xmrig | 2920aa00e26435beea5dc8c8663c9ccec1e9b76bba24ae54b9b7d99910e721a6

Analysis

max time kernel
39s
max time network
141s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
Size

1.9MB
MD5

00a54c07a2c53dbbf2df3bade30db2c3
SHA1

aee6dbe345bb8bebd956a3a3bea8101a31a3d3c9
SHA256

2920aa00e26435beea5dc8c8663c9ccec1e9b76bba24ae54b9b7d99910e721a6
SHA512

df039cba4bf2928a8bac4ad64662c79fc2941e31714a04365f760aec0e2c2f38f5f3e693485bb1739b13f29a03cd5d394fd1799e7e168e1a2516a31b7bfd5edd
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UT:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-9-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2448-234-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2212-233-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2568-207-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2640-204-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2708-201-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2936-238-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2600-242-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2500-236-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2496-266-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/820-260-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2564-200-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/1828-285-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/1704-284-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1964-283-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2736-277-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2688-199-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2720-20-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2064-294-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3048	UyAOJNP.exe
2720	cKIKCXa.exe
2688	diKAHfJ.exe
2564	HDDNMJf.exe
2804	JuPlLny.exe
2708	JusMosy.exe
2640	ihrICRT.exe
2568	aJkIWsr.exe
2212	YcQXptC.exe
2448	uqwEOTB.exe
2500	WoPwiXg.exe
2936	rvpwIbJ.exe
2600	YUtkUpD.exe
820	gqJaDPY.exe
2496	YvwTpDu.exe
2736	tbexQIx.exe
1964	OWOvCAP.exe
1704	rgnxvdt.exe
1828	wAtkGbU.exe
2220	uwqYSPE.exe
2004	ygVSbdG.exe
2780	HPoFedx.exe
540	flpdCkU.exe
792	NFYJNBv.exe
1224	xJWYYpW.exe
832	oqwaQgU.exe
636	DrGQIQi.exe
1260	JSTbsdk.exe
1516	AibAvVx.exe
1696	pJGUXVX.exe
2932	sflHomW.exe
1508	cknyhSq.exe
2104	QZIDZfc.exe
696	zheCPEi.exe
2236	iePSssC.exe
1544	jnkxDGn.exe
2144	FFoJVnZ.exe
1928	UsjyCnG.exe
2280	sqErNqh.exe
2300	zbjzDXZ.exe
2060	qDeruyf.exe
2040	daeXbGD.exe
1444	OhODhdJ.exe
1244	SEeltwE.exe
292	jxrmlVH.exe
2672	lverVzt.exe
3032	DmnvKTQ.exe
1568	gEaxeBm.exe
2972	LMOzhIP.exe
3040	jLfECJW.exe
2024	xpUmLZH.exe
2636	eyEHJQv.exe
2480	tGDVoqa.exe
2588	HDXzRRr.exe
2232	fFNFWTZ.exe
548	aaJsZZL.exe
864	DhvgSxx.exe
596	ndGcMMN.exe
2412	cqJQUay.exe
356	jyCKUiE.exe
2328	GnysKxw.exe
1316	rUHkWPY.exe
1656	knksHjU.exe
2620	KnvyXRm.exe

