xmrig | a07c182935bafa974a00b4740b1831740ab6e3a3df7971a28c2c086c774b69b4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
Size

1.8MB
MD5

003d08c6abdb96669effbd2198408709
SHA1

c5471dc146be1843e00297fa44f783615ba17aeb
SHA256

a07c182935bafa974a00b4740b1831740ab6e3a3df7971a28c2c086c774b69b4
SHA512

abba139ff57908532de2975033e9d77e3b9d703017082ebcc04eee09ab9c98750c9d72102eab5434040cbfe17840cf4aaa9979c52beac02828a16c79e080487b
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlN:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral2/memory/2792-313-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp	xmrig
behavioral2/memory/3908-479-0x00007FF6959A0000-0x00007FF695D92000-memory.dmp	xmrig
behavioral2/memory/4524-621-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp	xmrig
behavioral2/memory/4980-628-0x00007FF6A20B0000-0x00007FF6A24A2000-memory.dmp	xmrig
behavioral2/memory/3048-631-0x00007FF6934E0000-0x00007FF6938D2000-memory.dmp	xmrig
behavioral2/memory/4964-634-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	xmrig
behavioral2/memory/1756-635-0x00007FF61F840000-0x00007FF61FC32000-memory.dmp	xmrig
behavioral2/memory/408-990-0x00007FF679730000-0x00007FF679B22000-memory.dmp	xmrig
behavioral2/memory/1788-2235-0x00007FF714000000-0x00007FF7143F2000-memory.dmp	xmrig
behavioral2/memory/13696-2375-0x00007FF7B0DD0000-0x00007FF7B11C2000-memory.dmp	xmrig
behavioral2/memory/7688-1968-0x00007FF7A3490000-0x00007FF7A3882000-memory.dmp	xmrig
behavioral2/memory/7452-1940-0x00007FF6C6A80000-0x00007FF6C6E72000-memory.dmp	xmrig
behavioral2/memory/3512-633-0x00007FF7466D0000-0x00007FF746AC2000-memory.dmp	xmrig
behavioral2/memory/3012-632-0x00007FF76CA60000-0x00007FF76CE52000-memory.dmp	xmrig
behavioral2/memory/3600-630-0x00007FF6B6D60000-0x00007FF6B7152000-memory.dmp	xmrig
behavioral2/memory/2960-629-0x00007FF6C2140000-0x00007FF6C2532000-memory.dmp	xmrig
behavioral2/memory/2204-627-0x00007FF64ED40000-0x00007FF64F132000-memory.dmp	xmrig
behavioral2/memory/1476-626-0x00007FF766560000-0x00007FF766952000-memory.dmp	xmrig
behavioral2/memory/4760-625-0x00007FF62F030000-0x00007FF62F422000-memory.dmp	xmrig
behavioral2/memory/1216-235-0x00007FF699C20000-0x00007FF69A012000-memory.dmp	xmrig
behavioral2/memory/3500-191-0x00007FF79E3F0000-0x00007FF79E7E2000-memory.dmp	xmrig
behavioral2/memory/3372-132-0x00007FF784910000-0x00007FF784D02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3492	EiqGdUE.exe
5052	FbqFePn.exe
3372	VGEppjk.exe
3500	AxWfEbC.exe
1216	kqZifHn.exe
2792	YGPapDO.exe
3908	iKflbhD.exe
4524	QqpaFGP.exe
4760	CBVpjNq.exe
1476	cOEDICo.exe
4884	OlsaNJl.exe
2204	xfmfULt.exe
4980	wSLzOzk.exe
2960	vQqHouY.exe
3600	vOVNttA.exe
3900	jQbdmnH.exe
3048	GRcsiQx.exe
3012	JGfRClC.exe
3512	WFVKhfO.exe
4964	kkjUzVR.exe
1756	qSlXdGP.exe
408	dnMCxuV.exe
1788	zzVxUlr.exe
1576	eJIwiZK.exe
4228	TMVxxaQ.exe
2556	ZqhBIyG.exe
3772	uynpQGO.exe
1440	LiNDIHk.exe
2636	KnLNofW.exe
2372	NgVNPKy.exe
4768	deufKLA.exe
4320	bHUOcXP.exe
4740	LwZwATU.exe
2964	VXgeqKG.exe
4924	AysVGvn.exe
1140	NczHZja.exe
1812	emjuSXf.exe
4436	vGNCkvm.exe
3720	iYCQmFu.exe
3508	CmWPOEJ.exe
3300	nVLGuzF.exe
2420	BJtXgOK.exe
3608	vmwLYPb.exe
4432	KOWbywT.exe
4256	ZfTnhGs.exe
1400	WLOwsRP.exe
3004	eYzYBTi.exe
1504	wgOHnvi.exe
3400	bTYlbRL.exe
744	IVNGjZo.exe
4696	waOtztL.exe
1724	VwlYaBm.exe
1948	KBUgBIp.exe
4868	gkFysvm.exe
416	TgRpokK.exe
3320	AgwBGqH.exe
2044	OogeYxD.exe
2652	nZLdRnj.exe
640	mTdxEiN.exe
2444	fSWrwuM.exe
216	SJhGwwx.exe
4040	gcsqcBx.exe
4232	ncsKKGd.exe
4784	szLwlSB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4916-0-0x00007FF77C770000-0x00007FF77CB62000-memory.dmp	upx
behavioral2/files/0x000300000001e97c-5.dat	upx
behavioral2/files/0x000700000002342d-37.dat	upx
behavioral2/memory/5052-34-0x00007FF760CC0000-0x00007FF7610B2000-memory.dmp	upx
behavioral2/files/0x0007000000023437-55.dat	upx
behavioral2/files/0x000700000002343e-125.dat	upx
behavioral2/memory/2792-313-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp	upx
behavioral2/memory/3908-479-0x00007FF6959A0000-0x00007FF695D92000-memory.dmp	upx
behavioral2/memory/4524-621-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp	upx
behavioral2/memory/4980-628-0x00007FF6A20B0000-0x00007FF6A24A2000-memory.dmp	upx
behavioral2/memory/3048-631-0x00007FF6934E0000-0x00007FF6938D2000-memory.dmp	upx
behavioral2/memory/4964-634-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp	upx
behavioral2/memory/1756-635-0x00007FF61F840000-0x00007FF61FC32000-memory.dmp	upx
behavioral2/memory/408-990-0x00007FF679730000-0x00007FF679B22000-memory.dmp	upx
behavioral2/memory/7328-1886-0x00007FF652B20000-0x00007FF652F12000-memory.dmp	upx
behavioral2/memory/11796-2134-0x00007FF7008A0000-0x00007FF700C92000-memory.dmp	upx
behavioral2/memory/13660-2133-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp	upx
behavioral2/memory/5332-2184-0x00007FF6710F0000-0x00007FF6714E2000-memory.dmp	upx
behavioral2/memory/14032-2217-0x00007FF709D10000-0x00007FF70A102000-memory.dmp	upx
behavioral2/memory/1788-2235-0x00007FF714000000-0x00007FF7143F2000-memory.dmp	upx
behavioral2/memory/13380-2274-0x00007FF7E2AB0000-0x00007FF7E2EA2000-memory.dmp	upx
behavioral2/memory/13384-2281-0x00007FF6C0C50000-0x00007FF6C1042000-memory.dmp	upx
behavioral2/memory/13768-2298-0x00007FF6FE7E0000-0x00007FF6FEBD2000-memory.dmp	upx
behavioral2/memory/4552-2206-0x00007FF7FACE0000-0x00007FF7FB0D2000-memory.dmp	upx
behavioral2/memory/13384-2318-0x00007FF6C0C50000-0x00007FF6C1042000-memory.dmp	upx
behavioral2/memory/8744-2203-0x00007FF6E66B0000-0x00007FF6E6AA2000-memory.dmp	upx
behavioral2/memory/13696-2333-0x00007FF7B0DD0000-0x00007FF7B11C2000-memory.dmp	upx
behavioral2/memory/13460-2197-0x00007FF69AFE0000-0x00007FF69B3D2000-memory.dmp	upx
behavioral2/memory/13904-2338-0x00007FF7644C0000-0x00007FF7648B2000-memory.dmp	upx
behavioral2/memory/13696-2375-0x00007FF7B0DD0000-0x00007FF7B11C2000-memory.dmp	upx
behavioral2/memory/4860-2172-0x00007FF7BF8C0000-0x00007FF7BFCB2000-memory.dmp	upx
behavioral2/memory/7076-2018-0x00007FF7DD070000-0x00007FF7DD462000-memory.dmp	upx
behavioral2/memory/9620-1974-0x00007FF6879B0000-0x00007FF687DA2000-memory.dmp	upx
behavioral2/memory/7688-1968-0x00007FF7A3490000-0x00007FF7A3882000-memory.dmp	upx
behavioral2/memory/8264-1961-0x00007FF77D1D0000-0x00007FF77D5C2000-memory.dmp	upx
behavioral2/memory/10644-1953-0x00007FF798760000-0x00007FF798B52000-memory.dmp	upx
behavioral2/memory/7452-1940-0x00007FF6C6A80000-0x00007FF6C6E72000-memory.dmp	upx
behavioral2/memory/7116-1927-0x00007FF6DBF40000-0x00007FF6DC332000-memory.dmp	upx
behavioral2/memory/9656-1959-0x00007FF649FE0000-0x00007FF64A3D2000-memory.dmp	upx
behavioral2/memory/7380-1919-0x00007FF7CA3E0000-0x00007FF7CA7D2000-memory.dmp	upx
behavioral2/memory/8600-1918-0x00007FF70A690000-0x00007FF70AA82000-memory.dmp	upx
behavioral2/memory/8580-1917-0x00007FF78BCE0000-0x00007FF78C0D2000-memory.dmp	upx
behavioral2/memory/9060-1907-0x00007FF6C6570000-0x00007FF6C6962000-memory.dmp	upx
behavioral2/memory/7860-1901-0x00007FF79D6D0000-0x00007FF79DAC2000-memory.dmp	upx
behavioral2/memory/11812-1916-0x00007FF6878A0000-0x00007FF687C92000-memory.dmp	upx
behavioral2/memory/9636-1889-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp	upx
behavioral2/memory/9252-1888-0x00007FF6A15E0000-0x00007FF6A19D2000-memory.dmp	upx
behavioral2/memory/7560-1887-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp	upx
behavioral2/memory/11828-1885-0x00007FF7D9030000-0x00007FF7D9422000-memory.dmp	upx
behavioral2/memory/9200-1884-0x00007FF6E5080000-0x00007FF6E5472000-memory.dmp	upx
behavioral2/memory/7424-1896-0x00007FF6ABE00000-0x00007FF6AC1F2000-memory.dmp	upx
behavioral2/memory/8464-1895-0x00007FF72A2B0000-0x00007FF72A6A2000-memory.dmp	upx
behavioral2/memory/8684-1894-0x00007FF6B7B50000-0x00007FF6B7F42000-memory.dmp	upx
behavioral2/memory/5752-1893-0x00007FF7D0040000-0x00007FF7D0432000-memory.dmp	upx
behavioral2/memory/9712-1891-0x00007FF66BD30000-0x00007FF66C122000-memory.dmp	upx
behavioral2/memory/3512-633-0x00007FF7466D0000-0x00007FF746AC2000-memory.dmp	upx
behavioral2/memory/3012-632-0x00007FF76CA60000-0x00007FF76CE52000-memory.dmp	upx
behavioral2/memory/3600-630-0x00007FF6B6D60000-0x00007FF6B7152000-memory.dmp	upx
behavioral2/memory/2960-629-0x00007FF6C2140000-0x00007FF6C2532000-memory.dmp	upx
behavioral2/memory/2204-627-0x00007FF64ED40000-0x00007FF64F132000-memory.dmp	upx
behavioral2/memory/1476-626-0x00007FF766560000-0x00007FF766952000-memory.dmp	upx
behavioral2/memory/4760-625-0x00007FF62F030000-0x00007FF62F422000-memory.dmp	upx
behavioral2/files/0x0007000000023446-212.dat	upx
behavioral2/files/0x0007000000023459-208.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VqCrgaf.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\tCJzvco.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\TLojZnr.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\BoAMOPR.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\EfyaKjB.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\UvVGavu.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\XXAgIpx.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\MHmudrO.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\eXYqNhM.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\pRCjHtS.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\NuyPMEx.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\UIdYtCu.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\SawnJAv.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\YvokbPB.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\RoaxobA.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\jFFoppI.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\MDfmpGt.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\yFitchh.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\KeoadHQ.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\fiqbAuT.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\WHVjJdL.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\MCNJuCF.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\EGtBaqB.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\xCInUwp.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\XOtLOxS.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\DaHIkGc.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\FfBbfvN.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\VYJQcNg.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\IXHBGXK.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\UKSPMfB.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\NsMoqsl.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\PwLbtgL.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\aeVLDqO.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\LzGDsFe.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\OkDnwKQ.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\FEYbXug.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\vAJHARu.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\GVWwuDU.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\LAHZlyK.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\cljHIrw.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\RwhTZpq.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\JNEmadq.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\gEmrAqi.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\sCScMNE.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\dOjcVsI.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\eJIwiZK.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\dSMvaQy.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\HWbNSKQ.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\SVOHVsr.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\wTfFeeJ.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\VLJgNZM.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\oqwKhEM.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\bkOewcY.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\WWJxHHi.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\HlQAfAq.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\IHpdOBi.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\kDbDmES.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\CqJsvCd.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\yMjQXBa.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\ELketKA.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\GRJqCsM.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\bsXwjAX.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\JabXDBf.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
File created	C:\Windows\System\jZKeyvh.exe	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeLockMemoryPrivilege	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2752	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	85
PID 4916 wrote to memory of 2752	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	85
PID 4916 wrote to memory of 3492	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	86
PID 4916 wrote to memory of 3492	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	86
PID 4916 wrote to memory of 5052	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	87
PID 4916 wrote to memory of 5052	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	87
PID 4916 wrote to memory of 3372	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	88
PID 4916 wrote to memory of 3372	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	88
PID 4916 wrote to memory of 3500	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	89
PID 4916 wrote to memory of 3500	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	89
PID 4916 wrote to memory of 1216	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	90
PID 4916 wrote to memory of 1216	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	90
PID 4916 wrote to memory of 2792	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	91
PID 4916 wrote to memory of 2792	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	91
PID 4916 wrote to memory of 4980	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	92
PID 4916 wrote to memory of 4980	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	92
PID 4916 wrote to memory of 3908	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	93
PID 4916 wrote to memory of 3908	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	93
PID 4916 wrote to memory of 4524	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	94
PID 4916 wrote to memory of 4524	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	94
PID 4916 wrote to memory of 4760	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	95
PID 4916 wrote to memory of 4760	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	95
PID 4916 wrote to memory of 1476	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	96
PID 4916 wrote to memory of 1476	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	96
PID 4916 wrote to memory of 4884	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	97
PID 4916 wrote to memory of 4884	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	97
PID 4916 wrote to memory of 2204	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	98
PID 4916 wrote to memory of 2204	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	98
PID 4916 wrote to memory of 2960	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	99
PID 4916 wrote to memory of 2960	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	99
PID 4916 wrote to memory of 3600	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	100
PID 4916 wrote to memory of 3600	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	100
PID 4916 wrote to memory of 3900	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	101
PID 4916 wrote to memory of 3900	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	101
PID 4916 wrote to memory of 3048	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	102
PID 4916 wrote to memory of 3048	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	102
PID 4916 wrote to memory of 3012	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	103
PID 4916 wrote to memory of 3012	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	103
PID 4916 wrote to memory of 4320	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	104
PID 4916 wrote to memory of 4320	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	104
PID 4916 wrote to memory of 3512	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	105
PID 4916 wrote to memory of 3512	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	105
PID 4916 wrote to memory of 4964	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	106
PID 4916 wrote to memory of 4964	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	106
PID 4916 wrote to memory of 1756	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	107
PID 4916 wrote to memory of 1756	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	107
