xmrig | 40a28bb93d03379fb57662a234fe6e95e6a278c9d6a5a436003a8d09de99558d

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Size

2.3MB
MD5

01fc14956c8b3fa79a3c9f4b2a1d09c1
SHA1

fca7e22341fd2adecd35a53ec77a059d6a046300
SHA256

40a28bb93d03379fb57662a234fe6e95e6a278c9d6a5a436003a8d09de99558d
SHA512

131aa5621f866e9226cbb1e81fc36b1ef02cdc725c53baef292dea5e745c22d867608ca1f5572965e80ffbfd1c19180842123cef98b623ea5173c7df0a7d21b5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfET3:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/4912-231-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp	xmrig
behavioral2/memory/3772-262-0x00007FF7BFBA0000-0x00007FF7BFF92000-memory.dmp	xmrig
behavioral2/memory/844-370-0x00007FF74F280000-0x00007FF74F672000-memory.dmp	xmrig
behavioral2/memory/1172-425-0x00007FF6FC120000-0x00007FF6FC512000-memory.dmp	xmrig
behavioral2/memory/1012-451-0x00007FF6F6820000-0x00007FF6F6C12000-memory.dmp	xmrig
behavioral2/memory/1204-456-0x00007FF719DB0000-0x00007FF71A1A2000-memory.dmp	xmrig
behavioral2/memory/3700-455-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp	xmrig
behavioral2/memory/4536-454-0x00007FF659420000-0x00007FF659812000-memory.dmp	xmrig
behavioral2/memory/4828-453-0x00007FF6E9BE0000-0x00007FF6E9FD2000-memory.dmp	xmrig
behavioral2/memory/4748-452-0x00007FF7F68A0000-0x00007FF7F6C92000-memory.dmp	xmrig
behavioral2/memory/2368-450-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	xmrig
behavioral2/memory/4572-449-0x00007FF66A420000-0x00007FF66A812000-memory.dmp	xmrig
behavioral2/memory/3872-445-0x00007FF788240000-0x00007FF788632000-memory.dmp	xmrig
behavioral2/memory/2064-444-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp	xmrig
behavioral2/memory/3884-346-0x00007FF6A29A0000-0x00007FF6A2D92000-memory.dmp	xmrig
behavioral2/memory/4352-341-0x00007FF758880000-0x00007FF758C72000-memory.dmp	xmrig
behavioral2/memory/4384-340-0x00007FF6C2410000-0x00007FF6C2802000-memory.dmp	xmrig
behavioral2/memory/4524-301-0x00007FF727060000-0x00007FF727452000-memory.dmp	xmrig
behavioral2/memory/3448-159-0x00007FF71B540000-0x00007FF71B932000-memory.dmp	xmrig
behavioral2/memory/3572-167-0x00007FF6C6E00000-0x00007FF6C71F2000-memory.dmp	xmrig
behavioral2/memory/4912-4560-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp	xmrig
behavioral2/memory/4524-4559-0x00007FF727060000-0x00007FF727452000-memory.dmp	xmrig
behavioral2/memory/3700-4603-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp	xmrig
behavioral2/memory/2064-4600-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp	xmrig
behavioral2/memory/3772-4586-0x00007FF7BFBA0000-0x00007FF7BFF92000-memory.dmp	xmrig
behavioral2/memory/1204-4596-0x00007FF719DB0000-0x00007FF71A1A2000-memory.dmp	xmrig
behavioral2/memory/332-4585-0x00007FF6E8FE0000-0x00007FF6E93D2000-memory.dmp	xmrig
behavioral2/memory/4748-4635-0x00007FF7F68A0000-0x00007FF7F6C92000-memory.dmp	xmrig
behavioral2/memory/1012-4630-0x00007FF6F6820000-0x00007FF6F6C12000-memory.dmp	xmrig
behavioral2/memory/4352-4656-0x00007FF758880000-0x00007FF758C72000-memory.dmp	xmrig
behavioral2/memory/2368-4626-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	xmrig
behavioral2/memory/4384-4604-0x00007FF6C2410000-0x00007FF6C2802000-memory.dmp	xmrig
behavioral2/memory/4572-4602-0x00007FF66A420000-0x00007FF66A812000-memory.dmp	xmrig
behavioral2/memory/3448-4598-0x00007FF71B540000-0x00007FF71B932000-memory.dmp	xmrig
behavioral2/memory/1172-4670-0x00007FF6FC120000-0x00007FF6FC512000-memory.dmp	xmrig
behavioral2/memory/4536-4663-0x00007FF659420000-0x00007FF659812000-memory.dmp	xmrig
behavioral2/memory/4828-4658-0x00007FF6E9BE0000-0x00007FF6E9FD2000-memory.dmp	xmrig
behavioral2/memory/3732-4952-0x00007FF7C0E60000-0x00007FF7C1252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3700	XjndBLF.exe
332	XbwptQg.exe
3448	qAfZtMo.exe
3572	MdTEKHd.exe
4912	QkPbquZ.exe
3772	vyyEDAh.exe
4524	UDaHOKZ.exe
4384	VUdIayt.exe
4352	UCGciTF.exe
3884	TYJyxGo.exe
844	WHpLkXI.exe
1172	HIPQLVi.exe
2064	JsQkNnS.exe
1204	vjUkcha.exe
3872	bwacqPP.exe
4572	gZiPymX.exe
2368	WeuSmSg.exe
1012	kvyCMJL.exe
4748	ZpFgAdU.exe
4828	gPTnCfW.exe
4536	axvgxHL.exe
2256	zETDmVx.exe
3048	WOWCeFa.exe
396	NPggetR.exe
2372	fODKJjq.exe
3228	rJEJRhd.exe
3892	fdTsCXo.exe
1600	rANzYvv.exe
3516	oLYEWFI.exe
2700	eZgGQMR.exe
2508	oHpOExG.exe
2972	EAHodlR.exe
4852	LrBFNMQ.exe
3024	XMFenhb.exe
624	BuUBDtI.exe
4772	GSzLONE.exe
892	nWEeGHF.exe
936	CWXEhXl.exe
4196	AGybWlk.exe
1212	VMESmQz.exe
4420	QxcYMJs.exe
2068	mNhtmHr.exe
1224	zOkcQoy.exe
4012	KQBIZcS.exe
4100	fZrzgXc.exe
2280	hIRpykE.exe
3828	YOezCqI.exe
1380	IEnrwcl.exe
2232	Tctdkmj.exe
2120	blBEOzd.exe
972	KCMfwbk.exe
2236	CzkwKbp.exe
4532	ziXEGPN.exe
4004	kpqMDVd.exe
4428	JSKiVjo.exe
944	oaOnbuW.exe
3956	hOylBbu.exe
4988	rbxyBFc.exe
1764	gQLShhi.exe
1516	gxCHCFX.exe
432	hhJgzZq.exe
4796	FgoZDNr.exe
1088	ZobQvXN.exe
4440	ntPZNsI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3732-0-0x00007FF7C0E60000-0x00007FF7C1252000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-6.dat	upx
behavioral2/files/0x000a000000023bb4-23.dat	upx
behavioral2/files/0x000a000000023bc3-138.dat	upx
behavioral2/memory/4912-231-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-211.dat	upx
behavioral2/files/0x000a000000023bc2-194.dat	upx
behavioral2/files/0x000a000000023bd3-192.dat	upx
behavioral2/files/0x000a000000023bc9-188.dat	upx
behavioral2/files/0x000a000000023bd2-186.dat	upx
behavioral2/files/0x000a000000023bd1-184.dat	upx
behavioral2/files/0x000a000000023bc1-181.dat	upx
behavioral2/files/0x000a000000023bd0-180.dat	upx
behavioral2/files/0x000a000000023bcf-178.dat	upx
behavioral2/files/0x000a000000023bc0-172.dat	upx
behavioral2/files/0x000a000000023bbf-169.dat	upx
behavioral2/memory/3772-262-0x00007FF7BFBA0000-0x00007FF7BFF92000-memory.dmp	upx
behavioral2/memory/844-370-0x00007FF74F280000-0x00007FF74F672000-memory.dmp	upx
behavioral2/memory/1172-425-0x00007FF6FC120000-0x00007FF6FC512000-memory.dmp	upx
behavioral2/memory/1012-451-0x00007FF6F6820000-0x00007FF6F6C12000-memory.dmp	upx
behavioral2/memory/1204-456-0x00007FF719DB0000-0x00007FF71A1A2000-memory.dmp	upx
behavioral2/memory/3700-455-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp	upx
behavioral2/memory/4536-454-0x00007FF659420000-0x00007FF659812000-memory.dmp	upx
behavioral2/memory/4828-453-0x00007FF6E9BE0000-0x00007FF6E9FD2000-memory.dmp	upx
behavioral2/memory/4748-452-0x00007FF7F68A0000-0x00007FF7F6C92000-memory.dmp	upx
behavioral2/memory/2368-450-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp	upx
behavioral2/memory/4572-449-0x00007FF66A420000-0x00007FF66A812000-memory.dmp	upx
behavioral2/memory/3872-445-0x00007FF788240000-0x00007FF788632000-memory.dmp	upx
behavioral2/memory/2064-444-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp	upx
behavioral2/memory/3884-346-0x00007FF6A29A0000-0x00007FF6A2D92000-memory.dmp	upx
behavioral2/memory/4352-341-0x00007FF758880000-0x00007FF758C72000-memory.dmp	upx
behavioral2/memory/4384-340-0x00007FF6C2410000-0x00007FF6C2802000-memory.dmp	upx
behavioral2/memory/4524-301-0x00007FF727060000-0x00007FF727452000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-163.dat	upx
behavioral2/memory/3448-159-0x00007FF71B540000-0x00007FF71B932000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-152.dat	upx
behavioral2/files/0x000a000000023bcc-146.dat	upx
behavioral2/files/0x000a000000023bcb-145.dat	upx
behavioral2/files/0x000a000000023bca-141.dat	upx
behavioral2/files/0x000a000000023bba-130.dat	upx
behavioral2/files/0x000a000000023bb9-122.dat	upx
behavioral2/files/0x000a000000023bb8-119.dat	upx
behavioral2/files/0x000a000000023bc8-118.dat	upx
behavioral2/files/0x000a000000023bb7-114.dat	upx
behavioral2/memory/3572-167-0x00007FF6C6E00000-0x00007FF6C71F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-109.dat	upx
behavioral2/files/0x000a000000023bc5-104.dat	upx
behavioral2/files/0x0031000000023bbc-103.dat	upx
behavioral2/files/0x0031000000023bbd-102.dat	upx
behavioral2/memory/332-101-0x00007FF6E8FE0000-0x00007FF6E93D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-97.dat	upx
behavioral2/files/0x000a000000023bb6-96.dat	upx
behavioral2/files/0x0031000000023bbe-84.dat	upx
behavioral2/files/0x000a000000023bc7-115.dat	upx
behavioral2/files/0x000a000000023bbb-69.dat	upx
behavioral2/files/0x000a000000023bb0-57.dat	upx
behavioral2/files/0x000a000000023bb3-50.dat	upx
behavioral2/files/0x000a000000023bb5-28.dat	upx
behavioral2/files/0x000a000000023bb2-27.dat	upx
behavioral2/files/0x000b000000023bac-20.dat	upx
behavioral2/memory/4912-4560-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp	upx
behavioral2/memory/4524-4559-0x00007FF727060000-0x00007FF727452000-memory.dmp	upx
behavioral2/memory/3700-4603-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp	upx
behavioral2/memory/2064-4600-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RBEfnoD.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\IEGClpe.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\fDTOqLF.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\EagievC.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\lVVkaWa.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\SgIQwuP.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\LCVWnao.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jXxJmuT.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\GAfxCIJ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\CsNzHqX.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\lXWKySR.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ZANTSYJ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\IQcQdmA.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\yLwldsM.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\GAFXgvm.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\havKHNV.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\NDOVqDs.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ELuzWcJ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ltFCsEd.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\aNnguAt.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ZbTUdnj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\wqvKqXr.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jTFqhHv.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\XnzdAXm.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\GnOFzCv.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\HGKYOfy.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\JkTLlDG.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\MUOhbLy.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\voiYCcE.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\BjLtsQz.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\efBOqqB.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\qAwBcll.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\zFNlYSj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\YIegWKO.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\fvbiNSw.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jgJGvEn.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\dlWgmoz.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\WNqiLOH.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\qVzCIhK.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\wCiKYHu.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ESQBHbU.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\RDySZsb.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\oNvJkEj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\Islaase.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\BffEcDy.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\svUcRaf.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\SzMtjwg.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\fXSEDau.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\hKcQbGU.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\vYjYLrQ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\biOfjFw.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\nRIxLOZ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\btwapQM.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\PYKpUDu.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\wnOvdCl.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\CAmnJsP.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\VAHVHJk.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jWXfasO.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\QbgFFYm.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\VyFAAyH.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\fgCbOVp.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\TEroYpA.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\XqFrfEY.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\yGXgrXG.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Token: SeDebugPrivilege	3020	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3020	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	84
PID 3732 wrote to memory of 3020	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	84
PID 3732 wrote to memory of 3700	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	85
PID 3732 wrote to memory of 3700	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	85
PID 3732 wrote to memory of 332	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	86
PID 3732 wrote to memory of 332	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	86
PID 3732 wrote to memory of 3448	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	87
PID 3732 wrote to memory of 3448	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	87
PID 3732 wrote to memory of 3572	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	88
PID 3732 wrote to memory of 3572	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	88
PID 3732 wrote to memory of 4912	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	89
PID 3732 wrote to memory of 4912	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	89
PID 3732 wrote to memory of 3772	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	90
PID 3732 wrote to memory of 3772	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	90
PID 3732 wrote to memory of 4524	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	91
PID 3732 wrote to memory of 4524	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	91
PID 3732 wrote to memory of 4384	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	92
PID 3732 wrote to memory of 4384	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	92
PID 3732 wrote to memory of 4352	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	93
PID 3732 wrote to memory of 4352	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	93
PID 3732 wrote to memory of 3884	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	94
PID 3732 wrote to memory of 3884	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	94
PID 3732 wrote to memory of 844	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	95
PID 3732 wrote to memory of 844	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	95
PID 3732 wrote to memory of 1172	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	96
PID 3732 wrote to memory of 1172	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	96
PID 3732 wrote to memory of 2064	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	97
PID 3732 wrote to memory of 2064	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	97
PID 3732 wrote to memory of 1204	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	98
PID 3732 wrote to memory of 1204	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	98
PID 3732 wrote to memory of 3872	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	99
PID 3732 wrote to memory of 3872	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	99
PID 3732 wrote to memory of 4572	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	100
PID 3732 wrote to memory of 4572	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	100
PID 3732 wrote to memory of 2368	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	101
PID 3732 wrote to memory of 2368	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	101
PID 3732 wrote to memory of 1012	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	102
PID 3732 wrote to memory of 1012	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	102
PID 3732 wrote to memory of 4748	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	103
PID 3732 wrote to memory of 4748	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	103
PID 3732 wrote to memory of 4828	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	104
PID 3732 wrote to memory of 4828	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	104
PID 3732 wrote to memory of 3892	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	105
PID 3732 wrote to memory of 3892	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	105
PID 3732 wrote to memory of 4536	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	106
PID 3732 wrote to memory of 4536	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	106
