xmrig | 00709b3a06c9c580dcf448e29b77ef96b1c0a61eff05140f455ea491d0f68651

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
Size

2.3MB
MD5

002162ab421c0ec6c1a3bf9999355da7
SHA1

2025a27c0c4964e5c59e66ef5e15c564fd737774
SHA256

00709b3a06c9c580dcf448e29b77ef96b1c0a61eff05140f455ea491d0f68651
SHA512

10db01ff2d579b745d603045e2e32f0394cb02895d2a3d2a587adec50c3d989ba79dbb6cc53533f81cdde1dd4d7c83b71ccd6ea0480db6560f7ab348f4a6b450
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq4T:NABj

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/2152-20-0x00007FF786A10000-0x00007FF786E02000-memory.dmp	xmrig
behavioral2/memory/4008-54-0x00007FF6DA0B0000-0x00007FF6DA4A2000-memory.dmp	xmrig
behavioral2/memory/2028-60-0x00007FF671E10000-0x00007FF672202000-memory.dmp	xmrig
behavioral2/memory/5032-62-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp	xmrig
behavioral2/memory/1548-58-0x00007FF6E7310000-0x00007FF6E7702000-memory.dmp	xmrig
behavioral2/memory/3924-90-0x00007FF729AA0000-0x00007FF729E92000-memory.dmp	xmrig
behavioral2/memory/1136-91-0x00007FF77AC20000-0x00007FF77B012000-memory.dmp	xmrig
behavioral2/memory/2276-92-0x00007FF63EA80000-0x00007FF63EE72000-memory.dmp	xmrig
behavioral2/memory/3440-93-0x00007FF75B160000-0x00007FF75B552000-memory.dmp	xmrig
behavioral2/memory/4484-94-0x00007FF7F1110000-0x00007FF7F1502000-memory.dmp	xmrig
behavioral2/memory/4176-108-0x00007FF608A90000-0x00007FF608E82000-memory.dmp	xmrig
behavioral2/memory/4020-159-0x00007FF758F50000-0x00007FF759342000-memory.dmp	xmrig
behavioral2/memory/3352-161-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	xmrig
behavioral2/memory/1884-227-0x00007FF7241A0000-0x00007FF724592000-memory.dmp	xmrig
behavioral2/memory/3176-267-0x00007FF664390000-0x00007FF664782000-memory.dmp	xmrig
behavioral2/memory/2644-287-0x00007FF6D3830000-0x00007FF6D3C22000-memory.dmp	xmrig
behavioral2/memory/1796-292-0x00007FF79E910000-0x00007FF79ED02000-memory.dmp	xmrig
behavioral2/memory/3556-325-0x00007FF62D290000-0x00007FF62D682000-memory.dmp	xmrig
behavioral2/memory/5200-342-0x00007FF722DA0000-0x00007FF723192000-memory.dmp	xmrig
behavioral2/memory/5296-353-0x00007FF6F4D10000-0x00007FF6F5102000-memory.dmp	xmrig
behavioral2/memory/2460-458-0x00007FF786990000-0x00007FF786D82000-memory.dmp	xmrig
behavioral2/memory/2312-387-0x00007FF74D4E0000-0x00007FF74D8D2000-memory.dmp	xmrig
behavioral2/memory/544-365-0x00007FF6D0C00000-0x00007FF6D0FF2000-memory.dmp	xmrig
behavioral2/memory/5520-357-0x00007FF658CA0000-0x00007FF659092000-memory.dmp	xmrig
behavioral2/memory/5264-349-0x00007FF64BDD0000-0x00007FF64C1C2000-memory.dmp	xmrig
behavioral2/memory/5232-346-0x00007FF676D70000-0x00007FF677162000-memory.dmp	xmrig
behavioral2/memory/2968-338-0x00007FF7913E0000-0x00007FF7917D2000-memory.dmp	xmrig
behavioral2/memory/2796-336-0x00007FF7BEE90000-0x00007FF7BF282000-memory.dmp	xmrig
behavioral2/memory/4320-329-0x00007FF7BC620000-0x00007FF7BCA12000-memory.dmp	xmrig
behavioral2/memory/2040-322-0x00007FF61F2B0000-0x00007FF61F6A2000-memory.dmp	xmrig
behavioral2/memory/1888-318-0x00007FF60B370000-0x00007FF60B762000-memory.dmp	xmrig
behavioral2/memory/2568-314-0x00007FF605730000-0x00007FF605B22000-memory.dmp	xmrig
behavioral2/memory/3272-312-0x00007FF6CC6C0000-0x00007FF6CCAB2000-memory.dmp	xmrig
behavioral2/memory/3308-294-0x00007FF768FF0000-0x00007FF7693E2000-memory.dmp	xmrig
behavioral2/memory/2772-289-0x00007FF71C870000-0x00007FF71CC62000-memory.dmp	xmrig
behavioral2/memory/928-284-0x00007FF641FF0000-0x00007FF6423E2000-memory.dmp	xmrig
behavioral2/memory/1948-278-0x00007FF610560000-0x00007FF610952000-memory.dmp	xmrig
behavioral2/memory/1168-264-0x00007FF617A70000-0x00007FF617E62000-memory.dmp	xmrig
behavioral2/memory/4440-261-0x00007FF6733B0000-0x00007FF6737A2000-memory.dmp	xmrig
behavioral2/memory/4988-258-0x00007FF71F5F0000-0x00007FF71F9E2000-memory.dmp	xmrig
behavioral2/memory/1120-255-0x00007FF6E47D0000-0x00007FF6E4BC2000-memory.dmp	xmrig
behavioral2/memory/1556-252-0x00007FF7E1220000-0x00007FF7E1612000-memory.dmp	xmrig
behavioral2/memory/2360-249-0x00007FF6CD9F0000-0x00007FF6CDDE2000-memory.dmp	xmrig
behavioral2/memory/4804-245-0x00007FF634D70000-0x00007FF635162000-memory.dmp	xmrig
behavioral2/memory/524-241-0x00007FF61DAA0000-0x00007FF61DE92000-memory.dmp	xmrig
behavioral2/memory/3264-220-0x00007FF68A050000-0x00007FF68A442000-memory.dmp	xmrig
behavioral2/memory/3264-160-0x00007FF68A050000-0x00007FF68A442000-memory.dmp	xmrig
behavioral2/memory/1436-158-0x00007FF70D3E0000-0x00007FF70D7D2000-memory.dmp	xmrig
behavioral2/memory/932-157-0x00007FF6F57E0000-0x00007FF6F5BD2000-memory.dmp	xmrig
behavioral2/memory/2344-153-0x00007FF7AEA30000-0x00007FF7AEE22000-memory.dmp	xmrig
behavioral2/memory/2648-123-0x00007FF743900000-0x00007FF743CF2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2504	powershell.exe
5	2504	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3352	KeFiIAh.exe
2152	pQWyCss.exe
1884	rajZxhP.exe
5032	GxrsgFJ.exe
4008	nIqXPLZ.exe
1548	KIfCXgg.exe
2028	MnVSxdn.exe
1556	fhAWIIT.exe
3924	PYFPqDu.exe
1136	YAQtBRX.exe
2276	KrJPljX.exe
4484	uJbxXeE.exe
3440	qgcIaHn.exe
4176	gMrLIzg.exe
2648	zINoGgO.exe
4460	gTEtDdL.exe
664	GJIUoKp.exe
2344	VXhPRST.exe
2436	XpnnVez.exe
932	wZUNUZA.exe
1436	hEoEVdo.exe
1876	EOiNWvM.exe
4020	jvidxzn.exe
5108	uniolGU.exe
524	GgzPRDn.exe
4804	CibpYTO.exe
2360	CKcDLgP.exe
1120	azGNHKB.exe
4988	szNhgzu.exe
4440	yhsKspE.exe
1168	CwTsvGp.exe
3176	CpQELcA.exe
1948	FwhOInn.exe
928	SasKtpL.exe
2644	oWsgKmI.exe
2772	dVzugwS.exe
1796	tTvoqAQ.exe
3308	adDvrMa.exe
3272	XnHiBVx.exe
544	MFvauYL.exe
2568	koPXUlC.exe
1888	paMWbpo.exe
2040	xkToxwg.exe
3556	EETWKGe.exe
4320	MuoxYxT.exe
2312	skBidQK.exe
2460	EinOosg.exe
2520	OokTNoS.exe
4036	VCOgbKS.exe
100	YXBDbbu.exe
2796	oHMUBIu.exe
2968	ddfFFfs.exe
3124	UsnRjDx.exe
5156	XRkjlpu.exe
5200	pfSYDuk.exe
5232	gHzYlTG.exe
5264	ZMAnMXw.exe
5296	SmQrowx.exe
5320	jpnowmC.exe
5360	zSqvPpU.exe
5400	lDgqIxS.exe
5432	fSksluc.exe
5460	XdKRwYq.exe
5488	bBasvgi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3264-0-0x00007FF68A050000-0x00007FF68A442000-memory.dmp	upx
behavioral2/files/0x0008000000023261-5.dat	upx
behavioral2/files/0x0008000000023267-8.dat	upx
behavioral2/memory/3352-10-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	upx
behavioral2/files/0x0008000000023264-16.dat	upx
behavioral2/memory/1884-18-0x00007FF7241A0000-0x00007FF724592000-memory.dmp	upx
behavioral2/memory/2152-20-0x00007FF786A10000-0x00007FF786E02000-memory.dmp	upx
behavioral2/files/0x0007000000023269-23.dat	upx
behavioral2/files/0x000700000002326a-30.dat	upx
behavioral2/files/0x000700000002326d-44.dat	upx
behavioral2/files/0x0008000000023265-48.dat	upx
behavioral2/memory/4008-54-0x00007FF6DA0B0000-0x00007FF6DA4A2000-memory.dmp	upx
behavioral2/files/0x000800000002326b-59.dat	upx
behavioral2/memory/2028-60-0x00007FF671E10000-0x00007FF672202000-memory.dmp	upx
behavioral2/memory/5032-62-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp	upx
behavioral2/memory/1556-63-0x00007FF7E1220000-0x00007FF7E1612000-memory.dmp	upx
behavioral2/files/0x000800000002326c-68.dat	upx
behavioral2/memory/1548-58-0x00007FF6E7310000-0x00007FF6E7702000-memory.dmp	upx
behavioral2/files/0x000700000002326e-73.dat	upx
behavioral2/files/0x000700000002326f-78.dat	upx
behavioral2/files/0x0007000000023270-86.dat	upx
behavioral2/files/0x0007000000023271-88.dat	upx
behavioral2/memory/3924-90-0x00007FF729AA0000-0x00007FF729E92000-memory.dmp	upx
behavioral2/memory/1136-91-0x00007FF77AC20000-0x00007FF77B012000-memory.dmp	upx
behavioral2/memory/2276-92-0x00007FF63EA80000-0x00007FF63EE72000-memory.dmp	upx
behavioral2/memory/3440-93-0x00007FF75B160000-0x00007FF75B552000-memory.dmp	upx
behavioral2/memory/4484-94-0x00007FF7F1110000-0x00007FF7F1502000-memory.dmp	upx
behavioral2/files/0x0007000000023272-99.dat	upx
behavioral2/files/0x0007000000023274-107.dat	upx
behavioral2/memory/4176-108-0x00007FF608A90000-0x00007FF608E82000-memory.dmp	upx
behavioral2/files/0x0007000000023275-117.dat	upx
behavioral2/files/0x0007000000023277-122.dat	upx
behavioral2/files/0x0007000000023278-129.dat	upx
behavioral2/memory/2436-141-0x00007FF6FFD10000-0x00007FF700102000-memory.dmp	upx
behavioral2/files/0x0007000000023279-145.dat	upx
behavioral2/files/0x000700000002327a-148.dat	upx
behavioral2/files/0x000700000002327b-154.dat	upx
behavioral2/files/0x000700000002327c-156.dat	upx
behavioral2/memory/4020-159-0x00007FF758F50000-0x00007FF759342000-memory.dmp	upx
behavioral2/memory/3352-161-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	upx
behavioral2/files/0x000700000002327d-168.dat	upx
behavioral2/files/0x000700000002327e-173.dat	upx
behavioral2/files/0x0007000000023280-183.dat	upx
behavioral2/files/0x0007000000023282-191.dat	upx
behavioral2/files/0x0007000000023287-206.dat	upx
behavioral2/memory/1884-227-0x00007FF7241A0000-0x00007FF724592000-memory.dmp	upx
behavioral2/memory/3176-267-0x00007FF664390000-0x00007FF664782000-memory.dmp	upx
behavioral2/memory/2644-287-0x00007FF6D3830000-0x00007FF6D3C22000-memory.dmp	upx
behavioral2/memory/1796-292-0x00007FF79E910000-0x00007FF79ED02000-memory.dmp	upx
behavioral2/memory/3556-325-0x00007FF62D290000-0x00007FF62D682000-memory.dmp	upx
behavioral2/memory/5200-342-0x00007FF722DA0000-0x00007FF723192000-memory.dmp	upx
behavioral2/memory/5296-353-0x00007FF6F4D10000-0x00007FF6F5102000-memory.dmp	upx
behavioral2/memory/2460-458-0x00007FF786990000-0x00007FF786D82000-memory.dmp	upx
behavioral2/memory/2312-387-0x00007FF74D4E0000-0x00007FF74D8D2000-memory.dmp	upx
behavioral2/memory/544-365-0x00007FF6D0C00000-0x00007FF6D0FF2000-memory.dmp	upx
behavioral2/memory/5520-357-0x00007FF658CA0000-0x00007FF659092000-memory.dmp	upx
behavioral2/memory/5264-349-0x00007FF64BDD0000-0x00007FF64C1C2000-memory.dmp	upx
behavioral2/memory/5232-346-0x00007FF676D70000-0x00007FF677162000-memory.dmp	upx
behavioral2/memory/2968-338-0x00007FF7913E0000-0x00007FF7917D2000-memory.dmp	upx
behavioral2/memory/2796-336-0x00007FF7BEE90000-0x00007FF7BF282000-memory.dmp	upx
behavioral2/memory/4320-329-0x00007FF7BC620000-0x00007FF7BCA12000-memory.dmp	upx
behavioral2/memory/2040-322-0x00007FF61F2B0000-0x00007FF61F6A2000-memory.dmp	upx
behavioral2/memory/1888-318-0x00007FF60B370000-0x00007FF60B762000-memory.dmp	upx
behavioral2/memory/2568-314-0x00007FF605730000-0x00007FF605B22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZzVpEDp.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\UsnRjDx.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\lDgqIxS.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\ZXkIheS.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\RyHoIzJ.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\GJIUoKp.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\pnAUGtc.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\HftKMJA.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\QGaLJIX.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\SmQrowx.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\sKOvHMr.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\PYcZDWJ.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\ZgguteG.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\uYIvvrI.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\wsBfxuC.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\zUfPjRh.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\xkToxwg.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\EinOosg.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\TqpKoEx.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\uowWeGo.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\nkqANPe.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\jBDjItT.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\fPnHndM.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\vHaCULT.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\cWWblAL.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\gggwWWn.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\XRkjlpu.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\aMIfjyX.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\feEaPfN.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\GfACLzE.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\KrJPljX.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\MzPAgLp.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\BONLHYN.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\OXxXSNf.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\qGPIwjN.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\SwgeEGp.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\oglLNQq.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\CpQELcA.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\oBJRgMw.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\dwCfEvv.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\iMAERoZ.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\zYvrjFd.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\nIqXPLZ.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\wKJdVNX.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\tWNzqDk.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\VUTGuoM.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\wQNBqNC.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\thVhjho.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\tXiHufV.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\azGNHKB.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\CwTsvGp.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\MuoxYxT.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\ddfFFfs.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\LvKEFZR.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\BVCvgYw.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\UdzzVlm.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\mpmxzEH.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\mrQbAPZ.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\ShmfPwm.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\vVpvqLK.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\EETWKGe.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\WumMvBF.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\osTkfKb.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
File created	C:\Windows\System\FIayoVb.exe	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	powershell.exe
2504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeLockMemoryPrivilege	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2504	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	92
PID 3264 wrote to memory of 2504	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	92
PID 3264 wrote to memory of 3352	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	93
PID 3264 wrote to memory of 3352	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	93
PID 3264 wrote to memory of 2152	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	94
PID 3264 wrote to memory of 2152	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	94
PID 3264 wrote to memory of 1884	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	95
PID 3264 wrote to memory of 1884	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	95
PID 3264 wrote to memory of 5032	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	96
PID 3264 wrote to memory of 5032	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	96
PID 3264 wrote to memory of 4008	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	97
PID 3264 wrote to memory of 4008	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	97
PID 3264 wrote to memory of 1548	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	98
PID 3264 wrote to memory of 1548	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	98
PID 3264 wrote to memory of 2028	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	99
PID 3264 wrote to memory of 2028	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	99
PID 3264 wrote to memory of 1556	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	100
PID 3264 wrote to memory of 1556	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	100
PID 3264 wrote to memory of 3924	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	101
PID 3264 wrote to memory of 3924	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	101
PID 3264 wrote to memory of 1136	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	102
PID 3264 wrote to memory of 1136	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	102
PID 3264 wrote to memory of 2276	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	103
PID 3264 wrote to memory of 2276	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	103
PID 3264 wrote to memory of 4484	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	104
PID 3264 wrote to memory of 4484	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	104
PID 3264 wrote to memory of 3440	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	105
PID 3264 wrote to memory of 3440	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	105
PID 3264 wrote to memory of 4176	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	106
PID 3264 wrote to memory of 4176	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	106
PID 3264 wrote to memory of 2648	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	107