Loads dropped DLL 64 IoCs

pid	Process
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-1-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/3048-9-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-6.dat	upx
behavioral1/files/0x000d000000015d59-13.dat	upx
behavioral1/files/0x0008000000016a28-33.dat	upx
behavioral1/files/0x0025000000016013-32.dat	upx
behavioral1/files/0x0008000000016d81-45.dat	upx
behavioral1/files/0x0006000000016d85-49.dat	upx
behavioral1/files/0x0006000000016da9-53.dat	upx
behavioral1/files/0x0006000000016e56-57.dat	upx
behavioral1/files/0x0006000000016f7e-61.dat	upx
behavioral1/files/0x00060000000173df-85.dat	upx
behavioral1/memory/2448-234-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2212-233-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2568-207-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2640-204-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2708-201-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0005000000019367-153.dat	upx
behavioral1/memory/2936-238-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2600-242-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2500-236-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2496-266-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/820-260-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2564-200-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/1828-285-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/1704-284-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1964-283-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2736-277-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2688-199-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0005000000019259-147.dat	upx
behavioral1/files/0x000500000001877f-177.dat	upx
behavioral1/files/0x000d00000001865b-176.dat	upx
behavioral1/files/0x0006000000017510-173.dat	upx
behavioral1/files/0x0006000000017472-172.dat	upx
behavioral1/files/0x0005000000019251-141.dat	upx
behavioral1/files/0x0005000000019369-156.dat	upx
behavioral1/files/0x000500000001925d-150.dat	upx
behavioral1/files/0x0005000000019257-144.dat	upx
behavioral1/files/0x0005000000019232-138.dat	upx
behavioral1/files/0x000500000001921a-135.dat	upx
behavioral1/files/0x00050000000191dc-126.dat	upx
behavioral1/files/0x00060000000190bc-120.dat	upx
behavioral1/files/0x00050000000191fd-129.dat	upx
behavioral1/files/0x00050000000191d7-123.dat	upx
behavioral1/files/0x00060000000190b3-117.dat	upx
behavioral1/files/0x0005000000018674-111.dat	upx
behavioral1/files/0x000500000001920f-132.dat	upx
behavioral1/files/0x000600000001864a-105.dat	upx
behavioral1/files/0x000600000001748d-99.dat	upx
behavioral1/files/0x000600000001745d-92.dat	upx
behavioral1/files/0x00060000000173e7-89.dat	upx
behavioral1/files/0x00060000000173dc-82.dat	upx
behavioral1/files/0x00060000000173c5-77.dat	upx
behavioral1/files/0x000600000001738c-73.dat	upx
behavioral1/files/0x000600000001737e-69.dat	upx
behavioral1/files/0x000600000001737b-65.dat	upx
behavioral1/files/0x0009000000016c30-42.dat	upx
behavioral1/files/0x0007000000016c1f-38.dat	upx
behavioral1/files/0x0016000000005586-36.dat	upx
behavioral1/memory/2720-20-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2064-294-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HPoFedx.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\NFYJNBv.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\AiDqdib.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\jyCKUiE.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ngMLltU.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\kSwJIhL.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\QZIDZfc.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\xpUmLZH.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ndGcMMN.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ITjrCCP.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\JusMosy.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\vSnQqQS.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\aEYyPsK.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\OhODhdJ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\tGDVoqa.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\GnysKxw.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\sObLdRR.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\LFPKyjC.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\WoPwiXg.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\YwdNHXf.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\cIEpsIf.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\uqwEOTB.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\lNWRvRm.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\tbexQIx.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\fFNFWTZ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\icmPiaf.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\MMVzPUM.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\JwyywoW.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\XBpruLd.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\tczNeEH.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\PCetWzJ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\MxaMaXU.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\rgnxvdt.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\IMQVaDC.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\UNHfajq.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\EitmIsy.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\YkVwpRf.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\rvpwIbJ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\jxrmlVH.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\cpXCZno.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\FMINlww.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\RXKwTtN.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\LiSuQWw.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\XRKEmIn.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\raVNIYb.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\HeBPNRU.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\yFhvshT.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\UjOsCgl.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\aiurhmR.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\LMOzhIP.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\RVHtQwV.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\EhioCeF.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\Nxpkfhd.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\cKIKCXa.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\jMXDAXg.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ocaofYg.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\uaRmyaS.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\nPYURlu.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\KvMwziT.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\uXWUwZI.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\uwqYSPE.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ppbkwio.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\qLOknbY.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\YvwTpDu.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2192	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2192	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2192	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	29
PID 2064 wrote to memory of 3048	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	30
PID 2064 wrote to memory of 3048	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	30
PID 2064 wrote to memory of 3048	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2720	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2720	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2720	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2688	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	32
PID 2064 wrote to memory of 2688	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	32
PID 2064 wrote to memory of 2688	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	32
PID 2064 wrote to memory of 2804	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	33
PID 2064 wrote to memory of 2804	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	33
PID 2064 wrote to memory of 2804	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	33
PID 2064 wrote to memory of 2564	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	34
PID 2064 wrote to memory of 2564	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	34
PID 2064 wrote to memory of 2564	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	34
PID 2064 wrote to memory of 2708	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	35
PID 2064 wrote to memory of 2708	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	35
PID 2064 wrote to memory of 2708	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	35
PID 2064 wrote to memory of 2640	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	36
PID 2064 wrote to memory of 2640	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	36
PID 2064 wrote to memory of 2640	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	36
PID 2064 wrote to memory of 2568	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	37
PID 2064 wrote to memory of 2568	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	37
PID 2064 wrote to memory of 2568	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	37
PID 2064 wrote to memory of 2212	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	38
PID 2064 wrote to memory of 2212	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	38
PID 2064 wrote to memory of 2212	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	38
PID 2064 wrote to memory of 2448	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	39
PID 2064 wrote to memory of 2448	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	39
PID 2064 wrote to memory of 2448	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	39
PID 2064 wrote to memory of 2500	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	40
PID 2064 wrote to memory of 2500	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	40
PID 2064 wrote to memory of 2500	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	40
PID 2064 wrote to memory of 2936	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	41
PID 2064 wrote to memory of 2936	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	41
PID 2064 wrote to memory of 2936	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	41
PID 2064 wrote to memory of 2600	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	42
PID 2064 wrote to memory of 2600	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	42
PID 2064 wrote to memory of 2600	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	42
PID 2064 wrote to memory of 820	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	43
PID 2064 wrote to memory of 820	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	43
PID 2064 wrote to memory of 820	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	43
PID 2064 wrote to memory of 2496	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	44
PID 2064 wrote to memory of 2496	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	44
PID 2064 wrote to memory of 2496	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	44
PID 2064 wrote to memory of 2736	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	45
PID 2064 wrote to memory of 2736	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	45
PID 2064 wrote to memory of 2736	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	45
PID 2064 wrote to memory of 1964	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	46
PID 2064 wrote to memory of 1964	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	46
PID 2064 wrote to memory of 1964	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	46
PID 2064 wrote to memory of 1704	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	47
PID 2064 wrote to memory of 1704	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	47
PID 2064 wrote to memory of 1704	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	47
PID 2064 wrote to memory of 1828	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	48
PID 2064 wrote to memory of 1828	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	48
PID 2064 wrote to memory of 1828	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	48
PID 2064 wrote to memory of 832	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	49
PID 2064 wrote to memory of 832	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	49
PID 2064 wrote to memory of 832	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	49
PID 2064 wrote to memory of 2220	2064	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System\UyAOJNP.exe
  C:\Windows\System\UyAOJNP.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\cKIKCXa.exe
  C:\Windows\System\cKIKCXa.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\diKAHfJ.exe
  C:\Windows\System\diKAHfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\JuPlLny.exe
  C:\Windows\System\JuPlLny.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\HDDNMJf.exe
  C:\Windows\System\HDDNMJf.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\JusMosy.exe
  C:\Windows\System\JusMosy.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ihrICRT.exe
  C:\Windows\System\ihrICRT.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\aJkIWsr.exe
  C:\Windows\System\aJkIWsr.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\YcQXptC.exe
  C:\Windows\System\YcQXptC.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\uqwEOTB.exe
  C:\Windows\System\uqwEOTB.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\WoPwiXg.exe
  C:\Windows\System\WoPwiXg.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\rvpwIbJ.exe
  C:\Windows\System\rvpwIbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\YUtkUpD.exe
  C:\Windows\System\YUtkUpD.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\gqJaDPY.exe
  C:\Windows\System\gqJaDPY.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\YvwTpDu.exe
  C:\Windows\System\YvwTpDu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\tbexQIx.exe
  C:\Windows\System\tbexQIx.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\OWOvCAP.exe
  C:\Windows\System\OWOvCAP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\rgnxvdt.exe
  C:\Windows\System\rgnxvdt.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\wAtkGbU.exe
  C:\Windows\System\wAtkGbU.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\oqwaQgU.exe
  C:\Windows\System\oqwaQgU.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\uwqYSPE.exe
  C:\Windows\System\uwqYSPE.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\DrGQIQi.exe
  C:\Windows\System\DrGQIQi.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\ygVSbdG.exe
  C:\Windows\System\ygVSbdG.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\JSTbsdk.exe
  C:\Windows\System\JSTbsdk.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\HPoFedx.exe
  C:\Windows\System\HPoFedx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\pJGUXVX.exe
  C:\Windows\System\pJGUXVX.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\flpdCkU.exe
  C:\Windows\System\flpdCkU.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\zheCPEi.exe
  C:\Windows\System\zheCPEi.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\NFYJNBv.exe
  C:\Windows\System\NFYJNBv.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\iePSssC.exe
  C:\Windows\System\iePSssC.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\xJWYYpW.exe
  C:\Windows\System\xJWYYpW.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\jnkxDGn.exe
  C:\Windows\System\jnkxDGn.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\AibAvVx.exe
  C:\Windows\System\AibAvVx.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\FFoJVnZ.exe
  C:\Windows\System\FFoJVnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\sflHomW.exe
  C:\Windows\System\sflHomW.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\UsjyCnG.exe
  C:\Windows\System\UsjyCnG.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\cknyhSq.exe
  C:\Windows\System\cknyhSq.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\sqErNqh.exe
  C:\Windows\System\sqErNqh.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\QZIDZfc.exe
  C:\Windows\System\QZIDZfc.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\zbjzDXZ.exe
  C:\Windows\System\zbjzDXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\qDeruyf.exe
  C:\Windows\System\qDeruyf.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\DmnvKTQ.exe
  C:\Windows\System\DmnvKTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\daeXbGD.exe
  C:\Windows\System\daeXbGD.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\gEaxeBm.exe
  C:\Windows\System\gEaxeBm.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\OhODhdJ.exe
  C:\Windows\System\OhODhdJ.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\LMOzhIP.exe
  C:\Windows\System\LMOzhIP.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\SEeltwE.exe
  C:\Windows\System\SEeltwE.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\jLfECJW.exe
  C:\Windows\System\jLfECJW.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\jxrmlVH.exe
  C:\Windows\System\jxrmlVH.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\xpUmLZH.exe
  C:\Windows\System\xpUmLZH.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\lverVzt.exe
  C:\Windows\System\lverVzt.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\tGDVoqa.exe
  C:\Windows\System\tGDVoqa.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\eyEHJQv.exe
  C:\Windows\System\eyEHJQv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\fFNFWTZ.exe
  C:\Windows\System\fFNFWTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\HDXzRRr.exe
  C:\Windows\System\HDXzRRr.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\DhvgSxx.exe
  C:\Windows\System\DhvgSxx.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\aaJsZZL.exe
  C:\Windows\System\aaJsZZL.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\ndGcMMN.exe
  C:\Windows\System\ndGcMMN.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\cqJQUay.exe
  C:\Windows\System\cqJQUay.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GnysKxw.exe
  C:\Windows\System\GnysKxw.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\jyCKUiE.exe
  C:\Windows\System\jyCKUiE.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\knksHjU.exe
  C:\Windows\System\knksHjU.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\rUHkWPY.exe
  C:\Windows\System\rUHkWPY.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\XcLJwPM.exe
  C:\Windows\System\XcLJwPM.exe
  2⤵
  PID:1268
- C:\Windows\System\KnvyXRm.exe
  C:\Windows\System\KnvyXRm.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\JwyywoW.exe
