe
  C:\Windows\System\qfqcQru.exe
  2⤵
  PID:7448
- C:\Windows\System\KEsANqz.exe
  C:\Windows\System\KEsANqz.exe
  2⤵
  PID:7552
- C:\Windows\System\CWkgYfQ.exe
  C:\Windows\System\CWkgYfQ.exe
  2⤵
  PID:7656
- C:\Windows\System\rnoKYrI.exe
  C:\Windows\System\rnoKYrI.exe
  2⤵
  PID:7744
- C:\Windows\System\gRYygUq.exe
  C:\Windows\System\gRYygUq.exe
  2⤵
  PID:7052
- C:\Windows\System\XNYKvXS.exe
  C:\Windows\System\XNYKvXS.exe
  2⤵
  PID:8948
- C:\Windows\System\Qnsnwml.exe
  C:\Windows\System\Qnsnwml.exe
  2⤵
  PID:8996
- C:\Windows\System\DyceZUn.exe
  C:\Windows\System\DyceZUn.exe
  2⤵
  PID:9232
- C:\Windows\System\fdqULuj.exe
  C:\Windows\System\fdqULuj.exe
  2⤵
  PID:9256
- C:\Windows\System\TqCWREV.exe
  C:\Windows\System\TqCWREV.exe
  2⤵
  PID:9280
- C:\Windows\System\PumiZGE.exe
  C:\Windows\System\PumiZGE.exe
  2⤵
  PID:9300
- C:\Windows\System\RnGeWmu.exe
  C:\Windows\System\RnGeWmu.exe
  2⤵
  PID:9324
- C:\Windows\System\qrzJnuO.exe
  C:\Windows\System\qrzJnuO.exe
  2⤵
  PID:9340
- C:\Windows\System\SjHKYnU.exe
  C:\Windows\System\SjHKYnU.exe
  2⤵
  PID:9360
- C:\Windows\System\pYsdavx.exe
  C:\Windows\System\pYsdavx.exe
  2⤵
  PID:9380
- C:\Windows\System\hZWhyLw.exe
  C:\Windows\System\hZWhyLw.exe
  2⤵
  PID:9400
- C:\Windows\System\QVUPBSk.exe
  C:\Windows\System\QVUPBSk.exe
  2⤵
  PID:9420
- C:\Windows\System\OpZfPST.exe
  C:\Windows\System\OpZfPST.exe
  2⤵
  PID:9436
- C:\Windows\System\vpVzGVp.exe
  C:\Windows\System\vpVzGVp.exe
  2⤵
  PID:9452
- C:\Windows\System\VximFrZ.exe
  C:\Windows\System\VximFrZ.exe
  2⤵
  PID:9476
- C:\Windows\System\qBgycHO.exe
  C:\Windows\System\qBgycHO.exe
  2⤵
  PID:9496
- C:\Windows\System\QWABKji.exe
  C:\Windows\System\QWABKji.exe
  2⤵
  PID:9516
- C:\Windows\System\puqPePT.exe
  C:\Windows\System\puqPePT.exe
  2⤵
  PID:9536
- C:\Windows\System\TcnmXlp.exe
  C:\Windows\System\TcnmXlp.exe
  2⤵
  PID:9560
- C:\Windows\System\ppZggLl.exe
  C:\Windows\System\ppZggLl.exe
  2⤵
  PID:9580
- C:\Windows\System\UXTDxbt.exe
  C:\Windows\System\UXTDxbt.exe
  2⤵
  PID:9600
- C:\Windows\System\ZTXtjrS.exe
  C:\Windows\System\ZTXtjrS.exe
  2⤵
  PID:9620
- C:\Windows\System\VSKTmCn.exe
  C:\Windows\System\VSKTmCn.exe
  2⤵
  PID:9644
- C:\Windows\System\XHQRJqF.exe
  C:\Windows\System\XHQRJqF.exe
  2⤵
  PID:9664
- C:\Windows\System\NZziRzY.exe
  C:\Windows\System\NZziRzY.exe
  2⤵
  PID:9684
- C:\Windows\System\VunEiSb.exe
  C:\Windows\System\VunEiSb.exe
  2⤵
  PID:9704
- C:\Windows\System\PiqesLo.exe
  C:\Windows\System\PiqesLo.exe
  2⤵
  PID:9724
- C:\Windows\System\POrBbtL.exe
  C:\Windows\System\POrBbtL.exe
  2⤵
  PID:9744
- C:\Windows\System\CHhyFuN.exe
  C:\Windows\System\CHhyFuN.exe
  2⤵
  PID:9772
- C:\Windows\System\kZJsuyc.exe
  C:\Windows\System\kZJsuyc.exe
  2⤵
  PID:9792
- C:\Windows\System\sanFyLw.exe
  C:\Windows\System\sanFyLw.exe
  2⤵
  PID:9812
- C:\Windows\System\sJyrimy.exe
  C:\Windows\System\sJyrimy.exe
  2⤵
  PID:9832
- C:\Windows\System\jnCFpcI.exe
  C:\Windows\System\jnCFpcI.exe
  2⤵
  PID:9860
- C:\Windows\System\HdYvKJw.exe
  C:\Windows\System\HdYvKJw.exe
  2⤵
  PID:9884
- C:\Windows\System\DzdkDDI.exe
  C:\Windows\System\DzdkDDI.exe
  2⤵
  PID:9900
- C:\Windows\System\WrqnZKZ.exe
  C:\Windows\System\WrqnZKZ.exe
  2⤵
  PID:9920
- C:\Windows\System\tPXlvCj.exe
  C:\Windows\System\tPXlvCj.exe
  2⤵
  PID:9940
- C:\Windows\System\bALvxcc.exe
  C:\Windows\System\bALvxcc.exe
  2⤵
  PID:9960
- C:\Windows\System\zUbDzhr.exe
  C:\Windows\System\zUbDzhr.exe
  2⤵
  PID:9984
- C:\Windows\System\WzknAtn.exe
  C:\Windows\System\WzknAtn.exe
  2⤵
  PID:10000
- C:\Windows\System\yaJMvhG.exe
  C:\Windows\System\yaJMvhG.exe
  2⤵
  PID:10024
- C:\Windows\System\iXvGHJn.exe
  C:\Windows\System\iXvGHJn.exe
  2⤵
  PID:10048
- C:\Windows\System\LUleueu.exe
  C:\Windows\System\LUleueu.exe
  2⤵
  PID:10068
- C:\Windows\System\XNuAufQ.exe
  C:\Windows\System\XNuAufQ.exe
  2⤵
  PID:10096
- C:\Windows\System\eePnilv.exe
  C:\Windows\System\eePnilv.exe
  2⤵
  PID:10116
- C:\Windows\System\EHqqTEm.exe
  C:\Windows\System\EHqqTEm.exe
  2⤵
  PID:10136
- C:\Windows\System\gxWKsor.exe
  C:\Windows\System\gxWKsor.exe
  2⤵
  PID:10160
- C:\Windows\System\qYbYtTo.exe
  C:\Windows\System\qYbYtTo.exe
  2⤵
  PID:10180
- C:\Windows\System\oulwWxF.exe
  C:\Windows\System\oulwWxF.exe
  2⤵
  PID:10200
- C:\Windows\System\SCXyqyZ.exe
  C:\Windows\System\SCXyqyZ.exe
  2⤵
  PID:10228
- C:\Windows\System\ijojXhQ.exe
  C:\Windows\System\ijojXhQ.exe
  2⤵
  PID:6044
- C:\Windows\System\vGGGxBO.exe
  C:\Windows\System\vGGGxBO.exe
  2⤵
  PID:4356
- C:\Windows\System\CExiqSJ.exe
  C:\Windows\System\CExiqSJ.exe
  2⤵
  PID:5512
- C:\Windows\System\QMDPdzr.exe
  C:\Windows\System\QMDPdzr.exe
  2⤵
  PID:5756
- C:\Windows\System\FIvLHnq.exe
  C:\Windows\System\FIvLHnq.exe
  2⤵
  PID:5196
- C:\Windows\System\pgBQUkH.exe
  C:\Windows\System\pgBQUkH.exe
  2⤵
  PID:5320
- C:\Windows\System\vvqCpZD.exe
  C:\Windows\System\vvqCpZD.exe
  2⤵
  PID:5380
- C:\Windows\System\iJRMTCF.exe
  C:\Windows\System\iJRMTCF.exe
  2⤵
  PID:9152
- C:\Windows\System\xAfNDCd.exe
  C:\Windows\System\xAfNDCd.exe
  2⤵
  PID:8544
- C:\Windows\System\XTkznqj.exe
  C:\Windows\System\XTkznqj.exe
  2⤵
  PID:7408
- C:\Windows\System\eexUMlH.exe
  C:\Windows\System\eexUMlH.exe
  2⤵
  PID:6324
- C:\Windows\System\XtaJAyp.exe
  C:\Windows\System\XtaJAyp.exe
  2⤵
  PID:8772
- C:\Windows\System\noONQQX.exe
  C:\Windows\System\noONQQX.exe
  2⤵
  PID:8556
- C:\Windows\System\lNvGTxg.exe
  C:\Windows\System\lNvGTxg.exe
  2⤵
  PID:7852
- C:\Windows\System\DZSBRno.exe
  C:\Windows\System\DZSBRno.exe
  2⤵
  PID:8076
- C:\Windows\System\yhGxuyP.exe
  C:\Windows\System\yhGxuyP.exe
  2⤵
  PID:10360
- C:\Windows\System\ojJHsSU.exe
  C:\Windows\System\ojJHsSU.exe
  2⤵
  PID:10384
- C:\Windows\System\QBOHxmS.exe
  C:\Windows\System\QBOHxmS.exe
  2⤵
  PID:10408
- C:\Windows\System\ZEnVoUH.exe
  C:\Windows\System\ZEnVoUH.exe
  2⤵
  PID:10432
- C:\Windows\System\XQGgAVx.exe
  C:\Windows\System\XQGgAVx.exe
  2⤵
  PID:10452
- C:\Windows\System\zhfEInu.exe
  C:\Windows\System\zhfEInu.exe
  2⤵
  PID:10472
- C:\Windows\System\sluEqaW.exe
  C:\Windows\System\sluEqaW.exe
  2⤵
  PID:10496
- C:\Windows\System\uLeRBmt.exe
  C:\Windows\System\uLeRBmt.exe
  2⤵
  PID:10520
- C:\Windows\System\hGwflDs.exe
  C:\Windows\System\hGwflDs.exe
  2⤵
  PID:10548
- C:\Windows\System\lrbGAFN.exe
  C:\Windows\System\lrbGAFN.exe
  2⤵
  PID:10572
- C:\Windows\System\bdTfdtc.exe
  C:\Windows\System\bdTfdtc.exe
  2⤵
  PID:10592
- C:\Windows\System\PAltxhN.exe
  C:\Windows\System\PAltxhN.exe
  2⤵
  PID:10616
- C:\Windows\System\cAVtFjL.exe
  C:\Windows\System\cAVtFjL.exe
  2⤵
  PID:10640
- C:\Windows\System\Toseurn.exe
  C:\Windows\System\Toseurn.exe
  2⤵
  PID:10664
- C:\Windows\System\Babkgij.exe
  C:\Windows\System\Babkgij.exe
  2⤵
  PID:10688
- C:\Windows\System\hkRnGOO.exe
  C:\Windows\System\hkRnGOO.exe
  2⤵
  PID:11548
- C:\Windows\System\mQkKyvm.exe
  C:\Windows\System\mQkKyvm.exe
  2⤵
  PID:11564
- C:\Windows\System\VsGgFbn.exe
  C:\Windows\System\VsGgFbn.exe
  2⤵
  PID:11580
- C:\Windows\System\dpjadhQ.exe
  C:\Windows\System\dpjadhQ.exe
  2⤵
  PID:11596
- C:\Windows\System\fjcIZRm.exe
  C:\Windows\System\fjcIZRm.exe
  2⤵
  PID:11616
- C:\Windows\System\ZGIXEZP.exe
  C:\Windows\System\ZGIXEZP.exe
  2⤵
  PID:11636
- C:\Windows\System\YCKQCZd.exe
  C:\Windows\System\YCKQCZd.exe
  2⤵
  PID:11652
- C:\Windows\System\jkMwKNR.exe
  C:\Windows\System\jkMwKNR.exe
  2⤵
  PID:11668
- C:\Windows\System\QEaOPUu.exe
  C:\Windows\System\QEaOPUu.exe
  2⤵
  PID:11692
- C:\Windows\System\TKjSeZc.exe
  C:\Windows\System\TKjSeZc.exe
  2⤵
  PID:11708
- C:\Windows\System\SyBirLV.exe
  C:\Windows\System\SyBirLV.exe
  2⤵
  PID:11728
- C:\Windows\System\oQGQWSp.exe
  C:\Windows\System\oQGQWSp.exe
  2⤵
  PID:11744
- C:\Windows\System\iszDBHv.exe
  C:\Windows\System\iszDBHv.exe
  2⤵
  PID:11760
- C:\Windows\System\YVqQSKB.exe
  C:\Windows\System\YVqQSKB.exe
  2⤵
  PID:11776
- C:\Windows\System\WtjLoVO.exe
  C:\Windows\System\WtjLoVO.exe
  2⤵
  PID:11792
- C:\Windows\System\reLFdIA.exe
  C:\Windows\System\reLFdIA.exe
  2⤵
  PID:11808
- C:\Windows\System\flMUHLr.exe
  C:\Windows\System\flMUHLr.exe
  2⤵
  PID:11844
- C:\Windows\System\Vpdltrg.exe
  C:\Windows\System\Vpdltrg.exe
  2⤵
  PID:11868
- C:\Windows\System\XQYwSGC.exe
  C:\Windows\System\XQYwSGC.exe
  2⤵
  PID:11928
- C:\Windows\System\hbrtCPL.exe
  C:\Windows\System\hbrtCPL.exe
  2⤵
  PID:12004
- C:\Windows\System\NZzLlMx.exe
  C:\Windows\System\NZzLlMx.exe
  2⤵
  PID:12024
- C:\Windows\System\XPUKOSc.exe
  C:\Windows\System\XPUKOSc.exe
  2⤵
  PID:12056
- C:\Windows\System\RIgplwo.exe
  C:\Windows\System\RIgplwo.exe
  2⤵
  PID:12076
- C:\Windows\System\YrkDFBM.exe
  C:\Windows\System\YrkDFBM.exe
  2⤵
  PID:12100
- C:\Windows\System\ItehaId.exe
  C:\Windows\System\ItehaId.exe