PID 3264 wrote to memory of 2648	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	107
PID 3264 wrote to memory of 4460	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	108
PID 3264 wrote to memory of 4460	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	108
PID 3264 wrote to memory of 664	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	109
PID 3264 wrote to memory of 664	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	109
PID 3264 wrote to memory of 2344	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	110
PID 3264 wrote to memory of 2344	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	110
PID 3264 wrote to memory of 2436	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	111
PID 3264 wrote to memory of 2436	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	111
PID 3264 wrote to memory of 932	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	112
PID 3264 wrote to memory of 932	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	112
PID 3264 wrote to memory of 1436	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	113
PID 3264 wrote to memory of 1436	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	113
PID 3264 wrote to memory of 1876	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	114
PID 3264 wrote to memory of 1876	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	114
PID 3264 wrote to memory of 4020	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	115
PID 3264 wrote to memory of 4020	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	115
PID 3264 wrote to memory of 5108	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	116
PID 3264 wrote to memory of 5108	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	116
PID 3264 wrote to memory of 524	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	117
PID 3264 wrote to memory of 524	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	117
PID 3264 wrote to memory of 4804	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	118
PID 3264 wrote to memory of 4804	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	118
PID 3264 wrote to memory of 2360	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	119
PID 3264 wrote to memory of 2360	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	119
PID 3264 wrote to memory of 1120	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	120
PID 3264 wrote to memory of 1120	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	120
PID 3264 wrote to memory of 4988	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	121
PID 3264 wrote to memory of 4988	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	121
PID 3264 wrote to memory of 4440	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	122
PID 3264 wrote to memory of 4440	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	122
PID 3264 wrote to memory of 1168	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	123
PID 3264 wrote to memory of 1168	3264	002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\002162ab421c0ec6c1a3bf9999355da7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System\KeFiIAh.exe
  C:\Windows\System\KeFiIAh.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\pQWyCss.exe
  C:\Windows\System\pQWyCss.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\rajZxhP.exe
  C:\Windows\System\rajZxhP.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\GxrsgFJ.exe
  C:\Windows\System\GxrsgFJ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\nIqXPLZ.exe
  C:\Windows\System\nIqXPLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\KIfCXgg.exe
  C:\Windows\System\KIfCXgg.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\MnVSxdn.exe
  C:\Windows\System\MnVSxdn.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\fhAWIIT.exe
  C:\Windows\System\fhAWIIT.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\PYFPqDu.exe
  C:\Windows\System\PYFPqDu.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\YAQtBRX.exe
  C:\Windows\System\YAQtBRX.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\KrJPljX.exe
  C:\Windows\System\KrJPljX.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\uJbxXeE.exe
  C:\Windows\System\uJbxXeE.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\qgcIaHn.exe
  C:\Windows\System\qgcIaHn.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\gMrLIzg.exe
  C:\Windows\System\gMrLIzg.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\zINoGgO.exe
  C:\Windows\System\zINoGgO.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\gTEtDdL.exe
  C:\Windows\System\gTEtDdL.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\GJIUoKp.exe
  C:\Windows\System\GJIUoKp.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\VXhPRST.exe
  C:\Windows\System\VXhPRST.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\XpnnVez.exe
  C:\Windows\System\XpnnVez.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\wZUNUZA.exe
  C:\Windows\System\wZUNUZA.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\hEoEVdo.exe
  C:\Windows\System\hEoEVdo.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\EOiNWvM.exe
  C:\Windows\System\EOiNWvM.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\jvidxzn.exe
  C:\Windows\System\jvidxzn.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\uniolGU.exe
  C:\Windows\System\uniolGU.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\GgzPRDn.exe
  C:\Windows\System\GgzPRDn.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\CibpYTO.exe
  C:\Windows\System\CibpYTO.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\CKcDLgP.exe
  C:\Windows\System\CKcDLgP.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\azGNHKB.exe
  C:\Windows\System\azGNHKB.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\szNhgzu.exe
  C:\Windows\System\szNhgzu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\yhsKspE.exe
  C:\Windows\System\yhsKspE.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\CwTsvGp.exe
  C:\Windows\System\CwTsvGp.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\CpQELcA.exe
  C:\Windows\System\CpQELcA.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\FwhOInn.exe
  C:\Windows\System\FwhOInn.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SasKtpL.exe
  C:\Windows\System\SasKtpL.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\oWsgKmI.exe
  C:\Windows\System\oWsgKmI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\dVzugwS.exe
  C:\Windows\System\dVzugwS.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\MFvauYL.exe
  C:\Windows\System\MFvauYL.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\tTvoqAQ.exe
  C:\Windows\System\tTvoqAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\adDvrMa.exe
  C:\Windows\System\adDvrMa.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\XnHiBVx.exe
  C:\Windows\System\XnHiBVx.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\koPXUlC.exe
  C:\Windows\System\koPXUlC.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\paMWbpo.exe
  C:\Windows\System\paMWbpo.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\xkToxwg.exe
  C:\Windows\System\xkToxwg.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\EETWKGe.exe
  C:\Windows\System\EETWKGe.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\MuoxYxT.exe
  C:\Windows\System\MuoxYxT.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\skBidQK.exe
  C:\Windows\System\skBidQK.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\EinOosg.exe
  C:\Windows\System\EinOosg.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\OokTNoS.exe
  C:\Windows\System\OokTNoS.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\VCOgbKS.exe
  C:\Windows\System\VCOgbKS.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\YXBDbbu.exe
  C:\Windows\System\YXBDbbu.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\oHMUBIu.exe
  C:\Windows\System\oHMUBIu.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ddfFFfs.exe
  C:\Windows\System\ddfFFfs.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\UsnRjDx.exe
  C:\Windows\System\UsnRjDx.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\XRkjlpu.exe
  C:\Windows\System\XRkjlpu.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\pfSYDuk.exe
  C:\Windows\System\pfSYDuk.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\gHzYlTG.exe
  C:\Windows\System\gHzYlTG.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\ZMAnMXw.exe
  C:\Windows\System\ZMAnMXw.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\SmQrowx.exe
  C:\Windows\System\SmQrowx.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\jpnowmC.exe
  C:\Windows\System\jpnowmC.exe
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\System\zSqvPpU.exe
  C:\Windows\System\zSqvPpU.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\lDgqIxS.exe
  C:\Windows\System\lDgqIxS.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\fSksluc.exe
  C:\Windows\System\fSksluc.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\XdKRwYq.exe
  C:\Windows\System\XdKRwYq.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System\bBasvgi.exe
  C:\Windows\System\bBasvgi.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\lOhUUKH.exe
  C:\Windows\System\lOhUUKH.exe
  2⤵
  PID:5520
- C:\Windows\System\uYIvvrI.exe
  C:\Windows\System\uYIvvrI.exe
  2⤵
  PID:5564
- C:\Windows\System\IKHmkIS.exe
  C:\Windows\System\IKHmkIS.exe
  2⤵
  PID:5596
- C:\Windows\System\WcXiNEZ.exe
  C:\Windows\System\WcXiNEZ.exe
  2⤵
  PID:5628
- C:\Windows\System\YBEaauJ.exe
  C:\Windows\System\YBEaauJ.exe
  2⤵
  PID:5652
- C:\Windows\System\cfcbqhO.exe
  C:\Windows\System\cfcbqhO.exe
  2⤵
  PID:5680
- C:\Windows\System\naMrPTN.exe
  C:\Windows\System\naMrPTN.exe
  2⤵
  PID:5728
- C:\Windows\System\wQNBqNC.exe
  C:\Windows\System\wQNBqNC.exe
  2⤵
  PID:5756
- C:\Windows\System\zxCxaFB.exe
  C:\Windows\System\zxCxaFB.exe
  2⤵
  PID:5784
- C:\Windows\System\YZzOprS.exe
  C:\Windows\System\YZzOprS.exe
  2⤵
  PID:5808
- C:\Windows\System\HUmeelp.exe
  C:\Windows\System\HUmeelp.exe
  2⤵
  PID:5832
- C:\Windows\System\WumMvBF.exe
  C:\Windows\System\WumMvBF.exe
  2⤵
  PID:5860
- C:\Windows\System\BVCvgYw.exe
  C:\Windows\System\BVCvgYw.exe
  2⤵
  PID:5892
- C:\Windows\System\OATjWry.exe
  C:\Windows\System\OATjWry.exe
  2⤵
  PID:5916
- C:\Windows\System\sKOvHMr.exe
  C:\Windows\System\sKOvHMr.exe
  2⤵
  PID:5948
- C:\Windows\System\yavnmYy.exe
  C:\Windows\System\yavnmYy.exe
  2⤵
  PID:5976
- C:\Windows\System\ruZIxhW.exe
  C:\Windows\System\ruZIxhW.exe
  2⤵
  PID:6008
- C:\Windows\System\ytdjxMA.exe
  C:\Windows\System\ytdjxMA.exe
  2⤵
  PID:6040
- C:\Windows\System\ncNMllW.exe
  C:\Windows\System\ncNMllW.exe
  2⤵
  PID:6072
- C:\Windows\System\MzPAgLp.exe
  C:\Windows\System\MzPAgLp.exe
  2⤵
  PID:6104
- C:\Windows\System\thVhjho.exe
  C:\Windows\System\thVhjho.exe
  2⤵
  PID:6136
- C:\Windows\System\FughOpV.exe
  C:\Windows\System\FughOpV.exe
  2⤵
  PID:2924
- C:\Windows\System\RhDlaHx.exe
  C:\Windows\System\RhDlaHx.exe
  2⤵
  PID:5408
- C:\Windows\System\rAqCrKV.exe
  C:\Windows\System\rAqCrKV.exe
  2⤵
  PID:5348
- C:\Windows\System\VwgPzzK.exe
  C:\Windows\System\VwgPzzK.exe
  2⤵
  PID:5288
- C:\Windows\System\cpSyooc.exe
  C:\Windows\System\cpSyooc.exe
  2⤵
  PID:5228
- C:\Windows\System\wKJdVNX.exe
  C:\Windows\System\wKJdVNX.exe
  2⤵
  PID:3724
- C:\Windows\System\tqjwJpW.exe
  C:\Windows\System\tqjwJpW.exe
  2⤵
  PID:2044
- C:\Windows\System\UZyEZnQ.exe
  C:\Windows\System\UZyEZnQ.exe
  2⤵
  PID:3456
- C:\Windows\System\XSeKEPC.exe
  C:\Windows\System\XSeKEPC.exe
  2⤵
  PID:5536
- C:\Windows\System\ZzVpEDp.exe
  C:\Windows\System\ZzVpEDp.exe
  2⤵
  PID:5612
- C:\Windows\System\oBJRgMw.exe
  C:\Windows\System\oBJRgMw.exe
  2⤵
  PID:5700
- C:\Windows\System\TwBrgWZ.exe
  C:\Windows\System\TwBrgWZ.exe
  2⤵
  PID:5748
- C:\Windows\System\tXiHufV.exe
  C:\Windows\System\tXiHufV.exe
  2⤵
  PID:5800
- C:\Windows\System\sTFBprB.exe
  C:\Windows\System\sTFBprB.exe
  2⤵
  PID:3916
- C:\Windows\System\MrqbtMz.exe
  C:\Windows\System\MrqbtMz.exe
  2⤵
  PID:5912
- C:\Windows\System\eRnOYAS.exe
  C:\Windows\System\eRnOYAS.exe
  2⤵
  PID:4416
- C:\Windows\System\ZXkIheS.exe
  C:\Windows\System\ZXkIheS.exe
  2⤵
  PID:5352
- C:\Windows\System\JaoQTqe.exe
  C:\Windows\System\JaoQTqe.exe
  2⤵
  PID:5292
- C:\Windows\System\XMItYBB.exe
  C:\Windows\System\XMItYBB.exe
  2⤵
  PID:5240
- C:\Windows\System\xzFJSeH.exe
  C:\Windows\System\xzFJSeH.exe
  2⤵
  PID:4332
- C:\Windows\System\LZpBmvO.exe
  C:\Windows\System\LZpBmvO.exe
  2⤵
  PID:3612
- C:\Windows\System\HIaMxzV.exe
  C:\Windows\System\HIaMxzV.exe
  2⤵
  PID:4280
- C:\Windows\System\QjsXgFR.exe
  C:\Windows\System\QjsXgFR.exe
  2⤵
  PID:1056
- C:\Windows\System\DkmgyFp.exe
  C:\Windows\System\DkmgyFp.exe
  2⤵
  PID:64
- C:\Windows\System\KuqDVvm.exe
  C:\Windows\System\KuqDVvm.exe
  2⤵
  PID:1696
- C:\Windows\System\UdzzVlm.exe
  C:\Windows\System\UdzzVlm.exe
  2⤵
  PID:5668
- C:\Windows\System\GumjLHQ.exe
  C:\Windows\System\GumjLHQ.exe
  2⤵
  PID:5724
- C:\Windows\System\dwCfEvv.exe
  C:\Windows\System\dwCfEvv.exe
  2⤵
  PID:3964
- C:\Windows\System\BONLHYN.exe
  C:\Windows\System\BONLHYN.exe
  2⤵
  PID:5780
- C:\Windows\System\HwaxqFC.exe
  C:\Windows\System\HwaxqFC.exe
  2⤵
  PID:5828
- C:\Windows\System\nbAasay.exe
  C:\Windows\System\nbAasay.exe
  2⤵
  PID:5908
- C:\Windows\System\ykOjTgp.exe
  C:\Windows\System\ykOjTgp.exe
  2⤵
  PID:5940
- C:\Windows\System\GaRyhMv.exe
  C:\Windows\System\GaRyhMv.exe
  2⤵
  PID:6112
- C:\Windows\System\DHIEdCN.exe
  C:\Windows\System\DHIEdCN.exe
  2⤵
  PID:6064
- C:\Windows\System\hRXdHBE.exe
  C:\Windows\System\hRXdHBE.exe
  2⤵
  PID:4372
- C:\Windows\System\qGPIwjN.exe
  C:\Windows\System\qGPIwjN.exe
  2⤵
  PID:5272
- C:\Windows\System\icViSth.exe
  C:\Windows\System\icViSth.exe
  2⤵
  PID:1444
- C:\Windows\System\nkqANPe.exe
  C:\Windows\System\nkqANPe.exe
  2⤵
  PID:2680
- C:\Windows\System\aMIfjyX.exe
  C:\Windows\System\aMIfjyX.exe
  2⤵
  PID:2980
- C:\Windows\System\lORNibN.exe
  C:\Windows\System\lORNibN.exe
  2⤵
  PID:2148
- C:\Windows\System\AafcyfE.exe
  C:\Windows\System\AafcyfE.exe
  2⤵
  PID:5716
- C:\Windows\System\BVfVtnW.exe
  C:\Windows\System\BVfVtnW.exe
  2⤵
  PID:4816
- C:\Windows\System\vYGKDAp.exe
  C:\Windows\System\vYGKDAp.exe
  2⤵
  PID:5824
- C:\Windows\System\KLAXsDh.exe
  C:\Windows\System\KLAXsDh.exe
  2⤵
  PID:6000
- C:\Windows\System\RrFswwi.exe
  C:\Windows\System\RrFswwi.exe
  2⤵
  PID:5484
- C:\Windows\System\MFsGgEU.exe
  C:\Windows\System\MFsGgEU.exe
  2⤵
  PID:3592
- C:\Windows\System\bDNqppK.exe
  C:\Windows\System\bDNqppK.exe
  2⤵
  PID:3848
- C:\Windows\System\osTkfKb.exe
  C:\Windows\System\osTkfKb.exe
  2⤵
  PID:3580
- C:\Windows\System\YLveIMA.exe
  C:\Windows\System\YLveIMA.exe
  2⤵
  PID:2292
- C:\Windows\System\TaGFdcv.exe
  C:\Windows\System\TaGFdcv.exe
  2⤵
  PID:5544
- C:\Windows\System\IfGoCDG.exe
  C:\Windows\System\IfGoCDG.exe
  2⤵
  PID:5676
- C:\Windows\System\pnAUGtc.exe
  C:\Windows\System\pnAUGtc.exe
  2⤵
  PID:2384
- C:\Windows\System\AUiTeBT.exe
  C:\Windows\System\AUiTeBT.exe
  2⤵
  PID:5888
- C:\Windows\System\iMAERoZ.exe
  C:\Windows\System\iMAERoZ.exe
  2⤵
  PID:1932
- C:\Windows\System\rYshTzS.exe
  C:\Windows\System\rYshTzS.exe
  2⤵
  PID:5136
- C:\Windows\System\YgBCOqv.exe
  C:\Windows\System\YgBCOqv.exe
  2⤵
  PID:3076
- C:\Windows\System\JYWtsUA.exe
  C:\Windows\System\JYWtsUA.exe
  2⤵
  PID:5216
- C:\Windows\System\TZivPud.exe
  C:\Windows\System\TZivPud.exe
  2⤵
  PID:6224
- C:\Windows\System\PvPSTgH.exe
  C:\Windows\System\PvPSTgH.exe
  2⤵
  PID:6248
- C:\Windows\System\KQElJws.exe
  C:\Windows\System\KQElJws.exe
  2⤵
  PID:6264
- C:\Windows\System\iayvCaI.exe
  C:\Windows\System\iayvCaI.exe
  2⤵
  PID:6284
- C:\Windows\System\mSDJqNo.exe
  C:\Windows\System\mSDJqNo.exe
  2⤵
  PID:6460
- C:\Windows\System\Fdvwroe.exe
  C:\Windows\System\Fdvwroe.exe
  2⤵
  PID:6712
- C:\Windows\System\wtGxPJv.exe
  C:\Windows\System\wtGxPJv.exe
  2⤵
  PID:6776
- C:\Windows\System\aksSxmS.exe
  C:\Windows\System\aksSxmS.exe
  2⤵
  PID:6796
- C:\Windows\System\oaqiVnb.exe
  C:\Windows\System\oaqiVnb.exe
  2⤵
  PID:6820
- C:\Windows\System\UwGjOef.exe
  C:\Windows\System\UwGjOef.exe
  2⤵
  PID:6836
- C:\Windows\System\SwgeEGp.exe
  C:\Windows\System\SwgeEGp.exe
  2⤵
  PID:6888
- C:\Windows\System\OXxXSNf.exe
  C:\Windows\System\OXxXSNf.exe
  2⤵
  PID:6940
- C:\Windows\System\eoDXUXS.exe
  C:\Windows\System\eoDXUXS.exe
  2⤵
  PID:6960
- C:\Windows\System\OGmovSv.exe
  C:\Windows\System\OGmovSv.exe
  2⤵
  PID:7008
- C:\Windows\System\feEaPfN.exe
  C:\Windows\System\feEaPfN.exe
  2⤵
  PID:7056
- C:\Windows\System\CxCzfDw.exe
  C:\Windows\System\CxCzfDw.exe
  2⤵
  PID:7080
- C:\Windows\System\OHZrtbW.exe
  C:\Windows\System\OHZrtbW.exe
  2⤵
  PID:7136
- C:\Windows\System\lXnVrdl.exe
  C:\Windows\System\lXnVrdl.exe
  2⤵
  PID:2192
- C:\Windows\System\mpmxzEH.exe
  C:\Windows\System\mpmxzEH.exe
  2⤵
  PID:5188
- C:\Windows\System\YUPHNOs.exe
  C:\Windows\System\YUPHNOs.exe
  2⤵
  PID:6184
- C:\Windows\System\kLtdtlM.exe
  C:\Windows\System\kLtdtlM.exe
  2⤵
  PID:2328
- C:\Windows\System\fHzipmX.exe
  C:\Windows\System\fHzipmX.exe
  2⤵
  PID:5184
- C:\Windows\System\obIToMz.exe
  C:\Windows\System\obIToMz.exe
  2⤵
  PID:6356
- C:\Windows\System\XriuvXs.exe
  C:\Windows\System\XriuvXs.exe
  2⤵
  PID:3100