PID 4916 wrote to memory of 408	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	108
PID 4916 wrote to memory of 408	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	108
PID 4916 wrote to memory of 1788	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	109
PID 4916 wrote to memory of 1788	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	109
PID 4916 wrote to memory of 1576	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	110
PID 4916 wrote to memory of 1576	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	110
PID 4916 wrote to memory of 4228	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	111
PID 4916 wrote to memory of 4228	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	111
PID 4916 wrote to memory of 2420	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	112
PID 4916 wrote to memory of 2420	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	112
PID 4916 wrote to memory of 3608	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	113
PID 4916 wrote to memory of 3608	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	113
PID 4916 wrote to memory of 4432	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	114
PID 4916 wrote to memory of 4432	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	114
PID 4916 wrote to memory of 2556	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	115
PID 4916 wrote to memory of 2556	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	115
PID 4916 wrote to memory of 3772	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	116
PID 4916 wrote to memory of 3772	4916	003d08c6abdb96669effbd2198408709_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\003d08c6abdb96669effbd2198408709_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\003d08c6abdb96669effbd2198408709_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System\EiqGdUE.exe
  C:\Windows\System\EiqGdUE.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\FbqFePn.exe
  C:\Windows\System\FbqFePn.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\VGEppjk.exe
  C:\Windows\System\VGEppjk.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\AxWfEbC.exe
  C:\Windows\System\AxWfEbC.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\kqZifHn.exe
  C:\Windows\System\kqZifHn.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\YGPapDO.exe
  C:\Windows\System\YGPapDO.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\wSLzOzk.exe
  C:\Windows\System\wSLzOzk.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\iKflbhD.exe
  C:\Windows\System\iKflbhD.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\QqpaFGP.exe
  C:\Windows\System\QqpaFGP.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\CBVpjNq.exe
  C:\Windows\System\CBVpjNq.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\cOEDICo.exe
  C:\Windows\System\cOEDICo.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\OlsaNJl.exe
  C:\Windows\System\OlsaNJl.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\xfmfULt.exe
  C:\Windows\System\xfmfULt.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\vQqHouY.exe
  C:\Windows\System\vQqHouY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\vOVNttA.exe
  C:\Windows\System\vOVNttA.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\jQbdmnH.exe
  C:\Windows\System\jQbdmnH.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\GRcsiQx.exe
  C:\Windows\System\GRcsiQx.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\JGfRClC.exe
  C:\Windows\System\JGfRClC.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\bHUOcXP.exe
  C:\Windows\System\bHUOcXP.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\WFVKhfO.exe
  C:\Windows\System\WFVKhfO.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\kkjUzVR.exe
  C:\Windows\System\kkjUzVR.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\qSlXdGP.exe
  C:\Windows\System\qSlXdGP.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\dnMCxuV.exe
  C:\Windows\System\dnMCxuV.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\zzVxUlr.exe
  C:\Windows\System\zzVxUlr.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\eJIwiZK.exe
  C:\Windows\System\eJIwiZK.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\TMVxxaQ.exe
  C:\Windows\System\TMVxxaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\BJtXgOK.exe
  C:\Windows\System\BJtXgOK.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\vmwLYPb.exe
  C:\Windows\System\vmwLYPb.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\KOWbywT.exe
  C:\Windows\System\KOWbywT.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ZqhBIyG.exe
  C:\Windows\System\ZqhBIyG.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\uynpQGO.exe
  C:\Windows\System\uynpQGO.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\eYzYBTi.exe
  C:\Windows\System\eYzYBTi.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\LiNDIHk.exe
  C:\Windows\System\LiNDIHk.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\KnLNofW.exe
  C:\Windows\System\KnLNofW.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\NgVNPKy.exe
  C:\Windows\System\NgVNPKy.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\deufKLA.exe
  C:\Windows\System\deufKLA.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\LwZwATU.exe
  C:\Windows\System\LwZwATU.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\VXgeqKG.exe
  C:\Windows\System\VXgeqKG.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\VwlYaBm.exe
  C:\Windows\System\VwlYaBm.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\KBUgBIp.exe
  C:\Windows\System\KBUgBIp.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\AysVGvn.exe
  C:\Windows\System\AysVGvn.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\NczHZja.exe
  C:\Windows\System\NczHZja.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\emjuSXf.exe
  C:\Windows\System\emjuSXf.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\vGNCkvm.exe
  C:\Windows\System\vGNCkvm.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\iYCQmFu.exe
  C:\Windows\System\iYCQmFu.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\CmWPOEJ.exe
  C:\Windows\System\CmWPOEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\nVLGuzF.exe
  C:\Windows\System\nVLGuzF.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\ZfTnhGs.exe
  C:\Windows\System\ZfTnhGs.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\WLOwsRP.exe
  C:\Windows\System\WLOwsRP.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\wgOHnvi.exe
  C:\Windows\System\wgOHnvi.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\bTYlbRL.exe
  C:\Windows\System\bTYlbRL.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\IVNGjZo.exe
  C:\Windows\System\IVNGjZo.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\waOtztL.exe
  C:\Windows\System\waOtztL.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\gkFysvm.exe
  C:\Windows\System\gkFysvm.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\TgRpokK.exe
  C:\Windows\System\TgRpokK.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\AgwBGqH.exe
  C:\Windows\System\AgwBGqH.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\OogeYxD.exe
  C:\Windows\System\OogeYxD.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\nZLdRnj.exe
  C:\Windows\System\nZLdRnj.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\mTdxEiN.exe
  C:\Windows\System\mTdxEiN.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\fSWrwuM.exe
  C:\Windows\System\fSWrwuM.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\SJhGwwx.exe
  C:\Windows\System\SJhGwwx.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\gcsqcBx.exe
  C:\Windows\System\gcsqcBx.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\ncsKKGd.exe
  C:\Windows\System\ncsKKGd.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\VqgCPZs.exe
  C:\Windows\System\VqgCPZs.exe
  2⤵
  PID:4056
- C:\Windows\System\szLwlSB.exe
  C:\Windows\System\szLwlSB.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\hIluFIU.exe
  C:\Windows\System\hIluFIU.exe
  2⤵
  PID:3208
- C:\Windows\System\zOYqKiL.exe
  C:\Windows\System\zOYqKiL.exe
  2⤵
  PID:4172
- C:\Windows\System\MrVuWek.exe
  C:\Windows\System\MrVuWek.exe
  2⤵
  PID:4384
- C:\Windows\System\dDWtDvA.exe
  C:\Windows\System\dDWtDvA.exe
  2⤵
  PID:888
- C:\Windows\System\NTEtPCY.exe
  C:\Windows\System\NTEtPCY.exe
  2⤵
  PID:4016
- C:\Windows\System\LhEMfOQ.exe
  C:\Windows\System\LhEMfOQ.exe
  2⤵
  PID:2340
- C:\Windows\System\MgccxzJ.exe
  C:\Windows\System\MgccxzJ.exe
  2⤵
  PID:4360
- C:\Windows\System\MMbRRaS.exe
  C:\Windows\System\MMbRRaS.exe
  2⤵
  PID:4588
- C:\Windows\System\HhDeYYS.exe
  C:\Windows\System\HhDeYYS.exe
  2⤵
  PID:1780
- C:\Windows\System\vFCRCMV.exe
  C:\Windows\System\vFCRCMV.exe
  2⤵
  PID:5128
- C:\Windows\System\tmDAPQa.exe
  C:\Windows\System\tmDAPQa.exe
  2⤵
  PID:5144
- C:\Windows\System\ICUCYBH.exe
  C:\Windows\System\ICUCYBH.exe
  2⤵
  PID:5168
- C:\Windows\System\LFOnuBE.exe
  C:\Windows\System\LFOnuBE.exe
  2⤵
  PID:5184
- C:\Windows\System\bEjltbO.exe
  C:\Windows\System\bEjltbO.exe
  2⤵
  PID:5200
- C:\Windows\System\YYtzwSN.exe
  C:\Windows\System\YYtzwSN.exe
  2⤵
  PID:5216
- C:\Windows\System\uolOIVM.exe
  C:\Windows\System\uolOIVM.exe
  2⤵
  PID:5236
- C:\Windows\System\bdcgKAc.exe
  C:\Windows\System\bdcgKAc.exe
  2⤵
  PID:5260
- C:\Windows\System\xvIKIep.exe
  C:\Windows\System\xvIKIep.exe
  2⤵
  PID:5284
- C:\Windows\System\LXecPGd.exe
  C:\Windows\System\LXecPGd.exe
  2⤵
  PID:5300
- C:\Windows\System\NiafyDm.exe
  C:\Windows\System\NiafyDm.exe
  2⤵
  PID:5320
- C:\Windows\System\rkpnSHA.exe
  C:\Windows\System\rkpnSHA.exe
  2⤵
  PID:5336
- C:\Windows\System\IsmtBcV.exe
  C:\Windows\System\IsmtBcV.exe
  2⤵
  PID:5356
- C:\Windows\System\DfZRnVm.exe
  C:\Windows\System\DfZRnVm.exe
  2⤵
  PID:5376
- C:\Windows\System\LGWwqFx.exe
  C:\Windows\System\LGWwqFx.exe
  2⤵
  PID:5400
- C:\Windows\System\PCSIMUC.exe
  C:\Windows\System\PCSIMUC.exe
  2⤵
  PID:5416
- C:\Windows\System\yHrfEop.exe
  C:\Windows\System\yHrfEop.exe
  2⤵
  PID:5436
- C:\Windows\System\yOfHpQr.exe
  C:\Windows\System\yOfHpQr.exe
  2⤵
  PID:5452
- C:\Windows\System\cPbHHIJ.exe
  C:\Windows\System\cPbHHIJ.exe
  2⤵
  PID:5468
- C:\Windows\System\dOJmlVF.exe
  C:\Windows\System\dOJmlVF.exe
  2⤵
  PID:5488
- C:\Windows\System\GKNiujh.exe
  C:\Windows\System\GKNiujh.exe
  2⤵
  PID:5504
- C:\Windows\System\MwCanUY.exe
  C:\Windows\System\MwCanUY.exe
  2⤵
  PID:5524
- C:\Windows\System\YoIkSHP.exe
  C:\Windows\System\YoIkSHP.exe
  2⤵
  PID:5540
- C:\Windows\System\UGATeqX.exe
  C:\Windows\System\UGATeqX.exe
  2⤵
  PID:5560
- C:\Windows\System\xCInUwp.exe
  C:\Windows\System\xCInUwp.exe
  2⤵
  PID:5576
- C:\Windows\System\VRjtqzh.exe
  C:\Windows\System\VRjtqzh.exe
  2⤵
  PID:5596
- C:\Windows\System\LJLdsse.exe
  C:\Windows\System\LJLdsse.exe
  2⤵
  PID:5616
- C:\Windows\System\IsbMerP.exe
  C:\Windows\System\IsbMerP.exe
  2⤵
  PID:5636
- C:\Windows\System\rxBawDy.exe
  C:\Windows\System\rxBawDy.exe
  2⤵
  PID:5656
- C:\Windows\System\ilzbnpz.exe
  C:\Windows\System\ilzbnpz.exe
  2⤵
  PID:5676
- C:\Windows\System\PQNRnfv.exe
  C:\Windows\System\PQNRnfv.exe
  2⤵
  PID:5692
- C:\Windows\System\iPRqnHj.exe
  C:\Windows\System\iPRqnHj.exe
  2⤵
  PID:5708
- C:\Windows\System\EJaSJWN.exe
  C:\Windows\System\EJaSJWN.exe
  2⤵
  PID:5728
- C:\Windows\System\USflupn.exe
  C:\Windows\System\USflupn.exe
  2⤵
  PID:5752
- C:\Windows\System\cRoQWKP.exe
  C:\Windows\System\cRoQWKP.exe
  2⤵
  PID:5776
- C:\Windows\System\NqxbAIa.exe
  C:\Windows\System\NqxbAIa.exe
  2⤵
  PID:5792
- C:\Windows\System\oUbNELJ.exe
  C:\Windows\System\oUbNELJ.exe
  2⤵
  PID:5812
- C:\Windows\System\ROFAkOH.exe
  C:\Windows\System\ROFAkOH.exe
  2⤵
  PID:5828
- C:\Windows\System\bjFRYAI.exe
  C:\Windows\System\bjFRYAI.exe
  2⤵
  PID:5848
- C:\Windows\System\sqSOuNY.exe
  C:\Windows\System\sqSOuNY.exe
  2⤵
  PID:5876
- C:\Windows\System\DxYyWfB.exe
  C:\Windows\System\DxYyWfB.exe
  2⤵
  PID:5892
- C:\Windows\System\ioMXfht.exe
  C:\Windows\System\ioMXfht.exe
  2⤵
  PID:5912
- C:\Windows\System\JAJzPjF.exe
  C:\Windows\System\JAJzPjF.exe
  2⤵
  PID:5932
- C:\Windows\System\eXThOep.exe
  C:\Windows\System\eXThOep.exe
  2⤵
  PID:5960
- C:\Windows\System\dMaBMla.exe
  C:\Windows\System\dMaBMla.exe
  2⤵
  PID:5980
- C:\Windows\System\jOCpwhZ.exe
  C:\Windows\System\jOCpwhZ.exe
  2⤵
  PID:6000
- C:\Windows\System\hjJwQAX.exe
  C:\Windows\System\hjJwQAX.exe
  2⤵
  PID:6016
- C:\Windows\System\CbBqBSb.exe
  C:\Windows\System\CbBqBSb.exe
  2⤵
  PID:6032
- C:\Windows\System\EhQvlFC.exe
  C:\Windows\System\EhQvlFC.exe
  2⤵
  PID:6060
- C:\Windows\System\lkBzJnt.exe
  C:\Windows\System\lkBzJnt.exe
  2⤵
  PID:6080
- C:\Windows\System\iMMzTML.exe
  C:\Windows\System\iMMzTML.exe
  2⤵
  PID:6096
- C:\Windows\System\kDcwxUp.exe
  C:\Windows\System\kDcwxUp.exe
  2⤵
  PID:6116
- C:\Windows\System\YIQqKkf.exe
  C:\Windows\System\YIQqKkf.exe
  2⤵
  PID:6136
- C:\Windows\System\TGLmGrX.exe
  C:\Windows\System\TGLmGrX.exe
  2⤵
  PID:2664
- C:\Windows\System\XucUJpT.exe
  C:\Windows\System\XucUJpT.exe
  2⤵
  PID:2280
- C:\Windows\System\ZOREuqp.exe
  C:\Windows\System\ZOREuqp.exe
  2⤵
  PID:4188
- C:\Windows\System\BqqcFzW.exe
  C:\Windows\System\BqqcFzW.exe
  2⤵
  PID:3580
- C:\Windows\System\pcUYoBY.exe
  C:\Windows\System\pcUYoBY.exe
  2⤵
  PID:2488
- C:\Windows\System\RYoYopQ.exe
  C:\Windows\System\RYoYopQ.exe
  2⤵
  PID:2528
- C:\Windows\System\pSYbFdE.exe
  C:\Windows\System\pSYbFdE.exe
  2⤵
  PID:1688
- C:\Windows\System\cFbIYBd.exe
  C:\Windows\System\cFbIYBd.exe
  2⤵
  PID:1444
- C:\Windows\System\PyWYyiP.exe
  C:\Windows\System\PyWYyiP.exe
  2⤵
  PID:2344
- C:\Windows\System\KMjiqaj.exe
  C:\Windows\System\KMjiqaj.exe
  2⤵
  PID:3716
- C:\Windows\System\sPajboR.exe
  C:\Windows\System\sPajboR.exe
  2⤵
  PID:1996
- C:\Windows\System\VAyfHUN.exe
  C:\Windows\System\VAyfHUN.exe
  2⤵
  PID:1752
- C:\Windows\System\FOlQmaE.exe
  C:\Windows\System\FOlQmaE.exe
  2⤵
  PID:5228
- C:\Windows\System\oZwpyxX.exe
  C:\Windows\System\oZwpyxX.exe
  2⤵
  PID:4576
- C:\Windows\System\GAwEcRW.exe
  C:\Windows\System\GAwEcRW.exe
  2⤵
  PID:4504
- C:\Windows\System\KgkIGqs.exe
  C:\Windows\System\KgkIGqs.exe
  2⤵
  PID:1588
- C:\Windows\System\NfrhBvq.exe
  C:\Windows\System\NfrhBvq.exe
  2⤵
  PID:3516
- C:\Windows\System\kgGryRI.exe
  C:\Windows\System\kgGryRI.exe
  2⤵
  PID:6164
- C:\Windows\System\ddaTTVe.exe
  C:\Windows\System\ddaTTVe.exe
  2⤵
  PID:6184
- C:\Windows\System\QOKTxnj.exe
  C:\Windows\System\QOKTxnj.exe
  2⤵
  PID:6204
- C:\Windows\System\OXioaAV.exe
  C:\Windows\System\OXioaAV.exe
  2⤵
  PID:6220
- C:\Windows\System\PUxPMOR.exe
  C:\Windows\System\PUxPMOR.exe
  2⤵
  PID:6240
- C:\Windows\System\ysJFuUO.exe
  C:\Windows\System\ysJFuUO.exe
  2⤵
  PID:6260
- C:\Windows\System\JCGmthx.exe
  C:\Windows\System\JCGmthx.exe
  2⤵
  PID:6276
- C:\Windows\System\wbhqBHU.exe
  C:\Windows\System\wbhqBHU.exe
  2⤵
  PID:6300
- C:\Windows\System\WAjrKfJ.exe
  C:\Windows\System\WAjrKfJ.exe
  2⤵
  PID:6316
- C:\Windows\System\awsfAYq.exe
  C:\Windows\System\awsfAYq.exe
  2⤵
  PID:6332
- C:\Windows\System\IpmkrLr.exe
  C:\Windows\System\IpmkrLr.exe
  2⤵
  PID:6348
- C:\Windows\System\cEKlnBF.exe
  C:\Windows\System\cEKlnBF.exe
  2⤵
  PID:6368
- C:\Windows\System\CUhcRnn.exe
  C:\Windows\System\CUhcRnn.exe
  2⤵
  PID:6384
- C:\Windows\System\ADcJqLe.exe
  C:\Windows\System\ADcJqLe.exe
  2⤵
  PID:6404
- C:\Windows\System\sDuGkPO.exe
  C:\Windows\System\sDuGkPO.exe
  2⤵
  PID:6428
- C:\Windows\System\eQNFXCZ.exe
  C:\Windows\System\eQNFXCZ.exe
  2⤵
  PID:6452
- C:\Windows\System\ELDAxjI.exe
  C:\Windows\System\ELDAxjI.exe
  2⤵
  PID:6472
- C:\Windows\System\SpnuCXP.exe
  C:\Windows\System\SpnuCXP.exe
  2⤵
  PID:6496
- C:\Windows\System\GrgtyDX.exe
  C:\Windows\System\GrgtyDX.exe
  2⤵
  PID:6512
- C:\Windows\System\sXDWDoP.exe
  C:\Windows\System\sXDWDoP.exe
  2⤵
  PID:6532
- C:\Windows\System\cqKTruE.exe
  C:\Windows\System\cqKTruE.exe
  2⤵
  PID:6552
- C:\Windows\System\JQchOfp.exe
  C:\Windows\System\JQchOfp.exe
  2⤵
  PID:6568
- C:\Windows\System\LIwjVqo.exe
  C:\Windows\System\LIwjVqo.exe
  2⤵
  PID:6588
- C:\Windows\System\flEPPfM.exe
  C:\Windows\System\flEPPfM.exe
  2⤵
  PID:6604
- C:\Windows\System\suhwELp.exe
  C:\Windows\System\suhwELp.exe
  2⤵
  PID:6624
- C:\Windows\System\HSUqEMD.exe
  C:\Windows\System\HSUqEMD.exe
  2⤵
  PID:6644
- C:\Windows\System\fbjnPbv.exe
  C:\Windows\System\fbjnPbv.exe
  2⤵
  PID:6664
- C:\Windows\System\cYgCVCm.exe
  C:\Windows\System\cYgCVCm.exe
  2⤵
  PID:6680
- C:\Windows\System\uuavjNj.exe
  C:\Windows\System\uuavjNj.exe
  2⤵
  PID:6700
- C:\Windows\System\KErGaXA.exe
  C:\Windows\System\KErGaXA.exe
  2⤵
  PID:6716
- C:\Windows\System\sRinSfK.exe
  C:\Windows\System\sRinSfK.exe
  2⤵
  PID:6736
- C:\Windows\System\eVAweTS.exe
  C:\Windows\System\eVAweTS.exe
  2⤵
  PID:6752
- C:\Windows\System\qPnWseb.exe
  C:\Windows\System\qPnWseb.exe
  2⤵
  PID:6768
- C:\Windows\System\xTqSWoJ.exe
  C:\Windows\System\xTqSWoJ.exe
