xmrig | 6b7d2f8fd8949818a9e2f8da6ea36ba0b77e9c0a40277dba9b2f1f900916dd89

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
Size

2.3MB
MD5

016011096c324a0236ec7cd2e9d1e0d1
SHA1

6583b7fffd072b681d44c1c8b1ab1435e1d3ee0a
SHA256

6b7d2f8fd8949818a9e2f8da6ea36ba0b77e9c0a40277dba9b2f1f900916dd89
SHA512

52c208692b7d8bc849c025b5336620d15808c586fd7d868bb616e176318007a1849d5624e434cb6c2bcc658a54a7014279a7babba47a773a067b0a578ee93bf6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDiDf:NABr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/4444-166-0x00007FF669CE0000-0x00007FF66A0D2000-memory.dmp	xmrig
behavioral2/memory/4088-247-0x00007FF6C2230000-0x00007FF6C2622000-memory.dmp	xmrig
behavioral2/memory/5020-254-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	xmrig
behavioral2/memory/2112-268-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp	xmrig
behavioral2/memory/2896-270-0x00007FF61E8B0000-0x00007FF61ECA2000-memory.dmp	xmrig
behavioral2/memory/680-269-0x00007FF790CE0000-0x00007FF7910D2000-memory.dmp	xmrig
behavioral2/memory/3464-267-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp	xmrig
behavioral2/memory/4420-265-0x00007FF78D2B0000-0x00007FF78D6A2000-memory.dmp	xmrig
behavioral2/memory/4364-264-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp	xmrig
behavioral2/memory/456-263-0x00007FF732350000-0x00007FF732742000-memory.dmp	xmrig
behavioral2/memory/2032-262-0x00007FF6961E0000-0x00007FF6965D2000-memory.dmp	xmrig
behavioral2/memory/1424-261-0x00007FF6AE1E0000-0x00007FF6AE5D2000-memory.dmp	xmrig
behavioral2/memory/4920-253-0x00007FF78D0C0000-0x00007FF78D4B2000-memory.dmp	xmrig
behavioral2/memory/1940-240-0x00007FF75A030000-0x00007FF75A422000-memory.dmp	xmrig
behavioral2/memory/3904-211-0x00007FF7ADBF0000-0x00007FF7ADFE2000-memory.dmp	xmrig
behavioral2/memory/732-193-0x00007FF75EE70000-0x00007FF75F262000-memory.dmp	xmrig
behavioral2/memory/2612-167-0x00007FF7627D0000-0x00007FF762BC2000-memory.dmp	xmrig
behavioral2/memory/4488-144-0x00007FF612B30000-0x00007FF612F22000-memory.dmp	xmrig
behavioral2/memory/212-104-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp	xmrig
behavioral2/memory/4540-62-0x00007FF7914B0000-0x00007FF7918A2000-memory.dmp	xmrig
behavioral2/memory/212-4239-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp	xmrig
behavioral2/memory/3464-4242-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp	xmrig
behavioral2/memory/2112-4357-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp	xmrig
behavioral2/memory/4364-4370-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp	xmrig
behavioral2/memory/4420-4393-0x00007FF78D2B0000-0x00007FF78D6A2000-memory.dmp	xmrig
behavioral2/memory/456-4384-0x00007FF732350000-0x00007FF732742000-memory.dmp	xmrig
behavioral2/memory/3904-4383-0x00007FF7ADBF0000-0x00007FF7ADFE2000-memory.dmp	xmrig
behavioral2/memory/2032-4377-0x00007FF6961E0000-0x00007FF6965D2000-memory.dmp	xmrig
behavioral2/memory/5020-4375-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	xmrig
behavioral2/memory/2896-4373-0x00007FF61E8B0000-0x00007FF61ECA2000-memory.dmp	xmrig
behavioral2/memory/4088-4381-0x00007FF6C2230000-0x00007FF6C2622000-memory.dmp	xmrig
behavioral2/memory/1424-4379-0x00007FF6AE1E0000-0x00007FF6AE5D2000-memory.dmp	xmrig
behavioral2/memory/4920-4366-0x00007FF78D0C0000-0x00007FF78D4B2000-memory.dmp	xmrig
behavioral2/memory/4444-4361-0x00007FF669CE0000-0x00007FF66A0D2000-memory.dmp	xmrig
behavioral2/memory/1940-4359-0x00007FF75A030000-0x00007FF75A422000-memory.dmp	xmrig
behavioral2/memory/680-4363-0x00007FF790CE0000-0x00007FF7910D2000-memory.dmp	xmrig
behavioral2/memory/2656-4353-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp	xmrig
behavioral2/memory/732-4299-0x00007FF75EE70000-0x00007FF75F262000-memory.dmp	xmrig
behavioral2/memory/4488-4294-0x00007FF612B30000-0x00007FF612F22000-memory.dmp	xmrig
behavioral2/memory/248-4552-0x00007FF6776B0000-0x00007FF677AA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3464	SLCRgrS.exe
4540	dRprzTc.exe
2656	RNzxZEI.exe
212	GEKXaIV.exe
4488	SGppQzB.exe
4444	FoNYEPf.exe
2612	KOdnhjl.exe
732	WjjHJDl.exe
2112	TlGcNal.exe
3904	MTYSmAL.exe
1940	NPtIjxl.exe
4088	CldodyZ.exe
4920	QWEatwH.exe
680	iZjhUsf.exe
5020	lPXHQDn.exe
1424	wDZeFwI.exe
2032	ZSMXncy.exe
456	BcnSCIc.exe
2896	gUcANzO.exe
4364	dXsiopi.exe
4420	jNYgIYp.exe
4916	QWkrSxL.exe
4288	IadlEbc.exe
816	YSRDIVK.exe
2096	KggacdG.exe
2152	YpdCEtA.exe
4324	XigNgKv.exe
3180	COuXuTf.exe
2188	OupdpqK.exe
8	cGcHjru.exe
3144	lPzzWFv.exe
2908	ZCbjNTF.exe
424	ALTKlvA.exe
4352	TxEhsFa.exe
1096	GmzdLjH.exe
2948	cisxKLV.exe
3944	dcPTKpt.exe
3596	uWTsjTS.exe
4824	TDRcpSL.exe
2148	CYIVjqZ.exe
944	jfLeZLF.exe
900	BefCqmR.exe
1068	hdpeiKf.exe
1344	sPIWLHJ.exe
4068	qMeGslF.exe
2064	WcxMKHd.exe
824	XBYifnC.exe
4820	mTFnlml.exe
3100	PisizxV.exe
4880	UUwOcBq.exe
3424	dqGTsYU.exe
4416	FxssbBX.exe
4868	UaiDXLm.exe
2552	XJMLlZN.exe
1856	ryyMFbK.exe
2844	fhHdyAb.exe
472	ypRbLoX.exe
2912	CtlcyCA.exe
3348	XWosIcM.exe
1080	lrswuJK.exe
4796	ISOoYyN.exe
4848	XMaorLn.exe
668	doNkOyw.exe
5104	nDMcdFo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/248-0-0x00007FF6776B0000-0x00007FF677AA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-15.dat	upx
behavioral2/files/0x000a000000023b8c-26.dat	upx
behavioral2/files/0x000a000000023b94-65.dat	upx
behavioral2/files/0x000a000000023b8f-82.dat	upx
behavioral2/files/0x000a000000023b9c-103.dat	upx
behavioral2/files/0x000a000000023b95-130.dat	upx
behavioral2/memory/4444-166-0x00007FF669CE0000-0x00007FF66A0D2000-memory.dmp	upx
behavioral2/memory/4088-247-0x00007FF6C2230000-0x00007FF6C2622000-memory.dmp	upx
behavioral2/memory/5020-254-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp	upx
behavioral2/memory/2112-268-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp	upx
behavioral2/memory/2896-270-0x00007FF61E8B0000-0x00007FF61ECA2000-memory.dmp	upx
behavioral2/memory/680-269-0x00007FF790CE0000-0x00007FF7910D2000-memory.dmp	upx
behavioral2/memory/3464-267-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp	upx
behavioral2/memory/4420-265-0x00007FF78D2B0000-0x00007FF78D6A2000-memory.dmp	upx
behavioral2/memory/4364-264-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp	upx
behavioral2/memory/456-263-0x00007FF732350000-0x00007FF732742000-memory.dmp	upx
behavioral2/memory/2032-262-0x00007FF6961E0000-0x00007FF6965D2000-memory.dmp	upx
behavioral2/memory/1424-261-0x00007FF6AE1E0000-0x00007FF6AE5D2000-memory.dmp	upx
behavioral2/memory/4920-253-0x00007FF78D0C0000-0x00007FF78D4B2000-memory.dmp	upx
behavioral2/memory/1940-240-0x00007FF75A030000-0x00007FF75A422000-memory.dmp	upx
behavioral2/memory/3904-211-0x00007FF7ADBF0000-0x00007FF7ADFE2000-memory.dmp	upx
behavioral2/memory/732-193-0x00007FF75EE70000-0x00007FF75F262000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-175.dat	upx
behavioral2/files/0x000a000000023bab-174.dat	upx
behavioral2/files/0x000a000000023baa-173.dat	upx
behavioral2/files/0x000a000000023ba4-171.dat	upx
behavioral2/files/0x000a000000023b9f-169.dat	upx
behavioral2/memory/2612-167-0x00007FF7627D0000-0x00007FF762BC2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-165.dat	upx
behavioral2/files/0x000a000000023ba8-164.dat	upx
behavioral2/files/0x000a000000023ba7-163.dat	upx
behavioral2/files/0x000a000000023ba6-162.dat	upx
behavioral2/files/0x000a000000023b9b-155.dat	upx
behavioral2/files/0x000a000000023ba5-154.dat	upx
behavioral2/files/0x000c000000023b85-168.dat	upx
behavioral2/files/0x000a000000023b9e-148.dat	upx
behavioral2/files/0x000a000000023ba3-147.dat	upx
behavioral2/memory/4488-144-0x00007FF612B30000-0x00007FF612F22000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-141.dat	upx
behavioral2/files/0x000a000000023ba1-139.dat	upx
behavioral2/files/0x000a000000023b9a-135.dat	upx
behavioral2/files/0x000a000000023b99-132.dat	upx
behavioral2/files/0x000a000000023b98-127.dat	upx
behavioral2/files/0x000a000000023b96-119.dat	upx
behavioral2/files/0x000a000000023b92-113.dat	upx
behavioral2/files/0x000a000000023b9d-107.dat	upx
behavioral2/memory/212-104-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-122.dat	upx
behavioral2/files/0x000a000000023b93-92.dat	upx
behavioral2/files/0x000a000000023b90-90.dat	upx
behavioral2/memory/2656-79-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-93.dat	upx
behavioral2/files/0x000a000000023b8d-73.dat	upx
behavioral2/memory/4540-62-0x00007FF7914B0000-0x00007FF7918A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-52.dat	upx
behavioral2/files/0x000a000000023b8e-39.dat	upx
behavioral2/files/0x000c000000023b80-23.dat	upx
behavioral2/files/0x000a000000023b89-31.dat	upx
behavioral2/files/0x000a000000023b88-17.dat	upx
behavioral2/memory/212-4239-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp	upx
behavioral2/memory/3464-4242-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp	upx
behavioral2/memory/2112-4357-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp	upx
behavioral2/memory/4364-4370-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pyQNEgO.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\mAqbqBP.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\bEkyUFw.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\SMGZaGD.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\DoQXtLN.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\KqlNtWk.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\GOFQbLB.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\zrZKlzz.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\dxoILPC.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\KSboPJu.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\yCElkTF.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\XHMZhQl.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\bdzaiZj.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\fYJwUBk.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\CGYhcAv.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\uzOlWkG.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\zgdeAKc.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\IMpHOfz.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\cgvOeQw.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\mgPhzvf.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\IcWWBVS.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\jXrVYRF.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\mXSIXrh.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\SbcaJTE.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\JWFsEFe.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\XuuWhKg.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\IseuSVj.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\lNIunUx.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\sKvGQnd.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\TDRcpSL.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\QHpHPKG.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\IpjqFbU.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\sVZhKKL.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\pNvjYXY.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\bYGhMBo.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\lkyZctc.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\vDxSysP.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\DcSZjFu.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\WQlSoCK.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\UAbulqo.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\UuUqRaS.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\oOCTaPd.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\VdXACQG.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\nLDywbr.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\KKTDSzq.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\YmnzZsr.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\XQnURdF.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\qCiOjBE.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\gUiCPwL.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\xRLeqsD.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\MMZsxzo.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\oxRRYkv.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\yrliQfH.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\tmgJqww.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\XvWqAlJ.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\RXdkoQt.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\WcGaabf.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\gBphyfa.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\unqWDSP.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\fnIwzXi.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\zXYjdRe.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\OUGxzMM.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\IstlWFn.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
File created	C:\Windows\System\WZAjxyU.exe	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	powershell.exe
220	powershell.exe
220	powershell.exe
220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	powershell.exe
Token: SeLockMemoryPrivilege	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 220	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	85
PID 248 wrote to memory of 220	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	85
PID 248 wrote to memory of 3464	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	86
PID 248 wrote to memory of 3464	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	86
PID 248 wrote to memory of 212	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	87
PID 248 wrote to memory of 212	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	87
PID 248 wrote to memory of 4540	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	88
PID 248 wrote to memory of 4540	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	88
PID 248 wrote to memory of 2656	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	89
PID 248 wrote to memory of 2656	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	89
PID 248 wrote to memory of 4488	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	90
PID 248 wrote to memory of 4488	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	90
PID 248 wrote to memory of 4444	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	91
PID 248 wrote to memory of 4444	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	91
PID 248 wrote to memory of 2612	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	92
PID 248 wrote to memory of 2612	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	92
PID 248 wrote to memory of 732	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	93
PID 248 wrote to memory of 732	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	93
PID 248 wrote to memory of 2112	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	94
PID 248 wrote to memory of 2112	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	94
PID 248 wrote to memory of 3904	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	95
PID 248 wrote to memory of 3904	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	95
PID 248 wrote to memory of 1940	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	96
PID 248 wrote to memory of 1940	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	96
PID 248 wrote to memory of 4088	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	97
PID 248 wrote to memory of 4088	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	97
PID 248 wrote to memory of 4920	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	98
PID 248 wrote to memory of 4920	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	98
PID 248 wrote to memory of 680	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	99
PID 248 wrote to memory of 680	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	99
PID 248 wrote to memory of 5020	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	100
PID 248 wrote to memory of 5020	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	100
PID 248 wrote to memory of 1424	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	101
PID 248 wrote to memory of 1424	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	101
PID 248 wrote to memory of 2032	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	102
PID 248 wrote to memory of 2032	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	102
PID 248 wrote to memory of 456	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	103
PID 248 wrote to memory of 456	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	103
PID 248 wrote to memory of 2896	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	104
PID 248 wrote to memory of 2896	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	104
PID 248 wrote to memory of 4364	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	105
PID 248 wrote to memory of 4364	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	105
PID 248 wrote to memory of 4420	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	106