- C:\Windows\System\hoKbmuy.exe
  C:\Windows\System\hoKbmuy.exe
  2⤵
  PID:6168
- C:\Windows\System\aoxvphb.exe
  C:\Windows\System\aoxvphb.exe
  2⤵
  PID:6408
- C:\Windows\System\PYcZDWJ.exe
  C:\Windows\System\PYcZDWJ.exe
  2⤵
  PID:5444
- C:\Windows\System\IUCYWRG.exe
  C:\Windows\System\IUCYWRG.exe
  2⤵
  PID:6276
- C:\Windows\System\IjWoyyg.exe
  C:\Windows\System\IjWoyyg.exe
  2⤵
  PID:6484
- C:\Windows\System\SEGBFOY.exe
  C:\Windows\System\SEGBFOY.exe
  2⤵
  PID:6572
- C:\Windows\System\xxVLtRt.exe
  C:\Windows\System\xxVLtRt.exe
  2⤵
  PID:5572
- C:\Windows\System\aMGGLoe.exe
  C:\Windows\System\aMGGLoe.exe
  2⤵
  PID:6808
- C:\Windows\System\FIayoVb.exe
  C:\Windows\System\FIayoVb.exe
  2⤵
  PID:6752
- C:\Windows\System\VizbOzc.exe
  C:\Windows\System\VizbOzc.exe
  2⤵
  PID:6788
- C:\Windows\System\jKYHHjo.exe
  C:\Windows\System\jKYHHjo.exe
  2⤵
  PID:6952
- C:\Windows\System\FgOaVkm.exe
  C:\Windows\System\FgOaVkm.exe
  2⤵
  PID:5984
- C:\Windows\System\iQcOXXJ.exe
  C:\Windows\System\iQcOXXJ.exe
  2⤵
  PID:7024
- C:\Windows\System\zOIZzpb.exe
  C:\Windows\System\zOIZzpb.exe
  2⤵
  PID:4860
- C:\Windows\System\HHcudZi.exe
  C:\Windows\System\HHcudZi.exe
  2⤵
  PID:4756
- C:\Windows\System\GfACLzE.exe
  C:\Windows\System\GfACLzE.exe
  2⤵
  PID:5172
- C:\Windows\System\DjULOhN.exe
  C:\Windows\System\DjULOhN.exe
  2⤵
  PID:648
- C:\Windows\System\tGnDXEL.exe
  C:\Windows\System\tGnDXEL.exe
  2⤵
  PID:6412
- C:\Windows\System\jVgQnxb.exe
  C:\Windows\System\jVgQnxb.exe
  2⤵
  PID:5496
- C:\Windows\System\sBmhKqs.exe
  C:\Windows\System\sBmhKqs.exe
  2⤵
  PID:5792
- C:\Windows\System\SiGcexU.exe
  C:\Windows\System\SiGcexU.exe
  2⤵
  PID:6896
- C:\Windows\System\nekQbWm.exe
  C:\Windows\System\nekQbWm.exe
  2⤵
  PID:7052
- C:\Windows\System\jBDjItT.exe
  C:\Windows\System\jBDjItT.exe
  2⤵
  PID:6612
- C:\Windows\System\HfojHjV.exe
  C:\Windows\System\HfojHjV.exe
  2⤵
  PID:2268
- C:\Windows\System\cWWblAL.exe
  C:\Windows\System\cWWblAL.exe
  2⤵
  PID:6832
- C:\Windows\System\yddkRtt.exe
  C:\Windows\System\yddkRtt.exe
  2⤵
  PID:6556
- C:\Windows\System\gggwWWn.exe
  C:\Windows\System\gggwWWn.exe
  2⤵
  PID:4904
- C:\Windows\System\AZTAnVn.exe
  C:\Windows\System\AZTAnVn.exe
  2⤵
  PID:2728
- C:\Windows\System\TqpKoEx.exe
  C:\Windows\System\TqpKoEx.exe
  2⤵
  PID:7176
- C:\Windows\System\ELlLYIW.exe
  C:\Windows\System\ELlLYIW.exe
  2⤵
  PID:7268
- C:\Windows\System\WSSGeaL.exe
  C:\Windows\System\WSSGeaL.exe
  2⤵
  PID:7300
- C:\Windows\System\wsBfxuC.exe
  C:\Windows\System\wsBfxuC.exe
  2⤵
  PID:7320
- C:\Windows\System\POtNaXu.exe
  C:\Windows\System\POtNaXu.exe
  2⤵
  PID:7416
- C:\Windows\System\rLHqTSG.exe
  C:\Windows\System\rLHqTSG.exe
  2⤵
  PID:7448
- C:\Windows\System\DGhhcEs.exe
  C:\Windows\System\DGhhcEs.exe
  2⤵
  PID:7472
- C:\Windows\System\uxdIccS.exe
  C:\Windows\System\uxdIccS.exe
  2⤵
  PID:7492
- C:\Windows\System\JaJxEsH.exe
  C:\Windows\System\JaJxEsH.exe
  2⤵
  PID:7524
- C:\Windows\System\VLzoOAz.exe
  C:\Windows\System\VLzoOAz.exe
  2⤵
  PID:7540
- C:\Windows\System\xifpDpw.exe
  C:\Windows\System\xifpDpw.exe
  2⤵
  PID:7560
- C:\Windows\System\BdCZURm.exe
  C:\Windows\System\BdCZURm.exe
  2⤵
  PID:7596
- C:\Windows\System\OJLJPnC.exe
  C:\Windows\System\OJLJPnC.exe
  2⤵
  PID:7612
- C:\Windows\System\cjXkRgK.exe
  C:\Windows\System\cjXkRgK.exe
  2⤵
  PID:7688
- C:\Windows\System\mKRgIxV.exe
  C:\Windows\System\mKRgIxV.exe
  2⤵
  PID:7704
- C:\Windows\System\FWvmImK.exe
  C:\Windows\System\FWvmImK.exe
  2⤵
  PID:7720
- C:\Windows\System\HftKMJA.exe
  C:\Windows\System\HftKMJA.exe
  2⤵
  PID:7752
- C:\Windows\System\csuaxcE.exe
  C:\Windows\System\csuaxcE.exe
  2⤵
  PID:7772
- C:\Windows\System\DcGlDbv.exe
  C:\Windows\System\DcGlDbv.exe
  2⤵
  PID:7792
- C:\Windows\System\xheZfSD.exe
  C:\Windows\System\xheZfSD.exe
  2⤵
  PID:7840
- C:\Windows\System\gdPGwRm.exe
  C:\Windows\System\gdPGwRm.exe
  2⤵
  PID:7860
- C:\Windows\System\DCycSLc.exe
  C:\Windows\System\DCycSLc.exe
  2⤵
  PID:7884
- C:\Windows\System\UhLWIYp.exe
  C:\Windows\System\UhLWIYp.exe
  2⤵
  PID:7928
- C:\Windows\System\mrQbAPZ.exe
  C:\Windows\System\mrQbAPZ.exe
  2⤵
  PID:7948
- C:\Windows\System\uVAckSv.exe
  C:\Windows\System\uVAckSv.exe
  2⤵
  PID:7968
- C:\Windows\System\fPnHndM.exe
  C:\Windows\System\fPnHndM.exe
  2⤵
  PID:7996
- C:\Windows\System\tWNzqDk.exe
  C:\Windows\System\tWNzqDk.exe
  2⤵
  PID:8020
- C:\Windows\System\ZgguteG.exe
  C:\Windows\System\ZgguteG.exe
  2⤵
  PID:8036
- C:\Windows\System\gMzLNaD.exe
  C:\Windows\System\gMzLNaD.exe
  2⤵
  PID:8056
- C:\Windows\System\xTxlfuN.exe
  C:\Windows\System\xTxlfuN.exe
  2⤵
  PID:8076
- C:\Windows\System\LvKEFZR.exe
  C:\Windows\System\LvKEFZR.exe
  2⤵
  PID:8108
- C:\Windows\System\KPFvQhW.exe
  C:\Windows\System\KPFvQhW.exe
  2⤵
  PID:8164
- C:\Windows\System\GReVuoR.exe
  C:\Windows\System\GReVuoR.exe
  2⤵
  PID:8188
- C:\Windows\System\vHaCULT.exe
  C:\Windows\System\vHaCULT.exe
  2⤵
  PID:880
- C:\Windows\System\oglLNQq.exe
  C:\Windows\System\oglLNQq.exe
  2⤵
  PID:7164
- C:\Windows\System\KgbdPiq.exe
  C:\Windows\System\KgbdPiq.exe
  2⤵
  PID:7248
- C:\Windows\System\qLjgBMr.exe
  C:\Windows\System\qLjgBMr.exe
  2⤵
  PID:7316
- C:\Windows\System\pWaxmmz.exe
  C:\Windows\System\pWaxmmz.exe
  2⤵
  PID:7408
- C:\Windows\System\ShmfPwm.exe
  C:\Windows\System\ShmfPwm.exe
  2⤵
  PID:7436
- C:\Windows\System\VUTGuoM.exe
  C:\Windows\System\VUTGuoM.exe
  2⤵
  PID:7516
- C:\Windows\System\JFaXcSi.exe
  C:\Windows\System\JFaXcSi.exe
  2⤵
  PID:7664
- C:\Windows\System\FZTsyKr.exe
  C:\Windows\System\FZTsyKr.exe
  2⤵
  PID:7712
- C:\Windows\System\uowWeGo.exe
  C:\Windows\System\uowWeGo.exe
  2⤵
  PID:7816
- C:\Windows\System\SkfjJvW.exe
  C:\Windows\System\SkfjJvW.exe
  2⤵
  PID:7788
- C:\Windows\System\PIWbrzN.exe
  C:\Windows\System\PIWbrzN.exe
  2⤵
  PID:7880
- C:\Windows\System\vVpvqLK.exe
  C:\Windows\System\vVpvqLK.exe
  2⤵
  PID:1264
- C:\Windows\System\NFYRihq.exe
  C:\Windows\System\NFYRihq.exe
  2⤵
  PID:7912
- C:\Windows\System\YhTJXiB.exe
  C:\Windows\System\YhTJXiB.exe
  2⤵
  PID:7980
- C:\Windows\System\vmGzyCV.exe
  C:\Windows\System\vmGzyCV.exe
  2⤵
  PID:8072
- C:\Windows\System\MVBmItI.exe
  C:\Windows\System\MVBmItI.exe
  2⤵
  PID:8156
- C:\Windows\System\UpTTsea.exe
  C:\Windows\System\UpTTsea.exe
  2⤵
  PID:5208
- C:\Windows\System\DuyoJDB.exe
  C:\Windows\System\DuyoJDB.exe
  2⤵
  PID:7396
- C:\Windows\System\nkKTfeO.exe
  C:\Windows\System\nkKTfeO.exe
  2⤵
  PID:7440
- C:\Windows\System\RyHoIzJ.exe
  C:\Windows\System\RyHoIzJ.exe
  2⤵
  PID:7580
- C:\Windows\System\hYLxFmo.exe
  C:\Windows\System\hYLxFmo.exe
  2⤵
  PID:7768
- C:\Windows\System\zUfPjRh.exe
  C:\Windows\System\zUfPjRh.exe
  2⤵
  PID:3368
- C:\Windows\System\QGaLJIX.exe
  C:\Windows\System\QGaLJIX.exe
  2⤵
  PID:7984
- C:\Windows\System\elSXNJN.exe
  C:\Windows\System\elSXNJN.exe
  2⤵
  PID:7244
- C:\Windows\System\RKAQIEn.exe
  C:\Windows\System\RKAQIEn.exe
  2⤵
  PID:7232
- C:\Windows\System\zYvrjFd.exe
  C:\Windows\System\zYvrjFd.exe
  2⤵
  PID:7868
- C:\Windows\System\VHfylAI.exe
  C:\Windows\System\VHfylAI.exe
  2⤵
  PID:7956
- C:\Windows\System\ABBqvbY.exe
  C:\Windows\System\ABBqvbY.exe
  2⤵
  PID:8176
- C:\Windows\System\PCXGfYu.exe
  C:\Windows\System\PCXGfYu.exe
  2⤵
  PID:8212
- C:\Windows\System\hSJcLyd.exe
  C:\Windows\System\hSJcLyd.exe
  2⤵
  PID:8248
- C:\Windows\System\tyuNWVr.exe
  C:\Windows\System\tyuNWVr.exe
  2⤵
  PID:8280
- C:\Windows\System\MXninDG.exe
  C:\Windows\System\MXninDG.exe
  2⤵
  PID:8312
- C:\Windows\System\QPNYZuh.exe
  C:\Windows\System\QPNYZuh.exe
  2⤵
  PID:8340
- C:\Windows\System\VNdZFXI.exe
  C:\Windows\System\VNdZFXI.exe
  2⤵
  PID:8388
- C:\Windows\System\dzXTjFA.exe
  C:\Windows\System\dzXTjFA.exe
  2⤵
  PID:8416
- C:\Windows\System\tbQwZqX.exe
  C:\Windows\System\tbQwZqX.exe
  2⤵
  PID:8436
- C:\Windows\System\jlArOOc.exe
  C:\Windows\System\jlArOOc.exe
  2⤵
  PID:8468
- C:\Windows\System\EhcUkzn.exe
  C:\Windows\System\EhcUkzn.exe
  2⤵
  PID:8488
- C:\Windows\System\zTryNgT.exe
  C:\Windows\System\zTryNgT.exe
  2⤵
  PID:8516
- C:\Windows\System\lOZZYYc.exe
  C:\Windows\System\lOZZYYc.exe
  2⤵
  PID:8540
- C:\Windows\System\qHyIsAo.exe
  C:\Windows\System\qHyIsAo.exe
  2⤵
  PID:8560
- C:\Windows\System\GzBqEIt.exe
  C:\Windows\System\GzBqEIt.exe
  2⤵
  PID:8712
- C:\Windows\System\jtrwdKA.exe
  C:\Windows\System\jtrwdKA.exe
  2⤵
  PID:8736
- C:\Windows\System\sNzBQJX.exe
  C:\Windows\System\sNzBQJX.exe
  2⤵
  PID:8752
- C:\Windows\System\HpkhWFG.exe
  C:\Windows\System\HpkhWFG.exe
  2⤵
  PID:8772
- C:\Windows\System\EkwtLVz.exe
  C:\Windows\System\EkwtLVz.exe
  2⤵
  PID:8796
- C:\Windows\System\QzDLXKd.exe
  C:\Windows\System\QzDLXKd.exe
  2⤵
  PID:8820
- C:\Windows\System\LYeNuSt.exe
  C:\Windows\System\LYeNuSt.exe
  2⤵
  PID:8836
- C:\Windows\System\FxzhpAK.exe
  C:\Windows\System\FxzhpAK.exe
  2⤵
  PID:8876
- C:\Windows\System\YkvGYsE.exe
  C:\Windows\System\YkvGYsE.exe
  2⤵
  PID:8892
- C:\Windows\System\xseGKJp.exe
  C:\Windows\System\xseGKJp.exe
  2⤵
  PID:8916
- C:\Windows\System\SHexgNm.exe
  C:\Windows\System\SHexgNm.exe
  2⤵
  PID:8940
- C:\Windows\System\ribUYYF.exe
  C:\Windows\System\ribUYYF.exe
  2⤵
  PID:8960
- C:\Windows\System\mSvHAaY.exe
  C:\Windows\System\mSvHAaY.exe
  2⤵
  PID:8984
- C:\Windows\System\SBSxxZd.exe
  C:\Windows\System\SBSxxZd.exe
  2⤵
  PID:9008
- C:\Windows\System\atOyTfp.exe
  C:\Windows\System\atOyTfp.exe
  2⤵
  PID:9032
- C:\Windows\System\bkLxLhY.exe
  C:\Windows\System\bkLxLhY.exe
  2⤵
  PID:9048
- C:\Windows\System\uQgbTsl.exe
  C:\Windows\System\uQgbTsl.exe
  2⤵
  PID:9072
- C:\Windows\System\TazZkTf.exe
  C:\Windows\System\TazZkTf.exe
  2⤵
  PID:9156
- C:\Windows\System\xajYpAK.exe
  C:\Windows\System\xajYpAK.exe
  2⤵
  PID:9184
- C:\Windows\System\oFQdSAM.exe
  C:\Windows\System\oFQdSAM.exe
  2⤵
  PID:9200
- C:\Windows\System\sBbfcdV.exe
  C:\Windows\System\sBbfcdV.exe
  2⤵
  PID:7896
- C:\Windows\System\APvQFTR.exe
  C:\Windows\System\APvQFTR.exe
  2⤵
  PID:4264
- C:\Windows\System\VYrcSXI.exe
  C:\Windows\System\VYrcSXI.exe
  2⤵
  PID:8220
- C:\Windows\System\scmumhM.exe
  C:\Windows\System\scmumhM.exe
  2⤵
  PID:8288
- C:\Windows\System\SOynjkw.exe
  C:\Windows\System\SOynjkw.exe
  2⤵
  PID:8308
- C:\Windows\System\YmBafeT.exe
  C:\Windows\System\YmBafeT.exe
  2⤵
  PID:8352
- C:\Windows\System\aPTDdch.exe
  C:\Windows\System\aPTDdch.exe
  2⤵
  PID:8384
- C:\Windows\System\WySyyNA.exe
  C:\Windows\System\WySyyNA.exe
  2⤵
  PID:8408
- C:\Windows\System\gsoAkoA.exe
  C:\Windows\System\gsoAkoA.exe
  2⤵
  PID:8456
- C:\Windows\System\cdmuDCZ.exe
  C:\Windows\System\cdmuDCZ.exe
  2⤵
  PID:8480
- C:\Windows\System\JOpGRdD.exe
  C:\Windows\System\JOpGRdD.exe
  2⤵
  PID:8548
- C:\Windows\System\iOyMwfA.exe
  C:\Windows\System\iOyMwfA.exe
  2⤵
  PID:8580
- C:\Windows\System\IArteGa.exe
  C:\Windows\System\IArteGa.exe
  2⤵
  PID:8648
- C:\Windows\System\uktxFIb.exe
  C:\Windows\System\uktxFIb.exe
  2⤵
  PID:8672
- C:\Windows\System\tXjWYgm.exe
  C:\Windows\System\tXjWYgm.exe
  2⤵
  PID:8692
- C:\Windows\System\BAuxwGP.exe
  C:\Windows\System\BAuxwGP.exe
  2⤵
  PID:8708
- C:\Windows\System\yBAUjky.exe
  C:\Windows\System\yBAUjky.exe
  2⤵
  PID:8720
- C:\Windows\System\ojkftlU.exe
  C:\Windows\System\ojkftlU.exe
  2⤵
  PID:8788
- C:\Windows\System\JJVENly.exe
  C:\Windows\System\JJVENly.exe
  2⤵
  PID:8816
- C:\Windows\System\DauNQdc.exe
  C:\Windows\System\DauNQdc.exe
  2⤵
  PID:8884
- C:\Windows\System\JEhQRDK.exe
  C:\Windows\System\JEhQRDK.exe
  2⤵
  PID:8912
- C:\Windows\System\RtzwiWu.exe
  C:\Windows\System\RtzwiWu.exe
  2⤵
  PID:9116
- C:\Windows\System\vVAQKnE.exe
  C:\Windows\System\vVAQKnE.exe
  2⤵
  PID:9028
- C:\Windows\System\xIJbCaC.exe
  C:\Windows\System\xIJbCaC.exe
  2⤵
  PID:8588
- C:\Windows\System\kCQFuEr.exe
  C:\Windows\System\kCQFuEr.exe
  2⤵
  PID:8268
- C:\Windows\System\dldSQsZ.exe
  C:\Windows\System\dldSQsZ.exe
  2⤵
  PID:8336
- C:\Windows\System\hVGQibo.exe
  C:\Windows\System\hVGQibo.exe
  2⤵
  PID:7876
- C:\Windows\System\yxmtloJ.exe
  C:\Windows\System\yxmtloJ.exe
  2⤵
  PID:8276
- C:\Windows\System\sScQpGR.exe
  C:\Windows\System\sScQpGR.exe
  2⤵
  PID:8804
- C:\Windows\System\eBDCEyx.exe
  C:\Windows\System\eBDCEyx.exe
  2⤵
  PID:9064
- C:\Windows\System\lTCrzRV.exe
  C:\Windows\System\lTCrzRV.exe
  2⤵
  PID:8532
- C:\Windows\System\LhwCshQ.exe
  C:\Windows\System\LhwCshQ.exe
  2⤵
  PID:9196
- C:\Windows\System\CJLDshe.exe
  C:\Windows\System\CJLDshe.exe
  2⤵
  PID:8680
- C:\Windows\System\bsfltOL.exe
  C:\Windows\System\bsfltOL.exe
  2⤵
  PID:8260
- C:\Windows\System\INbbUgP.exe
  C:\Windows\System\INbbUgP.exe
  2⤵
  PID:5096
- C:\Windows\System\tqgtJUa.exe
  C:\Windows\System\tqgtJUa.exe
  2⤵
  PID:9240
- C:\Windows\System\kHORVqi.exe
  C:\Windows\System\kHORVqi.exe
  2⤵
  PID:9264
- C:\Windows\System\YBHmWWb.exe
  C:\Windows\System\YBHmWWb.exe
  2⤵
  PID:9284
- C:\Windows\System\adKBYie.exe
  C:\Windows\System\adKBYie.exe
  2⤵
  PID:9312
- C:\Windows\System\cVsDvCj.exe
  C:\Windows\System\cVsDvCj.exe
  2⤵
  PID:9328
- C:\Windows\System\JMffEzm.exe
  C:\Windows\System\JMffEzm.exe
  2⤵
  PID:9424
- C:\Windows\System\MqVjXoG.exe
  C:\Windows\System\MqVjXoG.exe
  2⤵
  PID:9444
- C:\Windows\System\lmJHNam.exe
  C:\Windows\System\lmJHNam.exe
  2⤵
  PID:9472
- C:\Windows\System\WCFOmQR.exe
  C:\Windows\System\WCFOmQR.exe
  2⤵
  PID:9488
- C:\Windows\System\ZRaVaCz.exe
  C:\Windows\System\ZRaVaCz.exe
  2⤵
  PID:9592
- C:\Windows\System\pOdNedy.exe
  C:\Windows\System\pOdNedy.exe
  2⤵
  PID:9696
- C:\Windows\System\iTrKcqD.exe
  C:\Windows\System\iTrKcqD.exe
  2⤵
  PID:9772
- C:\Windows\System\qhewjDM.exe
  C:\Windows\System\qhewjDM.exe
  2⤵
  PID:9804
- C:\Windows\System\xplDUyJ.exe
  C:\Windows\System\xplDUyJ.exe
  2⤵
  PID:9824
- C:\Windows\System\plhLwHN.exe
  C:\Windows\System\plhLwHN.exe
  2⤵
  PID:9908
- C:\Windows\System\rwJeGaj.exe
  C:\Windows\System\rwJeGaj.exe
  2⤵
  PID:9936
- C:\Windows\System\qZwkPDT.exe
  C:\Windows\System\qZwkPDT.exe
  2⤵
  PID:9952
- C:\Windows\System\RzVJYth.exe
  C:\Windows\System\RzVJYth.exe
  2⤵
  PID:9984
- C:\Windows\System\zUjNbdH.exe
  C:\Windows\System\zUjNbdH.exe
  2⤵
  PID:10004
- C:\Windows\System\QrLZCLP.exe
  C:\Windows\System\QrLZCLP.exe
  2⤵
  PID:10024
- C:\Windows\System\HMZTmDx.exe
  C:\Windows\System\HMZTmDx.exe
  2⤵
  PID:10052
- C:\Windows\System\kvaHZZS.exe
  C:\Windows\System\kvaHZZS.exe
  2⤵
  PID:10116
- C:\Windows\System\xnkqPdm.exe
  C:\Windows\System\xnkqPdm.exe
  2⤵
  PID:10136
- C:\Windows\System\CbXESwu.exe
  C:\Windows\System\CbXESwu.exe
  2⤵
  PID:10164
- C:\Windows\System\fBBKgWP.exe
  C:\Windows\System\fBBKgWP.exe
  2⤵
  PID:10180
- C:\Windows\System\DEDBfYz.exe
  C:\Windows\System\DEDBfYz.exe
  2⤵
  PID:10204
- C:\Windows\System\LghdrrE.exe
  C:\Windows\System\LghdrrE.exe
  2⤵
  PID:10224
- C:\Windows\System\PElTruO.exe
  C:\Windows\System\PElTruO.exe
  2⤵
  PID:8460
- C:\Windows\System\nUYwGaH.exe
  C:\Windows\System\nUYwGaH.exe
  2⤵
  PID:8780
- C:\Windows\System\cOReGCX.exe
  C:\Windows\System\cOReGCX.exe
  2⤵
  PID:8240
- C:\Windows\System\xWtzcmi.exe
  C:\Windows\System\xWtzcmi.exe
  2⤵
  PID:9300
- C:\Windows\System\IljrDhE.exe
  C:\Windows\System\IljrDhE.exe
  2⤵
  PID:9336
- C:\Windows\System\GrTJNXX.exe
  C:\Windows\System\GrTJNXX.exe
  2⤵
  PID:9084
- C:\Windows\System\rkXmSQq.exe
  C:\Windows\System\rkXmSQq.exe
  2⤵
  PID:5660
- C:\Windows\System\YCSiQCU.exe
  C:\Windows\System\YCSiQCU.exe
  2⤵
  PID:9220
- C:\Windows\System\bKcQAPt.exe
  C:\Windows\System\bKcQAPt.exe
  2⤵
  PID:9256
- C:\Windows\System\skQOMsW.exe
  C:\Windows\System\skQOMsW.exe
  2⤵
  PID:9320
- C:\Windows\System\vaeSfcW.exe
  C:\Windows\System\vaeSfcW.exe
  2⤵
  PID:9568
- C:\Windows\System\vEVBsjW.exe
  C:\Windows\System\vEVBsjW.exe
  2⤵
  PID:9432
- C:\Windows\System\apeFMaq.exe
  C:\Windows\System\apeFMaq.exe
  2⤵
  PID:9624
- C:\Windows\System\NLlGiBe.exe
  C:\Windows\System\NLlGiBe.exe
  2⤵
  PID:2780
- C:\Windows\System\nodNDTn.exe
  C:\Windows\System\nodNDTn.exe
  2⤵
  PID:9588
- C:\Windows\System\nCWNWch.exe
  C:\Windows\System\nCWNWch.exe
  2⤵
  PID:9612
- C:\Windows\System\VIStXKJ.exe
  C:\Windows\System\VIStXKJ.exe
  2⤵
  PID:9744
- C:\Windows\System\SYTadSx.exe
  C:\Windows\System\SYTadSx.exe
  2⤵
  PID:3096
- C:\Windows\System\PPFKQLW.exe
  C:\Windows\System\PPFKQLW.exe
  2⤵
  PID:9756
- C:\Windows\System\POiXqBt.exe
  C:\Windows\System\POiXqBt.exe
  2⤵
  PID:9860
- C:\Windows\System\ExrIZro.exe
  C:\Windows\System\ExrIZro.exe
  2⤵
  PID:5372
- C:\Windows\System\ZZWuyvU.exe
  C:\Windows\System\ZZWuyvU.exe
  2⤵
  PID:9880
- C:\Windows\System\AISZRBQ.exe
  C:\Windows\System\AISZRBQ.exe
  2⤵
  PID:10016
- C:\Windows\System\EjxAxFH.exe
  C:\Windows\System\EjxAxFH.exe
  2⤵
  PID:10220
- C:\Windows\System\JSMQFgO.exe
  C:\Windows\System\JSMQFgO.exe
  2⤵
  PID:5556
- C:\Windows\System\GgcniYU.exe
  C:\Windows\System\GgcniYU.exe
  2⤵
  PID:10132
- C:\Windows\System\EnGGhXA.exe
  C:\Windows\System\EnGGhXA.exe
  2⤵
  PID:8364
- C:\Windows\System\BeNZBYx.exe
  C:\Windows\System\BeNZBYx.exe
  2⤵
  PID:10152
- C:\Windows\System\pdZmLDA.exe
  C:\Windows\System\pdZmLDA.exe
  2⤵
  PID:8620
- C:\Windows\System\WroCrQN.exe
  C:\Windows\System\WroCrQN.exe
  2⤵
  PID:9040
- C:\Windows\System\bpAHfme.exe