  2⤵
  PID:6796
- C:\Windows\System\zWMnrLG.exe
  C:\Windows\System\zWMnrLG.exe
  2⤵
  PID:6812
- C:\Windows\System\jAKnnCP.exe
  C:\Windows\System\jAKnnCP.exe
  2⤵
  PID:6828
- C:\Windows\System\LeZBlPq.exe
  C:\Windows\System\LeZBlPq.exe
  2⤵
  PID:6848
- C:\Windows\System\zgIzdkR.exe
  C:\Windows\System\zgIzdkR.exe
  2⤵
  PID:6868
- C:\Windows\System\FqygxKL.exe
  C:\Windows\System\FqygxKL.exe
  2⤵
  PID:6888
- C:\Windows\System\yMRiRyH.exe
  C:\Windows\System\yMRiRyH.exe
  2⤵
  PID:6904
- C:\Windows\System\DFOckjz.exe
  C:\Windows\System\DFOckjz.exe
  2⤵
  PID:6924
- C:\Windows\System\aIHcmed.exe
  C:\Windows\System\aIHcmed.exe
  2⤵
  PID:6948
- C:\Windows\System\umLChFd.exe
  C:\Windows\System\umLChFd.exe
  2⤵
  PID:6964
- C:\Windows\System\edfDHYb.exe
  C:\Windows\System\edfDHYb.exe
  2⤵
  PID:6984
- C:\Windows\System\BjBAZhI.exe
  C:\Windows\System\BjBAZhI.exe
  2⤵
  PID:7000
- C:\Windows\System\OzfNimq.exe
  C:\Windows\System\OzfNimq.exe
  2⤵
  PID:7016
- C:\Windows\System\Gyylmia.exe
  C:\Windows\System\Gyylmia.exe
  2⤵
  PID:7036
- C:\Windows\System\ZKPHbmO.exe
  C:\Windows\System\ZKPHbmO.exe
  2⤵
  PID:7060
- C:\Windows\System\cucrdLq.exe
  C:\Windows\System\cucrdLq.exe
  2⤵
  PID:7080
- C:\Windows\System\lyKbdSt.exe
  C:\Windows\System\lyKbdSt.exe
  2⤵
  PID:7096
- C:\Windows\System\ctAqiRc.exe
  C:\Windows\System\ctAqiRc.exe
  2⤵
  PID:7120
- C:\Windows\System\xqlUzHQ.exe
  C:\Windows\System\xqlUzHQ.exe
  2⤵
  PID:7140
- C:\Windows\System\KkgZkEv.exe
  C:\Windows\System\KkgZkEv.exe
  2⤵
  PID:7160
- C:\Windows\System\POrjAjE.exe
  C:\Windows\System\POrjAjE.exe
  2⤵
  PID:5412
- C:\Windows\System\XPuaWTs.exe
  C:\Windows\System\XPuaWTs.exe
  2⤵
  PID:8
- C:\Windows\System\qztgVDv.exe
  C:\Windows\System\qztgVDv.exe
  2⤵
  PID:2276
- C:\Windows\System\qmLGzat.exe
  C:\Windows\System\qmLGzat.exe
  2⤵
  PID:5536
- C:\Windows\System\ZONttOr.exe
  C:\Windows\System\ZONttOr.exe
  2⤵
  PID:3616
- C:\Windows\System\YLbGOCI.exe
  C:\Windows\System\YLbGOCI.exe
  2⤵
  PID:3956
- C:\Windows\System\EDtTADD.exe
  C:\Windows\System\EDtTADD.exe
  2⤵
  PID:5684
- C:\Windows\System\AMNZzfj.exe
  C:\Windows\System\AMNZzfj.exe
  2⤵
  PID:4604
- C:\Windows\System\uNKJKsQ.exe
  C:\Windows\System\uNKJKsQ.exe
  2⤵
  PID:5180
- C:\Windows\System\StYtmbD.exe
  C:\Windows\System\StYtmbD.exe
  2⤵
  PID:5836
- C:\Windows\System\WNqIrVn.exe
  C:\Windows\System\WNqIrVn.exe
  2⤵
  PID:5900
- C:\Windows\System\VRiGddR.exe
  C:\Windows\System\VRiGddR.exe
  2⤵
  PID:6008
- C:\Windows\System\frmfPHf.exe
  C:\Windows\System\frmfPHf.exe
  2⤵
  PID:5248
- C:\Windows\System\eVJRhuX.exe
  C:\Windows\System\eVJRhuX.exe
  2⤵
  PID:7184
- C:\Windows\System\wYifceO.exe
  C:\Windows\System\wYifceO.exe
  2⤵
  PID:7200
- C:\Windows\System\RpKXXyM.exe
  C:\Windows\System\RpKXXyM.exe
  2⤵
  PID:7220
- C:\Windows\System\geQqycI.exe
  C:\Windows\System\geQqycI.exe
  2⤵
  PID:7244
- C:\Windows\System\pzVamGT.exe
  C:\Windows\System\pzVamGT.exe
  2⤵
  PID:7264
- C:\Windows\System\tGqDkeC.exe
  C:\Windows\System\tGqDkeC.exe
  2⤵
  PID:7284
- C:\Windows\System\KcLgCWe.exe
  C:\Windows\System\KcLgCWe.exe
  2⤵
  PID:7300
- C:\Windows\System\uhLAndG.exe
  C:\Windows\System\uhLAndG.exe
  2⤵
  PID:7320
- C:\Windows\System\xCfFfZI.exe
  C:\Windows\System\xCfFfZI.exe
  2⤵
  PID:7352
- C:\Windows\System\TjsNJZH.exe
  C:\Windows\System\TjsNJZH.exe
  2⤵
  PID:7380
- C:\Windows\System\URYNiXX.exe
  C:\Windows\System\URYNiXX.exe
  2⤵
  PID:7416
- C:\Windows\System\JabXDBf.exe
  C:\Windows\System\JabXDBf.exe
  2⤵
  PID:7432
- C:\Windows\System\ApWkuOT.exe
  C:\Windows\System\ApWkuOT.exe
  2⤵
  PID:7452
- C:\Windows\System\EbSANWh.exe
  C:\Windows\System\EbSANWh.exe
  2⤵
  PID:7468
- C:\Windows\System\yEYSXvZ.exe
  C:\Windows\System\yEYSXvZ.exe
  2⤵
  PID:7488
- C:\Windows\System\MMOZEyf.exe
  C:\Windows\System\MMOZEyf.exe
  2⤵
  PID:7504
- C:\Windows\System\awKgTcs.exe
  C:\Windows\System\awKgTcs.exe
  2⤵
  PID:7528
- C:\Windows\System\ZRmeToH.exe
  C:\Windows\System\ZRmeToH.exe
  2⤵
  PID:7544
- C:\Windows\System\VWyWIOZ.exe
  C:\Windows\System\VWyWIOZ.exe
  2⤵
  PID:7564
- C:\Windows\System\DVBFnfM.exe
  C:\Windows\System\DVBFnfM.exe
  2⤵
  PID:7580
- C:\Windows\System\IRCfffn.exe
  C:\Windows\System\IRCfffn.exe
  2⤵
  PID:7600
- C:\Windows\System\kgqfELc.exe
  C:\Windows\System\kgqfELc.exe
  2⤵
  PID:7620
- C:\Windows\System\YfwFpST.exe
  C:\Windows\System\YfwFpST.exe
  2⤵
  PID:7636
- C:\Windows\System\QglyKTb.exe
  C:\Windows\System\QglyKTb.exe
  2⤵
  PID:7652
- C:\Windows\System\ZekhXeQ.exe
  C:\Windows\System\ZekhXeQ.exe
  2⤵
  PID:7676
- C:\Windows\System\eApWMsR.exe
  C:\Windows\System\eApWMsR.exe
  2⤵
  PID:7696
- C:\Windows\System\EOtIiWT.exe
  C:\Windows\System\EOtIiWT.exe
  2⤵
  PID:7724
- C:\Windows\System\hfggoeD.exe
  C:\Windows\System\hfggoeD.exe
  2⤵
  PID:7928
- C:\Windows\System\FHkAZzo.exe
  C:\Windows\System\FHkAZzo.exe
  2⤵
  PID:7944
- C:\Windows\System\jwoOFCw.exe
  C:\Windows\System\jwoOFCw.exe
  2⤵
  PID:7960
- C:\Windows\System\cepsMHH.exe
  C:\Windows\System\cepsMHH.exe
  2⤵
  PID:7976
- C:\Windows\System\dbsSFNa.exe
  C:\Windows\System\dbsSFNa.exe
  2⤵
  PID:7992
- C:\Windows\System\EnOZWIW.exe
  C:\Windows\System\EnOZWIW.exe
  2⤵
  PID:8008
- C:\Windows\System\BCTxwCb.exe
  C:\Windows\System\BCTxwCb.exe
  2⤵
  PID:8024
- C:\Windows\System\ZvyPFMH.exe
  C:\Windows\System\ZvyPFMH.exe
  2⤵
  PID:8040
- C:\Windows\System\lWQnLyf.exe
  C:\Windows\System\lWQnLyf.exe
  2⤵
  PID:8060
- C:\Windows\System\EptVNft.exe
  C:\Windows\System\EptVNft.exe
  2⤵
  PID:8076
- C:\Windows\System\IBNsXkg.exe
  C:\Windows\System\IBNsXkg.exe
  2⤵
  PID:8096
- C:\Windows\System\roivktZ.exe
  C:\Windows\System\roivktZ.exe
  2⤵
  PID:8112
- C:\Windows\System\GeHKKQC.exe
  C:\Windows\System\GeHKKQC.exe
  2⤵
  PID:8132
- C:\Windows\System\LskWiXI.exe
  C:\Windows\System\LskWiXI.exe
  2⤵
  PID:8148
- C:\Windows\System\cLgwtYq.exe
  C:\Windows\System\cLgwtYq.exe
  2⤵
  PID:8168
- C:\Windows\System\CdndVsw.exe
  C:\Windows\System\CdndVsw.exe
  2⤵
  PID:8184
- C:\Windows\System\uhxcQIZ.exe
  C:\Windows\System\uhxcQIZ.exe
  2⤵
  PID:6124
- C:\Windows\System\bhAmXHS.exe
  C:\Windows\System\bhAmXHS.exe
  2⤵
  PID:4960
- C:\Windows\System\PdBoiew.exe
  C:\Windows\System\PdBoiew.exe
  2⤵
  PID:404
- C:\Windows\System\XQjQlUW.exe
  C:\Windows\System\XQjQlUW.exe
  2⤵
  PID:6180
- C:\Windows\System\JDEuigE.exe
  C:\Windows\System\JDEuigE.exe
  2⤵
  PID:6192
- C:\Windows\System\qAohSRB.exe
  C:\Windows\System\qAohSRB.exe
  2⤵
  PID:6248
- C:\Windows\System\bNKfZNW.exe
  C:\Windows\System\bNKfZNW.exe
  2⤵
  PID:5424
- C:\Windows\System\XgwmuNp.exe
  C:\Windows\System\XgwmuNp.exe
  2⤵
  PID:5548
- C:\Windows\System\XkBOOhO.exe
  C:\Windows\System\XkBOOhO.exe
  2⤵
  PID:4376
- C:\Windows\System\AGoPnYr.exe
  C:\Windows\System\AGoPnYr.exe
  2⤵
  PID:5700
- C:\Windows\System\QQdlStT.exe
  C:\Windows\System\QQdlStT.exe
  2⤵
  PID:5124
- C:\Windows\System\BBRhEhA.exe
  C:\Windows\System\BBRhEhA.exe
  2⤵
  PID:5948
- C:\Windows\System\asmoYhA.exe
  C:\Windows\System\asmoYhA.exe
  2⤵
  PID:5272
- C:\Windows\System\DJyKHRj.exe
  C:\Windows\System\DJyKHRj.exe
  2⤵
  PID:5312
- C:\Windows\System\ZlJtrAU.exe
  C:\Windows\System\ZlJtrAU.exe
  2⤵
  PID:6128
- C:\Windows\System\wuraNCm.exe
  C:\Windows\System\wuraNCm.exe
  2⤵
  PID:5364
- C:\Windows\System\UPvoMqE.exe
  C:\Windows\System\UPvoMqE.exe
  2⤵
  PID:6324
- C:\Windows\System\QsAlOdz.exe
  C:\Windows\System\QsAlOdz.exe
  2⤵
  PID:5476
- C:\Windows\System\LYjcUFW.exe
  C:\Windows\System\LYjcUFW.exe
  2⤵
  PID:5668
- C:\Windows\System\nFQwPor.exe
  C:\Windows\System\nFQwPor.exe
  2⤵
  PID:5764
- C:\Windows\System\eGyQxDy.exe
  C:\Windows\System\eGyQxDy.exe
  2⤵
  PID:5860
- C:\Windows\System\NUlXLqn.exe
  C:\Windows\System\NUlXLqn.exe
  2⤵
  PID:5940
- C:\Windows\System\LHcRzko.exe
  C:\Windows\System\LHcRzko.exe
  2⤵
  PID:6088
- C:\Windows\System\rysZYce.exe
  C:\Windows\System\rysZYce.exe
  2⤵
  PID:1676
- C:\Windows\System\LtqOnIo.exe
  C:\Windows\System\LtqOnIo.exe
  2⤵
  PID:5136
- C:\Windows\System\yFwNbKe.exe
  C:\Windows\System\yFwNbKe.exe
  2⤵
  PID:5196
- C:\Windows\System\RplBKnz.exe
  C:\Windows\System\RplBKnz.exe
  2⤵
  PID:3152
- C:\Windows\System\hyjwOIs.exe
  C:\Windows\System\hyjwOIs.exe
  2⤵
  PID:2688
- C:\Windows\System\febtsAN.exe
  C:\Windows\System\febtsAN.exe
  2⤵
  PID:3232
- C:\Windows\System\fPwjSXt.exe
  C:\Windows\System\fPwjSXt.exe
  2⤵
  PID:6232
- C:\Windows\System\JgsQilL.exe
  C:\Windows\System\JgsQilL.exe
  2⤵
  PID:6376
- C:\Windows\System\ORQbBgn.exe
  C:\Windows\System\ORQbBgn.exe
  2⤵
  PID:7068
- C:\Windows\System\cnocYim.exe
  C:\Windows\System\cnocYim.exe
  2⤵
  PID:5944
- C:\Windows\System\CSFcUyK.exe
  C:\Windows\System\CSFcUyK.exe
  2⤵
  PID:7684
- C:\Windows\System\KbMEZvp.exe
  C:\Windows\System\KbMEZvp.exe
  2⤵
  PID:7836
- C:\Windows\System\GTxmtaA.exe
  C:\Windows\System\GTxmtaA.exe
  2⤵
  PID:6424
- C:\Windows\System\zOHccmJ.exe
  C:\Windows\System\zOHccmJ.exe
  2⤵
  PID:6508
- C:\Windows\System\btYrRbJ.exe
  C:\Windows\System\btYrRbJ.exe
  2⤵
  PID:6596
- C:\Windows\System\USBYsgP.exe
  C:\Windows\System\USBYsgP.exe
  2⤵
  PID:6672
- C:\Windows\System\eOXBvYQ.exe
  C:\Windows\System\eOXBvYQ.exe
  2⤵
  PID:6744
- C:\Windows\System\sXQTfDV.exe
  C:\Windows\System\sXQTfDV.exe
  2⤵
  PID:6880
- C:\Windows\System\EjPJoVT.exe
  C:\Windows\System\EjPJoVT.exe
  2⤵
  PID:8208
- C:\Windows\System\oTotQkk.exe
  C:\Windows\System\oTotQkk.exe
  2⤵
  PID:8228
- C:\Windows\System\hRKFaJL.exe
  C:\Windows\System\hRKFaJL.exe
  2⤵
  PID:8244
- C:\Windows\System\hamzajq.exe
  C:\Windows\System\hamzajq.exe
  2⤵
  PID:8264
- C:\Windows\System\MALrBCQ.exe
  C:\Windows\System\MALrBCQ.exe
  2⤵
  PID:8284
- C:\Windows\System\qBIlOVG.exe
  C:\Windows\System\qBIlOVG.exe
  2⤵
  PID:8300
- C:\Windows\System\ueeVMsN.exe
  C:\Windows\System\ueeVMsN.exe
  2⤵
  PID:8320
- C:\Windows\System\DkZBCcD.exe
  C:\Windows\System\DkZBCcD.exe
  2⤵
  PID:8340
- C:\Windows\System\MvBsfmz.exe
  C:\Windows\System\MvBsfmz.exe
  2⤵
  PID:8356
- C:\Windows\System\xmlYHLp.exe
  C:\Windows\System\xmlYHLp.exe
  2⤵
  PID:8376
- C:\Windows\System\juViRAv.exe
  C:\Windows\System\juViRAv.exe
  2⤵
  PID:8392
- C:\Windows\System\tXbXCMF.exe
  C:\Windows\System\tXbXCMF.exe
  2⤵
  PID:8412
- C:\Windows\System\AQwTrkl.exe
  C:\Windows\System\AQwTrkl.exe
  2⤵
  PID:8432
- C:\Windows\System\CabWExA.exe
  C:\Windows\System\CabWExA.exe
  2⤵
  PID:8448
- C:\Windows\System\bPcXkfm.exe
  C:\Windows\System\bPcXkfm.exe
  2⤵
  PID:8468
- C:\Windows\System\FesiSEx.exe
  C:\Windows\System\FesiSEx.exe
  2⤵
  PID:8484
- C:\Windows\System\wyztGvh.exe
  C:\Windows\System\wyztGvh.exe
  2⤵
  PID:8500
- C:\Windows\System\HKeqoEl.exe
  C:\Windows\System\HKeqoEl.exe
  2⤵
  PID:8520
- C:\Windows\System\RcZgATc.exe
  C:\Windows\System\RcZgATc.exe
  2⤵
  PID:8540
- C:\Windows\System\TbUesgu.exe
  C:\Windows\System\TbUesgu.exe
  2⤵
  PID:8560
- C:\Windows\System\xcOaGay.exe
  C:\Windows\System\xcOaGay.exe
  2⤵
  PID:8580
- C:\Windows\System\hrElaYa.exe
  C:\Windows\System\hrElaYa.exe
  2⤵
  PID:8600
- C:\Windows\System\SPNHHYP.exe
  C:\Windows\System\SPNHHYP.exe
  2⤵
  PID:8624
- C:\Windows\System\EIGSFtE.exe
  C:\Windows\System\EIGSFtE.exe
  2⤵
  PID:8640
- C:\Windows\System\qTlSHRz.exe
  C:\Windows\System\qTlSHRz.exe
  2⤵
  PID:8660
- C:\Windows\System\BkXzjxZ.exe
  C:\Windows\System\BkXzjxZ.exe
  2⤵
  PID:8676
- C:\Windows\System\kHxgOhf.exe
  C:\Windows\System\kHxgOhf.exe
  2⤵
  PID:8696
- C:\Windows\System\urHOuLq.exe
  C:\Windows\System\urHOuLq.exe
  2⤵
  PID:8712
- C:\Windows\System\ZLxlwKt.exe
  C:\Windows\System\ZLxlwKt.exe
  2⤵
  PID:8728
- C:\Windows\System\HWmhAfh.exe
  C:\Windows\System\HWmhAfh.exe
  2⤵
  PID:8744
- C:\Windows\System\gsyPejm.exe
  C:\Windows\System\gsyPejm.exe
  2⤵
  PID:8764
- C:\Windows\System\NzTcpat.exe
  C:\Windows\System\NzTcpat.exe
  2⤵
  PID:8780
- C:\Windows\System\TcVHhSU.exe
  C:\Windows\System\TcVHhSU.exe
  2⤵
  PID:8800
- C:\Windows\System\bJraJmC.exe
  C:\Windows\System\bJraJmC.exe
  2⤵
  PID:8820
- C:\Windows\System\xyrWGwU.exe
  C:\Windows\System\xyrWGwU.exe
  2⤵
  PID:8836
- C:\Windows\System\rGUrpzk.exe
  C:\Windows\System\rGUrpzk.exe
  2⤵
  PID:8856
- C:\Windows\System\aGdfKKV.exe
  C:\Windows\System\aGdfKKV.exe
  2⤵
  PID:8876
- C:\Windows\System\MxVhKNR.exe
  C:\Windows\System\MxVhKNR.exe
  2⤵
  PID:8896
- C:\Windows\System\gUWDmrs.exe
  C:\Windows\System\gUWDmrs.exe
  2⤵
  PID:8916
- C:\Windows\System\lvDefZZ.exe
  C:\Windows\System\lvDefZZ.exe
  2⤵
  PID:8932
- C:\Windows\System\JVuATOd.exe
  C:\Windows\System\JVuATOd.exe
  2⤵
  PID:8948
- C:\Windows\System\IaJYCvh.exe
  C:\Windows\System\IaJYCvh.exe
  2⤵
  PID:8968
- C:\Windows\System\QxeZhDP.exe
  C:\Windows\System\QxeZhDP.exe
  2⤵
  PID:8988
- C:\Windows\System\cQDRhVx.exe
  C:\Windows\System\cQDRhVx.exe
  2⤵
  PID:9008
- C:\Windows\System\nLXiIkS.exe
  C:\Windows\System\nLXiIkS.exe
  2⤵
  PID:9024
- C:\Windows\System\JYCVFdD.exe
  C:\Windows\System\JYCVFdD.exe
  2⤵
  PID:9044
- C:\Windows\System\JHnOcUn.exe
  C:\Windows\System\JHnOcUn.exe
  2⤵
  PID:9060
- C:\Windows\System\pSLgwny.exe
  C:\Windows\System\pSLgwny.exe
  2⤵
  PID:9080
- C:\Windows\System\yAWqzra.exe
  C:\Windows\System\yAWqzra.exe
  2⤵
  PID:9096
- C:\Windows\System\KMwslqq.exe
  C:\Windows\System\KMwslqq.exe
  2⤵
  PID:9112
- C:\Windows\System\OtRjiyr.exe
  C:\Windows\System\OtRjiyr.exe
  2⤵
  PID:9140
- C:\Windows\System\TLAujZv.exe
  C:\Windows\System\TLAujZv.exe
  2⤵
  PID:9160
- C:\Windows\System\FAjyWIk.exe
  C:\Windows\System\FAjyWIk.exe
  2⤵
  PID:9180
- C:\Windows\System\UTcGgFH.exe
  C:\Windows\System\UTcGgFH.exe
  2⤵
  PID:9200
- C:\Windows\System\EwOSScu.exe
  C:\Windows\System\EwOSScu.exe
  2⤵
  PID:6932
- C:\Windows\System\FptLWYa.exe
  C:\Windows\System\FptLWYa.exe
  2⤵
  PID:7132
- C:\Windows\System\aQnozYm.exe
  C:\Windows\System\aQnozYm.exe
  2⤵
  PID:4664
- C:\Windows\System\wiHkzKj.exe
  C:\Windows\System\wiHkzKj.exe
  2⤵
  PID:5720
- C:\Windows\System\QfdiIFX.exe
  C:\Windows\System\QfdiIFX.exe
  2⤵
  PID:5996
- C:\Windows\System\pEVRzEf.exe
  C:\Windows\System\pEVRzEf.exe
  2⤵
  PID:7212
- C:\Windows\System\IdovqfM.exe
  C:\Windows\System\IdovqfM.exe
  2⤵
  PID:7328
- C:\Windows\System\BkOlRPJ.exe
  C:\Windows\System\BkOlRPJ.exe
  2⤵
  PID:7424
- C:\Windows\System\zlllAHf.exe
  C:\Windows\System\zlllAHf.exe
  2⤵
  PID:7480
- C:\Windows\System\fXbYYmS.exe
  C:\Windows\System\fXbYYmS.exe
  2⤵
  PID:7560
- C:\Windows\System\LHwmqGI.exe
  C:\Windows\System\LHwmqGI.exe
  2⤵
  PID:7688
- C:\Windows\System\NaIiPfa.exe
  C:\Windows\System\NaIiPfa.exe
  2⤵
  PID:7572
- C:\Windows\System\BVUHnUz.exe
  C:\Windows\System\BVUHnUz.exe
  2⤵
  PID:9232
- C:\Windows\System\bExNddT.exe
  C:\Windows\System\bExNddT.exe
  2⤵
  PID:9252
- C:\Windows\System\rdjmGfg.exe
  C:\Windows\System\rdjmGfg.exe
  2⤵
  PID:9268
- C:\Windows\System\oATvxpY.exe
  C:\Windows\System\oATvxpY.exe
  2⤵
  PID:9288
- C:\Windows\System\UuveDHb.exe
  C:\Windows\System\UuveDHb.exe
  2⤵
  PID:9304
- C:\Windows\System\eHUkxTA.exe
  C:\Windows\System\eHUkxTA.exe
  2⤵
  PID:9324
- C:\Windows\System\aMZCWkD.exe
  C:\Windows\System\aMZCWkD.exe
  2⤵
  PID:9344
- C:\Windows\System\abDyCOp.exe
  C:\Windows\System\abDyCOp.exe
  2⤵
  PID:9364
- C:\Windows\System\ZHAGtJZ.exe
  C:\Windows\System\ZHAGtJZ.exe
  2⤵
  PID:9380
- C:\Windows\System\CTfJtJP.exe
  C:\Windows\System\CTfJtJP.exe
  2⤵
  PID:9396
- C:\Windows\System\hMIiaoA.exe
  C:\Windows\System\hMIiaoA.exe
  2⤵
  PID:9416
- C:\Windows\System\UEeCdhB.exe
  C:\Windows\System\UEeCdhB.exe
  2⤵
  PID:9436
- C:\Windows\System\RUkrJMx.exe
  C:\Windows\System\RUkrJMx.exe
  2⤵
  PID:9456
- C:\Windows\System\UATQoNF.exe
  C:\Windows\System\UATQoNF.exe
  2⤵
  PID:9476
- C:\Windows\System\rYwLLzZ.exe
  C:\Windows\System\rYwLLzZ.exe
  2⤵
  PID:9492
- C:\Windows\System\CmolWZo.exe
  C:\Windows\System\CmolWZo.exe
  2⤵
  PID:9512
- C:\Windows\System\BaTwVsY.exe
  C:\Windows\System\BaTwVsY.exe
  2⤵
  PID:9528
- C:\Windows\System\zrKpYhe.exe
  C:\Windows\System\zrKpYhe.exe
  2⤵
  PID:9544
- C:\Windows\System\DJWfYHD.exe
  C:\Windows\System\DJWfYHD.exe
  2⤵
  PID:9564
- C:\Windows\System\XYIUIrf.exe
  C:\Windows\System\XYIUIrf.exe
  2⤵
  PID:9584
- C:\Windows\System\SdBCTGy.exe
  C:\Windows\System\SdBCTGy.exe
  2⤵
  PID:9600
- C:\Windows\System\YlOrPyB.exe
  C:\Windows\System\YlOrPyB.exe
  2⤵
  PID:9620
- C:\Windows\System\MatVcJG.exe
  C:\Windows\System\MatVcJG.exe
  2⤵
  PID:9636
- C:\Windows\System\fLnteoN.exe
  C:\Windows\System\fLnteoN.exe
  2⤵
  PID:9656
- C:\Windows\System\XYrfnad.exe
  C:\Windows\System\XYrfnad.exe
  2⤵
  PID:9672
- C:\Windows\System\GnvDbzX.exe
  C:\Windows\System\GnvDbzX.exe
  2⤵
  PID:9692
- C:\Windows\System\QtzlwNg.exe
  C:\Windows\System\QtzlwNg.exe
  2⤵
  PID:9712
- C:\Windows\System\iVxJrwh.exe
  C:\Windows\System\iVxJrwh.exe
  2⤵
  PID:9732
- C:\Windows\System\drVRcfX.exe
  C:\Windows\System\drVRcfX.exe
