xmrig | 681f738e7cfd1e7180d8d4a14825352cb295b91f0d915ea8b96e96e098c395f3

Analysis

max time kernel
127s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
Size

1.9MB
MD5

01736719f353e28581f090dcb84fa256
SHA1

0e1e9e6784bb1654a1462e023857358109f4b808
SHA256

681f738e7cfd1e7180d8d4a14825352cb295b91f0d915ea8b96e96e098c395f3
SHA512

595305f4bee9a3de8ebaf67e29223d1f25dac1a4769f3feda8ded71582570422c2d9e317a9fa9c3f5b90d952eac0a13529c384462ba8061038f2d8f85215f75c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+US:NABj

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/4580-218-0x00007FF63B910000-0x00007FF63BD02000-memory.dmp	xmrig
behavioral2/memory/2952-578-0x00007FF7F9050000-0x00007FF7F9442000-memory.dmp	xmrig
behavioral2/memory/2236-633-0x00007FF7BF610000-0x00007FF7BFA02000-memory.dmp	xmrig
behavioral2/memory/4360-661-0x00007FF6B18A0000-0x00007FF6B1C92000-memory.dmp	xmrig
behavioral2/memory/3284-659-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp	xmrig
behavioral2/memory/2920-644-0x00007FF6CDE90000-0x00007FF6CE282000-memory.dmp	xmrig
behavioral2/memory/5104-643-0x00007FF7588D0000-0x00007FF758CC2000-memory.dmp	xmrig
behavioral2/memory/2148-577-0x00007FF72BC10000-0x00007FF72C002000-memory.dmp	xmrig
behavioral2/memory/4748-544-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp	xmrig
behavioral2/memory/4828-516-0x00007FF660740000-0x00007FF660B32000-memory.dmp	xmrig
behavioral2/memory/3204-470-0x00007FF7ABF90000-0x00007FF7AC382000-memory.dmp	xmrig
behavioral2/memory/208-469-0x00007FF7D3FB0000-0x00007FF7D43A2000-memory.dmp	xmrig
behavioral2/memory/4060-383-0x00007FF70BFC0000-0x00007FF70C3B2000-memory.dmp	xmrig
behavioral2/memory/2140-329-0x00007FF793E00000-0x00007FF7941F2000-memory.dmp	xmrig
behavioral2/memory/4172-326-0x00007FF7A3070000-0x00007FF7A3462000-memory.dmp	xmrig
behavioral2/memory/4864-296-0x00007FF7E16F0000-0x00007FF7E1AE2000-memory.dmp	xmrig
behavioral2/memory/1572-228-0x00007FF620650000-0x00007FF620A42000-memory.dmp	xmrig
behavioral2/memory/3280-191-0x00007FF65C250000-0x00007FF65C642000-memory.dmp	xmrig
behavioral2/memory/2404-139-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	xmrig
behavioral2/memory/4612-89-0x00007FF6FF500000-0x00007FF6FF8F2000-memory.dmp	xmrig
behavioral2/memory/1976-85-0x00007FF6DD8B0000-0x00007FF6DDCA2000-memory.dmp	xmrig
behavioral2/memory/2404-5859-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	xmrig
behavioral2/memory/3280-5865-0x00007FF65C250000-0x00007FF65C642000-memory.dmp	xmrig
behavioral2/memory/4580-5939-0x00007FF63B910000-0x00007FF63BD02000-memory.dmp	xmrig
behavioral2/memory/2920-5998-0x00007FF6CDE90000-0x00007FF6CE282000-memory.dmp	xmrig
behavioral2/memory/4360-5971-0x00007FF6B18A0000-0x00007FF6B1C92000-memory.dmp	xmrig
behavioral2/memory/5104-5994-0x00007FF7588D0000-0x00007FF758CC2000-memory.dmp	xmrig
behavioral2/memory/3204-5988-0x00007FF7ABF90000-0x00007FF7AC382000-memory.dmp	xmrig
behavioral2/memory/2236-5967-0x00007FF7BF610000-0x00007FF7BFA02000-memory.dmp	xmrig
behavioral2/memory/2952-5960-0x00007FF7F9050000-0x00007FF7F9442000-memory.dmp	xmrig
behavioral2/memory/3284-5964-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp	xmrig
behavioral2/memory/4172-5957-0x00007FF7A3070000-0x00007FF7A3462000-memory.dmp	xmrig
behavioral2/memory/4060-5954-0x00007FF70BFC0000-0x00007FF70C3B2000-memory.dmp	xmrig
behavioral2/memory/2140-5950-0x00007FF793E00000-0x00007FF7941F2000-memory.dmp	xmrig
behavioral2/memory/4828-5933-0x00007FF660740000-0x00007FF660B32000-memory.dmp	xmrig