  2⤵
  PID:12120
- C:\Windows\System\kIqJRSx.exe
  C:\Windows\System\kIqJRSx.exe
  2⤵
  PID:12140
- C:\Windows\System\YUAvRHI.exe
  C:\Windows\System\YUAvRHI.exe
  2⤵
  PID:12156
- C:\Windows\System\KnyYuwB.exe
  C:\Windows\System\KnyYuwB.exe
  2⤵
  PID:12176
- C:\Windows\System\frQmhjX.exe
  C:\Windows\System\frQmhjX.exe
  2⤵
  PID:12200
- C:\Windows\System\gGlbNIE.exe
  C:\Windows\System\gGlbNIE.exe
  2⤵
  PID:12216
- C:\Windows\System\oIWYbBg.exe
  C:\Windows\System\oIWYbBg.exe
  2⤵
  PID:12232
- C:\Windows\System\LjFEZTl.exe
  C:\Windows\System\LjFEZTl.exe
  2⤵
  PID:12248
- C:\Windows\System\cJOqvGF.exe
  C:\Windows\System\cJOqvGF.exe
  2⤵
  PID:12272
- C:\Windows\System\nBBRiDR.exe
  C:\Windows\System\nBBRiDR.exe
  2⤵
  PID:7812
- C:\Windows\System\rwaExQT.exe
  C:\Windows\System\rwaExQT.exe
  2⤵
  PID:8860
- C:\Windows\System\NqyFIjc.exe
  C:\Windows\System\NqyFIjc.exe
  2⤵
  PID:10480
- C:\Windows\System\EMdWRKX.exe
  C:\Windows\System\EMdWRKX.exe
  2⤵
  PID:10540
- C:\Windows\System\ouGhHAK.exe
  C:\Windows\System\ouGhHAK.exe
  2⤵
  PID:10416
- C:\Windows\System\cBHXIkk.exe
  C:\Windows\System\cBHXIkk.exe
  2⤵
  PID:10584
- C:\Windows\System\OeuErOU.exe
  C:\Windows\System\OeuErOU.exe
  2⤵
  PID:9172
- C:\Windows\System\XVbXJbV.exe
  C:\Windows\System\XVbXJbV.exe
  2⤵
  PID:10744
- C:\Windows\System\ipUTdbp.exe
  C:\Windows\System\ipUTdbp.exe
  2⤵
  PID:10776
- C:\Windows\System\hSXSIdf.exe
  C:\Windows\System\hSXSIdf.exe
  2⤵
  PID:10876
- C:\Windows\System\GjLGyxZ.exe
  C:\Windows\System\GjLGyxZ.exe
  2⤵
  PID:10932
- C:\Windows\System\ahnqVeg.exe
  C:\Windows\System\ahnqVeg.exe
  2⤵
  PID:10972
- C:\Windows\System\paZMfnz.exe
  C:\Windows\System\paZMfnz.exe
  2⤵
  PID:11008
- C:\Windows\System\rfYJGyB.exe
  C:\Windows\System\rfYJGyB.exe
  2⤵
  PID:11048
- C:\Windows\System\nXYGOMv.exe
  C:\Windows\System\nXYGOMv.exe
  2⤵
  PID:11112
- C:\Windows\System\aQQgosY.exe
  C:\Windows\System\aQQgosY.exe
  2⤵
  PID:11152
- C:\Windows\System\gubXCdY.exe
  C:\Windows\System\gubXCdY.exe
  2⤵
  PID:9000
- C:\Windows\System\jBrWTXm.exe
  C:\Windows\System\jBrWTXm.exe
  2⤵
  PID:9248
- C:\Windows\System\MQyTkHD.exe
  C:\Windows\System\MQyTkHD.exe
  2⤵
  PID:4536
- C:\Windows\System\vveCyjR.exe
  C:\Windows\System\vveCyjR.exe
  2⤵
  PID:9108
- C:\Windows\System\MaQQKyH.exe
  C:\Windows\System\MaQQKyH.exe
  2⤵
  PID:11560
- C:\Windows\System\dSxKOZE.exe
  C:\Windows\System\dSxKOZE.exe
  2⤵
  PID:11704
- C:\Windows\System\CrqQshN.exe
  C:\Windows\System\CrqQshN.exe
  2⤵
  PID:10208
- C:\Windows\System\eGeszRL.exe
  C:\Windows\System\eGeszRL.exe
  2⤵
  PID:11816
- C:\Windows\System\VWYheZF.exe
  C:\Windows\System\VWYheZF.exe
  2⤵
  PID:11828
- C:\Windows\System\GZLcxMt.exe
  C:\Windows\System\GZLcxMt.exe
  2⤵
  PID:11856
- C:\Windows\System\aATjaAG.exe
  C:\Windows\System\aATjaAG.exe
  2⤵
  PID:4032
- C:\Windows\System\ebnhOvA.exe
  C:\Windows\System\ebnhOvA.exe
  2⤵
  PID:7492
- C:\Windows\System\SLHMrvS.exe
  C:\Windows\System\SLHMrvS.exe
  2⤵
  PID:3284
- C:\Windows\System\FiqRPUf.exe
  C:\Windows\System\FiqRPUf.exe
  2⤵
  PID:9408
- C:\Windows\System\BZUjLfQ.exe
  C:\Windows\System\BZUjLfQ.exe
  2⤵
  PID:9460
- C:\Windows\System\FBSRNJD.exe
  C:\Windows\System\FBSRNJD.exe
  2⤵
  PID:1916
- C:\Windows\System\nBXEbXW.exe
  C:\Windows\System\nBXEbXW.exe
  2⤵
  PID:9552
- C:\Windows\System\ElfPzXa.exe
  C:\Windows\System\ElfPzXa.exe
  2⤵
  PID:5244
- C:\Windows\System\hNRbqvq.exe
  C:\Windows\System\hNRbqvq.exe
  2⤵
  PID:9852
- C:\Windows\System\krEDfVr.exe
  C:\Windows\System\krEDfVr.exe
  2⤵
  PID:10020
- C:\Windows\System\mvAmXgE.exe
  C:\Windows\System\mvAmXgE.exe
  2⤵
  PID:11528
- C:\Windows\System\ThmJsJB.exe
  C:\Windows\System\ThmJsJB.exe
  2⤵
  PID:10172
- C:\Windows\System\VEeMmjo.exe
  C:\Windows\System\VEeMmjo.exe
  2⤵
  PID:11604
- C:\Windows\System\FlKxhqL.exe
  C:\Windows\System\FlKxhqL.exe
  2⤵
  PID:11644
- C:\Windows\System\thHLPmc.exe
  C:\Windows\System\thHLPmc.exe
  2⤵
  PID:12168
- C:\Windows\System\SvGkKlN.exe
  C:\Windows\System\SvGkKlN.exe
  2⤵
  PID:11740
- C:\Windows\System\ngQnHbd.exe
  C:\Windows\System\ngQnHbd.exe
  2⤵
  PID:12244
- C:\Windows\System\rtSiIES.exe
  C:\Windows\System\rtSiIES.exe
  2⤵
  PID:12284
- C:\Windows\System\sWFapoq.exe
  C:\Windows\System\sWFapoq.exe
  2⤵
  PID:8968
- C:\Windows\System\XALIYvb.exe
  C:\Windows\System\XALIYvb.exe
  2⤵
  PID:10820
- C:\Windows\System\HEztHFv.exe
  C:\Windows\System\HEztHFv.exe
  2⤵
  PID:11436
- C:\Windows\System\udSiSHg.exe
  C:\Windows\System\udSiSHg.exe
  2⤵
  PID:12020
- C:\Windows\System\XvTqptm.exe
  C:\Windows\System\XvTqptm.exe
  2⤵
  PID:11476
- C:\Windows\System\QyFtVEf.exe
  C:\Windows\System\QyFtVEf.exe
  2⤵
  PID:11492
- C:\Windows\System\GlROocj.exe
  C:\Windows\System\GlROocj.exe
  2⤵
  PID:11592
- C:\Windows\System\WcpGTUj.exe
  C:\Windows\System\WcpGTUj.exe
  2⤵
  PID:11136
- C:\Windows\System\ukzuxGz.exe
  C:\Windows\System\ukzuxGz.exe
  2⤵
  PID:11252
- C:\Windows\System\TOdLwQn.exe
  C:\Windows\System\TOdLwQn.exe
  2⤵
  PID:11456
- C:\Windows\System\zYNspvm.exe
  C:\Windows\System\zYNspvm.exe
  2⤵
  PID:8800
- C:\Windows\System\pzgqPHn.exe
  C:\Windows\System\pzgqPHn.exe
  2⤵
  PID:11884
- C:\Windows\System\JzUhUbh.exe
  C:\Windows\System\JzUhUbh.exe
  2⤵
  PID:10628
- C:\Windows\System\ZpZSvun.exe
  C:\Windows\System\ZpZSvun.exe
  2⤵
  PID:12308
- C:\Windows\System\ILmYwSw.exe
  C:\Windows\System\ILmYwSw.exe
  2⤵
  PID:12332
- C:\Windows\System\qEbKwkc.exe
  C:\Windows\System\qEbKwkc.exe
  2⤵
  PID:12396
- C:\Windows\System\VSzhCKX.exe
  C:\Windows\System\VSzhCKX.exe
  2⤵
  PID:12412
- C:\Windows\System\bNuNDuj.exe
  C:\Windows\System\bNuNDuj.exe
  2⤵
  PID:12432
- C:\Windows\System\yxtioBX.exe
  C:\Windows\System\yxtioBX.exe
  2⤵
  PID:12460
- C:\Windows\System\gjboekk.exe
  C:\Windows\System\gjboekk.exe
  2⤵
  PID:12480
- C:\Windows\System\Qjcvfye.exe
  C:\Windows\System\Qjcvfye.exe
  2⤵
  PID:12496
- C:\Windows\System\wxRGDyN.exe
  C:\Windows\System\wxRGDyN.exe
  2⤵
  PID:12520
- C:\Windows\System\CdSwsWR.exe
  C:\Windows\System\CdSwsWR.exe
  2⤵
  PID:12544
- C:\Windows\System\PkQfUYc.exe
  C:\Windows\System\PkQfUYc.exe
  2⤵
  PID:12564
- C:\Windows\System\ZJThArh.exe
  C:\Windows\System\ZJThArh.exe
  2⤵
  PID:12584
- C:\Windows\System\ytHofvl.exe
  C:\Windows\System\ytHofvl.exe
  2⤵
  PID:12612
- C:\Windows\System\JeRgZbe.exe
  C:\Windows\System\JeRgZbe.exe
  2⤵
  PID:12632
- C:\Windows\System\CSdQOKV.exe
  C:\Windows\System\CSdQOKV.exe
  2⤵
  PID:12656
- C:\Windows\System\xTimcrg.exe
  C:\Windows\System\xTimcrg.exe
  2⤵
  PID:12680
- C:\Windows\System\WpuUIDC.exe
  C:\Windows\System\WpuUIDC.exe
  2⤵
  PID:12704
- C:\Windows\System\ZVisbVa.exe
  C:\Windows\System\ZVisbVa.exe
  2⤵
  PID:12724
- C:\Windows\System\gFAuiRF.exe
  C:\Windows\System\gFAuiRF.exe
  2⤵
  PID:12752
- C:\Windows\System\VeXBOrQ.exe
  C:\Windows\System\VeXBOrQ.exe
  2⤵
  PID:12772
- C:\Windows\System\RduowcB.exe
  C:\Windows\System\RduowcB.exe
  2⤵
  PID:12796
- C:\Windows\System\uhaxzON.exe
  C:\Windows\System\uhaxzON.exe
  2⤵
  PID:12816
- C:\Windows\System\VGqXAay.exe
  C:\Windows\System\VGqXAay.exe
  2⤵
  PID:12836
- C:\Windows\System\XLuvFdc.exe
  C:\Windows\System\XLuvFdc.exe
  2⤵
  PID:8116
- C:\Windows\System\dJeoqut.exe
  C:\Windows\System\dJeoqut.exe
  2⤵
  PID:5336
- C:\Windows\System\xPSyeLJ.exe
  C:\Windows\System\xPSyeLJ.exe
  2⤵
  PID:10784
- C:\Windows\System\nfLpmCu.exe
  C:\Windows\System\nfLpmCu.exe
  2⤵
  PID:10916
- C:\Windows\System\UeCbIRf.exe
  C:\Windows\System\UeCbIRf.exe
  2⤵
  PID:12468
- C:\Windows\System\epsgdsI.exe
  C:\Windows\System\epsgdsI.exe
  2⤵
  PID:11236
- C:\Windows\System\MSUjrAs.exe
  C:\Windows\System\MSUjrAs.exe
  2⤵
  PID:13140
- C:\Windows\System\kxiMxRE.exe
  C:\Windows\System\kxiMxRE.exe
  2⤵
  PID:12972
- C:\Windows\System\mLJMiKi.exe
  C:\Windows\System\mLJMiKi.exe
  2⤵
  PID:11228
- C:\Windows\System\NUnLRcA.exe
  C:\Windows\System\NUnLRcA.exe
  2⤵
  PID:12172
- C:\Windows\System\qDBKpVg.exe
  C:\Windows\System\qDBKpVg.exe
  2⤵
  PID:6364
- C:\Windows\System\tHoFWau.exe
  C:\Windows\System\tHoFWau.exe
  2⤵
  PID:10464
- C:\Windows\System\RmrLikH.exe
  C:\Windows\System\RmrLikH.exe
  2⤵
  PID:10792
- C:\Windows\System\icDqavo.exe
  C:\Windows\System\icDqavo.exe
  2⤵
  PID:10968
- C:\Windows\System\jiSwzqs.exe
  C:\Windows\System\jiSwzqs.exe
  2⤵
  PID:2580
- C:\Windows\System\TiKcLuE.exe
  C:\Windows\System\TiKcLuE.exe
  2⤵
  PID:12936
- C:\Windows\System\EqPeqQf.exe
  C:\Windows\System\EqPeqQf.exe
  2⤵
  PID:12304
- C:\Windows\System\iFlcaOS.exe
  C:\Windows\System\iFlcaOS.exe
  2⤵
  PID:9764
- C:\Windows\System\lzwsWev.exe
  C:\Windows\System\lzwsWev.exe
  2⤵
  PID:9840
- C:\Windows\System\GcKWtNO.exe
  C:\Windows\System\GcKWtNO.exe
  2⤵
  PID:12980
- C:\Windows\System\WPJbUfJ.exe