  2⤵
  PID:9752
- C:\Windows\System\RMPoQvx.exe
  C:\Windows\System\RMPoQvx.exe
  2⤵
  PID:9768
- C:\Windows\System\ceJVPyy.exe
  C:\Windows\System\ceJVPyy.exe
  2⤵
  PID:9816
- C:\Windows\System\qNlYGnw.exe
  C:\Windows\System\qNlYGnw.exe
  2⤵
  PID:9840
- C:\Windows\System\sZYRzWZ.exe
  C:\Windows\System\sZYRzWZ.exe
  2⤵
  PID:9860
- C:\Windows\System\sTvjRpz.exe
  C:\Windows\System\sTvjRpz.exe
  2⤵
  PID:9880
- C:\Windows\System\VwKgMpZ.exe
  C:\Windows\System\VwKgMpZ.exe
  2⤵
  PID:9900
- C:\Windows\System\CzPIRlL.exe
  C:\Windows\System\CzPIRlL.exe
  2⤵
  PID:9920
- C:\Windows\System\tFCZIhh.exe
  C:\Windows\System\tFCZIhh.exe
  2⤵
  PID:9940
- C:\Windows\System\PcGKlem.exe
  C:\Windows\System\PcGKlem.exe
  2⤵
  PID:9964
- C:\Windows\System\ADwxHaY.exe
  C:\Windows\System\ADwxHaY.exe
  2⤵
  PID:9980
- C:\Windows\System\BPIdTSW.exe
  C:\Windows\System\BPIdTSW.exe
  2⤵
  PID:10000
- C:\Windows\System\iUXQcuX.exe
  C:\Windows\System\iUXQcuX.exe
  2⤵
  PID:10016
- C:\Windows\System\vhebHIr.exe
  C:\Windows\System\vhebHIr.exe
  2⤵
  PID:10036
- C:\Windows\System\SZlRaUY.exe
  C:\Windows\System\SZlRaUY.exe
  2⤵
  PID:10056
- C:\Windows\System\lGrwsrX.exe
  C:\Windows\System\lGrwsrX.exe
  2⤵
  PID:10072
- C:\Windows\System\jHbACpP.exe
  C:\Windows\System\jHbACpP.exe
  2⤵
  PID:10096
- C:\Windows\System\csLpEec.exe
  C:\Windows\System\csLpEec.exe
  2⤵
  PID:10112
- C:\Windows\System\MBrGUuj.exe
  C:\Windows\System\MBrGUuj.exe
  2⤵
  PID:10132
- C:\Windows\System\PmBLLil.exe
  C:\Windows\System\PmBLLil.exe
  2⤵
  PID:10152
- C:\Windows\System\uObEjbo.exe
  C:\Windows\System\uObEjbo.exe
  2⤵
  PID:10172
- C:\Windows\System\rnbQEPk.exe
  C:\Windows\System\rnbQEPk.exe
  2⤵
  PID:10188
- C:\Windows\System\fMjRlCb.exe
  C:\Windows\System\fMjRlCb.exe
  2⤵
  PID:10212
- C:\Windows\System\OvnjTkB.exe
  C:\Windows\System\OvnjTkB.exe
  2⤵
  PID:10232
- C:\Windows\System\TQYtFZz.exe
  C:\Windows\System\TQYtFZz.exe
  2⤵
  PID:5740
- C:\Windows\System\ExpZTMU.exe
  C:\Windows\System\ExpZTMU.exe
  2⤵
  PID:6112
- C:\Windows\System\oYFSqbz.exe
  C:\Windows\System\oYFSqbz.exe
  2⤵
  PID:5572
- C:\Windows\System\WEjZDft.exe
  C:\Windows\System\WEjZDft.exe
  2⤵
  PID:5928
- C:\Windows\System\MBTsOQM.exe
  C:\Windows\System\MBTsOQM.exe
  2⤵
  PID:6656
- C:\Windows\System\UCTSAog.exe
  C:\Windows\System\UCTSAog.exe
  2⤵
  PID:5036
- C:\Windows\System\UNQjRhz.exe
  C:\Windows\System\UNQjRhz.exe
  2⤵
  PID:6688
- C:\Windows\System\JPTddSn.exe
  C:\Windows\System\JPTddSn.exe
  2⤵
  PID:6396
- C:\Windows\System\MoVlDcd.exe
  C:\Windows\System\MoVlDcd.exe
  2⤵
  PID:6820
- C:\Windows\System\FlhIBdp.exe
  C:\Windows\System\FlhIBdp.exe
  2⤵
  PID:7832
- C:\Windows\System\rZgSojj.exe
  C:\Windows\System\rZgSojj.exe
  2⤵
  PID:7860
- C:\Windows\System\bsVtzXg.exe
  C:\Windows\System\bsVtzXg.exe
  2⤵
  PID:6528
- C:\Windows\System\zqEMteF.exe
  C:\Windows\System\zqEMteF.exe
  2⤵
  PID:6900
- C:\Windows\System\QdszSAM.exe
  C:\Windows\System\QdszSAM.exe
  2⤵
  PID:6912
- C:\Windows\System\aiQlsnq.exe
  C:\Windows\System\aiQlsnq.exe
  2⤵
  PID:6960
- C:\Windows\System\JplXRRn.exe
  C:\Windows\System\JplXRRn.exe
  2⤵
  PID:7028
- C:\Windows\System\SlOdBVD.exe
  C:\Windows\System\SlOdBVD.exe
  2⤵
  PID:7076
- C:\Windows\System\ATHRXAD.exe
  C:\Windows\System\ATHRXAD.exe
  2⤵
  PID:8332
- C:\Windows\System\KwoWUHA.exe
  C:\Windows\System\KwoWUHA.exe
  2⤵
  PID:8384
- C:\Windows\System\TRzBUut.exe
  C:\Windows\System\TRzBUut.exe
  2⤵
  PID:8464
- C:\Windows\System\ojbQWWZ.exe
  C:\Windows\System\ojbQWWZ.exe
  2⤵
  PID:4448
- C:\Windows\System\rHUbaWV.exe
  C:\Windows\System\rHUbaWV.exe
  2⤵
  PID:8516
- C:\Windows\System\OEVGbLh.exe
  C:\Windows\System\OEVGbLh.exe
  2⤵
  PID:10260
- C:\Windows\System\NjtwSng.exe
  C:\Windows\System\NjtwSng.exe
  2⤵
  PID:10280
- C:\Windows\System\XMQLneX.exe
  C:\Windows\System\XMQLneX.exe
  2⤵
  PID:10300
- C:\Windows\System\xvYMTmS.exe
  C:\Windows\System\xvYMTmS.exe
  2⤵
  PID:10320
- C:\Windows\System\kgxhEbL.exe
  C:\Windows\System\kgxhEbL.exe
  2⤵
  PID:10336
- C:\Windows\System\lyXhPoy.exe
  C:\Windows\System\lyXhPoy.exe
  2⤵
  PID:10356
- C:\Windows\System\rOIDdWB.exe
  C:\Windows\System\rOIDdWB.exe
  2⤵
  PID:10376
- C:\Windows\System\vPlaysZ.exe
  C:\Windows\System\vPlaysZ.exe
  2⤵
  PID:10396
- C:\Windows\System\tBqQvuL.exe
  C:\Windows\System\tBqQvuL.exe
  2⤵
  PID:10420
- C:\Windows\System\IDyiTCl.exe
  C:\Windows\System\IDyiTCl.exe
  2⤵
  PID:10440
- C:\Windows\System\OqmhhCb.exe
  C:\Windows\System\OqmhhCb.exe
  2⤵
  PID:10460
- C:\Windows\System\CAWKQLL.exe
  C:\Windows\System\CAWKQLL.exe
  2⤵
  PID:10476
- C:\Windows\System\jCsCxeR.exe
  C:\Windows\System\jCsCxeR.exe
  2⤵
  PID:10496
- C:\Windows\System\OJklTGI.exe
  C:\Windows\System\OJklTGI.exe
  2⤵
  PID:10512
- C:\Windows\System\wLHwHKN.exe
  C:\Windows\System\wLHwHKN.exe
  2⤵
  PID:10532
- C:\Windows\System\jqZgveA.exe
  C:\Windows\System\jqZgveA.exe
  2⤵
  PID:10556
- C:\Windows\System\qaLmtWm.exe
  C:\Windows\System\qaLmtWm.exe
  2⤵
  PID:10572
- C:\Windows\System\aqfkRNy.exe
  C:\Windows\System\aqfkRNy.exe
  2⤵
  PID:10588
- C:\Windows\System\GiJkVti.exe
  C:\Windows\System\GiJkVti.exe
  2⤵
  PID:10608
- C:\Windows\System\PTnTPwa.exe
  C:\Windows\System\PTnTPwa.exe
  2⤵
  PID:10628
- C:\Windows\System\XfEmpvY.exe
  C:\Windows\System\XfEmpvY.exe
  2⤵
  PID:10644
- C:\Windows\System\edVzxTN.exe
  C:\Windows\System\edVzxTN.exe
  2⤵
  PID:10664
- C:\Windows\System\NJIUcgD.exe
  C:\Windows\System\NJIUcgD.exe
  2⤵
  PID:10688
- C:\Windows\System\OVcYfWS.exe
  C:\Windows\System\OVcYfWS.exe
  2⤵
  PID:10712
- C:\Windows\System\shLlHth.exe
  C:\Windows\System\shLlHth.exe
  2⤵
  PID:10728
- C:\Windows\System\JGIlMxT.exe
  C:\Windows\System\JGIlMxT.exe
  2⤵
  PID:10744
- C:\Windows\System\duPgJxZ.exe
  C:\Windows\System\duPgJxZ.exe
  2⤵
  PID:10768
- C:\Windows\System\AkABYUx.exe
  C:\Windows\System\AkABYUx.exe
  2⤵
  PID:10788
- C:\Windows\System\pbZlIKj.exe
  C:\Windows\System\pbZlIKj.exe
  2⤵
  PID:10804
- C:\Windows\System\DwEHmXX.exe
  C:\Windows\System\DwEHmXX.exe
  2⤵
  PID:10824
- C:\Windows\System\nkEmPEZ.exe
  C:\Windows\System\nkEmPEZ.exe
  2⤵
  PID:10840
- C:\Windows\System\ZnOdTpQ.exe
  C:\Windows\System\ZnOdTpQ.exe
  2⤵
  PID:10860
- C:\Windows\System\NCoFStZ.exe
  C:\Windows\System\NCoFStZ.exe
  2⤵
  PID:10880
- C:\Windows\System\aefyTXF.exe
  C:\Windows\System\aefyTXF.exe
  2⤵
  PID:10900
- C:\Windows\System\FHkbBxP.exe
  C:\Windows\System\FHkbBxP.exe
  2⤵
  PID:10920
- C:\Windows\System\GUipdtr.exe
  C:\Windows\System\GUipdtr.exe
  2⤵
  PID:10940
- C:\Windows\System\nIrkFCF.exe
  C:\Windows\System\nIrkFCF.exe
  2⤵
  PID:10960
- C:\Windows\System\hgzLnMX.exe
  C:\Windows\System\hgzLnMX.exe
  2⤵
  PID:10980
- C:\Windows\System\HNUkTgJ.exe
  C:\Windows\System\HNUkTgJ.exe
  2⤵
  PID:11000
- C:\Windows\System\UTvbLqE.exe
  C:\Windows\System\UTvbLqE.exe
  2⤵
  PID:11020
- C:\Windows\System\tYvJKpk.exe
  C:\Windows\System\tYvJKpk.exe
  2⤵
  PID:11040
- C:\Windows\System\GphOVrE.exe
  C:\Windows\System\GphOVrE.exe
  2⤵
  PID:11056
- C:\Windows\System\BfsAvXI.exe
  C:\Windows\System\BfsAvXI.exe
  2⤵
  PID:11076
- C:\Windows\System\NmAyZtq.exe
  C:\Windows\System\NmAyZtq.exe
  2⤵
  PID:11092
- C:\Windows\System\IVmKMFd.exe
  C:\Windows\System\IVmKMFd.exe
  2⤵
  PID:11108
- C:\Windows\System\liEXOdp.exe
  C:\Windows\System\liEXOdp.exe
  2⤵
  PID:11128
- C:\Windows\System\SpREJiO.exe
  C:\Windows\System\SpREJiO.exe
  2⤵
  PID:11144
- C:\Windows\System\fzXTKFM.exe
  C:\Windows\System\fzXTKFM.exe
  2⤵
  PID:11164
- C:\Windows\System\lVSVuxt.exe
  C:\Windows\System\lVSVuxt.exe
  2⤵
  PID:11184
- C:\Windows\System\GIrLekf.exe
  C:\Windows\System\GIrLekf.exe
  2⤵
  PID:11204
- C:\Windows\System\FfVaBqa.exe
  C:\Windows\System\FfVaBqa.exe
  2⤵
  PID:11220
- C:\Windows\System\IFaySIs.exe
  C:\Windows\System\IFaySIs.exe
  2⤵
  PID:11240
- C:\Windows\System\pQacyjm.exe
  C:\Windows\System\pQacyjm.exe
  2⤵
  PID:11260
- C:\Windows\System\wOMsVuN.exe
  C:\Windows\System\wOMsVuN.exe
  2⤵
  PID:5988
- C:\Windows\System\iZwcKwo.exe
  C:\Windows\System\iZwcKwo.exe
  2⤵
  PID:8592
- C:\Windows\System\CONeIFQ.exe
  C:\Windows\System\CONeIFQ.exe
  2⤵
  PID:8684
- C:\Windows\System\KnKJdcM.exe
  C:\Windows\System\KnKJdcM.exe
  2⤵
  PID:8688
- C:\Windows\System\DXpOYVD.exe
  C:\Windows\System\DXpOYVD.exe
  2⤵
  PID:8756
- C:\Windows\System\dMizZIX.exe
  C:\Windows\System\dMizZIX.exe
  2⤵
  PID:8832
- C:\Windows\System\ElpBGKq.exe
  C:\Windows\System\ElpBGKq.exe
  2⤵
  PID:8864
- C:\Windows\System\IMrhHVi.exe
  C:\Windows\System\IMrhHVi.exe
  2⤵
  PID:8904
- C:\Windows\System\VWblUTj.exe
  C:\Windows\System\VWblUTj.exe
  2⤵
  PID:8956
- C:\Windows\System\KItBniJ.exe
  C:\Windows\System\KItBniJ.exe
  2⤵
  PID:8996
- C:\Windows\System\HiOtBCi.exe
  C:\Windows\System\HiOtBCi.exe
  2⤵
  PID:7296
- C:\Windows\System\TbbqPrW.exe
  C:\Windows\System\TbbqPrW.exe
  2⤵
  PID:9092
- C:\Windows\System\svGdfiw.exe
  C:\Windows\System\svGdfiw.exe
  2⤵
  PID:7500
- C:\Windows\System\dvOFcGE.exe
  C:\Windows\System\dvOFcGE.exe
  2⤵
  PID:7552
- C:\Windows\System\wEdnCvQ.exe
  C:\Windows\System\wEdnCvQ.exe
  2⤵
  PID:11272
- C:\Windows\System\XesIZKC.exe
  C:\Windows\System\XesIZKC.exe
  2⤵
  PID:11292
- C:\Windows\System\tiYRaVk.exe
  C:\Windows\System\tiYRaVk.exe
  2⤵
  PID:11312
- C:\Windows\System\wrJAyqL.exe
  C:\Windows\System\wrJAyqL.exe
  2⤵
  PID:11328
- C:\Windows\System\kfBjvNj.exe
  C:\Windows\System\kfBjvNj.exe
  2⤵
  PID:11348
- C:\Windows\System\YxjjVfW.exe
  C:\Windows\System\YxjjVfW.exe
  2⤵
  PID:11368
- C:\Windows\System\LYEOtFl.exe
  C:\Windows\System\LYEOtFl.exe
  2⤵
  PID:11384
- C:\Windows\System\LLdmafk.exe
  C:\Windows\System\LLdmafk.exe
  2⤵
  PID:11404
- C:\Windows\System\SAQomTh.exe
  C:\Windows\System\SAQomTh.exe
  2⤵
  PID:11424
- C:\Windows\System\IMCqhSO.exe
  C:\Windows\System\IMCqhSO.exe
  2⤵
  PID:11440
- C:\Windows\System\ozxVnBS.exe
  C:\Windows\System\ozxVnBS.exe
  2⤵
  PID:11460
- C:\Windows\System\zLnoAuV.exe
  C:\Windows\System\zLnoAuV.exe
  2⤵
  PID:11480
- C:\Windows\System\oRHupCf.exe
  C:\Windows\System\oRHupCf.exe
  2⤵
  PID:11496
- C:\Windows\System\dMHfhsT.exe
  C:\Windows\System\dMHfhsT.exe
  2⤵
  PID:11512
- C:\Windows\System\wYBhcNR.exe
  C:\Windows\System\wYBhcNR.exe
  2⤵
  PID:11532
- C:\Windows\System\cAiXngh.exe
  C:\Windows\System\cAiXngh.exe
  2⤵
  PID:11552
- C:\Windows\System\kPFRmBk.exe
  C:\Windows\System\kPFRmBk.exe
  2⤵
  PID:11568
- C:\Windows\System\dZORzzs.exe
  C:\Windows\System\dZORzzs.exe
  2⤵
  PID:11584
- C:\Windows\System\JNGWnwm.exe
  C:\Windows\System\JNGWnwm.exe
  2⤵
  PID:11604
- C:\Windows\System\wnDBWar.exe
  C:\Windows\System\wnDBWar.exe
  2⤵
  PID:11620
- C:\Windows\System\DtBRyUY.exe
  C:\Windows\System\DtBRyUY.exe
  2⤵
  PID:11640
- C:\Windows\System\DFOwRHg.exe
  C:\Windows\System\DFOwRHg.exe
  2⤵
  PID:11660
- C:\Windows\System\CTJlzRo.exe
  C:\Windows\System\CTJlzRo.exe
  2⤵
  PID:11676
- C:\Windows\System\KvujELV.exe
  C:\Windows\System\KvujELV.exe
  2⤵
  PID:11696
- C:\Windows\System\LYxTfJO.exe
  C:\Windows\System\LYxTfJO.exe
  2⤵
  PID:11716
- C:\Windows\System\EIVThuU.exe
  C:\Windows\System\EIVThuU.exe
  2⤵
  PID:11736
- C:\Windows\System\sxhlTaX.exe
  C:\Windows\System\sxhlTaX.exe
  2⤵
  PID:11752
- C:\Windows\System\KGPniuI.exe
  C:\Windows\System\KGPniuI.exe
  2⤵
  PID:11772
- C:\Windows\System\osOsBzZ.exe
  C:\Windows\System\osOsBzZ.exe
  2⤵
  PID:11788
- C:\Windows\System\gMpCNcl.exe
  C:\Windows\System\gMpCNcl.exe
  2⤵
  PID:11812
- C:\Windows\System\CPmaerr.exe
  C:\Windows\System\CPmaerr.exe
  2⤵
  PID:11828
- C:\Windows\System\vuXXvtN.exe
  C:\Windows\System\vuXXvtN.exe
  2⤵
  PID:11848
- C:\Windows\System\iGBTCro.exe
  C:\Windows\System\iGBTCro.exe
  2⤵
  PID:11864
- C:\Windows\System\pdyBeBo.exe
  C:\Windows\System\pdyBeBo.exe
  2⤵
  PID:11884
- C:\Windows\System\uFSzNLU.exe
  C:\Windows\System\uFSzNLU.exe
  2⤵
  PID:11912
- C:\Windows\System\adojgdA.exe
  C:\Windows\System\adojgdA.exe
  2⤵
  PID:11932
- C:\Windows\System\czDWBww.exe
  C:\Windows\System\czDWBww.exe
  2⤵
  PID:11948
- C:\Windows\System\sXBVZmJ.exe
  C:\Windows\System\sXBVZmJ.exe
  2⤵
  PID:11964
- C:\Windows\System\sYvUfBU.exe
  C:\Windows\System\sYvUfBU.exe
  2⤵
  PID:11984
- C:\Windows\System\QlVVSTU.exe
  C:\Windows\System\QlVVSTU.exe
  2⤵
  PID:12000
- C:\Windows\System\xCWtHBd.exe
  C:\Windows\System\xCWtHBd.exe
  2⤵
  PID:12020
- C:\Windows\System\bQVBvnU.exe
  C:\Windows\System\bQVBvnU.exe
  2⤵
  PID:12040
- C:\Windows\System\PYjFWBt.exe
  C:\Windows\System\PYjFWBt.exe
  2⤵
  PID:12060
- C:\Windows\System\TmaDMUJ.exe
  C:\Windows\System\TmaDMUJ.exe
  2⤵
  PID:12076
- C:\Windows\System\mQkhbkr.exe
  C:\Windows\System\mQkhbkr.exe
  2⤵
  PID:12100
- C:\Windows\System\TUlGRuW.exe
  C:\Windows\System\TUlGRuW.exe
  2⤵
  PID:12124
- C:\Windows\System\SzCcsTE.exe
  C:\Windows\System\SzCcsTE.exe
  2⤵
  PID:12144
- C:\Windows\System\uxvoQWv.exe
  C:\Windows\System\uxvoQWv.exe
  2⤵
  PID:12168
- C:\Windows\System\SevTvyd.exe
  C:\Windows\System\SevTvyd.exe
  2⤵
  PID:12192
- C:\Windows\System\SFoNMnj.exe
  C:\Windows\System\SFoNMnj.exe
  2⤵
  PID:12224
- C:\Windows\System\djvbWCB.exe
  C:\Windows\System\djvbWCB.exe
  2⤵
  PID:12240
- C:\Windows\System\gCTqwVE.exe
  C:\Windows\System\gCTqwVE.exe
  2⤵
  PID:12260
- C:\Windows\System\refxpUE.exe
  C:\Windows\System\refxpUE.exe
  2⤵
  PID:12280
- C:\Windows\System\lwaCbGc.exe
  C:\Windows\System\lwaCbGc.exe
  2⤵
  PID:9196
- C:\Windows\System\QniXrMY.exe
  C:\Windows\System\QniXrMY.exe
  2⤵
  PID:7292
- C:\Windows\System\YWPbrwe.exe
  C:\Windows\System\YWPbrwe.exe
  2⤵
  PID:7316
- C:\Windows\System\qRlYleb.exe
  C:\Windows\System\qRlYleb.exe
  2⤵
  PID:7592
- C:\Windows\System\grMvufq.exe
  C:\Windows\System\grMvufq.exe
  2⤵
  PID:2220
- C:\Windows\System\OelKGvs.exe
  C:\Windows\System\OelKGvs.exe
  2⤵
  PID:11088
- C:\Windows\System\eqGNwdu.exe
  C:\Windows\System\eqGNwdu.exe
  2⤵
  PID:12528
- C:\Windows\System\cgChPLF.exe
  C:\Windows\System\cgChPLF.exe
  2⤵
  PID:11256
- C:\Windows\System\IzOLZUS.exe
  C:\Windows\System\IzOLZUS.exe
  2⤵
  PID:7516
- C:\Windows\System\BqjksQq.exe
  C:\Windows\System\BqjksQq.exe
  2⤵
  PID:11308
- C:\Windows\System\veRGXnM.exe
  C:\Windows\System\veRGXnM.exe
  2⤵
  PID:11548
- C:\Windows\System\BPRMxbn.exe
  C:\Windows\System\BPRMxbn.exe
  2⤵
  PID:11652
- C:\Windows\System\oRjrelC.exe
  C:\Windows\System\oRjrelC.exe
  2⤵
  PID:11692
- C:\Windows\System\QBVynro.exe
  C:\Windows\System\QBVynro.exe
  2⤵
  PID:11728
- C:\Windows\System\CeMwqvK.exe
  C:\Windows\System\CeMwqvK.exe
  2⤵
  PID:11768
- C:\Windows\System\JCmRFHY.exe
  C:\Windows\System\JCmRFHY.exe
  2⤵
  PID:11844
- C:\Windows\System\mMyxyBN.exe
  C:\Windows\System\mMyxyBN.exe
  2⤵
  PID:11996
- C:\Windows\System\AKZBTTt.exe
  C:\Windows\System\AKZBTTt.exe
  2⤵
  PID:12032
- C:\Windows\System\UzAeIqX.exe
  C:\Windows\System\UzAeIqX.exe
  2⤵
  PID:12092
- C:\Windows\System\tOuJoDR.exe
  C:\Windows\System\tOuJoDR.exe
  2⤵
  PID:9452
- C:\Windows\System\cQfkCJr.exe
  C:\Windows\System\cQfkCJr.exe
  2⤵
  PID:12232
- C:\Windows\System\nYQFUWH.exe
  C:\Windows\System\nYQFUWH.exe
  2⤵
  PID:12828
- C:\Windows\System\VtpDROz.exe
  C:\Windows\System\VtpDROz.exe
  2⤵
  PID:9668
- C:\Windows\System\xAXhlAK.exe
  C:\Windows\System\xAXhlAK.exe
  2⤵
  PID:7408
- C:\Windows\System\tlkFsQE.exe
  C:\Windows\System\tlkFsQE.exe
  2⤵
  PID:2908
- C:\Windows\System\NPhFslo.exe
  C:\Windows\System\NPhFslo.exe
  2⤵
  PID:12928
- C:\Windows\System\ZegLMRr.exe
  C:\Windows\System\ZegLMRr.exe
  2⤵
  PID:9788
- C:\Windows\System\epvVlZr.exe
  C:\Windows\System\epvVlZr.exe
  2⤵
  PID:9856
- C:\Windows\System\klMTVXq.exe
  C:\Windows\System\klMTVXq.exe
  2⤵
  PID:9892
- C:\Windows\System\UETyGrF.exe
  C:\Windows\System\UETyGrF.exe
  2⤵
  PID:9932
- C:\Windows\System\lWiAQPT.exe
  C:\Windows\System\lWiAQPT.exe
  2⤵
  PID:9992
- C:\Windows\System\lmUXQzk.exe
  C:\Windows\System\lmUXQzk.exe
  2⤵
  PID:10028
- C:\Windows\System\DyKTgKf.exe
  C:\Windows\System\DyKTgKf.exe
  2⤵
  PID:10064
- C:\Windows\System\yyoUHoe.exe
  C:\Windows\System\yyoUHoe.exe
  2⤵
  PID:13152
- C:\Windows\System\LXNPRan.exe
  C:\Windows\System\LXNPRan.exe
  2⤵
  PID:13164
- C:\Windows\System\ULiPmmr.exe
  C:\Windows\System\ULiPmmr.exe
  2⤵
  PID:7924
- C:\Windows\System\pTUpWiS.exe
  C:\Windows\System\pTUpWiS.exe
  2⤵
  PID:13180
- C:\Windows\System\vVKrRne.exe
  C:\Windows\System\vVKrRne.exe
  2⤵
  PID:11196
- C:\Windows\System\xpFMSFu.exe
  C:\Windows\System\xpFMSFu.exe
  2⤵
  PID:7116
- C:\Windows\System\NKNWlQH.exe
  C:\Windows\System\NKNWlQH.exe
  2⤵
  PID:8672
- C:\Windows\System\aejvvCw.exe
  C:\Windows\System\aejvvCw.exe
  2⤵
  PID:11416
- C:\Windows\System\sMTCQjY.exe
  C:\Windows\System\sMTCQjY.exe
  2⤵
  PID:7972
- C:\Windows\System\mYbaFwq.exe
  C:\Windows\System\mYbaFwq.exe
  2⤵
  PID:9056
- C:\Windows\System\wNLvofo.exe
  C:\Windows\System\wNLvofo.exe
  2⤵
  PID:4552