Blocklisted process makes network request 16 IoCs

flow	pid	Process
3	2616	powershell.exe
5	2616	powershell.exe
10	2616	powershell.exe
11	2616	powershell.exe
14	2616	powershell.exe
16	2616	powershell.exe
17	2616	powershell.exe
18	2616	powershell.exe
19	2616	powershell.exe
20	2616	powershell.exe
21	2616	powershell.exe
22	2616	powershell.exe
23	2616	powershell.exe
24	2616	powershell.exe
25	2616	powershell.exe
26	2616	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1976	tkMpwwx.exe
4612	pkcyQyM.exe
2404	ONoARWA.exe
3280	RlJkakq.exe
4580	dtzEVbu.exe
1572	UUjXEBB.exe
4864	iKshMbh.exe
4172	aNlBzUG.exe
2140	JVGFnNm.exe
3284	gYJfRcI.exe
4060	mhuyPwa.exe
208	GGwxZNL.exe
3204	UnNaEdb.exe
4360	ihWSkJX.exe
4828	FTfQlBo.exe
4748	iAqjEWm.exe
2148	dQHMqgD.exe
2952	eOulBeM.exe
2236	dWlHXHw.exe
5104	TKoyKLo.exe
2920	uoehqVE.exe
392	JcxyOcB.exe
4028	EqHskRF.exe
1752	NNTlYAO.exe
4824	NzIrUse.exe
4436	YHQcHra.exe
2460	VSNKZQF.exe
2036	kDbcCiC.exe
1904	IfCTqzI.exe
3624	miqPPwm.exe
4024	fCeLaJJ.exe
3668	nQCLiFD.exe
384	cACRTZr.exe
4168	lIWAKQW.exe
1468	AMdmDNi.exe
1356	PBHZlDa.exe
3056	RgEWToo.exe
2384	dJZfjRq.exe
3596	TqEXXUe.exe
2040	bfMmuSa.exe
3740	REJoPgO.exe
2756	ZKWjRdJ.exe
3776	PHrIWpT.exe
1632	CLydmSe.exe
3260	yFpMOce.exe
448	ELOMkrw.exe
2912	vifPPRQ.exe
3144	mSpUvCk.exe
3628	iYHfabd.exe
3248	SqytmfG.exe
796	YZAmHHR.exe
2224	eLpWZNa.exe
5084	ZcROQEq.exe
4380	xrwxYsS.exe
3292	tXjFJDn.exe
4448	elRGWYw.exe
232	fCFxhkc.exe
220	KpaTGOh.exe
1364	LKSpWyD.exe
4924	akFTlFk.exe
3760	QtkPxSV.exe
4348	XLTrXYG.exe
4868	jEGqZpM.exe
4392	NzqnSwj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2488-0-0x00007FF701AD0000-0x00007FF701EC2000-memory.dmp	upx
behavioral2/files/0x0008000000023407-7.dat	upx
behavioral2/files/0x000a000000023401-13.dat	upx
behavioral2/files/0x000700000002341a-93.dat	upx
behavioral2/memory/4580-218-0x00007FF63B910000-0x00007FF63BD02000-memory.dmp	upx
behavioral2/memory/2952-578-0x00007FF7F9050000-0x00007FF7F9442000-memory.dmp	upx
behavioral2/memory/2236-633-0x00007FF7BF610000-0x00007FF7BFA02000-memory.dmp	upx
behavioral2/memory/4360-661-0x00007FF6B18A0000-0x00007FF6B1C92000-memory.dmp	upx
behavioral2/memory/3284-659-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp	upx
behavioral2/memory/2920-644-0x00007FF6CDE90000-0x00007FF6CE282000-memory.dmp	upx
behavioral2/memory/5104-643-0x00007FF7588D0000-0x00007FF758CC2000-memory.dmp	upx
behavioral2/memory/2148-577-0x00007FF72BC10000-0x00007FF72C002000-memory.dmp	upx
behavioral2/memory/4748-544-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp	upx
behavioral2/memory/4828-516-0x00007FF660740000-0x00007FF660B32000-memory.dmp	upx
behavioral2/memory/3204-470-0x00007FF7ABF90000-0x00007FF7AC382000-memory.dmp	upx
behavioral2/memory/208-469-0x00007FF7D3FB0000-0x00007FF7D43A2000-memory.dmp	upx
behavioral2/memory/4060-383-0x00007FF70BFC0000-0x00007FF70C3B2000-memory.dmp	upx
behavioral2/memory/2140-329-0x00007FF793E00000-0x00007FF7941F2000-memory.dmp	upx
behavioral2/memory/4172-326-0x00007FF7A3070000-0x00007FF7A3462000-memory.dmp	upx
behavioral2/memory/4864-296-0x00007FF7E16F0000-0x00007FF7E1AE2000-memory.dmp	upx
behavioral2/memory/1572-228-0x00007FF620650000-0x00007FF620A42000-memory.dmp	upx
behavioral2/files/0x0007000000023421-205.dat	upx
behavioral2/files/0x000700000002342e-202.dat	upx
behavioral2/files/0x000700000002342d-201.dat	upx
behavioral2/files/0x000700000002342c-200.dat	upx
behavioral2/files/0x0008000000023418-198.dat	upx
behavioral2/files/0x000700000002342b-197.dat	upx
behavioral2/files/0x000700000002342a-196.dat	upx
behavioral2/memory/3280-191-0x00007FF65C250000-0x00007FF65C642000-memory.dmp	upx
behavioral2/files/0x0007000000023429-190.dat	upx
behavioral2/files/0x0007000000023428-189.dat	upx
behavioral2/files/0x0008000000023417-186.dat	upx
behavioral2/files/0x0007000000023427-185.dat	upx
behavioral2/files/0x0007000000023426-184.dat	upx
behavioral2/files/0x0007000000023425-183.dat	upx
behavioral2/files/0x000700000002341d-175.dat	upx
behavioral2/files/0x0007000000023414-174.dat	upx
behavioral2/files/0x0007000000023424-173.dat	upx
behavioral2/files/0x0007000000023413-167.dat	upx
behavioral2/files/0x0007000000023423-166.dat	upx
behavioral2/files/0x0007000000023422-165.dat	upx
behavioral2/files/0x0007000000023412-162.dat	upx
behavioral2/files/0x000700000002341c-156.dat	upx
behavioral2/files/0x0007000000023420-153.dat	upx
behavioral2/files/0x000700000002341f-150.dat	upx
behavioral2/files/0x0007000000023410-142.dat	upx
behavioral2/files/0x0007000000023419-141.dat	upx
behavioral2/memory/2404-139-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	upx
behavioral2/files/0x000700000002340f-134.dat	upx
behavioral2/files/0x000700000002341e-129.dat	upx
behavioral2/files/0x0007000000023416-126.dat	upx
behavioral2/files/0x0007000000023415-123.dat	upx
behavioral2/files/0x000700000002340e-117.dat	upx
behavioral2/files/0x000700000002340c-105.dat	upx
behavioral2/files/0x000700000002341b-99.dat	upx
behavioral2/files/0x000700000002340b-94.dat	upx
behavioral2/memory/4612-89-0x00007FF6FF500000-0x00007FF6FF8F2000-memory.dmp	upx
behavioral2/memory/1976-85-0x00007FF6DD8B0000-0x00007FF6DDCA2000-memory.dmp	upx
behavioral2/files/0x000700000002340d-83.dat	upx
behavioral2/files/0x0007000000023411-78.dat	upx
behavioral2/files/0x0007000000023409-27.dat	upx
behavioral2/files/0x0007000000023408-26.dat	upx
behavioral2/files/0x000700000002340a-24.dat	upx
behavioral2/files/0x0006000000023288-10.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XujNdqj.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\rCzTTUV.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\mAzXZfh.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\mJyBpia.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\kwVBLwe.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\RktHRLS.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\XdDUCnQ.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\MVMhGZL.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\esosJXW.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\OSnNNcX.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\pTAYmUJ.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\FqozIOz.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\lxNljGC.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\AusTocI.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\rSslXGO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\RiDYmtZ.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\jvhdXhx.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\nrgFvSM.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\IKYDzAy.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\DCZtByo.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\OKVuwbx.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\RFKnUDR.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\nFRkgsa.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\AAooBwZ.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\jJUtBhC.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\cSxjChd.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\CvYYhnv.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ddvPNdO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\brreKpF.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ucSNejr.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\hOmTEFG.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\VsSRnxb.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ArNnPZO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\isAAemn.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\VEGTHUv.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\KRZLjQW.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\GeOEThl.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ULFseat.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\iIEAEKO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\yHEmWhx.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\oLkswZU.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\xnkVjXq.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\pEOafRj.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\TiyNiEM.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\pNMoyfM.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\MukvcPn.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\rPmepDQ.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\DwuacBH.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\bxrRxWc.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\dJkqwXf.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ZrWjvRa.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\prJuCRG.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\bISrJgO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\AgVdcAk.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\SRRFDCx.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\FEcycUl.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\hcxMVcd.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\DDKuJoc.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\EFQOUVe.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ScYErkg.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\ahpTLMj.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\TkAhmtO.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\VycnUVR.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
File created	C:\Windows\System\vTPFmFI.exe	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2616	powershell.exe
2616	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeLockMemoryPrivilege	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2616	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	82
PID 2488 wrote to memory of 2616	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	82
PID 2488 wrote to memory of 1976	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	83
PID 2488 wrote to memory of 1976	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	83
PID 2488 wrote to memory of 4612	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	84
PID 2488 wrote to memory of 4612	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	84
PID 2488 wrote to memory of 4580	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	85
PID 2488 wrote to memory of 4580	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	85
PID 2488 wrote to memory of 2404	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	86
PID 2488 wrote to memory of 2404	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	86
PID 2488 wrote to memory of 3280	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	87
PID 2488 wrote to memory of 3280	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	87
PID 2488 wrote to memory of 1572	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	88
PID 2488 wrote to memory of 1572	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	88
PID 2488 wrote to memory of 4864	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	89
PID 2488 wrote to memory of 4864	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	89
PID 2488 wrote to memory of 4172	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	90
PID 2488 wrote to memory of 4172	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	90
PID 2488 wrote to memory of 2140	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	91
PID 2488 wrote to memory of 2140	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	91
PID 2488 wrote to memory of 3284	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	92
PID 2488 wrote to memory of 3284	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	92
PID 2488 wrote to memory of 4828	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	93
PID 2488 wrote to memory of 4828	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	93
PID 2488 wrote to memory of 4060	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	94
PID 2488 wrote to memory of 4060	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	94
PID 2488 wrote to memory of 208	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	95
PID 2488 wrote to memory of 208	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	95
PID 2488 wrote to memory of 3204	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	96
PID 2488 wrote to memory of 3204	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	96
PID 2488 wrote to memory of 2236	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	97
PID 2488 wrote to memory of 2236	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	97
PID 2488 wrote to memory of 4360	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	98
PID 2488 wrote to memory of 4360	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	98
PID 2488 wrote to memory of 2920	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	99
PID 2488 wrote to memory of 2920	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	99
PID 2488 wrote to memory of 392	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	100
PID 2488 wrote to memory of 392	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	100
PID 2488 wrote to memory of 1752	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	101
PID 2488 wrote to memory of 1752	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	101
PID 2488 wrote to memory of 4748	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	102
PID 2488 wrote to memory of 4748	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	102
PID 2488 wrote to memory of 2148	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	103
PID 2488 wrote to memory of 2148	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	103
PID 2488 wrote to memory of 2952	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	104
PID 2488 wrote to memory of 2952	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	104
PID 2488 wrote to memory of 5104	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	105
PID 2488 wrote to memory of 5104	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	105
PID 2488 wrote to memory of 4028	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	106
PID 2488 wrote to memory of 4028	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	106
PID 2488 wrote to memory of 4824	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	107
PID 2488 wrote to memory of 4824	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	107
PID 2488 wrote to memory of 4436	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	108
PID 2488 wrote to memory of 4436	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	108
PID 2488 wrote to memory of 2460	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	109
PID 2488 wrote to memory of 2460	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	109
PID 2488 wrote to memory of 2036	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	110
PID 2488 wrote to memory of 2036	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	110
PID 2488 wrote to memory of 1904	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	111
PID 2488 wrote to memory of 1904	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	111
PID 2488 wrote to memory of 3624	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	112
PID 2488 wrote to memory of 3624	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	112
PID 2488 wrote to memory of 4024	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	113
PID 2488 wrote to memory of 4024	2488	01736719f353e28581f090dcb84fa256_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\01736719f353e28581f090dcb84fa256_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01736719f353e28581f090dcb84fa256_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System\tkMpwwx.exe
  C:\Windows\System\tkMpwwx.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\pkcyQyM.exe
  C:\Windows\System\pkcyQyM.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\dtzEVbu.exe
  C:\Windows\System\dtzEVbu.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\ONoARWA.exe
  C:\Windows\System\ONoARWA.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\RlJkakq.exe
  C:\Windows\System\RlJkakq.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\UUjXEBB.exe
  C:\Windows\System\UUjXEBB.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\iKshMbh.exe
  C:\Windows\System\iKshMbh.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\aNlBzUG.exe
  C:\Windows\System\aNlBzUG.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\JVGFnNm.exe
  C:\Windows\System\JVGFnNm.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\gYJfRcI.exe
  C:\Windows\System\gYJfRcI.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\FTfQlBo.exe
  C:\Windows\System\FTfQlBo.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\mhuyPwa.exe
  C:\Windows\System\mhuyPwa.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\GGwxZNL.exe
  C:\Windows\System\GGwxZNL.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\UnNaEdb.exe
  C:\Windows\System\UnNaEdb.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\dWlHXHw.exe
  C:\Windows\System\dWlHXHw.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ihWSkJX.exe
  C:\Windows\System\ihWSkJX.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\uoehqVE.exe
  C:\Windows\System\uoehqVE.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\JcxyOcB.exe
  C:\Windows\System\JcxyOcB.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\NNTlYAO.exe
  C:\Windows\System\NNTlYAO.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\iAqjEWm.exe
  C:\Windows\System\iAqjEWm.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\dQHMqgD.exe
  C:\Windows\System\dQHMqgD.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\eOulBeM.exe
  C:\Windows\System\eOulBeM.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\TKoyKLo.exe
  C:\Windows\System\TKoyKLo.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\EqHskRF.exe
  C:\Windows\System\EqHskRF.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\NzIrUse.exe
  C:\Windows\System\NzIrUse.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\YHQcHra.exe
  C:\Windows\System\YHQcHra.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\VSNKZQF.exe
  C:\Windows\System\VSNKZQF.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\kDbcCiC.exe
  C:\Windows\System\kDbcCiC.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\IfCTqzI.exe
  C:\Windows\System\IfCTqzI.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\miqPPwm.exe
  C:\Windows\System\miqPPwm.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\fCeLaJJ.exe
  C:\Windows\System\fCeLaJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\nQCLiFD.exe
  C:\Windows\System\nQCLiFD.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\cACRTZr.exe
  C:\Windows\System\cACRTZr.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\lIWAKQW.exe
  C:\Windows\System\lIWAKQW.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\AMdmDNi.exe
  C:\Windows\System\AMdmDNi.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\PBHZlDa.exe
  C:\Windows\System\PBHZlDa.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\RgEWToo.exe
  C:\Windows\System\RgEWToo.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\dJZfjRq.exe
  C:\Windows\System\dJZfjRq.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\TqEXXUe.exe
  C:\Windows\System\TqEXXUe.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\bfMmuSa.exe
  C:\Windows\System\bfMmuSa.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\REJoPgO.exe
  C:\Windows\System\REJoPgO.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\ZKWjRdJ.exe
  C:\Windows\System\ZKWjRdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\PHrIWpT.exe
  C:\Windows\System\PHrIWpT.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\CLydmSe.exe
  C:\Windows\System\CLydmSe.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\yFpMOce.exe