PID 248 wrote to memory of 4420	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	106
PID 248 wrote to memory of 4916	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	107
PID 248 wrote to memory of 4916	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	107
PID 248 wrote to memory of 4288	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	108
PID 248 wrote to memory of 4288	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	108
PID 248 wrote to memory of 816	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	109
PID 248 wrote to memory of 816	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	109
PID 248 wrote to memory of 2096	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	110
PID 248 wrote to memory of 2096	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	110
PID 248 wrote to memory of 2152	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	111
PID 248 wrote to memory of 2152	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	111
PID 248 wrote to memory of 4324	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	112
PID 248 wrote to memory of 4324	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	112
PID 248 wrote to memory of 3180	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	113
PID 248 wrote to memory of 3180	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	113
PID 248 wrote to memory of 2188	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	114
PID 248 wrote to memory of 2188	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	114
PID 248 wrote to memory of 8	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	115
PID 248 wrote to memory of 8	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	115
PID 248 wrote to memory of 3144	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	116
PID 248 wrote to memory of 3144	248	016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\016011096c324a0236ec7cd2e9d1e0d1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\System\SLCRgrS.exe
  C:\Windows\System\SLCRgrS.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\GEKXaIV.exe
  C:\Windows\System\GEKXaIV.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\dRprzTc.exe
  C:\Windows\System\dRprzTc.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\RNzxZEI.exe
  C:\Windows\System\RNzxZEI.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\SGppQzB.exe
  C:\Windows\System\SGppQzB.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\FoNYEPf.exe
  C:\Windows\System\FoNYEPf.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\KOdnhjl.exe
  C:\Windows\System\KOdnhjl.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\WjjHJDl.exe
  C:\Windows\System\WjjHJDl.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\TlGcNal.exe
  C:\Windows\System\TlGcNal.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\MTYSmAL.exe
  C:\Windows\System\MTYSmAL.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\NPtIjxl.exe
  C:\Windows\System\NPtIjxl.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\CldodyZ.exe
  C:\Windows\System\CldodyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QWEatwH.exe
  C:\Windows\System\QWEatwH.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\iZjhUsf.exe
  C:\Windows\System\iZjhUsf.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\lPXHQDn.exe
  C:\Windows\System\lPXHQDn.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\wDZeFwI.exe
  C:\Windows\System\wDZeFwI.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\ZSMXncy.exe
  C:\Windows\System\ZSMXncy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\BcnSCIc.exe
  C:\Windows\System\BcnSCIc.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\gUcANzO.exe
  C:\Windows\System\gUcANzO.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\dXsiopi.exe
  C:\Windows\System\dXsiopi.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\jNYgIYp.exe
  C:\Windows\System\jNYgIYp.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\QWkrSxL.exe
  C:\Windows\System\QWkrSxL.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\IadlEbc.exe
  C:\Windows\System\IadlEbc.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\YSRDIVK.exe
  C:\Windows\System\YSRDIVK.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\KggacdG.exe
  C:\Windows\System\KggacdG.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\YpdCEtA.exe
  C:\Windows\System\YpdCEtA.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\XigNgKv.exe
  C:\Windows\System\XigNgKv.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\COuXuTf.exe
  C:\Windows\System\COuXuTf.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\OupdpqK.exe
  C:\Windows\System\OupdpqK.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\cGcHjru.exe
  C:\Windows\System\cGcHjru.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\lPzzWFv.exe
  C:\Windows\System\lPzzWFv.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ZCbjNTF.exe
  C:\Windows\System\ZCbjNTF.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ALTKlvA.exe
  C:\Windows\System\ALTKlvA.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\TxEhsFa.exe
  C:\Windows\System\TxEhsFa.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\GmzdLjH.exe
  C:\Windows\System\GmzdLjH.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\cisxKLV.exe
  C:\Windows\System\cisxKLV.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\dcPTKpt.exe
  C:\Windows\System\dcPTKpt.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\uWTsjTS.exe
  C:\Windows\System\uWTsjTS.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\TDRcpSL.exe
  C:\Windows\System\TDRcpSL.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\CYIVjqZ.exe
  C:\Windows\System\CYIVjqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\jfLeZLF.exe
  C:\Windows\System\jfLeZLF.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\BefCqmR.exe
  C:\Windows\System\BefCqmR.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\PisizxV.exe
  C:\Windows\System\PisizxV.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\hdpeiKf.exe
  C:\Windows\System\hdpeiKf.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\sPIWLHJ.exe
  C:\Windows\System\sPIWLHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\qMeGslF.exe
  C:\Windows\System\qMeGslF.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\WcxMKHd.exe
  C:\Windows\System\WcxMKHd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\XBYifnC.exe
  C:\Windows\System\XBYifnC.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\mTFnlml.exe
  C:\Windows\System\mTFnlml.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\UUwOcBq.exe
  C:\Windows\System\UUwOcBq.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\fhHdyAb.exe
  C:\Windows\System\fhHdyAb.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\dqGTsYU.exe
  C:\Windows\System\dqGTsYU.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\FxssbBX.exe
  C:\Windows\System\FxssbBX.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\UaiDXLm.exe
  C:\Windows\System\UaiDXLm.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\XJMLlZN.exe
  C:\Windows\System\XJMLlZN.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ryyMFbK.exe
  C:\Windows\System\ryyMFbK.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ypRbLoX.exe
  C:\Windows\System\ypRbLoX.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\CtlcyCA.exe
  C:\Windows\System\CtlcyCA.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\XWosIcM.exe
  C:\Windows\System\XWosIcM.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\lrswuJK.exe
  C:\Windows\System\lrswuJK.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ISOoYyN.exe
  C:\Windows\System\ISOoYyN.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\XMaorLn.exe
  C:\Windows\System\XMaorLn.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\doNkOyw.exe
  C:\Windows\System\doNkOyw.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\nDMcdFo.exe
  C:\Windows\System\nDMcdFo.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\qPVWWIc.exe
  C:\Windows\System\qPVWWIc.exe
  2⤵
  PID:4228
- C:\Windows\System\pozRHPu.exe
  C:\Windows\System\pozRHPu.exe
  2⤵
  PID:5000
- C:\Windows\System\DCqFwcb.exe
  C:\Windows\System\DCqFwcb.exe
  2⤵
  PID:3224
- C:\Windows\System\oSjwPQT.exe
  C:\Windows\System\oSjwPQT.exe
  2⤵
  PID:4780
- C:\Windows\System\fDyTACi.exe
  C:\Windows\System\fDyTACi.exe
  2⤵
  PID:3460
- C:\Windows\System\fMWzCsD.exe
  C:\Windows\System\fMWzCsD.exe
  2⤵
  PID:2704
- C:\Windows\System\rbiphqm.exe
  C:\Windows\System\rbiphqm.exe
  2⤵
  PID:1268
- C:\Windows\System\dpUwXHA.exe
  C:\Windows\System\dpUwXHA.exe
  2⤵
  PID:2016
- C:\Windows\System\xpeBzoM.exe
  C:\Windows\System\xpeBzoM.exe
  2⤵
  PID:4588
- C:\Windows\System\usNiNxE.exe
  C:\Windows\System\usNiNxE.exe
  2⤵
  PID:1772
- C:\Windows\System\RWUBgMq.exe
  C:\Windows\System\RWUBgMq.exe
  2⤵
  PID:4568
- C:\Windows\System\zRSXEPV.exe
  C:\Windows\System\zRSXEPV.exe
  2⤵
  PID:3204
- C:\Windows\System\VbeBjUB.exe
  C:\Windows\System\VbeBjUB.exe
  2⤵
  PID:4040
- C:\Windows\System\XEMMVEL.exe
  C:\Windows\System\XEMMVEL.exe
  2⤵
  PID:4424
- C:\Windows\System\uuunCCq.exe
  C:\Windows\System\uuunCCq.exe
  2⤵
  PID:828
- C:\Windows\System\LbOpbPr.exe
  C:\Windows\System\LbOpbPr.exe
  2⤵
  PID:3468
- C:\Windows\System\iiqxbtY.exe
  C:\Windows\System\iiqxbtY.exe
  2⤵
  PID:5072
- C:\Windows\System\JcSKiAk.exe
  C:\Windows\System\JcSKiAk.exe
  2⤵
  PID:3620
- C:\Windows\System\qKmjTID.exe
  C:\Windows\System\qKmjTID.exe
  2⤵
  PID:4300
- C:\Windows\System\nKkFGbm.exe
  C:\Windows\System\nKkFGbm.exe
  2⤵
  PID:1276
- C:\Windows\System\gpHTsbh.exe
  C:\Windows\System\gpHTsbh.exe
  2⤵
  PID:1272
- C:\Windows\System\ODrIici.exe
  C:\Windows\System\ODrIici.exe
  2⤵
  PID:4608
- C:\Windows\System\fRWhbXw.exe
  C:\Windows\System\fRWhbXw.exe
  2⤵
  PID:468
- C:\Windows\System\RfZfDSc.exe
  C:\Windows\System\RfZfDSc.exe
  2⤵
  PID:4992
- C:\Windows\System\VVbidUJ.exe
  C:\Windows\System\VVbidUJ.exe
  2⤵
  PID:3412
- C:\Windows\System\MXCfbla.exe
  C:\Windows\System\MXCfbla.exe
  2⤵
  PID:3532
- C:\Windows\System\dhqyHwI.exe
  C:\Windows\System\dhqyHwI.exe
  2⤵
  PID:2404
- C:\Windows\System\FIjlUpr.exe
  C:\Windows\System\FIjlUpr.exe
  2⤵
  PID:3628
- C:\Windows\System\wGGntos.exe
  C:\Windows\System\wGGntos.exe
  2⤵
  PID:4388
- C:\Windows\System\APoQnAJ.exe
  C:\Windows\System\APoQnAJ.exe
  2⤵
  PID:780
- C:\Windows\System\GOAEmWM.exe
  C:\Windows\System\GOAEmWM.exe
  2⤵
  PID:4076
- C:\Windows\System\gsiLtHK.exe
  C:\Windows\System\gsiLtHK.exe
  2⤵
  PID:1848
- C:\Windows\System\xGZDlYC.exe
  C:\Windows\System\xGZDlYC.exe
  2⤵
  PID:4032
- C:\Windows\System\PKAzkFI.exe
  C:\Windows\System\PKAzkFI.exe
  2⤵
  PID:2300
- C:\Windows\System\xknjnqX.exe
  C:\Windows\System\xknjnqX.exe
  2⤵
  PID:5136
- C:\Windows\System\nSLoRQr.exe
  C:\Windows\System\nSLoRQr.exe
  2⤵
  PID:5156
- C:\Windows\System\xwqzZfF.exe
  C:\Windows\System\xwqzZfF.exe
  2⤵
  PID:5180
- C:\Windows\System\LdfbqPy.exe
  C:\Windows\System\LdfbqPy.exe
  2⤵
  PID:5204
- C:\Windows\System\TlngtUh.exe
  C:\Windows\System\TlngtUh.exe
  2⤵
  PID:5228
- C:\Windows\System\nacnirI.exe
  C:\Windows\System\nacnirI.exe
  2⤵
  PID:5252
- C:\Windows\System\rHfJKIh.exe
  C:\Windows\System\rHfJKIh.exe
  2⤵
  PID:5276
- C:\Windows\System\SpiOyWZ.exe
  C:\Windows\System\SpiOyWZ.exe
  2⤵
  PID:5300
- C:\Windows\System\SXZdsLt.exe
  C:\Windows\System\SXZdsLt.exe
  2⤵
  PID:5320
- C:\Windows\System\MXIbpBZ.exe
  C:\Windows\System\MXIbpBZ.exe
  2⤵
  PID:5344
- C:\Windows\System\HVOOnpU.exe
  C:\Windows\System\HVOOnpU.exe
  2⤵
  PID:5364
- C:\Windows\System\mkDOojT.exe
  C:\Windows\System\mkDOojT.exe
  2⤵
  PID:5380
- C:\Windows\System\vBOwBZP.exe
  C:\Windows\System\vBOwBZP.exe
  2⤵
  PID:5404
- C:\Windows\System\AUmvahI.exe
  C:\Windows\System\AUmvahI.exe
  2⤵
  PID:5440
- C:\Windows\System\ALSZLDC.exe
  C:\Windows\System\ALSZLDC.exe
  2⤵
  PID:5460
- C:\Windows\System\RzIvSGP.exe
  C:\Windows\System\RzIvSGP.exe
  2⤵
  PID:5484
- C:\Windows\System\HYRVyaU.exe
  C:\Windows\System\HYRVyaU.exe
  2⤵
  PID:5504
- C:\Windows\System\LMRVvak.exe
  C:\Windows\System\LMRVvak.exe
  2⤵
  PID:5528
- C:\Windows\System\ejZmYsW.exe
  C:\Windows\System\ejZmYsW.exe
  2⤵
  PID:5556
- C:\Windows\System\ndMzUWB.exe
  C:\Windows\System\ndMzUWB.exe
  2⤵
  PID:5572
- C:\Windows\System\REhQbLL.exe
  C:\Windows\System\REhQbLL.exe
  2⤵
  PID:5592
- C:\Windows\System\lymNnGJ.exe
  C:\Windows\System\lymNnGJ.exe
  2⤵
  PID:5616
- C:\Windows\System\YIVEaRo.exe
  C:\Windows\System\YIVEaRo.exe
  2⤵
  PID:5644
- C:\Windows\System\apATYxE.exe
  C:\Windows\System\apATYxE.exe
  2⤵
  PID:5664
- C:\Windows\System\tfkMstU.exe
  C:\Windows\System\tfkMstU.exe
  2⤵
  PID:5688
- C:\Windows\System\nJVOEAI.exe
  C:\Windows\System\nJVOEAI.exe
  2⤵
  PID:5716
- C:\Windows\System\MHefZJj.exe
  C:\Windows\System\MHefZJj.exe
  2⤵
  PID:5740
- C:\Windows\System\dRmeiic.exe
  C:\Windows\System\dRmeiic.exe
  2⤵
  PID:5760
- C:\Windows\System\EDRYfsa.exe
  C:\Windows\System\EDRYfsa.exe
  2⤵
  PID:5784
- C:\Windows\System\NTIYVQF.exe
  C:\Windows\System\NTIYVQF.exe
  2⤵
  PID:5812
- C:\Windows\System\bhTfjqy.exe
  C:\Windows\System\bhTfjqy.exe
  2⤵
  PID:5828
- C:\Windows\System\OtffJko.exe
  C:\Windows\System\OtffJko.exe
  2⤵
  PID:5860
- C:\Windows\System\MAbnWvk.exe
  C:\Windows\System\MAbnWvk.exe
  2⤵
  PID:5880
- C:\Windows\System\zpMjINq.exe
  C:\Windows\System\zpMjINq.exe
  2⤵
  PID:5900
- C:\Windows\System\HVPJPDh.exe
  C:\Windows\System\HVPJPDh.exe
  2⤵
  PID:5924
- C:\Windows\System\gqNuXIf.exe
  C:\Windows\System\gqNuXIf.exe
  2⤵
  PID:5944
- C:\Windows\System\VJkeQKl.exe
  C:\Windows\System\VJkeQKl.exe
  2⤵
  PID:5964
- C:\Windows\System\vGYOdJx.exe
  C:\Windows\System\vGYOdJx.exe
  2⤵
  PID:5988
- C:\Windows\System\TubCffG.exe
  C:\Windows\System\TubCffG.exe
  2⤵
  PID:6020
- C:\Windows\System\PSmsBFO.exe
  C:\Windows\System\PSmsBFO.exe
  2⤵
  PID:6048
- C:\Windows\System\zZOGdRl.exe
  C:\Windows\System\zZOGdRl.exe
  2⤵
  PID:6068
- C:\Windows\System\ZTVOWxO.exe
  C:\Windows\System\ZTVOWxO.exe
  2⤵
  PID:6088
- C:\Windows\System\BlYpxSN.exe
  C:\Windows\System\BlYpxSN.exe
  2⤵
  PID:6116
- C:\Windows\System\FxFixpZ.exe
  C:\Windows\System\FxFixpZ.exe
  2⤵
  PID:6136
- C:\Windows\System\DbSvvJU.exe
  C:\Windows\System\DbSvvJU.exe
  2⤵
  PID:3964
- C:\Windows\System\IEGYWlM.exe
  C:\Windows\System\IEGYWlM.exe
  2⤵
  PID:4308
- C:\Windows\System\MIWydtx.exe
  C:\Windows\System\MIWydtx.exe
  2⤵
  PID:5148
- C:\Windows\System\AvCkqTq.exe
  C:\Windows\System\AvCkqTq.exe
  2⤵
  PID:5188
- C:\Windows\System\iBbnQaR.exe
  C:\Windows\System\iBbnQaR.exe
  2⤵
  PID:5244
- C:\Windows\System\JDOfThG.exe
  C:\Windows\System\JDOfThG.exe
  2⤵
  PID:5416
- C:\Windows\System\JBpbhdS.exe
  C:\Windows\System\JBpbhdS.exe
  2⤵
  PID:5312
- C:\Windows\System\VBBDpQc.exe
  C:\Windows\System\VBBDpQc.exe
  2⤵
  PID:5336
- C:\Windows\System\rJXENyw.exe
  C:\Windows\System\rJXENyw.exe
  2⤵
  PID:5396
- C:\Windows\System\VMghjZo.exe
  C:\Windows\System\VMghjZo.exe
  2⤵
  PID:5564
- C:\Windows\System\OIMwYrP.exe
  C:\Windows\System\OIMwYrP.exe
  2⤵
  PID:5400
- C:\Windows\System\LgrJGLR.exe
  C:\Windows\System\LgrJGLR.exe
  2⤵
  PID:5452
- C:\Windows\System\mYlMjDc.exe
  C:\Windows\System\mYlMjDc.exe
  2⤵
  PID:5696
- C:\Windows\System\hzhdJvY.exe
  C:\Windows\System\hzhdJvY.exe
  2⤵
  PID:5580
- C:\Windows\System\KTKfVYD.exe
  C:\Windows\System\KTKfVYD.exe
  2⤵
  PID:5640
- C:\Windows\System\MOJHpBg.exe
  C:\Windows\System\MOJHpBg.exe
  2⤵
  PID:5780
- C:\Windows\System\ZXboIUV.exe
  C:\Windows\System\ZXboIUV.exe
  2⤵
  PID:5836
- C:\Windows\System\uLTNdNp.exe
  C:\Windows\System\uLTNdNp.exe
  2⤵
  PID:6064
- C:\Windows\System\OnhLTRw.exe
  C:\Windows\System\OnhLTRw.exe
  2⤵
  PID:5732
- C:\Windows\System\JOFOwIj.exe
  C:\Windows\System\JOFOwIj.exe
  2⤵
  PID:3000
- C:\Windows\System\vqsGriE.exe
  C:\Windows\System\vqsGriE.exe
  2⤵
  PID:5216
- C:\Windows\System\yHnewBi.exe
  C:\Windows\System\yHnewBi.exe
  2⤵
  PID:5892
- C:\Windows\System\AgRUlfm.exe
  C:\Windows\System\AgRUlfm.exe
  2⤵
  PID:6168
- C:\Windows\System\qGolhoK.exe
  C:\Windows\System\qGolhoK.exe
  2⤵
  PID:6192
- C:\Windows\System\jwerTlr.exe
  C:\Windows\System\jwerTlr.exe
  2⤵
  PID:6208
- C:\Windows\System\OjYWelu.exe
  C:\Windows\System\OjYWelu.exe
  2⤵
  PID:6244
- C:\Windows\System\ICyjOdu.exe
  C:\Windows\System\ICyjOdu.exe
  2⤵
  PID:6260
- C:\Windows\System\WxFiipD.exe
  C:\Windows\System\WxFiipD.exe
  2⤵
  PID:6280
- C:\Windows\System\DcpRybK.exe
  C:\Windows\System\DcpRybK.exe
  2⤵
  PID:6304
- C:\Windows\System\hyrHmFv.exe
  C:\Windows\System\hyrHmFv.exe
  2⤵
  PID:6324
- C:\Windows\System\XTrDjIJ.exe
  C:\Windows\System\XTrDjIJ.exe
  2⤵
  PID:6352
- C:\Windows\System\aySaPOD.exe
  C:\Windows\System\aySaPOD.exe
  2⤵
  PID:6376
- C:\Windows\System\hVibjsR.exe
  C:\Windows\System\hVibjsR.exe
  2⤵
  PID:6400
- C:\Windows\System\pyUFVeH.exe
  C:\Windows\System\pyUFVeH.exe
  2⤵
  PID:6420
- C:\Windows\System\vIxtfHT.exe
