xmrig | 714baadf36e8b5f487596186d3a451e5946045f4389b006c5483a459f853cd4a

Analysis

max time kernel
114s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
Size

1.8MB
MD5

0135278d4a814e9d73722ba27570f69e
SHA1

ba09e282ccfa636c09a1bc148da9aefd8254ce8b
SHA256

714baadf36e8b5f487596186d3a451e5946045f4389b006c5483a459f853cd4a
SHA512

6d9322a9c839e48bc40d3af3e078611aa1caaf1863fedde524110e69f636916f1f55bf72742204c5841a83f6ee843e5c1e8973c0a0b6912ad436de8d76d381a2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlg7T:NABT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/408-11-0x00007FF791740000-0x00007FF791B32000-memory.dmp	xmrig
behavioral2/memory/1384-29-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	xmrig
behavioral2/memory/572-30-0x00007FF7B5C60000-0x00007FF7B6052000-memory.dmp	xmrig
behavioral2/memory/2032-32-0x00007FF7BD3F0000-0x00007FF7BD7E2000-memory.dmp	xmrig
behavioral2/memory/2268-61-0x00007FF780340000-0x00007FF780732000-memory.dmp	xmrig
behavioral2/memory/2864-108-0x00007FF60AED0000-0x00007FF60B2C2000-memory.dmp	xmrig
behavioral2/memory/3804-117-0x00007FF68CF90000-0x00007FF68D382000-memory.dmp	xmrig
behavioral2/memory/4464-118-0x00007FF734000000-0x00007FF7343F2000-memory.dmp	xmrig
behavioral2/memory/5080-116-0x00007FF61E3A0000-0x00007FF61E792000-memory.dmp	xmrig
behavioral2/memory/780-115-0x00007FF675CA0000-0x00007FF676092000-memory.dmp	xmrig
behavioral2/memory/4304-98-0x00007FF766730000-0x00007FF766B22000-memory.dmp	xmrig
behavioral2/memory/1804-89-0x00007FF7E70A0000-0x00007FF7E7492000-memory.dmp	xmrig
behavioral2/memory/3596-80-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	xmrig
behavioral2/memory/572-2062-0x00007FF7B5C60000-0x00007FF7B6052000-memory.dmp	xmrig
behavioral2/memory/408-2066-0x00007FF791740000-0x00007FF791B32000-memory.dmp	xmrig
behavioral2/memory/1384-2067-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	xmrig
behavioral2/memory/2032-2064-0x00007FF7BD3F0000-0x00007FF7BD7E2000-memory.dmp	xmrig
behavioral2/memory/3664-2088-0x00007FF72EFF0000-0x00007FF72F3E2000-memory.dmp	xmrig
behavioral2/memory/3596-2176-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	xmrig
behavioral2/memory/2268-2160-0x00007FF780340000-0x00007FF780732000-memory.dmp	xmrig
behavioral2/memory/2012-2153-0x00007FF718960000-0x00007FF718D52000-memory.dmp	xmrig
behavioral2/memory/1804-2180-0x00007FF7E70A0000-0x00007FF7E7492000-memory.dmp	xmrig
behavioral2/memory/4304-2219-0x00007FF766730000-0x00007FF766B22000-memory.dmp	xmrig
behavioral2/memory/4464-2249-0x00007FF734000000-0x00007FF7343F2000-memory.dmp	xmrig
behavioral2/memory/2864-2237-0x00007FF60AED0000-0x00007FF60B2C2000-memory.dmp	xmrig
behavioral2/memory/1592-2233-0x00007FF6FE060000-0x00007FF6FE452000-memory.dmp	xmrig
behavioral2/memory/3804-2221-0x00007FF68CF90000-0x00007FF68D382000-memory.dmp	xmrig
behavioral2/memory/780-2216-0x00007FF675CA0000-0x00007FF676092000-memory.dmp	xmrig
behavioral2/memory/5080-2215-0x00007FF61E3A0000-0x00007FF61E792000-memory.dmp	xmrig
behavioral2/memory/3980-2731-0x00007FF69A030000-0x00007FF69A422000-memory.dmp	xmrig
behavioral2/memory/1376-2578-0x00007FF6EA030000-0x00007FF6EA422000-memory.dmp	xmrig
behavioral2/memory/2332-2778-0x00007FF7BF040000-0x00007FF7BF432000-memory.dmp	xmrig
behavioral2/memory/4832-4383-0x00007FF7B4BE0000-0x00007FF7B4FD2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2992	powershell.exe
10	2992	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
408	etbNKup.exe
1384	SbVvzTi.exe
2032	cqAYdKd.exe
572	Pjaijdb.exe
3664	RdYVBya.exe
2012	tNXfFCF.exe
2268	mzuOuuV.exe
3596	QcSPTfw.exe
780	HpixGYY.exe
1804	MBoVcNx.exe
4304	AlmostT.exe
1592	FfeUWzb.exe
5080	RSjPRzp.exe
2864	wOiylWv.exe
3804	oylMCJF.exe
1376	ekPpslr.exe
4464	XuVVMSV.exe
2332	Tkqpjhr.exe
3980	lxSbhVf.exe
4036	fSePvIG.exe
3252	BkaNTZH.exe
2196	GYMeWHx.exe
3328	CkKiodR.exe
2356	pnDqPnh.exe
3284	vBrIeuD.exe
2364	mAUPykc.exe
3628	yXnvbCe.exe
4336	iVTCbGw.exe
4132	NFXcdJH.exe
3200	GRTBauy.exe
2556	TeRKSbJ.exe
1932	QIeEPvF.exe
3016	kfDHpoL.exe
4636	zWBjABk.exe
4428	Iaxhypl.exe
4424	GcOWaSS.exe
1620	NIAPYIz.exe
412	ZTlUVAF.exe
3212	tGrntdk.exe
1208	FJASxLK.exe
3852	DhirGYx.exe
4696	ROPveJn.exe
1612	NYwGlMk.exe
5028	CyYXgcu.exe
1224	VSZNtWt.exe
4064	fxKvuuo.exe
1972	wUgDTEc.exe
1636	EZLSesA.exe
2428	PnlNNON.exe
4216	KQIMucJ.exe
5004	AkakFHz.exe
1960	FrTGwPH.exe
2492	MsVSjYO.exe
4272	kpxSLQz.exe
1104	uKlibuE.exe
892	gqngzUr.exe
3248	lyHfxPe.exe
3612	ayFMfoL.exe
4860	ekvrvFM.exe
1724	JOuVAXW.exe
3232	DkClgCq.exe
4596	WjEcURD.exe
1936	tPsABQC.exe
1728	KDVQJHA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-0-0x00007FF7B4BE0000-0x00007FF7B4FD2000-memory.dmp	upx
behavioral2/files/0x0008000000023268-5.dat	upx
behavioral2/files/0x000800000002326b-10.dat	upx
behavioral2/memory/408-11-0x00007FF791740000-0x00007FF791B32000-memory.dmp	upx
behavioral2/files/0x000800000002326e-9.dat	upx
behavioral2/files/0x0008000000023270-23.dat	upx
behavioral2/files/0x0007000000023271-26.dat	upx
behavioral2/memory/1384-29-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	upx
behavioral2/memory/572-30-0x00007FF7B5C60000-0x00007FF7B6052000-memory.dmp	upx
behavioral2/memory/3664-31-0x00007FF72EFF0000-0x00007FF72F3E2000-memory.dmp	upx
behavioral2/memory/2032-32-0x00007FF7BD3F0000-0x00007FF7BD7E2000-memory.dmp	upx
behavioral2/files/0x000800000002326c-47.dat	upx
behavioral2/memory/2012-49-0x00007FF718960000-0x00007FF718D52000-memory.dmp	upx
behavioral2/files/0x0008000000023272-52.dat	upx
behavioral2/files/0x0007000000023274-58.dat	upx
behavioral2/files/0x0007000000023275-64.dat	upx
behavioral2/memory/2268-61-0x00007FF780340000-0x00007FF780732000-memory.dmp	upx
behavioral2/files/0x0007000000023276-67.dat	upx
behavioral2/files/0x0007000000023278-76.dat	upx
behavioral2/files/0x0007000000023277-72.dat	upx
behavioral2/files/0x000700000002327a-88.dat	upx
behavioral2/files/0x000700000002327c-97.dat	upx
behavioral2/memory/1592-105-0x00007FF6FE060000-0x00007FF6FE452000-memory.dmp	upx
behavioral2/memory/2864-108-0x00007FF60AED0000-0x00007FF60B2C2000-memory.dmp	upx
behavioral2/files/0x000700000002327e-114.dat	upx
behavioral2/memory/3804-117-0x00007FF68CF90000-0x00007FF68D382000-memory.dmp	upx
behavioral2/memory/2332-128-0x00007FF7BF040000-0x00007FF7BF432000-memory.dmp	upx
behavioral2/files/0x0007000000023285-140.dat	upx
behavioral2/files/0x0007000000023286-145.dat	upx
behavioral2/memory/4036-155-0x00007FF74F9C0000-0x00007FF74FDB2000-memory.dmp	upx
behavioral2/files/0x000700000002328f-173.dat	upx
behavioral2/files/0x0007000000023293-185.dat	upx
behavioral2/files/0x000700000002329b-209.dat	upx
behavioral2/files/0x000700000002329a-206.dat	upx
behavioral2/files/0x0007000000023299-203.dat	upx
behavioral2/files/0x0007000000023298-200.dat	upx
behavioral2/files/0x0007000000023297-197.dat	upx
behavioral2/files/0x0007000000023296-194.dat	upx
behavioral2/files/0x0007000000023295-193.dat	upx
behavioral2/files/0x0007000000023294-188.dat	upx
behavioral2/files/0x0007000000023292-182.dat	upx
behavioral2/files/0x0007000000023291-179.dat	upx
behavioral2/files/0x0007000000023290-176.dat	upx
behavioral2/files/0x000700000002328e-170.dat	upx
behavioral2/files/0x000700000002328d-167.dat	upx
behavioral2/files/0x000700000002328c-164.dat	upx
behavioral2/files/0x000700000002328b-161.dat	upx
behavioral2/files/0x000700000002328a-160.dat	upx
behavioral2/files/0x0007000000023289-154.dat	upx
behavioral2/files/0x0007000000023288-153.dat	upx
behavioral2/files/0x0007000000023287-152.dat	upx
behavioral2/memory/3980-144-0x00007FF69A030000-0x00007FF69A422000-memory.dmp	upx
behavioral2/memory/3252-141-0x00007FF7BD2A0000-0x00007FF7BD692000-memory.dmp	upx
behavioral2/files/0x0007000000023284-139.dat	upx
behavioral2/files/0x0007000000023283-138.dat	upx
behavioral2/files/0x0007000000023282-131.dat	upx
behavioral2/files/0x0007000000023281-127.dat	upx
behavioral2/files/0x0007000000023280-126.dat	upx
behavioral2/files/0x000700000002327f-121.dat	upx
behavioral2/memory/4464-118-0x00007FF734000000-0x00007FF7343F2000-memory.dmp	upx
behavioral2/memory/5080-116-0x00007FF61E3A0000-0x00007FF61E792000-memory.dmp	upx
behavioral2/memory/780-115-0x00007FF675CA0000-0x00007FF676092000-memory.dmp	upx
behavioral2/memory/1376-113-0x00007FF6EA030000-0x00007FF6EA422000-memory.dmp	upx
behavioral2/files/0x000700000002327b-107.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RnUIwpj.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\yXnvbCe.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\VSZNtWt.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\bzlgzTm.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ZkhUKWU.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\KwrHIcb.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\YYslkAU.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\hvewOBH.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\aImSPXQ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\xlBVRjg.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ANcDhYd.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\hyfIaFn.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\bncYHFq.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\DDJXYEe.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\gSnJxoD.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\TlhrpEB.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ZQNgxfF.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\eNnQvNW.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\CqdBOdG.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\kdoyUYc.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\RJKSXZz.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\jBqbwFp.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\tYTuXDf.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\OiyHZjE.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\AAjXtEY.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\mNQdjnL.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ARUZOeD.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\FWPRDjs.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\AssGPnP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\vjczPrP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\fjHkUDn.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\KNNQqRp.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\FlHsjWL.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ejXCinD.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\UcmUZxu.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\jiGZBxG.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\RnywVeP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\onuGWzz.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\qknAiau.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\tCECxNL.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\nrgBnBt.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\VGKhvkw.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\IWiVIcn.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\azipQPv.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\vZhWBiF.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\BCNlXjx.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\skbWYYg.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\oDTCcvu.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\eHPfTen.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ZnSrgDs.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\KDVQJHA.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\RCECfmi.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\GIwDJXP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\PwlyHRZ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\rlqUBpZ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\XcGdGqQ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\vLUfyMi.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\GcOWaSS.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ACRdnus.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\hGGAhQj.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\YPmIcRU.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\OtouNSp.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\jSfTIgv.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\dgauCUV.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2992	powershell.exe
2992	powershell.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeLockMemoryPrivilege	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2992	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	92
PID 4832 wrote to memory of 2992	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	92
PID 4832 wrote to memory of 408	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	93
PID 4832 wrote to memory of 408	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	93
PID 4832 wrote to memory of 1384	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	94
PID 4832 wrote to memory of 1384	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	94
PID 4832 wrote to memory of 2032	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	95
PID 4832 wrote to memory of 2032	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	95
PID 4832 wrote to memory of 572	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	96
PID 4832 wrote to memory of 572	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	96
PID 4832 wrote to memory of 3664	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	97
PID 4832 wrote to memory of 3664	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	97
PID 4832 wrote to memory of 2012	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	98
PID 4832 wrote to memory of 2012	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	98
PID 4832 wrote to memory of 2268	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	99
PID 4832 wrote to memory of 2268	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	99
PID 4832 wrote to memory of 3596	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	100
PID 4832 wrote to memory of 3596	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	100
PID 4832 wrote to memory of 780	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	101
PID 4832 wrote to memory of 780	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	101
PID 4832 wrote to memory of 1804	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	102
PID 4832 wrote to memory of 1804	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	102
PID 4832 wrote to memory of 4304	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	103
PID 4832 wrote to memory of 4304	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	103
PID 4832 wrote to memory of 1592	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	104
PID 4832 wrote to memory of 1592	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	104
PID 4832 wrote to memory of 5080	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	105
PID 4832 wrote to memory of 5080	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	105
PID 4832 wrote to memory of 2864	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	106
PID 4832 wrote to memory of 2864	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	106
PID 4832 wrote to memory of 3804	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	107
PID 4832 wrote to memory of 3804	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	107
PID 4832 wrote to memory of 1376	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	108
PID 4832 wrote to memory of 1376	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	108
PID 4832 wrote to memory of 4464	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	109
PID 4832 wrote to memory of 4464	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	109
PID 4832 wrote to memory of 2332	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	110
PID 4832 wrote to memory of 2332	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	110
PID 4832 wrote to memory of 3980	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	111
PID 4832 wrote to memory of 3980	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	111
PID 4832 wrote to memory of 4036	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	112
PID 4832 wrote to memory of 4036	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	112
PID 4832 wrote to memory of 3252	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	113
PID 4832 wrote to memory of 3252	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	113
PID 4832 wrote to memory of 2196	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	114
PID 4832 wrote to memory of 2196	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	114
PID 4832 wrote to memory of 3328	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	115
PID 4832 wrote to memory of 3328	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	115
PID 4832 wrote to memory of 2356	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	116
PID 4832 wrote to memory of 2356	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	116