  C:\Windows\System\JwyywoW.exe
  2⤵
  PID:2020
- C:\Windows\System\DfSIJSp.exe
  C:\Windows\System\DfSIJSp.exe
  2⤵
  PID:2008
- C:\Windows\System\WGxfjyh.exe
  C:\Windows\System\WGxfjyh.exe
  2⤵
  PID:2884
- C:\Windows\System\nYNgIUf.exe
  C:\Windows\System\nYNgIUf.exe
  2⤵
  PID:2900
- C:\Windows\System\uaRmyaS.exe
  C:\Windows\System\uaRmyaS.exe
  2⤵
  PID:1340
- C:\Windows\System\DiBjVcH.exe
  C:\Windows\System\DiBjVcH.exe
  2⤵
  PID:2584
- C:\Windows\System\IirqSHc.exe
  C:\Windows\System\IirqSHc.exe
  2⤵
  PID:1148
- C:\Windows\System\jMXDAXg.exe
  C:\Windows\System\jMXDAXg.exe
  2⤵
  PID:2728
- C:\Windows\System\TOBxpCu.exe
  C:\Windows\System\TOBxpCu.exe
  2⤵
  PID:912
- C:\Windows\System\VSHZqLT.exe
  C:\Windows\System\VSHZqLT.exe
  2⤵
  PID:2544
- C:\Windows\System\apAtGss.exe
  C:\Windows\System\apAtGss.exe
  2⤵
  PID:1640
- C:\Windows\System\iNZfuQB.exe
  C:\Windows\System\iNZfuQB.exe
  2⤵
  PID:1448
- C:\Windows\System\BUuckJx.exe
  C:\Windows\System\BUuckJx.exe
  2⤵
  PID:1800
- C:\Windows\System\IMQVaDC.exe
  C:\Windows\System\IMQVaDC.exe
  2⤵
  PID:1600
- C:\Windows\System\QLLaIGe.exe
  C:\Windows\System\QLLaIGe.exe
  2⤵
  PID:1632
- C:\Windows\System\YBDLUcC.exe
  C:\Windows\System\YBDLUcC.exe
  2⤵
  PID:2140
- C:\Windows\System\rrxTVpZ.exe
  C:\Windows\System\rrxTVpZ.exe
  2⤵
  PID:1536
- C:\Windows\System\LTihmHK.exe
  C:\Windows\System\LTihmHK.exe
  2⤵
  PID:3044
- C:\Windows\System\iqfStSw.exe
  C:\Windows\System\iqfStSw.exe
  2⤵
  PID:1616
- C:\Windows\System\hMNFxEn.exe
  C:\Windows\System\hMNFxEn.exe
  2⤵
  PID:1248
- C:\Windows\System\cpXCZno.exe
  C:\Windows\System\cpXCZno.exe
  2⤵
  PID:2792
- C:\Windows\System\ITjrCCP.exe
  C:\Windows\System\ITjrCCP.exe
  2⤵
  PID:2492
- C:\Windows\System\LThHQOR.exe
  C:\Windows\System\LThHQOR.exe
  2⤵
  PID:2752
- C:\Windows\System\adOOZPH.exe
  C:\Windows\System\adOOZPH.exe
  2⤵
  PID:2632
- C:\Windows\System\frbZbgp.exe
  C:\Windows\System\frbZbgp.exe
  2⤵
  PID:2692
- C:\Windows\System\YwdNHXf.exe
  C:\Windows\System\YwdNHXf.exe
  2⤵
  PID:2864
- C:\Windows\System\bqpFqeJ.exe
  C:\Windows\System\bqpFqeJ.exe
  2⤵
  PID:1320
- C:\Windows\System\KiAaYeI.exe
  C:\Windows\System\KiAaYeI.exe
  2⤵
  PID:2036
- C:\Windows\System\TvzknFX.exe
  C:\Windows\System\TvzknFX.exe
  2⤵
  PID:2940
- C:\Windows\System\kvBOGpd.exe
  C:\Windows\System\kvBOGpd.exe
  2⤵
  PID:1592
- C:\Windows\System\crzHTiz.exe
  C:\Windows\System\crzHTiz.exe
  2⤵
  PID:2352
- C:\Windows\System\XBpruLd.exe
  C:\Windows\System\XBpruLd.exe
  2⤵
  PID:2664
- C:\Windows\System\vSnQqQS.exe
  C:\Windows\System\vSnQqQS.exe
  2⤵
  PID:2452
- C:\Windows\System\HeBPNRU.exe
  C:\Windows\System\HeBPNRU.exe
  2⤵
  PID:1780
- C:\Windows\System\exZSoRq.exe
  C:\Windows\System\exZSoRq.exe
  2⤵
  PID:2204
- C:\Windows\System\UNHfajq.exe
  C:\Windows\System\UNHfajq.exe
  2⤵
  PID:2440
- C:\Windows\System\CPFwNmh.exe
  C:\Windows\System\CPFwNmh.exe
  2⤵
  PID:3012
- C:\Windows\System\sNXaMnm.exe
  C:\Windows\System\sNXaMnm.exe
  2⤵
  PID:1052
- C:\Windows\System\TCPMmyv.exe
  C:\Windows\System\TCPMmyv.exe
  2⤵
  PID:2332
- C:\Windows\System\HfWABMP.exe
  C:\Windows\System\HfWABMP.exe
  2⤵
  PID:2308
- C:\Windows\System\obWZxzY.exe
  C:\Windows\System\obWZxzY.exe
  2⤵
  PID:928
- C:\Windows\System\MsVEcsk.exe
  C:\Windows\System\MsVEcsk.exe
  2⤵
  PID:2516
- C:\Windows\System\CFniQKk.exe
  C:\Windows\System\CFniQKk.exe
  2⤵
  PID:2168
- C:\Windows\System\tczNeEH.exe
  C:\Windows\System\tczNeEH.exe
  2⤵
  PID:1500
- C:\Windows\System\iRgEvjG.exe
  C:\Windows\System\iRgEvjG.exe
  2⤵
  PID:2096
- C:\Windows\System\OTxlFOl.exe
  C:\Windows\System\OTxlFOl.exe
  2⤵
  PID:2676
- C:\Windows\System\BAmqftm.exe
  C:\Windows\System\BAmqftm.exe
  2⤵
  PID:2424
- C:\Windows\System\RVHtQwV.exe
  C:\Windows\System\RVHtQwV.exe
  2⤵
  PID:1804
- C:\Windows\System\HuCIlRk.exe
  C:\Windows\System\HuCIlRk.exe
  2⤵
  PID:2312
- C:\Windows\System\CZXaYno.exe
  C:\Windows\System\CZXaYno.exe
  2⤵
  PID:1068
- C:\Windows\System\AUFrYGX.exe
  C:\Windows\System\AUFrYGX.exe
  2⤵
  PID:2800
- C:\Windows\System\FOudqLW.exe
  C:\Windows\System\FOudqLW.exe
  2⤵
  PID:1028
- C:\Windows\System\FMINlww.exe
  C:\Windows\System\FMINlww.exe
  2⤵
  PID:1968
- C:\Windows\System\AhFvQvp.exe
  C:\Windows\System\AhFvQvp.exe
  2⤵
  PID:3076
- C:\Windows\System\icmPiaf.exe
  C:\Windows\System\icmPiaf.exe
  2⤵
  PID:3092
- C:\Windows\System\cIEpsIf.exe
  C:\Windows\System\cIEpsIf.exe
  2⤵
  PID:3108
- C:\Windows\System\JjViVIq.exe
  C:\Windows\System\JjViVIq.exe
  2⤵
  PID:3276
- C:\Windows\System\oeMZOTg.exe
  C:\Windows\System\oeMZOTg.exe
  2⤵
  PID:3292
- C:\Windows\System\kPzStAZ.exe
  C:\Windows\System\kPzStAZ.exe
  2⤵
  PID:3308
- C:\Windows\System\emmCtrm.exe
  C:\Windows\System\emmCtrm.exe
  2⤵
  PID:3328
- C:\Windows\System\IjaiJET.exe
  C:\Windows\System\IjaiJET.exe
  2⤵
  PID:3344
- C:\Windows\System\ngMLltU.exe
  C:\Windows\System\ngMLltU.exe
  2⤵
  PID:3360
- C:\Windows\System\cQQINUf.exe
  C:\Windows\System\cQQINUf.exe
  2⤵
  PID:3376
- C:\Windows\System\mThqgBu.exe
  C:\Windows\System\mThqgBu.exe
  2⤵
  PID:3392
- C:\Windows\System\RXKwTtN.exe
  C:\Windows\System\RXKwTtN.exe
  2⤵
  PID:3408
- C:\Windows\System\rJejQVU.exe
  C:\Windows\System\rJejQVU.exe
  2⤵
  PID:3424
- C:\Windows\System\BtCNbGZ.exe
  C:\Windows\System\BtCNbGZ.exe
  2⤵
  PID:3440
- C:\Windows\System\LFPKyjC.exe
  C:\Windows\System\LFPKyjC.exe
  2⤵
  PID:3504
- C:\Windows\System\lNWRvRm.exe
  C:\Windows\System\lNWRvRm.exe
  2⤵
  PID:3528
- C:\Windows\System\yFhvshT.exe
  C:\Windows\System\yFhvshT.exe
  2⤵
  PID:3544
- C:\Windows\System\KwHegpr.exe
  C:\Windows\System\KwHegpr.exe
  2⤵
  PID:3564
- C:\Windows\System\nPYURlu.exe
  C:\Windows\System\nPYURlu.exe
  2⤵
  PID:3580
- C:\Windows\System\UjOsCgl.exe
  C:\Windows\System\UjOsCgl.exe
  2⤵
  PID:3600
- C:\Windows\System\ppbkwio.exe
  C:\Windows\System\ppbkwio.exe
  2⤵
  PID:3620
- C:\Windows\System\LiSuQWw.exe
  C:\Windows\System\LiSuQWw.exe
  2⤵
  PID:3640
- C:\Windows\System\vCqkRyZ.exe
  C:\Windows\System\vCqkRyZ.exe
  2⤵
  PID:3660
- C:\Windows\System\rRZlNZD.exe
  C:\Windows\System\rRZlNZD.exe
  2⤵
  PID:3680
- C:\Windows\System\doCiEfT.exe
  C:\Windows\System\doCiEfT.exe
  2⤵
  PID:3704
- C:\Windows\System\OhYwfqt.exe
  C:\Windows\System\OhYwfqt.exe
  2⤵
  PID:3724
- C:\Windows\System\DcPcRlV.exe
  C:\Windows\System\DcPcRlV.exe
  2⤵
  PID:3744
- C:\Windows\System\nDncVFA.exe
  C:\Windows\System\nDncVFA.exe
  2⤵
  PID:3764
- C:\Windows\System\KvMwziT.exe
  C:\Windows\System\KvMwziT.exe
  2⤵
  PID:3780
- C:\Windows\System\aEYyPsK.exe
  C:\Windows\System\aEYyPsK.exe
  2⤵
  PID:3804
- C:\Windows\System\ocaofYg.exe
  C:\Windows\System\ocaofYg.exe
  2⤵
  PID:3820
- C:\Windows\System\WiWRjaA.exe
  C:\Windows\System\WiWRjaA.exe
  2⤵
  PID:3844
- C:\Windows\System\XRKEmIn.exe
  C:\Windows\System\XRKEmIn.exe
  2⤵
  PID:3860
- C:\Windows\System\xtxVnLw.exe
  C:\Windows\System\xtxVnLw.exe
  2⤵
  PID:3896
- C:\Windows\System\TTPHMcV.exe
  C:\Windows\System\TTPHMcV.exe
  2⤵
  PID:3912
- C:\Windows\System\shoLZGF.exe
  C:\Windows\System\shoLZGF.exe
  2⤵
  PID:3936
- C:\Windows\System\EhioCeF.exe
  C:\Windows\System\EhioCeF.exe
  2⤵
  PID:3952
- C:\Windows\System\sObLdRR.exe
  C:\Windows\System\sObLdRR.exe
  2⤵
  PID:3972
- C:\Windows\System\PIoiXrk.exe
  C:\Windows\System\PIoiXrk.exe
  2⤵
  PID:3988
- C:\Windows\System\aiurhmR.exe
  C:\Windows\System\aiurhmR.exe
  2⤵
  PID:4012
- C:\Windows\System\Nxpkfhd.exe
  C:\Windows\System\Nxpkfhd.exe
  2⤵
  PID:4028
- C:\Windows\System\JbHbhgh.exe
  C:\Windows\System\JbHbhgh.exe
  2⤵
  PID:4052
- C:\Windows\System\MHaZxPF.exe
  C:\Windows\System\MHaZxPF.exe
  2⤵
  PID:4076
- C:\Windows\System\REaVcUf.exe
  C:\Windows\System\REaVcUf.exe
  2⤵
  PID:1164
- C:\Windows\System\qLOknbY.exe
  C:\Windows\System\qLOknbY.exe
  2⤵
  PID:2832
- C:\Windows\System\iCVqdIy.exe
  C:\Windows\System\iCVqdIy.exe
  2⤵
  PID:2916
- C:\Windows\System\IHwFNPg.exe
  C:\Windows\System\IHwFNPg.exe
  2⤵
  PID:3084
- C:\Windows\System\eMMdAgJ.exe
  C:\Windows\System\eMMdAgJ.exe
  2⤵
  PID:480
- C:\Windows\System\msQaatZ.exe
  C:\Windows\System\msQaatZ.exe
  2⤵
  PID:648
- C:\Windows\System\SPTfHbU.exe
  C:\Windows\System\SPTfHbU.exe
  2⤵
  PID:2216
- C:\Windows\System\zZdMiTg.exe
  C:\Windows\System\zZdMiTg.exe
  2⤵
  PID:2668
- C:\Windows\System\EUWVXfP.exe
  C:\Windows\System\EUWVXfP.exe
  2⤵
  PID:1692
- C:\Windows\System\jIPUzxZ.exe
  C:\Windows\System\jIPUzxZ.exe
  2⤵
  PID:2068
- C:\Windows\System\RaGUqgm.exe
  C:\Windows\System\RaGUqgm.exe
  2⤵
  PID:2576
- C:\Windows\System\zwoxQGl.exe
  C:\Windows\System\zwoxQGl.exe
  2⤵
  PID:3116
- C:\Windows\System\EitmIsy.exe
  C:\Windows\System\EitmIsy.exe
  2⤵
  PID:3132
- C:\Windows\System\poiBUtq.exe
  C:\Windows\System\poiBUtq.exe
  2⤵
  PID:3148
- C:\Windows\System\PCetWzJ.exe
  C:\Windows\System\PCetWzJ.exe
  2⤵
  PID:3168
- C:\Windows\System\yJrHfwd.exe
  C:\Windows\System\yJrHfwd.exe
  2⤵
  PID:656
- C:\Windows\System\MMVzPUM.exe
  C:\Windows\System\MMVzPUM.exe
  2⤵
  PID:2652
- C:\Windows\System\aLhMEOq.exe
  C:\Windows\System\aLhMEOq.exe
  2⤵
  PID:2320
- C:\Windows\System\NUmRrQo.exe
  C:\Windows\System\NUmRrQo.exe
  2⤵
  PID:2976
- C:\Windows\System\LTxZAlT.exe
  C:\Windows\System\LTxZAlT.exe
  2⤵
  PID:3264
- C:\Windows\System\AiDqdib.exe
  C:\Windows\System\AiDqdib.exe
  2⤵
  PID:2288
- C:\Windows\System\uXWUwZI.exe
  C:\Windows\System\uXWUwZI.exe
  2⤵
  PID:3400
- C:\Windows\System\CRtBTKT.exe
  C:\Windows\System\CRtBTKT.exe
  2⤵
  PID:1776
- C:\Windows\System\IuvnKRA.exe
  C:\Windows\System\IuvnKRA.exe
  2⤵
  PID:3268
- C:\Windows\System\CmttIoZ.exe
  C:\Windows\System\CmttIoZ.exe
  2⤵
  PID:3352
- C:\Windows\System\UrHpGQh.exe
  C:\Windows\System\UrHpGQh.exe
  2⤵
  PID:3416
- C:\Windows\System\sKqMUrU.exe
  C:\Windows\System\sKqMUrU.exe
  2⤵
  PID:3472
- C:\Windows\System\xnTVjgf.exe
  C:\Windows\System\xnTVjgf.exe
  2⤵
  PID:3516
- C:\Windows\System\NKWNfOv.exe
  C:\Windows\System\NKWNfOv.exe
  2⤵
  PID:1156
- C:\Windows\System\tHQrgpB.exe
  C:\Windows\System\tHQrgpB.exe
  2⤵
  PID:3556
- C:\Windows\System\hNiVTUI.exe
  C:\Windows\System\hNiVTUI.exe
  2⤵
  PID:3492
- C:\Windows\System\MzlTVXC.exe
  C:\Windows\System\MzlTVXC.exe
  2⤵
  PID:3460
- C:\Windows\System\YkVwpRf.exe
  C:\Windows\System\YkVwpRf.exe
  2⤵
  PID:3452
- C:\Windows\System\MYADxWi.exe
  C:\Windows\System\MYADxWi.exe
  2⤵
  PID:3536
- C:\Windows\System\trxnSsW.exe
  C:\Windows\System\trxnSsW.exe
  2⤵
  PID:1980
- C:\Windows\System\iTuemwU.exe
  C:\Windows\System\iTuemwU.exe
  2⤵
  PID:3488
- C:\Windows\System\FURYgaT.exe
  C:\Windows\System\FURYgaT.exe
  2⤵
  PID:3672
- C:\Windows\System\vMAwiXQ.exe
  C:\Windows\System\vMAwiXQ.exe
  2⤵
  PID:3720
- C:\Windows\System\MjHsbGx.exe
  C:\Windows\System\MjHsbGx.exe
  2⤵
  PID:3752
- C:\Windows\System\JdAUrdN.exe
  C:\Windows\System\JdAUrdN.exe
  2⤵
  PID:3692
- C:\Windows\System\kSwJIhL.exe
  C:\Windows\System\kSwJIhL.exe
  2⤵
  PID:3700
- C:\Windows\System\raVNIYb.exe
  C:\Windows\System\raVNIYb.exe
  2⤵
  PID:3828
- C:\Windows\System\xannpdN.exe
  C:\Windows\System\xannpdN.exe
  2⤵
  PID:112
- C:\Windows\System\DxgLurj.exe
  C:\Windows\System\DxgLurj.exe
  2⤵
  PID:3876
- C:\Windows\System\TVXTaXd.exe
  C:\Windows\System\TVXTaXd.exe
  2⤵
  PID:3924
- C:\Windows\System\EDLodBx.exe
  C:\Windows\System\EDLodBx.exe
  2⤵
  PID:3960
- C:\Windows\System\HjXBHuA.exe
  C:\Windows\System\HjXBHuA.exe
  2⤵
  PID:908
- C:\Windows\System\MxaMaXU.exe
  C:\Windows\System\MxaMaXU.exe
  2⤵
  PID:4004
- C:\Windows\System\jTOnXgJ.exe
  C:\Windows\System\jTOnXgJ.exe
  2⤵
  PID:4000
- C:\Windows\System\IhDRLxC.exe
  C:\Windows\System\IhDRLxC.exe
  2⤵
  PID:4044
- C:\Windows\System\kyPScEv.exe
  C:\Windows\System\kyPScEv.exe
  2⤵
  PID:3984
- C:\Windows\System\SCbVisM.exe
  C:\Windows\System\SCbVisM.exe
  2⤵
  PID:4020
- C:\Windows\System\yuDsATb.exe
  C:\Windows\System\yuDsATb.exe
  2⤵
  PID:4064
- C:\Windows\System\wXVZNzt.exe
  C:\Windows\System\wXVZNzt.exe
  2⤵
  PID:2072
- C:\Windows\System\eUsWrDK.exe
  C:\Windows\System\eUsWrDK.exe
  2⤵
  PID:2316
- C:\Windows\System\iUzwHlE.exe
  C:\Windows\System\iUzwHlE.exe
  2⤵
  PID:2628
- C:\Windows\System\OVvwNHv.exe
  C:\Windows\System\OVvwNHv.exe
  2⤵
  PID:1220
- C:\Windows\System\zSnAbIB.exe
  C:\Windows\System\zSnAbIB.exe
  2⤵
  PID:2980
- C:\Windows\System\nlTVLGK.exe
  C:\Windows\System\nlTVLGK.exe
  2⤵
  PID:3484
- C:\Windows\System\PvFjdjq.exe
  C:\Windows\System\PvFjdjq.exe
  2⤵
  PID:3588
- C:\Windows\System\KJchawD.exe
  C:\Windows\System\KJchawD.exe
  2⤵
  PID:3636
- C:\Windows\System\DmRSgHq.exe
  C:\Windows\System\DmRSgHq.exe
  2⤵
  PID:3560
- C:\Windows\System\ulTJQNO.exe
  C:\Windows\System\ulTJQNO.exe
  2⤵
  PID:3456
- C:\Windows\System\OENsMbC.exe
  C:\Windows\System\OENsMbC.exe
  2⤵
  PID:3832
- C:\Windows\System\yzqYMQd.exe
  C:\Windows\System\yzqYMQd.exe
  2⤵
  PID:3884
- C:\Windows\System\QJowDsj.exe
  C:\Windows\System\QJowDsj.exe
  2⤵
  PID:3980
- C:\Windows\System\DtnCicT.exe
  C:\Windows\System\DtnCicT.exe
  2⤵
  PID:3008
- C:\Windows\System\bKtqFiN.exe
  C:\Windows\System\bKtqFiN.exe
  2⤵
  PID:3572
- C:\Windows\System\LMLaLTu.exe
  C:\Windows\System\LMLaLTu.exe
  2⤵
  PID:3756
- C:\Windows\System\hyoPsXh.exe
  C:\Windows\System\hyoPsXh.exe
  2⤵
  PID:3776
- C:\Windows\System\KQQMRgH.exe
  C:\Windows\System\KQQMRgH.exe
  2⤵
  PID:3908
- C:\Windows\System\DPmYAsJ.exe
  C:\Windows\System\DPmYAsJ.exe
  2⤵
  PID:4088
- C:\Windows\System\sUuPOaI.exe
  C:\Windows\System\sUuPOaI.exe
  2⤵
  PID:2224
- C:\Windows\System\dRHefUE.exe
  C:\Windows\System\dRHefUE.exe
  2⤵
  PID:4100
- C:\Windows\System\zmkdHEh.exe
  C:\Windows\System\zmkdHEh.exe
  2⤵
  PID:4116
- C:\Windows\System\iyeXEDV.exe
  C:\Windows\System\iyeXEDV.exe
  2⤵
  PID:4132
- C:\Windows\System\Khcgcyv.exe
  C:\Windows\System\Khcgcyv.exe
  2⤵
  PID:4148
- C:\Windows\System\hNHZiCs.exe
  C:\Windows\System\hNHZiCs.exe
  2⤵
  PID:4164
- C:\Windows\System\odjnjMu.exe
  C:\Windows\System\odjnjMu.exe
  2⤵
  PID:4180
- C:\Windows\System\IIpGpAQ.exe
  C:\Windows\System\IIpGpAQ.exe
  2⤵
  PID:4196
- C:\Windows\System\iksVoTH.exe
  C:\Windows\System\iksVoTH.exe
  2⤵
  PID:4212
- C:\Windows\System\nfgcPMT.exe
  C:\Windows\System\nfgcPMT.exe
  2⤵
  PID:4228
- C:\Windows\System\kbxUqGD.exe
  C:\Windows\System\kbxUqGD.exe
  2⤵
  PID:4244
- C:\Windows\System\dCUrgWG.exe
  C:\Windows\System\dCUrgWG.exe
  2⤵
  PID:4260
- C:\Windows\System\QMbvLhE.exe
  C:\Windows\System\QMbvLhE.exe
  2⤵
  PID:4276
- C:\Windows\System\uUainNc.exe
  C:\Windows\System\uUainNc.exe
  2⤵
  PID:4292
- C:\Windows\System\tDxEmaW.exe
  C:\Windows\System\tDxEmaW.exe
  2⤵
  PID:4308
- C:\Windows\System\RWUItTF.exe
  C:\Windows\System\RWUItTF.exe
  2⤵
  PID:4324
- C:\Windows\System\XSVXsKz.exe
  C:\Windows\System\XSVXsKz.exe
  2⤵
  PID:4340
- C:\Windows\System\HaiLYQJ.exe
  C:\Windows\System\HaiLYQJ.exe
  2⤵
  PID:4356
- C:\Windows\System\ytLuqgn.exe
  C:\Windows\System\ytLuqgn.exe
  2⤵
  PID:4372
- C:\Windows\System\TAEeMDX.exe
  C:\Windows\System\TAEeMDX.exe
  2⤵
  PID:4388
- C:\Windows\System\kYlEIZk.exe
  C:\Windows\System\kYlEIZk.exe
  2⤵
  PID:4404
- C:\Windows\System\wqLTrxG.exe
  C:\Windows\System\wqLTrxG.exe
  2⤵
  PID:4420
- C:\Windows\System\NLFIfPR.exe
  C:\Windows\System\NLFIfPR.exe
  2⤵
  PID:4436
- C:\Windows\System\PlHwdbP.exe
  C:\Windows\System\PlHwdbP.exe
  2⤵
  PID:4464
- C:\Windows\System\cyWirAP.exe
  C:\Windows\System\cyWirAP.exe
  2⤵
  PID:4480
- C:\Windows\System\IECScTS.exe
  C:\Windows\System\IECScTS.exe
  2⤵
  PID:4496
- C:\Windows\System\PMzNBXv.exe
  C:\Windows\System\PMzNBXv.exe
  2⤵
  PID:4512
- C:\Windows\System\dfNfjhQ.exe
  C:\Windows\System\dfNfjhQ.exe
  2⤵
  PID:4528
- C:\Windows\System\DBKKZng.exe
  C:\Windows\System\DBKKZng.exe
  2⤵
  PID:4544
- C:\Windows\System\ldRIgle.exe
  C:\Windows\System\ldRIgle.exe
  2⤵
  PID:4560
- C:\Windows\System\pDosESe.exe
  C:\Windows\System\pDosESe.exe
  2⤵
  PID:4576
- C:\Windows\System\JfPsAuc.exe
  C:\Windows\System\JfPsAuc.exe
  2⤵
  PID:4592
- C:\Windows\System\cxPgUJA.exe
  C:\Windows\System\cxPgUJA.exe
  2⤵
  PID:4608
- C:\Windows\System\GfuolVi.exe
  C:\Windows\System\GfuolVi.exe
  2⤵
  PID:4624
- C:\Windows\System\pxeJKFi.exe
  C:\Windows\System\pxeJKFi.exe
  2⤵
  PID:4640
- C:\Windows\System\fRSVRoF.exe
  C:\Windows\System\fRSVRoF.exe
  2⤵
  PID:4656
- C:\Windows\System\NEIQjNH.exe
  C:\Windows\System\NEIQjNH.exe
  2⤵
  PID:4672
- C:\Windows\System\NOiSBwv.exe
  C:\Windows\System\NOiSBwv.exe
  2⤵
  PID:4688
- C:\Windows\System\BamLUtJ.exe
  C:\Windows\System\BamLUtJ.exe
  2⤵
  PID:4704
- C:\Windows\System\PVjRevp.exe
  C:\Windows\System\PVjRevp.exe
  2⤵
  PID:4720
- C:\Windows\System\OpCXqVt.exe
  C:\Windows\System\OpCXqVt.exe
  2⤵
  PID:4736
- C:\Windows\System\mvGkMCM.exe
  C:\Windows\System\mvGkMCM.exe
  2⤵
  PID:4756
- C:\Windows\System\kvuGhxq.exe
  C:\Windows\System\kvuGhxq.exe
  2⤵
  PID:4772
- C:\Windows\System\UhNgyij.exe
  C:\Windows\System\UhNgyij.exe
  2⤵
  PID:4788
- C:\Windows\System\LlPzokE.exe
  C:\Windows\System\LlPzokE.exe
  2⤵
  PID:4804
- C:\Windows\System\jvuqsLr.exe
  C:\Windows\System\jvuqsLr.exe
  2⤵
  PID:4820
- C:\Windows\System\HtsdISC.exe
  C:\Windows\System\HtsdISC.exe
  2⤵
  PID:4836
- C:\Windows\System\aMFiBPc.exe
  C:\Windows\System\aMFiBPc.exe
  2⤵
  PID:4852
- C:\Windows\System\fGdTSfp.exe
  C:\Windows\System\fGdTSfp.exe
  2⤵
  PID:4868
- C:\Windows\System\jtdjWqc.exe
  C:\Windows\System\jtdjWqc.exe
  2⤵
  PID:4884
- C:\Windows\System\UjOotzr.exe
  C:\Windows\System\UjOotzr.exe
  2⤵
  PID:4900
- C:\Windows\System\rfjjsTf.exe
  C:\Windows\System\rfjjsTf.exe
  2⤵
  PID:4916
- C:\Windows\System\IfcIMQG.exe
  C:\Windows\System\IfcIMQG.exe
  2⤵
  PID:4932
- C:\Windows\System\naTclaP.exe
  C:\Windows\System\naTclaP.exe
  2⤵
  PID:4948
- C:\Windows\System\GIAZRyh.exe
  C:\Windows\System\GIAZRyh.exe
  2⤵
  PID:4964
- C:\Windows\System\CoHjeBf.exe
  C:\Windows\System\CoHjeBf.exe
  2⤵
  PID:4980
- C:\Windows\System\kXzROnb.exe
  C:\Windows\System\kXzROnb.exe
  2⤵
  PID:4996
- C:\Windows\System\abWGAgQ.exe
  C:\Windows\System\abWGAgQ.exe
  2⤵
  PID:5012
- C:\Windows\System\yYEjTxF.exe
  C:\Windows\System\yYEjTxF.exe
  2⤵
  PID:5028
- C:\Windows\System\CCjBPhF.exe
  C:\Windows\System\CCjBPhF.exe
  2⤵
  PID:5044
- C:\Windows\System\ujXDevk.exe
  C:\Windows\System\ujXDevk.exe
  2⤵
  PID:5080
- C:\Windows\System\iQHriCF.exe
  C:\Windows\System\iQHriCF.exe
  2⤵
  PID:5096
- C:\Windows\System\xjdflMV.exe
  C:\Windows\System\xjdflMV.exe
  2⤵
  PID:5112
- C:\Windows\System\WkKZNpK.exe
  C:\Windows\System\WkKZNpK.exe
  2⤵
  PID:3088
- C:\Windows\System\IITDyTA.exe
  C:\Windows\System\IITDyTA.exe
  2⤵
  PID:3652
- C:\Windows\System\kjXLpvJ.exe
  C:\Windows\System\kjXLpvJ.exe
  2⤵
  PID:2756
- C:\Windows\System\FFBHgpg.exe
  C:\Windows\System\FFBHgpg.exe
  2⤵
  PID:3740
- C:\Windows\System\QExgJLf.exe
  C:\Windows\System\QExgJLf.exe
  2⤵
  PID:1376
- C:\Windows\System\LkCVhoE.exe