  C:\Windows\System\vIxtfHT.exe
  2⤵
  PID:6448
- C:\Windows\System\pbHdJuR.exe
  C:\Windows\System\pbHdJuR.exe
  2⤵
  PID:6468
- C:\Windows\System\YDeJWlb.exe
  C:\Windows\System\YDeJWlb.exe
  2⤵
  PID:6496
- C:\Windows\System\NMyKdAb.exe
  C:\Windows\System\NMyKdAb.exe
  2⤵
  PID:6512
- C:\Windows\System\FxdtBMa.exe
  C:\Windows\System\FxdtBMa.exe
  2⤵
  PID:6536
- C:\Windows\System\OXkKwmw.exe
  C:\Windows\System\OXkKwmw.exe
  2⤵
  PID:6560
- C:\Windows\System\XeMwoVA.exe
  C:\Windows\System\XeMwoVA.exe
  2⤵
  PID:6584
- C:\Windows\System\STpfhiW.exe
  C:\Windows\System\STpfhiW.exe
  2⤵
  PID:6604
- C:\Windows\System\rsPjFGs.exe
  C:\Windows\System\rsPjFGs.exe
  2⤵
  PID:6624
- C:\Windows\System\BNioEee.exe
  C:\Windows\System\BNioEee.exe
  2⤵
  PID:6648
- C:\Windows\System\EwsAFYu.exe
  C:\Windows\System\EwsAFYu.exe
  2⤵
  PID:6668
- C:\Windows\System\dqwoYAC.exe
  C:\Windows\System\dqwoYAC.exe
  2⤵
  PID:6692
- C:\Windows\System\KfKbcZL.exe
  C:\Windows\System\KfKbcZL.exe
  2⤵
  PID:6712
- C:\Windows\System\vtYTvBN.exe
  C:\Windows\System\vtYTvBN.exe
  2⤵
  PID:6740
- C:\Windows\System\KTeQGai.exe
  C:\Windows\System\KTeQGai.exe
  2⤵
  PID:6760
- C:\Windows\System\KsgwiVa.exe
  C:\Windows\System\KsgwiVa.exe
  2⤵
  PID:6788
- C:\Windows\System\hIKirHA.exe
  C:\Windows\System\hIKirHA.exe
  2⤵
  PID:6808
- C:\Windows\System\lJvzsjE.exe
  C:\Windows\System\lJvzsjE.exe
  2⤵
  PID:6832
- C:\Windows\System\DXbIUpz.exe
  C:\Windows\System\DXbIUpz.exe
  2⤵
  PID:6852
- C:\Windows\System\uxkJcyw.exe
  C:\Windows\System\uxkJcyw.exe
  2⤵
  PID:6876
- C:\Windows\System\dfLIkbF.exe
  C:\Windows\System\dfLIkbF.exe
  2⤵
  PID:6900
- C:\Windows\System\zutcPVi.exe
  C:\Windows\System\zutcPVi.exe
  2⤵
  PID:6920
- C:\Windows\System\ECkypSd.exe
  C:\Windows\System\ECkypSd.exe
  2⤵
  PID:6944
- C:\Windows\System\AoIaLIn.exe
  C:\Windows\System\AoIaLIn.exe
  2⤵
  PID:6964
- C:\Windows\System\ieKVXOs.exe
  C:\Windows\System\ieKVXOs.exe
  2⤵
  PID:6988
- C:\Windows\System\GPyXBDu.exe
  C:\Windows\System\GPyXBDu.exe
  2⤵
  PID:7012
- C:\Windows\System\HoodXRl.exe
  C:\Windows\System\HoodXRl.exe
  2⤵
  PID:7032
- C:\Windows\System\XfGPCXu.exe
  C:\Windows\System\XfGPCXu.exe
  2⤵
  PID:7052
- C:\Windows\System\fTRezia.exe
  C:\Windows\System\fTRezia.exe
  2⤵
  PID:7076
- C:\Windows\System\okVrzSE.exe
  C:\Windows\System\okVrzSE.exe
  2⤵
  PID:7100
- C:\Windows\System\JVIZekl.exe
  C:\Windows\System\JVIZekl.exe
  2⤵
  PID:7124
- C:\Windows\System\DsCEKVK.exe
  C:\Windows\System\DsCEKVK.exe
  2⤵
  PID:7148
- C:\Windows\System\vJTOnuq.exe
  C:\Windows\System\vJTOnuq.exe
  2⤵
  PID:5896
- C:\Windows\System\ZqwHzUp.exe
  C:\Windows\System\ZqwHzUp.exe
  2⤵
  PID:6104
- C:\Windows\System\FBAkDPB.exe
  C:\Windows\System\FBAkDPB.exe
  2⤵
  PID:2916
- C:\Windows\System\bnGPinp.exe
  C:\Windows\System\bnGPinp.exe
  2⤵
  PID:5848
- C:\Windows\System\PloJnlZ.exe
  C:\Windows\System\PloJnlZ.exe
  2⤵
  PID:5984
- C:\Windows\System\xOMWWQL.exe
  C:\Windows\System\xOMWWQL.exe
  2⤵
  PID:5132
- C:\Windows\System\ELHiNmc.exe
  C:\Windows\System\ELHiNmc.exe
  2⤵
  PID:5284
- C:\Windows\System\HVjsAfK.exe
  C:\Windows\System\HVjsAfK.exe
  2⤵
  PID:6388
- C:\Windows\System\zaqaSiZ.exe
  C:\Windows\System\zaqaSiZ.exe
  2⤵
  PID:5388
- C:\Windows\System\terkuQV.exe
  C:\Windows\System\terkuQV.exe
  2⤵
  PID:5492
- C:\Windows\System\pnSMABA.exe
  C:\Windows\System\pnSMABA.exe
  2⤵
  PID:5588
- C:\Windows\System\qhasINr.exe
  C:\Windows\System\qhasINr.exe
  2⤵
  PID:6508
- C:\Windows\System\GwCfKyw.exe
  C:\Windows\System\GwCfKyw.exe
  2⤵
  PID:6816
- C:\Windows\System\tDQuSKS.exe
  C:\Windows\System\tDQuSKS.exe
  2⤵
  PID:2276
- C:\Windows\System\sGrrxmB.exe
  C:\Windows\System\sGrrxmB.exe
  2⤵
  PID:5868
- C:\Windows\System\SxBoaxF.exe
  C:\Windows\System\SxBoaxF.exe
  2⤵
  PID:6912
- C:\Windows\System\ICHOIba.exe
  C:\Windows\System\ICHOIba.exe
  2⤵
  PID:6188
- C:\Windows\System\Wroypsn.exe
  C:\Windows\System\Wroypsn.exe
  2⤵
  PID:6236
- C:\Windows\System\QVQHvAv.exe
  C:\Windows\System\QVQHvAv.exe
  2⤵
  PID:7048
- C:\Windows\System\WHZYQuw.exe
  C:\Windows\System\WHZYQuw.exe
  2⤵
  PID:7092
- C:\Windows\System\tITqWWq.exe
  C:\Windows\System\tITqWWq.exe
  2⤵
  PID:6528
- C:\Windows\System\oCIfmBN.exe
  C:\Windows\System\oCIfmBN.exe
  2⤵
  PID:6660
- C:\Windows\System\UGrRAHc.exe
  C:\Windows\System\UGrRAHc.exe
  2⤵
  PID:6756
- C:\Windows\System\wFQOTqx.exe
  C:\Windows\System\wFQOTqx.exe
  2⤵
  PID:6796
- C:\Windows\System\lzVFpGx.exe
  C:\Windows\System\lzVFpGx.exe
  2⤵
  PID:5476
- C:\Windows\System\oxDXbGm.exe
  C:\Windows\System\oxDXbGm.exe
  2⤵
  PID:7188
- C:\Windows\System\btEnAad.exe
  C:\Windows\System\btEnAad.exe
  2⤵
  PID:7208
- C:\Windows\System\xbBaORN.exe
  C:\Windows\System\xbBaORN.exe
  2⤵
  PID:7228
- C:\Windows\System\nFogURP.exe
  C:\Windows\System\nFogURP.exe
  2⤵
  PID:7256
- C:\Windows\System\XPaIYdY.exe
  C:\Windows\System\XPaIYdY.exe
  2⤵
  PID:7272
- C:\Windows\System\vXPtHje.exe
  C:\Windows\System\vXPtHje.exe
  2⤵
  PID:7300
- C:\Windows\System\vBisiFI.exe
  C:\Windows\System\vBisiFI.exe
  2⤵
  PID:7324
- C:\Windows\System\eDBhxok.exe
  C:\Windows\System\eDBhxok.exe
  2⤵
  PID:7344
- C:\Windows\System\kaiZIgd.exe
  C:\Windows\System\kaiZIgd.exe
  2⤵
  PID:7364
- C:\Windows\System\JqfjHvD.exe
  C:\Windows\System\JqfjHvD.exe
  2⤵
  PID:7384
- C:\Windows\System\UuUqRaS.exe
  C:\Windows\System\UuUqRaS.exe
  2⤵
  PID:7408
- C:\Windows\System\LzRZLLT.exe
  C:\Windows\System\LzRZLLT.exe
  2⤵
  PID:7432
- C:\Windows\System\CfGIDie.exe
  C:\Windows\System\CfGIDie.exe
  2⤵
  PID:7456
- C:\Windows\System\idoIQie.exe
  C:\Windows\System\idoIQie.exe
  2⤵
  PID:7476
- C:\Windows\System\FgTTQcY.exe
  C:\Windows\System\FgTTQcY.exe
  2⤵
  PID:7492
- C:\Windows\System\aSiraHL.exe
  C:\Windows\System\aSiraHL.exe
  2⤵
  PID:7516
- C:\Windows\System\eZIKEFa.exe
  C:\Windows\System\eZIKEFa.exe
  2⤵
  PID:7536
- C:\Windows\System\zRICuFC.exe
  C:\Windows\System\zRICuFC.exe
  2⤵
  PID:7556
- C:\Windows\System\UldFGMM.exe
  C:\Windows\System\UldFGMM.exe
  2⤵
  PID:7584
- C:\Windows\System\wMOofol.exe
  C:\Windows\System\wMOofol.exe
  2⤵
  PID:7604
- C:\Windows\System\uvMcsgV.exe
  C:\Windows\System\uvMcsgV.exe
  2⤵
  PID:7628
- C:\Windows\System\WtyjUAD.exe
  C:\Windows\System\WtyjUAD.exe
  2⤵
  PID:7652
- C:\Windows\System\ycjxjRW.exe
  C:\Windows\System\ycjxjRW.exe
  2⤵
  PID:7672
- C:\Windows\System\vSGJVhW.exe
  C:\Windows\System\vSGJVhW.exe
  2⤵
  PID:7700
- C:\Windows\System\AKHLvhl.exe
  C:\Windows\System\AKHLvhl.exe
  2⤵
  PID:7720
- C:\Windows\System\xBLFzEf.exe
  C:\Windows\System\xBLFzEf.exe
  2⤵
  PID:7744
- C:\Windows\System\eIMGuIu.exe
  C:\Windows\System\eIMGuIu.exe
  2⤵
  PID:7768
- C:\Windows\System\eGLRBAT.exe
  C:\Windows\System\eGLRBAT.exe
  2⤵
  PID:7792
- C:\Windows\System\axXpBWa.exe
  C:\Windows\System\axXpBWa.exe
  2⤵
  PID:7820
- C:\Windows\System\bxSWStM.exe
  C:\Windows\System\bxSWStM.exe
  2⤵
  PID:7840
- C:\Windows\System\vSQjvSH.exe
  C:\Windows\System\vSQjvSH.exe
  2⤵
  PID:7860
- C:\Windows\System\VYbsVJW.exe
  C:\Windows\System\VYbsVJW.exe
  2⤵
  PID:7888
- C:\Windows\System\EJSTbTc.exe
  C:\Windows\System\EJSTbTc.exe
  2⤵
  PID:7908
- C:\Windows\System\KvehBKH.exe
  C:\Windows\System\KvehBKH.exe
  2⤵
  PID:7936
- C:\Windows\System\eeUgWxZ.exe
  C:\Windows\System\eeUgWxZ.exe
  2⤵
  PID:7960
- C:\Windows\System\kVpxvhF.exe
  C:\Windows\System\kVpxvhF.exe
  2⤵
  PID:7984
- C:\Windows\System\DuCrsLO.exe
  C:\Windows\System\DuCrsLO.exe
  2⤵
  PID:8004
- C:\Windows\System\DaYvMrv.exe
  C:\Windows\System\DaYvMrv.exe
  2⤵
  PID:8024
- C:\Windows\System\RdZWvfm.exe
  C:\Windows\System\RdZWvfm.exe
  2⤵
  PID:8044
- C:\Windows\System\qTaibGi.exe
  C:\Windows\System\qTaibGi.exe
  2⤵
  PID:8068
- C:\Windows\System\ZeTTprq.exe
  C:\Windows\System\ZeTTprq.exe
  2⤵
  PID:8096
- C:\Windows\System\XwRviey.exe
  C:\Windows\System\XwRviey.exe
  2⤵
  PID:8116
- C:\Windows\System\bczfnlM.exe
  C:\Windows\System\bczfnlM.exe
  2⤵
  PID:8136
- C:\Windows\System\FRqkxrt.exe
  C:\Windows\System\FRqkxrt.exe
  2⤵
  PID:8156
- C:\Windows\System\tZgguAp.exe
  C:\Windows\System\tZgguAp.exe
  2⤵
  PID:8184
- C:\Windows\System\agorMCm.exe
  C:\Windows\System\agorMCm.exe
  2⤵
  PID:6332
- C:\Windows\System\kemMqql.exe
  C:\Windows\System\kemMqql.exe
  2⤵
  PID:5624
- C:\Windows\System\FRKamVr.exe
  C:\Windows\System\FRKamVr.exe
  2⤵
  PID:7060
- C:\Windows\System\SUCRKSv.exe
  C:\Windows\System\SUCRKSv.exe
  2⤵
  PID:6572
- C:\Windows\System\zCoompf.exe
  C:\Windows\System\zCoompf.exe
  2⤵
  PID:5520
- C:\Windows\System\DNzHWXX.exe
  C:\Windows\System\DNzHWXX.exe
  2⤵
  PID:6632
- C:\Windows\System\IlWtfSy.exe
  C:\Windows\System\IlWtfSy.exe
  2⤵
  PID:6684
- C:\Windows\System\XClkZbs.exe
  C:\Windows\System\XClkZbs.exe
  2⤵
  PID:6780
- C:\Windows\System\EgNiEsW.exe
  C:\Windows\System\EgNiEsW.exe
  2⤵
  PID:5972
- C:\Windows\System\pwmUskj.exe
  C:\Windows\System\pwmUskj.exe
  2⤵
  PID:7200
- C:\Windows\System\ajfsDpf.exe
  C:\Windows\System\ajfsDpf.exe
  2⤵
  PID:6488
- C:\Windows\System\ajonLWd.exe
  C:\Windows\System\ajonLWd.exe
  2⤵
  PID:7380
- C:\Windows\System\fLrJRpI.exe
  C:\Windows\System\fLrJRpI.exe
  2⤵
  PID:6980
- C:\Windows\System\jdZlsDm.exe
  C:\Windows\System\jdZlsDm.exe
  2⤵
  PID:7404
- C:\Windows\System\FwptnaK.exe
  C:\Windows\System\FwptnaK.exe
  2⤵
  PID:7428
- C:\Windows\System\UXhTBRg.exe
  C:\Windows\System\UXhTBRg.exe
  2⤵
  PID:7524
- C:\Windows\System\RuSeDFB.exe
  C:\Windows\System\RuSeDFB.exe
  2⤵
  PID:7572
- C:\Windows\System\ULwgZdV.exe
  C:\Windows\System\ULwgZdV.exe
  2⤵
  PID:7668
- C:\Windows\System\bCTpSnV.exe
  C:\Windows\System\bCTpSnV.exe
  2⤵
  PID:5220
- C:\Windows\System\GVwGBVO.exe
  C:\Windows\System\GVwGBVO.exe
  2⤵
  PID:8208
- C:\Windows\System\huopqCS.exe
  C:\Windows\System\huopqCS.exe
  2⤵
  PID:8228
- C:\Windows\System\zzUtBFm.exe
  C:\Windows\System\zzUtBFm.exe
  2⤵
  PID:8252
- C:\Windows\System\hrtvyFX.exe
  C:\Windows\System\hrtvyFX.exe
  2⤵
  PID:8276
- C:\Windows\System\hxYKZkw.exe
  C:\Windows\System\hxYKZkw.exe
  2⤵
  PID:8300
- C:\Windows\System\qfNWCSH.exe
  C:\Windows\System\qfNWCSH.exe
  2⤵
  PID:8328
- C:\Windows\System\JQnAeOb.exe
  C:\Windows\System\JQnAeOb.exe
  2⤵
  PID:8356
- C:\Windows\System\RlyQrJM.exe
  C:\Windows\System\RlyQrJM.exe
  2⤵
  PID:8380
- C:\Windows\System\haQNwMT.exe
  C:\Windows\System\haQNwMT.exe
  2⤵
  PID:8404
- C:\Windows\System\wmrisgG.exe
  C:\Windows\System\wmrisgG.exe
  2⤵
  PID:8420
- C:\Windows\System\wvweUtd.exe
  C:\Windows\System\wvweUtd.exe
  2⤵
  PID:8436
- C:\Windows\System\ASFuNoL.exe
  C:\Windows\System\ASFuNoL.exe
  2⤵
  PID:8464
- C:\Windows\System\GlVGcuQ.exe
  C:\Windows\System\GlVGcuQ.exe
  2⤵
  PID:8484
- C:\Windows\System\GrWfuUy.exe
  C:\Windows\System\GrWfuUy.exe
  2⤵
  PID:8508
- C:\Windows\System\XBeDcBY.exe
  C:\Windows\System\XBeDcBY.exe
  2⤵
  PID:8540
- C:\Windows\System\OLDZGYb.exe
  C:\Windows\System\OLDZGYb.exe
  2⤵
  PID:8564
- C:\Windows\System\iBCZMHH.exe
  C:\Windows\System\iBCZMHH.exe
  2⤵
  PID:8596
- C:\Windows\System\oazlgkX.exe
  C:\Windows\System\oazlgkX.exe
  2⤵
  PID:8628
- C:\Windows\System\vishPcl.exe
  C:\Windows\System\vishPcl.exe
  2⤵
  PID:8656
- C:\Windows\System\fpeavBw.exe
  C:\Windows\System\fpeavBw.exe
  2⤵
  PID:8684
- C:\Windows\System\KfNDeHN.exe
  C:\Windows\System\KfNDeHN.exe
  2⤵
  PID:8704
- C:\Windows\System\WOqllyz.exe
  C:\Windows\System\WOqllyz.exe
  2⤵
  PID:8728
- C:\Windows\System\sFCwhqj.exe
  C:\Windows\System\sFCwhqj.exe
  2⤵
  PID:8756
- C:\Windows\System\yOMbqbb.exe
  C:\Windows\System\yOMbqbb.exe
  2⤵
  PID:8780
- C:\Windows\System\pjGpXoM.exe
  C:\Windows\System\pjGpXoM.exe
  2⤵
  PID:8804
- C:\Windows\System\GfezbCI.exe
  C:\Windows\System\GfezbCI.exe
  2⤵
  PID:8836
- C:\Windows\System\vRrLeBL.exe
  C:\Windows\System\vRrLeBL.exe
  2⤵
  PID:8856
- C:\Windows\System\VMTuKAL.exe
  C:\Windows\System\VMTuKAL.exe
  2⤵
  PID:8880
- C:\Windows\System\xxjZiPU.exe
  C:\Windows\System\xxjZiPU.exe
  2⤵
  PID:8908
- C:\Windows\System\fWhcppn.exe
  C:\Windows\System\fWhcppn.exe
  2⤵
  PID:8936
- C:\Windows\System\FYvhKyM.exe
  C:\Windows\System\FYvhKyM.exe
  2⤵
  PID:8964
- C:\Windows\System\VYZutgn.exe
  C:\Windows\System\VYZutgn.exe
  2⤵
  PID:8984
- C:\Windows\System\BTpgRNQ.exe
  C:\Windows\System\BTpgRNQ.exe
  2⤵
  PID:9004
- C:\Windows\System\EyPTgyz.exe
  C:\Windows\System\EyPTgyz.exe
  2⤵
  PID:9028
- C:\Windows\System\eCkQfbI.exe
  C:\Windows\System\eCkQfbI.exe
  2⤵
  PID:9056
- C:\Windows\System\LfGIfiq.exe
  C:\Windows\System\LfGIfiq.exe
  2⤵
  PID:9080
- C:\Windows\System\blpKnNc.exe
  C:\Windows\System\blpKnNc.exe
  2⤵
  PID:9100
- C:\Windows\System\SRlbEmr.exe
  C:\Windows\System\SRlbEmr.exe
  2⤵
  PID:9120
- C:\Windows\System\eKMZkjP.exe
  C:\Windows\System\eKMZkjP.exe
  2⤵
  PID:9148
- C:\Windows\System\uwLNRPa.exe
  C:\Windows\System\uwLNRPa.exe
  2⤵
  PID:9180
- C:\Windows\System\zyJoLgo.exe
  C:\Windows\System\zyJoLgo.exe
  2⤵
  PID:9204
- C:\Windows\System\zjdeeTh.exe
  C:\Windows\System\zjdeeTh.exe
  2⤵
  PID:7248
- C:\Windows\System\PsuKEAC.exe
  C:\Windows\System\PsuKEAC.exe
  2⤵
  PID:7876
- C:\Windows\System\BBzAEnz.exe
  C:\Windows\System\BBzAEnz.exe
  2⤵
  PID:7900
- C:\Windows\System\ySKNkUe.exe
  C:\Windows\System\ySKNkUe.exe
  2⤵
  PID:8012
- C:\Windows\System\sWjPCyF.exe
  C:\Windows\System\sWjPCyF.exe
  2⤵
  PID:8052
- C:\Windows\System\PngBIYO.exe
  C:\Windows\System\PngBIYO.exe
  2⤵
  PID:8108
- C:\Windows\System\njEyZcw.exe
  C:\Windows\System\njEyZcw.exe
  2⤵
  PID:8172
- C:\Windows\System\hmOWfnf.exe
  C:\Windows\System\hmOWfnf.exe
  2⤵
  PID:7500
- C:\Windows\System\ztJFgUH.exe
  C:\Windows\System\ztJFgUH.exe
  2⤵
  PID:6616
- C:\Windows\System\RLOxqle.exe
  C:\Windows\System\RLOxqle.exe
  2⤵
  PID:4872
- C:\Windows\System\RmpouEu.exe
  C:\Windows\System\RmpouEu.exe
  2⤵
  PID:7640
- C:\Windows\System\FXfNXEe.exe
  C:\Windows\System\FXfNXEe.exe
  2⤵
  PID:5756
- C:\Windows\System\UrFvTPJ.exe
  C:\Windows\System\UrFvTPJ.exe
  2⤵
  PID:7376
- C:\Windows\System\TzXxSMz.exe
  C:\Windows\System\TzXxSMz.exe
  2⤵
  PID:7732
- C:\Windows\System\dywOKzs.exe
  C:\Windows\System\dywOKzs.exe
  2⤵
  PID:6752
- C:\Windows\System\IkDepnJ.exe
  C:\Windows\System\IkDepnJ.exe
  2⤵
  PID:1404
- C:\Windows\System\FRTMLcj.exe
  C:\Windows\System\FRTMLcj.exe
  2⤵
  PID:7216
- C:\Windows\System\UBCMSFD.exe
  C:\Windows\System\UBCMSFD.exe
  2⤵
  PID:7904
- C:\Windows\System\gJuxtJd.exe
  C:\Windows\System\gJuxtJd.exe
  2⤵
  PID:8000
- C:\Windows\System\nTzHreC.exe
  C:\Windows\System\nTzHreC.exe
  2⤵
  PID:8496
- C:\Windows\System\rciaNPl.exe
  C:\Windows\System\rciaNPl.exe
  2⤵
  PID:4492
- C:\Windows\System\ExnqDGc.exe
  C:\Windows\System\ExnqDGc.exe
  2⤵
  PID:8536
- C:\Windows\System\dDeRqAI.exe
  C:\Windows\System\dDeRqAI.exe
  2⤵
  PID:6292
- C:\Windows\System\NtdaXmU.exe
  C:\Windows\System\NtdaXmU.exe
  2⤵
  PID:8636
- C:\Windows\System\jHrBqVd.exe
  C:\Windows\System\jHrBqVd.exe
  2⤵
  PID:8672
- C:\Windows\System\hctyKJj.exe
  C:\Windows\System\hctyKJj.exe
  2⤵
  PID:8712
- C:\Windows\System\aJZDALQ.exe
  C:\Windows\System\aJZDALQ.exe
  2⤵
  PID:7592
- C:\Windows\System\TiAfvMj.exe
  C:\Windows\System\TiAfvMj.exe
  2⤵
  PID:9228
- C:\Windows\System\hNpyEOo.exe
  C:\Windows\System\hNpyEOo.exe
  2⤵
  PID:9252
- C:\Windows\System\BPAVYJr.exe
  C:\Windows\System\BPAVYJr.exe
  2⤵
  PID:9276
- C:\Windows\System\GFmHKOw.exe
  C:\Windows\System\GFmHKOw.exe
  2⤵
  PID:9300
- C:\Windows\System\daefhyK.exe
  C:\Windows\System\daefhyK.exe
  2⤵
  PID:9320
- C:\Windows\System\ipjibqG.exe
  C:\Windows\System\ipjibqG.exe
  2⤵
  PID:9344
- C:\Windows\System\AKWMCHD.exe
  C:\Windows\System\AKWMCHD.exe
  2⤵
  PID:9372
- C:\Windows\System\XMsJoYg.exe
  C:\Windows\System\XMsJoYg.exe
  2⤵
  PID:9396
- C:\Windows\System\zdSWUmN.exe
  C:\Windows\System\zdSWUmN.exe
  2⤵
  PID:9416
- C:\Windows\System\aKSFDyr.exe
  C:\Windows\System\aKSFDyr.exe
  2⤵
  PID:9444
- C:\Windows\System\cOkJYPW.exe
  C:\Windows\System\cOkJYPW.exe
  2⤵
  PID:9468
- C:\Windows\System\bCFiFFK.exe
  C:\Windows\System\bCFiFFK.exe
  2⤵
  PID:9496
- C:\Windows\System\wlXBCWl.exe
  C:\Windows\System\wlXBCWl.exe
  2⤵
  PID:9512
- C:\Windows\System\APiFqpG.exe
  C:\Windows\System\APiFqpG.exe
  2⤵
  PID:9532
- C:\Windows\System\XRUprca.exe
  C:\Windows\System\XRUprca.exe
  2⤵
  PID:9556
- C:\Windows\System\mOBybhp.exe
  C:\Windows\System\mOBybhp.exe
  2⤵
  PID:9576
- C:\Windows\System\nRwOMSs.exe
  C:\Windows\System\nRwOMSs.exe
  2⤵
  PID:9600
- C:\Windows\System\KYFapFu.exe
  C:\Windows\System\KYFapFu.exe
  2⤵
  PID:9632
- C:\Windows\System\lOlzcal.exe
  C:\Windows\System\lOlzcal.exe
  2⤵
  PID:9656
- C:\Windows\System\ZhcMCxk.exe
  C:\Windows\System\ZhcMCxk.exe
  2⤵
  PID:9676
- C:\Windows\System\ocZkEqV.exe
  C:\Windows\System\ocZkEqV.exe
  2⤵
  PID:9696
- C:\Windows\System\paJOHKo.exe
  C:\Windows\System\paJOHKo.exe
  2⤵
  PID:9724
- C:\Windows\System\tQfGuyk.exe
  C:\Windows\System\tQfGuyk.exe
  2⤵
  PID:9756
- C:\Windows\System\rOCVJik.exe
  C:\Windows\System\rOCVJik.exe
