xmrig | b07409c6911302d7fd8df5396881e90067ed4478e44f50d0ebadc002131fc584

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Size

1.8MB
MD5

04291d34f59d3b196aa45f0d04b40cd7
SHA1

0d710adfcbc6a1e3b6201d479fad6768088e436d
SHA256

b07409c6911302d7fd8df5396881e90067ed4478e44f50d0ebadc002131fc584
SHA512

34d35189dbd4d3f875ff9208b298eb43a9dc6069c8284d378f7d4a72e59468801d42e6e738c949e88613d76b87b68b8212c94a6b2253697cd8741da945f5429f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl1:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/2600-409-0x00007FF725650000-0x00007FF725A42000-memory.dmp	xmrig
behavioral2/memory/4388-476-0x00007FF720980000-0x00007FF720D72000-memory.dmp	xmrig
behavioral2/memory/1316-515-0x00007FF6EB6E0000-0x00007FF6EBAD2000-memory.dmp	xmrig
behavioral2/memory/3020-527-0x00007FF645B30000-0x00007FF645F22000-memory.dmp	xmrig
behavioral2/memory/2728-533-0x00007FF7600C0000-0x00007FF7604B2000-memory.dmp	xmrig
behavioral2/memory/3420-532-0x00007FF6E8AB0000-0x00007FF6E8EA2000-memory.dmp	xmrig
behavioral2/memory/1076-531-0x00007FF73ADD0000-0x00007FF73B1C2000-memory.dmp	xmrig
behavioral2/memory/1660-530-0x00007FF64F760000-0x00007FF64FB52000-memory.dmp	xmrig
behavioral2/memory/1456-529-0x00007FF6C0300000-0x00007FF6C06F2000-memory.dmp	xmrig
behavioral2/memory/2664-528-0x00007FF6E5900000-0x00007FF6E5CF2000-memory.dmp	xmrig
behavioral2/memory/396-526-0x00007FF7A3DC0000-0x00007FF7A41B2000-memory.dmp	xmrig
behavioral2/memory/3120-358-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp	xmrig
behavioral2/memory/3648-353-0x00007FF7F0B70000-0x00007FF7F0F62000-memory.dmp	xmrig
behavioral2/memory/4920-308-0x00007FF6B5230000-0x00007FF6B5622000-memory.dmp	xmrig
behavioral2/memory/4016-274-0x00007FF776F70000-0x00007FF777362000-memory.dmp	xmrig
behavioral2/memory/2764-235-0x00007FF6A0B00000-0x00007FF6A0EF2000-memory.dmp	xmrig
behavioral2/memory/348-194-0x00007FF653860000-0x00007FF653C52000-memory.dmp	xmrig
behavioral2/memory/1300-163-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp	xmrig
behavioral2/memory/668-162-0x00007FF616E00000-0x00007FF6171F2000-memory.dmp	xmrig
behavioral2/memory/2036-124-0x00007FF6812E0000-0x00007FF6816D2000-memory.dmp	xmrig
behavioral2/memory/1300-5158-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp	xmrig
behavioral2/memory/3420-5164-0x00007FF6E8AB0000-0x00007FF6E8EA2000-memory.dmp	xmrig
behavioral2/memory/3648-5188-0x00007FF7F0B70000-0x00007FF7F0F62000-memory.dmp	xmrig
behavioral2/memory/3120-5210-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp	xmrig
behavioral2/memory/4016-5216-0x00007FF776F70000-0x00007FF777362000-memory.dmp	xmrig
behavioral2/memory/2664-5230-0x00007FF6E5900000-0x00007FF6E5CF2000-memory.dmp	xmrig
behavioral2/memory/1076-5242-0x00007FF73ADD0000-0x00007FF73B1C2000-memory.dmp	xmrig
behavioral2/memory/4920-5262-0x00007FF6B5230000-0x00007FF6B5622000-memory.dmp	xmrig
behavioral2/memory/4388-5255-0x00007FF720980000-0x00007FF720D72000-memory.dmp	xmrig
behavioral2/memory/2728-5252-0x00007FF7600C0000-0x00007FF7604B2000-memory.dmp	xmrig
behavioral2/memory/1456-5235-0x00007FF6C0300000-0x00007FF6C06F2000-memory.dmp	xmrig
behavioral2/memory/1660-5240-0x00007FF64F760000-0x00007FF64FB52000-memory.dmp	xmrig
behavioral2/memory/3020-5233-0x00007FF645B30000-0x00007FF645F22000-memory.dmp	xmrig
behavioral2/memory/1316-5219-0x00007FF6EB6E0000-0x00007FF6EBAD2000-memory.dmp	xmrig
behavioral2/memory/396-5220-0x00007FF7A3DC0000-0x00007FF7A41B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
936	xsmtBfK.exe
2036	WuauviV.exe
668	YnUicbq.exe
3420	uwYUkMd.exe
1300	GlXWjdj.exe
348	jAncRUl.exe
2764	iaSscqR.exe
4016	BUnuwOI.exe
4920	xLHHzpZ.exe
3648	rxaDRSp.exe
3120	XaOeJuZ.exe
2600	tIcCRXs.exe
4388	JyADYqs.exe
1316	wQknSrM.exe
396	xoHupmA.exe
3020	KBuagPo.exe
2664	PDLLgdc.exe
1456	hUVIrzH.exe
1660	uVZNZmK.exe
1076	vONhDDd.exe
2728	mVaWsnt.exe
1344	fCKouCe.exe
3872	cmEWMNL.exe
4332	CIxTBIu.exe
3900	oqCPREN.exe
1048	BhMklDo.exe
5116	GOZYAZj.exe
4384	zkPjpva.exe
780	rJWAYXo.exe
4592	AFnkxxy.exe
3344	GQTLEva.exe
3156	gddyMWI.exe
2332	csLPBeU.exe
2320	oOoRflm.exe
3808	mtJOhoW.exe
704	PqgbHYn.exe
3920	MDdyKmV.exe
2444	aaYcMWd.exe
1652	UwtpFLs.exe
2796	PiTjPmj.exe
4200	EknnvSc.exe
4948	IxgFlpz.exe
1892	gVyQzer.exe
3988	dsMRnXc.exe
2124	FkjFXXu.exe
2628	ywghRSt.exe
4816	cyHfQIv.exe
5104	jjTzyQI.exe
4048	RNtjYXr.exe
228	nRfWist.exe
2128	SlygVZi.exe
3560	vtTDOaV.exe
2692	YUihwYl.exe
4576	DfmPgxC.exe
212	PzLQoVX.exe
4796	GAsJyXx.exe
4348	smXfKyb.exe
3540	kBynBGR.exe
4344	PsaIwYy.exe
4960	KYTaOho.exe
1156	tMDLvei.exe
3932	BDZqOMN.exe
1104	PnLJNmY.exe
3028	xSLwlZK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2868-0-0x00007FF66A170000-0x00007FF66A562000-memory.dmp	upx
behavioral2/files/0x000b000000023b7e-5.dat	upx
behavioral2/memory/936-11-0x00007FF7F2F20000-0x00007FF7F3312000-memory.dmp	upx
behavioral2/files/0x000a000000023b83-16.dat	upx
behavioral2/files/0x000a000000023b87-38.dat	upx
behavioral2/files/0x000a000000023b86-58.dat	upx
behavioral2/files/0x000a000000023b96-100.dat	upx
behavioral2/files/0x000a000000023b94-145.dat	upx
behavioral2/files/0x000a000000023ba7-180.dat	upx
behavioral2/memory/2600-409-0x00007FF725650000-0x00007FF725A42000-memory.dmp	upx
behavioral2/memory/4388-476-0x00007FF720980000-0x00007FF720D72000-memory.dmp	upx
behavioral2/memory/1316-515-0x00007FF6EB6E0000-0x00007FF6EBAD2000-memory.dmp	upx
behavioral2/memory/3020-527-0x00007FF645B30000-0x00007FF645F22000-memory.dmp	upx
behavioral2/memory/2728-533-0x00007FF7600C0000-0x00007FF7604B2000-memory.dmp	upx
behavioral2/memory/3420-532-0x00007FF6E8AB0000-0x00007FF6E8EA2000-memory.dmp	upx
behavioral2/memory/1076-531-0x00007FF73ADD0000-0x00007FF73B1C2000-memory.dmp	upx
behavioral2/memory/1660-530-0x00007FF64F760000-0x00007FF64FB52000-memory.dmp	upx
behavioral2/memory/1456-529-0x00007FF6C0300000-0x00007FF6C06F2000-memory.dmp	upx
behavioral2/memory/2664-528-0x00007FF6E5900000-0x00007FF6E5CF2000-memory.dmp	upx
behavioral2/memory/396-526-0x00007FF7A3DC0000-0x00007FF7A41B2000-memory.dmp	upx
behavioral2/memory/3120-358-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp	upx
behavioral2/memory/3648-353-0x00007FF7F0B70000-0x00007FF7F0F62000-memory.dmp	upx
behavioral2/memory/4920-308-0x00007FF6B5230000-0x00007FF6B5622000-memory.dmp	upx
behavioral2/memory/4016-274-0x00007FF776F70000-0x00007FF777362000-memory.dmp	upx
behavioral2/memory/2764-235-0x00007FF6A0B00000-0x00007FF6A0EF2000-memory.dmp	upx
behavioral2/memory/348-194-0x00007FF653860000-0x00007FF653C52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-185.dat	upx
behavioral2/files/0x000a000000023b97-178.dat	upx
behavioral2/files/0x000a000000023ba6-177.dat	upx
behavioral2/files/0x000a000000023b95-168.dat	upx
behavioral2/files/0x000a000000023ba5-167.dat	upx
behavioral2/files/0x000a000000023ba4-166.dat	upx
behavioral2/files/0x000a000000023ba3-165.dat	upx
behavioral2/files/0x000a000000023ba2-164.dat	upx
behavioral2/memory/1300-163-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp	upx
behavioral2/memory/668-162-0x00007FF616E00000-0x00007FF6171F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-161.dat	upx
behavioral2/files/0x000a000000023ba0-160.dat	upx
behavioral2/files/0x000a000000023b9f-159.dat	upx
behavioral2/files/0x000a000000023b9e-158.dat	upx
behavioral2/files/0x000a000000023b9d-156.dat	upx
behavioral2/files/0x000a000000023b8d-150.dat	upx
behavioral2/files/0x000a000000023ba8-184.dat	upx
behavioral2/files/0x000a000000023b92-135.dat	upx
behavioral2/files/0x000a000000023b90-128.dat	upx
behavioral2/files/0x000a000000023b91-127.dat	upx
behavioral2/memory/2036-124-0x00007FF6812E0000-0x00007FF6816D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-123.dat	upx
behavioral2/files/0x000a000000023b9a-122.dat	upx
behavioral2/files/0x000a000000023b99-121.dat	upx
behavioral2/files/0x000a000000023b8f-114.dat	upx
behavioral2/files/0x000a000000023b8e-108.dat	upx
behavioral2/files/0x000a000000023b89-107.dat	upx
behavioral2/files/0x000a000000023b98-105.dat	upx
behavioral2/files/0x000a000000023b9c-149.dat	upx
behavioral2/files/0x000a000000023b93-140.dat	upx
behavioral2/files/0x000a000000023b8b-91.dat	upx
behavioral2/files/0x000a000000023b8c-85.dat	upx
behavioral2/files/0x000a000000023b88-90.dat	upx
behavioral2/files/0x000a000000023b8a-52.dat	upx
behavioral2/files/0x000a000000023b85-28.dat	upx
behavioral2/files/0x000a000000023b84-43.dat	upx
behavioral2/files/0x000a000000023b82-25.dat	upx
behavioral2/memory/1300-5158-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jxDHmQz.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\JATomcZ.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\DuWQoWE.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\VJsvnYC.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\vqpALRw.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\unhFArN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\nyvOsbs.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\QLZgmCf.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\WAGLoiJ.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\yZUYnSR.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\QpJXFkw.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\ZZJhWho.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\fdwOlWh.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\bgygJRP.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\NdRvZQo.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\RXZItgn.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\NghvhTJ.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\hYdUwiB.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\epkwela.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\dvlNLNj.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\fjnTniY.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\tcSFwog.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\sQUmyje.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\xasausd.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\gsISTVt.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\uNickmN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\JDtFSSR.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\RBhclZw.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\LOPLDVr.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\aWqRTHV.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\LuxSBtD.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\ydZihoJ.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\LSiaabo.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\ddeTame.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\FZNmcDc.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\TcrihcN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\optwdXb.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\bRfVgbj.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\eiXJrKM.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\wwQYETR.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\oxZWgsC.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\jYNZYZM.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\BYPLEeD.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\PfIAlOD.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\KMKnZId.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\OGvWnSW.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\CpqAnnl.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\gptxogf.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\PlMizRL.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\qBmQqLE.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\elQVWUG.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\WTqEVJM.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\sotdcHI.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\xhZQyTA.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\YRQAJtL.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\ifMpRkj.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\IAJKxDd.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\cZcOOAO.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\BbBCsLA.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\vrFrJZl.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\XGyDLzN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\BkrWjVV.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\aRciqxe.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\zrLnKfN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeCreateGlobalPrivilege	5732	dwm.exe
Token: SeChangeNotifyPrivilege	5732	dwm.exe
Token: 33	5732	dwm.exe
Token: SeIncBasePriorityPrivilege	5732	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1604	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	84
PID 2868 wrote to memory of 1604	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	84
PID 2868 wrote to memory of 936	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	85
PID 2868 wrote to memory of 936	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	85
PID 2868 wrote to memory of 2036	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	86
PID 2868 wrote to memory of 2036	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	86
PID 2868 wrote to memory of 668	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	87
PID 2868 wrote to memory of 668	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	87
PID 2868 wrote to memory of 3420	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	88
PID 2868 wrote to memory of 3420	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	88
PID 2868 wrote to memory of 1300	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	89
PID 2868 wrote to memory of 1300	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	89
PID 2868 wrote to memory of 348	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	90
PID 2868 wrote to memory of 348	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	90
PID 2868 wrote to memory of 2764	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	91
PID 2868 wrote to memory of 2764	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	91
PID 2868 wrote to memory of 4016	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	92
PID 2868 wrote to memory of 4016	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	92
PID 2868 wrote to memory of 4920	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	93
PID 2868 wrote to memory of 4920	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	93
PID 2868 wrote to memory of 3648	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	94