PID 3732 wrote to memory of 2256	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	107
PID 3732 wrote to memory of 2256	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	107
PID 3732 wrote to memory of 3048	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	108
PID 3732 wrote to memory of 3048	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	108
PID 3732 wrote to memory of 396	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	109
PID 3732 wrote to memory of 396	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	109
PID 3732 wrote to memory of 2372	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	110
PID 3732 wrote to memory of 2372	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	110
PID 3732 wrote to memory of 3228	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	111
PID 3732 wrote to memory of 3228	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	111
PID 3732 wrote to memory of 1600	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	112
PID 3732 wrote to memory of 1600	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	112
PID 3732 wrote to memory of 3516	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	113
PID 3732 wrote to memory of 3516	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	113
PID 3732 wrote to memory of 2700	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	114
PID 3732 wrote to memory of 2700	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	114
PID 3732 wrote to memory of 2508	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	115
PID 3732 wrote to memory of 2508	3732	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System\XjndBLF.exe
  C:\Windows\System\XjndBLF.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\XbwptQg.exe
  C:\Windows\System\XbwptQg.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\qAfZtMo.exe
  C:\Windows\System\qAfZtMo.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\MdTEKHd.exe
  C:\Windows\System\MdTEKHd.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\QkPbquZ.exe
  C:\Windows\System\QkPbquZ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\vyyEDAh.exe
  C:\Windows\System\vyyEDAh.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\UDaHOKZ.exe
  C:\Windows\System\UDaHOKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\VUdIayt.exe
  C:\Windows\System\VUdIayt.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\UCGciTF.exe
  C:\Windows\System\UCGciTF.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\TYJyxGo.exe
  C:\Windows\System\TYJyxGo.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\WHpLkXI.exe
  C:\Windows\System\WHpLkXI.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\HIPQLVi.exe
  C:\Windows\System\HIPQLVi.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\JsQkNnS.exe
  C:\Windows\System\JsQkNnS.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\vjUkcha.exe
  C:\Windows\System\vjUkcha.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\bwacqPP.exe
  C:\Windows\System\bwacqPP.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\gZiPymX.exe
  C:\Windows\System\gZiPymX.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\WeuSmSg.exe
  C:\Windows\System\WeuSmSg.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\kvyCMJL.exe
  C:\Windows\System\kvyCMJL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ZpFgAdU.exe
  C:\Windows\System\ZpFgAdU.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\gPTnCfW.exe
  C:\Windows\System\gPTnCfW.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\fdTsCXo.exe
  C:\Windows\System\fdTsCXo.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\axvgxHL.exe
  C:\Windows\System\axvgxHL.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\zETDmVx.exe
  C:\Windows\System\zETDmVx.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WOWCeFa.exe
  C:\Windows\System\WOWCeFa.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\NPggetR.exe
  C:\Windows\System\NPggetR.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\fODKJjq.exe
  C:\Windows\System\fODKJjq.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\rJEJRhd.exe
  C:\Windows\System\rJEJRhd.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\rANzYvv.exe
  C:\Windows\System\rANzYvv.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\oLYEWFI.exe
  C:\Windows\System\oLYEWFI.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\eZgGQMR.exe
  C:\Windows\System\eZgGQMR.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\oHpOExG.exe
  C:\Windows\System\oHpOExG.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\EAHodlR.exe
  C:\Windows\System\EAHodlR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\LrBFNMQ.exe
  C:\Windows\System\LrBFNMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\XMFenhb.exe
  C:\Windows\System\XMFenhb.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\BuUBDtI.exe
  C:\Windows\System\BuUBDtI.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\GSzLONE.exe
  C:\Windows\System\GSzLONE.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\nWEeGHF.exe
  C:\Windows\System\nWEeGHF.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\CWXEhXl.exe
  C:\Windows\System\CWXEhXl.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\AGybWlk.exe
  C:\Windows\System\AGybWlk.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\VMESmQz.exe
  C:\Windows\System\VMESmQz.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\QxcYMJs.exe
  C:\Windows\System\QxcYMJs.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\mNhtmHr.exe
  C:\Windows\System\mNhtmHr.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\zOkcQoy.exe
  C:\Windows\System\zOkcQoy.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\KQBIZcS.exe
  C:\Windows\System\KQBIZcS.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\fZrzgXc.exe
  C:\Windows\System\fZrzgXc.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\gxCHCFX.exe
  C:\Windows\System\gxCHCFX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\hIRpykE.exe
  C:\Windows\System\hIRpykE.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\YOezCqI.exe
  C:\Windows\System\YOezCqI.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\IEnrwcl.exe
  C:\Windows\System\IEnrwcl.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\Tctdkmj.exe
  C:\Windows\System\Tctdkmj.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\blBEOzd.exe
  C:\Windows\System\blBEOzd.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\KCMfwbk.exe
  C:\Windows\System\KCMfwbk.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\CzkwKbp.exe
  C:\Windows\System\CzkwKbp.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ziXEGPN.exe
  C:\Windows\System\ziXEGPN.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\kpqMDVd.exe
  C:\Windows\System\kpqMDVd.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\JSKiVjo.exe
  C:\Windows\System\JSKiVjo.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\oaOnbuW.exe
  C:\Windows\System\oaOnbuW.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\hOylBbu.exe
  C:\Windows\System\hOylBbu.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\rbxyBFc.exe
  C:\Windows\System\rbxyBFc.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\gQLShhi.exe
  C:\Windows\System\gQLShhi.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\hhJgzZq.exe
  C:\Windows\System\hhJgzZq.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\FgoZDNr.exe
  C:\Windows\System\FgoZDNr.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ZobQvXN.exe
  C:\Windows\System\ZobQvXN.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\ntPZNsI.exe
  C:\Windows\System\ntPZNsI.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\oDvAiEF.exe
  C:\Windows\System\oDvAiEF.exe
  2⤵
  PID:3868
- C:\Windows\System\JDLoSDg.exe
  C:\Windows\System\JDLoSDg.exe
  2⤵
  PID:2564
- C:\Windows\System\NPiGzWR.exe
  C:\Windows\System\NPiGzWR.exe
  2⤵
  PID:2724
- C:\Windows\System\qGnTnhk.exe
  C:\Windows\System\qGnTnhk.exe
  2⤵
  PID:4508
- C:\Windows\System\Ehhhnxl.exe
  C:\Windows\System\Ehhhnxl.exe
  2⤵
  PID:4740
- C:\Windows\System\XdXhpNf.exe
  C:\Windows\System\XdXhpNf.exe
  2⤵
  PID:2060
- C:\Windows\System\YAeYrOw.exe
  C:\Windows\System\YAeYrOw.exe
  2⤵
  PID:1072
- C:\Windows\System\RLlmjBM.exe
  C:\Windows\System\RLlmjBM.exe
  2⤵
  PID:3224
- C:\Windows\System\HdcfhON.exe
  C:\Windows\System\HdcfhON.exe
  2⤵
  PID:1776
- C:\Windows\System\TNIBZSe.exe
  C:\Windows\System\TNIBZSe.exe
  2⤵
  PID:768
- C:\Windows\System\NbypWRc.exe
  C:\Windows\System\NbypWRc.exe
  2⤵
  PID:4248
- C:\Windows\System\FKzNDUu.exe
  C:\Windows\System\FKzNDUu.exe
  2⤵
  PID:1292
- C:\Windows\System\TZjNJwI.exe
  C:\Windows\System\TZjNJwI.exe
  2⤵
  PID:4320
- C:\Windows\System\oLZQLvH.exe
  C:\Windows\System\oLZQLvH.exe
  2⤵
  PID:5008
- C:\Windows\System\rNyCWSo.exe
  C:\Windows\System\rNyCWSo.exe
  2⤵
  PID:644
- C:\Windows\System\qfJMpjo.exe
  C:\Windows\System\qfJMpjo.exe
  2⤵
  PID:4920
- C:\Windows\System\mngQaXu.exe
  C:\Windows\System\mngQaXu.exe
  2⤵
  PID:4236
- C:\Windows\System\FdjKZma.exe
  C:\Windows\System\FdjKZma.exe
  2⤵
  PID:3632
- C:\Windows\System\dRFpoDV.exe
  C:\Windows\System\dRFpoDV.exe
  2⤵
  PID:1236
- C:\Windows\System\zqnXXvF.exe
  C:\Windows\System\zqnXXvF.exe
  2⤵
  PID:4240
- C:\Windows\System\UxrWdGx.exe
  C:\Windows\System\UxrWdGx.exe
  2⤵
  PID:2744
- C:\Windows\System\cdhQSzr.exe
  C:\Windows\System\cdhQSzr.exe
  2⤵
  PID:4308
- C:\Windows\System\zWqkqBA.exe
  C:\Windows\System\zWqkqBA.exe
  2⤵
  PID:4516
- C:\Windows\System\hZwnTyQ.exe
  C:\Windows\System\hZwnTyQ.exe
  2⤵
  PID:2392
- C:\Windows\System\DXVLtYH.exe
  C:\Windows\System\DXVLtYH.exe
  2⤵
  PID:5140
- C:\Windows\System\UvFTGGT.exe
  C:\Windows\System\UvFTGGT.exe
  2⤵
  PID:5168
- C:\Windows\System\Opodcul.exe
  C:\Windows\System\Opodcul.exe
  2⤵
  PID:5184
- C:\Windows\System\gQOlIOf.exe
  C:\Windows\System\gQOlIOf.exe
  2⤵
  PID:5208
- C:\Windows\System\hLNqFQh.exe
  C:\Windows\System\hLNqFQh.exe
  2⤵
  PID:5244
- C:\Windows\System\bzMlreB.exe
  C:\Windows\System\bzMlreB.exe
  2⤵
  PID:5264
- C:\Windows\System\LRWrMfd.exe
  C:\Windows\System\LRWrMfd.exe
  2⤵
  PID:5292
- C:\Windows\System\HsgRfPM.exe
  C:\Windows\System\HsgRfPM.exe
  2⤵
  PID:5316
- C:\Windows\System\fPPgWiq.exe
  C:\Windows\System\fPPgWiq.exe
  2⤵
  PID:5480
- C:\Windows\System\JEOmJWb.exe
  C:\Windows\System\JEOmJWb.exe
  2⤵
  PID:5524
- C:\Windows\System\gjGUuUA.exe
  C:\Windows\System\gjGUuUA.exe
  2⤵
  PID:5588
- C:\Windows\System\PuEuOnd.exe
  C:\Windows\System\PuEuOnd.exe
  2⤵
  PID:5604
- C:\Windows\System\haSvhVB.exe
  C:\Windows\System\haSvhVB.exe
  2⤵
  PID:5624
- C:\Windows\System\BAdtnRl.exe
  C:\Windows\System\BAdtnRl.exe
  2⤵
  PID:5648
- C:\Windows\System\sVVyIUM.exe
  C:\Windows\System\sVVyIUM.exe
  2⤵
  PID:5728
- C:\Windows\System\hXCNgdx.exe
  C:\Windows\System\hXCNgdx.exe
  2⤵
  PID:5748
- C:\Windows\System\chWAlOE.exe
  C:\Windows\System\chWAlOE.exe
  2⤵
  PID:5772
- C:\Windows\System\wcgjMTP.exe
  C:\Windows\System\wcgjMTP.exe
  2⤵
  PID:5812
- C:\Windows\System\rhllZqf.exe
  C:\Windows\System\rhllZqf.exe
  2⤵
  PID:5828
- C:\Windows\System\gMIojeC.exe
  C:\Windows\System\gMIojeC.exe
  2⤵
  PID:5848
- C:\Windows\System\dDoRQil.exe
  C:\Windows\System\dDoRQil.exe
  2⤵
  PID:5864
- C:\Windows\System\aSTkThM.exe
  C:\Windows\System\aSTkThM.exe
  2⤵
  PID:5888
- C:\Windows\System\opqYnEg.exe
  C:\Windows\System\opqYnEg.exe
  2⤵
  PID:5912
- C:\Windows\System\nnSjUPa.exe
  C:\Windows\System\nnSjUPa.exe
  2⤵
  PID:5928
- C:\Windows\System\LNfBMJF.exe
  C:\Windows\System\LNfBMJF.exe
  2⤵
  PID:5952
- C:\Windows\System\ErYKehJ.exe
  C:\Windows\System\ErYKehJ.exe
  2⤵
  PID:5980
- C:\Windows\System\nifCuWV.exe
  C:\Windows\System\nifCuWV.exe
  2⤵
  PID:6000
- C:\Windows\System\AAtDdHt.exe
  C:\Windows\System\AAtDdHt.exe
  2⤵
  PID:6020
- C:\Windows\System\BSwakCv.exe
  C:\Windows\System\BSwakCv.exe
  2⤵
  PID:6048
- C:\Windows\System\JZSIXYL.exe
  C:\Windows\System\JZSIXYL.exe
  2⤵
  PID:6064
- C:\Windows\System\UxsLwIo.exe
  C:\Windows\System\UxsLwIo.exe
  2⤵
  PID:6080
- C:\Windows\System\UpTwTGR.exe
  C:\Windows\System\UpTwTGR.exe
  2⤵
  PID:6096
- C:\Windows\System\bQusQvl.exe
  C:\Windows\System\bQusQvl.exe
  2⤵
  PID:6112
- C:\Windows\System\jBsaQFB.exe
  C:\Windows\System\jBsaQFB.exe
  2⤵
  PID:6128
- C:\Windows\System\DzCByBV.exe
  C:\Windows\System\DzCByBV.exe
  2⤵
  PID:2228
- C:\Windows\System\KBsejjS.exe
  C:\Windows\System\KBsejjS.exe
  2⤵
  PID:920
- C:\Windows\System\uagTjqz.exe
  C:\Windows\System\uagTjqz.exe
  2⤵
  PID:4848
- C:\Windows\System\OMDzYFr.exe
  C:\Windows\System\OMDzYFr.exe
  2⤵
  PID:1348
- C:\Windows\System\eiBluKL.exe
  C:\Windows\System\eiBluKL.exe
  2⤵
  PID:3488
- C:\Windows\System\pYcFuGE.exe
  C:\Windows\System\pYcFuGE.exe
  2⤵
  PID:3672
- C:\Windows\System\DfavHyB.exe
  C:\Windows\System\DfavHyB.exe
  2⤵
  PID:2244
- C:\Windows\System\sUTcWmH.exe
  C:\Windows\System\sUTcWmH.exe
  2⤵
  PID:5872
- C:\Windows\System\wkTGvTk.exe
  C:\Windows\System\wkTGvTk.exe
  2⤵
  PID:5948
- C:\Windows\System\yxOyfoX.exe
  C:\Windows\System\yxOyfoX.exe
  2⤵
  PID:6016
- C:\Windows\System\rEEdVin.exe
  C:\Windows\System\rEEdVin.exe
  2⤵
  PID:4888
- C:\Windows\System\VPznfbV.exe
  C:\Windows\System\VPznfbV.exe
  2⤵
  PID:1984
- C:\Windows\System\ZggZDvU.exe
  C:\Windows\System\ZggZDvU.exe
  2⤵
  PID:5252
- C:\Windows\System\FIOTOoq.exe
  C:\Windows\System\FIOTOoq.exe
  2⤵
  PID:5192
- C:\Windows\System\QnRNApF.exe
  C:\Windows\System\QnRNApF.exe
  2⤵
  PID:5488
- C:\Windows\System\sbXnPte.exe
  C:\Windows\System\sbXnPte.exe
  2⤵
  PID:5640
- C:\Windows\System\XtgkaaT.exe
  C:\Windows\System\XtgkaaT.exe
  2⤵
  PID:5692
- C:\Windows\System\MElDXUv.exe
  C:\Windows\System\MElDXUv.exe
  2⤵
  PID:5780
- C:\Windows\System\FbOkiNl.exe
  C:\Windows\System\FbOkiNl.exe
  2⤵
  PID:5908
- C:\Windows\System\rWpXCmY.exe
  C:\Windows\System\rWpXCmY.exe
  2⤵
  PID:5996
- C:\Windows\System\gigdbGK.exe
  C:\Windows\System\gigdbGK.exe
  2⤵
  PID:2460
- C:\Windows\System\vapziYn.exe
  C:\Windows\System\vapziYn.exe
  2⤵
  PID:4996
- C:\Windows\System\PcQiGcA.exe
  C:\Windows\System\PcQiGcA.exe
  2⤵
  PID:2172
- C:\Windows\System\nRkJbmv.exe
  C:\Windows\System\nRkJbmv.exe
  2⤵
  PID:3968
- C:\Windows\System\xzRotwJ.exe
  C:\Windows\System\xzRotwJ.exe
  2⤵
  PID:3820
- C:\Windows\System\HkJTszd.exe
  C:\Windows\System\HkJTszd.exe
  2⤵
  PID:1080
- C:\Windows\System\mKvPqsJ.exe
  C:\Windows\System\mKvPqsJ.exe
  2⤵
  PID:5044
- C:\Windows\System\xguUzpv.exe
  C:\Windows\System\xguUzpv.exe
  2⤵
  PID:4820
- C:\Windows\System\wgnVKGu.exe
  C:\Windows\System\wgnVKGu.exe
  2⤵
  PID:1352
- C:\Windows\System\MEnlRmg.exe
  C:\Windows\System\MEnlRmg.exe
  2⤵
  PID:1856
- C:\Windows\System\IPolUov.exe
  C:\Windows\System\IPolUov.exe
  2⤵
  PID:2012
- C:\Windows\System\UNMzIEg.exe
  C:\Windows\System\UNMzIEg.exe
  2⤵
  PID:872
- C:\Windows\System\gfhvAGo.exe
  C:\Windows\System\gfhvAGo.exe
  2⤵
  PID:5376
- C:\Windows\System\XbnXcrT.exe
  C:\Windows\System\XbnXcrT.exe
  2⤵
  PID:5704
- C:\Windows\System\qJuTCGs.exe
  C:\Windows\System\qJuTCGs.exe
  2⤵
  PID:5288
- C:\Windows\System\dYipqxt.exe
  C:\Windows\System\dYipqxt.exe
  2⤵
  PID:6044
- C:\Windows\System\ueCkTzV.exe
  C:\Windows\System\ueCkTzV.exe
  2⤵
  PID:2792
- C:\Windows\System\rVdliJd.exe
  C:\Windows\System\rVdliJd.exe
  2⤵
  PID:5568
- C:\Windows\System\ZLjEqkt.exe
  C:\Windows\System\ZLjEqkt.exe
  2⤵
  PID:5220
- C:\Windows\System\wxYgdes.exe
  C:\Windows\System\wxYgdes.exe
  2⤵
  PID:5972
- C:\Windows\System\WUZJDbi.exe
  C:\Windows\System\WUZJDbi.exe
  2⤵
  PID:848
- C:\Windows\System\udkJyHL.exe
  C:\Windows\System\udkJyHL.exe
  2⤵
  PID:3036
- C:\Windows\System\qbVGOOh.exe
  C:\Windows\System\qbVGOOh.exe
  2⤵
  PID:3796
- C:\Windows\System\uaZOMwq.exe
  C:\Windows\System\uaZOMwq.exe
  2⤵
  PID:640
- C:\Windows\System\fCzpGTU.exe
  C:\Windows\System\fCzpGTU.exe
  2⤵
  PID:6156
- C:\Windows\System\ZMlnodG.exe
  C:\Windows\System\ZMlnodG.exe
  2⤵
  PID:6188
- C:\Windows\System\ilSReYk.exe
  C:\Windows\System\ilSReYk.exe
  2⤵
  PID:6208
- C:\Windows\System\GNkAFBs.exe
  C:\Windows\System\GNkAFBs.exe
  2⤵
  PID:6236
- C:\Windows\System\LGbcEzY.exe
  C:\Windows\System\LGbcEzY.exe
  2⤵
  PID:6256
- C:\Windows\System\gKVgIds.exe
  C:\Windows\System\gKVgIds.exe
  2⤵
  PID:6272
- C:\Windows\System\rWtVDUN.exe
  C:\Windows\System\rWtVDUN.exe
  2⤵
  PID:6308
- C:\Windows\System\OrymAGq.exe
  C:\Windows\System\OrymAGq.exe
  2⤵
  PID:6324
- C:\Windows\System\EYhWWZD.exe
  C:\Windows\System\EYhWWZD.exe
  2⤵
  PID:6348
- C:\Windows\System\bcLhgrL.exe
  C:\Windows\System\bcLhgrL.exe
  2⤵
  PID:6372
- C:\Windows\System\fdtPzXC.exe
  C:\Windows\System\fdtPzXC.exe
  2⤵
  PID:6404
- C:\Windows\System\pIcGxOV.exe
  C:\Windows\System\pIcGxOV.exe
  2⤵
  PID:6424
- C:\Windows\System\qtKmUEV.exe
  C:\Windows\System\qtKmUEV.exe
  2⤵
  PID:6444
- C:\Windows\System\bqlbCAr.exe
  C:\Windows\System\bqlbCAr.exe
  2⤵
  PID:6464
- C:\Windows\System\JJkpnwk.exe