- C:\Windows\System\lpmpIok.exe
  C:\Windows\System\lpmpIok.exe
  2⤵
  PID:12300
- C:\Windows\System\DdMugvq.exe
  C:\Windows\System\DdMugvq.exe
  2⤵
  PID:4324
- C:\Windows\System\HbwqSIx.exe
  C:\Windows\System\HbwqSIx.exe
  2⤵
  PID:4844
- C:\Windows\System\UUFnXXk.exe
  C:\Windows\System\UUFnXXk.exe
  2⤵
  PID:2748
- C:\Windows\System\orDjwHu.exe
  C:\Windows\System\orDjwHu.exe
  2⤵
  PID:10640
- C:\Windows\System\kRcBnAY.exe
  C:\Windows\System\kRcBnAY.exe
  2⤵
  PID:10452
- C:\Windows\System\StdtLkT.exe
  C:\Windows\System\StdtLkT.exe
  2⤵
  PID:10988
- C:\Windows\System\MPBeduw.exe
  C:\Windows\System\MPBeduw.exe
  2⤵
  PID:7460
- C:\Windows\System\AOPlINF.exe
  C:\Windows\System\AOPlINF.exe
  2⤵
  PID:10760
- C:\Windows\System\UFHsHbH.exe
  C:\Windows\System\UFHsHbH.exe
  2⤵
  PID:11796
- C:\Windows\System\XPdkvFn.exe
  C:\Windows\System\XPdkvFn.exe
  2⤵
  PID:4032
- C:\Windows\System\PRcFOXO.exe
  C:\Windows\System\PRcFOXO.exe
  2⤵
  PID:7024
- C:\Windows\System\MuygrPT.exe
  C:\Windows\System\MuygrPT.exe
  2⤵
  PID:4528
- C:\Windows\System\abIVOYA.exe
  C:\Windows\System\abIVOYA.exe
  2⤵
  PID:10996
- C:\Windows\System\zbAotKM.exe
  C:\Windows\System\zbAotKM.exe
  2⤵
  PID:4860
- C:\Windows\System\fuhMSnk.exe
  C:\Windows\System\fuhMSnk.exe
  2⤵
  PID:5332
- C:\Windows\System\PncEwYo.exe
  C:\Windows\System\PncEwYo.exe
  2⤵
  PID:13404
- C:\Windows\System\WhaOshM.exe
  C:\Windows\System\WhaOshM.exe
  2⤵
  PID:13460
- C:\Windows\System\dpavUkG.exe
  C:\Windows\System\dpavUkG.exe
  2⤵
  PID:13476
- C:\Windows\System\iDdfwDQ.exe
  C:\Windows\System\iDdfwDQ.exe
  2⤵
  PID:13504
- C:\Windows\System\aGXgCuH.exe
  C:\Windows\System\aGXgCuH.exe
  2⤵
  PID:13524
- C:\Windows\System\HhJsbRs.exe
  C:\Windows\System\HhJsbRs.exe
  2⤵
  PID:13560
- C:\Windows\System\jOroVER.exe
  C:\Windows\System\jOroVER.exe
  2⤵
  PID:13644
- C:\Windows\System\PWlukGB.exe
  C:\Windows\System\PWlukGB.exe
  2⤵
  PID:13660
- C:\Windows\System\ZTnEXgR.exe
  C:\Windows\System\ZTnEXgR.exe
  2⤵
  PID:13680
- C:\Windows\System\zYetWmO.exe
  C:\Windows\System\zYetWmO.exe
  2⤵
  PID:13744
- C:\Windows\System\edtCkjo.exe
  C:\Windows\System\edtCkjo.exe
  2⤵
  PID:14032
- C:\Windows\System\xUKXQnS.exe
  C:\Windows\System\xUKXQnS.exe
  2⤵
  PID:14084
- C:\Windows\System\OOxNWUs.exe
  C:\Windows\System\OOxNWUs.exe
  2⤵
  PID:14100
- C:\Windows\System\itFUVRZ.exe
  C:\Windows\System\itFUVRZ.exe
  2⤵
  PID:14156
- C:\Windows\System\BoAMOPR.exe
  C:\Windows\System\BoAMOPR.exe
  2⤵
  PID:12072
- C:\Windows\System\kRyhuLQ.exe
  C:\Windows\System\kRyhuLQ.exe
  2⤵
  PID:1876
- C:\Windows\System\AVnPGDO.exe
  C:\Windows\System\AVnPGDO.exe
  2⤵
  PID:5448
- C:\Windows\System\yKXXFdv.exe
  C:\Windows\System\yKXXFdv.exe
  2⤵
  PID:11880
- C:\Windows\System\OadjyRs.exe
  C:\Windows\System\OadjyRs.exe
  2⤵
  PID:1488
- C:\Windows\System\xauTXXJ.exe
  C:\Windows\System\xauTXXJ.exe
  2⤵
  PID:8576
- C:\Windows\System\KDhrIIl.exe
  C:\Windows\System\KDhrIIl.exe
  2⤵
  PID:9972
- C:\Windows\System\YpkoeIA.exe
  C:\Windows\System\YpkoeIA.exe
  2⤵
  PID:8460
- C:\Windows\System\kUyjkCf.exe
  C:\Windows\System\kUyjkCf.exe
  2⤵
  PID:7936
- C:\Windows\System\JlRkIgJ.exe
  C:\Windows\System\JlRkIgJ.exe
  2⤵
  PID:4424
- C:\Windows\System\LYoCiSe.exe
  C:\Windows\System\LYoCiSe.exe
  2⤵
  PID:2984
- C:\Windows\System\KlbuEuS.exe
  C:\Windows\System\KlbuEuS.exe
  2⤵
  PID:7692
- C:\Windows\System\EvGKjkH.exe
  C:\Windows\System\EvGKjkH.exe
  2⤵
  PID:13380
- C:\Windows\System\eraJbWn.exe
  C:\Windows\System\eraJbWn.exe
  2⤵
  PID:13384
- C:\Windows\System\GPqlkST.exe
  C:\Windows\System\GPqlkST.exe
  2⤵
  PID:13752
- C:\Windows\System\CoRDmxF.exe
  C:\Windows\System\CoRDmxF.exe
  2⤵
  PID:13768
- C:\Windows\System\jzvoNDo.exe
  C:\Windows\System\jzvoNDo.exe
  2⤵
  PID:13444
- C:\Windows\System\dPqkYIx.exe
  C:\Windows\System\dPqkYIx.exe
  2⤵
  PID:13672
- C:\Windows\System\VxietHP.exe
  C:\Windows\System\VxietHP.exe
  2⤵
  PID:13696
- C:\Windows\System\OKbaumq.exe
  C:\Windows\System\OKbaumq.exe
  2⤵
  PID:13904
- C:\Windows\System\DdjnydB.exe
  C:\Windows\System\DdjnydB.exe
  2⤵
  PID:3968
- C:\Windows\System\kZKTHUf.exe
  C:\Windows\System\kZKTHUf.exe
  2⤵
  PID:14328
- C:\Windows\System\DNwKwcr.exe
  C:\Windows\System\DNwKwcr.exe
  2⤵
  PID:3404
- C:\Windows\System\JQdxJZk.exe
  C:\Windows\System\JQdxJZk.exe
  2⤵
  PID:14292
- C:\Windows\System\jCtlVUN.exe
  C:\Windows\System\jCtlVUN.exe
  2⤵
  PID:14312
- C:\Windows\System\HsVjbGv.exe
  C:\Windows\System\HsVjbGv.exe
  2⤵
  PID:516
- C:\Windows\System\vRBbTlx.exe
  C:\Windows\System\vRBbTlx.exe
  2⤵
  PID:9296
- C:\Windows\System\lolOPOL.exe
  C:\Windows\System\lolOPOL.exe
  2⤵
  PID:3688
- C:\Windows\System\uWbEkgX.exe
  C:\Windows\System\uWbEkgX.exe
  2⤵
  PID:4408
- C:\Windows\System\fzavTMQ.exe
  C:\Windows\System\fzavTMQ.exe
  2⤵
  PID:4480
- C:\Windows\System\jtUzWDt.exe
  C:\Windows\System\jtUzWDt.exe
  2⤵
  PID:8328
- C:\Windows\System\maBMBzo.exe
  C:\Windows\System\maBMBzo.exe
  2⤵
  PID:13316
- C:\Windows\System\SyRhOUr.exe
  C:\Windows\System\SyRhOUr.exe
  2⤵
  PID:7260
- C:\Windows\System\DZAHswc.exe
  C:\Windows\System\DZAHswc.exe
  2⤵
  PID:9172
- C:\Windows\System\DgxcvwC.exe
  C:\Windows\System\DgxcvwC.exe
  2⤵
  PID:1840
- C:\Windows\System\olLwwDG.exe
  C:\Windows\System\olLwwDG.exe
  2⤵
  PID:11340
- C:\Windows\System\dJQVnOW.exe
  C:\Windows\System\dJQVnOW.exe
  2⤵
  PID:8068
- C:\Windows\System\eSxVUTg.exe
  C:\Windows\System\eSxVUTg.exe
  2⤵
  PID:12332
- C:\Windows\System\AQcElXp.exe
  C:\Windows\System\AQcElXp.exe
  2⤵
  PID:4204
- C:\Windows\System\cYXpBsa.exe
  C:\Windows\System\cYXpBsa.exe
  2⤵
  PID:644
- C:\Windows\System\BzkpmmH.exe
  C:\Windows\System\BzkpmmH.exe
  2⤵
  PID:6540
- C:\Windows\System\oGOoLMi.exe
  C:\Windows\System\oGOoLMi.exe
  2⤵
  PID:8912
- C:\Windows\System\iibXUKT.exe
  C:\Windows\System\iibXUKT.exe
  2⤵
  PID:13328
- C:\Windows\System\vVrnKIH.exe
  C:\Windows\System\vVrnKIH.exe
  2⤵
  PID:13732
- C:\Windows\System\SOFQVvx.exe
  C:\Windows\System\SOFQVvx.exe
  2⤵
  PID:13472
- C:\Windows\System\oCleFmC.exe
  C:\Windows\System\oCleFmC.exe
  2⤵
  PID:13628
- C:\Windows\System\ekmCNuY.exe
  C:\Windows\System\ekmCNuY.exe
  2⤵
  PID:7880
- C:\Windows\System\xULFVRh.exe
  C:\Windows\System\xULFVRh.exe
  2⤵
  PID:13960
- C:\Windows\System\FwLRyIt.exe
  C:\Windows\System\FwLRyIt.exe
  2⤵
  PID:13936
- C:\Windows\System\YHQYGQN.exe
  C:\Windows\System\YHQYGQN.exe
  2⤵
  PID:13992
- C:\Windows\System\RKwdbYT.exe
  C:\Windows\System\RKwdbYT.exe
  2⤵
  PID:14056
- C:\Windows\System\CxYJoNH.exe
  C:\Windows\System\CxYJoNH.exe
  2⤵
  PID:13244
- C:\Windows\System\wlWPeRR.exe
  C:\Windows\System\wlWPeRR.exe
  2⤵
  PID:3632
- C:\Windows\System\JjyVdDy.exe
  C:\Windows\System\JjyVdDy.exe
  2⤵
  PID:3520
- C:\Windows\System\IgYQDOm.exe
  C:\Windows\System\IgYQDOm.exe
  2⤵
  PID:4556
- C:\Windows\System\rQUiMHz.exe
  C:\Windows\System\rQUiMHz.exe
  2⤵
  PID:4464
- C:\Windows\System\CwbYFlu.exe
  C:\Windows\System\CwbYFlu.exe
  2⤵
  PID:14196
- C:\Windows\System\QsTbuPF.exe
  C:\Windows\System\QsTbuPF.exe
  2⤵
  PID:14236
- C:\Windows\System\SvihEJP.exe
  C:\Windows\System\SvihEJP.exe
  2⤵
  PID:2184
- C:\Windows\System\AudltFK.exe
  C:\Windows\System\AudltFK.exe
  2⤵
  PID:1484
- C:\Windows\System\fsMVAVb.exe
  C:\Windows\System\fsMVAVb.exe
  2⤵
  PID:9684
- C:\Windows\System\HzuZdBV.exe
  C:\Windows\System\HzuZdBV.exe
  2⤵
  PID:3984
- C:\Windows\System\DpFHFJr.exe
  C:\Windows\System\DpFHFJr.exe
  2⤵
  PID:9212
- C:\Windows\System\QQmSxTN.exe
  C:\Windows\System\QQmSxTN.exe
  2⤵
  PID:4952
- C:\Windows\System\AXAfgtM.exe
  C:\Windows\System\AXAfgtM.exe
  2⤵
  PID:13436
- C:\Windows\System\XiQgElN.exe
  C:\Windows\System\XiQgElN.exe
  2⤵
  PID:13864
- C:\Windows\System\PsDmyyS.exe
  C:\Windows\System\PsDmyyS.exe
  2⤵
  PID:7888
- C:\Windows\System\fIzdEFw.exe
  C:\Windows\System\fIzdEFw.exe
  2⤵
  PID:7844
- C:\Windows\System\owKxGjf.exe
  C:\Windows\System\owKxGjf.exe
  2⤵
  PID:4508
- C:\Windows\System\rTsTzmy.exe
  C:\Windows\System\rTsTzmy.exe
  2⤵
  PID:224
- C:\Windows\System\ctfezMI.exe
  C:\Windows\System\ctfezMI.exe
  2⤵
  PID:14276
- C:\Windows\System\gcPjgQr.exe
  C:\Windows\System\gcPjgQr.exe
  2⤵
  PID:376
- C:\Windows\System\LGTjrNS.exe
  C:\Windows\System\LGTjrNS.exe
  2⤵
  PID:4608
- C:\Windows\System\dgHDBZB.exe
  C:\Windows\System\dgHDBZB.exe
  2⤵
  PID:8596
- C:\Windows\System\eABJfSn.exe
  C:\Windows\System\eABJfSn.exe
  2⤵
  PID:1056
- C:\Windows\System\TYYRbku.exe
  C:\Windows\System\TYYRbku.exe
  2⤵
  PID:12724
- C:\Windows\System\jKOClYN.exe
  C:\Windows\System\jKOClYN.exe
  2⤵
  PID:13900
- C:\Windows\System\tGEZXaL.exe
  C:\Windows\System\tGEZXaL.exe
  2⤵
  PID:8888
- C:\Windows\System\LYNrTLU.exe
  C:\Windows\System\LYNrTLU.exe
  2⤵
  PID:11432
- C:\Windows\System\IYIoECK.exe
  C:\Windows\System\IYIoECK.exe
  2⤵
  PID:9912
- C:\Windows\System\sozqpZL.exe
  C:\Windows\System\sozqpZL.exe
  2⤵
  PID:5004
- C:\Windows\System\JbYbnYj.exe
  C:\Windows\System\JbYbnYj.exe
  2⤵
  PID:10468
- C:\Windows\System\JmLJWdR.exe
  C:\Windows\System\JmLJWdR.exe
  2⤵
  PID:9908
- C:\Windows\System\iadTGKF.exe
  C:\Windows\System\iadTGKF.exe
  2⤵
  PID:5232
- C:\Windows\System\QWLvrqi.exe
  C:\Windows\System\QWLvrqi.exe
  2⤵
  PID:13488
- C:\Windows\System\IGhjJps.exe
  C:\Windows\System\IGhjJps.exe
  2⤵
  PID:13320
- C:\Windows\System\kNawFuS.exe
  C:\Windows\System\kNawFuS.exe
  2⤵
  PID:9828
- C:\Windows\System\WepBYUW.exe
  C:\Windows\System\WepBYUW.exe
  2⤵
  PID:1188
- C:\Windows\System\BEKuKkw.exe
  C:\Windows\System\BEKuKkw.exe
  2⤵
  PID:10080
- C:\Windows\System\rBWvava.exe
  C:\Windows\System\rBWvava.exe
  2⤵
  PID:4196
- C:\Windows\System\dIPDwFx.exe
  C:\Windows\System\dIPDwFx.exe
  2⤵
  PID:14268
- C:\Windows\System\qFODKNf.exe
  C:\Windows\System\qFODKNf.exe
  2⤵
  PID:7892
- C:\Windows\System\WygJOpv.exe
  C:\Windows\System\WygJOpv.exe
  2⤵
  PID:3736
- C:\Windows\System\ljWmXDN.exe
  C:\Windows\System\ljWmXDN.exe
  2⤵
  PID:3292
- C:\Windows\System\fMnrHLe.exe
  C:\Windows\System\fMnrHLe.exe
  2⤵
  PID:13604
- C:\Windows\System\XQcRzvH.exe
  C:\Windows\System\XQcRzvH.exe
  2⤵
  PID:13456
- C:\Windows\System\NOmixxr.exe
  C:\Windows\System\NOmixxr.exe
  2⤵
  PID:13632
- C:\Windows\System\CqbAQTS.exe
  C:\Windows\System\CqbAQTS.exe
  2⤵
  PID:13912
- C:\Windows\System\ZnEUwQA.exe
  C:\Windows\System\ZnEUwQA.exe
  2⤵
  PID:1100
- C:\Windows\System\PTHZHgk.exe
  C:\Windows\System\PTHZHgk.exe
  2⤵
  PID:14012
- C:\Windows\System\ECRYUAc.exe
  C:\Windows\System\ECRYUAc.exe
  2⤵
  PID:14172
- C:\Windows\System\FhYXnPp.exe
  C:\Windows\System\FhYXnPp.exe
  2⤵
  PID:13372
- C:\Windows\System\fLMANtk.exe
  C:\Windows\System\fLMANtk.exe
  2⤵
  PID:13592
- C:\Windows\System\RuNCAIL.exe
  C:\Windows\System\RuNCAIL.exe
  2⤵
  PID:752
- C:\Windows\System\ozXsYyZ.exe
  C:\Windows\System\ozXsYyZ.exe
  2⤵
  PID:2304
- C:\Windows\System\kCjZykN.exe
  C:\Windows\System\kCjZykN.exe
  2⤵
  PID:4904
- C:\Windows\System\ebnynMj.exe
  C:\Windows\System\ebnynMj.exe
  2⤵
  PID:14052
- C:\Windows\System\CDQbXGp.exe
  C:\Windows\System\CDQbXGp.exe
  2⤵
  PID:13520
- C:\Windows\System\wWIKTnG.exe
  C:\Windows\System\wWIKTnG.exe
  2⤵
  PID:4816
- C:\Windows\System\ZAbhuUi.exe
  C:\Windows\System\ZAbhuUi.exe
  2⤵
  PID:14272
- C:\Windows\System\RTXaScI.exe
  C:\Windows\System\RTXaScI.exe
  2⤵
  PID:1128
- C:\Windows\System\FwNqaCc.exe
  C:\Windows\System\FwNqaCc.exe
  2⤵
  PID:1420
- C:\Windows\System\jZnCPsP.exe
  C:\Windows\System\jZnCPsP.exe
  2⤵
  PID:2464
- C:\Windows\System\jgfdYfr.exe
  C:\Windows\System\jgfdYfr.exe
  2⤵
  PID:4488
- C:\Windows\System\ZcyOiFY.exe
  C:\Windows\System\ZcyOiFY.exe
  2⤵
  PID:10504
- C:\Windows\System\jpznLVi.exe
  C:\Windows\System\jpznLVi.exe
  2⤵
  PID:4736
- C:\Windows\System\smTwMEr.exe
  C:\Windows\System\smTwMEr.exe
  2⤵
  PID:1716
- C:\Windows\System\ozWPqmJ.exe
  C:\Windows\System\ozWPqmJ.exe
  2⤵
  PID:1184
- C:\Windows\System\vjElLHO.exe
  C:\Windows\System\vjElLHO.exe
  2⤵
  PID:10052
- C:\Windows\System\lQiIydG.exe
  C:\Windows\System\lQiIydG.exe
  2⤵
  PID:3128
- C:\Windows\System\PpnBzME.exe
  C:\Windows\System\PpnBzME.exe
  2⤵
  PID:3200
- C:\Windows\System\VMwKirZ.exe
  C:\Windows\System\VMwKirZ.exe
  2⤵
  PID:2584
- C:\Windows\System\PdLmWvc.exe
  C:\Windows\System\PdLmWvc.exe
  2⤵
  PID:3892
- C:\Windows\System\hTBQrrO.exe
  C:\Windows\System\hTBQrrO.exe
  2⤵
  PID:6048
- C:\Windows\System\cdsXcyv.exe
  C:\Windows\System\cdsXcyv.exe
  2⤵
  PID:4972
- C:\Windows\System\yqHhzmx.exe
  C:\Windows\System\yqHhzmx.exe
  2⤵
  PID:4540
- C:\Windows\System\UQKKfjN.exe
  C:\Windows\System\UQKKfjN.exe
  2⤵
  PID:2144
- C:\Windows\System\RiIImZI.exe
  C:\Windows\System\RiIImZI.exe
  2⤵
  PID:13836
- C:\Windows\System\ytiyUHD.exe
  C:\Windows\System\ytiyUHD.exe
  2⤵
  PID:13856
- C:\Windows\System\AFncwYm.exe
  C:\Windows\System\AFncwYm.exe
  2⤵
  PID:4284
- C:\Windows\System\hstjAVh.exe
  C:\Windows\System\hstjAVh.exe
  2⤵
  PID:1980
- C:\Windows\System\fxMyVsF.exe
  C:\Windows\System\fxMyVsF.exe
  2⤵
  PID:4012
- C:\Windows\System\mgWxvpv.exe
  C:\Windows\System\mgWxvpv.exe
  2⤵
  PID:6696
- C:\Windows\System\IcCepqp.exe
  C:\Windows\System\IcCepqp.exe
  2⤵
  PID:14168
- C:\Windows\System\lrflNtf.exe
  C:\Windows\System\lrflNtf.exe
  2⤵
  PID:3928
- C:\Windows\System\pvUFYmO.exe
  C:\Windows\System\pvUFYmO.exe
  2⤵
  PID:632
- C:\Windows\System\pkSHsWH.exe
  C:\Windows\System\pkSHsWH.exe
  2⤵
  PID:5396
- C:\Windows\System\ZmtElRI.exe
  C:\Windows\System\ZmtElRI.exe
  2⤵
  PID:9764
- C:\Windows\System\WJpacPA.exe
  C:\Windows\System\WJpacPA.exe
  2⤵
  PID:14304
- C:\Windows\System\SzdQMbz.exe
  C:\Windows\System\SzdQMbz.exe
  2⤵
  PID:12564
- C:\Windows\System\HjNiMYD.exe
  C:\Windows\System\HjNiMYD.exe
  2⤵
  PID:3728
- C:\Windows\System\CxqdzVA.exe
  C:\Windows\System\CxqdzVA.exe
  2⤵
  PID:6788
- C:\Windows\System\sgyeQyO.exe
  C:\Windows\System\sgyeQyO.exe
  2⤵
  PID:7448
- C:\Windows\System\qUjBmum.exe
  C:\Windows\System\qUjBmum.exe
  2⤵
  PID:12936
- C:\Windows\System\ywUqZVg.exe
  C:\Windows\System\ywUqZVg.exe
  2⤵
  PID:5716
- C:\Windows\System\XMVQCpl.exe
  C:\Windows\System\XMVQCpl.exe
  2⤵
  PID:7820
- C:\Windows\System\FuOndQb.exe
  C:\Windows\System\FuOndQb.exe
  2⤵
  PID:4236
- C:\Windows\System\hOfdhXs.exe
  C:\Windows\System\hOfdhXs.exe
  2⤵
  PID:5628
- C:\Windows\System\ubvKuiz.exe
  C:\Windows\System\ubvKuiz.exe
  2⤵
  PID:7848
- C:\Windows\System\MryhfSa.exe
  C:\Windows\System\MryhfSa.exe
  2⤵
  PID:4932
- C:\Windows\System\RHGuePo.exe
  C:\Windows\System\RHGuePo.exe
  2⤵
  PID:11824
- C:\Windows\System\NeCTEMF.exe
  C:\Windows\System\NeCTEMF.exe
  2⤵
  PID:3656
- C:\Windows\System\BFwxQpG.exe
  C:\Windows\System\BFwxQpG.exe
  2⤵
  PID:556
- C:\Windows\System\tIsZSyb.exe
  C:\Windows\System\tIsZSyb.exe
  2⤵
  PID:2028
- C:\Windows\System\nSBsGPj.exe
  C:\Windows\System\nSBsGPj.exe
  2⤵
  PID:13820
- C:\Windows\System\iEkwbEH.exe
  C:\Windows\System\iEkwbEH.exe
  2⤵
  PID:14208
- C:\Windows\System\qtgFuOm.exe
  C:\Windows\System\qtgFuOm.exe
  2⤵
  PID:13588
- C:\Windows\System\FlDuxLJ.exe
  C:\Windows\System\FlDuxLJ.exe
  2⤵
  PID:7752
- C:\Windows\System\FayovqB.exe
  C:\Windows\System\FayovqB.exe
  2⤵
  PID:5516
- C:\Windows\System\LtqcJsW.exe
  C:\Windows\System\LtqcJsW.exe
  2⤵
  PID:5644
- C:\Windows\System\uCCAxAY.exe
  C:\Windows\System\uCCAxAY.exe
  2⤵
  PID:5388
- C:\Windows\System\DGLkExH.exe
  C:\Windows\System\DGLkExH.exe
  2⤵
  PID:13388
- C:\Windows\System\nXfqBtx.exe
  C:\Windows\System\nXfqBtx.exe
  2⤵
  PID:5280
- C:\Windows\System\qRlxAVy.exe
  C:\Windows\System\qRlxAVy.exe
  2⤵
  PID:10408
- C:\Windows\System\tjXzDNd.exe
  C:\Windows\System\tjXzDNd.exe
  2⤵
  PID:9808
- C:\Windows\System\jaDgqWu.exe
  C:\Windows\System\jaDgqWu.exe
  2⤵
  PID:7796
- C:\Windows\System\kZrXJAi.exe
  C:\Windows\System\kZrXJAi.exe
  2⤵
  PID:7228
- C:\Windows\System\DOoxuqy.exe
  C:\Windows\System\DOoxuqy.exe
  2⤵
  PID:6040
- C:\Windows\System\YyCfHpM.exe
  C:\Windows\System\YyCfHpM.exe
  2⤵
  PID:11508
- C:\Windows\System\tvqkXBe.exe
  C:\Windows\System\tvqkXBe.exe
  2⤵
  PID:7556
- C:\Windows\System\QAsDSoh.exe
  C:\Windows\System\QAsDSoh.exe
  2⤵
  PID:6448
- C:\Windows\System\QjTChGK.exe
  C:\Windows\System\QjTChGK.exe
  2⤵
  PID:5556
- C:\Windows\System\FUnzQYc.exe
  C:\Windows\System\FUnzQYc.exe
  2⤵
  PID:5612
- C:\Windows\System\hDyJMus.exe
  C:\Windows\System\hDyJMus.exe
  2⤵
  PID:5592
- C:\Windows\System\LfIuaiS.exe
  C:\Windows\System\LfIuaiS.exe
  2⤵
  PID:3904
- C:\Windows\System\KQmNuXu.exe
  C:\Windows\System\KQmNuXu.exe
  2⤵
  PID:2920
- C:\Windows\System\DTGtrJP.exe
  C:\Windows\System\DTGtrJP.exe
  2⤵
  PID:9132
- C:\Windows\System\CkCqcKS.exe
  C:\Windows\System\CkCqcKS.exe
  2⤵
  PID:11200
- C:\Windows\System\FvHMvMA.exe
  C:\Windows\System\FvHMvMA.exe
  2⤵
  PID:12796
- C:\Windows\System\bfBHbSs.exe
  C:\Windows\System\bfBHbSs.exe
  2⤵
  PID:9240
- C:\Windows\System\fEIKFJH.exe