  C:\Windows\System\yFpMOce.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\ELOMkrw.exe
  C:\Windows\System\ELOMkrw.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\eLpWZNa.exe
  C:\Windows\System\eLpWZNa.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\vifPPRQ.exe
  C:\Windows\System\vifPPRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\elRGWYw.exe
  C:\Windows\System\elRGWYw.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\mSpUvCk.exe
  C:\Windows\System\mSpUvCk.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\iYHfabd.exe
  C:\Windows\System\iYHfabd.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\SqytmfG.exe
  C:\Windows\System\SqytmfG.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\YZAmHHR.exe
  C:\Windows\System\YZAmHHR.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\ZcROQEq.exe
  C:\Windows\System\ZcROQEq.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xrwxYsS.exe
  C:\Windows\System\xrwxYsS.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\tXjFJDn.exe
  C:\Windows\System\tXjFJDn.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\fCFxhkc.exe
  C:\Windows\System\fCFxhkc.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\KpaTGOh.exe
  C:\Windows\System\KpaTGOh.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\LKSpWyD.exe
  C:\Windows\System\LKSpWyD.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\akFTlFk.exe
  C:\Windows\System\akFTlFk.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\QtkPxSV.exe
  C:\Windows\System\QtkPxSV.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\XLTrXYG.exe
  C:\Windows\System\XLTrXYG.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\jEGqZpM.exe
  C:\Windows\System\jEGqZpM.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\NzqnSwj.exe
  C:\Windows\System\NzqnSwj.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\njOQMER.exe
  C:\Windows\System\njOQMER.exe
  2⤵
  PID:1664
- C:\Windows\System\XglrfPf.exe
  C:\Windows\System\XglrfPf.exe
  2⤵
  PID:212
- C:\Windows\System\JgGgYwZ.exe
  C:\Windows\System\JgGgYwZ.exe
  2⤵
  PID:1168
- C:\Windows\System\NwEcjGg.exe
  C:\Windows\System\NwEcjGg.exe
  2⤵
  PID:1540
- C:\Windows\System\bdENhui.exe
  C:\Windows\System\bdENhui.exe
  2⤵
  PID:1152
- C:\Windows\System\YliCMHO.exe
  C:\Windows\System\YliCMHO.exe
  2⤵
  PID:3140
- C:\Windows\System\BYOzMTa.exe
  C:\Windows\System\BYOzMTa.exe
  2⤵
  PID:4664
- C:\Windows\System\xiLCFKh.exe
  C:\Windows\System\xiLCFKh.exe
  2⤵
  PID:3320
- C:\Windows\System\PcAmGtb.exe
  C:\Windows\System\PcAmGtb.exe
  2⤵
  PID:5116
- C:\Windows\System\xCHNgXP.exe
  C:\Windows\System\xCHNgXP.exe
  2⤵
  PID:4532
- C:\Windows\System\ZHxBWAy.exe
  C:\Windows\System\ZHxBWAy.exe
  2⤵
  PID:4412
- C:\Windows\System\mzEPaxM.exe
  C:\Windows\System\mzEPaxM.exe
  2⤵
  PID:960
- C:\Windows\System\HdgxtwN.exe
  C:\Windows\System\HdgxtwN.exe
  2⤵
  PID:3240
- C:\Windows\System\avzqUrl.exe
  C:\Windows\System\avzqUrl.exe
  2⤵
  PID:1224
- C:\Windows\System\OxylTDV.exe
  C:\Windows\System\OxylTDV.exe
  2⤵
  PID:952
- C:\Windows\System\SZtmeHj.exe
  C:\Windows\System\SZtmeHj.exe
  2⤵
  PID:2136
- C:\Windows\System\qfUgivJ.exe
  C:\Windows\System\qfUgivJ.exe
  2⤵
  PID:3976
- C:\Windows\System\HnPeEnE.exe
  C:\Windows\System\HnPeEnE.exe
  2⤵
  PID:2540
- C:\Windows\System\uKoJowd.exe
  C:\Windows\System\uKoJowd.exe
  2⤵
  PID:744
- C:\Windows\System\mODdvzE.exe
  C:\Windows\System\mODdvzE.exe
  2⤵
  PID:2640
- C:\Windows\System\aZdbsiz.exe
  C:\Windows\System\aZdbsiz.exe
  2⤵
  PID:3800
- C:\Windows\System\sLBBbma.exe
  C:\Windows\System\sLBBbma.exe
  2⤵
  PID:5132
- C:\Windows\System\yInxibk.exe
  C:\Windows\System\yInxibk.exe
  2⤵
  PID:5152
- C:\Windows\System\dOaEhgY.exe
  C:\Windows\System\dOaEhgY.exe
  2⤵
  PID:5168
- C:\Windows\System\GbMxbIV.exe
  C:\Windows\System\GbMxbIV.exe
  2⤵
  PID:5204
- C:\Windows\System\lgnaeFE.exe
  C:\Windows\System\lgnaeFE.exe
  2⤵
  PID:5228
- C:\Windows\System\JmsPGxB.exe
  C:\Windows\System\JmsPGxB.exe
  2⤵
  PID:5244
- C:\Windows\System\cKmDwCx.exe
  C:\Windows\System\cKmDwCx.exe
  2⤵
  PID:5296
- C:\Windows\System\QBjOyrL.exe
  C:\Windows\System\QBjOyrL.exe
  2⤵
  PID:5312
- C:\Windows\System\oCGVYpM.exe
  C:\Windows\System\oCGVYpM.exe
  2⤵
  PID:5340
- C:\Windows\System\MdONxbW.exe
  C:\Windows\System\MdONxbW.exe
  2⤵
  PID:5356
- C:\Windows\System\lJIsrzS.exe
  C:\Windows\System\lJIsrzS.exe
  2⤵
  PID:5432
- C:\Windows\System\lVhTYEO.exe
  C:\Windows\System\lVhTYEO.exe
  2⤵
  PID:5452
- C:\Windows\System\ozmsKig.exe
  C:\Windows\System\ozmsKig.exe
  2⤵
  PID:5472
- C:\Windows\System\cTKhneJ.exe
  C:\Windows\System\cTKhneJ.exe
  2⤵
  PID:5492
- C:\Windows\System\tSJDEvY.exe
  C:\Windows\System\tSJDEvY.exe
  2⤵
  PID:5516
- C:\Windows\System\fKjVhwa.exe
  C:\Windows\System\fKjVhwa.exe
  2⤵
  PID:5536
- C:\Windows\System\gguNnCG.exe
  C:\Windows\System\gguNnCG.exe
  2⤵
  PID:5564
- C:\Windows\System\MryVmOl.exe
  C:\Windows\System\MryVmOl.exe
  2⤵
  PID:5580
- C:\Windows\System\KMNfFQZ.exe
  C:\Windows\System\KMNfFQZ.exe
  2⤵
  PID:5608
- C:\Windows\System\IzrJINQ.exe
  C:\Windows\System\IzrJINQ.exe
  2⤵
  PID:5624
- C:\Windows\System\cYVbPDa.exe
  C:\Windows\System\cYVbPDa.exe
  2⤵
  PID:5644
- C:\Windows\System\xIJuaGv.exe
  C:\Windows\System\xIJuaGv.exe
  2⤵
  PID:5700
- C:\Windows\System\zZMnWoJ.exe
  C:\Windows\System\zZMnWoJ.exe
  2⤵
  PID:5736
- C:\Windows\System\DfbQcfb.exe
  C:\Windows\System\DfbQcfb.exe
  2⤵
  PID:5756
- C:\Windows\System\wXUZjRG.exe
  C:\Windows\System\wXUZjRG.exe
  2⤵
  PID:5780
- C:\Windows\System\HcwyaDF.exe
  C:\Windows\System\HcwyaDF.exe
  2⤵
  PID:5800
- C:\Windows\System\ZuOcApi.exe
  C:\Windows\System\ZuOcApi.exe
  2⤵
  PID:5820
- C:\Windows\System\musYOeT.exe
  C:\Windows\System\musYOeT.exe
  2⤵
  PID:5848
- C:\Windows\System\MMdESBL.exe
  C:\Windows\System\MMdESBL.exe
  2⤵
  PID:5868
- C:\Windows\System\vHfrLLz.exe
  C:\Windows\System\vHfrLLz.exe
  2⤵
  PID:5888
- C:\Windows\System\xqOSBbb.exe
  C:\Windows\System\xqOSBbb.exe
  2⤵
  PID:5932
- C:\Windows\System\rEaylDK.exe
  C:\Windows\System\rEaylDK.exe
  2⤵
  PID:5948
- C:\Windows\System\fHSAHfH.exe
  C:\Windows\System\fHSAHfH.exe
  2⤵
  PID:5972
- C:\Windows\System\auepbZO.exe
  C:\Windows\System\auepbZO.exe
  2⤵
  PID:5992
- C:\Windows\System\TSwtIiu.exe
  C:\Windows\System\TSwtIiu.exe
  2⤵
  PID:6012
- C:\Windows\System\SCQcmJo.exe
  C:\Windows\System\SCQcmJo.exe
  2⤵
  PID:6036
- C:\Windows\System\JHebQGB.exe
  C:\Windows\System\JHebQGB.exe
  2⤵
  PID:6056
- C:\Windows\System\ujabTZd.exe
  C:\Windows\System\ujabTZd.exe
  2⤵
  PID:6076
- C:\Windows\System\osvySKM.exe
  C:\Windows\System\osvySKM.exe
  2⤵
  PID:6100
- C:\Windows\System\FqvyPqr.exe
  C:\Windows\System\FqvyPqr.exe
  2⤵
  PID:6120
- C:\Windows\System\iYeJWeB.exe
  C:\Windows\System\iYeJWeB.exe
  2⤵
  PID:6140
- C:\Windows\System\nRdzgWg.exe
  C:\Windows\System\nRdzgWg.exe
  2⤵
  PID:4336
- C:\Windows\System\itYuVEF.exe
  C:\Windows\System\itYuVEF.exe
  2⤵
  PID:4688
- C:\Windows\System\EqDRNBn.exe
  C:\Windows\System\EqDRNBn.exe
  2⤵
  PID:4840
- C:\Windows\System\mLjXLMY.exe
  C:\Windows\System\mLjXLMY.exe
  2⤵
  PID:4268
- C:\Windows\System\KyiUJJw.exe
  C:\Windows\System\KyiUJJw.exe
  2⤵
  PID:3744
- C:\Windows\System\LfkNeNN.exe
  C:\Windows\System\LfkNeNN.exe
  2⤵
  PID:5176
- C:\Windows\System\vnwRzFV.exe
  C:\Windows\System\vnwRzFV.exe
  2⤵
  PID:4800
- C:\Windows\System\aGALgix.exe
  C:\Windows\System\aGALgix.exe
  2⤵
  PID:4444
- C:\Windows\System\kdQaJRe.exe
  C:\Windows\System\kdQaJRe.exe
  2⤵
  PID:5532
- C:\Windows\System\jlXfKIP.exe
  C:\Windows\System\jlXfKIP.exe
  2⤵
  PID:4700
- C:\Windows\System\PrixhQu.exe
  C:\Windows\System\PrixhQu.exe
  2⤵
  PID:5072
- C:\Windows\System\uVyrpny.exe
  C:\Windows\System\uVyrpny.exe
  2⤵
  PID:3272
- C:\Windows\System\KmQIdnc.exe
  C:\Windows\System\KmQIdnc.exe
  2⤵
  PID:3156
- C:\Windows\System\lWKZsEo.exe
  C:\Windows\System\lWKZsEo.exe
  2⤵
  PID:3436
- C:\Windows\System\WnqZcru.exe
  C:\Windows\System\WnqZcru.exe
  2⤵
  PID:5884
- C:\Windows\System\wvpvSSr.exe
  C:\Windows\System\wvpvSSr.exe
  2⤵
  PID:6156
- C:\Windows\System\fhOUMoz.exe
  C:\Windows\System\fhOUMoz.exe
  2⤵
  PID:6180
- C:\Windows\System\zelRGlC.exe
  C:\Windows\System\zelRGlC.exe
  2⤵
  PID:6196
- C:\Windows\System\ZvlhGPn.exe
  C:\Windows\System\ZvlhGPn.exe
  2⤵
  PID:6224
- C:\Windows\System\pYdpMxv.exe
  C:\Windows\System\pYdpMxv.exe
  2⤵
  PID:6240
- C:\Windows\System\oMDpzYz.exe
  C:\Windows\System\oMDpzYz.exe
  2⤵
  PID:6264
- C:\Windows\System\kvRorWc.exe
  C:\Windows\System\kvRorWc.exe
  2⤵
  PID:6288
- C:\Windows\System\btUoFlz.exe
  C:\Windows\System\btUoFlz.exe
  2⤵
  PID:6324
- C:\Windows\System\lELxmEB.exe
  C:\Windows\System\lELxmEB.exe
  2⤵
  PID:6352
- C:\Windows\System\UzKBfJx.exe
  C:\Windows\System\UzKBfJx.exe
  2⤵
  PID:6376
- C:\Windows\System\fzarREo.exe
  C:\Windows\System\fzarREo.exe
  2⤵
  PID:6400
- C:\Windows\System\OWftyCR.exe
  C:\Windows\System\OWftyCR.exe
  2⤵
  PID:6432
- C:\Windows\System\KfMwMWJ.exe
  C:\Windows\System\KfMwMWJ.exe
  2⤵
  PID:6448
- C:\Windows\System\ykQmeKV.exe
  C:\Windows\System\ykQmeKV.exe
  2⤵
  PID:6484
- C:\Windows\System\GuJqPpv.exe
  C:\Windows\System\GuJqPpv.exe
  2⤵
  PID:6500
- C:\Windows\System\mWBpZfZ.exe
  C:\Windows\System\mWBpZfZ.exe
  2⤵
  PID:6524
- C:\Windows\System\dHFrOId.exe
  C:\Windows\System\dHFrOId.exe
  2⤵
  PID:6540
- C:\Windows\System\XonEibR.exe
  C:\Windows\System\XonEibR.exe
  2⤵
  PID:6572
- C:\Windows\System\YpnpaZG.exe
  C:\Windows\System\YpnpaZG.exe
  2⤵
  PID:6612
- C:\Windows\System\pWIORgS.exe
  C:\Windows\System\pWIORgS.exe
  2⤵
  PID:6628
- C:\Windows\System\bkXscDB.exe
  C:\Windows\System\bkXscDB.exe
  2⤵
  PID:6644
- C:\Windows\System\RMaYGMY.exe
  C:\Windows\System\RMaYGMY.exe
  2⤵
  PID:6660
- C:\Windows\System\GMSCXlx.exe
  C:\Windows\System\GMSCXlx.exe
  2⤵
  PID:6680
- C:\Windows\System\opQyPQP.exe
  C:\Windows\System\opQyPQP.exe
  2⤵
  PID:6708
- C:\Windows\System\xzWUTQY.exe
  C:\Windows\System\xzWUTQY.exe
  2⤵
  PID:6728
- C:\Windows\System\MBQxVpt.exe
  C:\Windows\System\MBQxVpt.exe
  2⤵
  PID:6780
- C:\Windows\System\tyfrjuP.exe
  C:\Windows\System\tyfrjuP.exe
  2⤵
  PID:6804
- C:\Windows\System\ymhMpZc.exe
  C:\Windows\System\ymhMpZc.exe
  2⤵
  PID:6820
- C:\Windows\System\TppGUkz.exe
  C:\Windows\System\TppGUkz.exe
  2⤵
  PID:6840
- C:\Windows\System\gcRjhHr.exe
  C:\Windows\System\gcRjhHr.exe
  2⤵
  PID:6860
- C:\Windows\System\MIOuHBt.exe
  C:\Windows\System\MIOuHBt.exe
  2⤵
  PID:6880
- C:\Windows\System\mkMsYDA.exe
  C:\Windows\System\mkMsYDA.exe
  2⤵
  PID:6904
- C:\Windows\System\ifmXXmV.exe
  C:\Windows\System\ifmXXmV.exe
  2⤵
  PID:6924
- C:\Windows\System\KeeorQf.exe
  C:\Windows\System\KeeorQf.exe
  2⤵
  PID:6944
- C:\Windows\System\ABXBcOT.exe
  C:\Windows\System\ABXBcOT.exe
  2⤵
  PID:6964
- C:\Windows\System\kQjXyhI.exe
  C:\Windows\System\kQjXyhI.exe
  2⤵
  PID:7012
- C:\Windows\System\aoXGwvp.exe
  C:\Windows\System\aoXGwvp.exe
  2⤵
  PID:7036
- C:\Windows\System\WJInnTd.exe
  C:\Windows\System\WJInnTd.exe
  2⤵
  PID:7060
- C:\Windows\System\OdlQWZZ.exe
  C:\Windows\System\OdlQWZZ.exe
  2⤵
  PID:7076
- C:\Windows\System\vJnmhfk.exe
  C:\Windows\System\vJnmhfk.exe
  2⤵
  PID:7100
- C:\Windows\System\LSuEaVZ.exe
  C:\Windows\System\LSuEaVZ.exe
  2⤵
  PID:7116
- C:\Windows\System\hslOSoI.exe
  C:\Windows\System\hslOSoI.exe
  2⤵
  PID:7140
- C:\Windows\System\NLjTNKW.exe
  C:\Windows\System\NLjTNKW.exe
  2⤵
  PID:7156
- C:\Windows\System\gRzcoAA.exe
  C:\Windows\System\gRzcoAA.exe
  2⤵
  PID:4856
- C:\Windows\System\VDENuhH.exe
  C:\Windows\System\VDENuhH.exe
  2⤵
  PID:1548
- C:\Windows\System\dOXsaEW.exe
  C:\Windows\System\dOXsaEW.exe
  2⤵
  PID:1628
- C:\Windows\System\DMeuXKG.exe
  C:\Windows\System\DMeuXKG.exe
  2⤵
  PID:4916
- C:\Windows\System\XVIkbbZ.exe
  C:\Windows\System\XVIkbbZ.exe
  2⤵
  PID:2544
- C:\Windows\System\gFRECWq.exe
  C:\Windows\System\gFRECWq.exe
  2⤵
  PID:5280
- C:\Windows\System\dDDVxdd.exe
  C:\Windows\System\dDDVxdd.exe
  2⤵
  PID:5576
- C:\Windows\System\XtVpsod.exe
  C:\Windows\System\XtVpsod.exe
  2⤵
  PID:740
- C:\Windows\System\DJAWHZq.exe
  C:\Windows\System\DJAWHZq.exe
  2⤵
  PID:5900
- C:\Windows\System\qTTrvGi.exe
  C:\Windows\System\qTTrvGi.exe
  2⤵
  PID:5840
- C:\Windows\System\HvoaNKX.exe
  C:\Windows\System\HvoaNKX.exe
  2⤵
  PID:6188
- C:\Windows\System\XbrfymQ.exe
  C:\Windows\System\XbrfymQ.exe
  2⤵
  PID:5412
- C:\Windows\System\HXaUcDs.exe
  C:\Windows\System\HXaUcDs.exe
  2⤵
  PID:5500
- C:\Windows\System\OzOEkcZ.exe
  C:\Windows\System\OzOEkcZ.exe
  2⤵
  PID:5552
- C:\Windows\System\lDRyuqP.exe
  C:\Windows\System\lDRyuqP.exe
  2⤵
  PID:5600
- C:\Windows\System\nWBeZPO.exe
  C:\Windows\System\nWBeZPO.exe
  2⤵
  PID:6392
- C:\Windows\System\LpowFgC.exe
  C:\Windows\System\LpowFgC.exe
  2⤵
  PID:6028
- C:\Windows\System\ELLDRqp.exe
  C:\Windows\System\ELLDRqp.exe
  2⤵
  PID:6472
- C:\Windows\System\HfofXKV.exe
  C:\Windows\System\HfofXKV.exe
  2⤵
  PID:6212
- C:\Windows\System\TIvIUBx.exe
  C:\Windows\System\TIvIUBx.exe
  2⤵
  PID:7212
- C:\Windows\System\NHRcqyz.exe
  C:\Windows\System\NHRcqyz.exe
  2⤵
  PID:7244
- C:\Windows\System\YDHWMEE.exe
  C:\Windows\System\YDHWMEE.exe
  2⤵
  PID:7268
- C:\Windows\System\ucSNejr.exe
  C:\Windows\System\ucSNejr.exe
  2⤵
  PID:7288
- C:\Windows\System\wKHTVDV.exe
  C:\Windows\System\wKHTVDV.exe
  2⤵
  PID:7316
- C:\Windows\System\PWezvSL.exe
  C:\Windows\System\PWezvSL.exe
  2⤵
  PID:7344
- C:\Windows\System\EDmbffF.exe
  C:\Windows\System\EDmbffF.exe
  2⤵
  PID:7372
- C:\Windows\System\rpXAkgc.exe
  C:\Windows\System\rpXAkgc.exe
  2⤵
  PID:7400
- C:\Windows\System\oUKcEst.exe
  C:\Windows\System\oUKcEst.exe
  2⤵
  PID:7732
- C:\Windows\System\dvuqYLi.exe
  C:\Windows\System\dvuqYLi.exe
  2⤵
  PID:7764
- C:\Windows\System\UNJPygG.exe
  C:\Windows\System\UNJPygG.exe
  2⤵
  PID:7784
- C:\Windows\System\pqUDwlX.exe
  C:\Windows\System\pqUDwlX.exe
  2⤵
  PID:7816
- C:\Windows\System\lrndwLL.exe
  C:\Windows\System\lrndwLL.exe
  2⤵
  PID:7844
- C:\Windows\System\NiNWmve.exe
  C:\Windows\System\NiNWmve.exe
  2⤵
  PID:7872
- C:\Windows\System\YEmkRAB.exe
  C:\Windows\System\YEmkRAB.exe
  2⤵
  PID:7900
- C:\Windows\System\DwKNpXo.exe
  C:\Windows\System\DwKNpXo.exe
  2⤵
  PID:7952
- C:\Windows\System\TCrLaSN.exe
  C:\Windows\System\TCrLaSN.exe
  2⤵
  PID:7988
- C:\Windows\System\McETmkL.exe
  C:\Windows\System\McETmkL.exe
  2⤵
  PID:8008
- C:\Windows\System\YEHnohm.exe
  C:\Windows\System\YEHnohm.exe
  2⤵
  PID:8028
- C:\Windows\System\lwXxOpd.exe
  C:\Windows\System\lwXxOpd.exe
  2⤵
  PID:8052
- C:\Windows\System\jqpVcvI.exe
  C:\Windows\System\jqpVcvI.exe
  2⤵
  PID:8072
- C:\Windows\System\fPXaPDJ.exe
  C:\Windows\System\fPXaPDJ.exe
  2⤵
  PID:8100
- C:\Windows\System\HsmzQEK.exe
  C:\Windows\System\HsmzQEK.exe
  2⤵
  PID:8116
- C:\Windows\System\XrruvZi.exe
  C:\Windows\System\XrruvZi.exe
  2⤵
  PID:8132
- C:\Windows\System\dhjbDFa.exe
  C:\Windows\System\dhjbDFa.exe
  2⤵
  PID:8148
- C:\Windows\System\nGOzjJs.exe
  C:\Windows\System\nGOzjJs.exe
  2⤵
  PID:8168
- C:\Windows\System\puiIMxL.exe
  C:\Windows\System\puiIMxL.exe
  2⤵
  PID:8188
- C:\Windows\System\anVKwPb.exe
  C:\Windows\System\anVKwPb.exe
  2⤵
  PID:4932
- C:\Windows\System\FOjifNp.exe
  C:\Windows\System\FOjifNp.exe
  2⤵
  PID:5064
- C:\Windows\System\CdyYLzh.exe
  C:\Windows\System\CdyYLzh.exe
  2⤵
  PID:6232
- C:\Windows\System\MrvALKX.exe
  C:\Windows\System\MrvALKX.exe
  2⤵
  PID:6348
- C:\Windows\System\XyaIGEm.exe
  C:\Windows\System\XyaIGEm.exe
  2⤵
  PID:2424
- C:\Windows\System\XznSxvs.exe
  C:\Windows\System\XznSxvs.exe
  2⤵
  PID:4584
- C:\Windows\System\xbGmXmB.exe
  C:\Windows\System\xbGmXmB.exe
  2⤵
  PID:5876
- C:\Windows\System\bbbyXIP.exe
  C:\Windows\System\bbbyXIP.exe
  2⤵
  PID:6384
- C:\Windows\System\xHQndSC.exe
  C:\Windows\System\xHQndSC.exe
  2⤵
  PID:7024
- C:\Windows\System\vOeAKiE.exe
  C:\Windows\System\vOeAKiE.exe
  2⤵
  PID:7112
- C:\Windows\System\ZBmEbqS.exe
  C:\Windows\System\ZBmEbqS.exe
  2⤵
  PID:6024
- C:\Windows\System\JqWQMNb.exe
  C:\Windows\System\JqWQMNb.exe
  2⤵
  PID:5720
- C:\Windows\System\pEgJyou.exe
  C:\Windows\System\pEgJyou.exe
  2⤵
  PID:5616
- C:\Windows\System\qRkOvOS.exe
  C:\Windows\System\qRkOvOS.exe
  2⤵
  PID:7240
- C:\Windows\System\jvNQcAg.exe
  C:\Windows\System\jvNQcAg.exe
  2⤵
  PID:7296
- C:\Windows\System\aJZUOgk.exe
  C:\Windows\System\aJZUOgk.exe
  2⤵
  PID:7336
- C:\Windows\System\nXLgSlv.exe
  C:\Windows\System\nXLgSlv.exe
  2⤵
  PID:7388
- C:\Windows\System\YhvdVBA.exe
  C:\Windows\System\YhvdVBA.exe
  2⤵
  PID:7488
- C:\Windows\System\MVhtOBz.exe
  C:\Windows\System\MVhtOBz.exe
  2⤵
  PID:7560
- C:\Windows\System\BxnHKRS.exe
  C:\Windows\System\BxnHKRS.exe
  2⤵
  PID:7592
- C:\Windows\System\RwmEonf.exe
  C:\Windows\System\RwmEonf.exe
  2⤵
  PID:4452
- C:\Windows\System\qjEgRcp.exe
  C:\Windows\System\qjEgRcp.exe
  2⤵
  PID:1924
- C:\Windows\System\taaVyjK.exe
  C:\Windows\System\taaVyjK.exe
  2⤵
  PID:4388
- C:\Windows\System\hGLgjcN.exe
  C:\Windows\System\hGLgjcN.exe
  2⤵
  PID:2940
- C:\Windows\System\mMZoqqI.exe
  C:\Windows\System\mMZoqqI.exe
  2⤵
  PID:856
- C:\Windows\System\oczCZFu.exe
  C:\Windows\System\oczCZFu.exe
  2⤵
  PID:864
- C:\Windows\System\pgVNZDz.exe
  C:\Windows\System\pgVNZDz.exe
  2⤵
  PID:4236
- C:\Windows\System\qiJBhrH.exe
  C:\Windows\System\qiJBhrH.exe
  2⤵
  PID:4744
- C:\Windows\System\NBELDEp.exe
  C:\Windows\System\NBELDEp.exe
  2⤵
  PID:4464
- C:\Windows\System\NOiqaVE.exe
  C:\Windows\System\NOiqaVE.exe
  2⤵
  PID:4660
- C:\Windows\System\kJVPLyv.exe
  C:\Windows\System\kJVPLyv.exe
  2⤵
  PID:7744
- C:\Windows\System\SUsrOcc.exe
  C:\Windows\System\SUsrOcc.exe
  2⤵
  PID:3940
- C:\Windows\System\glGIgIG.exe
  C:\Windows\System\glGIgIG.exe
  2⤵
  PID:4036
- C:\Windows\System\jSTlmdj.exe
  C:\Windows\System\jSTlmdj.exe
  2⤵
  PID:7800
- C:\Windows\System\ohNRBbo.exe
  C:\Windows\System\ohNRBbo.exe
  2⤵
  PID:7856
- C:\Windows\System\jqifsGX.exe
  C:\Windows\System\jqifsGX.exe
  2⤵
  PID:7880
- C:\Windows\System\lhedLtW.exe
  C:\Windows\System\lhedLtW.exe
  2⤵
  PID:6856
- C:\Windows\System\bjghkFc.exe
  C:\Windows\System\bjghkFc.exe
  2⤵
  PID:6852
- C:\Windows\System\YhKyzSj.exe
  C:\Windows\System\YhKyzSj.exe
  2⤵
  PID:7000
- C:\Windows\System\KPYOGgK.exe
  C:\Windows\System\KPYOGgK.exe
  2⤵
  PID:7932
- C:\Windows\System\XoCaklx.exe
  C:\Windows\System\XoCaklx.exe
  2⤵
  PID:8000
- C:\Windows\System\OcusHBf.exe
  C:\Windows\System\OcusHBf.exe
  2⤵
  PID:8048
- C:\Windows\System\fdTKAuQ.exe
  C:\Windows\System\fdTKAuQ.exe
  2⤵
  PID:8164
- C:\Windows\System\XsQAtab.exe
  C:\Windows\System\XsQAtab.exe
  2⤵
  PID:2068
- C:\Windows\System\aAFycVq.exe
  C:\Windows\System\aAFycVq.exe
  2⤵
  PID:4564
- C:\Windows\System\kyrexbg.exe
  C:\Windows\System\kyrexbg.exe
  2⤵
  PID:3584
- C:\Windows\System\MnEeuaM.exe
  C:\Windows\System\MnEeuaM.exe
  2⤵
  PID:8160
- C:\Windows\System\aqmiejM.exe
  C:\Windows\System\aqmiejM.exe
  2⤵
  PID:6604
- C:\Windows\System\ElKCLLP.exe
  C:\Windows\System\ElKCLLP.exe
  2⤵
  PID:5660
- C:\Windows\System\lZDzxXq.exe
  C:\Windows\System\lZDzxXq.exe
  2⤵
  PID:4196
- C:\Windows\System\bXXgfZa.exe
  C:\Windows\System\bXXgfZa.exe
  2⤵
  PID:7436
- C:\Windows\System\XTizElJ.exe
  C:\Windows\System\XTizElJ.exe
  2⤵
  PID:4084
- C:\Windows\System\RWyvakX.exe
  C:\Windows\System\RWyvakX.exe
  2⤵
  PID:7300
- C:\Windows\System\rBdxHRy.exe
  C:\Windows\System\rBdxHRy.exe
  2⤵
  PID:7152
- C:\Windows\System\nsRvqgU.exe
  C:\Windows\System\nsRvqgU.exe
  2⤵
  PID:3612
- C:\Windows\System\bdZsrsW.exe
  C:\Windows\System\bdZsrsW.exe
  2⤵
  PID:7760
- C:\Windows\System\FXCjgZz.exe
  C:\Windows\System\FXCjgZz.exe
  2⤵
  PID:620
- C:\Windows\System\rqPAIFT.exe
  C:\Windows\System\rqPAIFT.exe
  2⤵
  PID:7456