  C:\Windows\System\JJkpnwk.exe
  2⤵
  PID:6492
- C:\Windows\System\sMFUfiK.exe
  C:\Windows\System\sMFUfiK.exe
  2⤵
  PID:6512
- C:\Windows\System\qMUKywv.exe
  C:\Windows\System\qMUKywv.exe
  2⤵
  PID:6536
- C:\Windows\System\ChEriLt.exe
  C:\Windows\System\ChEriLt.exe
  2⤵
  PID:6564
- C:\Windows\System\URVstdM.exe
  C:\Windows\System\URVstdM.exe
  2⤵
  PID:6588
- C:\Windows\System\KCTJxyr.exe
  C:\Windows\System\KCTJxyr.exe
  2⤵
  PID:6608
- C:\Windows\System\LzTiVIB.exe
  C:\Windows\System\LzTiVIB.exe
  2⤵
  PID:6632
- C:\Windows\System\WmwmEOu.exe
  C:\Windows\System\WmwmEOu.exe
  2⤵
  PID:6656
- C:\Windows\System\boYNFGF.exe
  C:\Windows\System\boYNFGF.exe
  2⤵
  PID:6680
- C:\Windows\System\FiNEwjk.exe
  C:\Windows\System\FiNEwjk.exe
  2⤵
  PID:6696
- C:\Windows\System\IOuWJKl.exe
  C:\Windows\System\IOuWJKl.exe
  2⤵
  PID:6720
- C:\Windows\System\uoaUcHW.exe
  C:\Windows\System\uoaUcHW.exe
  2⤵
  PID:6744
- C:\Windows\System\QeQOcJK.exe
  C:\Windows\System\QeQOcJK.exe
  2⤵
  PID:6764
- C:\Windows\System\NxPTuLs.exe
  C:\Windows\System\NxPTuLs.exe
  2⤵
  PID:6784
- C:\Windows\System\uKoAsgC.exe
  C:\Windows\System\uKoAsgC.exe
  2⤵
  PID:6808
- C:\Windows\System\HIDKjpA.exe
  C:\Windows\System\HIDKjpA.exe
  2⤵
  PID:6832
- C:\Windows\System\iLjXdvM.exe
  C:\Windows\System\iLjXdvM.exe
  2⤵
  PID:6848
- C:\Windows\System\kMJkkXI.exe
  C:\Windows\System\kMJkkXI.exe
  2⤵
  PID:6880
- C:\Windows\System\kDtuaNk.exe
  C:\Windows\System\kDtuaNk.exe
  2⤵
  PID:6904
- C:\Windows\System\YRAunSb.exe
  C:\Windows\System\YRAunSb.exe
  2⤵
  PID:6920
- C:\Windows\System\yEogfii.exe
  C:\Windows\System\yEogfii.exe
  2⤵
  PID:6948
- C:\Windows\System\UuPiuHl.exe
  C:\Windows\System\UuPiuHl.exe
  2⤵
  PID:6972
- C:\Windows\System\FIquDLt.exe
  C:\Windows\System\FIquDLt.exe
  2⤵
  PID:6992
- C:\Windows\System\NcFJiaI.exe
  C:\Windows\System\NcFJiaI.exe
  2⤵
  PID:7016
- C:\Windows\System\vXmeRlk.exe
  C:\Windows\System\vXmeRlk.exe
  2⤵
  PID:7040
- C:\Windows\System\fwYncWu.exe
  C:\Windows\System\fwYncWu.exe
  2⤵
  PID:7060
- C:\Windows\System\nBFnaME.exe
  C:\Windows\System\nBFnaME.exe
  2⤵
  PID:7084
- C:\Windows\System\taOERAR.exe
  C:\Windows\System\taOERAR.exe
  2⤵
  PID:7108
- C:\Windows\System\WgkpRmL.exe
  C:\Windows\System\WgkpRmL.exe
  2⤵
  PID:7128
- C:\Windows\System\PejBXVD.exe
  C:\Windows\System\PejBXVD.exe
  2⤵
  PID:7148
- C:\Windows\System\AfaeUos.exe
  C:\Windows\System\AfaeUos.exe
  2⤵
  PID:5300
- C:\Windows\System\ZCWThZp.exe
  C:\Windows\System\ZCWThZp.exe
  2⤵
  PID:5900
- C:\Windows\System\awnOUdT.exe
  C:\Windows\System\awnOUdT.exe
  2⤵
  PID:4124
- C:\Windows\System\fSWwfsx.exe
  C:\Windows\System\fSWwfsx.exe
  2⤵
  PID:6268
- C:\Windows\System\iVvGNsC.exe
  C:\Windows\System\iVvGNsC.exe
  2⤵
  PID:8
- C:\Windows\System\KhPWZaT.exe
  C:\Windows\System\KhPWZaT.exe
  2⤵
  PID:2860
- C:\Windows\System\WKakytm.exe
  C:\Windows\System\WKakytm.exe
  2⤵
  PID:6368
- C:\Windows\System\klzlvhT.exe
  C:\Windows\System\klzlvhT.exe
  2⤵
  PID:6412
- C:\Windows\System\WeLHWFR.exe
  C:\Windows\System\WeLHWFR.exe
  2⤵
  PID:6248
- C:\Windows\System\rdCxHoU.exe
  C:\Windows\System\rdCxHoU.exe
  2⤵
  PID:6460
- C:\Windows\System\LoYqwQq.exe
  C:\Windows\System\LoYqwQq.exe
  2⤵
  PID:6476
- C:\Windows\System\JAshwZO.exe
  C:\Windows\System\JAshwZO.exe
  2⤵
  PID:6556
- C:\Windows\System\kywiJcV.exe
  C:\Windows\System\kywiJcV.exe
  2⤵
  PID:6604
- C:\Windows\System\isjODqU.exe
  C:\Windows\System\isjODqU.exe
  2⤵
  PID:6224
- C:\Windows\System\cFuDPsM.exe
  C:\Windows\System\cFuDPsM.exe
  2⤵
  PID:6752
- C:\Windows\System\NgHEWld.exe
  C:\Windows\System\NgHEWld.exe
  2⤵
  PID:6804
- C:\Windows\System\caETdJw.exe
  C:\Windows\System\caETdJw.exe
  2⤵
  PID:6872
- C:\Windows\System\eLTIlQh.exe
  C:\Windows\System\eLTIlQh.exe
  2⤵
  PID:6912
- C:\Windows\System\XtVbFGL.exe
  C:\Windows\System\XtVbFGL.exe
  2⤵
  PID:6624
- C:\Windows\System\wDRwRYg.exe
  C:\Windows\System\wDRwRYg.exe
  2⤵
  PID:6640
- C:\Windows\System\mLokXwg.exe
  C:\Windows\System\mLokXwg.exe
  2⤵
  PID:7036
- C:\Windows\System\smdntpu.exe
  C:\Windows\System\smdntpu.exe
  2⤵
  PID:7092
- C:\Windows\System\RnoCaTN.exe
  C:\Windows\System\RnoCaTN.exe
  2⤵
  PID:6676
- C:\Windows\System\QLQuHDR.exe
  C:\Windows\System\QLQuHDR.exe
  2⤵
  PID:6712
- C:\Windows\System\vbycknf.exe
  C:\Windows\System\vbycknf.exe
  2⤵
  PID:6776
- C:\Windows\System\astkpYV.exe
  C:\Windows\System\astkpYV.exe
  2⤵
  PID:6828
- C:\Windows\System\oWfHiOE.exe
  C:\Windows\System\oWfHiOE.exe
  2⤵
  PID:5344
- C:\Windows\System\vzsrwgA.exe
  C:\Windows\System\vzsrwgA.exe
  2⤵
  PID:6244
- C:\Windows\System\CjDIuzU.exe
  C:\Windows\System\CjDIuzU.exe
  2⤵
  PID:6292
- C:\Windows\System\ZXANxue.exe
  C:\Windows\System\ZXANxue.exe
  2⤵
  PID:7176
- C:\Windows\System\ZYhuvyn.exe
  C:\Windows\System\ZYhuvyn.exe
  2⤵
  PID:7200
- C:\Windows\System\apVTOfg.exe
  C:\Windows\System\apVTOfg.exe
  2⤵
  PID:7224
- C:\Windows\System\lhKgkWf.exe
  C:\Windows\System\lhKgkWf.exe
  2⤵
  PID:7244
- C:\Windows\System\sPXoHem.exe
  C:\Windows\System\sPXoHem.exe
  2⤵
  PID:7260
- C:\Windows\System\nupbkRg.exe
  C:\Windows\System\nupbkRg.exe
  2⤵
  PID:7292
- C:\Windows\System\BJOZbhm.exe
  C:\Windows\System\BJOZbhm.exe
  2⤵
  PID:7312
- C:\Windows\System\pnjxPgr.exe
  C:\Windows\System\pnjxPgr.exe
  2⤵
  PID:7340
- C:\Windows\System\QyGNLsn.exe
  C:\Windows\System\QyGNLsn.exe
  2⤵
  PID:7364
- C:\Windows\System\npudVlV.exe
  C:\Windows\System\npudVlV.exe
  2⤵
  PID:7384
- C:\Windows\System\XkriHHf.exe
  C:\Windows\System\XkriHHf.exe
  2⤵
  PID:7404
- C:\Windows\System\DNxtqXz.exe
  C:\Windows\System\DNxtqXz.exe
  2⤵
  PID:7424
- C:\Windows\System\fJyOVWr.exe
  C:\Windows\System\fJyOVWr.exe
  2⤵
  PID:7448
- C:\Windows\System\HkoFQRz.exe
  C:\Windows\System\HkoFQRz.exe
  2⤵
  PID:7484
- C:\Windows\System\CgSqZRx.exe
  C:\Windows\System\CgSqZRx.exe
  2⤵
  PID:7500
- C:\Windows\System\lySPnLv.exe
  C:\Windows\System\lySPnLv.exe
  2⤵
  PID:7520
- C:\Windows\System\TVQUHYH.exe
  C:\Windows\System\TVQUHYH.exe
  2⤵
  PID:7544
- C:\Windows\System\eYNSoBr.exe
  C:\Windows\System\eYNSoBr.exe
  2⤵
  PID:7564
- C:\Windows\System\DgoENkA.exe
  C:\Windows\System\DgoENkA.exe
  2⤵
  PID:7588
- C:\Windows\System\clJncXT.exe
  C:\Windows\System\clJncXT.exe
  2⤵
  PID:7608
- C:\Windows\System\nibxOuM.exe
  C:\Windows\System\nibxOuM.exe
  2⤵
  PID:7632
- C:\Windows\System\wgDvXGH.exe
  C:\Windows\System\wgDvXGH.exe
  2⤵
  PID:7676
- C:\Windows\System\FFlCFjA.exe
  C:\Windows\System\FFlCFjA.exe
  2⤵
  PID:7696
- C:\Windows\System\JppfxgR.exe
  C:\Windows\System\JppfxgR.exe
  2⤵
  PID:7724
- C:\Windows\System\THmrtyq.exe
  C:\Windows\System\THmrtyq.exe
  2⤵
  PID:7748
- C:\Windows\System\mQaqFnj.exe
  C:\Windows\System\mQaqFnj.exe
  2⤵
  PID:7768
- C:\Windows\System\kWEwHtf.exe
  C:\Windows\System\kWEwHtf.exe
  2⤵
  PID:7788
- C:\Windows\System\SLZOCaF.exe
  C:\Windows\System\SLZOCaF.exe
  2⤵
  PID:7804
- C:\Windows\System\cnwQVwy.exe
  C:\Windows\System\cnwQVwy.exe
  2⤵
  PID:7824
- C:\Windows\System\IgSdOcq.exe
  C:\Windows\System\IgSdOcq.exe
  2⤵
  PID:7848
- C:\Windows\System\xqtrjHB.exe
  C:\Windows\System\xqtrjHB.exe
  2⤵
  PID:7872
- C:\Windows\System\YDEJVCT.exe
  C:\Windows\System\YDEJVCT.exe
  2⤵
  PID:7892
- C:\Windows\System\hzoTRXi.exe
  C:\Windows\System\hzoTRXi.exe
  2⤵
  PID:7916
- C:\Windows\System\bKuLgiL.exe
  C:\Windows\System\bKuLgiL.exe
  2⤵
  PID:7944
- C:\Windows\System\ExWAFcx.exe
  C:\Windows\System\ExWAFcx.exe
  2⤵
  PID:7964
- C:\Windows\System\KnMxZXV.exe
  C:\Windows\System\KnMxZXV.exe
  2⤵
  PID:7988
- C:\Windows\System\VvWsBsO.exe
  C:\Windows\System\VvWsBsO.exe
  2⤵
  PID:8012
- C:\Windows\System\XjpCoOs.exe
  C:\Windows\System\XjpCoOs.exe
  2⤵
  PID:8036
- C:\Windows\System\WPANfMq.exe
  C:\Windows\System\WPANfMq.exe
  2⤵
  PID:8068
- C:\Windows\System\eJBHosm.exe
  C:\Windows\System\eJBHosm.exe
  2⤵
  PID:8088
- C:\Windows\System\ImjobEl.exe
  C:\Windows\System\ImjobEl.exe
  2⤵
  PID:8120
- C:\Windows\System\JoiPdHP.exe
  C:\Windows\System\JoiPdHP.exe
  2⤵
  PID:8140
- C:\Windows\System\ABXdUVM.exe
  C:\Windows\System\ABXdUVM.exe
  2⤵
  PID:8160
- C:\Windows\System\HSFRlLJ.exe
  C:\Windows\System\HSFRlLJ.exe
  2⤵
  PID:8184
- C:\Windows\System\taUvCDN.exe
  C:\Windows\System\taUvCDN.exe
  2⤵
  PID:6792
- C:\Windows\System\vgnewcf.exe
  C:\Windows\System\vgnewcf.exe
  2⤵
  PID:7116
- C:\Windows\System\KProqbU.exe
  C:\Windows\System\KProqbU.exe
  2⤵
  PID:6596
- C:\Windows\System\rtZjkCW.exe
  C:\Windows\System\rtZjkCW.exe
  2⤵
  PID:7136
- C:\Windows\System\sMCGtVT.exe
  C:\Windows\System\sMCGtVT.exe
  2⤵
  PID:6320
- C:\Windows\System\VLEHLNQ.exe
  C:\Windows\System\VLEHLNQ.exe
  2⤵
  PID:6928
- C:\Windows\System\PjSyZjE.exe
  C:\Windows\System\PjSyZjE.exe
  2⤵
  PID:7192
- C:\Windows\System\OukIhis.exe
  C:\Windows\System\OukIhis.exe
  2⤵
  PID:7252
- C:\Windows\System\EJUMgap.exe
  C:\Windows\System\EJUMgap.exe
  2⤵
  PID:6344
- C:\Windows\System\HkVfRqg.exe
  C:\Windows\System\HkVfRqg.exe
  2⤵
  PID:6200
- C:\Windows\System\cmvFuZS.exe
  C:\Windows\System\cmvFuZS.exe
  2⤵
  PID:7444
- C:\Windows\System\ErXHImu.exe
  C:\Windows\System\ErXHImu.exe
  2⤵
  PID:7508
- C:\Windows\System\rlOlEDZ.exe
  C:\Windows\System\rlOlEDZ.exe
  2⤵
  PID:7552
- C:\Windows\System\yNaqKrH.exe
  C:\Windows\System\yNaqKrH.exe
  2⤵
  PID:7604
- C:\Windows\System\WhxXiEY.exe
  C:\Windows\System\WhxXiEY.exe
  2⤵
  PID:5736
- C:\Windows\System\XNRLWaE.exe
  C:\Windows\System\XNRLWaE.exe
  2⤵
  PID:7764
- C:\Windows\System\GRPEyZI.exe
  C:\Windows\System\GRPEyZI.exe
  2⤵
  PID:8196
- C:\Windows\System\xriHQat.exe
  C:\Windows\System\xriHQat.exe
  2⤵
  PID:8220
- C:\Windows\System\iugBIAL.exe
  C:\Windows\System\iugBIAL.exe
  2⤵
  PID:8240
- C:\Windows\System\NBEblqB.exe
  C:\Windows\System\NBEblqB.exe
  2⤵
  PID:8260
- C:\Windows\System\IHaLolY.exe
  C:\Windows\System\IHaLolY.exe
  2⤵
  PID:8284
- C:\Windows\System\oGBFJaN.exe
  C:\Windows\System\oGBFJaN.exe
  2⤵
  PID:8320
- C:\Windows\System\ycSjgnK.exe
  C:\Windows\System\ycSjgnK.exe
  2⤵
  PID:8340
- C:\Windows\System\MhSgtrn.exe
  C:\Windows\System\MhSgtrn.exe
  2⤵
  PID:8368
- C:\Windows\System\CXUATKJ.exe
  C:\Windows\System\CXUATKJ.exe
  2⤵
  PID:8388
- C:\Windows\System\lHCbfpr.exe
  C:\Windows\System\lHCbfpr.exe
  2⤵
  PID:8408
- C:\Windows\System\TGlZzae.exe
  C:\Windows\System\TGlZzae.exe
  2⤵
  PID:8428
- C:\Windows\System\uslYEPX.exe
  C:\Windows\System\uslYEPX.exe
  2⤵
  PID:8452
- C:\Windows\System\yZZsFBo.exe
  C:\Windows\System\yZZsFBo.exe
  2⤵
  PID:8476
- C:\Windows\System\AZWilpt.exe
  C:\Windows\System\AZWilpt.exe
  2⤵
  PID:8500
- C:\Windows\System\lfbJLqK.exe
  C:\Windows\System\lfbJLqK.exe
  2⤵
  PID:8520
- C:\Windows\System\WDfzEZx.exe
  C:\Windows\System\WDfzEZx.exe
  2⤵
  PID:8548
- C:\Windows\System\WQTzOXl.exe
  C:\Windows\System\WQTzOXl.exe
  2⤵
  PID:8568
- C:\Windows\System\XElHdvH.exe
  C:\Windows\System\XElHdvH.exe
  2⤵
  PID:8596
- C:\Windows\System\EZNcVxL.exe
  C:\Windows\System\EZNcVxL.exe
  2⤵
  PID:8628
- C:\Windows\System\jYohJuK.exe
  C:\Windows\System\jYohJuK.exe
  2⤵
  PID:8648
- C:\Windows\System\Pnzvpzb.exe
  C:\Windows\System\Pnzvpzb.exe
  2⤵
  PID:8668
- C:\Windows\System\aNbNTra.exe
  C:\Windows\System\aNbNTra.exe
  2⤵
  PID:8696
- C:\Windows\System\EYVAAsq.exe
  C:\Windows\System\EYVAAsq.exe
  2⤵
  PID:8712
- C:\Windows\System\atLJURa.exe
  C:\Windows\System\atLJURa.exe
  2⤵
  PID:8740
- C:\Windows\System\AbetxlW.exe
  C:\Windows\System\AbetxlW.exe
  2⤵
  PID:8756
- C:\Windows\System\bCMqetB.exe
  C:\Windows\System\bCMqetB.exe
  2⤵
  PID:8776
- C:\Windows\System\McxLtpc.exe
  C:\Windows\System\McxLtpc.exe
  2⤵
  PID:8808
- C:\Windows\System\zDgwoEz.exe
  C:\Windows\System\zDgwoEz.exe
  2⤵
  PID:8832
- C:\Windows\System\ufBmBqb.exe
  C:\Windows\System\ufBmBqb.exe
  2⤵
  PID:8864
- C:\Windows\System\YXfxfSh.exe
  C:\Windows\System\YXfxfSh.exe
  2⤵
  PID:8884
- C:\Windows\System\vcJsFFk.exe
  C:\Windows\System\vcJsFFk.exe
  2⤵
  PID:8904
- C:\Windows\System\YAVEXtI.exe
  C:\Windows\System\YAVEXtI.exe
  2⤵
  PID:8928
- C:\Windows\System\kueeYwV.exe
  C:\Windows\System\kueeYwV.exe
  2⤵
  PID:8952
- C:\Windows\System\lCbKkFb.exe
  C:\Windows\System\lCbKkFb.exe
  2⤵
  PID:8976
- C:\Windows\System\VGJLYxM.exe
  C:\Windows\System\VGJLYxM.exe
  2⤵
  PID:8992
- C:\Windows\System\ORKIkyO.exe
  C:\Windows\System\ORKIkyO.exe
  2⤵
  PID:9020
- C:\Windows\System\qyyMLdN.exe
  C:\Windows\System\qyyMLdN.exe
  2⤵
  PID:9044
- C:\Windows\System\hUCujvz.exe
  C:\Windows\System\hUCujvz.exe
  2⤵
  PID:9064
- C:\Windows\System\gMFpExC.exe
  C:\Windows\System\gMFpExC.exe
  2⤵
  PID:9084
- C:\Windows\System\pEuynht.exe
  C:\Windows\System\pEuynht.exe
  2⤵
  PID:9112
- C:\Windows\System\CCkIpco.exe
  C:\Windows\System\CCkIpco.exe
  2⤵
  PID:9132
- C:\Windows\System\LveRKlg.exe
  C:\Windows\System\LveRKlg.exe
  2⤵
  PID:9156
- C:\Windows\System\DfFufJB.exe
  C:\Windows\System\DfFufJB.exe
  2⤵
  PID:9188
- C:\Windows\System\UQSJHAT.exe
  C:\Windows\System\UQSJHAT.exe
  2⤵
  PID:9212
- C:\Windows\System\ChoFueR.exe
  C:\Windows\System\ChoFueR.exe
  2⤵
  PID:7400
- C:\Windows\System\GxGuGSY.exe
  C:\Windows\System\GxGuGSY.exe
  2⤵
  PID:8008
- C:\Windows\System\njHsDcw.exe
  C:\Windows\System\njHsDcw.exe
  2⤵
  PID:7512
- C:\Windows\System\kcLmOsf.exe
  C:\Windows\System\kcLmOsf.exe
  2⤵
  PID:8100
- C:\Windows\System\Jropdvv.exe
  C:\Windows\System\Jropdvv.exe
  2⤵
  PID:8152
- C:\Windows\System\PFOJaIy.exe
  C:\Windows\System\PFOJaIy.exe
  2⤵
  PID:6600
- C:\Windows\System\yBGYsVG.exe
  C:\Windows\System\yBGYsVG.exe
  2⤵
  PID:6960
- C:\Windows\System\AftJNNM.exe
  C:\Windows\System\AftJNNM.exe
  2⤵
  PID:4908
- C:\Windows\System\vMpAakI.exe
  C:\Windows\System\vMpAakI.exe
  2⤵
  PID:6916
- C:\Windows\System\kgsmKDh.exe
  C:\Windows\System\kgsmKDh.exe
  2⤵
  PID:7656
- C:\Windows\System\AANmqte.exe
  C:\Windows\System\AANmqte.exe
  2⤵
  PID:6728
- C:\Windows\System\LngXeqa.exe
  C:\Windows\System\LngXeqa.exe
  2⤵
  PID:7704
- C:\Windows\System\AxMHPaI.exe
  C:\Windows\System\AxMHPaI.exe
  2⤵
  PID:7740
- C:\Windows\System\rVKQbcn.exe
  C:\Windows\System\rVKQbcn.exe
  2⤵
  PID:7624
- C:\Windows\System\dRPTHrY.exe
  C:\Windows\System\dRPTHrY.exe
  2⤵
  PID:2612
- C:\Windows\System\riozdgI.exe
  C:\Windows\System\riozdgI.exe
  2⤵
  PID:7780
- C:\Windows\System\pVLOBBS.exe
  C:\Windows\System\pVLOBBS.exe
  2⤵
  PID:7832
- C:\Windows\System\tSdzysR.exe
  C:\Windows\System\tSdzysR.exe
  2⤵
  PID:8236
- C:\Windows\System\HJXCLge.exe
  C:\Windows\System\HJXCLge.exe
  2⤵
  PID:7956
- C:\Windows\System\OxBAtYs.exe
  C:\Windows\System\OxBAtYs.exe
  2⤵
  PID:8436
- C:\Windows\System\rGEQXoD.exe
  C:\Windows\System\rGEQXoD.exe
  2⤵
  PID:8492
- C:\Windows\System\iSVmvWR.exe
  C:\Windows\System\iSVmvWR.exe
  2⤵
  PID:8588
- C:\Windows\System\SMAbAVj.exe
  C:\Windows\System\SMAbAVj.exe
  2⤵
  PID:8644
- C:\Windows\System\nmftoaf.exe
  C:\Windows\System\nmftoaf.exe
  2⤵
  PID:8728
- C:\Windows\System\mUkvFfN.exe
  C:\Windows\System\mUkvFfN.exe
  2⤵
  PID:8804
- C:\Windows\System\VsbPQrk.exe
  C:\Windows\System\VsbPQrk.exe
  2⤵
  PID:9228
- C:\Windows\System\KYEBQWC.exe
  C:\Windows\System\KYEBQWC.exe
  2⤵
  PID:9252
- C:\Windows\System\CzurciG.exe
  C:\Windows\System\CzurciG.exe
  2⤵
  PID:9276
- C:\Windows\System\qzAVOON.exe
  C:\Windows\System\qzAVOON.exe
  2⤵
  PID:9300
- C:\Windows\System\ruJJcQA.exe
  C:\Windows\System\ruJJcQA.exe
  2⤵
  PID:9320
- C:\Windows\System\fGEmCnz.exe
  C:\Windows\System\fGEmCnz.exe
  2⤵
  PID:9340
- C:\Windows\System\hNNARCI.exe
  C:\Windows\System\hNNARCI.exe
  2⤵
  PID:9360
- C:\Windows\System\LMACBMU.exe
  C:\Windows\System\LMACBMU.exe
  2⤵
  PID:9388
- C:\Windows\System\VAJvZjj.exe
  C:\Windows\System\VAJvZjj.exe
  2⤵
  PID:9408
- C:\Windows\System\igXONpn.exe
  C:\Windows\System\igXONpn.exe
  2⤵
  PID:9432
- C:\Windows\System\xfKeUGQ.exe
  C:\Windows\System\xfKeUGQ.exe
  2⤵
  PID:9452
- C:\Windows\System\PmPHiCj.exe
  C:\Windows\System\PmPHiCj.exe
  2⤵
  PID:9476
- C:\Windows\System\rmaLbYF.exe
  C:\Windows\System\rmaLbYF.exe
  2⤵
  PID:9500
- C:\Windows\System\MVjmciK.exe
  C:\Windows\System\MVjmciK.exe
  2⤵
  PID:9524
- C:\Windows\System\SCFnHtm.exe
  C:\Windows\System\SCFnHtm.exe
  2⤵
  PID:9552
- C:\Windows\System\nzPAApx.exe
  C:\Windows\System\nzPAApx.exe
  2⤵
  PID:9572
- C:\Windows\System\DWBpnVk.exe
  C:\Windows\System\DWBpnVk.exe
  2⤵
  PID:9592
- C:\Windows\System\hpbViWL.exe
  C:\Windows\System\hpbViWL.exe
  2⤵
  PID:9616
- C:\Windows\System\HaSlPTQ.exe
  C:\Windows\System\HaSlPTQ.exe
  2⤵
  PID:9640
- C:\Windows\System\KbvUvJE.exe
  C:\Windows\System\KbvUvJE.exe
  2⤵
  PID:9668
- C:\Windows\System\cJNWjfS.exe
  C:\Windows\System\cJNWjfS.exe
  2⤵
  PID:9688
- C:\Windows\System\kvLtewh.exe
  C:\Windows\System\kvLtewh.exe
  2⤵
  PID:9712
- C:\Windows\System\DvZemex.exe
  C:\Windows\System\DvZemex.exe
  2⤵
  PID:9736
- C:\Windows\System\sEwICpn.exe
  C:\Windows\System\sEwICpn.exe
  2⤵
  PID:9760
- C:\Windows\System\TqWscCE.exe