  C:\Windows\System\bpAHfme.exe
  2⤵
  PID:3536
- C:\Windows\System\FXggxTS.exe
  C:\Windows\System\FXggxTS.exe
  2⤵
  PID:5664
- C:\Windows\System\dVeAowT.exe
  C:\Windows\System\dVeAowT.exe
  2⤵
  PID:9604
- C:\Windows\System\UkjwoIH.exe
  C:\Windows\System\UkjwoIH.exe
  2⤵
  PID:9440
- C:\Windows\System\mfZWeEd.exe
  C:\Windows\System\mfZWeEd.exe
  2⤵
  PID:4024
- C:\Windows\System\DpgTSwm.exe
  C:\Windows\System\DpgTSwm.exe
  2⤵
  PID:9784
- C:\Windows\System\hqGJtHU.exe
  C:\Windows\System\hqGJtHU.exe
  2⤵
  PID:9436
- C:\Windows\System\ifbafik.exe
  C:\Windows\System\ifbafik.exe
  2⤵
  PID:3680
- C:\Windows\System\AyqvjLo.exe
  C:\Windows\System\AyqvjLo.exe
  2⤵
  PID:9280
- C:\Windows\System\gLxWwNW.exe
  C:\Windows\System\gLxWwNW.exe
  2⤵
  PID:5844
- C:\Windows\System\SWXiJbb.exe
  C:\Windows\System\SWXiJbb.exe
  2⤵
  PID:9852
- C:\Windows\System\SZzgDlf.exe
  C:\Windows\System\SZzgDlf.exe
  2⤵
  PID:9720
- C:\Windows\System\BJbPSkk.exe
  C:\Windows\System\BJbPSkk.exe
  2⤵
  PID:1792
- C:\Windows\System\QdLAymK.exe
  C:\Windows\System\QdLAymK.exe
  2⤵
  PID:8048
- C:\Windows\System\riSbSWn.exe
  C:\Windows\System\riSbSWn.exe
  2⤵
  PID:1952
- C:\Windows\System\xokoBYE.exe
  C:\Windows\System\xokoBYE.exe
  2⤵
  PID:10252
- C:\Windows\System\QQtGgam.exe
  C:\Windows\System\QQtGgam.exe
  2⤵
  PID:10272
- C:\Windows\System\gzVMXlk.exe
  C:\Windows\System\gzVMXlk.exe
  2⤵
  PID:10296
- C:\Windows\System\sCfvlsA.exe
  C:\Windows\System\sCfvlsA.exe
  2⤵
  PID:10324
- C:\Windows\System\NdxIssO.exe
  C:\Windows\System\NdxIssO.exe
  2⤵
  PID:10344
- C:\Windows\System\GYWlJXV.exe
  C:\Windows\System\GYWlJXV.exe
  2⤵
  PID:10368
- C:\Windows\System\YCDGldP.exe
  C:\Windows\System\YCDGldP.exe
  2⤵
  PID:10472
- C:\Windows\System\hpCpGJw.exe
  C:\Windows\System\hpCpGJw.exe
  2⤵
  PID:10488
- C:\Windows\System\CLSbnqS.exe
  C:\Windows\System\CLSbnqS.exe
  2⤵
  PID:10756
- C:\Windows\System\TzZdYYm.exe
  C:\Windows\System\TzZdYYm.exe
  2⤵
  PID:10772
- C:\Windows\System\foPVTea.exe
  C:\Windows\System\foPVTea.exe
  2⤵
  PID:10792
- C:\Windows\System\NZfFmKW.exe
  C:\Windows\System\NZfFmKW.exe
  2⤵
  PID:10812
- C:\Windows\System\hfGswZw.exe
  C:\Windows\System\hfGswZw.exe
  2⤵
  PID:10836
- C:\Windows\System\KfCGmFK.exe
  C:\Windows\System\KfCGmFK.exe
  2⤵
  PID:10860
- C:\Windows\System\nMGvOxx.exe
  C:\Windows\System\nMGvOxx.exe
  2⤵
  PID:10884
- C:\Windows\System\TtjTIno.exe
  C:\Windows\System\TtjTIno.exe
  2⤵
  PID:10904
- C:\Windows\System\rsLmvtA.exe
  C:\Windows\System\rsLmvtA.exe
  2⤵
  PID:10924
- C:\Windows\System\mNHlrjS.exe
  C:\Windows\System\mNHlrjS.exe
  2⤵
  PID:10944
- C:\Windows\System\oiiakpK.exe
  C:\Windows\System\oiiakpK.exe
  2⤵
  PID:11032
- C:\Windows\System\JVjmWGA.exe
  C:\Windows\System\JVjmWGA.exe
  2⤵
  PID:11048
- C:\Windows\System\icGEhzB.exe
  C:\Windows\System\icGEhzB.exe
  2⤵
  PID:11068
- C:\Windows\System\jdDRVnX.exe
  C:\Windows\System\jdDRVnX.exe
  2⤵
  PID:11088
- C:\Windows\System\Ntuulry.exe
  C:\Windows\System\Ntuulry.exe
  2⤵
  PID:11104
- C:\Windows\System\vXQsLSN.exe
  C:\Windows\System\vXQsLSN.exe
  2⤵
  PID:11124
- C:\Windows\System\UAEEJdt.exe
  C:\Windows\System\UAEEJdt.exe
  2⤵
  PID:11140
- C:\Windows\System\tDOuwjg.exe
  C:\Windows\System\tDOuwjg.exe
  2⤵
  PID:11168
- C:\Windows\System\RXFjgIB.exe
  C:\Windows\System\RXFjgIB.exe
  2⤵
  PID:11184
- C:\Windows\System\nsyNtGo.exe
  C:\Windows\System\nsyNtGo.exe
  2⤵
  PID:11204
- C:\Windows\System\uTApeTk.exe
  C:\Windows\System\uTApeTk.exe
  2⤵
  PID:11232
- C:\Windows\System\kibzoZb.exe
  C:\Windows\System\kibzoZb.exe
  2⤵
  PID:11256
- C:\Windows\System\MJKztdO.exe
  C:\Windows\System\MJKztdO.exe
  2⤵
  PID:10200
- C:\Windows\System\cPRBKiV.exe
  C:\Windows\System\cPRBKiV.exe
  2⤵
  PID:9992
- C:\Windows\System\QmsjiQD.exe
  C:\Windows\System\QmsjiQD.exe
  2⤵
  PID:6024
- C:\Windows\System\zJxaqOk.exe
  C:\Windows\System\zJxaqOk.exe
  2⤵
  PID:9896
- C:\Windows\System\srNWiyj.exe
  C:\Windows\System\srNWiyj.exe
  2⤵
  PID:6120
- C:\Windows\System\YHgYCIZ.exe
  C:\Windows\System\YHgYCIZ.exe
  2⤵
  PID:10032
- C:\Windows\System\YxdddEu.exe
  C:\Windows\System\YxdddEu.exe
  2⤵
  PID:10468
- C:\Windows\System\LIKYSOX.exe
  C:\Windows\System\LIKYSOX.exe
  2⤵
  PID:9764
- C:\Windows\System\Okcuwpc.exe
  C:\Windows\System\Okcuwpc.exe
  2⤵
  PID:9276
- C:\Windows\System\YfTNcnZ.exe
  C:\Windows\System\YfTNcnZ.exe
  2⤵
  PID:10704
- C:\Windows\System\nTxrAvq.exe
  C:\Windows\System\nTxrAvq.exe
  2⤵
  PID:9308
- C:\Windows\System\VkaAwaF.exe
  C:\Windows\System\VkaAwaF.exe
  2⤵
  PID:10564
- C:\Windows\System\MCNpTyk.exe
  C:\Windows\System\MCNpTyk.exe
  2⤵
  PID:10780
- C:\Windows\System\lFxIJBu.exe
  C:\Windows\System\lFxIJBu.exe
  2⤵
  PID:10920
- C:\Windows\System\MZillta.exe
  C:\Windows\System\MZillta.exe
  2⤵
  PID:1300
- C:\Windows\System\PWDjpTf.exe
  C:\Windows\System\PWDjpTf.exe
  2⤵
  PID:10976
- C:\Windows\System\NLhnLRf.exe
  C:\Windows\System\NLhnLRf.exe
  2⤵
  PID:10996
- C:\Windows\System\XmFGuJb.exe
  C:\Windows\System\XmFGuJb.exe
  2⤵
  PID:11008
- C:\Windows\System\toKXfNf.exe
  C:\Windows\System\toKXfNf.exe
  2⤵
  PID:11020
- C:\Windows\System\CkNowsi.exe
  C:\Windows\System\CkNowsi.exe
  2⤵
  PID:11064
- C:\Windows\System\dmkkSXj.exe
  C:\Windows\System\dmkkSXj.exe
  2⤵
  PID:10960
- C:\Windows\System\oMuUyoY.exe
  C:\Windows\System\oMuUyoY.exe
  2⤵
  PID:11160
- C:\Windows\System\KAcDLGS.exe
  C:\Windows\System\KAcDLGS.exe
  2⤵
  PID:908
- C:\Windows\System\xDfVGzm.exe
  C:\Windows\System\xDfVGzm.exe
  2⤵
  PID:11192
- C:\Windows\System\bhSiLXO.exe
  C:\Windows\System\bhSiLXO.exe
  2⤵
  PID:11216
- C:\Windows\System\vNSFpWV.exe
  C:\Windows\System\vNSFpWV.exe
  2⤵
  PID:9524
- C:\Windows\System\FgCPVYp.exe
  C:\Windows\System\FgCPVYp.exe
  2⤵
  PID:10932
- C:\Windows\System\cNsypAX.exe
  C:\Windows\System\cNsypAX.exe
  2⤵
  PID:1432
- C:\Windows\System\FqpxqTt.exe
  C:\Windows\System\FqpxqTt.exe
  2⤵
  PID:4000
- C:\Windows\System\hNZTSUX.exe
  C:\Windows\System\hNZTSUX.exe
  2⤵
  PID:11152
- C:\Windows\System\tWdbCaD.exe
  C:\Windows\System\tWdbCaD.exe
  2⤵
  PID:4556
- C:\Windows\System\kxCqRVr.exe
  C:\Windows\System\kxCqRVr.exe
  2⤵
  PID:8536
- C:\Windows\System\zVtQasR.exe
  C:\Windows\System\zVtQasR.exe
  2⤵
  PID:11116
- C:\Windows\System\egOgduZ.exe
  C:\Windows\System\egOgduZ.exe
  2⤵
  PID:10868
- C:\Windows\System\XMXdGNi.exe
  C:\Windows\System\XMXdGNi.exe
  2⤵
  PID:10824
- C:\Windows\System\lMughVh.exe
  C:\Windows\System\lMughVh.exe
  2⤵
  PID:1172
- C:\Windows\System\QWLoLBK.exe
  C:\Windows\System\QWLoLBK.exe
  2⤵
  PID:11228
- C:\Windows\System\lpwDPfQ.exe
  C:\Windows\System\lpwDPfQ.exe
  2⤵
  PID:1956
- C:\Windows\System\mKvxYvH.exe
  C:\Windows\System\mKvxYvH.exe
  2⤵
  PID:4992
- C:\Windows\System\uCjHcEY.exe
  C:\Windows\System\uCjHcEY.exe
  2⤵
  PID:10548
- C:\Windows\System\iBFawIM.exe
  C:\Windows\System\iBFawIM.exe
  2⤵
  PID:10988
- C:\Windows\System\PuJlQfu.exe
  C:\Windows\System\PuJlQfu.exe
  2⤵
  PID:10872
- C:\Windows\System\FQrlsOf.exe
  C:\Windows\System\FQrlsOf.exe
  2⤵
  PID:11056
- C:\Windows\System\eTcuGqM.exe
  C:\Windows\System\eTcuGqM.exe
  2⤵
  PID:4356
- C:\Windows\System\vtZjrLF.exe
  C:\Windows\System\vtZjrLF.exe
  2⤵
  PID:10480
- C:\Windows\System\xKsJSZL.exe
  C:\Windows\System\xKsJSZL.exe
  2⤵
  PID:10828
- C:\Windows\System\PWAbFNJ.exe
  C:\Windows\System\PWAbFNJ.exe
  2⤵
  PID:11284
- C:\Windows\System\XSBhtGU.exe
  C:\Windows\System\XSBhtGU.exe
  2⤵
  PID:11456
- C:\Windows\System\cPIvjLL.exe
  C:\Windows\System\cPIvjLL.exe
  2⤵
  PID:11476
- C:\Windows\System\NNokhRO.exe
  C:\Windows\System\NNokhRO.exe
  2⤵
  PID:11492
- C:\Windows\System\yntTTAs.exe
  C:\Windows\System\yntTTAs.exe
  2⤵
  PID:11508
- C:\Windows\System\KviXBxA.exe
  C:\Windows\System\KviXBxA.exe
  2⤵
  PID:11540
- C:\Windows\System\jCNwcqz.exe
  C:\Windows\System\jCNwcqz.exe
  2⤵
  PID:11556
- C:\Windows\System\CQCAvdo.exe
  C:\Windows\System\CQCAvdo.exe
  2⤵
  PID:11584
- C:\Windows\System\LYKKQKE.exe
  C:\Windows\System\LYKKQKE.exe
  2⤵
  PID:11604
- C:\Windows\System\SWGfZFp.exe
  C:\Windows\System\SWGfZFp.exe
  2⤵
  PID:11624
- C:\Windows\System\oaDczkP.exe
  C:\Windows\System\oaDczkP.exe
  2⤵
  PID:11644
- C:\Windows\System\oCsXCmq.exe
  C:\Windows\System\oCsXCmq.exe
  2⤵
  PID:11668
- C:\Windows\System\RkdXrsc.exe
  C:\Windows\System\RkdXrsc.exe
  2⤵
  PID:11860
- C:\Windows\System\RybMalv.exe
  C:\Windows\System\RybMalv.exe
  2⤵
  PID:11880
- C:\Windows\System\SQySrxq.exe
  C:\Windows\System\SQySrxq.exe
  2⤵
  PID:11896
- C:\Windows\System\mAYBndU.exe
  C:\Windows\System\mAYBndU.exe
  2⤵
  PID:11916
- C:\Windows\System\WruNWzO.exe
  C:\Windows\System\WruNWzO.exe
  2⤵
  PID:11940
- C:\Windows\System\JidjBrl.exe
  C:\Windows\System\JidjBrl.exe
  2⤵
  PID:11960
- C:\Windows\System\FtytMzw.exe
  C:\Windows\System\FtytMzw.exe
  2⤵
  PID:11976
- C:\Windows\System\gXmzLxF.exe
  C:\Windows\System\gXmzLxF.exe
  2⤵
  PID:11996
- C:\Windows\System\BLvIbni.exe
  C:\Windows\System\BLvIbni.exe
  2⤵
  PID:12012
- C:\Windows\System\JzbBMVs.exe
  C:\Windows\System\JzbBMVs.exe
  2⤵
  PID:12028
- C:\Windows\System\bKmJlXu.exe
  C:\Windows\System\bKmJlXu.exe
  2⤵
  PID:12048
- C:\Windows\System\LsmuLPc.exe
  C:\Windows\System\LsmuLPc.exe
  2⤵
  PID:12072
- C:\Windows\System\feylERc.exe
  C:\Windows\System\feylERc.exe
  2⤵
  PID:12096
- C:\Windows\System\mzAxZqb.exe
  C:\Windows\System\mzAxZqb.exe
  2⤵
  PID:12112
- C:\Windows\System\sFTFwOx.exe
  C:\Windows\System\sFTFwOx.exe
  2⤵
  PID:12132
- C:\Windows\System\mExpiiz.exe
  C:\Windows\System\mExpiiz.exe
  2⤵
  PID:12156
- C:\Windows\System\sHgDzrO.exe
  C:\Windows\System\sHgDzrO.exe
  2⤵
  PID:12172
- C:\Windows\System\zYkcCNL.exe
  C:\Windows\System\zYkcCNL.exe
  2⤵
  PID:12192
- C:\Windows\System\BFgvAaJ.exe
  C:\Windows\System\BFgvAaJ.exe
  2⤵
  PID:12220
- C:\Windows\System\pklMqPw.exe
  C:\Windows\System\pklMqPw.exe
  2⤵
  PID:12240
- C:\Windows\System\DaCcrkI.exe
  C:\Windows\System\DaCcrkI.exe
  2⤵
  PID:12268
- C:\Windows\System\SstkPUE.exe
  C:\Windows\System\SstkPUE.exe
  2⤵
  PID:2496
- C:\Windows\System\fdeNqus.exe
  C:\Windows\System\fdeNqus.exe
  2⤵
  PID:10384
- C:\Windows\System\xwgwJOD.exe
  C:\Windows\System\xwgwJOD.exe
  2⤵
  PID:10336
- C:\Windows\System\cEEjruj.exe
  C:\Windows\System\cEEjruj.exe
  2⤵
  PID:10676
- C:\Windows\System\zYlCpRD.exe
  C:\Windows\System\zYlCpRD.exe
  2⤵
  PID:6116
- C:\Windows\System\CiBGCag.exe
  C:\Windows\System\CiBGCag.exe
  2⤵
  PID:4360
- C:\Windows\System\aXbJhMU.exe
  C:\Windows\System\aXbJhMU.exe
  2⤵
  PID:3944
- C:\Windows\System\hYPoZbt.exe
  C:\Windows\System\hYPoZbt.exe
  2⤵
  PID:11340
- C:\Windows\System\HuSLOnh.exe
  C:\Windows\System\HuSLOnh.exe
  2⤵
  PID:10084
- C:\Windows\System\FjDEZeN.exe
  C:\Windows\System\FjDEZeN.exe
  2⤵
  PID:9260
- C:\Windows\System\PblPHia.exe
  C:\Windows\System\PblPHia.exe
  2⤵
  PID:3372
- C:\Windows\System\QHOPFQj.exe
  C:\Windows\System\QHOPFQj.exe
  2⤵
  PID:3088
- C:\Windows\System\iIZHmjx.exe
  C:\Windows\System\iIZHmjx.exe
  2⤵
  PID:11076
- C:\Windows\System\AZXVbPE.exe
  C:\Windows\System\AZXVbPE.exe
  2⤵
  PID:11276
- C:\Windows\System\UfSXMiJ.exe
  C:\Windows\System\UfSXMiJ.exe
  2⤵
  PID:11452
- C:\Windows\System\JYYIAqM.exe
  C:\Windows\System\JYYIAqM.exe
  2⤵
  PID:2296
- C:\Windows\System\qkOQMPl.exe
  C:\Windows\System\qkOQMPl.exe
  2⤵
  PID:11520
- C:\Windows\System\WpvwkSq.exe
  C:\Windows\System\WpvwkSq.exe
  2⤵
  PID:11616
- C:\Windows\System\SVVzXwT.exe
  C:\Windows\System\SVVzXwT.exe
  2⤵
  PID:11368
- C:\Windows\System\wXCurSa.exe
  C:\Windows\System\wXCurSa.exe
  2⤵
  PID:11652
- C:\Windows\System\LIlANyf.exe
  C:\Windows\System\LIlANyf.exe
  2⤵
  PID:11664
- C:\Windows\System\ZADatvJ.exe
  C:\Windows\System\ZADatvJ.exe
  2⤵
  PID:5996
- C:\Windows\System\hewHyWp.exe
  C:\Windows\System\hewHyWp.exe
  2⤵
  PID:11472
- C:\Windows\System\zAOwOCd.exe
  C:\Windows\System\zAOwOCd.exe
  2⤵
  PID:11324
- C:\Windows\System\VHMcDjU.exe
  C:\Windows\System\VHMcDjU.exe
  2⤵
  PID:11548
- C:\Windows\System\wfAxkIu.exe
  C:\Windows\System\wfAxkIu.exe
  2⤵
  PID:1704
- C:\Windows\System\flSvuss.exe
  C:\Windows\System\flSvuss.exe
  2⤵
  PID:11384
- C:\Windows\System\joosmSn.exe
  C:\Windows\System\joosmSn.exe
  2⤵
  PID:2104
- C:\Windows\System\motqwzB.exe
  C:\Windows\System\motqwzB.exe
  2⤵
  PID:3300
- C:\Windows\System\NHcqNGU.exe
  C:\Windows\System\NHcqNGU.exe
  2⤵
  PID:11820
- C:\Windows\System\VWdcAhe.exe
  C:\Windows\System\VWdcAhe.exe
  2⤵
  PID:11844
- C:\Windows\System\yutXtMh.exe
  C:\Windows\System\yutXtMh.exe
  2⤵
  PID:12040
- C:\Windows\System\nfZPaDo.exe
  C:\Windows\System\nfZPaDo.exe
  2⤵
  PID:696
- C:\Windows\System\ANiWwMy.exe
  C:\Windows\System\ANiWwMy.exe
  2⤵
  PID:1028
- C:\Windows\System\AtcOOKf.exe
  C:\Windows\System\AtcOOKf.exe
  2⤵
  PID:4108
- C:\Windows\System\AfDqMsZ.exe
  C:\Windows\System\AfDqMsZ.exe
  2⤵
  PID:12212
- C:\Windows\System\LJeSTZH.exe
  C:\Windows\System\LJeSTZH.exe
  2⤵
  PID:11816
- C:\Windows\System\OSdpcig.exe
  C:\Windows\System\OSdpcig.exe
  2⤵
  PID:10764
- C:\Windows\System\eJEOZeq.exe
  C:\Windows\System\eJEOZeq.exe
  2⤵
  PID:11420
- C:\Windows\System\FMIyBor.exe
  C:\Windows\System\FMIyBor.exe
  2⤵
  PID:3816
- C:\Windows\System\cPYWKXR.exe
  C:\Windows\System\cPYWKXR.exe
  2⤵
  PID:3852
- C:\Windows\System\WdZOmFb.exe
  C:\Windows\System\WdZOmFb.exe
  2⤵
  PID:5528
- C:\Windows\System\TRlgpwb.exe
  C:\Windows\System\TRlgpwb.exe
  2⤵
  PID:10100
- C:\Windows\System\turVpUe.exe
  C:\Windows\System\turVpUe.exe
  2⤵
  PID:11552
- C:\Windows\System\RXWAmpm.exe
  C:\Windows\System\RXWAmpm.exe
  2⤵
  PID:1048
- C:\Windows\System\BGajJZj.exe
  C:\Windows\System\BGajJZj.exe
  2⤵
  PID:11912
- C:\Windows\System\MAxxGtb.exe
  C:\Windows\System\MAxxGtb.exe
  2⤵
  PID:620
- C:\Windows\System\fDaaqXU.exe
  C:\Windows\System\fDaaqXU.exe
  2⤵
  PID:2672
- C:\Windows\System\NoKIPZG.exe
  C:\Windows\System\NoKIPZG.exe
  2⤵
  PID:6856
- C:\Windows\System\NUOTcOv.exe
  C:\Windows\System\NUOTcOv.exe
  2⤵
  PID:6880
- C:\Windows\System\IXmjrWB.exe
  C:\Windows\System\IXmjrWB.exe
  2⤵
  PID:7028
- C:\Windows\System\KgfFinC.exe
  C:\Windows\System\KgfFinC.exe
  2⤵
  PID:11296
- C:\Windows\System\DBwaSCB.exe
  C:\Windows\System\DBwaSCB.exe
  2⤵
  PID:11308
- C:\Windows\System\bxZSMaw.exe
  C:\Windows\System\bxZSMaw.exe
  2⤵
  PID:11796
- C:\Windows\System\NtFQNfA.exe
  C:\Windows\System\NtFQNfA.exe
  2⤵
  PID:2320
- C:\Windows\System\jgpjOpe.exe
  C:\Windows\System\jgpjOpe.exe
  2⤵
  PID:11348
- C:\Windows\System\dBhaqvR.exe
  C:\Windows\System\dBhaqvR.exe
  2⤵
  PID:12300
- C:\Windows\System\xQNAckN.exe
  C:\Windows\System\xQNAckN.exe
  2⤵
  PID:12320
- C:\Windows\System\oDRpDst.exe
  C:\Windows\System\oDRpDst.exe
  2⤵
  PID:12340
- C:\Windows\System\jKQLscc.exe
  C:\Windows\System\jKQLscc.exe
  2⤵
  PID:12360
- C:\Windows\System\BZTabTQ.exe
  C:\Windows\System\BZTabTQ.exe
  2⤵
  PID:12400
- C:\Windows\System\zFNfcou.exe
  C:\Windows\System\zFNfcou.exe
  2⤵
  PID:12424
- C:\Windows\System\AsSbQZF.exe
  C:\Windows\System\AsSbQZF.exe
  2⤵
  PID:12448
- C:\Windows\System\rNTVxqe.exe
  C:\Windows\System\rNTVxqe.exe
  2⤵
  PID:12472
- C:\Windows\System\HxiIWOk.exe
  C:\Windows\System\HxiIWOk.exe
  2⤵
  PID:12496
- C:\Windows\System\BruOaAu.exe
  C:\Windows\System\BruOaAu.exe
  2⤵
  PID:12516
- C:\Windows\System\dGFHvKv.exe
  C:\Windows\System\dGFHvKv.exe
  2⤵
  PID:12536
- C:\Windows\System\lWaqIEp.exe
  C:\Windows\System\lWaqIEp.exe
  2⤵
  PID:12568
- C:\Windows\System\AdHjohE.exe
  C:\Windows\System\AdHjohE.exe
  2⤵
  PID:12600
- C:\Windows\System\wShVGPG.exe
  C:\Windows\System\wShVGPG.exe
  2⤵
  PID:12620
- C:\Windows\System\kojARMJ.exe
  C:\Windows\System\kojARMJ.exe
  2⤵
  PID:12640
- C:\Windows\System\GhZOeCc.exe
  C:\Windows\System\GhZOeCc.exe
  2⤵
  PID:12660
- C:\Windows\System\YkoZswG.exe
  C:\Windows\System\YkoZswG.exe
  2⤵
  PID:12680
- C:\Windows\System\fgxlROS.exe
  C:\Windows\System\fgxlROS.exe
  2⤵
  PID:12696
- C:\Windows\System\jruqNWL.exe
  C:\Windows\System\jruqNWL.exe
  2⤵
  PID:12712
- C:\Windows\System\NBxLKsQ.exe
  C:\Windows\System\NBxLKsQ.exe
  2⤵
  PID:12736
- C:\Windows\System\RpPmOMk.exe
  C:\Windows\System\RpPmOMk.exe
  2⤵
  PID:12764
- C:\Windows\System\XtfWWjT.exe
  C:\Windows\System\XtfWWjT.exe
  2⤵
  PID:12780
- C:\Windows\System\qbYbYwk.exe
  C:\Windows\System\qbYbYwk.exe
  2⤵
  PID:12800
- C:\Windows\System\LydHFJc.exe
  C:\Windows\System\LydHFJc.exe
  2⤵
  PID:12820
- C:\Windows\System\UVCCBKp.exe
  C:\Windows\System\UVCCBKp.exe
  2⤵
  PID:12844
- C:\Windows\System\HbuDyaF.exe
  C:\Windows\System\HbuDyaF.exe
  2⤵
  PID:12860
- C:\Windows\System\TkRUlEM.exe
  C:\Windows\System\TkRUlEM.exe
  2⤵
  PID:12884
- C:\Windows\System\IpleGJw.exe
  C:\Windows\System\IpleGJw.exe
  2⤵
  PID:12904
- C:\Windows\System\icCqYuG.exe
  C:\Windows\System\icCqYuG.exe
  2⤵
  PID:12920
- C:\Windows\System\vkdJXML.exe
  C:\Windows\System\vkdJXML.exe
  2⤵
  PID:12940
- C:\Windows\System\FhFbLyB.exe
  C:\Windows\System\FhFbLyB.exe
  2⤵
  PID:12960
- C:\Windows\System\WKspcOr.exe
  C:\Windows\System\WKspcOr.exe
  2⤵
  PID:12980
- C:\Windows\System\fmqFIyn.exe
  C:\Windows\System\fmqFIyn.exe
  2⤵
  PID:13004
- C:\Windows\System\gczHcge.exe
  C:\Windows\System\gczHcge.exe
  2⤵
  PID:13024
- C:\Windows\System\wrWjHfm.exe