  C:\Windows\System\WPJbUfJ.exe
  2⤵
  PID:12516
- C:\Windows\System\WHmmYxw.exe
  C:\Windows\System\WHmmYxw.exe
  2⤵
  PID:11736
- C:\Windows\System\WZGzKnV.exe
  C:\Windows\System\WZGzKnV.exe
  2⤵
  PID:5352
- C:\Windows\System\zItOGmr.exe
  C:\Windows\System\zItOGmr.exe
  2⤵
  PID:11500
- C:\Windows\System\ijIRAyf.exe
  C:\Windows\System\ijIRAyf.exe
  2⤵
  PID:11244
- C:\Windows\System\kImOCjd.exe
  C:\Windows\System\kImOCjd.exe
  2⤵
  PID:12316
- C:\Windows\System\UvuqbNL.exe
  C:\Windows\System\UvuqbNL.exe
  2⤵
  PID:12440
- C:\Windows\System\LTnQRSr.exe
  C:\Windows\System\LTnQRSr.exe
  2⤵
  PID:3544
- C:\Windows\System\PhzFtKu.exe
  C:\Windows\System\PhzFtKu.exe
  2⤵
  PID:1072
- C:\Windows\System\ELnpIOY.exe
  C:\Windows\System\ELnpIOY.exe
  2⤵
  PID:12132
- C:\Windows\System\oZUbVGw.exe
  C:\Windows\System\oZUbVGw.exe
  2⤵
  PID:12324
- C:\Windows\System\KFYoawr.exe
  C:\Windows\System\KFYoawr.exe
  2⤵
  PID:12672
- C:\Windows\System\zSxlMsf.exe
  C:\Windows\System\zSxlMsf.exe
  2⤵
  PID:4184
- C:\Windows\System\QzNrknZ.exe
  C:\Windows\System\QzNrknZ.exe
  2⤵
  PID:2548
- C:\Windows\System\pjZtuCg.exe
  C:\Windows\System\pjZtuCg.exe
  2⤵
  PID:320
- C:\Windows\System\kOqmDEm.exe
  C:\Windows\System\kOqmDEm.exe
  2⤵
  PID:4888
- C:\Windows\System\srfVKTQ.exe
  C:\Windows\System\srfVKTQ.exe
  2⤵
  PID:9736
- C:\Windows\System\HFdWHHb.exe
  C:\Windows\System\HFdWHHb.exe
  2⤵
  PID:3164
- C:\Windows\System\EzHcyzN.exe
  C:\Windows\System\EzHcyzN.exe
  2⤵
  PID:12404
- C:\Windows\System\VSvSnyY.exe
  C:\Windows\System\VSvSnyY.exe
  2⤵
  PID:13036
- C:\Windows\System\bbsDYpe.exe
  C:\Windows\System\bbsDYpe.exe
  2⤵
  PID:12928
- C:\Windows\System\FEtsOex.exe
  C:\Windows\System\FEtsOex.exe
  2⤵
  PID:12904
- C:\Windows\System\aPAbjZR.exe
  C:\Windows\System\aPAbjZR.exe
  2⤵
  PID:12876
- C:\Windows\System\FVTTpuY.exe
  C:\Windows\System\FVTTpuY.exe
  2⤵
  PID:12848
- C:\Windows\System\aMTQrgz.exe
  C:\Windows\System\aMTQrgz.exe
  2⤵
  PID:12808
- C:\Windows\System\pdQAjFY.exe
  C:\Windows\System\pdQAjFY.exe
  2⤵
  PID:12604
- C:\Windows\System\Ipsuxiy.exe
  C:\Windows\System\Ipsuxiy.exe
  2⤵
  PID:12556
- C:\Windows\System\kFsQyAS.exe
  C:\Windows\System\kFsQyAS.exe
  2⤵
  PID:7164
- C:\Windows\System\jNDGUZY.exe
  C:\Windows\System\jNDGUZY.exe
  2⤵
  PID:13268
- C:\Windows\System\tVKTPWj.exe
  C:\Windows\System\tVKTPWj.exe
  2⤵
  PID:13172
- C:\Windows\System\ImXaZPn.exe
  C:\Windows\System\ImXaZPn.exe
  2⤵
  PID:1780
- C:\Windows\System\cbkuUme.exe
  C:\Windows\System\cbkuUme.exe
  2⤵
  PID:7708
- C:\Windows\System\YkSUHtA.exe
  C:\Windows\System\YkSUHtA.exe
  2⤵
  PID:10016
- C:\Windows\System\aIvyyfz.exe
  C:\Windows\System\aIvyyfz.exe
  2⤵
  PID:9200
- C:\Windows\System\KhsZdWp.exe
  C:\Windows\System\KhsZdWp.exe
  2⤵
  PID:12424
- C:\Windows\System\rhGbYvm.exe
  C:\Windows\System\rhGbYvm.exe
  2⤵
  PID:12868
- C:\Windows\System\TSVWzoV.exe
  C:\Windows\System\TSVWzoV.exe
  2⤵
  PID:12428
- C:\Windows\System\xEjcYqh.exe
  C:\Windows\System\xEjcYqh.exe
  2⤵
  PID:12880
- C:\Windows\System\fIjmxcE.exe
  C:\Windows\System\fIjmxcE.exe
  2⤵
  PID:1744
- C:\Windows\System\KnzSvys.exe
  C:\Windows\System\KnzSvys.exe
  2⤵
  PID:2372
- C:\Windows\System\PDSDglL.exe
  C:\Windows\System\PDSDglL.exe
  2⤵
  PID:12212
- C:\Windows\System\FJzZwKu.exe
  C:\Windows\System\FJzZwKu.exe
  2⤵
  PID:13200
- C:\Windows\System\veVOFlg.exe
  C:\Windows\System\veVOFlg.exe
  2⤵
  PID:6500
- C:\Windows\System\CCQhayU.exe
  C:\Windows\System\CCQhayU.exe
  2⤵
  PID:6828
- C:\Windows\System\CheAZwx.exe
  C:\Windows\System\CheAZwx.exe
  2⤵
  PID:12512
- C:\Windows\System\FvArSZQ.exe
  C:\Windows\System\FvArSZQ.exe
  2⤵
  PID:3336
- C:\Windows\System\bMtqmYy.exe
  C:\Windows\System\bMtqmYy.exe
  2⤵
  PID:12764
- C:\Windows\System\csYUqVC.exe
  C:\Windows\System\csYUqVC.exe
  2⤵
  PID:12944
- C:\Windows\System\qyImmYP.exe
  C:\Windows\System\qyImmYP.exe
  2⤵
  PID:3036
- C:\Windows\System\bgyvpPy.exe
  C:\Windows\System\bgyvpPy.exe
  2⤵
  PID:12976
- C:\Windows\System\ZUfIQoR.exe
  C:\Windows\System\ZUfIQoR.exe
  2⤵
  PID:2764
- C:\Windows\System\AKkjxdj.exe
  C:\Windows\System\AKkjxdj.exe
  2⤵
  PID:12988
- C:\Windows\System\rkZKxAE.exe
  C:\Windows\System\rkZKxAE.exe
  2⤵
  PID:12096
- C:\Windows\System\PGTxYHj.exe
  C:\Windows\System\PGTxYHj.exe
  2⤵
  PID:5100
- C:\Windows\System\KqZHHzq.exe
  C:\Windows\System\KqZHHzq.exe
  2⤵
  PID:3056
- C:\Windows\System\FgWHVMZ.exe
  C:\Windows\System\FgWHVMZ.exe
  2⤵
  PID:13020
- C:\Windows\System\IaRGptt.exe
  C:\Windows\System\IaRGptt.exe
  2⤵
  PID:1572
- C:\Windows\System\rXCCWJA.exe
  C:\Windows\System\rXCCWJA.exe
  2⤵
  PID:12116
- C:\Windows\System\TwMiIwn.exe
  C:\Windows\System\TwMiIwn.exe
  2⤵
  PID:1064
- C:\Windows\System\gPSIbLq.exe
  C:\Windows\System\gPSIbLq.exe
  2⤵
  PID:12652
- C:\Windows\System\hELfNpk.exe
  C:\Windows\System\hELfNpk.exe
  2⤵
  PID:13556
- C:\Windows\System\GBXStAI.exe
  C:\Windows\System\GBXStAI.exe
  2⤵
  PID:13572
- C:\Windows\System\DtevFzA.exe
  C:\Windows\System\DtevFzA.exe
  2⤵
  PID:13600
- C:\Windows\System\QJrYMun.exe
  C:\Windows\System\QJrYMun.exe
  2⤵
  PID:13620
- C:\Windows\System\PhbeSzI.exe
  C:\Windows\System\PhbeSzI.exe
  2⤵
  PID:13636
- C:\Windows\System\fMEOKwo.exe
  C:\Windows\System\fMEOKwo.exe
  2⤵
  PID:13652
- C:\Windows\System\lInYETm.exe
  C:\Windows\System\lInYETm.exe
  2⤵
  PID:13668
- C:\Windows\System\KUhvRLt.exe
  C:\Windows\System\KUhvRLt.exe
  2⤵
  PID:13708
- C:\Windows\System\DFLFOND.exe
  C:\Windows\System\DFLFOND.exe
  2⤵
  PID:13724
- C:\Windows\System\UQBrxPt.exe
  C:\Windows\System\UQBrxPt.exe
  2⤵
  PID:13748
- C:\Windows\System\ginPUMS.exe
  C:\Windows\System\ginPUMS.exe
  2⤵
  PID:13780
- C:\Windows\System\jKsjjoz.exe
  C:\Windows\System\jKsjjoz.exe
  2⤵
  PID:13792
- C:\Windows\System\dtJgJok.exe
  C:\Windows\System\dtJgJok.exe
  2⤵
  PID:13804
- C:\Windows\System\rJMLuIq.exe
  C:\Windows\System\rJMLuIq.exe
  2⤵
  PID:13848
- C:\Windows\System\yIANqKm.exe
  C:\Windows\System\yIANqKm.exe
  2⤵
  PID:13924
- C:\Windows\System\LVJEbPC.exe
  C:\Windows\System\LVJEbPC.exe
  2⤵
  PID:13996
- C:\Windows\System\apTHsay.exe
  C:\Windows\System\apTHsay.exe
  2⤵
  PID:14064
- C:\Windows\System\WrJPaCy.exe
  C:\Windows\System\WrJPaCy.exe
  2⤵
  PID:14156
- C:\Windows\System\wBMQdNL.exe
  C:\Windows\System\wBMQdNL.exe
  2⤵
  PID:3604
- C:\Windows\System\YQeaUuv.exe
  C:\Windows\System\YQeaUuv.exe
  2⤵
  PID:14152
- C:\Windows\System\LdNCxDB.exe
  C:\Windows\System\LdNCxDB.exe
  2⤵
  PID:2996
- C:\Windows\System\KwNsaSC.exe
  C:\Windows\System\KwNsaSC.exe
  2⤵
  PID:14200
- C:\Windows\System\rbQwpKU.exe
  C:\Windows\System\rbQwpKU.exe
  2⤵
  PID:14224
- C:\Windows\System\kOzrrqE.exe
  C:\Windows\System\kOzrrqE.exe
  2⤵
  PID:14276
- C:\Windows\System\zWzTaWi.exe
  C:\Windows\System\zWzTaWi.exe
  2⤵
  PID:13328
- C:\Windows\System\tMeZKIw.exe
  C:\Windows\System\tMeZKIw.exe
  2⤵
  PID:2780
- C:\Windows\System\vSPcxvg.exe
  C:\Windows\System\vSPcxvg.exe
  2⤵
  PID:13964
- C:\Windows\System\sYQdNdJ.exe
  C:\Windows\System\sYQdNdJ.exe
  2⤵
  PID:13968
- C:\Windows\System\ztQfPkG.exe
  C:\Windows\System\ztQfPkG.exe
  2⤵
  PID:13932
- C:\Windows\System\MBfJFhl.exe
  C:\Windows\System\MBfJFhl.exe
  2⤵
  PID:14048
- C:\Windows\System\fJQnISn.exe
  C:\Windows\System\fJQnISn.exe
  2⤵
  PID:13840
- C:\Windows\System\WTHUyyi.exe
  C:\Windows\System\WTHUyyi.exe
  2⤵
  PID:14036
- C:\Windows\System\NrZJMrG.exe
  C:\Windows\System\NrZJMrG.exe
  2⤵
  PID:13448
- C:\Windows\System\ksvcbhk.exe
  C:\Windows\System\ksvcbhk.exe
  2⤵
  PID:13500
- C:\Windows\System\guZoVkg.exe
  C:\Windows\System\guZoVkg.exe
  2⤵
  PID:12888
- C:\Windows\System\OBmjSDt.exe
  C:\Windows\System\OBmjSDt.exe
  2⤵
  PID:1620
- C:\Windows\System\WIPFlem.exe
  C:\Windows\System\WIPFlem.exe
  2⤵
  PID:3260
- C:\Windows\System\gbFUzBE.exe
  C:\Windows\System\gbFUzBE.exe
  2⤵
  PID:13428
- C:\Windows\System\yZVqHxT.exe
  C:\Windows\System\yZVqHxT.exe
  2⤵
  PID:13452
- C:\Windows\System\CRdzZSf.exe
  C:\Windows\System\CRdzZSf.exe
  2⤵
  PID:13524
- C:\Windows\System\wuhhwvy.exe
  C:\Windows\System\wuhhwvy.exe
  2⤵
  PID:13596
- C:\Windows\System\yhAjrrs.exe
  C:\Windows\System\yhAjrrs.exe
  2⤵
  PID:13760
- C:\Windows\System\QtipmLl.exe
  C:\Windows\System\QtipmLl.exe
  2⤵
  PID:13876
- C:\Windows\System\EXEXagU.exe
  C:\Windows\System\EXEXagU.exe
  2⤵
  PID:13936
- C:\Windows\System\uPKnNMC.exe
  C:\Windows\System\uPKnNMC.exe
  2⤵
  PID:14296
- C:\Windows\System\xfzIgAx.exe
  C:\Windows\System\xfzIgAx.exe
  2⤵
  PID:14192
- C:\Windows\System\OtaiVzt.exe
  C:\Windows\System\OtaiVzt.exe
  2⤵
  PID:656
- C:\Windows\System\xuUlMJO.exe
  C:\Windows\System\xuUlMJO.exe
  2⤵
  PID:3888
- C:\Windows\System\DSDSvDM.exe
  C:\Windows\System\DSDSvDM.exe
  2⤵
  PID:13324
- C:\Windows\System\GWkvISH.exe