  C:\Windows\System\fEIKFJH.exe
  2⤵
  PID:9360
- C:\Windows\System\YAxpMjd.exe
  C:\Windows\System\YAxpMjd.exe
  2⤵
  PID:8364
- C:\Windows\System\ASzIwod.exe
  C:\Windows\System\ASzIwod.exe
  2⤵
  PID:14288
- C:\Windows\System\wOnBVJD.exe
  C:\Windows\System\wOnBVJD.exe
  2⤵
  PID:7280
- C:\Windows\System\YhqYGvQ.exe
  C:\Windows\System\YhqYGvQ.exe
  2⤵
  PID:3328
- C:\Windows\System\owmIwdS.exe
  C:\Windows\System\owmIwdS.exe
  2⤵
  PID:9728
- C:\Windows\System\BUytTDh.exe
  C:\Windows\System\BUytTDh.exe
  2⤵
  PID:14220
- C:\Windows\System\rOgTyLM.exe
  C:\Windows\System\rOgTyLM.exe
  2⤵
  PID:9340
- C:\Windows\System\NpVoFwR.exe
  C:\Windows\System\NpVoFwR.exe
  2⤵
  PID:1408
- C:\Windows\System\hRFnRrQ.exe
  C:\Windows\System\hRFnRrQ.exe
  2⤵
  PID:9792
- C:\Windows\System\KvaCRNU.exe
  C:\Windows\System\KvaCRNU.exe
  2⤵
  PID:1352
- C:\Windows\System\IuDFwPP.exe
  C:\Windows\System\IuDFwPP.exe
  2⤵
  PID:7756
- C:\Windows\System\jBFKsPS.exe
  C:\Windows\System\jBFKsPS.exe
  2⤵
  PID:10204
- C:\Windows\System\EIKdtSK.exe
  C:\Windows\System\EIKdtSK.exe
  2⤵
  PID:5772
- C:\Windows\System\bMkysqc.exe
  C:\Windows\System\bMkysqc.exe
  2⤵
  PID:6944
- C:\Windows\System\RYmumjc.exe
  C:\Windows\System\RYmumjc.exe
  2⤵
  PID:6836
- C:\Windows\System\coQKcYh.exe
  C:\Windows\System\coQKcYh.exe
  2⤵
  PID:12468
- C:\Windows\System\QoewgXs.exe
  C:\Windows\System\QoewgXs.exe
  2⤵
  PID:11008
- C:\Windows\System\AZUhQln.exe
  C:\Windows\System\AZUhQln.exe
  2⤵
  PID:13276
- C:\Windows\System\mpiCIUT.exe
  C:\Windows\System\mpiCIUT.exe
  2⤵
  PID:11980
- C:\Windows\System\CHZMkXJ.exe
  C:\Windows\System\CHZMkXJ.exe
  2⤵
  PID:6052
- C:\Windows\System\ZrWYHxd.exe
  C:\Windows\System\ZrWYHxd.exe
  2⤵
  PID:5084
- C:\Windows\System\ejYvfdG.exe
  C:\Windows\System\ejYvfdG.exe
  2⤵
  PID:5372
- C:\Windows\System\TSTQtxU.exe
  C:\Windows\System\TSTQtxU.exe
  2⤵
  PID:11160
- C:\Windows\System\bkLgSIr.exe
  C:\Windows\System\bkLgSIr.exe
  2⤵
  PID:11564
- C:\Windows\System\SuxJlec.exe
  C:\Windows\System\SuxJlec.exe
  2⤵
  PID:7108
- C:\Windows\System\UNbLWam.exe
  C:\Windows\System\UNbLWam.exe
  2⤵
  PID:13212
- C:\Windows\System\LwvypzE.exe
  C:\Windows\System\LwvypzE.exe
  2⤵
  PID:10816
- C:\Windows\System\TryKRZO.exe
  C:\Windows\System\TryKRZO.exe
  2⤵
  PID:12404
- C:\Windows\System\nHUrMjw.exe
  C:\Windows\System\nHUrMjw.exe
  2⤵
  PID:13248
- C:\Windows\System\LLNafqa.exe
  C:\Windows\System\LLNafqa.exe
  2⤵
  PID:11808
- C:\Windows\System\hRnIYop.exe
  C:\Windows\System\hRnIYop.exe
  2⤵
  PID:3704
- C:\Windows\System\jmafqSc.exe
  C:\Windows\System\jmafqSc.exe
  2⤵
  PID:9916
- C:\Windows\System\gGbvcNL.exe
  C:\Windows\System\gGbvcNL.exe
  2⤵
  PID:9824
- C:\Windows\System\XoHrISR.exe
  C:\Windows\System\XoHrISR.exe
  2⤵
  PID:12492
- C:\Windows\System\UMxAtZf.exe
  C:\Windows\System\UMxAtZf.exe
  2⤵
  PID:12476
- C:\Windows\System\SxSODSK.exe
  C:\Windows\System\SxSODSK.exe
  2⤵
  PID:6564
- C:\Windows\System\PKDaFcg.exe
  C:\Windows\System\PKDaFcg.exe
  2⤵
  PID:10228
- C:\Windows\System\EvMpbrM.exe
  C:\Windows\System\EvMpbrM.exe
  2⤵
  PID:14256
- C:\Windows\System\TeYhAQo.exe
  C:\Windows\System\TeYhAQo.exe
  2⤵
  PID:7208
- C:\Windows\System\TYjUFLo.exe
  C:\Windows\System\TYjUFLo.exe
  2⤵
  PID:4312
- C:\Windows\System\XWWSKMx.exe
  C:\Windows\System\XWWSKMx.exe
  2⤵
  PID:6620
- C:\Windows\System\gFbnNcj.exe
  C:\Windows\System\gFbnNcj.exe
  2⤵
  PID:10180
- C:\Windows\System\slBjOrj.exe
  C:\Windows\System\slBjOrj.exe
  2⤵
  PID:12500
- C:\Windows\System\JcMBORj.exe
  C:\Windows\System\JcMBORj.exe
  2⤵
  PID:12516
- C:\Windows\System\ZZMWoCZ.exe
  C:\Windows\System\ZZMWoCZ.exe
  2⤵
  PID:5444
- C:\Windows\System\ARaqdBW.exe
  C:\Windows\System\ARaqdBW.exe
  2⤵
  PID:4344
- C:\Windows\System\wvsUCIG.exe
  C:\Windows\System\wvsUCIG.exe
  2⤵
  PID:5520
- C:\Windows\System\KBaPOrR.exe
  C:\Windows\System\KBaPOrR.exe
  2⤵
  PID:5744
- C:\Windows\System\IDfDtbR.exe
  C:\Windows\System\IDfDtbR.exe
  2⤵
  PID:12108
- C:\Windows\System\BsNJiKB.exe
  C:\Windows\System\BsNJiKB.exe
  2⤵
  PID:9576
- C:\Windows\System\USZLbsU.exe
  C:\Windows\System\USZLbsU.exe
  2⤵
  PID:1396
- C:\Windows\System\qLhFRgm.exe
  C:\Windows\System\qLhFRgm.exe
  2⤵
  PID:3776
- C:\Windows\System\iEksJEY.exe
  C:\Windows\System\iEksJEY.exe
  2⤵
  PID:12660
- C:\Windows\System\ClHqykI.exe
  C:\Windows\System\ClHqykI.exe
  2⤵
  PID:12532
- C:\Windows\System\VxqkoRG.exe
  C:\Windows\System\VxqkoRG.exe
  2⤵
  PID:12716
- C:\Windows\System\rPFDYXH.exe
  C:\Windows\System\rPFDYXH.exe
  2⤵
  PID:13352
- C:\Windows\System\PunwcOK.exe
  C:\Windows\System\PunwcOK.exe
  2⤵
  PID:7956
- C:\Windows\System\aZSFLYi.exe
  C:\Windows\System\aZSFLYi.exe
  2⤵
  PID:12656
- C:\Windows\System\llLromj.exe
  C:\Windows\System\llLromj.exe
  2⤵
  PID:8200
- C:\Windows\System\dlbTlGi.exe
  C:\Windows\System\dlbTlGi.exe
  2⤵
  PID:10752
- C:\Windows\System\thunbEm.exe
  C:\Windows\System\thunbEm.exe
  2⤵
  PID:7092
- C:\Windows\System\IDGTAab.exe
  C:\Windows\System\IDGTAab.exe
  2⤵
  PID:720
- C:\Windows\System\nrPoqtP.exe
  C:\Windows\System\nrPoqtP.exe
  2⤵
  PID:3864
- C:\Windows\System\WZeSBGQ.exe
  C:\Windows\System\WZeSBGQ.exe
  2⤵
  PID:13104
- C:\Windows\System\PGfvqfT.exe
  C:\Windows\System\PGfvqfT.exe
  2⤵
  PID:10104
- C:\Windows\System\LovKLHE.exe
  C:\Windows\System\LovKLHE.exe
  2⤵
  PID:12740
- C:\Windows\System\oePVxgE.exe
  C:\Windows\System\oePVxgE.exe
  2⤵
  PID:6484
- C:\Windows\System\NVYQJmJ.exe
  C:\Windows\System\NVYQJmJ.exe
  2⤵
  PID:13004
- C:\Windows\System\ivXmboG.exe
  C:\Windows\System\ivXmboG.exe
  2⤵
  PID:8220
- C:\Windows\System\cTOzFHp.exe
  C:\Windows\System\cTOzFHp.exe
  2⤵
  PID:13032
- C:\Windows\System\crjUOBb.exe
  C:\Windows\System\crjUOBb.exe
  2⤵
  PID:4416
- C:\Windows\System\GWKmvCa.exe
  C:\Windows\System\GWKmvCa.exe
  2⤵
  PID:5588
- C:\Windows\System\dUFScHG.exe
  C:\Windows\System\dUFScHG.exe
  2⤵
  PID:12832
- C:\Windows\System\VLnqVdv.exe
  C:\Windows\System\VLnqVdv.exe
  2⤵
  PID:13100
- C:\Windows\System\WBSKism.exe
  C:\Windows\System\WBSKism.exe
  2⤵
  PID:8400
- C:\Windows\System\mkKJzVA.exe
  C:\Windows\System\mkKJzVA.exe
  2⤵
  PID:5532
- C:\Windows\System\lsleKoA.exe
  C:\Windows\System\lsleKoA.exe
  2⤵
  PID:13020
- C:\Windows\System\HPuVqAR.exe
  C:\Windows\System\HPuVqAR.exe
  2⤵
  PID:10124
- C:\Windows\System\WDDXXNY.exe
  C:\Windows\System\WDDXXNY.exe
  2⤵
  PID:13192
- C:\Windows\System\gSmFOxb.exe
  C:\Windows\System\gSmFOxb.exe
  2⤵
  PID:9484
- C:\Windows\System\OZojszo.exe
  C:\Windows\System\OZojszo.exe
  2⤵
  PID:1120
- C:\Windows\System\agIRGES.exe
  C:\Windows\System\agIRGES.exe
  2⤵
  PID:13220
- C:\Windows\System\qwEiyAk.exe
  C:\Windows\System\qwEiyAk.exe
  2⤵
  PID:15332
- C:\Windows\System\XuBZJFR.exe
  C:\Windows\System\XuBZJFR.exe
  2⤵
  PID:9868
- C:\Windows\System\BumUgDw.exe
  C:\Windows\System\BumUgDw.exe
  2⤵
  PID:8404
- C:\Windows\System\jssfKVu.exe
  C:\Windows\System\jssfKVu.exe
  2⤵
  PID:12208
- C:\Windows\System\QCfhotp.exe
  C:\Windows\System\QCfhotp.exe
  2⤵
  PID:10832
- C:\Windows\System\TuiHuHW.exe
  C:\Windows\System\TuiHuHW.exe
  2⤵
  PID:13160
- C:\Windows\System\dLlPTkj.exe
  C:\Windows\System\dLlPTkj.exe
  2⤵
  PID:10220
- C:\Windows\System\VYxbPtT.exe
  C:\Windows\System\VYxbPtT.exe
  2⤵
  PID:1972
- C:\Windows\System\jAxvZOo.exe
  C:\Windows\System\jAxvZOo.exe
  2⤵
  PID:12748
- C:\Windows\System\gkqufwF.exe
  C:\Windows\System\gkqufwF.exe
  2⤵
  PID:2860
- C:\Windows\System\uziwxlZ.exe
  C:\Windows\System\uziwxlZ.exe
  2⤵
  PID:8216
- C:\Windows\System\ELuvFxN.exe
  C:\Windows\System\ELuvFxN.exe
  2⤵
  PID:8960
- C:\Windows\System\nZjBdUk.exe
  C:\Windows\System\nZjBdUk.exe
  2⤵
  PID:4404
- C:\Windows\System\ElbTykh.exe
  C:\Windows\System\ElbTykh.exe
  2⤵
  PID:13108
- C:\Windows\System\KkOyKxC.exe
  C:\Windows\System\KkOyKxC.exe
  2⤵
  PID:8352
- C:\Windows\System\vHseCAm.exe
  C:\Windows\System\vHseCAm.exe
  2⤵
  PID:13092
- C:\Windows\System\yyqKEpa.exe
  C:\Windows\System\yyqKEpa.exe
  2⤵
  PID:13844
- C:\Windows\System\ljhiMiy.exe
  C:\Windows\System\ljhiMiy.exe
  2⤵
  PID:432
- C:\Windows\System\fIysTnA.exe
  C:\Windows\System\fIysTnA.exe
  2⤵
  PID:14136
- C:\Windows\System\ebokvPa.exe
  C:\Windows\System\ebokvPa.exe
  2⤵
  PID:3396
- C:\Windows\System\FMSXyXp.exe
  C:\Windows\System\FMSXyXp.exe
  2⤵
  PID:760
- C:\Windows\System\hhHHcxO.exe
  C:\Windows\System\hhHHcxO.exe
  2⤵
  PID:4948
- C:\Windows\System\OohMZpO.exe
  C:\Windows\System\OohMZpO.exe
  2⤵
  PID:460
- C:\Windows\System\ROGacBe.exe
  C:\Windows\System\ROGacBe.exe
  2⤵
  PID:7364
- C:\Windows\System\iACTBng.exe
  C:\Windows\System\iACTBng.exe
  2⤵
  PID:13812
- C:\Windows\System\PfpdsTY.exe
  C:\Windows\System\PfpdsTY.exe
  2⤵
  PID:2800
- C:\Windows\System\bzpkaCr.exe
  C:\Windows\System\bzpkaCr.exe
  2⤵
  PID:208
- C:\Windows\System\lYZPZBm.exe
  C:\Windows\System\lYZPZBm.exe
  2⤵
  PID:3288
- C:\Windows\System\WKmIHHn.exe
  C:\Windows\System\WKmIHHn.exe
  2⤵
  PID:8312
- C:\Windows\System\SucYmkk.exe
  C:\Windows\System\SucYmkk.exe
  2⤵
  PID:12744
- C:\Windows\System\QXQzEvE.exe
  C:\Windows\System\QXQzEvE.exe
  2⤵
  PID:13620
- C:\Windows\System\DzTHbCX.exe
  C:\Windows\System\DzTHbCX.exe
  2⤵
  PID:13232
- C:\Windows\System\EMFQaEB.exe
  C:\Windows\System\EMFQaEB.exe
  2⤵
  PID:13308
- C:\Windows\System\BEKEVRS.exe
  C:\Windows\System\BEKEVRS.exe
  2⤵
  PID:10208
- C:\Windows\System\sFBaZQi.exe
  C:\Windows\System\sFBaZQi.exe
  2⤵
  PID:10848
- C:\Windows\System\lTeNBuS.exe
  C:\Windows\System\lTeNBuS.exe
  2⤵
  PID:6520
- C:\Windows\System\DzQNLhA.exe
  C:\Windows\System\DzQNLhA.exe
  2⤵
  PID:14360
- C:\Windows\System\Jkbsenr.exe
  C:\Windows\System\Jkbsenr.exe
  2⤵
  PID:10724
- C:\Windows\System\YEPStpA.exe
  C:\Windows\System\YEPStpA.exe
  2⤵
  PID:12736
- C:\Windows\System\MILjjuh.exe
  C:\Windows\System\MILjjuh.exe
  2⤵
  PID:7824
- C:\Windows\System\ZSKUunX.exe
  C:\Windows\System\ZSKUunX.exe
  2⤵
  PID:7588
- C:\Windows\System\YAFzvWA.exe
  C:\Windows\System\YAFzvWA.exe
  2⤵
  PID:7596
- C:\Windows\System\ZloTvMP.exe
  C:\Windows\System\ZloTvMP.exe
  2⤵
  PID:6748
- C:\Windows\System\DxQUGuc.exe
  C:\Windows\System\DxQUGuc.exe
  2⤵
  PID:8884
- C:\Windows\System\vDcMbFh.exe
  C:\Windows\System\vDcMbFh.exe
  2⤵
  PID:10596
- C:\Windows\System\TbFDXYK.exe
  C:\Windows\System\TbFDXYK.exe
  2⤵
  PID:9680
- C:\Windows\System\IFZzBfs.exe
  C:\Windows\System\IFZzBfs.exe
  2⤵
  PID:7196
- C:\Windows\System\zTeunZb.exe
  C:\Windows\System\zTeunZb.exe
  2⤵
  PID:7856
- C:\Windows\System\VDICCeT.exe
  C:\Windows\System\VDICCeT.exe
  2⤵
  PID:8224
- C:\Windows\System\WKudPhK.exe
  C:\Windows\System\WKudPhK.exe
  2⤵
  PID:11612
- C:\Windows\System\lVOJexq.exe
  C:\Windows\System\lVOJexq.exe
  2⤵
  PID:8056
- C:\Windows\System\PYFPxlE.exe
  C:\Windows\System\PYFPxlE.exe
  2⤵
  PID:4496
- C:\Windows\System\NWWHFOd.exe
  C:\Windows\System\NWWHFOd.exe
  2⤵
  PID:12556
- C:\Windows\System\sUHWNld.exe
  C:\Windows\System\sUHWNld.exe
  2⤵
  PID:7736
- C:\Windows\System\JChHGqj.exe
  C:\Windows\System\JChHGqj.exe
  2⤵
  PID:12684
- C:\Windows\System\CkKivPP.exe
  C:\Windows\System\CkKivPP.exe
  2⤵
  PID:13000
- C:\Windows\System\KSFFsEz.exe
  C:\Windows\System\KSFFsEz.exe
  2⤵
  PID:8828
- C:\Windows\System\DyiMZjO.exe
  C:\Windows\System\DyiMZjO.exe
  2⤵
  PID:8144
- C:\Windows\System\slZOuda.exe
  C:\Windows\System\slZOuda.exe
  2⤵
  PID:8372
- C:\Windows\System\byznaKg.exe
  C:\Windows\System\byznaKg.exe
  2⤵
  PID:7952
- C:\Windows\System\jSVQuCQ.exe
  C:\Windows\System\jSVQuCQ.exe
  2⤵
  PID:12184
- C:\Windows\System\NqibUaD.exe
  C:\Windows\System\NqibUaD.exe
  2⤵
  PID:8316
- C:\Windows\System\MijMdNv.exe
  C:\Windows\System\MijMdNv.exe
  2⤵
  PID:3668
- C:\Windows\System\jOcPNkH.exe
  C:\Windows\System\jOcPNkH.exe
  2⤵
  PID:12948
- C:\Windows\System\HiyaBMj.exe
  C:\Windows\System\HiyaBMj.exe
  2⤵
  PID:9300
- C:\Windows\System\viDFuCU.exe
  C:\Windows\System\viDFuCU.exe
  2⤵
  PID:9628
- C:\Windows\System\kNUjssx.exe
  C:\Windows\System\kNUjssx.exe
  2⤵
  PID:12964
- C:\Windows\System\ZmJFKxb.exe
  C:\Windows\System\ZmJFKxb.exe
  2⤵
  PID:12420
- C:\Windows\System\vYmEDSR.exe
  C:\Windows\System\vYmEDSR.exe
  2⤵
  PID:12872
- C:\Windows\System\UeflDjB.exe
  C:\Windows\System\UeflDjB.exe
  2⤵
  PID:14332
- C:\Windows\System\AJdljTv.exe
  C:\Windows\System\AJdljTv.exe
  2⤵
  PID:9188
- C:\Windows\System\kVSfhST.exe
  C:\Windows\System\kVSfhST.exe
  2⤵
  PID:13236
- C:\Windows\System\qDnkbCp.exe
  C:\Windows\System\qDnkbCp.exe
  2⤵
  PID:4568
- C:\Windows\System\QFTQMsm.exe
  C:\Windows\System\QFTQMsm.exe
  2⤵
  PID:6808
- C:\Windows\System\vNoMLnj.exe
  C:\Windows\System\vNoMLnj.exe
  2⤵
  PID:12768
- C:\Windows\System\AzkIPWi.exe
  C:\Windows\System\AzkIPWi.exe
  2⤵
  PID:3884
- C:\Windows\System\EzAgFcm.exe
  C:\Windows\System\EzAgFcm.exe
  2⤵
  PID:14864
- C:\Windows\System\yyaMFzh.exe
  C:\Windows\System\yyaMFzh.exe
  2⤵
  PID:6760
- C:\Windows\System\sHwqBjb.exe
  C:\Windows\System\sHwqBjb.exe
  2⤵
  PID:12952
- C:\Windows\System\UCMOGWL.exe
  C:\Windows\System\UCMOGWL.exe
  2⤵
  PID:12900
- C:\Windows\System\ncPgrYp.exe
  C:\Windows\System\ncPgrYp.exe
  2⤵
  PID:12088
- C:\Windows\System\wNACNLs.exe
  C:\Windows\System\wNACNLs.exe
  2⤵
  PID:7192
- C:\Windows\System\NJRfFkz.exe
  C:\Windows\System\NJRfFkz.exe
  2⤵
  PID:11628
- C:\Windows\System\ziWdyKq.exe
  C:\Windows\System\ziWdyKq.exe
  2⤵
  PID:14928
- C:\Windows\System\ZGRHBNY.exe
  C:\Windows\System\ZGRHBNY.exe
  2⤵
  PID:11300
- C:\Windows\System\GiKXeHM.exe
  C:\Windows\System\GiKXeHM.exe
  2⤵
  PID:10288
- C:\Windows\System\neGIiuX.exe
  C:\Windows\System\neGIiuX.exe
  2⤵
  PID:14364
- C:\Windows\System\PZUOtic.exe
  C:\Windows\System\PZUOtic.exe
  2⤵
  PID:14404
- C:\Windows\System\IeaVFBU.exe
  C:\Windows\System\IeaVFBU.exe
  2⤵
  PID:14520
- C:\Windows\System\BsAtICy.exe
  C:\Windows\System\BsAtICy.exe
  2⤵
  PID:10912
- C:\Windows\System\iAoqjjp.exe
  C:\Windows\System\iAoqjjp.exe
  2⤵
  PID:14552
- C:\Windows\System\AeZInLu.exe
  C:\Windows\System\AeZInLu.exe
  2⤵
  PID:9176
- C:\Windows\System\qyREnwE.exe
  C:\Windows\System\qyREnwE.exe
  2⤵
  PID:14576
- C:\Windows\System\LiieAFX.exe
  C:\Windows\System\LiieAFX.exe
  2⤵
  PID:10672
- C:\Windows\System\YeBqJoW.exe
  C:\Windows\System\YeBqJoW.exe
  2⤵
  PID:6216
- C:\Windows\System\ONBaCRn.exe
  C:\Windows\System\ONBaCRn.exe
  2⤵
  PID:11960
- C:\Windows\System\ToPTofS.exe
  C:\Windows\System\ToPTofS.exe
  2⤵
  PID:14764
- C:\Windows\System\ZCDbYNu.exe
  C:\Windows\System\ZCDbYNu.exe
  2⤵
  PID:14776
- C:\Windows\System\NKfjoEp.exe
  C:\Windows\System\NKfjoEp.exe
  2⤵
  PID:14804
- C:\Windows\System\ewofJKe.exe
  C:\Windows\System\ewofJKe.exe
  2⤵
  PID:14828
- C:\Windows\System\hBxYROC.exe
  C:\Windows\System\hBxYROC.exe
  2⤵
  PID:4596
- C:\Windows\System\kOsBGOX.exe
  C:\Windows\System\kOsBGOX.exe
  2⤵
  PID:13612
- C:\Windows\System\dIPuiWB.exe
  C:\Windows\System\dIPuiWB.exe
  2⤵
  PID:12200
- C:\Windows\System\hghygWC.exe
  C:\Windows\System\hghygWC.exe
  2⤵
  PID:12620
- C:\Windows\System\IBuuUJw.exe
  C:\Windows\System\IBuuUJw.exe
  2⤵
  PID:9356
- C:\Windows\System\zrvJYHL.exe
  C:\Windows\System\zrvJYHL.exe
  2⤵
  PID:13176
- C:\Windows\System\enclOkJ.exe
  C:\Windows\System\enclOkJ.exe
  2⤵
  PID:7512
- C:\Windows\System\LyWTmOm.exe
  C:\Windows\System\LyWTmOm.exe
  2⤵
  PID:14900
- C:\Windows\System\lmDaZAc.exe
  C:\Windows\System\lmDaZAc.exe
  2⤵
  PID:12276
- C:\Windows\System\hJLNDlc.exe
  C:\Windows\System\hJLNDlc.exe
  2⤵
  PID:13216
- C:\Windows\System\JclrHqn.exe
  C:\Windows\System\JclrHqn.exe
  2⤵
  PID:12592
- C:\Windows\System\evQXnIU.exe
  C:\Windows\System\evQXnIU.exe
  2⤵
  PID:11176
- C:\Windows\System\jYxgMgL.exe
  C:\Windows\System\jYxgMgL.exe
  2⤵
  PID:4004
- C:\Windows\System\CJVbaNs.exe
  C:\Windows\System\CJVbaNs.exe
  2⤵
  PID:10756
- C:\Windows\System\UEmvvyy.exe
  C:\Windows\System\UEmvvyy.exe
  2⤵
  PID:8120
- C:\Windows\System\KKNYrIu.exe
  C:\Windows\System\KKNYrIu.exe
  2⤵
  PID:14372
- C:\Windows\System\QznPUtP.exe
  C:\Windows\System\QznPUtP.exe
  2⤵
  PID:14392
- C:\Windows\System\rfolmPx.exe
  C:\Windows\System\rfolmPx.exe
  2⤵
  PID:12484
- C:\Windows\System\XeVRBdl.exe
  C:\Windows\System\XeVRBdl.exe
  2⤵
  PID:12444
- C:\Windows\System\dGsxzHv.exe
  C:\Windows\System\dGsxzHv.exe
  2⤵
  PID:12856
- C:\Windows\System\ktrMdvX.exe
  C:\Windows\System\ktrMdvX.exe
  2⤵
  PID:9088
- C:\Windows\System\gnmEtcc.exe
  C:\Windows\System\gnmEtcc.exe
  2⤵
  PID:12412
- C:\Windows\System\YXrctDj.exe
  C:\Windows\System\YXrctDj.exe
  2⤵
  PID:7920
- C:\Windows\System\zxvyyyV.exe
  C:\Windows\System\zxvyyyV.exe
  2⤵
  PID:14908
- C:\Windows\System\szzCUBi.exe
  C:\Windows\System\szzCUBi.exe
  2⤵
  PID:13200
- C:\Windows\System\azOqbVw.exe
  C:\Windows\System\azOqbVw.exe
  2⤵
  PID:11544
- C:\Windows\System\HNdUNnw.exe
  C:\Windows\System\HNdUNnw.exe
  2⤵
  PID:9280