  2⤵
  PID:9780
- C:\Windows\System\uYldZgO.exe
  C:\Windows\System\uYldZgO.exe
  2⤵
  PID:9804
- C:\Windows\System\jNOOCpZ.exe
  C:\Windows\System\jNOOCpZ.exe
  2⤵
  PID:9832
- C:\Windows\System\VvGQbMb.exe
  C:\Windows\System\VvGQbMb.exe
  2⤵
  PID:9856
- C:\Windows\System\KDpDMro.exe
  C:\Windows\System\KDpDMro.exe
  2⤵
  PID:9876
- C:\Windows\System\QGknbBJ.exe
  C:\Windows\System\QGknbBJ.exe
  2⤵
  PID:9896
- C:\Windows\System\dhvhHDc.exe
  C:\Windows\System\dhvhHDc.exe
  2⤵
  PID:9916
- C:\Windows\System\WVlXsBn.exe
  C:\Windows\System\WVlXsBn.exe
  2⤵
  PID:9944
- C:\Windows\System\xBqhLck.exe
  C:\Windows\System\xBqhLck.exe
  2⤵
  PID:9968
- C:\Windows\System\wTVxJqu.exe
  C:\Windows\System\wTVxJqu.exe
  2⤵
  PID:9996
- C:\Windows\System\eXgbHNI.exe
  C:\Windows\System\eXgbHNI.exe
  2⤵
  PID:10016
- C:\Windows\System\qHCBOdq.exe
  C:\Windows\System\qHCBOdq.exe
  2⤵
  PID:10032
- C:\Windows\System\nvpaWgm.exe
  C:\Windows\System\nvpaWgm.exe
  2⤵
  PID:10052
- C:\Windows\System\NSrquPc.exe
  C:\Windows\System\NSrquPc.exe
  2⤵
  PID:10076
- C:\Windows\System\CbVTmre.exe
  C:\Windows\System\CbVTmre.exe
  2⤵
  PID:10100
- C:\Windows\System\npaorGo.exe
  C:\Windows\System\npaorGo.exe
  2⤵
  PID:10124
- C:\Windows\System\MykhrZf.exe
  C:\Windows\System\MykhrZf.exe
  2⤵
  PID:10144
- C:\Windows\System\LKipBAX.exe
  C:\Windows\System\LKipBAX.exe
  2⤵
  PID:10176
- C:\Windows\System\qXzXCWf.exe
  C:\Windows\System\qXzXCWf.exe
  2⤵
  PID:10196
- C:\Windows\System\WwBLezk.exe
  C:\Windows\System\WwBLezk.exe
  2⤵
  PID:10224
- C:\Windows\System\GXzBffp.exe
  C:\Windows\System\GXzBffp.exe
  2⤵
  PID:6972
- C:\Windows\System\nERFRxZ.exe
  C:\Windows\System\nERFRxZ.exe
  2⤵
  PID:8864
- C:\Windows\System\CUNkzcQ.exe
  C:\Windows\System\CUNkzcQ.exe
  2⤵
  PID:7716
- C:\Windows\System\zbvhtLh.exe
  C:\Windows\System\zbvhtLh.exe
  2⤵
  PID:7756
- C:\Windows\System\lXUwYok.exe
  C:\Windows\System\lXUwYok.exe
  2⤵
  PID:7780
- C:\Windows\System\MOuaAhU.exe
  C:\Windows\System\MOuaAhU.exe
  2⤵
  PID:9044
- C:\Windows\System\RtuovRZ.exe
  C:\Windows\System\RtuovRZ.exe
  2⤵
  PID:8428
- C:\Windows\System\XiTvhLJ.exe
  C:\Windows\System\XiTvhLJ.exe
  2⤵
  PID:7160
- C:\Windows\System\tXyiXld.exe
  C:\Windows\System\tXyiXld.exe
  2⤵
  PID:9260
- C:\Windows\System\BBJtYiv.exe
  C:\Windows\System\BBJtYiv.exe
  2⤵
  PID:7488
- C:\Windows\System\GQFclov.exe
  C:\Windows\System\GQFclov.exe
  2⤵
  PID:9520
- C:\Windows\System\uDBbWGQ.exe
  C:\Windows\System\uDBbWGQ.exe
  2⤵
  PID:8268
- C:\Windows\System\eFzSAmN.exe
  C:\Windows\System\eFzSAmN.exe
  2⤵
  PID:7296
- C:\Windows\System\AdHmoAA.exe
  C:\Windows\System\AdHmoAA.exe
  2⤵
  PID:8076
- C:\Windows\System\eRXRmpN.exe
  C:\Windows\System\eRXRmpN.exe
  2⤵
  PID:8416
- C:\Windows\System\NYFKKpr.exe
  C:\Windows\System\NYFKKpr.exe
  2⤵
  PID:7004
- C:\Windows\System\ITSTcpj.exe
  C:\Windows\System\ITSTcpj.exe
  2⤵
  PID:1932
- C:\Windows\System\QtuzVRk.exe
  C:\Windows\System\QtuzVRk.exe
  2⤵
  PID:7020
- C:\Windows\System\CQhShON.exe
  C:\Windows\System\CQhShON.exe
  2⤵
  PID:8644
- C:\Windows\System\PwvvJqw.exe
  C:\Windows\System\PwvvJqw.exe
  2⤵
  PID:8244
- C:\Windows\System\dDYlLHL.exe
  C:\Windows\System\dDYlLHL.exe
  2⤵
  PID:10192
- C:\Windows\System\eZlbRLr.exe
  C:\Windows\System\eZlbRLr.exe
  2⤵
  PID:2088
- C:\Windows\System\JhzmtdE.exe
  C:\Windows\System\JhzmtdE.exe
  2⤵
  PID:9360
- C:\Windows\System\YuMoOCJ.exe
  C:\Windows\System\YuMoOCJ.exe
  2⤵
  PID:10084
- C:\Windows\System\iaXgFro.exe
  C:\Windows\System\iaXgFro.exe
  2⤵
  PID:8724
- C:\Windows\System\niECWSP.exe
  C:\Windows\System\niECWSP.exe
  2⤵
  PID:6176
- C:\Windows\System\mpXodqb.exe
  C:\Windows\System\mpXodqb.exe
  2⤵
  PID:10136
- C:\Windows\System\lOxOmSR.exe
  C:\Windows\System\lOxOmSR.exe
  2⤵
  PID:9020
- C:\Windows\System\NnbYMNS.exe
  C:\Windows\System\NnbYMNS.exe
  2⤵
  PID:9352
- C:\Windows\System\lntiKSW.exe
  C:\Windows\System\lntiKSW.exe
  2⤵
  PID:8924
- C:\Windows\System\rEjSekX.exe
  C:\Windows\System\rEjSekX.exe
  2⤵
  PID:8972
- C:\Windows\System\okVUFgN.exe
  C:\Windows\System\okVUFgN.exe
  2⤵
  PID:9140
- C:\Windows\System\oupLmip.exe
  C:\Windows\System\oupLmip.exe
  2⤵
  PID:10244
- C:\Windows\System\dtgGQMm.exe
  C:\Windows\System\dtgGQMm.exe
  2⤵
  PID:10268
- C:\Windows\System\usUCJwi.exe
  C:\Windows\System\usUCJwi.exe
  2⤵
  PID:10288
- C:\Windows\System\QSZvtxq.exe
  C:\Windows\System\QSZvtxq.exe
  2⤵
  PID:10316
- C:\Windows\System\PIzyQWb.exe
  C:\Windows\System\PIzyQWb.exe
  2⤵
  PID:10340
- C:\Windows\System\UaJogeg.exe
  C:\Windows\System\UaJogeg.exe
  2⤵
  PID:10364
- C:\Windows\System\HptGfvp.exe
  C:\Windows\System\HptGfvp.exe
  2⤵
  PID:10400
- C:\Windows\System\hjroXcB.exe
  C:\Windows\System\hjroXcB.exe
  2⤵
  PID:10424
- C:\Windows\System\JRmUUzI.exe
  C:\Windows\System\JRmUUzI.exe
  2⤵
  PID:10452
- C:\Windows\System\aRwkdSX.exe
  C:\Windows\System\aRwkdSX.exe
  2⤵
  PID:10480
- C:\Windows\System\LQkHsUs.exe
  C:\Windows\System\LQkHsUs.exe
  2⤵
  PID:10500
- C:\Windows\System\nKwwYwR.exe
  C:\Windows\System\nKwwYwR.exe
  2⤵
  PID:10528
- C:\Windows\System\kFFpnVT.exe
  C:\Windows\System\kFFpnVT.exe
  2⤵
  PID:10548
- C:\Windows\System\fNEXwFI.exe
  C:\Windows\System\fNEXwFI.exe
  2⤵
  PID:10564
- C:\Windows\System\YfZHqSP.exe
  C:\Windows\System\YfZHqSP.exe
  2⤵
  PID:10580
- C:\Windows\System\ExAUwVg.exe
  C:\Windows\System\ExAUwVg.exe
  2⤵
  PID:10604
- C:\Windows\System\PPKoqiR.exe
  C:\Windows\System\PPKoqiR.exe
  2⤵
  PID:10624
- C:\Windows\System\RkTiSzL.exe
  C:\Windows\System\RkTiSzL.exe
  2⤵
  PID:10648
- C:\Windows\System\UYgEoXT.exe
  C:\Windows\System\UYgEoXT.exe
  2⤵
  PID:10676
- C:\Windows\System\DqdZrbi.exe
  C:\Windows\System\DqdZrbi.exe
  2⤵
  PID:10704
- C:\Windows\System\OPtbABI.exe
  C:\Windows\System\OPtbABI.exe
  2⤵
  PID:10724
- C:\Windows\System\hrbKKbP.exe
  C:\Windows\System\hrbKKbP.exe
  2⤵
  PID:10748
- C:\Windows\System\LWRKhhg.exe
  C:\Windows\System\LWRKhhg.exe
  2⤵
  PID:10772
- C:\Windows\System\kMomkRb.exe
  C:\Windows\System\kMomkRb.exe
  2⤵
  PID:10796
- C:\Windows\System\oYVfCZN.exe
  C:\Windows\System\oYVfCZN.exe
  2⤵
  PID:10820
- C:\Windows\System\oycRhcm.exe
  C:\Windows\System\oycRhcm.exe
  2⤵
  PID:10848
- C:\Windows\System\YWhpXUU.exe
  C:\Windows\System\YWhpXUU.exe
  2⤵
  PID:10872
- C:\Windows\System\dRYeIVS.exe
  C:\Windows\System\dRYeIVS.exe
  2⤵
  PID:10896
- C:\Windows\System\pWFvzeY.exe
  C:\Windows\System\pWFvzeY.exe
  2⤵
  PID:10932
- C:\Windows\System\xXjIxIU.exe
  C:\Windows\System\xXjIxIU.exe
  2⤵
  PID:10960
- C:\Windows\System\RadVFeZ.exe
  C:\Windows\System\RadVFeZ.exe
  2⤵
  PID:10980
- C:\Windows\System\SFfnhFc.exe
  C:\Windows\System\SFfnhFc.exe
  2⤵
  PID:11012
- C:\Windows\System\NRkLsep.exe
  C:\Windows\System\NRkLsep.exe
  2⤵
  PID:11032
- C:\Windows\System\bXjYfGI.exe
  C:\Windows\System\bXjYfGI.exe
  2⤵
  PID:11064
- C:\Windows\System\UwiUOKr.exe
  C:\Windows\System\UwiUOKr.exe
  2⤵
  PID:11084
- C:\Windows\System\eWqRLtT.exe
  C:\Windows\System\eWqRLtT.exe
  2⤵
  PID:11112
- C:\Windows\System\DInlELH.exe
  C:\Windows\System\DInlELH.exe
  2⤵
  PID:11128
- C:\Windows\System\zUIBLLV.exe
  C:\Windows\System\zUIBLLV.exe
  2⤵
  PID:11152
- C:\Windows\System\iVxcDPY.exe
  C:\Windows\System\iVxcDPY.exe
  2⤵
  PID:11172
- C:\Windows\System\yZoSdwI.exe
  C:\Windows\System\yZoSdwI.exe
  2⤵
  PID:11204
- C:\Windows\System\GHyaaTV.exe
  C:\Windows\System\GHyaaTV.exe
  2⤵
  PID:11224
- C:\Windows\System\kWsacWS.exe
  C:\Windows\System\kWsacWS.exe
  2⤵
  PID:11248
- C:\Windows\System\Zzstsrk.exe
  C:\Windows\System\Zzstsrk.exe
  2⤵
  PID:7264
- C:\Windows\System\gAplSwc.exe
  C:\Windows\System\gAplSwc.exe
  2⤵
  PID:7116
- C:\Windows\System\xqQJfRH.exe
  C:\Windows\System\xqQJfRH.exe
  2⤵
  PID:8260
- C:\Windows\System\pYtIAJq.exe
  C:\Windows\System\pYtIAJq.exe
  2⤵
  PID:1000
- C:\Windows\System\uPPXmTN.exe
  C:\Windows\System\uPPXmTN.exe
  2⤵
  PID:8952
- C:\Windows\System\qKwihXJ.exe
  C:\Windows\System\qKwihXJ.exe
  2⤵
  PID:9768
- C:\Windows\System\UYMtBKR.exe
  C:\Windows\System\UYMtBKR.exe
  2⤵
  PID:7472
- C:\Windows\System\pevtpWO.exe
  C:\Windows\System\pevtpWO.exe
  2⤵
  PID:3240
- C:\Windows\System\lOvoWhy.exe
  C:\Windows\System\lOvoWhy.exe
  2⤵
  PID:8388
- C:\Windows\System\iuTyAOk.exe
  C:\Windows\System\iuTyAOk.exe
  2⤵
  PID:9548
- C:\Windows\System\PFATrYo.exe
  C:\Windows\System\PFATrYo.exe
  2⤵
  PID:9592
- C:\Windows\System\yCwOhzW.exe
  C:\Windows\System\yCwOhzW.exe
  2⤵
  PID:8948
- C:\Windows\System\eEOEoNA.exe
  C:\Windows\System\eEOEoNA.exe
  2⤵
  PID:8852
- C:\Windows\System\WVUnBaw.exe
  C:\Windows\System\WVUnBaw.exe
  2⤵
  PID:8996
- C:\Windows\System\AiqkGYH.exe
  C:\Windows\System\AiqkGYH.exe
  2⤵
  PID:10256
- C:\Windows\System\sCpCPNp.exe
  C:\Windows\System\sCpCPNp.exe
  2⤵
  PID:10280
- C:\Windows\System\xYSmRda.exe
  C:\Windows\System\xYSmRda.exe
  2⤵
  PID:10640
- C:\Windows\System\yhGrtMK.exe
  C:\Windows\System\yhGrtMK.exe
  2⤵
  PID:10696
- C:\Windows\System\ihuNkki.exe
  C:\Windows\System\ihuNkki.exe
  2⤵
  PID:10892
- C:\Windows\System\fIdFbyb.exe
  C:\Windows\System\fIdFbyb.exe
  2⤵
  PID:10212
- C:\Windows\System\JwOSlXm.exe
  C:\Windows\System\JwOSlXm.exe
  2⤵
  PID:11292
- C:\Windows\System\epiADvC.exe
  C:\Windows\System\epiADvC.exe
  2⤵
  PID:11316
- C:\Windows\System\mNjyxzb.exe
  C:\Windows\System\mNjyxzb.exe
  2⤵
  PID:11340
- C:\Windows\System\NNUwaMM.exe
  C:\Windows\System\NNUwaMM.exe
  2⤵
  PID:11372
- C:\Windows\System\jqacpeg.exe
  C:\Windows\System\jqacpeg.exe
  2⤵
  PID:11396
- C:\Windows\System\VOBMuJz.exe
  C:\Windows\System\VOBMuJz.exe
  2⤵
  PID:11420
- C:\Windows\System\jNCQqqz.exe
  C:\Windows\System\jNCQqqz.exe
  2⤵
  PID:11448
- C:\Windows\System\NwLpiZP.exe
  C:\Windows\System\NwLpiZP.exe
  2⤵
  PID:11464
- C:\Windows\System\VMnVTuA.exe
  C:\Windows\System\VMnVTuA.exe
  2⤵
  PID:11484
- C:\Windows\System\DgZWzkj.exe
  C:\Windows\System\DgZWzkj.exe
  2⤵
  PID:11504
- C:\Windows\System\CMtDpZw.exe
  C:\Windows\System\CMtDpZw.exe
  2⤵
  PID:11520
- C:\Windows\System\TuCeLcz.exe
  C:\Windows\System\TuCeLcz.exe
  2⤵
  PID:11540
- C:\Windows\System\YzCpaEL.exe
  C:\Windows\System\YzCpaEL.exe
  2⤵
  PID:11560
- C:\Windows\System\RZwKoGx.exe
  C:\Windows\System\RZwKoGx.exe
  2⤵
  PID:11588
- C:\Windows\System\TskOLzE.exe
  C:\Windows\System\TskOLzE.exe
  2⤵
  PID:11612
- C:\Windows\System\YQQlMyq.exe
  C:\Windows\System\YQQlMyq.exe
  2⤵
  PID:11632
- C:\Windows\System\CyxzluU.exe
  C:\Windows\System\CyxzluU.exe
  2⤵
  PID:11668
- C:\Windows\System\mvbJmLm.exe
  C:\Windows\System\mvbJmLm.exe
  2⤵
  PID:11688
- C:\Windows\System\dlBLmCp.exe
  C:\Windows\System\dlBLmCp.exe
  2⤵
  PID:11716
- C:\Windows\System\SyBzCfI.exe
  C:\Windows\System\SyBzCfI.exe
  2⤵
  PID:11744
- C:\Windows\System\JwwlwRf.exe
  C:\Windows\System\JwwlwRf.exe
  2⤵
  PID:11764
- C:\Windows\System\FZhKleE.exe
  C:\Windows\System\FZhKleE.exe
  2⤵
  PID:11788
- C:\Windows\System\dCguKIm.exe
  C:\Windows\System\dCguKIm.exe
  2⤵
  PID:11808
- C:\Windows\System\jJXvpVw.exe
  C:\Windows\System\jJXvpVw.exe
  2⤵
  PID:11828
- C:\Windows\System\gXTANIk.exe
  C:\Windows\System\gXTANIk.exe
  2⤵
  PID:11852
- C:\Windows\System\JdqEPgx.exe
  C:\Windows\System\JdqEPgx.exe
  2⤵
  PID:11876
- C:\Windows\System\qbGjJqE.exe
  C:\Windows\System\qbGjJqE.exe
  2⤵
  PID:11896
- C:\Windows\System\PyZCRcB.exe
  C:\Windows\System\PyZCRcB.exe
  2⤵
  PID:11916
- C:\Windows\System\cWwUJAA.exe
  C:\Windows\System\cWwUJAA.exe
  2⤵
  PID:11944
- C:\Windows\System\SXEqNwT.exe
  C:\Windows\System\SXEqNwT.exe
  2⤵
  PID:11964
- C:\Windows\System\hzSCUUX.exe
  C:\Windows\System\hzSCUUX.exe
  2⤵
  PID:11984
- C:\Windows\System\sSzfYQN.exe
  C:\Windows\System\sSzfYQN.exe
  2⤵
  PID:12008
- C:\Windows\System\xzVjyyX.exe
  C:\Windows\System\xzVjyyX.exe
  2⤵
  PID:12028
- C:\Windows\System\azwXFpW.exe
  C:\Windows\System\azwXFpW.exe
  2⤵
  PID:12052
- C:\Windows\System\xFCcHed.exe
  C:\Windows\System\xFCcHed.exe
  2⤵
  PID:12072
- C:\Windows\System\qJuNaJJ.exe
  C:\Windows\System\qJuNaJJ.exe
  2⤵
  PID:12100
- C:\Windows\System\wTCdifM.exe
  C:\Windows\System\wTCdifM.exe
  2⤵
  PID:12120
- C:\Windows\System\GeOMPsF.exe
  C:\Windows\System\GeOMPsF.exe
  2⤵
  PID:12140
- C:\Windows\System\MelXEbs.exe
  C:\Windows\System\MelXEbs.exe
  2⤵
  PID:12164
- C:\Windows\System\XbrEdBh.exe
  C:\Windows\System\XbrEdBh.exe
  2⤵
  PID:12188
- C:\Windows\System\oziGhGG.exe
  C:\Windows\System\oziGhGG.exe
  2⤵
  PID:12212
- C:\Windows\System\vtvvRbA.exe
  C:\Windows\System\vtvvRbA.exe
  2⤵
  PID:12236
- C:\Windows\System\vUUpEFZ.exe
  C:\Windows\System\vUUpEFZ.exe
  2⤵
  PID:12256
- C:\Windows\System\KzOkYBS.exe
  C:\Windows\System\KzOkYBS.exe
  2⤵
  PID:12280
- C:\Windows\System\TZiLQIU.exe
  C:\Windows\System\TZiLQIU.exe
  2⤵
  PID:11044
- C:\Windows\System\jesHQqw.exe
  C:\Windows\System\jesHQqw.exe
  2⤵
  PID:11096
- C:\Windows\System\UuwUrqC.exe
  C:\Windows\System\UuwUrqC.exe
  2⤵
  PID:11100
- C:\Windows\System\vOZtyqw.exe
  C:\Windows\System\vOZtyqw.exe
  2⤵
  PID:9844
- C:\Windows\System\OXUJMeA.exe
  C:\Windows\System\OXUJMeA.exe
  2⤵
  PID:9380
- C:\Windows\System\FZtcVuQ.exe
  C:\Windows\System\FZtcVuQ.exe
  2⤵
  PID:11184
- C:\Windows\System\QsICtkT.exe
  C:\Windows\System\QsICtkT.exe
  2⤵
  PID:11236
- C:\Windows\System\xODYlKd.exe
  C:\Windows\System\xODYlKd.exe
  2⤵
  PID:3444
- C:\Windows\System\yfVHbGp.exe
  C:\Windows\System\yfVHbGp.exe
  2⤵
  PID:10012
- C:\Windows\System\CGQFprY.exe
  C:\Windows\System\CGQFprY.exe
  2⤵
  PID:8980
- C:\Windows\System\cobaPdm.exe
  C:\Windows\System\cobaPdm.exe
  2⤵
  PID:9712
- C:\Windows\System\OJMpvCM.exe
  C:\Windows\System\OJMpvCM.exe
  2⤵
  PID:9648
- C:\Windows\System\PUfCxUs.exe
  C:\Windows\System\PUfCxUs.exe
  2⤵
  PID:10304
- C:\Windows\System\aILgoXp.exe
  C:\Windows\System\aILgoXp.exe
  2⤵
  PID:10348
- C:\Windows\System\akuQaFx.exe
  C:\Windows\System\akuQaFx.exe
  2⤵
  PID:6464
- C:\Windows\System\IeKfGFh.exe
  C:\Windows\System\IeKfGFh.exe
  2⤵
  PID:10040
- C:\Windows\System\SENONpj.exe
  C:\Windows\System\SENONpj.exe
  2⤵
  PID:10616
- C:\Windows\System\RaxLrTX.exe
  C:\Windows\System\RaxLrTX.exe
  2⤵
  PID:12304
- C:\Windows\System\hIgbNKM.exe
  C:\Windows\System\hIgbNKM.exe
  2⤵
  PID:12324
- C:\Windows\System\WivTjjL.exe
  C:\Windows\System\WivTjjL.exe
  2⤵
  PID:12340
- C:\Windows\System\jCGBdVm.exe
  C:\Windows\System\jCGBdVm.exe
  2⤵
  PID:12356
- C:\Windows\System\OfDFFoQ.exe
  C:\Windows\System\OfDFFoQ.exe
  2⤵
  PID:12376
- C:\Windows\System\sCSRAld.exe
  C:\Windows\System\sCSRAld.exe
  2⤵
  PID:12392
- C:\Windows\System\jikkZWD.exe
  C:\Windows\System\jikkZWD.exe
  2⤵
  PID:12408
- C:\Windows\System\HMEMtBY.exe
  C:\Windows\System\HMEMtBY.exe
  2⤵
  PID:12428
- C:\Windows\System\zTelqqy.exe
  C:\Windows\System\zTelqqy.exe
  2⤵
  PID:12444
- C:\Windows\System\RvYqEzJ.exe
  C:\Windows\System\RvYqEzJ.exe
  2⤵
  PID:12468
- C:\Windows\System\MpbloJh.exe
  C:\Windows\System\MpbloJh.exe
  2⤵
  PID:12488
- C:\Windows\System\odaUGIT.exe
  C:\Windows\System\odaUGIT.exe
  2⤵
  PID:12520
- C:\Windows\System\rWWVziv.exe
  C:\Windows\System\rWWVziv.exe
  2⤵
  PID:12544
- C:\Windows\System\jgFasLs.exe
  C:\Windows\System\jgFasLs.exe
  2⤵
  PID:12576
- C:\Windows\System\WTDASYE.exe
  C:\Windows\System\WTDASYE.exe
  2⤵
  PID:12604
- C:\Windows\System\HKEzwur.exe
  C:\Windows\System\HKEzwur.exe
  2⤵
  PID:12632
- C:\Windows\System\trlzIAR.exe
  C:\Windows\System\trlzIAR.exe
  2⤵
  PID:12652
- C:\Windows\System\ZSOgPcG.exe
  C:\Windows\System\ZSOgPcG.exe
  2⤵
  PID:12672
- C:\Windows\System\iJHucsv.exe
  C:\Windows\System\iJHucsv.exe
  2⤵
  PID:12692
- C:\Windows\System\oQnyGyJ.exe
  C:\Windows\System\oQnyGyJ.exe
  2⤵
  PID:12728
- C:\Windows\System\CqQUoge.exe
  C:\Windows\System\CqQUoge.exe
  2⤵
  PID:12748
- C:\Windows\System\oeqKppp.exe
  C:\Windows\System\oeqKppp.exe
  2⤵
  PID:12768
- C:\Windows\System\dlrxaOu.exe
  C:\Windows\System\dlrxaOu.exe
  2⤵
  PID:12788
- C:\Windows\System\OYrmSOZ.exe
  C:\Windows\System\OYrmSOZ.exe
  2⤵
  PID:12812
- C:\Windows\System\DmkDxoB.exe
  C:\Windows\System\DmkDxoB.exe
  2⤵
  PID:12832
- C:\Windows\System\PUrWpRt.exe
  C:\Windows\System\PUrWpRt.exe
  2⤵
  PID:12860
- C:\Windows\System\VBYrnrQ.exe
  C:\Windows\System\VBYrnrQ.exe
  2⤵
  PID:12884
- C:\Windows\System\xvXZgkz.exe
  C:\Windows\System\xvXZgkz.exe
  2⤵
  PID:12908
- C:\Windows\System\MaofvIF.exe
  C:\Windows\System\MaofvIF.exe
  2⤵
  PID:12936
- C:\Windows\System\sgteqsn.exe
  C:\Windows\System\sgteqsn.exe
  2⤵
  PID:12956
- C:\Windows\System\ciCUGlm.exe
  C:\Windows\System\ciCUGlm.exe
  2⤵
  PID:12980
- C:\Windows\System\ryfgDJm.exe
  C:\Windows\System\ryfgDJm.exe
  2⤵
  PID:13000
- C:\Windows\System\lDJekrU.exe
  C:\Windows\System\lDJekrU.exe
  2⤵
  PID:13024
- C:\Windows\System\fouTtZE.exe
  C:\Windows\System\fouTtZE.exe
  2⤵
  PID:13048
- C:\Windows\System\LAfERld.exe
  C:\Windows\System\LAfERld.exe
  2⤵
  PID:13072
- C:\Windows\System\qqKkabU.exe
  C:\Windows\System\qqKkabU.exe
  2⤵
  PID:13096