- C:\Windows\System\EgOjycU.exe
  C:\Windows\System\EgOjycU.exe
  2⤵
  PID:8080
- C:\Windows\System\vybBIWP.exe
  C:\Windows\System\vybBIWP.exe
  2⤵
  PID:8184
- C:\Windows\System\NoRzWas.exe
  C:\Windows\System\NoRzWas.exe
  2⤵
  PID:8196
- C:\Windows\System\fbwxfHS.exe
  C:\Windows\System\fbwxfHS.exe
  2⤵
  PID:8220
- C:\Windows\System\KBibdCR.exe
  C:\Windows\System\KBibdCR.exe
  2⤵
  PID:8236
- C:\Windows\System\QmZJxww.exe
  C:\Windows\System\QmZJxww.exe
  2⤵
  PID:8260
- C:\Windows\System\zRGIVmH.exe
  C:\Windows\System\zRGIVmH.exe
  2⤵
  PID:8284
- C:\Windows\System\FFhceMX.exe
  C:\Windows\System\FFhceMX.exe
  2⤵
  PID:8316
- C:\Windows\System\tAfCSnP.exe
  C:\Windows\System\tAfCSnP.exe
  2⤵
  PID:8340
- C:\Windows\System\RMiVVAH.exe
  C:\Windows\System\RMiVVAH.exe
  2⤵
  PID:8356
- C:\Windows\System\gGlYyZB.exe
  C:\Windows\System\gGlYyZB.exe
  2⤵
  PID:8376
- C:\Windows\System\oaYjjcD.exe
  C:\Windows\System\oaYjjcD.exe
  2⤵
  PID:8400
- C:\Windows\System\FIdsNZt.exe
  C:\Windows\System\FIdsNZt.exe
  2⤵
  PID:8424
- C:\Windows\System\HzAKUlm.exe
  C:\Windows\System\HzAKUlm.exe
  2⤵
  PID:8448
- C:\Windows\System\ypxPcbK.exe
  C:\Windows\System\ypxPcbK.exe
  2⤵
  PID:8468
- C:\Windows\System\ndevbCI.exe
  C:\Windows\System\ndevbCI.exe
  2⤵
  PID:8488
- C:\Windows\System\BCkRFaH.exe
  C:\Windows\System\BCkRFaH.exe
  2⤵
  PID:8508
- C:\Windows\System\liDNLMV.exe
  C:\Windows\System\liDNLMV.exe
  2⤵
  PID:8528
- C:\Windows\System\gSZzLwj.exe
  C:\Windows\System\gSZzLwj.exe
  2⤵
  PID:8548
- C:\Windows\System\RYOSgMP.exe
  C:\Windows\System\RYOSgMP.exe
  2⤵
  PID:8572
- C:\Windows\System\dYcGBYZ.exe
  C:\Windows\System\dYcGBYZ.exe
  2⤵
  PID:8596
- C:\Windows\System\DJJuLpm.exe
  C:\Windows\System\DJJuLpm.exe
  2⤵
  PID:8620
- C:\Windows\System\ImBoSAY.exe
  C:\Windows\System\ImBoSAY.exe
  2⤵
  PID:8640
- C:\Windows\System\nfSWwlj.exe
  C:\Windows\System\nfSWwlj.exe
  2⤵
  PID:8664
- C:\Windows\System\qCbYpJL.exe
  C:\Windows\System\qCbYpJL.exe
  2⤵
  PID:8684
- C:\Windows\System\aBQcsxs.exe
  C:\Windows\System\aBQcsxs.exe
  2⤵
  PID:8712
- C:\Windows\System\xbOEobg.exe
  C:\Windows\System\xbOEobg.exe
  2⤵
  PID:8732
- C:\Windows\System\rPaOvwq.exe
  C:\Windows\System\rPaOvwq.exe
  2⤵
  PID:8764
- C:\Windows\System\QKSazzk.exe
  C:\Windows\System\QKSazzk.exe
  2⤵
  PID:8784
- C:\Windows\System\lfNmgJN.exe
  C:\Windows\System\lfNmgJN.exe
  2⤵
  PID:8808
- C:\Windows\System\yWGEElJ.exe
  C:\Windows\System\yWGEElJ.exe
  2⤵
  PID:8828
- C:\Windows\System\LcWTFxO.exe
  C:\Windows\System\LcWTFxO.exe
  2⤵
  PID:8852
- C:\Windows\System\VoNFwPx.exe
  C:\Windows\System\VoNFwPx.exe
  2⤵
  PID:8876
- C:\Windows\System\DnkPxJc.exe
  C:\Windows\System\DnkPxJc.exe
  2⤵
  PID:8896
- C:\Windows\System\QxVgQRT.exe
  C:\Windows\System\QxVgQRT.exe
  2⤵
  PID:8920
- C:\Windows\System\WWIinCm.exe
  C:\Windows\System\WWIinCm.exe
  2⤵
  PID:8944
- C:\Windows\System\liCQpFp.exe
  C:\Windows\System\liCQpFp.exe
  2⤵
  PID:8964
- C:\Windows\System\giZvnST.exe
  C:\Windows\System\giZvnST.exe
  2⤵
  PID:8992
- C:\Windows\System\CHnnvtq.exe
  C:\Windows\System\CHnnvtq.exe
  2⤵
  PID:9020
- C:\Windows\System\LQwvHkJ.exe
  C:\Windows\System\LQwvHkJ.exe
  2⤵
  PID:9036
- C:\Windows\System\hcuDOgD.exe
  C:\Windows\System\hcuDOgD.exe
  2⤵
  PID:9060
- C:\Windows\System\qoaOFyV.exe
  C:\Windows\System\qoaOFyV.exe
  2⤵
  PID:9080
- C:\Windows\System\cqSaCIr.exe
  C:\Windows\System\cqSaCIr.exe
  2⤵
  PID:9104
- C:\Windows\System\SuhTkLR.exe
  C:\Windows\System\SuhTkLR.exe
  2⤵
  PID:9124
- C:\Windows\System\IdIfOpf.exe
  C:\Windows\System\IdIfOpf.exe
  2⤵
  PID:9144
- C:\Windows\System\rLpqtyC.exe
  C:\Windows\System\rLpqtyC.exe
  2⤵
  PID:9168
- C:\Windows\System\kXlVPdk.exe
  C:\Windows\System\kXlVPdk.exe
  2⤵
  PID:9192
- C:\Windows\System\YUvljoF.exe
  C:\Windows\System\YUvljoF.exe
  2⤵
  PID:9212
- C:\Windows\System\WxjeCVD.exe
  C:\Windows\System\WxjeCVD.exe
  2⤵
  PID:7332
- C:\Windows\System\bQENlsZ.exe
  C:\Windows\System\bQENlsZ.exe
  2⤵
  PID:7780
- C:\Windows\System\WJpYrle.exe
  C:\Windows\System\WJpYrle.exe
  2⤵
  PID:7920
- C:\Windows\System\OoDonFY.exe
  C:\Windows\System\OoDonFY.exe
  2⤵
  PID:4668
- C:\Windows\System\kNBlvkH.exe
  C:\Windows\System\kNBlvkH.exe
  2⤵
  PID:6956
- C:\Windows\System\XgYPDHt.exe
  C:\Windows\System\XgYPDHt.exe
  2⤵
  PID:2768
- C:\Windows\System\qgfeJzV.exe
  C:\Windows\System\qgfeJzV.exe
  2⤵
  PID:4988
- C:\Windows\System\cZYLZHk.exe
  C:\Windows\System\cZYLZHk.exe
  2⤵
  PID:1644
- C:\Windows\System\LbFzIJK.exe
  C:\Windows\System\LbFzIJK.exe
  2⤵
  PID:7792
- C:\Windows\System\iwIiWbV.exe
  C:\Windows\System\iwIiWbV.exe
  2⤵
  PID:8416
- C:\Windows\System\oLbIKOK.exe
  C:\Windows\System\oLbIKOK.exe
  2⤵
  PID:6788
- C:\Windows\System\aBGEHCI.exe
  C:\Windows\System\aBGEHCI.exe
  2⤵
  PID:8540
- C:\Windows\System\uHMPBpJ.exe
  C:\Windows\System\uHMPBpJ.exe
  2⤵
  PID:8588
- C:\Windows\System\nabmSib.exe
  C:\Windows\System\nabmSib.exe
  2⤵
  PID:8648
- C:\Windows\System\gbtVuzP.exe
  C:\Windows\System\gbtVuzP.exe
  2⤵
  PID:8216
- C:\Windows\System\bXQiHwJ.exe
  C:\Windows\System\bXQiHwJ.exe
  2⤵
  PID:8252
- C:\Windows\System\AKcyNre.exe
  C:\Windows\System\AKcyNre.exe
  2⤵
  PID:8276
- C:\Windows\System\tBheack.exe
  C:\Windows\System\tBheack.exe
  2⤵
  PID:8756
- C:\Windows\System\kINbZMe.exe
  C:\Windows\System\kINbZMe.exe
  2⤵
  PID:8364
- C:\Windows\System\clkTwzH.exe
  C:\Windows\System\clkTwzH.exe
  2⤵
  PID:8392
- C:\Windows\System\lnAefiZ.exe
  C:\Windows\System\lnAefiZ.exe
  2⤵
  PID:4676
- C:\Windows\System\NVAEENi.exe
  C:\Windows\System\NVAEENi.exe
  2⤵
  PID:8504
- C:\Windows\System\qLGXWUA.exe
  C:\Windows\System\qLGXWUA.exe
  2⤵
  PID:9112
- C:\Windows\System\SmYVwSQ.exe
  C:\Windows\System\SmYVwSQ.exe
  2⤵
  PID:9160
- C:\Windows\System\zrkQylr.exe
  C:\Windows\System\zrkQylr.exe
  2⤵
  PID:9240
- C:\Windows\System\mXvpVuv.exe
  C:\Windows\System\mXvpVuv.exe
  2⤵
  PID:9260
- C:\Windows\System\hYCaQKH.exe
  C:\Windows\System\hYCaQKH.exe
  2⤵
  PID:9284
- C:\Windows\System\chkNaGh.exe
  C:\Windows\System\chkNaGh.exe
  2⤵
  PID:9304
- C:\Windows\System\WHHgBJR.exe
  C:\Windows\System\WHHgBJR.exe
  2⤵
  PID:9328
- C:\Windows\System\mHVfeAK.exe
  C:\Windows\System\mHVfeAK.exe
  2⤵
  PID:9352
- C:\Windows\System\NXmETas.exe
  C:\Windows\System\NXmETas.exe
  2⤵
  PID:9372
- C:\Windows\System\YyURnLs.exe
  C:\Windows\System\YyURnLs.exe
  2⤵
  PID:9400
- C:\Windows\System\LQGwXjY.exe
  C:\Windows\System\LQGwXjY.exe
  2⤵
  PID:9420
- C:\Windows\System\mFCpAHb.exe
  C:\Windows\System\mFCpAHb.exe
  2⤵
  PID:9444
- C:\Windows\System\cOvovlc.exe
  C:\Windows\System\cOvovlc.exe
  2⤵
  PID:9468
- C:\Windows\System\mognvlf.exe
  C:\Windows\System\mognvlf.exe
  2⤵
  PID:9492
- C:\Windows\System\OraPZFl.exe
  C:\Windows\System\OraPZFl.exe
  2⤵
  PID:9516
- C:\Windows\System\nwAxItF.exe
  C:\Windows\System\nwAxItF.exe
  2⤵
  PID:9536
- C:\Windows\System\DJCcfBe.exe
  C:\Windows\System\DJCcfBe.exe
  2⤵
  PID:9552
- C:\Windows\System\rSdmRJJ.exe
  C:\Windows\System\rSdmRJJ.exe
  2⤵
  PID:9576
- C:\Windows\System\sCpoZft.exe
  C:\Windows\System\sCpoZft.exe
  2⤵
  PID:9604
- C:\Windows\System\kISYFBx.exe
  C:\Windows\System\kISYFBx.exe
  2⤵
  PID:9624
- C:\Windows\System\Shguzqw.exe
  C:\Windows\System\Shguzqw.exe
  2⤵
  PID:9648
- C:\Windows\System\zvfZPjF.exe
  C:\Windows\System\zvfZPjF.exe
  2⤵
  PID:9664
- C:\Windows\System\EHkFrUU.exe
  C:\Windows\System\EHkFrUU.exe
  2⤵
  PID:9680
- C:\Windows\System\zInUFfH.exe
  C:\Windows\System\zInUFfH.exe
  2⤵
  PID:9700
- C:\Windows\System\kwrqqTE.exe
  C:\Windows\System\kwrqqTE.exe
  2⤵
  PID:9716
- C:\Windows\System\iPgTPyW.exe
  C:\Windows\System\iPgTPyW.exe
  2⤵
  PID:9732
- C:\Windows\System\oHhGARp.exe
  C:\Windows\System\oHhGARp.exe
  2⤵
  PID:9756
- C:\Windows\System\NGBYVyc.exe
  C:\Windows\System\NGBYVyc.exe
  2⤵
  PID:9784
- C:\Windows\System\boUrUrR.exe
  C:\Windows\System\boUrUrR.exe
  2⤵
  PID:9804
- C:\Windows\System\aOWYsJS.exe
  C:\Windows\System\aOWYsJS.exe
  2⤵
  PID:9828
- C:\Windows\System\DNhtOfj.exe
  C:\Windows\System\DNhtOfj.exe
  2⤵
  PID:9852
- C:\Windows\System\QPWkyaJ.exe
  C:\Windows\System\QPWkyaJ.exe
  2⤵
  PID:9868
- C:\Windows\System\LBrOioM.exe
  C:\Windows\System\LBrOioM.exe
  2⤵
  PID:9896
- C:\Windows\System\VjCMBTq.exe
  C:\Windows\System\VjCMBTq.exe
  2⤵
  PID:9924
- C:\Windows\System\YrCesYQ.exe
  C:\Windows\System\YrCesYQ.exe
  2⤵
  PID:9940
- C:\Windows\System\aowHFWu.exe
  C:\Windows\System\aowHFWu.exe
  2⤵
  PID:9968
- C:\Windows\System\bpPnoUH.exe
  C:\Windows\System\bpPnoUH.exe
  2⤵
  PID:9988
- C:\Windows\System\Xxxhqiz.exe
  C:\Windows\System\Xxxhqiz.exe
  2⤵
  PID:10012
- C:\Windows\System\FTQjXtj.exe
  C:\Windows\System\FTQjXtj.exe
  2⤵
  PID:10036
- C:\Windows\System\zrNglan.exe
  C:\Windows\System\zrNglan.exe
  2⤵
  PID:10056
- C:\Windows\System\nrgMDDF.exe
  C:\Windows\System\nrgMDDF.exe
  2⤵
  PID:10076
- C:\Windows\System\LrugyrT.exe
  C:\Windows\System\LrugyrT.exe
  2⤵
  PID:10104
- C:\Windows\System\ooibolz.exe
  C:\Windows\System\ooibolz.exe
  2⤵
  PID:10128
- C:\Windows\System\gJVYcLS.exe
  C:\Windows\System\gJVYcLS.exe
  2⤵
  PID:10156
- C:\Windows\System\DwbMASz.exe
  C:\Windows\System\DwbMASz.exe
  2⤵
  PID:10188
- C:\Windows\System\qmjUGce.exe
  C:\Windows\System\qmjUGce.exe
  2⤵
  PID:10220
- C:\Windows\System\IlrnKrR.exe
  C:\Windows\System\IlrnKrR.exe
  2⤵
  PID:9184
- C:\Windows\System\CJkARiy.exe
  C:\Windows\System\CJkARiy.exe
  2⤵
  PID:3492
- C:\Windows\System\ejJXxuc.exe
  C:\Windows\System\ejJXxuc.exe
  2⤵
  PID:8848
- C:\Windows\System\pUqjkCa.exe
  C:\Windows\System\pUqjkCa.exe
  2⤵
  PID:8396
- C:\Windows\System\ezTLqIh.exe
  C:\Windows\System\ezTLqIh.exe
  2⤵
  PID:8916
- C:\Windows\System\mAPXyxU.exe
  C:\Windows\System\mAPXyxU.exe
  2⤵
  PID:8972
- C:\Windows\System\LJCsYnI.exe
  C:\Windows\System\LJCsYnI.exe
  2⤵
  PID:8500
- C:\Windows\System\besABpr.exe
  C:\Windows\System\besABpr.exe
  2⤵
  PID:9016
- C:\Windows\System\iMtOmFu.exe
  C:\Windows\System\iMtOmFu.exe
  2⤵
  PID:8780
- C:\Windows\System\DEJJeFK.exe
  C:\Windows\System\DEJJeFK.exe
  2⤵
  PID:7712
- C:\Windows\System\BTgplMQ.exe
  C:\Windows\System\BTgplMQ.exe
  2⤵
  PID:9180
- C:\Windows\System\BjaEhDS.exe
  C:\Windows\System\BjaEhDS.exe
  2⤵
  PID:9312
- C:\Windows\System\ePNhsgg.exe
  C:\Windows\System\ePNhsgg.exe
  2⤵
  PID:9348
- C:\Windows\System\bbsbGBM.exe
  C:\Windows\System\bbsbGBM.exe
  2⤵
  PID:9392
- C:\Windows\System\kJvCKWn.exe
  C:\Windows\System\kJvCKWn.exe
  2⤵
  PID:3452
- C:\Windows\System\rGsHKlx.exe
  C:\Windows\System\rGsHKlx.exe
  2⤵
  PID:6176
- C:\Windows\System\irkxHXN.exe
  C:\Windows\System\irkxHXN.exe
  2⤵
  PID:8444
- C:\Windows\System\xVPLuUq.exe
  C:\Windows\System\xVPLuUq.exe
  2⤵
  PID:10244
- C:\Windows\System\ohGADkX.exe
  C:\Windows\System\ohGADkX.exe
  2⤵
  PID:10272
- C:\Windows\System\bxxOMRZ.exe
  C:\Windows\System\bxxOMRZ.exe
  2⤵
  PID:10296
- C:\Windows\System\fXhzWJd.exe
  C:\Windows\System\fXhzWJd.exe
  2⤵
  PID:10324
- C:\Windows\System\UkOJUoa.exe
  C:\Windows\System\UkOJUoa.exe
  2⤵
  PID:10344
- C:\Windows\System\iwAUJUB.exe
  C:\Windows\System\iwAUJUB.exe
  2⤵
  PID:10372
- C:\Windows\System\josACXA.exe
  C:\Windows\System\josACXA.exe
  2⤵
  PID:10388
- C:\Windows\System\nsNgAYh.exe
  C:\Windows\System\nsNgAYh.exe
  2⤵
  PID:10416
- C:\Windows\System\PsqOkBc.exe
  C:\Windows\System\PsqOkBc.exe
  2⤵
  PID:10436
- C:\Windows\System\INvGnTg.exe
  C:\Windows\System\INvGnTg.exe
  2⤵
  PID:10456
- C:\Windows\System\hWASRvP.exe
  C:\Windows\System\hWASRvP.exe
  2⤵
  PID:10484
- C:\Windows\System\gZociXQ.exe
  C:\Windows\System\gZociXQ.exe
  2⤵
  PID:10504
- C:\Windows\System\TBesdeU.exe
  C:\Windows\System\TBesdeU.exe
  2⤵
  PID:10524
- C:\Windows\System\lwPsWVs.exe
  C:\Windows\System\lwPsWVs.exe
  2⤵
  PID:10552
- C:\Windows\System\ugWeqEc.exe
  C:\Windows\System\ugWeqEc.exe
  2⤵
  PID:10572
- C:\Windows\System\dBUfryd.exe
  C:\Windows\System\dBUfryd.exe
  2⤵
  PID:10596
- C:\Windows\System\SwqceOt.exe
  C:\Windows\System\SwqceOt.exe
  2⤵
  PID:10616
- C:\Windows\System\hQnGpxD.exe
  C:\Windows\System\hQnGpxD.exe
  2⤵
  PID:10636
- C:\Windows\System\obLBdoz.exe
  C:\Windows\System\obLBdoz.exe
  2⤵
  PID:10660
- C:\Windows\System\cKecheE.exe
  C:\Windows\System\cKecheE.exe
  2⤵
  PID:10676
- C:\Windows\System\egGndFf.exe
  C:\Windows\System\egGndFf.exe
  2⤵
  PID:10696
- C:\Windows\System\YwUItdw.exe
  C:\Windows\System\YwUItdw.exe
  2⤵
  PID:10720
- C:\Windows\System\lIEGOzG.exe
  C:\Windows\System\lIEGOzG.exe
  2⤵
  PID:10748
- C:\Windows\System\UXroaNN.exe
  C:\Windows\System\UXroaNN.exe
  2⤵
  PID:10788
- C:\Windows\System\rxcIQsb.exe
  C:\Windows\System\rxcIQsb.exe
  2⤵
  PID:10808
- C:\Windows\System\BKIUtSo.exe
  C:\Windows\System\BKIUtSo.exe
  2⤵
  PID:10832
- C:\Windows\System\NsiVouS.exe
  C:\Windows\System\NsiVouS.exe
  2⤵
  PID:10856
- C:\Windows\System\STYgwVz.exe
  C:\Windows\System\STYgwVz.exe
  2⤵
  PID:10876
- C:\Windows\System\LTPMKgo.exe
  C:\Windows\System\LTPMKgo.exe
  2⤵
  PID:10892
- C:\Windows\System\jAVOStm.exe
  C:\Windows\System\jAVOStm.exe
  2⤵
  PID:10912
- C:\Windows\System\tuwyOHb.exe
  C:\Windows\System\tuwyOHb.exe
  2⤵
  PID:10936
- C:\Windows\System\KZRNtKV.exe
  C:\Windows\System\KZRNtKV.exe
  2⤵
  PID:10960
- C:\Windows\System\oVXWdQE.exe
  C:\Windows\System\oVXWdQE.exe
  2⤵
  PID:10984
- C:\Windows\System\fXHDWNs.exe
  C:\Windows\System\fXHDWNs.exe
  2⤵
  PID:11008
- C:\Windows\System\uBeYLOG.exe
  C:\Windows\System\uBeYLOG.exe
  2⤵
  PID:11036
- C:\Windows\System\iGHaTZP.exe
  C:\Windows\System\iGHaTZP.exe
  2⤵
  PID:11052
- C:\Windows\System\eWQIXWT.exe
  C:\Windows\System\eWQIXWT.exe
  2⤵
  PID:11072
- C:\Windows\System\eemaMzr.exe
  C:\Windows\System\eemaMzr.exe
  2⤵
  PID:11096
- C:\Windows\System\LoFZjUv.exe
  C:\Windows\System\LoFZjUv.exe
  2⤵
  PID:11120
- C:\Windows\System\yDuDrUG.exe
  C:\Windows\System\yDuDrUG.exe
  2⤵
  PID:11140
- C:\Windows\System\RcCzSkS.exe
  C:\Windows\System\RcCzSkS.exe
  2⤵
  PID:11160
- C:\Windows\System\kPHJTrU.exe
  C:\Windows\System\kPHJTrU.exe
  2⤵
  PID:11180
- C:\Windows\System\XXKTsth.exe
  C:\Windows\System\XXKTsth.exe
  2⤵
  PID:11204
- C:\Windows\System\MUuuQAl.exe
  C:\Windows\System\MUuuQAl.exe
  2⤵
  PID:11232
- C:\Windows\System\JkoDuWP.exe
  C:\Windows\System\JkoDuWP.exe
  2⤵
  PID:11260
- C:\Windows\System\chuQUrz.exe
  C:\Windows\System\chuQUrz.exe
  2⤵
  PID:9776
- C:\Windows\System\NsGZNaW.exe
  C:\Windows\System\NsGZNaW.exe
  2⤵
  PID:9820
- C:\Windows\System\VjyJMuy.exe
  C:\Windows\System\VjyJMuy.exe
  2⤵
  PID:9888
- C:\Windows\System\cfBiTTu.exe
  C:\Windows\System\cfBiTTu.exe
  2⤵
  PID:9000
- C:\Windows\System\OGVBxGJ.exe
  C:\Windows\System\OGVBxGJ.exe
  2⤵
  PID:10048
- C:\Windows\System\SczSNeQ.exe
  C:\Windows\System\SczSNeQ.exe
  2⤵
  PID:9256
- C:\Windows\System\rAgkFZd.exe
  C:\Windows\System\rAgkFZd.exe
  2⤵
  PID:10116
- C:\Windows\System\fpgIqsY.exe
  C:\Windows\System\fpgIqsY.exe
  2⤵
  PID:9360
- C:\Windows\System\LOWTRVy.exe
  C:\Windows\System\LOWTRVy.exe
  2⤵
  PID:8820
- C:\Windows\System\biMhjnx.exe
  C:\Windows\System\biMhjnx.exe
  2⤵
  PID:9584
- C:\Windows\System\Gmvluqe.exe
  C:\Windows\System\Gmvluqe.exe
  2⤵
  PID:9220
- C:\Windows\System\RFaVWjK.exe
  C:\Windows\System\RFaVWjK.exe
  2⤵
  PID:9336
- C:\Windows\System\KDreYKX.exe
  C:\Windows\System\KDreYKX.exe
  2⤵
  PID:6536
- C:\Windows\System\LBSYBJQ.exe
  C:\Windows\System\LBSYBJQ.exe
  2⤵
  PID:9724
- C:\Windows\System\rdSmZkV.exe
  C:\Windows\System\rdSmZkV.exe
  2⤵
  PID:10288
- C:\Windows\System\tTuCtrA.exe
  C:\Windows\System\tTuCtrA.exe
  2⤵
  PID:10352
- C:\Windows\System\sVmEdvo.exe
  C:\Windows\System\sVmEdvo.exe
  2⤵
  PID:10452
- C:\Windows\System\xIPkYKx.exe
  C:\Windows\System\xIPkYKx.exe
  2⤵
  PID:8352
- C:\Windows\System\TpJGNIA.exe
  C:\Windows\System\TpJGNIA.exe
  2⤵
  PID:9860
- C:\Windows\System\kdFAiFI.exe
  C:\Windows\System\kdFAiFI.exe
  2⤵
  PID:8440
- C:\Windows\System\dbqRJqX.exe
  C:\Windows\System\dbqRJqX.exe
  2⤵
  PID:9976
- C:\Windows\System\KtQBfca.exe
  C:\Windows\System\KtQBfca.exe
  2⤵
  PID:9252
- C:\Windows\System\eOQYXvt.exe
  C:\Windows\System\eOQYXvt.exe
  2⤵
  PID:11280
- C:\Windows\System\LTOvqKp.exe
  C:\Windows\System\LTOvqKp.exe
  2⤵
  PID:11300
- C:\Windows\System\wWUxFqr.exe
  C:\Windows\System\wWUxFqr.exe
  2⤵
  PID:11324
- C:\Windows\System\VDAJCeI.exe
  C:\Windows\System\VDAJCeI.exe
  2⤵
  PID:11344
- C:\Windows\System\oUWPOoA.exe
  C:\Windows\System\oUWPOoA.exe
  2⤵
  PID:11364
- C:\Windows\System\uAFFfRg.exe
  C:\Windows\System\uAFFfRg.exe
  2⤵
  PID:11388
- C:\Windows\System\IvjJHup.exe
  C:\Windows\System\IvjJHup.exe
  2⤵
  PID:11412
- C:\Windows\System\sLFqygb.exe
  C:\Windows\System\sLFqygb.exe
  2⤵
  PID:11432
- C:\Windows\System\wTxdqRN.exe
  C:\Windows\System\wTxdqRN.exe
  2⤵
  PID:11452
- C:\Windows\System\wsUSkww.exe
  C:\Windows\System\wsUSkww.exe
  2⤵
  PID:11472
- C:\Windows\System\WlpnrSo.exe
  C:\Windows\System\WlpnrSo.exe
  2⤵
  PID:11492
- C:\Windows\System\YQollJi.exe
  C:\Windows\System\YQollJi.exe
  2⤵
  PID:11516
- C:\Windows\System\EcJCkrc.exe
  C:\Windows\System\EcJCkrc.exe
  2⤵
  PID:11540
- C:\Windows\System\DccdtWA.exe
  C:\Windows\System\DccdtWA.exe
  2⤵
  PID:11568
- C:\Windows\System\hcwpjeQ.exe
  C:\Windows\System\hcwpjeQ.exe
  2⤵
  PID:11600
- C:\Windows\System\RPiEwJY.exe
  C:\Windows\System\RPiEwJY.exe
  2⤵
  PID:11628
- C:\Windows\System\PLrqSAx.exe
  C:\Windows\System\PLrqSAx.exe
  2⤵
  PID:11648
- C:\Windows\System\JDwaARn.exe
  C:\Windows\System\JDwaARn.exe
  2⤵
  PID:11672
- C:\Windows\System\empkdtw.exe
  C:\Windows\System\empkdtw.exe
  2⤵
  PID:11696
- C:\Windows\System\HcRQflc.exe
  C:\Windows\System\HcRQflc.exe
  2⤵
  PID:11716
- C:\Windows\System\ZRURjJB.exe
  C:\Windows\System\ZRURjJB.exe
  2⤵
  PID:11736
- C:\Windows\System\fLpprzs.exe
  C:\Windows\System\fLpprzs.exe
  2⤵
  PID:11760
- C:\Windows\System\UYwEBUO.exe
  C:\Windows\System\UYwEBUO.exe
  2⤵
  PID:11784
- C:\Windows\System\dXLrfTR.exe
  C:\Windows\System\dXLrfTR.exe
  2⤵
  PID:11812
- C:\Windows\System\SbXfAca.exe
  C:\Windows\System\SbXfAca.exe
  2⤵
  PID:11840
- C:\Windows\System\iOoTvmP.exe
  C:\Windows\System\iOoTvmP.exe
  2⤵
  PID:11864
- C:\Windows\System\UjvQfSn.exe
  C:\Windows\System\UjvQfSn.exe
  2⤵
  PID:11888
- C:\Windows\System\aORSNWe.exe
  C:\Windows\System\aORSNWe.exe
  2⤵
  PID:11904
- C:\Windows\System\dYPUTlm.exe
  C:\Windows\System\dYPUTlm.exe
  2⤵
  PID:11920
- C:\Windows\System\CXXpJww.exe
  C:\Windows\System\CXXpJww.exe
  2⤵
  PID:11936
- C:\Windows\System\VBqdawh.exe
  C:\Windows\System\VBqdawh.exe
  2⤵
  PID:11952
- C:\Windows\System\ZNsrrhj.exe
  C:\Windows\System\ZNsrrhj.exe
  2⤵
  PID:11968
- C:\Windows\System\SeeHmwz.exe
  C:\Windows\System\SeeHmwz.exe
  2⤵
  PID:11984
- C:\Windows\System\DCZtByo.exe
  C:\Windows\System\DCZtByo.exe
  2⤵
  PID:12004
- C:\Windows\System\vafVPve.exe
  C:\Windows\System\vafVPve.exe
  2⤵
  PID:12028
- C:\Windows\System\mEUCSEU.exe
  C:\Windows\System\mEUCSEU.exe
  2⤵
  PID:12052
- C:\Windows\System\RyVhqgp.exe
  C:\Windows\System\RyVhqgp.exe
  2⤵
  PID:12072
- C:\Windows\System\SEpLLsi.exe
  C:\Windows\System\SEpLLsi.exe
  2⤵
  PID:12092
- C:\Windows\System\MjRrEJM.exe
  C:\Windows\System\MjRrEJM.exe
  2⤵
  PID:12120
- C:\Windows\System\nuQJIgO.exe
  C:\Windows\System\nuQJIgO.exe
  2⤵
  PID:12144
- C:\Windows\System\DcxtQZd.exe
  C:\Windows\System\DcxtQZd.exe
  2⤵
  PID:12164
- C:\Windows\System\LedlqxU.exe
  C:\Windows\System\LedlqxU.exe
  2⤵
  PID:12188
- C:\Windows\System\JUemqsD.exe
  C:\Windows\System\JUemqsD.exe
  2⤵
  PID:12208
- C:\Windows\System\TmGjdaw.exe
  C:\Windows\System\TmGjdaw.exe
  2⤵
  PID:12228
- C:\Windows\System\eAMKIdr.exe
  C:\Windows\System\eAMKIdr.exe
  2⤵
  PID:12248
- C:\Windows\System\ptReOhH.exe