  C:\Windows\System\wrWjHfm.exe
  2⤵
  PID:13044
- C:\Windows\System\paqVhrM.exe
  C:\Windows\System\paqVhrM.exe
  2⤵
  PID:13064
- C:\Windows\System\YVQWhav.exe
  C:\Windows\System\YVQWhav.exe
  2⤵
  PID:13088
- C:\Windows\System\cxSnbEL.exe
  C:\Windows\System\cxSnbEL.exe
  2⤵
  PID:13108
- C:\Windows\System\TsaLvuQ.exe
  C:\Windows\System\TsaLvuQ.exe
  2⤵
  PID:13128
- C:\Windows\System\jWQFktd.exe
  C:\Windows\System\jWQFktd.exe
  2⤵
  PID:13148
- C:\Windows\System\yHVSfMa.exe
  C:\Windows\System\yHVSfMa.exe
  2⤵
  PID:13168
- C:\Windows\System\ryhunXb.exe
  C:\Windows\System\ryhunXb.exe
  2⤵
  PID:13188
- C:\Windows\System\gFGmBZR.exe
  C:\Windows\System\gFGmBZR.exe
  2⤵
  PID:13216
- C:\Windows\System\NveSiEs.exe
  C:\Windows\System\NveSiEs.exe
  2⤵
  PID:12064
- C:\Windows\System\ukRzgQe.exe
  C:\Windows\System\ukRzgQe.exe
  2⤵
  PID:3720
- C:\Windows\System\Hygjjky.exe
  C:\Windows\System\Hygjjky.exe
  2⤵
  PID:4644
- C:\Windows\System\NSHgPbT.exe
  C:\Windows\System\NSHgPbT.exe
  2⤵
  PID:11364
- C:\Windows\System\kexfmMW.exe
  C:\Windows\System\kexfmMW.exe
  2⤵
  PID:1464
- C:\Windows\System\xKnjUKM.exe
  C:\Windows\System\xKnjUKM.exe
  2⤵
  PID:11280
- C:\Windows\System\kcrPGrJ.exe
  C:\Windows\System\kcrPGrJ.exe
  2⤵
  PID:4832
- C:\Windows\System\yxlGatU.exe
  C:\Windows\System\yxlGatU.exe
  2⤵
  PID:5368
- C:\Windows\System\seggsVb.exe
  C:\Windows\System\seggsVb.exe
  2⤵
  PID:6844
- C:\Windows\System\ILvERzd.exe
  C:\Windows\System\ILvERzd.exe
  2⤵
  PID:7072
- C:\Windows\System\IsgklwZ.exe
  C:\Windows\System\IsgklwZ.exe
  2⤵
  PID:2832
- C:\Windows\System\vnDOoif.exe
  C:\Windows\System\vnDOoif.exe
  2⤵
  PID:6592
- C:\Windows\System\YjocjOw.exe
  C:\Windows\System\YjocjOw.exe
  2⤵
  PID:12108
- C:\Windows\System\rbUKSYz.exe
  C:\Windows\System\rbUKSYz.exe
  2⤵
  PID:6984
- C:\Windows\System\BInXGVi.exe
  C:\Windows\System\BInXGVi.exe
  2⤵
  PID:13052
- C:\Windows\System\IQurhyV.exe
  C:\Windows\System\IQurhyV.exe
  2⤵
  PID:12308
- C:\Windows\System\dfZfHcc.exe
  C:\Windows\System\dfZfHcc.exe
  2⤵
  PID:12524
- C:\Windows\System\KJdnAAP.exe
  C:\Windows\System\KJdnAAP.exe
  2⤵
  PID:12560
- C:\Windows\System\RWHKRhD.exe
  C:\Windows\System\RWHKRhD.exe
  2⤵
  PID:12668
- C:\Windows\System\YiitFsv.exe
  C:\Windows\System\YiitFsv.exe
  2⤵
  PID:7188
- C:\Windows\System\eDmTVUe.exe
  C:\Windows\System\eDmTVUe.exe
  2⤵
  PID:7364
- C:\Windows\System\lhhHJus.exe
  C:\Windows\System\lhhHJus.exe
  2⤵
  PID:12460
- C:\Windows\System\oVSsjxD.exe
  C:\Windows\System\oVSsjxD.exe
  2⤵
  PID:12488
- C:\Windows\System\EkYuuRO.exe
  C:\Windows\System\EkYuuRO.exe
  2⤵
  PID:12284
- C:\Windows\System\lvTyeTe.exe
  C:\Windows\System\lvTyeTe.exe
  2⤵
  PID:12508
- C:\Windows\System\zZBjyPw.exe
  C:\Windows\System\zZBjyPw.exe
  2⤵
  PID:12672
- C:\Windows\System\iKqVuxB.exe
  C:\Windows\System\iKqVuxB.exe
  2⤵
  PID:6548
- C:\Windows\System\zoWOMni.exe
  C:\Windows\System\zoWOMni.exe
  2⤵
  PID:7200
- C:\Windows\System\zgdmNab.exe
  C:\Windows\System\zgdmNab.exe
  2⤵
  PID:7368
- C:\Windows\System\aBQQtKa.exe
  C:\Windows\System\aBQQtKa.exe
  2⤵
  PID:7508
- C:\Windows\System\UAgdKBU.exe
  C:\Windows\System\UAgdKBU.exe
  2⤵
  PID:7656
- C:\Windows\System\onJNWwx.exe
  C:\Windows\System\onJNWwx.exe
  2⤵
  PID:7856
- C:\Windows\System\KjHAmtl.exe
  C:\Windows\System\KjHAmtl.exe
  2⤵
  PID:7976
- C:\Windows\System\xrUXeVT.exe
  C:\Windows\System\xrUXeVT.exe
  2⤵
  PID:8008
- C:\Windows\System\ynNVQYV.exe
  C:\Windows\System\ynNVQYV.exe
  2⤵
  PID:12912
- C:\Windows\System\HgqynoH.exe
  C:\Windows\System\HgqynoH.exe
  2⤵
  PID:12936
- C:\Windows\System\MtHizkr.exe
  C:\Windows\System\MtHizkr.exe
  2⤵
  PID:13000
- C:\Windows\System\FIdQuxa.exe
  C:\Windows\System\FIdQuxa.exe
  2⤵
  PID:6732
- C:\Windows\System\JVVDtLL.exe
  C:\Windows\System\JVVDtLL.exe
  2⤵
  PID:5260
- C:\Windows\System\hFjcneX.exe
  C:\Windows\System\hFjcneX.exe
  2⤵
  PID:13136
- C:\Windows\System\OqiUYjT.exe
  C:\Windows\System\OqiUYjT.exe
  2⤵
  PID:13196
- C:\Windows\System\FJQplhK.exe
  C:\Windows\System\FJQplhK.exe
  2⤵
  PID:652
- C:\Windows\System\VXaKsRV.exe
  C:\Windows\System\VXaKsRV.exe
  2⤵
  PID:892
- C:\Windows\System\xLZCdFv.exe
  C:\Windows\System\xLZCdFv.exe
  2⤵
  PID:460
- C:\Windows\System\fEKtPhR.exe
  C:\Windows\System\fEKtPhR.exe
  2⤵
  PID:8132
- C:\Windows\System\MoLOKAp.exe
  C:\Windows\System\MoLOKAp.exe
  2⤵
  PID:6508
- C:\Windows\System\ZLlxzeo.exe
  C:\Windows\System\ZLlxzeo.exe
  2⤵
  PID:5144
- C:\Windows\System\EZwgzSl.exe
  C:\Windows\System\EZwgzSl.exe
  2⤵
  PID:12236
- C:\Windows\System\SSrNHgt.exe
  C:\Windows\System\SSrNHgt.exe
  2⤵
  PID:6904
- C:\Windows\System\Smmkxhg.exe
  C:\Windows\System\Smmkxhg.exe
  2⤵
  PID:12316
- C:\Windows\System\lhfoAqH.exe
  C:\Windows\System\lhfoAqH.exe
  2⤵
  PID:12020
- C:\Windows\System\DXfRrdi.exe
  C:\Windows\System\DXfRrdi.exe
  2⤵
  PID:7108
- C:\Windows\System\NOVJkAb.exe
  C:\Windows\System\NOVJkAb.exe
  2⤵
  PID:6256
- C:\Windows\System\YFZuHip.exe
  C:\Windows\System\YFZuHip.exe
  2⤵
  PID:6708
- C:\Windows\System\qTKPbQu.exe
  C:\Windows\System\qTKPbQu.exe
  2⤵
  PID:11120
- C:\Windows\System\mlDVbNZ.exe
  C:\Windows\System\mlDVbNZ.exe
  2⤵
  PID:7016
- C:\Windows\System\AJmcEkh.exe
  C:\Windows\System\AJmcEkh.exe
  2⤵
  PID:8236
- C:\Windows\System\FNdCFhO.exe
  C:\Windows\System\FNdCFhO.exe
  2⤵
  PID:8368
- C:\Windows\System\TgKQaPw.exe
  C:\Windows\System\TgKQaPw.exe
  2⤵
  PID:8448
- C:\Windows\System\WVGoeZJ.exe
  C:\Windows\System\WVGoeZJ.exe
  2⤵
  PID:13096
- C:\Windows\System\SROSYUk.exe
  C:\Windows\System\SROSYUk.exe
  2⤵
  PID:816
- C:\Windows\System\kmwonUe.exe
  C:\Windows\System\kmwonUe.exe
  2⤵
  PID:12412
- C:\Windows\System\JYzaNDs.exe
  C:\Windows\System\JYzaNDs.exe
  2⤵
  PID:5576
- C:\Windows\System\YGQWOpY.exe
  C:\Windows\System\YGQWOpY.exe
  2⤵
  PID:5332
- C:\Windows\System\mcsWrfi.exe
  C:\Windows\System\mcsWrfi.exe
  2⤵
  PID:1752
- C:\Windows\System\jfrufer.exe
  C:\Windows\System\jfrufer.exe
  2⤵
  PID:12868
- C:\Windows\System\nTCkNdb.exe
  C:\Windows\System\nTCkNdb.exe
  2⤵
  PID:12732
- C:\Windows\System\eQBtrSb.exe
  C:\Windows\System\eQBtrSb.exe
  2⤵
  PID:8568
- C:\Windows\System\dxvAqFs.exe
  C:\Windows\System\dxvAqFs.exe
  2⤵
  PID:8304
- C:\Windows\System\jNdzthO.exe
  C:\Windows\System\jNdzthO.exe
  2⤵
  PID:6152
- C:\Windows\System\xYeOqBJ.exe
  C:\Windows\System\xYeOqBJ.exe
  2⤵
  PID:13036
- C:\Windows\System\xYHPAWk.exe
  C:\Windows\System\xYHPAWk.exe
  2⤵
  PID:12188
- C:\Windows\System\sRIkgje.exe
  C:\Windows\System\sRIkgje.exe
  2⤵
  PID:8628
- C:\Windows\System\FGRaySo.exe
  C:\Windows\System\FGRaySo.exe
  2⤵
  PID:12104
- C:\Windows\System\aQuenNG.exe
  C:\Windows\System\aQuenNG.exe
  2⤵
  PID:9560
- C:\Windows\System\KEwDVwg.exe
  C:\Windows\System\KEwDVwg.exe
  2⤵
  PID:9712
- C:\Windows\System\aRcrUXR.exe
  C:\Windows\System\aRcrUXR.exe
  2⤵
  PID:9660
- C:\Windows\System\RUxkjsU.exe
  C:\Windows\System\RUxkjsU.exe
  2⤵
  PID:6348
- C:\Windows\System\BxXCRPb.exe
  C:\Windows\System\BxXCRPb.exe
  2⤵
  PID:7780
- C:\Windows\System\uBFZPjB.exe
  C:\Windows\System\uBFZPjB.exe
  2⤵
  PID:12468
- C:\Windows\System\ssbiosY.exe
  C:\Windows\System\ssbiosY.exe
  2⤵
  PID:6596
- C:\Windows\System\sOVXIHd.exe
  C:\Windows\System\sOVXIHd.exe
  2⤵
  PID:6588
- C:\Windows\System\WPMyNvG.exe
  C:\Windows\System\WPMyNvG.exe
  2⤵
  PID:6180
- C:\Windows\System\lCizXjS.exe
  C:\Windows\System\lCizXjS.exe
  2⤵
  PID:5376
- C:\Windows\System\wnqtVqM.exe
  C:\Windows\System\wnqtVqM.exe
  2⤵
  PID:7172
- C:\Windows\System\ZCFgxhL.exe
  C:\Windows\System\ZCFgxhL.exe
  2⤵
  PID:6536
- C:\Windows\System\bXKlclS.exe
  C:\Windows\System\bXKlclS.exe
  2⤵
  PID:6220
- C:\Windows\System\MBLNuKU.exe
  C:\Windows\System\MBLNuKU.exe
  2⤵
  PID:6492
- C:\Windows\System\qNVycdq.exe
  C:\Windows\System\qNVycdq.exe
  2⤵
  PID:9916
- C:\Windows\System\EDOcsSM.exe
  C:\Windows\System\EDOcsSM.exe
  2⤵
  PID:6608
- C:\Windows\System\HDioZKd.exe
  C:\Windows\System\HDioZKd.exe
  2⤵
  PID:13332
- C:\Windows\System\sxkZbdn.exe
  C:\Windows\System\sxkZbdn.exe
  2⤵
  PID:13352
- C:\Windows\System\QWBvhwf.exe
  C:\Windows\System\QWBvhwf.exe
  2⤵
  PID:13368
- C:\Windows\System\QfngEkE.exe
  C:\Windows\System\QfngEkE.exe
  2⤵
  PID:13384
- C:\Windows\System\YHUlWWM.exe
  C:\Windows\System\YHUlWWM.exe
  2⤵
  PID:13408
- C:\Windows\System\ipovwwW.exe
  C:\Windows\System\ipovwwW.exe
  2⤵
  PID:13428
- C:\Windows\System\NZNFYDA.exe
  C:\Windows\System\NZNFYDA.exe
  2⤵
  PID:13448
- C:\Windows\System\hDUtwpf.exe
  C:\Windows\System\hDUtwpf.exe
  2⤵
  PID:13464
- C:\Windows\System\RWmcVPa.exe
  C:\Windows\System\RWmcVPa.exe
  2⤵
  PID:13484
- C:\Windows\System\KuwBcRJ.exe
  C:\Windows\System\KuwBcRJ.exe
  2⤵
  PID:13504
- C:\Windows\System\ZfyzYxj.exe
  C:\Windows\System\ZfyzYxj.exe
  2⤵
  PID:13524
- C:\Windows\System\EzrtTtN.exe
  C:\Windows\System\EzrtTtN.exe
  2⤵
  PID:13544
- C:\Windows\System\heKXZJv.exe
  C:\Windows\System\heKXZJv.exe
  2⤵
  PID:13564
- C:\Windows\System\CnMriSf.exe
  C:\Windows\System\CnMriSf.exe
  2⤵
  PID:13584
- C:\Windows\System\qYZlcJV.exe
  C:\Windows\System\qYZlcJV.exe
  2⤵
  PID:13604
- C:\Windows\System\hiRDaBl.exe
  C:\Windows\System\hiRDaBl.exe
  2⤵
  PID:13620
- C:\Windows\System\yjAZKol.exe
  C:\Windows\System\yjAZKol.exe
  2⤵
  PID:13640
- C:\Windows\System\BxaFifh.exe
  C:\Windows\System\BxaFifh.exe
  2⤵
  PID:13660
- C:\Windows\System\FRaAzVD.exe
  C:\Windows\System\FRaAzVD.exe
  2⤵
  PID:13676
- C:\Windows\System\OSLhNfs.exe
  C:\Windows\System\OSLhNfs.exe
  2⤵
  PID:13692
- C:\Windows\System\RgvCVcX.exe
  C:\Windows\System\RgvCVcX.exe
  2⤵
  PID:13940
- C:\Windows\System\TRdrQGv.exe
  C:\Windows\System\TRdrQGv.exe
  2⤵
  PID:13960
- C:\Windows\System\xWDVvNj.exe
  C:\Windows\System\xWDVvNj.exe
  2⤵
  PID:13988
- C:\Windows\System\XSBUoDj.exe
  C:\Windows\System\XSBUoDj.exe
  2⤵
  PID:14004
- C:\Windows\System\ZJLhjJM.exe
  C:\Windows\System\ZJLhjJM.exe
  2⤵
  PID:14024
- C:\Windows\System\tozmyKI.exe
  C:\Windows\System\tozmyKI.exe
  2⤵
  PID:14040
- C:\Windows\System\pwAPler.exe
  C:\Windows\System\pwAPler.exe
  2⤵
  PID:14060
- C:\Windows\System\uxBPKWN.exe
  C:\Windows\System\uxBPKWN.exe
  2⤵
  PID:14080
- C:\Windows\System\OafqZIB.exe
  C:\Windows\System\OafqZIB.exe
  2⤵
  PID:14096
- C:\Windows\System\YEaRWiF.exe
  C:\Windows\System\YEaRWiF.exe
  2⤵
  PID:14116
- C:\Windows\System\tYIaSVm.exe
  C:\Windows\System\tYIaSVm.exe
  2⤵
  PID:14144
- C:\Windows\System\aNlBkIU.exe
  C:\Windows\System\aNlBkIU.exe
  2⤵
  PID:14164
- C:\Windows\System\WEzbzyK.exe
  C:\Windows\System\WEzbzyK.exe
  2⤵
  PID:14192
- C:\Windows\System\OilJZtw.exe
  C:\Windows\System\OilJZtw.exe
  2⤵
  PID:14212
- C:\Windows\System\mepLuvL.exe
  C:\Windows\System\mepLuvL.exe
  2⤵
  PID:14232
- C:\Windows\System\GdZNJYf.exe
  C:\Windows\System\GdZNJYf.exe
  2⤵
  PID:14248
- C:\Windows\System\RKKYmFm.exe
  C:\Windows\System\RKKYmFm.exe
  2⤵
  PID:14264
- C:\Windows\System\GaeHfiO.exe
  C:\Windows\System\GaeHfiO.exe
  2⤵
  PID:14284
- C:\Windows\System\LmzNfNp.exe
  C:\Windows\System\LmzNfNp.exe
  2⤵
  PID:14304
- C:\Windows\System\FGfAHlD.exe
  C:\Windows\System\FGfAHlD.exe
  2⤵
  PID:14332
- C:\Windows\System\MhCmpVD.exe
  C:\Windows\System\MhCmpVD.exe
  2⤵
  PID:9344
- C:\Windows\System\nIjTrSJ.exe
  C:\Windows\System\nIjTrSJ.exe
  2⤵
  PID:6852
- C:\Windows\System\ccllrDS.exe
  C:\Windows\System\ccllrDS.exe
  2⤵
  PID:7624
- C:\Windows\System\HhAXFXg.exe
  C:\Windows\System\HhAXFXg.exe
  2⤵
  PID:6364
- C:\Windows\System\fOenjNC.exe
  C:\Windows\System\fOenjNC.exe
  2⤵
  PID:9380
- C:\Windows\System\zhzRWAJ.exe
  C:\Windows\System\zhzRWAJ.exe
  2⤵
  PID:6604
- C:\Windows\System\jzbxldT.exe
  C:\Windows\System\jzbxldT.exe
  2⤵
  PID:10064
- C:\Windows\System\mIwNidz.exe
  C:\Windows\System\mIwNidz.exe
  2⤵
  PID:10072
- C:\Windows\System\HLWsIRY.exe
  C:\Windows\System\HLWsIRY.exe
  2⤵
  PID:6156
- C:\Windows\System\tcnRggn.exe
  C:\Windows\System\tcnRggn.exe
  2⤵
  PID:13648
- C:\Windows\System\HUWspgF.exe
  C:\Windows\System\HUWspgF.exe
  2⤵
  PID:6476
- C:\Windows\System\NvHdPNV.exe
  C:\Windows\System\NvHdPNV.exe
  2⤵
  PID:5560
- C:\Windows\System\oKOhrvf.exe
  C:\Windows\System\oKOhrvf.exe
  2⤵
  PID:7500
- C:\Windows\System\MWmPXOu.exe
  C:\Windows\System\MWmPXOu.exe
  2⤵
  PID:9564
- C:\Windows\System\HcGdkfL.exe
  C:\Windows\System\HcGdkfL.exe
  2⤵
  PID:9680
- C:\Windows\System\jWURMwU.exe
  C:\Windows\System\jWURMwU.exe
  2⤵
  PID:6792
- C:\Windows\System\gdVySYP.exe
  C:\Windows\System\gdVySYP.exe
  2⤵
  PID:5472
- C:\Windows\System\PqproZX.exe
  C:\Windows\System\PqproZX.exe
  2⤵
  PID:10108
- C:\Windows\System\WEYYFXg.exe
  C:\Windows\System\WEYYFXg.exe
  2⤵
  PID:6392
- C:\Windows\System\xQOPLEk.exe
  C:\Windows\System\xQOPLEk.exe
  2⤵
  PID:13360
- C:\Windows\System\aXlYhDI.exe
  C:\Windows\System\aXlYhDI.exe
  2⤵
  PID:13832
- C:\Windows\System\mKhkskO.exe
  C:\Windows\System\mKhkskO.exe
  2⤵
  PID:13440
- C:\Windows\System\eYmRwKJ.exe
  C:\Windows\System\eYmRwKJ.exe
  2⤵
  PID:13480
- C:\Windows\System\OxSHuzf.exe
  C:\Windows\System\OxSHuzf.exe
  2⤵
  PID:6568
- C:\Windows\System\vXgaWZM.exe
  C:\Windows\System\vXgaWZM.exe
  2⤵
  PID:13516
- C:\Windows\System\WwYdfrM.exe
  C:\Windows\System\WwYdfrM.exe
  2⤵
  PID:13904
- C:\Windows\System\qITgOaH.exe
  C:\Windows\System\qITgOaH.exe
  2⤵
  PID:13572
- C:\Windows\System\RkzUhez.exe
  C:\Windows\System\RkzUhez.exe
  2⤵
  PID:13592
- C:\Windows\System\PzRssTm.exe
  C:\Windows\System\PzRssTm.exe
  2⤵
  PID:13716
- C:\Windows\System\rdRZWfG.exe
  C:\Windows\System\rdRZWfG.exe
  2⤵
  PID:13652
- C:\Windows\System\IvyiIGO.exe
  C:\Windows\System\IvyiIGO.exe
  2⤵
  PID:7604
- C:\Windows\System\iqhMHQa.exe
  C:\Windows\System\iqhMHQa.exe
  2⤵
  PID:14204
- C:\Windows\System\IuBjYlc.exe
  C:\Windows\System\IuBjYlc.exe
  2⤵
  PID:14300
- C:\Windows\System\wlVpRvo.exe
  C:\Windows\System\wlVpRvo.exe
  2⤵
  PID:6472
- C:\Windows\System\okGHxbc.exe
  C:\Windows\System\okGHxbc.exe
  2⤵
  PID:6308
- C:\Windows\System\NKycMkC.exe
  C:\Windows\System\NKycMkC.exe
  2⤵
  PID:780
- C:\Windows\System\UvFwHXU.exe
  C:\Windows\System\UvFwHXU.exe
  2⤵
  PID:8524
- C:\Windows\System\VrXWTQs.exe
  C:\Windows\System\VrXWTQs.exe
  2⤵
  PID:13996
- C:\Windows\System\qIBytOS.exe
  C:\Windows\System\qIBytOS.exe
  2⤵
  PID:1964
- C:\Windows\System\YMcFoTQ.exe
  C:\Windows\System\YMcFoTQ.exe
  2⤵
  PID:11156
- C:\Windows\System\hxSJcAl.exe
  C:\Windows\System\hxSJcAl.exe
  2⤵
  PID:14184
- C:\Windows\System\QKxbLdT.exe
  C:\Windows\System\QKxbLdT.exe
  2⤵
  PID:7068
- C:\Windows\System\REETwra.exe
  C:\Windows\System\REETwra.exe
  2⤵
  PID:9656
- C:\Windows\System\cIMHcrP.exe
  C:\Windows\System\cIMHcrP.exe
  2⤵
  PID:9928
- C:\Windows\System\wtXYXPI.exe
  C:\Windows\System\wtXYXPI.exe
  2⤵
  PID:13920
- C:\Windows\System\gnVxjtv.exe
  C:\Windows\System\gnVxjtv.exe
  2⤵
  PID:9120
- C:\Windows\System\WzlouqP.exe
  C:\Windows\System\WzlouqP.exe
  2⤵
  PID:7640
- C:\Windows\System\PJnBqkz.exe
  C:\Windows\System\PJnBqkz.exe
  2⤵
  PID:14128
- C:\Windows\System\OGBOKEF.exe
  C:\Windows\System\OGBOKEF.exe
  2⤵
  PID:14200
- C:\Windows\System\VMjfMsK.exe
  C:\Windows\System\VMjfMsK.exe
  2⤵
  PID:14276
- C:\Windows\System\vRxUZEy.exe
  C:\Windows\System\vRxUZEy.exe
  2⤵
  PID:13772
- C:\Windows\System\gIycjIa.exe
  C:\Windows\System\gIycjIa.exe
  2⤵
  PID:6428
- C:\Windows\System\UZaKBtJ.exe
  C:\Windows\System\UZaKBtJ.exe
  2⤵
  PID:10068
- C:\Windows\System\yjQcpGv.exe
  C:\Windows\System\yjQcpGv.exe
  2⤵
  PID:9480
- C:\Windows\System\kAdoVrv.exe
  C:\Windows\System\kAdoVrv.exe
  2⤵
  PID:10540
- C:\Windows\System\tzbYqux.exe
  C:\Windows\System\tzbYqux.exe
  2⤵
  PID:6688
- C:\Windows\System\idXBFlY.exe
  C:\Windows\System\idXBFlY.exe
  2⤵
  PID:11212
- C:\Windows\System\ilkrDsd.exe
  C:\Windows\System\ilkrDsd.exe
  2⤵
  PID:10316
- C:\Windows\System\gnnSRHB.exe
  C:\Windows\System\gnnSRHB.exe
  2⤵
  PID:10444
- C:\Windows\System\KeauEav.exe
  C:\Windows\System\KeauEav.exe
  2⤵
  PID:10692
- C:\Windows\System\ZAPctAC.exe
  C:\Windows\System\ZAPctAC.exe
  2⤵
  PID:10800
- C:\Windows\System\rdBrSJX.exe
  C:\Windows\System\rdBrSJX.exe
  2⤵
  PID:6016
- C:\Windows\System\bUlsQma.exe
  C:\Windows\System\bUlsQma.exe
  2⤵
  PID:8148
- C:\Windows\System\yULbCFg.exe
  C:\Windows\System\yULbCFg.exe
  2⤵
  PID:13376
- C:\Windows\System\YumefWI.exe
  C:\Windows\System\YumefWI.exe
  2⤵
  PID:10648
- C:\Windows\System\EIAkTXj.exe
  C:\Windows\System\EIAkTXj.exe
  2⤵
  PID:14228
- C:\Windows\System\xYYRPpb.exe
  C:\Windows\System\xYYRPpb.exe
  2⤵
  PID:10688
- C:\Windows\System\AoItzUk.exe
  C:\Windows\System\AoItzUk.exe
  2⤵
  PID:2964
- C:\Windows\System\lATcaoo.exe
  C:\Windows\System\lATcaoo.exe
  2⤵
  PID:10768
- C:\Windows\System\uTpwpvG.exe
  C:\Windows\System\uTpwpvG.exe
  2⤵
  PID:7456
- C:\Windows\System\FRbiZpi.exe
  C:\Windows\System\FRbiZpi.exe
  2⤵
  PID:14348
- C:\Windows\System\nHjhdTw.exe
  C:\Windows\System\nHjhdTw.exe
  2⤵
  PID:14372
- C:\Windows\System\SjYpAjs.exe
  C:\Windows\System\SjYpAjs.exe
  2⤵
  PID:14392
- C:\Windows\System\mVcwzMt.exe
  C:\Windows\System\mVcwzMt.exe
  2⤵
  PID:14408
- C:\Windows\System\YyFmJDv.exe
  C:\Windows\System\YyFmJDv.exe
  2⤵
  PID:14432
- C:\Windows\System\PYNbnpG.exe