  C:\Windows\System\LkCVhoE.exe
  2⤵
  PID:4364
- C:\Windows\System\iBhttjK.exe
  C:\Windows\System\iBhttjK.exe
  2⤵
  PID:3304
- C:\Windows\System\xtUSili.exe
  C:\Windows\System\xtUSili.exe
  2⤵
  PID:3436
- C:\Windows\System\POxNUiJ.exe
  C:\Windows\System\POxNUiJ.exe
  2⤵
  PID:2696
- C:\Windows\System\jsQZasg.exe
  C:\Windows\System\jsQZasg.exe
  2⤵
  PID:3372
- C:\Windows\System\ygczydK.exe
  C:\Windows\System\ygczydK.exe
  2⤵
  PID:3144
- C:\Windows\System\YCLCtSx.exe
  C:\Windows\System\YCLCtSx.exe
  2⤵
  PID:4112
- C:\Windows\System\vhMwhKY.exe
  C:\Windows\System\vhMwhKY.exe
  2⤵
  PID:4172
- C:\Windows\System\vNjsulg.exe
  C:\Windows\System\vNjsulg.exe
  2⤵
  PID:4236
- C:\Windows\System\DAAHNNg.exe
  C:\Windows\System\DAAHNNg.exe
  2⤵
  PID:4300
- C:\Windows\System\AKyaWoo.exe
  C:\Windows\System\AKyaWoo.exe
  2⤵
  PID:4336
- C:\Windows\System\kSHmLiL.exe
  C:\Windows\System\kSHmLiL.exe
  2⤵
  PID:4428
- C:\Windows\System\kMbjyAA.exe
  C:\Windows\System\kMbjyAA.exe
  2⤵
  PID:2476
- C:\Windows\System\uJGiXmT.exe
  C:\Windows\System\uJGiXmT.exe
  2⤵
  PID:1496
- C:\Windows\System\hzQpEKm.exe
  C:\Windows\System\hzQpEKm.exe
  2⤵
  PID:3732
- C:\Windows\System\FXGUquF.exe
  C:\Windows\System\FXGUquF.exe
  2⤵
  PID:4156
- C:\Windows\System\ZNTyhNx.exe
  C:\Windows\System\ZNTyhNx.exe
  2⤵
  PID:4220
- C:\Windows\System\hoRXtnD.exe
  C:\Windows\System\hoRXtnD.exe
  2⤵
  PID:4320
- C:\Windows\System\xXcaRSL.exe
  C:\Windows\System\xXcaRSL.exe
  2⤵
  PID:4384
- C:\Windows\System\EPwsdPB.exe
  C:\Windows\System\EPwsdPB.exe
  2⤵
  PID:4476
- C:\Windows\System\iUjmgzy.exe
  C:\Windows\System\iUjmgzy.exe
  2⤵
  PID:4540
- C:\Windows\System\wegrQTd.exe
  C:\Windows\System\wegrQTd.exe
  2⤵
  PID:4604
- C:\Windows\System\jRPbgDZ.exe
  C:\Windows\System\jRPbgDZ.exe
  2⤵
  PID:4668
- C:\Windows\System\AkKnadD.exe
  C:\Windows\System\AkKnadD.exe
  2⤵
  PID:4732
- C:\Windows\System\PRGaZaG.exe
  C:\Windows\System\PRGaZaG.exe
  2⤵
  PID:4928
- C:\Windows\System\RGhguVV.exe
  C:\Windows\System\RGhguVV.exe
  2⤵
  PID:1784
- C:\Windows\System\FYSiDhm.exe
  C:\Windows\System\FYSiDhm.exe
  2⤵
  PID:4472
- C:\Windows\System\aDkhxNM.exe
  C:\Windows\System\aDkhxNM.exe
  2⤵
  PID:3676
- C:\Windows\System\cmWJVUX.exe
  C:\Windows\System\cmWJVUX.exe
  2⤵
  PID:2572
- C:\Windows\System\POpmfab.exe
  C:\Windows\System\POpmfab.exe
  2⤵
  PID:4800
- C:\Windows\System\jssmrvv.exe
  C:\Windows\System\jssmrvv.exe
  2⤵
  PID:4892
- C:\Windows\System\zSmAlTV.exe
  C:\Windows\System\zSmAlTV.exe
  2⤵
  PID:5024
- C:\Windows\System\ouvaDwX.exe
  C:\Windows\System\ouvaDwX.exe
  2⤵
  PID:4492
- C:\Windows\System\AjQwdUC.exe
  C:\Windows\System\AjQwdUC.exe
  2⤵
  PID:4556
- C:\Windows\System\uXBQbDg.exe
  C:\Windows\System\uXBQbDg.exe
  2⤵
  PID:4620
- C:\Windows\System\fhHmqbK.exe
  C:\Windows\System\fhHmqbK.exe
  2⤵
  PID:4712
- C:\Windows\System\hIqmfGb.exe
  C:\Windows\System\hIqmfGb.exe
  2⤵
  PID:4780
- C:\Windows\System\wLWVSvE.exe
  C:\Windows\System\wLWVSvE.exe
  2⤵
  PID:4848
- C:\Windows\System\RvDzavl.exe
  C:\Windows\System\RvDzavl.exe
  2⤵
  PID:4944
- C:\Windows\System\lBPKBAN.exe
  C:\Windows\System\lBPKBAN.exe
  2⤵
  PID:5008
- C:\Windows\System\yLySAbV.exe
  C:\Windows\System\yLySAbV.exe
  2⤵
  PID:5076
- C:\Windows\System\HPmcCsZ.exe
  C:\Windows\System\HPmcCsZ.exe
  2⤵
  PID:3668
- C:\Windows\System\oSZBTYp.exe
  C:\Windows\System\oSZBTYp.exe
  2⤵
  PID:1772
- C:\Windows\System\wPeTOOs.exe
  C:\Windows\System\wPeTOOs.exe
  2⤵
  PID:3340
- C:\Windows\System\TQZgliV.exe
  C:\Windows\System\TQZgliV.exe
  2⤵
  PID:4208
- C:\Windows\System\RRHQaaq.exe
  C:\Windows\System\RRHQaaq.exe
  2⤵
  PID:3156
- C:\Windows\System\GAoGzth.exe
  C:\Windows\System\GAoGzth.exe
  2⤵
  PID:4192
- C:\Windows\System\PVddVZr.exe
  C:\Windows\System\PVddVZr.exe
  2⤵
  PID:4536
- C:\Windows\System\LIfvZhd.exe
  C:\Windows\System\LIfvZhd.exe
  2⤵
  PID:4768
- C:\Windows\System\BqQqVfF.exe
  C:\Windows\System\BqQqVfF.exe
  2⤵
  PID:3368
- C:\Windows\System\awWLgiv.exe
  C:\Windows\System\awWLgiv.exe
  2⤵
  PID:4460
- C:\Windows\System\UzbhEch.exe
  C:\Windows\System\UzbhEch.exe
  2⤵
  PID:4812
- C:\Windows\System\oppxFYb.exe
  C:\Windows\System\oppxFYb.exe
  2⤵
  PID:5092
- C:\Windows\System\sfllTIF.exe
  C:\Windows\System\sfllTIF.exe
  2⤵
  PID:3932
- C:\Windows\System\XGovrbb.exe
  C:\Windows\System\XGovrbb.exe
  2⤵
  PID:2248
- C:\Windows\System\AMBmzKv.exe
  C:\Windows\System\AMBmzKv.exe
  2⤵
  PID:3260
- C:\Windows\System\qxrYgYe.exe
  C:\Windows\System\qxrYgYe.exe
  2⤵
  PID:4272
- C:\Windows\System\ZAMjHjm.exe
  C:\Windows\System\ZAMjHjm.exe
  2⤵
  PID:3592
- C:\Windows\System\fPHdGzS.exe
  C:\Windows\System\fPHdGzS.exe
  2⤵
  PID:4288
- C:\Windows\System\eMptlUx.exe
  C:\Windows\System\eMptlUx.exe
  2⤵
  PID:4728
- C:\Windows\System\kRVqkQv.exe
  C:\Windows\System\kRVqkQv.exe
  2⤵
  PID:3552
- C:\Windows\System\dfQFINa.exe
  C:\Windows\System\dfQFINa.exe
  2⤵
  PID:5128
- C:\Windows\System\yHMcwbU.exe
  C:\Windows\System\yHMcwbU.exe
  2⤵
  PID:5144
- C:\Windows\System\tAceZqo.exe
  C:\Windows\System\tAceZqo.exe
  2⤵
  PID:5184
- C:\Windows\System\VtnvMEV.exe
  C:\Windows\System\VtnvMEV.exe
  2⤵
  PID:5200
- C:\Windows\System\JgXhLBB.exe
  C:\Windows\System\JgXhLBB.exe
  2⤵
  PID:5216
- C:\Windows\System\mSCkFMV.exe
  C:\Windows\System\mSCkFMV.exe
  2⤵
  PID:5232
- C:\Windows\System\YPIEJJS.exe
  C:\Windows\System\YPIEJJS.exe
  2⤵
  PID:5248
- C:\Windows\System\TasHVZf.exe
  C:\Windows\System\TasHVZf.exe
  2⤵
  PID:5264
- C:\Windows\System\SaMbIlM.exe
  C:\Windows\System\SaMbIlM.exe
  2⤵
  PID:5280
- C:\Windows\System\GArYzeJ.exe
  C:\Windows\System\GArYzeJ.exe
  2⤵
  PID:5296
- C:\Windows\System\gSlaUpd.exe
  C:\Windows\System\gSlaUpd.exe
  2⤵
  PID:5312
- C:\Windows\System\nAFtcWa.exe
  C:\Windows\System\nAFtcWa.exe
  2⤵
  PID:5328
- C:\Windows\System\urdknXB.exe
  C:\Windows\System\urdknXB.exe
  2⤵
  PID:5344
- C:\Windows\System\vKPOISR.exe
  C:\Windows\System\vKPOISR.exe
  2⤵
  PID:5360
- C:\Windows\System\tFWfQOy.exe
  C:\Windows\System\tFWfQOy.exe
  2⤵
  PID:5376
- C:\Windows\System\kmolGxn.exe
  C:\Windows\System\kmolGxn.exe
  2⤵
  PID:5392
- C:\Windows\System\NmzoIMU.exe
  C:\Windows\System\NmzoIMU.exe
  2⤵
  PID:5408
- C:\Windows\System\SEvACNH.exe
  C:\Windows\System\SEvACNH.exe
  2⤵
  PID:5424
- C:\Windows\System\anEtVQO.exe
  C:\Windows\System\anEtVQO.exe
  2⤵
  PID:5440
- C:\Windows\System\HSPtiCD.exe
  C:\Windows\System\HSPtiCD.exe
  2⤵
  PID:5456
- C:\Windows\System\wwZTHSZ.exe
  C:\Windows\System\wwZTHSZ.exe
  2⤵
  PID:5472
- C:\Windows\System\tnJBYbB.exe
  C:\Windows\System\tnJBYbB.exe
  2⤵
  PID:5488
- C:\Windows\System\rkAtVUv.exe
  C:\Windows\System\rkAtVUv.exe
  2⤵
  PID:5504
- C:\Windows\System\pwopyIH.exe
  C:\Windows\System\pwopyIH.exe
  2⤵
  PID:5520
- C:\Windows\System\XIwyWWD.exe
  C:\Windows\System\XIwyWWD.exe
  2⤵
  PID:5536
- C:\Windows\System\FQaWCsb.exe
  C:\Windows\System\FQaWCsb.exe
  2⤵
  PID:5552
- C:\Windows\System\KyilKco.exe
  C:\Windows\System\KyilKco.exe
  2⤵
  PID:5568
- C:\Windows\System\gNNZtFV.exe
  C:\Windows\System\gNNZtFV.exe
  2⤵
  PID:5584
- C:\Windows\System\HKsVnfE.exe
  C:\Windows\System\HKsVnfE.exe
  2⤵
  PID:5608
- C:\Windows\System\SmcbTMA.exe
  C:\Windows\System\SmcbTMA.exe
  2⤵
  PID:5624
- C:\Windows\System\ZKEKpcp.exe
  C:\Windows\System\ZKEKpcp.exe
  2⤵
  PID:5640
- C:\Windows\System\XIiRAPJ.exe
  C:\Windows\System\XIiRAPJ.exe
  2⤵
  PID:5656
- C:\Windows\System\RWUJXOq.exe
  C:\Windows\System\RWUJXOq.exe
  2⤵
  PID:5672
- C:\Windows\System\WCVQwpa.exe
  C:\Windows\System\WCVQwpa.exe
  2⤵
  PID:5688
- C:\Windows\System\OxhyXKH.exe
  C:\Windows\System\OxhyXKH.exe
  2⤵
  PID:5704
- C:\Windows\System\xLxcWhj.exe
  C:\Windows\System\xLxcWhj.exe
  2⤵
  PID:5720
- C:\Windows\System\kMlXFxl.exe
  C:\Windows\System\kMlXFxl.exe
  2⤵
  PID:5844
- C:\Windows\System\mZlXosS.exe
  C:\Windows\System\mZlXosS.exe
  2⤵
  PID:5860
- C:\Windows\System\pghPyZP.exe
  C:\Windows\System\pghPyZP.exe
  2⤵
  PID:5876
- C:\Windows\System\Pdbrhns.exe
  C:\Windows\System\Pdbrhns.exe
  2⤵
  PID:5892
- C:\Windows\System\JrGNzjP.exe
  C:\Windows\System\JrGNzjP.exe
  2⤵
  PID:5908
- C:\Windows\System\APTbmvx.exe
  C:\Windows\System\APTbmvx.exe
  2⤵
  PID:5924
- C:\Windows\System\rGSNNtF.exe
  C:\Windows\System\rGSNNtF.exe
  2⤵
  PID:5940
- C:\Windows\System\zVcxkjT.exe
  C:\Windows\System\zVcxkjT.exe
  2⤵
  PID:5956
- C:\Windows\System\NeMJwLx.exe
  C:\Windows\System\NeMJwLx.exe
  2⤵
  PID:5972
- C:\Windows\System\oZrgcaf.exe
  C:\Windows\System\oZrgcaf.exe
  2⤵
  PID:5988
- C:\Windows\System\bSqZczt.exe
  C:\Windows\System\bSqZczt.exe
  2⤵
  PID:6004
- C:\Windows\System\nnJTdsz.exe
  C:\Windows\System\nnJTdsz.exe
  2⤵
  PID:6020
- C:\Windows\System\IeDDHhi.exe
  C:\Windows\System\IeDDHhi.exe
  2⤵
  PID:6036
- C:\Windows\System\txkNEVf.exe
  C:\Windows\System\txkNEVf.exe
  2⤵
  PID:6052
- C:\Windows\System\KbENfOp.exe
  C:\Windows\System\KbENfOp.exe
  2⤵
  PID:6068
- C:\Windows\System\FgIShOl.exe
  C:\Windows\System\FgIShOl.exe
  2⤵
  PID:6084
- C:\Windows\System\JYfwoUM.exe
  C:\Windows\System\JYfwoUM.exe
  2⤵
  PID:6100
- C:\Windows\System\ehAIkVo.exe
  C:\Windows\System\ehAIkVo.exe
  2⤵
  PID:6116
- C:\Windows\System\DiPUBkk.exe
  C:\Windows\System\DiPUBkk.exe
  2⤵
  PID:6132
- C:\Windows\System\pzbCqpS.exe
  C:\Windows\System\pzbCqpS.exe
  2⤵
  PID:5056
- C:\Windows\System\dcwbciz.exe
  C:\Windows\System\dcwbciz.exe
  2⤵
  PID:4912
- C:\Windows\System\NrqDPPi.exe
  C:\Windows\System\NrqDPPi.exe
  2⤵
  PID:972
- C:\Windows\System\mSNpIvz.exe
  C:\Windows\System\mSNpIvz.exe
  2⤵
  PID:4188
- C:\Windows\System\QCZhumR.exe
  C:\Windows\System\QCZhumR.exe
  2⤵
  PID:4036
- C:\Windows\System\tcMokxz.exe
  C:\Windows\System\tcMokxz.exe
  2⤵
  PID:2436
- C:\Windows\System\RcWElFS.exe
  C:\Windows\System\RcWElFS.exe
  2⤵
  PID:4284
- C:\Windows\System\YHKGlwM.exe
  C:\Windows\System\YHKGlwM.exe
  2⤵
  PID:5140
- C:\Windows\System\DLbKsgg.exe
  C:\Windows\System\DLbKsgg.exe
  2⤵
  PID:4316
- C:\Windows\System\LzNVpXM.exe
  C:\Windows\System\LzNVpXM.exe
  2⤵
  PID:4524
- C:\Windows\System\IIaWJlx.exe
  C:\Windows\System\IIaWJlx.exe
  2⤵
  PID:4844
- C:\Windows\System\eBIvBsw.exe
  C:\Windows\System\eBIvBsw.exe
  2⤵
  PID:3628
- C:\Windows\System\oKOFodn.exe
  C:\Windows\System\oKOFodn.exe
  2⤵
  PID:4652
- C:\Windows\System\SCjZQpd.exe
  C:\Windows\System\SCjZQpd.exe
  2⤵
  PID:2176
- C:\Windows\System\akYUHXr.exe
  C:\Windows\System\akYUHXr.exe
  2⤵
  PID:4600
- C:\Windows\System\PHGfneU.exe
  C:\Windows\System\PHGfneU.exe
  2⤵
  PID:5152
- C:\Windows\System\EtGvnoC.exe
  C:\Windows\System\EtGvnoC.exe
  2⤵
  PID:5208
- C:\Windows\System\NScqXUU.exe
  C:\Windows\System\NScqXUU.exe
  2⤵
  PID:5272
- C:\Windows\System\uRKfxYh.exe
  C:\Windows\System\uRKfxYh.exe
  2⤵
  PID:5336
- C:\Windows\System\NbyvFfw.exe
  C:\Windows\System\NbyvFfw.exe
  2⤵
  PID:5400
- C:\Windows\System\MnmeuVg.exe
  C:\Windows\System\MnmeuVg.exe
  2⤵
  PID:5464
- C:\Windows\System\HKtmFSr.exe
  C:\Windows\System\HKtmFSr.exe
  2⤵
  PID:5528
- C:\Windows\System\JvdcTPk.exe
  C:\Windows\System\JvdcTPk.exe
  2⤵
  PID:5592
- C:\Windows\System\bmvBRHF.exe
  C:\Windows\System\bmvBRHF.exe
  2⤵
  PID:5632
- C:\Windows\System\ICjRXQh.exe
  C:\Windows\System\ICjRXQh.exe
  2⤵
  PID:4444
- C:\Windows\System\vbdEfxv.exe
  C:\Windows\System\vbdEfxv.exe
  2⤵
  PID:5596
- C:\Windows\System\QUkGTZz.exe
  C:\Windows\System\QUkGTZz.exe
  2⤵
  PID:5156
- C:\Windows\System\HcPcGld.exe
  C:\Windows\System\HcPcGld.exe
  2⤵
  PID:5228
- C:\Windows\System\DVSUqJh.exe
  C:\Windows\System\DVSUqJh.exe
  2⤵
  PID:5324
- C:\Windows\System\kUQcBlo.exe
  C:\Windows\System\kUQcBlo.exe
  2⤵
  PID:5388
- C:\Windows\System\QxFrtvx.exe
  C:\Windows\System\QxFrtvx.exe
  2⤵
  PID:5452
- C:\Windows\System\XYPSsXG.exe
  C:\Windows\System\XYPSsXG.exe
  2⤵
  PID:5516
- C:\Windows\System\vJvuacH.exe
  C:\Windows\System\vJvuacH.exe
  2⤵
  PID:5580
- C:\Windows\System\WYTrhYv.exe
  C:\Windows\System\WYTrhYv.exe
  2⤵
  PID:5680
- C:\Windows\System\zzAkAyT.exe
  C:\Windows\System\zzAkAyT.exe
  2⤵
  PID:5748
- C:\Windows\System\ABEZMKo.exe
  C:\Windows\System\ABEZMKo.exe
  2⤵
  PID:5768
- C:\Windows\System\nkCsBWY.exe
  C:\Windows\System\nkCsBWY.exe
  2⤵
  PID:5732
- C:\Windows\System\KlhNbxk.exe
  C:\Windows\System\KlhNbxk.exe
  2⤵
  PID:5868
- C:\Windows\System\yOPBNps.exe
  C:\Windows\System\yOPBNps.exe
  2⤵
  PID:5932
- C:\Windows\System\iVXvVsO.exe
  C:\Windows\System\iVXvVsO.exe
  2⤵
  PID:5996
- C:\Windows\System\mDXrthO.exe
  C:\Windows\System\mDXrthO.exe
  2⤵
  PID:6060
- C:\Windows\System\Szrjxgg.exe
  C:\Windows\System\Szrjxgg.exe
  2⤵
  PID:6124
- C:\Windows\System\XasuMIp.exe
  C:\Windows\System\XasuMIp.exe
  2⤵
  PID:4204
- C:\Windows\System\lwdtjko.exe
  C:\Windows\System\lwdtjko.exe
  2⤵
  PID:2788
- C:\Windows\System\fLNGOyH.exe
  C:\Windows\System\fLNGOyH.exe
  2⤵
  PID:4752
- C:\Windows\System\xrRhNHt.exe
  C:\Windows\System\xrRhNHt.exe
  2⤵
  PID:5832
- C:\Windows\System\LoOwLMv.exe
  C:\Windows\System\LoOwLMv.exe
  2⤵
  PID:5948
- C:\Windows\System\tlXYlEh.exe
  C:\Windows\System\tlXYlEh.exe
  2⤵
  PID:6016
- C:\Windows\System\dOweBqs.exe
  C:\Windows\System\dOweBqs.exe
  2⤵
  PID:6080
- C:\Windows\System\StvSNWl.exe
  C:\Windows\System\StvSNWl.exe
  2⤵
  PID:4864
- C:\Windows\System\YlFABDx.exe
  C:\Windows\System\YlFABDx.exe
  2⤵
  PID:4456
- C:\Windows\System\fZqPmRA.exe
  C:\Windows\System\fZqPmRA.exe
  2⤵
  PID:2392
- C:\Windows\System\mNsBcoF.exe
  C:\Windows\System\mNsBcoF.exe
  2⤵
  PID:1808
- C:\Windows\System\ZvRbmCA.exe
  C:\Windows\System\ZvRbmCA.exe
  2⤵
  PID:5240
- C:\Windows\System\URJFCqL.exe
  C:\Windows\System\URJFCqL.exe
  2⤵
  PID:5496
- C:\Windows\System\EzoDhFm.exe
  C:\Windows\System\EzoDhFm.exe
  2⤵
  PID:5700
- C:\Windows\System\HnmQTGh.exe
  C:\Windows\System\HnmQTGh.exe
  2⤵
  PID:5356
- C:\Windows\System\CNakrsF.exe
  C:\Windows\System\CNakrsF.exe
  2⤵
  PID:5648
- C:\Windows\System\rkvkdCD.exe
  C:\Windows\System\rkvkdCD.exe
  2⤵
  PID:5836
- C:\Windows\System\dPvLnnu.exe
  C:\Windows\System\dPvLnnu.exe
  2⤵
  PID:6092
- C:\Windows\System\zjIFWpS.exe
  C:\Windows\System\zjIFWpS.exe
  2⤵
  PID:5852
- C:\Windows\System\KhRSUKX.exe
  C:\Windows\System\KhRSUKX.exe
  2⤵
  PID:5952
- C:\Windows\System\tLLKmzI.exe
  C:\Windows\System\tLLKmzI.exe
  2⤵
  PID:5432
- C:\Windows\System\sLcPWFT.exe
  C:\Windows\System\sLcPWFT.exe
  2⤵
  PID:4924
- C:\Windows\System\lHJuklD.exe
  C:\Windows\System\lHJuklD.exe
  2⤵
  PID:5288
- C:\Windows\System\GeVfyEV.exe
  C:\Windows\System\GeVfyEV.exe
  2⤵
  PID:5576
- C:\Windows\System\NXTEbUZ.exe
  C:\Windows\System\NXTEbUZ.exe
  2⤵
  PID:5740
- C:\Windows\System\Qigufun.exe
  C:\Windows\System\Qigufun.exe
  2⤵
  PID:5904
- C:\Windows\System\IqqCftp.exe
  C:\Windows\System\IqqCftp.exe
  2⤵
  PID:1520
- C:\Windows\System\LyTcNnd.exe
  C:\Windows\System\LyTcNnd.exe
  2⤵
  PID:6012
- C:\Windows\System\fuJCOun.exe
  C:\Windows\System\fuJCOun.exe
  2⤵
  PID:4124
- C:\Windows\System\bhCrZFb.exe
  C:\Windows\System\bhCrZFb.exe
  2⤵
  PID:5604
- C:\Windows\System\ZTOFWAo.exe
  C:\Windows\System\ZTOFWAo.exe
  2⤵
  PID:5548
- C:\Windows\System\IRTokPq.exe
  C:\Windows\System\IRTokPq.exe
  2⤵
  PID:4796
- C:\Windows\System\AsnowCe.exe
  C:\Windows\System\AsnowCe.exe
  2⤵
  PID:5176
- C:\Windows\System\jTpVgFX.exe
  C:\Windows\System\jTpVgFX.exe
  2⤵
  PID:5320
- C:\Windows\System\JqYjngu.exe
  C:\Windows\System\JqYjngu.exe
  2⤵
  PID:5984
- C:\Windows\System\lfOayyp.exe
  C:\Windows\System\lfOayyp.exe
  2⤵
  PID:5808
- C:\Windows\System\yILWGBH.exe
  C:\Windows\System\yILWGBH.exe
  2⤵
  PID:5888
- C:\Windows\System\XOPKUzO.exe
  C:\Windows\System\XOPKUzO.exe
  2⤵
  PID:5060
- C:\Windows\System\sZzpxzr.exe
  C:\Windows\System\sZzpxzr.exe
  2⤵
  PID:5372
- C:\Windows\System\UqSOkrH.exe
  C:\Windows\System\UqSOkrH.exe
  2⤵
  PID:5760
- C:\Windows\System\vEUNjPp.exe
  C:\Windows\System\vEUNjPp.exe
  2⤵
  PID:5308
- C:\Windows\System\iuQebxa.exe
  C:\Windows\System\iuQebxa.exe
  2⤵
  PID:6032
- C:\Windows\System\LtVIDEH.exe
  C:\Windows\System\LtVIDEH.exe
  2⤵
  PID:6148
- C:\Windows\System\OjTsnGZ.exe
  C:\Windows\System\OjTsnGZ.exe
  2⤵
  PID:6164
- C:\Windows\System\KGnsVvl.exe
  C:\Windows\System\KGnsVvl.exe
  2⤵
  PID:6180
- C:\Windows\System\fvWHORI.exe
  C:\Windows\System\fvWHORI.exe
  2⤵
  PID:6196
- C:\Windows\System\kPiXmrm.exe
  C:\Windows\System\kPiXmrm.exe
  2⤵
  PID:6212
- C:\Windows\System\RCjOjFq.exe
  C:\Windows\System\RCjOjFq.exe
  2⤵
  PID:6228
- C:\Windows\System\oHIprPt.exe
  C:\Windows\System\oHIprPt.exe
  2⤵
  PID:6244
- C:\Windows\System\YbzOtBP.exe
  C:\Windows\System\YbzOtBP.exe
  2⤵
  PID:6260
- C:\Windows\System\xsHMOcE.exe
  C:\Windows\System\xsHMOcE.exe
  2⤵
  PID:6276
- C:\Windows\System\CTpIOaw.exe
  C:\Windows\System\CTpIOaw.exe
  2⤵
  PID:6292
- C:\Windows\System\DTGScDg.exe
  C:\Windows\System\DTGScDg.exe
  2⤵
  PID:6308
- C:\Windows\System\EPAsbCG.exe
  C:\Windows\System\EPAsbCG.exe
  2⤵
  PID:6324
- C:\Windows\System\RIKkfca.exe
  C:\Windows\System\RIKkfca.exe
  2⤵
  PID:6340
- C:\Windows\System\ZYIyqpO.exe
  C:\Windows\System\ZYIyqpO.exe
  2⤵
  PID:6356
- C:\Windows\System\oEInBxO.exe
  C:\Windows\System\oEInBxO.exe
  2⤵
  PID:6372
- C:\Windows\System\VlCocTr.exe
  C:\Windows\System\VlCocTr.exe
  2⤵
  PID:6388
- C:\Windows\System\MtaLQok.exe
  C:\Windows\System\MtaLQok.exe
  2⤵
  PID:6404
- C:\Windows\System\efpCwYE.exe
  C:\Windows\System\efpCwYE.exe
  2⤵
  PID:6424
- C:\Windows\System\VfLylGz.exe
  C:\Windows\System\VfLylGz.exe
  2⤵
  PID:6448
- C:\Windows\System\EncMlGM.exe
  C:\Windows\System\EncMlGM.exe
  2⤵
  PID:6464
- C:\Windows\System\trwefBt.exe
  C:\Windows\System\trwefBt.exe
  2⤵
  PID:6480
- C:\Windows\System\jhACBuZ.exe
  C:\Windows\System\jhACBuZ.exe
  2⤵
  PID:6496
- C:\Windows\System\ayOADlQ.exe
  C:\Windows\System\ayOADlQ.exe
  2⤵
  PID:6512
- C:\Windows\System\QFSbMVY.exe
  C:\Windows\System\QFSbMVY.exe
  2⤵
  PID:6528
- C:\Windows\System\vLogAlw.exe
  C:\Windows\System\vLogAlw.exe
  2⤵
  PID:6544
- C:\Windows\System\sSjvgWm.exe
  C:\Windows\System\sSjvgWm.exe
  2⤵
  PID:6560
- C:\Windows\System\uscnbQa.exe
  C:\Windows\System\uscnbQa.exe
  2⤵
  PID:6576
- C:\Windows\System\iiuFgIM.exe
  C:\Windows\System\iiuFgIM.exe
  2⤵
  PID:6592
- C:\Windows\System\HBiAXoS.exe
  C:\Windows\System\HBiAXoS.exe
  2⤵
  PID:6608
- C:\Windows\System\WUZqMMm.exe
  C:\Windows\System\WUZqMMm.exe
  2⤵
  PID:6624
- C:\Windows\System\mDukpti.exe
  C:\Windows\System\mDukpti.exe
  2⤵
  PID:6640
- C:\Windows\System\AcGftMt.exe
  C:\Windows\System\AcGftMt.exe
  2⤵
  PID:6656
- C:\Windows\System\xdCgbeQ.exe
  C:\Windows\System\xdCgbeQ.exe
  2⤵
  PID:6672
- C:\Windows\System\OMlJLfJ.exe
  C:\Windows\System\OMlJLfJ.exe
  2⤵
  PID:6688
- C:\Windows\System\sCUUuCe.exe
  C:\Windows\System\sCUUuCe.exe
  2⤵
  PID:6704
- C:\Windows\System\HARRNow.exe
  C:\Windows\System\HARRNow.exe
  2⤵
  PID:6720
- C:\Windows\System\ikjnLml.exe
  C:\Windows\System\ikjnLml.exe