PID 4832 wrote to memory of 3284	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	117
PID 4832 wrote to memory of 3284	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	117
PID 4832 wrote to memory of 2364	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	118
PID 4832 wrote to memory of 2364	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	118
PID 4832 wrote to memory of 3628	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	119
PID 4832 wrote to memory of 3628	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	119
PID 4832 wrote to memory of 4336	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	120
PID 4832 wrote to memory of 4336	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	120
PID 4832 wrote to memory of 4132	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	121
PID 4832 wrote to memory of 4132	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	121
PID 4832 wrote to memory of 3200	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	122
PID 4832 wrote to memory of 3200	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	122
PID 4832 wrote to memory of 2556	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	123
PID 4832 wrote to memory of 2556	4832	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System\etbNKup.exe
  C:\Windows\System\etbNKup.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\SbVvzTi.exe
  C:\Windows\System\SbVvzTi.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\cqAYdKd.exe
  C:\Windows\System\cqAYdKd.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\Pjaijdb.exe
  C:\Windows\System\Pjaijdb.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\RdYVBya.exe
  C:\Windows\System\RdYVBya.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\tNXfFCF.exe
  C:\Windows\System\tNXfFCF.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mzuOuuV.exe
  C:\Windows\System\mzuOuuV.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QcSPTfw.exe
  C:\Windows\System\QcSPTfw.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\HpixGYY.exe
  C:\Windows\System\HpixGYY.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\MBoVcNx.exe
  C:\Windows\System\MBoVcNx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\AlmostT.exe
  C:\Windows\System\AlmostT.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\FfeUWzb.exe
  C:\Windows\System\FfeUWzb.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\RSjPRzp.exe
  C:\Windows\System\RSjPRzp.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\wOiylWv.exe
  C:\Windows\System\wOiylWv.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\oylMCJF.exe
  C:\Windows\System\oylMCJF.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\ekPpslr.exe
  C:\Windows\System\ekPpslr.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\XuVVMSV.exe
  C:\Windows\System\XuVVMSV.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\Tkqpjhr.exe
  C:\Windows\System\Tkqpjhr.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\lxSbhVf.exe
  C:\Windows\System\lxSbhVf.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\fSePvIG.exe
  C:\Windows\System\fSePvIG.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\BkaNTZH.exe
  C:\Windows\System\BkaNTZH.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\GYMeWHx.exe
  C:\Windows\System\GYMeWHx.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\CkKiodR.exe
  C:\Windows\System\CkKiodR.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\pnDqPnh.exe
  C:\Windows\System\pnDqPnh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\vBrIeuD.exe
  C:\Windows\System\vBrIeuD.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\mAUPykc.exe
  C:\Windows\System\mAUPykc.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\yXnvbCe.exe
  C:\Windows\System\yXnvbCe.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\iVTCbGw.exe
  C:\Windows\System\iVTCbGw.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\NFXcdJH.exe
  C:\Windows\System\NFXcdJH.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\GRTBauy.exe
  C:\Windows\System\GRTBauy.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TeRKSbJ.exe
  C:\Windows\System\TeRKSbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\QIeEPvF.exe
  C:\Windows\System\QIeEPvF.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\kfDHpoL.exe
  C:\Windows\System\kfDHpoL.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\zWBjABk.exe
  C:\Windows\System\zWBjABk.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\Iaxhypl.exe
  C:\Windows\System\Iaxhypl.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\GcOWaSS.exe
  C:\Windows\System\GcOWaSS.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\NIAPYIz.exe
  C:\Windows\System\NIAPYIz.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ZTlUVAF.exe
  C:\Windows\System\ZTlUVAF.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\tGrntdk.exe
  C:\Windows\System\tGrntdk.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\FJASxLK.exe
  C:\Windows\System\FJASxLK.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\DhirGYx.exe
  C:\Windows\System\DhirGYx.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ROPveJn.exe
  C:\Windows\System\ROPveJn.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\NYwGlMk.exe
  C:\Windows\System\NYwGlMk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\CyYXgcu.exe
  C:\Windows\System\CyYXgcu.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\VSZNtWt.exe
  C:\Windows\System\VSZNtWt.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\fxKvuuo.exe
  C:\Windows\System\fxKvuuo.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\wUgDTEc.exe
  C:\Windows\System\wUgDTEc.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\EZLSesA.exe
  C:\Windows\System\EZLSesA.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\PnlNNON.exe
  C:\Windows\System\PnlNNON.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\KQIMucJ.exe
  C:\Windows\System\KQIMucJ.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\AkakFHz.exe
  C:\Windows\System\AkakFHz.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\FrTGwPH.exe
  C:\Windows\System\FrTGwPH.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\MsVSjYO.exe
  C:\Windows\System\MsVSjYO.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\kpxSLQz.exe
  C:\Windows\System\kpxSLQz.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\uKlibuE.exe
  C:\Windows\System\uKlibuE.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\gqngzUr.exe
  C:\Windows\System\gqngzUr.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\lyHfxPe.exe
  C:\Windows\System\lyHfxPe.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\ayFMfoL.exe
  C:\Windows\System\ayFMfoL.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ekvrvFM.exe
  C:\Windows\System\ekvrvFM.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\JOuVAXW.exe
  C:\Windows\System\JOuVAXW.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\DkClgCq.exe
  C:\Windows\System\DkClgCq.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\WjEcURD.exe
  C:\Windows\System\WjEcURD.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\tPsABQC.exe
  C:\Windows\System\tPsABQC.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\KDVQJHA.exe
  C:\Windows\System\KDVQJHA.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iNTWiuB.exe
  C:\Windows\System\iNTWiuB.exe
  2⤵
  PID:2608
- C:\Windows\System\dlpOHSP.exe
  C:\Windows\System\dlpOHSP.exe
  2⤵
  PID:1432
- C:\Windows\System\GEGhUhV.exe
  C:\Windows\System\GEGhUhV.exe
  2⤵
  PID:2204
- C:\Windows\System\atajRMp.exe
  C:\Windows\System\atajRMp.exe
  2⤵
  PID:3768
- C:\Windows\System\EGfActg.exe
  C:\Windows\System\EGfActg.exe
  2⤵
  PID:2684
- C:\Windows\System\KbePawq.exe
  C:\Windows\System\KbePawq.exe
  2⤵
  PID:1068
- C:\Windows\System\dmbZHMx.exe
  C:\Windows\System\dmbZHMx.exe
  2⤵
  PID:960
- C:\Windows\System\VZdnFIk.exe
  C:\Windows\System\VZdnFIk.exe
  2⤵
  PID:3024
- C:\Windows\System\RcfDobk.exe
  C:\Windows\System\RcfDobk.exe
  2⤵
  PID:4640
- C:\Windows\System\USzmayA.exe
  C:\Windows\System\USzmayA.exe
  2⤵
  PID:4000
- C:\Windows\System\WIOvbpl.exe
  C:\Windows\System\WIOvbpl.exe
  2⤵
  PID:1496
- C:\Windows\System\vnVyvcx.exe
  C:\Windows\System\vnVyvcx.exe
  2⤵
  PID:1560
- C:\Windows\System\isSGSuS.exe
  C:\Windows\System\isSGSuS.exe
  2⤵
  PID:1064
- C:\Windows\System\djqmmtH.exe
  C:\Windows\System\djqmmtH.exe
  2⤵
  PID:3492
- C:\Windows\System\WLYtjfN.exe
  C:\Windows\System\WLYtjfN.exe
  2⤵
  PID:5040
- C:\Windows\System\IVksXhc.exe
  C:\Windows\System\IVksXhc.exe
  2⤵
  PID:4516
- C:\Windows\System\hhqoJdb.exe
  C:\Windows\System\hhqoJdb.exe
  2⤵
  PID:3352
- C:\Windows\System\IEIJNEC.exe
  C:\Windows\System\IEIJNEC.exe
  2⤵
  PID:2180
- C:\Windows\System\PWADEiq.exe
  C:\Windows\System\PWADEiq.exe
  2⤵
  PID:3916
- C:\Windows\System\elmZVKr.exe
  C:\Windows\System\elmZVKr.exe
  2⤵
  PID:2248
- C:\Windows\System\VqVTYwO.exe
  C:\Windows\System\VqVTYwO.exe
  2⤵
  PID:4068
- C:\Windows\System\caYtcvz.exe
  C:\Windows\System\caYtcvz.exe
  2⤵
  PID:4908
- C:\Windows\System\YMMkwGH.exe
  C:\Windows\System\YMMkwGH.exe
  2⤵
  PID:2344
- C:\Windows\System\PmGugMe.exe
  C:\Windows\System\PmGugMe.exe
  2⤵
  PID:2596
- C:\Windows\System\XtBJDMB.exe
  C:\Windows\System\XtBJDMB.exe
  2⤵
  PID:5112
- C:\Windows\System\ywliEjO.exe
  C:\Windows\System\ywliEjO.exe
  2⤵
  PID:4852
- C:\Windows\System\jChYJor.exe
  C:\Windows\System\jChYJor.exe
  2⤵
  PID:2108
- C:\Windows\System\mCEHbqV.exe
  C:\Windows\System\mCEHbqV.exe
  2⤵
  PID:3988
- C:\Windows\System\HinbGtl.exe
  C:\Windows\System\HinbGtl.exe
  2⤵
  PID:788
- C:\Windows\System\FywkuJT.exe
  C:\Windows\System\FywkuJT.exe
  2⤵
  PID:2788
- C:\Windows\System\LnmeUDv.exe
  C:\Windows\System\LnmeUDv.exe
  2⤵
  PID:2712
- C:\Windows\System\vGXHkLX.exe
  C:\Windows\System\vGXHkLX.exe
  2⤵
  PID:552
- C:\Windows\System\JdXCfXU.exe
  C:\Windows\System\JdXCfXU.exe
  2⤵
  PID:1832
- C:\Windows\System\gKCFHPP.exe
  C:\Windows\System\gKCFHPP.exe
  2⤵
  PID:5124
- C:\Windows\System\BSotYHh.exe
  C:\Windows\System\BSotYHh.exe
  2⤵
  PID:5144
- C:\Windows\System\yQCmRrU.exe
  C:\Windows\System\yQCmRrU.exe
  2⤵
  PID:5164
- C:\Windows\System\PVdDAAt.exe
  C:\Windows\System\PVdDAAt.exe
  2⤵
  PID:5188
- C:\Windows\System\TLsLjUz.exe
  C:\Windows\System\TLsLjUz.exe
  2⤵
  PID:5212
- C:\Windows\System\DldDOqZ.exe
  C:\Windows\System\DldDOqZ.exe
  2⤵
  PID:5232
- C:\Windows\System\rcjRSXj.exe
  C:\Windows\System\rcjRSXj.exe
  2⤵
  PID:5252
- C:\Windows\System\goctckY.exe
  C:\Windows\System\goctckY.exe
  2⤵
  PID:5272
- C:\Windows\System\KgVZtrd.exe
  C:\Windows\System\KgVZtrd.exe
  2⤵
  PID:5292
- C:\Windows\System\ehCyxxe.exe
  C:\Windows\System\ehCyxxe.exe
  2⤵
  PID:5316
- C:\Windows\System\MeZgNNT.exe
  C:\Windows\System\MeZgNNT.exe
  2⤵
  PID:5332
- C:\Windows\System\gnMbVlz.exe
  C:\Windows\System\gnMbVlz.exe
  2⤵
  PID:5356
- C:\Windows\System\DJvwMKS.exe
  C:\Windows\System\DJvwMKS.exe
  2⤵
  PID:5380
- C:\Windows\System\fObbZNR.exe
  C:\Windows\System\fObbZNR.exe
  2⤵
  PID:5396
- C:\Windows\System\izTyfKh.exe
  C:\Windows\System\izTyfKh.exe
  2⤵
  PID:5420
- C:\Windows\System\xkMKBgj.exe
  C:\Windows\System\xkMKBgj.exe
  2⤵
  PID:5444
- C:\Windows\System\RvmTArh.exe
  C:\Windows\System\RvmTArh.exe
  2⤵
  PID:5468
- C:\Windows\System\cAcrjoI.exe
  C:\Windows\System\cAcrjoI.exe
  2⤵
  PID:5488
- C:\Windows\System\FwCmcNt.exe
  C:\Windows\System\FwCmcNt.exe
  2⤵
  PID:5512
- C:\Windows\System\LvvxMwI.exe
  C:\Windows\System\LvvxMwI.exe
  2⤵
  PID:5536
- C:\Windows\System\HEhTEqJ.exe
  C:\Windows\System\HEhTEqJ.exe
  2⤵
  PID:5552
- C:\Windows\System\vWRxzff.exe
  C:\Windows\System\vWRxzff.exe
  2⤵
  PID:5576
- C:\Windows\System\AEfkSpO.exe
  C:\Windows\System\AEfkSpO.exe
  2⤵
  PID:5600
- C:\Windows\System\AdOTliL.exe
  C:\Windows\System\AdOTliL.exe
  2⤵
  PID:5620
- C:\Windows\System\CCZLxEA.exe
  C:\Windows\System\CCZLxEA.exe
  2⤵
  PID:5644
- C:\Windows\System\ivzkqkA.exe
  C:\Windows\System\ivzkqkA.exe
  2⤵
  PID:5664
- C:\Windows\System\pLMSzMl.exe
  C:\Windows\System\pLMSzMl.exe
  2⤵
  PID:5684
- C:\Windows\System\rzOTDVm.exe
  C:\Windows\System\rzOTDVm.exe
  2⤵
  PID:5708
- C:\Windows\System\MgjMsEj.exe
  C:\Windows\System\MgjMsEj.exe
  2⤵
  PID:5732
- C:\Windows\System\KWLKtfU.exe
  C:\Windows\System\KWLKtfU.exe
  2⤵
  PID:5752
- C:\Windows\System\JChovZN.exe
  C:\Windows\System\JChovZN.exe
  2⤵
  PID:5776
- C:\Windows\System\YzGLhgb.exe
  C:\Windows\System\YzGLhgb.exe
  2⤵
  PID:5796
- C:\Windows\System\UAeTFMv.exe
  C:\Windows\System\UAeTFMv.exe
  2⤵
  PID:5816
- C:\Windows\System\ImdApqr.exe
  C:\Windows\System\ImdApqr.exe
  2⤵
  PID:5840
- C:\Windows\System\XVOxabX.exe
  C:\Windows\System\XVOxabX.exe
  2⤵
  PID:5860
- C:\Windows\System\KVPwBPR.exe
  C:\Windows\System\KVPwBPR.exe
  2⤵
  PID:5880
- C:\Windows\System\MwVjieY.exe
  C:\Windows\System\MwVjieY.exe
  2⤵
  PID:5904
- C:\Windows\System\hRSIoyV.exe
  C:\Windows\System\hRSIoyV.exe
  2⤵
  PID:5928
- C:\Windows\System\RvUgpjG.exe
  C:\Windows\System\RvUgpjG.exe
  2⤵
  PID:5948
- C:\Windows\System\kTSZpMx.exe
  C:\Windows\System\kTSZpMx.exe
  2⤵
  PID:5968
- C:\Windows\System\NIXJGix.exe
  C:\Windows\System\NIXJGix.exe
  2⤵
  PID:5992
- C:\Windows\System\zJNnPEq.exe
  C:\Windows\System\zJNnPEq.exe
  2⤵
  PID:6012
- C:\Windows\System\rnfjbaA.exe
  C:\Windows\System\rnfjbaA.exe
  2⤵
  PID:6036
- C:\Windows\System\CQqbGkh.exe
  C:\Windows\System\CQqbGkh.exe
  2⤵
  PID:6056
- C:\Windows\System\TahnzCX.exe
  C:\Windows\System\TahnzCX.exe
  2⤵
  PID:6080
- C:\Windows\System\eHPfTen.exe
  C:\Windows\System\eHPfTen.exe
  2⤵
  PID:6100
- C:\Windows\System\eoShZsz.exe
  C:\Windows\System\eoShZsz.exe
  2⤵
  PID:6124
- C:\Windows\System\oHJfvhy.exe
  C:\Windows\System\oHJfvhy.exe
  2⤵
  PID:6152
- C:\Windows\System\RpObiHD.exe
  C:\Windows\System\RpObiHD.exe
  2⤵
  PID:6176
- C:\Windows\System\RVSQqHc.exe
  C:\Windows\System\RVSQqHc.exe
  2⤵
  PID:6200
- C:\Windows\System\WHQGmyc.exe
  C:\Windows\System\WHQGmyc.exe
  2⤵
  PID:6220
- C:\Windows\System\wCCvOOE.exe
  C:\Windows\System\wCCvOOE.exe
  2⤵
  PID:6240
- C:\Windows\System\EfLvegS.exe
  C:\Windows\System\EfLvegS.exe
  2⤵
  PID:6264
- C:\Windows\System\rXlnMLt.exe
  C:\Windows\System\rXlnMLt.exe
  2⤵
  PID:6280
- C:\Windows\System\qfjBiBS.exe
  C:\Windows\System\qfjBiBS.exe
  2⤵
  PID:6304
- C:\Windows\System\BAqejwM.exe
  C:\Windows\System\BAqejwM.exe
  2⤵
  PID:6328
- C:\Windows\System\qVnzjFm.exe
  C:\Windows\System\qVnzjFm.exe
  2⤵
  PID:6348
- C:\Windows\System\jCneBxv.exe
  C:\Windows\System\jCneBxv.exe
  2⤵
  PID:6368
- C:\Windows\System\xrIkyEz.exe
  C:\Windows\System\xrIkyEz.exe
  2⤵
  PID:6388
- C:\Windows\System\yLQdrgO.exe
  C:\Windows\System\yLQdrgO.exe
  2⤵
  PID:6412
- C:\Windows\System\OPAHOsq.exe
  C:\Windows\System\OPAHOsq.exe
  2⤵
  PID:6432
- C:\Windows\System\hHAerUF.exe
  C:\Windows\System\hHAerUF.exe
  2⤵
  PID:6452
- C:\Windows\System\GeGMbmD.exe
  C:\Windows\System\GeGMbmD.exe
  2⤵
  PID:6472
- C:\Windows\System\UFwpMze.exe
  C:\Windows\System\UFwpMze.exe
  2⤵
  PID:6504
- C:\Windows\System\FPTxEtE.exe
  C:\Windows\System\FPTxEtE.exe
  2⤵
  PID:6528
- C:\Windows\System\ELnHDxN.exe
  C:\Windows\System\ELnHDxN.exe
  2⤵
  PID:6544
- C:\Windows\System\seZtwVG.exe
  C:\Windows\System\seZtwVG.exe
  2⤵
  PID:6568
- C:\Windows\System\pgocOkB.exe
  C:\Windows\System\pgocOkB.exe
  2⤵
  PID:6592
- C:\Windows\System\uxdthCh.exe
  C:\Windows\System\uxdthCh.exe
  2⤵
  PID:6608
- C:\Windows\System\vDyqWtU.exe
  C:\Windows\System\vDyqWtU.exe
  2⤵
  PID:6632
- C:\Windows\System\idPmMyD.exe
  C:\Windows\System\idPmMyD.exe
  2⤵
  PID:6656
- C:\Windows\System\Oqprtpz.exe
  C:\Windows\System\Oqprtpz.exe
  2⤵
  PID:6684
- C:\Windows\System\KqHxWNG.exe
  C:\Windows\System\KqHxWNG.exe
  2⤵
  PID:6700
- C:\Windows\System\reIPCaW.exe
  C:\Windows\System\reIPCaW.exe
  2⤵
  PID:6724
- C:\Windows\System\qyguFUJ.exe
  C:\Windows\System\qyguFUJ.exe
  2⤵
  PID:6756
- C:\Windows\System\WZcvAvg.exe
  C:\Windows\System\WZcvAvg.exe
  2⤵
  PID:6772
- C:\Windows\System\xEDYgLE.exe
  C:\Windows\System\xEDYgLE.exe
  2⤵
  PID:6796
- C:\Windows\System\IkIjoLL.exe
  C:\Windows\System\IkIjoLL.exe
  2⤵
  PID:6896
- C:\Windows\System\UOLtBvL.exe
  C:\Windows\System\UOLtBvL.exe
  2⤵
  PID:6912
- C:\Windows\System\lQbjkGm.exe
  C:\Windows\System\lQbjkGm.exe
  2⤵
  PID:6928
- C:\Windows\System\vjoALVc.exe
  C:\Windows\System\vjoALVc.exe
  2⤵
  PID:6956
- C:\Windows\System\gRCrYDv.exe
  C:\Windows\System\gRCrYDv.exe
  2⤵
  PID:6976
- C:\Windows\System\yIzJnjr.exe
  C:\Windows\System\yIzJnjr.exe
  2⤵
  PID:7000
- C:\Windows\System\ivlCLQh.exe
  C:\Windows\System\ivlCLQh.exe
  2⤵
  PID:7016
- C:\Windows\System\XKvfUNY.exe
  C:\Windows\System\XKvfUNY.exe
  2⤵
  PID:7044
- C:\Windows\System\NprfnRI.exe
  C:\Windows\System\NprfnRI.exe
  2⤵
  PID:7064
- C:\Windows\System\UDXxgpr.exe
  C:\Windows\System\UDXxgpr.exe
  2⤵
  PID:7084