- C:\Windows\System\TUfBozd.exe
  C:\Windows\System\TUfBozd.exe
  2⤵
  PID:9036
- C:\Windows\System\bLUVtCk.exe
  C:\Windows\System\bLUVtCk.exe
  2⤵
  PID:10448
- C:\Windows\System\byCExdm.exe
  C:\Windows\System\byCExdm.exe
  2⤵
  PID:10296
- C:\Windows\System\LkIJVmN.exe
  C:\Windows\System\LkIJVmN.exe
  2⤵
  PID:12624
- C:\Windows\System\CgjUoiW.exe
  C:\Windows\System\CgjUoiW.exe
  2⤵
  PID:12708
- C:\Windows\System\BkcgvFE.exe
  C:\Windows\System\BkcgvFE.exe
  2⤵
  PID:12780
- C:\Windows\System\lSBZhQz.exe
  C:\Windows\System\lSBZhQz.exe
  2⤵
  PID:12848
- C:\Windows\System\EHZrATa.exe
  C:\Windows\System\EHZrATa.exe
  2⤵
  PID:32
- C:\Windows\System\jyFwxns.exe
  C:\Windows\System\jyFwxns.exe
  2⤵
  PID:11696
- C:\Windows\System\lNLFsaM.exe
  C:\Windows\System\lNLFsaM.exe
  2⤵
  PID:11080
- C:\Windows\System\PLYqPQC.exe
  C:\Windows\System\PLYqPQC.exe
  2⤵
  PID:11844
- C:\Windows\System\NbKxvCY.exe
  C:\Windows\System\NbKxvCY.exe
  2⤵
  PID:11124
- C:\Windows\System\UPyJvFi.exe
  C:\Windows\System\UPyJvFi.exe
  2⤵
  PID:12004
- C:\Windows\System\CxGpAhM.exe
  C:\Windows\System\CxGpAhM.exe
  2⤵
  PID:7852
- C:\Windows\System\AFVcHoo.exe
  C:\Windows\System\AFVcHoo.exe
  2⤵
  PID:7992
- C:\Windows\System\izWsnhP.exe
  C:\Windows\System\izWsnhP.exe
  2⤵
  PID:12252
- C:\Windows\System\dTinREQ.exe
  C:\Windows\System\dTinREQ.exe
  2⤵
  PID:12272
- C:\Windows\System\YwNsVzM.exe
  C:\Windows\System\YwNsVzM.exe
  2⤵
  PID:9504
- C:\Windows\System\ghMBamz.exe
  C:\Windows\System\ghMBamz.exe
  2⤵
  PID:11868
- C:\Windows\System\bZGAwAR.exe
  C:\Windows\System\bZGAwAR.exe
  2⤵
  PID:11220
- C:\Windows\System\zbGIfRn.exe
  C:\Windows\System\zbGIfRn.exe
  2⤵
  PID:10472
- C:\Windows\System\DUxUDkP.exe
  C:\Windows\System\DUxUDkP.exe
  2⤵
  PID:11556
- C:\Windows\System\bDDXZhP.exe
  C:\Windows\System\bDDXZhP.exe
  2⤵
  PID:10004
- C:\Windows\System\YlsduIH.exe
  C:\Windows\System\YlsduIH.exe
  2⤵
  PID:10756
- C:\Windows\System\cUuYgHd.exe
  C:\Windows\System\cUuYgHd.exe
  2⤵
  PID:9872
- C:\Windows\System\igqYRBf.exe
  C:\Windows\System\igqYRBf.exe
  2⤵
  PID:12972
- C:\Windows\System\lBmlSsq.exe
  C:\Windows\System\lBmlSsq.exe
  2⤵
  PID:10384
- C:\Windows\System\gAnjAKM.exe
  C:\Windows\System\gAnjAKM.exe
  2⤵
  PID:2800
- C:\Windows\System\ovQrRMT.exe
  C:\Windows\System\ovQrRMT.exe
  2⤵
  PID:12024
- C:\Windows\System\VtRdreJ.exe
  C:\Windows\System\VtRdreJ.exe
  2⤵
  PID:11952
- C:\Windows\System\KIClDvE.exe
  C:\Windows\System\KIClDvE.exe
  2⤵
  PID:10468
- C:\Windows\System\IZYoXDV.exe
  C:\Windows\System\IZYoXDV.exe
  2⤵
  PID:11528
- C:\Windows\System\gBFFTAN.exe
  C:\Windows\System\gBFFTAN.exe
  2⤵
  PID:12400
- C:\Windows\System\OSfZfjG.exe
  C:\Windows\System\OSfZfjG.exe
  2⤵
  PID:12560
- C:\Windows\System\OelxtFr.exe
  C:\Windows\System\OelxtFr.exe
  2⤵
  PID:11572
- C:\Windows\System\makSEOj.exe
  C:\Windows\System\makSEOj.exe
  2⤵
  PID:9812
- C:\Windows\System\bVgLSVb.exe
  C:\Windows\System\bVgLSVb.exe
  2⤵
  PID:10380
- C:\Windows\System\CPVziIv.exe
  C:\Windows\System\CPVziIv.exe
  2⤵
  PID:10208
- C:\Windows\System\fUGawiO.exe
  C:\Windows\System\fUGawiO.exe
  2⤵
  PID:11644
- C:\Windows\System\iNtFVrT.exe
  C:\Windows\System\iNtFVrT.exe
  2⤵
  PID:11180
- C:\Windows\System\FQaoWEj.exe
  C:\Windows\System\FQaoWEj.exe
  2⤵
  PID:11092
- C:\Windows\System\TIHQzjz.exe
  C:\Windows\System\TIHQzjz.exe
  2⤵
  PID:11992
- C:\Windows\System\aUSvpsw.exe
  C:\Windows\System\aUSvpsw.exe
  2⤵
  PID:12508
- C:\Windows\System\rswcPIW.exe
  C:\Windows\System\rswcPIW.exe
  2⤵
  PID:12552
- C:\Windows\System\fJrvQUV.exe
  C:\Windows\System\fJrvQUV.exe
  2⤵
  PID:13136
- C:\Windows\System\udenoPo.exe
  C:\Windows\System\udenoPo.exe
  2⤵
  PID:12020
- C:\Windows\System\fcBQyfe.exe
  C:\Windows\System\fcBQyfe.exe
  2⤵
  PID:12368
- C:\Windows\System\NmfhKzb.exe
  C:\Windows\System\NmfhKzb.exe
  2⤵
  PID:11684
- C:\Windows\System\jZUJpGd.exe
  C:\Windows\System\jZUJpGd.exe
  2⤵
  PID:7396
- C:\Windows\System\bZJbGHl.exe
  C:\Windows\System\bZJbGHl.exe
  2⤵
  PID:10788
- C:\Windows\System\lIFdYvH.exe
  C:\Windows\System\lIFdYvH.exe
  2⤵
  PID:3820
- C:\Windows\System\qCqkjXm.exe
  C:\Windows\System\qCqkjXm.exe
  2⤵
  PID:3228
- C:\Windows\System\hmoNYMJ.exe
  C:\Windows\System\hmoNYMJ.exe
  2⤵
  PID:3116
- C:\Windows\System\mznDQJo.exe
  C:\Windows\System\mznDQJo.exe
  2⤵
  PID:11052
- C:\Windows\System\eCfsPXa.exe
  C:\Windows\System\eCfsPXa.exe
  2⤵
  PID:11256
- C:\Windows\System\zAbRxpk.exe
  C:\Windows\System\zAbRxpk.exe
  2⤵
  PID:13408
- C:\Windows\System\yDeGlnL.exe
  C:\Windows\System\yDeGlnL.exe
  2⤵
  PID:13720
- C:\Windows\System\BQozXFY.exe
  C:\Windows\System\BQozXFY.exe
  2⤵
  PID:13752
- C:\Windows\System\yQPYlCy.exe
  C:\Windows\System\yQPYlCy.exe
  2⤵
  PID:13812
- C:\Windows\System\YfKZyNU.exe
  C:\Windows\System\YfKZyNU.exe
  2⤵
  PID:14168
- C:\Windows\System\DImnZKU.exe
  C:\Windows\System\DImnZKU.exe
  2⤵
  PID:14200
- C:\Windows\System\MEFSbht.exe
  C:\Windows\System\MEFSbht.exe
  2⤵
  PID:14272
- C:\Windows\System\QFChAwZ.exe
  C:\Windows\System\QFChAwZ.exe
  2⤵
  PID:14308
- C:\Windows\System\vEuGxJT.exe
  C:\Windows\System\vEuGxJT.exe
  2⤵
  PID:12900
- C:\Windows\System\iqdDsPh.exe
  C:\Windows\System\iqdDsPh.exe
  2⤵
  PID:12760
- C:\Windows\System\GUilkaw.exe
  C:\Windows\System\GUilkaw.exe
  2⤵
  PID:4328
- C:\Windows\System\nvAapEX.exe
  C:\Windows\System\nvAapEX.exe
  2⤵
  PID:12424
- C:\Windows\System\kpMkSqs.exe
  C:\Windows\System\kpMkSqs.exe
  2⤵
  PID:11076
- C:\Windows\System\bJwyWBQ.exe
  C:\Windows\System\bJwyWBQ.exe
  2⤵
  PID:13440
- C:\Windows\System\RdWYTav.exe
  C:\Windows\System\RdWYTav.exe
  2⤵
  PID:13584
- C:\Windows\System\YKLazjy.exe
  C:\Windows\System\YKLazjy.exe
  2⤵
  PID:13880
- C:\Windows\System\jksJyKx.exe
  C:\Windows\System\jksJyKx.exe
  2⤵
  PID:13772
- C:\Windows\System\Scgclfz.exe
  C:\Windows\System\Scgclfz.exe
  2⤵
  PID:13928
- C:\Windows\System\IskJkNv.exe
  C:\Windows\System\IskJkNv.exe
  2⤵
  PID:14208
- C:\Windows\System\VztHTKC.exe
  C:\Windows\System\VztHTKC.exe
  2⤵
  PID:14236
- C:\Windows\System\qMmIKoO.exe
  C:\Windows\System\qMmIKoO.exe
  2⤵
  PID:3960
- C:\Windows\System\MVDfOuy.exe
  C:\Windows\System\MVDfOuy.exe
  2⤵
  PID:4640
- C:\Windows\System\EqYddkw.exe
  C:\Windows\System\EqYddkw.exe
  2⤵
  PID:13480
- C:\Windows\System\rbQDTPJ.exe
  C:\Windows\System\rbQDTPJ.exe
  2⤵
  PID:13492
- C:\Windows\System\cSmfheI.exe
  C:\Windows\System\cSmfheI.exe
  2⤵
  PID:13460
- C:\Windows\System\ghXZooR.exe
  C:\Windows\System\ghXZooR.exe
  2⤵
  PID:13612
- C:\Windows\System\vECYVUs.exe
  C:\Windows\System\vECYVUs.exe
  2⤵
  PID:13588
- C:\Windows\System\KsKgOVh.exe
  C:\Windows\System\KsKgOVh.exe
  2⤵
  PID:13764
- C:\Windows\System\OxriwoN.exe
  C:\Windows\System\OxriwoN.exe
  2⤵
  PID:1388
- C:\Windows\System\MSRfjoi.exe
  C:\Windows\System\MSRfjoi.exe
  2⤵
  PID:1836
- C:\Windows\System\BqNLyod.exe
  C:\Windows\System\BqNLyod.exe
  2⤵
  PID:2616
- C:\Windows\System\aloNeGl.exe
  C:\Windows\System\aloNeGl.exe
  2⤵
  PID:13616
- C:\Windows\System\zByAiBI.exe
  C:\Windows\System\zByAiBI.exe
  2⤵
  PID:13556
- C:\Windows\System\ZXNtwJG.exe
  C:\Windows\System\ZXNtwJG.exe
  2⤵
  PID:13836
- C:\Windows\System\YIztEcO.exe
  C:\Windows\System\YIztEcO.exe
  2⤵
  PID:13936
- C:\Windows\System\TMjHdqs.exe
  C:\Windows\System\TMjHdqs.exe
  2⤵
  PID:13916
- C:\Windows\System\nTlLQlT.exe
  C:\Windows\System\nTlLQlT.exe
  2⤵
  PID:14020
- C:\Windows\System\XyUMCkZ.exe
  C:\Windows\System\XyUMCkZ.exe
  2⤵
  PID:14072
- C:\Windows\System\ajzMwkG.exe
  C:\Windows\System\ajzMwkG.exe
  2⤵
  PID:14024
- C:\Windows\System\WPUyvWy.exe
  C:\Windows\System\WPUyvWy.exe
  2⤵
  PID:14112
- C:\Windows\System\hPmrKDy.exe
  C:\Windows\System\hPmrKDy.exe
  2⤵
  PID:13776
- C:\Windows\System\UbuFtoK.exe
  C:\Windows\System\UbuFtoK.exe
  2⤵
  PID:2832
- C:\Windows\System\VyyYceG.exe
  C:\Windows\System\VyyYceG.exe
  2⤵
  PID:14176
- C:\Windows\System\CZgiaHO.exe
  C:\Windows\System\CZgiaHO.exe
  2⤵
  PID:14292
- C:\Windows\System\oQpcXfN.exe
  C:\Windows\System\oQpcXfN.exe
  2⤵
  PID:14148
- C:\Windows\System\MZOcrVX.exe
  C:\Windows\System\MZOcrVX.exe
  2⤵
  PID:14108
- C:\Windows\System\HhnkYla.exe
  C:\Windows\System\HhnkYla.exe
  2⤵
  PID:336
- C:\Windows\System\oKjhCQy.exe
  C:\Windows\System\oKjhCQy.exe
  2⤵
  PID:3164
- C:\Windows\System\gzgrHod.exe
  C:\Windows\System\gzgrHod.exe
  2⤵
  PID:13988
- C:\Windows\System\yqVIpTJ.exe
  C:\Windows\System\yqVIpTJ.exe
  2⤵
  PID:13364
- C:\Windows\System\gUHOvhO.exe
  C:\Windows\System\gUHOvhO.exe
  2⤵
  PID:3816
- C:\Windows\System\lWSolLZ.exe
  C:\Windows\System\lWSolLZ.exe
  2⤵
  PID:2932
- C:\Windows\System\FPPFItD.exe
  C:\Windows\System\FPPFItD.exe
  2⤵
  PID:13532
- C:\Windows\System\tqzqkCc.exe
  C:\Windows\System\tqzqkCc.exe
  2⤵
  PID:992
- C:\Windows\System\rHlHaIn.exe
  C:\Windows\System\rHlHaIn.exe
  2⤵
  PID:13524
- C:\Windows\System\mAsMkQr.exe
  C:\Windows\System\mAsMkQr.exe
  2⤵
  PID:4624
- C:\Windows\System\HgaHFyj.exe
  C:\Windows\System\HgaHFyj.exe
  2⤵
  PID:12740
- C:\Windows\System\wZyVolV.exe
  C:\Windows\System\wZyVolV.exe
  2⤵
  PID:13716
- C:\Windows\System\SSyWkKO.exe
  C:\Windows\System\SSyWkKO.exe
  2⤵
  PID:1988
- C:\Windows\System\KkEgCdb.exe
  C:\Windows\System\KkEgCdb.exe
  2⤵
  PID:4496
- C:\Windows\System\HJBOnYL.exe
  C:\Windows\System\HJBOnYL.exe
  2⤵
  PID:13824
- C:\Windows\System\xLqraPu.exe
  C:\Windows\System\xLqraPu.exe
  2⤵
  PID:4584
- C:\Windows\System\xDkoSma.exe
  C:\Windows\System\xDkoSma.exe
  2⤵
  PID:3328
- C:\Windows\System\wWSHfVl.exe
  C:\Windows\System\wWSHfVl.exe
  2⤵
  PID:4700
- C:\Windows\System\RPwJhxu.exe
  C:\Windows\System\RPwJhxu.exe
  2⤵
  PID:3232
- C:\Windows\System\wPjfgVX.exe
  C:\Windows\System\wPjfgVX.exe
  2⤵
  PID:3864
- C:\Windows\System\PnouaXx.exe
  C:\Windows\System\PnouaXx.exe
  2⤵
  PID:14116
- C:\Windows\System\VHqkeFu.exe
  C:\Windows\System\VHqkeFu.exe
  2⤵
  PID:14160
- C:\Windows\System\odnyJps.exe
  C:\Windows\System\odnyJps.exe
  2⤵
  PID:1588
- C:\Windows\System\MJgaelF.exe
  C:\Windows\System\MJgaelF.exe
  2⤵
  PID:1528
- C:\Windows\System\HyHAXuq.exe
  C:\Windows\System\HyHAXuq.exe
  2⤵
  PID:3784
- C:\Windows\System\zuUQpNm.exe
  C:\Windows\System\zuUQpNm.exe
  2⤵
  PID:14052
- C:\Windows\System\OsvMkRN.exe
  C:\Windows\System\OsvMkRN.exe
  2⤵
  PID:1488
- C:\Windows\System\qPkpqpi.exe
  C:\Windows\System\qPkpqpi.exe
  2⤵
  PID:14304
- C:\Windows\System\DemNWQF.exe
  C:\Windows\System\DemNWQF.exe
  2⤵
  PID:2464
- C:\Windows\System\XCCcfrG.exe
  C:\Windows\System\XCCcfrG.exe
  2⤵
  PID:1744
- C:\Windows\System\ZMQXxqa.exe
  C:\Windows\System\ZMQXxqa.exe
  2⤵
  PID:5960
- C:\Windows\System\noYnsBv.exe
  C:\Windows\System\noYnsBv.exe
  2⤵
  PID:6860
- C:\Windows\System\BTWimnE.exe
  C:\Windows\System\BTWimnE.exe
  2⤵
  PID:7088
- C:\Windows\System\LHwToTX.exe
  C:\Windows\System\LHwToTX.exe
  2⤵
  PID:6108
- C:\Windows\System\bHGjDYZ.exe
  C:\Windows\System\bHGjDYZ.exe
  2⤵
  PID:800
- C:\Windows\System\UTINBzp.exe
  C:\Windows\System\UTINBzp.exe
  2⤵
  PID:1652
- C:\Windows\System\UZKmPJh.exe
  C:\Windows\System\UZKmPJh.exe
  2⤵
  PID:776
- C:\Windows\System\imwmphD.exe
  C:\Windows\System\imwmphD.exe
  2⤵
  PID:4792
- C:\Windows\System\vUjbKEk.exe
  C:\Windows\System\vUjbKEk.exe
  2⤵
  PID:2524
- C:\Windows\System\iELkQMA.exe
  C:\Windows\System\iELkQMA.exe
  2⤵
  PID:13872
- C:\Windows\System\btkLXRh.exe
  C:\Windows\System\btkLXRh.exe
  2⤵
  PID:5012
- C:\Windows\System\QuigFMS.exe
  C:\Windows\System\QuigFMS.exe
  2⤵
  PID:13912
- C:\Windows\System\CCJJUHL.exe
  C:\Windows\System\CCJJUHL.exe
  2⤵
  PID:13992
- C:\Windows\System\dPZQtoq.exe
  C:\Windows\System\dPZQtoq.exe
  2⤵
  PID:2624
- C:\Windows\System\whUVkTS.exe
  C:\Windows\System\whUVkTS.exe
  2⤵
  PID:6124
- C:\Windows\System\mtOyKaV.exe
  C:\Windows\System\mtOyKaV.exe
  2⤵
  PID:5296
- C:\Windows\System\eKNEfGV.exe
  C:\Windows\System\eKNEfGV.exe
  2⤵
  PID:14324
- C:\Windows\System\DZXxpGj.exe
  C:\Windows\System\DZXxpGj.exe
  2⤵
  PID:2288
- C:\Windows\System\KsXDjiH.exe
  C:\Windows\System\KsXDjiH.exe
  2⤵
  PID:4972
- C:\Windows\System\ptjYoXH.exe
  C:\Windows\System\ptjYoXH.exe
  2⤵
  PID:1552
- C:\Windows\System\BnLSJeM.exe
  C:\Windows\System\BnLSJeM.exe
  2⤵
  PID:2872
- C:\Windows\System\ftpMMKZ.exe
  C:\Windows\System\ftpMMKZ.exe
  2⤵
  PID:1416
- C:\Windows\System\MVTqlqL.exe
  C:\Windows\System\MVTqlqL.exe
  2⤵
  PID:2572
- C:\Windows\System\LqJWjqr.exe
  C:\Windows\System\LqJWjqr.exe
  2⤵
  PID:13876
- C:\Windows\System\KihsOWL.exe
  C:\Windows\System\KihsOWL.exe
  2⤵
  PID:13932
- C:\Windows\System\BhGtWjm.exe
  C:\Windows\System\BhGtWjm.exe
  2⤵
  PID:4708
- C:\Windows\System\CuOKORx.exe
  C:\Windows\System\CuOKORx.exe
  2⤵
  PID:2176
- C:\Windows\System\udLIrRW.exe
  C:\Windows\System\udLIrRW.exe
  2⤵
  PID:1808
- C:\Windows\System\rcufoSc.exe
  C:\Windows\System\rcufoSc.exe
  2⤵
  PID:14244
- C:\Windows\System\dJZIpaJ.exe
  C:\Windows\System\dJZIpaJ.exe
  2⤵
  PID:1824
- C:\Windows\System\HESttvp.exe
  C:\Windows\System\HESttvp.exe
  2⤵
  PID:11888
- C:\Windows\System\vpoMKgf.exe
  C:\Windows\System\vpoMKgf.exe
  2⤵
  PID:6440
- C:\Windows\System\ZFDixnf.exe
  C:\Windows\System\ZFDixnf.exe
  2⤵
  PID:4804
- C:\Windows\System\zbiaTVH.exe
  C:\Windows\System\zbiaTVH.exe
  2⤵
  PID:10668
- C:\Windows\System\LPLGcyN.exe
  C:\Windows\System\LPLGcyN.exe
  2⤵
  PID:1484
- C:\Windows\System\xhPNYzH.exe
  C:\Windows\System\xhPNYzH.exe
  2⤵
  PID:4768
- C:\Windows\System\zRgHXod.exe
  C:\Windows\System\zRgHXod.exe
  2⤵
  PID:13792
- C:\Windows\System\PvRytFo.exe
  C:\Windows\System\PvRytFo.exe
  2⤵
  PID:2764
- C:\Windows\System\hpWVfub.exe
  C:\Windows\System\hpWVfub.exe
  2⤵
  PID:4272
- C:\Windows\System\kzGGbhK.exe
  C:\Windows\System\kzGGbhK.exe
  2⤵
  PID:924
- C:\Windows\System\TwJzoTn.exe
  C:\Windows\System\TwJzoTn.exe
  2⤵
  PID:1684
- C:\Windows\System\aZlOxau.exe
  C:\Windows\System\aZlOxau.exe
  2⤵
  PID:4904
- C:\Windows\System\BwscKXi.exe
  C:\Windows\System\BwscKXi.exe
  2⤵
  PID:820
- C:\Windows\System\fGdBkOh.exe
  C:\Windows\System\fGdBkOh.exe
  2⤵
  PID:2828
- C:\Windows\System\ADcmuiy.exe
  C:\Windows\System\ADcmuiy.exe
  2⤵
  PID:8800
- C:\Windows\System\dgMHEyh.exe
  C:\Windows\System\dgMHEyh.exe
  2⤵
  PID:4052
- C:\Windows\System\HoKUtSS.exe
  C:\Windows\System\HoKUtSS.exe
  2⤵
  PID:13920
- C:\Windows\System\UBBesoV.exe
  C:\Windows\System\UBBesoV.exe
  2⤵
  PID:5128
- C:\Windows\System\eeyfbrA.exe
  C:\Windows\System\eeyfbrA.exe
  2⤵
  PID:5632
- C:\Windows\System\bJUFDeM.exe
  C:\Windows\System\bJUFDeM.exe
  2⤵
  PID:13340
- C:\Windows\System\OoehrUV.exe
  C:\Windows\System\OoehrUV.exe
  2⤵
  PID:2812
- C:\Windows\System\jtHElyT.exe
  C:\Windows\System\jtHElyT.exe
  2⤵
  PID:1648
- C:\Windows\System\oDzQPtt.exe
  C:\Windows\System\oDzQPtt.exe
  2⤵
  PID:2848
- C:\Windows\System\khUZZia.exe
  C:\Windows\System\khUZZia.exe
  2⤵
  PID:5808
- C:\Windows\System\uynAJCE.exe
  C:\Windows\System\uynAJCE.exe
  2⤵
  PID:5704
- C:\Windows\System\wQIZeUx.exe
  C:\Windows\System\wQIZeUx.exe
  2⤵
  PID:5952
- C:\Windows\System\AvDastx.exe
  C:\Windows\System\AvDastx.exe
  2⤵
  PID:5976
- C:\Windows\System\bkbnrNX.exe
  C:\Windows\System\bkbnrNX.exe
  2⤵
  PID:5600
- C:\Windows\System\XjwFIBc.exe
  C:\Windows\System\XjwFIBc.exe
  2⤵
  PID:3612
- C:\Windows\System\kAEfWBx.exe
  C:\Windows\System\kAEfWBx.exe
  2⤵
  PID:3108
- C:\Windows\System\gBYGLCY.exe
  C:\Windows\System\gBYGLCY.exe
  2⤵
  PID:13652
- C:\Windows\System\gDupBxx.exe
  C:\Windows\System\gDupBxx.exe
  2⤵
  PID:1044
- C:\Windows\System\sIxtTNp.exe
  C:\Windows\System\sIxtTNp.exe
  2⤵
  PID:1780
- C:\Windows\System\AeaWeiA.exe
  C:\Windows\System\AeaWeiA.exe
  2⤵
  PID:1288
- C:\Windows\System\ibtCgcX.exe
  C:\Windows\System\ibtCgcX.exe
  2⤵
  PID:5612
- C:\Windows\System\nqKhUiL.exe
  C:\Windows\System\nqKhUiL.exe
  2⤵
  PID:5516
- C:\Windows\System\DOQxSkc.exe
  C:\Windows\System\DOQxSkc.exe
  2⤵
  PID:5548
- C:\Windows\System\yInrwML.exe
  C:\Windows\System\yInrwML.exe
  2⤵
  PID:5840
- C:\Windows\System\ahTSvdh.exe
  C:\Windows\System\ahTSvdh.exe
  2⤵
  PID:3932
- C:\Windows\System\PlNwzFd.exe
  C:\Windows\System\PlNwzFd.exe
  2⤵
  PID:13516
- C:\Windows\System\FxewCkk.exe
  C:\Windows\System\FxewCkk.exe
  2⤵
  PID:7120
- C:\Windows\System\nLJHrFd.exe
  C:\Windows\System\nLJHrFd.exe
  2⤵
  PID:5912
- C:\Windows\System\lRAHpvt.exe
  C:\Windows\System\lRAHpvt.exe
  2⤵
  PID:13476
- C:\Windows\System\vTjonIs.exe
  C:\Windows\System\vTjonIs.exe
  2⤵
  PID:5916
- C:\Windows\System\lLiQlCw.exe
  C:\Windows\System\lLiQlCw.exe
  2⤵
  PID:6076
- C:\Windows\System\qpoefmG.exe
  C:\Windows\System\qpoefmG.exe
  2⤵
  PID:5032
- C:\Windows\System\TEPZtvC.exe
  C:\Windows\System\TEPZtvC.exe
  2⤵
  PID:5708
- C:\Windows\System\UaaoOce.exe
  C:\Windows\System\UaaoOce.exe
  2⤵
  PID:5192
- C:\Windows\System\CmOebUT.exe
  C:\Windows\System\CmOebUT.exe
  2⤵
  PID:13700
- C:\Windows\System\AgfLsJD.exe
  C:\Windows\System\AgfLsJD.exe
  2⤵
  PID:7224