  2⤵
  PID:6736
- C:\Windows\System\IoPrwNa.exe
  C:\Windows\System\IoPrwNa.exe
  2⤵
  PID:6752
- C:\Windows\System\ijsDmMe.exe
  C:\Windows\System\ijsDmMe.exe
  2⤵
  PID:6768
- C:\Windows\System\kQXMtPt.exe
  C:\Windows\System\kQXMtPt.exe
  2⤵
  PID:6784
- C:\Windows\System\QZDUBRf.exe
  C:\Windows\System\QZDUBRf.exe
  2⤵
  PID:6800
- C:\Windows\System\gGiZzyP.exe
  C:\Windows\System\gGiZzyP.exe
  2⤵
  PID:6816
- C:\Windows\System\LyXjdQS.exe
  C:\Windows\System\LyXjdQS.exe
  2⤵
  PID:6832
- C:\Windows\System\PQxbLLH.exe
  C:\Windows\System\PQxbLLH.exe
  2⤵
  PID:6848
- C:\Windows\System\wAMIVJH.exe
  C:\Windows\System\wAMIVJH.exe
  2⤵
  PID:6864
- C:\Windows\System\eKNqCVJ.exe
  C:\Windows\System\eKNqCVJ.exe
  2⤵
  PID:6880
- C:\Windows\System\yjLFSRp.exe
  C:\Windows\System\yjLFSRp.exe
  2⤵
  PID:6896
- C:\Windows\System\xOVtMFF.exe
  C:\Windows\System\xOVtMFF.exe
  2⤵
  PID:6912
- C:\Windows\System\pShwsSd.exe
  C:\Windows\System\pShwsSd.exe
  2⤵
  PID:6928
- C:\Windows\System\zcodtDo.exe
  C:\Windows\System\zcodtDo.exe
  2⤵
  PID:6944
- C:\Windows\System\RlVxVuo.exe
  C:\Windows\System\RlVxVuo.exe
  2⤵
  PID:6960
- C:\Windows\System\BqwshnQ.exe
  C:\Windows\System\BqwshnQ.exe
  2⤵
  PID:6976
- C:\Windows\System\obeGRiy.exe
  C:\Windows\System\obeGRiy.exe
  2⤵
  PID:6992
- C:\Windows\System\czeNMeO.exe
  C:\Windows\System\czeNMeO.exe
  2⤵
  PID:7008
- C:\Windows\System\lguSwvM.exe
  C:\Windows\System\lguSwvM.exe
  2⤵
  PID:7024
- C:\Windows\System\YSqaoOw.exe
  C:\Windows\System\YSqaoOw.exe
  2⤵
  PID:7040
- C:\Windows\System\gBIWWjK.exe
  C:\Windows\System\gBIWWjK.exe
  2⤵
  PID:7056
- C:\Windows\System\VELGXsi.exe
  C:\Windows\System\VELGXsi.exe
  2⤵
  PID:7072
- C:\Windows\System\GMnrvON.exe
  C:\Windows\System\GMnrvON.exe
  2⤵
  PID:7088
- C:\Windows\System\JBOlVWB.exe
  C:\Windows\System\JBOlVWB.exe
  2⤵
  PID:7104
- C:\Windows\System\DiyyyNe.exe
  C:\Windows\System\DiyyyNe.exe
  2⤵
  PID:7120
- C:\Windows\System\iYIZKYF.exe
  C:\Windows\System\iYIZKYF.exe
  2⤵
  PID:7136
- C:\Windows\System\CwMEsTv.exe
  C:\Windows\System\CwMEsTv.exe
  2⤵
  PID:7152
- C:\Windows\System\OirKbKX.exe
  C:\Windows\System\OirKbKX.exe
  2⤵
  PID:5088
- C:\Windows\System\EnDpYlq.exe
  C:\Windows\System\EnDpYlq.exe
  2⤵
  PID:5180
- C:\Windows\System\ewQBMEw.exe
  C:\Windows\System\ewQBMEw.exe
  2⤵
  PID:5224
- C:\Windows\System\MJWCnqZ.exe
  C:\Windows\System\MJWCnqZ.exe
  2⤵
  PID:6156
- C:\Windows\System\kEYBuYd.exe
  C:\Windows\System\kEYBuYd.exe
  2⤵
  PID:6220
- C:\Windows\System\HdegiOF.exe
  C:\Windows\System\HdegiOF.exe
  2⤵
  PID:6284
- C:\Windows\System\uOabFge.exe
  C:\Windows\System\uOabFge.exe
  2⤵
  PID:6352
- C:\Windows\System\ulvQgRf.exe
  C:\Windows\System\ulvQgRf.exe
  2⤵
  PID:5968
- C:\Windows\System\oyLVSYs.exe
  C:\Windows\System\oyLVSYs.exe
  2⤵
  PID:6288
- C:\Windows\System\AOcvaNs.exe
  C:\Windows\System\AOcvaNs.exe
  2⤵
  PID:1736
- C:\Windows\System\VtNVPhQ.exe
  C:\Windows\System\VtNVPhQ.exe
  2⤵
  PID:6304
- C:\Windows\System\SrsMEuB.exe
  C:\Windows\System\SrsMEuB.exe
  2⤵
  PID:2732
- C:\Windows\System\IVINObi.exe
  C:\Windows\System\IVINObi.exe
  2⤵
  PID:5920
- C:\Windows\System\CLhxuvn.exe
  C:\Windows\System\CLhxuvn.exe
  2⤵
  PID:6416
- C:\Windows\System\XWVvtmD.exe
  C:\Windows\System\XWVvtmD.exe
  2⤵
  PID:2272
- C:\Windows\System\ylrCuxD.exe
  C:\Windows\System\ylrCuxD.exe
  2⤵
  PID:1012
- C:\Windows\System\uilEJUs.exe
  C:\Windows\System\uilEJUs.exe
  2⤵
  PID:412
- C:\Windows\System\WyxLjvE.exe
  C:\Windows\System\WyxLjvE.exe
  2⤵
  PID:1356
- C:\Windows\System\xVAPwpJ.exe
  C:\Windows\System\xVAPwpJ.exe
  2⤵
  PID:1872
- C:\Windows\System\pgzFeuh.exe
  C:\Windows\System\pgzFeuh.exe
  2⤵
  PID:4816
- C:\Windows\System\wQQNIwK.exe
  C:\Windows\System\wQQNIwK.exe
  2⤵
  PID:6204
- C:\Windows\System\HoWgXRv.exe
  C:\Windows\System\HoWgXRv.exe
  2⤵
  PID:6332
- C:\Windows\System\roBQmfJ.exe
  C:\Windows\System\roBQmfJ.exe
  2⤵
  PID:3004
- C:\Windows\System\upmiqrF.exe
  C:\Windows\System\upmiqrF.exe
  2⤵
  PID:2828
- C:\Windows\System\KyELDJe.exe
  C:\Windows\System\KyELDJe.exe
  2⤵
  PID:3060
- C:\Windows\System\dxabjVK.exe
  C:\Windows\System\dxabjVK.exe
  2⤵
  PID:2092
- C:\Windows\System\tYvqqOf.exe
  C:\Windows\System\tYvqqOf.exe
  2⤵
  PID:2988
- C:\Windows\System\atCEkuY.exe
  C:\Windows\System\atCEkuY.exe
  2⤵
  PID:608
- C:\Windows\System\pilaOdb.exe
  C:\Windows\System\pilaOdb.exe
  2⤵
  PID:2648
- C:\Windows\System\IIJTaGn.exe
  C:\Windows\System\IIJTaGn.exe
  2⤵
  PID:2644
- C:\Windows\System\GULIpNt.exe
  C:\Windows\System\GULIpNt.exe
  2⤵
  PID:6460
- C:\Windows\System\SHhlYfn.exe
  C:\Windows\System\SHhlYfn.exe
  2⤵
  PID:6524
- C:\Windows\System\sdPJaCV.exe
  C:\Windows\System\sdPJaCV.exe
  2⤵
  PID:6588
- C:\Windows\System\rvUgChA.exe
  C:\Windows\System\rvUgChA.exe
  2⤵
  PID:6652
- C:\Windows\System\xYXaYFG.exe
  C:\Windows\System\xYXaYFG.exe
  2⤵
  PID:6716
- C:\Windows\System\rcbGEUL.exe
  C:\Windows\System\rcbGEUL.exe
  2⤵
  PID:6780
- C:\Windows\System\vrMvtTb.exe
  C:\Windows\System\vrMvtTb.exe
  2⤵
  PID:6844
- C:\Windows\System\NrFQcWz.exe
  C:\Windows\System\NrFQcWz.exe
  2⤵
  PID:6632
- C:\Windows\System\xsQseem.exe
  C:\Windows\System\xsQseem.exe
  2⤵
  PID:6696
- C:\Windows\System\OhpeeXX.exe
  C:\Windows\System\OhpeeXX.exe
  2⤵
  PID:6760
- C:\Windows\System\SeIeklD.exe
  C:\Windows\System\SeIeklD.exe
  2⤵
  PID:6824
- C:\Windows\System\eKpQdax.exe
  C:\Windows\System\eKpQdax.exe
  2⤵
  PID:6876
- C:\Windows\System\QypUpnL.exe
  C:\Windows\System\QypUpnL.exe
  2⤵
  PID:6940
- C:\Windows\System\GrTKGcK.exe
  C:\Windows\System\GrTKGcK.exe
  2⤵
  PID:7004
- C:\Windows\System\vEcGATD.exe
  C:\Windows\System\vEcGATD.exe
  2⤵
  PID:7068
- C:\Windows\System\PecIKnR.exe
  C:\Windows\System\PecIKnR.exe
  2⤵
  PID:7132
- C:\Windows\System\qSbqgJk.exe
  C:\Windows\System\qSbqgJk.exe
  2⤵
  PID:5068
- C:\Windows\System\RRduZsa.exe
  C:\Windows\System\RRduZsa.exe
  2⤵
  PID:6348
- C:\Windows\System\KIiPWTR.exe
  C:\Windows\System\KIiPWTR.exe
  2⤵
  PID:6872
- C:\Windows\System\cUTZBDC.exe
  C:\Windows\System\cUTZBDC.exe
  2⤵
  PID:4832
- C:\Windows\System\UpUCJcr.exe
  C:\Windows\System\UpUCJcr.exe
  2⤵
  PID:6272
- C:\Windows\System\mBijZqL.exe
  C:\Windows\System\mBijZqL.exe
  2⤵
  PID:6536
- C:\Windows\System\PfxhYmY.exe
  C:\Windows\System\PfxhYmY.exe
  2⤵
  PID:6952
- C:\Windows\System\qBalVDb.exe
  C:\Windows\System\qBalVDb.exe
  2⤵
  PID:7016
- C:\Windows\System\JLhMGhl.exe
  C:\Windows\System\JLhMGhl.exe
  2⤵
  PID:7084
- C:\Windows\System\MOYkbhr.exe
  C:\Windows\System\MOYkbhr.exe
  2⤵
  PID:7148
- C:\Windows\System\ECQlJNc.exe
  C:\Windows\System\ECQlJNc.exe
  2⤵
  PID:3448
- C:\Windows\System\hDDoALW.exe
  C:\Windows\System\hDDoALW.exe
  2⤵
  PID:6412
- C:\Windows\System\qjrbbLk.exe
  C:\Windows\System\qjrbbLk.exe
  2⤵
  PID:5884
- C:\Windows\System\dmElyeL.exe
  C:\Windows\System\dmElyeL.exe
  2⤵
  PID:1016
- C:\Windows\System\FqzxBVd.exe
  C:\Windows\System\FqzxBVd.exe
  2⤵
  PID:6172
- C:\Windows\System\yMhIEmp.exe
  C:\Windows\System\yMhIEmp.exe
  2⤵
  PID:1792
- C:\Windows\System\wKiiSBd.exe
  C:\Windows\System\wKiiSBd.exe
  2⤵
  PID:2508
- C:\Windows\System\SOvfkAY.exe
  C:\Windows\System\SOvfkAY.exe
  2⤵
  PID:312
- C:\Windows\System\tTONFRO.exe
  C:\Windows\System\tTONFRO.exe
  2⤵
  PID:7100
- C:\Windows\System\urcngjK.exe
  C:\Windows\System\urcngjK.exe
  2⤵
  PID:4988
- C:\Windows\System\TPsrdiH.exe
  C:\Windows\System\TPsrdiH.exe
  2⤵
  PID:6256
- C:\Windows\System\NmSbUAo.exe
  C:\Windows\System\NmSbUAo.exe
  2⤵
  PID:2384
- C:\Windows\System\jjpTyRe.exe
  C:\Windows\System\jjpTyRe.exe
  2⤵
  PID:7172
- C:\Windows\System\qguikLj.exe
  C:\Windows\System\qguikLj.exe
  2⤵
  PID:7188
- C:\Windows\System\gntFYby.exe
  C:\Windows\System\gntFYby.exe
  2⤵
  PID:7204
- C:\Windows\System\ZmBIMda.exe
  C:\Windows\System\ZmBIMda.exe
  2⤵
  PID:7220
- C:\Windows\System\IyATMjP.exe
  C:\Windows\System\IyATMjP.exe
  2⤵
  PID:7236
- C:\Windows\System\RrqCZGA.exe
  C:\Windows\System\RrqCZGA.exe
  2⤵
  PID:7252
- C:\Windows\System\WDDxjgh.exe
  C:\Windows\System\WDDxjgh.exe
  2⤵
  PID:7268
- C:\Windows\System\kkHwOgl.exe
  C:\Windows\System\kkHwOgl.exe
  2⤵
  PID:7284
- C:\Windows\System\dDmGYJH.exe
  C:\Windows\System\dDmGYJH.exe
  2⤵
  PID:7300
- C:\Windows\System\DrVoWpn.exe
  C:\Windows\System\DrVoWpn.exe
  2⤵
  PID:7316
- C:\Windows\System\ZxzqJBP.exe
  C:\Windows\System\ZxzqJBP.exe
  2⤵
  PID:7332
- C:\Windows\System\mBQxnTg.exe
  C:\Windows\System\mBQxnTg.exe
  2⤵
  PID:7348
- C:\Windows\System\LVoGkfc.exe
  C:\Windows\System\LVoGkfc.exe
  2⤵
  PID:7364
- C:\Windows\System\eGCLRfd.exe
  C:\Windows\System\eGCLRfd.exe
  2⤵
  PID:7380
- C:\Windows\System\JFNoTSi.exe
  C:\Windows\System\JFNoTSi.exe
  2⤵
  PID:7396
- C:\Windows\System\ovkuhdy.exe
  C:\Windows\System\ovkuhdy.exe
  2⤵
  PID:7412
- C:\Windows\System\usyGXEi.exe
  C:\Windows\System\usyGXEi.exe
  2⤵
  PID:7428
- C:\Windows\System\kLFYkoc.exe
  C:\Windows\System\kLFYkoc.exe
  2⤵
  PID:7444
- C:\Windows\System\fQmEdjn.exe
  C:\Windows\System\fQmEdjn.exe
  2⤵
  PID:7460
- C:\Windows\System\sjFEdWO.exe
  C:\Windows\System\sjFEdWO.exe
  2⤵
  PID:7476
- C:\Windows\System\cBaVvUv.exe
  C:\Windows\System\cBaVvUv.exe
  2⤵
  PID:7552
- C:\Windows\System\MTnpdet.exe
  C:\Windows\System\MTnpdet.exe
  2⤵
  PID:7568
- C:\Windows\System\oZGhBgt.exe
  C:\Windows\System\oZGhBgt.exe
  2⤵
  PID:7584
- C:\Windows\System\NDVgTgZ.exe
  C:\Windows\System\NDVgTgZ.exe
  2⤵
  PID:7600
- C:\Windows\System\dxawszf.exe
  C:\Windows\System\dxawszf.exe
  2⤵
  PID:7616
- C:\Windows\System\tJFpfKf.exe
  C:\Windows\System\tJFpfKf.exe
  2⤵
  PID:7632
- C:\Windows\System\OOqvsBa.exe
  C:\Windows\System\OOqvsBa.exe
  2⤵
  PID:7648
- C:\Windows\System\vTgKCPi.exe
  C:\Windows\System\vTgKCPi.exe
  2⤵
  PID:7664
- C:\Windows\System\ryktoXH.exe
  C:\Windows\System\ryktoXH.exe
  2⤵
  PID:7680
- C:\Windows\System\qtQbYKc.exe
  C:\Windows\System\qtQbYKc.exe
  2⤵
  PID:7696
- C:\Windows\System\hQEExjQ.exe
  C:\Windows\System\hQEExjQ.exe
  2⤵
  PID:7712
- C:\Windows\System\SbLdTSk.exe
  C:\Windows\System\SbLdTSk.exe
  2⤵
  PID:7728
- C:\Windows\System\JiWtxpW.exe
  C:\Windows\System\JiWtxpW.exe
  2⤵
  PID:7744
- C:\Windows\System\EHoEzNM.exe
  C:\Windows\System\EHoEzNM.exe
  2⤵
  PID:7760
- C:\Windows\System\GmaQuWJ.exe
  C:\Windows\System\GmaQuWJ.exe
  2⤵
  PID:7776
- C:\Windows\System\AqndZrk.exe
  C:\Windows\System\AqndZrk.exe
  2⤵
  PID:7792
- C:\Windows\System\gllnZbA.exe
  C:\Windows\System\gllnZbA.exe
  2⤵
  PID:7808
- C:\Windows\System\WfRHMpE.exe
  C:\Windows\System\WfRHMpE.exe
  2⤵
  PID:7824
- C:\Windows\System\iNXiYww.exe
  C:\Windows\System\iNXiYww.exe
  2⤵
  PID:7840
- C:\Windows\System\IYILRoh.exe
  C:\Windows\System\IYILRoh.exe
  2⤵
  PID:7856
- C:\Windows\System\JreWwjl.exe
  C:\Windows\System\JreWwjl.exe
  2⤵
  PID:7872
- C:\Windows\System\mFpuWAH.exe
  C:\Windows\System\mFpuWAH.exe
  2⤵
  PID:7888
- C:\Windows\System\uXJEDQJ.exe
  C:\Windows\System\uXJEDQJ.exe
  2⤵
  PID:7904
- C:\Windows\System\KqaHkgk.exe
  C:\Windows\System\KqaHkgk.exe
  2⤵
  PID:7920
- C:\Windows\System\KXTaCoJ.exe
  C:\Windows\System\KXTaCoJ.exe
  2⤵
  PID:7944
- C:\Windows\System\lKkDdGj.exe
  C:\Windows\System\lKkDdGj.exe
  2⤵
  PID:7960
- C:\Windows\System\nBDPwTD.exe
  C:\Windows\System\nBDPwTD.exe
  2⤵
  PID:7976
- C:\Windows\System\aDrXSsJ.exe
  C:\Windows\System\aDrXSsJ.exe
  2⤵
  PID:7992
- C:\Windows\System\jupuTOO.exe
  C:\Windows\System\jupuTOO.exe
  2⤵
  PID:8008
- C:\Windows\System\nsPGYUv.exe
  C:\Windows\System\nsPGYUv.exe
  2⤵
  PID:8024
- C:\Windows\System\AQhNGPC.exe
  C:\Windows\System\AQhNGPC.exe
  2⤵
  PID:8040
- C:\Windows\System\lwQOSMC.exe
  C:\Windows\System\lwQOSMC.exe
  2⤵
  PID:8056
- C:\Windows\System\QHOOBYi.exe
  C:\Windows\System\QHOOBYi.exe
  2⤵
  PID:8072
- C:\Windows\System\nIBGWtj.exe
  C:\Windows\System\nIBGWtj.exe
  2⤵
  PID:8088
- C:\Windows\System\aiGgLHi.exe
  C:\Windows\System\aiGgLHi.exe
  2⤵
  PID:8104
- C:\Windows\System\EJlheFS.exe
  C:\Windows\System\EJlheFS.exe
  2⤵
  PID:8120
- C:\Windows\System\CrAsJyh.exe
  C:\Windows\System\CrAsJyh.exe
  2⤵
  PID:8136
- C:\Windows\System\pPARESt.exe
  C:\Windows\System\pPARESt.exe
  2⤵
  PID:8152
- C:\Windows\System\hSppXts.exe
  C:\Windows\System\hSppXts.exe
  2⤵
  PID:8168
- C:\Windows\System\YvAWBDb.exe
  C:\Windows\System\YvAWBDb.exe
  2⤵
  PID:8184
- C:\Windows\System\lqiWUYM.exe
  C:\Windows\System\lqiWUYM.exe
  2⤵
  PID:6556
- C:\Windows\System\COPtFqD.exe
  C:\Windows\System\COPtFqD.exe
  2⤵
  PID:7048
- C:\Windows\System\qaKtFxL.exe
  C:\Windows\System\qaKtFxL.exe
  2⤵
  PID:6300
- C:\Windows\System\drqpOFW.exe
  C:\Windows\System\drqpOFW.exe
  2⤵
  PID:6540
- C:\Windows\System\oJQyCSj.exe
  C:\Windows\System\oJQyCSj.exe
  2⤵
  PID:6812
- C:\Windows\System\EgHnMLL.exe
  C:\Windows\System\EgHnMLL.exe
  2⤵
  PID:5020
- C:\Windows\System\sFZxRYA.exe
  C:\Windows\System\sFZxRYA.exe
  2⤵
  PID:2532
- C:\Windows\System\LPtPfSB.exe
  C:\Windows\System\LPtPfSB.exe
  2⤵
  PID:6620
- C:\Windows\System\sAuSrcx.exe
  C:\Windows\System\sAuSrcx.exe
  2⤵
  PID:6664
- C:\Windows\System\AXUSMtd.exe
  C:\Windows\System\AXUSMtd.exe
  2⤵
  PID:6796
- C:\Windows\System\lTtCbAq.exe
  C:\Windows\System\lTtCbAq.exe
  2⤵
  PID:7064
- C:\Windows\System\yyKWKBQ.exe
  C:\Windows\System\yyKWKBQ.exe
  2⤵
  PID:6048
- C:\Windows\System\ofTomAE.exe
  C:\Windows\System\ofTomAE.exe
  2⤵
  PID:6420
- C:\Windows\System\ERCxced.exe
  C:\Windows\System\ERCxced.exe
  2⤵
  PID:7392
- C:\Windows\System\GJtYTQW.exe
  C:\Windows\System\GJtYTQW.exe
  2⤵
  PID:6600
- C:\Windows\System\woFgzdp.exe
  C:\Windows\System\woFgzdp.exe
  2⤵
  PID:5368
- C:\Windows\System\nMsHxKf.exe
  C:\Windows\System\nMsHxKf.exe
  2⤵
  PID:6972
- C:\Windows\System\niyXvkr.exe
  C:\Windows\System\niyXvkr.exe
  2⤵
  PID:6476
- C:\Windows\System\nlNZrdB.exe
  C:\Windows\System\nlNZrdB.exe
  2⤵
  PID:7228
- C:\Windows\System\KvyhZbx.exe
  C:\Windows\System\KvyhZbx.exe
  2⤵
  PID:7292
- C:\Windows\System\JPDnqtl.exe
  C:\Windows\System\JPDnqtl.exe
  2⤵
  PID:7356
- C:\Windows\System\eKYWXqD.exe
  C:\Windows\System\eKYWXqD.exe
  2⤵
  PID:7452
- C:\Windows\System\vOsOlnH.exe
  C:\Windows\System\vOsOlnH.exe
  2⤵
  PID:1860
- C:\Windows\System\XlTzguf.exe
  C:\Windows\System\XlTzguf.exe
  2⤵
  PID:2484
- C:\Windows\System\epZNRuX.exe
  C:\Windows\System\epZNRuX.exe
  2⤵
  PID:936
- C:\Windows\System\JISsbcg.exe
  C:\Windows\System\JISsbcg.exe
  2⤵
  PID:7280
- C:\Windows\System\sCgUbrM.exe
  C:\Windows\System\sCgUbrM.exe
  2⤵
  PID:7344
- C:\Windows\System\YHoJIZg.exe
  C:\Windows\System\YHoJIZg.exe
  2⤵
  PID:7408
- C:\Windows\System\kwVZmGU.exe
  C:\Windows\System\kwVZmGU.exe
  2⤵
  PID:7472
- C:\Windows\System\OvUQKqN.exe
  C:\Windows\System\OvUQKqN.exe
  2⤵
  PID:7504
- C:\Windows\System\GERVEQv.exe
  C:\Windows\System\GERVEQv.exe
  2⤵
  PID:7532
- C:\Windows\System\mOovwog.exe
  C:\Windows\System\mOovwog.exe
  2⤵
  PID:7580
- C:\Windows\System\WdGjAEl.exe
  C:\Windows\System\WdGjAEl.exe
  2⤵
  PID:7644
- C:\Windows\System\nymfSbp.exe
  C:\Windows\System\nymfSbp.exe
  2⤵
  PID:7708
- C:\Windows\System\bOvCVUy.exe
  C:\Windows\System\bOvCVUy.exe
  2⤵
  PID:7772
- C:\Windows\System\kvILkre.exe
  C:\Windows\System\kvILkre.exe
  2⤵
  PID:7836
- C:\Windows\System\gEzklTS.exe
  C:\Windows\System\gEzklTS.exe
  2⤵
  PID:7900
- C:\Windows\System\envWcaU.exe
  C:\Windows\System\envWcaU.exe
  2⤵
  PID:6140
- C:\Windows\System\XdgZkxC.exe
  C:\Windows\System\XdgZkxC.exe
  2⤵
  PID:7248
- C:\Windows\System\kiRFxcR.exe
  C:\Windows\System\kiRFxcR.exe
  2⤵
  PID:7628
- C:\Windows\System\tdblftv.exe
  C:\Windows\System\tdblftv.exe
  2⤵
  PID:7692
- C:\Windows\System\LmHfzUX.exe
  C:\Windows\System\LmHfzUX.exe
  2⤵
  PID:7756
- C:\Windows\System\KzMtdrW.exe
  C:\Windows\System\KzMtdrW.exe
  2⤵
  PID:7820
- C:\Windows\System\dbxelqP.exe
  C:\Windows\System\dbxelqP.exe
  2⤵
  PID:7884
- C:\Windows\System\xleBLRm.exe
  C:\Windows\System\xleBLRm.exe
  2⤵
  PID:7968
- C:\Windows\System\xhyevZj.exe
  C:\Windows\System\xhyevZj.exe
  2⤵
  PID:8032
- C:\Windows\System\ZWvVLOl.exe
  C:\Windows\System\ZWvVLOl.exe
  2⤵
  PID:8096
- C:\Windows\System\UjBgyCa.exe
  C:\Windows\System\UjBgyCa.exe
  2⤵
  PID:8160
- C:\Windows\System\WvOovkj.exe
  C:\Windows\System\WvOovkj.exe
  2⤵
  PID:5900
- C:\Windows\System\HuTRlKd.exe
  C:\Windows\System\HuTRlKd.exe
  2⤵
  PID:1020
- C:\Windows\System\rckAfaM.exe
  C:\Windows\System\rckAfaM.exe
  2⤵
  PID:7564
- C:\Windows\System\jhxZumG.exe
  C:\Windows\System\jhxZumG.exe
  2⤵
  PID:8016
- C:\Windows\System\lZQEFMk.exe
  C:\Windows\System\lZQEFMk.exe
  2⤵
  PID:8080
- C:\Windows\System\kgklscO.exe
  C:\Windows\System\kgklscO.exe
  2⤵
  PID:8176
- C:\Windows\System\kGtonYC.exe
  C:\Windows\System\kGtonYC.exe
  2⤵
  PID:1048
- C:\Windows\System\rxnZMBd.exe
  C:\Windows\System\rxnZMBd.exe
  2⤵
  PID:708
- C:\Windows\System\LmdNBKT.exe
  C:\Windows\System\LmdNBKT.exe
  2⤵
  PID:6776
- C:\Windows\System\itFloQM.exe
  C:\Windows\System\itFloQM.exe
  2⤵
  PID:7080
- C:\Windows\System\ysTBrIF.exe
  C:\Windows\System\ysTBrIF.exe
  2⤵
  PID:7196
- C:\Windows\System\ntWYzvZ.exe
  C:\Windows\System\ntWYzvZ.exe
  2⤵
  PID:7484
- C:\Windows\System\NLzwsQi.exe
  C:\Windows\System\NLzwsQi.exe
  2⤵
  PID:7312
- C:\Windows\System\HodrxmJ.exe
  C:\Windows\System\HodrxmJ.exe
  2⤵
  PID:3888
- C:\Windows\System\LPNSfgO.exe
  C:\Windows\System\LPNSfgO.exe
  2⤵
  PID:6668
- C:\Windows\System\EIQpxSK.exe
  C:\Windows\System\EIQpxSK.exe
  2⤵
  PID:2816
- C:\Windows\System\AZaWJWZ.exe
  C:\Windows\System\AZaWJWZ.exe
  2⤵
  PID:6988
- C:\Windows\System\gJBzwOg.exe
  C:\Windows\System\gJBzwOg.exe
  2⤵
  PID:7420
- C:\Windows\System\vcTYlak.exe
  C:\Windows\System\vcTYlak.exe
  2⤵
  PID:7244
- C:\Windows\System\iaTGeqq.exe
  C:\Windows\System\iaTGeqq.exe
  2⤵
  PID:1884
- C:\Windows\System\enfQRBS.exe
  C:\Windows\System\enfQRBS.exe
  2⤵
  PID:7528
- C:\Windows\System\GhZZtbS.exe
  C:\Windows\System\GhZZtbS.exe
  2⤵
  PID:7768
- C:\Windows\System\JhuIAVN.exe
  C:\Windows\System\JhuIAVN.exe
  2⤵
  PID:7216
- C:\Windows\System\xyPCSfF.exe
  C:\Windows\System\xyPCSfF.exe
  2⤵
  PID:7816
- C:\Windows\System\brEgxVS.exe
  C:\Windows\System\brEgxVS.exe
  2⤵
  PID:8068
- C:\Windows\System\oiUanFX.exe
  C:\Windows\System\oiUanFX.exe
  2⤵
  PID:7560
- C:\Windows\System\lndrHyk.exe
  C:\Windows\System\lndrHyk.exe
  2⤵
  PID:6492
- C:\Windows\System\fCqCTBF.exe
  C:\Windows\System\fCqCTBF.exe
  2⤵
  PID:5292
- C:\Windows\System\QzqenIS.exe
  C:\Windows\System\QzqenIS.exe
  2⤵
  PID:7880
- C:\Windows\System\wEMcIae.exe
  C:\Windows\System\wEMcIae.exe
  2⤵
  PID:2512
- C:\Windows\System\bagQruX.exe
  C:\Windows\System\bagQruX.exe
  2⤵
  PID:3056
- C:\Windows\System\vPLzbNI.exe
  C:\Windows\System\vPLzbNI.exe
  2⤵
  PID:8128
- C:\Windows\System\vdVKTMY.exe
  C:\Windows\System\vdVKTMY.exe
  2⤵
  PID:7984
- C:\Windows\System\KgFSRfh.exe
  C:\Windows\System\KgFSRfh.exe