  C:\Windows\System\TqWscCE.exe
  2⤵
  PID:9784
- C:\Windows\System\OKTBZgn.exe
  C:\Windows\System\OKTBZgn.exe
  2⤵
  PID:9804
- C:\Windows\System\wHhIBiF.exe
  C:\Windows\System\wHhIBiF.exe
  2⤵
  PID:9824
- C:\Windows\System\WUWUWFV.exe
  C:\Windows\System\WUWUWFV.exe
  2⤵
  PID:9848
- C:\Windows\System\BoJCoLG.exe
  C:\Windows\System\BoJCoLG.exe
  2⤵
  PID:9872
- C:\Windows\System\aeQrCMk.exe
  C:\Windows\System\aeQrCMk.exe
  2⤵
  PID:9896
- C:\Windows\System\WVTqTrG.exe
  C:\Windows\System\WVTqTrG.exe
  2⤵
  PID:9924
- C:\Windows\System\qhYoOuL.exe
  C:\Windows\System\qhYoOuL.exe
  2⤵
  PID:9952
- C:\Windows\System\xVOJtFA.exe
  C:\Windows\System\xVOJtFA.exe
  2⤵
  PID:9968
- C:\Windows\System\wAmrFuK.exe
  C:\Windows\System\wAmrFuK.exe
  2⤵
  PID:9988
- C:\Windows\System\fPFCKyo.exe
  C:\Windows\System\fPFCKyo.exe
  2⤵
  PID:10012
- C:\Windows\System\FNxNgta.exe
  C:\Windows\System\FNxNgta.exe
  2⤵
  PID:10036
- C:\Windows\System\PsZaBYW.exe
  C:\Windows\System\PsZaBYW.exe
  2⤵
  PID:10060
- C:\Windows\System\GehuijI.exe
  C:\Windows\System\GehuijI.exe
  2⤵
  PID:10080
- C:\Windows\System\XqSGxeo.exe
  C:\Windows\System\XqSGxeo.exe
  2⤵
  PID:10104
- C:\Windows\System\DxxITTI.exe
  C:\Windows\System\DxxITTI.exe
  2⤵
  PID:10128
- C:\Windows\System\ZRTZsWS.exe
  C:\Windows\System\ZRTZsWS.exe
  2⤵
  PID:10152
- C:\Windows\System\aCkggGX.exe
  C:\Windows\System\aCkggGX.exe
  2⤵
  PID:10172
- C:\Windows\System\NiTYlZM.exe
  C:\Windows\System\NiTYlZM.exe
  2⤵
  PID:10192
- C:\Windows\System\POLITEl.exe
  C:\Windows\System\POLITEl.exe
  2⤵
  PID:10212
- C:\Windows\System\aLWClrg.exe
  C:\Windows\System\aLWClrg.exe
  2⤵
  PID:9060
- C:\Windows\System\GjDkpNh.exe
  C:\Windows\System\GjDkpNh.exe
  2⤵
  PID:8216
- C:\Windows\System\GBHKfta.exe
  C:\Windows\System\GBHKfta.exe
  2⤵
  PID:9144
- C:\Windows\System\xqxkXCP.exe
  C:\Windows\System\xqxkXCP.exe
  2⤵
  PID:8268
- C:\Windows\System\ocrWFWC.exe
  C:\Windows\System\ocrWFWC.exe
  2⤵
  PID:8028
- C:\Windows\System\YpaAMlu.exe
  C:\Windows\System\YpaAMlu.exe
  2⤵
  PID:7900
- C:\Windows\System\UURAJdT.exe
  C:\Windows\System\UURAJdT.exe
  2⤵
  PID:6484
- C:\Windows\System\RVjPGCR.exe
  C:\Windows\System\RVjPGCR.exe
  2⤵
  PID:7120
- C:\Windows\System\vjYkrCN.exe
  C:\Windows\System\vjYkrCN.exe
  2⤵
  PID:1560
- C:\Windows\System\cTvhPzE.exe
  C:\Windows\System\cTvhPzE.exe
  2⤵
  PID:7692
- C:\Windows\System\ocJmJUS.exe
  C:\Windows\System\ocJmJUS.exe
  2⤵
  PID:8720
- C:\Windows\System\XmssPtJ.exe
  C:\Windows\System\XmssPtJ.exe
  2⤵
  PID:7440
- C:\Windows\System\JSkwxPg.exe
  C:\Windows\System\JSkwxPg.exe
  2⤵
  PID:8840
- C:\Windows\System\UixjyDG.exe
  C:\Windows\System\UixjyDG.exe
  2⤵
  PID:7416
- C:\Windows\System\YCBjOpr.exe
  C:\Windows\System\YCBjOpr.exe
  2⤵
  PID:9684
- C:\Windows\System\OBMJDzv.exe
  C:\Windows\System\OBMJDzv.exe
  2⤵
  PID:9756
- C:\Windows\System\aFRTDww.exe
  C:\Windows\System\aFRTDww.exe
  2⤵
  PID:9844
- C:\Windows\System\UdFFHGX.exe
  C:\Windows\System\UdFFHGX.exe
  2⤵
  PID:10256
- C:\Windows\System\FuRAKUx.exe
  C:\Windows\System\FuRAKUx.exe
  2⤵
  PID:10276
- C:\Windows\System\omXWLnc.exe
  C:\Windows\System\omXWLnc.exe
  2⤵
  PID:10300
- C:\Windows\System\MZPKyWj.exe
  C:\Windows\System\MZPKyWj.exe
  2⤵
  PID:10320
- C:\Windows\System\hVudWkN.exe
  C:\Windows\System\hVudWkN.exe
  2⤵
  PID:10344
- C:\Windows\System\YyQwhNA.exe
  C:\Windows\System\YyQwhNA.exe
  2⤵
  PID:10364
- C:\Windows\System\slaSKIK.exe
  C:\Windows\System\slaSKIK.exe
  2⤵
  PID:10388
- C:\Windows\System\hyvJSyf.exe
  C:\Windows\System\hyvJSyf.exe
  2⤵
  PID:10412
- C:\Windows\System\MlVDRWc.exe
  C:\Windows\System\MlVDRWc.exe
  2⤵
  PID:10436
- C:\Windows\System\FxIPtKu.exe
  C:\Windows\System\FxIPtKu.exe
  2⤵
  PID:10464
- C:\Windows\System\IxICraO.exe
  C:\Windows\System\IxICraO.exe
  2⤵
  PID:10484
- C:\Windows\System\dFGAUKV.exe
  C:\Windows\System\dFGAUKV.exe
  2⤵
  PID:10504
- C:\Windows\System\TFpFEDz.exe
  C:\Windows\System\TFpFEDz.exe
  2⤵
  PID:10536
- C:\Windows\System\IcNgZWf.exe
  C:\Windows\System\IcNgZWf.exe
  2⤵
  PID:10556
- C:\Windows\System\RDJbqJa.exe
  C:\Windows\System\RDJbqJa.exe
  2⤵
  PID:10580
- C:\Windows\System\eZUNTta.exe
  C:\Windows\System\eZUNTta.exe
  2⤵
  PID:10600
- C:\Windows\System\JALknwB.exe
  C:\Windows\System\JALknwB.exe
  2⤵
  PID:10624
- C:\Windows\System\vvdQAWf.exe
  C:\Windows\System\vvdQAWf.exe
  2⤵
  PID:10656
- C:\Windows\System\XXjPhbi.exe
  C:\Windows\System\XXjPhbi.exe
  2⤵
  PID:10676
- C:\Windows\System\ihlpqFo.exe
  C:\Windows\System\ihlpqFo.exe
  2⤵
  PID:10700
- C:\Windows\System\FomcNwP.exe
  C:\Windows\System\FomcNwP.exe
  2⤵
  PID:10724
- C:\Windows\System\nBuoSPg.exe
  C:\Windows\System\nBuoSPg.exe
  2⤵
  PID:10744
- C:\Windows\System\SOrkqKL.exe
  C:\Windows\System\SOrkqKL.exe
  2⤵
  PID:10764
- C:\Windows\System\SJDhJkd.exe
  C:\Windows\System\SJDhJkd.exe
  2⤵
  PID:10792
- C:\Windows\System\GoLbOUD.exe
  C:\Windows\System\GoLbOUD.exe
  2⤵
  PID:10820
- C:\Windows\System\JDQXooY.exe
  C:\Windows\System\JDQXooY.exe
  2⤵
  PID:10836
- C:\Windows\System\ONYXpoq.exe
  C:\Windows\System\ONYXpoq.exe
  2⤵
  PID:10852
- C:\Windows\System\MbkPRDT.exe
  C:\Windows\System\MbkPRDT.exe
  2⤵
  PID:10872
- C:\Windows\System\xOtdDzh.exe
  C:\Windows\System\xOtdDzh.exe
  2⤵
  PID:10888
- C:\Windows\System\lGZiZPd.exe
  C:\Windows\System\lGZiZPd.exe
  2⤵
  PID:10904
- C:\Windows\System\OFZfsax.exe
  C:\Windows\System\OFZfsax.exe
  2⤵
  PID:10920
- C:\Windows\System\llfQRbk.exe
  C:\Windows\System\llfQRbk.exe
  2⤵
  PID:10948
- C:\Windows\System\RRNPrUQ.exe
  C:\Windows\System\RRNPrUQ.exe
  2⤵
  PID:10968
- C:\Windows\System\IZKdNxX.exe
  C:\Windows\System\IZKdNxX.exe
  2⤵
  PID:10992
- C:\Windows\System\dmoJzCc.exe
  C:\Windows\System\dmoJzCc.exe
  2⤵
  PID:11020
- C:\Windows\System\WCgrjju.exe
  C:\Windows\System\WCgrjju.exe
  2⤵
  PID:11044
- C:\Windows\System\LmOYQGc.exe
  C:\Windows\System\LmOYQGc.exe
  2⤵
  PID:11068
- C:\Windows\System\sOhAQXF.exe
  C:\Windows\System\sOhAQXF.exe
  2⤵
  PID:11096
- C:\Windows\System\yHJinzB.exe
  C:\Windows\System\yHJinzB.exe
  2⤵
  PID:11124
- C:\Windows\System\GrAOGqD.exe
  C:\Windows\System\GrAOGqD.exe
  2⤵
  PID:11160
- C:\Windows\System\mlPvEOM.exe
  C:\Windows\System\mlPvEOM.exe
  2⤵
  PID:11180
- C:\Windows\System\AkEgPNK.exe
  C:\Windows\System\AkEgPNK.exe
  2⤵
  PID:11220
- C:\Windows\System\oWcpRDi.exe
  C:\Windows\System\oWcpRDi.exe
  2⤵
  PID:11248
- C:\Windows\System\lcMIZXw.exe
  C:\Windows\System\lcMIZXw.exe
  2⤵
  PID:9936
- C:\Windows\System\UaayaDg.exe
  C:\Windows\System\UaayaDg.exe
  2⤵
  PID:9976
- C:\Windows\System\tGHdVxM.exe
  C:\Windows\System\tGHdVxM.exe
  2⤵
  PID:5016
- C:\Windows\System\eRROdSd.exe
  C:\Windows\System\eRROdSd.exe
  2⤵
  PID:10144
- C:\Windows\System\lTqaiVo.exe
  C:\Windows\System\lTqaiVo.exe
  2⤵
  PID:10208
- C:\Windows\System\ljbZWtV.exe
  C:\Windows\System\ljbZWtV.exe
  2⤵
  PID:8900
- C:\Windows\System\WJIgwmV.exe
  C:\Windows\System\WJIgwmV.exe
  2⤵
  PID:7972
- C:\Windows\System\uZVyDrV.exe
  C:\Windows\System\uZVyDrV.exe
  2⤵
  PID:8400
- C:\Windows\System\mncKYCH.exe
  C:\Windows\System\mncKYCH.exe
  2⤵
  PID:8528
- C:\Windows\System\cUTtMcJ.exe
  C:\Windows\System\cUTtMcJ.exe
  2⤵
  PID:8664
- C:\Windows\System\VzrMWjL.exe
  C:\Windows\System\VzrMWjL.exe
  2⤵
  PID:9380
- C:\Windows\System\gLwrYom.exe
  C:\Windows\System\gLwrYom.exe
  2⤵
  PID:6392
- C:\Windows\System\CdCWkCq.exe
  C:\Windows\System\CdCWkCq.exe
  2⤵
  PID:7640
- C:\Windows\System\llgDebQ.exe
  C:\Windows\System\llgDebQ.exe
  2⤵
  PID:8048
- C:\Windows\System\bRMStaB.exe
  C:\Windows\System\bRMStaB.exe
  2⤵
  PID:9564
- C:\Windows\System\NpDRPpT.exe
  C:\Windows\System\NpDRPpT.exe
  2⤵
  PID:6868
- C:\Windows\System\HFlykHQ.exe
  C:\Windows\System\HFlykHQ.exe
  2⤵
  PID:9816
- C:\Windows\System\cpYqzJV.exe
  C:\Windows\System\cpYqzJV.exe
  2⤵
  PID:10244
- C:\Windows\System\SfmphZg.exe
  C:\Windows\System\SfmphZg.exe
  2⤵
  PID:9964
- C:\Windows\System\WLmKSzP.exe
  C:\Windows\System\WLmKSzP.exe
  2⤵
  PID:10376
- C:\Windows\System\GqOBSKF.exe
  C:\Windows\System\GqOBSKF.exe
  2⤵
  PID:10408
- C:\Windows\System\sZaEOFo.exe
  C:\Windows\System\sZaEOFo.exe
  2⤵
  PID:11284
- C:\Windows\System\CaKnseA.exe
  C:\Windows\System\CaKnseA.exe
  2⤵
  PID:11304
- C:\Windows\System\FJbyvLK.exe
  C:\Windows\System\FJbyvLK.exe
  2⤵
  PID:11332
- C:\Windows\System\gAiJUVH.exe
  C:\Windows\System\gAiJUVH.exe
  2⤵
  PID:11364
- C:\Windows\System\AnKLamn.exe
  C:\Windows\System\AnKLamn.exe
  2⤵
  PID:11384
- C:\Windows\System\JXauXPJ.exe
  C:\Windows\System\JXauXPJ.exe
  2⤵
  PID:11412
- C:\Windows\System\nLriFrr.exe
  C:\Windows\System\nLriFrr.exe
  2⤵
  PID:11432
- C:\Windows\System\qjffBoy.exe
  C:\Windows\System\qjffBoy.exe
  2⤵
  PID:11456
- C:\Windows\System\UDQcQib.exe
  C:\Windows\System\UDQcQib.exe
  2⤵
  PID:11476
- C:\Windows\System\bcubMjk.exe
  C:\Windows\System\bcubMjk.exe
  2⤵
  PID:11504
- C:\Windows\System\pCcMqob.exe
  C:\Windows\System\pCcMqob.exe
  2⤵
  PID:11524
- C:\Windows\System\yWuFLCA.exe
  C:\Windows\System\yWuFLCA.exe
  2⤵
  PID:11552
- C:\Windows\System\jkTHxIm.exe
  C:\Windows\System\jkTHxIm.exe
  2⤵
  PID:11572
- C:\Windows\System\SaagdRg.exe
  C:\Windows\System\SaagdRg.exe
  2⤵
  PID:11592
- C:\Windows\System\lfaAqex.exe
  C:\Windows\System\lfaAqex.exe
  2⤵
  PID:11620
- C:\Windows\System\JpThdkK.exe
  C:\Windows\System\JpThdkK.exe
  2⤵
  PID:11640
- C:\Windows\System\wueqejF.exe
  C:\Windows\System\wueqejF.exe
  2⤵
  PID:11660
- C:\Windows\System\aLnyBsY.exe
  C:\Windows\System\aLnyBsY.exe
  2⤵
  PID:11676
- C:\Windows\System\KJIMzUp.exe
  C:\Windows\System\KJIMzUp.exe
  2⤵
  PID:11692
- C:\Windows\System\DoEtUWI.exe
  C:\Windows\System\DoEtUWI.exe
  2⤵
  PID:11708
- C:\Windows\System\xXBaqJp.exe
  C:\Windows\System\xXBaqJp.exe
  2⤵
  PID:11724
- C:\Windows\System\QkqsIXr.exe
  C:\Windows\System\QkqsIXr.exe
  2⤵
  PID:11740
- C:\Windows\System\UMiczwG.exe
  C:\Windows\System\UMiczwG.exe
  2⤵
  PID:11756
- C:\Windows\System\zfiOVQL.exe
  C:\Windows\System\zfiOVQL.exe
  2⤵
  PID:11776
- C:\Windows\System\qNaxBNB.exe
  C:\Windows\System\qNaxBNB.exe
  2⤵
  PID:11792
- C:\Windows\System\wazRakj.exe
  C:\Windows\System\wazRakj.exe
  2⤵
  PID:11816
- C:\Windows\System\YERlmZs.exe
  C:\Windows\System\YERlmZs.exe
  2⤵
  PID:11844
- C:\Windows\System\nYUrSlj.exe
  C:\Windows\System\nYUrSlj.exe
  2⤵
  PID:11868
- C:\Windows\System\rjhHatx.exe
  C:\Windows\System\rjhHatx.exe
  2⤵
  PID:11884
- C:\Windows\System\RSnDGDQ.exe
  C:\Windows\System\RSnDGDQ.exe
  2⤵
  PID:11908
- C:\Windows\System\rtLNypl.exe
  C:\Windows\System\rtLNypl.exe
  2⤵
  PID:11936
- C:\Windows\System\tuKwAKY.exe
  C:\Windows\System\tuKwAKY.exe
  2⤵
  PID:11960
- C:\Windows\System\WjZHweN.exe
  C:\Windows\System\WjZHweN.exe
  2⤵
  PID:11984
- C:\Windows\System\LwgALwM.exe
  C:\Windows\System\LwgALwM.exe
  2⤵
  PID:12008
- C:\Windows\System\sIUlGmL.exe
  C:\Windows\System\sIUlGmL.exe
  2⤵
  PID:12040
- C:\Windows\System\lJYGoAs.exe
  C:\Windows\System\lJYGoAs.exe
  2⤵
  PID:12056
- C:\Windows\System\alIfUoZ.exe
  C:\Windows\System\alIfUoZ.exe
  2⤵
  PID:12092
- C:\Windows\System\OjNsnmw.exe
  C:\Windows\System\OjNsnmw.exe
  2⤵
  PID:12112
- C:\Windows\System\wQzrGuI.exe
  C:\Windows\System\wQzrGuI.exe
  2⤵
  PID:12132
- C:\Windows\System\hewjgXT.exe
  C:\Windows\System\hewjgXT.exe
  2⤵
  PID:12156
- C:\Windows\System\cSsojus.exe
  C:\Windows\System\cSsojus.exe
  2⤵
  PID:12176
- C:\Windows\System\zsdJZJZ.exe
  C:\Windows\System\zsdJZJZ.exe
  2⤵
  PID:7820
- C:\Windows\System\IVigCCS.exe
  C:\Windows\System\IVigCCS.exe
  2⤵
  PID:8852
- C:\Windows\System\jDPnamL.exe
  C:\Windows\System\jDPnamL.exe
  2⤵
  PID:9440
- C:\Windows\System\rLAPpcI.exe
  C:\Windows\System\rLAPpcI.exe
  2⤵
  PID:11188
- C:\Windows\System\NSrgbnm.exe
  C:\Windows\System\NSrgbnm.exe
  2⤵
  PID:9000
- C:\Windows\System\aPBVeZM.exe
  C:\Windows\System\aPBVeZM.exe
  2⤵
  PID:9092
- C:\Windows\System\cbHTAOc.exe
  C:\Windows\System\cbHTAOc.exe
  2⤵
  PID:9336
- C:\Windows\System\MHdtLXV.exe
  C:\Windows\System\MHdtLXV.exe
  2⤵
  PID:9608
- C:\Windows\System\sBzWpIg.exe
  C:\Windows\System\sBzWpIg.exe
  2⤵
  PID:9648
- C:\Windows\System\rlqGgsS.exe
  C:\Windows\System\rlqGgsS.exe
  2⤵
  PID:3180
- C:\Windows\System\JJVOuoW.exe
  C:\Windows\System\JJVOuoW.exe
  2⤵
  PID:3752
- C:\Windows\System\kEsAafz.exe
  C:\Windows\System\kEsAafz.exe
  2⤵
  PID:9892
- C:\Windows\System\pfVxwcR.exe
  C:\Windows\System\pfVxwcR.exe
  2⤵
  PID:10296
- C:\Windows\System\phkzhyj.exe
  C:\Windows\System\phkzhyj.exe
  2⤵
  PID:10048
- C:\Windows\System\NpNRvyx.exe
  C:\Windows\System\NpNRvyx.exe
  2⤵
  PID:10188
- C:\Windows\System\gRdZqNo.exe
  C:\Windows\System\gRdZqNo.exe
  2⤵
  PID:10916
- C:\Windows\System\jtBZYAx.exe
  C:\Windows\System\jtBZYAx.exe
  2⤵
  PID:10072
- C:\Windows\System\qACPlQM.exe
  C:\Windows\System\qACPlQM.exe
  2⤵
  PID:12100
- C:\Windows\System\aYFrzno.exe
  C:\Windows\System\aYFrzno.exe
  2⤵
  PID:11948
- C:\Windows\System\EAjvdaX.exe
  C:\Windows\System\EAjvdaX.exe
  2⤵
  PID:11800
- C:\Windows\System\AusAtZA.exe
  C:\Windows\System\AusAtZA.exe
  2⤵
  PID:11716
- C:\Windows\System\kNDqGRQ.exe
  C:\Windows\System\kNDqGRQ.exe
  2⤵
  PID:11608
- C:\Windows\System\uYfKdzN.exe
  C:\Windows\System\uYfKdzN.exe
  2⤵
  PID:11444
- C:\Windows\System\pRRawVF.exe
  C:\Windows\System\pRRawVF.exe
  2⤵
  PID:11312
- C:\Windows\System\kkVqOSA.exe
  C:\Windows\System\kkVqOSA.exe
  2⤵
  PID:8560
- C:\Windows\System\COLZEem.exe
  C:\Windows\System\COLZEem.exe
  2⤵
  PID:8352
- C:\Windows\System\aHUgRGQ.exe
  C:\Windows\System\aHUgRGQ.exe
  2⤵
  PID:10232
- C:\Windows\System\fWxvfaH.exe
  C:\Windows\System\fWxvfaH.exe
  2⤵
  PID:9560
- C:\Windows\System\SYoDnIw.exe
  C:\Windows\System\SYoDnIw.exe
  2⤵
  PID:10420
- C:\Windows\System\srGPbHR.exe
  C:\Windows\System\srGPbHR.exe
  2⤵
  PID:10564
- C:\Windows\System\rlnsvgm.exe
  C:\Windows\System\rlnsvgm.exe
  2⤵
  PID:11380
- C:\Windows\System\cImhmDB.exe
  C:\Windows\System\cImhmDB.exe
  2⤵
  PID:11520
- C:\Windows\System\GiODQmD.exe
  C:\Windows\System\GiODQmD.exe
  2⤵
  PID:11568
- C:\Windows\System\NFekvBW.exe
  C:\Windows\System\NFekvBW.exe
  2⤵
  PID:10900
- C:\Windows\System\xyEWpnj.exe
  C:\Windows\System\xyEWpnj.exe
  2⤵
  PID:10980
- C:\Windows\System\DjtrDcb.exe
  C:\Windows\System\DjtrDcb.exe
  2⤵
  PID:11032
- C:\Windows\System\viPWtbj.exe
  C:\Windows\System\viPWtbj.exe
  2⤵
  PID:11136
- C:\Windows\System\SritZoV.exe
  C:\Windows\System\SritZoV.exe
  2⤵
  PID:12080
- C:\Windows\System\LKOYkjd.exe
  C:\Windows\System\LKOYkjd.exe
  2⤵
  PID:12128
- C:\Windows\System\tXEtsQV.exe
  C:\Windows\System\tXEtsQV.exe
  2⤵
  PID:9104
- C:\Windows\System\rHoIefO.exe
  C:\Windows\System\rHoIefO.exe
  2⤵
  PID:12316
- C:\Windows\System\ZLpXjLD.exe
  C:\Windows\System\ZLpXjLD.exe
  2⤵
  PID:12336
- C:\Windows\System\FpudCEx.exe
  C:\Windows\System\FpudCEx.exe
  2⤵
  PID:12364
- C:\Windows\System\FglycGa.exe
  C:\Windows\System\FglycGa.exe
  2⤵
  PID:12384
- C:\Windows\System\EtOybSZ.exe
  C:\Windows\System\EtOybSZ.exe
  2⤵
  PID:12412
- C:\Windows\System\vmHQBHW.exe
  C:\Windows\System\vmHQBHW.exe
  2⤵
  PID:12432
- C:\Windows\System\kdVtfME.exe
  C:\Windows\System\kdVtfME.exe
  2⤵
  PID:12460
- C:\Windows\System\nlgnofs.exe
  C:\Windows\System\nlgnofs.exe
  2⤵
  PID:12488
- C:\Windows\System\xrMfThj.exe
  C:\Windows\System\xrMfThj.exe
  2⤵
  PID:12512
- C:\Windows\System\JEeAoRE.exe
  C:\Windows\System\JEeAoRE.exe
  2⤵
  PID:12536
- C:\Windows\System\ngHuDpH.exe
  C:\Windows\System\ngHuDpH.exe
  2⤵
  PID:12564
- C:\Windows\System\xBEQHdc.exe
  C:\Windows\System\xBEQHdc.exe
  2⤵
  PID:12592
- C:\Windows\System\MQdNhih.exe
  C:\Windows\System\MQdNhih.exe
  2⤵
  PID:12620
- C:\Windows\System\OcLMLVL.exe
  C:\Windows\System\OcLMLVL.exe
  2⤵
  PID:12648
- C:\Windows\System\BkKFlhX.exe
  C:\Windows\System\BkKFlhX.exe
  2⤵
  PID:12676
- C:\Windows\System\cUrgYMH.exe
  C:\Windows\System\cUrgYMH.exe
  2⤵
  PID:12700
- C:\Windows\System\kqYXwkW.exe
  C:\Windows\System\kqYXwkW.exe
  2⤵
  PID:12724
- C:\Windows\System\LfcOuoA.exe
  C:\Windows\System\LfcOuoA.exe
  2⤵
  PID:12744
- C:\Windows\System\eXzSlBX.exe
  C:\Windows\System\eXzSlBX.exe
  2⤵
  PID:12760
- C:\Windows\System\cQKZKGJ.exe
  C:\Windows\System\cQKZKGJ.exe
  2⤵
  PID:12776
- C:\Windows\System\xjSvdtw.exe
  C:\Windows\System\xjSvdtw.exe
  2⤵
  PID:10184
- C:\Windows\System\PmCBjxF.exe
  C:\Windows\System\PmCBjxF.exe
  2⤵
  PID:12928
- C:\Windows\System\GFDXKKu.exe
  C:\Windows\System\GFDXKKu.exe
  2⤵
  PID:10716
- C:\Windows\System\sINHdBL.exe
  C:\Windows\System\sINHdBL.exe
  2⤵
  PID:12312
- C:\Windows\System\AdrbYvU.exe
  C:\Windows\System\AdrbYvU.exe
  2⤵
  PID:12480
- C:\Windows\System\EwjwtiX.exe
  C:\Windows\System\EwjwtiX.exe
  2⤵
  PID:12696
- C:\Windows\System\PzdOVLR.exe
  C:\Windows\System\PzdOVLR.exe
  2⤵
  PID:12756
- C:\Windows\System\RzdHNei.exe
  C:\Windows\System\RzdHNei.exe
  2⤵
  PID:12832
- C:\Windows\System\bwqkhjo.exe