PID 2868 wrote to memory of 3648	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	94
PID 2868 wrote to memory of 3120	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	95
PID 2868 wrote to memory of 3120	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	95
PID 2868 wrote to memory of 2600	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	96
PID 2868 wrote to memory of 2600	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	96
PID 2868 wrote to memory of 4388	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	97
PID 2868 wrote to memory of 4388	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	97
PID 2868 wrote to memory of 1316	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	98
PID 2868 wrote to memory of 1316	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	98
PID 2868 wrote to memory of 396	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	99
PID 2868 wrote to memory of 396	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	99
PID 2868 wrote to memory of 3020	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	100
PID 2868 wrote to memory of 3020	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	100
PID 2868 wrote to memory of 2664	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	101
PID 2868 wrote to memory of 2664	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	101
PID 2868 wrote to memory of 1456	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	102
PID 2868 wrote to memory of 1456	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	102
PID 2868 wrote to memory of 1660	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	103
PID 2868 wrote to memory of 1660	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	103
PID 2868 wrote to memory of 1076	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	104
PID 2868 wrote to memory of 1076	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	104
PID 2868 wrote to memory of 2728	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	105
PID 2868 wrote to memory of 2728	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	105
PID 2868 wrote to memory of 1344	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	106
PID 2868 wrote to memory of 1344	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	106
PID 2868 wrote to memory of 3872	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	107
PID 2868 wrote to memory of 3872	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	107
PID 2868 wrote to memory of 4332	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	108
PID 2868 wrote to memory of 4332	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	108
PID 2868 wrote to memory of 3900	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	109
PID 2868 wrote to memory of 3900	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	109
PID 2868 wrote to memory of 1048	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	110
PID 2868 wrote to memory of 1048	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	110
PID 2868 wrote to memory of 5116	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	111
PID 2868 wrote to memory of 5116	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	111
PID 2868 wrote to memory of 4384	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	112
PID 2868 wrote to memory of 4384	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	112
PID 2868 wrote to memory of 780	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	113
PID 2868 wrote to memory of 780	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	113
PID 2868 wrote to memory of 4592	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	114
PID 2868 wrote to memory of 4592	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	114
PID 2868 wrote to memory of 3344	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	115
PID 2868 wrote to memory of 3344	2868	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\System\xsmtBfK.exe
  C:\Windows\System\xsmtBfK.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\WuauviV.exe
  C:\Windows\System\WuauviV.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\YnUicbq.exe
  C:\Windows\System\YnUicbq.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\uwYUkMd.exe
  C:\Windows\System\uwYUkMd.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\GlXWjdj.exe
  C:\Windows\System\GlXWjdj.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\jAncRUl.exe
  C:\Windows\System\jAncRUl.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\iaSscqR.exe
  C:\Windows\System\iaSscqR.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\BUnuwOI.exe
  C:\Windows\System\BUnuwOI.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\xLHHzpZ.exe
  C:\Windows\System\xLHHzpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\rxaDRSp.exe
  C:\Windows\System\rxaDRSp.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\XaOeJuZ.exe
  C:\Windows\System\XaOeJuZ.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\tIcCRXs.exe
  C:\Windows\System\tIcCRXs.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\JyADYqs.exe
  C:\Windows\System\JyADYqs.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\wQknSrM.exe
  C:\Windows\System\wQknSrM.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\xoHupmA.exe
  C:\Windows\System\xoHupmA.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\KBuagPo.exe
  C:\Windows\System\KBuagPo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\PDLLgdc.exe
  C:\Windows\System\PDLLgdc.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\hUVIrzH.exe
  C:\Windows\System\hUVIrzH.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\uVZNZmK.exe
  C:\Windows\System\uVZNZmK.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\vONhDDd.exe
  C:\Windows\System\vONhDDd.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\mVaWsnt.exe
  C:\Windows\System\mVaWsnt.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\fCKouCe.exe
  C:\Windows\System\fCKouCe.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\cmEWMNL.exe
  C:\Windows\System\cmEWMNL.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\CIxTBIu.exe
  C:\Windows\System\CIxTBIu.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\oqCPREN.exe
  C:\Windows\System\oqCPREN.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\BhMklDo.exe
  C:\Windows\System\BhMklDo.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\GOZYAZj.exe
  C:\Windows\System\GOZYAZj.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\zkPjpva.exe
  C:\Windows\System\zkPjpva.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\rJWAYXo.exe
  C:\Windows\System\rJWAYXo.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\AFnkxxy.exe
  C:\Windows\System\AFnkxxy.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\GQTLEva.exe
  C:\Windows\System\GQTLEva.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\gddyMWI.exe
  C:\Windows\System\gddyMWI.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\csLPBeU.exe
  C:\Windows\System\csLPBeU.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\oOoRflm.exe
  C:\Windows\System\oOoRflm.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\mtJOhoW.exe
  C:\Windows\System\mtJOhoW.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\PqgbHYn.exe
  C:\Windows\System\PqgbHYn.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\MDdyKmV.exe
  C:\Windows\System\MDdyKmV.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\aaYcMWd.exe
  C:\Windows\System\aaYcMWd.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\UwtpFLs.exe
  C:\Windows\System\UwtpFLs.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\PiTjPmj.exe
  C:\Windows\System\PiTjPmj.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\EknnvSc.exe
  C:\Windows\System\EknnvSc.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\IxgFlpz.exe
  C:\Windows\System\IxgFlpz.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\gVyQzer.exe
  C:\Windows\System\gVyQzer.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\dsMRnXc.exe
  C:\Windows\System\dsMRnXc.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\FkjFXXu.exe
  C:\Windows\System\FkjFXXu.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\ywghRSt.exe
  C:\Windows\System\ywghRSt.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\cyHfQIv.exe
  C:\Windows\System\cyHfQIv.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\BDZqOMN.exe
  C:\Windows\System\BDZqOMN.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\jjTzyQI.exe
  C:\Windows\System\jjTzyQI.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\RNtjYXr.exe
  C:\Windows\System\RNtjYXr.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\nRfWist.exe
  C:\Windows\System\nRfWist.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\SlygVZi.exe
  C:\Windows\System\SlygVZi.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\vtTDOaV.exe
  C:\Windows\System\vtTDOaV.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\YUihwYl.exe
  C:\Windows\System\YUihwYl.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DfmPgxC.exe
  C:\Windows\System\DfmPgxC.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\PzLQoVX.exe
  C:\Windows\System\PzLQoVX.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\GAsJyXx.exe
  C:\Windows\System\GAsJyXx.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\smXfKyb.exe
  C:\Windows\System\smXfKyb.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\kBynBGR.exe
  C:\Windows\System\kBynBGR.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\PsaIwYy.exe
  C:\Windows\System\PsaIwYy.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\KYTaOho.exe
  C:\Windows\System\KYTaOho.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\tMDLvei.exe
  C:\Windows\System\tMDLvei.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\PnLJNmY.exe
  C:\Windows\System\PnLJNmY.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\xSLwlZK.exe
  C:\Windows\System\xSLwlZK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\nhvaXWc.exe
  C:\Windows\System\nhvaXWc.exe
  2⤵
  PID:2264
- C:\Windows\System\bAHshSl.exe
  C:\Windows\System\bAHshSl.exe
  2⤵
  PID:1708
- C:\Windows\System\JihHarf.exe
  C:\Windows\System\JihHarf.exe
  2⤵
  PID:5020
- C:\Windows\System\kWtkpHL.exe
  C:\Windows\System\kWtkpHL.exe
  2⤵
  PID:3316
- C:\Windows\System\MatGtQf.exe
  C:\Windows\System\MatGtQf.exe
  2⤵
  PID:1980
- C:\Windows\System\SpgpCNE.exe
  C:\Windows\System\SpgpCNE.exe
  2⤵
  PID:4984
- C:\Windows\System\kPSmDJB.exe
  C:\Windows\System\kPSmDJB.exe
  2⤵
  PID:2420
- C:\Windows\System\ihTaxvE.exe
  C:\Windows\System\ihTaxvE.exe
  2⤵
  PID:2804
- C:\Windows\System\TYYUKDi.exe
  C:\Windows\System\TYYUKDi.exe
  2⤵
  PID:372
- C:\Windows\System\FvuSeDL.exe
  C:\Windows\System\FvuSeDL.exe
  2⤵
  PID:692
- C:\Windows\System\FgDixrJ.exe
  C:\Windows\System\FgDixrJ.exe
  2⤵
  PID:2884
- C:\Windows\System\jwovfUZ.exe
  C:\Windows\System\jwovfUZ.exe
  2⤵
  PID:4144
- C:\Windows\System\bkppPKh.exe
  C:\Windows\System\bkppPKh.exe
  2⤵
  PID:4636
- C:\Windows\System\VXFirIe.exe
  C:\Windows\System\VXFirIe.exe
  2⤵
  PID:4324
- C:\Windows\System\AThmjPi.exe
  C:\Windows\System\AThmjPi.exe
  2⤵
  PID:2704
- C:\Windows\System\CxjkeEI.exe
  C:\Windows\System\CxjkeEI.exe
  2⤵
  PID:4064
- C:\Windows\System\JuwuIyl.exe
  C:\Windows\System\JuwuIyl.exe
  2⤵
  PID:5152
- C:\Windows\System\RVCgjWZ.exe
  C:\Windows\System\RVCgjWZ.exe
  2⤵
  PID:5176
- C:\Windows\System\MKhCbzb.exe
  C:\Windows\System\MKhCbzb.exe
  2⤵
  PID:5196
- C:\Windows\System\odIxEjg.exe
  C:\Windows\System\odIxEjg.exe
  2⤵
  PID:5216
- C:\Windows\System\KDqHNUS.exe
  C:\Windows\System\KDqHNUS.exe
  2⤵
  PID:5244
- C:\Windows\System\eVUWWOg.exe
  C:\Windows\System\eVUWWOg.exe
  2⤵
  PID:5268
- C:\Windows\System\zneSbsb.exe
  C:\Windows\System\zneSbsb.exe
  2⤵
  PID:5288
- C:\Windows\System\KMQaoAs.exe
  C:\Windows\System\KMQaoAs.exe
  2⤵
  PID:5308
- C:\Windows\System\jvUSsai.exe
  C:\Windows\System\jvUSsai.exe
  2⤵
  PID:5332
- C:\Windows\System\kjdKYTJ.exe
  C:\Windows\System\kjdKYTJ.exe
  2⤵
  PID:5376
- C:\Windows\System\IzicnDx.exe
  C:\Windows\System\IzicnDx.exe
  2⤵
  PID:5396
- C:\Windows\System\nzxDCQa.exe
  C:\Windows\System\nzxDCQa.exe
  2⤵
  PID:5420
- C:\Windows\System\AiRQjar.exe
  C:\Windows\System\AiRQjar.exe
  2⤵
  PID:5440
- C:\Windows\System\wEZeXdb.exe
  C:\Windows\System\wEZeXdb.exe
  2⤵
  PID:5460
- C:\Windows\System\LuusYrD.exe
  C:\Windows\System\LuusYrD.exe
  2⤵
  PID:5480
- C:\Windows\System\usVaKuh.exe
  C:\Windows\System\usVaKuh.exe
  2⤵
  PID:5504
- C:\Windows\System\pALxnYX.exe
  C:\Windows\System\pALxnYX.exe
  2⤵
  PID:5520
- C:\Windows\System\VMNdKqw.exe
  C:\Windows\System\VMNdKqw.exe
  2⤵
  PID:5560
- C:\Windows\System\rRwVslN.exe
  C:\Windows\System\rRwVslN.exe
  2⤵
  PID:5588
- C:\Windows\System\oTRAYoJ.exe
  C:\Windows\System\oTRAYoJ.exe
  2⤵
  PID:5612
- C:\Windows\System\IGKWGzZ.exe
  C:\Windows\System\IGKWGzZ.exe
  2⤵
  PID:5636
- C:\Windows\System\MxNKCzp.exe
  C:\Windows\System\MxNKCzp.exe
  2⤵
  PID:5684
- C:\Windows\System\KHmXyXD.exe
  C:\Windows\System\KHmXyXD.exe
  2⤵
  PID:5708
- C:\Windows\System\hTQSWAE.exe
  C:\Windows\System\hTQSWAE.exe
  2⤵
  PID:5724
- C:\Windows\System\LeRfsTz.exe
  C:\Windows\System\LeRfsTz.exe
  2⤵
  PID:5748
- C:\Windows\System\BNTtUoZ.exe
  C:\Windows\System\BNTtUoZ.exe
  2⤵
  PID:5768
- C:\Windows\System\MYFJrWq.exe
  C:\Windows\System\MYFJrWq.exe
  2⤵
  PID:5812
- C:\Windows\System\EUihvqL.exe
  C:\Windows\System\EUihvqL.exe
  2⤵
  PID:5836
- C:\Windows\System\HKEJPzp.exe
  C:\Windows\System\HKEJPzp.exe
  2⤵
  PID:5852
- C:\Windows\System\ZhbIdMx.exe
  C:\Windows\System\ZhbIdMx.exe
  2⤵
  PID:5872
- C:\Windows\System\nIlECph.exe
  C:\Windows\System\nIlECph.exe
  2⤵
  PID:5900
- C:\Windows\System\jadMDMp.exe
  C:\Windows\System\jadMDMp.exe
  2⤵
  PID:5956
- C:\Windows\System\MhHfKdC.exe
  C:\Windows\System\MhHfKdC.exe
  2⤵
  PID:5980
- C:\Windows\System\iSalEXC.exe
  C:\Windows\System\iSalEXC.exe
  2⤵
  PID:6012
- C:\Windows\System\dKXxBCo.exe
  C:\Windows\System\dKXxBCo.exe
  2⤵
  PID:6036
- C:\Windows\System\iPxInpO.exe
  C:\Windows\System\iPxInpO.exe
  2⤵
  PID:6056
- C:\Windows\System\JteQuWJ.exe
  C:\Windows\System\JteQuWJ.exe
  2⤵
  PID:6080
- C:\Windows\System\aWstEQU.exe
  C:\Windows\System\aWstEQU.exe
  2⤵
  PID:6096
- C:\Windows\System\LFyfRSc.exe
  C:\Windows\System\LFyfRSc.exe
  2⤵
  PID:6112
- C:\Windows\System\UXjxgKS.exe
  C:\Windows\System\UXjxgKS.exe
  2⤵
  PID:6128
- C:\Windows\System\mKDoPPd.exe
  C:\Windows\System\mKDoPPd.exe
  2⤵