  2⤵
  PID:564
- C:\Windows\System\Gzzyqpg.exe
  C:\Windows\System\Gzzyqpg.exe
  2⤵
  PID:7328
- C:\Windows\System\EAoqjMj.exe
  C:\Windows\System\EAoqjMj.exe
  2⤵
  PID:2848
- C:\Windows\System\GNDtsni.exe
  C:\Windows\System\GNDtsni.exe
  2⤵
  PID:7404
- C:\Windows\System\vjkXsgY.exe
  C:\Windows\System\vjkXsgY.exe
  2⤵
  PID:6368
- C:\Windows\System\KAnOTZH.exe
  C:\Windows\System\KAnOTZH.exe
  2⤵
  PID:8200
- C:\Windows\System\AVrFaHJ.exe
  C:\Windows\System\AVrFaHJ.exe
  2⤵
  PID:8216
- C:\Windows\System\TOEvlXt.exe
  C:\Windows\System\TOEvlXt.exe
  2⤵
  PID:8232
- C:\Windows\System\DInOcYD.exe
  C:\Windows\System\DInOcYD.exe
  2⤵
  PID:8248
- C:\Windows\System\lRJXQev.exe
  C:\Windows\System\lRJXQev.exe
  2⤵
  PID:8264
- C:\Windows\System\OHcZHga.exe
  C:\Windows\System\OHcZHga.exe
  2⤵
  PID:8280
- C:\Windows\System\DRsXzTd.exe
  C:\Windows\System\DRsXzTd.exe
  2⤵
  PID:8296
- C:\Windows\System\GmViiNG.exe
  C:\Windows\System\GmViiNG.exe
  2⤵
  PID:8312
- C:\Windows\System\ZPByGnx.exe
  C:\Windows\System\ZPByGnx.exe
  2⤵
  PID:8328
- C:\Windows\System\SEAkmCI.exe
  C:\Windows\System\SEAkmCI.exe
  2⤵
  PID:8344
- C:\Windows\System\NhdHOrF.exe
  C:\Windows\System\NhdHOrF.exe
  2⤵
  PID:8360
- C:\Windows\System\qKTjoyb.exe
  C:\Windows\System\qKTjoyb.exe
  2⤵
  PID:8376
- C:\Windows\System\XkhNRxF.exe
  C:\Windows\System\XkhNRxF.exe
  2⤵
  PID:8392
- C:\Windows\System\yFlCWrE.exe
  C:\Windows\System\yFlCWrE.exe
  2⤵
  PID:8428
- C:\Windows\System\axfGESX.exe
  C:\Windows\System\axfGESX.exe
  2⤵
  PID:8444
- C:\Windows\System\gRzByMC.exe
  C:\Windows\System\gRzByMC.exe
  2⤵
  PID:8460
- C:\Windows\System\zJzdoze.exe
  C:\Windows\System\zJzdoze.exe
  2⤵
  PID:8476
- C:\Windows\System\eFZIwPU.exe
  C:\Windows\System\eFZIwPU.exe
  2⤵
  PID:8492
- C:\Windows\System\GGSiftx.exe
  C:\Windows\System\GGSiftx.exe
  2⤵
  PID:8508
- C:\Windows\System\mBMmVBf.exe
  C:\Windows\System\mBMmVBf.exe
  2⤵
  PID:8524
- C:\Windows\System\PQzMDPw.exe
  C:\Windows\System\PQzMDPw.exe
  2⤵
  PID:8540
- C:\Windows\System\nrInjIk.exe
  C:\Windows\System\nrInjIk.exe
  2⤵
  PID:8556
- C:\Windows\System\meBxTPJ.exe
  C:\Windows\System\meBxTPJ.exe
  2⤵
  PID:8572
- C:\Windows\System\jCYAxpN.exe
  C:\Windows\System\jCYAxpN.exe
  2⤵
  PID:8588
- C:\Windows\System\EOPcmXT.exe
  C:\Windows\System\EOPcmXT.exe
  2⤵
  PID:8604
- C:\Windows\System\kzPdzYY.exe
  C:\Windows\System\kzPdzYY.exe
  2⤵
  PID:8620
- C:\Windows\System\SMNYqgP.exe
  C:\Windows\System\SMNYqgP.exe
  2⤵
  PID:8636
- C:\Windows\System\rSxboPs.exe
  C:\Windows\System\rSxboPs.exe
  2⤵
  PID:8652
- C:\Windows\System\qGcmqCR.exe
  C:\Windows\System\qGcmqCR.exe
  2⤵
  PID:8668
- C:\Windows\System\jdrSiLJ.exe
  C:\Windows\System\jdrSiLJ.exe
  2⤵
  PID:8684
- C:\Windows\System\pjZNHbn.exe
  C:\Windows\System\pjZNHbn.exe
  2⤵
  PID:8700
- C:\Windows\System\ZFKaJPn.exe
  C:\Windows\System\ZFKaJPn.exe
  2⤵
  PID:8716
- C:\Windows\System\DtyxqfR.exe
  C:\Windows\System\DtyxqfR.exe
  2⤵
  PID:8732
- C:\Windows\System\TdFPeju.exe
  C:\Windows\System\TdFPeju.exe
  2⤵
  PID:8748
- C:\Windows\System\CJFnsra.exe
  C:\Windows\System\CJFnsra.exe
  2⤵
  PID:8764
- C:\Windows\System\gQIshoK.exe
  C:\Windows\System\gQIshoK.exe
  2⤵
  PID:8780
- C:\Windows\System\RlrCKOJ.exe
  C:\Windows\System\RlrCKOJ.exe
  2⤵
  PID:8820
- C:\Windows\System\NKNlXBm.exe
  C:\Windows\System\NKNlXBm.exe
  2⤵
  PID:8836
- C:\Windows\System\iiMcnzg.exe
  C:\Windows\System\iiMcnzg.exe
  2⤵
  PID:8852
- C:\Windows\System\NROkIAz.exe
  C:\Windows\System\NROkIAz.exe
  2⤵
  PID:8868
- C:\Windows\System\MFypvGa.exe
  C:\Windows\System\MFypvGa.exe
  2⤵
  PID:8884
- C:\Windows\System\lHLtcnW.exe
  C:\Windows\System\lHLtcnW.exe
  2⤵
  PID:8900
- C:\Windows\System\vtPDczA.exe
  C:\Windows\System\vtPDczA.exe
  2⤵
  PID:8916
- C:\Windows\System\TnltUba.exe
  C:\Windows\System\TnltUba.exe
  2⤵
  PID:8932
- C:\Windows\System\StyygAJ.exe
  C:\Windows\System\StyygAJ.exe
  2⤵
  PID:8948
- C:\Windows\System\dGpdvOl.exe
  C:\Windows\System\dGpdvOl.exe
  2⤵
  PID:8964
- C:\Windows\System\GLPCgZF.exe
  C:\Windows\System\GLPCgZF.exe
  2⤵
  PID:8980
- C:\Windows\System\AoPiUdk.exe
  C:\Windows\System\AoPiUdk.exe
  2⤵
  PID:8996
- C:\Windows\System\pdXdkhg.exe
  C:\Windows\System\pdXdkhg.exe
  2⤵
  PID:9012
- C:\Windows\System\NVhytGG.exe
  C:\Windows\System\NVhytGG.exe
  2⤵
  PID:9028
- C:\Windows\System\KPnwXIl.exe
  C:\Windows\System\KPnwXIl.exe
  2⤵
  PID:9044
- C:\Windows\System\lkuxlWh.exe
  C:\Windows\System\lkuxlWh.exe
  2⤵
  PID:9060
- C:\Windows\System\XlPYGwn.exe
  C:\Windows\System\XlPYGwn.exe
  2⤵
  PID:9076
- C:\Windows\System\EuqwyEZ.exe
  C:\Windows\System\EuqwyEZ.exe
  2⤵
  PID:9092
- C:\Windows\System\GGRrVad.exe
  C:\Windows\System\GGRrVad.exe
  2⤵
  PID:9108
- C:\Windows\System\AkiiOlC.exe
  C:\Windows\System\AkiiOlC.exe
  2⤵
  PID:9124
- C:\Windows\System\gtvBkrT.exe
  C:\Windows\System\gtvBkrT.exe
  2⤵
  PID:9140
- C:\Windows\System\PcxCjSP.exe
  C:\Windows\System\PcxCjSP.exe
  2⤵
  PID:9156
- C:\Windows\System\rKGjnlQ.exe
  C:\Windows\System\rKGjnlQ.exe
  2⤵
  PID:9196
- C:\Windows\System\bNGaKec.exe
  C:\Windows\System\bNGaKec.exe
  2⤵
  PID:9212
- C:\Windows\System\ftcHcuD.exe
  C:\Windows\System\ftcHcuD.exe
  2⤵
  PID:7852
- C:\Windows\System\CTTNfhv.exe
  C:\Windows\System\CTTNfhv.exe
  2⤵
  PID:8064
- C:\Windows\System\kLxSeCj.exe
  C:\Windows\System\kLxSeCj.exe
  2⤵
  PID:7264
- C:\Windows\System\voINqMF.exe
  C:\Windows\System\voINqMF.exe
  2⤵
  PID:8224
- C:\Windows\System\VgyoXzJ.exe
  C:\Windows\System\VgyoXzJ.exe
  2⤵
  PID:8288
- C:\Windows\System\DVOQYFc.exe
  C:\Windows\System\DVOQYFc.exe
  2⤵
  PID:8352
- C:\Windows\System\gkUUaoy.exe
  C:\Windows\System\gkUUaoy.exe
  2⤵
  PID:1300
- C:\Windows\System\zbDNJUo.exe
  C:\Windows\System\zbDNJUo.exe
  2⤵
  PID:1368
- C:\Windows\System\FfYOlvf.exe
  C:\Windows\System\FfYOlvf.exe
  2⤵
  PID:7468
- C:\Windows\System\ghYnHYy.exe
  C:\Windows\System\ghYnHYy.exe
  2⤵
  PID:8208
- C:\Windows\System\JOthYEH.exe
  C:\Windows\System\JOthYEH.exe
  2⤵
  PID:8272
- C:\Windows\System\WGGiALF.exe
  C:\Windows\System\WGGiALF.exe
  2⤵
  PID:8336
- C:\Windows\System\zIGQKln.exe
  C:\Windows\System\zIGQKln.exe
  2⤵
  PID:8400
- C:\Windows\System\kBeCgxA.exe
  C:\Windows\System\kBeCgxA.exe
  2⤵
  PID:8404
- C:\Windows\System\UqdxxKj.exe
  C:\Windows\System\UqdxxKj.exe
  2⤵
  PID:8472
- C:\Windows\System\iCPfpGt.exe
  C:\Windows\System\iCPfpGt.exe
  2⤵
  PID:8536
- C:\Windows\System\MIODsPx.exe
  C:\Windows\System\MIODsPx.exe
  2⤵
  PID:8600
- C:\Windows\System\MjbcHOM.exe
  C:\Windows\System\MjbcHOM.exe
  2⤵
  PID:8664
- C:\Windows\System\kNUJSGA.exe
  C:\Windows\System\kNUJSGA.exe
  2⤵
  PID:8728
- C:\Windows\System\agwvqQT.exe
  C:\Windows\System\agwvqQT.exe
  2⤵
  PID:8412
- C:\Windows\System\LGCXpZt.exe
  C:\Windows\System\LGCXpZt.exe
  2⤵
  PID:4068
- C:\Windows\System\xXrszCf.exe
  C:\Windows\System\xXrszCf.exe
  2⤵
  PID:8488
- C:\Windows\System\bFBVFEy.exe
  C:\Windows\System\bFBVFEy.exe
  2⤵
  PID:8580
- C:\Windows\System\WPwCfik.exe
  C:\Windows\System\WPwCfik.exe
  2⤵
  PID:8644
- C:\Windows\System\ucJLENf.exe
  C:\Windows\System\ucJLENf.exe
  2⤵
  PID:8708
- C:\Windows\System\ccCWjpb.exe
  C:\Windows\System\ccCWjpb.exe
  2⤵
  PID:8772
- C:\Windows\System\AWuhhHw.exe
  C:\Windows\System\AWuhhHw.exe
  2⤵
  PID:8876
- C:\Windows\System\QsyBFfu.exe
  C:\Windows\System\QsyBFfu.exe
  2⤵
  PID:8944
- C:\Windows\System\TTyQWwN.exe
  C:\Windows\System\TTyQWwN.exe
  2⤵
  PID:9036
- C:\Windows\System\NGwftzb.exe
  C:\Windows\System\NGwftzb.exe
  2⤵
  PID:9072
- C:\Windows\System\avYKbKe.exe
  C:\Windows\System\avYKbKe.exe
  2⤵
  PID:9136
- C:\Windows\System\xBJxjdf.exe
  C:\Windows\System\xBJxjdf.exe
  2⤵
  PID:8452
- C:\Windows\System\FsSfkoy.exe
  C:\Windows\System\FsSfkoy.exe
  2⤵
  PID:8864
- C:\Windows\System\GaWoZrO.exe
  C:\Windows\System\GaWoZrO.exe
  2⤵
  PID:8928
- C:\Windows\System\SMEfsau.exe
  C:\Windows\System\SMEfsau.exe
  2⤵
  PID:8992
- C:\Windows\System\lslasoC.exe
  C:\Windows\System\lslasoC.exe
  2⤵
  PID:9056
- C:\Windows\System\OBUsanS.exe
  C:\Windows\System\OBUsanS.exe
  2⤵
  PID:9120
- C:\Windows\System\wklGPKX.exe
  C:\Windows\System\wklGPKX.exe
  2⤵
  PID:9220
- C:\Windows\System\pOKisTx.exe
  C:\Windows\System\pOKisTx.exe
  2⤵
  PID:9236
- C:\Windows\System\bzFTidd.exe
  C:\Windows\System\bzFTidd.exe
  2⤵
  PID:9252
- C:\Windows\System\pdpfZiV.exe
  C:\Windows\System\pdpfZiV.exe
  2⤵
  PID:9268
- C:\Windows\System\XQjngJq.exe
  C:\Windows\System\XQjngJq.exe
  2⤵
  PID:9284
- C:\Windows\System\EQMHiLi.exe
  C:\Windows\System\EQMHiLi.exe
  2⤵
  PID:9300
- C:\Windows\System\fUHnVOI.exe
  C:\Windows\System\fUHnVOI.exe
  2⤵
  PID:9316
- C:\Windows\System\gMrSKDl.exe
  C:\Windows\System\gMrSKDl.exe
  2⤵
  PID:9340
- C:\Windows\System\kCMkwFG.exe
  C:\Windows\System\kCMkwFG.exe
  2⤵
  PID:9360
- C:\Windows\System\NDZmAku.exe
  C:\Windows\System\NDZmAku.exe
  2⤵
  PID:9376
- C:\Windows\System\ETwrbiY.exe
  C:\Windows\System\ETwrbiY.exe
  2⤵
  PID:9392
- C:\Windows\System\GFkYMnL.exe
  C:\Windows\System\GFkYMnL.exe
  2⤵
  PID:9408
- C:\Windows\System\lTjJusO.exe
  C:\Windows\System\lTjJusO.exe
  2⤵
  PID:9424
- C:\Windows\System\gfuVnuY.exe
  C:\Windows\System\gfuVnuY.exe
  2⤵
  PID:9440
- C:\Windows\System\dzWpxLc.exe
  C:\Windows\System\dzWpxLc.exe
  2⤵
  PID:9456
- C:\Windows\System\MHtsecK.exe
  C:\Windows\System\MHtsecK.exe
  2⤵
  PID:9472
- C:\Windows\System\LLRaMqv.exe
  C:\Windows\System\LLRaMqv.exe
  2⤵
  PID:9488
- C:\Windows\System\JYfaorT.exe
  C:\Windows\System\JYfaorT.exe
  2⤵
  PID:9504
- C:\Windows\System\RuvBrxg.exe
  C:\Windows\System\RuvBrxg.exe
  2⤵
  PID:9520
- C:\Windows\System\DrAJxsS.exe
  C:\Windows\System\DrAJxsS.exe
  2⤵
  PID:9536
- C:\Windows\System\hHfhOyT.exe
  C:\Windows\System\hHfhOyT.exe
  2⤵
  PID:9552
- C:\Windows\System\pwmZxsR.exe
  C:\Windows\System\pwmZxsR.exe
  2⤵
  PID:9568
- C:\Windows\System\AgkNhvt.exe
  C:\Windows\System\AgkNhvt.exe
  2⤵
  PID:9584
- C:\Windows\System\cMAtvnJ.exe
  C:\Windows\System\cMAtvnJ.exe
  2⤵
  PID:9600
- C:\Windows\System\qtNeyMi.exe
  C:\Windows\System\qtNeyMi.exe
  2⤵
  PID:9616
- C:\Windows\System\qVoalli.exe
  C:\Windows\System\qVoalli.exe
  2⤵
  PID:9632
- C:\Windows\System\pWWXrHs.exe
  C:\Windows\System\pWWXrHs.exe
  2⤵
  PID:9648
- C:\Windows\System\ZmoJOQX.exe
  C:\Windows\System\ZmoJOQX.exe
  2⤵
  PID:9680
- C:\Windows\System\HKSyMsS.exe
  C:\Windows\System\HKSyMsS.exe
  2⤵
  PID:9696
- C:\Windows\System\AfygvnQ.exe
  C:\Windows\System\AfygvnQ.exe
  2⤵
  PID:9712
- C:\Windows\System\DvVVugY.exe
  C:\Windows\System\DvVVugY.exe
  2⤵
  PID:9728
- C:\Windows\System\UFvhgjl.exe
  C:\Windows\System\UFvhgjl.exe
  2⤵
  PID:9744
- C:\Windows\System\jDwuhMT.exe
  C:\Windows\System\jDwuhMT.exe
  2⤵
  PID:9760
- C:\Windows\System\IDFKBgK.exe
  C:\Windows\System\IDFKBgK.exe
  2⤵
  PID:9776
- C:\Windows\System\BleQGVJ.exe
  C:\Windows\System\BleQGVJ.exe
  2⤵
  PID:9792
- C:\Windows\System\elOBGND.exe
  C:\Windows\System\elOBGND.exe
  2⤵
  PID:9808
- C:\Windows\System\VTCjteF.exe
  C:\Windows\System\VTCjteF.exe
  2⤵
  PID:9824
- C:\Windows\System\bJQrBTN.exe
  C:\Windows\System\bJQrBTN.exe
  2⤵
  PID:9840
- C:\Windows\System\hTUgHoH.exe
  C:\Windows\System\hTUgHoH.exe
  2⤵
  PID:9856
- C:\Windows\System\iuTsnVD.exe
  C:\Windows\System\iuTsnVD.exe
  2⤵
  PID:9872
- C:\Windows\System\EBnfNld.exe
  C:\Windows\System\EBnfNld.exe
  2⤵
  PID:9888
- C:\Windows\System\KoBaWMU.exe
  C:\Windows\System\KoBaWMU.exe
  2⤵
  PID:9904
- C:\Windows\System\PMBXaLA.exe
  C:\Windows\System\PMBXaLA.exe
  2⤵
  PID:9920
- C:\Windows\System\fgByXiZ.exe
  C:\Windows\System\fgByXiZ.exe
  2⤵
  PID:9936
- C:\Windows\System\tDeUEsH.exe
  C:\Windows\System\tDeUEsH.exe
  2⤵
  PID:9952
- C:\Windows\System\FBloNYq.exe
  C:\Windows\System\FBloNYq.exe
  2⤵
  PID:9968
- C:\Windows\System\nQtrjjz.exe
  C:\Windows\System\nQtrjjz.exe
  2⤵
  PID:9984
- C:\Windows\System\KcHLbdq.exe
  C:\Windows\System\KcHLbdq.exe
  2⤵
  PID:10000
- C:\Windows\System\ZQtblbm.exe
  C:\Windows\System\ZQtblbm.exe
  2⤵
  PID:10016
- C:\Windows\System\jYxyUyt.exe
  C:\Windows\System\jYxyUyt.exe
  2⤵
  PID:10036
- C:\Windows\System\MkfKkRp.exe
  C:\Windows\System\MkfKkRp.exe
  2⤵
  PID:10052
- C:\Windows\System\KnBjxfD.exe
  C:\Windows\System\KnBjxfD.exe
  2⤵
  PID:10068
- C:\Windows\System\UKGgItx.exe
  C:\Windows\System\UKGgItx.exe
  2⤵
  PID:10084
- C:\Windows\System\FqWhYsf.exe
  C:\Windows\System\FqWhYsf.exe
  2⤵
  PID:10100
- C:\Windows\System\KAdfTZm.exe
  C:\Windows\System\KAdfTZm.exe
  2⤵
  PID:10116
- C:\Windows\System\phTPgPE.exe
  C:\Windows\System\phTPgPE.exe
  2⤵
  PID:10132
- C:\Windows\System\wsjomcP.exe
  C:\Windows\System\wsjomcP.exe
  2⤵
  PID:10148
- C:\Windows\System\FOwSFgw.exe
  C:\Windows\System\FOwSFgw.exe
  2⤵
  PID:10164
- C:\Windows\System\srIXewb.exe
  C:\Windows\System\srIXewb.exe
  2⤵
  PID:10180
- C:\Windows\System\vcbwWLJ.exe
  C:\Windows\System\vcbwWLJ.exe
  2⤵
  PID:10196
- C:\Windows\System\VECkVCL.exe
  C:\Windows\System\VECkVCL.exe
  2⤵
  PID:10212
- C:\Windows\System\NQSJaHm.exe
  C:\Windows\System\NQSJaHm.exe
  2⤵
  PID:10228
- C:\Windows\System\FTcXtOJ.exe
  C:\Windows\System\FTcXtOJ.exe
  2⤵
  PID:6920
- C:\Windows\System\AXOmBpm.exe
  C:\Windows\System\AXOmBpm.exe
  2⤵
  PID:8260
- C:\Windows\System\vOchNxJ.exe
  C:\Windows\System\vOchNxJ.exe
  2⤵
  PID:8144
- C:\Windows\System\nUjouuV.exe
  C:\Windows\System\nUjouuV.exe
  2⤵
  PID:8372
- C:\Windows\System\nZKSezE.exe
  C:\Windows\System\nZKSezE.exe
  2⤵
  PID:8596
- C:\Windows\System\Pgaocuh.exe
  C:\Windows\System\Pgaocuh.exe
  2⤵
  PID:8808
- C:\Windows\System\gPrAqFg.exe
  C:\Windows\System\gPrAqFg.exe
  2⤵
  PID:8676
- C:\Windows\System\EdvHtMx.exe
  C:\Windows\System\EdvHtMx.exe
  2⤵
  PID:8976
- C:\Windows\System\wstgHPj.exe
  C:\Windows\System\wstgHPj.exe
  2⤵
  PID:8960
- C:\Windows\System\sEoGGve.exe
  C:\Windows\System\sEoGGve.exe
  2⤵
  PID:9228
- C:\Windows\System\JsUYDfj.exe
  C:\Windows\System\JsUYDfj.exe
  2⤵
  PID:9292
- C:\Windows\System\HSXkVHW.exe
  C:\Windows\System\HSXkVHW.exe
  2⤵
  PID:9188
- C:\Windows\System\jDalNtz.exe
  C:\Windows\System\jDalNtz.exe
  2⤵
  PID:2116
- C:\Windows\System\gQRzeDy.exe
  C:\Windows\System\gQRzeDy.exe
  2⤵
  PID:2456
- C:\Windows\System\oCWwCuu.exe
  C:\Windows\System\oCWwCuu.exe
  2⤵
  PID:8308
- C:\Windows\System\zmAsxUI.exe
  C:\Windows\System\zmAsxUI.exe
  2⤵
  PID:8532
- C:\Windows\System\ukFefsL.exe
  C:\Windows\System\ukFefsL.exe
  2⤵
  PID:8788
- C:\Windows\System\ARvhdiu.exe
  C:\Windows\System\ARvhdiu.exe
  2⤵
  PID:8740
- C:\Windows\System\fcPVKIZ.exe
  C:\Windows\System\fcPVKIZ.exe
  2⤵
  PID:8912
- C:\Windows\System\bmjiWtz.exe
  C:\Windows\System\bmjiWtz.exe
  2⤵
  PID:8924
- C:\Windows\System\KaLNYIv.exe
  C:\Windows\System\KaLNYIv.exe
  2⤵
  PID:9168
- C:\Windows\System\cEUPopG.exe
  C:\Windows\System\cEUPopG.exe
  2⤵
  PID:9280
- C:\Windows\System\ZqxPokE.exe
  C:\Windows\System\ZqxPokE.exe
  2⤵
  PID:948
- C:\Windows\System\Clljufk.exe
  C:\Windows\System\Clljufk.exe
  2⤵
  PID:944
- C:\Windows\System\rXgbptq.exe
  C:\Windows\System\rXgbptq.exe
  2⤵
  PID:9404
- C:\Windows\System\wRdPnyW.exe
  C:\Windows\System\wRdPnyW.exe
  2⤵
  PID:9468
- C:\Windows\System\GMHFZjS.exe
  C:\Windows\System\GMHFZjS.exe
  2⤵
  PID:9532
- C:\Windows\System\RtqPMYP.exe
  C:\Windows\System\RtqPMYP.exe
  2⤵
  PID:9596
- C:\Windows\System\ZGcPsJo.exe
  C:\Windows\System\ZGcPsJo.exe
  2⤵
  PID:8816
- C:\Windows\System\pOWmUbg.exe
  C:\Windows\System\pOWmUbg.exe
  2⤵
  PID:8940
- C:\Windows\System\gamGDjc.exe
  C:\Windows\System\gamGDjc.exe
  2⤵
  PID:9068
- C:\Windows\System\ZftGwsf.exe
  C:\Windows\System\ZftGwsf.exe
  2⤵
  PID:9736
- C:\Windows\System\HzzgseV.exe
  C:\Windows\System\HzzgseV.exe
  2⤵
  PID:9800
- C:\Windows\System\CHffjfM.exe
  C:\Windows\System\CHffjfM.exe
  2⤵
  PID:9864
- C:\Windows\System\JBQVCRr.exe
  C:\Windows\System\JBQVCRr.exe
  2⤵
  PID:9928
- C:\Windows\System\gImbKKw.exe
  C:\Windows\System\gImbKKw.exe
  2⤵
  PID:9992
- C:\Windows\System\VyMLmEa.exe
  C:\Windows\System\VyMLmEa.exe
  2⤵
  PID:9348
- C:\Windows\System\kqyMjUk.exe
  C:\Windows\System\kqyMjUk.exe
  2⤵
  PID:9576
- C:\Windows\System\bnfJgfr.exe
  C:\Windows\System\bnfJgfr.exe
  2⤵
  PID:9548
- C:\Windows\System\cASllfl.exe
  C:\Windows\System\cASllfl.exe
  2⤵
  PID:9512
- C:\Windows\System\YlvYwFI.exe
  C:\Windows\System\YlvYwFI.exe
  2⤵
  PID:9420
- C:\Windows\System\nwVPuJi.exe
  C:\Windows\System\nwVPuJi.exe
  2⤵
  PID:9356
- C:\Windows\System\RRWtFDS.exe
  C:\Windows\System\RRWtFDS.exe
  2⤵
  PID:9884
- C:\Windows\System\cQFJBpc.exe
  C:\Windows\System\cQFJBpc.exe
  2⤵
  PID:9948
- C:\Windows\System\HBDUipn.exe
  C:\Windows\System\HBDUipn.exe
  2⤵
  PID:10012
- C:\Windows\System\wXDwyDK.exe
  C:\Windows\System\wXDwyDK.exe
  2⤵
  PID:10092
- C:\Windows\System\CMFegKw.exe
  C:\Windows\System\CMFegKw.exe
  2⤵
  PID:10156
- C:\Windows\System\LnQWrnw.exe
  C:\Windows\System\LnQWrnw.exe
  2⤵
  PID:10220
- C:\Windows\System\jqPeqtB.exe
  C:\Windows\System\jqPeqtB.exe
  2⤵
  PID:8244
- C:\Windows\System\FfTNENK.exe
  C:\Windows\System\FfTNENK.exe
  2⤵
  PID:8792
- C:\Windows\System\wBpHXNC.exe
  C:\Windows\System\wBpHXNC.exe
  2⤵
  PID:9692
- C:\Windows\System\bZJtVYX.exe
  C:\Windows\System\bZJtVYX.exe
  2⤵
  PID:9848
- C:\Windows\System\YAkWapm.exe
  C:\Windows\System\YAkWapm.exe
  2⤵
  PID:10144
- C:\Windows\System\ICAGxmX.exe
  C:\Windows\System\ICAGxmX.exe
  2⤵
  PID:9104
- C:\Windows\System\gpervoF.exe
  C:\Windows\System\gpervoF.exe
  2⤵
  PID:9324
- C:\Windows\System\bcdVeqo.exe
  C:\Windows\System\bcdVeqo.exe
  2⤵
  PID:6456
- C:\Windows\System\jooorCY.exe
  C:\Windows\System\jooorCY.exe
  2⤵
  PID:8424
- C:\Windows\System\PUcpryb.exe
  C:\Windows\System\PUcpryb.exe
  2⤵
  PID:968
- C:\Windows\System\hVxOOSA.exe
  C:\Windows\System\hVxOOSA.exe
  2⤵
  PID:9564
- C:\Windows\System\HrVcVog.exe
  C:\Windows\System\HrVcVog.exe
  2⤵
  PID:10032
- C:\Windows\System\FJSWpQc.exe
  C:\Windows\System\FJSWpQc.exe
  2⤵
  PID:10080
- C:\Windows\System\KoDqQKE.exe
  C:\Windows\System\KoDqQKE.exe
  2⤵
  PID:10204
- C:\Windows\System\wbaDHEG.exe
  C:\Windows\System\wbaDHEG.exe
  2⤵
  PID:8112
- C:\Windows\System\lDLjCZr.exe
  C:\Windows\System\lDLjCZr.exe
  2⤵
  PID:7688
- C:\Windows\System\FsAXXap.exe
  C:\Windows\System\FsAXXap.exe
  2⤵
  PID:9052
- C:\Windows\System\OhpFkap.exe
  C:\Windows\System\OhpFkap.exe
  2⤵
  PID:9400
- C:\Windows\System\kDlwFrn.exe
  C:\Windows\System\kDlwFrn.exe
  2⤵
  PID:9628
- C:\Windows\System\NrgjhVd.exe
  C:\Windows\System\NrgjhVd.exe
  2⤵
  PID:9836
- C:\Windows\System\NCQdmqY.exe
  C:\Windows\System\NCQdmqY.exe
  2⤵
  PID:9932
- C:\Windows\System\mGiWmEH.exe
  C:\Windows\System\mGiWmEH.exe
  2⤵
  PID:9516
- C:\Windows\System\lAzULMR.exe
  C:\Windows\System\lAzULMR.exe
  2⤵
  PID:9916
- C:\Windows\System\VOhUDGk.exe
  C:\Windows\System\VOhUDGk.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HDDNMJf.exe