  C:\Windows\System\GWkvISH.exe
  2⤵
  PID:4036
- C:\Windows\System\QzqFSPE.exe
  C:\Windows\System\QzqFSPE.exe
  2⤵
  PID:3308
- C:\Windows\System\VmndKIK.exe
  C:\Windows\System\VmndKIK.exe
  2⤵
  PID:5012
- C:\Windows\System\dcVFDfm.exe
  C:\Windows\System\dcVFDfm.exe
  2⤵
  PID:13492
- C:\Windows\System\vALxbWe.exe
  C:\Windows\System\vALxbWe.exe
  2⤵
  PID:13512
- C:\Windows\System\KrjhXwu.exe
  C:\Windows\System\KrjhXwu.exe
  2⤵
  PID:13564
- C:\Windows\System\iMjbaLH.exe
  C:\Windows\System\iMjbaLH.exe
  2⤵
  PID:13628
- C:\Windows\System\kaDKvpp.exe
  C:\Windows\System\kaDKvpp.exe
  2⤵
  PID:13660
- C:\Windows\System\kSKcEhL.exe
  C:\Windows\System\kSKcEhL.exe
  2⤵
  PID:13828
- C:\Windows\System\yZVqQdl.exe
  C:\Windows\System\yZVqQdl.exe
  2⤵
  PID:13700
- C:\Windows\System\pxzvELh.exe
  C:\Windows\System\pxzvELh.exe
  2⤵
  PID:13768
- C:\Windows\System\eqSJoHz.exe
  C:\Windows\System\eqSJoHz.exe
  2⤵
  PID:13952
- C:\Windows\System\UJLXUnx.exe
  C:\Windows\System\UJLXUnx.exe
  2⤵
  PID:4996
- C:\Windows\System\IqAjMaX.exe
  C:\Windows\System\IqAjMaX.exe
  2⤵
  PID:14212
- C:\Windows\System\YBwMRmp.exe
  C:\Windows\System\YBwMRmp.exe
  2⤵
  PID:14292
- C:\Windows\System\brpskpD.exe
  C:\Windows\System\brpskpD.exe
  2⤵
  PID:2080
- C:\Windows\System\GBBLnxG.exe
  C:\Windows\System\GBBLnxG.exe
  2⤵
  PID:3396
- C:\Windows\System\spxVIqA.exe
  C:\Windows\System\spxVIqA.exe
  2⤵
  PID:2024
- C:\Windows\System\jkwyPkZ.exe
  C:\Windows\System\jkwyPkZ.exe
  2⤵
  PID:13348
- C:\Windows\System\xgIJYZd.exe
  C:\Windows\System\xgIJYZd.exe
  2⤵
  PID:2604
- C:\Windows\System\nubghls.exe
  C:\Windows\System\nubghls.exe
  2⤵
  PID:13476
- C:\Windows\System\PFYRerl.exe
  C:\Windows\System\PFYRerl.exe
  2⤵
  PID:4244
- C:\Windows\System\OUYuhZw.exe
  C:\Windows\System\OUYuhZw.exe
  2⤵
  PID:13440
- C:\Windows\System\OuASsMF.exe
  C:\Windows\System\OuASsMF.exe
  2⤵
  PID:13516
- C:\Windows\System\xKZvbsy.exe
  C:\Windows\System\xKZvbsy.exe
  2⤵
  PID:5988
- C:\Windows\System\bnjVwOr.exe
  C:\Windows\System\bnjVwOr.exe
  2⤵
  PID:13552
- C:\Windows\System\xQpXKvq.exe
  C:\Windows\System\xQpXKvq.exe
  2⤵
  PID:5276
- C:\Windows\System\GEYVWmT.exe
  C:\Windows\System\GEYVWmT.exe
  2⤵
  PID:13824
- C:\Windows\System\ojPpAIi.exe
  C:\Windows\System\ojPpAIi.exe
  2⤵
  PID:13900
- C:\Windows\System\CTopHro.exe
  C:\Windows\System\CTopHro.exe
  2⤵
  PID:5728
- C:\Windows\System\IRkdEBv.exe
  C:\Windows\System\IRkdEBv.exe
  2⤵
  PID:5220
- C:\Windows\System\DldjGsH.exe
  C:\Windows\System\DldjGsH.exe
  2⤵
  PID:5636
- C:\Windows\System\cVKiwEg.exe
  C:\Windows\System\cVKiwEg.exe
  2⤵
  PID:14252
- C:\Windows\System\WWVKOrR.exe
  C:\Windows\System\WWVKOrR.exe
  2⤵
  PID:14112
- C:\Windows\System\uycypnk.exe
  C:\Windows\System\uycypnk.exe
  2⤵
  PID:2508
- C:\Windows\System\YwBQQfh.exe
  C:\Windows\System\YwBQQfh.exe
  2⤵
  PID:3580
- C:\Windows\System\HNVlOtx.exe
  C:\Windows\System\HNVlOtx.exe
  2⤵
  PID:2636
- C:\Windows\System\fGnayca.exe
  C:\Windows\System\fGnayca.exe
  2⤵
  PID:2728
- C:\Windows\System\OqTafng.exe
  C:\Windows\System\OqTafng.exe
  2⤵
  PID:6624
- C:\Windows\System\KwBdyuD.exe
  C:\Windows\System\KwBdyuD.exe
  2⤵
  PID:2036
- C:\Windows\System\KhDrLhR.exe
  C:\Windows\System\KhDrLhR.exe
  2⤵
  PID:6704
- C:\Windows\System\TwJMsCj.exe
  C:\Windows\System\TwJMsCj.exe
  2⤵
  PID:6820
- C:\Windows\System\EJCRbDP.exe
  C:\Windows\System\EJCRbDP.exe
  2⤵
  PID:5368
- C:\Windows\System\iUISVYV.exe
  C:\Windows\System\iUISVYV.exe
  2⤵
  PID:5388
- C:\Windows\System\cMeMhBZ.exe
  C:\Windows\System\cMeMhBZ.exe
  2⤵
  PID:6840
- C:\Windows\System\zWHHSUQ.exe
  C:\Windows\System\zWHHSUQ.exe
  2⤵
  PID:6656
- C:\Windows\System\cfjuGbX.exe
  C:\Windows\System\cfjuGbX.exe
  2⤵
  PID:13820
- C:\Windows\System\paxugAm.exe
  C:\Windows\System\paxugAm.exe
  2⤵
  PID:4220
- C:\Windows\System\BCQMynn.exe
  C:\Windows\System\BCQMynn.exe
  2⤵
  PID:5832
- C:\Windows\System\JDaLPzg.exe
  C:\Windows\System\JDaLPzg.exe
  2⤵
  PID:6208
- C:\Windows\System\DFYbOar.exe
  C:\Windows\System\DFYbOar.exe
  2⤵
  PID:14208
- C:\Windows\System\wHLNnln.exe
  C:\Windows\System\wHLNnln.exe
  2⤵
  PID:6388
- C:\Windows\System\RXjosTG.exe
  C:\Windows\System\RXjosTG.exe
  2⤵
  PID:6620
- C:\Windows\System\bshGWvz.exe
  C:\Windows\System\bshGWvz.exe
  2⤵
  PID:2192
- C:\Windows\System\aXDMMXQ.exe
  C:\Windows\System\aXDMMXQ.exe
  2⤵
  PID:6992
- C:\Windows\System\tlaobUR.exe
  C:\Windows\System\tlaobUR.exe
  2⤵
  PID:13692
- C:\Windows\System\uxjNrbB.exe
  C:\Windows\System\uxjNrbB.exe
  2⤵
  PID:7144
- C:\Windows\System\uzMgyKt.exe
  C:\Windows\System\uzMgyKt.exe
  2⤵
  PID:6824
- C:\Windows\System\urVjTZp.exe
  C:\Windows\System\urVjTZp.exe
  2⤵
  PID:6832
- C:\Windows\System\WfSixRi.exe
  C:\Windows\System\WfSixRi.exe
  2⤵
  PID:7936
- C:\Windows\System\sxuBdvE.exe
  C:\Windows\System\sxuBdvE.exe
  2⤵
  PID:6636
- C:\Windows\System\xFdIJca.exe
  C:\Windows\System\xFdIJca.exe
  2⤵
  PID:6852
- C:\Windows\System\mCiMOGd.exe
  C:\Windows\System\mCiMOGd.exe
  2⤵
  PID:6716
- C:\Windows\System\GcvwGpE.exe
  C:\Windows\System\GcvwGpE.exe
  2⤵
  PID:8156
- C:\Windows\System\ZFDnfHP.exe
  C:\Windows\System\ZFDnfHP.exe
  2⤵
  PID:6904
- C:\Windows\System\aJhSpyd.exe
  C:\Windows\System\aJhSpyd.exe
  2⤵
  PID:6928
- C:\Windows\System\scaPCCY.exe
  C:\Windows\System\scaPCCY.exe
  2⤵
  PID:5888
- C:\Windows\System\JcUlkJA.exe
  C:\Windows\System\JcUlkJA.exe
  2⤵
  PID:6252
- C:\Windows\System\IzAhtyV.exe
  C:\Windows\System\IzAhtyV.exe
  2⤵
  PID:8316
- C:\Windows\System\YBYbNds.exe
  C:\Windows\System\YBYbNds.exe
  2⤵
  PID:7232
- C:\Windows\System\mLOzHNN.exe
  C:\Windows\System\mLOzHNN.exe
  2⤵
  PID:6784
- C:\Windows\System\ZKxnYaE.exe
  C:\Windows\System\ZKxnYaE.exe
  2⤵
  PID:7000
- C:\Windows\System\eJGhAWl.exe
  C:\Windows\System\eJGhAWl.exe
  2⤵
  PID:10864
- C:\Windows\System\QdjBCwv.exe
  C:\Windows\System\QdjBCwv.exe
  2⤵
  PID:5192
- C:\Windows\System\nYTBzun.exe
  C:\Windows\System\nYTBzun.exe
  2⤵
  PID:7532
- C:\Windows\System\OgtDOVy.exe
  C:\Windows\System\OgtDOVy.exe
  2⤵
  PID:6204
- C:\Windows\System\sTpnIav.exe
  C:\Windows\System\sTpnIav.exe
  2⤵
  PID:7432
- C:\Windows\System\QTkBIhb.exe
  C:\Windows\System\QTkBIhb.exe
  2⤵
  PID:12128
- C:\Windows\System\eECLaNO.exe
  C:\Windows\System\eECLaNO.exe
  2⤵
  PID:8764
- C:\Windows\System\UpjkTeI.exe
  C:\Windows\System\UpjkTeI.exe
  2⤵
  PID:13580
- C:\Windows\System\NBWnuVl.exe
  C:\Windows\System\NBWnuVl.exe
  2⤵
  PID:7912
- C:\Windows\System\AouSNpA.exe
  C:\Windows\System\AouSNpA.exe
  2⤵
  PID:7900
- C:\Windows\System\VzYRwvS.exe
  C:\Windows\System\VzYRwvS.exe
  2⤵
  PID:7988
- C:\Windows\System\vgaWWdL.exe
  C:\Windows\System\vgaWWdL.exe
  2⤵
  PID:5680
- C:\Windows\System\kXUiKWA.exe
  C:\Windows\System\kXUiKWA.exe
  2⤵
  PID:5892
- C:\Windows\System\iEPZaGb.exe
  C:\Windows\System\iEPZaGb.exe
  2⤵
  PID:6780
- C:\Windows\System\XmUdwIn.exe
  C:\Windows\System\XmUdwIn.exe
  2⤵
  PID:8452
- C:\Windows\System\kzqOiiW.exe
  C:\Windows\System\kzqOiiW.exe
  2⤵
  PID:2992
- C:\Windows\System\rFGEDht.exe
  C:\Windows\System\rFGEDht.exe
  2⤵
  PID:8640
- C:\Windows\System\lmEuIfX.exe
  C:\Windows\System\lmEuIfX.exe
  2⤵
  PID:8692
- C:\Windows\System\AGjPPiF.exe
  C:\Windows\System\AGjPPiF.exe
  2⤵
  PID:6796
- C:\Windows\System\BagTcvE.exe
  C:\Windows\System\BagTcvE.exe
  2⤵
  PID:3844
- C:\Windows\System\mIsLJii.exe
  C:\Windows\System\mIsLJii.exe
  2⤵
  PID:13420
- C:\Windows\System\tYbpjej.exe
  C:\Windows\System\tYbpjej.exe
  2⤵
  PID:4892
- C:\Windows\System\WvDAaSa.exe
  C:\Windows\System\WvDAaSa.exe
  2⤵
  PID:9908
- C:\Windows\System\lSdPBHR.exe
  C:\Windows\System\lSdPBHR.exe
  2⤵
  PID:10092
- C:\Windows\System\KCArqJN.exe
  C:\Windows\System\KCArqJN.exe
  2⤵
  PID:5492
- C:\Windows\System\qvmyWLi.exe
  C:\Windows\System\qvmyWLi.exe
  2⤵
  PID:6844
- C:\Windows\System\LDSivhy.exe
  C:\Windows\System\LDSivhy.exe
  2⤵
  PID:8084
- C:\Windows\System\YbSVpNX.exe
  C:\Windows\System\YbSVpNX.exe
  2⤵
  PID:7948
- C:\Windows\System\rOxFCOd.exe
  C:\Windows\System\rOxFCOd.exe
  2⤵
  PID:6024
- C:\Windows\System\bmEoKXf.exe
  C:\Windows\System\bmEoKXf.exe
  2⤵
  PID:9524
- C:\Windows\System\ghtZjqR.exe
  C:\Windows\System\ghtZjqR.exe
  2⤵
  PID:6812
- C:\Windows\System\jwIjQhF.exe
  C:\Windows\System\jwIjQhF.exe
  2⤵
  PID:9732
- C:\Windows\System\KYwrSAt.exe
  C:\Windows\System\KYwrSAt.exe
  2⤵
  PID:8400
- C:\Windows\System\xPUkZBp.exe
  C:\Windows\System\xPUkZBp.exe
  2⤵
  PID:6616
- C:\Windows\System\EVDUpvB.exe
  C:\Windows\System\EVDUpvB.exe
  2⤵
  PID:6728
- C:\Windows\System\fZzfBut.exe
  C:\Windows\System\fZzfBut.exe
  2⤵
  PID:1768
- C:\Windows\System\IFBuLJc.exe
  C:\Windows\System\IFBuLJc.exe
  2⤵
  PID:7904
- C:\Windows\System\XPdbFsG.exe
  C:\Windows\System\XPdbFsG.exe