- C:\Windows\System\NopIdTA.exe
  C:\Windows\System\NopIdTA.exe
  2⤵
  PID:7108
- C:\Windows\System\hgBBBIE.exe
  C:\Windows\System\hgBBBIE.exe
  2⤵
  PID:7136
- C:\Windows\System\yQnkffj.exe
  C:\Windows\System\yQnkffj.exe
  2⤵
  PID:7160
- C:\Windows\System\yDFbDSd.exe
  C:\Windows\System\yDFbDSd.exe
  2⤵
  PID:4308
- C:\Windows\System\XbgUfQQ.exe
  C:\Windows\System\XbgUfQQ.exe
  2⤵
  PID:5676
- C:\Windows\System\okszERP.exe
  C:\Windows\System\okszERP.exe
  2⤵
  PID:5724
- C:\Windows\System\IfBExvP.exe
  C:\Windows\System\IfBExvP.exe
  2⤵
  PID:5784
- C:\Windows\System\HWRarFU.exe
  C:\Windows\System\HWRarFU.exe
  2⤵
  PID:5980
- C:\Windows\System\cJjkQLV.exe
  C:\Windows\System\cJjkQLV.exe
  2⤵
  PID:7188
- C:\Windows\System\XUnnUVS.exe
  C:\Windows\System\XUnnUVS.exe
  2⤵
  PID:7204
- C:\Windows\System\iyJNbLb.exe
  C:\Windows\System\iyJNbLb.exe
  2⤵
  PID:7228
- C:\Windows\System\VFoiLsW.exe
  C:\Windows\System\VFoiLsW.exe
  2⤵
  PID:7252
- C:\Windows\System\kUIDLot.exe
  C:\Windows\System\kUIDLot.exe
  2⤵
  PID:7276
- C:\Windows\System\AZuImGm.exe
  C:\Windows\System\AZuImGm.exe
  2⤵
  PID:7296
- C:\Windows\System\guAUotp.exe
  C:\Windows\System\guAUotp.exe
  2⤵
  PID:7320
- C:\Windows\System\xGUILeH.exe
  C:\Windows\System\xGUILeH.exe
  2⤵
  PID:7340
- C:\Windows\System\ZgBPuVC.exe
  C:\Windows\System\ZgBPuVC.exe
  2⤵
  PID:7364
- C:\Windows\System\hnMmwlJ.exe
  C:\Windows\System\hnMmwlJ.exe
  2⤵
  PID:7384
- C:\Windows\System\gzCWpPC.exe
  C:\Windows\System\gzCWpPC.exe
  2⤵
  PID:7412
- C:\Windows\System\ZKotPKM.exe
  C:\Windows\System\ZKotPKM.exe
  2⤵
  PID:7436
- C:\Windows\System\yUHarmv.exe
  C:\Windows\System\yUHarmv.exe
  2⤵
  PID:7460
- C:\Windows\System\vZWnQbP.exe
  C:\Windows\System\vZWnQbP.exe
  2⤵
  PID:7836
- C:\Windows\System\MyfGbid.exe
  C:\Windows\System\MyfGbid.exe
  2⤵
  PID:7884
- C:\Windows\System\DbVVMLt.exe
  C:\Windows\System\DbVVMLt.exe
  2⤵
  PID:7916
- C:\Windows\System\FRnGION.exe
  C:\Windows\System\FRnGION.exe
  2⤵
  PID:7932
- C:\Windows\System\FAoqLtg.exe
  C:\Windows\System\FAoqLtg.exe
  2⤵
  PID:7948
- C:\Windows\System\CFBcVus.exe
  C:\Windows\System\CFBcVus.exe
  2⤵
  PID:7968
- C:\Windows\System\EBcUnoz.exe
  C:\Windows\System\EBcUnoz.exe
  2⤵
  PID:7996
- C:\Windows\System\iaytCKt.exe
  C:\Windows\System\iaytCKt.exe
  2⤵
  PID:8016
- C:\Windows\System\pHdGUit.exe
  C:\Windows\System\pHdGUit.exe
  2⤵
  PID:8052
- C:\Windows\System\ACRdnus.exe
  C:\Windows\System\ACRdnus.exe
  2⤵
  PID:8068
- C:\Windows\System\MEoNSsR.exe
  C:\Windows\System\MEoNSsR.exe
  2⤵
  PID:8084
- C:\Windows\System\wqyLXFg.exe
  C:\Windows\System\wqyLXFg.exe
  2⤵
  PID:8100
- C:\Windows\System\RnqioJF.exe
  C:\Windows\System\RnqioJF.exe
  2⤵
  PID:8116
- C:\Windows\System\HshOXxp.exe
  C:\Windows\System\HshOXxp.exe
  2⤵
  PID:8136
- C:\Windows\System\EXKwtyN.exe
  C:\Windows\System\EXKwtyN.exe
  2⤵
  PID:8152
- C:\Windows\System\TidJzWp.exe
  C:\Windows\System\TidJzWp.exe
  2⤵
  PID:8176
- C:\Windows\System\lbPWVZQ.exe
  C:\Windows\System\lbPWVZQ.exe
  2⤵
  PID:6008
- C:\Windows\System\USGeZHE.exe
  C:\Windows\System\USGeZHE.exe
  2⤵
  PID:6048
- C:\Windows\System\cnUvTwl.exe
  C:\Windows\System\cnUvTwl.exe
  2⤵
  PID:1836
- C:\Windows\System\UMlUZUM.exe
  C:\Windows\System\UMlUZUM.exe
  2⤵
  PID:6732
- C:\Windows\System\RaIwehk.exe
  C:\Windows\System\RaIwehk.exe
  2⤵
  PID:5104
- C:\Windows\System\seXHVxO.exe
  C:\Windows\System\seXHVxO.exe
  2⤵
  PID:4472
- C:\Windows\System\nvqdTFG.exe
  C:\Windows\System\nvqdTFG.exe
  2⤵
  PID:7060
- C:\Windows\System\OMPYZOM.exe
  C:\Windows\System\OMPYZOM.exe
  2⤵
  PID:5832
- C:\Windows\System\ibSMPAX.exe
  C:\Windows\System\ibSMPAX.exe
  2⤵
  PID:5916
- C:\Windows\System\AYthqBq.exe
  C:\Windows\System\AYthqBq.exe
  2⤵
  PID:5988
- C:\Windows\System\MvLVpsB.exe
  C:\Windows\System\MvLVpsB.exe
  2⤵
  PID:1316
- C:\Windows\System\SHhBSvn.exe
  C:\Windows\System\SHhBSvn.exe
  2⤵
  PID:6428
- C:\Windows\System\uWacMmy.exe
  C:\Windows\System\uWacMmy.exe
  2⤵
  PID:6480
- C:\Windows\System\IFTXNSp.exe
  C:\Windows\System\IFTXNSp.exe
  2⤵
  PID:6524
- C:\Windows\System\vMqYtsX.exe
  C:\Windows\System\vMqYtsX.exe
  2⤵
  PID:6576
- C:\Windows\System\DolRDwv.exe
  C:\Windows\System\DolRDwv.exe
  2⤵
  PID:6616
- C:\Windows\System\gyhAdpD.exe
  C:\Windows\System\gyhAdpD.exe
  2⤵
  PID:6672
- C:\Windows\System\vNAzexl.exe
  C:\Windows\System\vNAzexl.exe
  2⤵
  PID:7604
- C:\Windows\System\lnkdJrB.exe
  C:\Windows\System\lnkdJrB.exe
  2⤵
  PID:8196
- C:\Windows\System\LPkEzSG.exe
  C:\Windows\System\LPkEzSG.exe
  2⤵
  PID:8220
- C:\Windows\System\iMDXgea.exe
  C:\Windows\System\iMDXgea.exe
  2⤵
  PID:8248
- C:\Windows\System\EMxqVyU.exe
  C:\Windows\System\EMxqVyU.exe
  2⤵
  PID:8272
- C:\Windows\System\JrjFJXt.exe
  C:\Windows\System\JrjFJXt.exe
  2⤵
  PID:8288
- C:\Windows\System\AwFpIyl.exe
  C:\Windows\System\AwFpIyl.exe
  2⤵
  PID:8312
- C:\Windows\System\hgAMHao.exe
  C:\Windows\System\hgAMHao.exe
  2⤵
  PID:8332
- C:\Windows\System\MiHdiYh.exe
  C:\Windows\System\MiHdiYh.exe
  2⤵
  PID:8352
- C:\Windows\System\UvFlugb.exe
  C:\Windows\System\UvFlugb.exe
  2⤵
  PID:9112
- C:\Windows\System\bieRRYe.exe
  C:\Windows\System\bieRRYe.exe
  2⤵
  PID:9136
- C:\Windows\System\Mjjxfye.exe
  C:\Windows\System\Mjjxfye.exe
  2⤵
  PID:9156
- C:\Windows\System\lGcZNEw.exe
  C:\Windows\System\lGcZNEw.exe
  2⤵
  PID:5152
- C:\Windows\System\ViwkJxh.exe
  C:\Windows\System\ViwkJxh.exe
  2⤵
  PID:884
- C:\Windows\System\PVmvlCJ.exe
  C:\Windows\System\PVmvlCJ.exe
  2⤵
  PID:7100
- C:\Windows\System\FfcOXih.exe
  C:\Windows\System\FfcOXih.exe
  2⤵
  PID:5772
- C:\Windows\System\YkKiFAu.exe
  C:\Windows\System\YkKiFAu.exe
  2⤵
  PID:5856
- C:\Windows\System\pMPaUdO.exe
  C:\Windows\System\pMPaUdO.exe
  2⤵
  PID:5640
- C:\Windows\System\FWPRDjs.exe
  C:\Windows\System\FWPRDjs.exe
  2⤵
  PID:7196
- C:\Windows\System\NNZEKhH.exe
  C:\Windows\System\NNZEKhH.exe
  2⤵
  PID:7260
- C:\Windows\System\LXBNwPS.exe
  C:\Windows\System\LXBNwPS.exe
  2⤵
  PID:6108
- C:\Windows\System\WEwAAme.exe
  C:\Windows\System\WEwAAme.exe
  2⤵
  PID:6184
- C:\Windows\System\JcZDTgr.exe
  C:\Windows\System\JcZDTgr.exe
  2⤵
  PID:7408
- C:\Windows\System\ZQNgxfF.exe
  C:\Windows\System\ZQNgxfF.exe
  2⤵
  PID:7444
- C:\Windows\System\EXkzktP.exe
  C:\Windows\System\EXkzktP.exe
  2⤵
  PID:6276
- C:\Windows\System\BDgGmcD.exe
  C:\Windows\System\BDgGmcD.exe
  2⤵
  PID:6316
- C:\Windows\System\oBFBHsI.exe
  C:\Windows\System\oBFBHsI.exe
  2⤵
  PID:6344
- C:\Windows\System\ZjeuLnc.exe
  C:\Windows\System\ZjeuLnc.exe
  2⤵
  PID:6384
- C:\Windows\System\ICfPtQw.exe
  C:\Windows\System\ICfPtQw.exe
  2⤵
  PID:6400
- C:\Windows\System\sMzXfeJ.exe
  C:\Windows\System\sMzXfeJ.exe
  2⤵
  PID:6588
- C:\Windows\System\qmQIBTX.exe
  C:\Windows\System\qmQIBTX.exe
  2⤵
  PID:6768
- C:\Windows\System\NvdnUOF.exe
  C:\Windows\System\NvdnUOF.exe
  2⤵
  PID:6816
- C:\Windows\System\XcLQDYD.exe
  C:\Windows\System\XcLQDYD.exe
  2⤵
  PID:4480
- C:\Windows\System\AMcicMa.exe
  C:\Windows\System\AMcicMa.exe
  2⤵
  PID:6648
- C:\Windows\System\oOfRVkV.exe
  C:\Windows\System\oOfRVkV.exe
  2⤵
  PID:8228
- C:\Windows\System\pfHknOT.exe
  C:\Windows\System\pfHknOT.exe
  2⤵
  PID:7012
- C:\Windows\System\MqwGxND.exe
  C:\Windows\System\MqwGxND.exe
  2⤵
  PID:7052
- C:\Windows\System\kuQBzON.exe
  C:\Windows\System\kuQBzON.exe
  2⤵
  PID:8424
- C:\Windows\System\YoMegiw.exe
  C:\Windows\System\YoMegiw.exe
  2⤵
  PID:7736
- C:\Windows\System\oSJMWlZ.exe
  C:\Windows\System\oSJMWlZ.exe
  2⤵
  PID:8488
- C:\Windows\System\ObToqxX.exe
  C:\Windows\System\ObToqxX.exe
  2⤵
  PID:7268
- C:\Windows\System\RHtcMXC.exe
  C:\Windows\System\RHtcMXC.exe
  2⤵
  PID:7336
- C:\Windows\System\uDdQnDk.exe
  C:\Windows\System\uDdQnDk.exe
  2⤵
  PID:8528
- C:\Windows\System\bOmDWeb.exe
  C:\Windows\System\bOmDWeb.exe
  2⤵
  PID:7448
- C:\Windows\System\OqFJCcK.exe
  C:\Windows\System\OqFJCcK.exe
  2⤵
  PID:7944
- C:\Windows\System\iuTJEWz.exe
  C:\Windows\System\iuTJEWz.exe
  2⤵
  PID:6032
- C:\Windows\System\xnoCcMT.exe
  C:\Windows\System\xnoCcMT.exe
  2⤵
  PID:4980
- C:\Windows\System\BZMKoDU.exe
  C:\Windows\System\BZMKoDU.exe
  2⤵
  PID:8324
- C:\Windows\System\pAmTmCM.exe
  C:\Windows\System\pAmTmCM.exe
  2⤵
  PID:4700
- C:\Windows\System\ipsItJP.exe
  C:\Windows\System\ipsItJP.exe
  2⤵
  PID:7680
- C:\Windows\System\GrwYabr.exe
  C:\Windows\System\GrwYabr.exe
  2⤵
  PID:8952
- C:\Windows\System\hyfIaFn.exe
  C:\Windows\System\hyfIaFn.exe
  2⤵
  PID:8012
- C:\Windows\System\bBwCskb.exe
  C:\Windows\System\bBwCskb.exe
  2⤵
  PID:8028
- C:\Windows\System\UcmUZxu.exe
  C:\Windows\System\UcmUZxu.exe
  2⤵
  PID:8064
- C:\Windows\System\HJeaugG.exe
  C:\Windows\System\HJeaugG.exe
  2⤵
  PID:6076
- C:\Windows\System\wgtGtbH.exe
  C:\Windows\System\wgtGtbH.exe
  2⤵
  PID:3712
- C:\Windows\System\rECFSGm.exe
  C:\Windows\System\rECFSGm.exe
  2⤵
  PID:4552
- C:\Windows\System\RCECfmi.exe
  C:\Windows\System\RCECfmi.exe
  2⤵
  PID:2440
- C:\Windows\System\DHfjeTP.exe
  C:\Windows\System\DHfjeTP.exe
  2⤵
  PID:6500
- C:\Windows\System\eyqwMpQ.exe
  C:\Windows\System\eyqwMpQ.exe
  2⤵
  PID:9108
- C:\Windows\System\ogftdtn.exe
  C:\Windows\System\ogftdtn.exe
  2⤵
  PID:1360
- C:\Windows\System\xuOGZtO.exe
  C:\Windows\System\xuOGZtO.exe
  2⤵
  PID:8060
- C:\Windows\System\ppmyNRZ.exe
  C:\Windows\System\ppmyNRZ.exe
  2⤵
  PID:7960
- C:\Windows\System\QsOdxhP.exe
  C:\Windows\System\QsOdxhP.exe
  2⤵
  PID:8308
- C:\Windows\System\PlfrzFQ.exe
  C:\Windows\System\PlfrzFQ.exe
  2⤵
  PID:2308
- C:\Windows\System\OwyISOR.exe
  C:\Windows\System\OwyISOR.exe
  2⤵
  PID:8212
- C:\Windows\System\fhUtiay.exe
  C:\Windows\System\fhUtiay.exe
  2⤵
  PID:7868
- C:\Windows\System\POCIaLy.exe
  C:\Windows\System\POCIaLy.exe
  2⤵
  PID:9084
- C:\Windows\System\Hvtnths.exe
  C:\Windows\System\Hvtnths.exe
  2⤵
  PID:8656
- C:\Windows\System\ldKtAUg.exe
  C:\Windows\System\ldKtAUg.exe
  2⤵
  PID:6312
- C:\Windows\System\CqgKmvL.exe
  C:\Windows\System\CqgKmvL.exe
  2⤵
  PID:6360
- C:\Windows\System\doMgbUl.exe
  C:\Windows\System\doMgbUl.exe
  2⤵
  PID:7940
- C:\Windows\System\dEXsMFf.exe
  C:\Windows\System\dEXsMFf.exe
  2⤵
  PID:9164
- C:\Windows\System\EwjSHOa.exe
  C:\Windows\System\EwjSHOa.exe
  2⤵
  PID:9200
- C:\Windows\System\HzCSoLF.exe
  C:\Windows\System\HzCSoLF.exe
  2⤵
  PID:5572
- C:\Windows\System\vCoDKEb.exe
  C:\Windows\System\vCoDKEb.exe
  2⤵
  PID:5956
- C:\Windows\System\lNShVlp.exe
  C:\Windows\System\lNShVlp.exe
  2⤵
  PID:8776
- C:\Windows\System\pBjVgty.exe
  C:\Windows\System\pBjVgty.exe
  2⤵
  PID:8852
- C:\Windows\System\KDAUJHQ.exe
  C:\Windows\System\KDAUJHQ.exe
  2⤵
  PID:8900
- C:\Windows\System\cZvWqJO.exe
  C:\Windows\System\cZvWqJO.exe
  2⤵
  PID:4976
- C:\Windows\System\KbBQBqq.exe
  C:\Windows\System\KbBQBqq.exe
  2⤵
  PID:9036
- C:\Windows\System\ruoIzoD.exe
  C:\Windows\System\ruoIzoD.exe
  2⤵
  PID:7200
- C:\Windows\System\QyhDacX.exe
  C:\Windows\System\QyhDacX.exe
  2⤵
  PID:7244
- C:\Windows\System\PLosIEr.exe
  C:\Windows\System\PLosIEr.exe
  2⤵
  PID:7976
- C:\Windows\System\swSWmNA.exe
  C:\Windows\System\swSWmNA.exe
  2⤵
  PID:9240
- C:\Windows\System\jykKgdW.exe
  C:\Windows\System\jykKgdW.exe
  2⤵
  PID:9260
- C:\Windows\System\WWrKJTM.exe
  C:\Windows\System\WWrKJTM.exe
  2⤵
  PID:9280
- C:\Windows\System\UKMNtVM.exe
  C:\Windows\System\UKMNtVM.exe
  2⤵
  PID:9304
- C:\Windows\System\hfXbwjl.exe
  C:\Windows\System\hfXbwjl.exe
  2⤵
  PID:9324
- C:\Windows\System\scVPLJl.exe
  C:\Windows\System\scVPLJl.exe
  2⤵
  PID:9356
- C:\Windows\System\cwRHbED.exe
  C:\Windows\System\cwRHbED.exe
  2⤵
  PID:9380
- C:\Windows\System\RscrTVF.exe
  C:\Windows\System\RscrTVF.exe
  2⤵
  PID:9412
- C:\Windows\System\MjFKGRd.exe
  C:\Windows\System\MjFKGRd.exe
  2⤵
  PID:9432
- C:\Windows\System\BKpFury.exe
  C:\Windows\System\BKpFury.exe
  2⤵
  PID:9452
- C:\Windows\System\xtJzuWG.exe
  C:\Windows\System\xtJzuWG.exe
  2⤵
  PID:9488
- C:\Windows\System\pMUIwSW.exe
  C:\Windows\System\pMUIwSW.exe
  2⤵
  PID:9516
- C:\Windows\System\ouFaKWr.exe
  C:\Windows\System\ouFaKWr.exe
  2⤵
  PID:9536
- C:\Windows\System\dCkKbpt.exe
  C:\Windows\System\dCkKbpt.exe
  2⤵
  PID:9552
- C:\Windows\System\YmestAt.exe
  C:\Windows\System\YmestAt.exe
  2⤵
  PID:9572
- C:\Windows\System\ZErpwuc.exe
  C:\Windows\System\ZErpwuc.exe
  2⤵
  PID:9596
- C:\Windows\System\MUsKgCw.exe
  C:\Windows\System\MUsKgCw.exe
  2⤵
  PID:9612
- C:\Windows\System\xGeDDZl.exe
  C:\Windows\System\xGeDDZl.exe
  2⤵
  PID:9636
- C:\Windows\System\CzCsHJR.exe
  C:\Windows\System\CzCsHJR.exe
  2⤵
  PID:9660
- C:\Windows\System\QEsPTFm.exe
  C:\Windows\System\QEsPTFm.exe
  2⤵
  PID:9684
- C:\Windows\System\aMTStSj.exe
  C:\Windows\System\aMTStSj.exe
  2⤵
  PID:9700
- C:\Windows\System\bncYHFq.exe
  C:\Windows\System\bncYHFq.exe
  2⤵
  PID:9728
- C:\Windows\System\wsyduHt.exe
  C:\Windows\System\wsyduHt.exe
  2⤵
  PID:9760
- C:\Windows\System\KDqSqNj.exe
  C:\Windows\System\KDqSqNj.exe
  2⤵
  PID:9776
- C:\Windows\System\hqZJCvF.exe
  C:\Windows\System\hqZJCvF.exe
  2⤵
  PID:9800
- C:\Windows\System\hsLCijG.exe
  C:\Windows\System\hsLCijG.exe
  2⤵
  PID:9832
- C:\Windows\System\iYrGKsg.exe
  C:\Windows\System\iYrGKsg.exe
  2⤵
  PID:9848
- C:\Windows\System\zTUyHew.exe
  C:\Windows\System\zTUyHew.exe
  2⤵
  PID:9872
- C:\Windows\System\zJZDgTc.exe
  C:\Windows\System\zJZDgTc.exe
  2⤵
  PID:9900
- C:\Windows\System\TEUbVaH.exe
  C:\Windows\System\TEUbVaH.exe
  2⤵
  PID:9916
- C:\Windows\System\mcqbimP.exe
  C:\Windows\System\mcqbimP.exe
  2⤵
  PID:9944
- C:\Windows\System\ZnSrgDs.exe
  C:\Windows\System\ZnSrgDs.exe
  2⤵
  PID:9972
- C:\Windows\System\OxdWlXe.exe
  C:\Windows\System\OxdWlXe.exe
  2⤵
  PID:9992
- C:\Windows\System\bzlgzTm.exe
  C:\Windows\System\bzlgzTm.exe
  2⤵
  PID:10112
- C:\Windows\System\sPGuJhK.exe
  C:\Windows\System\sPGuJhK.exe
  2⤵
  PID:10228
- C:\Windows\System\IwWBuQm.exe
  C:\Windows\System\IwWBuQm.exe
  2⤵
  PID:9068
- C:\Windows\System\rsDkCMy.exe
  C:\Windows\System\rsDkCMy.exe
  2⤵
  PID:1092
- C:\Windows\System\uSJZebG.exe
  C:\Windows\System\uSJZebG.exe
  2⤵
  PID:1184
- C:\Windows\System\SaAZWHI.exe
  C:\Windows\System\SaAZWHI.exe
  2⤵
  PID:3684
- C:\Windows\System\BEuPxUl.exe
  C:\Windows\System\BEuPxUl.exe
  2⤵
  PID:7264
- C:\Windows\System\slLZLHb.exe
  C:\Windows\System\slLZLHb.exe
  2⤵
  PID:4396
- C:\Windows\System\MvegMTt.exe
  C:\Windows\System\MvegMTt.exe
  2⤵
  PID:5284
- C:\Windows\System\GWkwwkF.exe
  C:\Windows\System\GWkwwkF.exe
  2⤵
  PID:5760
- C:\Windows\System\zoitNZT.exe
  C:\Windows\System\zoitNZT.exe
  2⤵
  PID:5960
- C:\Windows\System\ZIMYEeT.exe
  C:\Windows\System\ZIMYEeT.exe
  2⤵
  PID:2316
- C:\Windows\System\yuslZob.exe
  C:\Windows\System\yuslZob.exe
  2⤵
  PID:3080
- C:\Windows\System\UvaXAkn.exe
  C:\Windows\System\UvaXAkn.exe
  2⤵
  PID:6164
- C:\Windows\System\dBmTiid.exe
  C:\Windows\System\dBmTiid.exe
  2⤵
  PID:6192
- C:\Windows\System\ZsWqaOH.exe
  C:\Windows\System\ZsWqaOH.exe
  2⤵
  PID:2424
- C:\Windows\System\zTXZdaU.exe
  C:\Windows\System\zTXZdaU.exe
  2⤵
  PID:6804
- C:\Windows\System\kChyeME.exe
  C:\Windows\System\kChyeME.exe
  2⤵
  PID:6628
- C:\Windows\System\moaVSKK.exe
  C:\Windows\System\moaVSKK.exe
  2⤵
  PID:7648
- C:\Windows\System\UYYHnKp.exe
  C:\Windows\System\UYYHnKp.exe
  2⤵
  PID:9808
- C:\Windows\System\Prduxkr.exe
  C:\Windows\System\Prduxkr.exe
  2⤵
  PID:9828
- C:\Windows\System\xjkfbjw.exe
  C:\Windows\System\xjkfbjw.exe
  2⤵
  PID:9248
- C:\Windows\System\NjzPPEe.exe
  C:\Windows\System\NjzPPEe.exe
  2⤵
  PID:9912
- C:\Windows\System\HdIGCxn.exe
  C:\Windows\System\HdIGCxn.exe
  2⤵
  PID:9296
- C:\Windows\System\nibyGPs.exe
  C:\Windows\System\nibyGPs.exe
  2⤵
  PID:9940
- C:\Windows\System\hXnPTny.exe
  C:\Windows\System\hXnPTny.exe
  2⤵
  PID:7892
- C:\Windows\System\lbkxcUF.exe
  C:\Windows\System\lbkxcUF.exe
  2⤵
  PID:9176
- C:\Windows\System\lOozwBX.exe
  C:\Windows\System\lOozwBX.exe
  2⤵
  PID:8480
- C:\Windows\System\UqDIrWS.exe
  C:\Windows\System\UqDIrWS.exe
  2⤵
  PID:8868
- C:\Windows\System\IFmsoan.exe
  C:\Windows\System\IFmsoan.exe
  2⤵
  PID:5136
- C:\Windows\System\oPHhJPp.exe
  C:\Windows\System\oPHhJPp.exe
  2⤵
  PID:9236
- C:\Windows\System\kvMehEk.exe
  C:\Windows\System\kvMehEk.exe
  2⤵
  PID:9428
- C:\Windows\System\jnOETmf.exe
  C:\Windows\System\jnOETmf.exe
  2⤵
  PID:9484
- C:\Windows\System\jZprRJQ.exe
  C:\Windows\System\jZprRJQ.exe
  2⤵
  PID:9532
- C:\Windows\System\NMsWHUB.exe
  C:\Windows\System\NMsWHUB.exe
  2⤵
  PID:9580
- C:\Windows\System\YWZCzGL.exe
  C:\Windows\System\YWZCzGL.exe
  2⤵
  PID:9620
- C:\Windows\System\jLvFpau.exe
  C:\Windows\System\jLvFpau.exe
  2⤵
  PID:9668
- C:\Windows\System\SfzRDlq.exe
  C:\Windows\System\SfzRDlq.exe
  2⤵
  PID:9724
- C:\Windows\System\omCbelO.exe
  C:\Windows\System\omCbelO.exe
  2⤵
  PID:9784
- C:\Windows\System\UojPpAI.exe
  C:\Windows\System\UojPpAI.exe
  2⤵
  PID:10060