Filesize
1.9MB

MD5
4f43eb837b65d57c53c7fb7b468e34e3

SHA1
de71301b9b20c8cc93bc836983f79adf968e701d

SHA256
b596578fbd2bc028bc7c961a89c33731c52b0d848dabdb3d3a4130ed3d087a1a

SHA512
ad1e524e61bd0ce1a04d5d039b42f667b765cbcc394b65ef96c9c71724089610abf0b123edfec319395e9702ccf8a009c727586bd5d3cc3889271bca514d8596

Download Submit
C:\Windows\system\HPoFedx.exe

Filesize
1.9MB

MD5
5dbd8d96fe781f4264c65ec5555e5cae

SHA1
413911c28891628a020da8fcdc9be8ea8cbf232a

SHA256
6447e24cd28e26807d20b4e7683cc59e078cd7e46fe2020e0b7abcaa0dd868bb

SHA512
2c6bb6ad73f293518005379766ab909a6e91b622fce220ac3e67dc0a62f5ee75ad1ec680642412ab40e89dc9dd6e0b58a396dbbfe9cd3f67a1842ffd2c7a3c12

Download Submit
C:\Windows\system\JuPlLny.exe

Filesize
1.9MB

MD5
4253b84b9fdd67576c754a10ffe0f69d

SHA1
a14c0d5cf30018ee113694eb9b709da66317ac6c

SHA256
8c3e9c682dafe44ec0104454cbf943e9d0bd3306f2a83b45f186235d954ebb47

SHA512
d8c04a0253ee5353ac6ac22b5d63118a37c0c5816ede7d92f21c2463fe6da90435afa86f4d29a37cff35f8a249a1a47e5603df34acf4abdaa8a8a5ad8bec09a8

Download Submit
C:\Windows\system\JusMosy.exe

Filesize
1.9MB

MD5
aeae3cd3ec0e90c440a314f4c455487b

SHA1
c46b3ebd5e538522b0cbe3606cba4001498d201c

SHA256
6841c09a1fbcacc69ea55c5aa9dff29a3cf64928adb811f809231642f8eb792d

SHA512
40625a39506a7f0cdcf6efd1e7bd5df2866961e45566b28ffd7573db6a9a39677b08abc77ee4a4956eeb3edebfbef016d4f819b2a3c57243360d0bab1cf793b3

Download Submit
C:\Windows\system\OWOvCAP.exe

Filesize
1.9MB

MD5
2902b650670ba0bbe02d907f774d8982

SHA1
825f8f6f4f21ae416a082e3d9e929818a5b48945

SHA256
f3989435580587eafd08ea0712e98d8e43b79a2be424cbc8759d93384a7f578f

SHA512
919453475df8cf899f1118a5ff894bacc7955925b2483ec212356dfee935b26065004ad83db4c56cfa7802ea974f3903ff319dfe8a5012666c88c6e3de215bd6

Download Submit
C:\Windows\system\UyAOJNP.exe

Filesize
1.9MB

MD5
2c65a7cc0382b7af067dfdc6cfabe0b4

SHA1
f7e91ab9815480961cdf3fa0f9dc3631f34d316b

SHA256
66656b05e370f2d8cbd79cca3a2261cd087cc110d5e2591809c66683cddea448

SHA512
20f604696f857fccc36ea8d449099765f8f4520141377d1cd239b03d176e2b58a95df57620944bf9624af3ef99ccba9dd41ce62da6466db8f8101e85153dd153