  2⤵
  PID:7584
- C:\Windows\System\wbpDnfm.exe
  C:\Windows\System\wbpDnfm.exe
  2⤵
  PID:4116
- C:\Windows\System\tMdLSXd.exe
  C:\Windows\System\tMdLSXd.exe
  2⤵
  PID:5272
- C:\Windows\System\BLxkmdX.exe
  C:\Windows\System\BLxkmdX.exe
  2⤵
  PID:8600
- C:\Windows\System\ymWjxbc.exe
  C:\Windows\System\ymWjxbc.exe
  2⤵
  PID:7944
- C:\Windows\System\ZVgqqaJ.exe
  C:\Windows\System\ZVgqqaJ.exe
  2⤵
  PID:11172
- C:\Windows\System\ZNWsRss.exe
  C:\Windows\System\ZNWsRss.exe
  2⤵
  PID:11216
- C:\Windows\System\NsxnkyX.exe
  C:\Windows\System\NsxnkyX.exe
  2⤵
  PID:8904
- C:\Windows\System\hhWdmpx.exe
  C:\Windows\System\hhWdmpx.exe
  2⤵
  PID:9224
- C:\Windows\System\HQJFsXP.exe
  C:\Windows\System\HQJFsXP.exe
  2⤵
  PID:9264
- C:\Windows\System\gZwfuSi.exe
  C:\Windows\System\gZwfuSi.exe
  2⤵
  PID:9064
- C:\Windows\System\LytEXLS.exe
  C:\Windows\System\LytEXLS.exe
  2⤵
  PID:10756
- C:\Windows\System\SHizRFf.exe
  C:\Windows\System\SHizRFf.exe
  2⤵
  PID:7748
- C:\Windows\System\JDWhwLT.exe
  C:\Windows\System\JDWhwLT.exe
  2⤵
  PID:9844
- C:\Windows\System\LetwhLD.exe
  C:\Windows\System\LetwhLD.exe
  2⤵
  PID:5568
- C:\Windows\System\joZGLVs.exe
  C:\Windows\System\joZGLVs.exe
  2⤵
  PID:8464
- C:\Windows\System\FOvdLYu.exe
  C:\Windows\System\FOvdLYu.exe
  2⤵
  PID:7116
- C:\Windows\System\SxWUrZK.exe
  C:\Windows\System\SxWUrZK.exe
  2⤵
  PID:11012
- C:\Windows\System\aCYZsuo.exe
  C:\Windows\System\aCYZsuo.exe
  2⤵
  PID:11108
- C:\Windows\System\NjlYIpc.exe
  C:\Windows\System\NjlYIpc.exe
  2⤵
  PID:11100
- C:\Windows\System\OhJVLnx.exe
  C:\Windows\System\OhJVLnx.exe
  2⤵
  PID:920
- C:\Windows\System\jwLoKBb.exe
  C:\Windows\System\jwLoKBb.exe
  2⤵
  PID:11036
- C:\Windows\System\hpfUpzC.exe
  C:\Windows\System\hpfUpzC.exe
  2⤵
  PID:7320
- C:\Windows\System\SupiQML.exe
  C:\Windows\System\SupiQML.exe
  2⤵
  PID:8572
- C:\Windows\System\kbjkyfs.exe
  C:\Windows\System\kbjkyfs.exe
  2⤵
  PID:7728
- C:\Windows\System\EhTulbO.exe
  C:\Windows\System\EhTulbO.exe
  2⤵
  PID:9932
- C:\Windows\System\bAjGTlK.exe
  C:\Windows\System\bAjGTlK.exe
  2⤵
  PID:9092
- C:\Windows\System\huYBrEY.exe
  C:\Windows\System\huYBrEY.exe
  2⤵
  PID:7764
- C:\Windows\System\IhngqVr.exe
  C:\Windows\System\IhngqVr.exe
  2⤵
  PID:10088
- C:\Windows\System\KityeFf.exe
  C:\Windows\System\KityeFf.exe
  2⤵
  PID:9952
- C:\Windows\System\RhbBQUf.exe
  C:\Windows\System\RhbBQUf.exe
  2⤵
  PID:8456
- C:\Windows\System\cXfdHPK.exe
  C:\Windows\System\cXfdHPK.exe
  2⤵
  PID:3616
- C:\Windows\System\hzJNJui.exe
  C:\Windows\System\hzJNJui.exe
  2⤵
  PID:7452
- C:\Windows\System\UxZhfHL.exe
  C:\Windows\System\UxZhfHL.exe
  2⤵
  PID:7228
- C:\Windows\System\CYYXgbA.exe
  C:\Windows\System\CYYXgbA.exe
  2⤵
  PID:2704
- C:\Windows\System\WKjEwMK.exe
  C:\Windows\System\WKjEwMK.exe
  2⤵
  PID:7476
- C:\Windows\System\RJVCUpz.exe
  C:\Windows\System\RJVCUpz.exe
  2⤵
  PID:8960
- C:\Windows\System\desULYt.exe
  C:\Windows\System\desULYt.exe
  2⤵
  PID:11292
- C:\Windows\System\LrDfMjf.exe
  C:\Windows\System\LrDfMjf.exe
  2⤵
  PID:11308
- C:\Windows\System\VBaSiDL.exe
  C:\Windows\System\VBaSiDL.exe
  2⤵
  PID:11332
- C:\Windows\System\IbSOWfU.exe
  C:\Windows\System\IbSOWfU.exe
  2⤵
  PID:9028
- C:\Windows\System\kaUGFQR.exe
  C:\Windows\System\kaUGFQR.exe
  2⤵
  PID:9784
- C:\Windows\System\PGXtLcL.exe
  C:\Windows\System\PGXtLcL.exe
  2⤵
  PID:8080
- C:\Windows\System\DIuJvsu.exe
  C:\Windows\System\DIuJvsu.exe
  2⤵
  PID:7156
- C:\Windows\System\nHryagj.exe
  C:\Windows\System\nHryagj.exe
  2⤵
  PID:10156
- C:\Windows\System\FFBMhXr.exe
  C:\Windows\System\FFBMhXr.exe
  2⤵
  PID:8088
- C:\Windows\System\ftXCmmn.exe
  C:\Windows\System\ftXCmmn.exe
  2⤵
  PID:9332
- C:\Windows\System\pyyLsgG.exe
  C:\Windows\System\pyyLsgG.exe
  2⤵
  PID:7280
- C:\Windows\System\OqdbJez.exe
  C:\Windows\System\OqdbJez.exe
  2⤵
  PID:7636
- C:\Windows\System\cbUNnzJ.exe
  C:\Windows\System\cbUNnzJ.exe
  2⤵
  PID:7424
- C:\Windows\System\TlPeHuX.exe
  C:\Windows\System\TlPeHuX.exe
  2⤵
  PID:5932
- C:\Windows\System\OzJqFzv.exe
  C:\Windows\System\OzJqFzv.exe
  2⤵
  PID:6452
- C:\Windows\System\GDGgsYq.exe
  C:\Windows\System\GDGgsYq.exe
  2⤵
  PID:10812
- C:\Windows\System\zbazddO.exe
  C:\Windows\System\zbazddO.exe
  2⤵
  PID:9680
- C:\Windows\System\HCnbuqg.exe
  C:\Windows\System\HCnbuqg.exe
  2⤵
  PID:11956
- C:\Windows\System\iuXjMaw.exe
  C:\Windows\System\iuXjMaw.exe
  2⤵
  PID:11540
- C:\Windows\System\azhHIoJ.exe
  C:\Windows\System\azhHIoJ.exe
  2⤵
  PID:10368
- C:\Windows\System\OeQUidT.exe
  C:\Windows\System\OeQUidT.exe
  2⤵
  PID:10996
- C:\Windows\System\iCBxYkG.exe
  C:\Windows\System\iCBxYkG.exe
  2⤵
  PID:8368
- C:\Windows\System\xLExtxe.exe
  C:\Windows\System\xLExtxe.exe
  2⤵
  PID:11852
- C:\Windows\System\MIQQIoX.exe
  C:\Windows\System\MIQQIoX.exe
  2⤵
  PID:14184
- C:\Windows\System\CmXfoZN.exe
  C:\Windows\System\CmXfoZN.exe
  2⤵
  PID:7244
- C:\Windows\System\HDZJBqj.exe
  C:\Windows\System\HDZJBqj.exe
  2⤵
  PID:10188
- C:\Windows\System\cIqDIOO.exe
  C:\Windows\System\cIqDIOO.exe
  2⤵
  PID:12088
- C:\Windows\System\SjKcMqG.exe
  C:\Windows\System\SjKcMqG.exe
  2⤵
  PID:10192
- C:\Windows\System\QxlaaQx.exe
  C:\Windows\System\QxlaaQx.exe
  2⤵
  PID:8284
- C:\Windows\System\RYqUfab.exe
  C:\Windows\System\RYqUfab.exe
  2⤵
  PID:10844
- C:\Windows\System\ILylcAs.exe
  C:\Windows\System\ILylcAs.exe
  2⤵
  PID:10712
- C:\Windows\System\fObHtzj.exe
  C:\Windows\System\fObHtzj.exe
  2⤵
  PID:9692
- C:\Windows\System\PYkLagh.exe
  C:\Windows\System\PYkLagh.exe
  2⤵
  PID:11212
- C:\Windows\System\ZmRcLtT.exe
  C:\Windows\System\ZmRcLtT.exe
  2⤵
  PID:11144
- C:\Windows\System\NUcpTlE.exe
  C:\Windows\System\NUcpTlE.exe
  2⤵
  PID:6776
- C:\Windows\System\jtukCco.exe
  C:\Windows\System\jtukCco.exe
  2⤵
  PID:7048
- C:\Windows\System\hcNOCnd.exe
  C:\Windows\System\hcNOCnd.exe
  2⤵
  PID:7152
- C:\Windows\System\HbDqMoS.exe
  C:\Windows\System\HbDqMoS.exe
  2⤵
  PID:10152
- C:\Windows\System\uLQAPcK.exe
  C:\Windows\System\uLQAPcK.exe
  2⤵
  PID:9788
- C:\Windows\System\HxVULYY.exe
  C:\Windows\System\HxVULYY.exe
  2⤵
  PID:7364
- C:\Windows\System\GAyBTTP.exe
  C:\Windows\System\GAyBTTP.exe
  2⤵
  PID:6944
- C:\Windows\System\iwYURXr.exe
  C:\Windows\System\iwYURXr.exe
  2⤵
  PID:10060
- C:\Windows\System\WWuCoHL.exe
  C:\Windows\System\WWuCoHL.exe
  2⤵
  PID:11464
- C:\Windows\System\TwVcHaP.exe
  C:\Windows\System\TwVcHaP.exe
  2⤵
  PID:11160
- C:\Windows\System\nCEPsAG.exe
  C:\Windows\System\nCEPsAG.exe
  2⤵
  PID:12952
- C:\Windows\System\KeCBtGw.exe
  C:\Windows\System\KeCBtGw.exe
  2⤵
  PID:12968
- C:\Windows\System\PESTZof.exe
  C:\Windows\System\PESTZof.exe
  2⤵
  PID:7512
- C:\Windows\System\asfbaHB.exe
  C:\Windows\System\asfbaHB.exe
  2⤵
  PID:12476
- C:\Windows\System\ckAlmvw.exe
  C:\Windows\System\ckAlmvw.exe
  2⤵
  PID:11304
- C:\Windows\System\HDOsCPV.exe
  C:\Windows\System\HDOsCPV.exe
  2⤵
  PID:7956
- C:\Windows\System\MrwaOns.exe
  C:\Windows\System\MrwaOns.exe
  2⤵
  PID:9548
- C:\Windows\System\OStZHfm.exe
  C:\Windows\System\OStZHfm.exe
  2⤵
  PID:13132
- C:\Windows\System\OEtvduU.exe
  C:\Windows\System\OEtvduU.exe
  2⤵
  PID:12908
- C:\Windows\System\upzLJwL.exe
  C:\Windows\System\upzLJwL.exe
  2⤵
  PID:6736
- C:\Windows\System\LbfRyUA.exe
  C:\Windows\System\LbfRyUA.exe
  2⤵
  PID:13120
- C:\Windows\System\NrQZEOe.exe
  C:\Windows\System\NrQZEOe.exe
  2⤵
  PID:13272
- C:\Windows\System\whXENWO.exe
  C:\Windows\System\whXENWO.exe
  2⤵
  PID:9076
- C:\Windows\System\OGZzXFp.exe
  C:\Windows\System\OGZzXFp.exe
  2⤵
  PID:10556
- C:\Windows\System\gxWWqso.exe
  C:\Windows\System\gxWWqso.exe
  2⤵
  PID:7644
- C:\Windows\System\tDOLvtH.exe
  C:\Windows\System\tDOLvtH.exe
  2⤵
  PID:11524
- C:\Windows\System\LbGiFOI.exe
  C:\Windows\System\LbGiFOI.exe
  2⤵
  PID:3912
- C:\Windows\System\IlGBssM.exe
  C:\Windows\System\IlGBssM.exe
  2⤵
  PID:9632
- C:\Windows\System\qefyQNd.exe
  C:\Windows\System\qefyQNd.exe
  2⤵
  PID:11752
- C:\Windows\System\zINBJAK.exe
  C:\Windows\System\zINBJAK.exe
  2⤵
  PID:11484
- C:\Windows\System\TSnRFvR.exe
  C:\Windows\System\TSnRFvR.exe
  2⤵
  PID:10624
- C:\Windows\System\COXKbHp.exe
  C:\Windows\System\COXKbHp.exe
  2⤵
  PID:13232
- C:\Windows\System\IJOWMse.exe
  C:\Windows\System\IJOWMse.exe
  2⤵
  PID:8528
- C:\Windows\System\FlwcCau.exe
  C:\Windows\System\FlwcCau.exe
  2⤵
  PID:10444
- C:\Windows\System\NdDbFHc.exe
  C:\Windows\System\NdDbFHc.exe
  2⤵
  PID:9372
- C:\Windows\System\PEdnDWr.exe
  C:\Windows\System\PEdnDWr.exe
  2⤵
  PID:12064
- C:\Windows\System\GrKkgZU.exe
  C:\Windows\System\GrKkgZU.exe
  2⤵
  PID:8428
- C:\Windows\System\WKQRvBC.exe
  C:\Windows\System\WKQRvBC.exe
  2⤵
  PID:11968
- C:\Windows\System\aLrvszJ.exe
  C:\Windows\System\aLrvszJ.exe
  2⤵
  PID:11964