  PID:2680
- C:\Windows\System\xivmgqA.exe
  C:\Windows\System\xivmgqA.exe
  2⤵
  PID:4376
- C:\Windows\System\TsmHbvf.exe
  C:\Windows\System\TsmHbvf.exe
  2⤵
  PID:4336
- C:\Windows\System\LUCXQny.exe
  C:\Windows\System\LUCXQny.exe
  2⤵
  PID:4968
- C:\Windows\System\CMLpPNF.exe
  C:\Windows\System\CMLpPNF.exe
  2⤵
  PID:3504
- C:\Windows\System\ZszoLVC.exe
  C:\Windows\System\ZszoLVC.exe
  2⤵
  PID:4416
- C:\Windows\System\inaUSlZ.exe
  C:\Windows\System\inaUSlZ.exe
  2⤵
  PID:4652
- C:\Windows\System\drJfecn.exe
  C:\Windows\System\drJfecn.exe
  2⤵
  PID:4596
- C:\Windows\System\DACqITX.exe
  C:\Windows\System\DACqITX.exe
  2⤵
  PID:4808
- C:\Windows\System\UymvJkE.exe
  C:\Windows\System\UymvJkE.exe
  2⤵
  PID:2840
- C:\Windows\System\fZgwOgE.exe
  C:\Windows\System\fZgwOgE.exe
  2⤵
  PID:5388
- C:\Windows\System\JOsShOZ.exe
  C:\Windows\System\JOsShOZ.exe
  2⤵
  PID:5476
- C:\Windows\System\uWAyMEu.exe
  C:\Windows\System\uWAyMEu.exe
  2⤵
  PID:2828
- C:\Windows\System\HfdkYHo.exe
  C:\Windows\System\HfdkYHo.exe
  2⤵
  PID:5644
- C:\Windows\System\YOdjGLi.exe
  C:\Windows\System\YOdjGLi.exe
  2⤵
  PID:5736
- C:\Windows\System\otsoher.exe
  C:\Windows\System\otsoher.exe
  2⤵
  PID:4880
- C:\Windows\System\DrXLlpc.exe
  C:\Windows\System\DrXLlpc.exe
  2⤵
  PID:5916
- C:\Windows\System\YxEvQIh.exe
  C:\Windows\System\YxEvQIh.exe
  2⤵
  PID:5552
- C:\Windows\System\bFBPgfr.exe
  C:\Windows\System\bFBPgfr.exe
  2⤵
  PID:5964
- C:\Windows\System\DBHGIoW.exe
  C:\Windows\System\DBHGIoW.exe
  2⤵
  PID:5620
- C:\Windows\System\hJivfLV.exe
  C:\Windows\System\hJivfLV.exe
  2⤵
  PID:5208
- C:\Windows\System\yFBQVoE.exe
  C:\Windows\System\yFBQVoE.exe
  2⤵
  PID:6020
- C:\Windows\System\ucCsFPQ.exe
  C:\Windows\System\ucCsFPQ.exe
  2⤵
  PID:6088
- C:\Windows\System\fyWzNXb.exe
  C:\Windows\System\fyWzNXb.exe
  2⤵
  PID:6156
- C:\Windows\System\VkEbhrL.exe
  C:\Windows\System\VkEbhrL.exe
  2⤵
  PID:6180
- C:\Windows\System\eCjZYPO.exe
  C:\Windows\System\eCjZYPO.exe
  2⤵
  PID:6196
- C:\Windows\System\qOhrniL.exe
  C:\Windows\System\qOhrniL.exe
  2⤵
  PID:6216
- C:\Windows\System\XxPribo.exe
  C:\Windows\System\XxPribo.exe
  2⤵
  PID:6232
- C:\Windows\System\qKkQZLW.exe
  C:\Windows\System\qKkQZLW.exe
  2⤵
  PID:6252
- C:\Windows\System\cyOjaiH.exe
  C:\Windows\System\cyOjaiH.exe
  2⤵
  PID:6276
- C:\Windows\System\ECPuCmp.exe
  C:\Windows\System\ECPuCmp.exe
  2⤵
  PID:6300
- C:\Windows\System\fvBJtPM.exe
  C:\Windows\System\fvBJtPM.exe
  2⤵
  PID:6332
- C:\Windows\System\otiMvcB.exe
  C:\Windows\System\otiMvcB.exe
  2⤵
  PID:6352
- C:\Windows\System\ydnOBWm.exe
  C:\Windows\System\ydnOBWm.exe
  2⤵
  PID:6376
- C:\Windows\System\KgFgYPG.exe
  C:\Windows\System\KgFgYPG.exe
  2⤵
  PID:6404
- C:\Windows\System\EkftQQk.exe
  C:\Windows\System\EkftQQk.exe
  2⤵
  PID:6424
- C:\Windows\System\xGupBXV.exe
  C:\Windows\System\xGupBXV.exe
  2⤵
  PID:6448
- C:\Windows\System\hMvXgia.exe
  C:\Windows\System\hMvXgia.exe
  2⤵
  PID:6468
- C:\Windows\System\FmtolWV.exe
  C:\Windows\System\FmtolWV.exe
  2⤵
  PID:6496
- C:\Windows\System\BqxtKnQ.exe
  C:\Windows\System\BqxtKnQ.exe
  2⤵
  PID:6516
- C:\Windows\System\IyGeoJG.exe
  C:\Windows\System\IyGeoJG.exe
  2⤵
  PID:6540
- C:\Windows\System\aNwivoM.exe
  C:\Windows\System\aNwivoM.exe
  2⤵
  PID:6564
- C:\Windows\System\ccnxlLr.exe
  C:\Windows\System\ccnxlLr.exe
  2⤵
  PID:6724
- C:\Windows\System\IGIYxqs.exe
  C:\Windows\System\IGIYxqs.exe
  2⤵
  PID:6852
- C:\Windows\System\JsALVDA.exe
  C:\Windows\System\JsALVDA.exe
  2⤵
  PID:6876
- C:\Windows\System\JmlPLot.exe
  C:\Windows\System\JmlPLot.exe
  2⤵
  PID:6892
- C:\Windows\System\zGPDTIv.exe
  C:\Windows\System\zGPDTIv.exe
  2⤵
  PID:6908
- C:\Windows\System\fUWtCso.exe
  C:\Windows\System\fUWtCso.exe
  2⤵
  PID:6924
- C:\Windows\System\YqjVlDI.exe
  C:\Windows\System\YqjVlDI.exe
  2⤵
  PID:6940
- C:\Windows\System\towqutS.exe
  C:\Windows\System\towqutS.exe
  2⤵
  PID:6956
- C:\Windows\System\YyRKMNk.exe
  C:\Windows\System\YyRKMNk.exe
  2⤵
  PID:6976
- C:\Windows\System\tuLjngn.exe
  C:\Windows\System\tuLjngn.exe
  2⤵
  PID:6992
- C:\Windows\System\JamygFH.exe
  C:\Windows\System\JamygFH.exe
  2⤵
  PID:7008
- C:\Windows\System\KzEJwmi.exe
  C:\Windows\System\KzEJwmi.exe
  2⤵
  PID:7024
- C:\Windows\System\jUircys.exe
  C:\Windows\System\jUircys.exe
  2⤵
  PID:7040
- C:\Windows\System\dYWfdWb.exe
  C:\Windows\System\dYWfdWb.exe
  2⤵
  PID:7056
- C:\Windows\System\wiTOHJs.exe
  C:\Windows\System\wiTOHJs.exe
  2⤵
  PID:7072
- C:\Windows\System\CqVETEI.exe
  C:\Windows\System\CqVETEI.exe
  2⤵
  PID:7092
- C:\Windows\System\rJIJGKe.exe
  C:\Windows\System\rJIJGKe.exe
  2⤵
  PID:7116
- C:\Windows\System\cuzTRxG.exe
  C:\Windows\System\cuzTRxG.exe
  2⤵
  PID:7136
- C:\Windows\System\DhGWVoV.exe
  C:\Windows\System\DhGWVoV.exe
  2⤵
  PID:7156
- C:\Windows\System\nJBPZQo.exe
  C:\Windows\System\nJBPZQo.exe
  2⤵
  PID:2312
- C:\Windows\System\yYoOamZ.exe
  C:\Windows\System\yYoOamZ.exe
  2⤵
  PID:5264
- C:\Windows\System\wykHiFk.exe
  C:\Windows\System\wykHiFk.exe
  2⤵
  PID:5304
- C:\Windows\System\RtPhQLO.exe
  C:\Windows\System\RtPhQLO.exe
  2⤵
  PID:5760
- C:\Windows\System\RNXqhbE.exe
  C:\Windows\System\RNXqhbE.exe
  2⤵
  PID:2180
- C:\Windows\System\javXHqQ.exe
  C:\Windows\System\javXHqQ.exe
  2⤵
  PID:5468
- C:\Windows\System\KCEAPlG.exe
  C:\Windows\System\KCEAPlG.exe
  2⤵
  PID:5536
- C:\Windows\System\PMFQOyM.exe
  C:\Windows\System\PMFQOyM.exe
  2⤵
  PID:5936
- C:\Windows\System\QhaoTXn.exe
  C:\Windows\System\QhaoTXn.exe
  2⤵
  PID:5976
- C:\Windows\System\nmLFrhH.exe
  C:\Windows\System\nmLFrhH.exe
  2⤵
  PID:5660
- C:\Windows\System\CLAoVwq.exe
  C:\Windows\System\CLAoVwq.exe
  2⤵
  PID:5680
- C:\Windows\System\hJdoelz.exe
  C:\Windows\System\hJdoelz.exe
  2⤵
  PID:5720
- C:\Windows\System\WPJSbvS.exe
  C:\Windows\System\WPJSbvS.exe
  2⤵
  PID:5788
- C:\Windows\System\MIVyxzj.exe
  C:\Windows\System\MIVyxzj.exe
  2⤵
  PID:5848
- C:\Windows\System\XLLPytB.exe
  C:\Windows\System\XLLPytB.exe
  2⤵
  PID:6420
- C:\Windows\System\wuxrFed.exe
  C:\Windows\System\wuxrFed.exe
  2⤵
  PID:5432
- C:\Windows\System\GzZSVzd.exe
  C:\Windows\System\GzZSVzd.exe
  2⤵
  PID:6480
- C:\Windows\System\CnAOVVc.exe
  C:\Windows\System\CnAOVVc.exe
  2⤵
  PID:6368
- C:\Windows\System\myPiGOQ.exe
  C:\Windows\System\myPiGOQ.exe
  2⤵
  PID:6224
- C:\Windows\System\xEKRczQ.exe
  C:\Windows\System\xEKRczQ.exe
  2⤵
  PID:6004
- C:\Windows\System\WDrwlQG.exe
  C:\Windows\System\WDrwlQG.exe
  2⤵
  PID:5548
- C:\Windows\System\pRcsQQd.exe
  C:\Windows\System\pRcsQQd.exe
  2⤵
  PID:6124
- C:\Windows\System\VgSQKNB.exe
  C:\Windows\System\VgSQKNB.exe
  2⤵
  PID:2268
- C:\Windows\System\HWorqOB.exe
  C:\Windows\System\HWorqOB.exe
  2⤵
  PID:4444
- C:\Windows\System\UkgEjko.exe
  C:\Windows\System\UkgEjko.exe
  2⤵
  PID:4272
- C:\Windows\System\eLnVLgE.exe
  C:\Windows\System\eLnVLgE.exe
  2⤵
  PID:5132
- C:\Windows\System\faBSzkF.exe
  C:\Windows\System\faBSzkF.exe
  2⤵
  PID:4180
- C:\Windows\System\IfsTtLe.exe
  C:\Windows\System\IfsTtLe.exe
  2⤵
  PID:5604
- C:\Windows\System\uqKeEKa.exe
  C:\Windows\System\uqKeEKa.exe
  2⤵
  PID:5228
- C:\Windows\System\VReKVqP.exe
  C:\Windows\System\VReKVqP.exe
  2⤵
  PID:6192
- C:\Windows\System\wXxLQnt.exe
  C:\Windows\System\wXxLQnt.exe
  2⤵
  PID:6308
- C:\Windows\System\vvfmDfm.exe
  C:\Windows\System\vvfmDfm.exe
  2⤵
  PID:6360
- C:\Windows\System\ocCvfCo.exe
  C:\Windows\System\ocCvfCo.exe
  2⤵
  PID:6492
- C:\Windows\System\EyPnRkQ.exe
  C:\Windows\System\EyPnRkQ.exe
  2⤵
  PID:6560
- C:\Windows\System\AnbBcDQ.exe
  C:\Windows\System\AnbBcDQ.exe
  2⤵
  PID:6616
- C:\Windows\System\gRqtamB.exe
  C:\Windows\System\gRqtamB.exe
  2⤵
  PID:4400
- C:\Windows\System\JfqOkqd.exe
  C:\Windows\System\JfqOkqd.exe
  2⤵
  PID:6712
- C:\Windows\System\QAsEzIv.exe
  C:\Windows\System\QAsEzIv.exe
  2⤵
  PID:7184
- C:\Windows\System\AibBmxb.exe
  C:\Windows\System\AibBmxb.exe
  2⤵
  PID:7208
- C:\Windows\System\iVXWxuq.exe
  C:\Windows\System\iVXWxuq.exe
  2⤵
  PID:7232
- C:\Windows\System\drwSKBu.exe
  C:\Windows\System\drwSKBu.exe
  2⤵
  PID:7248
- C:\Windows\System\VfqjvNI.exe
  C:\Windows\System\VfqjvNI.exe
  2⤵
  PID:7272
- C:\Windows\System\PETComb.exe
  C:\Windows\System\PETComb.exe
  2⤵
  PID:7288
- C:\Windows\System\pxMWizb.exe
  C:\Windows\System\pxMWizb.exe
  2⤵
  PID:7312
- C:\Windows\System\AbgvTko.exe
  C:\Windows\System\AbgvTko.exe
  2⤵
  PID:7332
- C:\Windows\System\xuUZZDg.exe
  C:\Windows\System\xuUZZDg.exe
  2⤵
  PID:7372
- C:\Windows\System\iSiueRU.exe
  C:\Windows\System\iSiueRU.exe
  2⤵
  PID:7388
- C:\Windows\System\ZCDMBfC.exe
  C:\Windows\System\ZCDMBfC.exe
  2⤵
  PID:7412
- C:\Windows\System\vJAqddD.exe
  C:\Windows\System\vJAqddD.exe
  2⤵
  PID:7428
- C:\Windows\System\mcHpjHD.exe
  C:\Windows\System\mcHpjHD.exe
  2⤵
  PID:7460
- C:\Windows\System\kklxNZc.exe
  C:\Windows\System\kklxNZc.exe
  2⤵
  PID:7476
- C:\Windows\System\TvHSCqq.exe
  C:\Windows\System\TvHSCqq.exe
  2⤵
  PID:7508
- C:\Windows\System\WMlDmPX.exe
  C:\Windows\System\WMlDmPX.exe
  2⤵
  PID:7528
- C:\Windows\System\sBnTYgB.exe
  C:\Windows\System\sBnTYgB.exe
  2⤵
  PID:7560
- C:\Windows\System\gqfFSuU.exe
  C:\Windows\System\gqfFSuU.exe
  2⤵
  PID:7588
- C:\Windows\System\rbJkoNE.exe
  C:\Windows\System\rbJkoNE.exe
  2⤵
  PID:7604
- C:\Windows\System\unoZYwo.exe
  C:\Windows\System\unoZYwo.exe
  2⤵
  PID:7628
- C:\Windows\System\CBOBuCw.exe
  C:\Windows\System\CBOBuCw.exe
  2⤵
  PID:7652
- C:\Windows\System\UaQjKFN.exe
  C:\Windows\System\UaQjKFN.exe
  2⤵
  PID:7668
- C:\Windows\System\NbyvwVQ.exe
  C:\Windows\System\NbyvwVQ.exe
  2⤵
  PID:7696
- C:\Windows\System\GKAnXkC.exe
  C:\Windows\System\GKAnXkC.exe
  2⤵
  PID:7716
- C:\Windows\System\WZGhZTy.exe
  C:\Windows\System\WZGhZTy.exe
  2⤵
  PID:7740
- C:\Windows\System\FLgdrUn.exe
  C:\Windows\System\FLgdrUn.exe
  2⤵
  PID:7760
- C:\Windows\System\hFfZbnU.exe
  C:\Windows\System\hFfZbnU.exe
  2⤵
  PID:7784
- C:\Windows\System\ueRYJQY.exe
  C:\Windows\System\ueRYJQY.exe
  2⤵
  PID:7808
- C:\Windows\System\qxePDiK.exe
  C:\Windows\System\qxePDiK.exe
  2⤵
  PID:7836
- C:\Windows\System\tVrlmGR.exe
  C:\Windows\System\tVrlmGR.exe
  2⤵
  PID:7868
- C:\Windows\System\BWBVlys.exe
  C:\Windows\System\BWBVlys.exe
  2⤵
  PID:7896
- C:\Windows\System\SVpGDCT.exe
  C:\Windows\System\SVpGDCT.exe
  2⤵
  PID:7912
- C:\Windows\System\IUNIxOE.exe
  C:\Windows\System\IUNIxOE.exe
  2⤵
  PID:7932
- C:\Windows\System\SNGcXDz.exe
  C:\Windows\System\SNGcXDz.exe
  2⤵
  PID:7952
- C:\Windows\System\wXfgvJj.exe
  C:\Windows\System\wXfgvJj.exe
  2⤵
  PID:7976
- C:\Windows\System\pkcjnZu.exe
  C:\Windows\System\pkcjnZu.exe
  2⤵
  PID:7992
- C:\Windows\System\TZshEkv.exe
  C:\Windows\System\TZshEkv.exe
  2⤵
  PID:8016
- C:\Windows\System\mvQwXRM.exe
  C:\Windows\System\mvQwXRM.exe
  2⤵
  PID:8036
- C:\Windows\System\RLTZUmM.exe
  C:\Windows\System\RLTZUmM.exe
  2⤵
  PID:8060
- C:\Windows\System\PoOqXgP.exe
  C:\Windows\System\PoOqXgP.exe
  2⤵
  PID:8076
- C:\Windows\System\NjOJVwW.exe
  C:\Windows\System\NjOJVwW.exe
  2⤵
  PID:8092
- C:\Windows\System\AGpeMby.exe
  C:\Windows\System\AGpeMby.exe
  2⤵
  PID:8108
- C:\Windows\System\SSmFZim.exe
  C:\Windows\System\SSmFZim.exe
  2⤵
  PID:8128
- C:\Windows\System\PogCHQL.exe
  C:\Windows\System\PogCHQL.exe
  2⤵
  PID:8156
- C:\Windows\System\CRlEPLQ.exe
  C:\Windows\System\CRlEPLQ.exe
  2⤵
  PID:8184
- C:\Windows\System\vuvkWBh.exe
  C:\Windows\System\vuvkWBh.exe
  2⤵
  PID:7108
- C:\Windows\System\JiUSfAo.exe
  C:\Windows\System\JiUSfAo.exe
  2⤵
  PID:5368
- C:\Windows\System\ZgXhkZO.exe
  C:\Windows\System\ZgXhkZO.exe
  2⤵
  PID:5452
- C:\Windows\System\HZceLSS.exe
  C:\Windows\System\HZceLSS.exe
  2⤵
  PID:5792
- C:\Windows\System\uFTdQZs.exe
  C:\Windows\System\uFTdQZs.exe
  2⤵
  PID:6176
- C:\Windows\System\ZmEXODL.exe
  C:\Windows\System\ZmEXODL.exe
  2⤵
  PID:7224
- C:\Windows\System\wsispvw.exe
  C:\Windows\System\wsispvw.exe
  2⤵
  PID:7264
- C:\Windows\System\AHXAdnh.exe
  C:\Windows\System\AHXAdnh.exe
  2⤵
  PID:7772
- C:\Windows\System\MRlKPOK.exe
  C:\Windows\System\MRlKPOK.exe
  2⤵
  PID:7800
- C:\Windows\System\RrLOKzb.exe
  C:\Windows\System\RrLOKzb.exe
  2⤵
  PID:6188
- C:\Windows\System\PuyMiad.exe
  C:\Windows\System\PuyMiad.exe
  2⤵
  PID:6248
- C:\Windows\System\TJZQREp.exe
  C:\Windows\System\TJZQREp.exe
  2⤵
  PID:6388
- C:\Windows\System\HOVSKmf.exe
  C:\Windows\System\HOVSKmf.exe
  2⤵
  PID:8216
- C:\Windows\System\PNndTqw.exe
  C:\Windows\System\PNndTqw.exe
  2⤵
  PID:8240
- C:\Windows\System\icypsFx.exe
  C:\Windows\System\icypsFx.exe
  2⤵
  PID:8256
- C:\Windows\System\xPGAcKz.exe
  C:\Windows\System\xPGAcKz.exe
  2⤵
  PID:8276
- C:\Windows\System\BFFWVUT.exe
  C:\Windows\System\BFFWVUT.exe
  2⤵
  PID:8296
- C:\Windows\System\GXOsBTx.exe
  C:\Windows\System\GXOsBTx.exe
  2⤵
  PID:8316
- C:\Windows\System\MQezVvE.exe
  C:\Windows\System\MQezVvE.exe
  2⤵
  PID:8336
- C:\Windows\System\qYMJonS.exe
  C:\Windows\System\qYMJonS.exe
  2⤵
  PID:8352
- C:\Windows\System\OymdwNX.exe
  C:\Windows\System\OymdwNX.exe
  2⤵
  PID:8376
- C:\Windows\System\PNKZnmf.exe
  C:\Windows\System\PNKZnmf.exe
  2⤵
  PID:8392
- C:\Windows\System\vWowslP.exe
  C:\Windows\System\vWowslP.exe
  2⤵
  PID:8420
- C:\Windows\System\wNOIQwE.exe
  C:\Windows\System\wNOIQwE.exe
  2⤵
  PID:8436
- C:\Windows\System\SeKzQGp.exe
  C:\Windows\System\SeKzQGp.exe
  2⤵
  PID:8460
- C:\Windows\System\oWOokMc.exe
  C:\Windows\System\oWOokMc.exe
  2⤵
  PID:8480
- C:\Windows\System\hnlxIOX.exe
  C:\Windows\System\hnlxIOX.exe
  2⤵
  PID:8496
- C:\Windows\System\ztmGjgI.exe
  C:\Windows\System\ztmGjgI.exe
  2⤵
  PID:8512
- C:\Windows\System\eoofHry.exe
  C:\Windows\System\eoofHry.exe
  2⤵
  PID:8532
- C:\Windows\System\tLLKQqX.exe
  C:\Windows\System\tLLKQqX.exe
  2⤵
  PID:8548
- C:\Windows\System\HtfMnZe.exe
  C:\Windows\System\HtfMnZe.exe
  2⤵
  PID:8564
- C:\Windows\System\rjKesjW.exe
  C:\Windows\System\rjKesjW.exe
  2⤵
  PID:8588
- C:\Windows\System\ugFaiQa.exe
  C:\Windows\System\ugFaiQa.exe
  2⤵
  PID:8604
- C:\Windows\System\EGruHBt.exe
  C:\Windows\System\EGruHBt.exe
  2⤵
  PID:8624
- C:\Windows\System\XLoZnby.exe
  C:\Windows\System\XLoZnby.exe
  2⤵
  PID:8644
- C:\Windows\System\QXqCtGW.exe
  C:\Windows\System\QXqCtGW.exe
  2⤵
  PID:8660
- C:\Windows\System\qQKNCIi.exe
  C:\Windows\System\qQKNCIi.exe
  2⤵
  PID:8692
- C:\Windows\System\lHBiJbc.exe
  C:\Windows\System\lHBiJbc.exe
  2⤵
  PID:8708
- C:\Windows\System\LEUQIWs.exe
  C:\Windows\System\LEUQIWs.exe