Download Submit
C:\Windows\system\WoPwiXg.exe

Filesize
1.9MB

MD5
3c14dfab5128300f7ceda63693502971

SHA1
4fc327d7ea54c0ddb4b6869f23d1792708b2bac4

SHA256
d7f8256a38ec7b564961f8eaef2a2410a74892ddcf6dcd46f04b95945b2c8fab

SHA512
38cd6f5f513f13969b39d79a2a8dd1d84ebe593587f6399a201986f4ad488daa73c13a1aaddb3200f98228f9749b52551735e6fe62a6efd75171b41ba3f1eaa9

Download Submit
C:\Windows\system\YUtkUpD.exe

Filesize
1.9MB

MD5
d58fdf8c4c59bf4c94e4b06cbd447a66

SHA1
57fe0d7400a88183c3248289d280a2c3f585f3ca

SHA256
43b51eb113f2da6ec6842ad8a67331f17fface662ca7ccc8a55f82f16e5d09fb

SHA512
5531af38dcb97a8e4da11a162f19dab45ab799b387bfc6493cf6663d6aef699cf50c61ac1e99656f5dcec57b0ad7e23f29deb1a22feaed41224bfce59580cd7a

Download Submit
C:\Windows\system\YcQXptC.exe

Filesize
1.9MB

MD5
067b5e6958ea8dc51bcc57059604d949

SHA1
a955c5809420b357742c4683da810f7c03c06bbd

SHA256
6b2fc141697d37f3bcaf9f1031b2cd3e46a184a57d4dbf756adaa84f7a5bfc69

SHA512
b1227dbb8207f9f591635dc35e12425b271a71f2529591f3e5ab5632cfd30c676f1ef103adb02f4c18e2ae69bccf407ecb2faa4dff17b264c8e119c8175f29c1

Download Submit
C:\Windows\system\YvwTpDu.exe

Filesize
1.9MB

MD5
17cc3f6256ac6cb88287da268e34a0bb

SHA1
c2eb320dd25bd5ec0041999375dd36e672b0e809

SHA256
41625925dce69578604f4ad4211433b959e85a446ee5fb066d2f55c1b300fb80

SHA512
76b2c9d485056c7698c9dd09b04c1064b517364f22299e5bd016ad668eedb037f525873fbeccbbd24f2340cbec5b24c41074defce393eb6852230a103689a583

Download Submit
C:\Windows\system\aJkIWsr.exe

Filesize
1.9MB

MD5
f0a9bb329983afb5b8fe2498fe326f84

SHA1
2f45af49799e6c7937b22ead74b3fd399a88ac1d

SHA256
106d29222f247e3c5897403657399783cb4deb9e799b6b374645cabf27f27902

SHA512
84481236a36f17d1b2a78f6263db7c831fbfbde0e9b477bbbfc0ec11ea8fa0bee2d2108f3cbbc0b232d6bfa01fac2abf6a894b4a7f0292d3c0b0b1ce6b4d45fa

Download Submit
C:\Windows\system\cKIKCXa.exe

Filesize
1.9MB

MD5
4fd21ef1d63e74cecb75edd8cffe8eef

SHA1
a91849134d5298bff8d7a7b88fd82ec13254c42a

SHA256
8f8c58fdbdf44539150bceea9c3f32bce0b11b3b94819da16a1c315748859b68

SHA512
ccbe72065e29ec16039573e0825a6ff5447e79339bca97aa75086eebb0ecebc65e9376fec6f01109d44dad4e93b65d11b5f2b4c9bb9e0dccabba637f31bd9418

Download Submit
C:\Windows\system\diKAHfJ.exe

Filesize
1.9MB

MD5
40da946bf46e09f16b27d3010ec3b6e8

SHA1
e3c47223634fd1a28883da0c6e30f39c47ca028b

SHA256
9e2e983009896c8ded39457a483b4d05f2f6937e82618096557ad51f24a2ab5a

SHA512
e651115a14d7f53079f9429270e38c4c24f23a277e18f92c19ab9e2344abae76e2ed1515a5c3beb7e6ae4f819ccff040eb3cb6b0716d2e2a06e8557f253258db

Download Submit
C:\Windows\system\flpdCkU.exe

Filesize
1.9MB

MD5
b7531492aa2307da8a53dad0029c8bc0

SHA1
cee53f785947bc5305393b2b74bdad2ac971053e

SHA256
952830a6817d318a7cb6710cb5be5bac479d9f231368f81753a89fc4f9aac0f5

SHA512
dda529a23226c15b4e7d3050883278039cf4908c8dad4ae06c795be3f1789641d603a00a830b4e80ab3615a7bab22e6cb42056064147dd2fe669bc3552cbf462

Download Submit
C:\Windows\system\gqJaDPY.exe

Filesize
1.9MB

MD5
a2726ea484c6525a9f0902ab6db7cf86

SHA1
6f2602c7cba911d98619b93f7f70603ccd0fe5f3

SHA256
8d94855b891cf7b28ec55eb81dea2211005be0f32409901c3592da17f772f39c

SHA512
c5c90b94f280128cfd50d055b94a49a0652a765566f4d94c0db0951bf7ed3902574cfae047c02ded0251a1f4893664cbe90eacc79ba8c342c0859fe4e7ba6e83

Download Submit
C:\Windows\system\ihrICRT.exe

Filesize
1.9MB

MD5
b82324a7696f68a2929a36cbf354495b

SHA1
5d4d02616309d26a3eac23e73ef4c5c68947e669

SHA256
73579aefe0d4585a91367006b7834f8454ae469c4723e4db25d244e43108ae30

SHA512
9f066d9393b99327fb139e735294aa89ebc6c9de6726bf9fff84d15980fbfcef05efa556621d53b57273ce01aab2e38b7002a737c48dd7832d1cfe1ac71abad7

Download Submit
C:\Windows\system\rgnxvdt.exe

Filesize
1.9MB

MD5
57f3151a8dcc9433156075766aa43349

SHA1
2386d81f579751ffc19707f1c941c93938cd5edb

SHA256
73fcd631bb8d0b872bee337656968dab47eb7e28456cb66191718563c6c595bf

SHA512
2e1e1bfec348db21dd4af2d2055bb8e45508b915806f6e6e4ee20567d44634d6a3f3c290475cb6151c5db460876ee76bf34538ad848f1d133c2dc646c7d7fbea

Download Submit
C:\Windows\system\rvpwIbJ.exe

Filesize
1.9MB

MD5
d18705cce4f5944eb4f518e484e2728b

SHA1
ee11ef1b1e9fbf221afe7449aa063a14db6797d6

SHA256
de05293a2f37d316add1c5f4cd16c25648a5cbdbc05f16650e370d506bb915c8

SHA512
eb45099878c47183192d0ced00506ef03a8e9c0fb5f8d649dfb57219b63cd4cf98df4fc47c0becebe92ed4350a54b0ba42f1f40f2d0241fd8c1f175d20459e67

Download Submit
C:\Windows\system\tbexQIx.exe

Filesize
1.9MB

MD5
4446186d7a1969a7eec7c549672c15f3

SHA1
82bfe0f41204dba2f9900976b2923b83cd63898b

SHA256
8c4ad8071c83a38ab5b3250dcf7eb042ebfba368d70d70b5eb5d914204b8e578

SHA512
29e31134bdd4ad97facc962cf1e30e56abb7b3a05aa55ce59dbc7fb03041ce01539da2f9adf01ea0a23b798e1dd0579e5ac8c4d634e0e82947356eaf8fe51ed2

Download Submit
C:\Windows\system\uqwEOTB.exe

Filesize
1.9MB

MD5
57af185821c546cb500e04b711e0a683

SHA1
1e3965438f56e876ebd62c0e9407527b4a36bba5

SHA256
3ca51d8c4a3c69478f47bf4a53448b509e7efb5aa265071fe019e3f6c758482f

SHA512
cce8d711a6daaeacacaabd5f2833216d9ae72ad93c5b0efd0d13d4f7b81de205f9560d71a4a0d62dfa327e14c12a438cd872f9a6073962588f2d2b12d8c950c4

Download Submit
C:\Windows\system\uwqYSPE.exe

Filesize
1.9MB

MD5
46d069f4b853f84151934d4e19ca4179

SHA1
32bfe1c43101ebc51ae2b12960dea7dbb985db81

SHA256
9c0b89ed4d6ed8de8be422c001a386b36a8f2d91198602001e6792bfbb9714c6

SHA512
4a391bd80b948042656698640260e57a84ae3469cfb717b85c3bed3cf9de5667fbab3ed37b2998a8241625ed8f2a7a3288b81fbdb5a2e2fb80d729129f2ca807

Download Submit
C:\Windows\system\wAtkGbU.exe

Filesize
1.9MB

MD5
6e6add52a3e0ff4db04205b7acc48aba

SHA1
7d4b95c6e3f8939e7bc9b82d8b5f1fec5dd7cd83

SHA256
e6fdc784dd5fc1b8818eef3336393a399c93df747e1ea342dcc5f8541d1041bb

SHA512
e40166135abf696c0a37ea62ed1baec87e84de16e75e63d7b7cea384274793d7ffe0248255f5016167da3aa87e0cc0b329156fcabbe3f1cf29e802e09afb36aa

Download Submit
C:\Windows\system\ygVSbdG.exe

Filesize
1.9MB

MD5
71f2bf9165c2c9935400e30fdd3ac7f6

SHA1
add21d7c938b0819c67b95d3a894cbee771172ed

SHA256
bbe1766cc39dbe881e17f62aa141238a536fb70f5a26b13f53011d9d473bb4bb

SHA512
fd073e1094feb7001750498af103b209d302e738345bd4df0126edcf35b22a425e4d07d325abbaa12a750196e0d256166579abdd61097ad51658748c332bf7c7

Download Submit
\Windows\system\AibAvVx.exe

Filesize
1.9MB

MD5
a49212aaa8862cd4f80324b1c8132504

SHA1
83984cfc7cb574507c7e0ec71cd7caf17e661716

SHA256
3bf2608aa636725999711c865fd7c9394aa3bc0a45869ed599e50cfd2354c5a6

SHA512
273a1e58457f5b0badd3eea8268c0a21b627a1fe796fbc9d2872d8bf9e4e6296d8643c88af2519e1296a0b9234a670b02999f0dba56be46dc8471eb13c285da4

Download Submit
\Windows\system\DrGQIQi.exe

Filesize
1.9MB

MD5
7617f40dde6d3ff5a9965270784c14de

SHA1
999b56af152bef38b5f3bf01942600d1db8baf58

SHA256
5c6e16cc9b5748e42e6431882d1aebf99dfa4b4077c53bcabd9fd538514def35

SHA512
44ed4d4c78da4563bd8f6f85db41019306d2fabe78f02aa93547b66de19a7ed2e7cf0ff565eafffcc25c0274e4dc5d1ef4ac32317626de2bc3433384fccf0c5e

Download Submit
\Windows\system\FFoJVnZ.exe

Filesize
1.9MB

MD5
7aaab5e9fb1858e19a29eefcb7f9100f

SHA1
61c84c8929046ab3fc4dc481715d8255e3d7d799

SHA256
7fc1eb7d0aeb108cf883ef078305ea0f640a9371a3b4eb8bca87649eb90a4b61

SHA512
c1c0de1662c0c2e7f93835a47c6d9805d8746bf5fb578e4cc9d8e7f758eb87b834d5c59163daaa0eff136e5d04f4e1178eb4df3a0ad1c6b023a1305e1066b290

Download Submit
\Windows\system\JSTbsdk.exe

Filesize
1.9MB

MD5
92322cee44f7799276e335ab96d1c52b

SHA1
8b502f9011f5a1202c20777b3c43b729f04a60f3

SHA256
f918549b7c8289f43635e21d4c10b2a7a5916bdebed0c0c21f5252d2a40a3918

SHA512
e1d49c1a357e4badd641c212bdd6a8a7281d53d4a62c4aa08ee734aa65a07858b20d5c32dacbdf39d5e6f5d9577dd30304a02b14a6f8486469b81e0237387964

Download Submit
\Windows\system\NFYJNBv.exe

Filesize
1.9MB

MD5
c8e0f4c21933a76d4176bf3d57ab7883

SHA1
b5898fd3d984196b0442390519e4d0cc9c18bf65

SHA256
8715f58b0f85059c9d5aa26894fe66cffd4aab7bb34f47712d44a00b11fe1936

SHA512
bb168cd07c415060236264dc19332723f5a6d85ea329655771df132dfce3c52d0bb7af0e98bb015cdcb79e0de929f5ad1cfeb1d5d11d01cc59ce274d980a7124

Download Submit
\Windows\system\QZIDZfc.exe

Filesize
1.9MB

MD5
14623effc9633637e167b3ec957dfc10

SHA1
26d7d6cd4c971eca6034bfea8d30b9b0f1823659

SHA256
5510c73850252a3ee71bfc7efa75fdba8f3052b579cc13b878c2b4c595bafc63

SHA512
7e33d13275b4fba4135528458be05d6fd1e27ead1061b26376655e860cb150d6a78c262e96dc8bc52e175bac7b78a31ba45bcb3a1981409059b3cb213a7efa1f

Download Submit
\Windows\system\UsjyCnG.exe

Filesize
1.9MB

MD5
ae7b0b48c668de32e6a8c1c538aadc3d

SHA1
b567ffbb7d58a4775298b35665fc2a823ca21e24

SHA256
9c18cfc47bd6ef63f1ba7ac07ba33fb2d76c79e0c9efce86c3f7e1d7a77ac1b2

SHA512
9d696a85336e31dab91fb13d1a9f2534a7acc9e72809a14fd725c13a3da92b63203468315272391623f3eb0d35d934145e615bfd10d65a14b0676505942767d2

Download Submit
\Windows\system\cknyhSq.exe

Filesize
1.9MB

MD5
6ac8ff2d8b69bc38e146037f96495f26

SHA1
71549dfe6162480ef3c083c7b0b721117b6d2859

SHA256
2759cc68f7051db20d495b456f6a266121d0697d36d044fca82b013259d69508

SHA512
c123f82ea13ff2b6093d91b6acc7509624f5a38c3cbef9249bea44ae1dde0ffb80b8a67c6cc0fd1e98718edff5da104472d5e6093bdf16dba194ba2f0958d15e

Download Submit
\Windows\system\iePSssC.exe

Filesize
1.9MB

MD5
c87f1f61d07d15305eeb5291e56a85c2

SHA1
a0b1e65d6609b0b66b6121e1e4794f79832765ff

SHA256
2dea136e74408c1d16e2d2db659e659d5510d312fc30a60ecadec47fe847c377

SHA512
32cd95a768e3a88cb364c5074be43b3b68c35487cfa2451462146b73927acf9448250d7c446d5354ca51c4b0e0303846dd491bb6fd8f2321cac10223dc0e0bb0

Download Submit
\Windows\system\jnkxDGn.exe

Filesize
1.9MB

MD5
d4df352e5ce5587c41ae0b699957f7af

SHA1
78e2bdbe157841e4e83b421389a3527ad056e885

SHA256
30b7ee94c1f2d314c3d60fb3b0953e55de5156f0fbf626315efde9dc0a168c2c

SHA512
b4d2c6f7d3f2074aaf428478895b5103eb7c176cdaf03390a3edd2294aa5b2bb33416ae4ed917c46a5df24a5a2b5c9cbe76fbf80bf96595abdab739e080f9ef3

Download Submit
\Windows\system\oqwaQgU.exe

Filesize
1.9MB

MD5
998e453d881e6f7239ca11a624b45efd

SHA1
c0b89f048153b032d200c8d0c16c6318e78a75d8

SHA256
e9c28c84862a3deaf743006914d10504335c8f7dfce4357a61fd0165c1326baa

SHA512
c66d260b3231240a23da0e97b9ead4a1027abbacebcb6c71a943abdf30f4b8d1351d3604fb962d204b27a9f47a33408b812372dc6f5b0f680c9e0f82ee190eb1

Download Submit
\Windows\system\pJGUXVX.exe

Filesize
1.9MB

MD5
cf6d7d1a2799ea0cc031c09ca5772320

SHA1
39113accafdfa528d90f6d4acbb2e383e052e91c

SHA256
71a62f52e99a272cef4700afc7330d06d92f40a5baa432b06b342a32cb38a778

SHA512
2592ede5f0e3019d234bfc86fe9e080338f37dffe2ea73eff7e4d911995012f4217afc9fbcde2c5d87cc6f7f4328888be4ed5be3545d37070b1326f2045ba44d

Download Submit
\Windows\system\qDeruyf.exe

Filesize
1.9MB

MD5
ef270eae9415891178a1ca14f93953f9

SHA1
6ea0278ee3535685cd7a4e0a5cfcfa9ed354d816

SHA256
f49ecb3da44cf6496323a86c0b2792b67cdd38645426160f8ca0c34ea92ec1b4

SHA512
5c3edcfbb9973fe374ce990d1fbc056bba1cafbc4b68a56ec3b797a83c68714e38fd25ced5857d9ec47456d724bd82f076c65c09350317ae5b7d58b10e9ff244

Download Submit
\Windows\system\sflHomW.exe

Filesize
1.9MB

MD5
2092b0267a1190f15b04f313a89ee41d

SHA1
97f67aebc18d30fc101986f6c9cbe2fa0f2e82aa

SHA256
54524dc571a189d97483d193739f325d67f24aca4efe03eb3ed623ff5f3ab900

SHA512
69dd2742829e7acd77fa108a9dc4510544ddf1a8263b9d039f0c271833e2147bc8deb549e00e3748da3737a9d9010b3372295c318b7bd66fa699b799307c8c17

Download Submit
\Windows\system\sqErNqh.exe

Filesize
1.9MB

MD5
7a6f20d355ab4ae89a131f29ff0c210f

SHA1
134888756a17a73782a81b6e05c8384a9a4b4042

SHA256
ed3e7853c626fe6ef2510219eb4621dca5688d7fdfefef25b80b380d986391a0

SHA512
29154fdbeb66e0356babda12f2dd8a6abd1c3c195479ed01195da89d798d0512af1015a201bcd86b21d9a6f2592c9c28fea9be3d00ae54fe3924603731d92b65

Download Submit
\Windows\system\xJWYYpW.exe

Filesize
1.9MB

MD5
8414a0739e3c4dee5134de491095eb0e

SHA1
9b98a7feb658e0f419a52ae612d00000b36a0640

SHA256
c11928e4163806fca537bd1a29e817085fe506c9fb32a88beccfe9ed7833d3bc

SHA512
6cc34d574651f4910945ca74f823d804c11c66428ed24ce7d5e83a4d06c2d8f8a1a31da68b5caccde61eeab3cc99a75291b6306241b8d2a0ed5b2d0450123c57

Download Submit
\Windows\system\zbjzDXZ.exe

Filesize
1.9MB

MD5
535ade1934b065e4009afe57203369eb

SHA1
0ca81233b739cf00762c647acb42104fe07ccfb8

SHA256
34078bf13404e358f93a73d828d6b4ad4582bfae11290113e588d9e68a5f60a0

SHA512
c7141097278bf3f6538634a51a7adcad5219aa2f44d6584185ec60eb1774ee9dc2aa239fb1e6231b7e6733d2c7b5e3eb7c7f467cefb0aa377a2a64d65eb8e97e

Download Submit
\Windows\system\zheCPEi.exe

Filesize
1.9MB

MD5
01c612040b11fc2afce61610c1c53045

SHA1
c59bde26a01dce77083718769a8650701886d8de

SHA256
8e391c8a78b84dd645487cf41f1fa343b8e12fa4d7451d94c275d2705739c634

SHA512
5fbf4a4e19702c72a66b67315eaf3da510df01f402c5ebb449a956fef528c1bdb2e69c8cefb61701b737e258f835c11f4edfd78ad1d14209fa98baab4ca43743

Download Submit
memory/820-260-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-284-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-285-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/1964-283-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-239-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-359-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-196-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-197-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-413-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-393-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2064-386-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-362-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2064-357-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2064-358-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-235-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-273-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-265-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2064-229-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-356-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-294-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2064-237-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-253-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-289-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2064-1-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2064-0-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2064-7-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/2064-203-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-14-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2064-206-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2192-21-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2192-91-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-278-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-171-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2192-282-0x000000000275B000-0x00000000027C2000-memory.dmp

Filesize
412KB

Download
memory/2192-286-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2192-24-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2192-194-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2212-233-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-234-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-266-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2500-236-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-200-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2568-207-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2600-242-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-204-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-199-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2708-201-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2720-20-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2736-277-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-238-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-9-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download