- C:\Windows\System\kzeKUaT.exe
  C:\Windows\System\kzeKUaT.exe
  2⤵
  PID:10828
- C:\Windows\System\FfyTqal.exe
  C:\Windows\System\FfyTqal.exe
  2⤵
  PID:10328
- C:\Windows\System\BLDKzxV.exe
  C:\Windows\System\BLDKzxV.exe
  2⤵
  PID:11328
- C:\Windows\System\rqaemYT.exe
  C:\Windows\System\rqaemYT.exe
  2⤵
  PID:12032
- C:\Windows\System\tyWwbkR.exe
  C:\Windows\System\tyWwbkR.exe
  2⤵
  PID:12268
- C:\Windows\System\mpjhREj.exe
  C:\Windows\System\mpjhREj.exe
  2⤵
  PID:11084
- C:\Windows\System\zhSaBVa.exe
  C:\Windows\System\zhSaBVa.exe
  2⤵
  PID:12720
- C:\Windows\System\tvDxwYo.exe
  C:\Windows\System\tvDxwYo.exe
  2⤵
  PID:12992
- C:\Windows\System\JGEyYBm.exe
  C:\Windows\System\JGEyYBm.exe
  2⤵
  PID:7032
- C:\Windows\System\HIqlxfD.exe
  C:\Windows\System\HIqlxfD.exe
  2⤵
  PID:12492
- C:\Windows\System\HQFXtsS.exe
  C:\Windows\System\HQFXtsS.exe
  2⤵
  PID:11140
- C:\Windows\System\FNdJXbE.exe
  C:\Windows\System\FNdJXbE.exe
  2⤵
  PID:8776
- C:\Windows\System\suMfobA.exe
  C:\Windows\System\suMfobA.exe
  2⤵
  PID:8176
- C:\Windows\System\rGopJNF.exe
  C:\Windows\System\rGopJNF.exe
  2⤵
  PID:12380
- C:\Windows\System\beqvCTg.exe
  C:\Windows\System\beqvCTg.exe
  2⤵
  PID:10808
- C:\Windows\System\ryaEklK.exe
  C:\Windows\System\ryaEklK.exe
  2⤵
  PID:1808
- C:\Windows\System\RMDEOEy.exe
  C:\Windows\System\RMDEOEy.exe
  2⤵
  PID:2208
- C:\Windows\System\pJosgQg.exe
  C:\Windows\System\pJosgQg.exe
  2⤵
  PID:9252
- C:\Windows\System\zUTaUfI.exe
  C:\Windows\System\zUTaUfI.exe
  2⤵
  PID:9720
- C:\Windows\System\VlfIoNz.exe
  C:\Windows\System\VlfIoNz.exe
  2⤵
  PID:11340
- C:\Windows\System\xPBgmlh.exe
  C:\Windows\System\xPBgmlh.exe
  2⤵
  PID:10568
- C:\Windows\System\lrmApfw.exe
  C:\Windows\System\lrmApfw.exe
  2⤵
  PID:13244
- C:\Windows\System\pIjlYKG.exe
  C:\Windows\System\pIjlYKG.exe
  2⤵
  PID:9676
- C:\Windows\System\LzvgcIy.exe
  C:\Windows\System\LzvgcIy.exe
  2⤵
  PID:13128
- C:\Windows\System\DbDxeZo.exe
  C:\Windows\System\DbDxeZo.exe
  2⤵
  PID:9740
- C:\Windows\System\qeJyRoR.exe
  C:\Windows\System\qeJyRoR.exe
  2⤵
  PID:7100
- C:\Windows\System\XaWcvyp.exe
  C:\Windows\System\XaWcvyp.exe
  2⤵
  PID:14288
- C:\Windows\System\DNaDkqY.exe
  C:\Windows\System\DNaDkqY.exe
  2⤵
  PID:11800
- C:\Windows\System\ToIQtWe.exe
  C:\Windows\System\ToIQtWe.exe
  2⤵
  PID:5944
- C:\Windows\System\QMqSZFX.exe
  C:\Windows\System\QMqSZFX.exe
  2⤵
  PID:1672
- C:\Windows\System\sKLFUXF.exe
  C:\Windows\System\sKLFUXF.exe
  2⤵
  PID:10244
- C:\Windows\System\NElOiSd.exe
  C:\Windows\System\NElOiSd.exe
  2⤵
  PID:11424
- C:\Windows\System\QLjQCFv.exe
  C:\Windows\System\QLjQCFv.exe
  2⤵
  PID:13988
- C:\Windows\System\SVhqnlK.exe
  C:\Windows\System\SVhqnlK.exe
  2⤵
  PID:6836
- C:\Windows\System\MFfjbZR.exe
  C:\Windows\System\MFfjbZR.exe
  2⤵
  PID:13116
- C:\Windows\System\ICXheTr.exe
  C:\Windows\System\ICXheTr.exe
  2⤵
  PID:6528
- C:\Windows\System\zcjJNXw.exe
  C:\Windows\System\zcjJNXw.exe
  2⤵
  PID:9616
- C:\Windows\System\UVnzLWQ.exe
  C:\Windows\System\UVnzLWQ.exe
  2⤵
  PID:9656
- C:\Windows\System\DZjRxQh.exe
  C:\Windows\System\DZjRxQh.exe
  2⤵
  PID:12628
- C:\Windows\System\UgoEIuT.exe
  C:\Windows\System\UgoEIuT.exe
  2⤵
  PID:11040
- C:\Windows\System\kkcGAES.exe
  C:\Windows\System\kkcGAES.exe
  2⤵
  PID:2272
- C:\Windows\System\vughiOB.exe
  C:\Windows\System\vughiOB.exe
  2⤵
  PID:7192
- C:\Windows\System\SFDQZeN.exe
  C:\Windows\System\SFDQZeN.exe
  2⤵
  PID:6932
- C:\Windows\System\tKQwMFU.exe
  C:\Windows\System\tKQwMFU.exe
  2⤵
  PID:10728
- C:\Windows\System\JIQIFPg.exe
  C:\Windows\System\JIQIFPg.exe
  2⤵
  PID:12592
- C:\Windows\System\EMJLvLR.exe
  C:\Windows\System\EMJLvLR.exe
  2⤵
  PID:12920
- C:\Windows\System\KLaBJPp.exe
  C:\Windows\System\KLaBJPp.exe
  2⤵
  PID:12644
- C:\Windows\System\UHUXJhu.exe
  C:\Windows\System\UHUXJhu.exe
  2⤵
  PID:2216
- C:\Windows\System\lEmLWAm.exe
  C:\Windows\System\lEmLWAm.exe
  2⤵
  PID:11336
- C:\Windows\System\BNkKuhm.exe
  C:\Windows\System\BNkKuhm.exe
  2⤵
  PID:12696
- C:\Windows\System\gUzxlDd.exe
  C:\Windows\System\gUzxlDd.exe
  2⤵
  PID:13096
- C:\Windows\System\bwsqHWU.exe
  C:\Windows\System\bwsqHWU.exe
  2⤵
  PID:7148
- C:\Windows\System\nJyXuFc.exe
  C:\Windows\System\nJyXuFc.exe
  2⤵
  PID:12784
- C:\Windows\System\AqHZsUZ.exe
  C:\Windows\System\AqHZsUZ.exe
  2⤵
  PID:6000
- C:\Windows\System\SykLpIR.exe
  C:\Windows\System\SykLpIR.exe
  2⤵
  PID:10504
- C:\Windows\System\RhaXVgL.exe
  C:\Windows\System\RhaXVgL.exe
  2⤵
  PID:12068
- C:\Windows\System\ItsGiiA.exe
  C:\Windows\System\ItsGiiA.exe
  2⤵
  PID:7620
- C:\Windows\System\zIcJVNh.exe
  C:\Windows\System\zIcJVNh.exe
  2⤵
  PID:13800
- C:\Windows\System\UwSfbyB.exe
  C:\Windows\System\UwSfbyB.exe
  2⤵
  PID:11988
- C:\Windows\System\cZHabTd.exe
  C:\Windows\System\cZHabTd.exe
  2⤵
  PID:12504
- C:\Windows\System\XvxVlJX.exe
  C:\Windows\System\XvxVlJX.exe
  2⤵
  PID:12716
- C:\Windows\System\nWaolgQ.exe
  C:\Windows\System\nWaolgQ.exe
  2⤵
  PID:11912
- C:\Windows\System\WcKfbul.exe
  C:\Windows\System\WcKfbul.exe
  2⤵
  PID:13040
- C:\Windows\System\ZCounZy.exe
  C:\Windows\System\ZCounZy.exe
  2⤵
  PID:7428
- C:\Windows\System\LyALbRo.exe
  C:\Windows\System\LyALbRo.exe
  2⤵
  PID:11628
- C:\Windows\System\lhHOqNQ.exe
  C:\Windows\System\lhHOqNQ.exe
  2⤵
  PID:8120
- C:\Windows\System\MhdSpGI.exe
  C:\Windows\System\MhdSpGI.exe
  2⤵
  PID:10928
- C:\Windows\System\fqeGoFx.exe
  C:\Windows\System\fqeGoFx.exe
  2⤵
  PID:10076
- C:\Windows\System\UtXdXjn.exe
  C:\Windows\System\UtXdXjn.exe
  2⤵
  PID:11232
- C:\Windows\System\QKExJKt.exe
  C:\Windows\System\QKExJKt.exe
  2⤵
  PID:11768
- C:\Windows\System\wxxzFKC.exe
  C:\Windows\System\wxxzFKC.exe
  2⤵
  PID:11192
- C:\Windows\System\KsbBYJQ.exe
  C:\Windows\System\KsbBYJQ.exe
  2⤵
  PID:8876
- C:\Windows\System\RtICPmh.exe
  C:\Windows\System\RtICPmh.exe
  2⤵
  PID:10988
- C:\Windows\System\wBfdFUt.exe
  C:\Windows\System\wBfdFUt.exe
  2⤵
  PID:13212
- C:\Windows\System\TZFxwtw.exe
  C:\Windows\System\TZFxwtw.exe
  2⤵
  PID:6080
- C:\Windows\System\gCTBsWd.exe
  C:\Windows\System\gCTBsWd.exe
  2⤵
  PID:13776
- C:\Windows\System\gEgvpDE.exe
  C:\Windows\System\gEgvpDE.exe
  2⤵
  PID:11904
- C:\Windows\System\jGYFmzd.exe
  C:\Windows\System\jGYFmzd.exe
  2⤵
  PID:628
- C:\Windows\System\LzRdiaB.exe
  C:\Windows\System\LzRdiaB.exe
  2⤵
  PID:13080
- C:\Windows\System\jbWCUnh.exe
  C:\Windows\System\jbWCUnh.exe
  2⤵
  PID:10132
- C:\Windows\System\imoprFL.exe
  C:\Windows\System\imoprFL.exe
  2⤵
  PID:9048
- C:\Windows\System\iQAsade.exe
  C:\Windows\System\iQAsade.exe
  2⤵
  PID:12364
- C:\Windows\System\rsLlhNy.exe
  C:\Windows\System\rsLlhNy.exe
  2⤵
  PID:6544
- C:\Windows\System\PHqKZDd.exe
  C:\Windows\System\PHqKZDd.exe
  2⤵
  PID:9752
- C:\Windows\System\jMNzIoO.exe
  C:\Windows\System\jMNzIoO.exe
  2⤵
  PID:11404
- C:\Windows\System\QEucYbZ.exe
  C:\Windows\System\QEucYbZ.exe
  2⤵
  PID:12744
- C:\Windows\System\oBQjZOt.exe
  C:\Windows\System\oBQjZOt.exe
  2⤵
  PID:11128
- C:\Windows\System\hDmnVzR.exe
  C:\Windows\System\hDmnVzR.exe
  2⤵
  PID:10324
- C:\Windows\System\oBFXCSu.exe
  C:\Windows\System\oBFXCSu.exe
  2⤵
  PID:10984
- C:\Windows\System\HxzXlby.exe
  C:\Windows\System\HxzXlby.exe
  2⤵
  PID:11116
- C:\Windows\System\xTqGgWT.exe
  C:\Windows\System\xTqGgWT.exe
  2⤵
  PID:4020
- C:\Windows\System\hVpeYWJ.exe
  C:\Windows\System\hVpeYWJ.exe
  2⤵
  PID:12344
- C:\Windows\System\UmTpFNq.exe
  C:\Windows\System\UmTpFNq.exe
  2⤵
  PID:2476
- C:\Windows\System\hKfMGHu.exe
  C:\Windows\System\hKfMGHu.exe
  2⤵
  PID:8404
- C:\Windows\System\WYBxjSC.exe
  C:\Windows\System\WYBxjSC.exe
  2⤵
  PID:13048
- C:\Windows\System\chcYBDA.exe
  C:\Windows\System\chcYBDA.exe
  2⤵
  PID:9892
- C:\Windows\System\hZlCMJC.exe
  C:\Windows\System\hZlCMJC.exe
  2⤵
  PID:14032
- C:\Windows\System\TXVZUwx.exe
  C:\Windows\System\TXVZUwx.exe
  2⤵
  PID:11520
- C:\Windows\System\MPAAQcm.exe
  C:\Windows\System\MPAAQcm.exe
  2⤵
  PID:2292
- C:\Windows\System\GTXjsKC.exe
  C:\Windows\System\GTXjsKC.exe
  2⤵
  PID:14352
- C:\Windows\System\ggxYENv.exe
  C:\Windows\System\ggxYENv.exe
  2⤵
  PID:14392
- C:\Windows\System\LbwIWhe.exe
  C:\Windows\System\LbwIWhe.exe
  2⤵
  PID:14420
- C:\Windows\System\hEwpGFN.exe
  C:\Windows\System\hEwpGFN.exe
  2⤵
  PID:14448
- C:\Windows\System\uRQsRwb.exe
  C:\Windows\System\uRQsRwb.exe
  2⤵
  PID:14476
- C:\Windows\System\cZqwbME.exe
  C:\Windows\System\cZqwbME.exe
  2⤵
  PID:14504
- C:\Windows\System\qrWPNdd.exe
  C:\Windows\System\qrWPNdd.exe
  2⤵
  PID:14520
- C:\Windows\System\pApckOO.exe
  C:\Windows\System\pApckOO.exe
  2⤵
  PID:14536
- C:\Windows\System\VjlYewl.exe
  C:\Windows\System\VjlYewl.exe
  2⤵
  PID:14556
- C:\Windows\System\luvociw.exe
  C:\Windows\System\luvociw.exe
  2⤵
  PID:14616