  2⤵
  PID:8732
- C:\Windows\System\QwpKFtW.exe
  C:\Windows\System\QwpKFtW.exe
  2⤵
  PID:8756
- C:\Windows\System\TovPpKa.exe
  C:\Windows\System\TovPpKa.exe
  2⤵
  PID:8772
- C:\Windows\System\dDtfhZF.exe
  C:\Windows\System\dDtfhZF.exe
  2⤵
  PID:8788
- C:\Windows\System\zOooqJe.exe
  C:\Windows\System\zOooqJe.exe
  2⤵
  PID:8812
- C:\Windows\System\osNefOm.exe
  C:\Windows\System\osNefOm.exe
  2⤵
  PID:8840
- C:\Windows\System\DRguBPu.exe
  C:\Windows\System\DRguBPu.exe
  2⤵
  PID:8868
- C:\Windows\System\kgmsmEK.exe
  C:\Windows\System\kgmsmEK.exe
  2⤵
  PID:8884
- C:\Windows\System\PxVkGrP.exe
  C:\Windows\System\PxVkGrP.exe
  2⤵
  PID:8912
- C:\Windows\System\BADvIJk.exe
  C:\Windows\System\BADvIJk.exe
  2⤵
  PID:8928
- C:\Windows\System\qgCEBtt.exe
  C:\Windows\System\qgCEBtt.exe
  2⤵
  PID:8948
- C:\Windows\System\wgGPytc.exe
  C:\Windows\System\wgGPytc.exe
  2⤵
  PID:9100
- C:\Windows\System\LAYTniB.exe
  C:\Windows\System\LAYTniB.exe
  2⤵
  PID:9116
- C:\Windows\System\oKQNpkX.exe
  C:\Windows\System\oKQNpkX.exe
  2⤵
  PID:9132
- C:\Windows\System\NKzvDNq.exe
  C:\Windows\System\NKzvDNq.exe
  2⤵
  PID:9148
- C:\Windows\System\pmegOCd.exe
  C:\Windows\System\pmegOCd.exe
  2⤵
  PID:9164
- C:\Windows\System\oxqQXex.exe
  C:\Windows\System\oxqQXex.exe
  2⤵
  PID:9180
- C:\Windows\System\ZfYnZiI.exe
  C:\Windows\System\ZfYnZiI.exe
  2⤵
  PID:9196
- C:\Windows\System\vCpSuVG.exe
  C:\Windows\System\vCpSuVG.exe
  2⤵
  PID:9212
- C:\Windows\System\fXckSzG.exe
  C:\Windows\System\fXckSzG.exe
  2⤵
  PID:8028
- C:\Windows\System\RhjmduM.exe
  C:\Windows\System\RhjmduM.exe
  2⤵
  PID:8088
- C:\Windows\System\zhEQkST.exe
  C:\Windows\System\zhEQkST.exe
  2⤵
  PID:8120
- C:\Windows\System\bDCopFY.exe
  C:\Windows\System\bDCopFY.exe
  2⤵
  PID:8148
- C:\Windows\System\BNRbLXr.exe
  C:\Windows\System\BNRbLXr.exe
  2⤵
  PID:6660
- C:\Windows\System\LTSCVUX.exe
  C:\Windows\System\LTSCVUX.exe
  2⤵
  PID:6708
- C:\Windows\System\QRqkHwB.exe
  C:\Windows\System\QRqkHwB.exe
  2⤵
  PID:7192
- C:\Windows\System\NFPbEUe.exe
  C:\Windows\System\NFPbEUe.exe
  2⤵
  PID:6844
- C:\Windows\System\LGhBmZy.exe
  C:\Windows\System\LGhBmZy.exe
  2⤵
  PID:6884
- C:\Windows\System\MpgjJQF.exe
  C:\Windows\System\MpgjJQF.exe
  2⤵
  PID:6904
- C:\Windows\System\xxZdvvl.exe
  C:\Windows\System\xxZdvvl.exe
  2⤵
  PID:6952
- C:\Windows\System\UTYUCsF.exe
  C:\Windows\System\UTYUCsF.exe
  2⤵
  PID:6988
- C:\Windows\System\HucDVlV.exe
  C:\Windows\System\HucDVlV.exe
  2⤵
  PID:7036
- C:\Windows\System\DmThzHK.exe
  C:\Windows\System\DmThzHK.exe
  2⤵
  PID:7064
- C:\Windows\System\gpNawHL.exe
  C:\Windows\System\gpNawHL.exe
  2⤵
  PID:7164
- C:\Windows\System\ElPOBOf.exe
  C:\Windows\System\ElPOBOf.exe
  2⤵
  PID:5544
- C:\Windows\System\nCQbXzE.exe
  C:\Windows\System\nCQbXzE.exe
  2⤵
  PID:6024
- C:\Windows\System\vKfqasv.exe
  C:\Windows\System\vKfqasv.exe
  2⤵
  PID:5828
- C:\Windows\System\GAJYHUj.exe
  C:\Windows\System\GAJYHUj.exe
  2⤵
  PID:5096
- C:\Windows\System\pwlEVNq.exe
  C:\Windows\System\pwlEVNq.exe
  2⤵
  PID:5168
- C:\Windows\System\rqYYypZ.exe
  C:\Windows\System\rqYYypZ.exe
  2⤵
  PID:3424
- C:\Windows\System\yZdWpkw.exe
  C:\Windows\System\yZdWpkw.exe
  2⤵
  PID:6264
- C:\Windows\System\trRDrLo.exe
  C:\Windows\System\trRDrLo.exe
  2⤵
  PID:7304
- C:\Windows\System\OYiodzR.exe
  C:\Windows\System\OYiodzR.exe
  2⤵
  PID:7364
- C:\Windows\System\hetmQwD.exe
  C:\Windows\System\hetmQwD.exe
  2⤵
  PID:7404
- C:\Windows\System\LAzgdTC.exe
  C:\Windows\System\LAzgdTC.exe
  2⤵
  PID:7456
- C:\Windows\System\UkqHgwp.exe
  C:\Windows\System\UkqHgwp.exe
  2⤵
  PID:7648
- C:\Windows\System\ecVeCAg.exe
  C:\Windows\System\ecVeCAg.exe
  2⤵
  PID:7600
- C:\Windows\System\svSToDu.exe
  C:\Windows\System\svSToDu.exe
  2⤵
  PID:7552
- C:\Windows\System\rAzwCcJ.exe
  C:\Windows\System\rAzwCcJ.exe
  2⤵
  PID:8072
- C:\Windows\System\JSenprl.exe
  C:\Windows\System\JSenprl.exe
  2⤵
  PID:7968
- C:\Windows\System\RTWdnVO.exe
  C:\Windows\System\RTWdnVO.exe
  2⤵
  PID:7940
- C:\Windows\System\OlahOwH.exe
  C:\Windows\System\OlahOwH.exe
  2⤵
  PID:7852
- C:\Windows\System\zAkwTxF.exe
  C:\Windows\System\zAkwTxF.exe
  2⤵
  PID:7828
- C:\Windows\System\YiVfyLb.exe
  C:\Windows\System\YiVfyLb.exe
  2⤵
  PID:7724
- C:\Windows\System\cQtaghk.exe
  C:\Windows\System\cQtaghk.exe
  2⤵
  PID:7680
- C:\Windows\System\GocopGz.exe
  C:\Windows\System\GocopGz.exe
  2⤵
  PID:5300
- C:\Windows\System\GPFUBVq.exe
  C:\Windows\System\GPFUBVq.exe
  2⤵
  PID:4024
- C:\Windows\System\XsBeCyN.exe
  C:\Windows\System\XsBeCyN.exe
  2⤵
  PID:9220
- C:\Windows\System\cnesRtI.exe
  C:\Windows\System\cnesRtI.exe
  2⤵
  PID:9244
- C:\Windows\System\zPpFMkN.exe
  C:\Windows\System\zPpFMkN.exe
  2⤵
  PID:9268
- C:\Windows\System\UVfMPhd.exe
  C:\Windows\System\UVfMPhd.exe
  2⤵
  PID:9288
- C:\Windows\System\ksiQZhR.exe
  C:\Windows\System\ksiQZhR.exe
  2⤵
  PID:9312
- C:\Windows\System\xDlrmZh.exe
  C:\Windows\System\xDlrmZh.exe
  2⤵
  PID:9332
- C:\Windows\System\HriBBGr.exe
  C:\Windows\System\HriBBGr.exe
  2⤵
  PID:9356
- C:\Windows\System\XPHxwHk.exe
  C:\Windows\System\XPHxwHk.exe
  2⤵
  PID:9376
- C:\Windows\System\vpQRrVI.exe
  C:\Windows\System\vpQRrVI.exe
  2⤵
  PID:9400
- C:\Windows\System\lVPIKhl.exe
  C:\Windows\System\lVPIKhl.exe
  2⤵
  PID:9420
- C:\Windows\System\vkONONP.exe
  C:\Windows\System\vkONONP.exe
  2⤵
  PID:9444
- C:\Windows\System\YdiwnTG.exe
  C:\Windows\System\YdiwnTG.exe
  2⤵
  PID:9468
- C:\Windows\System\bftEWKK.exe
  C:\Windows\System\bftEWKK.exe
  2⤵
  PID:9492
- C:\Windows\System\cVcdQKS.exe
  C:\Windows\System\cVcdQKS.exe
  2⤵
  PID:9512
- C:\Windows\System\qLNLPej.exe
  C:\Windows\System\qLNLPej.exe
  2⤵
  PID:9540
- C:\Windows\System\WdzSfeW.exe
  C:\Windows\System\WdzSfeW.exe
  2⤵
  PID:9560
- C:\Windows\System\CkvdhsY.exe
  C:\Windows\System\CkvdhsY.exe
  2⤵
  PID:9580
- C:\Windows\System\TunItNd.exe
  C:\Windows\System\TunItNd.exe
  2⤵
  PID:9600
- C:\Windows\System\torsfEg.exe
  C:\Windows\System\torsfEg.exe
  2⤵
  PID:9628
- C:\Windows\System\YuwlKAW.exe
  C:\Windows\System\YuwlKAW.exe
  2⤵
  PID:9648
- C:\Windows\System\sIonMTh.exe
  C:\Windows\System\sIonMTh.exe
  2⤵
  PID:9672
- C:\Windows\System\KEbMbCh.exe
  C:\Windows\System\KEbMbCh.exe
  2⤵
  PID:9688
- C:\Windows\System\DljhoJS.exe
  C:\Windows\System\DljhoJS.exe
  2⤵
  PID:9716
- C:\Windows\System\JzqADLq.exe
  C:\Windows\System\JzqADLq.exe
  2⤵
  PID:9740
- C:\Windows\System\YeYgDhW.exe
  C:\Windows\System\YeYgDhW.exe
  2⤵
  PID:9760
- C:\Windows\System\oFEIzuq.exe
  C:\Windows\System\oFEIzuq.exe
  2⤵
  PID:9780
- C:\Windows\System\ssAyAbW.exe
  C:\Windows\System\ssAyAbW.exe
  2⤵
  PID:9808
- C:\Windows\System\HBqHeuz.exe
  C:\Windows\System\HBqHeuz.exe
  2⤵
  PID:9828
- C:\Windows\System\QuwspGQ.exe
  C:\Windows\System\QuwspGQ.exe
  2⤵
  PID:9848
- C:\Windows\System\Qyztyyj.exe
  C:\Windows\System\Qyztyyj.exe
  2⤵
  PID:9868
- C:\Windows\System\nUhyHWz.exe
  C:\Windows\System\nUhyHWz.exe
  2⤵
  PID:9892
- C:\Windows\System\oIHIvLD.exe
  C:\Windows\System\oIHIvLD.exe
  2⤵
  PID:9908
- C:\Windows\System\MnqUClK.exe
  C:\Windows\System\MnqUClK.exe
  2⤵
  PID:9932
- C:\Windows\System\HklPEat.exe
  C:\Windows\System\HklPEat.exe
  2⤵
  PID:9948
- C:\Windows\System\oTKWdmU.exe
  C:\Windows\System\oTKWdmU.exe
  2⤵
  PID:9968
- C:\Windows\System\nZWOsRj.exe
  C:\Windows\System\nZWOsRj.exe
  2⤵
  PID:9984
- C:\Windows\System\UAwsaAw.exe
  C:\Windows\System\UAwsaAw.exe
  2⤵
  PID:10000
- C:\Windows\System\FfAaAsD.exe
  C:\Windows\System\FfAaAsD.exe
  2⤵
  PID:10016
- C:\Windows\System\dqGMGBu.exe
  C:\Windows\System\dqGMGBu.exe
  2⤵
  PID:10032
- C:\Windows\System\visuJKZ.exe
  C:\Windows\System\visuJKZ.exe
  2⤵
  PID:10052
- C:\Windows\System\PwjTWyW.exe
  C:\Windows\System\PwjTWyW.exe
  2⤵
  PID:10072
- C:\Windows\System\tIiwdDO.exe
  C:\Windows\System\tIiwdDO.exe
  2⤵
  PID:10088
- C:\Windows\System\oRlfoqz.exe
  C:\Windows\System\oRlfoqz.exe
  2⤵
  PID:10116
- C:\Windows\System\ktVakXs.exe
  C:\Windows\System\ktVakXs.exe
  2⤵
  PID:10140
- C:\Windows\System\QWVAPlX.exe
  C:\Windows\System\QWVAPlX.exe
  2⤵
  PID:10156
- C:\Windows\System\gaAEnXC.exe
  C:\Windows\System\gaAEnXC.exe
  2⤵
  PID:10176
- C:\Windows\System\MjaNKnq.exe
  C:\Windows\System\MjaNKnq.exe
  2⤵
  PID:10200
- C:\Windows\System\AgPZKLE.exe
  C:\Windows\System\AgPZKLE.exe
  2⤵
  PID:10224
- C:\Windows\System\fAShOwa.exe
  C:\Windows\System\fAShOwa.exe
  2⤵
  PID:10252
- C:\Windows\System\byfJWAK.exe
  C:\Windows\System\byfJWAK.exe
  2⤵
  PID:10272
- C:\Windows\System\brzKHga.exe
  C:\Windows\System\brzKHga.exe
  2⤵
  PID:10292
- C:\Windows\System\qFSySTX.exe
  C:\Windows\System\qFSySTX.exe
  2⤵
  PID:10312
- C:\Windows\System\zzZldOD.exe
  C:\Windows\System\zzZldOD.exe
  2⤵
  PID:10328
- C:\Windows\System\sTLHcnS.exe
  C:\Windows\System\sTLHcnS.exe
  2⤵
  PID:10348
- C:\Windows\System\tKvHGmx.exe
  C:\Windows\System\tKvHGmx.exe
  2⤵
  PID:10368
- C:\Windows\System\ZPlTNvo.exe
  C:\Windows\System\ZPlTNvo.exe
  2⤵
  PID:10400
- C:\Windows\System\cQZiPNo.exe
  C:\Windows\System\cQZiPNo.exe
  2⤵
  PID:10420
- C:\Windows\System\MQzjPYK.exe
  C:\Windows\System\MQzjPYK.exe
  2⤵
  PID:10440
- C:\Windows\System\BJagMMD.exe
  C:\Windows\System\BJagMMD.exe
  2⤵
  PID:10460
- C:\Windows\System\tkTHdeG.exe
  C:\Windows\System\tkTHdeG.exe
  2⤵
  PID:10488
- C:\Windows\System\GIFOkEu.exe
  C:\Windows\System\GIFOkEu.exe
  2⤵
  PID:10512
- C:\Windows\System\sNkcSug.exe
  C:\Windows\System\sNkcSug.exe
  2⤵
  PID:10528
- C:\Windows\System\iBnYQIK.exe
  C:\Windows\System\iBnYQIK.exe
  2⤵
  PID:10548
- C:\Windows\System\enlfXgD.exe
  C:\Windows\System\enlfXgD.exe
  2⤵
  PID:10576
- C:\Windows\System\AuyVDFB.exe
  C:\Windows\System\AuyVDFB.exe
  2⤵
  PID:10600
- C:\Windows\System\XapGmPZ.exe
  C:\Windows\System\XapGmPZ.exe
  2⤵
  PID:10624
- C:\Windows\System\NVzKSyX.exe
  C:\Windows\System\NVzKSyX.exe
  2⤵
  PID:10640
- C:\Windows\System\pQszGgD.exe
  C:\Windows\System\pQszGgD.exe
  2⤵
  PID:10656
- C:\Windows\System\ZpjEHVY.exe
  C:\Windows\System\ZpjEHVY.exe
  2⤵
  PID:10672
- C:\Windows\System\bzasXCe.exe
  C:\Windows\System\bzasXCe.exe
  2⤵
  PID:10692
- C:\Windows\System\OGMBPuW.exe
  C:\Windows\System\OGMBPuW.exe
  2⤵
  PID:11000
- C:\Windows\System\QblgNbZ.exe
  C:\Windows\System\QblgNbZ.exe
  2⤵
  PID:11016
- C:\Windows\System\MrZbuIY.exe
  C:\Windows\System\MrZbuIY.exe
  2⤵
  PID:11036
- C:\Windows\System\UZABhNY.exe
  C:\Windows\System\UZABhNY.exe
  2⤵
  PID:11056
- C:\Windows\System\XGaCXUP.exe
  C:\Windows\System\XGaCXUP.exe
  2⤵
  PID:11072
- C:\Windows\System\xctiiLh.exe
  C:\Windows\System\xctiiLh.exe
  2⤵
  PID:11088
- C:\Windows\System\mJaTTAA.exe
  C:\Windows\System\mJaTTAA.exe
  2⤵
  PID:11104
- C:\Windows\System\azyaGsL.exe
  C:\Windows\System\azyaGsL.exe
  2⤵
  PID:11132
- C:\Windows\System\puegfuf.exe
  C:\Windows\System\puegfuf.exe
  2⤵
  PID:11156
- C:\Windows\System\HnZfsEe.exe
  C:\Windows\System\HnZfsEe.exe
  2⤵
  PID:11180
- C:\Windows\System\dSmCGnM.exe
  C:\Windows\System\dSmCGnM.exe
  2⤵
  PID:11200
- C:\Windows\System\AshoIKz.exe
  C:\Windows\System\AshoIKz.exe
  2⤵
  PID:11224
- C:\Windows\System\oOiwxSu.exe
  C:\Windows\System\oOiwxSu.exe
  2⤵
  PID:11244
- C:\Windows\System\psZrGob.exe
  C:\Windows\System\psZrGob.exe
  2⤵
  PID:6440
- C:\Windows\System\RpFqkcG.exe
  C:\Windows\System\RpFqkcG.exe
  2⤵
  PID:7280
- C:\Windows\System\ytnQjju.exe
  C:\Windows\System\ytnQjju.exe
  2⤵
  PID:6260
- C:\Windows\System\MHELPJn.exe
  C:\Windows\System\MHELPJn.exe
  2⤵
  PID:8204
- C:\Windows\System\YPCOHAo.exe
  C:\Windows\System\YPCOHAo.exe
  2⤵
  PID:8252
- C:\Windows\System\WrikoCd.exe
  C:\Windows\System\WrikoCd.exe
  2⤵
  PID:8292
- C:\Windows\System\VIjuTsO.exe
  C:\Windows\System\VIjuTsO.exe
  2⤵
  PID:8344
- C:\Windows\System\SMLHGrm.exe
  C:\Windows\System\SMLHGrm.exe
  2⤵
  PID:8388
- C:\Windows\System\pJGRkUq.exe
  C:\Windows\System\pJGRkUq.exe
  2⤵
  PID:8444
- C:\Windows\System\SoFcIsM.exe
  C:\Windows\System\SoFcIsM.exe
  2⤵
  PID:8476
- C:\Windows\System\viOAknX.exe
  C:\Windows\System\viOAknX.exe
  2⤵
  PID:8520
- C:\Windows\System\qyGFxzG.exe
  C:\Windows\System\qyGFxzG.exe
  2⤵
  PID:8572
- C:\Windows\System\IDzYJbN.exe
  C:\Windows\System\IDzYJbN.exe
  2⤵
  PID:8616
- C:\Windows\System\XmlVNld.exe
  C:\Windows\System\XmlVNld.exe
  2⤵
  PID:8656
- C:\Windows\System\KDYciVr.exe
  C:\Windows\System\KDYciVr.exe
  2⤵
  PID:8724
- C:\Windows\System\eupzZGg.exe
  C:\Windows\System\eupzZGg.exe
  2⤵
  PID:8764
- C:\Windows\System\OdRmNHo.exe
  C:\Windows\System\OdRmNHo.exe
  2⤵
  PID:8804
- C:\Windows\System\mPnMTUz.exe
  C:\Windows\System\mPnMTUz.exe
  2⤵
  PID:8852
- C:\Windows\System\fYTKOee.exe
  C:\Windows\System\fYTKOee.exe
  2⤵
  PID:8892
- C:\Windows\System\oJRCpeK.exe
  C:\Windows\System\oJRCpeK.exe
  2⤵
  PID:8936
- C:\Windows\System\WXLRbQJ.exe
  C:\Windows\System\WXLRbQJ.exe
  2⤵
  PID:6972
- C:\Windows\System\DmYGxhW.exe
  C:\Windows\System\DmYGxhW.exe
  2⤵
  PID:9596
- C:\Windows\System\CiGRfSR.exe
  C:\Windows\System\CiGRfSR.exe
  2⤵
  PID:9640
- C:\Windows\System\LHVVWpH.exe
  C:\Windows\System\LHVVWpH.exe
  2⤵
  PID:9684
- C:\Windows\System\VkgZYgp.exe
  C:\Windows\System\VkgZYgp.exe
  2⤵
  PID:9728
- C:\Windows\System\XUbcuIz.exe
  C:\Windows\System\XUbcuIz.exe
  2⤵
  PID:9796
- C:\Windows\System\SPyzBtT.exe
  C:\Windows\System\SPyzBtT.exe
  2⤵
  PID:9924
- C:\Windows\System\lDBJtOB.exe
  C:\Windows\System\lDBJtOB.exe
  2⤵
  PID:9992
- C:\Windows\System\YRQPTJF.exe
  C:\Windows\System\YRQPTJF.exe
  2⤵
  PID:10084
- C:\Windows\System\DWTRhgt.exe
  C:\Windows\System\DWTRhgt.exe
  2⤵
  PID:10152
- C:\Windows\System\osZkinm.exe
  C:\Windows\System\osZkinm.exe
  2⤵
  PID:10284
- C:\Windows\System\zJkVTVb.exe
  C:\Windows\System\zJkVTVb.exe
  2⤵
  PID:10340
- C:\Windows\System\BVhZyyr.exe
  C:\Windows\System\BVhZyyr.exe
  2⤵
  PID:10412
- C:\Windows\System\RWlsBSU.exe
  C:\Windows\System\RWlsBSU.exe
  2⤵
  PID:10480
- C:\Windows\System\YkzWySZ.exe
  C:\Windows\System\YkzWySZ.exe
  2⤵
  PID:10540
- C:\Windows\System\LAhzrfX.exe
  C:\Windows\System\LAhzrfX.exe
  2⤵
  PID:10596
- C:\Windows\System\hoORbhg.exe
  C:\Windows\System\hoORbhg.exe
  2⤵
  PID:10668
- C:\Windows\System\RXfDMyT.exe
  C:\Windows\System\RXfDMyT.exe
  2⤵
  PID:11308
- C:\Windows\System\DUtqmue.exe
  C:\Windows\System\DUtqmue.exe
  2⤵
  PID:11324
- C:\Windows\System\vXxraww.exe
  C:\Windows\System\vXxraww.exe
  2⤵
  PID:11340
- C:\Windows\System\HbIXdYO.exe
  C:\Windows\System\HbIXdYO.exe