- C:\Windows\System\bKNqQCE.exe
  C:\Windows\System\bKNqQCE.exe
  2⤵
  PID:6428
- C:\Windows\System\wAslbXc.exe
  C:\Windows\System\wAslbXc.exe
  2⤵
  PID:3636
- C:\Windows\System\AWlKsyj.exe
  C:\Windows\System\AWlKsyj.exe
  2⤵
  PID:6896
- C:\Windows\System\LIybvfU.exe
  C:\Windows\System\LIybvfU.exe
  2⤵
  PID:5152
- C:\Windows\System\zCsHcPT.exe
  C:\Windows\System\zCsHcPT.exe
  2⤵
  PID:6036
- C:\Windows\System\kqNUBLc.exe
  C:\Windows\System\kqNUBLc.exe
  2⤵
  PID:14216
- C:\Windows\System\hzoQdZS.exe
  C:\Windows\System\hzoQdZS.exe
  2⤵
  PID:7352
- C:\Windows\System\EYjGGxh.exe
  C:\Windows\System\EYjGGxh.exe
  2⤵
  PID:4460
- C:\Windows\System\EwlXqFD.exe
  C:\Windows\System\EwlXqFD.exe
  2⤵
  PID:6132
- C:\Windows\System\dfwGKFT.exe
  C:\Windows\System\dfwGKFT.exe
  2⤵
  PID:7240
- C:\Windows\System\bzzzplH.exe
  C:\Windows\System\bzzzplH.exe
  2⤵
  PID:6184
- C:\Windows\System\AFgYXZk.exe
  C:\Windows\System\AFgYXZk.exe
  2⤵
  PID:7196
- C:\Windows\System\kFKItvn.exe
  C:\Windows\System\kFKItvn.exe
  2⤵
  PID:6204
- C:\Windows\System\XkJylej.exe
  C:\Windows\System\XkJylej.exe
  2⤵
  PID:5356
- C:\Windows\System\epionzb.exe
  C:\Windows\System\epionzb.exe
  2⤵
  PID:6360
- C:\Windows\System\cTTAwqe.exe
  C:\Windows\System\cTTAwqe.exe
  2⤵
  PID:6348
- C:\Windows\System\NvQXiFo.exe
  C:\Windows\System\NvQXiFo.exe
  2⤵
  PID:6936
- C:\Windows\System\imzWheB.exe
  C:\Windows\System\imzWheB.exe
  2⤵
  PID:628
- C:\Windows\System\sIfXRQG.exe
  C:\Windows\System\sIfXRQG.exe
  2⤵
  PID:8668
- C:\Windows\System\Btxehnz.exe
  C:\Windows\System\Btxehnz.exe
  2⤵
  PID:6268
- C:\Windows\System\SXUPpyT.exe
  C:\Windows\System\SXUPpyT.exe
  2⤵
  PID:7292
- C:\Windows\System\lYriWkZ.exe
  C:\Windows\System\lYriWkZ.exe
  2⤵
  PID:8832
- C:\Windows\System\bYARkDk.exe
  C:\Windows\System\bYARkDk.exe
  2⤵
  PID:8816
- C:\Windows\System\raXSRyo.exe
  C:\Windows\System\raXSRyo.exe
  2⤵
  PID:14188
- C:\Windows\System\fDdEHSP.exe
  C:\Windows\System\fDdEHSP.exe
  2⤵
  PID:6612
- C:\Windows\System\VTHItjl.exe
  C:\Windows\System\VTHItjl.exe
  2⤵
  PID:6680
- C:\Windows\System\izbwpJm.exe
  C:\Windows\System\izbwpJm.exe
  2⤵
  PID:8700
- C:\Windows\System\dTcbuhW.exe
  C:\Windows\System\dTcbuhW.exe
  2⤵
  PID:7812
- C:\Windows\System\azGmMXL.exe
  C:\Windows\System\azGmMXL.exe
  2⤵
  PID:8604
- C:\Windows\System\hfKamxn.exe
  C:\Windows\System\hfKamxn.exe
  2⤵
  PID:7280
- C:\Windows\System\kgpugTY.exe
  C:\Windows\System\kgpugTY.exe
  2⤵
  PID:8124
- C:\Windows\System\zNXWRgH.exe
  C:\Windows\System\zNXWRgH.exe
  2⤵
  PID:5308
- C:\Windows\System\bWuMebf.exe
  C:\Windows\System\bWuMebf.exe
  2⤵
  PID:6396
- C:\Windows\System\OiIYNTE.exe
  C:\Windows\System\OiIYNTE.exe
  2⤵
  PID:9172
- C:\Windows\System\gOYARpZ.exe
  C:\Windows\System\gOYARpZ.exe
  2⤵
  PID:9816
- C:\Windows\System\jxzJHZF.exe
  C:\Windows\System\jxzJHZF.exe
  2⤵
  PID:9016
- C:\Windows\System\viwBFfR.exe
  C:\Windows\System\viwBFfR.exe
  2⤵
  PID:9800
- C:\Windows\System\cCJnZxO.exe
  C:\Windows\System\cCJnZxO.exe
  2⤵
  PID:7600
- C:\Windows\System\CmZhRQJ.exe
  C:\Windows\System\CmZhRQJ.exe
  2⤵
  PID:5736
- C:\Windows\System\PuLgOyV.exe
  C:\Windows\System\PuLgOyV.exe
  2⤵
  PID:7416
- C:\Windows\System\kqkDEqK.exe
  C:\Windows\System\kqkDEqK.exe
  2⤵
  PID:8452
- C:\Windows\System\AWAVkUw.exe
  C:\Windows\System\AWAVkUw.exe
  2⤵
  PID:644
- C:\Windows\System\aAyDyvc.exe
  C:\Windows\System\aAyDyvc.exe
  2⤵
  PID:10184
- C:\Windows\System\SIUwXqj.exe
  C:\Windows\System\SIUwXqj.exe
  2⤵
  PID:13020
- C:\Windows\System\MdTWtta.exe
  C:\Windows\System\MdTWtta.exe
  2⤵
  PID:8720
- C:\Windows\System\vMxHShD.exe
  C:\Windows\System\vMxHShD.exe
  2⤵
  PID:9128
- C:\Windows\System\JsNYHCM.exe
  C:\Windows\System\JsNYHCM.exe
  2⤵
  PID:7952
- C:\Windows\System\zvsfexQ.exe
  C:\Windows\System\zvsfexQ.exe
  2⤵
  PID:1864
- C:\Windows\System\fRxGuOc.exe
  C:\Windows\System\fRxGuOc.exe
  2⤵
  PID:5628
- C:\Windows\System\JbFkiNX.exe
  C:\Windows\System\JbFkiNX.exe
  2⤵
  PID:8092
- C:\Windows\System\YGeywuJ.exe
  C:\Windows\System\YGeywuJ.exe
  2⤵
  PID:7648
- C:\Windows\System\tBeNYuZ.exe
  C:\Windows\System\tBeNYuZ.exe
  2⤵
  PID:8308
- C:\Windows\System\CXnKrMc.exe
  C:\Windows\System\CXnKrMc.exe
  2⤵
  PID:8128
- C:\Windows\System\LPvKIiL.exe
  C:\Windows\System\LPvKIiL.exe
  2⤵
  PID:9764
- C:\Windows\System\efeOIvU.exe
  C:\Windows\System\efeOIvU.exe
  2⤵
  PID:7612
- C:\Windows\System\NMQFeVu.exe
  C:\Windows\System\NMQFeVu.exe
  2⤵
  PID:7512
- C:\Windows\System\LtkiLAv.exe
  C:\Windows\System\LtkiLAv.exe
  2⤵
  PID:10132
- C:\Windows\System\jCFSVaj.exe
  C:\Windows\System\jCFSVaj.exe
  2⤵
  PID:9932
- C:\Windows\System\cMliPqW.exe
  C:\Windows\System\cMliPqW.exe
  2⤵
  PID:7624
- C:\Windows\System\JJiHyZT.exe
  C:\Windows\System\JJiHyZT.exe
  2⤵
  PID:8148
- C:\Windows\System\kqDXLHG.exe
  C:\Windows\System\kqDXLHG.exe
  2⤵
  PID:9072
- C:\Windows\System\zcmelLD.exe
  C:\Windows\System\zcmelLD.exe
  2⤵
  PID:7320
- C:\Windows\System\diNJJqu.exe
  C:\Windows\System\diNJJqu.exe
  2⤵
  PID:10952
- C:\Windows\System\ssRTuDG.exe
  C:\Windows\System\ssRTuDG.exe
  2⤵
  PID:9488
- C:\Windows\System\ANEakzQ.exe
  C:\Windows\System\ANEakzQ.exe
  2⤵
  PID:7024
- C:\Windows\System\PEqyqLn.exe
  C:\Windows\System\PEqyqLn.exe
  2⤵
  PID:10956
- C:\Windows\System\ebSQYvy.exe
  C:\Windows\System\ebSQYvy.exe
  2⤵
  PID:1504
- C:\Windows\System\iEDtkcr.exe
  C:\Windows\System\iEDtkcr.exe
  2⤵
  PID:8696
- C:\Windows\System\rFIgUys.exe
  C:\Windows\System\rFIgUys.exe
  2⤵
  PID:7268
- C:\Windows\System\mdSEBIy.exe
  C:\Windows\System\mdSEBIy.exe
  2⤵
  PID:11188
- C:\Windows\System\opQvuny.exe
  C:\Windows\System\opQvuny.exe
  2⤵
  PID:9708
- C:\Windows\System\fksnyPY.exe
  C:\Windows\System\fksnyPY.exe
  2⤵
  PID:11196
- C:\Windows\System\jsTRdEe.exe
  C:\Windows\System\jsTRdEe.exe
  2⤵
  PID:11200
- C:\Windows\System\fNEQapO.exe
  C:\Windows\System\fNEQapO.exe
  2⤵
  PID:10072
- C:\Windows\System\cxJjOxh.exe
  C:\Windows\System\cxJjOxh.exe
  2⤵
  PID:6256
- C:\Windows\System\aEfgaOS.exe
  C:\Windows\System\aEfgaOS.exe
  2⤵
  PID:9160
- C:\Windows\System\PvTHeas.exe
  C:\Windows\System\PvTHeas.exe
  2⤵
  PID:8144
- C:\Windows\System\uYqQsyd.exe
  C:\Windows\System\uYqQsyd.exe
  2⤵
  PID:8040
- C:\Windows\System\hFacwFv.exe
  C:\Windows\System\hFacwFv.exe
  2⤵
  PID:8368
- C:\Windows\System\ogiGnzL.exe
  C:\Windows\System\ogiGnzL.exe
  2⤵
  PID:8352
- C:\Windows\System\KIaepDA.exe
  C:\Windows\System\KIaepDA.exe
  2⤵
  PID:9744
- C:\Windows\System\gdEIbAg.exe
  C:\Windows\System\gdEIbAg.exe
  2⤵
  PID:7620
- C:\Windows\System\FXLsISm.exe
  C:\Windows\System\FXLsISm.exe
  2⤵
  PID:10172
- C:\Windows\System\iDSlRMr.exe
  C:\Windows\System\iDSlRMr.exe
  2⤵
  PID:1092
- C:\Windows\System\EtLoPaz.exe
  C:\Windows\System\EtLoPaz.exe
  2⤵
  PID:8336
- C:\Windows\System\jiquvkV.exe
  C:\Windows\System\jiquvkV.exe
  2⤵
  PID:10856
- C:\Windows\System\bUmDuJX.exe
  C:\Windows\System\bUmDuJX.exe
  2⤵
  PID:9464
- C:\Windows\System\tRQIsyU.exe
  C:\Windows\System\tRQIsyU.exe
  2⤵
  PID:9052
- C:\Windows\System\AUKssiJ.exe
  C:\Windows\System\AUKssiJ.exe
  2⤵
  PID:6444
- C:\Windows\System\jaBPpWB.exe
  C:\Windows\System\jaBPpWB.exe
  2⤵
  PID:11352
- C:\Windows\System\QJycXnl.exe
  C:\Windows\System\QJycXnl.exe
  2⤵
  PID:10412
- C:\Windows\System\kCWEOIH.exe
  C:\Windows\System\kCWEOIH.exe
  2⤵
  PID:12564
- C:\Windows\System\dSBbWbP.exe
  C:\Windows\System\dSBbWbP.exe
  2⤵
  PID:7288
- C:\Windows\System\kYqwSAj.exe
  C:\Windows\System\kYqwSAj.exe
  2⤵
  PID:9064
- C:\Windows\System\cjglEPk.exe
  C:\Windows\System\cjglEPk.exe
  2⤵
  PID:8460
- C:\Windows\System\dSEiFGP.exe
  C:\Windows\System\dSEiFGP.exe
  2⤵
  PID:8928
- C:\Windows\System\BnrgvQS.exe
  C:\Windows\System\BnrgvQS.exe
  2⤵
  PID:8236
- C:\Windows\System\FQaPMiy.exe
  C:\Windows\System\FQaPMiy.exe
  2⤵
  PID:12060
- C:\Windows\System\KxDpStc.exe
  C:\Windows\System\KxDpStc.exe
  2⤵
  PID:13164
- C:\Windows\System\Uygsswn.exe
  C:\Windows\System\Uygsswn.exe
  2⤵
  PID:12996
- C:\Windows\System\xNkcDHr.exe
  C:\Windows\System\xNkcDHr.exe
  2⤵
  PID:8872
- C:\Windows\System\cygwoln.exe
  C:\Windows\System\cygwoln.exe
  2⤵
  PID:11656
- C:\Windows\System\VBHGWNI.exe
  C:\Windows\System\VBHGWNI.exe
  2⤵
  PID:968
- C:\Windows\System\KjyHWCj.exe
  C:\Windows\System\KjyHWCj.exe
  2⤵
  PID:6872
- C:\Windows\System\RvLiOQD.exe
  C:\Windows\System\RvLiOQD.exe
  2⤵
  PID:11740
- C:\Windows\System\oApfnlA.exe
  C:\Windows\System\oApfnlA.exe
  2⤵
  PID:6996
- C:\Windows\System\yEJpmNr.exe
  C:\Windows\System\yEJpmNr.exe
  2⤵
  PID:4520
- C:\Windows\System\kNOjHeh.exe
  C:\Windows\System\kNOjHeh.exe
  2⤵
  PID:11008
- C:\Windows\System\fNNnyvR.exe
  C:\Windows\System\fNNnyvR.exe
  2⤵
  PID:6436
- C:\Windows\System\VIFoCKl.exe
  C:\Windows\System\VIFoCKl.exe
  2⤵
  PID:10236
- C:\Windows\System\hVRZLwl.exe
  C:\Windows\System\hVRZLwl.exe
  2⤵
  PID:10376
- C:\Windows\System\kdbVbvR.exe
  C:\Windows\System\kdbVbvR.exe
  2⤵
  PID:13260
- C:\Windows\System\gxvBzvc.exe
  C:\Windows\System\gxvBzvc.exe
  2⤵
  PID:10116
- C:\Windows\System\GpEcgXR.exe
  C:\Windows\System\GpEcgXR.exe
  2⤵
  PID:9340
- C:\Windows\System\egCOZUx.exe
  C:\Windows\System\egCOZUx.exe
  2⤵
  PID:12820
- C:\Windows\System\UNDOgpz.exe
  C:\Windows\System\UNDOgpz.exe
  2⤵
  PID:12640
- C:\Windows\System\CNigkJN.exe
  C:\Windows\System\CNigkJN.exe
  2⤵
  PID:12868
- C:\Windows\System\XyDvrkN.exe
  C:\Windows\System\XyDvrkN.exe
  2⤵
  PID:13284
- C:\Windows\System\ZZSieAp.exe
  C:\Windows\System\ZZSieAp.exe
  2⤵
  PID:12152
- C:\Windows\System\zlPRRcV.exe
  C:\Windows\System\zlPRRcV.exe
  2⤵
  PID:7316
- C:\Windows\System\SQSbrmn.exe
  C:\Windows\System\SQSbrmn.exe
  2⤵
  PID:4456
- C:\Windows\System\XBjmLDE.exe
  C:\Windows\System\XBjmLDE.exe
  2⤵
  PID:7784
- C:\Windows\System\Abevoqv.exe
  C:\Windows\System\Abevoqv.exe
  2⤵
  PID:8616
- C:\Windows\System\UTugwZQ.exe
  C:\Windows\System\UTugwZQ.exe
  2⤵
  PID:5360
- C:\Windows\System\zoLTSOM.exe
  C:\Windows\System\zoLTSOM.exe
  2⤵
  PID:10736
- C:\Windows\System\sApkryU.exe
  C:\Windows\System\sApkryU.exe
  2⤵
  PID:10880
- C:\Windows\System\udbZXOa.exe
  C:\Windows\System\udbZXOa.exe
  2⤵
  PID:11848
- C:\Windows\System\OpSoSqf.exe
  C:\Windows\System\OpSoSqf.exe
  2⤵
  PID:8624
- C:\Windows\System\zdkmWYL.exe
  C:\Windows\System\zdkmWYL.exe
  2⤵
  PID:12300
- C:\Windows\System\YfWUJxL.exe
  C:\Windows\System\YfWUJxL.exe
  2⤵
  PID:9092
- C:\Windows\System\JBwhasl.exe
  C:\Windows\System\JBwhasl.exe
  2⤵
  PID:9692
- C:\Windows\System\NjuWsNn.exe
  C:\Windows\System\NjuWsNn.exe
  2⤵
  PID:11652
- C:\Windows\System\agkbNDe.exe
  C:\Windows\System\agkbNDe.exe
  2⤵
  PID:8592
- C:\Windows\System\EWhTzWw.exe
  C:\Windows\System\EWhTzWw.exe
  2⤵
  PID:12584
- C:\Windows\System\Kfsbnnc.exe
  C:\Windows\System\Kfsbnnc.exe
  2⤵
  PID:11332
- C:\Windows\System\pPJpKGl.exe
  C:\Windows\System\pPJpKGl.exe
  2⤵
  PID:11212
- C:\Windows\System\aGubaIJ.exe
  C:\Windows\System\aGubaIJ.exe
  2⤵
  PID:11104
- C:\Windows\System\YHlDLbW.exe
  C:\Windows\System\YHlDLbW.exe
  2⤵
  PID:13064
- C:\Windows\System\fBtOmxO.exe
  C:\Windows\System\fBtOmxO.exe
  2⤵
  PID:10508
- C:\Windows\System\QwQHjaQ.exe
  C:\Windows\System\QwQHjaQ.exe
  2⤵
  PID:11284
- C:\Windows\System\RhyXFrK.exe
  C:\Windows\System\RhyXFrK.exe
  2⤵
  PID:11276
- C:\Windows\System\BfhspXL.exe
  C:\Windows\System\BfhspXL.exe
  2⤵
  PID:5008
- C:\Windows\System\ymxNDJl.exe
  C:\Windows\System\ymxNDJl.exe
  2⤵
  PID:11436
- C:\Windows\System\mxkMOal.exe
  C:\Windows\System\mxkMOal.exe
  2⤵
  PID:10888
- C:\Windows\System\szHpTks.exe
  C:\Windows\System\szHpTks.exe
  2⤵
  PID:12944
- C:\Windows\System\oFhOJZU.exe
  C:\Windows\System\oFhOJZU.exe
  2⤵
  PID:11168
- C:\Windows\System\ToKkasq.exe
  C:\Windows\System\ToKkasq.exe
  2⤵
  PID:13304
- C:\Windows\System\jvcoohu.exe
  C:\Windows\System\jvcoohu.exe
  2⤵
  PID:9904
- C:\Windows\System\AXjSWFt.exe
  C:\Windows\System\AXjSWFt.exe
  2⤵
  PID:13056
- C:\Windows\System\tzCkKHJ.exe
  C:\Windows\System\tzCkKHJ.exe
  2⤵
  PID:12044
- C:\Windows\System\xMEJkRj.exe
  C:\Windows\System\xMEJkRj.exe
  2⤵
  PID:13088
- C:\Windows\System\qYtCQAx.exe
  C:\Windows\System\qYtCQAx.exe
  2⤵
  PID:4220
- C:\Windows\System\RAlLAFs.exe
  C:\Windows\System\RAlLAFs.exe
  2⤵
  PID:9824
- C:\Windows\System\TZbEWky.exe
  C:\Windows\System\TZbEWky.exe
  2⤵
  PID:6504
- C:\Windows\System\CtYHvVM.exe
  C:\Windows\System\CtYHvVM.exe
  2⤵
  PID:11780
- C:\Windows\System\obJgNHv.exe
  C:\Windows\System\obJgNHv.exe
  2⤵
  PID:7448
- C:\Windows\System\YiWlucj.exe
  C:\Windows\System\YiWlucj.exe
  2⤵
  PID:11836
- C:\Windows\System\hjjhNQg.exe
  C:\Windows\System\hjjhNQg.exe
  2⤵
  PID:11784
- C:\Windows\System\mbidZwV.exe
  C:\Windows\System\mbidZwV.exe
  2⤵
  PID:7108
- C:\Windows\System\pSlIbKt.exe
  C:\Windows\System\pSlIbKt.exe
  2⤵
  PID:12612
- C:\Windows\System\UXmIapx.exe
  C:\Windows\System\UXmIapx.exe
  2⤵
  PID:8520
- C:\Windows\System\etxcUDR.exe
  C:\Windows\System\etxcUDR.exe
  2⤵
  PID:11336
- C:\Windows\System\ebImVuL.exe
  C:\Windows\System\ebImVuL.exe
  2⤵
  PID:12500
- C:\Windows\System\KacqXbc.exe
  C:\Windows\System\KacqXbc.exe
  2⤵
  PID:12128
- C:\Windows\System\ZIoziZm.exe
  C:\Windows\System\ZIoziZm.exe
  2⤵
  PID:10252
- C:\Windows\System\wFosagi.exe
  C:\Windows\System\wFosagi.exe
  2⤵
  PID:11368
- C:\Windows\System\OdlJcYJ.exe
  C:\Windows\System\OdlJcYJ.exe
  2⤵
  PID:10864
- C:\Windows\System\TYRYDhr.exe
  C:\Windows\System\TYRYDhr.exe
  2⤵
  PID:11892
- C:\Windows\System\WWHFKVr.exe
  C:\Windows\System\WWHFKVr.exe
  2⤵
  PID:5268
- C:\Windows\System\OuBfWkx.exe
  C:\Windows\System\OuBfWkx.exe
  2⤵
  PID:10092
- C:\Windows\System\bxaKxbq.exe
  C:\Windows\System\bxaKxbq.exe
  2⤵
  PID:11700
- C:\Windows\System\XdBeeai.exe
  C:\Windows\System\XdBeeai.exe
  2⤵
  PID:11404
- C:\Windows\System\AxvyFof.exe
  C:\Windows\System\AxvyFof.exe
  2⤵
  PID:12372
- C:\Windows\System\NBKUZeO.exe
  C:\Windows\System\NBKUZeO.exe
  2⤵
  PID:10524
- C:\Windows\System\XFQiAds.exe
  C:\Windows\System\XFQiAds.exe
  2⤵
  PID:13032
- C:\Windows\System\PKVcpfp.exe
  C:\Windows\System\PKVcpfp.exe
  2⤵
  PID:10912
- C:\Windows\System\qraXaNc.exe
  C:\Windows\System\qraXaNc.exe
  2⤵
  PID:9220
- C:\Windows\System\WSzBreV.exe
  C:\Windows\System\WSzBreV.exe
  2⤵
  PID:10992
- C:\Windows\System\dQDtkKx.exe
  C:\Windows\System\dQDtkKx.exe
  2⤵
  PID:13144
- C:\Windows\System\MSmvZhQ.exe
  C:\Windows\System\MSmvZhQ.exe
  2⤵
  PID:12292
- C:\Windows\System\HjJPdNk.exe
  C:\Windows\System\HjJPdNk.exe
  2⤵
  PID:12456
- C:\Windows\System\IgYnKdD.exe
  C:\Windows\System\IgYnKdD.exe
  2⤵
  PID:12388
- C:\Windows\System\vjpXAME.exe
  C:\Windows\System\vjpXAME.exe
  2⤵
  PID:10416
- C:\Windows\System\quuqBRF.exe
  C:\Windows\System\quuqBRF.exe
  2⤵
  PID:12964
- C:\Windows\System\CUOwSwo.exe
  C:\Windows\System\CUOwSwo.exe
  2⤵
  PID:12460
- C:\Windows\System\Ekwnamb.exe
  C:\Windows\System\Ekwnamb.exe
  2⤵
  PID:13436
- C:\Windows\System\BgEMcCE.exe
  C:\Windows\System\BgEMcCE.exe
  2⤵
  PID:10868
- C:\Windows\System\AbITEQA.exe
  C:\Windows\System\AbITEQA.exe
  2⤵
  PID:13576
- C:\Windows\System\NGzECmg.exe
  C:\Windows\System\NGzECmg.exe
  2⤵
  PID:13732
- C:\Windows\System\sHdsLmM.exe
  C:\Windows\System\sHdsLmM.exe
  2⤵
  PID:12744
- C:\Windows\System\qBxuaRw.exe
  C:\Windows\System\qBxuaRw.exe
  2⤵
  PID:11724
- C:\Windows\System\cxrehHp.exe
  C:\Windows\System\cxrehHp.exe
  2⤵
  PID:9244
- C:\Windows\System\agplDZB.exe
  C:\Windows\System\agplDZB.exe
  2⤵
  PID:12480
- C:\Windows\System\tyTIdKp.exe
  C:\Windows\System\tyTIdKp.exe
  2⤵
  PID:12504
- C:\Windows\System\hOclLVo.exe
  C:\Windows\System\hOclLVo.exe
  2⤵
  PID:11640
- C:\Windows\System\hwSOWWa.exe
  C:\Windows\System\hwSOWWa.exe
  2⤵
  PID:12596
- C:\Windows\System\HjYzjmi.exe
  C:\Windows\System\HjYzjmi.exe
  2⤵
  PID:10108
- C:\Windows\System\YJKIQzi.exe
  C:\Windows\System\YJKIQzi.exe
  2⤵
  PID:2092
- C:\Windows\System\ahjgNln.exe
  C:\Windows\System\ahjgNln.exe
  2⤵
  PID:12976
- C:\Windows\System\hWtUjDH.exe
  C:\Windows\System\hWtUjDH.exe
  2⤵
  PID:9828
- C:\Windows\System\FqLzikv.exe
  C:\Windows\System\FqLzikv.exe
  2⤵
  PID:11412
- C:\Windows\System\nxRDMvA.exe
  C:\Windows\System\nxRDMvA.exe
  2⤵
  PID:11932
- C:\Windows\System\mIvEUxX.exe
  C:\Windows\System\mIvEUxX.exe
  2⤵
  PID:12528
- C:\Windows\System\njueDCp.exe
  C:\Windows\System\njueDCp.exe
  2⤵
  PID:12336
- C:\Windows\System\FPqQDWq.exe
  C:\Windows\System\FPqQDWq.exe
  2⤵
  PID:10496
- C:\Windows\System\dfdQNbU.exe
  C:\Windows\System\dfdQNbU.exe
  2⤵
  PID:13344
- C:\Windows\System\pzlTyDB.exe
  C:\Windows\System\pzlTyDB.exe
  2⤵
  PID:8392
- C:\Windows\System\fLFgWLd.exe
  C:\Windows\System\fLFgWLd.exe
  2⤵
  PID:12688
- C:\Windows\System\qBFKzqv.exe
  C:\Windows\System\qBFKzqv.exe
  2⤵
  PID:14180
- C:\Windows\System\nopSVXz.exe
  C:\Windows\System\nopSVXz.exe
  2⤵
  PID:4764
- C:\Windows\System\WfunnyJ.exe
  C:\Windows\System\WfunnyJ.exe
  2⤵
  PID:13572