- C:\Windows\System\nKtXJaw.exe
  C:\Windows\System\nKtXJaw.exe
  2⤵
  PID:5812
- C:\Windows\System\UFUFbBA.exe
  C:\Windows\System\UFUFbBA.exe
  2⤵
  PID:5116
- C:\Windows\System\OkhBHPd.exe
  C:\Windows\System\OkhBHPd.exe
  2⤵
  PID:6212
- C:\Windows\System\POCNJqu.exe
  C:\Windows\System\POCNJqu.exe
  2⤵
  PID:9964
- C:\Windows\System\lJJEvpj.exe
  C:\Windows\System\lJJEvpj.exe
  2⤵
  PID:9768
- C:\Windows\System\eAscpcH.exe
  C:\Windows\System\eAscpcH.exe
  2⤵
  PID:9880
- C:\Windows\System\QdAfvZs.exe
  C:\Windows\System\QdAfvZs.exe
  2⤵
  PID:6444
- C:\Windows\System\VvFEIjE.exe
  C:\Windows\System\VvFEIjE.exe
  2⤵
  PID:4512
- C:\Windows\System\YpipzyV.exe
  C:\Windows\System\YpipzyV.exe
  2⤵
  PID:3608
- C:\Windows\System\sTQdMDB.exe
  C:\Windows\System\sTQdMDB.exe
  2⤵
  PID:10236
- C:\Windows\System\SRyaDHE.exe
  C:\Windows\System\SRyaDHE.exe
  2⤵
  PID:10252
- C:\Windows\System\coaVbIw.exe
  C:\Windows\System\coaVbIw.exe
  2⤵
  PID:10276
- C:\Windows\System\PIzbMSh.exe
  C:\Windows\System\PIzbMSh.exe
  2⤵
  PID:10292
- C:\Windows\System\VvCWIre.exe
  C:\Windows\System\VvCWIre.exe
  2⤵
  PID:10316
- C:\Windows\System\IsnjsvN.exe
  C:\Windows\System\IsnjsvN.exe
  2⤵
  PID:10344
- C:\Windows\System\QyVchUn.exe
  C:\Windows\System\QyVchUn.exe
  2⤵
  PID:10360
- C:\Windows\System\udhswRa.exe
  C:\Windows\System\udhswRa.exe
  2⤵
  PID:10384
- C:\Windows\System\HGCwfEj.exe
  C:\Windows\System\HGCwfEj.exe
  2⤵
  PID:10408
- C:\Windows\System\uEDFyHF.exe
  C:\Windows\System\uEDFyHF.exe
  2⤵
  PID:10432
- C:\Windows\System\XeuDRFF.exe
  C:\Windows\System\XeuDRFF.exe
  2⤵
  PID:10452
- C:\Windows\System\FItMqOt.exe
  C:\Windows\System\FItMqOt.exe
  2⤵
  PID:10476
- C:\Windows\System\PFGumDr.exe
  C:\Windows\System\PFGumDr.exe
  2⤵
  PID:10504
- C:\Windows\System\AoFAXxA.exe
  C:\Windows\System\AoFAXxA.exe
  2⤵
  PID:10520
- C:\Windows\System\AXPNDgo.exe
  C:\Windows\System\AXPNDgo.exe
  2⤵
  PID:10544
- C:\Windows\System\fCKspeA.exe
  C:\Windows\System\fCKspeA.exe
  2⤵
  PID:10572
- C:\Windows\System\NiXsZkV.exe
  C:\Windows\System\NiXsZkV.exe
  2⤵
  PID:10588
- C:\Windows\System\ynGcmZz.exe
  C:\Windows\System\ynGcmZz.exe
  2⤵
  PID:10608
- C:\Windows\System\RqZohXP.exe
  C:\Windows\System\RqZohXP.exe
  2⤵
  PID:10632
- C:\Windows\System\HjvPAaU.exe
  C:\Windows\System\HjvPAaU.exe
  2⤵
  PID:10680
- C:\Windows\System\jArjWNq.exe
  C:\Windows\System\jArjWNq.exe
  2⤵
  PID:10712
- C:\Windows\System\cvnEAiM.exe
  C:\Windows\System\cvnEAiM.exe
  2⤵
  PID:10752
- C:\Windows\System\YXrAvQS.exe
  C:\Windows\System\YXrAvQS.exe
  2⤵
  PID:10796
- C:\Windows\System\tXjWrGp.exe
  C:\Windows\System\tXjWrGp.exe
  2⤵
  PID:10820
- C:\Windows\System\LNTlhGg.exe
  C:\Windows\System\LNTlhGg.exe
  2⤵
  PID:10840
- C:\Windows\System\isEuorI.exe
  C:\Windows\System\isEuorI.exe
  2⤵
  PID:10864
- C:\Windows\System\wWIAhYE.exe
  C:\Windows\System\wWIAhYE.exe
  2⤵
  PID:10884
- C:\Windows\System\aCHAiqB.exe
  C:\Windows\System\aCHAiqB.exe
  2⤵
  PID:10908
- C:\Windows\System\KnPgmHc.exe
  C:\Windows\System\KnPgmHc.exe
  2⤵
  PID:10924
- C:\Windows\System\eNnQvNW.exe
  C:\Windows\System\eNnQvNW.exe
  2⤵
  PID:10952
- C:\Windows\System\vmTgpGQ.exe
  C:\Windows\System\vmTgpGQ.exe
  2⤵
  PID:10968
- C:\Windows\System\PTXJjJc.exe
  C:\Windows\System\PTXJjJc.exe
  2⤵
  PID:10988
- C:\Windows\System\ZGSEQno.exe
  C:\Windows\System\ZGSEQno.exe
  2⤵
  PID:11004
- C:\Windows\System\BrreQWD.exe
  C:\Windows\System\BrreQWD.exe
  2⤵
  PID:11020
- C:\Windows\System\MnxKdFo.exe
  C:\Windows\System\MnxKdFo.exe
  2⤵
  PID:11040
- C:\Windows\System\duccAcH.exe
  C:\Windows\System\duccAcH.exe
  2⤵
  PID:11060
- C:\Windows\System\sSWxygA.exe
  C:\Windows\System\sSWxygA.exe
  2⤵
  PID:11076
- C:\Windows\System\TuKaOIY.exe
  C:\Windows\System\TuKaOIY.exe
  2⤵
  PID:11096
- C:\Windows\System\KWreaEV.exe
  C:\Windows\System\KWreaEV.exe
  2⤵
  PID:11116
- C:\Windows\System\WrvnkdC.exe
  C:\Windows\System\WrvnkdC.exe
  2⤵
  PID:11132
- C:\Windows\System\LsPYyHv.exe
  C:\Windows\System\LsPYyHv.exe
  2⤵
  PID:11148
- C:\Windows\System\LfghLJE.exe
  C:\Windows\System\LfghLJE.exe
  2⤵
  PID:11164
- C:\Windows\System\OsMxSKk.exe
  C:\Windows\System\OsMxSKk.exe
  2⤵
  PID:11184
- C:\Windows\System\FfCvqzo.exe
  C:\Windows\System\FfCvqzo.exe
  2⤵
  PID:11204
- C:\Windows\System\eXCaeFs.exe
  C:\Windows\System\eXCaeFs.exe
  2⤵
  PID:11224
- C:\Windows\System\BzfNPIW.exe
  C:\Windows\System\BzfNPIW.exe
  2⤵
  PID:11240
- C:\Windows\System\hvewOBH.exe
  C:\Windows\System\hvewOBH.exe
  2⤵
  PID:11260
- C:\Windows\System\UoaOHHU.exe
  C:\Windows\System\UoaOHHU.exe
  2⤵
  PID:8464
- C:\Windows\System\XosTOGy.exe
  C:\Windows\System\XosTOGy.exe
  2⤵
  PID:8184
- C:\Windows\System\vpkLeIx.exe
  C:\Windows\System\vpkLeIx.exe
  2⤵
  PID:416
- C:\Windows\System\tIpeGZu.exe
  C:\Windows\System\tIpeGZu.exe
  2⤵
  PID:7240
- C:\Windows\System\uutSxpJ.exe
  C:\Windows\System\uutSxpJ.exe
  2⤵
  PID:9884
- C:\Windows\System\NNcnarq.exe
  C:\Windows\System\NNcnarq.exe
  2⤵
  PID:6552
- C:\Windows\System\SutxmFE.exe
  C:\Windows\System\SutxmFE.exe
  2⤵
  PID:2892
- C:\Windows\System\DWvLaXb.exe
  C:\Windows\System\DWvLaXb.exe
  2⤵
  PID:9840
- C:\Windows\System\DxUCIey.exe
  C:\Windows\System\DxUCIey.exe
  2⤵
  PID:11280
- C:\Windows\System\GiTkvrc.exe
  C:\Windows\System\GiTkvrc.exe
  2⤵
  PID:11300
- C:\Windows\System\hkYRmFg.exe
  C:\Windows\System\hkYRmFg.exe
  2⤵
  PID:11340
- C:\Windows\System\LilvYyz.exe
  C:\Windows\System\LilvYyz.exe
  2⤵
  PID:11360
- C:\Windows\System\NxiUEwM.exe
  C:\Windows\System\NxiUEwM.exe
  2⤵
  PID:11388
- C:\Windows\System\VDssZOU.exe
  C:\Windows\System\VDssZOU.exe
  2⤵
  PID:11404
- C:\Windows\System\LIxTvTL.exe
  C:\Windows\System\LIxTvTL.exe
  2⤵
  PID:11420
- C:\Windows\System\pkOldXb.exe
  C:\Windows\System\pkOldXb.exe
  2⤵
  PID:11448
- C:\Windows\System\szhDWbe.exe
  C:\Windows\System\szhDWbe.exe
  2⤵
  PID:11468
- C:\Windows\System\ZgwLikk.exe
  C:\Windows\System\ZgwLikk.exe
  2⤵
  PID:11488
- C:\Windows\System\SmGpctt.exe
  C:\Windows\System\SmGpctt.exe
  2⤵
  PID:11504
- C:\Windows\System\DCIUhPl.exe
  C:\Windows\System\DCIUhPl.exe
  2⤵
  PID:11520
- C:\Windows\System\sCqYySm.exe
  C:\Windows\System\sCqYySm.exe
  2⤵
  PID:11544
- C:\Windows\System\GmofrQQ.exe
  C:\Windows\System\GmofrQQ.exe
  2⤵
  PID:11568
- C:\Windows\System\JjMODAH.exe
  C:\Windows\System\JjMODAH.exe
  2⤵
  PID:11584
- C:\Windows\System\qwqFlxs.exe
  C:\Windows\System\qwqFlxs.exe
  2⤵
  PID:11608
- C:\Windows\System\slhBdAz.exe
  C:\Windows\System\slhBdAz.exe
  2⤵
  PID:11636
- C:\Windows\System\POONYHh.exe
  C:\Windows\System\POONYHh.exe
  2⤵
  PID:11656
- C:\Windows\System\LEIFUYi.exe
  C:\Windows\System\LEIFUYi.exe
  2⤵
  PID:11676
- C:\Windows\System\ttOQFov.exe
  C:\Windows\System\ttOQFov.exe
  2⤵
  PID:12176
- C:\Windows\System\hGGAhQj.exe
  C:\Windows\System\hGGAhQj.exe
  2⤵
  PID:12192
- C:\Windows\System\CllyCdI.exe
  C:\Windows\System\CllyCdI.exe
  2⤵
  PID:12208
- C:\Windows\System\bEdmgSa.exe
  C:\Windows\System\bEdmgSa.exe
  2⤵
  PID:12228
- C:\Windows\System\mxtCvNU.exe
  C:\Windows\System\mxtCvNU.exe
  2⤵
  PID:12248
- C:\Windows\System\JEyQKhd.exe
  C:\Windows\System\JEyQKhd.exe
  2⤵
  PID:12264
- C:\Windows\System\djZwPfL.exe
  C:\Windows\System\djZwPfL.exe
  2⤵
  PID:12280
- C:\Windows\System\xlVvacQ.exe
  C:\Windows\System\xlVvacQ.exe
  2⤵
  PID:9820
- C:\Windows\System\ZkXYsAM.exe
  C:\Windows\System\ZkXYsAM.exe
  2⤵
  PID:6236
- C:\Windows\System\nVCqjhd.exe
  C:\Windows\System\nVCqjhd.exe
  2⤵
  PID:9444
- C:\Windows\System\dCBxRUs.exe
  C:\Windows\System\dCBxRUs.exe
  2⤵
  PID:5836
- C:\Windows\System\ujxLxYy.exe
  C:\Windows\System\ujxLxYy.exe
  2⤵
  PID:10284
- C:\Windows\System\PGNwcNr.exe
  C:\Windows\System\PGNwcNr.exe
  2⤵
  PID:10312
- C:\Windows\System\YSwJZmC.exe
  C:\Windows\System\YSwJZmC.exe
  2⤵
  PID:8236
- C:\Windows\System\jRmPDMx.exe
  C:\Windows\System\jRmPDMx.exe
  2⤵
  PID:10460
- C:\Windows\System\QnFPrBV.exe
  C:\Windows\System\QnFPrBV.exe
  2⤵
  PID:10540
- C:\Windows\System\RTTRego.exe
  C:\Windows\System\RTTRego.exe
  2⤵
  PID:10584
- C:\Windows\System\WGWFkWE.exe
  C:\Windows\System\WGWFkWE.exe
  2⤵
  PID:10616
- C:\Windows\System\LnXavXW.exe
  C:\Windows\System\LnXavXW.exe
  2⤵
  PID:2416
- C:\Windows\System\vqokDHu.exe
  C:\Windows\System\vqokDHu.exe
  2⤵
  PID:5072
- C:\Windows\System\xpkvhKw.exe
  C:\Windows\System\xpkvhKw.exe
  2⤵
  PID:9756
- C:\Windows\System\wfBpYFJ.exe
  C:\Windows\System\wfBpYFJ.exe
  2⤵
  PID:11068
- C:\Windows\System\OkbLzGq.exe
  C:\Windows\System\OkbLzGq.exe
  2⤵
  PID:11092
- C:\Windows\System\hhOjGXG.exe
  C:\Windows\System\hhOjGXG.exe
  2⤵
  PID:11128
- C:\Windows\System\ylQYuwc.exe
  C:\Windows\System\ylQYuwc.exe
  2⤵
  PID:11160
- C:\Windows\System\MboACoV.exe
  C:\Windows\System\MboACoV.exe
  2⤵
  PID:2360
- C:\Windows\System\ZghWQqI.exe
  C:\Windows\System\ZghWQqI.exe
  2⤵
  PID:7664
- C:\Windows\System\UhSSGjl.exe
  C:\Windows\System\UhSSGjl.exe
  2⤵
  PID:8764
- C:\Windows\System\wYDoeqx.exe
  C:\Windows\System\wYDoeqx.exe
  2⤵
  PID:3792
- C:\Windows\System\cDpxtlZ.exe
  C:\Windows\System\cDpxtlZ.exe
  2⤵
  PID:6028
- C:\Windows\System\uCbDrxG.exe
  C:\Windows\System\uCbDrxG.exe
  2⤵
  PID:5748
- C:\Windows\System\DrPhtjv.exe
  C:\Windows\System\DrPhtjv.exe
  2⤵
  PID:9860
- C:\Windows\System\YJDYdva.exe
  C:\Windows\System\YJDYdva.exe
  2⤵
  PID:5016
- C:\Windows\System\dRBYBsB.exe
  C:\Windows\System\dRBYBsB.exe
  2⤵
  PID:2300
- C:\Windows\System\ShQjbel.exe
  C:\Windows\System\ShQjbel.exe
  2⤵
  PID:8884
- C:\Windows\System\FNULaJq.exe
  C:\Windows\System\FNULaJq.exe
  2⤵
  PID:9752
- C:\Windows\System\gBRkBZN.exe
  C:\Windows\System\gBRkBZN.exe
  2⤵
  PID:9468
- C:\Windows\System\TrVgalC.exe
  C:\Windows\System\TrVgalC.exe
  2⤵
  PID:9560
- C:\Windows\System\nZcsYLL.exe
  C:\Windows\System\nZcsYLL.exe
  2⤵
  PID:9708
- C:\Windows\System\XkSwkCv.exe
  C:\Windows\System\XkSwkCv.exe
  2⤵
  PID:11952
- C:\Windows\System\spAqVWC.exe
  C:\Windows\System\spAqVWC.exe
  2⤵
  PID:7928
- C:\Windows\System\YnEQXXX.exe
  C:\Windows\System\YnEQXXX.exe
  2⤵
  PID:8160
- C:\Windows\System\fiDiRLn.exe
  C:\Windows\System\fiDiRLn.exe
  2⤵
  PID:6448
- C:\Windows\System\FiZxrji.exe
  C:\Windows\System\FiZxrji.exe
  2⤵
  PID:8132
- C:\Windows\System\iiWsQxb.exe
  C:\Windows\System\iiWsQxb.exe
  2⤵
  PID:10340
- C:\Windows\System\ZYqQefR.exe
  C:\Windows\System\ZYqQefR.exe
  2⤵
  PID:10424
- C:\Windows\System\Elimopn.exe
  C:\Windows\System\Elimopn.exe
  2⤵
  PID:10528
- C:\Windows\System\heaqhMU.exe
  C:\Windows\System\heaqhMU.exe
  2⤵
  PID:10700
- C:\Windows\System\ZxfayoU.exe
  C:\Windows\System\ZxfayoU.exe
  2⤵
  PID:10792
- C:\Windows\System\EyUeDqz.exe
  C:\Windows\System\EyUeDqz.exe
  2⤵
  PID:10856
- C:\Windows\System\qATHYoD.exe
  C:\Windows\System\qATHYoD.exe
  2⤵
  PID:10896
- C:\Windows\System\BoiOFMA.exe
  C:\Windows\System\BoiOFMA.exe
  2⤵
  PID:10960
- C:\Windows\System\dBlrQSk.exe
  C:\Windows\System\dBlrQSk.exe
  2⤵
  PID:11012
- C:\Windows\System\qgnBJWf.exe
  C:\Windows\System\qgnBJWf.exe
  2⤵
  PID:11048
- C:\Windows\System\uqUkqFK.exe
  C:\Windows\System\uqUkqFK.exe
  2⤵
  PID:11232
- C:\Windows\System\fJVIANY.exe
  C:\Windows\System\fJVIANY.exe
  2⤵
  PID:12200
- C:\Windows\System\YgBfavH.exe
  C:\Windows\System\YgBfavH.exe
  2⤵
  PID:12256
- C:\Windows\System\gJuYeRu.exe
  C:\Windows\System\gJuYeRu.exe
  2⤵
  PID:10264
- C:\Windows\System\SoxdhPr.exe
  C:\Windows\System\SoxdhPr.exe
  2⤵
  PID:10596
- C:\Windows\System\jLGoEtT.exe
  C:\Windows\System\jLGoEtT.exe
  2⤵
  PID:11292
- C:\Windows\System\gXYcWkf.exe
  C:\Windows\System\gXYcWkf.exe
  2⤵
  PID:11312
- C:\Windows\System\AkVOqgk.exe
  C:\Windows\System\AkVOqgk.exe
  2⤵
  PID:11376
- C:\Windows\System\LKPPEpe.exe
  C:\Windows\System\LKPPEpe.exe
  2⤵
  PID:11400
- C:\Windows\System\GDsplHY.exe
  C:\Windows\System\GDsplHY.exe
  2⤵
  PID:11444
- C:\Windows\System\UUtNRId.exe
  C:\Windows\System\UUtNRId.exe
  2⤵
  PID:11484
- C:\Windows\System\CYEmqWu.exe
  C:\Windows\System\CYEmqWu.exe
  2⤵
  PID:11516
- C:\Windows\System\GEXuxoW.exe
  C:\Windows\System\GEXuxoW.exe
  2⤵
  PID:11564
- C:\Windows\System\lQOfKzj.exe
  C:\Windows\System\lQOfKzj.exe
  2⤵
  PID:11596
- C:\Windows\System\MBNJQdf.exe
  C:\Windows\System\MBNJQdf.exe
  2⤵
  PID:11624
- C:\Windows\System\RtUsDac.exe
  C:\Windows\System\RtUsDac.exe
  2⤵
  PID:11672
- C:\Windows\System\kETuilX.exe
  C:\Windows\System\kETuilX.exe
  2⤵
  PID:11732
- C:\Windows\System\OuDaOUO.exe
  C:\Windows\System\OuDaOUO.exe
  2⤵
  PID:11784
- C:\Windows\System\GJTsGlX.exe
  C:\Windows\System\GJTsGlX.exe
  2⤵
  PID:11848
- C:\Windows\System\fNtYfnw.exe
  C:\Windows\System\fNtYfnw.exe
  2⤵
  PID:11884
- C:\Windows\System\FaqoAMD.exe
  C:\Windows\System\FaqoAMD.exe
  2⤵
  PID:11940
- C:\Windows\System\pQzwEcr.exe
  C:\Windows\System\pQzwEcr.exe
  2⤵
  PID:11272
- C:\Windows\System\OuLOjsv.exe
  C:\Windows\System\OuLOjsv.exe
  2⤵
  PID:9936
- C:\Windows\System\RQDzrjD.exe
  C:\Windows\System\RQDzrjD.exe
  2⤵
  PID:6488
- C:\Windows\System\HuKUjFC.exe
  C:\Windows\System\HuKUjFC.exe
  2⤵
  PID:7524
- C:\Windows\System\LJAQlRM.exe
  C:\Windows\System\LJAQlRM.exe
  2⤵
  PID:9524
- C:\Windows\System\kQEaisK.exe
  C:\Windows\System\kQEaisK.exe
  2⤵
  PID:5744
- C:\Windows\System\RcOYYif.exe
  C:\Windows\System\RcOYYif.exe
  2⤵
  PID:11112
- C:\Windows\System\NyFwAlF.exe
  C:\Windows\System\NyFwAlF.exe
  2⤵
  PID:11296
- C:\Windows\System\rFGpYcx.exe
  C:\Windows\System\rFGpYcx.exe
  2⤵
  PID:9180
- C:\Windows\System\LpnFbAv.exe
  C:\Windows\System\LpnFbAv.exe
  2⤵
  PID:10468
- C:\Windows\System\zCiNZiP.exe
  C:\Windows\System\zCiNZiP.exe
  2⤵
  PID:7924
- C:\Windows\System\bqRhIQX.exe
  C:\Windows\System\bqRhIQX.exe
  2⤵
  PID:10984
- C:\Windows\System\rSMZQiR.exe
  C:\Windows\System\rSMZQiR.exe
  2⤵
  PID:12088
- C:\Windows\System\qLGckxg.exe
  C:\Windows\System\qLGckxg.exe
  2⤵
  PID:10324
- C:\Windows\System\CkEKJnD.exe
  C:\Windows\System\CkEKJnD.exe
  2⤵
  PID:8284
- C:\Windows\System\jqAwCBV.exe
  C:\Windows\System\jqAwCBV.exe
  2⤵
  PID:2292
- C:\Windows\System\FteJElc.exe
  C:\Windows\System\FteJElc.exe
  2⤵
  PID:10920
- C:\Windows\System\BChIcPw.exe
  C:\Windows\System\BChIcPw.exe
  2⤵
  PID:9288
- C:\Windows\System\bciraJt.exe
  C:\Windows\System\bciraJt.exe
  2⤵
  PID:12116
- C:\Windows\System\whmMMUI.exe
  C:\Windows\System\whmMMUI.exe
  2⤵
  PID:11560
- C:\Windows\System\ymJvVzW.exe
  C:\Windows\System\ymJvVzW.exe
  2⤵
  PID:12460
- C:\Windows\System\BVTOArc.exe
  C:\Windows\System\BVTOArc.exe
  2⤵
  PID:12760
- C:\Windows\System\yhdfpzr.exe
  C:\Windows\System\yhdfpzr.exe
  2⤵
  PID:12780
- C:\Windows\System\GQMtEoo.exe
  C:\Windows\System\GQMtEoo.exe
  2⤵
  PID:12864
- C:\Windows\System\patqnlo.exe
  C:\Windows\System\patqnlo.exe
  2⤵
  PID:13212
- C:\Windows\System\mBTuTjW.exe
  C:\Windows\System\mBTuTjW.exe
  2⤵
  PID:10872
- C:\Windows\System\YEhRxTO.exe
  C:\Windows\System\YEhRxTO.exe
  2⤵
  PID:4248
- C:\Windows\System\xtvrNxD.exe
  C:\Windows\System\xtvrNxD.exe
  2⤵
  PID:2096
- C:\Windows\System\riprWwT.exe
  C:\Windows\System\riprWwT.exe
  2⤵
  PID:9968
- C:\Windows\System\AvIUcSR.exe
  C:\Windows\System\AvIUcSR.exe
  2⤵
  PID:10816
- C:\Windows\System\PDttFIX.exe
  C:\Windows\System\PDttFIX.exe
  2⤵
  PID:12316
- C:\Windows\System\yWOzfZJ.exe
  C:\Windows\System\yWOzfZJ.exe
  2⤵
  PID:12348
- C:\Windows\System\lOrKFiV.exe
  C:\Windows\System\lOrKFiV.exe
  2⤵
  PID:11500
- C:\Windows\System\pbJdqww.exe
  C:\Windows\System\pbJdqww.exe
  2⤵
  PID:12224
- C:\Windows\System\xlWntaD.exe
  C:\Windows\System\xlWntaD.exe
  2⤵
  PID:11144
- C:\Windows\System\XqgiJtT.exe
  C:\Windows\System\XqgiJtT.exe
  2⤵
  PID:12468
- C:\Windows\System\QlytZwr.exe
  C:\Windows\System\QlytZwr.exe
  2⤵
  PID:12320
- C:\Windows\System\jbvXomJ.exe
  C:\Windows\System\jbvXomJ.exe
  2⤵
  PID:12524
- C:\Windows\System\ollqqvq.exe
  C:\Windows\System\ollqqvq.exe
  2⤵
  PID:12676
- C:\Windows\System\uzKAelk.exe
  C:\Windows\System\uzKAelk.exe
  2⤵
  PID:12720
- C:\Windows\System\dTmDsUQ.exe
  C:\Windows\System\dTmDsUQ.exe
  2⤵
  PID:12744
- C:\Windows\System\ZEIFWzm.exe
  C:\Windows\System\ZEIFWzm.exe
  2⤵
  PID:12792
- C:\Windows\System\jWwjodK.exe
  C:\Windows\System\jWwjodK.exe
  2⤵
  PID:12824
- C:\Windows\System\wrYtOmZ.exe
  C:\Windows\System\wrYtOmZ.exe
  2⤵
  PID:12876
- C:\Windows\System\VxsHlCh.exe
  C:\Windows\System\VxsHlCh.exe
  2⤵
  PID:12936
- C:\Windows\System\dStPuEw.exe
  C:\Windows\System\dStPuEw.exe
  2⤵
  PID:12380
- C:\Windows\System\MVfGCvo.exe
  C:\Windows\System\MVfGCvo.exe
  2⤵
  PID:12668
- C:\Windows\System\sxcKZAY.exe
  C:\Windows\System\sxcKZAY.exe
  2⤵
  PID:12708
- C:\Windows\System\vLBkAbl.exe
  C:\Windows\System\vLBkAbl.exe
  2⤵
  PID:12592
- C:\Windows\System\Zxousqf.exe
  C:\Windows\System\Zxousqf.exe
  2⤵
  PID:12828
- C:\Windows\System\viEpcXW.exe
  C:\Windows\System\viEpcXW.exe
  2⤵
  PID:12892
- C:\Windows\System\IJmqllO.exe