  2⤵
  PID:11356
- C:\Windows\System\kdKkgSv.exe
  C:\Windows\System\kdKkgSv.exe
  2⤵
  PID:11372
- C:\Windows\System\GQLNPzc.exe
  C:\Windows\System\GQLNPzc.exe
  2⤵
  PID:11388
- C:\Windows\System\XNWbdHV.exe
  C:\Windows\System\XNWbdHV.exe
  2⤵
  PID:11404
- C:\Windows\System\FUJNdzh.exe
  C:\Windows\System\FUJNdzh.exe
  2⤵
  PID:11420
- C:\Windows\System\YqamsHq.exe
  C:\Windows\System\YqamsHq.exe
  2⤵
  PID:11436
- C:\Windows\System\hxUNRTp.exe
  C:\Windows\System\hxUNRTp.exe
  2⤵
  PID:11452
- C:\Windows\System\odABTwB.exe
  C:\Windows\System\odABTwB.exe
  2⤵
  PID:11472
- C:\Windows\System\KFiPGNr.exe
  C:\Windows\System\KFiPGNr.exe
  2⤵
  PID:11496
- C:\Windows\System\pmRIfwl.exe
  C:\Windows\System\pmRIfwl.exe
  2⤵
  PID:11516
- C:\Windows\System\nGbonjb.exe
  C:\Windows\System\nGbonjb.exe
  2⤵
  PID:11544
- C:\Windows\System\UdANHtH.exe
  C:\Windows\System\UdANHtH.exe
  2⤵
  PID:11564
- C:\Windows\System\kpybFMs.exe
  C:\Windows\System\kpybFMs.exe
  2⤵
  PID:11580
- C:\Windows\System\EfagsCN.exe
  C:\Windows\System\EfagsCN.exe
  2⤵
  PID:11600
- C:\Windows\System\XqjDivu.exe
  C:\Windows\System\XqjDivu.exe
  2⤵
  PID:11620
- C:\Windows\System\FfiysyH.exe
  C:\Windows\System\FfiysyH.exe
  2⤵
  PID:11636
- C:\Windows\System\CXEgEFv.exe
  C:\Windows\System\CXEgEFv.exe
  2⤵
  PID:11652
- C:\Windows\System\oXVKLcV.exe
  C:\Windows\System\oXVKLcV.exe
  2⤵
  PID:11676
- C:\Windows\System\DWkPlWR.exe
  C:\Windows\System\DWkPlWR.exe
  2⤵
  PID:11700
- C:\Windows\System\MUIpUgq.exe
  C:\Windows\System\MUIpUgq.exe
  2⤵
  PID:11720
- C:\Windows\System\qrdSpWo.exe
  C:\Windows\System\qrdSpWo.exe
  2⤵
  PID:11736
- C:\Windows\System\yVASEZy.exe
  C:\Windows\System\yVASEZy.exe
  2⤵
  PID:11760
- C:\Windows\System\ClohNdN.exe
  C:\Windows\System\ClohNdN.exe
  2⤵
  PID:11784
- C:\Windows\System\RJByCQp.exe
  C:\Windows\System\RJByCQp.exe
  2⤵
  PID:11804
- C:\Windows\System\KGbOplO.exe
  C:\Windows\System\KGbOplO.exe
  2⤵
  PID:11832
- C:\Windows\System\FuXxrDn.exe
  C:\Windows\System\FuXxrDn.exe
  2⤵
  PID:11852
- C:\Windows\System\jSJuoUQ.exe
  C:\Windows\System\jSJuoUQ.exe
  2⤵
  PID:11872
- C:\Windows\System\uVXVpOC.exe
  C:\Windows\System\uVXVpOC.exe
  2⤵
  PID:11896
- C:\Windows\System\ZhxXMcf.exe
  C:\Windows\System\ZhxXMcf.exe
  2⤵
  PID:11916
- C:\Windows\System\alvimct.exe
  C:\Windows\System\alvimct.exe
  2⤵
  PID:11936
- C:\Windows\System\mOoyNsl.exe
  C:\Windows\System\mOoyNsl.exe
  2⤵
  PID:11960
- C:\Windows\System\LIybEnA.exe
  C:\Windows\System\LIybEnA.exe
  2⤵
  PID:11980
- C:\Windows\System\LEnHVbs.exe
  C:\Windows\System\LEnHVbs.exe
  2⤵
  PID:12000
- C:\Windows\System\ggmddDb.exe
  C:\Windows\System\ggmddDb.exe
  2⤵
  PID:12024
- C:\Windows\System\Ybxyxgo.exe
  C:\Windows\System\Ybxyxgo.exe
  2⤵
  PID:12044
- C:\Windows\System\ttcmJJM.exe
  C:\Windows\System\ttcmJJM.exe
  2⤵
  PID:12068
- C:\Windows\System\KXrjzWg.exe
  C:\Windows\System\KXrjzWg.exe
  2⤵
  PID:12096
- C:\Windows\System\nzjuVqV.exe
  C:\Windows\System\nzjuVqV.exe
  2⤵
  PID:12116
- C:\Windows\System\IWQtiqd.exe
  C:\Windows\System\IWQtiqd.exe
  2⤵
  PID:12140
- C:\Windows\System\DbMiwWJ.exe
  C:\Windows\System\DbMiwWJ.exe
  2⤵
  PID:12160
- C:\Windows\System\ZpKGAyM.exe
  C:\Windows\System\ZpKGAyM.exe
  2⤵
  PID:12184
- C:\Windows\System\hyggCxk.exe
  C:\Windows\System\hyggCxk.exe
  2⤵
  PID:12204
- C:\Windows\System\gfZNQZi.exe
  C:\Windows\System\gfZNQZi.exe
  2⤵
  PID:12224
- C:\Windows\System\uUhhCxR.exe
  C:\Windows\System\uUhhCxR.exe
  2⤵
  PID:12244
- C:\Windows\System\jWSaWSG.exe
  C:\Windows\System\jWSaWSG.exe
  2⤵
  PID:12260
- C:\Windows\System\uYtEUvQ.exe
  C:\Windows\System\uYtEUvQ.exe
  2⤵
  PID:12280
- C:\Windows\System\HcnoDHG.exe
  C:\Windows\System\HcnoDHG.exe
  2⤵
  PID:388
- C:\Windows\System\UKoKjoY.exe
  C:\Windows\System\UKoKjoY.exe
  2⤵
  PID:9500
- C:\Windows\System\mSJaaPY.exe
  C:\Windows\System\mSJaaPY.exe
  2⤵
  PID:11052
- C:\Windows\System\OKaCPEe.exe
  C:\Windows\System\OKaCPEe.exe
  2⤵
  PID:11120
- C:\Windows\System\GJYdMPa.exe
  C:\Windows\System\GJYdMPa.exe
  2⤵
  PID:11176
- C:\Windows\System\FzayROc.exe
  C:\Windows\System\FzayROc.exe
  2⤵
  PID:9904
- C:\Windows\System\OUckkjH.exe
  C:\Windows\System\OUckkjH.exe
  2⤵
  PID:11252
- C:\Windows\System\hWXMxIK.exe
  C:\Windows\System\hWXMxIK.exe
  2⤵
  PID:7796
- C:\Windows\System\hJQTczh.exe
  C:\Windows\System\hJQTczh.exe
  2⤵
  PID:8284
- C:\Windows\System\RRdbeUg.exe
  C:\Windows\System\RRdbeUg.exe
  2⤵
  PID:8596
- C:\Windows\System\IsqwcSG.exe
  C:\Windows\System\IsqwcSG.exe
  2⤵
  PID:12296
- C:\Windows\System\kISIqvM.exe
  C:\Windows\System\kISIqvM.exe
  2⤵
  PID:12320
- C:\Windows\System\ufPcoEC.exe
  C:\Windows\System\ufPcoEC.exe
  2⤵
  PID:12340
- C:\Windows\System\UmVrlGg.exe
  C:\Windows\System\UmVrlGg.exe
  2⤵
  PID:12360
- C:\Windows\System\MuXJGre.exe
  C:\Windows\System\MuXJGre.exe
  2⤵
  PID:12380
- C:\Windows\System\kMYyags.exe
  C:\Windows\System\kMYyags.exe
  2⤵
  PID:12404
- C:\Windows\System\qEkZrJY.exe
  C:\Windows\System\qEkZrJY.exe
  2⤵
  PID:12432
- C:\Windows\System\SjbfMgS.exe
  C:\Windows\System\SjbfMgS.exe
  2⤵
  PID:12452
- C:\Windows\System\dzhsiku.exe
  C:\Windows\System\dzhsiku.exe
  2⤵
  PID:12468
- C:\Windows\System\aWBMbys.exe
  C:\Windows\System\aWBMbys.exe
  2⤵
  PID:12484
- C:\Windows\System\mcJYZjK.exe
  C:\Windows\System\mcJYZjK.exe
  2⤵
  PID:12500
- C:\Windows\System\YdHUooO.exe
  C:\Windows\System\YdHUooO.exe
  2⤵
  PID:12516
- C:\Windows\System\SDQSDCQ.exe
  C:\Windows\System\SDQSDCQ.exe
  2⤵
  PID:12536
- C:\Windows\System\tgyBmtJ.exe
  C:\Windows\System\tgyBmtJ.exe
  2⤵
  PID:12556
- C:\Windows\System\fDtkekQ.exe
  C:\Windows\System\fDtkekQ.exe
  2⤵
  PID:12572
- C:\Windows\System\OLgYRCJ.exe
  C:\Windows\System\OLgYRCJ.exe
  2⤵
  PID:12592
- C:\Windows\System\Qzdrsbr.exe
  C:\Windows\System\Qzdrsbr.exe
  2⤵
  PID:12608
- C:\Windows\System\uCEFpMe.exe
  C:\Windows\System\uCEFpMe.exe
  2⤵
  PID:12632
- C:\Windows\System\gOySbHG.exe
  C:\Windows\System\gOySbHG.exe
  2⤵
  PID:12656
- C:\Windows\System\TAguNhg.exe
  C:\Windows\System\TAguNhg.exe
  2⤵
  PID:12676
- C:\Windows\System\yFScmUk.exe
  C:\Windows\System\yFScmUk.exe
  2⤵
  PID:12700
- C:\Windows\System\tJZbzQP.exe
  C:\Windows\System\tJZbzQP.exe
  2⤵
  PID:12724
- C:\Windows\System\rCyGSmM.exe
  C:\Windows\System\rCyGSmM.exe
  2⤵
  PID:12748
- C:\Windows\System\tdtRORg.exe
  C:\Windows\System\tdtRORg.exe
  2⤵
  PID:12768
- C:\Windows\System\LNRDbhk.exe
  C:\Windows\System\LNRDbhk.exe
  2⤵
  PID:12788
- C:\Windows\System\btkZpRm.exe
  C:\Windows\System\btkZpRm.exe
  2⤵
  PID:12812
- C:\Windows\System\KDhCLoY.exe
  C:\Windows\System\KDhCLoY.exe
  2⤵
  PID:12836
- C:\Windows\System\GSDKwro.exe
  C:\Windows\System\GSDKwro.exe
  2⤵
  PID:12860
- C:\Windows\System\EYFgvIO.exe
  C:\Windows\System\EYFgvIO.exe
  2⤵
  PID:12880
- C:\Windows\System\dKqERPR.exe
  C:\Windows\System\dKqERPR.exe
  2⤵
  PID:12904
- C:\Windows\System\XncbTKi.exe
  C:\Windows\System\XncbTKi.exe
  2⤵
  PID:12928
- C:\Windows\System\AqjPwyg.exe
  C:\Windows\System\AqjPwyg.exe
  2⤵
  PID:12952
- C:\Windows\System\YHreWUN.exe
  C:\Windows\System\YHreWUN.exe
  2⤵
  PID:12976
- C:\Windows\System\mqTBbHe.exe
  C:\Windows\System\mqTBbHe.exe
  2⤵
  PID:12996
- C:\Windows\System\OWabgYj.exe
  C:\Windows\System\OWabgYj.exe
  2⤵
  PID:13020
- C:\Windows\System\bujkQKg.exe
  C:\Windows\System\bujkQKg.exe
  2⤵
  PID:13044
- C:\Windows\System\hQXXgAT.exe
  C:\Windows\System\hQXXgAT.exe
  2⤵
  PID:13068
- C:\Windows\System\NZAHUdy.exe
  C:\Windows\System\NZAHUdy.exe
  2⤵
  PID:13088
- C:\Windows\System\bAmRFmf.exe
  C:\Windows\System\bAmRFmf.exe
  2⤵
  PID:13112
- C:\Windows\System\lTrdvaT.exe
  C:\Windows\System\lTrdvaT.exe
  2⤵
  PID:13132
- C:\Windows\System\djFWsoM.exe
  C:\Windows\System\djFWsoM.exe
  2⤵
  PID:13152
- C:\Windows\System\GxxbUMy.exe
  C:\Windows\System\GxxbUMy.exe
  2⤵
  PID:13172
- C:\Windows\System\wjarrxC.exe
  C:\Windows\System\wjarrxC.exe
  2⤵
  PID:13200
- C:\Windows\System\QCLyLtF.exe
  C:\Windows\System\QCLyLtF.exe
  2⤵
  PID:13228
- C:\Windows\System\iMdNJQL.exe
  C:\Windows\System\iMdNJQL.exe
  2⤵
  PID:13256
- C:\Windows\System\uZgpgpS.exe
  C:\Windows\System\uZgpgpS.exe
  2⤵
  PID:13272
- C:\Windows\System\zMWnBAd.exe
  C:\Windows\System\zMWnBAd.exe
  2⤵
  PID:13288
- C:\Windows\System\JRxfIxP.exe
  C:\Windows\System\JRxfIxP.exe
  2⤵
  PID:13304
- C:\Windows\System\tsDXWIo.exe
  C:\Windows\System\tsDXWIo.exe
  2⤵
  PID:10376
- C:\Windows\System\QYSZkUI.exe
  C:\Windows\System\QYSZkUI.exe
  2⤵
  PID:10028
- C:\Windows\System\vonXDHH.exe
  C:\Windows\System\vonXDHH.exe
  2⤵
  PID:316
- C:\Windows\System\qzqMvEN.exe
  C:\Windows\System\qzqMvEN.exe
  2⤵
  PID:9820
- C:\Windows\System\OJlMHWo.exe
  C:\Windows\System\OJlMHWo.exe
  2⤵
  PID:13224
- C:\Windows\System\ITrHhNc.exe
  C:\Windows\System\ITrHhNc.exe
  2⤵
  PID:13296
- C:\Windows\System\WnyBcbZ.exe
  C:\Windows\System\WnyBcbZ.exe
  2⤵
  PID:1208
- C:\Windows\System\hUURXDR.exe
  C:\Windows\System\hUURXDR.exe
  2⤵
  PID:6644
- C:\Windows\System\hxDYWUr.exe
  C:\Windows\System\hxDYWUr.exe
  2⤵
  PID:4892
- C:\Windows\System\ohjOAUQ.exe
  C:\Windows\System\ohjOAUQ.exe
  2⤵
  PID:7020
- C:\Windows\System\OMIgGqX.exe
  C:\Windows\System\OMIgGqX.exe
  2⤵
  PID:8004
- C:\Windows\System\SpCzvLS.exe
  C:\Windows\System\SpCzvLS.exe
  2⤵
  PID:7520
- C:\Windows\System\HpchCcS.exe
  C:\Windows\System\HpchCcS.exe
  2⤵
  PID:7736
- C:\Windows\System\WoPWfDg.exe
  C:\Windows\System\WoPWfDg.exe
  2⤵
  PID:3792
- C:\Windows\System\hUWdKaG.exe
  C:\Windows\System\hUWdKaG.exe
  2⤵
  PID:11488
- C:\Windows\System\RAyvxDK.exe
  C:\Windows\System\RAyvxDK.exe
  2⤵
  PID:6696
- C:\Windows\System\cSbwNzK.exe
  C:\Windows\System\cSbwNzK.exe
  2⤵
  PID:11628
- C:\Windows\System\WqkshYp.exe
  C:\Windows\System\WqkshYp.exe
  2⤵
  PID:11904
- C:\Windows\System\cLTlhjh.exe
  C:\Windows\System\cLTlhjh.exe
  2⤵
  PID:10064
- C:\Windows\System\tFAUiLo.exe
  C:\Windows\System\tFAUiLo.exe
  2⤵
  PID:12196
- C:\Windows\System\dEXkfzs.exe
  C:\Windows\System\dEXkfzs.exe
  2⤵
  PID:8716
- C:\Windows\System\rhijPcQ.exe
  C:\Windows\System\rhijPcQ.exe
  2⤵
  PID:10192
- C:\Windows\System\gIDvFgY.exe
  C:\Windows\System\gIDvFgY.exe
  2⤵
  PID:10236
- C:\Windows\System\TGBDgyd.exe
  C:\Windows\System\TGBDgyd.exe
  2⤵
  PID:9112
- C:\Windows\System\aHPBUgh.exe
  C:\Windows\System\aHPBUgh.exe
  2⤵
  PID:1704
- C:\Windows\System\XlewoPa.exe
  C:\Windows\System\XlewoPa.exe
  2⤵
  PID:10568
- C:\Windows\System\mZbBbyB.exe
  C:\Windows\System\mZbBbyB.exe
  2⤵
  PID:1468
- C:\Windows\System\kJZAezy.exe
  C:\Windows\System\kJZAezy.exe
  2⤵
  PID:1868
- C:\Windows\System\XnHCPfx.exe
  C:\Windows\System\XnHCPfx.exe
  2⤵
  PID:11320
- C:\Windows\System\CwHMFml.exe
  C:\Windows\System\CwHMFml.exe
  2⤵
  PID:11348
- C:\Windows\System\WSBwUBr.exe
  C:\Windows\System\WSBwUBr.exe
  2⤵
  PID:3836
- C:\Windows\System\GkwdQkD.exe
  C:\Windows\System\GkwdQkD.exe
  2⤵
  PID:2912
- C:\Windows\System\PRmhUXg.exe
  C:\Windows\System\PRmhUXg.exe
  2⤵
  PID:9436
- C:\Windows\System\ihbUuaa.exe
  C:\Windows\System\ihbUuaa.exe
  2⤵
  PID:9208
- C:\Windows\System\snWHGDh.exe
  C:\Windows\System\snWHGDh.exe
  2⤵
  PID:4976
- C:\Windows\System\hVlWYXC.exe
  C:\Windows\System\hVlWYXC.exe
  2⤵
  PID:11412
- C:\Windows\System\cmNEGPk.exe
  C:\Windows\System\cmNEGPk.exe
  2⤵
  PID:1404
- C:\Windows\System\RfDTqSK.exe
  C:\Windows\System\RfDTqSK.exe
  2⤵
  PID:12480
- C:\Windows\System\tQPxZXj.exe
  C:\Windows\System\tQPxZXj.exe
  2⤵
  PID:9276
- C:\Windows\System\nEUwXWD.exe
  C:\Windows\System\nEUwXWD.exe
  2⤵
  PID:12512
- C:\Windows\System\GrXHSpd.exe
  C:\Windows\System\GrXHSpd.exe
  2⤵
  PID:12588
- C:\Windows\System\ZcuWvlj.exe
  C:\Windows\System\ZcuWvlj.exe
  2⤵
  PID:3396
- C:\Windows\System\bEgRYLw.exe
  C:\Windows\System\bEgRYLw.exe
  2⤵
  PID:5280
- C:\Windows\System\ImRSRzJ.exe
  C:\Windows\System\ImRSRzJ.exe
  2⤵
  PID:10652
- C:\Windows\System\JQkRoRb.exe
  C:\Windows\System\JQkRoRb.exe
  2⤵
  PID:9204
- C:\Windows\System\ffdkFcW.exe
  C:\Windows\System\ffdkFcW.exe
  2⤵
  PID:5472
- C:\Windows\System\RUvTFCM.exe
  C:\Windows\System\RUvTFCM.exe
  2⤵
  PID:9860
- C:\Windows\System\UpUQbey.exe
  C:\Windows\System\UpUQbey.exe
  2⤵
  PID:11316
- C:\Windows\System\yItrEgh.exe
  C:\Windows\System\yItrEgh.exe
  2⤵
  PID:7324
- C:\Windows\System\ZuekYKA.exe
  C:\Windows\System\ZuekYKA.exe
  2⤵
  PID:10820
- C:\Windows\System\HpqHpgK.exe
  C:\Windows\System\HpqHpgK.exe
  2⤵
  PID:3496
- C:\Windows\System\qIbzpnZ.exe
  C:\Windows\System\qIbzpnZ.exe
  2⤵
  PID:12968
- C:\Windows\System\dUbpNfI.exe
  C:\Windows\System\dUbpNfI.exe
  2⤵
  PID:9264
- C:\Windows\System\awoHqit.exe
  C:\Windows\System\awoHqit.exe
  2⤵
  PID:2380
- C:\Windows\System\ijHPEBw.exe
  C:\Windows\System\ijHPEBw.exe
  2⤵
  PID:9880
- C:\Windows\System\MiUaywW.exe
  C:\Windows\System\MiUaywW.exe
  2⤵
  PID:12156
- C:\Windows\System\NywwXet.exe
  C:\Windows\System\NywwXet.exe
  2⤵
  PID:796
- C:\Windows\System\FDCIron.exe
  C:\Windows\System\FDCIron.exe
  2⤵
  PID:13316
- C:\Windows\System\eLNKAmA.exe
  C:\Windows\System\eLNKAmA.exe
  2⤵
  PID:13364
- C:\Windows\System\CXHecZN.exe
  C:\Windows\System\CXHecZN.exe
  2⤵
  PID:13524
- C:\Windows\System\xlvDZeZ.exe
  C:\Windows\System\xlvDZeZ.exe
  2⤵
  PID:13548
- C:\Windows\System\HMGPoRh.exe
  C:\Windows\System\HMGPoRh.exe
  2⤵
  PID:13572
- C:\Windows\System\PbYojkC.exe
  C:\Windows\System\PbYojkC.exe
  2⤵
  PID:13616
- C:\Windows\System\SaENXqI.exe
  C:\Windows\System\SaENXqI.exe
  2⤵
  PID:13640
- C:\Windows\System\rfPbDIx.exe
  C:\Windows\System\rfPbDIx.exe
  2⤵
  PID:13656
- C:\Windows\System\uskTkRE.exe
  C:\Windows\System\uskTkRE.exe
  2⤵
  PID:13676
- C:\Windows\System\RqHrfvE.exe
  C:\Windows\System\RqHrfvE.exe
  2⤵
  PID:13700
- C:\Windows\System\LsXlIzN.exe
  C:\Windows\System\LsXlIzN.exe
  2⤵
  PID:13764
- C:\Windows\System\QyZyNjw.exe
  C:\Windows\System\QyZyNjw.exe
  2⤵
  PID:14232
- C:\Windows\System\AkSxVFi.exe
  C:\Windows\System\AkSxVFi.exe
  2⤵
  PID:14252
- C:\Windows\System\sdfxfNq.exe
  C:\Windows\System\sdfxfNq.exe
  2⤵
  PID:14268
- C:\Windows\System\enWEjIF.exe
  C:\Windows\System\enWEjIF.exe
  2⤵
  PID:14324
- C:\Windows\System\ZvvBKRN.exe
  C:\Windows\System\ZvvBKRN.exe
  2⤵
  PID:8104
- C:\Windows\System\qpbelFj.exe
  C:\Windows\System\qpbelFj.exe
  2⤵
  PID:9416
- C:\Windows\System\kvVucvk.exe
  C:\Windows\System\kvVucvk.exe
  2⤵
  PID:11912
- C:\Windows\System\lIVDQpm.exe
  C:\Windows\System\lIVDQpm.exe