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 9992 -ip 9992
1⤵
PID:12072

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2712

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvfw5ffa.cji.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AxWfEbC.exe

Filesize
1.8MB

MD5
614bb33c6913b092c2a559cfc30c67ab

SHA1
1691e4689637bdadb6044f2cdf1b21502af81d8e

SHA256
85239643be23082c18dac3523fc36a2d7117a4bdea66c5e42f9881efbcccaad5

SHA512
07168772bcd6242852e5c89eaa690ff4564ebf2aac2e249f09e87e836d0bcab0a75a0b4a0035a752c56c6f3d356b0e73d1fc3284180a74222ba7b62445687c26

Download Submit
C:\Windows\System\AysVGvn.exe

Filesize
1.8MB

MD5
f8c3ba844d6ce8c59a585b3bc421ceac

SHA1
aee038a2861d2de2aae479d0541abc01b95ce4d5

SHA256
89c69306e2f3c29c1208e37efefb6fcf1e9605c34c62c9617389c9ee08dcb8e8

SHA512
211876d3a7a4937bb518e04075c660ad261fdbe6756cb85dbf66478ee38c4ab79c8f5a56b742a224b0c340fa324141deb9df712a9ba247c0b6c32dcf62e129f6

Download Submit
C:\Windows\System\BJtXgOK.exe

Filesize
1.8MB

MD5
640232f899cba276953bafa0e83a74af

SHA1
c128ad398e11f27df27345f575240fea4632e6f4

SHA256
4942f7dbb61d520dc43c9021b35030442dbbdb8e93dff686d72e1133b462ff73

SHA512
376c237906738eef28a809ccc30a55d4193ef3323f0e2a831020fe43f832de3cb04fb38e3c0539e63c3b32343ff08a561859c4b4a83ad08e62ac48cee6cfe077

Download Submit
C:\Windows\System\CBVpjNq.exe

Filesize
1.8MB

MD5
605ab06e35de366d509985c5c81608df

SHA1
9b41d72d14718c6ee3db24adc3a3ad83b62714a2

SHA256
a3384771ed40e9e9ea0766c2b3217495f055a56c6e2ac01d5c8f05a3d67cdd86

SHA512
1bb4087d039eec914f5fafaa27fdd92195e52b679b41af925213d9fa7cfdc87e643e6c26ecaa089014e2b67a1f40e3e3290ad182935db01decadbaa5890df5c1

Download Submit
C:\Windows\System\CmWPOEJ.exe

Filesize
1.8MB

MD5
1d4bd8f63e6f31e60fe4d887057070ce

SHA1
e2d39d484363fe020f5d366e0150f579275aec85

SHA256
ec8897e663e2ebcd9279b4c8a7ef8a337bdc2192e3fba827fcab4b9cd95aec8b

SHA512
1a78a4533f5c7c34abe74b6a66897d3730066f843bfb8f244e0bbcb386dd0ac3b0f7dc4a39c7c703b37ef596d11e8536bdbd53be1773c663ebda101bbb956e73

Download Submit
C:\Windows\System\EiqGdUE.exe

Filesize
1.8MB

MD5
38870e141f556165385e396de56c141f

SHA1
c33411ea53822f53fe961b15c53c5c16a28063f3

SHA256
e2a920dfe680d0586cd5bd0fb04958c67bd8a9b67da9f37c6932dd828fb75d98

SHA512
d03d8897a5483aeb559354c2b637848b291ae7e68f838172a831c62955dc4e5f60859f27ed6741e3b5a4405afff6758a76b16cc58c6e8c7cff4f98cb6e88241e

Download Submit
C:\Windows\System\FbqFePn.exe

Filesize
1.8MB

MD5
ec73c5d062b23f74e10529ce21f35f3d

SHA1
762a44b5815a2cbc05e887f47a8c8ac4af73fbf1

SHA256
a792d906e9665c7675a31bb2b76996671886c97617511a38f51ea25c1d5f9a9d

SHA512
5d05894cafa4d7ea889141a6a31afd916ba30d62cd36a34465b6cedc1b6ceffe4e20962f945c95a6cb8dcff68cc3ed0a6a56efe8d8b946d5e4bad9c7dfa70301

Download Submit
C:\Windows\System\GRcsiQx.exe

Filesize
1.8MB

MD5
8dba036def91cc4cfa0f7d12aa202cff

SHA1
91d3de70a7008f3df345adc3fb90445d1d5e0132

SHA256
d0c2fc96e6253e78e66014b6a50946efde223f2181022ccdcbeb2cf5b72b8077

SHA512
ded209232e8e7a5493db4447d5debd564c3555579b6a31dc0f2ff250e40658439c1ecddebeffacbdc0030e13927c827f64e51819c30620f84891263a30675585

Download Submit
C:\Windows\System\JGfRClC.exe

Filesize
1.8MB

MD5
0d64e0f7379e947392c5bfc15b0bff8c

SHA1
ea7c7982b1b5185b01a2ad8dd5b88123947aaf34

SHA256
200c267adeb42c88aebb0882b08150b4ed6713297ccbf9da6351306febcd9ac0

SHA512
010eb71fe1a97bce90a3089acd33f7115ad210626f3dd67b9fb779da0dd651a12f807a81cf2d2f8c13f279c3ffea17870e4de424faf31cbcac21514f1098d0e8

Download Submit
C:\Windows\System\KnLNofW.exe

Filesize
1.8MB

MD5
9d1c2c37b10692a1944294bee6dde72d

SHA1
d2df8ded5cef26ce89e85430e957c0a177601ce2

SHA256
178eb5d0a2285bd8e3822dadba8ba56c78770f18410f1349fa228f7dfc2ecfcf

SHA512
8c708442c5d1e1128097e1747262683fd05d38e80335ae729bc5ef6590daa33a0998fa22b4c0733c263e707a8a8bcf193fcd3ce96c724ee5b2f4399cf3ba766c

Download Submit
C:\Windows\System\LiNDIHk.exe

Filesize
1.8MB

MD5
5740f20fad65c172aa45d9f531e87304

SHA1
07f64af2a73e2337662e80449fc1d126810e6669

SHA256
cf25cf32078308127967fef60b90197d41a90ab76aadf83338dc6ce827209c73

SHA512
05e1dafbd3dfdf9c53456d699c46903d18b6486e5d8cade1dc81ab1432420cb5f0705bc9ef2355c5a8096355ac040490fb403b4949c34af364042625a0ea3214

Download Submit
C:\Windows\System\LwZwATU.exe

Filesize
1.8MB

MD5
e3f5024c39c13697f6fa0436d96bf024

SHA1
b0ec14fab257e7750875b05143ad5714d967b836

SHA256
8bc4134847ddead739350402c7554f578898ef94d9a24d5d3e49d50f0b85f1f2

SHA512
75b769788f47346a0750091495e7696a7814fd580a27314a850bf430ceb5877cd7d898bd95f777047c659a804f693740535798e3f67114dbe4c5c1c506163003

Download Submit
C:\Windows\System\NczHZja.exe

Filesize
1.8MB

MD5
4e83e130cb2710e6e71f2fcaee9253ba

SHA1
c2c71ca05d9990dfc2b905a950f005e1f9baf289

SHA256
b032b65d52dae42fa1fce740d41974a5c84e491a79f94b9bfe8c0bb2c31f919e

SHA512
c8dbccc80d18f46659360afe75cd47427850e0aa4f8f3d89c41de81c408d190c9677baef12caf5f5cafcc353670daaaea0bddb88d53541e1c57f78cc28a98f9c

Download Submit
C:\Windows\System\NgVNPKy.exe

Filesize
1.8MB

MD5
14460665f8c737eebad82cc1f71679ed

SHA1
60ce6421944d4064e537332513e27d7c92815e66

SHA256
f7081b256cddf0019ca6279402111ffb39b9a7b5e212930440d53bc20df7be5e

SHA512
18a5a2a7ba3437411a23c6b92e70fde669da6a3d9d368d60482c9dd99560c15e40c8443752c6cf767b4b03036cdcf373323308018626566df37f15b2a2d3fd53

Download Submit
C:\Windows\System\OlsaNJl.exe

Filesize
1.8MB

MD5
842169931df3ec9280dd7a15a0f0998b

SHA1
89388a4331d5ca40d500705d50a10e4f0522df5d

SHA256
c12eaf5d833905ec162bf782b5968e8e924edae1871574b2bdab5009abf015a8

SHA512
c99a7074e5a3742d207448952b6593be853390000d3ee4a0de19c7c22bd5774eec633f36ffa69266eeacfbeba4b9098898dee03b4d87265e41eeb4d6c69c078e

Download Submit
C:\Windows\System\QqpaFGP.exe

Filesize
1.8MB

MD5
ccec1ae26af70d231de57dc9c99c59dd

SHA1
1d49a2435124e947ee4885184ed5ffa31b647d1b

SHA256
f83db656598ff6c7683d5c452284f9d0fc87303ad48cb8a63d98fa3a766b3b2a

SHA512
be86482b18c1a7f8c736ac64ffd404b9e5349e8558198db56a694310768da25cb875b4b0904c6ba107d759a46bf05993441d739b291c7074ef1f6a74e41a6316

Download Submit
C:\Windows\System\TMVxxaQ.exe

Filesize
1.8MB

MD5
5e8731773d4badc9ec95c4fec8e0a6a0

SHA1
1ea182664e04e7c5d5fe555c8527792f2b78cfbc

SHA256
0940441ac72e0016cc65b7abea970630cc5038796a8a90958f2d7d38ec905884

SHA512
6e18293a5a5d8f64a8f1f698f1c8369009a3549074eaa54db2c18838fed37db146e1a8ed11c2229f20b56b0e8b348e0fb88ed4d65490eb01626015335c39d834

Download Submit
C:\Windows\System\VGEppjk.exe

Filesize
1.8MB

MD5
03f6da2408e45c89e9ab973c0d9517f4

SHA1
f3dff4b567fe715fb65e2266ae5f01128e52e140

SHA256
f6c99674b6212dd10d2a331c3f4c469e99be90f4aeb7e54c375793fa1ec56ed1

SHA512
5c95f6f5355443f77474f11832fb26dc7750fbfcecb607d5e7814ba4d01a2a70c834f15cc8c4edb5884a9ab6995589aa8c7531b44db5b245ba4373e6ae5c05e5