  C:\Windows\System\IJmqllO.exe
  2⤵
  PID:12924
- C:\Windows\System\MhRndgk.exe
  C:\Windows\System\MhRndgk.exe
  2⤵
  PID:12972
- C:\Windows\System\pEOuSjX.exe
  C:\Windows\System\pEOuSjX.exe
  2⤵
  PID:13016
- C:\Windows\System\MPMbhZg.exe
  C:\Windows\System\MPMbhZg.exe
  2⤵
  PID:13260
- C:\Windows\System\dkzOTcu.exe
  C:\Windows\System\dkzOTcu.exe
  2⤵
  PID:13292
- C:\Windows\System\tYTuXDf.exe
  C:\Windows\System\tYTuXDf.exe
  2⤵
  PID:11688
- C:\Windows\System\OoWEqbx.exe
  C:\Windows\System\OoWEqbx.exe
  2⤵
  PID:13152
- C:\Windows\System\hBLQdDr.exe
  C:\Windows\System\hBLQdDr.exe
  2⤵
  PID:13192
- C:\Windows\System\pPbsdFb.exe
  C:\Windows\System\pPbsdFb.exe
  2⤵
  PID:13236
- C:\Windows\System\DKLBzxd.exe
  C:\Windows\System\DKLBzxd.exe
  2⤵
  PID:12344
- C:\Windows\System\QjlZPip.exe
  C:\Windows\System\QjlZPip.exe
  2⤵
  PID:12308
- C:\Windows\System\YGjPMkp.exe
  C:\Windows\System\YGjPMkp.exe
  2⤵
  PID:12432
- C:\Windows\System\skcKmcv.exe
  C:\Windows\System\skcKmcv.exe
  2⤵
  PID:12352
- C:\Windows\System\zKbivMy.exe
  C:\Windows\System\zKbivMy.exe
  2⤵
  PID:12736
- C:\Windows\System\rSmPSGH.exe
  C:\Windows\System\rSmPSGH.exe
  2⤵
  PID:12776
- C:\Windows\System\FQZmeSv.exe
  C:\Windows\System\FQZmeSv.exe
  2⤵
  PID:12852
- C:\Windows\System\nYuSRxJ.exe
  C:\Windows\System\nYuSRxJ.exe
  2⤵
  PID:12932
- C:\Windows\System\SBlaqIJ.exe
  C:\Windows\System\SBlaqIJ.exe
  2⤵
  PID:12788
- C:\Windows\System\vceBgVT.exe
  C:\Windows\System\vceBgVT.exe
  2⤵
  PID:12568
- C:\Windows\System\uUZhGJP.exe
  C:\Windows\System\uUZhGJP.exe
  2⤵
  PID:13036
- C:\Windows\System\XNneNDA.exe
  C:\Windows\System\XNneNDA.exe
  2⤵
  PID:12572
- C:\Windows\System\HOsCtJH.exe
  C:\Windows\System\HOsCtJH.exe
  2⤵
  PID:12804
- C:\Windows\System\GmMnFFg.exe
  C:\Windows\System\GmMnFFg.exe
  2⤵
  PID:13084
- C:\Windows\System\ZpfzMEN.exe
  C:\Windows\System\ZpfzMEN.exe
  2⤵
  PID:12416
- C:\Windows\System\AWpIFBf.exe
  C:\Windows\System\AWpIFBf.exe
  2⤵
  PID:13112
- C:\Windows\System\uCeNyzx.exe
  C:\Windows\System\uCeNyzx.exe
  2⤵
  PID:3224
- C:\Windows\System\szfsDnD.exe
  C:\Windows\System\szfsDnD.exe
  2⤵
  PID:2044
- C:\Windows\System\xAmKddd.exe
  C:\Windows\System\xAmKddd.exe
  2⤵
  PID:13268
- C:\Windows\System\vaDHRZQ.exe
  C:\Windows\System\vaDHRZQ.exe
  2⤵
  PID:12608
- C:\Windows\System\WJTyeoB.exe
  C:\Windows\System\WJTyeoB.exe
  2⤵
  PID:1436
- C:\Windows\System\gQIcglm.exe
  C:\Windows\System\gQIcglm.exe
  2⤵
  PID:10764
- C:\Windows\System\OpIkDqk.exe
  C:\Windows\System\OpIkDqk.exe
  2⤵
  PID:1536
- C:\Windows\System\wmdCwnv.exe
  C:\Windows\System\wmdCwnv.exe
  2⤵
  PID:1096
- C:\Windows\System\IJpTzRf.exe
  C:\Windows\System\IJpTzRf.exe
  2⤵
  PID:2116
- C:\Windows\System\rrehUQq.exe
  C:\Windows\System\rrehUQq.exe
  2⤵
  PID:10604
- C:\Windows\System\bMyEEWU.exe
  C:\Windows\System\bMyEEWU.exe
  2⤵
  PID:12620
- C:\Windows\System\WLrelZG.exe
  C:\Windows\System\WLrelZG.exe
  2⤵
  PID:11536
- C:\Windows\System\zKeYPtX.exe
  C:\Windows\System\zKeYPtX.exe
  2⤵
  PID:332
- C:\Windows\System\CRDKfKl.exe
  C:\Windows\System\CRDKfKl.exe
  2⤵
  PID:12904
- C:\Windows\System\TnFjxWu.exe
  C:\Windows\System\TnFjxWu.exe
  2⤵
  PID:2872
- C:\Windows\System\eFlGQEg.exe
  C:\Windows\System\eFlGQEg.exe
  2⤵
  PID:12588
- C:\Windows\System\tOnwxBK.exe
  C:\Windows\System\tOnwxBK.exe
  2⤵
  PID:13024
- C:\Windows\System\dPXMcAm.exe
  C:\Windows\System\dPXMcAm.exe
  2⤵
  PID:10496
- C:\Windows\System\yVnQvxl.exe
  C:\Windows\System\yVnQvxl.exe
  2⤵
  PID:13332
- C:\Windows\System\iyFvrUR.exe
  C:\Windows\System\iyFvrUR.exe
  2⤵
  PID:13356
- C:\Windows\System\IvkcRyC.exe
  C:\Windows\System\IvkcRyC.exe
  2⤵
  PID:13476
- C:\Windows\System\EDtMjtF.exe
  C:\Windows\System\EDtMjtF.exe
  2⤵
  PID:13516
- C:\Windows\System\mXdveMY.exe
  C:\Windows\System\mXdveMY.exe
  2⤵
  PID:13540
- C:\Windows\System\ZGHjFxh.exe
  C:\Windows\System\ZGHjFxh.exe
  2⤵
  PID:13572
- C:\Windows\System\smfmuUg.exe
  C:\Windows\System\smfmuUg.exe
  2⤵
  PID:13656
- C:\Windows\System\uEizWVH.exe
  C:\Windows\System\uEizWVH.exe
  2⤵
  PID:13684
- C:\Windows\System\sSEAZep.exe
  C:\Windows\System\sSEAZep.exe
  2⤵
  PID:13704
- C:\Windows\System\sEfqYjp.exe
  C:\Windows\System\sEfqYjp.exe
  2⤵
  PID:13728
- C:\Windows\System\JrIsJem.exe
  C:\Windows\System\JrIsJem.exe
  2⤵
  PID:13748
- C:\Windows\System\oVIXrMU.exe
  C:\Windows\System\oVIXrMU.exe
  2⤵
  PID:13768
- C:\Windows\System\CDuvGQL.exe
  C:\Windows\System\CDuvGQL.exe
  2⤵
  PID:13784
- C:\Windows\System\XTOSohY.exe
  C:\Windows\System\XTOSohY.exe
  2⤵
  PID:13800
- C:\Windows\System\ruQtWNt.exe
  C:\Windows\System\ruQtWNt.exe
  2⤵
  PID:13856
- C:\Windows\System\ASiAkhI.exe
  C:\Windows\System\ASiAkhI.exe
  2⤵
  PID:13876
- C:\Windows\System\uqnxqXD.exe
  C:\Windows\System\uqnxqXD.exe
  2⤵
  PID:14028
- C:\Windows\System\sKSFxNS.exe
  C:\Windows\System\sKSFxNS.exe
  2⤵
  PID:14052
- C:\Windows\System\peUFmhN.exe
  C:\Windows\System\peUFmhN.exe
  2⤵
  PID:14068
- C:\Windows\System\YOfygsZ.exe
  C:\Windows\System\YOfygsZ.exe
  2⤵
  PID:14088
- C:\Windows\System\ffEnLte.exe
  C:\Windows\System\ffEnLte.exe
  2⤵
  PID:14112
- C:\Windows\System\QKmeFfo.exe
  C:\Windows\System\QKmeFfo.exe
  2⤵
  PID:14128
- C:\Windows\System\BTWntGB.exe
  C:\Windows\System\BTWntGB.exe
  2⤵
  PID:14152
- C:\Windows\System\evxrAen.exe
  C:\Windows\System\evxrAen.exe
  2⤵
  PID:14172
- C:\Windows\System\YaMwhSE.exe
  C:\Windows\System\YaMwhSE.exe
  2⤵
  PID:14192
- C:\Windows\System\BkIgtqC.exe
  C:\Windows\System\BkIgtqC.exe
  2⤵
  PID:14212
- C:\Windows\System\mUzUXki.exe
  C:\Windows\System\mUzUXki.exe
  2⤵
  PID:14252
- C:\Windows\System\OUpwpIo.exe
  C:\Windows\System\OUpwpIo.exe
  2⤵
  PID:14272
- C:\Windows\System\istNMOC.exe
  C:\Windows\System\istNMOC.exe
  2⤵
  PID:14296
- C:\Windows\System\TtCkVmS.exe
  C:\Windows\System\TtCkVmS.exe
  2⤵
  PID:14312
- C:\Windows\System\ySPnQuz.exe
  C:\Windows\System\ySPnQuz.exe
  2⤵
  PID:14332
- C:\Windows\System\hcsAIqP.exe
  C:\Windows\System\hcsAIqP.exe
  2⤵
  PID:4312
- C:\Windows\System\NUoqRqs.exe
  C:\Windows\System\NUoqRqs.exe
  2⤵
  PID:1800
- C:\Windows\System\DZXiaFM.exe
  C:\Windows\System\DZXiaFM.exe
  2⤵
  PID:4460
- C:\Windows\System\jpJpBrU.exe
  C:\Windows\System\jpJpBrU.exe
  2⤵
  PID:12940
- C:\Windows\System\GRPHAuS.exe
  C:\Windows\System\GRPHAuS.exe
  2⤵
  PID:11644
- C:\Windows\System\enPnELl.exe
  C:\Windows\System\enPnELl.exe
  2⤵
  PID:4932
- C:\Windows\System\SDwAErr.exe
  C:\Windows\System\SDwAErr.exe
  2⤵
  PID:13404
- C:\Windows\System\ZkhUKWU.exe
  C:\Windows\System\ZkhUKWU.exe
  2⤵
  PID:13792
- C:\Windows\System\CoXiVeY.exe
  C:\Windows\System\CoXiVeY.exe
  2⤵
  PID:13844
- C:\Windows\System\lSJhYOS.exe
  C:\Windows\System\lSJhYOS.exe
  2⤵
  PID:13980
- C:\Windows\System\rDGDjWJ.exe
  C:\Windows\System\rDGDjWJ.exe
  2⤵
  PID:3192
- C:\Windows\System\ZOrutBs.exe
  C:\Windows\System\ZOrutBs.exe
  2⤵
  PID:13884
- C:\Windows\System\ZRjggcv.exe
  C:\Windows\System\ZRjggcv.exe
  2⤵
  PID:13368
- C:\Windows\System\rWKTyQJ.exe
  C:\Windows\System\rWKTyQJ.exe
  2⤵
  PID:4744
- C:\Windows\System\xcJkedL.exe
  C:\Windows\System\xcJkedL.exe
  2⤵
  PID:404
- C:\Windows\System\huZiCmr.exe
  C:\Windows\System\huZiCmr.exe
  2⤵
  PID:13524
- C:\Windows\System\JigZfDi.exe
  C:\Windows\System\JigZfDi.exe
  2⤵
  PID:13668
- C:\Windows\System\nemnKim.exe
  C:\Windows\System\nemnKim.exe
  2⤵
  PID:12520
- C:\Windows\System\GiAtgxb.exe
  C:\Windows\System\GiAtgxb.exe
  2⤵
  PID:14280
- C:\Windows\System\vGEPzhv.exe
  C:\Windows\System\vGEPzhv.exe
  2⤵
  PID:10448
- C:\Windows\System\LoZOIDr.exe
  C:\Windows\System\LoZOIDr.exe
  2⤵
  PID:14136
- C:\Windows\System\WqHorVu.exe
  C:\Windows\System\WqHorVu.exe
  2⤵
  PID:14000
- C:\Windows\System\tkkWQtd.exe
  C:\Windows\System\tkkWQtd.exe
  2⤵
  PID:13820
- C:\Windows\System\SUbcvoh.exe
  C:\Windows\System\SUbcvoh.exe
  2⤵
  PID:5368
- C:\Windows\System\whVtFqu.exe
  C:\Windows\System\whVtFqu.exe
  2⤵
  PID:4568
- C:\Windows\System\sPUWffH.exe
  C:\Windows\System\sPUWffH.exe
  2⤵
  PID:13824
- C:\Windows\System\TUBrBMB.exe
  C:\Windows\System\TUBrBMB.exe
  2⤵
  PID:13608
- C:\Windows\System\SJmoDCm.exe
  C:\Windows\System\SJmoDCm.exe
  2⤵
  PID:13448
- C:\Windows\System\RPFwZKu.exe
  C:\Windows\System\RPFwZKu.exe
  2⤵
  PID:14004
- C:\Windows\System\XDzDrla.exe
  C:\Windows\System\XDzDrla.exe
  2⤵
  PID:13624
- C:\Windows\System\kMZiYRi.exe
  C:\Windows\System\kMZiYRi.exe
  2⤵
  PID:13552
- C:\Windows\System\MRUSVER.exe
  C:\Windows\System\MRUSVER.exe
  2⤵
  PID:8456
- C:\Windows\System\gnIFuEn.exe
  C:\Windows\System\gnIFuEn.exe
  2⤵
  PID:9312
- C:\Windows\System\IWiVIcn.exe
  C:\Windows\System\IWiVIcn.exe
  2⤵
  PID:5740
- C:\Windows\System\lJUUIed.exe
  C:\Windows\System\lJUUIed.exe
  2⤵
  PID:13512
- C:\Windows\System\yvQbxAg.exe
  C:\Windows\System\yvQbxAg.exe
  2⤵
  PID:6828
- C:\Windows\System\WXWCIlC.exe
  C:\Windows\System\WXWCIlC.exe
  2⤵
  PID:13692
- C:\Windows\System\LWONPbu.exe
  C:\Windows\System\LWONPbu.exe
  2⤵
  PID:5132
- C:\Windows\System\MZmkwno.exe
  C:\Windows\System\MZmkwno.exe
  2⤵
  PID:2468
- C:\Windows\System\JDllfJv.exe
  C:\Windows\System\JDllfJv.exe
  2⤵
  PID:13832
- C:\Windows\System\hhzVjal.exe
  C:\Windows\System\hhzVjal.exe
  2⤵
  PID:14024
- C:\Windows\System\CbhKYny.exe
  C:\Windows\System\CbhKYny.exe
  2⤵
  PID:14204
- C:\Windows\System\iWpoZjX.exe
  C:\Windows\System\iWpoZjX.exe
  2⤵
  PID:5476
- C:\Windows\System\UpQKFPS.exe
  C:\Windows\System\UpQKFPS.exe
  2⤵
  PID:5432
- C:\Windows\System\vfDKEmu.exe
  C:\Windows\System\vfDKEmu.exe
  2⤵
  PID:6252
- C:\Windows\System\CMequxG.exe
  C:\Windows\System\CMequxG.exe
  2⤵
  PID:5564
- C:\Windows\System\mFUQyCq.exe
  C:\Windows\System\mFUQyCq.exe
  2⤵
  PID:7144
- C:\Windows\System\hNkITYa.exe
  C:\Windows\System\hNkITYa.exe
  2⤵
  PID:7308
- C:\Windows\System\YRQjpOH.exe
  C:\Windows\System\YRQjpOH.exe
  2⤵
  PID:7400
- C:\Windows\System\jqaRzFi.exe
  C:\Windows\System\jqaRzFi.exe
  2⤵
  PID:6784
- C:\Windows\System\deSCbcX.exe
  C:\Windows\System\deSCbcX.exe
  2⤵
  PID:6516
- C:\Windows\System\IBwVtFv.exe
  C:\Windows\System\IBwVtFv.exe
  2⤵
  PID:5936
- C:\Windows\System\pjMVmpH.exe
  C:\Windows\System\pjMVmpH.exe
  2⤵
  PID:7508
- C:\Windows\System\dCZQkNH.exe
  C:\Windows\System\dCZQkNH.exe
  2⤵
  PID:7672
- C:\Windows\System\EvmZWNC.exe
  C:\Windows\System\EvmZWNC.exe
  2⤵
  PID:8592
- C:\Windows\System\MaSNWZq.exe
  C:\Windows\System\MaSNWZq.exe
  2⤵
  PID:7832
- C:\Windows\System\flGizVi.exe
  C:\Windows\System\flGizVi.exe
  2⤵
  PID:8392
- C:\Windows\System\KspxIef.exe
  C:\Windows\System\KspxIef.exe
  2⤵
  PID:8652
- C:\Windows\System\zFDEdog.exe
  C:\Windows\System\zFDEdog.exe
  2⤵
  PID:7568
- C:\Windows\System\MvyeHrI.exe
  C:\Windows\System\MvyeHrI.exe
  2⤵
  PID:7504
- C:\Windows\System\FJjWlcp.exe
  C:\Windows\System\FJjWlcp.exe
  2⤵
  PID:11616
- C:\Windows\System\wjBhaQc.exe
  C:\Windows\System\wjBhaQc.exe
  2⤵
  PID:8372
- C:\Windows\System\ldpsRhc.exe
  C:\Windows\System\ldpsRhc.exe
  2⤵
  PID:7284
- C:\Windows\System\LmtzvXz.exe
  C:\Windows\System\LmtzvXz.exe
  2⤵
  PID:8628
- C:\Windows\System\gbbdjkS.exe
  C:\Windows\System\gbbdjkS.exe
  2⤵
  PID:6736
- C:\Windows\System\kuUZcEl.exe
  C:\Windows\System\kuUZcEl.exe
  2⤵
  PID:6680
- C:\Windows\System\cZyVnns.exe
  C:\Windows\System\cZyVnns.exe
  2⤵
  PID:7592
- C:\Windows\System\KiUAkwH.exe
  C:\Windows\System\KiUAkwH.exe
  2⤵
  PID:1272
- C:\Windows\System\rIhIheT.exe
  C:\Windows\System\rIhIheT.exe
  2⤵
  PID:7356
- C:\Windows\System\ohNKPVB.exe
  C:\Windows\System\ohNKPVB.exe
  2⤵
  PID:14268
- C:\Windows\System\BSqSMCX.exe
  C:\Windows\System\BSqSMCX.exe
  2⤵
  PID:8384
- C:\Windows\System\YWVSbqS.exe
  C:\Windows\System\YWVSbqS.exe
  2⤵
  PID:5984
- C:\Windows\System\pQnmXoi.exe
  C:\Windows\System\pQnmXoi.exe
  2⤵
  PID:14080
- C:\Windows\System\JjvUcIq.exe
  C:\Windows\System\JjvUcIq.exe
  2⤵
  PID:7828
- C:\Windows\System\IOygAer.exe
  C:\Windows\System\IOygAer.exe
  2⤵
  PID:6556
- C:\Windows\System\glOsNzO.exe
  C:\Windows\System\glOsNzO.exe
  2⤵
  PID:13560
- C:\Windows\System\BrzFpMd.exe
  C:\Windows\System\BrzFpMd.exe
  2⤵
  PID:7632
- C:\Windows\System\ZBShRCO.exe
  C:\Windows\System\ZBShRCO.exe
  2⤵
  PID:7716
- C:\Windows\System\qbTgRkD.exe
  C:\Windows\System\qbTgRkD.exe
  2⤵
  PID:7120
- C:\Windows\System\bFGjJqh.exe
  C:\Windows\System\bFGjJqh.exe
  2⤵
  PID:13952
- C:\Windows\System\iopvCKx.exe
  C:\Windows\System\iopvCKx.exe
  2⤵
  PID:7788
- C:\Windows\System\XSeHiWo.exe
  C:\Windows\System\XSeHiWo.exe
  2⤵
  PID:8504
- C:\Windows\System\cwIUQgU.exe
  C:\Windows\System\cwIUQgU.exe
  2⤵
  PID:8676
- C:\Windows\System\lFKrbiH.exe
  C:\Windows\System\lFKrbiH.exe
  2⤵
  PID:8496
- C:\Windows\System\WRnRhot.exe
  C:\Windows\System\WRnRhot.exe
  2⤵
  PID:8484
- C:\Windows\System\ZxTRRuK.exe
  C:\Windows\System\ZxTRRuK.exe
  2⤵
  PID:9144
- C:\Windows\System\uLpxczR.exe
  C:\Windows\System\uLpxczR.exe
  2⤵
  PID:7536
- C:\Windows\System\GqpaCMN.exe
  C:\Windows\System\GqpaCMN.exe
  2⤵
  PID:5716
- C:\Windows\System\ajBPwVE.exe
  C:\Windows\System\ajBPwVE.exe
  2⤵
  PID:5308
- C:\Windows\System\yhkzvcM.exe
  C:\Windows\System\yhkzvcM.exe
  2⤵
  PID:8300
- C:\Windows\System\GPxyFVf.exe
  C:\Windows\System\GPxyFVf.exe
  2⤵
  PID:8744
- C:\Windows\System\FKOCeCP.exe
  C:\Windows\System\FKOCeCP.exe
  2⤵
  PID:8664
- C:\Windows\System\qYqsbMz.exe
  C:\Windows\System\qYqsbMz.exe
  2⤵
  PID:8712
- C:\Windows\System\jnPBWNh.exe
  C:\Windows\System\jnPBWNh.exe
  2⤵
  PID:13588
- C:\Windows\System\ybitZGC.exe
  C:\Windows\System\ybitZGC.exe
  2⤵
  PID:8600
- C:\Windows\System\pgXFNUk.exe
  C:\Windows\System\pgXFNUk.exe
  2⤵
  PID:8404
- C:\Windows\System\MIsWbLo.exe
  C:\Windows\System\MIsWbLo.exe
  2⤵
  PID:7704
- C:\Windows\System\RjlkqrL.exe
  C:\Windows\System\RjlkqrL.exe
  2⤵
  PID:5500
- C:\Windows\System\XhZSlKR.exe
  C:\Windows\System\XhZSlKR.exe
  2⤵
  PID:5464
- C:\Windows\System\cvOUICp.exe
  C:\Windows\System\cvOUICp.exe
  2⤵
  PID:13536
- C:\Windows\System\melKfxm.exe
  C:\Windows\System\melKfxm.exe
  2⤵
  PID:5548
- C:\Windows\System\AXbQQWY.exe
  C:\Windows\System\AXbQQWY.exe
  2⤵
  PID:8920
- C:\Windows\System\hZiWUiI.exe
  C:\Windows\System\hZiWUiI.exe
  2⤵
  PID:5924
- C:\Windows\System\fhgphfR.exe
  C:\Windows\System\fhgphfR.exe
  2⤵
  PID:13616
- C:\Windows\System\CPCCIGg.exe
  C:\Windows\System\CPCCIGg.exe
  2⤵
  PID:5428
- C:\Windows\System\zbQhRij.exe
  C:\Windows\System\zbQhRij.exe
  2⤵
  PID:7724
- C:\Windows\System\vvwBBna.exe
  C:\Windows\System\vvwBBna.exe
  2⤵
  PID:8144
- C:\Windows\System\OiyHZjE.exe
  C:\Windows\System\OiyHZjE.exe
  2⤵
  PID:7176
- C:\Windows\System\tmOOEpD.exe
  C:\Windows\System\tmOOEpD.exe
  2⤵
  PID:5392
- C:\Windows\System\pFbOUrN.exe
  C:\Windows\System\pFbOUrN.exe
  2⤵
  PID:8536
- C:\Windows\System\ebqtuct.exe
  C:\Windows\System\ebqtuct.exe
  2⤵
  PID:7708
- C:\Windows\System\HZmiSND.exe
  C:\Windows\System\HZmiSND.exe
  2⤵
  PID:8716
- C:\Windows\System\VIOqxUC.exe
  C:\Windows\System\VIOqxUC.exe
  2⤵
  PID:7224
- C:\Windows\System\SKNAgzH.exe
  C:\Windows\System\SKNAgzH.exe
  2⤵
  PID:8640
- C:\Windows\System\vRLSgBo.exe
  C:\Windows\System\vRLSgBo.exe
  2⤵
  PID:7744
- C:\Windows\System\fBmRpwi.exe
  C:\Windows\System\fBmRpwi.exe
  2⤵
  PID:5180
- C:\Windows\System\LaaczEy.exe
  C:\Windows\System\LaaczEy.exe
  2⤵
  PID:9060
- C:\Windows\System\lcnxkMW.exe
  C:\Windows\System\lcnxkMW.exe
  2⤵
  PID:14292
- C:\Windows\System\YnzojBU.exe
  C:\Windows\System\YnzojBU.exe
  2⤵
  PID:13464
- C:\Windows\System\IusOAHr.exe
  C:\Windows\System\IusOAHr.exe
  2⤵
  PID:6484
- C:\Windows\System\SYSfyuy.exe
  C:\Windows\System\SYSfyuy.exe
  2⤵
  PID:6216
- C:\Windows\System\aafUfOz.exe
  C:\Windows\System\aafUfOz.exe
  2⤵
  PID:8968
- C:\Windows\System\cbFWyyM.exe
  C:\Windows\System\cbFWyyM.exe
  2⤵
  PID:5876
- C:\Windows\System\PBvzovK.exe
  C:\Windows\System\PBvzovK.exe
  2⤵
  PID:8360
- C:\Windows\System\YUPuUfV.exe
  C:\Windows\System\YUPuUfV.exe
  2⤵
  PID:4952
- C:\Windows\System\ekFJgnI.exe
  C:\Windows\System\ekFJgnI.exe
  2⤵
  PID:6644
- C:\Windows\System\UgWtOjE.exe
  C:\Windows\System\UgWtOjE.exe
  2⤵
  PID:6420
- C:\Windows\System\pBPcFsX.exe
  C:\Windows\System\pBPcFsX.exe
  2⤵
  PID:8516
- C:\Windows\System\DuLzUiu.exe
  C:\Windows\System\DuLzUiu.exe
  2⤵
  PID:644
- C:\Windows\System\MqEwnDp.exe
  C:\Windows\System\MqEwnDp.exe
  2⤵
  PID:7616
- C:\Windows\System\dXWvpcO.exe
  C:\Windows\System\dXWvpcO.exe
  2⤵
  PID:5440
- C:\Windows\System\hZLpqeV.exe
  C:\Windows\System\hZLpqeV.exe
  2⤵
  PID:7360
- C:\Windows\System\yFsqSTR.exe
  C:\Windows\System\yFsqSTR.exe
  2⤵
  PID:7328
- C:\Windows\System\IgfQFSb.exe
  C:\Windows\System\IgfQFSb.exe
  2⤵
  PID:7080
- C:\Windows\System\umSDpdZ.exe
  C:\Windows\System\umSDpdZ.exe
  2⤵
  PID:7864
- C:\Windows\System\wCyhHfV.exe
  C:\Windows\System\wCyhHfV.exe
  2⤵
  PID:8508
- C:\Windows\System\PYyLfag.exe