  2⤵
  PID:9140
- C:\Windows\System\PyQFztf.exe
  C:\Windows\System\PyQFztf.exe
  2⤵
  PID:9144
- C:\Windows\System\xtLwiDf.exe
  C:\Windows\System\xtLwiDf.exe
  2⤵
  PID:12668
- C:\Windows\System\ztsfOLt.exe
  C:\Windows\System\ztsfOLt.exe
  2⤵
  PID:11236
- C:\Windows\System\zsvXPCs.exe
  C:\Windows\System\zsvXPCs.exe
  2⤵
  PID:11752
- C:\Windows\System\SpzTFnQ.exe
  C:\Windows\System\SpzTFnQ.exe
  2⤵
  PID:11460
- C:\Windows\System\iiazwcA.exe
  C:\Windows\System\iiazwcA.exe
  2⤵
  PID:1160
- C:\Windows\System\LFwXahw.exe
  C:\Windows\System\LFwXahw.exe
  2⤵
  PID:3476
- C:\Windows\System\YKZqYyQ.exe
  C:\Windows\System\YKZqYyQ.exe
  2⤵
  PID:9128
- C:\Windows\System\TZFnKpv.exe
  C:\Windows\System\TZFnKpv.exe
  2⤵
  PID:13484
- C:\Windows\System\mNUWlJX.exe
  C:\Windows\System\mNUWlJX.exe
  2⤵
  PID:13500
- C:\Windows\System\sduyMSR.exe
  C:\Windows\System\sduyMSR.exe
  2⤵
  PID:8544
- C:\Windows\System\YpdSere.exe
  C:\Windows\System\YpdSere.exe
  2⤵
  PID:9172
- C:\Windows\System\siYbSbC.exe
  C:\Windows\System\siYbSbC.exe
  2⤵
  PID:13336
- C:\Windows\System\AhXDUIn.exe
  C:\Windows\System\AhXDUIn.exe
  2⤵
  PID:10344
- C:\Windows\System\mVRhYsR.exe
  C:\Windows\System\mVRhYsR.exe
  2⤵
  PID:11728
- C:\Windows\System\XjEZQwN.exe
  C:\Windows\System\XjEZQwN.exe
  2⤵
  PID:11276
- C:\Windows\System\nGwjDxZ.exe
  C:\Windows\System\nGwjDxZ.exe
  2⤵
  PID:13812
- C:\Windows\System\qycweyl.exe
  C:\Windows\System\qycweyl.exe
  2⤵
  PID:13568
- C:\Windows\System\bdJIZOj.exe
  C:\Windows\System\bdJIZOj.exe
  2⤵
  PID:6828
- C:\Windows\System\JkxuQSw.exe
  C:\Windows\System\JkxuQSw.exe
  2⤵
  PID:6812
- C:\Windows\System\bwBIkuq.exe
  C:\Windows\System\bwBIkuq.exe
  2⤵
  PID:3644
- C:\Windows\System\HtgNLlW.exe
  C:\Windows\System\HtgNLlW.exe
  2⤵
  PID:12872
- C:\Windows\System\vioNFQV.exe
  C:\Windows\System\vioNFQV.exe
  2⤵
  PID:6328
- C:\Windows\System\rVVZBkW.exe
  C:\Windows\System\rVVZBkW.exe
  2⤵
  PID:5076
- C:\Windows\System\MWyPjwg.exe
  C:\Windows\System\MWyPjwg.exe
  2⤵
  PID:13648
- C:\Windows\System\vqcRYHf.exe
  C:\Windows\System\vqcRYHf.exe
  2⤵
  PID:13796
- C:\Windows\System\uDExkrS.exe
  C:\Windows\System\uDExkrS.exe
  2⤵
  PID:14064
- C:\Windows\System\MNBtFPj.exe
  C:\Windows\System\MNBtFPj.exe
  2⤵
  PID:13860
- C:\Windows\System\PVuplVZ.exe
  C:\Windows\System\PVuplVZ.exe
  2⤵
  PID:14188
- C:\Windows\System\jMWPQJM.exe
  C:\Windows\System\jMWPQJM.exe
  2⤵
  PID:5320
- C:\Windows\System\uXAOVVD.exe
  C:\Windows\System\uXAOVVD.exe
  2⤵
  PID:1148
- C:\Windows\System\cXjXYYQ.exe
  C:\Windows\System\cXjXYYQ.exe
  2⤵
  PID:332
- C:\Windows\System\hMQnJUz.exe
  C:\Windows\System\hMQnJUz.exe
  2⤵
  PID:116
- C:\Windows\System\camZsMz.exe
  C:\Windows\System\camZsMz.exe
  2⤵
  PID:11480
- C:\Windows\System\zQatRph.exe
  C:\Windows\System\zQatRph.exe
  2⤵
  PID:13348
- C:\Windows\System\mVgPDQR.exe
  C:\Windows\System\mVgPDQR.exe
  2⤵
  PID:13280
- C:\Windows\System\LxjSxjS.exe
  C:\Windows\System\LxjSxjS.exe
  2⤵
  PID:11164
- C:\Windows\System\TAIagYG.exe
  C:\Windows\System\TAIagYG.exe
  2⤵
  PID:7748
- C:\Windows\System\lxJWZVV.exe
  C:\Windows\System\lxJWZVV.exe
  2⤵
  PID:13688
- C:\Windows\System\WmRxMAx.exe
  C:\Windows\System\WmRxMAx.exe
  2⤵
  PID:13928
- C:\Windows\System\hRlcHKn.exe
  C:\Windows\System\hRlcHKn.exe
  2⤵
  PID:1600
- C:\Windows\System\KRZDUaP.exe
  C:\Windows\System\KRZDUaP.exe
  2⤵
  PID:2432
- C:\Windows\System\RofBTmf.exe
  C:\Windows\System\RofBTmf.exe
  2⤵
  PID:14160
- C:\Windows\System\zWUGZwX.exe
  C:\Windows\System\zWUGZwX.exe
  2⤵
  PID:13732
- C:\Windows\System\EnJtPLL.exe
  C:\Windows\System\EnJtPLL.exe
  2⤵
  PID:13872
- C:\Windows\System\nLAqrGJ.exe
  C:\Windows\System\nLAqrGJ.exe
  2⤵
  PID:2940
- C:\Windows\System\hSbQDXJ.exe
  C:\Windows\System\hSbQDXJ.exe
  2⤵
  PID:3748
- C:\Windows\System\NeRklcm.exe
  C:\Windows\System\NeRklcm.exe
  2⤵
  PID:9092
- C:\Windows\System\STwdnMQ.exe
  C:\Windows\System\STwdnMQ.exe
  2⤵
  PID:13436
- C:\Windows\System\uPxDeBz.exe
  C:\Windows\System\uPxDeBz.exe
  2⤵
  PID:10132
- C:\Windows\System\RlaJqBo.exe
  C:\Windows\System\RlaJqBo.exe
  2⤵
  PID:2772
- C:\Windows\System\HrpRBLa.exe
  C:\Windows\System\HrpRBLa.exe
  2⤵
  PID:13580
- C:\Windows\System\vhMLNAg.exe
  C:\Windows\System\vhMLNAg.exe
  2⤵
  PID:13564
- C:\Windows\System\FSdQaEa.exe
  C:\Windows\System\FSdQaEa.exe
  2⤵
  PID:13668
- C:\Windows\System\CsVYVmA.exe
  C:\Windows\System\CsVYVmA.exe
  2⤵
  PID:4228
- C:\Windows\System\rWbBzeG.exe
  C:\Windows\System\rWbBzeG.exe
  2⤵
  PID:13736
- C:\Windows\System\pHqqvAt.exe
  C:\Windows\System\pHqqvAt.exe
  2⤵
  PID:14012
- C:\Windows\System\qpMgzhQ.exe
  C:\Windows\System\qpMgzhQ.exe
  2⤵
  PID:13924
- C:\Windows\System\DODnlMf.exe
  C:\Windows\System\DODnlMf.exe
  2⤵
  PID:13984
- C:\Windows\System\GcFrKNU.exe
  C:\Windows\System\GcFrKNU.exe
  2⤵
  PID:14072
- C:\Windows\System\glKsoXM.exe
  C:\Windows\System\glKsoXM.exe
  2⤵
  PID:14104
- C:\Windows\System\RQrancm.exe
  C:\Windows\System\RQrancm.exe
  2⤵
  PID:14028
- C:\Windows\System\FxMxjsu.exe
  C:\Windows\System\FxMxjsu.exe
  2⤵
  PID:3292
- C:\Windows\System\BTsaENZ.exe
  C:\Windows\System\BTsaENZ.exe
  2⤵
  PID:14120
- C:\Windows\System\LUNxgEx.exe
  C:\Windows\System\LUNxgEx.exe
  2⤵
  PID:960
- C:\Windows\System\aRsqmPv.exe
  C:\Windows\System\aRsqmPv.exe
  2⤵
  PID:3472
- C:\Windows\System\KGoMzrd.exe
  C:\Windows\System\KGoMzrd.exe
  2⤵
  PID:1896
- C:\Windows\System\upTzWxD.exe
  C:\Windows\System\upTzWxD.exe
  2⤵
  PID:4772
- C:\Windows\System\tapfvwr.exe
  C:\Windows\System\tapfvwr.exe
  2⤵
  PID:3368
- C:\Windows\System\DQTQMHN.exe
  C:\Windows\System\DQTQMHN.exe
  2⤵
  PID:13396
- C:\Windows\System\qcdDVyv.exe
  C:\Windows\System\qcdDVyv.exe
  2⤵
  PID:13392
- C:\Windows\System\lePiXkL.exe
  C:\Windows\System\lePiXkL.exe
  2⤵
  PID:4780
- C:\Windows\System\ZKESMAe.exe
  C:\Windows\System\ZKESMAe.exe
  2⤵
  PID:1508
- C:\Windows\System\fBgHKKq.exe
  C:\Windows\System\fBgHKKq.exe
  2⤵
  PID:8988
- C:\Windows\System\nMnNtDc.exe
  C:\Windows\System\nMnNtDc.exe
  2⤵
  PID:1244
- C:\Windows\System\fbgxtBr.exe
  C:\Windows\System\fbgxtBr.exe
  2⤵
  PID:3588
- C:\Windows\System\monfnVL.exe
  C:\Windows\System\monfnVL.exe
  2⤵
  PID:13012
- C:\Windows\System\zIJOtci.exe
  C:\Windows\System\zIJOtci.exe
  2⤵
  PID:4296
- C:\Windows\System\jmSoqWS.exe
  C:\Windows\System\jmSoqWS.exe
  2⤵
  PID:7636
- C:\Windows\System\ITQEZtp.exe
  C:\Windows\System\ITQEZtp.exe
  2⤵
  PID:2748
- C:\Windows\System\BCPMLgz.exe
  C:\Windows\System\BCPMLgz.exe
  2⤵
  PID:2136
- C:\Windows\System\XHQNoDP.exe
  C:\Windows\System\XHQNoDP.exe
  2⤵
  PID:3296
- C:\Windows\System\donoFts.exe
  C:\Windows\System\donoFts.exe
  2⤵
  PID:13772
- C:\Windows\System\kSpFGLk.exe
  C:\Windows\System\kSpFGLk.exe
  2⤵
  PID:14220
- C:\Windows\System\YbnWXKS.exe
  C:\Windows\System\YbnWXKS.exe
  2⤵
  PID:3840
- C:\Windows\System\xXoehRp.exe
  C:\Windows\System\xXoehRp.exe
  2⤵
  PID:3608
- C:\Windows\System\OyGWqbF.exe
  C:\Windows\System\OyGWqbF.exe
  2⤵
  PID:3708
- C:\Windows\System\zgBBvRf.exe
  C:\Windows\System\zgBBvRf.exe
  2⤵
  PID:3804
- C:\Windows\System\xCUORhA.exe
  C:\Windows\System\xCUORhA.exe
  2⤵
  PID:2864
- C:\Windows\System\TVfkxAD.exe
  C:\Windows\System\TVfkxAD.exe
  2⤵
  PID:784
- C:\Windows\System\cruvjUT.exe
  C:\Windows\System\cruvjUT.exe
  2⤵
  PID:1588
- C:\Windows\System\JvLviLi.exe
  C:\Windows\System\JvLviLi.exe
  2⤵
  PID:2000
- C:\Windows\System\atdjxfZ.exe
  C:\Windows\System\atdjxfZ.exe
  2⤵
  PID:1996
- C:\Windows\System\xYRgyxt.exe
  C:\Windows\System\xYRgyxt.exe
  2⤵
  PID:1340
- C:\Windows\System\WziaYuT.exe
  C:\Windows\System\WziaYuT.exe
  2⤵
  PID:2344
- C:\Windows\System\fQUipDt.exe
  C:\Windows\System\fQUipDt.exe
  2⤵
  PID:3384
- C:\Windows\System\nhUyIds.exe
  C:\Windows\System\nhUyIds.exe
  2⤵
  PID:9080
- C:\Windows\System\LXjEOfL.exe
  C:\Windows\System\LXjEOfL.exe
  2⤵
  PID:11464
- C:\Windows\System\ULiDemG.exe
  C:\Windows\System\ULiDemG.exe
  2⤵
  PID:3488
- C:\Windows\System\qgUJwbG.exe
  C:\Windows\System\qgUJwbG.exe
  2⤵
  PID:4268
- C:\Windows\System\ajRMuZJ.exe
  C:\Windows\System\ajRMuZJ.exe
  2⤵
  PID:8
- C:\Windows\System\ZMuzVoI.exe
  C:\Windows\System\ZMuzVoI.exe
  2⤵
  PID:3008
- C:\Windows\System\VQBAanS.exe
  C:\Windows\System\VQBAanS.exe
  2⤵
  PID:3904
- C:\Windows\System\ZPsELST.exe
  C:\Windows\System\ZPsELST.exe
  2⤵
  PID:13452
- C:\Windows\System\uAuaZEx.exe
  C:\Windows\System\uAuaZEx.exe
  2⤵
  PID:1576
- C:\Windows\System\ZlfVaIR.exe
  C:\Windows\System\ZlfVaIR.exe
  2⤵
  PID:6504
- C:\Windows\System\shFNrNN.exe
  C:\Windows\System\shFNrNN.exe
  2⤵
  PID:9252
- C:\Windows\System\lMHhZLR.exe
  C:\Windows\System\lMHhZLR.exe
  2⤵
  PID:11768
- C:\Windows\System\UYKCFpH.exe
  C:\Windows\System\UYKCFpH.exe
  2⤵
  PID:10248
- C:\Windows\System\IbRVPZI.exe
  C:\Windows\System\IbRVPZI.exe
  2⤵
  PID:9656
- C:\Windows\System\FSeQyjo.exe
  C:\Windows\System\FSeQyjo.exe
  2⤵
  PID:10104
- C:\Windows\System\DOZSTpc.exe
  C:\Windows\System\DOZSTpc.exe
  2⤵
  PID:5192
- C:\Windows\System\BlXVjjr.exe
  C:\Windows\System\BlXVjjr.exe
  2⤵
  PID:748
- C:\Windows\System\BBZMjJr.exe
  C:\Windows\System\BBZMjJr.exe
  2⤵
  PID:1480
- C:\Windows\System\UcUPywi.exe
  C:\Windows\System\UcUPywi.exe
  2⤵
  PID:5364
- C:\Windows\System\aUnMocG.exe
  C:\Windows\System\aUnMocG.exe
  2⤵
  PID:5584
- C:\Windows\System\BOvQXFq.exe
  C:\Windows\System\BOvQXFq.exe
  2⤵
  PID:5924
- C:\Windows\System\mofHqKw.exe
  C:\Windows\System\mofHqKw.exe
  2⤵
  PID:4564
- C:\Windows\System\ISPvcwM.exe
  C:\Windows\System\ISPvcwM.exe
  2⤵
  PID:13972
- C:\Windows\System\teQJuBA.exe
  C:\Windows\System\teQJuBA.exe
  2⤵
  PID:6292
- C:\Windows\System\juwOsHV.exe
  C:\Windows\System\juwOsHV.exe
  2⤵
  PID:6464
- C:\Windows\System\XgTiweD.exe
  C:\Windows\System\XgTiweD.exe
  2⤵
  PID:5284
- C:\Windows\System\WaOuHIi.exe
  C:\Windows\System\WaOuHIi.exe
  2⤵
  PID:1004
- C:\Windows\System\JtaiSuY.exe
  C:\Windows\System\JtaiSuY.exe
  2⤵
  PID:5928
- C:\Windows\System\IAIssSs.exe
  C:\Windows\System\IAIssSs.exe
  2⤵
  PID:5908
- C:\Windows\System\nDdpqDF.exe
  C:\Windows\System\nDdpqDF.exe
  2⤵
  PID:5164
- C:\Windows\System\AgtKYoe.exe
  C:\Windows\System\AgtKYoe.exe
  2⤵
  PID:5160
- C:\Windows\System\ZMNVbin.exe
  C:\Windows\System\ZMNVbin.exe
  2⤵
  PID:3432
- C:\Windows\System\mQMCTZn.exe
  C:\Windows\System\mQMCTZn.exe
  2⤵
  PID:1928
- C:\Windows\System\PzREkrs.exe
  C:\Windows\System\PzREkrs.exe
  2⤵
  PID:13964
- C:\Windows\System\ZLPZpkL.exe
  C:\Windows\System\ZLPZpkL.exe
  2⤵
  PID:3908
- C:\Windows\System\jeWxpff.exe
  C:\Windows\System\jeWxpff.exe
  2⤵
  PID:752
- C:\Windows\System\OXvCmVv.exe
  C:\Windows\System\OXvCmVv.exe
  2⤵
  PID:6312
- C:\Windows\System\llQpgZH.exe
  C:\Windows\System\llQpgZH.exe
  2⤵
  PID:2452
- C:\Windows\System\lSjlDtB.exe
  C:\Windows\System\lSjlDtB.exe
  2⤵
  PID:4904
- C:\Windows\System\DeoxZPA.exe
  C:\Windows\System\DeoxZPA.exe
  2⤵
  PID:6632
- C:\Windows\System\sZQwxYX.exe
  C:\Windows\System\sZQwxYX.exe
  2⤵
  PID:3088
- C:\Windows\System\LrOuJqP.exe
  C:\Windows\System\LrOuJqP.exe
  2⤵
  PID:548
- C:\Windows\System\kfFjCnc.exe
  C:\Windows\System\kfFjCnc.exe
  2⤵
  PID:6772
- C:\Windows\System\DLmtYuq.exe
  C:\Windows\System\DLmtYuq.exe
  2⤵
  PID:4648
- C:\Windows\System\jZjFLef.exe
  C:\Windows\System\jZjFLef.exe
  2⤵
  PID:6656
- C:\Windows\System\QrxoCkL.exe
  C:\Windows\System\QrxoCkL.exe
  2⤵
  PID:6000
- C:\Windows\System\WNkZevG.exe
  C:\Windows\System\WNkZevG.exe
  2⤵
  PID:4988
- C:\Windows\System\ADhNilJ.exe
  C:\Windows\System\ADhNilJ.exe
  2⤵
  PID:14052
- C:\Windows\System\ZJDmZYw.exe
  C:\Windows\System\ZJDmZYw.exe
  2⤵
  PID:3596
- C:\Windows\System\gtebRLv.exe
  C:\Windows\System\gtebRLv.exe
  2⤵
  PID:14020
- C:\Windows\System\OahcQYX.exe
  C:\Windows\System\OahcQYX.exe
  2⤵
  PID:4276
- C:\Windows\System\IAXHvmq.exe
  C:\Windows\System\IAXHvmq.exe
  2⤵
  PID:12620
- C:\Windows\System\TxDxJUh.exe
  C:\Windows\System\TxDxJUh.exe
  2⤵
  PID:12348
- C:\Windows\System\SOUlbVW.exe
  C:\Windows\System\SOUlbVW.exe
  2⤵
  PID:3492
- C:\Windows\System\aRPJgpw.exe
  C:\Windows\System\aRPJgpw.exe
  2⤵
  PID:6700
- C:\Windows\System\DRMOqDR.exe
  C:\Windows\System\DRMOqDR.exe
  2⤵
  PID:6172
- C:\Windows\System\oeAxcDQ.exe
  C:\Windows\System\oeAxcDQ.exe
  2⤵
  PID:2112
- C:\Windows\System\wYOYndc.exe
  C:\Windows\System\wYOYndc.exe
  2⤵
  PID:7496
- C:\Windows\System\kUDCXGN.exe
  C:\Windows\System\kUDCXGN.exe
  2⤵
  PID:5516
- C:\Windows\System\bDHjzNC.exe
  C:\Windows\System\bDHjzNC.exe
  2⤵
  PID:5016
- C:\Windows\System\gmxbsQg.exe
  C:\Windows\System\gmxbsQg.exe
  2⤵
  PID:5384
- C:\Windows\System\TJKlSwm.exe
  C:\Windows\System\TJKlSwm.exe
  2⤵
  PID:7584
- C:\Windows\System\ZJTGeWx.exe
  C:\Windows\System\ZJTGeWx.exe
  2⤵
  PID:1232
- C:\Windows\System\ndWbxBE.exe
  C:\Windows\System\ndWbxBE.exe
  2⤵
  PID:6584
- C:\Windows\System\GwXcfJe.exe
  C:\Windows\System\GwXcfJe.exe
  2⤵
  PID:6536
- C:\Windows\System\fvrbnCL.exe
  C:\Windows\System\fvrbnCL.exe
  2⤵
  PID:5372
- C:\Windows\System\OrNNZHs.exe
  C:\Windows\System\OrNNZHs.exe
  2⤵
  PID:6780
- C:\Windows\System\oKEWZmF.exe
  C:\Windows\System\oKEWZmF.exe
  2⤵
  PID:4316
- C:\Windows\System\oooByqh.exe
  C:\Windows\System\oooByqh.exe
  2⤵
  PID:3992
- C:\Windows\System\TKgLUAo.exe
  C:\Windows\System\TKgLUAo.exe
  2⤵
  PID:4188
- C:\Windows\System\acOiodM.exe
  C:\Windows\System\acOiodM.exe
  2⤵
  PID:2196
- C:\Windows\System\dIgYMIb.exe
  C:\Windows\System\dIgYMIb.exe
  2⤵
  PID:6484
- C:\Windows\System\LsjYIes.exe
  C:\Windows\System\LsjYIes.exe
  2⤵
  PID:6048
- C:\Windows\System\tuGrpQP.exe
  C:\Windows\System\tuGrpQP.exe
  2⤵
  PID:13460
- C:\Windows\System\mGbmXuT.exe
  C:\Windows\System\mGbmXuT.exe
  2⤵
  PID:6572
- C:\Windows\System\smdutfV.exe
  C:\Windows\System\smdutfV.exe
  2⤵
  PID:2028
- C:\Windows\System\DvJHgxr.exe
  C:\Windows\System\DvJHgxr.exe
  2⤵
  PID:1080
- C:\Windows\System\QcRooJZ.exe
  C:\Windows\System\QcRooJZ.exe
  2⤵
  PID:7848
- C:\Windows\System\dGgHvZa.exe
  C:\Windows\System\dGgHvZa.exe
  2⤵
  PID:7540
- C:\Windows\System\jKmxZfO.exe
  C:\Windows\System\jKmxZfO.exe
  2⤵
  PID:7348
- C:\Windows\System\QOnUpLo.exe
  C:\Windows\System\QOnUpLo.exe
  2⤵
  PID:6524
- C:\Windows\System\lZNRXYD.exe
  C:\Windows\System\lZNRXYD.exe
  2⤵
  PID:13544
- C:\Windows\System\INutFKC.exe
  C:\Windows\System\INutFKC.exe
  2⤵
  PID:6044
- C:\Windows\System\IHDmbpw.exe
  C:\Windows\System\IHDmbpw.exe
  2⤵