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:13544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_figs5bus.52y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ALTKlvA.exe

Filesize
2.3MB

MD5
624808d04aed0c72ade6c591b2b10d6e

SHA1
5187bdfd70a24196fcc8db373d80809ab93e2b5f

SHA256
5d393c6880eb9e6cdd30a0520acb5c1523dc3c9f605e111f9610858f7e36c336

SHA512
54d0eaa7d067d0459a01195f715a07ddd0546f0490df13d770fe59d14e1787a2bda7f8e30fc9a7ffba681d280141f45b5ca961f0ab10d74dbdf28a4fa487da73

Download Submit
C:\Windows\System\BcnSCIc.exe

Filesize
2.3MB

MD5
9fa7a88e586ee72c79dc0a22bf88a696

SHA1
d8855fc96f9d2ccd455a19d231279eb3973d7e80

SHA256
49baad787a2609e4f20a564bc21e9bd3bfd597d22bc1c70034f3a23e42b4b5e0

SHA512
7c6e743fd9cc685e524cdfe5bbd5174010d9a019434ea40921edac8ead361009c92f7c28996097adee9c06cbf438e5f781743721fcbbcddd524760f2ded092e4

Download Submit
C:\Windows\System\COuXuTf.exe

Filesize
2.3MB

MD5
63e7c00f7cc9da7f1c45612966607bc3

SHA1
6bbdbc22667b35eec4ad4dbd87cd3ec7fa15120d

SHA256
2a53b2ddfb0d015aafadba140e067b5e91b0b207a7c58a922a03222d733775db

SHA512
2bca0fa980c43b2b6d6f198a5753363e310bee3bd7e42b6e1ce57c05b7b92eab37bba9c05adfc8ee7c0529fe7d660178cb0a55b443c4f572f60bb68732fad682

Download Submit
C:\Windows\System\CldodyZ.exe

Filesize
2.3MB

MD5
eebb8acb18113611a7901774ef4dbe6d

SHA1
1ac8fb1a171eb00490079726b2434f26223d9c8a

SHA256
67a91afbe98fa38ba9fdcc3aa649cd0359c86e9c20240ba75e1cb55f2210aa43

SHA512
ebfa9598cf4d1d94416e765bc77b6669d451eeb04039ae5061a21597f9316864a10971f74c02ee92025564e53beaf98d3087569d4f9ffd19d8ba9aa808c80f02

Download Submit
C:\Windows\System\FoNYEPf.exe

Filesize
2.3MB

MD5
4d964233f3cf3f1e019ab91b3a16ae83

SHA1
c2eecb186def85321c7bd54c56955c0cb284acec

SHA256
c6e5574f57ea9bc6d7bc027e72b57478c11061cd21c098ea1cc470e634f5cbb0

SHA512
8a0806bac2c36e38cc31425d23cde932002e08264de43cf5ab3587488d3ae213c1550c604305bfb51143cf1992628c408bb5b049bf5efc6cbeeb50725ffc6783

Download Submit
C:\Windows\System\GEKXaIV.exe

Filesize
2.3MB

MD5
15f602ed4c522a49fb2ae2ad9c59b863

SHA1
c5ba0c765f3d9719c397754d7a5339cdb6c1e929

SHA256
70ba7ac7038eb4acf770e52c8c181b46177dac659e467a7ca9cd9453af6f8a12

SHA512
71545e89db2a8aee869e7b35691a28e6235ba8558d5d224dd81e5145cc88d0b127928f14d0e914dd816744dc6810bf82cdf6b617badb52ca144fac7caeb5985f

Download Submit
C:\Windows\System\GmzdLjH.exe

Filesize
2.3MB

MD5
615b133e1cd8a6b67ed35ef010169c4b

SHA1
8da412b12f062e562782806824a89a6476d83d0f

SHA256
13215d5582168b268ee6466b4ceaf472a5ee26af8a535d2387bbfc70c2d55c78

SHA512
9f9f6d064a598f58fa099dda1525c7ddcf1429d3d40495ac0971aeaf2018c75db0eda7da7bb760f7fa6feba530304e866faf69dbd3eabced9f59574a8da02c2a

Download Submit
C:\Windows\System\IadlEbc.exe

Filesize
2.3MB

MD5
1ce317f913acb2a6d310b2013f20384a

SHA1
e5aa89c413e30713779a02931372e89ff6385705

SHA256
ee1384096b8423ab423e078f7bf3fba1a585fa8ce897396c56eed8063db08b48

SHA512
9002f8925f1bb388768f8bccf6858e52bb5c0fec930b4f70071c56c31734c427f4b61f1c80ae1ccfca594719b113b57d5620a25f2f8b575ce94fe8716bd7110e