Download Submit
C:\Windows\System\VXgeqKG.exe

Filesize
1.8MB

MD5
9e3e108cb5b49ef8b458d9086e8c7ec2

SHA1
81b3eff5d993fc7d95806c029efd47f75649bb9d

SHA256
e3d440711dfbddae3ece9caedbb1dd357ba21ecc71f0a234ace74f0ae05c621c

SHA512
2a7204119874bbe8a3f48a505f76160d08f81393a64685e29f84be914299386a6a29dc93352379e9f2951b88e9e6d7c0da229ee074f67dc1992ef79c1e0cfb75

Download Submit
C:\Windows\System\WFVKhfO.exe

Filesize
1.8MB

MD5
d7dd41cbbdedc78d3ced121081b9d98e

SHA1
ea36db8f330c7a1382ea48fa933d07e428d7c8cf

SHA256
41a54fb21addd16e21851f68f4f53b2687dc7a1f05bb03ee98b9a864ecddd35d

SHA512
eae7201ac251eb5668966dae9b5113af54e15f65c1da664e8b679c204cd2dd323da102f88cf3c5a78f362b082e72d04c7306291f465122b29469646854edd567

Download Submit
C:\Windows\System\WjdZtYz.exe

Filesize
8B

MD5
b849dbcfb08ac877290add49e99178d8

SHA1
e96fe151173fd43a6d834740f52198931a388bf9

SHA256
a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163

SHA512
8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863

Download Submit
C:\Windows\System\YGPapDO.exe

Filesize
1.8MB

MD5
7b2262c21dc015f42e79ad05d3c887f4

SHA1
69dfe75a614c3b24894b2ed151fc4d3896c0963c

SHA256
62193c8f35ab9b844e41c8cf3853208ffdff3293761761576fc5c28b0aaac96a

SHA512
69422560891caf8f32e7c123b90b6452c1269ca123f93cf59b13f0e8f3143d2f9d14f778bff02ecb2cfbd0ec78f3c9e07190991da250d9f8b07ddddb84fe553c

Download Submit
C:\Windows\System\ZqhBIyG.exe

Filesize
1.8MB

MD5
b583a5465839662c1cd1f7fc8f160ece

SHA1
c3ba041ef61e340d9e30f4aad85d8894ff20bda8

SHA256
8929260ad5ca7cebb0b07ced309d226b84d3957a93e75b8deada49bf177076f3

SHA512
ae28bff0bc1f7b532df5066058272e2782164f104b14643b317e84d5ebc750a134e7b1ec7016e5d0b02610951466932cc383bfa205ee3930d1c4281b36801e69

Download Submit
C:\Windows\System\bHUOcXP.exe

Filesize
1.8MB

MD5
0a62cc78fd85a54563b659ebac24cfd5

SHA1
4c5c637fb42e70c3ff630797fbcdee2b7c8af809

SHA256
3b11ca30898d188664e8dd2e2482373f20340c368164a3a88d7148cf60377542

SHA512
2c1339bef515243f8b3053df47d6d456f8228d9e5417d75054b9a5bedd010652261d084a6c0dd53da9e3966e80f05ce477b7dc87f40e6d888a66fef5cea88234

Download Submit
C:\Windows\System\cOEDICo.exe

Filesize
1.8MB

MD5
28ac64f472137d95d24bffc2169d9e10

SHA1
487d6a8004e7cca4ca177516c4dbef811a17e858

SHA256
404de594b852f1efd620eb543833e4f701bc088ae4bbd70e4dbc33d1de67f1c0

SHA512
58ad73966a5760b4656bf2c10f899dc1bea727201fa672969a8a978413f1b34ced38a80eb7897b375ea9d6250d8a4789c652a0ade2c939b253bea4996d31a8cd

Download Submit
C:\Windows\System\deufKLA.exe

Filesize
1.8MB

MD5
1556c034eec65af2d6dde020f02368dc

SHA1
08d335bccbd8ee7e6aa15593186107ac15dceea0

SHA256
38799e8422a4c6376211203727501459741c620dc4834fafe372ab4f86123cf5

SHA512
f6965725c67e4f3d9607bbc3047b5bb6fc19a2189a47add77700823af062a706f732a0cf8a56b9d9a4dda13f83dd74ad45582e4ec8ae820a967882a82e73cb30

Download Submit
C:\Windows\System\dnMCxuV.exe

Filesize
1.8MB

MD5
4938cfb1617f363910128b142500e412

SHA1
c45c495e68db2113ec8ce359bc6d3cde66d04d8c

SHA256
603022ff296ba580da2255a78b162a88afbef150cb9ccb55a1af84c04c255286

SHA512
033838fcaef004e5c981ab15cb835641fa6897e7b957e0b675eeca43fdec9f3c0ceda4215dd046bc65e0a304ec662b4b8decc639a693f0d88203cb61c48f6a1c

Download Submit
C:\Windows\System\eJIwiZK.exe

Filesize
1.8MB

MD5
f78d27da065c7ea06857579194ccd114

SHA1
e3d4d90b8eda70b2f6eec20c53f2454412d4cbd5

SHA256
09d5e1e83ef5fdea61162e0f43d753a159aa771176a90f1a1fbe732fc1eb20ef

SHA512
50643e6effec682dfaf6cf418c4a802bb3eef46a993fd4bb7c0e8b200109de220a5359e766cf20efaed1a8f3b60a8587dd1112c04503bac666e6f2f41b53984d

Download Submit
C:\Windows\System\emjuSXf.exe

Filesize
1.8MB

MD5
f853e42c6e23b37085346140265793c9

SHA1
11711f1b3c507e68183ae5f35af4a1a39ba1d9e5

SHA256
dae24357594da7404b0fe4a4f57d71de437124071517e3ac0d827c55bb6222bb

SHA512
bda462711804c79968a5383e399c059ab625dabc44e1c3ec1bf1abe754ec7c526abd54dbee569b59805645bb3967290d98705ab36089451b955ee4a10e624141

Download Submit
C:\Windows\System\iKflbhD.exe

Filesize
1.8MB

MD5
570e2b24ec4a2b4bd95cafa7d4d174ee

SHA1
7aecf95eb89b251cfb6dd50c9e541f11a409eb6f

SHA256
296f57b0efe63e9d061b67beeb3b4a4c0b55e28136f1d26be9436f4b3a1cd0ec

SHA512
393a419becfe7d18ad01f7b315c55df95705b141b1289500bcc1df85d4a57b1760731103687f0a8d5334959824a22395d26e01a8f09f13c35bdce2dbc3da43b2

Download Submit
C:\Windows\System\iYCQmFu.exe

Filesize
1.8MB

MD5
4f20f4dc5c80815f6382c24493207f07

SHA1
057f4e786a57655b31548f69311f7f68003c5871

SHA256
8e6229607c21e98dab5feeb93ab298a31afd60665bb1f9af395da09be88b64c6

SHA512
218aa4ac82ce7c9cce3aca2060787b40777cdb1adbb1c546c44c851e1690edd508fb22622331e4270c27f82226d4282369f933903903ae0ab9a40ce40682be51

Download Submit
C:\Windows\System\jQbdmnH.exe

Filesize
1.8MB

MD5
67f7b6c6f39b16002052a187f2c303ca

SHA1
bb7943c9eeeed073725f6ac959b17552aca4ec97

SHA256
5c1e0d30625e70e049d57264e81afdf213bc2b8f04b0f1b8d709af2af4df4642

SHA512
de523a4f62b3481952f6b5eb194966cdfcee117c332a6b24169831ee2d6f8c4ba86b63949e0bc5a0dbba7bf6cfc08f139cd671c3843aa45bc2fd22c8743398aa

Download Submit
C:\Windows\System\kkjUzVR.exe

Filesize
1.8MB

MD5
241da00b7523fd2e296888d121010858

SHA1
062f3c69f7016225eac5cf80a5a0dc5df3d4e3ec

SHA256
9838c500ccd771aff25bdedc0cdc100e662983dc906f8e9e6d2a46b870620c78

SHA512
0d648f9e49778d10b849b940237691fc7222eda6c778376dd963af04bc3d349d70acfda05803cdeedc9ff38d0550bb78c2fd010b6a331474cba4219f7c30d244

Download Submit
C:\Windows\System\kqZifHn.exe

Filesize
1.8MB

MD5
0c02f0738e2e6e586c7a05b04ab1569c

SHA1
62ff32ea38da665feb3d645febaa181e8646ecbf

SHA256
8e2fe331b279499934ac785c240fe9d10326c761e8ba5840f128fcf35d53fe69

SHA512
e67177576ec5794a528fee2d4bd9a5b7587c6df3210b058cc20dca1a1b4c6767c4a12eb00f481b9dae277bfa78c69b2eaf97646d4d80fac2197f7e9da58a0fc0

Download Submit
C:\Windows\System\nVLGuzF.exe

Filesize
1.8MB

MD5
03ff311427b536ad1ec22e8f1dc5c4e7

SHA1
eb0da420405856db041d151b08ea589392115c44

SHA256
591216936325ecb01200391e4e19abab1aac03d10ea1a5666672afb472bd7581

SHA512
597e96a174f689478647c3f905ff13e7d687d802421acb73f2f3e00774b5b98adaf64114ff48e50f9abe681b1ff50c5d6464fa0d68d330fe8fb0291d2d7b1645

Download Submit
C:\Windows\System\pMGgwqn.exe

Filesize
18B

MD5
9ac80bd3676a9afcd1b2b87ad503ff74

SHA1
9450a6252bf5581c786da39e335ef6daa84b2b14

SHA256
139bf5b4b00f1d1c9f3d4e09a18af03fd56e363a9ac57feac70ae54041e87fda

SHA512
226b7fdaf3841f974f5dc515ea308559528af6f1b3b8dde2492efb31cf145d9bc78df64f1a51b99bf63428b956e0222e2726ceae7a82f99d50ed082ea9487262

Download Submit
C:\Windows\System\qSlXdGP.exe

Filesize
1.8MB

MD5
6aba540cd837057d5f930e6fb81e8249

SHA1
b1bf4deb82ad70523e36e52f6819e45e036e6c2d

SHA256
e011dff7426b195794835e684a073cb282344c72e07c2002432ad58f9e85a4a4

SHA512
0d3a4bd850f970adc6c05f446fae72c3a729e7a0b0c1ef96635461a32b429fa59e6fffde63fce598511499ace0320be93b5cc7c8798b1cf9509385dd0db50eea

Download Submit
C:\Windows\System\uynpQGO.exe

Filesize
1.8MB

MD5
cdadb2fbe5f315ab1d27e9d6262d879c

SHA1
0d7f3cda8edd70ef8b83200f0a39afec3aacc703

SHA256
3ee51b3523a9cf243cba7a956f1eb31753fac5c93a67cb942bd358ed93bf0755

SHA512
039d10aab654bf0bc46ea4e6915c90e0440f2af5bbe0a2d94ec8975bfae4ccc4aa010af01fbe50b86e17b7e4d9100eed30aea7f5dcb8f14bc1d7e6e6e3835ef1

Download Submit
C:\Windows\System\vGNCkvm.exe

Filesize
1.8MB

MD5
1ef529ce064c62467224dd49c653894b

SHA1
2d1f32f64fcfe0a92614d19600c7fd1eee2409da

SHA256
c2462e11d696ea572053485675b23edba5c6b3b001c848699562dfe66ce4fd85

SHA512
5d53c3672ee25e95e3d32fc31d683b3dbfe45abace3431bdd6e059147db3bfd1b6b60e9bcf31e1faba3921b33356f5deda83cdcc13506637bb36d90f817dd0a1

Download Submit
C:\Windows\System\vOVNttA.exe

Filesize
1.8MB

MD5
21b6582df228b299c989a830a848d7f3

SHA1
93f17c6737e0eb6f9da5b872929acb5ff19e1dc0

SHA256
4104bfa091ec98d90c55091f51725bfb1149d0f1779745e50f8248779bc5c449

SHA512
bdd800ee3699f9aeafd4f9197fd3f955d912db99abe3e16a1f00c764fe6ecbee752cad0e4d474f10815d7db63ad4b1e74d078735162e96e02cb1cbb00861360f

Download Submit
C:\Windows\System\vQqHouY.exe

Filesize
1.8MB

MD5
3078b1eb8bc1b0a21c79a470c259363b

SHA1
7b8bf2634dda56ff7eccec675972507aa65e6b5c

SHA256
39e83a2040ce107ace9c3c357484388c38d19b7b88d7d3b13ecc6ec76cbc35e7

SHA512
af895d958ab506751b31e5947a8b9163a5c62f1985e5a499a6c7462b6419c7e34e382642e0451e88243053a8aab3001cf03a7fa890ba9d1ab188909d1f17df8d

Download Submit
C:\Windows\System\vmwLYPb.exe

Filesize
1.8MB

MD5
c1bbaf359d5fec467440e7e3b4ea2053

SHA1
c755c8e6baa35638a20a0c705c61090b084dcc8e

SHA256
4854a9f6484f1a15a6d2934f57be5cb1abbb987b43f33ca2c4142bc589d11031

SHA512
bf73379144aa8cb138f19cc78694543bb57a4d8ccca164411fd83a2ce2de45e109d0ea740baa1793ae692382bb04759e73fd5bf59ca3e0246b40f39f8a153cbf

Download Submit
C:\Windows\System\wSLzOzk.exe

Filesize
1.8MB

MD5
19eae455c44bd5bdf13fc9c126a0e28b

SHA1
3f7a5b88440aa7b0e69a9b361ebc12237dd8c5de

SHA256
47c225043064d50189a418c0061c111e44d0821018f28b0f31b7c2a77e3d29a0

SHA512
3e7a2eb3ddd73106b1dfee9c69e9c31284ebb38e8b4762a674053ded3f526d8b0b06590862438265d78cd1f610ec5ecf151c804b3de32d9fe628101b410cb6cd

Download Submit
C:\Windows\System\xfmfULt.exe

Filesize
1.8MB

MD5
22d744b7988ec98c8409560eaa830853

SHA1
385ea06032709c002d25e4acef3b325709fe3bd6

SHA256
04be2d8c168dfc98c3bf5ac7bbe4aab4556a35f64c570955eb6924e96db6c54e

SHA512
cf0a866a5d3a184b27aa7c425ef200345b7c08f0a5ee604f8d8a0f0cdfb59077a3db58607c6a56631ef248793d205730cd7a84557e7702b7ae29c935b400975f

Download Submit
C:\Windows\System\zzVxUlr.exe

Filesize
1.8MB

MD5
2191ca457aa9f293185ab9012a0ea4a3

SHA1
0f9d02dc6dc756b1f8fbe911dd840c6828d498c9

SHA256
3c5e5ce54d4100edd0583c1c189c74099773966bc28c2ff1cc2103fc8476c971

SHA512
e9712c8fcd25c5edaa92a14c7dfd3e62b5c8d872277c956859791006dfd216adaaf147ee9ce1a0862388a1a16b85f8af7cd74303bd92dedbcab747b496480a00

Download Submit
memory/408-990-0x00007FF679730000-0x00007FF679B22000-memory.dmp

Filesize
3.9MB

Download
memory/1216-235-0x00007FF699C20000-0x00007FF69A012000-memory.dmp

Filesize
3.9MB

Download
memory/1476-626-0x00007FF766560000-0x00007FF766952000-memory.dmp

Filesize
3.9MB

Download
memory/1756-635-0x00007FF61F840000-0x00007FF61FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1788-2235-0x00007FF714000000-0x00007FF7143F2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-627-0x00007FF64ED40000-0x00007FF64F132000-memory.dmp

Filesize
3.9MB

Download
memory/2752-1395-0x0000023379440000-0x0000023379462000-memory.dmp

Filesize
136KB

Download
memory/2752-53-0x0000023379200000-0x0000023379210000-memory.dmp

Filesize
64KB

Download
memory/2792-313-0x00007FF727AD0000-0x00007FF727EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-629-0x00007FF6C2140000-0x00007FF6C2532000-memory.dmp

Filesize
3.9MB

Download
memory/3012-632-0x00007FF76CA60000-0x00007FF76CE52000-memory.dmp

Filesize
3.9MB

Download
memory/3048-631-0x00007FF6934E0000-0x00007FF6938D2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-132-0x00007FF784910000-0x00007FF784D02000-memory.dmp

Filesize
3.9MB

Download
memory/3492-16-0x00007FF774120000-0x00007FF774512000-memory.dmp

Filesize
3.9MB

Download
memory/3500-191-0x00007FF79E3F0000-0x00007FF79E7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-633-0x00007FF7466D0000-0x00007FF746AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-630-0x00007FF6B6D60000-0x00007FF6B7152000-memory.dmp

Filesize
3.9MB

Download
memory/3908-479-0x00007FF6959A0000-0x00007FF695D92000-memory.dmp

Filesize
3.9MB

Download
memory/4524-621-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp

Filesize
3.9MB

Download
memory/4552-2206-0x00007FF7FACE0000-0x00007FF7FB0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-625-0x00007FF62F030000-0x00007FF62F422000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2172-0x00007FF7BF8C0000-0x00007FF7BFCB2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-0-0x00007FF77C770000-0x00007FF77CB62000-memory.dmp

Filesize
3.9MB

Download
memory/4916-1-0x0000029F95590000-0x0000029F955A0000-memory.dmp

Filesize
64KB

Download
memory/4964-634-0x00007FF6F4BF0000-0x00007FF6F4FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-628-0x00007FF6A20B0000-0x00007FF6A24A2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-34-0x00007FF760CC0000-0x00007FF7610B2000-memory.dmp

Filesize
3.9MB

Download
memory/5332-2184-0x00007FF6710F0000-0x00007FF6714E2000-memory.dmp

Filesize
3.9MB

Download
memory/5752-1893-0x00007FF7D0040000-0x00007FF7D0432000-memory.dmp

Filesize
3.9MB

Download
memory/7076-2018-0x00007FF7DD070000-0x00007FF7DD462000-memory.dmp

Filesize
3.9MB

Download
memory/7116-1927-0x00007FF6DBF40000-0x00007FF6DC332000-memory.dmp

Filesize
3.9MB

Download
memory/7328-1886-0x00007FF652B20000-0x00007FF652F12000-memory.dmp

Filesize
3.9MB

Download
memory/7380-1919-0x00007FF7CA3E0000-0x00007FF7CA7D2000-memory.dmp

Filesize
3.9MB

Download
memory/7424-1896-0x00007FF6ABE00000-0x00007FF6AC1F2000-memory.dmp

Filesize
3.9MB

Download
memory/7452-1940-0x00007FF6C6A80000-0x00007FF6C6E72000-memory.dmp

Filesize
3.9MB

Download
memory/7560-1887-0x00007FF72AF20000-0x00007FF72B312000-memory.dmp

Filesize
3.9MB

Download
memory/7688-1968-0x00007FF7A3490000-0x00007FF7A3882000-memory.dmp

Filesize
3.9MB

Download
memory/7860-1901-0x00007FF79D6D0000-0x00007FF79DAC2000-memory.dmp

Filesize
3.9MB

Download
memory/8264-1961-0x00007FF77D1D0000-0x00007FF77D5C2000-memory.dmp

Filesize
3.9MB

Download
memory/8464-1895-0x00007FF72A2B0000-0x00007FF72A6A2000-memory.dmp

Filesize
3.9MB

Download
memory/8580-1917-0x00007FF78BCE0000-0x00007FF78C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/8600-1918-0x00007FF70A690000-0x00007FF70AA82000-memory.dmp

Filesize
3.9MB

Download
memory/8684-1894-0x00007FF6B7B50000-0x00007FF6B7F42000-memory.dmp

Filesize
3.9MB

Download
memory/8744-2203-0x00007FF6E66B0000-0x00007FF6E6AA2000-memory.dmp

Filesize
3.9MB

Download
memory/9060-1907-0x00007FF6C6570000-0x00007FF6C6962000-memory.dmp

Filesize
3.9MB

Download
memory/9200-1884-0x00007FF6E5080000-0x00007FF6E5472000-memory.dmp

Filesize
3.9MB

Download
memory/9252-1888-0x00007FF6A15E0000-0x00007FF6A19D2000-memory.dmp

Filesize
3.9MB

Download
memory/9620-1974-0x00007FF6879B0000-0x00007FF687DA2000-memory.dmp

Filesize
3.9MB

Download
memory/9636-1889-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp

Filesize
3.9MB

Download
memory/9656-1959-0x00007FF649FE0000-0x00007FF64A3D2000-memory.dmp

Filesize
3.9MB

Download
memory/9712-1891-0x00007FF66BD30000-0x00007FF66C122000-memory.dmp

Filesize
3.9MB

Download
memory/10644-1953-0x00007FF798760000-0x00007FF798B52000-memory.dmp

Filesize
3.9MB

Download
memory/11796-2134-0x00007FF7008A0000-0x00007FF700C92000-memory.dmp

Filesize
3.9MB

Download
memory/11812-1916-0x00007FF6878A0000-0x00007FF687C92000-memory.dmp

Filesize
3.9MB

Download
memory/11828-1885-0x00007FF7D9030000-0x00007FF7D9422000-memory.dmp

Filesize
3.9MB

Download
memory/13380-2274-0x00007FF7E2AB0000-0x00007FF7E2EA2000-memory.dmp

Filesize
3.9MB

Download
memory/13384-2318-0x00007FF6C0C50000-0x00007FF6C1042000-memory.dmp

Filesize
3.9MB

Download
memory/13384-2281-0x00007FF6C0C50000-0x00007FF6C1042000-memory.dmp

Filesize
3.9MB

Download
memory/13460-2197-0x00007FF69AFE0000-0x00007FF69B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/13660-2133-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp

Filesize
3.9MB

Download
memory/13696-2333-0x00007FF7B0DD0000-0x00007FF7B11C2000-memory.dmp

Filesize
3.9MB

Download
memory/13696-2375-0x00007FF7B0DD0000-0x00007FF7B11C2000-memory.dmp

Filesize
3.9MB

Download
memory/13768-2298-0x00007FF6FE7E0000-0x00007FF6FEBD2000-memory.dmp

Filesize
3.9MB

Download
memory/13904-2338-0x00007FF7644C0000-0x00007FF7648B2000-memory.dmp

Filesize
3.9MB

Download
memory/14032-2217-0x00007FF709D10000-0x00007FF70A102000-memory.dmp

Filesize
3.9MB

Download