  C:\Windows\System\bwqkhjo.exe
  2⤵
  PID:12896
- C:\Windows\System\oArNvap.exe
  C:\Windows\System\oArNvap.exe
  2⤵
  PID:13076
- C:\Windows\System\dGyqpcD.exe
  C:\Windows\System\dGyqpcD.exe
  2⤵
  PID:4840
- C:\Windows\System\DSZiFII.exe
  C:\Windows\System\DSZiFII.exe
  2⤵
  PID:13140
- C:\Windows\System\BsPaYhC.exe
  C:\Windows\System\BsPaYhC.exe
  2⤵
  PID:12584
- C:\Windows\System\IXWkeuc.exe
  C:\Windows\System\IXWkeuc.exe
  2⤵
  PID:13284
- C:\Windows\System\RwdNeWk.exe
  C:\Windows\System\RwdNeWk.exe
  2⤵
  PID:11428
- C:\Windows\System\yPIrNiv.exe
  C:\Windows\System\yPIrNiv.exe
  2⤵
  PID:12376
- C:\Windows\System\jHteBss.exe
  C:\Windows\System\jHteBss.exe
  2⤵
  PID:9368
- C:\Windows\System\ZtgFnrG.exe
  C:\Windows\System\ZtgFnrG.exe
  2⤵
  PID:10284
- C:\Windows\System\ZcFpUow.exe
  C:\Windows\System\ZcFpUow.exe
  2⤵
  PID:10028
- C:\Windows\System\lBHFPwN.exe
  C:\Windows\System\lBHFPwN.exe
  2⤵
  PID:12948
- C:\Windows\System\xKBBgRp.exe
  C:\Windows\System\xKBBgRp.exe
  2⤵
  PID:12212
- C:\Windows\System\RGGQEUU.exe
  C:\Windows\System\RGGQEUU.exe
  2⤵
  PID:11216
- C:\Windows\System\nKjOSnN.exe
  C:\Windows\System\nKjOSnN.exe
  2⤵
  PID:12424
- C:\Windows\System\HaozUIE.exe
  C:\Windows\System\HaozUIE.exe
  2⤵
  PID:11260
- C:\Windows\System\tvLXkjD.exe
  C:\Windows\System\tvLXkjD.exe
  2⤵
  PID:13224
- C:\Windows\System\plNinKu.exe
  C:\Windows\System\plNinKu.exe
  2⤵
  PID:11296
- C:\Windows\System\bKoLQuA.exe
  C:\Windows\System\bKoLQuA.exe
  2⤵
  PID:11232
- C:\Windows\System\UVXugXw.exe
  C:\Windows\System\UVXugXw.exe
  2⤵
  PID:9496
- C:\Windows\System\ExCBvrX.exe
  C:\Windows\System\ExCBvrX.exe
  2⤵
  PID:9292
- C:\Windows\System\dssEPYr.exe
  C:\Windows\System\dssEPYr.exe
  2⤵
  PID:11464
- C:\Windows\System\JnvOGmz.exe
  C:\Windows\System\JnvOGmz.exe
  2⤵
  PID:10352
- C:\Windows\System\mvnhvQr.exe
  C:\Windows\System\mvnhvQr.exe
  2⤵
  PID:11996
- C:\Windows\System\OzfWMRA.exe
  C:\Windows\System\OzfWMRA.exe
  2⤵
  PID:1464
- C:\Windows\System\IgTYgRK.exe
  C:\Windows\System\IgTYgRK.exe
  2⤵
  PID:8984
- C:\Windows\System\ShnqrnF.exe
  C:\Windows\System\ShnqrnF.exe
  2⤵
  PID:12796
- C:\Windows\System\mFUQDek.exe
  C:\Windows\System\mFUQDek.exe
  2⤵
  PID:12068
- C:\Windows\System\QMOwBDq.exe
  C:\Windows\System\QMOwBDq.exe
  2⤵
  PID:9508
- C:\Windows\System\bKlopPZ.exe
  C:\Windows\System\bKlopPZ.exe
  2⤵
  PID:11040
- C:\Windows\System\etopVXz.exe
  C:\Windows\System\etopVXz.exe
  2⤵
  PID:12124
- C:\Windows\System\iPHvimK.exe
  C:\Windows\System\iPHvimK.exe
  2⤵
  PID:12960
- C:\Windows\System\SreXFaQ.exe
  C:\Windows\System\SreXFaQ.exe
  2⤵
  PID:12000
- C:\Windows\System\HUZAOTi.exe
  C:\Windows\System\HUZAOTi.exe
  2⤵
  PID:13152
- C:\Windows\System\qvwOItc.exe
  C:\Windows\System\qvwOItc.exe
  2⤵
  PID:13036
- C:\Windows\System\LMnyvyc.exe
  C:\Windows\System\LMnyvyc.exe
  2⤵
  PID:11404
- C:\Windows\System\azOhXuv.exe
  C:\Windows\System\azOhXuv.exe
  2⤵
  PID:9812
- C:\Windows\System\QCYAyFW.exe
  C:\Windows\System\QCYAyFW.exe
  2⤵
  PID:13020
- C:\Windows\System\FbvRpxe.exe
  C:\Windows\System\FbvRpxe.exe
  2⤵
  PID:1620
- C:\Windows\System\JrgeHtC.exe
  C:\Windows\System\JrgeHtC.exe
  2⤵
  PID:11240
- C:\Windows\System\HCHlvDk.exe
  C:\Windows\System\HCHlvDk.exe
  2⤵
  PID:13068
- C:\Windows\System\iqgfEyC.exe
  C:\Windows\System\iqgfEyC.exe
  2⤵
  PID:12264
- C:\Windows\System\AdytHXJ.exe
  C:\Windows\System\AdytHXJ.exe
  2⤵
  PID:13048
- C:\Windows\System\tNvdXoa.exe
  C:\Windows\System\tNvdXoa.exe
  2⤵
  PID:10424
- C:\Windows\System\euYQgHp.exe
  C:\Windows\System\euYQgHp.exe
  2⤵
  PID:11684
- C:\Windows\System\RhRvUGy.exe
  C:\Windows\System\RhRvUGy.exe
  2⤵
  PID:4844
- C:\Windows\System\xBDlpVC.exe
  C:\Windows\System\xBDlpVC.exe
  2⤵
  PID:9880
- C:\Windows\System\YtkvWqI.exe
  C:\Windows\System\YtkvWqI.exe
  2⤵
  PID:9868
- C:\Windows\System\QOBvEmm.exe
  C:\Windows\System\QOBvEmm.exe
  2⤵
  PID:1724
- C:\Windows\System\oZIOgeF.exe
  C:\Windows\System\oZIOgeF.exe
  2⤵
  PID:4480
- C:\Windows\System\BGNWTdL.exe
  C:\Windows\System\BGNWTdL.exe
  2⤵
  PID:5096
- C:\Windows\System\wjuLHnZ.exe
  C:\Windows\System\wjuLHnZ.exe
  2⤵
  PID:3296
- C:\Windows\System\nPGVvQt.exe
  C:\Windows\System\nPGVvQt.exe
  2⤵
  PID:9680
- C:\Windows\System\vNVLUib.exe
  C:\Windows\System\vNVLUib.exe
  2⤵
  PID:208
- C:\Windows\System\PCPomSZ.exe
  C:\Windows\System\PCPomSZ.exe
  2⤵
  PID:3168
- C:\Windows\System\vVrdYJT.exe
  C:\Windows\System\vVrdYJT.exe
  2⤵
  PID:1852
- C:\Windows\System\FXSjIGU.exe
  C:\Windows\System\FXSjIGU.exe
  2⤵
  PID:2668
- C:\Windows\System\CuVUPqd.exe
  C:\Windows\System\CuVUPqd.exe
  2⤵
  PID:2444
- C:\Windows\System\cWCONOF.exe
  C:\Windows\System\cWCONOF.exe
  2⤵
  PID:6136
- C:\Windows\System\SrENFuX.exe
  C:\Windows\System\SrENFuX.exe
  2⤵
  PID:4204
- C:\Windows\System\spktRyT.exe
  C:\Windows\System\spktRyT.exe
  2⤵
  PID:3816
- C:\Windows\System\awzcJRb.exe
  C:\Windows\System\awzcJRb.exe
  2⤵
  PID:1996
- C:\Windows\System\sZsetGl.exe
  C:\Windows\System\sZsetGl.exe
  2⤵
  PID:2696
- C:\Windows\System\iQVuxTo.exe
  C:\Windows\System\iQVuxTo.exe
  2⤵
  PID:4472
- C:\Windows\System\KeajdDT.exe
  C:\Windows\System\KeajdDT.exe
  2⤵
  PID:11092
- C:\Windows\System\DlnFJGs.exe
  C:\Windows\System\DlnFJGs.exe
  2⤵
  PID:4300
- C:\Windows\System\IvMOnXY.exe
  C:\Windows\System\IvMOnXY.exe
  2⤵
  PID:5240
- C:\Windows\System\cAZPWBw.exe
  C:\Windows\System\cAZPWBw.exe
  2⤵
  PID:2488
- C:\Windows\System\UbNvNIS.exe
  C:\Windows\System\UbNvNIS.exe
  2⤵
  PID:3996
- C:\Windows\System\dBmCrRc.exe
  C:\Windows\System\dBmCrRc.exe
  2⤵
  PID:1520
- C:\Windows\System\kiJehVc.exe
  C:\Windows\System\kiJehVc.exe
  2⤵
  PID:4412
- C:\Windows\System\eiUNNmY.exe
  C:\Windows\System\eiUNNmY.exe
  2⤵
  PID:5464
- C:\Windows\System\tOnBAPk.exe
  C:\Windows\System\tOnBAPk.exe
  2⤵
  PID:5348
- C:\Windows\System\ckeYhem.exe
  C:\Windows\System\ckeYhem.exe
  2⤵
  PID:5356
- C:\Windows\System\KjtHDti.exe
  C:\Windows\System\KjtHDti.exe
  2⤵
  PID:9792
- C:\Windows\System\msMhvAD.exe
  C:\Windows\System\msMhvAD.exe
  2⤵
  PID:3564
- C:\Windows\System\AriBEpw.exe
  C:\Windows\System\AriBEpw.exe
  2⤵
  PID:5512
- C:\Windows\System\lSJPdqY.exe
  C:\Windows\System\lSJPdqY.exe
  2⤵
  PID:1456
- C:\Windows\System\hwEnQdF.exe
  C:\Windows\System\hwEnQdF.exe
  2⤵
  PID:4388
- C:\Windows\System\xmvOKQP.exe
  C:\Windows\System\xmvOKQP.exe
  2⤵
  PID:5724
- C:\Windows\System\zpfEiXP.exe
  C:\Windows\System\zpfEiXP.exe
  2⤵
  PID:3656
- C:\Windows\System\PpzgoBx.exe
  C:\Windows\System\PpzgoBx.exe
  2⤵
  PID:5904
- C:\Windows\System\XrQpMxZ.exe
  C:\Windows\System\XrQpMxZ.exe
  2⤵
  PID:4064
- C:\Windows\System\CalnGEp.exe
  C:\Windows\System\CalnGEp.exe
  2⤵
  PID:784
- C:\Windows\System\TzWVyUl.exe
  C:\Windows\System\TzWVyUl.exe
  2⤵
  PID:1788
- C:\Windows\System\nKzVPTN.exe
  C:\Windows\System\nKzVPTN.exe
  2⤵
  PID:2148
- C:\Windows\System\sqoWBvo.exe
  C:\Windows\System\sqoWBvo.exe
  2⤵
  PID:780
- C:\Windows\System\LTfogSI.exe
  C:\Windows\System\LTfogSI.exe
  2⤵
  PID:2936
- C:\Windows\System\xbvQzuj.exe
  C:\Windows\System\xbvQzuj.exe
  2⤵
  PID:5380
- C:\Windows\System\TQOOiwB.exe
  C:\Windows\System\TQOOiwB.exe
  2⤵
  PID:60
- C:\Windows\System\OrYhyVz.exe
  C:\Windows\System\OrYhyVz.exe
  2⤵
  PID:4812
- C:\Windows\System\WzEbakD.exe
  C:\Windows\System\WzEbakD.exe
  2⤵
  PID:1568
- C:\Windows\System\wdgTbdg.exe
  C:\Windows\System\wdgTbdg.exe
  2⤵
  PID:13304
- C:\Windows\System\hADIDHN.exe
  C:\Windows\System\hADIDHN.exe
  2⤵
  PID:4780
- C:\Windows\System\NvyFEcA.exe
  C:\Windows\System\NvyFEcA.exe
  2⤵
  PID:5352
- C:\Windows\System\CyoBQBT.exe
  C:\Windows\System\CyoBQBT.exe
  2⤵
  PID:4608
- C:\Windows\System\Zhdisjo.exe
  C:\Windows\System\Zhdisjo.exe
  2⤵
  PID:5408
- C:\Windows\System\RkBXQLS.exe
  C:\Windows\System\RkBXQLS.exe
  2⤵
  PID:5340
- C:\Windows\System\rGLGqZw.exe
  C:\Windows\System\rGLGqZw.exe
  2⤵
  PID:928
- C:\Windows\System\hkrvAdu.exe
  C:\Windows\System\hkrvAdu.exe
  2⤵
  PID:1672
- C:\Windows\System\JlwJzDW.exe
  C:\Windows\System\JlwJzDW.exe
  2⤵
  PID:5576
- C:\Windows\System\pOfuiUN.exe
  C:\Windows\System\pOfuiUN.exe
  2⤵
  PID:4296
- C:\Windows\System\GmScDjS.exe
  C:\Windows\System\GmScDjS.exe
  2⤵
  PID:5456
- C:\Windows\System\QHRSkro.exe
  C:\Windows\System\QHRSkro.exe
  2⤵
  PID:6528
- C:\Windows\System\NSGgpQA.exe
  C:\Windows\System\NSGgpQA.exe
  2⤵
  PID:5844
- C:\Windows\System\JihLJes.exe
  C:\Windows\System\JihLJes.exe
  2⤵
  PID:5940
- C:\Windows\System\mpTPEGO.exe
  C:\Windows\System\mpTPEGO.exe
  2⤵
  PID:5276
- C:\Windows\System\aDemGGn.exe
  C:\Windows\System\aDemGGn.exe
  2⤵
  PID:1472
- C:\Windows\System\keNOVoE.exe
  C:\Windows\System\keNOVoE.exe
  2⤵
  PID:3052
- C:\Windows\System\ybgCIvd.exe
  C:\Windows\System\ybgCIvd.exe
  2⤵
  PID:5280
- C:\Windows\System\yfNDxkb.exe
  C:\Windows\System\yfNDxkb.exe
  2⤵
  PID:5968
- C:\Windows\System\xDHLsPo.exe
  C:\Windows\System\xDHLsPo.exe
  2⤵
  PID:5820
- C:\Windows\System\kfHRhDW.exe
  C:\Windows\System\kfHRhDW.exe
  2⤵
  PID:5580
- C:\Windows\System\yMRCfge.exe
  C:\Windows\System\yMRCfge.exe
  2⤵
  PID:5584
- C:\Windows\System\zDWIPFU.exe
  C:\Windows\System\zDWIPFU.exe
  2⤵
  PID:4832
- C:\Windows\System\QDuNGjT.exe
  C:\Windows\System\QDuNGjT.exe
  2⤵
  PID:2784
- C:\Windows\System\URPKWgX.exe
  C:\Windows\System\URPKWgX.exe
  2⤵
  PID:5764
- C:\Windows\System\IdmXqnw.exe
  C:\Windows\System\IdmXqnw.exe
  2⤵
  PID:4972
- C:\Windows\System\MvCYQQr.exe
  C:\Windows\System\MvCYQQr.exe
  2⤵
  PID:6140
- C:\Windows\System\koIoopT.exe
  C:\Windows\System\koIoopT.exe
  2⤵
  PID:6088
- C:\Windows\System\ESGThrW.exe
  C:\Windows\System\ESGThrW.exe
  2⤵
  PID:2524
- C:\Windows\System\XmyYLVx.exe
  C:\Windows\System\XmyYLVx.exe
  2⤵
  PID:1404
- C:\Windows\System\BEitBGP.exe
  C:\Windows\System\BEitBGP.exe
  2⤵
  PID:2676
- C:\Windows\System\UmelVvq.exe
  C:\Windows\System\UmelVvq.exe
  2⤵
  PID:2420
- C:\Windows\System\sydXNHG.exe
  C:\Windows\System\sydXNHG.exe
  2⤵
  PID:5544
- C:\Windows\System\QmYqKlU.exe
  C:\Windows\System\QmYqKlU.exe
  2⤵
  PID:5552
- C:\Windows\System\zAaOQLu.exe
  C:\Windows\System\zAaOQLu.exe
  2⤵
  PID:5656
- C:\Windows\System\qMOuNSd.exe
  C:\Windows\System\qMOuNSd.exe
  2⤵
  PID:5964
- C:\Windows\System\KVKrNOJ.exe
  C:\Windows\System\KVKrNOJ.exe
  2⤵
  PID:5808
- C:\Windows\System\JuuJJvi.exe
  C:\Windows\System\JuuJJvi.exe
  2⤵
  PID:548
- C:\Windows\System\jLxgDLg.exe
  C:\Windows\System\jLxgDLg.exe
  2⤵
  PID:12252
- C:\Windows\System\VwVogbZ.exe
  C:\Windows\System\VwVogbZ.exe
  2⤵
  PID:3972
- C:\Windows\System\RiTCIAO.exe
  C:\Windows\System\RiTCIAO.exe
  2⤵
  PID:5856
- C:\Windows\System\SYkFMwK.exe
  C:\Windows\System\SYkFMwK.exe
  2⤵
  PID:5492
- C:\Windows\System\dqKVIbE.exe
  C:\Windows\System\dqKVIbE.exe
  2⤵
  PID:13324
- C:\Windows\System\whWJelT.exe
  C:\Windows\System\whWJelT.exe
  2⤵
  PID:13352
- C:\Windows\System\SnfbLAC.exe
  C:\Windows\System\SnfbLAC.exe
  2⤵
  PID:13380
- C:\Windows\System\fXmsbSl.exe
  C:\Windows\System\fXmsbSl.exe
  2⤵
  PID:13408
- C:\Windows\System\ZqFZiBM.exe
  C:\Windows\System\ZqFZiBM.exe
  2⤵
  PID:13440
- C:\Windows\System\OQOQxfY.exe
  C:\Windows\System\OQOQxfY.exe
  2⤵
  PID:13468
- C:\Windows\System\KgjXEcb.exe
  C:\Windows\System\KgjXEcb.exe
  2⤵
  PID:13496
- C:\Windows\System\VhpOFCR.exe
  C:\Windows\System\VhpOFCR.exe
  2⤵
  PID:13524
- C:\Windows\System\uSVqdvl.exe
  C:\Windows\System\uSVqdvl.exe
  2⤵
  PID:13552
- C:\Windows\System\PfbstqN.exe
  C:\Windows\System\PfbstqN.exe
  2⤵
  PID:13580
- C:\Windows\System\wxtagBU.exe
  C:\Windows\System\wxtagBU.exe
  2⤵
  PID:13608
- C:\Windows\System\GIfFBup.exe
  C:\Windows\System\GIfFBup.exe
  2⤵
  PID:13680
- C:\Windows\System\pOPiMBb.exe
  C:\Windows\System\pOPiMBb.exe
  2⤵
  PID:13744
- C:\Windows\System\WsjnGDw.exe
  C:\Windows\System\WsjnGDw.exe
  2⤵
  PID:13776
- C:\Windows\System\rUoqSCj.exe
  C:\Windows\System\rUoqSCj.exe
  2⤵
  PID:13808
- C:\Windows\System\zLLfNNo.exe
  C:\Windows\System\zLLfNNo.exe
  2⤵
  PID:13836
- C:\Windows\System\OKIzMZN.exe
  C:\Windows\System\OKIzMZN.exe
  2⤵
  PID:13892
- C:\Windows\System\aRbyZai.exe
  C:\Windows\System\aRbyZai.exe
  2⤵
  PID:13924
- C:\Windows\System\evgaQdn.exe
  C:\Windows\System\evgaQdn.exe
  2⤵
  PID:13956
- C:\Windows\System\GMgMWhE.exe
  C:\Windows\System\GMgMWhE.exe
  2⤵
  PID:13824
- C:\Windows\System\RsoDcFW.exe
  C:\Windows\System\RsoDcFW.exe
  2⤵
  PID:13932
- C:\Windows\System\ZBUevyc.exe
  C:\Windows\System\ZBUevyc.exe
  2⤵
  PID:14064
- C:\Windows\System\OvytiZQ.exe
  C:\Windows\System\OvytiZQ.exe
  2⤵
  PID:14100
- C:\Windows\System\CwKLJaH.exe
  C:\Windows\System\CwKLJaH.exe
  2⤵
  PID:13760
- C:\Windows\System\KJHwopw.exe
  C:\Windows\System\KJHwopw.exe
  2⤵
  PID:1900
- C:\Windows\System\nQbxFON.exe
  C:\Windows\System\nQbxFON.exe
  2⤵
  PID:13964
- C:\Windows\System\jvLCUkb.exe
  C:\Windows\System\jvLCUkb.exe
  2⤵
  PID:14024
- C:\Windows\System\HIoNWZO.exe
  C:\Windows\System\HIoNWZO.exe
  2⤵
  PID:14036
- C:\Windows\System\JbuqXrg.exe
  C:\Windows\System\JbuqXrg.exe
  2⤵
  PID:14152
- C:\Windows\System\zxhjEJK.exe
  C:\Windows\System\zxhjEJK.exe
  2⤵
  PID:14244
- C:\Windows\System\VEqnNyH.exe
  C:\Windows\System\VEqnNyH.exe
  2⤵
  PID:14172
- C:\Windows\System\nddNRit.exe
  C:\Windows\System\nddNRit.exe
  2⤵
  PID:14280
- C:\Windows\System\udvnRrd.exe
  C:\Windows\System\udvnRrd.exe
  2⤵
  PID:13540
- C:\Windows\System\OkuUHwS.exe
  C:\Windows\System\OkuUHwS.exe
  2⤵
  PID:13388
- C:\Windows\System\YWndzOV.exe
  C:\Windows\System\YWndzOV.exe
  2⤵
  PID:13688
- C:\Windows\System\bRsWvHU.exe
  C:\Windows\System\bRsWvHU.exe
  2⤵
  PID:13576
- C:\Windows\System\nwsDXUt.exe
  C:\Windows\System\nwsDXUt.exe
  2⤵
  PID:4088
- C:\Windows\System\ljBPOAv.exe
  C:\Windows\System\ljBPOAv.exe
  2⤵
  PID:13676
- C:\Windows\System\efEcMEZ.exe
  C:\Windows\System\efEcMEZ.exe
  2⤵
  PID:13752
- C:\Windows\System\YJCuxBI.exe
  C:\Windows\System\YJCuxBI.exe
  2⤵
  PID:6380
- C:\Windows\System\ArdtyVV.exe
  C:\Windows\System\ArdtyVV.exe
  2⤵
  PID:13732
- C:\Windows\System\xkaUpih.exe
  C:\Windows\System\xkaUpih.exe
  2⤵
  PID:13856
- C:\Windows\System\ozDSHsj.exe
  C:\Windows\System\ozDSHsj.exe
  2⤵
  PID:13988
- C:\Windows\System\NPTREtx.exe
  C:\Windows\System\NPTREtx.exe
  2⤵
  PID:6436
- C:\Windows\System\mNxnwaZ.exe
  C:\Windows\System\mNxnwaZ.exe
  2⤵
  PID:14080
- C:\Windows\System\AdKifUG.exe
  C:\Windows\System\AdKifUG.exe
  2⤵
  PID:6740
- C:\Windows\System\bFdRZHi.exe
  C:\Windows\System\bFdRZHi.exe
  2⤵
  PID:6572
- C:\Windows\System\PghEUiR.exe
  C:\Windows\System\PghEUiR.exe
  2⤵
  PID:14116
- C:\Windows\System\jRKQFuM.exe
  C:\Windows\System\jRKQFuM.exe
  2⤵
  PID:6552
- C:\Windows\System\wARsHwV.exe
  C:\Windows\System\wARsHwV.exe
  2⤵
  PID:14136
- C:\Windows\System\MMtHdvj.exe
  C:\Windows\System\MMtHdvj.exe
  2⤵
  PID:14284
- C:\Windows\System\FGFjVte.exe
  C:\Windows\System\FGFjVte.exe
  2⤵
  PID:14192
- C:\Windows\System\haxdSOT.exe
  C:\Windows\System\haxdSOT.exe
  2⤵
  PID:6440
- C:\Windows\System\iSuhSVT.exe
  C:\Windows\System\iSuhSVT.exe
  2⤵
  PID:6180
- C:\Windows\System\EgGWLyY.exe
  C:\Windows\System\EgGWLyY.exe
  2⤵
  PID:12304
- C:\Windows\System\sdTRpjU.exe
  C:\Windows\System\sdTRpjU.exe
  2⤵
  PID:11880
- C:\Windows\System\TbzMpOM.exe
  C:\Windows\System\TbzMpOM.exe
  2⤵
  PID:7164
- C:\Windows\System\qWFuinn.exe
  C:\Windows\System\qWFuinn.exe
  2⤵
  PID:12296
- C:\Windows\System\QTMJdGX.exe
  C:\Windows\System\QTMJdGX.exe
  2⤵
  PID:7188
- C:\Windows\System\XmuyRQo.exe
  C:\Windows\System\XmuyRQo.exe
  2⤵
  PID:13588
- C:\Windows\System\RulAjxh.exe
  C:\Windows\System\RulAjxh.exe
  2⤵
  PID:7868
- C:\Windows\System\GROnqTm.exe
  C:\Windows\System\GROnqTm.exe
  2⤵
  PID:7940
- C:\Windows\System\ElkuuBk.exe
  C:\Windows\System\ElkuuBk.exe
  2⤵
  PID:2876
- C:\Windows\System\cDihkcS.exe
  C:\Windows\System\cDihkcS.exe
  2⤵
  PID:7620
- C:\Windows\System\sPuEcPo.exe
  C:\Windows\System\sPuEcPo.exe
  2⤵
  PID:7396
- C:\Windows\System\JsxlTjA.exe
  C:\Windows\System\JsxlTjA.exe
  2⤵
  PID:4048
- C:\Windows\System\JeNWJqw.exe
  C:\Windows\System\JeNWJqw.exe
  2⤵
  PID:13860
- C:\Windows\System\XsZgvZg.exe
  C:\Windows\System\XsZgvZg.exe
  2⤵
  PID:8312
- C:\Windows\System\GvshYNH.exe
  C:\Windows\System\GvshYNH.exe
  2⤵
  PID:14040
- C:\Windows\System\RfNJkJV.exe
  C:\Windows\System\RfNJkJV.exe
  2⤵
  PID:8532
- C:\Windows\System\tpsMsIm.exe
  C:\Windows\System\tpsMsIm.exe
  2⤵
  PID:8580
- C:\Windows\System\SINIFWU.exe
  C:\Windows\System\SINIFWU.exe
  2⤵
  PID:6620
- C:\Windows\System\YQamWeR.exe
  C:\Windows\System\YQamWeR.exe
  2⤵
  PID:6152
- C:\Windows\System\nVerJel.exe
  C:\Windows\System\nVerJel.exe
  2⤵
  PID:8940
- C:\Windows\System\jfKSeSB.exe
  C:\Windows\System\jfKSeSB.exe
  2⤵
  PID:7628
- C:\Windows\System\ejHqApb.exe
  C:\Windows\System\ejHqApb.exe
  2⤵
  PID:14112
- C:\Windows\System\vWMALcb.exe
  C:\Windows\System\vWMALcb.exe
  2⤵
  PID:6756