  PID:7260
- C:\Windows\System\kXXJyjG.exe
  C:\Windows\System\kXXJyjG.exe
  2⤵
  PID:14344
- C:\Windows\System\svFkfMn.exe
  C:\Windows\System\svFkfMn.exe
  2⤵
  PID:14360
- C:\Windows\System\PzeKOZK.exe
  C:\Windows\System\PzeKOZK.exe
  2⤵
  PID:14376
- C:\Windows\System\XtGGEye.exe
  C:\Windows\System\XtGGEye.exe
  2⤵
  PID:14392
- C:\Windows\System\MjqQILk.exe
  C:\Windows\System\MjqQILk.exe
  2⤵
  PID:14412
- C:\Windows\System\TnOJJCq.exe
  C:\Windows\System\TnOJJCq.exe
  2⤵
  PID:14440
- C:\Windows\System\cjZrWxP.exe
  C:\Windows\System\cjZrWxP.exe
  2⤵
  PID:14468
- C:\Windows\System\IDytfWt.exe
  C:\Windows\System\IDytfWt.exe
  2⤵
  PID:14540
- C:\Windows\System\bDnwoOG.exe
  C:\Windows\System\bDnwoOG.exe
  2⤵
  PID:14584
- C:\Windows\System\eqGFBBo.exe
  C:\Windows\System\eqGFBBo.exe
  2⤵
  PID:14652
- C:\Windows\System\uaTcXAW.exe
  C:\Windows\System\uaTcXAW.exe
  2⤵
  PID:14796
- C:\Windows\System\HEMzbPV.exe
  C:\Windows\System\HEMzbPV.exe
  2⤵
  PID:14812
- C:\Windows\System\MqPhhHf.exe
  C:\Windows\System\MqPhhHf.exe
  2⤵
  PID:14912
- C:\Windows\System\CIRHXEs.exe
  C:\Windows\System\CIRHXEs.exe
  2⤵
  PID:14932
- C:\Windows\System\oVsIPbG.exe
  C:\Windows\System\oVsIPbG.exe
  2⤵
  PID:14948
- C:\Windows\System\GVYGDfK.exe
  C:\Windows\System\GVYGDfK.exe
  2⤵
  PID:14984
- C:\Windows\System\eXSnXYK.exe
  C:\Windows\System\eXSnXYK.exe
  2⤵
  PID:15004
- C:\Windows\System\cwXKqFK.exe
  C:\Windows\System\cwXKqFK.exe
  2⤵
  PID:15024
- C:\Windows\System\dQJrQwf.exe
  C:\Windows\System\dQJrQwf.exe
  2⤵
  PID:15044
- C:\Windows\System\iKbiNEo.exe
  C:\Windows\System\iKbiNEo.exe
  2⤵
  PID:15064
- C:\Windows\System\hRAXiUO.exe
  C:\Windows\System\hRAXiUO.exe
  2⤵
  PID:15144
- C:\Windows\System\EdGkowY.exe
  C:\Windows\System\EdGkowY.exe
  2⤵
  PID:15204
- C:\Windows\System\oNazWFq.exe
  C:\Windows\System\oNazWFq.exe
  2⤵
  PID:14264
- C:\Windows\System\AKtEHlk.exe
  C:\Windows\System\AKtEHlk.exe
  2⤵
  PID:7892
- C:\Windows\System\pmNiXIi.exe
  C:\Windows\System\pmNiXIi.exe
  2⤵
  PID:7704
- C:\Windows\System\AwglcUX.exe
  C:\Windows\System\AwglcUX.exe
  2⤵
  PID:14400
- C:\Windows\System\XcMlmoD.exe
  C:\Windows\System\XcMlmoD.exe
  2⤵
  PID:14388
- C:\Windows\System\IEUFkXU.exe
  C:\Windows\System\IEUFkXU.exe
  2⤵
  PID:14628
- C:\Windows\System\rScRPBo.exe
  C:\Windows\System\rScRPBo.exe
  2⤵
  PID:8140
- C:\Windows\System\KRaPryk.exe
  C:\Windows\System\KRaPryk.exe
  2⤵
  PID:14688
- C:\Windows\System\XnFGgdr.exe
  C:\Windows\System\XnFGgdr.exe
  2⤵
  PID:14744
- C:\Windows\System\PuOxDgb.exe
  C:\Windows\System\PuOxDgb.exe
  2⤵
  PID:14768
- C:\Windows\System\cScSGJO.exe
  C:\Windows\System\cScSGJO.exe
  2⤵
  PID:8152
- C:\Windows\System\UQyoNzS.exe
  C:\Windows\System\UQyoNzS.exe
  2⤵
  PID:14692
- C:\Windows\System\trzjdFu.exe
  C:\Windows\System\trzjdFu.exe
  2⤵
  PID:14712
- C:\Windows\System\aqVkbDM.exe
  C:\Windows\System\aqVkbDM.exe
  2⤵
  PID:15168
- C:\Windows\System\AGOOUsU.exe
  C:\Windows\System\AGOOUsU.exe
  2⤵
  PID:15300
- C:\Windows\System\XoMFgzz.exe
  C:\Windows\System\XoMFgzz.exe
  2⤵
  PID:7544
- C:\Windows\System\rRDncyg.exe
  C:\Windows\System\rRDncyg.exe
  2⤵
  PID:1796
- C:\Windows\System\uHloUQx.exe
  C:\Windows\System\uHloUQx.exe
  2⤵
  PID:2820
- C:\Windows\System\xWRSCWj.exe
  C:\Windows\System\xWRSCWj.exe
  2⤵
  PID:9040
- C:\Windows\System\sHYrHJK.exe
  C:\Windows\System\sHYrHJK.exe
  2⤵
  PID:11756
- C:\Windows\System\svHLjrX.exe
  C:\Windows\System\svHLjrX.exe
  2⤵
  PID:7452
- C:\Windows\System\qIKQGlo.exe
  C:\Windows\System\qIKQGlo.exe
  2⤵
  PID:7556
- C:\Windows\System\kWnbVxR.exe
  C:\Windows\System\kWnbVxR.exe
  2⤵
  PID:8864
- C:\Windows\System\reeHVTN.exe
  C:\Windows\System\reeHVTN.exe
  2⤵
  PID:8900
- C:\Windows\System\cewmmZL.exe
  C:\Windows\System\cewmmZL.exe
  2⤵
  PID:7572
- C:\Windows\System\pVueuVZ.exe
  C:\Windows\System\pVueuVZ.exe
  2⤵
  PID:7756
- C:\Windows\System\lOxJJSD.exe
  C:\Windows\System\lOxJJSD.exe
  2⤵
  PID:8024
- C:\Windows\System\QbIydsu.exe
  C:\Windows\System\QbIydsu.exe
  2⤵
  PID:14432
- C:\Windows\System\xDwmXmb.exe
  C:\Windows\System\xDwmXmb.exe
  2⤵
  PID:14724
- C:\Windows\System\ErDHTUH.exe
  C:\Windows\System\ErDHTUH.exe
  2⤵
  PID:1516
- C:\Windows\System\RedRgrM.exe
  C:\Windows\System\RedRgrM.exe
  2⤵
  PID:10800
- C:\Windows\System\fUKnItY.exe
  C:\Windows\System\fUKnItY.exe
  2⤵
  PID:7440
- C:\Windows\System\XaHGhvL.exe
  C:\Windows\System\XaHGhvL.exe
  2⤵
  PID:14648
- C:\Windows\System\CXOSUVF.exe
  C:\Windows\System\CXOSUVF.exe
  2⤵
  PID:8304
- C:\Windows\System\iAMKeOW.exe
  C:\Windows\System\iAMKeOW.exe
  2⤵
  PID:8972
- C:\Windows\System\SlQYnQv.exe
  C:\Windows\System\SlQYnQv.exe
  2⤵
  PID:14832
- C:\Windows\System\iPUUKmQ.exe
  C:\Windows\System\iPUUKmQ.exe
  2⤵
  PID:14708
- C:\Windows\System\OLhmrqy.exe
  C:\Windows\System\OLhmrqy.exe
  2⤵
  PID:9000
- C:\Windows\System\LjYffWf.exe
  C:\Windows\System\LjYffWf.exe
  2⤵
  PID:15052
- C:\Windows\System\oagJAxC.exe
  C:\Windows\System\oagJAxC.exe
  2⤵
  PID:10804
- C:\Windows\System\QncIPEF.exe
  C:\Windows\System\QncIPEF.exe
  2⤵
  PID:14876
- C:\Windows\System\CwpfDtU.exe
  C:\Windows\System\CwpfDtU.exe
  2⤵
  PID:15224
- C:\Windows\System\NsxxaGA.exe
  C:\Windows\System\NsxxaGA.exe
  2⤵
  PID:15292
- C:\Windows\System\hUvZDSD.exe
  C:\Windows\System\hUvZDSD.exe
  2⤵
  PID:8824
- C:\Windows\System\LJLJOAI.exe
  C:\Windows\System\LJLJOAI.exe
  2⤵
  PID:10872
- C:\Windows\System\BuEdbBK.exe
  C:\Windows\System\BuEdbBK.exe
  2⤵
  PID:9396
- C:\Windows\System\IMuuoNv.exe
  C:\Windows\System\IMuuoNv.exe
  2⤵
  PID:15272
- C:\Windows\System\NFfcWdQ.exe
  C:\Windows\System\NFfcWdQ.exe
  2⤵
  PID:15320
- C:\Windows\System\OmSKxQB.exe
  C:\Windows\System\OmSKxQB.exe
  2⤵
  PID:10884
- C:\Windows\System\xXepcDB.exe
  C:\Windows\System\xXepcDB.exe
  2⤵
  PID:10944
- C:\Windows\System\cfUHWWZ.exe
  C:\Windows\System\cfUHWWZ.exe
  2⤵
  PID:9664
- C:\Windows\System\UbVJgCG.exe
  C:\Windows\System\UbVJgCG.exe
  2⤵
  PID:9612
- C:\Windows\System\lDrEUUS.exe
  C:\Windows\System\lDrEUUS.exe
  2⤵
  PID:10864
- C:\Windows\System\ecTposX.exe
  C:\Windows\System\ecTposX.exe
  2⤵
  PID:15268
- C:\Windows\System\YELpHFH.exe
  C:\Windows\System\YELpHFH.exe
  2⤵
  PID:9056
- C:\Windows\System\FpAlCrG.exe
  C:\Windows\System\FpAlCrG.exe
  2⤵
  PID:5416
- C:\Windows\System\SWbjHhb.exe
  C:\Windows\System\SWbjHhb.exe
  2⤵
  PID:15244
- C:\Windows\System\eHTWllc.exe
  C:\Windows\System\eHTWllc.exe
  2⤵
  PID:10524
- C:\Windows\System\iQAHjNS.exe
  C:\Windows\System\iQAHjNS.exe
  2⤵
  PID:10040
- C:\Windows\System\OpWZtyd.exe
  C:\Windows\System\OpWZtyd.exe
  2⤵
  PID:8748
- C:\Windows\System\pqnPyvF.exe
  C:\Windows\System\pqnPyvF.exe
  2⤵
  PID:8808
- C:\Windows\System\klTDIWK.exe
  C:\Windows\System\klTDIWK.exe
  2⤵
  PID:9724
- C:\Windows\System\AoXvGCS.exe
  C:\Windows\System\AoXvGCS.exe
  2⤵
  PID:8224
- C:\Windows\System\wslBUvw.exe
  C:\Windows\System\wslBUvw.exe
  2⤵
  PID:14496
- C:\Windows\System\woEBDgT.exe
  C:\Windows\System\woEBDgT.exe
  2⤵
  PID:9752
- C:\Windows\System\ENVziIR.exe
  C:\Windows\System\ENVziIR.exe
  2⤵
  PID:6776
- C:\Windows\System\ABofeMj.exe
  C:\Windows\System\ABofeMj.exe
  2⤵
  PID:10592
- C:\Windows\System\wvWyJmN.exe
  C:\Windows\System\wvWyJmN.exe
  2⤵
  PID:14956
- C:\Windows\System\yukbBhF.exe
  C:\Windows\System\yukbBhF.exe
  2⤵
  PID:14924
- C:\Windows\System\aQelYIE.exe
  C:\Windows\System\aQelYIE.exe
  2⤵
  PID:15136
- C:\Windows\System\RFqgqpk.exe
  C:\Windows\System\RFqgqpk.exe
  2⤵
  PID:10776
- C:\Windows\System\boVEWyz.exe
  C:\Windows\System\boVEWyz.exe
  2⤵
  PID:10740
- C:\Windows\System\XJPcUbK.exe
  C:\Windows\System\XJPcUbK.exe
  2⤵
  PID:14992
- C:\Windows\System\sQaiyJk.exe
  C:\Windows\System\sQaiyJk.exe
  2⤵
  PID:11292
- C:\Windows\System\PeDqpFn.exe
  C:\Windows\System\PeDqpFn.exe
  2⤵
  PID:7492
- C:\Windows\System\aWbDart.exe
  C:\Windows\System\aWbDart.exe
  2⤵
  PID:15232
- C:\Windows\System\bymHkBQ.exe
  C:\Windows\System\bymHkBQ.exe
  2⤵
  PID:7624
- C:\Windows\System\oHkJLkX.exe
  C:\Windows\System\oHkJLkX.exe
  2⤵
  PID:9372
- C:\Windows\System\cAhBrYv.exe
  C:\Windows\System\cAhBrYv.exe
  2⤵
  PID:10892
- C:\Windows\System\CIAfyBu.exe
  C:\Windows\System\CIAfyBu.exe
  2⤵
  PID:11824
- C:\Windows\System\beRBdJF.exe
  C:\Windows\System\beRBdJF.exe
  2⤵
  PID:8560
- C:\Windows\System\KCHurBI.exe
  C:\Windows\System\KCHurBI.exe
  2⤵
  PID:8680
- C:\Windows\System\mCIgAEo.exe
  C:\Windows\System\mCIgAEo.exe
  2⤵
  PID:10392
- C:\Windows\System\EVVhsBn.exe
  C:\Windows\System\EVVhsBn.exe
  2⤵
  PID:14464
- C:\Windows\System\ZBxkywZ.exe
  C:\Windows\System\ZBxkywZ.exe
  2⤵
  PID:14872
- C:\Windows\System\RBQBrNa.exe
  C:\Windows\System\RBQBrNa.exe
  2⤵
  PID:8908
- C:\Windows\System\naRlueG.exe
  C:\Windows\System\naRlueG.exe
  2⤵
  PID:10700
- C:\Windows\System\bTRMSLR.exe
  C:\Windows\System\bTRMSLR.exe
  2⤵
  PID:768
- C:\Windows\System\bGrkFBb.exe
  C:\Windows\System\bGrkFBb.exe
  2⤵
  PID:8208
- C:\Windows\System\wzzVbko.exe
  C:\Windows\System\wzzVbko.exe
  2⤵
  PID:14516
- C:\Windows\System\hvfkWBX.exe
  C:\Windows\System\hvfkWBX.exe
  2⤵
  PID:5512
- C:\Windows\System\WtAPuGW.exe
  C:\Windows\System\WtAPuGW.exe
  2⤵
  PID:6868
- C:\Windows\System\xYchkZZ.exe
  C:\Windows\System\xYchkZZ.exe
  2⤵
  PID:10848
- C:\Windows\System\iLCZFIH.exe
  C:\Windows\System\iLCZFIH.exe
  2⤵
  PID:11280
- C:\Windows\System\tNdyVwM.exe
  C:\Windows\System\tNdyVwM.exe
  2⤵
  PID:10448
- C:\Windows\System\PcQlAqN.exe
  C:\Windows\System\PcQlAqN.exe
  2⤵
  PID:14920
- C:\Windows\System\iXitXGA.exe
  C:\Windows\System\iXitXGA.exe
  2⤵
  PID:11528
- C:\Windows\System\jXDCPsh.exe
  C:\Windows\System\jXDCPsh.exe
  2⤵
  PID:7728
- C:\Windows\System\chsWNiK.exe
  C:\Windows\System\chsWNiK.exe
  2⤵
  PID:11712
- C:\Windows\System\MSRFRHK.exe
  C:\Windows\System\MSRFRHK.exe
  2⤵
  PID:11800
- C:\Windows\System\YMMBooD.exe
  C:\Windows\System\YMMBooD.exe
  2⤵
  PID:8832
- C:\Windows\System\PwCAwSD.exe
  C:\Windows\System\PwCAwSD.exe
  2⤵
  PID:8372
- C:\Windows\System\pvYeRzg.exe
  C:\Windows\System\pvYeRzg.exe
  2⤵
  PID:9472
- C:\Windows\System\ETPkxqz.exe
  C:\Windows\System\ETPkxqz.exe
  2⤵
  PID:11828
- C:\Windows\System\bQRTVBt.exe
  C:\Windows\System\bQRTVBt.exe
  2⤵
  PID:10716
- C:\Windows\System\xzsrGBE.exe
  C:\Windows\System\xzsrGBE.exe
  2⤵
  PID:12428
- C:\Windows\System\eqLUHor.exe
  C:\Windows\System\eqLUHor.exe
  2⤵
  PID:8196
- C:\Windows\System\OZFSOkz.exe
  C:\Windows\System\OZFSOkz.exe
  2⤵
  PID:9320
- C:\Windows\System\MPSgikg.exe
  C:\Windows\System\MPSgikg.exe
  2⤵
  PID:10888
- C:\Windows\System\ydpQcRU.exe
  C:\Windows\System\ydpQcRU.exe
  2⤵
  PID:3896
- C:\Windows\System\txGuBqS.exe
  C:\Windows\System\txGuBqS.exe
  2⤵
  PID:12688
- C:\Windows\System\fVKSAAM.exe
  C:\Windows\System\fVKSAAM.exe
  2⤵
  PID:11776
- C:\Windows\System\ZhcMKmg.exe
  C:\Windows\System\ZhcMKmg.exe
  2⤵
  PID:11860
- C:\Windows\System\pPYavqd.exe
  C:\Windows\System\pPYavqd.exe
  2⤵
  PID:12832
- C:\Windows\System\fjfkoJq.exe
  C:\Windows\System\fjfkoJq.exe
  2⤵
  PID:12652
- C:\Windows\System\SdJIfaJ.exe
  C:\Windows\System\SdJIfaJ.exe
  2⤵
  PID:10336
- C:\Windows\System\JRwLCft.exe
  C:\Windows\System\JRwLCft.exe
  2⤵
  PID:15372
- C:\Windows\System\qXiPrPs.exe
  C:\Windows\System\qXiPrPs.exe
  2⤵
  PID:15392
- C:\Windows\System\MDjVgJW.exe
  C:\Windows\System\MDjVgJW.exe
  2⤵
  PID:15480
- C:\Windows\System\WKwCpGd.exe
  C:\Windows\System\WKwCpGd.exe
  2⤵
  PID:15508
- C:\Windows\System\gEwEWTL.exe
  C:\Windows\System\gEwEWTL.exe
  2⤵
  PID:15536
- C:\Windows\System\BcPlIXS.exe
  C:\Windows\System\BcPlIXS.exe
  2⤵
  PID:15612
- C:\Windows\System\oACIEwB.exe
  C:\Windows\System\oACIEwB.exe
  2⤵
  PID:15632
- C:\Windows\System\tbIcwWZ.exe
  C:\Windows\System\tbIcwWZ.exe
  2⤵
  PID:15684
- C:\Windows\System\JocNgmI.exe
  C:\Windows\System\JocNgmI.exe
  2⤵
  PID:15708
- C:\Windows\System\PyHEhTQ.exe
  C:\Windows\System\PyHEhTQ.exe
  2⤵
  PID:15740
- C:\Windows\System\cQtgKmH.exe
  C:\Windows\System\cQtgKmH.exe
  2⤵
  PID:15816
- C:\Windows\System\jOxFDpo.exe
  C:\Windows\System\jOxFDpo.exe
  2⤵
  PID:15904
- C:\Windows\System\NQsSknj.exe
  C:\Windows\System\NQsSknj.exe
  2⤵
  PID:15972
- C:\Windows\System\ipKciGM.exe
  C:\Windows\System\ipKciGM.exe
  2⤵
  PID:16012
- C:\Windows\System\MBwzbaO.exe
  C:\Windows\System\MBwzbaO.exe
  2⤵
  PID:16104
- C:\Windows\System\IMpvxJg.exe
  C:\Windows\System\IMpvxJg.exe
  2⤵
  PID:16136
- C:\Windows\System\XGLuHae.exe
  C:\Windows\System\XGLuHae.exe
  2⤵
  PID:16152
- C:\Windows\System\EsVlpuP.exe
  C:\Windows\System\EsVlpuP.exe
  2⤵
  PID:16184
- C:\Windows\System\xzJBKGO.exe
  C:\Windows\System\xzJBKGO.exe
  2⤵
  PID:16204
- C:\Windows\System\KjROMUU.exe
  C:\Windows\System\KjROMUU.exe
  2⤵
  PID:16220
- C:\Windows\System\suJamdr.exe
  C:\Windows\System\suJamdr.exe
  2⤵
  PID:16236
- C:\Windows\System\dCYlCNQ.exe
  C:\Windows\System\dCYlCNQ.exe
  2⤵
  PID:16252
- C:\Windows\System\NvvuvJm.exe
  C:\Windows\System\NvvuvJm.exe
  2⤵
  PID:7132
- C:\Windows\System\ghWNgWl.exe
  C:\Windows\System\ghWNgWl.exe
  2⤵
  PID:15092
- C:\Windows\System\qguOfdz.exe
  C:\Windows\System\qguOfdz.exe
  2⤵
  PID:12664
- C:\Windows\System\VGXTpqZ.exe
  C:\Windows\System\VGXTpqZ.exe
  2⤵
  PID:9364
- C:\Windows\System\ndUqMIV.exe
  C:\Windows\System\ndUqMIV.exe
  2⤵
  PID:11924
- C:\Windows\System\XeQloSG.exe
  C:\Windows\System\XeQloSG.exe
  2⤵
  PID:15420
- C:\Windows\System\KrhgsYc.exe
  C:\Windows\System\KrhgsYc.exe
  2⤵
  PID:15476
- C:\Windows\System\uPiNSCW.exe
  C:\Windows\System\uPiNSCW.exe
  2⤵
  PID:15568
- C:\Windows\System\UZlFiee.exe
  C:\Windows\System\UZlFiee.exe
  2⤵
  PID:15516
- C:\Windows\System\VqIHgxD.exe
  C:\Windows\System\VqIHgxD.exe
  2⤵
  PID:15532
- C:\Windows\System\WMPrZvM.exe
  C:\Windows\System\WMPrZvM.exe
  2⤵
  PID:13456
- C:\Windows\System\dfEdlia.exe
  C:\Windows\System\dfEdlia.exe
  2⤵
  PID:13148
- C:\Windows\System\iCOMwEs.exe
  C:\Windows\System\iCOMwEs.exe
  2⤵
  PID:15672
- C:\Windows\System\YpfxCTD.exe
  C:\Windows\System\YpfxCTD.exe
  2⤵
  PID:15808
- C:\Windows\System\DGXUSbe.exe
  C:\Windows\System\DGXUSbe.exe
  2⤵
  PID:15748
- C:\Windows\System\fLPpwrf.exe
  C:\Windows\System\fLPpwrf.exe
  2⤵
  PID:15772
- C:\Windows\System\FeAuIRi.exe
  C:\Windows\System\FeAuIRi.exe
  2⤵
  PID:15848
- C:\Windows\System\erKKsBG.exe
  C:\Windows\System\erKKsBG.exe
  2⤵
  PID:15872
- C:\Windows\System\pQheRQm.exe
  C:\Windows\System\pQheRQm.exe
  2⤵
  PID:15896