  C:\Windows\System\PYNbnpG.exe
  2⤵
  PID:14456
- C:\Windows\System\tKkNaCP.exe
  C:\Windows\System\tKkNaCP.exe
  2⤵
  PID:14476
- C:\Windows\System\GjUhnFP.exe
  C:\Windows\System\GjUhnFP.exe
  2⤵
  PID:14504
- C:\Windows\System\DvNZmDd.exe
  C:\Windows\System\DvNZmDd.exe
  2⤵
  PID:14524
- C:\Windows\System\TXIvlWA.exe
  C:\Windows\System\TXIvlWA.exe
  2⤵
  PID:14548
- C:\Windows\System\IPMolvj.exe
  C:\Windows\System\IPMolvj.exe
  2⤵
  PID:15036
- C:\Windows\System\QKwsvwn.exe
  C:\Windows\System\QKwsvwn.exe
  2⤵
  PID:15056
- C:\Windows\System\ixNnejX.exe
  C:\Windows\System\ixNnejX.exe
  2⤵
  PID:15076
- C:\Windows\System\JlauthG.exe
  C:\Windows\System\JlauthG.exe
  2⤵
  PID:15096
- C:\Windows\System\xVuZSJL.exe
  C:\Windows\System\xVuZSJL.exe
  2⤵
  PID:15120
- C:\Windows\System\wfwInPr.exe
  C:\Windows\System\wfwInPr.exe
  2⤵
  PID:15140
- C:\Windows\System\pZrQRHv.exe
  C:\Windows\System\pZrQRHv.exe
  2⤵
  PID:15160
- C:\Windows\System\ENkckXS.exe
  C:\Windows\System\ENkckXS.exe
  2⤵
  PID:15180
- C:\Windows\System\kXdjVZG.exe
  C:\Windows\System\kXdjVZG.exe
  2⤵
  PID:15200
- C:\Windows\System\wYZdJYq.exe
  C:\Windows\System\wYZdJYq.exe
  2⤵
  PID:15216
- C:\Windows\System\SuPJLOl.exe
  C:\Windows\System\SuPJLOl.exe
  2⤵
  PID:15236
- C:\Windows\System\tLuPOjk.exe
  C:\Windows\System\tLuPOjk.exe
  2⤵
  PID:6848
- C:\Windows\System\qGEGHDi.exe
  C:\Windows\System\qGEGHDi.exe
  2⤵
  PID:10628
- C:\Windows\System\EiPLhPy.exe
  C:\Windows\System\EiPLhPy.exe
  2⤵
  PID:2472
- C:\Windows\System\WgyAsxw.exe
  C:\Windows\System\WgyAsxw.exe
  2⤵
  PID:14156
- C:\Windows\System\JMhrKmi.exe
  C:\Windows\System\JMhrKmi.exe
  2⤵
  PID:8612
- C:\Windows\System\RurQEap.exe
  C:\Windows\System\RurQEap.exe
  2⤵
  PID:8264
- C:\Windows\System\wWKkKtD.exe
  C:\Windows\System\wWKkKtD.exe
  2⤵
  PID:14452
- C:\Windows\System\zigPzBm.exe
  C:\Windows\System\zigPzBm.exe
  2⤵
  PID:14596
- C:\Windows\System\WEBdJSb.exe
  C:\Windows\System\WEBdJSb.exe
  2⤵
  PID:4628
- C:\Windows\System\mLGlmCO.exe
  C:\Windows\System\mLGlmCO.exe
  2⤵
  PID:13616
- C:\Windows\System\KaOHhEs.exe
  C:\Windows\System\KaOHhEs.exe
  2⤵
  PID:13928
- C:\Windows\System\IhtLqsl.exe
  C:\Windows\System\IhtLqsl.exe
  2⤵
  PID:9404
- C:\Windows\System\zhnFiRb.exe
  C:\Windows\System\zhnFiRb.exe
  2⤵
  PID:14092
- C:\Windows\System\bkyTDAb.exe
  C:\Windows\System\bkyTDAb.exe
  2⤵
  PID:14736
- C:\Windows\System\rZTEQXE.exe
  C:\Windows\System\rZTEQXE.exe
  2⤵
  PID:11200
- C:\Windows\System\YWWAplD.exe
  C:\Windows\System\YWWAplD.exe
  2⤵
  PID:2916
- C:\Windows\System\QhEJkEM.exe
  C:\Windows\System\QhEJkEM.exe
  2⤵
  PID:11992
- C:\Windows\System\jtHdltY.exe
  C:\Windows\System\jtHdltY.exe
  2⤵
  PID:11832
- C:\Windows\System\iLCiqsV.exe
  C:\Windows\System\iLCiqsV.exe
  2⤵
  PID:12004
- C:\Windows\System\HqGeoFp.exe
  C:\Windows\System\HqGeoFp.exe
  2⤵
  PID:8044
- C:\Windows\System\tjeqbwY.exe
  C:\Windows\System\tjeqbwY.exe
  2⤵
  PID:8604
- C:\Windows\System\HaLcXwf.exe
  C:\Windows\System\HaLcXwf.exe
  2⤵
  PID:4352
- C:\Windows\System\gIYlMkK.exe
  C:\Windows\System\gIYlMkK.exe
  2⤵
  PID:8996
- C:\Windows\System\caGQPcF.exe
  C:\Windows\System\caGQPcF.exe
  2⤵
  PID:5388
- C:\Windows\System\wDaCGqu.exe
  C:\Windows\System\wDaCGqu.exe
  2⤵
  PID:9152
- C:\Windows\System\hGbVDgq.exe
  C:\Windows\System\hGbVDgq.exe
  2⤵
  PID:9732
- C:\Windows\System\nMfbdwW.exe
  C:\Windows\System\nMfbdwW.exe
  2⤵
  PID:8832
- C:\Windows\System\LOmFmMF.exe
  C:\Windows\System\LOmFmMF.exe
  2⤵
  PID:8952
- C:\Windows\System\vsifACF.exe
  C:\Windows\System\vsifACF.exe
  2⤵
  PID:14956
- C:\Windows\System\vLUtVhG.exe
  C:\Windows\System\vLUtVhG.exe
  2⤵
  PID:14468
- C:\Windows\System\yrAVGWy.exe
  C:\Windows\System\yrAVGWy.exe
  2⤵
  PID:13492
- C:\Windows\System\GcktOkb.exe
  C:\Windows\System\GcktOkb.exe
  2⤵
  PID:15176
- C:\Windows\System\sPdNVbc.exe
  C:\Windows\System\sPdNVbc.exe
  2⤵
  PID:15208
- C:\Windows\System\JRuFtbd.exe
  C:\Windows\System\JRuFtbd.exe
  2⤵
  PID:14612
- C:\Windows\System\qhkIFrr.exe
  C:\Windows\System\qhkIFrr.exe
  2⤵
  PID:15256
- C:\Windows\System\EDeGzqq.exe
  C:\Windows\System\EDeGzqq.exe
  2⤵
  PID:9636
- C:\Windows\System\znEezIg.exe
  C:\Windows\System\znEezIg.exe
  2⤵
  PID:14624
- C:\Windows\System\HRmetNV.exe
  C:\Windows\System\HRmetNV.exe
  2⤵
  PID:1772
- C:\Windows\System\mGfoXbb.exe
  C:\Windows\System\mGfoXbb.exe
  2⤵
  PID:15336
- C:\Windows\System\cTlCgaU.exe
  C:\Windows\System\cTlCgaU.exe
  2⤵
  PID:8496
- C:\Windows\System\fccNffD.exe
  C:\Windows\System\fccNffD.exe
  2⤵
  PID:13864
- C:\Windows\System\CUSxSBQ.exe
  C:\Windows\System\CUSxSBQ.exe
  2⤵
  PID:9292
- C:\Windows\System\tJiprxd.exe
  C:\Windows\System\tJiprxd.exe
  2⤵
  PID:10360
- C:\Windows\System\LSlmmAk.exe
  C:\Windows\System\LSlmmAk.exe
  2⤵
  PID:5776
- C:\Windows\System\KIeZsJB.exe
  C:\Windows\System\KIeZsJB.exe
  2⤵
  PID:15112
- C:\Windows\System\iqNieyx.exe
  C:\Windows\System\iqNieyx.exe
  2⤵
  PID:15128
- C:\Windows\System\XIZJING.exe
  C:\Windows\System\XIZJING.exe
  2⤵
  PID:8812
- C:\Windows\System\bzSeYhw.exe
  C:\Windows\System\bzSeYhw.exe
  2⤵
  PID:9608
- C:\Windows\System\fWYEFHp.exe
  C:\Windows\System\fWYEFHp.exe
  2⤵
  PID:14620
- C:\Windows\System\XcJITZk.exe
  C:\Windows\System\XcJITZk.exe
  2⤵
  PID:14640
- C:\Windows\System\fjMSraa.exe
  C:\Windows\System\fjMSraa.exe
  2⤵
  PID:15348
- C:\Windows\System\NSvgVgr.exe
  C:\Windows\System\NSvgVgr.exe
  2⤵
  PID:9904
- C:\Windows\System\BthBwCa.exe
  C:\Windows\System\BthBwCa.exe
  2⤵
  PID:9412
- C:\Windows\System\ZYWDVns.exe
  C:\Windows\System\ZYWDVns.exe
  2⤵
  PID:4604
- C:\Windows\System\KanPKQU.exe
  C:\Windows\System\KanPKQU.exe
  2⤵
  PID:8856
- C:\Windows\System\GkKoXRj.exe
  C:\Windows\System\GkKoXRj.exe
  2⤵
  PID:13252
- C:\Windows\System\BpGWPak.exe
  C:\Windows\System\BpGWPak.exe
  2⤵
  PID:6696
- C:\Windows\System\Ptfwund.exe
  C:\Windows\System\Ptfwund.exe
  2⤵
  PID:8556
- C:\Windows\System\mSYThGE.exe
  C:\Windows\System\mSYThGE.exe
  2⤵
  PID:4560
- C:\Windows\System\NyJBAIU.exe
  C:\Windows\System\NyJBAIU.exe
  2⤵
  PID:15020
- C:\Windows\System\HkMMhNG.exe
  C:\Windows\System\HkMMhNG.exe
  2⤵
  PID:15132
- C:\Windows\System\nVCBcUP.exe
  C:\Windows\System\nVCBcUP.exe
  2⤵
  PID:14344
- C:\Windows\System\fwWIDYs.exe
  C:\Windows\System\fwWIDYs.exe
  2⤵
  PID:11660
- C:\Windows\System\wSNAJzq.exe
  C:\Windows\System\wSNAJzq.exe
  2⤵
  PID:11936
- C:\Windows\System\hJwnHgD.exe
  C:\Windows\System\hJwnHgD.exe
  2⤵
  PID:10660
- C:\Windows\System\zQZZklK.exe
  C:\Windows\System\zQZZklK.exe
  2⤵
  PID:10504
- C:\Windows\System\MbLZphJ.exe
  C:\Windows\System\MbLZphJ.exe
  2⤵
  PID:14320
- C:\Windows\System\IbJOUqb.exe
  C:\Windows\System\IbJOUqb.exe
  2⤵
  PID:9544
- C:\Windows\System\rtqrrvS.exe
  C:\Windows\System\rtqrrvS.exe
  2⤵
  PID:15168
- C:\Windows\System\RvKuOdz.exe
  C:\Windows\System\RvKuOdz.exe
  2⤵
  PID:15248
- C:\Windows\System\sTZggkd.exe
  C:\Windows\System\sTZggkd.exe
  2⤵
  PID:15264
- C:\Windows\System\emIHCEl.exe
  C:\Windows\System\emIHCEl.exe
  2⤵
  PID:15304
- C:\Windows\System\QEQAlmV.exe
  C:\Windows\System\QEQAlmV.exe
  2⤵
  PID:8444
- C:\Windows\System\jWUniGg.exe
  C:\Windows\System\jWUniGg.exe
  2⤵
  PID:6620
- C:\Windows\System\RgYXrat.exe
  C:\Windows\System\RgYXrat.exe
  2⤵
  PID:9616
- C:\Windows\System\ifvugTL.exe
  C:\Windows\System\ifvugTL.exe
  2⤵
  PID:13328
- C:\Windows\System\PlDjvGy.exe
  C:\Windows\System\PlDjvGy.exe
  2⤵
  PID:7120
- C:\Windows\System\REWIFiW.exe
  C:\Windows\System\REWIFiW.exe
  2⤵
  PID:12836
- C:\Windows\System\CAgMKAB.exe
  C:\Windows\System\CAgMKAB.exe
  2⤵
  PID:9148
- C:\Windows\System\jFzGaKD.exe
  C:\Windows\System\jFzGaKD.exe
  2⤵
  PID:13740
- C:\Windows\System\VNhlKyC.exe
  C:\Windows\System\VNhlKyC.exe
  2⤵
  PID:7736
- C:\Windows\System\AdZCPrb.exe
  C:\Windows\System\AdZCPrb.exe
  2⤵
  PID:9212
- C:\Windows\System\XkBgsVn.exe
  C:\Windows\System\XkBgsVn.exe
  2⤵
  PID:6544
- C:\Windows\System\mhApKFv.exe
  C:\Windows\System\mhApKFv.exe
  2⤵
  PID:13916
- C:\Windows\System\cltFthy.exe
  C:\Windows\System\cltFthy.exe
  2⤵
  PID:10668
- C:\Windows\System\HGPXxZn.exe
  C:\Windows\System\HGPXxZn.exe
  2⤵
  PID:11756
- C:\Windows\System\SDprGHi.exe
  C:\Windows\System\SDprGHi.exe
  2⤵
  PID:12128
- C:\Windows\System\qmDFujO.exe
  C:\Windows\System\qmDFujO.exe
  2⤵
  PID:1248
- C:\Windows\System\NxdkiDq.exe
  C:\Windows\System\NxdkiDq.exe
  2⤵
  PID:14868
- C:\Windows\System\JkkThxk.exe
  C:\Windows\System\JkkThxk.exe
  2⤵
  PID:9132
- C:\Windows\System\sPJhZpj.exe
  C:\Windows\System\sPJhZpj.exe
  2⤵
  PID:9668
- C:\Windows\System\ZFZsVBB.exe
  C:\Windows\System\ZFZsVBB.exe
  2⤵
  PID:14536
- C:\Windows\System\XIqVtjI.exe
  C:\Windows\System\XIqVtjI.exe
  2⤵
  PID:15292
- C:\Windows\System\mbijFjE.exe
  C:\Windows\System\mbijFjE.exe
  2⤵
  PID:14652
- C:\Windows\System\iIsQSFi.exe
  C:\Windows\System\iIsQSFi.exe
  2⤵
  PID:15084
- C:\Windows\System\cvBbrLQ.exe
  C:\Windows\System\cvBbrLQ.exe
  2⤵
  PID:10308
- C:\Windows\System\MgqyGlh.exe
  C:\Windows\System\MgqyGlh.exe
  2⤵
  PID:5764
- C:\Windows\System\xdwXykU.exe
  C:\Windows\System\xdwXykU.exe
  2⤵
  PID:7252
- C:\Windows\System\YTufwHN.exe
  C:\Windows\System\YTufwHN.exe
  2⤵
  PID:13520
- C:\Windows\System\dOUMEKL.exe
  C:\Windows\System\dOUMEKL.exe
  2⤵
  PID:14440
- C:\Windows\System\zoNGkFs.exe
  C:\Windows\System\zoNGkFs.exe
  2⤵
  PID:14000
- C:\Windows\System\cxYHNNQ.exe
  C:\Windows\System\cxYHNNQ.exe
  2⤵
  PID:7184
- C:\Windows\System\HHCJVUP.exe
  C:\Windows\System\HHCJVUP.exe
  2⤵
  PID:13972
- C:\Windows\System\WYgeFJg.exe
  C:\Windows\System\WYgeFJg.exe
  2⤵
  PID:6628
- C:\Windows\System\rXylbus.exe
  C:\Windows\System\rXylbus.exe
  2⤵
  PID:11576
- C:\Windows\System\XmFkZrF.exe
  C:\Windows\System\XmFkZrF.exe
  2⤵
  PID:10560
- C:\Windows\System\BzuoHEw.exe
  C:\Windows\System\BzuoHEw.exe
  2⤵
  PID:15380
- C:\Windows\System\UITjHAy.exe
  C:\Windows\System\UITjHAy.exe
  2⤵
  PID:15404
- C:\Windows\System\zlSyvDj.exe
  C:\Windows\System\zlSyvDj.exe
  2⤵
  PID:15424
- C:\Windows\System\TdnnXOm.exe
  C:\Windows\System\TdnnXOm.exe
  2⤵
  PID:15448
- C:\Windows\System\frNHhLL.exe
  C:\Windows\System\frNHhLL.exe
  2⤵
  PID:15472
- C:\Windows\System\yMrisJx.exe
  C:\Windows\System\yMrisJx.exe
  2⤵
  PID:15488
- C:\Windows\System\GnsEknU.exe
  C:\Windows\System\GnsEknU.exe
  2⤵
  PID:15512
- C:\Windows\System\UcPRqYx.exe
  C:\Windows\System\UcPRqYx.exe
  2⤵
  PID:15684
- C:\Windows\System\skyHyUk.exe
  C:\Windows\System\skyHyUk.exe
  2⤵
  PID:15716
- C:\Windows\System\GQXVdUR.exe
  C:\Windows\System\GQXVdUR.exe
  2⤵
  PID:15744
- C:\Windows\System\TeAmlkj.exe
  C:\Windows\System\TeAmlkj.exe
  2⤵
  PID:15848
- C:\Windows\System\CZRqNWf.exe
  C:\Windows\System\CZRqNWf.exe
  2⤵
  PID:15868
- C:\Windows\System\XAjdRfN.exe
  C:\Windows\System\XAjdRfN.exe
  2⤵
  PID:15892
- C:\Windows\System\VCtIVPH.exe
  C:\Windows\System\VCtIVPH.exe
  2⤵
  PID:15912
- C:\Windows\System\npMpsXc.exe
  C:\Windows\System\npMpsXc.exe
  2⤵
  PID:15936
- C:\Windows\System\cRlQFhw.exe
  C:\Windows\System\cRlQFhw.exe
  2⤵
  PID:15964
- C:\Windows\System\pTTfrfr.exe
  C:\Windows\System\pTTfrfr.exe
  2⤵
  PID:15988
- C:\Windows\System\AaxmmDB.exe
  C:\Windows\System\AaxmmDB.exe
  2⤵
  PID:16028
- C:\Windows\System\CXpschx.exe
  C:\Windows\System\CXpschx.exe
  2⤵
  PID:16056
- C:\Windows\System\FriDKZp.exe
  C:\Windows\System\FriDKZp.exe
  2⤵
  PID:16076
- C:\Windows\System\uCxCPsx.exe
  C:\Windows\System\uCxCPsx.exe
  2⤵
  PID:16100
- C:\Windows\System\NgFRhkU.exe
  C:\Windows\System\NgFRhkU.exe
  2⤵
  PID:16124
- C:\Windows\System\pAvCOZd.exe
  C:\Windows\System\pAvCOZd.exe
  2⤵
  PID:16148
- C:\Windows\System\ZzlMONX.exe
  C:\Windows\System\ZzlMONX.exe
  2⤵
  PID:16172
- C:\Windows\System\eYAlBsX.exe
  C:\Windows\System\eYAlBsX.exe
  2⤵
  PID:16196
- C:\Windows\System\rhuLRSM.exe
  C:\Windows\System\rhuLRSM.exe
  2⤵
  PID:15392
- C:\Windows\System\DYEogtG.exe
  C:\Windows\System\DYEogtG.exe
  2⤵
  PID:15636
- C:\Windows\System\lxKokkw.exe
  C:\Windows\System\lxKokkw.exe
  2⤵
  PID:9092
- C:\Windows\System\BKrBWqY.exe
  C:\Windows\System\BKrBWqY.exe
  2⤵
  PID:16072
- C:\Windows\System\oKnDlXT.exe
  C:\Windows\System\oKnDlXT.exe
  2⤵
  PID:16140
- C:\Windows\System\lFOSZXc.exe
  C:\Windows\System\lFOSZXc.exe
  2⤵
  PID:15440
- C:\Windows\System\kONNlxA.exe
  C:\Windows\System\kONNlxA.exe
  2⤵
  PID:12080
- C:\Windows\System\OSKBDmr.exe
  C:\Windows\System\OSKBDmr.exe
  2⤵
  PID:15560
- C:\Windows\System\wbDiKZH.exe
  C:\Windows\System\wbDiKZH.exe
  2⤵
  PID:15580
- C:\Windows\System\yfXKYpM.exe
  C:\Windows\System\yfXKYpM.exe
  2⤵
  PID:15608
- C:\Windows\System\YckjxgX.exe
  C:\Windows\System\YckjxgX.exe
  2⤵
  PID:15712
- C:\Windows\System\VBLTrZU.exe
  C:\Windows\System\VBLTrZU.exe
  2⤵
  PID:16048
- C:\Windows\System\JUyNmcX.exe
  C:\Windows\System\JUyNmcX.exe
  2⤵
  PID:16224
- C:\Windows\System\mnpFjAr.exe
  C:\Windows\System\mnpFjAr.exe
  2⤵
  PID:16276
- C:\Windows\System\lyvaFZh.exe
  C:\Windows\System\lyvaFZh.exe
  2⤵
  PID:16376
- C:\Windows\System\FZlRJBg.exe
  C:\Windows\System\FZlRJBg.exe
  2⤵
  PID:10956
- C:\Windows\System\JzlvOGw.exe
  C:\Windows\System\JzlvOGw.exe
  2⤵
  PID:11688
- C:\Windows\System\UGsMwHx.exe
  C:\Windows\System\UGsMwHx.exe
  2⤵
  PID:10192
- C:\Windows\System\qfWmDOf.exe
  C:\Windows\System\qfWmDOf.exe
  2⤵
  PID:15420
- C:\Windows\System\zULpfBy.exe
  C:\Windows\System\zULpfBy.exe
  2⤵
  PID:14648
- C:\Windows\System\PQlCRpV.exe
  C:\Windows\System\PQlCRpV.exe
  2⤵
  PID:15584
- C:\Windows\System\mqYoALB.exe
  C:\Windows\System\mqYoALB.exe
  2⤵
  PID:16112
- C:\Windows\System\LkOadYW.exe
  C:\Windows\System\LkOadYW.exe
  2⤵
  PID:16188
- C:\Windows\System\iLJDSds.exe
  C:\Windows\System\iLJDSds.exe
  2⤵
  PID:11972
- C:\Windows\System\aQlmaDH.exe
  C:\Windows\System\aQlmaDH.exe
  2⤵
  PID:11904
- C:\Windows\System\GbygGkJ.exe
  C:\Windows\System\GbygGkJ.exe
  2⤵
  PID:9536
- C:\Windows\System\hkoWGYd.exe
  C:\Windows\System\hkoWGYd.exe
  2⤵
  PID:6648
- C:\Windows\System\TEtfOqC.exe
  C:\Windows\System\TEtfOqC.exe
  2⤵
  PID:12232
- C:\Windows\System\TSlxXSm.exe
  C:\Windows\System\TSlxXSm.exe
  2⤵
  PID:12748
- C:\Windows\System\vTZeXXl.exe
  C:\Windows\System\vTZeXXl.exe
  2⤵
  PID:15840
- C:\Windows\System\YdMOdVG.exe
  C:\Windows\System\YdMOdVG.exe
  2⤵
  PID:12968
- C:\Windows\System\gxAtWAf.exe
  C:\Windows\System\gxAtWAf.exe
  2⤵
  PID:15920
- C:\Windows\System\IatpTiH.exe
  C:\Windows\System\IatpTiH.exe
  2⤵
  PID:10680
- C:\Windows\System\ZesCpHo.exe
  C:\Windows\System\ZesCpHo.exe
  2⤵
  PID:13436
- C:\Windows\System\RALEtJo.exe
  C:\Windows\System\RALEtJo.exe
  2⤵
  PID:1488
- C:\Windows\System\AQYotKO.exe
  C:\Windows\System\AQYotKO.exe
  2⤵
  PID:11100
- C:\Windows\System\jIpdabK.exe
  C:\Windows\System\jIpdabK.exe
  2⤵
  PID:13144
- C:\Windows\System\GXprHLZ.exe
  C:\Windows\System\GXprHLZ.exe
  2⤵
  PID:5440
- C:\Windows\System\YCDUsys.exe
  C:\Windows\System\YCDUsys.exe
  2⤵
  PID:11176
- C:\Windows\System\tbgQUTM.exe
  C:\Windows\System\tbgQUTM.exe
  2⤵
  PID:15572
- C:\Windows\System\XjDtfmx.exe
  C:\Windows\System\XjDtfmx.exe
  2⤵
  PID:13496
- C:\Windows\System\GpJuNTL.exe
  C:\Windows\System\GpJuNTL.exe
  2⤵
  PID:12068
- C:\Windows\System\nxuBNla.exe
  C:\Windows\System\nxuBNla.exe
  2⤵
  PID:15728
- C:\Windows\System\pqLKIli.exe
  C:\Windows\System\pqLKIli.exe
  2⤵
  PID:15172
- C:\Windows\System\WyuIVKa.exe
  C:\Windows\System\WyuIVKa.exe
  2⤵
  PID:13076
- C:\Windows\System\GxhttHe.exe
  C:\Windows\System\GxhttHe.exe
  2⤵
  PID:16320
- C:\Windows\System\prCYaOG.exe
  C:\Windows\System\prCYaOG.exe
  2⤵
  PID:13500
- C:\Windows\System\bEfjWMG.exe
  C:\Windows\System\bEfjWMG.exe
  2⤵
  PID:11336
- C:\Windows\System\BVzUagj.exe
  C:\Windows\System\BVzUagj.exe
  2⤵
  PID:15832
- C:\Windows\System\aQqyflv.exe
  C:\Windows\System\aQqyflv.exe
  2⤵
  PID:13100
- C:\Windows\System\bqAIwlS.exe
  C:\Windows\System\bqAIwlS.exe
  2⤵
  PID:15800
- C:\Windows\System\LYqBtbY.exe
  C:\Windows\System\LYqBtbY.exe
  2⤵
  PID:5704
- C:\Windows\System\fYzdlFU.exe
  C:\Windows\System\fYzdlFU.exe
  2⤵
  PID:11632
- C:\Windows\System\DJAVHjg.exe
  C:\Windows\System\DJAVHjg.exe
  2⤵
  PID:10060
- C:\Windows\System\tcaaNPi.exe
  C:\Windows\System\tcaaNPi.exe
  2⤵
  PID:10568
- C:\Windows\System\HsnsgYt.exe
  C:\Windows\System\HsnsgYt.exe
  2⤵
  PID:8104
- C:\Windows\System\DpulCRf.exe
  C:\Windows\System\DpulCRf.exe
  2⤵
  PID:11872
- C:\Windows\System\kCUyLWT.exe
  C:\Windows\System\kCUyLWT.exe
  2⤵
  PID:8992
- C:\Windows\System\LDrwlFf.exe
  C:\Windows\System\LDrwlFf.exe
  2⤵
  PID:3484
- C:\Windows\System\JibMZQr.exe
  C:\Windows\System\JibMZQr.exe
  2⤵
  PID:15464
- C:\Windows\System\PwlrObf.exe
  C:\Windows\System\PwlrObf.exe
  2⤵
  PID:15640
- C:\Windows\System\nfUEWdR.exe
  C:\Windows\System\nfUEWdR.exe
  2⤵
  PID:11856
- C:\Windows\System\LdUvZnh.exe
  C:\Windows\System\LdUvZnh.exe
  2⤵
  PID:15576
- C:\Windows\System\gwNhYRl.exe
  C:\Windows\System\gwNhYRl.exe
  2⤵
  PID:4640
- C:\Windows\System\cdJIvDE.exe
  C:\Windows\System\cdJIvDE.exe
  2⤵
  PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:9888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_icbido00.sau.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CKcDLgP.exe