  C:\Windows\System\ptReOhH.exe
  2⤵
  PID:12272
- C:\Windows\System\rBCkVtE.exe
  C:\Windows\System\rBCkVtE.exe
  2⤵
  PID:10668
- C:\Windows\System\bLNQNTZ.exe
  C:\Windows\System\bLNQNTZ.exe
  2⤵
  PID:9456
- C:\Windows\System\TowrAIz.exe
  C:\Windows\System\TowrAIz.exe
  2⤵
  PID:2132
- C:\Windows\System\QJDYLay.exe
  C:\Windows\System\QJDYLay.exe
  2⤵
  PID:8484
- C:\Windows\System\QlcJFOn.exe
  C:\Windows\System\QlcJFOn.exe
  2⤵
  PID:8680
- C:\Windows\System\dKVDCCn.exe
  C:\Windows\System\dKVDCCn.exe
  2⤵
  PID:8296
- C:\Windows\System\MbvCMji.exe
  C:\Windows\System\MbvCMji.exe
  2⤵
  PID:11088
- C:\Windows\System\FjGjsLc.exe
  C:\Windows\System\FjGjsLc.exe
  2⤵
  PID:9984
- C:\Windows\System\kXJRAfw.exe
  C:\Windows\System\kXJRAfw.exe
  2⤵
  PID:9272
- C:\Windows\System\ddnUMsN.exe
  C:\Windows\System\ddnUMsN.exe
  2⤵
  PID:9844
- C:\Windows\System\eHvEOVf.exe
  C:\Windows\System\eHvEOVf.exe
  2⤵
  PID:9916
- C:\Windows\System\YitpTZr.exe
  C:\Windows\System\YitpTZr.exe
  2⤵
  PID:6996
- C:\Windows\System\xPnGnNF.exe
  C:\Windows\System\xPnGnNF.exe
  2⤵
  PID:10628
- C:\Windows\System\VXqTbIz.exe
  C:\Windows\System\VXqTbIz.exe
  2⤵
  PID:9840
- C:\Windows\System\EUfuWVP.exe
  C:\Windows\System\EUfuWVP.exe
  2⤵
  PID:10652
- C:\Windows\System\Zovmapo.exe
  C:\Windows\System\Zovmapo.exe
  2⤵
  PID:10704
- C:\Windows\System\xtdAsqB.exe
  C:\Windows\System\xtdAsqB.exe
  2⤵
  PID:10712
- C:\Windows\System\odwMMbS.exe
  C:\Windows\System\odwMMbS.exe
  2⤵
  PID:12300
- C:\Windows\System\UewGIYi.exe
  C:\Windows\System\UewGIYi.exe
  2⤵
  PID:12320
- C:\Windows\System\zYcRTAE.exe
  C:\Windows\System\zYcRTAE.exe
  2⤵
  PID:12348
- C:\Windows\System\PaldvbY.exe
  C:\Windows\System\PaldvbY.exe
  2⤵
  PID:12364
- C:\Windows\System\VnninHL.exe
  C:\Windows\System\VnninHL.exe
  2⤵
  PID:12388
- C:\Windows\System\npUBqYf.exe
  C:\Windows\System\npUBqYf.exe
  2⤵
  PID:12416
- C:\Windows\System\VFxGiSN.exe
  C:\Windows\System\VFxGiSN.exe
  2⤵
  PID:12432
- C:\Windows\System\oRHCFfk.exe
  C:\Windows\System\oRHCFfk.exe
  2⤵
  PID:12460
- C:\Windows\System\WHHymxN.exe
  C:\Windows\System\WHHymxN.exe
  2⤵
  PID:12476
- C:\Windows\System\OJujuNH.exe
  C:\Windows\System\OJujuNH.exe
  2⤵
  PID:12496
- C:\Windows\System\fMLHlYV.exe
  C:\Windows\System\fMLHlYV.exe
  2⤵
  PID:12524
- C:\Windows\System\trRlDnb.exe
  C:\Windows\System\trRlDnb.exe
  2⤵
  PID:12540
- C:\Windows\System\pExpJUK.exe
  C:\Windows\System\pExpJUK.exe
  2⤵
  PID:12564
- C:\Windows\System\XOfcoYD.exe
  C:\Windows\System\XOfcoYD.exe
  2⤵
  PID:12584
- C:\Windows\System\LkWwYcL.exe
  C:\Windows\System\LkWwYcL.exe
  2⤵
  PID:12600
- C:\Windows\System\wPkIySA.exe
  C:\Windows\System\wPkIySA.exe
  2⤵
  PID:12620
- C:\Windows\System\ToHFVNB.exe
  C:\Windows\System\ToHFVNB.exe
  2⤵
  PID:12644
- C:\Windows\System\EUQJbAT.exe
  C:\Windows\System\EUQJbAT.exe
  2⤵
  PID:12664
- C:\Windows\System\lLHPtuw.exe
  C:\Windows\System\lLHPtuw.exe
  2⤵
  PID:12684
- C:\Windows\System\RiAwUlH.exe
  C:\Windows\System\RiAwUlH.exe
  2⤵
  PID:12708
- C:\Windows\System\yUFvkGf.exe
  C:\Windows\System\yUFvkGf.exe
  2⤵
  PID:12732
- C:\Windows\System\ilPufON.exe
  C:\Windows\System\ilPufON.exe
  2⤵
  PID:12752
- C:\Windows\System\RtunioH.exe
  C:\Windows\System\RtunioH.exe
  2⤵
  PID:12772
- C:\Windows\System\micNhzJ.exe
  C:\Windows\System\micNhzJ.exe
  2⤵
  PID:12796
- C:\Windows\System\iIRlWsH.exe
  C:\Windows\System\iIRlWsH.exe
  2⤵
  PID:12820
- C:\Windows\System\lLOoWoX.exe
  C:\Windows\System\lLOoWoX.exe
  2⤵
  PID:12840
- C:\Windows\System\FbFRWgf.exe
  C:\Windows\System\FbFRWgf.exe
  2⤵
  PID:12860
- C:\Windows\System\NwzpmEH.exe
  C:\Windows\System\NwzpmEH.exe
  2⤵
  PID:12884
- C:\Windows\System\mSKDkMn.exe
  C:\Windows\System\mSKDkMn.exe
  2⤵
  PID:12904
- C:\Windows\System\tVOODJP.exe
  C:\Windows\System\tVOODJP.exe
  2⤵
  PID:12928
- C:\Windows\System\eFmyhnm.exe
  C:\Windows\System\eFmyhnm.exe
  2⤵
  PID:12948
- C:\Windows\System\RYikPxQ.exe
  C:\Windows\System\RYikPxQ.exe
  2⤵
  PID:12964
- C:\Windows\System\ovXRmkn.exe
  C:\Windows\System\ovXRmkn.exe
  2⤵
  PID:12980
- C:\Windows\System\BaWpJGx.exe
  C:\Windows\System\BaWpJGx.exe
  2⤵
  PID:13004
- C:\Windows\System\ZsUownF.exe
  C:\Windows\System\ZsUownF.exe
  2⤵
  PID:13020
- C:\Windows\System\MHBuhDt.exe
  C:\Windows\System\MHBuhDt.exe
  2⤵
  PID:13036
- C:\Windows\System\sfAsNSX.exe
  C:\Windows\System\sfAsNSX.exe
  2⤵
  PID:13052
- C:\Windows\System\nuSHIok.exe
  C:\Windows\System\nuSHIok.exe
  2⤵
  PID:13068
- C:\Windows\System\ORNFALN.exe
  C:\Windows\System\ORNFALN.exe
  2⤵
  PID:13084
- C:\Windows\System\DhVmkEY.exe
  C:\Windows\System\DhVmkEY.exe
  2⤵
  PID:11752
- C:\Windows\System\EkRAMEB.exe
  C:\Windows\System\EkRAMEB.exe
  2⤵
  PID:11916
- C:\Windows\System\VcoFAKy.exe
  C:\Windows\System\VcoFAKy.exe
  2⤵
  PID:11960
- C:\Windows\System\YjFNwsQ.exe
  C:\Windows\System\YjFNwsQ.exe
  2⤵
  PID:12088
- C:\Windows\System\fuskuWy.exe
  C:\Windows\System\fuskuWy.exe
  2⤵
  PID:12760
- C:\Windows\System\PXBHXxu.exe
  C:\Windows\System\PXBHXxu.exe
  2⤵
  PID:9532
- C:\Windows\System\DMFvqQG.exe
  C:\Windows\System\DMFvqQG.exe
  2⤵
  PID:12916
- C:\Windows\System\PFCLCqk.exe
  C:\Windows\System\PFCLCqk.exe
  2⤵
  PID:12976
- C:\Windows\System\isQisGC.exe
  C:\Windows\System\isQisGC.exe
  2⤵
  PID:13076
- C:\Windows\System\fPcPHDw.exe
  C:\Windows\System\fPcPHDw.exe
  2⤵
  PID:13136
- C:\Windows\System\ToFUeRV.exe
  C:\Windows\System\ToFUeRV.exe
  2⤵
  PID:12240
- C:\Windows\System\uxfkLrJ.exe
  C:\Windows\System\uxfkLrJ.exe
  2⤵
  PID:3196
- C:\Windows\System\TNMOJrG.exe
  C:\Windows\System\TNMOJrG.exe
  2⤵
  PID:9460
- C:\Windows\System\HocqxMb.exe
  C:\Windows\System\HocqxMb.exe
  2⤵
  PID:9764
- C:\Windows\System\gkHwyDn.exe
  C:\Windows\System\gkHwyDn.exe
  2⤵
  PID:9884
- C:\Windows\System\BywSTFy.exe
  C:\Windows\System\BywSTFy.exe
  2⤵
  PID:10084
- C:\Windows\System\SPmOrat.exe
  C:\Windows\System\SPmOrat.exe
  2⤵
  PID:8568
- C:\Windows\System\zHLFEKm.exe
  C:\Windows\System\zHLFEKm.exe
  2⤵
  PID:10100
- C:\Windows\System\YzCWecq.exe
  C:\Windows\System\YzCWecq.exe
  2⤵
  PID:11380
- C:\Windows\System\ifPHdfv.exe
  C:\Windows\System\ifPHdfv.exe
  2⤵
  PID:11548
- C:\Windows\System\OhAIJsr.exe
  C:\Windows\System\OhAIJsr.exe
  2⤵
  PID:12548
- C:\Windows\System\PfKvzph.exe
  C:\Windows\System\PfKvzph.exe
  2⤵
  PID:12592
- C:\Windows\System\ZxknAhY.exe
  C:\Windows\System\ZxknAhY.exe
  2⤵
  PID:12060
- C:\Windows\System\BIPzRXz.exe
  C:\Windows\System\BIPzRXz.exe
  2⤵
  PID:12112
- C:\Windows\System\dIBSHpb.exe
  C:\Windows\System\dIBSHpb.exe
  2⤵
  PID:12892
- C:\Windows\System\XpQTmsn.exe
  C:\Windows\System\XpQTmsn.exe
  2⤵
  PID:9836
- C:\Windows\System\QhgkKSz.exe
  C:\Windows\System\QhgkKSz.exe
  2⤵
  PID:13144
- C:\Windows\System\hxZWYlG.exe
  C:\Windows\System\hxZWYlG.exe
  2⤵
  PID:13116
- C:\Windows\System\nWLXEOe.exe
  C:\Windows\System\nWLXEOe.exe
  2⤵
  PID:8904
- C:\Windows\System\BlPuTHT.exe
  C:\Windows\System\BlPuTHT.exe
  2⤵
  PID:8984
- C:\Windows\System\cACGMmF.exe
  C:\Windows\System\cACGMmF.exe
  2⤵
  PID:12316
- C:\Windows\System\QJeCxnE.exe
  C:\Windows\System\QJeCxnE.exe
  2⤵
  PID:12456
- C:\Windows\System\ksbdzSU.exe
  C:\Windows\System\ksbdzSU.exe
  2⤵
  PID:12944
- C:\Windows\System\kbZuIPo.exe
  C:\Windows\System\kbZuIPo.exe
  2⤵
  PID:13080
- C:\Windows\System\iPHsyny.exe
  C:\Windows\System\iPHsyny.exe
  2⤵
  PID:11620
- C:\Windows\System\KkMYzgJ.exe
  C:\Windows\System\KkMYzgJ.exe
  2⤵
  PID:11712
- C:\Windows\System\rWzzPnA.exe
  C:\Windows\System\rWzzPnA.exe
  2⤵
  PID:4148
- C:\Windows\System\SeAbExt.exe
  C:\Windows\System\SeAbExt.exe
  2⤵
  PID:11196
- C:\Windows\System\TPVBUQN.exe
  C:\Windows\System\TPVBUQN.exe
  2⤵
  PID:9672
- C:\Windows\System\kkuwHHq.exe
  C:\Windows\System\kkuwHHq.exe
  2⤵
  PID:9908
- C:\Windows\System\OvznaSV.exe
  C:\Windows\System\OvznaSV.exe
  2⤵
  PID:9484
- C:\Windows\System\cxDSQcp.exe
  C:\Windows\System\cxDSQcp.exe
  2⤵
  PID:10928
- C:\Windows\System\tGgSSkk.exe
  C:\Windows\System\tGgSSkk.exe
  2⤵
  PID:10980
- C:\Windows\System\CDPtcUc.exe
  C:\Windows\System\CDPtcUc.exe
  2⤵
  PID:7908
- C:\Windows\System\efXeBkc.exe
  C:\Windows\System\efXeBkc.exe
  2⤵
  PID:11172
- C:\Windows\System\RLaZEvJ.exe
  C:\Windows\System\RLaZEvJ.exe
  2⤵
  PID:3308
- C:\Windows\System\qfxFPoO.exe
  C:\Windows\System\qfxFPoO.exe
  2⤵
  PID:1888
- C:\Windows\System\ywyLTQX.exe
  C:\Windows\System\ywyLTQX.exe
  2⤵
  PID:9712
- C:\Windows\System\aMcAelM.exe
  C:\Windows\System\aMcAelM.exe
  2⤵
  PID:11016
- C:\Windows\System\NdkwsIU.exe
  C:\Windows\System\NdkwsIU.exe
  2⤵
  PID:11060
- C:\Windows\System\MyDKwIn.exe
  C:\Windows\System\MyDKwIn.exe
  2⤵
  PID:11996
- C:\Windows\System\soyjczA.exe
  C:\Windows\System\soyjczA.exe
  2⤵
  PID:12360
- C:\Windows\System\vmsYJSt.exe
  C:\Windows\System\vmsYJSt.exe
  2⤵
  PID:11356
- C:\Windows\System\nXVAonE.exe
  C:\Windows\System\nXVAonE.exe
  2⤵
  PID:11468
- C:\Windows\System\qyJFlUQ.exe
  C:\Windows\System\qyJFlUQ.exe
  2⤵
  PID:12040
- C:\Windows\System\OHiQsyI.exe
  C:\Windows\System\OHiQsyI.exe
  2⤵
  PID:11448
- C:\Windows\System\AhzcNVV.exe
  C:\Windows\System\AhzcNVV.exe
  2⤵
  PID:11136
- C:\Windows\System\xBOznhS.exe
  C:\Windows\System\xBOznhS.exe
  2⤵
  PID:9280
- C:\Windows\System\hkDnWWH.exe
  C:\Windows\System\hkDnWWH.exe
  2⤵
  PID:11404
- C:\Windows\System\NPjiDeA.exe
  C:\Windows\System\NPjiDeA.exe
  2⤵
  PID:12704
- C:\Windows\System\yxrpPHj.exe
  C:\Windows\System\yxrpPHj.exe
  2⤵
  PID:12492
- C:\Windows\System\sZpUhuB.exe
  C:\Windows\System\sZpUhuB.exe
  2⤵
  PID:13324
- C:\Windows\System\iFnPzLP.exe
  C:\Windows\System\iFnPzLP.exe
  2⤵
  PID:13348
- C:\Windows\System\uDVAvbJ.exe
  C:\Windows\System\uDVAvbJ.exe
  2⤵
  PID:13364
- C:\Windows\System\mTHYUov.exe
  C:\Windows\System\mTHYUov.exe
  2⤵
  PID:13388
- C:\Windows\System\DllHwhK.exe
  C:\Windows\System\DllHwhK.exe
  2⤵
  PID:13436
- C:\Windows\System\rsQhVmW.exe
  C:\Windows\System\rsQhVmW.exe
  2⤵
  PID:13464
- C:\Windows\System\KngIZNd.exe
  C:\Windows\System\KngIZNd.exe
  2⤵
  PID:13492
- C:\Windows\System\GPSujKl.exe
  C:\Windows\System\GPSujKl.exe
  2⤵
  PID:13520
- C:\Windows\System\ctIdkiK.exe
  C:\Windows\System\ctIdkiK.exe
  2⤵
  PID:13536
- C:\Windows\System\Zxbwpln.exe
  C:\Windows\System\Zxbwpln.exe
  2⤵
  PID:13560
- C:\Windows\System\QPkrAQQ.exe
  C:\Windows\System\QPkrAQQ.exe
  2⤵
  PID:13580
- C:\Windows\System\TjSDQsX.exe
  C:\Windows\System\TjSDQsX.exe
  2⤵
  PID:13596
- C:\Windows\System\iCcnrER.exe
  C:\Windows\System\iCcnrER.exe
  2⤵
  PID:13692
- C:\Windows\System\WOCNxQM.exe
  C:\Windows\System\WOCNxQM.exe
  2⤵
  PID:13708
- C:\Windows\System\COccKvT.exe
  C:\Windows\System\COccKvT.exe
  2⤵
  PID:10252
- C:\Windows\System\RAEJiLT.exe
  C:\Windows\System\RAEJiLT.exe
  2⤵
  PID:10200
- C:\Windows\System\AVpfVMq.exe
  C:\Windows\System\AVpfVMq.exe
  2⤵
  PID:12580
- C:\Windows\System\TogJlVr.exe
  C:\Windows\System\TogJlVr.exe
  2⤵
  PID:12868
- C:\Windows\System\oDlnNOi.exe
  C:\Windows\System\oDlnNOi.exe
  2⤵
  PID:10976
- C:\Windows\System\mWYneSQ.exe
  C:\Windows\System\mWYneSQ.exe
  2⤵
  PID:10516
- C:\Windows\System\loXIyej.exe
  C:\Windows\System\loXIyej.exe
  2⤵
  PID:9640
- C:\Windows\System\biwPDyG.exe
  C:\Windows\System\biwPDyG.exe
  2⤵
  PID:13632
- C:\Windows\System\aPIHQzw.exe
  C:\Windows\System\aPIHQzw.exe
  2⤵
  PID:13528
- C:\Windows\System\XKQtwrf.exe
  C:\Windows\System\XKQtwrf.exe
  2⤵
  PID:13872
- C:\Windows\System\gpchJgQ.exe
  C:\Windows\System\gpchJgQ.exe
  2⤵
  PID:14036
- C:\Windows\System\TmrKjsf.exe
  C:\Windows\System\TmrKjsf.exe
  2⤵
  PID:14108
- C:\Windows\System\JTzRaUX.exe
  C:\Windows\System\JTzRaUX.exe
  2⤵
  PID:12720
- C:\Windows\System\PQXipxS.exe
  C:\Windows\System\PQXipxS.exe
  2⤵
  PID:12132
- C:\Windows\System\hbqPuCH.exe
  C:\Windows\System\hbqPuCH.exe
  2⤵
  PID:9800
- C:\Windows\System\zLJJeWP.exe
  C:\Windows\System\zLJJeWP.exe
  2⤵
  PID:13820
- C:\Windows\System\wullheL.exe
  C:\Windows\System\wullheL.exe
  2⤵
  PID:4332
- C:\Windows\System\fLpKZFD.exe
  C:\Windows\System\fLpKZFD.exe
  2⤵
  PID:14236
- C:\Windows\System\HRTwOzL.exe
  C:\Windows\System\HRTwOzL.exe
  2⤵
  PID:12100
- C:\Windows\System\LrgJDEu.exe
  C:\Windows\System\LrgJDEu.exe
  2⤵
  PID:12572
- C:\Windows\System\aCdvMFi.exe
  C:\Windows\System\aCdvMFi.exe
  2⤵
  PID:13720
- C:\Windows\System\gdvmNRW.exe
  C:\Windows\System\gdvmNRW.exe
  2⤵
  PID:13832
- C:\Windows\System\axCNxtO.exe
  C:\Windows\System\axCNxtO.exe
  2⤵
  PID:13612
- C:\Windows\System\foNRviM.exe
  C:\Windows\System\foNRviM.exe
  2⤵
  PID:14144
- C:\Windows\System\rWhfkUf.exe
  C:\Windows\System\rWhfkUf.exe
  2⤵
  PID:14128
- C:\Windows\System\fYkzVgp.exe
  C:\Windows\System\fYkzVgp.exe
  2⤵
  PID:13248
- C:\Windows\System\iLRomJk.exe
  C:\Windows\System\iLRomJk.exe
  2⤵
  PID:14252
- C:\Windows\System\HjKwFgH.exe
  C:\Windows\System\HjKwFgH.exe
  2⤵
  PID:3432
- C:\Windows\System\wAdxakH.exe
  C:\Windows\System\wAdxakH.exe
  2⤵
  PID:12836
- C:\Windows\System\OjDnOBR.exe
  C:\Windows\System\OjDnOBR.exe
  2⤵
  PID:14212
- C:\Windows\System\OVLBpux.exe
  C:\Windows\System\OVLBpux.exe
  2⤵
  PID:9656
- C:\Windows\System\geoHAUm.exe
  C:\Windows\System\geoHAUm.exe
  2⤵
  PID:13648
- C:\Windows\System\TlFUAxL.exe
  C:\Windows\System\TlFUAxL.exe
  2⤵
  PID:14328
- C:\Windows\System\hASfUuL.exe
  C:\Windows\System\hASfUuL.exe
  2⤵
  PID:13340
- C:\Windows\System\xqJaqPK.exe
  C:\Windows\System\xqJaqPK.exe
  2⤵
  PID:10824
- C:\Windows\System\CSUCUbg.exe
  C:\Windows\System\CSUCUbg.exe
  2⤵
  PID:10632
- C:\Windows\System\EvbfWXa.exe
  C:\Windows\System\EvbfWXa.exe
  2⤵
  PID:13916
- C:\Windows\System\BIwwJpA.exe
  C:\Windows\System\BIwwJpA.exe
  2⤵
  PID:2360
- C:\Windows\System\mGzVCbp.exe
  C:\Windows\System\mGzVCbp.exe
  2⤵
  PID:11460
- C:\Windows\System\TqrrWkm.exe
  C:\Windows\System\TqrrWkm.exe
  2⤵
  PID:13628
- C:\Windows\System\eZybCSR.exe
  C:\Windows\System\eZybCSR.exe
  2⤵
  PID:13484
- C:\Windows\System\WhRtalt.exe
  C:\Windows\System\WhRtalt.exe
  2⤵
  PID:10968
- C:\Windows\System\hrHOMkM.exe
  C:\Windows\System\hrHOMkM.exe
  2⤵
  PID:13684
- C:\Windows\System\cwJTbjt.exe
  C:\Windows\System\cwJTbjt.exe
  2⤵
  PID:13940
- C:\Windows\System\aapGfId.exe
  C:\Windows\System\aapGfId.exe
  2⤵
  PID:14268
- C:\Windows\System\leQdkxH.exe
  C:\Windows\System\leQdkxH.exe
  2⤵
  PID:13568
- C:\Windows\System\YzFAFgC.exe
  C:\Windows\System\YzFAFgC.exe
  2⤵
  PID:14088
- C:\Windows\System\iUwifqD.exe
  C:\Windows\System\iUwifqD.exe
  2⤵
  PID:11092
- C:\Windows\System\wuinJCH.exe
  C:\Windows\System\wuinJCH.exe
  2⤵
  PID:13984
- C:\Windows\System\vqbyUDU.exe
  C:\Windows\System\vqbyUDU.exe
  2⤵
  PID:13032
- C:\Windows\System\FGmiTHc.exe
  C:\Windows\System\FGmiTHc.exe
  2⤵
  PID:14204
- C:\Windows\System\DlmAipa.exe
  C:\Windows\System\DlmAipa.exe
  2⤵
  PID:3768
- C:\Windows\System\gfBTtcu.exe
  C:\Windows\System\gfBTtcu.exe
  2⤵
  PID:13048
- C:\Windows\System\HygWROJ.exe
  C:\Windows\System\HygWROJ.exe
  2⤵
  PID:4908
- C:\Windows\System\QEBBacP.exe
  C:\Windows\System\QEBBacP.exe
  2⤵
  PID:7676
- C:\Windows\System\XXYpKpY.exe
  C:\Windows\System\XXYpKpY.exe
  2⤵
  PID:3392
- C:\Windows\System\DFIqAPM.exe
  C:\Windows\System\DFIqAPM.exe
  2⤵
  PID:2784
- C:\Windows\System\CPJntJm.exe
  C:\Windows\System\CPJntJm.exe
  2⤵
  PID:14116
- C:\Windows\System\pLkHiOt.exe
  C:\Windows\System\pLkHiOt.exe
  2⤵
  PID:2196
- C:\Windows\System\DPMQhpr.exe
  C:\Windows\System\DPMQhpr.exe
  2⤵
  PID:14248
- C:\Windows\System\bfVdFSH.exe
  C:\Windows\System\bfVdFSH.exe
  2⤵
  PID:14228
- C:\Windows\System\YRjljlF.exe
  C:\Windows\System\YRjljlF.exe
  2⤵
  PID:3796
- C:\Windows\System\XNTYrbZ.exe
  C:\Windows\System\XNTYrbZ.exe
  2⤵
  PID:12560
- C:\Windows\System\ooKFpAh.exe
  C:\Windows\System\ooKFpAh.exe
  2⤵
  PID:3340
- C:\Windows\System\mVJSLrw.exe
  C:\Windows\System\mVJSLrw.exe
  2⤵
  PID:2868
- C:\Windows\System\FmGfuDD.exe
  C:\Windows\System\FmGfuDD.exe
  2⤵
  PID:4760
- C:\Windows\System\prNMXwv.exe
  C:\Windows\System\prNMXwv.exe
  2⤵
  PID:4976
- C:\Windows\System\hAxbWCs.exe
  C:\Windows\System\hAxbWCs.exe
  2⤵
  PID:2984
- C:\Windows\System\TkMLABF.exe
  C:\Windows\System\TkMLABF.exe
  2⤵
  PID:13416
- C:\Windows\System\fpKTvnn.exe
  C:\Windows\System\fpKTvnn.exe
  2⤵
  PID:9028
- C:\Windows\System\MrINssU.exe
  C:\Windows\System\MrINssU.exe
  2⤵
  PID:4260
- C:\Windows\System\ipSjwku.exe
  C:\Windows\System\ipSjwku.exe
  2⤵
  PID:13728
- C:\Windows\System\kXULfsA.exe
  C:\Windows\System\kXULfsA.exe
  2⤵
  PID:8480
- C:\Windows\System\vPZGCxl.exe
  C:\Windows\System\vPZGCxl.exe
  2⤵
  PID:11188
- C:\Windows\System\kcFqmYK.exe
  C:\Windows\System\kcFqmYK.exe
  2⤵
  PID:4624
- C:\Windows\System\gJhkfIn.exe
  C:\Windows\System\gJhkfIn.exe
  2⤵
  PID:13668
- C:\Windows\System\YdmyZSz.exe
  C:\Windows\System\YdmyZSz.exe
  2⤵
  PID:12356
- C:\Windows\System\dtfkRMK.exe
  C:\Windows\System\dtfkRMK.exe
  2⤵
  PID:11692
- C:\Windows\System\UDDBbvs.exe
  C:\Windows\System\UDDBbvs.exe
  2⤵
  PID:7644
- C:\Windows\System\ZaIoZRR.exe
  C:\Windows\System\ZaIoZRR.exe
  2⤵
  PID:2832
- C:\Windows\System\IJXdbAG.exe
  C:\Windows\System\IJXdbAG.exe
  2⤵
  PID:7996
- C:\Windows\System\lGNxiOK.exe
  C:\Windows\System\lGNxiOK.exe
  2⤵
  PID:2408
- C:\Windows\System\tgqQGZm.exe
  C:\Windows\System\tgqQGZm.exe
  2⤵
  PID:13988
- C:\Windows\System\SGjrZuu.exe
  C:\Windows\System\SGjrZuu.exe
  2⤵
  PID:14240
- C:\Windows\System\uHlfkBE.exe
  C:\Windows\System\uHlfkBE.exe
  2⤵
  PID:13840
- C:\Windows\System\TVekZbK.exe
  C:\Windows\System\TVekZbK.exe
  2⤵
  PID:3528
- C:\Windows\System\OiNxtzd.exe
  C:\Windows\System\OiNxtzd.exe
  2⤵
  PID:4288
- C:\Windows\System\aIjdfkr.exe
  C:\Windows\System\aIjdfkr.exe
  2⤵
  PID:4048
- C:\Windows\System\qiMnRFm.exe
  C:\Windows\System\qiMnRFm.exe
  2⤵
  PID:832
- C:\Windows\System\LdQhCJH.exe
  C:\Windows\System\LdQhCJH.exe
  2⤵
  PID:924
- C:\Windows\System\UJbFeWx.exe
  C:\Windows\System\UJbFeWx.exe
  2⤵
  PID:2744
- C:\Windows\System\GYDdput.exe
  C:\Windows\System\GYDdput.exe
  2⤵
  PID:11360
- C:\Windows\System\CenHsAw.exe
  C:\Windows\System\CenHsAw.exe
  2⤵
  PID:13396
- C:\Windows\System\gaWlZBr.exe
  C:\Windows\System\gaWlZBr.exe
  2⤵
  PID:14076
- C:\Windows\System\iOLCQLq.exe
  C:\Windows\System\iOLCQLq.exe
  2⤵
  PID:12264
- C:\Windows\System\OxREyeg.exe
  C:\Windows\System\OxREyeg.exe
  2⤵
  PID:1676
- C:\Windows\System\FDHkDSK.exe
  C:\Windows\System\FDHkDSK.exe
  2⤵
  PID:1704
- C:\Windows\System\ijcKyim.exe
  C:\Windows\System\ijcKyim.exe
  2⤵
  PID:4500
- C:\Windows\System\pRCGfDI.exe
  C:\Windows\System\pRCGfDI.exe
  2⤵
  PID:1248
- C:\Windows\System\PzbyrDx.exe
  C:\Windows\System\PzbyrDx.exe
  2⤵
  PID:5192
- C:\Windows\System\ZuJZCBc.exe
  C:\Windows\System\ZuJZCBc.exe
  2⤵
  PID:5388
- C:\Windows\System\QQcjmfs.exe
  C:\Windows\System\QQcjmfs.exe
  2⤵
  PID:14040
- C:\Windows\System\McOchXC.exe
  C:\Windows\System\McOchXC.exe
  2⤵
  PID:5144
- C:\Windows\System\CIvxBqB.exe
  C:\Windows\System\CIvxBqB.exe
  2⤵
  PID:4112
- C:\Windows\System\erTPHnT.exe
  C:\Windows\System\erTPHnT.exe
  2⤵
  PID:13272
- C:\Windows\System\BQuVHha.exe
  C:\Windows\System\BQuVHha.exe
  2⤵
  PID:13752
- C:\Windows\System\dpfIlrI.exe
  C:\Windows\System\dpfIlrI.exe
  2⤵
  PID:920
- C:\Windows\System\HZnHuCs.exe
  C:\Windows\System\HZnHuCs.exe
  2⤵
  PID:4228
- C:\Windows\System\LYLWpUc.exe
  C:\Windows\System\LYLWpUc.exe
  2⤵
  PID:3780
- C:\Windows\System\UKiwKoQ.exe
  C:\Windows\System\UKiwKoQ.exe
  2⤵
  PID:5256
- C:\Windows\System\WWTUEdH.exe
  C:\Windows\System\WWTUEdH.exe
  2⤵
  PID:2852
- C:\Windows\System\laIyeYs.exe
  C:\Windows\System\laIyeYs.exe
  2⤵
  PID:2192
- C:\Windows\System\iUkKMLW.exe
  C:\Windows\System\iUkKMLW.exe
  2⤵
  PID:4644