Download Submit
C:\Windows\System\KOdnhjl.exe

Filesize
2.3MB

MD5
9a3cacd23e8cdab4e7cc1692aac1941d

SHA1
ffec364e2d39c9e96b9a240c38f2eb1a45d67249

SHA256
c188616226126f5a5e51b007de951916050b004a4bf07a9907819e38f6617bb7

SHA512
d894be0d6e63ad2a1dbd3421077ad1186dae6863e714788bcb433c2169ccd73b47a683c170122107c5e2c1d457df9ced2b571df591ee2cc235a798310157333f

Download Submit
C:\Windows\System\KggacdG.exe

Filesize
2.3MB

MD5
277f7ed9e4e5bc4a41bf83a1185a9b21

SHA1
d8bd31cb56b2794ec14c9aed45b402b62b4051e9

SHA256
5442134e965ab40c77c837580f0eaaa6b2f24b5d74aaad86905565ca646bc862

SHA512
757cebf4e71d5f06918f381313d8b17887c5ea13078d9439a3684c94eea6a0ed4b5cf36497273fd5196d078b8706bcde3820da8eb029a06d66b7b2ebafb1cfb1

Download Submit
C:\Windows\System\LTtVDQO.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\MTYSmAL.exe

Filesize
2.3MB

MD5
47727947ca37ede8a0591921ee3c8308

SHA1
55c423e09f7727a0aa1bbffb0e7ff41f238879dc

SHA256
b2017ed99e6fd119cc34d9df576ef517ca32137df2d02566a40fc394725b65c9

SHA512
a63e592604ebfadf1860f42a9c062d642b447ce33b6d2f809cb12962aa423d69af967e5cdf88f0572ae927a4ff12f0718dee6fa7498d1a81924dcbfe1460209e

Download Submit
C:\Windows\System\NPtIjxl.exe

Filesize
2.3MB

MD5
af3a4038ca04794b37391b13ffb363d1

SHA1
cde6bd23258b265330261c2c1b2f5e6cfa7a685e

SHA256
f0ce8aa9fee7a5943747cbdfa9444ec90cb21b32c74b1b997d2df2fdc13299da

SHA512
79b1eba2b2235f99183ed98bae69847ac386a5e32d5063ed98412d8a2fed31c39913fc6379cc52533cfd2aac4ded1a77de31b96fc4e7e874258b36862eb7a170

Download Submit
C:\Windows\System\OupdpqK.exe

Filesize
2.3MB

MD5
fc560f26418111fec9c679039d2a0722

SHA1
f1221df295bc805a793d7667c2f127f2a0d97cec

SHA256
35e74a287b105904959cf36b762343ea8fd1d67ccb43290d54e9ccd26ef24e60

SHA512
06b93c84169ec0bfa29e6f63da5672cff3dd85cfe7b25121a17b94ed2ab1879c47aa6bd347ee39a480d197e49e93c85679d525df26f4293b14fb71170934282e

Download Submit
C:\Windows\System\QWEatwH.exe

Filesize
2.3MB

MD5
ad8a52c661b62078b10b30268c6d716f

SHA1
eaff690c7451429b0c868555cc5bbaa26647500a

SHA256
0afa199799c8f68462ee644e24b1715675b53acb87c284b56478505605596101

SHA512
cc16a999732194c37e21c01906bacd9845a50696506050976bef99c91a542616aa62bf42e72f35d4ec8a29c7adfee584ff1bb167084fbabeb49fa85d26a79ffb

Download Submit
C:\Windows\System\QWkrSxL.exe

Filesize
2.3MB

MD5
3a7806427cba3b2243514b4bbee4fae4

SHA1
3ec8a4029ac309c03537779db69da211d0558567

SHA256
51156bba1f18a1aedce87518640f3cdb56349f4fc54606269171b3f1ec6454f6

SHA512
3af9f2b358878b43611a6febbdab5242f8abde5555ff700e6efaba6eb3f45d4f6cf1a68427a513cda5ebe8412c5867b71b2f0d019362059e94762b026e6d35f1

Download Submit
C:\Windows\System\RNzxZEI.exe

Filesize
2.3MB

MD5
4416e03db83a844e58f2be422e8b1fe1

SHA1
e774d801dea0e2c3556e5074cd70b7dc38d71e39

SHA256
4426fbebdd6b8a3143bbdfd3790b97347aabe81c7f3d6925cfa6524986c64d81

SHA512
8706a6f40eccf26f3f26c3047be6afbff4359f7679dae65a9ad5de0529ffbc6328316bc8f605af19813ddb989c871d690917950f05fc2ed227907579a9cbc87a

Download Submit
C:\Windows\System\SGppQzB.exe

Filesize
2.3MB

MD5
a3b607426f8a1c592be7c62569f4c4fd

SHA1
cd4eade9d613e594c8546b6c951e8928614d058b

SHA256
5dc87bf0056549e14239ac36fc72e4f676d13ef55416bfe851d52059ee7c5615

SHA512
b104dfecbd7fa77dc7bdf35ce6497caa8e24b68b9ca850ff4084232ac87201796ea8db2e203a795707a8f1313bdd4a80b80e95f3c862385e47cb57752cbeaedf

Download Submit
C:\Windows\System\SLCRgrS.exe

Filesize
2.3MB

MD5
962c46a256f37e501fffa9f2a1326cfc

SHA1
c2f0f6a574665ab4ffd0c9d646a21cec962ce1f4

SHA256
30f259db9a8a08114aed59f7f1a5da72499620687670391ca77dca611251268d

SHA512
ba901e1f043ef6252b309805e43a63f96a88ceaf4909f10865bd416f2f8536e38371446df3555155d685a1d7f4bdcec05e18adc1c4eb3351cbd1ed6a3dc0538e

Download Submit
C:\Windows\System\TlGcNal.exe

Filesize
2.3MB

MD5
79422516ac1df280913e412501914a6e

SHA1
4ee2c85f12f440f9a6ef1a8bb82934563e1b7784

SHA256
445286c9f78803a08635740995655e8209a6bcd28b256ca8073f8cfdbf3b9b85

SHA512
a0ebb02a849f0d6135b44701fabf897177f73f3c5eeb5b577ba8a8d7d65689d0151bffa1f06a19f835607bf8728e71c2bc8d6db21857977670b83f48bd2050d9

Download Submit
C:\Windows\System\TxEhsFa.exe

Filesize
2.3MB

MD5
903780bad14faf516fc94f709fdf87b6

SHA1
f75a5329e98515ad3aa26fd5f1a7276d356d68f4

SHA256
96d770eb7fea3a14ac9e12d78d6829dff7988419efc09327648782d6cb80651e

SHA512
10be7aadd66d64cc0e65e348174a553b9d7e0b13ee24a5889736fee337844cf45ef19583ce1431965d07d36cde2f90e66a940d4ae20bdede033adfac77c723d5

Download Submit
C:\Windows\System\WjjHJDl.exe

Filesize
2.3MB

MD5
58fed5b16849053d3f85e80f3d3cafc6

SHA1
60284b70c67270385979973bd401239cfb58131c

SHA256
68f4975c255edd971d71202741f123d599d14272ff8053b9a4d8856ead6395c6

SHA512
db6e2a7ab700bbedd845c4e4e3f5794ea083c44cbc025c5218375cc277bc0b085937eeb67ed0c7403b134dccf6e31591caa7efe63355c3ab7b62fbbf68ef7183

Download Submit
C:\Windows\System\XigNgKv.exe

Filesize
2.3MB

MD5
ebcb78d1331599c71cf3e9ab94c7277e

SHA1
94111db42a1287fd224e5f0c1790116386a48aae

SHA256
8c33d75d78aa74c06d0443962c63f71cb8cbd680550ef4b642b320ac04e5e761

SHA512
9aab288280c5364b55334be8e9da46e5a710eab4430718862f5ebb8aa392381967afc6a18362bc15ad5e1348727d67bed0faa7c8fbd760d50a6a1e9adb4c172a

Download Submit
C:\Windows\System\YSRDIVK.exe

Filesize
2.3MB

MD5
693a65fc3ebb188eb5d309d49b606453

SHA1
de7ba29fdb7cd6ebd5df9ff99d5dc1367b5059f2

SHA256
e9368d11d5847d48b5da13ecb8091a26cffa3841480898a85adc636a8a7fb5b3

SHA512
6a477e32207a6d102cfb4376fa716a7c7b4f25f27f5dec8d227f935e0b99ef3ff0ba9ef30b3689d0396f73f7610e3e82f67cdf7dc90513ad5417d11f96bf512e

Download Submit
C:\Windows\System\YpdCEtA.exe

Filesize
2.3MB

MD5
e2c03009ca85cbc47921928a0a8a117a

SHA1
ebe5140a96d88afef86eba6995bea5bffd5d94be

SHA256
d4254922bd341ec96f05c894ca293a4a8802e3ea0612ec9391222077ee0fd019

SHA512
c0f0b4c7e3910594c4efb969c9526ec7f393dbce3d2542f4b7ba545a87947dcf60120faa76471dda2f84a23b6cb2b4a1e86dbbe74f02b5dee1f868d41e0ec802

Download Submit
C:\Windows\System\ZCbjNTF.exe

Filesize
2.3MB

MD5
39a1a4011adac3f692b3793e169ac67b

SHA1
15a0ab3a48138f15977698c2b80492ec7c7a9861

SHA256
78099375516d4e469ef4e377fc07868375ed29c36b9407cdb980a843cf9aa726

SHA512
3dec8f9809431a601ae9373c75366453624a052d198a39f4d2ccbd0008df1ab34ccb0565e8fafe10720fe143e5255d4afc099515fff049b509495d1649376204

Download Submit
C:\Windows\System\ZSMXncy.exe

Filesize
2.3MB

MD5
a739ed9d7171b7854b5ec7a4228cb8f4

SHA1
bc32d2ed7de47244d1128da2add4a1bdc817473b

SHA256
1cb115c87aa07dedae4489c02cca4c5d0df0d4c6707bdb5b262c397b124f378a

SHA512
a122aa15e1771a7d66f98d94c6ad234ff3e879376950ea1b0becb8882e1c84ae30611d9180736dc4ab6df09d90e52dece348ec051b00d3cdf27c2e7b42c60aad

Download Submit
C:\Windows\System\cGcHjru.exe

Filesize
2.3MB

MD5
77b47f446ac683f3fc37ca22d386035b

SHA1
de55614c55419cb3300a68f48151b329900dbc98

SHA256
c9c9a5df6111e26c7ce7bb03749b1a17f47aad2b570f4620f34455cdbc3d76ba

SHA512
ff974466c1d6616b0e7f3247c16e284229ce65390e81d2dc0a7828d4713ef4556a3288253652ed69c5d3fad29ceb89231cb3d57c76618d059b2e87ffb5daa1b8

Download Submit
C:\Windows\System\cisxKLV.exe

Filesize
2.3MB

MD5
a4691ce204c7be1cba883e9f83ef7557

SHA1
3ab24a3dcdfbb56d264d851a70344f89b4f88ff0

SHA256
fb088c9fea0365a15e276b223ba2c636db4237abdc8aff674e9568e8e27d33c0

SHA512
6f864eb9552d7667c7d1ecc4ff326f3568128150a6c2f5a86306262882aee4fb6998522843ea9ba9eb8ca0f3a53a545dc33b3e02f666ccb6f5fae010a831b93e

Download Submit
C:\Windows\System\dRprzTc.exe

Filesize
2.3MB

MD5
778f18012085596e8cf633f0550dce79

SHA1
6b198b313202e102175a41bc7df171b435c732fa

SHA256
5fe3bf44c8ce269906d8ac6f5b7dd877d949174c5af88445cd6d63a8b692dd12

SHA512
12f19b03571e2513d4223f4ba85d1d17173910e328773def7eba555792354659af625ef1cc8caa58903c18cb07879039837a9b30121324ca19fa4f14e9104c5a

Download Submit
C:\Windows\System\dUiuayW.exe

Filesize
18B

MD5
042db3cca454b08b58bb73257239b438

SHA1
10e1bc7e7aa884031afcaafcefc742038d62d2cd

SHA256
510e41435a3d3cd5a736a89698b55c8a0f6d8d417f5acfd6cfca25146be56e68

SHA512
4790b4c15b8195254f6e315afe9f499a40aa9fc5aedba27229271073ad599e5f02d68cd51a7467384e5f09ff788d983132a63cbca82567af910557bf3b7bd269

Download Submit
C:\Windows\System\dXsiopi.exe

Filesize
2.3MB

MD5
6d3352c20f1748daa28960ffdc696059

SHA1
fc2ef98175a8dfc45d3b7462d583fefb17615254

SHA256
1ac4735f5725d7bcb52936dac194454752da70dbdba1817dafb85684f9783f92

SHA512
cd82e295f6df396e93a6ab9dc5fda77b31e29ba064f9ff9714a1675d87e2f075711f36760c7fa166f0204fe1c50855de4e7d828c5c52021b77f140cf50984087

Download Submit
C:\Windows\System\dcPTKpt.exe

Filesize
2.3MB

MD5
c905ca4fb9f45c3fc4fd59fd1b5551ed

SHA1
c611520522b0756e0eabcad198cdb4a614cf6ccd

SHA256
2c37a1375b601f9232b32ad0d14a1f19a0fc6a98920958e438992529103e00e2

SHA512
66bc3dcf73858e4f8deeebc1a5a56b8fbd2f9faa8a574d442613813b20389d96dc9f84241433af63ab91519c5975213287fba6402c1ca163c92ff7ae8fe8696a

Download Submit
C:\Windows\System\gUcANzO.exe

Filesize
2.3MB

MD5
d0d48e93fd4d171469c7143ea6de5ca7

SHA1
1a666f2e04b25f9dfea7e6d918179808c167ccfa

SHA256
a5264293da60c50e00470995a0dee9d2193f131f6d6c087369bf261418fd4796

SHA512
289bd35c318b0ffffdd98fce0e3b3cad785ccf5ded745894d1cd4d608f2e6a51a5d0b3ac043687ea026b71ed0907053d1ddf2bf846ca707f91b05e9d58936a15

Download Submit
C:\Windows\System\iZjhUsf.exe

Filesize
2.3MB

MD5
263a5bf7fcafaabdb49ad36e06adcfac

SHA1
093e961077aff481b4305ef2d8da40171b39acfe

SHA256
53467aec98f3c6de8224a9fff136f799ff7db16898df7b4084b7f170c74de717

SHA512
48008afa4445ce2f57682acba1c756741df254f026bb53c492f9fd63e545cc107c8f219fb6b60bbfe0157952d892bfc3df37269e113f4ca3620458e556cec2e8

Download Submit
C:\Windows\System\jNYgIYp.exe

Filesize
2.3MB

MD5
bb90ed869069051ddaa9035fec51f68e

SHA1
681e94526816eef3117ffdd63cd7fa491616dfd5

SHA256
d1333547292d5eb39413ab5cea3e501072b408971224dfaf14d580e3312c3d5a

SHA512
5152cb801ad5d73e0c2810444f0ecc1dd28683ac2b6000b864eae7d10d3fa9cb51bef1f0b0ef55042b9fc909e660af202027f65be51cf830303bc006cf3e25cf

Download Submit
C:\Windows\System\lPXHQDn.exe

Filesize
2.3MB

MD5
184d1d1cd8adb5cc3224fa1e85e0514c

SHA1
6708a52627ea6c9a2bfb327866f30bedd0724bf3

SHA256
abcecb2a95fe9a5501dd00dd8349e1c058e3c17d954a310fc624e7945ae717f9

SHA512
eda4b7a5437622f2a016963e9537020d355e5ffc9a6a8c5be95287f7a83c6796cd0a78316d46936fc8a13d42d1d6521a4716a1416a7b6142ba48f717e9f69863

Download Submit
C:\Windows\System\lPzzWFv.exe

Filesize
2.3MB

MD5
1310fce8d309a86641d09ddd4f935a87

SHA1
0e2f48061cfc11a35aebbfd522775c04dededea6

SHA256
ce70ee346e460b9dfdbe5888535a37417827707b0cc2179e91a717ec97794780

SHA512
7b820a398a0bb17c98f26e67394c7ca8f076fba4c1cd50d8aed2599c951b26c4e7f639ab2318b84c9cbc5c4dd598e44b9bba0eca65ba0979c947f36d424400d7

Download Submit
C:\Windows\System\uWTsjTS.exe

Filesize
2.3MB

MD5
00a32277f5340605ac034eb610f7b23b

SHA1
8d4f6fdf5b69ee64c23fbdd4c353be6c6650750d

SHA256
e80931cc117e68876d5db6f1e47a570bfd80ab0ca6d8759dafafe390e8b9fcef

SHA512
82d3f54eb4c13fc7e1d51bdaa668e774382702f2ad7a266350659cfb9fe10a9db2f42d157ada022722ffd180010b5ee2cc5109a4839f476c14abbc0b60122fe8

Download Submit
C:\Windows\System\wDZeFwI.exe

Filesize
2.3MB

MD5
468ed3f799cb860dc18d92af64cbc292

SHA1
a70837e4c2780e2c5a0752e6b4389c5dd6542b12

SHA256
73809aebd62b4c10c3d6ec373ff20fe1ca1a276bab6f52edef0579335e8153c9

SHA512
87f4ac6eaa7bb87e1bd3f9e65d1d80e408b72944658eee58f748b0f9121fd549e39adc0da54f3de660880e09fdd0597d2026dbdde131cac4eea710bdb9c57546

Download Submit
memory/212-4239-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp

Filesize
3.9MB

Download
memory/212-104-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp

Filesize
3.9MB

Download
memory/220-43-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/220-190-0x0000020D4B440000-0x0000020D4B462000-memory.dmp

Filesize
136KB

Download
memory/220-266-0x0000020D32F40000-0x0000020D32F50000-memory.dmp

Filesize
64KB

Download
memory/220-46-0x0000020D32F40000-0x0000020D32F50000-memory.dmp

Filesize
64KB

Download
memory/248-0-0x00007FF6776B0000-0x00007FF677AA2000-memory.dmp

Filesize
3.9MB

Download
memory/248-4552-0x00007FF6776B0000-0x00007FF677AA2000-memory.dmp

Filesize
3.9MB

Download
memory/248-1-0x00000264CC5F0000-0x00000264CC600000-memory.dmp

Filesize
64KB

Download
memory/456-263-0x00007FF732350000-0x00007FF732742000-memory.dmp

Filesize
3.9MB

Download
memory/456-4384-0x00007FF732350000-0x00007FF732742000-memory.dmp

Filesize
3.9MB

Download
memory/680-4363-0x00007FF790CE0000-0x00007FF7910D2000-memory.dmp

Filesize
3.9MB

Download
memory/680-269-0x00007FF790CE0000-0x00007FF7910D2000-memory.dmp

Filesize
3.9MB

Download
memory/732-4299-0x00007FF75EE70000-0x00007FF75F262000-memory.dmp

Filesize
3.9MB

Download
memory/732-193-0x00007FF75EE70000-0x00007FF75F262000-memory.dmp

Filesize
3.9MB

Download
memory/1424-261-0x00007FF6AE1E0000-0x00007FF6AE5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1424-4379-0x00007FF6AE1E0000-0x00007FF6AE5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-4359-0x00007FF75A030000-0x00007FF75A422000-memory.dmp

Filesize
3.9MB

Download
memory/1940-240-0x00007FF75A030000-0x00007FF75A422000-memory.dmp

Filesize
3.9MB

Download
memory/2032-4377-0x00007FF6961E0000-0x00007FF6965D2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-262-0x00007FF6961E0000-0x00007FF6965D2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-268-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4357-0x00007FF77E3E0000-0x00007FF77E7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-167-0x00007FF7627D0000-0x00007FF762BC2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-79-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-4353-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-4373-0x00007FF61E8B0000-0x00007FF61ECA2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-270-0x00007FF61E8B0000-0x00007FF61ECA2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-267-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-4242-0x00007FF72C500000-0x00007FF72C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-211-0x00007FF7ADBF0000-0x00007FF7ADFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-4383-0x00007FF7ADBF0000-0x00007FF7ADFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-247-0x00007FF6C2230000-0x00007FF6C2622000-memory.dmp

Filesize
3.9MB

Download
memory/4088-4381-0x00007FF6C2230000-0x00007FF6C2622000-memory.dmp

Filesize
3.9MB

Download
memory/4364-4370-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp

Filesize
3.9MB

Download
memory/4364-264-0x00007FF7CBEA0000-0x00007FF7CC292000-memory.dmp

Filesize
3.9MB

Download
memory/4420-265-0x00007FF78D2B0000-0x00007FF78D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-4393-0x00007FF78D2B0000-0x00007FF78D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-4361-0x00007FF669CE0000-0x00007FF66A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-166-0x00007FF669CE0000-0x00007FF66A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-4294-0x00007FF612B30000-0x00007FF612F22000-memory.dmp

Filesize
3.9MB

Download
memory/4488-144-0x00007FF612B30000-0x00007FF612F22000-memory.dmp

Filesize
3.9MB

Download
memory/4540-62-0x00007FF7914B0000-0x00007FF7918A2000-memory.dmp

Filesize
3.9MB

Download
memory/4920-4366-0x00007FF78D0C0000-0x00007FF78D4B2000-memory.dmp

Filesize
3.9MB

Download
memory/4920-253-0x00007FF78D0C0000-0x00007FF78D4B2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-254-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp

Filesize
3.9MB

Download
memory/5020-4375-0x00007FF7D3A70000-0x00007FF7D3E62000-memory.dmp

Filesize
3.9MB

Download