Filesize
2.3MB

MD5
217142755f29e2e05d6580af359cfb00

SHA1
30e33c40402803eae2ff9fb0fc8b25b17c1eab07

SHA256
8afa6a213f753873391c7d730765d063367e6899fcc752c4f74549898c6fe899

SHA512
5c99153c0d1a73bea06c4c5e1e7fef971a014fdcb90beca89f29eec5aaa6c249331376bb553a7a94540079bf1d35e32d6ddceb8eda0c70d0dc6c1f6629b8539a

Download Submit
C:\Windows\System\CibpYTO.exe

Filesize
2.3MB

MD5
043f25f2df0e0665d1a345a4169338ae

SHA1
7a6bfa785f1e5465ee2898c5cbba38f2d015884b

SHA256
3ef3d602426a9ea400e72a9991c4347a51747f221b5adfac52a8043607baa103

SHA512
036e43c105a6dd46b31b4308dbd155a1eb50d94bc135f33269823216f4c74dd1620632ce1b0e783a33df11c1b166caf8573e7eb6429879b07f0cc965d4f8d773

Download Submit
C:\Windows\System\CpQELcA.exe

Filesize
2.3MB

MD5
2733f687cd6cdd3acb74c2ce9fd5d8c1

SHA1
2bdee03bed143bfd7b84584dc1f6af8d2e4588f9

SHA256
31b791cbe86b0552eb9a1260b54ec3f389758ba28c020f8bab44576169e47b22

SHA512
09814133985d64a3073527c7c64e91fbba365980bc933a5727a21cfa61431d8985778e73180f41cb42a0d7bcfc8c8bead0e544c19ab53dcbeb5f2984cc97c2dc

Download Submit
C:\Windows\System\CwTsvGp.exe

Filesize
2.3MB

MD5
8968e6d8ae59707d630b0eb13de2afbf

SHA1
ead42927115f8ab86cda810f1da65c5b52dee9b9

SHA256
3c2a07c7caf07dcd1e10fd554bc2bc4809d0b0f0b5308827a8b3c283faf256b4

SHA512
469a778ed68496f41a1202c80159340796d53f2e46700c40d3d552d7c0d2462cb5bfeddb0fd32cba008022092f4c26e46847ce4af9bbbefcfedcb45894c242fb

Download Submit
C:\Windows\System\EOiNWvM.exe

Filesize
2.3MB

MD5
33f30737e02b59096b422daa51d8b308

SHA1
1ff48435c3095320e7fc8d8cd8266e9b54c43cbc

SHA256
148b9752300ca4a43c8ccde14ba028b347a5b864246159b04c5ba7f975893fe6

SHA512
35c4ff5d3141607be6414152b1800397a900d705b612c0750d44c0b3de670020b43b0af72e99b5b9de92321d7b9ec779cec5cae6fd780b533682f8c6ee350ead

Download Submit
C:\Windows\System\FwhOInn.exe

Filesize
2.3MB

MD5
29ed60eea2f36f1410d3817238f092c6

SHA1
b75356705794e7d87c4144b0905ed83108443749

SHA256
443efbe030ac7a6f505a41799420108f30aa2ca33992de18071ba5d2c57ddd9f

SHA512
2bdc709e519bc25b8ec278327eab148a6ca2e3d320259bd84db72e4b4e2504409e1a1f8b516b8218d5777a5ef64402a1964d84e608a7085af7f8ba7dcdcefbad

Download Submit
C:\Windows\System\GJIUoKp.exe

Filesize
2.3MB

MD5
00c79b98c75b62434291ab18ea289e25

SHA1
aad46b15a5426891551efa71241a7527a7f9b939

SHA256
e694c0d2f6822e483c3fa3629fb97e8c075c689480c46c3558acee37eef29a39

SHA512
b121b535a1d1601093c870f3c54fc116aaba87560258634c1130bc274d7d2c431cd01f1461e2bc9e7e1826f7c3d8032b8584429d326fdbf7d9a0624ba2f4899c

Download Submit
C:\Windows\System\GgzPRDn.exe

Filesize
2.3MB

MD5
b64fa2d841dd1ceac5a2accc55a577f5

SHA1
6d79ec8d39936ddf504a77b2495ce79fea8e3f83

SHA256
4a96c0ad973328a60363d1b88e052b3ec2ba329675fe36716f8a2fe507e5e39e

SHA512
2c407efa72a2a8847df3e3f0ab12b0425912fb75e237584b2ef26d7a7908c18bab3ae2255c3eb3d5ef27ba3a44179e74abfe2e7c3ba6e8dd8a645ec272efadbb

Download Submit
C:\Windows\System\GxrsgFJ.exe

Filesize
2.3MB

MD5
fa4dd2da8bccc9f3be15fed60a22966e

SHA1
9c397c9ac895a70fe7963699ba8bdf6b4dafb69f

SHA256
4ba0e614824a31eebc7fa405875797832aadcad583ed58e7c0188b87fd769d0f

SHA512
ad5d35e7e3f32cdc823786e2d2fd7cc260b85faaff3567060b7f82495da979fc14fe4603f2879751ec8740e892b61d4711f16f26d2e612171a05770b650a6e4b