- C:\Windows\System\lbIQWOm.exe
  C:\Windows\System\lbIQWOm.exe
  2⤵
  PID:1084
- C:\Windows\System\GzuQmiR.exe
  C:\Windows\System\GzuQmiR.exe
  2⤵
  PID:3836
- C:\Windows\System\mKsGRPz.exe
  C:\Windows\System\mKsGRPz.exe
  2⤵
  PID:11212
- C:\Windows\System\zqDsfJm.exe
  C:\Windows\System\zqDsfJm.exe
  2⤵
  PID:5836
- C:\Windows\System\udXwkKJ.exe
  C:\Windows\System\udXwkKJ.exe
  2⤵
  PID:14304
- C:\Windows\System\chkPYYY.exe
  C:\Windows\System\chkPYYY.exe
  2⤵
  PID:3632
- C:\Windows\System\MsKIfQo.exe
  C:\Windows\System\MsKIfQo.exe
  2⤵
  PID:6216
- C:\Windows\System\IwzFnNM.exe
  C:\Windows\System\IwzFnNM.exe
  2⤵
  PID:4116
- C:\Windows\System\JdIvglM.exe
  C:\Windows\System\JdIvglM.exe
  2⤵
  PID:4076
- C:\Windows\System\ANhTKfO.exe
  C:\Windows\System\ANhTKfO.exe
  2⤵
  PID:6008
- C:\Windows\System\KCWpYdJ.exe
  C:\Windows\System\KCWpYdJ.exe
  2⤵
  PID:6108
- C:\Windows\System\yZgxYDw.exe
  C:\Windows\System\yZgxYDw.exe
  2⤵
  PID:3536
- C:\Windows\System\tKhpgOK.exe
  C:\Windows\System\tKhpgOK.exe
  2⤵
  PID:12828
- C:\Windows\System\njytCdv.exe
  C:\Windows\System\njytCdv.exe
  2⤵
  PID:5224
- C:\Windows\System\WRMOtFf.exe
  C:\Windows\System\WRMOtFf.exe
  2⤵
  PID:6588
- C:\Windows\System\SMIQZcP.exe
  C:\Windows\System\SMIQZcP.exe
  2⤵
  PID:11944
- C:\Windows\System\nxHQHAM.exe
  C:\Windows\System\nxHQHAM.exe
  2⤵
  PID:14148
- C:\Windows\System\uWZyFbB.exe
  C:\Windows\System\uWZyFbB.exe
  2⤵
  PID:14156
- C:\Windows\System\KNKKKKK.exe
  C:\Windows\System\KNKKKKK.exe
  2⤵
  PID:2892
- C:\Windows\System\bVqdfUL.exe
  C:\Windows\System\bVqdfUL.exe
  2⤵
  PID:6168
- C:\Windows\System\IGgPboH.exe
  C:\Windows\System\IGgPboH.exe
  2⤵
  PID:6312
- C:\Windows\System\pwrsDMt.exe
  C:\Windows\System\pwrsDMt.exe
  2⤵
  PID:404
- C:\Windows\System\IIQdFHC.exe
  C:\Windows\System\IIQdFHC.exe
  2⤵
  PID:5680
- C:\Windows\System\jWGKtmv.exe
  C:\Windows\System\jWGKtmv.exe
  2⤵
  PID:5788
- C:\Windows\System\Uoyxmlu.exe
  C:\Windows\System\Uoyxmlu.exe
  2⤵
  PID:5744
- C:\Windows\System\irTDeVO.exe
  C:\Windows\System\irTDeVO.exe
  2⤵
  PID:6460
- C:\Windows\System\IaskPos.exe
  C:\Windows\System\IaskPos.exe
  2⤵
  PID:13532
- C:\Windows\System\LsFbhnM.exe
  C:\Windows\System\LsFbhnM.exe
  2⤵
  PID:6044
- C:\Windows\System\zboQoZt.exe
  C:\Windows\System\zboQoZt.exe
  2⤵
  PID:6480
- C:\Windows\System\nWWszmV.exe
  C:\Windows\System\nWWszmV.exe
  2⤵
  PID:4052
- C:\Windows\System\BpZeypM.exe
  C:\Windows\System\BpZeypM.exe
  2⤵
  PID:6344
- C:\Windows\System\XTFaqPt.exe
  C:\Windows\System\XTFaqPt.exe
  2⤵
  PID:7912
- C:\Windows\System\fgTOMmG.exe
  C:\Windows\System\fgTOMmG.exe
  2⤵
  PID:6208
- C:\Windows\System\DSzCJsm.exe
  C:\Windows\System\DSzCJsm.exe
  2⤵
  PID:5480
- C:\Windows\System\usnLkiv.exe
  C:\Windows\System\usnLkiv.exe
  2⤵
  PID:5220
- C:\Windows\System\vCYIqdQ.exe
  C:\Windows\System\vCYIqdQ.exe
  2⤵
  PID:6336
- C:\Windows\System\ukgJdrs.exe
  C:\Windows\System\ukgJdrs.exe
  2⤵
  PID:5332
- C:\Windows\System\DJmUUwF.exe
  C:\Windows\System\DJmUUwF.exe
  2⤵
  PID:6260
- C:\Windows\System\YiSsgGO.exe
  C:\Windows\System\YiSsgGO.exe
  2⤵
  PID:6520
- C:\Windows\System\qwajydr.exe
  C:\Windows\System\qwajydr.exe
  2⤵
  PID:6600
- C:\Windows\System\MVvoAFC.exe
  C:\Windows\System\MVvoAFC.exe
  2⤵
  PID:5592
- C:\Windows\System\wPfjaZM.exe
  C:\Windows\System\wPfjaZM.exe
  2⤵
  PID:6764
- C:\Windows\System\pTkdIOl.exe
  C:\Windows\System\pTkdIOl.exe
  2⤵
  PID:13876
- C:\Windows\System\iPVIpec.exe
  C:\Windows\System\iPVIpec.exe
  2⤵
  PID:6568
- C:\Windows\System\CnLhPDt.exe
  C:\Windows\System\CnLhPDt.exe
  2⤵
  PID:6420
- C:\Windows\System\vCcSLEq.exe
  C:\Windows\System\vCcSLEq.exe
  2⤵
  PID:3256
- C:\Windows\System\ENAKjdk.exe
  C:\Windows\System\ENAKjdk.exe
  2⤵
  PID:7936
- C:\Windows\System\wXGwAjO.exe
  C:\Windows\System\wXGwAjO.exe
  2⤵
  PID:6364
- C:\Windows\System\xRawzoR.exe
  C:\Windows\System\xRawzoR.exe
  2⤵
  PID:14384
- C:\Windows\System\nHSebrH.exe
  C:\Windows\System\nHSebrH.exe
  2⤵
  PID:14408
- C:\Windows\System\gZdvxbA.exe
  C:\Windows\System\gZdvxbA.exe
  2⤵
  PID:14428
- C:\Windows\System\YKsFQGA.exe
  C:\Windows\System\YKsFQGA.exe
  2⤵
  PID:14464
- C:\Windows\System\Wzvlidt.exe
  C:\Windows\System\Wzvlidt.exe
  2⤵
  PID:14716
- C:\Windows\System\benWChH.exe
  C:\Windows\System\benWChH.exe
  2⤵
  PID:14784
- C:\Windows\System\SGNGbZC.exe
  C:\Windows\System\SGNGbZC.exe
  2⤵
  PID:14804
- C:\Windows\System\aQfGqPl.exe
  C:\Windows\System\aQfGqPl.exe
  2⤵
  PID:14820
- C:\Windows\System\BrWEjFR.exe
  C:\Windows\System\BrWEjFR.exe
  2⤵
  PID:14888
- C:\Windows\System\YXGHvkY.exe
  C:\Windows\System\YXGHvkY.exe
  2⤵
  PID:14916
- C:\Windows\System\woGvgJU.exe
  C:\Windows\System\woGvgJU.exe
  2⤵
  PID:14932
- C:\Windows\System\ynxLkwR.exe
  C:\Windows\System\ynxLkwR.exe
  2⤵
  PID:14964
- C:\Windows\System\wKzmCvh.exe
  C:\Windows\System\wKzmCvh.exe
  2⤵
  PID:15180
- C:\Windows\System\eYMzaqa.exe
  C:\Windows\System\eYMzaqa.exe
  2⤵
  PID:15196
- C:\Windows\System\ILPkKfq.exe
  C:\Windows\System\ILPkKfq.exe
  2⤵
  PID:15216
- C:\Windows\System\HPXTGmR.exe
  C:\Windows\System\HPXTGmR.exe
  2⤵
  PID:15232
- C:\Windows\System\ZalHngH.exe
  C:\Windows\System\ZalHngH.exe
  2⤵
  PID:15248
- C:\Windows\System\HhimFNI.exe
  C:\Windows\System\HhimFNI.exe
  2⤵
  PID:15264
- C:\Windows\System\kXLgqgW.exe
  C:\Windows\System\kXLgqgW.exe
  2⤵
  PID:15280
- C:\Windows\System\fgxsgYG.exe
  C:\Windows\System\fgxsgYG.exe
  2⤵
  PID:15296
- C:\Windows\System\ryfYWkC.exe
  C:\Windows\System\ryfYWkC.exe
  2⤵
  PID:15312
- C:\Windows\System\Bttxvwh.exe
  C:\Windows\System\Bttxvwh.exe
  2⤵
  PID:15328
- C:\Windows\System\VQJrFpe.exe
  C:\Windows\System\VQJrFpe.exe
  2⤵
  PID:15344
- C:\Windows\System\fLuMnTd.exe
  C:\Windows\System\fLuMnTd.exe
  2⤵
  PID:4480
- C:\Windows\System\abcajQS.exe
  C:\Windows\System\abcajQS.exe
  2⤵
  PID:5324
- C:\Windows\System\RReQkCe.exe
  C:\Windows\System\RReQkCe.exe
  2⤵
  PID:3044
- C:\Windows\System\HdXfQsf.exe
  C:\Windows\System\HdXfQsf.exe
  2⤵
  PID:5372
- C:\Windows\System\DxonHnc.exe
  C:\Windows\System\DxonHnc.exe
  2⤵
  PID:5928
- C:\Windows\System\KSOYzBt.exe
  C:\Windows\System\KSOYzBt.exe
  2⤵
  PID:6128
- C:\Windows\System\VTfaBmq.exe
  C:\Windows\System\VTfaBmq.exe
  2⤵
  PID:14344
- C:\Windows\System\QuFcLFU.exe
  C:\Windows\System\QuFcLFU.exe
  2⤵
  PID:14380
- C:\Windows\System\YEBxDmr.exe
  C:\Windows\System\YEBxDmr.exe
  2⤵
  PID:7096
- C:\Windows\System\DGBpLRG.exe
  C:\Windows\System\DGBpLRG.exe
  2⤵
  PID:6936
- C:\Windows\System\GWHEaoJ.exe
  C:\Windows\System\GWHEaoJ.exe
  2⤵
  PID:14416
- C:\Windows\System\oXtkACt.exe
  C:\Windows\System\oXtkACt.exe
  2⤵
  PID:6280
- C:\Windows\System\fqMjstU.exe
  C:\Windows\System\fqMjstU.exe
  2⤵
  PID:6000
- C:\Windows\System\PweVkAP.exe
  C:\Windows\System\PweVkAP.exe
  2⤵
  PID:5860
- C:\Windows\System\yAQugqO.exe
  C:\Windows\System\yAQugqO.exe
  2⤵
  PID:14628
- C:\Windows\System\pOOfuWz.exe
  C:\Windows\System\pOOfuWz.exe
  2⤵
  PID:14472
- C:\Windows\System\gZqKlBT.exe
  C:\Windows\System\gZqKlBT.exe
  2⤵
  PID:14584
- C:\Windows\System\aKcetRT.exe
  C:\Windows\System\aKcetRT.exe
  2⤵
  PID:6192
- C:\Windows\System\aknxKPQ.exe
  C:\Windows\System\aknxKPQ.exe
  2⤵
  PID:14648
- C:\Windows\System\mgPBpbF.exe
  C:\Windows\System\mgPBpbF.exe
  2⤵
  PID:6952
- C:\Windows\System\lBAVaxj.exe
  C:\Windows\System\lBAVaxj.exe
  2⤵
  PID:14576
- C:\Windows\System\QRBeFJc.exe
  C:\Windows\System\QRBeFJc.exe
  2⤵
  PID:14696
- C:\Windows\System\gXAEdRe.exe
  C:\Windows\System\gXAEdRe.exe
  2⤵
  PID:5264
- C:\Windows\System\VulhaCT.exe
  C:\Windows\System\VulhaCT.exe
  2⤵
  PID:5512
- C:\Windows\System\NCdgUHw.exe
  C:\Windows\System\NCdgUHw.exe
  2⤵
  PID:5124
- C:\Windows\System\eTBVLyq.exe
  C:\Windows\System\eTBVLyq.exe
  2⤵
  PID:6088
- C:\Windows\System\GZxxdme.exe
  C:\Windows\System\GZxxdme.exe
  2⤵
  PID:6532
- C:\Windows\System\xAuPgRW.exe
  C:\Windows\System\xAuPgRW.exe
  2⤵
  PID:14672
- C:\Windows\System\Idfpzkk.exe
  C:\Windows\System\Idfpzkk.exe
  2⤵
  PID:14308
- C:\Windows\System\otlwixT.exe
  C:\Windows\System\otlwixT.exe
  2⤵
  PID:14848
- C:\Windows\System\DNcyGhW.exe
  C:\Windows\System\DNcyGhW.exe
  2⤵
  PID:14924
- C:\Windows\System\oOWKdHJ.exe
  C:\Windows\System\oOWKdHJ.exe
  2⤵
  PID:14952
- C:\Windows\System\VpsqYDg.exe
  C:\Windows\System\VpsqYDg.exe
  2⤵
  PID:15048
- C:\Windows\System\SnOHnBc.exe
  C:\Windows\System\SnOHnBc.exe
  2⤵
  PID:6388
- C:\Windows\System\OWXZvXP.exe
  C:\Windows\System\OWXZvXP.exe
  2⤵
  PID:7360
- C:\Windows\System\gboGSOG.exe
  C:\Windows\System\gboGSOG.exe
  2⤵
  PID:15084
- C:\Windows\System\kQaLzpm.exe
  C:\Windows\System\kQaLzpm.exe
  2⤵
  PID:7108
- C:\Windows\System\PEJtUht.exe
  C:\Windows\System\PEJtUht.exe
  2⤵
  PID:15108
- C:\Windows\System\NqwGsJX.exe
  C:\Windows\System\NqwGsJX.exe
  2⤵
  PID:5284
- C:\Windows\System\TQFaJMQ.exe
  C:\Windows\System\TQFaJMQ.exe
  2⤵
  PID:15148
- C:\Windows\System\jkhiaPl.exe
  C:\Windows\System\jkhiaPl.exe
  2⤵
  PID:7208
- C:\Windows\System\MAjINNd.exe
  C:\Windows\System\MAjINNd.exe
  2⤵
  PID:15060
- C:\Windows\System\gQGUgLT.exe
  C:\Windows\System\gQGUgLT.exe
  2⤵
  PID:15244
- C:\Windows\System\SQOchaG.exe
  C:\Windows\System\SQOchaG.exe
  2⤵
  PID:15320
- C:\Windows\System\nOWpptK.exe
  C:\Windows\System\nOWpptK.exe
  2⤵
  PID:15352
- C:\Windows\System\dLOaKrM.exe
  C:\Windows\System\dLOaKrM.exe
  2⤵
  PID:7460
- C:\Windows\System\ufXMdkb.exe
  C:\Windows\System\ufXMdkb.exe
  2⤵
  PID:15340
- C:\Windows\System\Gwypmtz.exe
  C:\Windows\System\Gwypmtz.exe
  2⤵
  PID:6564
- C:\Windows\System\JGaVCJH.exe
  C:\Windows\System\JGaVCJH.exe
  2⤵
  PID:7204
- C:\Windows\System\IlhZWVc.exe
  C:\Windows\System\IlhZWVc.exe
  2⤵
  PID:5408
- C:\Windows\System\dzEVuir.exe
  C:\Windows\System\dzEVuir.exe
  2⤵
  PID:14492
- C:\Windows\System\FTKgKKz.exe
  C:\Windows\System\FTKgKKz.exe
  2⤵
  PID:6456
- C:\Windows\System\wfuUsSd.exe
  C:\Windows\System\wfuUsSd.exe
  2⤵
  PID:14592
- C:\Windows\System\KTUkgAh.exe
  C:\Windows\System\KTUkgAh.exe
  2⤵
  PID:14828
- C:\Windows\System\UIKlxwo.exe
  C:\Windows\System\UIKlxwo.exe
  2⤵
  PID:7604
- C:\Windows\System\RJKvBMP.exe
  C:\Windows\System\RJKvBMP.exe
  2⤵
  PID:14856
- C:\Windows\System\DxGTgrn.exe
  C:\Windows\System\DxGTgrn.exe
  2⤵
  PID:5016
- C:\Windows\System\MozuZSB.exe
  C:\Windows\System\MozuZSB.exe
  2⤵
  PID:7548
- C:\Windows\System\JunyKxD.exe
  C:\Windows\System\JunyKxD.exe
  2⤵
  PID:14364
- C:\Windows\System\hQMYUuX.exe
  C:\Windows\System\hQMYUuX.exe
  2⤵
  PID:5988
- C:\Windows\System\JtykwRL.exe
  C:\Windows\System\JtykwRL.exe
  2⤵
  PID:14836
- C:\Windows\System\ZwNJBON.exe
  C:\Windows\System\ZwNJBON.exe
  2⤵
  PID:7008
- C:\Windows\System\DeQOhXB.exe
  C:\Windows\System\DeQOhXB.exe
  2⤵
  PID:6360
- C:\Windows\System\rFjuAIO.exe
  C:\Windows\System\rFjuAIO.exe
  2⤵
  PID:7496
- C:\Windows\System\HojZfyd.exe
  C:\Windows\System\HojZfyd.exe
  2⤵
  PID:6372
- C:\Windows\System\rvoMWcl.exe
  C:\Windows\System\rvoMWcl.exe
  2⤵
  PID:14488
- C:\Windows\System\polZdKM.exe
  C:\Windows\System\polZdKM.exe
  2⤵
  PID:14636
- C:\Windows\System\nLogafg.exe
  C:\Windows\System\nLogafg.exe
  2⤵
  PID:14980
- C:\Windows\System\HLAoVZJ.exe
  C:\Windows\System\HLAoVZJ.exe
  2⤵
  PID:5404
- C:\Windows\System\zEryWjF.exe
  C:\Windows\System\zEryWjF.exe
  2⤵
  PID:14564
- C:\Windows\System\DuSuXxv.exe
  C:\Windows\System\DuSuXxv.exe
  2⤵
  PID:15228
- C:\Windows\System\shucvCQ.exe
  C:\Windows\System\shucvCQ.exe
  2⤵
  PID:5000
- C:\Windows\System\wgSmTNd.exe
  C:\Windows\System\wgSmTNd.exe
  2⤵
  PID:6580
- C:\Windows\System\fZHWVnN.exe
  C:\Windows\System\fZHWVnN.exe
  2⤵
  PID:15212
- C:\Windows\System\DspEYyy.exe
  C:\Windows\System\DspEYyy.exe
  2⤵
  PID:12256
- C:\Windows\System\oZkKHFh.exe
  C:\Windows\System\oZkKHFh.exe
  2⤵
  PID:5708
- C:\Windows\System\NssIKhS.exe
  C:\Windows\System\NssIKhS.exe
  2⤵
  PID:6064
- C:\Windows\System\fuvEqtB.exe
  C:\Windows\System\fuvEqtB.exe
  2⤵
  PID:14568
- C:\Windows\System\qCTZDFx.exe
  C:\Windows\System\qCTZDFx.exe
  2⤵
  PID:3560
- C:\Windows\System\jGqFbKN.exe
  C:\Windows\System\jGqFbKN.exe
  2⤵
  PID:1228
- C:\Windows\System\JVAuHbh.exe
  C:\Windows\System\JVAuHbh.exe
  2⤵
  PID:14764
- C:\Windows\System\SKyyqid.exe
  C:\Windows\System\SKyyqid.exe
  2⤵
  PID:2340
- C:\Windows\System\hnLZJYh.exe
  C:\Windows\System\hnLZJYh.exe
  2⤵
  PID:7356
- C:\Windows\System\UsGIogS.exe
  C:\Windows\System\UsGIogS.exe
  2⤵
  PID:15356
- C:\Windows\System\eYSWPIr.exe
  C:\Windows\System\eYSWPIr.exe
  2⤵
  PID:15176
- C:\Windows\System\sktmdXk.exe
  C:\Windows\System\sktmdXk.exe
  2⤵
  PID:7476
- C:\Windows\System\LrGhibL.exe
  C:\Windows\System\LrGhibL.exe
  2⤵
  PID:4852
- C:\Windows\System\SNUgPuF.exe
  C:\Windows\System\SNUgPuF.exe
  2⤵
  PID:13732
- C:\Windows\System\tmJfMfL.exe
  C:\Windows\System\tmJfMfL.exe
  2⤵
  PID:2728
- C:\Windows\System\zZYjwyW.exe
  C:\Windows\System\zZYjwyW.exe
  2⤵
  PID:5916
- C:\Windows\System\TypFPuT.exe
  C:\Windows\System\TypFPuT.exe
  2⤵
  PID:7532
- C:\Windows\System\pJicZpQ.exe
  C:\Windows\System\pJicZpQ.exe
  2⤵
  PID:2000
- C:\Windows\System\ZIthyrE.exe
  C:\Windows\System\ZIthyrE.exe
  2⤵
  PID:14392
- C:\Windows\System\eUSiTOs.exe
  C:\Windows\System\eUSiTOs.exe
  2⤵
  PID:7564
- C:\Windows\System\sifEVzt.exe
  C:\Windows\System\sifEVzt.exe
  2⤵
  PID:5128
- C:\Windows\System\VVLlkok.exe
  C:\Windows\System\VVLlkok.exe
  2⤵
  PID:14736
- C:\Windows\System\NXAneSg.exe
  C:\Windows\System\NXAneSg.exe
  2⤵
  PID:6256
- C:\Windows\System\tudydtH.exe
  C:\Windows\System\tudydtH.exe
  2⤵
  PID:2056
- C:\Windows\System\lUPLhJS.exe
  C:\Windows\System\lUPLhJS.exe
  2⤵
  PID:7836
- C:\Windows\System\NNgsHQF.exe
  C:\Windows\System\NNgsHQF.exe
  2⤵
  PID:7420
- C:\Windows\System\XUJdGmZ.exe
  C:\Windows\System\XUJdGmZ.exe
  2⤵
  PID:8776
- C:\Windows\System\xdUFKxg.exe
  C:\Windows\System\xdUFKxg.exe
  2⤵
  PID:1728
- C:\Windows\System\HtRZxoI.exe
  C:\Windows\System\HtRZxoI.exe
  2⤵
  PID:5752
- C:\Windows\System\bsGBsEz.exe
  C:\Windows\System\bsGBsEz.exe
  2⤵
  PID:14536
- C:\Windows\System\ndrgEVG.exe
  C:\Windows\System\ndrgEVG.exe
  2⤵
  PID:7432
- C:\Windows\System\uomLnNE.exe
  C:\Windows\System\uomLnNE.exe
  2⤵
  PID:14912
- C:\Windows\System\hDYoDAT.exe
  C:\Windows\System\hDYoDAT.exe
  2⤵
  PID:15160
- C:\Windows\System\BeojMge.exe
  C:\Windows\System\BeojMge.exe
  2⤵
  PID:8020
- C:\Windows\System\fDUsnOk.exe
  C:\Windows\System\fDUsnOk.exe
  2⤵
  PID:8744
- C:\Windows\System\mevQVoH.exe
  C:\Windows\System\mevQVoH.exe
  2⤵
  PID:8248
- C:\Windows\System\byeyvSY.exe
  C:\Windows\System\byeyvSY.exe
  2⤵
  PID:2896
- C:\Windows\System\wZcZYDG.exe
  C:\Windows\System\wZcZYDG.exe
  2⤵
  PID:8496
- C:\Windows\System\gmLChDs.exe
  C:\Windows\System\gmLChDs.exe
  2⤵
  PID:14988
- C:\Windows\System\JOeUipp.exe
  C:\Windows\System\JOeUipp.exe
  2⤵
  PID:8704
- C:\Windows\System\xAvOTOR.exe
  C:\Windows\System\xAvOTOR.exe
  2⤵
  PID:9088
- C:\Windows\System\XyNBuPP.exe
  C:\Windows\System\XyNBuPP.exe
  2⤵
  PID:2412
- C:\Windows\System\kfLeCYR.exe
  C:\Windows\System\kfLeCYR.exe
  2⤵
  PID:5288
- C:\Windows\System\OaoAQeB.exe
  C:\Windows\System\OaoAQeB.exe
  2⤵
  PID:15080
- C:\Windows\System\gtrwgGN.exe
  C:\Windows\System\gtrwgGN.exe
  2⤵
  PID:8408
- C:\Windows\System\eyPpLHi.exe
  C:\Windows\System\eyPpLHi.exe
  2⤵
  PID:8696
- C:\Windows\System\fXMhEYM.exe
  C:\Windows\System\fXMhEYM.exe
  2⤵
  PID:12940
- C:\Windows\System\pVytfoq.exe
  C:\Windows\System\pVytfoq.exe
  2⤵
  PID:2332
- C:\Windows\System\CHLPlpB.exe
  C:\Windows\System\CHLPlpB.exe
  2⤵
  PID:7892
- C:\Windows\System\AqcGbhW.exe
  C:\Windows\System\AqcGbhW.exe
  2⤵
  PID:7004
- C:\Windows\System\SXITdGw.exe
  C:\Windows\System\SXITdGw.exe
  2⤵
  PID:8672
- C:\Windows\System\rJNFHQs.exe
  C:\Windows\System\rJNFHQs.exe
  2⤵
  PID:9464
- C:\Windows\System\cuSJFEX.exe
  C:\Windows\System\cuSJFEX.exe
  2⤵
  PID:9616
- C:\Windows\System\ngaSEtS.exe
  C:\Windows\System\ngaSEtS.exe
  2⤵
  PID:9340
- C:\Windows\System\fAhbNGU.exe
  C:\Windows\System\fAhbNGU.exe
  2⤵
  PID:7924
- C:\Windows\System\gntjFPL.exe
  C:\Windows\System\gntjFPL.exe
  2⤵
  PID:1268
- C:\Windows\System\iAcGlRs.exe
  C:\Windows\System\iAcGlRs.exe
  2⤵
  PID:860
- C:\Windows\System\RuMnuJz.exe
  C:\Windows\System\RuMnuJz.exe
  2⤵
  PID:8908
- C:\Windows\System\soPCWob.exe
  C:\Windows\System\soPCWob.exe
  2⤵
  PID:10124
- C:\Windows\System\OsevsJr.exe
  C:\Windows\System\OsevsJr.exe
  2⤵
  PID:7264
- C:\Windows\System\jPIBSNE.exe
  C:\Windows\System\jPIBSNE.exe
  2⤵
  PID:8752
- C:\Windows\System\zkCjwgj.exe
  C:\Windows\System\zkCjwgj.exe
  2⤵
  PID:15112
- C:\Windows\System\hPyAxwp.exe
  C:\Windows\System\hPyAxwp.exe
  2⤵
  PID:244
- C:\Windows\System\icmHrno.exe
  C:\Windows\System\icmHrno.exe
  2⤵
  PID:7172
- C:\Windows\System\ljCcoaZ.exe
  C:\Windows\System\ljCcoaZ.exe
  2⤵
  PID:10312
- C:\Windows\System\UjVPvVa.exe
  C:\Windows\System\UjVPvVa.exe
  2⤵
  PID:9912
- C:\Windows\System\rOUhriJ.exe
  C:\Windows\System\rOUhriJ.exe
  2⤵
  PID:13284
- C:\Windows\System\PcgoqlR.exe
  C:\Windows\System\PcgoqlR.exe
  2⤵
  PID:9276
- C:\Windows\System\GJuaOSD.exe
  C:\Windows\System\GJuaOSD.exe
  2⤵
  PID:10164
- C:\Windows\System\NcCJRBt.exe
  C:\Windows\System\NcCJRBt.exe
  2⤵
  PID:15188
- C:\Windows\System\LhuBqOJ.exe
  C:\Windows\System\LhuBqOJ.exe
  2⤵
  PID:9892
- C:\Windows\System\UPMOVlu.exe
  C:\Windows\System\UPMOVlu.exe
  2⤵
  PID:8044
- C:\Windows\System\owgvPmu.exe
  C:\Windows\System\owgvPmu.exe
  2⤵
  PID:12036
- C:\Windows\System\wpjDKfj.exe
  C:\Windows\System\wpjDKfj.exe
  2⤵
  PID:7368
- C:\Windows\System\TpqUVMj.exe
  C:\Windows\System\TpqUVMj.exe
  2⤵
  PID:8740
- C:\Windows\System\ryxOGDY.exe
  C:\Windows\System\ryxOGDY.exe
  2⤵
  PID:8884
- C:\Windows\System\XlihTOM.exe
  C:\Windows\System\XlihTOM.exe
  2⤵
  PID:9012
- C:\Windows\System\PbBwYAE.exe
  C:\Windows\System\PbBwYAE.exe
  2⤵
  PID:10148
- C:\Windows\System\xofIikM.exe
  C:\Windows\System\xofIikM.exe
  2⤵
  PID:10772
- C:\Windows\System\DIaqWgD.exe
  C:\Windows\System\DIaqWgD.exe
  2⤵
  PID:9156
- C:\Windows\System\BnWACEU.exe
  C:\Windows\System\BnWACEU.exe
  2⤵
  PID:14756
- C:\Windows\System\FiQbGOB.exe
  C:\Windows\System\FiQbGOB.exe
  2⤵
  PID:12344
- C:\Windows\System\srDuPtQ.exe
  C:\Windows\System\srDuPtQ.exe
  2⤵
  PID:11584
- C:\Windows\System\rSmxqkF.exe
  C:\Windows\System\rSmxqkF.exe
  2⤵
  PID:9956
- C:\Windows\System\nstMEPZ.exe
  C:\Windows\System\nstMEPZ.exe
  2⤵
  PID:12520
- C:\Windows\System\GlygMAH.exe
  C:\Windows\System\GlygMAH.exe
  2⤵
  PID:12080
- C:\Windows\System\qfjMoNv.exe
  C:\Windows\System\qfjMoNv.exe
  2⤵
  PID:14688
- C:\Windows\System\AkXKSpu.exe
  C:\Windows\System\AkXKSpu.exe
  2⤵
  PID:9476
- C:\Windows\System\yiFHCCF.exe
  C:\Windows\System\yiFHCCF.exe
  2⤵
  PID:11596
- C:\Windows\System\TVxhtHs.exe
  C:\Windows\System\TVxhtHs.exe
  2⤵
  PID:13900
- C:\Windows\System\jeijtLY.exe
  C:\Windows\System\jeijtLY.exe
  2⤵
  PID:15128
- C:\Windows\System\oMgNZFH.exe
  C:\Windows\System\oMgNZFH.exe
  2⤵
  PID:11444
- C:\Windows\System\rrkbCgg.exe
  C:\Windows\System\rrkbCgg.exe
  2⤵
  PID:9544
- C:\Windows\System\jGQpaCQ.exe
  C:\Windows\System\jGQpaCQ.exe
  2⤵
  PID:12996
- C:\Windows\System\jArPmkG.exe
  C:\Windows\System\jArPmkG.exe
  2⤵
  PID:10756
- C:\Windows\System\XZDLmAs.exe
  C:\Windows\System\XZDLmAs.exe
  2⤵
  PID:11836
- C:\Windows\System\JsWMloo.exe
  C:\Windows\System\JsWMloo.exe
  2⤵
  PID:13828
- C:\Windows\System\TjauMGI.exe
  C:\Windows\System\TjauMGI.exe
  2⤵
  PID:9688
- C:\Windows\System\fvvpmbS.exe
  C:\Windows\System\fvvpmbS.exe
  2⤵
  PID:10444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qd2lhjjs.qff.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMdmDNi.exe