  C:\Windows\System\PYyLfag.exe
  2⤵
  PID:9400
- C:\Windows\System\KufXfGN.exe
  C:\Windows\System\KufXfGN.exe
  2⤵
  PID:8428
- C:\Windows\System\LeGTNRR.exe
  C:\Windows\System\LeGTNRR.exe
  2⤵
  PID:8188
- C:\Windows\System\GYUKzZe.exe
  C:\Windows\System\GYUKzZe.exe
  2⤵
  PID:8980
- C:\Windows\System\hgVBYFP.exe
  C:\Windows\System\hgVBYFP.exe
  2⤵
  PID:5456
- C:\Windows\System\DcnnqTx.exe
  C:\Windows\System\DcnnqTx.exe
  2⤵
  PID:8112
- C:\Windows\System\OcZDlqS.exe
  C:\Windows\System\OcZDlqS.exe
  2⤵
  PID:5460
- C:\Windows\System\rmqhfVq.exe
  C:\Windows\System\rmqhfVq.exe
  2⤵
  PID:9232
- C:\Windows\System\UgZdohP.exe
  C:\Windows\System\UgZdohP.exe
  2⤵
  PID:6692
- C:\Windows\System\UEQzTzp.exe
  C:\Windows\System\UEQzTzp.exe
  2⤵
  PID:14356
- C:\Windows\System\ryamqCa.exe
  C:\Windows\System\ryamqCa.exe
  2⤵
  PID:14380
- C:\Windows\System\vBDJvJq.exe
  C:\Windows\System\vBDJvJq.exe
  2⤵
  PID:14400
- C:\Windows\System\kopKgEN.exe
  C:\Windows\System\kopKgEN.exe
  2⤵
  PID:14424
- C:\Windows\System\SHrCbfD.exe
  C:\Windows\System\SHrCbfD.exe
  2⤵
  PID:14448
- C:\Windows\System\jfErXId.exe
  C:\Windows\System\jfErXId.exe
  2⤵
  PID:14472
- C:\Windows\System\maLQBeU.exe
  C:\Windows\System\maLQBeU.exe
  2⤵
  PID:14500
- C:\Windows\System\XotOPvI.exe
  C:\Windows\System\XotOPvI.exe
  2⤵
  PID:14524
- C:\Windows\System\qTewjJR.exe
  C:\Windows\System\qTewjJR.exe
  2⤵
  PID:14544
- C:\Windows\System\NbFwwRM.exe
  C:\Windows\System\NbFwwRM.exe
  2⤵
  PID:14572
- C:\Windows\System\pNpCsQv.exe
  C:\Windows\System\pNpCsQv.exe
  2⤵
  PID:14592
- C:\Windows\System\WFBbcSX.exe
  C:\Windows\System\WFBbcSX.exe
  2⤵
  PID:14612
- C:\Windows\System\oDTCcvu.exe
  C:\Windows\System\oDTCcvu.exe
  2⤵
  PID:14632
- C:\Windows\System\bZaQnhf.exe
  C:\Windows\System\bZaQnhf.exe
  2⤵
  PID:14656
- C:\Windows\System\ptziyPA.exe
  C:\Windows\System\ptziyPA.exe
  2⤵
  PID:14684
- C:\Windows\System\sIdzNOK.exe
  C:\Windows\System\sIdzNOK.exe
  2⤵
  PID:14704
- C:\Windows\System\bFQTgQS.exe
  C:\Windows\System\bFQTgQS.exe
  2⤵
  PID:14728
- C:\Windows\System\taqCwUR.exe
  C:\Windows\System\taqCwUR.exe
  2⤵
  PID:14748
- C:\Windows\System\uVcTrgb.exe
  C:\Windows\System\uVcTrgb.exe
  2⤵
  PID:14776
- C:\Windows\System\diNbhDu.exe
  C:\Windows\System\diNbhDu.exe
  2⤵
  PID:14792
- C:\Windows\System\VHYdUZA.exe
  C:\Windows\System\VHYdUZA.exe
  2⤵
  PID:14808
- C:\Windows\System\bhifArt.exe
  C:\Windows\System\bhifArt.exe
  2⤵
  PID:14832
- C:\Windows\System\KJeSmGi.exe
  C:\Windows\System\KJeSmGi.exe
  2⤵
  PID:14848
- C:\Windows\System\mZBFIgG.exe
  C:\Windows\System\mZBFIgG.exe
  2⤵
  PID:14868
- C:\Windows\System\IiQyRcM.exe
  C:\Windows\System\IiQyRcM.exe
  2⤵
  PID:14884
- C:\Windows\System\chGwhhn.exe
  C:\Windows\System\chGwhhn.exe
  2⤵
  PID:14900
- C:\Windows\System\JvhUasa.exe
  C:\Windows\System\JvhUasa.exe
  2⤵
  PID:14920
- C:\Windows\System\ghTPWJE.exe
  C:\Windows\System\ghTPWJE.exe
  2⤵
  PID:14936
- C:\Windows\System\SfMKpkh.exe
  C:\Windows\System\SfMKpkh.exe
  2⤵
  PID:15128
- C:\Windows\System\QXvFuxV.exe
  C:\Windows\System\QXvFuxV.exe
  2⤵
  PID:15152
- C:\Windows\System\xUAowfE.exe
  C:\Windows\System\xUAowfE.exe
  2⤵
  PID:15172
- C:\Windows\System\IxAXqFu.exe
  C:\Windows\System\IxAXqFu.exe
  2⤵
  PID:15196
- C:\Windows\System\NBaQjXg.exe
  C:\Windows\System\NBaQjXg.exe
  2⤵
  PID:15216
- C:\Windows\System\OTNSaIY.exe
  C:\Windows\System\OTNSaIY.exe
  2⤵
  PID:15256
- C:\Windows\System\MYefImm.exe
  C:\Windows\System\MYefImm.exe
  2⤵
  PID:15280
- C:\Windows\System\lOEHKJH.exe
  C:\Windows\System\lOEHKJH.exe
  2⤵
  PID:15308
- C:\Windows\System\XjlJHyq.exe
  C:\Windows\System\XjlJHyq.exe
  2⤵
  PID:15328
- C:\Windows\System\BAcRwIb.exe
  C:\Windows\System\BAcRwIb.exe
  2⤵
  PID:9956
- C:\Windows\System\QajPNGv.exe
  C:\Windows\System\QajPNGv.exe
  2⤵
  PID:9932
- C:\Windows\System\aglwBzT.exe
  C:\Windows\System\aglwBzT.exe
  2⤵
  PID:6600
- C:\Windows\System\KLCXdYp.exe
  C:\Windows\System\KLCXdYp.exe
  2⤵
  PID:8444
- C:\Windows\System\KxMIoAk.exe
  C:\Windows\System\KxMIoAk.exe
  2⤵
  PID:13936
- C:\Windows\System\HkUvUgQ.exe
  C:\Windows\System\HkUvUgQ.exe
  2⤵
  PID:10004
- C:\Windows\System\KXEtxfd.exe
  C:\Windows\System\KXEtxfd.exe
  2⤵
  PID:6248
- C:\Windows\System\xPlgulp.exe
  C:\Windows\System\xPlgulp.exe
  2⤵
  PID:7496
- C:\Windows\System\cgZlHiV.exe
  C:\Windows\System\cgZlHiV.exe
  2⤵
  PID:10020
- C:\Windows\System\HkWZcun.exe
  C:\Windows\System\HkWZcun.exe
  2⤵
  PID:8364
- C:\Windows\System\DSrTgTf.exe
  C:\Windows\System\DSrTgTf.exe
  2⤵
  PID:5480
- C:\Windows\System\XplnprM.exe
  C:\Windows\System\XplnprM.exe
  2⤵
  PID:13912
- C:\Windows\System\PwIaliw.exe
  C:\Windows\System\PwIaliw.exe
  2⤵
  PID:10044
- C:\Windows\System\zWZJZsQ.exe
  C:\Windows\System\zWZJZsQ.exe
  2⤵
  PID:8388
- C:\Windows\System\qFYmhdn.exe
  C:\Windows\System\qFYmhdn.exe
  2⤵
  PID:8856
- C:\Windows\System\itlwmep.exe
  C:\Windows\System\itlwmep.exe
  2⤵
  PID:14372
- C:\Windows\System\pmgrGAQ.exe
  C:\Windows\System\pmgrGAQ.exe
  2⤵
  PID:9032
- C:\Windows\System\DJcgemI.exe
  C:\Windows\System\DJcgemI.exe
  2⤵
  PID:14456
- C:\Windows\System\WkozEAa.exe
  C:\Windows\System\WkozEAa.exe
  2⤵
  PID:12796
- C:\Windows\System\LcIPkRz.exe
  C:\Windows\System\LcIPkRz.exe
  2⤵
  PID:9960
- C:\Windows\System\PKUSwCB.exe
  C:\Windows\System\PKUSwCB.exe
  2⤵
  PID:6792
- C:\Windows\System\WhgGxrz.exe
  C:\Windows\System\WhgGxrz.exe
  2⤵
  PID:7656
- C:\Windows\System\adoCFkn.exe
  C:\Windows\System\adoCFkn.exe
  2⤵
  PID:7552
- C:\Windows\System\TtvXwki.exe
  C:\Windows\System\TtvXwki.exe
  2⤵
  PID:1212
- C:\Windows\System\PLZAeLD.exe
  C:\Windows\System\PLZAeLD.exe
  2⤵
  PID:10024
- C:\Windows\System\LvDrHOy.exe
  C:\Windows\System\LvDrHOy.exe
  2⤵
  PID:7032
- C:\Windows\System\sZUaLga.exe
  C:\Windows\System\sZUaLga.exe
  2⤵
  PID:10128
- C:\Windows\System\uuLQdyh.exe
  C:\Windows\System\uuLQdyh.exe
  2⤵
  PID:8344
- C:\Windows\System\mMslxiw.exe
  C:\Windows\System\mMslxiw.exe
  2⤵
  PID:6652
- C:\Windows\System\PiwhKjf.exe
  C:\Windows\System\PiwhKjf.exe
  2⤵
  PID:8256
- C:\Windows\System\XbEvAeh.exe
  C:\Windows\System\XbEvAeh.exe
  2⤵
  PID:9928
- C:\Windows\System\iTmFlje.exe
  C:\Windows\System\iTmFlje.exe
  2⤵
  PID:14516
- C:\Windows\System\ydqPzpO.exe
  C:\Windows\System\ydqPzpO.exe
  2⤵
  PID:5568
- C:\Windows\System\DyGofHO.exe
  C:\Windows\System\DyGofHO.exe
  2⤵
  PID:7600
- C:\Windows\System\nXooTIy.exe
  C:\Windows\System\nXooTIy.exe
  2⤵
  PID:14676
- C:\Windows\System\ikWNRjN.exe
  C:\Windows\System\ikWNRjN.exe
  2⤵
  PID:10096
- C:\Windows\System\VvqyKDj.exe
  C:\Windows\System\VvqyKDj.exe
  2⤵
  PID:10088
- C:\Windows\System\iSvlnWN.exe
  C:\Windows\System\iSvlnWN.exe
  2⤵
  PID:14800
- C:\Windows\System\bNkQgpK.exe
  C:\Windows\System\bNkQgpK.exe
  2⤵
  PID:10092
- C:\Windows\System\DgGffNn.exe
  C:\Windows\System\DgGffNn.exe
  2⤵
  PID:10160
- C:\Windows\System\zoelUnM.exe
  C:\Windows\System\zoelUnM.exe
  2⤵
  PID:9024
- C:\Windows\System\puEDAVH.exe
  C:\Windows\System\puEDAVH.exe
  2⤵
  PID:14892
- C:\Windows\System\RtnyEhd.exe
  C:\Windows\System\RtnyEhd.exe
  2⤵
  PID:15160
- C:\Windows\System\kXvrBnF.exe
  C:\Windows\System\kXvrBnF.exe
  2⤵
  PID:6864
- C:\Windows\System\bDcjazQ.exe
  C:\Windows\System\bDcjazQ.exe
  2⤵
  PID:7628
- C:\Windows\System\rUtVdlX.exe
  C:\Windows\System\rUtVdlX.exe
  2⤵
  PID:15268
- C:\Windows\System\dCpBJiR.exe
  C:\Windows\System\dCpBJiR.exe
  2⤵
  PID:8840
- C:\Windows\System\bRzFYfa.exe
  C:\Windows\System\bRzFYfa.exe
  2⤵
  PID:7792
- C:\Windows\System\LiSqzsa.exe
  C:\Windows\System\LiSqzsa.exe
  2⤵
  PID:9464
- C:\Windows\System\SMJnJyC.exe
  C:\Windows\System\SMJnJyC.exe
  2⤵
  PID:9132
- C:\Windows\System\tlDiNSZ.exe
  C:\Windows\System\tlDiNSZ.exe
  2⤵
  PID:15380
- C:\Windows\System\RgFUHME.exe
  C:\Windows\System\RgFUHME.exe
  2⤵
  PID:15396
- C:\Windows\System\avqcDNP.exe
  C:\Windows\System\avqcDNP.exe
  2⤵
  PID:15424
- C:\Windows\System\yBmUSYy.exe
  C:\Windows\System\yBmUSYy.exe
  2⤵
  PID:15448
- C:\Windows\System\bnZIauY.exe
  C:\Windows\System\bnZIauY.exe
  2⤵
  PID:15472
- C:\Windows\System\VfIEXRb.exe
  C:\Windows\System\VfIEXRb.exe
  2⤵
  PID:15492
- C:\Windows\System\hAvcvnC.exe
  C:\Windows\System\hAvcvnC.exe
  2⤵
  PID:15512
- C:\Windows\System\zPcPjTk.exe
  C:\Windows\System\zPcPjTk.exe
  2⤵
  PID:15536
- C:\Windows\System\VkpnWKI.exe
  C:\Windows\System\VkpnWKI.exe
  2⤵
  PID:16164
- C:\Windows\System\ppPZYgH.exe
  C:\Windows\System\ppPZYgH.exe
  2⤵
  PID:16184
- C:\Windows\System\VdQwrMu.exe
  C:\Windows\System\VdQwrMu.exe
  2⤵
  PID:14784
- C:\Windows\System\UrzxEAP.exe
  C:\Windows\System\UrzxEAP.exe
  2⤵
  PID:14816
- C:\Windows\System\wFUyAgY.exe
  C:\Windows\System\wFUyAgY.exe
  2⤵
  PID:6540
- C:\Windows\System\Xoygjoc.exe
  C:\Windows\System\Xoygjoc.exe
  2⤵
  PID:10784
- C:\Windows\System\drfJyDP.exe
  C:\Windows\System\drfJyDP.exe
  2⤵
  PID:14828
- C:\Windows\System\FqzkAoz.exe
  C:\Windows\System\FqzkAoz.exe
  2⤵
  PID:11320
- C:\Windows\System\tWADcgW.exe
  C:\Windows\System\tWADcgW.exe
  2⤵
  PID:10676
- C:\Windows\System\WMnTMPT.exe
  C:\Windows\System\WMnTMPT.exe
  2⤵
  PID:11332
- C:\Windows\System\rLMuZtT.exe
  C:\Windows\System\rLMuZtT.exe
  2⤵
  PID:10032
- C:\Windows\System\GlfFJXc.exe
  C:\Windows\System\GlfFJXc.exe
  2⤵
  PID:12616
- C:\Windows\System\RJKSXZz.exe
  C:\Windows\System\RJKSXZz.exe
  2⤵
  PID:13000
- C:\Windows\System\frcaJDQ.exe
  C:\Windows\System\frcaJDQ.exe
  2⤵
  PID:13244
- C:\Windows\System\LeQvpcI.exe
  C:\Windows\System\LeQvpcI.exe
  2⤵
  PID:11032
- C:\Windows\System\CjOnmTl.exe
  C:\Windows\System\CjOnmTl.exe
  2⤵
  PID:9720
- C:\Windows\System\mgllpwN.exe
  C:\Windows\System\mgllpwN.exe
  2⤵
  PID:11580
- C:\Windows\System\yBKntVq.exe
  C:\Windows\System\yBKntVq.exe
  2⤵
  PID:12420
- C:\Windows\System\VJiqXKp.exe
  C:\Windows\System\VJiqXKp.exe
  2⤵
  PID:13060
- C:\Windows\System\vcVsIVZ.exe
  C:\Windows\System\vcVsIVZ.exe
  2⤵
  PID:13128
- C:\Windows\System\ZNxapJo.exe
  C:\Windows\System\ZNxapJo.exe
  2⤵
  PID:12480
- C:\Windows\System\tHWMsqB.exe
  C:\Windows\System\tHWMsqB.exe
  2⤵
  PID:10404
- C:\Windows\System\upZGbLo.exe
  C:\Windows\System\upZGbLo.exe
  2⤵
  PID:12628
- C:\Windows\System\PQfAqnx.exe
  C:\Windows\System\PQfAqnx.exe
  2⤵
  PID:10056
- C:\Windows\System\XDpeEme.exe
  C:\Windows\System\XDpeEme.exe
  2⤵
  PID:8024
- C:\Windows\System\USpHniZ.exe
  C:\Windows\System\USpHniZ.exe
  2⤵
  PID:15592
- C:\Windows\System\WtyiBFV.exe
  C:\Windows\System\WtyiBFV.exe
  2⤵
  PID:10304
- C:\Windows\System\IIoZMdu.exe
  C:\Windows\System\IIoZMdu.exe
  2⤵
  PID:15052
- C:\Windows\System\jpIIVoK.exe
  C:\Windows\System\jpIIVoK.exe
  2⤵
  PID:9204
- C:\Windows\System\JQSnyRY.exe
  C:\Windows\System\JQSnyRY.exe
  2⤵
  PID:13896
- C:\Windows\System\yrMQaMI.exe
  C:\Windows\System\yrMQaMI.exe
  2⤵
  PID:8328
- C:\Windows\System\UHZyCJO.exe
  C:\Windows\System\UHZyCJO.exe
  2⤵
  PID:10780
- C:\Windows\System\zNmpVne.exe
  C:\Windows\System\zNmpVne.exe
  2⤵
  PID:14876
- C:\Windows\System\jzXxRSk.exe
  C:\Windows\System\jzXxRSk.exe
  2⤵
  PID:9004
- C:\Windows\System\pmklLTw.exe
  C:\Windows\System\pmklLTw.exe
  2⤵
  PID:7844
- C:\Windows\System\lMPnWlc.exe
  C:\Windows\System\lMPnWlc.exe
  2⤵
  PID:10176
- C:\Windows\System\VaMdyZz.exe
  C:\Windows\System\VaMdyZz.exe
  2⤵
  PID:10560
- C:\Windows\System\TRdfXvO.exe
  C:\Windows\System\TRdfXvO.exe
  2⤵
  PID:15768
- C:\Windows\System\jpDGGeN.exe
  C:\Windows\System\jpDGGeN.exe
  2⤵
  PID:15208
- C:\Windows\System\vebUPlL.exe
  C:\Windows\System\vebUPlL.exe
  2⤵
  PID:10932
- C:\Windows\System\JwuEqIZ.exe
  C:\Windows\System\JwuEqIZ.exe
  2⤵
  PID:15788
- C:\Windows\System\OBrQqAU.exe
  C:\Windows\System\OBrQqAU.exe
  2⤵
  PID:14844
- C:\Windows\System\JKxJxaq.exe
  C:\Windows\System\JKxJxaq.exe
  2⤵
  PID:10808
- C:\Windows\System\yoAfycj.exe
  C:\Windows\System\yoAfycj.exe
  2⤵
  PID:10184
- C:\Windows\System\oRFhyyI.exe
  C:\Windows\System\oRFhyyI.exe
  2⤵
  PID:7520
- C:\Windows\System\XHtJBqa.exe
  C:\Windows\System\XHtJBqa.exe
  2⤵
  PID:7580
- C:\Windows\System\NsEgWtH.exe
  C:\Windows\System\NsEgWtH.exe
  2⤵
  PID:11772
- C:\Windows\System\xuadRUZ.exe
  C:\Windows\System\xuadRUZ.exe
  2⤵
  PID:15932
- C:\Windows\System\VnDAqku.exe
  C:\Windows\System\VnDAqku.exe
  2⤵
  PID:13248
- C:\Windows\System\KwrHIcb.exe
  C:\Windows\System\KwrHIcb.exe
  2⤵
  PID:9824
- C:\Windows\System\BkjtBYi.exe
  C:\Windows\System\BkjtBYi.exe
  2⤵
  PID:8500
- C:\Windows\System\SFSBQeE.exe
  C:\Windows\System\SFSBQeE.exe
  2⤵
  PID:15968
- C:\Windows\System\YuyHXXr.exe
  C:\Windows\System\YuyHXXr.exe
  2⤵
  PID:10068
- C:\Windows\System\AApYMEk.exe
  C:\Windows\System\AApYMEk.exe
  2⤵
  PID:5324
- C:\Windows\System\miVnuBd.exe
  C:\Windows\System\miVnuBd.exe
  2⤵
  PID:15612
- C:\Windows\System\iCRZjLp.exe
  C:\Windows\System\iCRZjLp.exe
  2⤵
  PID:10704
- C:\Windows\System\ZqQOdPe.exe
  C:\Windows\System\ZqQOdPe.exe
  2⤵
  PID:11972
- C:\Windows\System\OywLnqf.exe
  C:\Windows\System\OywLnqf.exe
  2⤵
  PID:14604
- C:\Windows\System\sUfUDjf.exe
  C:\Windows\System\sUfUDjf.exe
  2⤵
  PID:11756
- C:\Windows\System\tscWXbD.exe
  C:\Windows\System\tscWXbD.exe
  2⤵
  PID:3472
- C:\Windows\System\iNDGRZf.exe
  C:\Windows\System\iNDGRZf.exe
  2⤵
  PID:15676
- C:\Windows\System\bkXwwVF.exe
  C:\Windows\System\bkXwwVF.exe
  2⤵
  PID:6340
- C:\Windows\System\HXuRTfB.exe
  C:\Windows\System\HXuRTfB.exe
  2⤵
  PID:11920
- C:\Windows\System\aVsiANn.exe
  C:\Windows\System\aVsiANn.exe
  2⤵
  PID:15192
- C:\Windows\System\toROnHj.exe
  C:\Windows\System\toROnHj.exe
  2⤵
  PID:11888
- C:\Windows\System\UouSAzy.exe
  C:\Windows\System\UouSAzy.exe
  2⤵
  PID:11980
- C:\Windows\System\QCAiWPg.exe
  C:\Windows\System\QCAiWPg.exe
  2⤵
  PID:12168
- C:\Windows\System\RVqNoqe.exe
  C:\Windows\System\RVqNoqe.exe
  2⤵
  PID:14536
- C:\Windows\System\TrAnDYt.exe
  C:\Windows\System\TrAnDYt.exe
  2⤵
  PID:11396
- C:\Windows\System\JKSVvKm.exe
  C:\Windows\System\JKSVvKm.exe
  2⤵
  PID:12356
- C:\Windows\System\rQyjzlM.exe
  C:\Windows\System\rQyjzlM.exe
  2⤵
  PID:2512
- C:\Windows\System\SGwaBvW.exe
  C:\Windows\System\SGwaBvW.exe
  2⤵
  PID:16032
- C:\Windows\System\SOVdIAN.exe
  C:\Windows\System\SOVdIAN.exe
  2⤵
  PID:5228
- C:\Windows\System\KhIcmYQ.exe
  C:\Windows\System\KhIcmYQ.exe
  2⤵
  PID:15088
- C:\Windows\System\ZAtSoPO.exe
  C:\Windows\System\ZAtSoPO.exe
  2⤵
  PID:8708
- C:\Windows\System\TYeepLh.exe
  C:\Windows\System\TYeepLh.exe
  2⤵
  PID:11760
- C:\Windows\System\wHFrwkp.exe
  C:\Windows\System\wHFrwkp.exe
  2⤵
  PID:12160
- C:\Windows\System\bpRuwAv.exe
  C:\Windows\System\bpRuwAv.exe
  2⤵
  PID:16368
- C:\Windows\System\kWOcjxz.exe
  C:\Windows\System\kWOcjxz.exe
  2⤵
  PID:11000
- C:\Windows\System\YBjGuMf.exe
  C:\Windows\System\YBjGuMf.exe
  2⤵
  PID:8976
- C:\Windows\System\TTDnlts.exe
  C:\Windows\System\TTDnlts.exe
  2⤵
  PID:13364
- C:\Windows\System\inxnvIY.exe
  C:\Windows\System\inxnvIY.exe
  2⤵
  PID:11604
- C:\Windows\System\jlFyHUo.exe
  C:\Windows\System\jlFyHUo.exe
  2⤵
  PID:14712
- C:\Windows\System\wERSbVu.exe
  C:\Windows\System\wERSbVu.exe
  2⤵
  PID:10620
- C:\Windows\System\FRnKgnw.exe
  C:\Windows\System\FRnKgnw.exe
  2⤵
  PID:15460
- C:\Windows\System\PHphaOG.exe
  C:\Windows\System\PHphaOG.exe
  2⤵
  PID:6876
- C:\Windows\System\qRCjAVq.exe
  C:\Windows\System\qRCjAVq.exe
  2⤵
  PID:12672
- C:\Windows\System\iGEMElt.exe
  C:\Windows\System\iGEMElt.exe
  2⤵
  PID:10108
- C:\Windows\System\nTuDUTr.exe
  C:\Windows\System\nTuDUTr.exe
  2⤵
  PID:13504
- C:\Windows\System\WzYkooR.exe
  C:\Windows\System\WzYkooR.exe
  2⤵
  PID:11288
- C:\Windows\System\qMBWUWY.exe
  C:\Windows\System\qMBWUWY.exe
  2⤵
  PID:10372
- C:\Windows\System\JsSvjqN.exe
  C:\Windows\System\JsSvjqN.exe
  2⤵
  PID:9988
- C:\Windows\System\QIiGyaJ.exe
  C:\Windows\System\QIiGyaJ.exe
  2⤵
  PID:684
- C:\Windows\System\WEtRzZq.exe
  C:\Windows\System\WEtRzZq.exe
  2⤵
  PID:12340
- C:\Windows\System\kFHjfZf.exe
  C:\Windows\System\kFHjfZf.exe
  2⤵
  PID:11124
- C:\Windows\System\kbBmONV.exe
  C:\Windows\System\kbBmONV.exe
  2⤵
  PID:9332
- C:\Windows\System\TuUfYqf.exe
  C:\Windows\System\TuUfYqf.exe
  2⤵
  PID:10164
- C:\Windows\System\VgYCQYi.exe
  C:\Windows\System\VgYCQYi.exe
  2⤵
  PID:14468
- C:\Windows\System\gPRtzWg.exe
  C:\Windows\System\gPRtzWg.exe
  2⤵
  PID:10692
- C:\Windows\System\ShiIWnv.exe
  C:\Windows\System\ShiIWnv.exe
  2⤵
  PID:15100
- C:\Windows\System\gYJIfet.exe
  C:\Windows\System\gYJIfet.exe
  2⤵
  PID:10532
- C:\Windows\System\yEjDtGE.exe
  C:\Windows\System\yEjDtGE.exe
  2⤵
  PID:15764
- C:\Windows\System\mnXgROZ.exe
  C:\Windows\System\mnXgROZ.exe
  2⤵
  PID:3948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 3984 -ip 3984
1⤵
PID:13512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_usn4lg5a.n04.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AlmostT.exe