Download Submit
C:\Windows\System\KIfCXgg.exe

Filesize
2.3MB

MD5
7bc62df35d57d5d608715f40f5e07b42

SHA1
c1c65f8e8b87bf09ab00b45541dd821234d0c932

SHA256
6379ec54405d7c9ef87bfd6ba3870006b5abf775ce5776c4246fc7478618cd6e

SHA512
0cb1fe892c6d84ebf091d7d1f4aa426ec1f259046f550e02d61ac7330a6fc76702d05b2bbc374e8d087d67df64f1f7172434243cafb91a04b4e5a0e7c5a0173a

Download Submit
C:\Windows\System\KeFiIAh.exe

Filesize
2.3MB

MD5
6875e07ab762ffd34ff99992b17c25eb

SHA1
f0703cb478838fb6a6170a9a29607a0eaca2fcec

SHA256
ca7f8349338ef77c14eef0ed1d84fd75d27d5dc471acb9a532ad50a2a5e78a39

SHA512
8d15e3920af78fb29abb2906dfe0b5b9c781543d826cccc875da1a91cd6f7b7089459b89451c6b40198702a1d275d1e19e8a624e7bb6f0017989a5c5d7f8e641

Download Submit
C:\Windows\System\KrJPljX.exe

Filesize
2.3MB

MD5
d88e69b60cb001a3556f4d58ae595d24

SHA1
c97ac7819c50c2c3c35f8d16d98e9cedc56af5e9

SHA256
8386629bc5a3fee442c5a6493b4b768e43e11960ab74ead5947adcf643370a7d

SHA512
00d7559fd96506a670a5f3ba6191a7e544522c972444b2741941a0ef3b077e2394de69e09c3f152a81becd79c81eda446727156f3b40962f0bf7e40326df33c1

Download Submit
C:\Windows\System\MnVSxdn.exe

Filesize
2.3MB

MD5
188a20f504ba266ddb203b2166d15d82

SHA1
4fa82a54f83d9a34cf277da9df9d5af596609344

SHA256
ceb4517542cf17776048cf41c7a7e2bf9eb6c6b4ec4327a329f797294326b12c

SHA512
ab88bdc3c20b8c7f8f4105ac439e093ec9dc91a2fbdf79c3372ecfb9b399306f17f83298abdda597bf7e75416693d5aaf2d20954b72af3a44677e57173569607

Download Submit
C:\Windows\System\PYFPqDu.exe

Filesize
2.3MB

MD5
31ebe75da335b580d4c2370d49ea13e3

SHA1
4bb1d25c6c34442af53ed2d7f53bb0480a627df2

SHA256
e1ca9f27d8f3e96abdae1b83449ca85ad012cecab9bf050b03ebacb7941d5dab

SHA512
d689e2a07f300048725dd05ba844e3cb8d16fa155b4f85bff4a59ec61ab36c0eaf96b5542d5e7c22653b5a438cc8bde493217e534a53b9c3c79ff51600266ff4

Download Submit
C:\Windows\System\SasKtpL.exe

Filesize
2.3MB

MD5
4dc489d0f8846f800aad353c8e069ac7

SHA1
4b8189cf58e1398bd809c0494225a5bdb70f19d3

SHA256
73647b24a669e363062322ddbe111a745467f37501327d3ac579535919283c78

SHA512
bc08815f156e2240dd8ba0e114fb385bcdea13a435e0d303ae1c9321f163607767b21799e75c938a9463b1e262b544678524fe23f36860c5f48755de085897bc

Download Submit
C:\Windows\System\VXhPRST.exe

Filesize
2.3MB

MD5
4cac30edb9bb6dcf9a282f6b784380a7

SHA1
5bf442a21a1b0316871980a428aea540cd259589

SHA256
d61ae6c1d7dc8c15fd489d6c708225d6c6e49c6dac6408734a9bad866c2478eb

SHA512
277a4cd97a9067599e93b4eb96b8cd918ebee3b3eaa04b6584736ffca99afc7fb31d6d0070fb3375515ad20eccd87459f9a42d2210a4fee88a17e097ec7defb8

Download Submit
C:\Windows\System\XpnnVez.exe

Filesize
2.3MB

MD5
6902ceefb8e90723f8975a660e5a4128

SHA1
bdf27851dd220889fbf67eeb0b5a2fe18467a59c

SHA256
92584652b21f300c1fbde0601ad49e4d0646d6d89eaf0e5dcfdd727e49b51e62

SHA512
a87fdc5f0aa4b3dcde98c7e4cd8526f4b70faffb1dc36682f9d1564d6b68eee78dc383f819fa96ae71e747ab9f3aa1bf2947d0dd448ab46298261ba0d9b66069

Download Submit
C:\Windows\System\YAQtBRX.exe

Filesize
2.3MB

MD5
093586a63d64ade3927555a038762757

SHA1
f44ca86da6fb32b9513e5dfa22891e6b7b52b7cf

SHA256
c62a30c5a71466b00d97d429281c9a9ff1d090549b3cf72ef8fedcf68591abea

SHA512
d1afb89239357c4a7562324140706fea970b05edbc8c9903db5373d81278fbbdee7dbf5b2f34e027b03507793425b28f77212b48880179815554bbb45b619016

Download Submit
C:\Windows\System\azGNHKB.exe

Filesize
2.3MB

MD5
a3ae0b62a1a537ae0904537b009c2e6e

SHA1
d40e81ea4611ab777eb98daacd970c3f1b8afbe0

SHA256
8a1f1905a034acc2bb90bd4a058e1a8c9b1996e2cdc24bfd05a7c42d9b35c9c7

SHA512
23058d51c2c290b69ee3f58e3e683eee5a2ddbdb429f2ac8740e4c7987249ff5ee6693f0dc2bc2078853eb20c6d8791ddc6939ebd1e48f6b913538a625b05bff

Download Submit
C:\Windows\System\fhAWIIT.exe

Filesize
2.3MB

MD5
8902a088636fb1c60ca9ec0fcaa9d4a4

SHA1
3e08767b3a9c3e5684ee65b58749f4a785c9b0ee

SHA256
69427735cb90ad28a9ce0140907e095481e99bd9a906dce9f91e9ca526875fc9

SHA512
80b8ce194d4e417e0fe6fc60ed6e574bbb13cdb6a5cc7c681102231deb6dba049dae4626f9592c7b6825ce727d527ffd7d2c0fc9e8e0e829aacad676703c3f32

Download Submit
C:\Windows\System\gMrLIzg.exe

Filesize
2.3MB

MD5
46a7c4641b0ac085d608e88648f3c826

SHA1
602ec68c94ba0fd3aca9f8301f473ad7da8ad692

SHA256
6faeeb015676d171a44a47ed2a8e67e857343c10152f31920d7202c843763fbd

SHA512
e6b189d0addc147e0ca0f3eb44007cf821c62532ebb074a8c274c64db6977e8cdc79c507ffcc0f62c4523ad49efb24352c8c0a38e1c6a68c7377f9241f2f6cb0

Download Submit
C:\Windows\System\gTEtDdL.exe

Filesize
2.3MB

MD5
e40ead0a4a17179555a2c7718e0ad9d1

SHA1
ae0589af3de7d61054b264bf431f802bf8585642

SHA256
23707fa4305d11766238e4a1a2ed4b8cd78d749cb7449544f6196b9cc036c05c

SHA512
c53f0d7bf7750778381c35e65fcad69a048900229e3ac205b0c74c322f1c3d25aa4fd1c4194fb3700d4c8a5b43adf593d32418ce071a317216103d82556461c8

Download Submit
C:\Windows\System\hEoEVdo.exe

Filesize
2.3MB

MD5
38312ca800c7a10cee7f71c66f5fe1d4

SHA1
b2908f705a45e284407571da1813bbcb599b58ed

SHA256
5329a326ecf9d9b470ee47db4b4dbff14c98f96a52d536b8d80d2fae54948550

SHA512
424bbd82998de0b9084e0892fe099877375f89ce5f35231f1cdb876e85a68ff0b96e703aa84823d84277a7ed54cf97d8bbfb9bd7a40808cc093bfbe147594e44

Download Submit
C:\Windows\System\jvidxzn.exe

Filesize
2.3MB

MD5
11cc11089157c807516690a8f2b6b959

SHA1
bdc4063b38d6c4830957f0854dce1f71f67d5383

SHA256
c25374b3ff6cbaccfaa14500c6f17280156153bf3d8bcf1f88587834d2aadc76

SHA512
003ca50ff385c47ced6081ef06e77bcb7e1b1bf0652fbb16af5900a2965d245f0dd4570e5d7b9dc446d3adcf3400d273a3b5fc1f0cba019979d80893fcb6d777

Download Submit
C:\Windows\System\nIqXPLZ.exe

Filesize
2.3MB

MD5
fc9be01598572d0fdfc8d61949d1a215

SHA1
4cff86310020208eff7eef045dd225f2d867a9ec

SHA256
824ab5fb2d7745e17c44415af9a8b68b88c21e882044d353cc6708a705cf1785

SHA512
92ce6033ebdab423fd3d9041be1fcb5b45a29aa09c1b32d41090f3140f9d03c5d23d17ee17c8643080b0fd1a2f51b0bddbcb2405cecbeceeb110621f9b164d1d

Download Submit
C:\Windows\System\oWsgKmI.exe

Filesize
2.3MB

MD5
4c70ff383b40490fe84944dfe28af4e8

SHA1
df2f9324217c921f24af1514e67aea6927971f51

SHA256
8989f04018cd35e18ac37a371bde91c9244ef6c7d13e6506785d9fb5563d9512

SHA512
2a0ed4cbd8d8f7cec1ff5208306fcd2e4bd526b743cdc9539af7fe6f8b4e68efc736f58b40b95736961530de1ce32e7fbdc1b7fe8a927d129dbabe4a7be86aa0

Download Submit
C:\Windows\System\pQWyCss.exe

Filesize
2.3MB

MD5
bd9dd48f753cff6e1aa69e3ecfefb0de

SHA1
b17e5f6c4e7b40462662668e4c2046218b3f4ab4

SHA256
fb0c87f1bc44a8066abb7ecc3ed24fd2e50418619f46b10f12b01fe13969ca00

SHA512
bcc6bb7bbc2da0270b1f63d202810a9dbacaa91dae66a4f06790b2cde2df69ed28780e68f1f1966c515b4eb139f3d7740dfa5596b8fb8e5182a513c2cccf5ebd

Download Submit
C:\Windows\System\qgcIaHn.exe

Filesize
2.3MB

MD5
1206da7769164f5a09b7d53a763431af

SHA1
8f3ccb8bb0f9ced3043e28918335896edcdb0251

SHA256
69bab0d6e70cd7105a0611241506f69993ad1d9d12e1ae01b0a45e81832f1dac

SHA512
3e7eb800dca4baa01ebc9a920de9801861d8400eec10d3f6cbe7d1531625e9d087f44bcdc17e7fe88e14eb526c794b81f17b58a8d191e28141b4826733973d23

Download Submit
C:\Windows\System\rajZxhP.exe

Filesize
2.3MB

MD5
e10da3d73f07defb7f083c676e6dec76

SHA1
5d07364266b1b23973c2b1db2e1011a9720ad253

SHA256
901c9c142cb26e0afdacf65d3b29e5454b44edbb383ad83c554e3c4f4ced4355

SHA512
398a0fc7081576d6c85ea606942123d374b50ebf05271384023b275ca08cb287da7f48b4b89b92cc21c32c039207bdd5835b76c495466dba60a8361b2a24a0a8

Download Submit
C:\Windows\System\szNhgzu.exe

Filesize
2.3MB

MD5
30375acb4f6cbe67132d8ee3f11825fe

SHA1
42c4f37fa07e2c50626e7f4b924177fcab842e75

SHA256
84f5763f1b7ffdf646f4dd2ffc448c9e5fbdcbd612d64c99c906cfb132cee06d

SHA512
bf057d16f1be6e281bb92419ee95e3af54890ffe18cb23933eceb9105e49ab5bcdef2fcf7676338a71d212aa55e920310f213b14d4bf755773ca42fc9d2cc209

Download Submit
C:\Windows\System\uJbxXeE.exe

Filesize
2.3MB

MD5
980eb50113fa028e636e855cec3eb1a4

SHA1
e065658a212e9b69a6035be2cb830f533558c83b

SHA256
0b4368a0369405eae231c214745b146d381b09d9d488ac8c194399659e7c139d

SHA512
c7ab82a757c636d218a5bd1492efa44c553fe806225d7825417ecf2d8a7484463cc6773e5d7a0b3c666f048997d259429b3da37d71eac80226372702845bc3be

Download Submit
C:\Windows\System\uniolGU.exe

Filesize
2.3MB

MD5
849157aa2f99c372addc8b109415f620

SHA1
6ab7b00a2bd2942b2e434e7dcdec282ffca3e94a

SHA256
bee58a280021949ae3d9106c05fee636748ee4fe7725459843c9b995ae7a7653

SHA512
ad2e084d88764cb2c823b3242f772b3824daebeb3b416bf0bfbeedba477334da57fbe285a4c880531cc856a05609bc90f16fc68f2a3db0469b2179cd91dcff7b

Download Submit
C:\Windows\System\wZUNUZA.exe

Filesize
2.3MB

MD5
b913589e0743f26eb57a2c75e0d7aa59

SHA1
6ee2b06bd75af413ddb3f311accad2b775f255d3

SHA256
1818b699f7f4fee4b19e5523dc047cb285473faadff3976d0c80d50d3bac3d79

SHA512
36c00b32245e244393338e544da80a8e5ad721505040f2df2bd7ad5bc63f6d2b123dbf2948015e6c86f6556bdb4fa038866c534f1e426e6593009a9a3b326e7c

Download Submit
C:\Windows\System\yhsKspE.exe

Filesize
2.3MB

MD5
5bdcac836e9781c19fe845e910ea2f81

SHA1
30caecca4a4a7f601dd4c1aa3e19b0701e13e1f6

SHA256
71ab862534ad4163d61e38296915221238cc877bb7fa215d1541711fe92d934c

SHA512
e568972d8a7e70b4affbc566390708a5bc7a863958d1182b31c7673423285888081ecd791feb98fe1a423a38bd79c1d90a2aa48f7b8681e6b9557de2b46a152a

Download Submit
C:\Windows\System\zINoGgO.exe

Filesize
2.3MB

MD5
3de83c926d87bb50d3d34e6fd0ae3e71

SHA1
ec3064379f2a709a21be9fe1ff30b768f8655ae8

SHA256
69c380538c0086a0fdca29caa5df93d8f6ca9e3aa3dc0c4adfd2959fc2db8e11

SHA512
b696a8028130770703b1e716309041dcbf3e3ec476eb0cbb99931c6964e4c87b5086b7664ec78a6c5a71262e436199f3a76c2e4fbf3752166337e7a034f98392

Download Submit
memory/524-241-0x00007FF61DAA0000-0x00007FF61DE92000-memory.dmp

Filesize
3.9MB

Download
memory/544-365-0x00007FF6D0C00000-0x00007FF6D0FF2000-memory.dmp

Filesize
3.9MB

Download
memory/664-126-0x00007FF692380000-0x00007FF692772000-memory.dmp

Filesize
3.9MB

Download
memory/928-284-0x00007FF641FF0000-0x00007FF6423E2000-memory.dmp

Filesize
3.9MB

Download
memory/932-157-0x00007FF6F57E0000-0x00007FF6F5BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-255-0x00007FF6E47D0000-0x00007FF6E4BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-91-0x00007FF77AC20000-0x00007FF77B012000-memory.dmp

Filesize
3.9MB

Download
memory/1168-264-0x00007FF617A70000-0x00007FF617E62000-memory.dmp

Filesize
3.9MB

Download
memory/1436-158-0x00007FF70D3E0000-0x00007FF70D7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-58-0x00007FF6E7310000-0x00007FF6E7702000-memory.dmp

Filesize
3.9MB

Download
memory/1556-63-0x00007FF7E1220000-0x00007FF7E1612000-memory.dmp

Filesize
3.9MB

Download
memory/1556-252-0x00007FF7E1220000-0x00007FF7E1612000-memory.dmp

Filesize
3.9MB

Download
memory/1796-292-0x00007FF79E910000-0x00007FF79ED02000-memory.dmp

Filesize
3.9MB

Download
memory/1876-146-0x00007FF792210000-0x00007FF792602000-memory.dmp

Filesize
3.9MB

Download
memory/1884-227-0x00007FF7241A0000-0x00007FF724592000-memory.dmp

Filesize
3.9MB

Download
memory/1884-18-0x00007FF7241A0000-0x00007FF724592000-memory.dmp

Filesize
3.9MB

Download
memory/1888-318-0x00007FF60B370000-0x00007FF60B762000-memory.dmp

Filesize
3.9MB

Download
memory/1948-278-0x00007FF610560000-0x00007FF610952000-memory.dmp

Filesize
3.9MB

Download
memory/2028-60-0x00007FF671E10000-0x00007FF672202000-memory.dmp

Filesize
3.9MB

Download
memory/2040-322-0x00007FF61F2B0000-0x00007FF61F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-20-0x00007FF786A10000-0x00007FF786E02000-memory.dmp

Filesize
3.9MB

Download
memory/2276-92-0x00007FF63EA80000-0x00007FF63EE72000-memory.dmp

Filesize
3.9MB

Download
memory/2312-387-0x00007FF74D4E0000-0x00007FF74D8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-153-0x00007FF7AEA30000-0x00007FF7AEE22000-memory.dmp

Filesize
3.9MB

Download
memory/2360-249-0x00007FF6CD9F0000-0x00007FF6CDDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-141-0x00007FF6FFD10000-0x00007FF700102000-memory.dmp

Filesize
3.9MB

Download
memory/2460-458-0x00007FF786990000-0x00007FF786D82000-memory.dmp

Filesize
3.9MB

Download
memory/2504-374-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-52-0x0000029F58F60000-0x0000029F58F70000-memory.dmp

Filesize
64KB

Download
memory/2504-53-0x0000029F58F60000-0x0000029F58F70000-memory.dmp

Filesize
64KB

Download
memory/2504-51-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-55-0x0000029F58F60000-0x0000029F58F70000-memory.dmp

Filesize
64KB

Download
memory/2504-95-0x0000029F5BC70000-0x0000029F5C416000-memory.dmp

Filesize
7.6MB

Download
memory/2504-40-0x0000029F5B0E0000-0x0000029F5B102000-memory.dmp

Filesize
136KB

Download
memory/2568-314-0x00007FF605730000-0x00007FF605B22000-memory.dmp

Filesize
3.9MB

Download
memory/2644-287-0x00007FF6D3830000-0x00007FF6D3C22000-memory.dmp

Filesize
3.9MB

Download
memory/2648-123-0x00007FF743900000-0x00007FF743CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-289-0x00007FF71C870000-0x00007FF71CC62000-memory.dmp

Filesize
3.9MB

Download
memory/2796-336-0x00007FF7BEE90000-0x00007FF7BF282000-memory.dmp

Filesize
3.9MB

Download
memory/2968-338-0x00007FF7913E0000-0x00007FF7917D2000-memory.dmp

Filesize
3.9MB

Download
memory/3176-267-0x00007FF664390000-0x00007FF664782000-memory.dmp

Filesize
3.9MB

Download
memory/3264-160-0x00007FF68A050000-0x00007FF68A442000-memory.dmp

Filesize
3.9MB

Download
memory/3264-220-0x00007FF68A050000-0x00007FF68A442000-memory.dmp

Filesize
3.9MB

Download
memory/3264-1-0x000002770A090000-0x000002770A0A0000-memory.dmp

Filesize
64KB

Download
memory/3264-0-0x00007FF68A050000-0x00007FF68A442000-memory.dmp

Filesize
3.9MB

Download
memory/3272-312-0x00007FF6CC6C0000-0x00007FF6CCAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3308-294-0x00007FF768FF0000-0x00007FF7693E2000-memory.dmp

Filesize
3.9MB

Download
memory/3352-161-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp

Filesize
3.9MB

Download
memory/3352-10-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp

Filesize
3.9MB

Download
memory/3440-93-0x00007FF75B160000-0x00007FF75B552000-memory.dmp

Filesize
3.9MB

Download
memory/3556-325-0x00007FF62D290000-0x00007FF62D682000-memory.dmp

Filesize
3.9MB

Download
memory/3924-90-0x00007FF729AA0000-0x00007FF729E92000-memory.dmp

Filesize
3.9MB

Download
memory/4008-54-0x00007FF6DA0B0000-0x00007FF6DA4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-159-0x00007FF758F50000-0x00007FF759342000-memory.dmp

Filesize
3.9MB

Download
memory/4176-108-0x00007FF608A90000-0x00007FF608E82000-memory.dmp

Filesize
3.9MB

Download
memory/4320-329-0x00007FF7BC620000-0x00007FF7BCA12000-memory.dmp

Filesize
3.9MB

Download
memory/4440-261-0x00007FF6733B0000-0x00007FF6737A2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-118-0x00007FF668EF0000-0x00007FF6692E2000-memory.dmp

Filesize
3.9MB

Download
memory/4484-94-0x00007FF7F1110000-0x00007FF7F1502000-memory.dmp

Filesize
3.9MB

Download
memory/4804-245-0x00007FF634D70000-0x00007FF635162000-memory.dmp

Filesize
3.9MB

Download
memory/4988-258-0x00007FF71F5F0000-0x00007FF71F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-62-0x00007FF68EA60000-0x00007FF68EE52000-memory.dmp

Filesize
3.9MB

Download
memory/5108-162-0x00007FF7E07A0000-0x00007FF7E0B92000-memory.dmp

Filesize
3.9MB

Download
memory/5200-342-0x00007FF722DA0000-0x00007FF723192000-memory.dmp

Filesize
3.9MB

Download
memory/5232-346-0x00007FF676D70000-0x00007FF677162000-memory.dmp

Filesize
3.9MB

Download
memory/5264-349-0x00007FF64BDD0000-0x00007FF64C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/5296-353-0x00007FF6F4D10000-0x00007FF6F5102000-memory.dmp

Filesize
3.9MB

Download
memory/5520-357-0x00007FF658CA0000-0x00007FF659092000-memory.dmp

Filesize
3.9MB

Download