Filesize
1.9MB

MD5
33477bfa31d0cd81dfa849be93126c3b

SHA1
14fa082921bddc641ec66a6b830322c04f1a5ec9

SHA256
16b1852ec740aec93fce385678d6427b21ee71fe7799e3ac805566c8a0d7ae81

SHA512
a55b24c42a893e1840d12e773fc82f3a07e120f984d25b693e4d679644bb49cbb5f527e7fd6405e54145f13fcf6c1e40c73a4e1aa6eae3bf7e76621410ba7af1

Download Submit
C:\Windows\System\EqHskRF.exe

Filesize
1.9MB

MD5
60691eda2655dd37b355208582974d15

SHA1
747554b45d9f8a51c0bef5b38abfff81b9618554

SHA256
65dc249fcbdb2bc1bcb9261f7c6b54dbf4417921ab149ff82bdc08a566d505ef

SHA512
4410ab1846e1ace521604756b28b2d5de709e192f0b6450e6d91f5a73bca4123c5774d324b73837de729aa3b8095dbf96515d350ec5a3ef9c647a0caa1df2377

Download Submit
C:\Windows\System\FTfQlBo.exe

Filesize
1.9MB

MD5
ff93e84d2b26d33d6febe5f30a6860c0

SHA1
f09fdac1fd856b6c7040dcc953ab6c055cf559c4

SHA256
e16ec90c9fbf4790806adbde6b2ec024840dd3b3807803fda34172cd02f588fd

SHA512
1dd53036495c69f68db0c73affaee8a27885725be519e4321166730af04d248275626bf879740c93d55caf315b482ad9e0a74544e4b697aa23b49b666a398a0d

Download Submit
C:\Windows\System\GGwxZNL.exe

Filesize
1.9MB

MD5
86c2048b56051d727ef2ef00ac9d7f72

SHA1
2e3469659892c6b1ac9eda86565b9a6163456aa1

SHA256
4b464aa56c73e98a1c32bc41965df2b9b29e972b6a487c569c834fbfb6f32a20

SHA512
9c1e020a46102fa34f9beb6ba706d30ef8b6dbe66640ae6433aea66cd12edd9379c953f5d62d4980ab094ad3bfb3f8db32e9b597e72aa189174cfa4a3c07d98f

Download Submit
C:\Windows\System\IfCTqzI.exe

Filesize
1.9MB

MD5
0664742f9eff3c94855c3575b85b54bb

SHA1
9c7732ee730bbf9d363697d0aaec108fb18fd261

SHA256
dd29009ce87b98c77093d75d0f5a09ef32a70846cbfaa52e07f9615e051d1434

SHA512
40a124a77bef089d3c0690932872aedd294e79d7ae23005555bcbc8ffbbd93ca3631a3e933ca9161df1e2a3f39835ac29b204dafc030784bef76f894b376c49b

Download Submit
C:\Windows\System\JVGFnNm.exe

Filesize
1.9MB

MD5
f90ca1a3cc0513a5c7e5e8e06d0de22a

SHA1
87b9f6d2e08b5e3214bd6da72650861bc4e379f2

SHA256
98fe569923c253b8df5ad97242c30089f1d3446805b3365e2847017da3be54ea

SHA512
ccedde5826d94db59ac73ccb2a044d92243adfcd5bf7251dd6dd77cc64ffd160c72ad99f60209cb9267c9e6c129a0941d67a3505201a65054437d848e3839776

Download Submit
C:\Windows\System\JcxyOcB.exe

Filesize
1.9MB

MD5
7d3b3c55aa13db65e0138b8a5e67ed9f

SHA1
abee901bb6644683a80b03e53e525a856b682613

SHA256
e9684358f0af196ebe7a1009b27d62737f032aed1c5ae36e8206cf7fe7bb141d

SHA512
c7b4e1c2ad6f422a50982abe0695669f15ccd42469fe4ba90e54869f9dbebaab5bcad85d260d6d62b60fdd61c98d43ba9f5bb75aa195d72fe3c56357e7ce06b7

Download Submit
C:\Windows\System\KaEdsfh.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\NNTlYAO.exe

Filesize
1.9MB

MD5
3238f33c6611657e4474b1240663a1f7

SHA1
a6d8d868f888fd9d41f73ec9c29c047d84a37593

SHA256
5843c25643659f5999c70b078d6f7edc965d35f2426b6465a92bdf519cdcfb14

SHA512
20875ab0630e4acaf60d92ac1e2d46568398054fda3e50bc8884dfc1a35613cb59a9cd138e741669309d81c1f67d5e705482342e2f65d042209fe99da1395837

Download Submit
C:\Windows\System\NzIrUse.exe

Filesize
1.9MB

MD5
b450db69cc34f14986b7dfe4e90da3c8

SHA1
a057b8e965a228ffee4c07dd651d6ae1436d63f4

SHA256
65d72a43bae583e71638d3e87bedb3be0d9be5707a19f90695ae972de0659878

SHA512
ef21b480bff31eabf4ed37b9b36c632a270e5196fd1915578742d1fc463c82d4bfd2e8d69ffd87b76ffdb8ece994ed473dce82ce83860114e2eebb2d4e1eefa3

Download Submit
C:\Windows\System\ONoARWA.exe

Filesize
1.9MB

MD5
7b2d04dc82051d28ebfc65c87afcc103

SHA1
805b089c8c0900a0f21584722dc934b4d6f59e47

SHA256
1a32e535931c7d28da4ae4ca5984936837f85ec230adf2a110c5b7100682536f

SHA512
8f45c03e5ca3908f13e229097cbcc3215d44a01a2ad6610164fc90de51429fa109843a6d6544ac456a0b9b7b901a9b26c0b6c2790110fe67970bd71bf2cffa63