Filesize
1.8MB

MD5
871241306609adb2ef0c635f7c890d7b

SHA1
0fe14bb63bec277699adc8559a60664a7d3c150b

SHA256
651ceeacc56b7e7f57f75da4eeeef7fa52c173236be8de17c75333e9dc0b7bbd

SHA512
9141c5846fe32f0b2fc5ed7ddda28f16879451959032988ac28882604e195829be20d5ef13cbe9c679bb1980c6a1cc6fb98ac782586c561f20231aca5edd2d73

Download Submit
C:\Windows\System\BkaNTZH.exe

Filesize
1.9MB

MD5
19ac076ab76d2af53bf2d88346fcd17b

SHA1
d91dd94deb4bfcbf5df612801d5519b9d1dc4078

SHA256
4ad17f0754b34f973ca485e47ae87676199f69ab8103089118cf2b3065395883

SHA512
292a38e76a4f07353b586f8f122eafb2b9cca1fa65376334d3441a7575bd0be4d54b53796518cafa524ec4eaaa8a8efa3d11b59b816cf991be9224efc53cdfaa

Download Submit
C:\Windows\System\CkKiodR.exe

Filesize
1.9MB

MD5
5e002b3c9ca33202d162c3dc1533a772

SHA1
c6ef48d13dc7eec68b6089d9e6ef9c87a1aca751

SHA256
2b118e86e0a1b67e3ca937bfc74e6f075db2ee8f5c1116d296f6aea5e840aff4

SHA512
7a2fb441a9c971a0bbd1f44da8377e506365fb4bbab36690d844f3ecec95d9a8df95d17cfd8ceebedfd63c10ddb64844eb0124f372e9f7ea6a8ddd0be5c3095e

Download Submit
C:\Windows\System\CyYXgcu.exe

Filesize
1.9MB

MD5
90aa6607d56cdc51611a3c5feeaf49a7

SHA1
b29c9466f5057ba2704d61fe314eedd6c0211a61

SHA256
3e7d18e53baeca24626efd3f20236267c786f2c5c0520691152d4a447d9bfbd0

SHA512
a331825d16e9b6ab1a9e952adb640ab2f24073ef2d6885191a4df277d4eb6c50075c7acbadc65e9a142bdb6e3aae6802df4244051d55f0986064c2fa9aca7421

Download Submit
C:\Windows\System\DhirGYx.exe

Filesize
1.9MB

MD5
79b04df5d375f9c9437168b2ce3e496e

SHA1
6973e61d94e7cae0e58bad9030dd1e5fa89814ee

SHA256
4d2f67107571ddd12b941836c7c72eb2b642b8af9f984d9e2d5af95f83bbe70e

SHA512
9256a17b4cc060ff2c6cdb82e337ece8b6406cfc6ab77f72b14b4eabd89798c9d5bcda7f575d83e1f729c9a3588ef1c8045f350654e84394194b7d5446e2b80d

Download Submit
C:\Windows\System\FJASxLK.exe

Filesize
1.9MB

MD5
66fca5932212a347324a5cb19cf0c190

SHA1
206abbbc210c0c573d2ac48a998cc37aefa42487

SHA256
3e0b05e81e4eb95f71cafbdebea90ade12485b7da485a06f022da3c27270009d

SHA512
1c8b35974364f1fd6eebf199c696ab0544f6e500a60f9aba025e8d336b070bb0e5d0122e2c4923b2d9dca431b13e8d9c9a7093e36cb12df7d08671211e8b1cf4

Download Submit
C:\Windows\System\FfeUWzb.exe

Filesize
1.8MB

MD5
3a93d79cd79d4e57ab01a9bb2268abfd

SHA1
84b494f153b6c8e45a8db25d4c0e5fca5bce49b5

SHA256
13143a06a1758775cb4d1a3e75b765b72860f6b0987c6db300bb3c335cd462f5

SHA512
9f26b186a1312a2b6f4d826ba9f910ae16eb8d3e6c08f51ff7c3fcc7c09ec77a70b36a014b2ada2c0e6f22a0d952543b891758fe9347e7b36c1924b16b0ce7d6

Download Submit
C:\Windows\System\GRTBauy.exe

Filesize
1.9MB

MD5
4eaa023fad5c4d52e9a2b27e6783cf8a

SHA1
1752d37b7bf4fa07e789e44fa795e1f94138fdd5

SHA256
2a02fb127e2ecaaeaf3b803f4f7bbed2e336b8479e63fc0ae5a7bbe54af6dfe3

SHA512
37831d8a33900ac6132894a2ee3af4529073212f6d889dafd05bf0f871e5be3abd966aa8ecc57ec0633b3f18bcc0c334cf18168ea0d01ce243ca3e630a523b77

Download Submit
C:\Windows\System\GYMeWHx.exe

Filesize
1.9MB

MD5
4110b6913072b64202ffbf523bf2abd2

SHA1
08aedf522d5dc42c1e9c6e76217b01c90b2ad12b

SHA256
056716ce9abfb62b4fcef7c3d0c676f8227f03f85e617f0fa033b2f865bc234f

SHA512
501cfeb14abe489cdd5379e9045aba900a6411ede3c3d815139606e3ab743b294992b8cec51e928a930fd9b06d07890ddb57ffd17f44ddeb958473449f43d991

Download Submit
C:\Windows\System\GcOWaSS.exe

Filesize
1.9MB

MD5
804ad06bed8c5ff7f36ac2ae9ac5a5ba

SHA1
39fa3b7f262c02382a333cc718dcb693d49fc0e7

SHA256
27b996afcf7a245abf29f33a09930d938c573fe4b8b5c7b46c9d14d34f7ab0a9

SHA512
0126b58688db1d215642d18fe4c85d5ae249670bc7d952f41bb49e5b3e6f7e20272a68d1893ab0d47a7ae2580d9d64cf5ca3b35ce4cd46c858a31eeabb602c6a

Download Submit
C:\Windows\System\HpixGYY.exe

Filesize
1.8MB

MD5
ca5591129e483a673f65856937871675

SHA1
d0df11a7d7eedb9e8238e5b7b37f32d36d683676

SHA256
03be391d65564bdb21c7557b2f386f6a1d18c4a28367d180aede64e79af45279

SHA512
6cde89d2bd646c3bd37a90b55f0e2bb6170fd57864492fe6d98ca57fb0d225080aac720f863b0f873f66af4d1e45de113e58bc700d154dd9dd1def29d45260fb

Download Submit
C:\Windows\System\Iaxhypl.exe

Filesize
1.9MB

MD5
cdf63cbc2de3f4b513f040dfc963d44d

SHA1
f75f5f9d6a54098d7aa6896ca9cd6f79fb28359c

SHA256
3f20a1cbc601df1371c70246cd024f116c7b1e7291a9c48fb30e6bf183b0a81f

SHA512
f9c36148cd752a4ab5ea5fed5cc28dd7402c02c2a5c9d5187bbfbdf6d547bd07beef45e58876b97babfaf3ca06033771196a59ab6fa7ee46561aa012ef9dcd7e

Download Submit
C:\Windows\System\MBoVcNx.exe

Filesize
1.8MB

MD5
6959349c0aca208ead9250e997bf0f9f

SHA1
969abf6023329630c29a1aee6b3b0b2660de0df5

SHA256
3531eada9ff18ace2c06bda767e361f1e2f15ad896fe0439ce03ac98fe53660a

SHA512
6bacdac95235dfadcfb6d2f329d92bd9e281d7bb44296519054c7b965f0397f3be8c9e429623cdd1c75eaca58dea77a22beacace850ba2046d1b1e8dbce31808

Download Submit
C:\Windows\System\NFXcdJH.exe

Filesize
1.9MB

MD5
8b76bd993948ff667b7c7b2898cb4d38

SHA1
777d6d07dca9d2a6a826fb50ab87869853c2afe8

SHA256
c5fc040437e0ef7da16ba927de5fc5a5e40baa5b496cab17a5bc9f4360129989

SHA512
14d641fd120df8b76ce94975796bf52cfb97f2d7e1511a8c2db26a7ffdd8fea6aafa1994dd880751590eef624a2bfef12dad916a288db7e4d2d65a8791b75125

Download Submit
C:\Windows\System\NIAPYIz.exe

Filesize
1.9MB

MD5
b7905413caf7c10412ab148595b7d1e4

SHA1
827c4f7e97a8510e88d40551761afc5b27ff74c3

SHA256
0c233fdecc1183c878ef4747b94c71db2bcb76227147e5a3157a4acbdc6e8ec0

SHA512
46ef037c90ea3d8359fd4a1f582fdb0c2992aff309b1b8eac014a385a00932bc37c07fb572e2ffde90c5e72c2a9b3d52a21ce835d37260799c60534a6cc30d03

Download Submit
C:\Windows\System\NYwGlMk.exe

Filesize
1.9MB

MD5
a349d7ff86e72a1d4ccc072b0ea40fe6

SHA1
aae8b7c72d604e92df3b19c7fa8a643cb215dcd5

SHA256
bdcbf885a7d042708f02f9b96ac2afd9f0c0a1c5b8c761df6dbe0b269fa624a3

SHA512
2ade638e5c166fa5c4be16c5da5c9fa6a8fa7edb59ed622b298c2fad1cdf2a20993b8ae42b27ce72e6037d849afd7f8ad2446cddc27edc8402ca4356b8133bd9