- C:\Windows\System\WVEaRWe.exe
  C:\Windows\System\WVEaRWe.exe
  2⤵
  PID:7284
- C:\Windows\System\OZmJSJl.exe
  C:\Windows\System\OZmJSJl.exe
  2⤵
  PID:8460
- C:\Windows\System\VjbeILl.exe
  C:\Windows\System\VjbeILl.exe
  2⤵
  PID:6984
- C:\Windows\System\eJHvgkL.exe
  C:\Windows\System\eJHvgkL.exe
  2⤵
  PID:9096
- C:\Windows\System\AfRlhCa.exe
  C:\Windows\System\AfRlhCa.exe
  2⤵
  PID:9512
- C:\Windows\System\EJIcrfJ.exe
  C:\Windows\System\EJIcrfJ.exe
  2⤵
  PID:13376
- C:\Windows\System\PSKFIgI.exe
  C:\Windows\System\PSKFIgI.exe
  2⤵
  PID:7756
- C:\Windows\System\cZAQbiP.exe
  C:\Windows\System\cZAQbiP.exe
  2⤵
  PID:13648
- C:\Windows\System\iZYKjcR.exe
  C:\Windows\System\iZYKjcR.exe
  2⤵
  PID:8544
- C:\Windows\System\LlKCIYr.exe
  C:\Windows\System\LlKCIYr.exe
  2⤵
  PID:9004
- C:\Windows\System\zjmTyTm.exe
  C:\Windows\System\zjmTyTm.exe
  2⤵
  PID:13720
- C:\Windows\System\MYzUBWd.exe
  C:\Windows\System\MYzUBWd.exe
  2⤵
  PID:3484
- C:\Windows\System\gbJqzeM.exe
  C:\Windows\System\gbJqzeM.exe
  2⤵
  PID:8704
- C:\Windows\System\FNfQuEH.exe
  C:\Windows\System\FNfQuEH.exe
  2⤵
  PID:9120
- C:\Windows\System\gSvjAsd.exe
  C:\Windows\System\gSvjAsd.exe
  2⤵
  PID:9604
- C:\Windows\System\rqxecyK.exe
  C:\Windows\System\rqxecyK.exe
  2⤵
  PID:9520
- C:\Windows\System\SzyMpvX.exe
  C:\Windows\System\SzyMpvX.exe
  2⤵
  PID:8176
- C:\Windows\System\YauoQoH.exe
  C:\Windows\System\YauoQoH.exe
  2⤵
  PID:9836
- C:\Windows\System\SLklVxY.exe
  C:\Windows\System\SLklVxY.exe
  2⤵
  PID:14016
- C:\Windows\System\yDIXXty.exe
  C:\Windows\System\yDIXXty.exe
  2⤵
  PID:14032
- C:\Windows\System\vIMDopK.exe
  C:\Windows\System\vIMDopK.exe
  2⤵
  PID:10116
- C:\Windows\System\mZLkfgi.exe
  C:\Windows\System\mZLkfgi.exe
  2⤵
  PID:13632
- C:\Windows\System\GVArfDC.exe
  C:\Windows\System\GVArfDC.exe
  2⤵
  PID:8680
- C:\Windows\System\wRyUIfL.exe
  C:\Windows\System\wRyUIfL.exe
  2⤵
  PID:8316
- C:\Windows\System\LDRyjDp.exe
  C:\Windows\System\LDRyjDp.exe
  2⤵
  PID:7540
- C:\Windows\System\FulRveE.exe
  C:\Windows\System\FulRveE.exe
  2⤵
  PID:10988
- C:\Windows\System\cgQRafY.exe
  C:\Windows\System\cgQRafY.exe
  2⤵
  PID:8920
- C:\Windows\System\ViGgZYF.exe
  C:\Windows\System\ViGgZYF.exe
  2⤵
  PID:8272
- C:\Windows\System\eTKuLFF.exe
  C:\Windows\System\eTKuLFF.exe
  2⤵
  PID:6844
- C:\Windows\System\MnmPCSg.exe
  C:\Windows\System\MnmPCSg.exe
  2⤵
  PID:3376
- C:\Windows\System\Gewmeku.exe
  C:\Windows\System\Gewmeku.exe
  2⤵
  PID:9264
- C:\Windows\System\udIGxHm.exe
  C:\Windows\System\udIGxHm.exe
  2⤵
  PID:3416
- C:\Windows\System\HistWcs.exe
  C:\Windows\System\HistWcs.exe
  2⤵
  PID:10020
- C:\Windows\System\kRCSPtz.exe
  C:\Windows\System\kRCSPtz.exe
  2⤵
  PID:8620
- C:\Windows\System\GCriAfw.exe
  C:\Windows\System\GCriAfw.exe
  2⤵
  PID:9472
- C:\Windows\System\baeQGuQ.exe
  C:\Windows\System\baeQGuQ.exe
  2⤵
  PID:7460
- C:\Windows\System\CZPyxRB.exe
  C:\Windows\System\CZPyxRB.exe
  2⤵
  PID:14164
- C:\Windows\System\fvZIPXs.exe
  C:\Windows\System\fvZIPXs.exe
  2⤵
  PID:11348
- C:\Windows\System\jGzGUkC.exe
  C:\Windows\System\jGzGUkC.exe
  2⤵
  PID:11420
- C:\Windows\System\PNoLCyT.exe
  C:\Windows\System\PNoLCyT.exe
  2⤵
  PID:13652
- C:\Windows\System\KCkXJHP.exe
  C:\Windows\System\KCkXJHP.exe
  2⤵
  PID:11656
- C:\Windows\System\SyZhSCq.exe
  C:\Windows\System\SyZhSCq.exe
  2⤵
  PID:11004
- C:\Windows\System\gvThxTK.exe
  C:\Windows\System\gvThxTK.exe
  2⤵
  PID:7268
- C:\Windows\System\Tcjtbsq.exe
  C:\Windows\System\Tcjtbsq.exe
  2⤵
  PID:7816
- C:\Windows\System\aoyUyjw.exe
  C:\Windows\System\aoyUyjw.exe
  2⤵
  PID:6164
- C:\Windows\System\CEoQrDW.exe
  C:\Windows\System\CEoQrDW.exe
  2⤵
  PID:1612
- C:\Windows\System\xdPtUCe.exe
  C:\Windows\System\xdPtUCe.exe
  2⤵
  PID:10096
- C:\Windows\System\GHwedWD.exe
  C:\Windows\System\GHwedWD.exe
  2⤵
  PID:6956
- C:\Windows\System\ZcCmYLQ.exe
  C:\Windows\System\ZcCmYLQ.exe
  2⤵
  PID:9172
- C:\Windows\System\BpgNQWZ.exe
  C:\Windows\System\BpgNQWZ.exe
  2⤵
  PID:7880
- C:\Windows\System\dwZAPui.exe
  C:\Windows\System\dwZAPui.exe
  2⤵
  PID:10552
- C:\Windows\System\ZHGSDth.exe
  C:\Windows\System\ZHGSDth.exe
  2⤵
  PID:10292
- C:\Windows\System\StKRlNI.exe
  C:\Windows\System\StKRlNI.exe
  2⤵
  PID:10024
- C:\Windows\System\fqQjzTU.exe
  C:\Windows\System\fqQjzTU.exe
  2⤵
  PID:9916
- C:\Windows\System\VXKdDqE.exe
  C:\Windows\System\VXKdDqE.exe
  2⤵
  PID:11172
- C:\Windows\System\BTiBwIa.exe
  C:\Windows\System\BTiBwIa.exe
  2⤵
  PID:12220
- C:\Windows\System\mCXJYga.exe
  C:\Windows\System\mCXJYga.exe
  2⤵
  PID:7336
- C:\Windows\System\LwXqAAQ.exe
  C:\Windows\System\LwXqAAQ.exe
  2⤵
  PID:8732
- C:\Windows\System\mXJojSr.exe
  C:\Windows\System\mXJojSr.exe
  2⤵
  PID:8860
- C:\Windows\System\IzNVAmH.exe
  C:\Windows\System\IzNVAmH.exe
  2⤵
  PID:8252
- C:\Windows\System\nniwWFq.exe
  C:\Windows\System\nniwWFq.exe
  2⤵
  PID:6896
- C:\Windows\System\KvOXBoc.exe
  C:\Windows\System\KvOXBoc.exe
  2⤵
  PID:12484
- C:\Windows\System\ILjSXDw.exe
  C:\Windows\System\ILjSXDw.exe
  2⤵
  PID:2008
- C:\Windows\System\LeRIZnf.exe
  C:\Windows\System\LeRIZnf.exe
  2⤵
  PID:8488
- C:\Windows\System\TMdHuVh.exe
  C:\Windows\System\TMdHuVh.exe
  2⤵
  PID:9424
- C:\Windows\System\VULpPDk.exe
  C:\Windows\System\VULpPDk.exe
  2⤵
  PID:14148
- C:\Windows\System\GpxzncJ.exe
  C:\Windows\System\GpxzncJ.exe
  2⤵
  PID:11244
- C:\Windows\System\KPLlXCf.exe
  C:\Windows\System\KPLlXCf.exe
  2⤵
  PID:9376
- C:\Windows\System\LFplccq.exe
  C:\Windows\System\LFplccq.exe
  2⤵
  PID:10456
- C:\Windows\System\UqMEDCC.exe
  C:\Windows\System\UqMEDCC.exe
  2⤵
  PID:14184
- C:\Windows\System\sihZfka.exe
  C:\Windows\System\sihZfka.exe
  2⤵
  PID:8612
- C:\Windows\System\cbIBmes.exe
  C:\Windows\System\cbIBmes.exe
  2⤵
  PID:11468
- C:\Windows\System\lUbIHyo.exe
  C:\Windows\System\lUbIHyo.exe
  2⤵
  PID:9404
- C:\Windows\System\QgcmIeR.exe
  C:\Windows\System\QgcmIeR.exe
  2⤵
  PID:10576
- C:\Windows\System\mBthfYc.exe
  C:\Windows\System\mBthfYc.exe
  2⤵
  PID:12972
- C:\Windows\System\zMXFfNl.exe
  C:\Windows\System\zMXFfNl.exe
  2⤵
  PID:10492
- C:\Windows\System\WkSwiWb.exe
  C:\Windows\System\WkSwiWb.exe
  2⤵
  PID:11320
- C:\Windows\System\edcEQBQ.exe
  C:\Windows\System\edcEQBQ.exe
  2⤵
  PID:11228
- C:\Windows\System\ebMRygs.exe
  C:\Windows\System\ebMRygs.exe
  2⤵
  PID:10692
- C:\Windows\System\AQKRzBf.exe
  C:\Windows\System\AQKRzBf.exe
  2⤵
  PID:9036
- C:\Windows\System\yoaMNtt.exe
  C:\Windows\System\yoaMNtt.exe
  2⤵
  PID:10588
- C:\Windows\System\PxivRxp.exe
  C:\Windows\System\PxivRxp.exe
  2⤵
  PID:9536
- C:\Windows\System\FHjzqWt.exe
  C:\Windows\System\FHjzqWt.exe
  2⤵
  PID:12608
- C:\Windows\System\MxwjEtQ.exe
  C:\Windows\System\MxwjEtQ.exe
  2⤵
  PID:11840
- C:\Windows\System\wxSJThd.exe
  C:\Windows\System\wxSJThd.exe
  2⤵
  PID:11108
- C:\Windows\System\ZXyPQLj.exe
  C:\Windows\System\ZXyPQLj.exe
  2⤵
  PID:13704
- C:\Windows\System\fbekTkJ.exe
  C:\Windows\System\fbekTkJ.exe
  2⤵
  PID:10224
- C:\Windows\System\hMVALGI.exe
  C:\Windows\System\hMVALGI.exe
  2⤵
  PID:9516
- C:\Windows\System\iZYJXXg.exe
  C:\Windows\System\iZYJXXg.exe
  2⤵
  PID:10800
- C:\Windows\System\YqCojPa.exe
  C:\Windows\System\YqCojPa.exe
  2⤵
  PID:13184
- C:\Windows\System\UsyakMq.exe
  C:\Windows\System\UsyakMq.exe
  2⤵
  PID:13308
- C:\Windows\System\kFHyQEt.exe
  C:\Windows\System\kFHyQEt.exe
  2⤵
  PID:10512
- C:\Windows\System\kYiqaEU.exe
  C:\Windows\System\kYiqaEU.exe
  2⤵
  PID:11008
- C:\Windows\System\ReWMxhx.exe
  C:\Windows\System\ReWMxhx.exe
  2⤵
  PID:13272
- C:\Windows\System\spoMLAc.exe
  C:\Windows\System\spoMLAc.exe
  2⤵
  PID:13280
- C:\Windows\System\ppfXvcy.exe
  C:\Windows\System\ppfXvcy.exe
  2⤵
  PID:9484
- C:\Windows\System\prwrRBD.exe
  C:\Windows\System\prwrRBD.exe
  2⤵
  PID:13216
- C:\Windows\System\FWDSubX.exe
  C:\Windows\System\FWDSubX.exe
  2⤵
  PID:8384
- C:\Windows\System\FmtqdUp.exe
  C:\Windows\System\FmtqdUp.exe
  2⤵
  PID:10524
- C:\Windows\System\EttwXad.exe
  C:\Windows\System\EttwXad.exe
  2⤵
  PID:11752
- C:\Windows\System\oQlrKRs.exe
  C:\Windows\System\oQlrKRs.exe
  2⤵
  PID:9860
- C:\Windows\System\PNNiesT.exe
  C:\Windows\System\PNNiesT.exe
  2⤵
  PID:12616
- C:\Windows\System\SJDiTxb.exe
  C:\Windows\System\SJDiTxb.exe
  2⤵
  PID:12712
- C:\Windows\System\euojzOu.exe
  C:\Windows\System\euojzOu.exe
  2⤵
  PID:10608
- C:\Windows\System\wlRRgqJ.exe
  C:\Windows\System\wlRRgqJ.exe
  2⤵
  PID:7652
- C:\Windows\System\zKNhCJT.exe
  C:\Windows\System\zKNhCJT.exe
  2⤵
  PID:11648
- C:\Windows\System\rGzgrif.exe
  C:\Windows\System\rGzgrif.exe
  2⤵
  PID:8148
- C:\Windows\System\cIxzMIR.exe
  C:\Windows\System\cIxzMIR.exe
  2⤵
  PID:12940
- C:\Windows\System\RjsYciI.exe
  C:\Windows\System\RjsYciI.exe
  2⤵
  PID:1396
- C:\Windows\System\SAyQFZp.exe
  C:\Windows\System\SAyQFZp.exe
  2⤵
  PID:11176
- C:\Windows\System\gXQxgQJ.exe
  C:\Windows\System\gXQxgQJ.exe
  2⤵
  PID:10200
- C:\Windows\System\ytUnBuT.exe
  C:\Windows\System\ytUnBuT.exe
  2⤵
  PID:14108
- C:\Windows\System\OeWwrpm.exe
  C:\Windows\System\OeWwrpm.exe
  2⤵
  PID:7464
- C:\Windows\System\CfoTUTN.exe
  C:\Windows\System\CfoTUTN.exe
  2⤵
  PID:7924
- C:\Windows\System\uzJpWbx.exe
  C:\Windows\System\uzJpWbx.exe
  2⤵
  PID:11652
- C:\Windows\System\Yaykynz.exe
  C:\Windows\System\Yaykynz.exe
  2⤵
  PID:11084
- C:\Windows\System\jnyPxDi.exe
  C:\Windows\System\jnyPxDi.exe
  2⤵
  PID:11036
- C:\Windows\System\PuzJFcS.exe
  C:\Windows\System\PuzJFcS.exe
  2⤵
  PID:9460
- C:\Windows\System\wpSmWvJ.exe
  C:\Windows\System\wpSmWvJ.exe
  2⤵
  PID:13180
- C:\Windows\System\HIRQpKU.exe
  C:\Windows\System\HIRQpKU.exe
  2⤵
  PID:13252
- C:\Windows\System\gAvswME.exe
  C:\Windows\System\gAvswME.exe
  2⤵
  PID:7072
- C:\Windows\System\qxryFnm.exe
  C:\Windows\System\qxryFnm.exe
  2⤵
  PID:10400
- C:\Windows\System\usyzGRp.exe
  C:\Windows\System\usyzGRp.exe
  2⤵
  PID:12644
- C:\Windows\System\WWnDHPe.exe
  C:\Windows\System\WWnDHPe.exe
  2⤵
  PID:8608
- C:\Windows\System\uizjATy.exe
  C:\Windows\System\uizjATy.exe
  2⤵
  PID:8052
- C:\Windows\System\iJoHHPo.exe
  C:\Windows\System\iJoHHPo.exe
  2⤵
  PID:13260
- C:\Windows\System\mDKFqBO.exe
  C:\Windows\System\mDKFqBO.exe
  2⤵
  PID:8820
- C:\Windows\System\uDfOQhq.exe
  C:\Windows\System\uDfOQhq.exe
  2⤵
  PID:11536
- C:\Windows\System\ByJfSNA.exe
  C:\Windows\System\ByJfSNA.exe
  2⤵
  PID:12428
- C:\Windows\System\HchEFVV.exe
  C:\Windows\System\HchEFVV.exe
  2⤵
  PID:10832
- C:\Windows\System\jDsrrYH.exe
  C:\Windows\System\jDsrrYH.exe
  2⤵
  PID:10160
- C:\Windows\System\YgEjCBV.exe
  C:\Windows\System\YgEjCBV.exe
  2⤵
  PID:8916
- C:\Windows\System\oQqyJiJ.exe
  C:\Windows\System\oQqyJiJ.exe
  2⤵
  PID:12992
- C:\Windows\System\lpjvnZZ.exe
  C:\Windows\System\lpjvnZZ.exe
  2⤵
  PID:10788
- C:\Windows\System\lBKZBFJ.exe
  C:\Windows\System\lBKZBFJ.exe
  2⤵
  PID:12444
- C:\Windows\System\suAcaRs.exe
  C:\Windows\System\suAcaRs.exe
  2⤵
  PID:10936
- C:\Windows\System\WTBXGuc.exe
  C:\Windows\System\WTBXGuc.exe
  2⤵
  PID:11052
- C:\Windows\System\OMaXlux.exe
  C:\Windows\System\OMaXlux.exe
  2⤵
  PID:11212
- C:\Windows\System\ZRvlCpQ.exe
  C:\Windows\System\ZRvlCpQ.exe
  2⤵
  PID:9284
- C:\Windows\System\brPfkpS.exe
  C:\Windows\System\brPfkpS.exe
  2⤵
  PID:6716
- C:\Windows\System\vJATmxF.exe
  C:\Windows\System\vJATmxF.exe
  2⤵
  PID:13112
- C:\Windows\System\RgowGou.exe
  C:\Windows\System\RgowGou.exe
  2⤵
  PID:9548
- C:\Windows\System\iufiLFH.exe
  C:\Windows\System\iufiLFH.exe
  2⤵
  PID:13100
- C:\Windows\System\AqoXgfT.exe
  C:\Windows\System\AqoXgfT.exe
  2⤵
  PID:13104
- C:\Windows\System\zUpNlBz.exe
  C:\Windows\System\zUpNlBz.exe
  2⤵
  PID:13192
- C:\Windows\System\ZSLcElq.exe
  C:\Windows\System\ZSLcElq.exe
  2⤵
  PID:13200
- C:\Windows\System\PczPADx.exe
  C:\Windows\System\PczPADx.exe
  2⤵
  PID:12640
- C:\Windows\System\riHzhOT.exe
  C:\Windows\System\riHzhOT.exe
  2⤵
  PID:12528
- C:\Windows\System\NMNITci.exe
  C:\Windows\System\NMNITci.exe
  2⤵
  PID:13172
- C:\Windows\System\ewPHriV.exe
  C:\Windows\System\ewPHriV.exe
  2⤵
  PID:11316
- C:\Windows\System\RVQxmfo.exe
  C:\Windows\System\RVQxmfo.exe
  2⤵
  PID:9628
- C:\Windows\System\drkqXAr.exe
  C:\Windows\System\drkqXAr.exe
  2⤵
  PID:11280
- C:\Windows\System\bnCxPEI.exe
  C:\Windows\System\bnCxPEI.exe
  2⤵
  PID:7904
- C:\Windows\System\KjARWjD.exe
  C:\Windows\System\KjARWjD.exe
  2⤵
  PID:8968
- C:\Windows\System\QVRioNL.exe
  C:\Windows\System\QVRioNL.exe
  2⤵
  PID:1912
- C:\Windows\System\kcmImee.exe
  C:\Windows\System\kcmImee.exe
  2⤵
  PID:6172
- C:\Windows\System\dCrTTKZ.exe
  C:\Windows\System\dCrTTKZ.exe
  2⤵
  PID:10640
- C:\Windows\System\wcuxcZo.exe
  C:\Windows\System\wcuxcZo.exe
  2⤵
  PID:9400
- C:\Windows\System\ACSWQSO.exe
  C:\Windows\System\ACSWQSO.exe
  2⤵
  PID:12272
- C:\Windows\System\JDTmTcN.exe
  C:\Windows\System\JDTmTcN.exe
  2⤵
  PID:12532
- C:\Windows\System\QjryHAr.exe
  C:\Windows\System\QjryHAr.exe
  2⤵
  PID:10736
- C:\Windows\System\VJRPbAm.exe
  C:\Windows\System\VJRPbAm.exe
  2⤵
  PID:11560
- C:\Windows\System\UHZRYTU.exe
  C:\Windows\System\UHZRYTU.exe
  2⤵
  PID:212
- C:\Windows\System\zsehYrT.exe
  C:\Windows\System\zsehYrT.exe
  2⤵
  PID:11928
- C:\Windows\System\GTQanQi.exe
  C:\Windows\System\GTQanQi.exe
  2⤵
  PID:12020
- C:\Windows\System\pSLvHKG.exe
  C:\Windows\System\pSLvHKG.exe
  2⤵
  PID:7080
- C:\Windows\System\bUyCxLw.exe
  C:\Windows\System\bUyCxLw.exe
  2⤵
  PID:4276
- C:\Windows\System\gEsNmNz.exe
  C:\Windows\System\gEsNmNz.exe
  2⤵
  PID:10500
- C:\Windows\System\nvEULGL.exe
  C:\Windows\System\nvEULGL.exe
  2⤵
  PID:13396
- C:\Windows\System\YCVYMHC.exe
  C:\Windows\System\YCVYMHC.exe
  2⤵
  PID:13504
- C:\Windows\System\BvJtWAL.exe
  C:\Windows\System\BvJtWAL.exe
  2⤵
  PID:7476
- C:\Windows\System\TPhkNcd.exe
  C:\Windows\System\TPhkNcd.exe
  2⤵
  PID:10220
- C:\Windows\System\ULmLLJT.exe
  C:\Windows\System\ULmLLJT.exe
  2⤵
  PID:9348
- C:\Windows\System\oCgUikG.exe
  C:\Windows\System\oCgUikG.exe
  2⤵
  PID:5272
- C:\Windows\System\hIXZXQV.exe
  C:\Windows\System\hIXZXQV.exe
  2⤵
  PID:8256
- C:\Windows\System\iEAOuKS.exe
  C:\Windows\System\iEAOuKS.exe
  2⤵
  PID:9396
- C:\Windows\System\tgQLdjl.exe
  C:\Windows\System\tgQLdjl.exe
  2⤵
  PID:12404
- C:\Windows\System\SyNfFDQ.exe
  C:\Windows\System\SyNfFDQ.exe
  2⤵
  PID:11924
- C:\Windows\System\yKSUIvy.exe
  C:\Windows\System\yKSUIvy.exe
  2⤵
  PID:11512
- C:\Windows\System\EZTPVzO.exe
  C:\Windows\System\EZTPVzO.exe
  2⤵
  PID:7276
- C:\Windows\System\zqwnSUW.exe
  C:\Windows\System\zqwnSUW.exe
  2⤵
  PID:12520
- C:\Windows\System\BhjyHaE.exe
  C:\Windows\System\BhjyHaE.exe
  2⤵
  PID:9980
- C:\Windows\System\VvADSWi.exe
  C:\Windows\System\VvADSWi.exe
  2⤵
  PID:10100
- C:\Windows\System\ZuFZBMV.exe
  C:\Windows\System\ZuFZBMV.exe
  2⤵
  PID:8416
- C:\Windows\System\MxOgguy.exe
  C:\Windows\System\MxOgguy.exe
  2⤵
  PID:8800
- C:\Windows\System\MrPcZhd.exe
  C:\Windows\System\MrPcZhd.exe
  2⤵
  PID:9624
- C:\Windows\System\qOjTjnd.exe
  C:\Windows\System\qOjTjnd.exe
  2⤵
  PID:8168
- C:\Windows\System\drnSRJm.exe
  C:\Windows\System\drnSRJm.exe
  2⤵
  PID:8472
- C:\Windows\System\YXIksgM.exe
  C:\Windows\System\YXIksgM.exe
  2⤵
  PID:4776
- C:\Windows\System\MHFhOoU.exe
  C:\Windows\System\MHFhOoU.exe
  2⤵
  PID:11372
- C:\Windows\System\TyYZFVp.exe
  C:\Windows\System\TyYZFVp.exe
  2⤵
  PID:11732
- C:\Windows\System\lWBjdXM.exe
  C:\Windows\System\lWBjdXM.exe
  2⤵
  PID:6824
- C:\Windows\System\JIAwCOE.exe
  C:\Windows\System\JIAwCOE.exe
  2⤵
  PID:9200
- C:\Windows\System\SRLccpR.exe
  C:\Windows\System\SRLccpR.exe
  2⤵
  PID:6708
- C:\Windows\System\LfYAJwk.exe
  C:\Windows\System\LfYAJwk.exe
  2⤵
  PID:12524
- C:\Windows\System\sRBdNVz.exe
  C:\Windows\System\sRBdNVz.exe
  2⤵
  PID:5400
- C:\Windows\System\aJIWoiC.exe
  C:\Windows\System\aJIWoiC.exe
  2⤵
  PID:9884
- C:\Windows\System\YElGruw.exe
  C:\Windows\System\YElGruw.exe
  2⤵
  PID:13052
- C:\Windows\System\BrSuzbN.exe
  C:\Windows\System\BrSuzbN.exe
  2⤵
  PID:9296
- C:\Windows\System\YqJWvoq.exe
  C:\Windows\System\YqJWvoq.exe
  2⤵
  PID:6520
- C:\Windows\System\YdWpIbF.exe
  C:\Windows\System\YdWpIbF.exe
  2⤵
  PID:14236
- C:\Windows\System\ntIzXaf.exe
  C:\Windows\System\ntIzXaf.exe
  2⤵
  PID:14252
- C:\Windows\System\zqvPOVr.exe
  C:\Windows\System\zqvPOVr.exe
  2⤵
  PID:3188
- C:\Windows\System\oSZshuw.exe
  C:\Windows\System\oSZshuw.exe
  2⤵
  PID:14436
- C:\Windows\System\HgOYIvp.exe
  C:\Windows\System\HgOYIvp.exe
  2⤵
  PID:14452
- C:\Windows\System\uTeYzkI.exe
  C:\Windows\System\uTeYzkI.exe
  2⤵
  PID:14472
- C:\Windows\System\wpCgbYT.exe
  C:\Windows\System\wpCgbYT.exe
  2⤵
  PID:14528
- C:\Windows\System\cCrbOwq.exe
  C:\Windows\System\cCrbOwq.exe
  2⤵
  PID:14560
- C:\Windows\System\KXauRjj.exe
  C:\Windows\System\KXauRjj.exe
  2⤵
  PID:14592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amlquins.ggw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BuUBDtI.exe