Download Submit
C:\Windows\System\PBHZlDa.exe

Filesize
1.9MB

MD5
16e40e98017b9296c8cb15d090eea42d

SHA1
de377ea88fb96ab47c4413157f9711d88cadd12a

SHA256
d9f75cefb177f603d3a525f91b06cb8e531be60cf5152d953e90fed740c91e8c

SHA512
9d707f3ce782025d943240cbce2d57aaa25663066c03f210ba1bba1a20af536d9e4bd03928f693dc0eaf8986756c35bc3251c9015adb75ef3bedcb2fa9643f51

Download Submit
C:\Windows\System\REJoPgO.exe

Filesize
1.9MB

MD5
73021b98c4fd0cf091ca99b0f715f5f2

SHA1
b19a58667b1c969366abe32a15dfa2f4cd2b6890

SHA256
d60ed4186d8256b5140020c884c31ad5246742cb13ab93454bd2793c35626306

SHA512
3e97d97d6ae96f1079aad13557c6953a26e3b5e211598c9669a056b278e97f37b53e0260a33efb371a9908a9d715afcd8ea3e0ef865278a6cfcf5cfc05fbf85a

Download Submit
C:\Windows\System\RgEWToo.exe

Filesize
1.9MB

MD5
62164ddb68e9cf143535ab90f8966b73

SHA1
f76eea97e25330461c8d3436993befb87a7a6d90

SHA256
02ea0394278af3b617bbe8c7b5cb97ae056a9c02c906f20d2a23b94aee2eb139

SHA512
52bef8920482d6233fe4bdbea29d9721653a905605d7a7176013350da2d357aa3212ed2e7dab11e7b3e2ea04de6f16073b1a4b27cbf3e7cbe65e09e8f40a89f6

Download Submit
C:\Windows\System\RlJkakq.exe

Filesize
1.9MB

MD5
3df6932b0bd4337bb5bf3e613bf678a9

SHA1
70eaa2faa56b10720631c7f152bfccab9d1fb1f8

SHA256
ff7c636ccef173eff976f9e57612091a848278f02ffb40266c0530123837e311

SHA512
13b2c7a51e1aa6898a7c5d4705510374cc57c030141621cd81162b8a0a43bdf7f3679010d9a71c3e2002d5b50732374a221d3a7a3eec0bd6f56af31b0f7bce8c

Download Submit
C:\Windows\System\TKoyKLo.exe

Filesize
1.9MB

MD5
931df575afc730b26724be10cbd7efd5

SHA1
f7fb0cad86125380c7c1b448f56233a27e6ececc

SHA256
e9991cb7a5c78148f11bb1679f9f622192f9fcd72147d0249d14e1be08ef82b3

SHA512
3e53425af11d2240cd6f85fe8e3d560c0c61f20966994947e1bd5929d8763b60944a52fbd09ae5f2d505d27dc99e010c92c2ce53a3b74fffd429e008d7f257fd

Download Submit
C:\Windows\System\TqEXXUe.exe

Filesize
1.9MB

MD5
1f29bfdd15fc450529ce1c0f6865008e

SHA1
b003cb8132eebef05ed20363efa0a648b325001a

SHA256
5c369ce0d3453f7a5fa5e7149f04f36226a1011ebb5c949375323a4e40f1468f

SHA512
3e44c4765398bd8b0bcd654e00723947a81352f947dcf03ecc22291d093000ec085fc671338a0b348bc849a3dda773e5f0c5a7bbf0c0705bfaf5d6020409242e

Download Submit
C:\Windows\System\UUjXEBB.exe

Filesize
1.9MB

MD5
b15f058e6487dc50c44497d42465c57b

SHA1
a12155b260585228b04ebe47b6232f05e7c35e29

SHA256
e2d0318ed679fbd3487330c0a889ca1b1b4effe980ff7f3ceae4371495797646

SHA512
976b7130f1b5cbd299c0b49b9357f15e781da2f8db51f1d7d4fba5f27595ba65eb9394d9d35b23a92beca6ec9917470dcab13018b1e9ad9aeed380f48cb763a7

Download Submit
C:\Windows\System\UnNaEdb.exe

Filesize
1.9MB

MD5
e4b941529766611bd513e758874c3b8d

SHA1
c8076593622dabef2ac39064c00df2f4a59132a1

SHA256
84b7ab4810c37ef728d12bba2fdb00525b29e175d47e39368a4c531027a25b58

SHA512
b3e3e6b431cd29983ad7583361ea5260b741356b923f4e84fec45a83470058e2772d761f657373957791dd1f0cc95306006f47400053a4b23198ced528e80404

Download Submit
C:\Windows\System\VSNKZQF.exe

Filesize
1.9MB

MD5
fb8116ea9121b0eaa8387ab95812bbef

SHA1
734602ed518af890576bfab25df299d3f1a980d0

SHA256
9c8a11019ea9942c8ac4b1d55604ef09b02c4510550a20bcd9c88b33b50cb2e4

SHA512
82b609772dd92b734457409d1b0af762697944427047b48caa7d10d46726e3c9c91e3dd7925f47e904a560f3f833f5a250474cf8bf9323e480a3d78995070a6e

Download Submit
C:\Windows\System\YHQcHra.exe

Filesize
1.9MB

MD5
7cae8f83255210da01da3973d30eeaa5

SHA1
ca67f56b157dadc360a864f2aabed8b5e9dd58bc

SHA256
bc64734c2da55c5dc77d6f70eb4fd82d037cebab6aee5a0a570bacb3e31c8a66

SHA512
b5159f25ce7233d69b3056d5314a73c173fa17baaf1fe8bfc450f69c4866e8738cf16f1371a4743992489c6b5e22de72384632e28265958769fb2096cea4568b

Download Submit
C:\Windows\System\ZKWjRdJ.exe

Filesize
1.9MB

MD5
79fd228fd7b0a6da05fab088e7f9dfca

SHA1
b27984ed96a780677e01a28d2d234a8550c156b6

SHA256
9b2b0e5a15d8d351ce3ca308fadf420d9e989e838189e7635fb7c7f5199a3717

SHA512
65535784700813bd528f593e66d4b7f75d7458d6364461cda1bf8ab2932c407e3f603462005dbc916f81cdb0e35f68d1093502228192506e2c91276052b53204

Download Submit
C:\Windows\System\aNlBzUG.exe

Filesize
1.9MB

MD5
7ffb79b7eda682c21f7bfb7644585a2c

SHA1
a5aed4a58374f00bcc00fa440ee6645856bb35d6

SHA256
2227d51b9de3c9daa6c0259cce5d768e7708cf0a70329f7dc7e7258ca616a847

SHA512
4de2f1f89ed562a231a59510d14e4493bf155408c09da56d93dece6609dd7c41bcc2b6b61c53bcf038c8d4e86b2ce4c48b58e0af4ed9198d78d63426bcf4c8dd

Download Submit
C:\Windows\System\bfMmuSa.exe

Filesize
1.9MB

MD5
4a73c031b2316d2a8c615065d11d6ea8

SHA1
2316d9a8b9cf991a60d229637b542999121b6d15

SHA256
6effe67f53c3b7919fede0b7445d1d31b8498ac550259322ad9902cc20d02452

SHA512
5799e96650bde73e2f6fe0e90114635a9331187b939bcd46098602f1def95f4797aaa2a476141e9a41f97481007cf77bf453697c3562337a05ef5a94fbb477f4

Download Submit
C:\Windows\System\cACRTZr.exe

Filesize
1.9MB

MD5
f5d8cb823fe79e73053d5b528629a7b7

SHA1
ad75f3f5d7c6e76cb27ae01e4c06f463cb9264f8

SHA256
a237cff3e6dff16d72a519e53f27d8292e77e7fc77825c63ad8d45cdfc4a310c

SHA512
e782c84afa7167ad76fc5fa2305a703cc8cdae849d5ed67d1ca9aea5527261eaa1ec16143ad3bb8aa38abe3ab677ebba5061a9f83eb21eceaabac5d170aa9f49

Download Submit
C:\Windows\System\dJZfjRq.exe

Filesize
1.9MB

MD5
2a9a1e4e6427aaed604eed0c1e590739

SHA1
b41204b086026433ab06736362b0a021da19921f

SHA256
d502e51c09d7c831e075064a519e2b4ea80a1a9dabcf63e71f704a9b532cb3fa

SHA512
cf8e68828973ee5753f290693ddadb983b273879f805a380b6f8f3ca1ec140bcdddafcd091977d6370ed7fc549d45ecfb22d56b75e5b11a5d88b67f9bec27162

Download Submit
C:\Windows\System\dQHMqgD.exe

Filesize
1.9MB

MD5
9d44eb8cfc2980241109c60553019931

SHA1
6f7ade56efa737426c089f35bde70679ec0fc5ef

SHA256
6a9c3b138ac9a2efa0e43be669292148b34ae36e32aa64ed7c80ad6997b37957

SHA512
64199ffd8f36398c73c7e549f2de4679ba49591b189609b04ad9927b8234a3d6f6b65994ebeced6989de6200941ee31f24cae60657929758adea627af38c461b

Download Submit
C:\Windows\System\dWlHXHw.exe

Filesize
1.9MB

MD5
68fd9425c2cef7728adbd713cd668c0e

SHA1
baa681d7833e5c04c68b5ea5f0f8175c6421594a

SHA256
cf381c2a12317ad1574c7c41df85bcac54ea4eaefd31cb6948a4e2a21f8c7d24

SHA512
4feeb89b4f9fc3d416ae2afa0f985e7c39bfa7d5bde7ed1944de6858814d6e177c39f957845a1ed7024f371331779f7d46b653763a030a63ed0e4e5960651c84

Download Submit
C:\Windows\System\dtzEVbu.exe

Filesize
1.9MB

MD5
523ef181a86e17d2852d2bc22c4b9c87

SHA1
5632f9a186ae58d046e2efc40831d21f277a5f3f

SHA256
ccc0fac89ade9e65341623ee8819c71f1d557704f92ec36d4783aefc72c2b0e8

SHA512
f9decd403d2b4542f4fcaaebc679b0cf7b582f5ba3e57dc4c76cdc33384dfab9dd7dc9bee8e35621e8773c43e45b884d5a3b5aa986998e2168e7ab0d4b1223cd

Download Submit
C:\Windows\System\eOulBeM.exe

Filesize
1.9MB

MD5
85017d37dcd964bfdd88ec2fc225f955

SHA1
71a64467e0d957e766519982524fd83c392d0a49

SHA256
d8aeb41b61667e80b717cea15f932bbe3536136403f730cd56585e666b55ad0f

SHA512
319c4195960ed65ee6a531b0728ab575a985046e604345bf656fda9e09b4b09024011ad3b3471a34b755b0a49022975703c81d4fd383f2afa823ba191d65bff7

Download Submit
C:\Windows\System\fCeLaJJ.exe

Filesize
1.9MB

MD5
0c462b6ac7341c2a25637ef46ca5a892

SHA1
45695b93dddb843f50b0ebe0ae2172e7936c4846

SHA256
431cacab4569db9863b80f1831540c2bc0fcefc1c7328d0023a9ca06737c4ce5

SHA512
a0fcdd368ccfde53ac0913613a8954696c865a1afac595453e8292f6d225955e2cb62d83119684268bf2a1db8528cf8f1c10c57994f5005c170df332b28e2ac1

Download Submit
C:\Windows\System\gYJfRcI.exe

Filesize
1.9MB

MD5
c2d5c97acc5e9831d696c1622e7b1ced

SHA1
808bc2857ab8734b3e7d681537a3ac20aff3a240

SHA256
535c5aa8f08c5e27e0dbd74ea0a48bd47713e3cabc8a078f2cd6d84f4ef1969a

SHA512
1242afc26c5fba7b03cbf29526e2f920df2a7b4077500ed382ee13e4e6eadc092a8467f9ecb13d7aa4b15bebc4c175b891b92b9f783db7bc3e99da8a931c3072

Download Submit
C:\Windows\System\iAqjEWm.exe

Filesize
1.9MB

MD5
0a0217da715eb5badab00ca8d2864822

SHA1
4dc5cb9a625ee020f4d1decc4954f8fafa7a1c2f

SHA256
e63e946aebf6a1dd2e718d87d89b26a7a3fd2fa23059455bda8eee7cb57a33f3

SHA512
f67a5540084e08157bd9f7caa53da36a5f28937be6825a48f0d73133fbe80d3cb88d0377476bffcc997e033a09acd24209273c50c97781e8ab57370f002822ff

Download Submit
C:\Windows\System\iKshMbh.exe

Filesize
1.9MB

MD5
3799701d00fa8bc80a70522d38cac037

SHA1
4f6ff4157a8c6d8aaf355c926f7e7be9947de70f

SHA256
dc37c9aba0a7fa2d4bfaa5874dd556ae4523b9ddea407f5d4d33d37d76ba43ed

SHA512
a221ea17bc14e3c349c70c8508c49319660960d058c87e8af5849b961282bbf0b66a31f43b75bdc80ef028f4ebc67775175df653c16e39bc4e376e8e05121e64

Download Submit
C:\Windows\System\ihWSkJX.exe

Filesize
1.9MB

MD5
2f3cfdb0da911ff10323b07a4fa28695

SHA1
266b9b06c333725589932df3d354771e47072bc2

SHA256
d077868c61bddd97fb3867ffdb75d2cc1225c197fef620b8b6599e23bebdaf54

SHA512
ce249bb5059e0497feca609eae440bc8e2174f56852fa1e39c47e92ff0a909233143c9d43efe8991f267a9058d85a6e59d81ba8fbc850252e0a44878c6ac98c5

Download Submit
C:\Windows\System\kDbcCiC.exe

Filesize
1.9MB

MD5
2e25f4275ce8a65ce1e7f8acbf27817b

SHA1
f20934b87c35446135ba6ba188927e5e01d4a9ce

SHA256
7aea159f6bb3222148ae0b4b0add38109f585ada709a6a02f010430eedde759f

SHA512
f24fdec7b495f702c3bcd4852132fc6416201fa2d8e062fd7de8d822f79e9284d0c1358a8d56624e1e1a582071b72079528fe2039115c00b3fdcca468919cf29

Download Submit
C:\Windows\System\lIWAKQW.exe

Filesize
1.9MB

MD5
5f3172e30eb3d61f9d3f60e16b0ac64f

SHA1
8175ba6887809a89ee3cc2ad1ae0828c3abaa65e

SHA256
aae777077696d8a0d8f241edb8aa986d7ddb71e75e8762664e412fe887dd9530

SHA512
e240c235db7471d3c8019b8ce0e604b174e0abafd4576a6d1449c6626a984b60f646adcdeae17596c3312e804f1b5c35454c25b99d95b92d1f9ff01b0348450a

Download Submit
C:\Windows\System\mhuyPwa.exe

Filesize
1.9MB

MD5
86a9d00867064519ac8eb215bbf6bab1

SHA1
33d259ce642bc97277b6dacbe6114b0dd76c7815

SHA256
999b90cdda53ddd715be3ee5f488618528f47df9ff809917382e622b0cd7a5a5

SHA512
5f63bae9bd536fcbcc1156c0566c1d067a5e903befe479c22e2e3caed42930c66071982f4ff25baacf3e2d7177ad922576836966ec3d2863ac18a5117b19b3da

Download Submit
C:\Windows\System\miqPPwm.exe

Filesize
1.9MB

MD5
dd2382dc87db5e42046ff59e20776361

SHA1
000122c5ca8078a44ac4cff0d8cca6b1dc8bd9a0

SHA256
c3f76c3e124df363efafcfcf0c1bf2f3a931934922aa9f525c15cfce56cd3a4e

SHA512
c86ace3c102da825aad42e2934cfdd4e763dfc5fc27ea8cebe77ab7a78c3d0d36359801dce5b713d9ee7cfb394cb600e7a6dd852c67ba802b3d45c4403f1bace

Download Submit
C:\Windows\System\nHextQt.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\nQCLiFD.exe

Filesize
1.9MB

MD5
9447961a2574032e0f02bb3254c457eb

SHA1
40b383cc1ba9606e67a73db2f6cd81fbd0f8f00d

SHA256
320334846f2545e1cf91687fd421b204ec36328675c84644306f7b1a15971e70

SHA512
d5f55b666e54b804e59e69f31e947e752cfdf16ead042ba64b0c4266d2a54211244ab22b06bd3e1810fe31c890337253567ad183786a874f727f1660aa620917

Download Submit
C:\Windows\System\pkcyQyM.exe

Filesize
1.9MB

MD5
3b9f1baa4333910b0fe108ac5a534629

SHA1
fc676d1f1ddb7ed996093acc1cad93000f587bc7

SHA256
e57319647c3dac2641d8375604d66cde22fc60bed4d2f0f4677f9c2e00633dcb

SHA512
d4efd10498f1f534511929ab0af990f2986bd99f20faa333c7f43a491635a11882b309943eba3598b384865359a6b64d3633ec781fda186203f1b6d5dace12a2

Download Submit
C:\Windows\System\tkMpwwx.exe

Filesize
1.9MB

MD5
7a07a1dda8bce75b0cb0928cc26badc5

SHA1
0046a54600363b85d7f9020087ef12b6a1af9498

SHA256
65a1a89281a9598482583625d427618deb0ad9ed5b8b1c3c13d43e4d0a4f71b3

SHA512
508269a8cdefa542bd04655a0ad926c19cafc71a862b5aa3f323313df52412f6ea997bd904a87b272a9685cd07bf75cc9593d04226b62c61214ad9e57d9f4da9

Download Submit
C:\Windows\System\uoehqVE.exe

Filesize
1.9MB

MD5
c0423597fc6aa137c56bd31dabec85de

SHA1
cdba937bc9bd59920cc3354e0ee1a6907eff2ddf

SHA256
f75e565781bca32651d3b812393f7f4b38e36c18666ae6eb8b53ae45a0f98ddb

SHA512
7c910938fcf02eaa5b1d9bf1c63d433923289354abc8bab6dc8114a057e6dc8dfac061e501be39ea241693a6165481f91dbfaf67833a70b3dce27012827caa76

Download Submit
memory/208-469-0x00007FF7D3FB0000-0x00007FF7D43A2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-228-0x00007FF620650000-0x00007FF620A42000-memory.dmp

Filesize
3.9MB

Download
memory/1976-85-0x00007FF6DD8B0000-0x00007FF6DDCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-5950-0x00007FF793E00000-0x00007FF7941F2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-329-0x00007FF793E00000-0x00007FF7941F2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-577-0x00007FF72BC10000-0x00007FF72C002000-memory.dmp

Filesize
3.9MB

Download
memory/2236-5967-0x00007FF7BF610000-0x00007FF7BFA02000-memory.dmp

Filesize
3.9MB

Download
memory/2236-633-0x00007FF7BF610000-0x00007FF7BFA02000-memory.dmp

Filesize
3.9MB

Download
memory/2404-5859-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-139-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-1-0x000001693E130000-0x000001693E140000-memory.dmp

Filesize
64KB

Download
memory/2488-0-0x00007FF701AD0000-0x00007FF701EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-71-0x00000283DD2C0000-0x00000283DD2E2000-memory.dmp

Filesize
136KB

Download
memory/2616-732-0x00000283DDEA0000-0x00000283DE646000-memory.dmp

Filesize
7.6MB

Download
memory/2616-49-0x00000283DB140000-0x00000283DB150000-memory.dmp

Filesize
64KB

Download
memory/2616-46-0x00007FFCDB590000-0x00007FFCDC051000-memory.dmp

Filesize
10.8MB

Download
memory/2920-5998-0x00007FF6CDE90000-0x00007FF6CE282000-memory.dmp

Filesize
3.9MB

Download
memory/2920-644-0x00007FF6CDE90000-0x00007FF6CE282000-memory.dmp

Filesize
3.9MB

Download
memory/2952-578-0x00007FF7F9050000-0x00007FF7F9442000-memory.dmp

Filesize
3.9MB

Download
memory/2952-5960-0x00007FF7F9050000-0x00007FF7F9442000-memory.dmp

Filesize
3.9MB

Download
memory/3204-470-0x00007FF7ABF90000-0x00007FF7AC382000-memory.dmp

Filesize
3.9MB

Download
memory/3204-5988-0x00007FF7ABF90000-0x00007FF7AC382000-memory.dmp

Filesize
3.9MB

Download
memory/3280-191-0x00007FF65C250000-0x00007FF65C642000-memory.dmp

Filesize
3.9MB

Download
memory/3280-5865-0x00007FF65C250000-0x00007FF65C642000-memory.dmp

Filesize
3.9MB

Download
memory/3284-5964-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-659-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-5954-0x00007FF70BFC0000-0x00007FF70C3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-383-0x00007FF70BFC0000-0x00007FF70C3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-5957-0x00007FF7A3070000-0x00007FF7A3462000-memory.dmp

Filesize
3.9MB

Download
memory/4172-326-0x00007FF7A3070000-0x00007FF7A3462000-memory.dmp

Filesize
3.9MB

Download
memory/4360-5971-0x00007FF6B18A0000-0x00007FF6B1C92000-memory.dmp

Filesize
3.9MB

Download
memory/4360-661-0x00007FF6B18A0000-0x00007FF6B1C92000-memory.dmp

Filesize
3.9MB

Download
memory/4580-5939-0x00007FF63B910000-0x00007FF63BD02000-memory.dmp

Filesize
3.9MB

Download
memory/4580-218-0x00007FF63B910000-0x00007FF63BD02000-memory.dmp

Filesize
3.9MB

Download
memory/4612-89-0x00007FF6FF500000-0x00007FF6FF8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-544-0x00007FF6D1C70000-0x00007FF6D2062000-memory.dmp

Filesize
3.9MB

Download
memory/4828-516-0x00007FF660740000-0x00007FF660B32000-memory.dmp

Filesize
3.9MB

Download
memory/4828-5933-0x00007FF660740000-0x00007FF660B32000-memory.dmp

Filesize
3.9MB

Download
memory/4864-296-0x00007FF7E16F0000-0x00007FF7E1AE2000-memory.dmp

Filesize
3.9MB

Download
memory/5104-5994-0x00007FF7588D0000-0x00007FF758CC2000-memory.dmp

Filesize
3.9MB

Download
memory/5104-643-0x00007FF7588D0000-0x00007FF758CC2000-memory.dmp

Filesize
3.9MB

Download