Download Submit
C:\Windows\System\Pjaijdb.exe

Filesize
1.8MB

MD5
ebd466b31b97137ead39f14cf107b26e

SHA1
8c645f1f83ffa7fa80ae64efaaf2451c550db0ca

SHA256
e86dc6823e03add12fc6a62fb9fd80fc5d639475e53d7d23d5fecd638725d34e

SHA512
b40a4aee48b66580de3d88190f036e24ccf16fbc0439f97904efecb262cdb409d72cdc756efb0b25f509a4ebca1a1627e0e918e25b219c19f8c04bbd3d7b59fa

Download Submit
C:\Windows\System\QIeEPvF.exe

Filesize
1.9MB

MD5
e7d1b5764f50cf0772555e7fa7ef595d

SHA1
77720ca2c1d593dfcde2fece0b6bde60dcb99e35

SHA256
5b8c0cdeedc8bfa51f76ef07f2d9e9a8845b4afef36713d9f30b4f0341b585ec

SHA512
2c911eea2170d70b171b150e63e5548014439af1b71f49e2a9a3a2c8c9aa587e48a19a10e2fbc87b79ae27516c6cef23753471f54a30e62d60d33b086a5a40b4

Download Submit
C:\Windows\System\QcSPTfw.exe

Filesize
1.8MB

MD5
5709c22faeddc3a39f965808b5652bd1

SHA1
c978677ea205c07062e4a4e7bfca8b34145e6612

SHA256
f9d8a939a41624f1150b91cd3c05633b7caf0ebdb710534ff8742f854f813680

SHA512
d16d7aac634bae65ba7ff8937859fa66c7d887f72f82254ce5a6231629e26f039e77c40d776060061ab0bc6e63d0116b85b0cf5d87ddd1531d145705ff2c22f1

Download Submit
C:\Windows\System\ROPveJn.exe

Filesize
1.9MB

MD5
9d38e4bc72be5f455d155976d5264b71

SHA1
301ce6c1a588beadf9562b088098b4db8866b4ae

SHA256
e0098d427128889ed22aa73c9291ced2ffa8bc7e23b5d3510875afc1a128cea6

SHA512
039bad0d452e2342609271bdea84cccd7d622c2670307ac68c068ddb9bb69720f3f863ae5dfdd3a3d6bd2a01e06bcaff352e400ebe3c65381d2c4e6e2a2ec545

Download Submit
C:\Windows\System\RSjPRzp.exe

Filesize
1.8MB

MD5
f92519875cf8426eef65b48460f8295f

SHA1
5ec3b7cc5c965d957564f7c4f0c4363ac198ce25

SHA256
8af53fc317bebae86ef6aec35e5fbf91256254c0bf61121a0f24d09fc90b71e7

SHA512
c95f475e6a1c6f55f1c921494ab4701ade629f09bc3a354420861dfce4ca7447b8eaf54b79072c19fcfa75f87d6f13b622a7264f3d8ac49a195daa60c1710ce8

Download Submit
C:\Windows\System\RdYVBya.exe

Filesize
1.8MB

MD5
dc4e60382243357e26163363c383b30e

SHA1
b603f71a9a6f593102646f512a147834e4a2ba1d

SHA256
b1de645799f96b5572b637546b70f3fd5fd667b5b3eb6506149f9df5af210657

SHA512
97603650f9ce5e6ba22559aad72cf1b88def53e971fd1b1117e7b97ab80b7656b89a7462c5029564225fbadeef3fb21447cfdd85b9a9dcde88036dd4d17fce8b

Download Submit
C:\Windows\System\SbVvzTi.exe

Filesize
1.8MB

MD5
922d92303a457a832dfca981cf3ab776

SHA1
25b9a89fe659fe949fa764a237930b1bf4849130

SHA256
bec735281d93f686fac637159d6f932e5d7ae66e0ed387bd18b129c6d33ffb7c

SHA512
2b1aa078dce4a24a3e9478ad65328c8d0103fa8d74bec2c79fc7fe9e8352b058f076fdf99fb769ca2b6c5ff3af3c588729ed574c6dbf3fa126820408daf02142

Download Submit
C:\Windows\System\TeRKSbJ.exe

Filesize
1.9MB

MD5
0c65fb6973be3a591b80a270ab6a9465

SHA1
ad7c37f8336fe600a51ecc227c18f43f77aad261

SHA256
598d6df0d1f6f7ae04017728378567235327bec8e7306f8fdd5e4674039ec1d5

SHA512
2e0eae36ea1c23d3a89ae0754315d0b835da42b927f5a8990753ddd3a3a18ddc0c40a3589429d970419eab9a2267b513aee2977fa3ba7d6b53fc566611463a2e

Download Submit
C:\Windows\System\Tkqpjhr.exe

Filesize
1.9MB

MD5
8b82aa97955d38a63afe9ab1c8e1ff0f

SHA1
e80bd637d2033253f358d86bd77c929528319ed2

SHA256
711dfe0cdbdfabd11a23faad2c9e27d854a4dec532a60c91b940be75577c6640

SHA512
8887aa427d165e8f535c333638015fc05b95b46abc31a99aacb7109df2dfcda2ec6b20f38c1a5a9671385076c282d5909deb2e89bb1bc65413670b9571786927

Download Submit
C:\Windows\System\VSZNtWt.exe

Filesize
1.9MB

MD5
b53696ce5c47fc61d3de0cb0379559d9

SHA1
dcfafdc340d828f97cf3cfcb8fed048e01591e57

SHA256
28c760a908f66dfa98afad7c3721d0c98dea17be3101b57d73b1e161f94cd298

SHA512
292df20bb1c7474dc224f93d60d22c817c03522666db95a4cefd3b316751a8c933076d05f28dda302f3f3435450d928ba606746e3c8cb05d70252753537df9f4

Download Submit
C:\Windows\System\XuVVMSV.exe

Filesize
1.9MB

MD5
5fcc960a77fc9b026d49a28b45b4557e

SHA1
1867f86edf983cc7ac6e5c75e838ab7827a30117

SHA256
6f0dae6a8150b686b39ad302b1d91c4461e99da4dd7f871b2ee5e723d612b4c0

SHA512
537bf220d2fd33afc758c3ec45afe95b9098c1349b09eec6333d70e371eb6009d3621901037e31f878c5c63fd9f526df6eeb97d5461ca2a21cc1220a009d30e6

Download Submit
C:\Windows\System\ZTlUVAF.exe

Filesize
1.9MB

MD5
c5afea0c44ab1d39c068c94ae888bdfa

SHA1
43e73a2b25bc59a00c7fffc4b6de84c59a76dbae

SHA256
ec75c8494fab9ebda280fd549e508359584261e24834bd84285eca8df6793ab2

SHA512
9fd464e50490dac46dfb4ec5a72e5b0e2ee7f4ae49aa6cff254900273a157da1d443861c0e5a4e50e7ef7ba4213a090134572cca295ac0678e53916d2815963b

Download Submit
C:\Windows\System\cqAYdKd.exe

Filesize
1.8MB

MD5
6716535d8631b1267177d6bedca3c1cf

SHA1
815935e264215d6d938f4e9fdd83d19a2dc3129f

SHA256
0c30003ca484d3c8f1fd5e089777bef9498aac64a1505eb20da132478e554961

SHA512
0b63ca39f40e7946d7c46ed1a1889b6ca87fa71c137566bc796ba610efe674b497d40d8509773d7884c007b6754f9393a53ce6bce31a12ac15cbea3389f68a11

Download Submit
C:\Windows\System\ekPpslr.exe

Filesize
1.9MB

MD5
6cc36c3be637303504b588edb4c27345

SHA1
9e7a92b3d5449a8792fdc14ad1077c79bae68f70

SHA256
23aa7423f38b942002ed5e38b8260f5c1a42ee078fe95419b565109d8c9c1334

SHA512
7485546822f4b46ea748010c2d21fa17f81453b0819e65526a1caa19f37016f980d8840e72381cc98f2840e1f81333b98ccdaf1fe6ccb67648863ff87db41a16

Download Submit
C:\Windows\System\etbNKup.exe

Filesize
1.8MB

MD5
fa3afc0d8f45e933c7296744b6754f86

SHA1
72d2453360ce2ea6c002051e4a4e83c717a81764

SHA256
07be5f63562a021e21b7a6e39876131fe8455ef2787634ede41ebf88e9c4d49f

SHA512
4428d2e436daa4e28fc3ab296eb080357570736d936db5e94d9e24cc4eefccf3a376c44223c543ba1c76f555e5bdb63d28e14ac218359fbe3917d2463dc929ee

Download Submit
C:\Windows\System\fSePvIG.exe

Filesize
1.9MB

MD5
0f06c3fb4e0d1e009f3df656b162b2b0

SHA1
754cc88a3a452c73261990fa4482cad6036577dd

SHA256
f68a370e6569cdd2bbc4cb67c3f06833862e82f1d1a17a8bd0f611a3baac9ed3

SHA512
047c0a0d8464a4b27d6fb64e366f0c01e47db6e38a8cc1dca0556c5fccb936158fc1fb07a27f57323467fc1fe9a9625aa7b73068940d31ff9b1f39b76874a529

Download Submit
C:\Windows\System\fxKvuuo.exe

Filesize
1.9MB

MD5
e7403ddcb36f1bfbaec43ccc97a28c40

SHA1
1ca6e5ced07064ff24319b91f0c5f991983c5ac7

SHA256
37e4bef86554c49d56270edf6f3b1d8bd881a552febab1cb4d5c25aa04cd2ab7

SHA512
e40409bbb9fe593b121c229396dc15fb6f3b57bfe9a76ea2e451c33a856c047fe70f649c2399b2d9bf16adb02808e44b475a5f8713411a36621fbe3ed1113eb8

Download Submit
C:\Windows\System\iVTCbGw.exe

Filesize
1.9MB

MD5
4a7210a35aee22ca46081ebc99dc42de

SHA1
72d5e3fa87285894f714b5a5315d24a3745a7b1c

SHA256
5d71a0b0690f7b7bf8c504cc7463acb56c1aba240e65a47e2a501b35d1cdcd1f

SHA512
49b812f6dd354bf6c5600f9ca1c88988e234a406db23b1ab4ee9e4807f33da8e018f40c181a22e60357ae7588cf438c3d969c88ea306cc39af055af7a1e7efe2

Download Submit
C:\Windows\System\kfDHpoL.exe

Filesize
1.9MB

MD5
c72e16a47bd4b6fb9e70df91020ead06

SHA1
32496c46d4f9f7651a839223e73fccf9c878f719

SHA256
4aab2929fa94099a10e376bbf54697fce04f017863fb1d75c16156c0eeabeb61

SHA512
9f8e0658f76c5312593eaf3347db1e55305cfd4b6754c784dde20c7bcf8ed5c3fb858a0118b785d1c2c1091ddefef4b938f827704c67f7bc1104ee85fed89e72

Download Submit
C:\Windows\System\lxSbhVf.exe

Filesize
1.9MB

MD5
56773a66c26209fe2aabf96b0c17f473

SHA1
238b153682590509b9816f960705d665a67ed08b

SHA256
10e021a87e66c2ee63b71ef4bbd28da6d87427128909246b9cb9a2541d54de4f

SHA512
cbb2c51038c05304b9bef14578b367bc6fa10e26d79ffc8ba169cfa8f0725b2849a62cc836ac82fc99808e65d32c2ccea36841ca1a9cc8458a56864f207d0d60

Download Submit
C:\Windows\System\mAUPykc.exe

Filesize
1.9MB

MD5
aeb41c6e8d19d87082bb24cf9cdf23cd

SHA1
d1e9bb8b831a70b7a419c7720f94ae934f42953d

SHA256
9ee7db01cddfc6d31f803e5cce3a5ff501de191896c681aa8ba8503763a27b99

SHA512
95d781eec01edaf8a1bba3d1c5096d85f998077fb4567d4a5af4a3819b018cc07e23d677d77b81a83bbc6d9bd32ab93de977e1164e4e5968b9f470ca7f6bc534

Download Submit
C:\Windows\System\mzuOuuV.exe

Filesize
1.8MB

MD5
b1e7796bc122046615ee8addd9351648

SHA1
5e987870c397900f40e3225fe67d9e2169669a46

SHA256
b26fc3c6c69a5e80289ac390a614580f3cf8f697e3d87434264b59d17b8b5481

SHA512
ac899a30afb0edf26f3c2cb0d833dabe5ddb1a53035216370122c202d5f840282d6feb57ddd3120181abb4a6a1af0b1a0d75378b5a0772755ab0a8340b6124f8

Download Submit
C:\Windows\System\oylMCJF.exe

Filesize
1.9MB

MD5
bf1f354f537dc21c0c8d2da3f88d39c9

SHA1
41c7430b177f7a43a49f4bb4b5a2cf62762da156

SHA256
4a31eba15b45569ffb24d62a0a0684ab2c08a262ff11d5482f2e179142b29527

SHA512
b943f7b5394b12bc185057ada61645e6bd9a08858c3a0b87e0659508b5bc7cd23e0d3ed9770690b33e33e72713c4539f25dd8de001f9025f888a68bd0864e5c6

Download Submit
C:\Windows\System\pnDqPnh.exe

Filesize
1.9MB

MD5
146671a8a6a82875255625fdcedbc985

SHA1
ea12cede254b8ba9798f60f6072981a97fd47300

SHA256
5ff359c63f84f90fc295c378babacd0d3ead318b840ef1751c4c43589f021c7a

SHA512
c9310a64cc3f6e77712da9275a528251a329bec4d61636d79fe7f2170d52a4a74e28fcdcecc92ca3c2c403cc82a963b10143de166b28354e2a247a59c21f436f

Download Submit
C:\Windows\System\tGrntdk.exe

Filesize
1.9MB

MD5
78c67c2fbccd1b2f9c50c1fb558154f8

SHA1
c41340322048e9cea8d41340670c9735f4545de4

SHA256
b8ba46dd95686c872e266100bea8da51e0534a3417a138eed1186cad79d06f8e

SHA512
57bd2b7677ec67961e5437582d21e9672c3324f5161093bcc4a2a3753efda9efc2921371d11e46760a2206b32a1b5faa0c46c37c116114673adbf8401100f197

Download Submit
C:\Windows\System\tNXfFCF.exe

Filesize
1.8MB

MD5
42514b4643f64a2d9cc9ef7882a8d604

SHA1
6f9b9a9197f42d5cb0a4a208037da75ef0350c03

SHA256
a27e2d89027ddbdd06fde37fc9882df059dcd98a5a738b6b78d228e0235d3056

SHA512
7a3df25d1b75fe8b35bd2f2db56fcfc1d05c1219d89dac15431dc3db497da53bb2c034ac1be412c0451384a4c83a0a2a345bf15111993bb72add53d21004e9b5

Download Submit
C:\Windows\System\vBrIeuD.exe

Filesize
1.9MB

MD5
54dd4260b617813c2d1f9ccf4006dbac

SHA1
a0fe377429e9c6dd749b7181f1a4329cc90fb3b2

SHA256
341f3a51be3425e50f0c85e0c18de27a153fca25d55113a3cf337dc9f54d729c

SHA512
2880eb06ad57b5d399912826131bf681afdf8e245c4bcdcd68a5fbebafe418bc230285c6cf86ca7c677f755c76ad5ea2e39e2e19dc1fdc2fa163942daa2ac134

Download Submit
C:\Windows\System\wOiylWv.exe

Filesize
1.9MB

MD5
9187a58260061096fc602ab123148ee2

SHA1
8156911ce7aa654dc6ddc7dd40d7dd18fd3719d8

SHA256
5cdbe1a3db4756dfb744d7c8bce15d459c310e044e9fb24254f9e5a336c3910f

SHA512
754ce8f706eadb1126df252917680a3d9c13da06cff03ce4dba66817d08245e66050e015862c142b102e734710e50c9690b12aa74e967c033a8709cb2e7df484

Download Submit
C:\Windows\System\wUgDTEc.exe

Filesize
1.9MB

MD5
7123c0c9fb3c564d3751f6664b6863b2

SHA1
d7578cd20ae2aca006a42d81a9b23ac9c072240e

SHA256
6787873b24b9c7a9fc9f75f83b6d70e4fd27c1e0732972d30098f8c32240fae4

SHA512
15d9f603391922f2d97cb29da24bf876131b035700e57b828e7bcc535a0020fcbac7a1a5e37b3453be46b34cd5abde6a3483c15f2dff9d002feb053553aec7b3

Download Submit
C:\Windows\System\yXnvbCe.exe

Filesize
1.9MB

MD5
3baddbcb168abaec0b3f52b98855a965

SHA1
5e3ac8329f8a84e75d8b6f92c1b3d56ce70ce521

SHA256
d6ff7407f50d4899e48e5dd410f7eab27efdb0dedfa7f7c3fc43ac3d96fa51ef

SHA512
fee729b51914a41c79cb9133dd33d3fabb294ea1fd1bb3268eff1e264a7d6b1d0e857f8a0f62c0d573cfded5dff84149789b8096b930ddb93892e88f9fa17a34

Download Submit
C:\Windows\System\zWBjABk.exe

Filesize
1.9MB

MD5
d07d2d1951f92ea4a558fea701a56f15

SHA1
0545914723624ef6195f6fd841cf500a20f7d1b5

SHA256
ac4e564c52fbf1137318994e3350d3c85dbcadd13a8e21de816e806edc8a6bed

SHA512
2ab3cbb26e5655253cf7588a7bfc12fe748f12b4539f93bd0f1757364a9021271fdcaa4ab588f5393d3da67d5132d785a2ecb20257ed55477fe53dae3b6b2624

Download Submit
memory/408-11-0x00007FF791740000-0x00007FF791B32000-memory.dmp

Filesize
3.9MB

Download
memory/408-2066-0x00007FF791740000-0x00007FF791B32000-memory.dmp

Filesize
3.9MB

Download
memory/572-30-0x00007FF7B5C60000-0x00007FF7B6052000-memory.dmp

Filesize
3.9MB

Download
memory/572-2062-0x00007FF7B5C60000-0x00007FF7B6052000-memory.dmp

Filesize
3.9MB

Download
memory/780-2216-0x00007FF675CA0000-0x00007FF676092000-memory.dmp

Filesize
3.9MB

Download
memory/780-115-0x00007FF675CA0000-0x00007FF676092000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2578-0x00007FF6EA030000-0x00007FF6EA422000-memory.dmp

Filesize
3.9MB

Download
memory/1376-113-0x00007FF6EA030000-0x00007FF6EA422000-memory.dmp

Filesize
3.9MB

Download
memory/1384-2067-0x00007FF63F150000-0x00007FF63F542000-memory.dmp

Filesize
3.9MB

Download
memory/1384-29-0x00007FF63F150000-0x00007FF63F542000-memory.dmp

Filesize
3.9MB

Download
memory/1592-105-0x00007FF6FE060000-0x00007FF6FE452000-memory.dmp

Filesize
3.9MB

Download
memory/1592-2233-0x00007FF6FE060000-0x00007FF6FE452000-memory.dmp

Filesize
3.9MB

Download
memory/1804-89-0x00007FF7E70A0000-0x00007FF7E7492000-memory.dmp

Filesize
3.9MB

Download
memory/1804-2180-0x00007FF7E70A0000-0x00007FF7E7492000-memory.dmp

Filesize
3.9MB

Download
memory/2012-49-0x00007FF718960000-0x00007FF718D52000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2153-0x00007FF718960000-0x00007FF718D52000-memory.dmp

Filesize
3.9MB

Download
memory/2032-2064-0x00007FF7BD3F0000-0x00007FF7BD7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-32-0x00007FF7BD3F0000-0x00007FF7BD7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-61-0x00007FF780340000-0x00007FF780732000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2160-0x00007FF780340000-0x00007FF780732000-memory.dmp

Filesize
3.9MB

Download
memory/2332-128-0x00007FF7BF040000-0x00007FF7BF432000-memory.dmp

Filesize
3.9MB

Download
memory/2332-2778-0x00007FF7BF040000-0x00007FF7BF432000-memory.dmp

Filesize
3.9MB

Download
memory/2864-108-0x00007FF60AED0000-0x00007FF60B2C2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2237-0x00007FF60AED0000-0x00007FF60B2C2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-5208-0x00000232C5A30000-0x00000232C5A40000-memory.dmp

Filesize
64KB

Download
memory/2992-2841-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2992-19-0x00000232C5890000-0x00000232C58B2000-memory.dmp

Filesize
136KB

Download
memory/2992-27-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2992-28-0x00000232C5A30000-0x00000232C5A40000-memory.dmp

Filesize
64KB

Download
memory/2992-5527-0x00000232C5A30000-0x00000232C5A40000-memory.dmp

Filesize
64KB

Download
memory/2992-6038-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/2992-2144-0x00000232C86B0000-0x00000232C8E56000-memory.dmp

Filesize
7.6MB

Download
memory/3252-141-0x00007FF7BD2A0000-0x00007FF7BD692000-memory.dmp

Filesize
3.9MB

Download
memory/3596-2176-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-80-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-31-0x00007FF72EFF0000-0x00007FF72F3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-2088-0x00007FF72EFF0000-0x00007FF72F3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-117-0x00007FF68CF90000-0x00007FF68D382000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2221-0x00007FF68CF90000-0x00007FF68D382000-memory.dmp

Filesize
3.9MB

Download
memory/3980-144-0x00007FF69A030000-0x00007FF69A422000-memory.dmp

Filesize
3.9MB

Download
memory/3980-2731-0x00007FF69A030000-0x00007FF69A422000-memory.dmp

Filesize
3.9MB

Download
memory/4036-155-0x00007FF74F9C0000-0x00007FF74FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4304-98-0x00007FF766730000-0x00007FF766B22000-memory.dmp

Filesize
3.9MB

Download
memory/4304-2219-0x00007FF766730000-0x00007FF766B22000-memory.dmp

Filesize
3.9MB

Download
memory/4464-2249-0x00007FF734000000-0x00007FF7343F2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-118-0x00007FF734000000-0x00007FF7343F2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-1-0x000001BD00500000-0x000001BD00510000-memory.dmp

Filesize
64KB

Download
memory/4832-4383-0x00007FF7B4BE0000-0x00007FF7B4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-0-0x00007FF7B4BE0000-0x00007FF7B4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2215-0x00007FF61E3A0000-0x00007FF61E792000-memory.dmp

Filesize
3.9MB

Download
memory/5080-116-0x00007FF61E3A0000-0x00007FF61E792000-memory.dmp

Filesize
3.9MB

Download