Filesize
2.3MB

MD5
41eef1fdb4414e8fc4a9de7f983d2230

SHA1
c57a789587f98264a968452baa96221cc830a74d

SHA256
d4f768ea04e55f2eca072fc3843bc954474b5a91ddb9b93e7c59da7ba0ec659b

SHA512
915fd1bb09ccff136d7036be84498e12b6c8f17c2df46541b8d25a613d31188cb9d9101a61aebd27f01c88533b288ff1d497d4c85a2f9299d654bb3f9b454756

Download Submit
C:\Windows\System\CWXEhXl.exe

Filesize
2.3MB

MD5
f57a29ffc25d1385dc9e7795d5e2eb76

SHA1
16fbead66bd4be96028613bab5de39753aa0aadb

SHA256
6eca55839bc26b261da493097a649aff3e5e035657a408556cb6ab7a2550f11e

SHA512
8d39b893b8e815eaa5953bf1228709ba806bd6439366564c77564e93d3236f6b5d0d01676fb9a9a521e0954268eac9daf721efd532981f4f28449bae7e1b0b0c

Download Submit
C:\Windows\System\EAHodlR.exe

Filesize
2.3MB

MD5
b605bf75b2a6c95a28e9f91ca19cae64

SHA1
c85a1801e42ab2e85a3331cae4a166977071537f

SHA256
e6c4bc2eb40a03a479642045906f4baae7d9060ca891f3de203a0eb06e0ee6c4

SHA512
39c2bb29b80b8f752d59a4c9d15b2d9eda6ccda400947cdb23c30014273bea9a131b21292b1571ddabc5c9d2c13767c447ef05ad8db9f9d5747245abfa311c48

Download Submit
C:\Windows\System\GSzLONE.exe

Filesize
2.3MB

MD5
d995ed1fc75e2f8341781bbfba687658

SHA1
a894e00bbdc2203b8d90d32fff723d14465665b1

SHA256
15679bc2ea495b9485cf26bdc9b642d0ccf4768aca775408eab27200ee5fc6dc

SHA512
d3795237e51d395da7de31e99d03131b09586ef486e6ec2ee98abd9492f81d7d571e1b3898b6e9b4fb72f3302191d22e7e5e77f9ad373c460df69863206d99e6

Download Submit
C:\Windows\System\HIPQLVi.exe

Filesize
2.3MB

MD5
38c44cefba12f59fe8f611fabc7fb5fb

SHA1
9ccdf15eee46f231216eb19dd00c3aeec55a302e

SHA256
e44e178284fe88ce7308d03a66941dd745362cf320f87d6d54b834370f992f2f

SHA512
fc08ce9748124f1df3c054a7fbd4bbbf26a26cf88331dfdf6b9d308a253e086ce8eadaee3e79131748a720aa9127c3e736f6e4af36f69fedd680a39573e426cc

Download Submit
C:\Windows\System\JsQkNnS.exe

Filesize
2.3MB

MD5
6a89cd2434dc871ba8156a69198a8308

SHA1
c7307b9adcf23a635e4a6d04feaf7651e034777a

SHA256
e42bbd3a5bd109c865022c42de385cece01e90b92f9d751e44275423d3f2393d

SHA512
b0d8193ded59a23206f0ba0224db453b57258e491cff0dfcb0f506381b8bedc58b2e224032a5c2fe180b83661ae36afe53b557f4822ddad23ce32b7203c3c452

Download Submit
C:\Windows\System\LrBFNMQ.exe

Filesize
2.3MB

MD5
1be510f83f1c8099bbb2d645d88e5190

SHA1
ce89431f7555d1627f6d2fe224fa70b6e8bead01

SHA256
3e6747db90f7289897e67014ae6b0be037e0970e3e16b2fbfc831e754f4b3def

SHA512
bb78d8f8fd115ccc70f75312678278ea3c29484b0b5de232268f921b36145fb54a1f209c082a6cb985a8fec1b07222d345297ee3914ba092a3a5bec1f14ce975

Download Submit
C:\Windows\System\MdTEKHd.exe

Filesize
2.3MB

MD5
5eb1b1b2cfd65ff6e4e044f544a4c963

SHA1
8facb4570d088467a71db4a8ec13376657170c7e

SHA256
8f6c94fc83d0c06d0c894eb86aab31cacf286f2e5da84e84d77bc02e59db3acb

SHA512
e0345a757461aecf6b424fb11d5b9e9ed9223361f20f63ace64f9eda74718d67d79aa3e1409c50e6d08010b0280c7042f1836ae81358ae009f47fc6389846de6

Download Submit
C:\Windows\System\NPggetR.exe

Filesize
2.3MB

MD5
4a10c1d34cfd34201f65b55a51295b44

SHA1
52d34f8f3e6e4f7addef2c92e78758d12966cb1e

SHA256
e8315b9da8ecc9cf697ca8512b2bdd94c18066b90057311f88175493d337f70f

SHA512
f6d6e45192a4feda6194e0adf906bc8c413f06d28ed092f35c7c92f33d5610f3df22919d4a37db5ded79916d21ef6be42636cf6b2d602eeb318031377f5b49d1