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13528

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_urulvonn.otn.psm1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVbbkMH.exe

Filesize
1.8MB

MD5
18d18e44a74cdf458ec1f63af66d519f

SHA1
22b774d1d3c3e5d4030154cc43d948d137281bf1

SHA256
3ea57249b118681307aa0f1d19c41f8c4d4d04c961998615ddc3ce42e1f76565

SHA512
6cca978e42f2a5b67579aa04571039639f724d79c989332a8658a035f7f63cca98a914fc4cbb765860d203062e9a755c6544754f5683d9b3bfcc7bfc2fabd026

Download Submit
C:\Windows\System\AjgLhWZ.exe

Filesize
1.8MB

MD5
4059e668f2d79601850dea6893111693

SHA1
f6e3f92b10d7fcda56c31c08674b3a235c87260e

SHA256
b9460102f8801a0762137c72703feb2fa6ce6930caf44ddb0fb7ec3a3f14da6f

SHA512
62fce7fb907fe5b26588697d435ba91a8035ff3c5454193b83da65000c324fcdcd54e3e454d4c0fd0fe30b1bb46b429389184517076fee6591b1ca734b8bc526

Download Submit
C:\Windows\System\BMZylzz.exe

Filesize
1.8MB

MD5
5f227994e3ec218d1a3916d2b8161329

SHA1
37f76d29837373e8525d3fa86aec1e5c4e2cf944

SHA256
173a09f776e2d3f6fde5daf09fa189e0fe10aeffd49a9a3d66de080529b610d9

SHA512
85b2b3cec61c2bf8df21f7f26297c0f348d93fe3280cca86c49d077a7b06d93ee2fa948afb803172e6d102465d8c47265225f318f773eab608743f2057230222

Download Submit
C:\Windows\System\DneKAWm.exe

Filesize
1.8MB

MD5
dcc4a198dfcf8ad584a75d9801a39c63

SHA1
f54a3a49cf2bde55c9ee15eb2406fd22d1a7af80

SHA256
6a19d6bf19f8d5710dbfe1ace6b8e8efff5f8a5ba09f579f30434f1d13c94dcf

SHA512
c81f7ed114ec6ec82ed54d59ba37f849a98a955c6260adbea6c339e673b4860ad765b4be27f1ce10f180d98179ef2d9e2580892595e6aaab2eadc3f41fac8c72

Download Submit
C:\Windows\System\FHpttlp.exe

Filesize
18B

MD5
af336c7ae3762c9807aefd390616669c

SHA1
93b316ce9e2ad369b0fcc70ad59b2313f711009c

SHA256
9668de7119efb9b23c3c368b2d727ed02615231a660e7ad7c3ab8319e470bda4

SHA512
daafdbf457f7ed1270ec4d453baa3047d254d74acd0059cddb1adfe20dc28783253f2fa96d0726b51c77e41214f869f41ad28cb24e3c9b3f46231510262d8768

Download Submit
C:\Windows\System\FvnkCoh.exe

Filesize
1.8MB

MD5
d7ccda6c6764b5822049bd50a9108f5f

SHA1
855899cbcaf8d18028333e36591d6cb472aa1559

SHA256
eaffe0967b8189923a2aa74d2d9ddd34e0691ca40f7b3ed7ad54133c639f22b5

SHA512
9f1675b4850064eb997a9450ba18bc89675c2b1648baec2a30b6b70553cf93fa40e14fc0225578981d3b7fd0e4f4a1afd8818487762898d212a9df3a79e37bc8

Download Submit
C:\Windows\System\GKhLabJ.exe

Filesize
1.8MB

MD5
34c69534e46170774feee83eac834716

SHA1
674951193c51c699dbe703ace2519b62858b525a

SHA256
b1a5537cd0414a0d0e58470191d1b200dff1706902ca48a5e53f33403905ba30

SHA512
b3a10084c21f9b74e9e89915bef954612d64a9c1c78976b7a09102eb86be42d6e98ce065de53cb38a22fc1467758a3fbded9c04834b771c7aad0166e1e7ac351

Download Submit
C:\Windows\System\HAHNMBg.exe

Filesize
1.8MB

MD5
11cfc88bca40da1b31c561f0195cf686

SHA1
1ae459855b279fe1ad93b95e7f662f4427fac591

SHA256
5add4f555272019b510aa3ba4157e22dc622627ccbf05d7f5b30391f63264088

SHA512
783089cfdb85ff1e2b64c8c9003e650bfb84ebb73298ac30640ff89ff7a5f02c55d6da7aaa65ee509f2bf2720dbc7340692c8524968a621bc17e8b3862580f1d

Download Submit
C:\Windows\System\HOIMuNa.exe

Filesize
1.8MB

MD5
6f20a4d3fd68be71c80766c46c6805a1

SHA1
15f90f19e280b853fdfb430e8f3a8ddf6e267312

SHA256
6d7a1ba18d9adda42327fccb9d36e45c1410a1a1a5b4627117762400e7da0b3c

SHA512
caaf784bc855fefb2a16fa8bb737c95faf057ff9427aa6e256fbfac9b824ce5fb18a5762e457a67affb1cca2c1150777e07b74e22c26ab9aa7c4e3eceb198d26

Download Submit
C:\Windows\System\IOIJfxF.exe

Filesize
1.8MB

MD5
251482905d536fae249f7ab5af09b6da

SHA1
a18cca89a440bd9cb490c98dba291618dc884010

SHA256
b23b18e1fc8a5b2538930c05ea3d13423a1cdbc2877110dbbf4ca997b4a6a6eb

SHA512
c676125bcca69e3fdb0eda1b641394c7b8cb834bc0de4879b79a8e0969229aca0b5f9b4789404e3a1beadb350cfeaf2f65fc9528dc4c0d598219ac10d1f2592c

Download Submit
C:\Windows\System\IsZNXjQ.exe

Filesize
1.8MB

MD5
70e511395f5f7298300f06fed1e5f2e3

SHA1
ed3e6c73e2b109c1b828930edffbf03bf5b287a0

SHA256
9e010ce5de722ec172df771f01e3e864e5870c7c514ea228274f5f0b7b10cf76

SHA512
9092e2e5f5abc4193d36931dce50f935337458806306b2d788e81a9caddb59451f7e76fea13781ceeb21c2bbf7da7e8dda355529c722ed6b500bcb275a11322a

Download Submit
C:\Windows\System\PGziZGP.exe

Filesize
8B

MD5
d33d66ea64213a11220ff46e1066e8c4

SHA1
11df077d45cb6c18dde351720388ac43664403a2

SHA256
b2aac390d4a70eec771d01aa85ea606c2fcf5e3b2ec05338e195df492df26016

SHA512
4f6272cb17b1ae9b4ebb9b755a9d4f83dd7a010a29db67c7a6463d91c58d4250809d9f6f8bdb747b657363c9141bbd4db149efd469384e92e75f03d0396ea32b

Download Submit
C:\Windows\System\REAFnzn.exe

Filesize
1.8MB

MD5
6296dbbb1ecae0d5db3ed97605cc9b0b

SHA1
7adcc037707f21e589965935381440fb8f0eb4d1

SHA256
72d061dca31779e0d87efada498201b858001c32f367ad15e1625c308b29691b

SHA512
a8d2a5c3addd6726fb2f801dfb317c336d6de4a354c8c31a7404d2f21752fa77404801a549ddd4a88c6f58afa48ddb785f43b8d911fae89a5b05043d9295a28c

Download Submit
C:\Windows\System\RIpiPtH.exe

Filesize
1.8MB

MD5
4c66c6a2fecc16948ee8c37199b13f6e

SHA1
ec263ad192daf7f8a52ac009f95468466e3bb4ba

SHA256
3b4151051c6c301e219dbcd86dcb77307def00c35ee563761b7a20d973412cdc

SHA512
756e1d37adad7b86f1c2d117fbac6b7b961a5aaa380fe33be4829f7b43d1b0536fccd60fd5071b0bcc4c3134ae48d82b1695b48c1230173c14479c03a592146e

Download Submit
C:\Windows\System\RirmQCE.exe

Filesize
1.8MB

MD5
44ac67c7d6d592bf939081a303a383d2

SHA1
03fdb326a0747eb905c5dd4b38e7fa9da2f2fc95

SHA256
183dabe009b4197d9b6655aa18f7c36555be871337aa71b5b82083a76f0c58d9

SHA512
a7e0410f368e4a21dbaaf31c74a4befc072c58031390d293fb447772cb451d0c8311cbaa8fda847fadfb12a4b8e8a69c2658710e2bb650fdbdb7866b4a122df7

Download Submit
C:\Windows\System\SBsKLeS.exe

Filesize
1.8MB

MD5
aeeb172973865cbd6d3a7d1e402e767d

SHA1
78fd5d4c64862fd77da811f068884d0bc02bd9cb

SHA256
0f3a41195034301bc41bd7384e739cc95013309cb2f0d18654bdb72c0dc5da29

SHA512
5f76946bdc6e716c82a6b36982c7610b482289e5768ef6377bf4052a493a55c866701b6050bfecb83274836da0c2b8c56c483f90385f28c5fe1a3122657fff79

Download Submit
C:\Windows\System\SWTQbcy.exe

Filesize
1.8MB

MD5
25502b435c2db0d7f1fefcccd826b07c

SHA1
dfce10826eaebf01bab7dffc6df0decf1cbd476a

SHA256
99d1911167c1ec648e7cb51919785eeba8ae9d1f218bdebf37770ec70487cd2c

SHA512
11158d2f84a6c27a9f2cf2ce557b2c406ff42eac81fa90fa1be5ac7ccf3069eacc7808de1599061b4fa4c4b6d9b22ef349df9cbaef8d1e39fa120d11b6f47f55

Download Submit
C:\Windows\System\UdaXkKY.exe

Filesize
1.8MB

MD5
6b48352b075fa141efda0b8dbf7564ad

SHA1
a38e338f8eb88d267c95896fc2a54f94171f4809

SHA256
27b8630427227fade2172ac7e7c747389ce5fb6b2af49774dc8faba8c4d8eb6a

SHA512
019cb021b22acc029520fe1c7e7fc401a7090ba2a90c38a87d744732cce88cc68549f26e1c6eea1f028ebacbb9552f9e49a506475fa7c41a314fda3eb455e8b1

Download Submit
C:\Windows\System\WdrzVkE.exe

Filesize
1.8MB

MD5
960ad75e36fe7d31e33f3c33b57097fe

SHA1
d0abcf916e532a477a290d9a16a7a2d9d6994c7f

SHA256
5e819101856469c33d5b549a2001dbc4bf82698e9266807eddce3e9f7630977a

SHA512
dcb3b16fe2f71feee869fc6789472b4b711df1232d1b663eacf7d54874c4d910eca09b3c95b528e2b563a428ab00df6694f1889e731d4de9c994d636253dd023

Download Submit
C:\Windows\System\XVDkJqS.exe

Filesize
1.8MB

MD5
3ed477df1549afffde3bb6200c9f8cad

SHA1
fb9297d5232d504a510cd04ec249c1b6068deddd

SHA256
677cff14ec0360631530a5b98258e70c466616a5c75c9f15bb6420455396d7f2

SHA512
f9afc7c97a82d2d2d25df067edb15df682a945bb5bb7d902f20ef92b7decde6a2e383bdbac2dc0003557091a06ac743231bd17b39366a0f3bb8f35aee53d3ec0

Download Submit
C:\Windows\System\YImnFTH.exe

Filesize
1.8MB

MD5
425dad879488e62a3eaf0a683e125164

SHA1
4f67426294213d751d506a0b98cbfeaaf14d982d

SHA256
f8a8d2868491a880c774b666e7ac27c6dba02deddb9bde1fe2e12482b3af7e9b

SHA512
dbc9a1c217adeb42cc28bb202125108143dd0bae66b5e043e03ddd2b333998b1556446100cfced31cde3b8549e8cabbfaac81e52381438c5027cdd1cdd744408

Download Submit
C:\Windows\System\YXEsOgO.exe

Filesize
1.8MB

MD5
0b555d377ef98206206dfb8cda001f85

SHA1
9b84e1b2705402bad086d1e21d90afb20439004c

SHA256
06540540191f58a5694230e7f870556ec58c9879cbdb6ad2691a888017d0e3fc

SHA512
eb4ccb2eda3f47772a3b17baf4268284039157c53953a047d6d1167011e2962e5896fc8c0a01c72c564e80d0712ff266702e3d164d6f422e5c2f4b3bafaaf7dc

Download Submit
C:\Windows\System\atiGQIG.exe

Filesize
1.8MB

MD5
7015f124c360ed8f2d1cccb7426cf37a

SHA1
124d3170f478dd139134d77e425f85048b257fd1

SHA256
4c62dedbea7647ae700809644728cfed0d19db49f7a35a5eb5924fcd4587297e

SHA512
305868940eb02ad752a148ca0c4acb936d4feb1e6d1671fa695e968e99b5f6dd9713cd106aafaca4cb168b9143f657421dd01c0549a1fcf6ff3f2cd3cb09e24a