Download Submit
C:\Windows\System\QkPbquZ.exe

Filesize
2.3MB

MD5
6a9cb0921c65ca3309a1266f49aaf48c

SHA1
c169aea770633b1f91ead0e02c80866a9edaf58a

SHA256
70778920649cb2637548d87a0e15385e20533d79cb0bc9e93abe94d3a44cb2ba

SHA512
d0aaaff5cc9c6725a71de1bef1dbe005f4df398560e5161823227c8e01e3907a1f68677839fd57319cf66d4662334730c023a7a885931c73c0079f037a29c91c

Download Submit
C:\Windows\System\TYJyxGo.exe

Filesize
2.3MB

MD5
1a1d1f5d888d2e782bad246e2681e7e0

SHA1
b43f96ff83a476a0ac68e590beca28a6251c636a

SHA256
85cbacb55ed2d1cc4f7d78e011ff2d00dee4d87fb6af954d701e996ae107ca5c

SHA512
6c4d4a359cd2cf4a68edb490e60d623cb2fd644ef178c78b010d42ee37a05471fa6f67a2e8f1e52c23747d61a0cb58fdefcc0c60860900a039b84d5549886abf

Download Submit
C:\Windows\System\UCGciTF.exe

Filesize
2.3MB

MD5
66c7547f0781e7c8465c7335477371e6

SHA1
b6a97d21232285fdd2a886dede6ccaf9f6566d10

SHA256
b288cab538973f80014945cda1a4d084fb0afdc061d790f44b8dcef1561b919d

SHA512
61d09357ab8a1d99eeab1399b4b72ceafd5dbd4377e4dd3ca7257811226a66a24a4673d6d364a0190d236c5e2f53ba221721809c7fe00c77a834937e89dde023

Download Submit
C:\Windows\System\UDaHOKZ.exe

Filesize
2.3MB

MD5
567d7fccb6b240c9a0c5e4346a339dd6

SHA1
a27b5cc0ad536b904c3d511fcbf9e60de13b241c

SHA256
99e12b0f220c15e9b58457ad95cdc142ed658b0281e3538b94060adde352958a

SHA512
cf824352405040fad0a1354f8d53542990f363feb733d90f979b8ef25442f2ae67c732fc18cde001ebbbb6d9577556fa014ba6e59efa1e2d2c4b6540de6d8460

Download Submit
C:\Windows\System\VUdIayt.exe

Filesize
2.3MB

MD5
056e91948c3bd50cca632b92972ae91f

SHA1
3024f6b66b5bc59b3980525532432dcc2f150939

SHA256
fa455230382ca5bd50364bcc0e24a6dfaa8c188185461aee9627f72f986d8851

SHA512
6cda1dd9d69756c5fe7e31e50230ab8739adeb497c3114117a32e3ac71c08268f8aa7d2b122dcd77a4327537cceb5c715339b8f6d4f8f072a071479d5a57c89f

Download Submit
C:\Windows\System\WHpLkXI.exe

Filesize
2.3MB

MD5
904dcaac7c01ec7f5c522cb447dc930c

SHA1
34971a9c32a342f2506509b6647f6a10fafa8787

SHA256
975cbb2b3fe5e25e22db5d6b14e3eb1ff596ddecd0ecf1b9f922dfb28c6afad8

SHA512
3ffd78aaad6d5c81896327ac7022b7577c3fc89396d9019269e7d63dc5f6bead087aed91d7d4ad1e7b96663804f45d49cf44d3a5fa725b4f87853adb80a0aade

Download Submit
C:\Windows\System\WOWCeFa.exe

Filesize
2.3MB

MD5
db5b083ad0cf8fc33c6e2cd5155e514e

SHA1
4c70d9fd0a7e68e8227f0eebd163fb7445eca563

SHA256
66215cec7caae4b2b0db823c82954777f8d4854e0faaf1cca6cc61f1a4fec682

SHA512
1ecd0d9ada445fac4a73caae62ea1459f43a25f76d16f14efb74e83f42459984e044d876994e340d2a41de5352f9ab0097baec04a554511c32ff3dd42b3d569d

Download Submit
C:\Windows\System\WeuSmSg.exe

Filesize
2.3MB

MD5
1a3cbae30425d6d1f542f71b1eb83475

SHA1
8223ca18ca793ab9053c172ddfc7a7ba3476f63c

SHA256
1ed6d6dc302e953c3c16d13c5eb3c5d4ca1f65c85c5b78837b41ca6ce9ec53ed

SHA512
de571319b4724250ecb0ecbb299dd2a48d66db327c3d58185739792522d3297d0d09e919a522034c2f8d82df191d0958f989e64132c864d245a4934534c84b79

Download Submit
C:\Windows\System\XMFenhb.exe

Filesize
2.3MB

MD5
200df4f9a5ec4d8653e4e9e33ac005f6

SHA1
92b5b571ff43a673682d3d6e73cf2135caa728bb

SHA256
a9ae9e2720d453cd2682ce83d1180114f1d6516f01ea99f77bd9566b2c3aee60

SHA512
71f3ce7bd6e6f8af58e8a74cde989e946b4b5c426fc640420f197eb8d801fbe1c8e0559d8998e94e92d1600c423d453ea1b2eafdc8790ef0d20220801730093d

Download Submit
C:\Windows\System\XbwptQg.exe

Filesize
2.3MB

MD5
b984fc523876ef3e633c133e74eb34a7

SHA1
cb80f8b30f08d67dd983ea6401d9e56f02ba6fff

SHA256
da7602811b3bb446dbada3710fa21174259d645cfb313a476ae7421b022e84bd

SHA512
eb0f279ae9d6152a7ccf2cb0efa04f61e4650e26cfe98bd74cd040f08c35c365fdd09f41c3b6be42fbe0f6b60a9de372f34b2679ba7de3a96408a9c4b9c9d9cb

Download Submit
C:\Windows\System\XcsYRzj.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\XfKzHzN.exe

Filesize
18B

MD5
22152ecc1df3a96b28053bf455c90507

SHA1
d8bf6eba4d9bed5a98fae18923f65b1588f8e10f

SHA256
c0c034a9c894ca053c6684fc78523c77b7a09b3a91b01db48b68c2cf921966e1

SHA512
409b6155423769334cf3f9aff8477dcab133fc0d80c40beb2174d23bcee6b144df61cf63175ebd37324ea7b3b35780a1df5ee7f9cf384a4564fb3ff119afedb6

Download Submit
C:\Windows\System\XjndBLF.exe

Filesize
2.3MB

MD5
a812c130f31360a45cd7fc0b285c4d58

SHA1
697d3cdcec940adf7fed76fd656f863ceebce419

SHA256
18cdbac27a4dec72290e957061d4a3068a3dcdf144fd7e0c3fee17afd24e660a

SHA512
f89147d731388ccb3e74bde28c13ed7e385c434a530a7b674650082d189248f73e4a0775292379374b0ed3b7fb8f708eebe21275f169a9dd66aefc69169f4bd8

Download Submit
C:\Windows\System\ZpFgAdU.exe

Filesize
2.3MB

MD5
a9edfedc56411d77432182ae1f0c4dd0

SHA1
913bbfff9713ed7a55dc5ab0170209fae22bc913

SHA256
4ea11ddb3747c295e9d2e5ebfbcfd348f9406e45a6ec41fd812a11cf22347898

SHA512
b0d661a03d6a3877b88496806dcc2feda178edde78392d724d86c9c313ac15e193087c7a7eebc9984688ce403ee8a92df7911fd65bb4d5341eae7836bdb9c71b

Download Submit
C:\Windows\System\axvgxHL.exe

Filesize
2.3MB

MD5
cc73ebaa0090d0240cf913dfdbeef7ef

SHA1
3e9004cee90b08d5f41ab938ab445bd53c6de1be

SHA256
7cc03f918e0c3214321d55aa2ccef9bba50accf3ae0420b7170c2514f161203f

SHA512
21bdc1c7366b922f9d1d500eee41aab9e251aeec8f231de9340136586f4bb2889bf13ff84086287edaf22977d87a5a9d2aaf76154040a5de540e151f281be708

Download Submit
C:\Windows\System\bwacqPP.exe

Filesize
2.3MB

MD5
a05c491670fbc882b5eb03045f1af09b

SHA1
6b43b17fb49263c26b97b226a533e7cac746c769

SHA256
de1edc4dc98950d7c2d0b7307694cf637a5950b74235be14c56fe8e335ca7a65

SHA512
1201da13b85fa41ae795856cb254d76665e3c9f910a655d2d4c3b15a2855610c2ad013290e46fa87653723fe2dbcb2bc10a78e607fd78e11e2a367ace524a3ac

Download Submit
C:\Windows\System\eZgGQMR.exe

Filesize
2.3MB

MD5
2980d6adce02791e37bd55bb7c512508

SHA1
96f069ca7b1ed4ac65e83c196a2c4ef8dea6e6d0

SHA256
edd95083052450372336170e50fe659bfaa37359896e4eb2be49736ead23b3ff

SHA512
7a05075008fe4d542bb9cd61d4a68ac096226c3e14678f56f30f2310ddf19ccd74ece2f71f1b2005c3131a6b6d2c58bb6365277f0e5f201b6eecf23ae4070943

Download Submit
C:\Windows\System\fODKJjq.exe

Filesize
2.3MB

MD5
b697d5d57a21ccb2a41321d3dbc74296

SHA1
8eefd49e71e426a001890605410388aa0d6de84f

SHA256
521c52596b2473c99578a0e16b5d5a2f46665aadcf2b6c730f6d5744b2b46616

SHA512
44a5acbe16dbe4e6118038f7ec10f2d7ef32bc83affb4e78ce54c648d5e1e6a94952cf550ae6409d96e6d2916bca03175032619c59c936e14b0e209231a97f96

Download Submit
C:\Windows\System\fdTsCXo.exe

Filesize
2.3MB

MD5
06c1a35f0526755e29aa465859b8819d

SHA1
634dcb04a48a744d53d99f09321cbb8ffec66e75

SHA256
dfe0fc18aeebc59f13c98e3951726a3c980d484ca301998bea9c95203892e34d

SHA512
c36e3c39b618c7f82f89ddaa990d7b32032aa790f35c73abc9514f450f6b1b03f7da8803d743a9917f69a15e8e6b9fee31e2d0ffb89e2cff49da518fce1aa56b

Download Submit
C:\Windows\System\gPTnCfW.exe

Filesize
2.3MB

MD5
05a5d52215cf06ed8174c43b8c8ac4a6

SHA1
7a36130e6bca03f935faed4524b376de8c3e7bf7

SHA256
2d18b4b01ae1f6f1d955e88778d9d0c10586fed379e19e728de09b6acfb6ac55

SHA512
dc8cd12348741cbace54459d1fcafb8ece7eceae4c2ed57aa4e574733409edd664b13cfaabaa0ebaaee5f21585215e1b7f7d8f970d080a3c56f7a59ba2dce828

Download Submit
C:\Windows\System\gZiPymX.exe

Filesize
2.3MB

MD5
676f6a58f3fd6aaf01be2396a843becb

SHA1
8347a5cd390aebc68c016d89001dc3e299bcd3ef

SHA256
4a500848e35696b87ab15aed30911ba70b4721204fe3aa6e0224077adf08028f

SHA512
f2de6917d24c0b2af1096a974235eecd43da8363f4eb8453c94a2a20e012c04ed32b38c5adb5485ff4afba2c54a830204d913bd2798c43d6a34f2c1bb6b12678

Download Submit
C:\Windows\System\kvyCMJL.exe

Filesize
2.3MB

MD5
e910dbcb7e58cd31047ab60128d43cf8

SHA1
eac0015450e04a589128c8986b7c4b80fed3f81a

SHA256
6aed40eee1666e797f3d14d1b46a82e7a1223feb23308f24706375bf176396a7

SHA512
0f73977db6690567efb7a6629c8f435a9a8ff6bcca7558b724d7ddff303fd890d355faba7a785f4bbb022f6a82174ad2baaa2e02b3c6dffe801ec6b8d1e16037

Download Submit
C:\Windows\System\nWEeGHF.exe

Filesize
2.3MB

MD5
5b4e7994d8a545987d18841af5f06e53

SHA1
ae038a34e0e49c8fe30469d5398309f01128cb3a

SHA256
61b1270b04c90e5e7aa7b63f4414eca41da531d298f184b239486205d5f6c52a

SHA512
60c0810ae656ed59b63caa4b53661abd5c94f12eb29c4f9c13313b129f689500f9273c73acea8188c011c4190348f6eec79c36a7fec147f922b43e96ed8dff54

Download Submit
C:\Windows\System\oHpOExG.exe

Filesize
2.3MB

MD5
8d6d64df61095fe087a33dc6130ef9a2

SHA1
306b8425c21c996cecd548048bbb7d9ef7a7841a

SHA256
a79faa23b9c848b9c961364091ab84b9910d536f2a366ed5ac8815d898e20ecd

SHA512
c00a347d795cfb2dc2fa6eb05d10abec2c1b0fc8393a203523a67cafef02b948554e49ec8bb29657b78f6207010d5adcf8a349dba8a9a68cc9bf0fd112e05a0b

Download Submit
C:\Windows\System\oLYEWFI.exe

Filesize
2.3MB

MD5
8504ab30ba72dc018b1c7c9d70a7a71f

SHA1
58a632248393950919ff1a454fff63895f34da62

SHA256
12f496460a90a1e7413424f80cc94dcdbb39df95364afd92be912aaeba623c13

SHA512
2a01e7e5da7307a86626c5f5b190c3c6f71eda613438d215587be601f00dc023996ec3ac83b588b3a31a7dae7a2efba4b727a711142d22cbf1c82428c291f27e

Download Submit
C:\Windows\System\qAfZtMo.exe

Filesize
2.3MB

MD5
8bc3732bda9b90b575977af9b44b7aec

SHA1
e4a8ec9313661143d54aff59a56d22411b1850be

SHA256
b64e533975a80c1109449d7cb7787105922bb08277786b39cd5898f59be321d3

SHA512
210ec4f4425b8b3f510dde7057289967cc4db088c571dc6e7eea00720c0875aaab0ecd54a86230b958365b64b0dd36b910e14a2a96eaeb361ad3321b87eead2a

Download Submit
C:\Windows\System\rANzYvv.exe

Filesize
2.3MB

MD5
694a3e2cb6a45cd20462bd27835ebba3

SHA1
54f2b9dd2c6188d89b3aa1289ee7eeff2051cdf9

SHA256
cf219ba82056b174adf9cd5078a264d43e841dd2bfea2d3937bd4733deac9dc3

SHA512
2d16b824bf48a4c8698f514accab5235982ff733a166a04feae949dfffc792f4073ae833ef41dd14d22fccd25ec1314ec759089421f5af7650cf6608b703d136

Download Submit
C:\Windows\System\rJEJRhd.exe

Filesize
2.3MB

MD5
6dbe5cdc8bc3c4bed7f861f35a68aae8

SHA1
daa0bb03095ab1b35b17592b217209b092ae3f8b

SHA256
068e7720e59c08bb43970e9c6e88c56ed05bd75799a75dcb69ecc5ab4047218a

SHA512
fb1f88bfe92446e4f4e0c29549138d5f3b7326e5f3b70ed1eabd5ffba8a4b9f47ff86fa5f2718818a9f9c6b4921121286b0775a2c4093ff2a1570d07aad0c7e0

Download Submit
C:\Windows\System\vjUkcha.exe

Filesize
2.3MB

MD5
4eab1e06710edec79a64cc56498153a0

SHA1
27f3e555d2d2f3afc386a2686467787a05d6a862

SHA256
6a23f57242b9afdd06cac78ccf9d6edaa1d774cb67be8411371178d0e7aae590

SHA512
0cb4aed2e09dba8a4a17918111b1679f70d38013d82d50950a9646a9673ec53d18a95529b3646fae329d92fdb64457cbc6f56e7b2f96b2cc52ea48e723eca861

Download Submit
C:\Windows\System\vyyEDAh.exe

Filesize
2.3MB

MD5
92439d4ee2bd8e71ecb888c4dfa90af3

SHA1
1423b2b2849d435e930a2ea646e499b263ea4ecc

SHA256
d8df33c1caaa6107aad7ad9cfc4a241774f5e74aa9e609e8c41818eda7cafa37

SHA512
cc44783fecfe844abc01e1e70a2c5b5bfee29bf854b9b45f0f2cb8d1a71d2521e2403d544897973a30bec0bbc431897fd93d0eb32b8eaac03d9cb380d0a3424a

Download Submit
C:\Windows\System\zETDmVx.exe

Filesize
2.3MB

MD5
c914b35b69c40cb6fbb2af75eaff0b70

SHA1
3fae4ab01a88ddbdc2fff91dddc55168896a0b9e

SHA256
b549d9c61107cab0ccc02336353f7c972fb8c06fc58eb26a0057a8878c1661a6

SHA512
8b61c72c91236ed4a343f0801df1bba14cd5f9ef1ebd095caff7263315aae05d7901a00c2869a487a76b76faf608ae36f7ec5b20e34b7e9d238da6fb3a378d5b

Download Submit
memory/332-101-0x00007FF6E8FE0000-0x00007FF6E93D2000-memory.dmp

Filesize
3.9MB

Download
memory/332-4585-0x00007FF6E8FE0000-0x00007FF6E93D2000-memory.dmp

Filesize
3.9MB

Download
memory/844-370-0x00007FF74F280000-0x00007FF74F672000-memory.dmp

Filesize
3.9MB

Download
memory/1012-4630-0x00007FF6F6820000-0x00007FF6F6C12000-memory.dmp

Filesize
3.9MB

Download
memory/1012-451-0x00007FF6F6820000-0x00007FF6F6C12000-memory.dmp

Filesize
3.9MB

Download
memory/1172-425-0x00007FF6FC120000-0x00007FF6FC512000-memory.dmp

Filesize
3.9MB

Download
memory/1172-4670-0x00007FF6FC120000-0x00007FF6FC512000-memory.dmp

Filesize
3.9MB

Download
memory/1204-456-0x00007FF719DB0000-0x00007FF71A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-4596-0x00007FF719DB0000-0x00007FF71A1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4600-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-444-0x00007FF7AE7E0000-0x00007FF7AEBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-450-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp

Filesize
3.9MB

Download
memory/2368-4626-0x00007FF77EB70000-0x00007FF77EF62000-memory.dmp

Filesize
3.9MB

Download
memory/3020-208-0x00000120773D0000-0x00000120773F2000-memory.dmp

Filesize
136KB

Download
memory/3020-71-0x0000012077480000-0x0000012077490000-memory.dmp

Filesize
64KB

Download
memory/3020-44-0x00007FF8FD300000-0x00007FF8FDDC1000-memory.dmp

Filesize
10.8MB

Download
memory/3448-159-0x00007FF71B540000-0x00007FF71B932000-memory.dmp

Filesize
3.9MB

Download
memory/3448-4598-0x00007FF71B540000-0x00007FF71B932000-memory.dmp

Filesize
3.9MB

Download
memory/3572-167-0x00007FF6C6E00000-0x00007FF6C71F2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-455-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-4603-0x00007FF7C3CD0000-0x00007FF7C40C2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-4952-0x00007FF7C0E60000-0x00007FF7C1252000-memory.dmp

Filesize
3.9MB

Download
memory/3732-1-0x00000192F7E80000-0x00000192F7E90000-memory.dmp

Filesize
64KB

Download
memory/3732-0-0x00007FF7C0E60000-0x00007FF7C1252000-memory.dmp

Filesize
3.9MB

Download
memory/3772-262-0x00007FF7BFBA0000-0x00007FF7BFF92000-memory.dmp

Filesize
3.9MB

Download
memory/3772-4586-0x00007FF7BFBA0000-0x00007FF7BFF92000-memory.dmp

Filesize
3.9MB

Download
memory/3872-445-0x00007FF788240000-0x00007FF788632000-memory.dmp

Filesize
3.9MB

Download
memory/3884-346-0x00007FF6A29A0000-0x00007FF6A2D92000-memory.dmp

Filesize
3.9MB

Download
memory/4352-341-0x00007FF758880000-0x00007FF758C72000-memory.dmp

Filesize
3.9MB

Download
memory/4352-4656-0x00007FF758880000-0x00007FF758C72000-memory.dmp

Filesize
3.9MB

Download
memory/4384-340-0x00007FF6C2410000-0x00007FF6C2802000-memory.dmp

Filesize
3.9MB

Download
memory/4384-4604-0x00007FF6C2410000-0x00007FF6C2802000-memory.dmp

Filesize
3.9MB

Download
memory/4524-4559-0x00007FF727060000-0x00007FF727452000-memory.dmp

Filesize
3.9MB

Download
memory/4524-301-0x00007FF727060000-0x00007FF727452000-memory.dmp

Filesize
3.9MB

Download
memory/4536-4663-0x00007FF659420000-0x00007FF659812000-memory.dmp

Filesize
3.9MB

Download
memory/4536-454-0x00007FF659420000-0x00007FF659812000-memory.dmp

Filesize
3.9MB

Download
memory/4572-4602-0x00007FF66A420000-0x00007FF66A812000-memory.dmp

Filesize
3.9MB

Download
memory/4572-449-0x00007FF66A420000-0x00007FF66A812000-memory.dmp

Filesize
3.9MB

Download
memory/4748-452-0x00007FF7F68A0000-0x00007FF7F6C92000-memory.dmp

Filesize
3.9MB

Download
memory/4748-4635-0x00007FF7F68A0000-0x00007FF7F6C92000-memory.dmp

Filesize
3.9MB

Download
memory/4828-453-0x00007FF6E9BE0000-0x00007FF6E9FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-4658-0x00007FF6E9BE0000-0x00007FF6E9FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-4560-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp

Filesize
3.9MB

Download
memory/4912-231-0x00007FF7EDC50000-0x00007FF7EE042000-memory.dmp

Filesize
3.9MB

Download