Download Submit
C:\Windows\System\bPtsTNO.exe

Filesize
1.8MB

MD5
b21e52a699c780e007a99752867a2cde

SHA1
0ea23af0b5db604cc187e416d40b77dd95f0a342

SHA256
22b0ee9367513fe8630b754fb1a1dce2729740aac9d7b82bbf784c5a9cf385b8

SHA512
5fdebac0a6757ee52c038acddb55733d573f09665aba04382433779f962e8fbbb1755042f42201c861d93c8ab8c396014dd73d49b9e907a4c99441c46bc10bb5

Download Submit
C:\Windows\System\cytpSsM.exe

Filesize
1.8MB

MD5
ef58ae25b9709d00b0282aadc7741e48

SHA1
7569fc43ce732f316471bfaf941a4474431daad3

SHA256
b52411c4d049de0c7657ead8bd238cc78ef4155553d165731279a4e2ca1e1b94

SHA512
06d66b161eafe415cedebd1282bafda6eeb295a62cf9b8a09173b32b9dd4632ca94471f108a729aada62c07c0bc661971c7c7b462763ec4f0dbc6177c168c3e7

Download Submit
C:\Windows\System\ervTHBI.exe

Filesize
1.8MB

MD5
ad760f56de3d35a42d9f523cb074e66a

SHA1
523368bf04344fc1ff1fc3154335f3ed1026f987

SHA256
2745b5b35537c06a9994a209de554361abe40d7e5098caa07ad71544b78a6d4a

SHA512
b40452f21173d508e553fb8ab2a0c9d5fc6ea525da22c53f0d8f285b6acd0adcca1c17ceedba638a4bc2a92aa1771ac4e9621d89ca9424164588e3e9157b0920

Download Submit
C:\Windows\System\hYcUFwj.exe

Filesize
1.8MB

MD5
4c48845d164ed9b2ce224c4f5fc41272

SHA1
3ca03e1585b0b053f8f75199fad3077fec60faf3

SHA256
344a889a1b827eaf491b2b6e5eb3072cea9bbaf547151b905ba3357dc10c04fb

SHA512
c8283dcb411ca399bb72661cd29a5ab3d591d5f74d4dea33274cad4a3267fe12835392ba3c8b21fc40f10f3e4f61ae662eedda395e4140e5a7e4fc1f259f78aa

Download Submit
C:\Windows\System\hdphAQi.exe

Filesize
1.8MB

MD5
b6fe2b8f426ed85395e24c829c529ecf

SHA1
f4aa0de73175b4276d465859e2cc965573c98e28

SHA256
b1f5c38e9349a3691730cfcb9b7b4b4ce24625f82324b1839cc8e69ea984020b

SHA512
12fc665e431e32338a420ee656732847aec627fde8e82e57370eada30d59f558304d439a70dd902b8a674d9bd9c36a9f87e648dee154771ca93e8ca2711aa727

Download Submit
C:\Windows\System\lFPMuUL.exe

Filesize
1.8MB

MD5
6a8d694a6f843cfc70679c6094cff49f

SHA1
dcf0aa9c8fa802694cffb768201a4147c6c3c5ec

SHA256
e743d0aac9f3a1c9caf39b1ac294d4f82515f162b7cb64bb374d96e2c9b8c7b4

SHA512
ad560be158d0ac44c041e731c0dbc70feceefed77000a74def2b934c577fb0847beae795d8adb499cf10a8058f661b51f3bb4a5be52eb64f702f5e66db92103e

Download Submit
C:\Windows\System\lXKpmdc.exe

Filesize
1.8MB

MD5
e03b48671c02450a3919f892340ba8e9

SHA1
9954943dee0ce3f51b80d0b191e1566116faf630

SHA256
dcc028766ea1adb9ac83bd4c3e5d820f148a3e95a1e7e394ef4565477418d969

SHA512
b35ae4ea1e95bf7a1e7f989a45a1e7ff9b376a57f39d6d879f398b867d20dd52d33c42223eff14aba8814b6469553fa1ab79e69709d284a69caf852161452ef9

Download Submit
C:\Windows\System\likFyok.exe

Filesize
1.8MB

MD5
e2d73921c5c95071dc369bba65657cc8

SHA1
9bcae9d4807de6cff460b41ba1befd31a961b8f9

SHA256
b275d74c078b558dfa50aa8a6409a2f6e146ed61f0f25cac87ee445fabf59bec

SHA512
74d3c04ef5c6414792fd12521eb8587928258dea91737986fb48cd3ba1d4bb6544e00eb65fb09a342ea47828e9477237537800762f0faa6803819bd4ddcdfca2

Download Submit
C:\Windows\System\nZgBlrj.exe

Filesize
1.8MB

MD5
aa069abeff4e7dacd9b6c717ce974929

SHA1
180673c47764e0f282eb133628d33a16583e0c2c

SHA256
5f5e6fa4c6837437c372d1879ed1827bda9e1f28b574f495154e9de502738500

SHA512
c53870285750b98fa664e3225a1a1f0e88b4829c122ffa2beb768537d29a8d9f43630fa000365094d36f7fd1c1f16c72cb064d56296cd429869212c9a43515c5

Download Submit
C:\Windows\System\tDnCLgs.exe

Filesize
1.8MB

MD5
6bfd9a8b01a0a307d6a219b1a82adb27

SHA1
cbfea7c59817b5b5180a73bf3322b80a3e6ac97f

SHA256
747f82bae026d6f394c2d720036cc2430e152cbf1283291046ef98c8303ebeb7

SHA512
a157c23b5b2ea760e5e845ad17ee0a73d3352711b36e125c68ad002e0f507f5e71d86d60980db87c7ad45fc551a70f123955fe50b558f1d43ceec46cd78faf85

Download Submit
C:\Windows\System\tSHYWje.exe

Filesize
1.8MB

MD5
c05cc89f71a5567f1f0ecbdd58f6ab3c

SHA1
89d8abe8b470e1ce8b034395751a5f1352a46d9e

SHA256
e8929b36a51a7fcb34aca1bba702eeb38304df6b3829d83cac1e1d41f58b9f1a

SHA512
c16da020fe188ac7f2e1bae130a1b5116ceb55ec150a7ac003b8e9b6d7d7c0fa398f8ece8cdab7923c9d4d0c2cf1bb6859d5a0671f2f07d810207327cf435222

Download Submit
C:\Windows\System\vvTmNTa.exe

Filesize
1.8MB

MD5
f6658432456d66cc19bdbd302826b4b5

SHA1
6da5fe10d9ed662b201b733d267e3d4de159ff0d

SHA256
f22e776c422c6c53427280aac9a2a607475ff6b575737edb3ba5aab06a02c269

SHA512
347b882862ea806abbfafaa07d12af2dbb218ff1e4182647101bc15525436e34d6eb35af39c2c5b62fa9af61d49e4c340e7aa029f5a0088b2be23839f5a45ab9

Download Submit
C:\Windows\System\vwsEcEP.exe

Filesize
1.8MB

MD5
9d68e387924ec5d446f5864efe6c2a91

SHA1
151b6846906ef048989e4487fb66bdb0bd2492f7

SHA256
93a1fbc84a79a21bc857dab04b7866baff1456acef0f3eb314066b7cbd949049

SHA512
1c68b3cd061c59cfab694f59cd4f922fbc1edfc256d15f96fb57259b05e89a2500c9c220483dfb46061a77cc0a3aa5957ff9416de8baa752fad2387496d08c57

Download Submit
C:\Windows\System\wWKSVSa.exe

Filesize
1.8MB

MD5
a39f1edbdc27d7acd014d01a405306fd

SHA1
44e468af03d07aa896762f9d245a7995637a5543

SHA256
9bb4bf05103ed43931fed4c8610287bccf0ec1bb201f603734502aea55efa6f5

SHA512
52d4a7dbbacd124bf73b10aa7539e83ea3b8f2b050a899ee5d090ad865df0faf4858deb1ac17d3d78a4cd60450ab476a14d57011a919606177c561c216241d35

Download Submit
C:\Windows\System\wuTLxxI.exe

Filesize
1.8MB

MD5
8963a8c9f5fb1a56598731777455a196

SHA1
26b4e4c907a149039fb904f3b66bf78f8ff74365

SHA256
c4094fe8dad4cc7c5b1960b4633dc942ebf624824ca45dedb9cbd72e145b8d76

SHA512
ebf8495c9c1e01278b75a09a378f44b1fcdc69d440a9f272e062a8c391c825ad3c84df2d072ff5651ea861e9eb755d0a2408683697ef0b333f291de9bbb39c4a

Download Submit
C:\Windows\System\ypOoiSl.exe

Filesize
1.8MB

MD5
a5701d6fd952a3ca4a1b2fb1b536ef62

SHA1
45322085ceedee9138c05b9352a7354fc888492e

SHA256
2974bc6980ca505fd25ca445076e750b4cd93a99b2069801721fabc1158e6653

SHA512
f0ae67f12b9e8133c166c0af3c8c364afc32b3dfd23bc3bff4e84736d4a9e8d596b9044881ef304c928e2ec707b004742858c537c626cb892726d2ac8b7e0ed4

Download Submit
C:\Windows\System\zGNoeLM.exe

Filesize
1.8MB

MD5
44f213e18967d12851c8580678470c70

SHA1
3b82408d10679252feb17f6e1e350de7314f806d

SHA256
347ae37f02c8ccb2570de43a152683a1e7991f1b1909e8e59f1c31906044593b

SHA512
14746074a974a866b3b83844afd30cba166c217c73bcd52ab847caeb6a2c95057fd80c46bd15702474e547b9365eabdce7c3a88841c735f661afaa7b789e65d2

Download Submit
C:\Windows\System\zOZvaUS.exe

Filesize
1.8MB

MD5
38392ba43fb9f4d857cada0d5676f5ce

SHA1
b3231407cf1d47f01283038944f6799566d57946

SHA256
e48554e18d4b1d69b443d1334fdaf3aa0b3d6b2b1422f3cf8adcb70c3d5a8b1a

SHA512
b91a7b12b9a4a55e70f169f92ad2d0aa13dfa9fb72be349a59e4c14863e4c50c26bec3d82a406effa7179ce8564b314d0f47117cd99f6757691150bdad0dd3c1

Download Submit
C:\Windows\System\zPpIyby.exe

Filesize
1.8MB

MD5
7b2d5fbd5fde94f6bc53c934bd1ec3f0

SHA1
c150557759da4aec5336519834764e3c62387a5a

SHA256
c5caedec0f7e77edef3f94b7de92ed09955d16b0bddf8d7f52aa48ea3b604df0

SHA512
c9b672827213104787e00661ee53ae579bd2ee6ce6c4c99ac2ad191d5f13c970f21a837c75348e48a15235d13130e84b0e58e50f17315f6ea55251f339eada9e

Download Submit
memory/708-1130-0x00007FF7D76E0000-0x00007FF7D7AD2000-memory.dmp

Filesize
3.9MB

Download
memory/876-555-0x00007FF69A9E0000-0x00007FF69ADD2000-memory.dmp

Filesize
3.9MB

Download
memory/952-640-0x00007FF673090000-0x00007FF673482000-memory.dmp

Filesize
3.9MB

Download
memory/1028-1616-0x00007FF71CD10000-0x00007FF71D102000-memory.dmp

Filesize
3.9MB

Download
memory/1076-1502-0x00007FF72C680000-0x00007FF72CA72000-memory.dmp

Filesize
3.9MB

Download
memory/1208-1-0x000001AF8DFE0000-0x000001AF8DFF0000-memory.dmp

Filesize
64KB

Download
memory/1208-0-0x00007FF610280000-0x00007FF610672000-memory.dmp

Filesize
3.9MB

Download
memory/1360-820-0x00007FF7D4600000-0x00007FF7D49F2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-86-0x00007FF736C50000-0x00007FF737042000-memory.dmp

Filesize
3.9MB

Download
memory/2116-1430-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp

Filesize
3.9MB

Download
memory/2232-1556-0x00007FF740600000-0x00007FF7409F2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-4864-0x00007FF740600000-0x00007FF7409F2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-1615-0x00007FF7DA770000-0x00007FF7DAB62000-memory.dmp

Filesize
3.9MB

Download
memory/2460-1497-0x00007FF721F40000-0x00007FF722332000-memory.dmp

Filesize
3.9MB

Download
memory/2564-962-0x00007FF6F3CC0000-0x00007FF6F40B2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1563-0x00007FF69FC30000-0x00007FF6A0022000-memory.dmp

Filesize
3.9MB

Download
memory/3044-417-0x00007FF760E80000-0x00007FF761272000-memory.dmp

Filesize
3.9MB

Download
memory/3052-523-0x00007FF7B37A0000-0x00007FF7B3B92000-memory.dmp

Filesize
3.9MB

Download
memory/3052-4564-0x00007FF7B37A0000-0x00007FF7B3B92000-memory.dmp

Filesize
3.9MB

Download
memory/3380-829-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-11-0x00007FFBE1BF3000-0x00007FFBE1BF5000-memory.dmp

Filesize
8KB

Download
memory/3460-264-0x0000019C76850000-0x0000019C76872000-memory.dmp

Filesize
136KB

Download
memory/3460-50-0x00007FFBE1BF0000-0x00007FFBE26B1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-173-0x00007FFBE1BF0000-0x00007FFBE26B1000-memory.dmp

Filesize
10.8MB

Download
memory/3504-1137-0x00007FF78F3C0000-0x00007FF78F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-4828-0x00007FF78F3C0000-0x00007FF78F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3668-1496-0x00007FF6100E0000-0x00007FF6104D2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-275-0x00007FF758EA0000-0x00007FF759292000-memory.dmp

Filesize
3.9MB

Download
memory/3976-1560-0x00007FF7F49A0000-0x00007FF7F4D92000-memory.dmp

Filesize
3.9MB

Download
memory/4240-1183-0x00007FF6DE2F0000-0x00007FF6DE6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4240-4872-0x00007FF6DE2F0000-0x00007FF6DE6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-339-0x00007FF626F20000-0x00007FF627312000-memory.dmp

Filesize
3.9MB

Download
memory/4992-4808-0x00007FF783E50000-0x00007FF784242000-memory.dmp

Filesize
3.9MB

Download
memory/4992-966-0x00007FF783E50000-0x00007FF784242000-memory.dmp

Filesize
3.9MB

Download
memory/5088-563-0x00007FF7DFF40000-0x00007FF7E0332000-memory.dmp

Filesize
3.9MB

Download