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbv5xcfo.loe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFnkxxy.exe

Filesize
1.8MB

MD5
7f987029cc60305f8c5d4aaf581216cc

SHA1
bc704c60b3ef69cc1c2b5242011bb58f619a9e04

SHA256
d8c5b2bfe487a17fe948c141f3120fac689371c319d27c5c395be7377c94dfc8

SHA512
ad1d55d40a3bd4cc6c6a2f6faa096afb43f3ea43c4cd0e68b0eaff03bf2a2a7fe2f948a80cc10e2537f063aca90901f68a0d189e21ac4e909740eae6840bd861

Download Submit
C:\Windows\System\BUnuwOI.exe

Filesize
1.8MB

MD5
c08fa1fe582062cfdecde0bf31785fd8

SHA1
6b595e2b3a971cf31f2e230723f47d8864d1f866

SHA256
09fde957a5e07e9b8756f6c6b080a6d5713124fa25dec411aa3c9fdd99a95402

SHA512
bce601b0be374a148acc60364480bf1c62c9d9e604d096d9c6cf1e232e7859496adbc603ec1a4ad99e96bb3594a795cb3b0fb08623d5e5fed0e57c444902b383

Download Submit
C:\Windows\System\BhMklDo.exe

Filesize
1.8MB

MD5
6042bcdd29e18ca024ae590aae9c2323

SHA1
7524a95dda854c1cdd315a8558c25370e7c484b7

SHA256
1cd963e4493aafe980a42a4f93ddd2bd9d525239b267539ec4a2bacc8ed928a7

SHA512
cb837034d9bcd839639d3fc402d9d24008be7ecb9275fb9d33b014b3faee20d2ecf9fe937c44fafbc3170f308b04b9d5854484e9a6449fe80efc276887697e64

Download Submit
C:\Windows\System\CIxTBIu.exe

Filesize
1.8MB

MD5
28c1abe107ad338d04a65ece298a8c8f

SHA1
db215c544adc59fbccec7acca9cf163dec7e8d99

SHA256
e0ff2c3ea305e35baa04ca4e481f2205d1d4b63863331eb32155018544c3802b

SHA512
39ef132e58e84d8f2feb4f76aadb3a87a5c9e87476869af52aa993da7237090938c8e05f5d2347cff1ec1780f53e70df4a109e1f2dc0da8135152ac7679a456e

Download Submit
C:\Windows\System\EknnvSc.exe

Filesize
1.8MB

MD5
59d0a7d749649f9b5746e304def19980

SHA1
74f7796adfe1ca2ff3c0e1cf4ac5ef0156d46b0e

SHA256
51967977d74b6d67aedc5045d41d160735ed8257d47ba07843d994243df0cf38

SHA512
e60549bfc587528b753a0c1e58575866b0d183edab4d1607bb366c96287599b91ebb3d7c910a4c32bef88bfa5d08923c75b868f63d980d2784bae52a83f4b191

Download Submit
C:\Windows\System\GOZYAZj.exe

Filesize
1.8MB

MD5
3a9471e8dcc1b4d37a80704897af155b

SHA1
8a2d345155c57cd162f682538899499adb9f5388

SHA256
e1be7fe50fdf2168082a404446d1fbfb1bff974e6466aa6e1cd0862951f91d31

SHA512
043cae769f2e43b9f2b820ee4bd301eb88ddaaabe0f970e1776b34073b68ac9e7ee296c95f5287ddcc6f36920a132c0819060fb73373b1a3a4921999158f6ea5

Download Submit
C:\Windows\System\GQTLEva.exe

Filesize
1.8MB

MD5
d655dac167d49506f0931fcbd8e8cec9

SHA1
9261ed0af4d190576ca5c336b256809faf2504c2

SHA256
3fdf3e1232b744031905a018c3a205c4f2693d932d0256fcae459c5dfb6b5c23

SHA512
45d275fcfa759ad66a2540e475b108f40f0445dd5fe517f88597ec423fa33bae245359817e2e3743c69801c236612e6b70d691b378214b0dd28ebbffebc5e31c

Download Submit
C:\Windows\System\GlXWjdj.exe

Filesize
1.8MB

MD5
ca5669b3dc4a1ca794cf4dcc7ebb98f8

SHA1
28f28390297fa6528965c31241168e99fae5928b

SHA256
7ce3bd2334bb8f943512c6ddeb9c06f5c7bb5e44ec326c03b5def42bf338cb40

SHA512
f3a3e4e4e11e754117bff2f235b14812b66293df3aedc01a9d8bd4cd2f61a003646e225fce2b0f03c6a6a5327a3170a1ce8a0264d5a909256812a4ee2696f8f0

Download Submit
C:\Windows\System\JyADYqs.exe

Filesize
1.8MB

MD5
67f34d3cbc7a9eb09e37b8ef10ad9dc6

SHA1
ac59f11fbe1e7fb617b319b017aea6540430b9c8

SHA256
9db39a509b597b4ff0a10d04a24c54e9b1dcd14f68543ee0aa5d44de5ce9655d

SHA512
5a3351c81c53f12a633db458a6b8e06775b384786473756c4f6b91828ae7e7e70c0019b1f540d5e38eb3620e3829536d9983c41993ecbe4a263338076a3c3dbf

Download Submit
C:\Windows\System\KBuagPo.exe

Filesize
1.8MB

MD5
c58326846ac6508f4a3efaa40850b81c

SHA1
480fa48da1c0a3c0e1372b5d56e38b0e35c391d2

SHA256
edf1f1bbc9afe60d1aee01c07cc7557406cc071e74865cc99a7613644e401f20

SHA512
53bd15da78818d67acfd0e81482c21b3f9ac43901e92b64f448b27ac03a5a046135e85954d88ea6f9726de148d22376fac868d52f799c0c6b7125069293e0200

Download Submit
C:\Windows\System\MDdyKmV.exe

Filesize
1.8MB

MD5
66946acecd7a9e434c8974f970c31936

SHA1
4e9fbc2d25370fcaed20510fff6ccaa63c43fc79

SHA256
42865687d240d36edd73c07cf556ee56c7b0b504745c24cae57afd1259854827

SHA512
530ef4e0997760c03978863565a98c9851aa2fb08a83a85630648a8cc821a1050760833ff9beefd4448526c5614a6131a9f7cc45f320803fd03286686154a1e6

Download Submit
C:\Windows\System\PDLLgdc.exe

Filesize
1.8MB

MD5
704146335ec35e5e5e172e1adaa020c4

SHA1
539e1aef7a927cd83ee66809ef1f7dcd2f68afd9

SHA256
ba81c810334cd573228ce3b11b0feef40b91bca3a5bf5f7208d2ff55cda57385

SHA512
b969531e6ec477d167d27b1199dfbf2a97f7899557f9311460b747b90a2e59e71ebf10a5a50938ec92e0dfe73e527b5c5516670245c0de91d3f7297a035fc8c3

Download Submit
C:\Windows\System\PiTjPmj.exe

Filesize
1.8MB

MD5
db2dd35405b9c405ad466d4ef34bcbd3

SHA1
8495df683179be991581eff931a873a9a503391a

SHA256
8227a4a89c727fb2e0152aeeed32b2fabbe7a6d5ec0772d42ac3ef69b00f173c

SHA512
8f6870662d6764eba679911e5be5bd5a2972cd01c56d8658954d5a0bf9b15fd4a3b2562aab1c93276f51484ceb1a47267770e4a2337d28baa969835ec5ea2bb7

Download Submit
C:\Windows\System\PqgbHYn.exe

Filesize
1.8MB

MD5
ee03a60ae452f626a9ca3247cb0278c9

SHA1
e311f987e70e98935ad6b5aae0ebde0d3e4ea4b7

SHA256
3a8cca753a18881046ac8c2644f83f1e16f899a4687f2e7e12dd9befb825e53a

SHA512
b518b8e6578ff1f509b8665703487afb4df73fe0687555be09948255ea5021938b575312011a4c13634399623326998d3e0e058b33a133902d41accec25504cf

Download Submit
C:\Windows\System\UwtpFLs.exe

Filesize
1.8MB

MD5
93439a194639ce740d79d4f2096be8e1

SHA1
9ef46f04dbb0ea2ff98087f701a7aa988931ee0b

SHA256
f5a3530a994e340aaeb7b0344417eedc19dc756edd46205721c78816028f70e8

SHA512
6483afae3559b6a19688b64b9f592a75776e9ca97f94ed36d806c2d7a457d231253b985b976f7a2ad9df2b4d3f82d0dba564c906b95c0cfd03ac7b0ce61b605b

Download Submit
C:\Windows\System\WuauviV.exe

Filesize
1.8MB

MD5
bc56da4f254c8295e6a4eb1aea24c2d3

SHA1
65413f549f73b22d5dd925dcc17ac7f756e99755

SHA256
f826ebf1aa50c675510f6818b6b0d3e65f0e52cc9aa746bdcdc74f365642886a

SHA512
c7b944d0a8eab61f8d064a231745421d6484c6e29f951f57e41e7c6e8919d11c0d20b06c0a2ccee043cac9761090a5af6f3c824163c8137a5f5ee7cefcd20be2

Download Submit
C:\Windows\System\XaOeJuZ.exe

Filesize
1.8MB

MD5
6116a845e004b6d6fc15715a9dfa4649

SHA1
5641a591c021b370f0f71c3aa97007a82842085d

SHA256
92ad9e31bc10859e900a99c8dfc5c69da8e7063ee9e59842cb1b6d8b0aa4c1cc

SHA512
a1e8d0de33f6217b3e6b1ec3e8e202d30b961d7293e59a053d8a6a6c280ca8c9bb1a71ad5345b02e0b95df33ad9ebe8edeff9cc75cf88ce0d3f2e464a3d52033

Download Submit
C:\Windows\System\YnUicbq.exe

Filesize
1.8MB

MD5
b3b5a8833680d6d39a4b1a0ed7ab6549

SHA1
42e7b595f4c049406f62ad08c50335d8921c4fb4

SHA256
d9c43f8745380e3d6f247f23a4f528fe75ffe84e2b8144714d9068e68b381141

SHA512
706e46fca55a505413b00daba8ead286f9b65f4adeb990f6aa3619d16b2ac434340dc1f9d267d02b246374c4a19cda9e29c50100d411db2cf337db4004de10ce

Download Submit
C:\Windows\System\aaYcMWd.exe

Filesize
1.8MB

MD5
f99a40027848dbf34d518a6602fb61e1

SHA1
2d2a65686abe7b794757e32668ecd491cd8ed28c

SHA256
66b35d276271496a454f3057f72897936484440d384b77c4e13f8cd2eeec444b

SHA512
8c14ba63069bf3cc39887847bd31fab8f575cf671b9df8d89c2424b5ca65b1e0627808b752670e1f3309ea049debb9a4e28acc2f1adb0ff21c7d40d4235c1a00

Download Submit
C:\Windows\System\cmEWMNL.exe

Filesize
1.8MB

MD5
077b62a590e18e3287ace884fbcce4e3

SHA1
63e4857d5b15c9fd773a74b0988db96d4daa5792

SHA256
71188f02f9a4cb8ae7ca73a32aed3db729e42a87c53ad1a72e12394a323e6b26

SHA512
af7f086d85456f4d6ab14fb7626f9c62e194bab488df8d24c7ccc7e7d20ef5ef86a11527cfe1f73da77a7c8d971e1774f72834657cf8142a6a3c0b420f07a163

Download Submit
C:\Windows\System\csLPBeU.exe

Filesize
1.8MB

MD5
78f1c02ae3f7eda3016fc9bd896e30a0

SHA1
69c47c0aef5eeabff24d58d692f7832774b0acfe

SHA256
70742c406161517b68505912c5cb51ba715f246a5804c030d4bf407d071abd7d

SHA512
c4c5ed7d87ca430e56b59e978548c58bcbc08ae9f6511e9ee42da70de926abc1a30ed89858bf36519ca441809c1192a4f4d74de73d0ee57e94e124a833f8074d

Download Submit
C:\Windows\System\fCKouCe.exe

Filesize
1.8MB

MD5
586548e991ed2ca78f3572f87597b727

SHA1
0f29563c935ebdad0ea0c899496cc0437b47f17b

SHA256
59922c18c6dc86aca4856e33b1d63de7eb3594bfddb4612cdb1cff56e474d517

SHA512
8e46e329c25d79e37cbeaad207c10531701176df9566a26e98a23557ae7206de998fdabcf412e41ddbbcf303413ee13c69c0f3c9fb86f8b19b572d90bea589e1

Download Submit
C:\Windows\System\gddyMWI.exe

Filesize
1.8MB

MD5
2a65259834826fb99ac7dd1870587644

SHA1
35f29debc3f832b44aac1469bc125899ab5773bc

SHA256
fe5141a7762891ac9e9d13ae6b1ca2d3c810dc66720fb44e49fae13a51cec4de

SHA512
85d8cf5d85330cc3841da3c3825b0ab9d9fd7cfb227873d90d7db9ee103240bbe8105893727d132c14e43e2e7276dcc92ac25bdc73ea6e046b2b185f67d03d14

Download Submit
C:\Windows\System\hUVIrzH.exe

Filesize
1.8MB

MD5
93adaec712d147d8dfcdbc1b29448213

SHA1
2b6e8393264f553c91ad9454b26020fcdcace082

SHA256
c152136bd3f956bec8de73d7734820e1e3efb316fe07a4d46d820d8b17a391c4

SHA512
2e8978c3bd484d190506dc5e1365aee3b3e8d0d5bae292640df96d1df2972459dc657354d6ce63b6364851756523d957fac6cb6a4aeae39491573eae5976679e

Download Submit
C:\Windows\System\iaSscqR.exe

Filesize
1.8MB

MD5
9a7e007e32b70cff4412db38911f3d1c

SHA1
bcb0967c2b34114986f3688791a153b46db13c45

SHA256
0056f258630905307d5bbb3b9ee73a6471672ba7b317326da96fc7c4bc062933

SHA512
0a672b670331530047d2152ac49b0cb6213eb145ff04bd7523f78b77fb501ec7055db723769d2e7dc6f5d6a4a38dbec7d0f9e8460b175dbcd4a4feb81bbaeac8

Download Submit
C:\Windows\System\jAncRUl.exe

Filesize
1.8MB

MD5
7cfc5b54c6f0a33c75a50a5d6490a5f6

SHA1
e44488340310a378b8b95f9929f98e4760395d7d

SHA256
9b8d09f0e8dec86f237ed689b9113650bede8309b44630cae3d884c0d27bc139

SHA512
fe05b142f3ea38bea831e181d5f169685521640a7591b47bcaeb9f2e303f2b9cc841b509fe5ada9a6b070e2ef0b003098e3ee2f96de75bb1b23de8ce29150aa9

Download Submit
C:\Windows\System\mVaWsnt.exe

Filesize
1.8MB

MD5
94ece020e601a3d23a13b1e38bcc969f

SHA1
b266390c46283db0325312616c6756ca7124b554

SHA256
5def7868118e8982bf2727082980814070f81fe5885e2dfd8b30712d4f5d9123

SHA512
4b54f32f3de57fec8e670b9db5c7bef9a3cc9a92162789e125897824d61ca0df7797571fb28f4fc1dad60eef1674f7754abf18521a8709cbe4b598573354cc7b

Download Submit
C:\Windows\System\mtJOhoW.exe

Filesize
1.8MB

MD5
b4f4c9dc735550c808ce223595cb5b93

SHA1
205b5d3e583e320b6532309632feed1231bf6e08

SHA256
cae17ceaea38305863f1fcf92d06a6aaf98b8641aa5e9fbce511f141c2df2017

SHA512
8c9927c867c562c0b682cfbe2122ebf25375f0e3206db03319ce9f93ad88e692fa66d99037be14265c5e9bcdee7cef2240ca058b3020a5bc7b2a92038d9f3491

Download Submit
C:\Windows\System\oOUMPTW.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\oOoRflm.exe

Filesize
1.8MB

MD5
184e084ac76694a025bea53d52606081

SHA1
00d001bbfb8ee5ad0789dec5621197c30abfba0a

SHA256
75dcf3418a921901e765b94ae8206683005fed2a9650d722081a237975040c70

SHA512
dfe69859e30c2a87c2a64bfea89e8ec47e35031cd75c4a9abf7df47bcf36d6e362ad24bb5cbc33d6da93750c7b46fc153671fc931bf4bdb2f250e69b7f2b6338

Download Submit
C:\Windows\System\oqCPREN.exe

Filesize
1.8MB

MD5
b3f3ab577fe55c22e77135bb1fd9237d

SHA1
9c756e16a3623160e75c5830f72a48af8b727af7

SHA256
3915127c8ff4a0ecf57fff5f30df57c6d490e133579765c3bab7290f503b04e9

SHA512
df14107c612a797e6c455772e1af20e41b5f97b725af296775f54e671f638949be8c21391d2c8e7422860ece5b9a46723ed74bf211f029cb7543e71335d3a0a1

Download Submit
C:\Windows\System\rJWAYXo.exe

Filesize
1.8MB

MD5
517831693002c64d18366ef0f4220a02

SHA1
fbcae39465b37c147a4cb9cb8542b23f18e88887

SHA256
b201a34929ea60c9a04602b82488b1089ff2822fe1685d69d5b1f6fc274972e8

SHA512
03891ab00dd98b1beb8ee386d64d69f32ad2b092ce4d72a513b1a11d8cb0ff5299924c74b1696e690879b7a6a34fe5ac4f4731918f6bb5a7cffb3825aca63b72

Download Submit
C:\Windows\System\rxaDRSp.exe

Filesize
1.8MB

MD5
d82bc0ffdc6f3b3898388c21eab8cf19

SHA1
3d78decc494536ea7786220aa8219b54c4f32b66

SHA256
67794e4f1c0b35022b582d54ab78de43a7bbf765d30a2bc42a4fd7565976b89e

SHA512
cbc68c22aae8921673a913217b893debbfa7633b0b62c1ef8aa17895d121320ced525e6e8c449971de13c20b2c5b35f2202faace415a23bfff1d8622a234ff63

Download Submit
C:\Windows\System\tIcCRXs.exe

Filesize
1.8MB

MD5
32f9c4f24e516d73fcfb90ed7c643fee

SHA1
32a33a6c773078e1ebd758ea085c7c74600d3bb4

SHA256
a922ca19b3cc49c4dffafdc274ea4f8828c2f08026b32a7e25ba91452e4854da

SHA512
7f84ceb216461c1c2e0fa3451450834ffec9991920e394e82da057e71712e24048ffd8471a04b376cd8fb784ba4ca8f4189afa6e6e4fdd86d425d9132b227ebe

Download Submit
C:\Windows\System\uVZNZmK.exe

Filesize
1.8MB

MD5
d2e1151860a0a8283c85e2e3a316966c

SHA1
73878bbfba1ce92eb38e3e7eff5ea71e2df7dbe3

SHA256
5cae44e8ea75cad1bf3602bcd92723d6346177b0fec55410e404b9ca9916bbef

SHA512
baefa6b12eed589ce2fee389e15fe1d0a7d9bfae21d17e7ae9132fce179c2fe577d3437235653ecbdacd63f579dbcb2d9be7d250ba132cc128592b0bee1ec067

Download Submit
C:\Windows\System\uwYUkMd.exe

Filesize
1.8MB

MD5
5a4666d13c7e9439b12aafa7b670775f

SHA1
9a26a01666f357333585a445cc508e003fc3591a

SHA256
6aa2637d623261cdab84ee465cb4c9d60cb4dd5943968f59322a861a96a0b8bf

SHA512
74b62acbf294ff4136e3b43333acbf4b74c538d0d7378f483e365e8a6c98ca63848e36580139d5d9e59ddc3474c0289833c9e838281701d76899ef06a0e39fc3

Download Submit
C:\Windows\System\vONhDDd.exe

Filesize
1.8MB

MD5
4a2cc8e4bd4a08516b6b48651ca00110

SHA1
19a78e294c52d40b3487c409f6afd0805a7e9ae4

SHA256
a3e77bd6f768cd59cce34e5f53d15d5ef603540ba37763474cb3a0fc83fb6280

SHA512
b1747d65d11db9d6d4ebc624f4bffdb0bddad115738500439da5b01e6cfd9a52e6a057243dd5ac4dad1b1f6517c585446db9c7aa4d12953b8e8dd0dad00cc409

Download Submit
C:\Windows\System\wQknSrM.exe

Filesize
1.8MB

MD5
5f9b7bb23843188e5fde666b4714b562

SHA1
2ab82726988765dea3673a21fe3b5149f51a2251

SHA256
2c6ca54060843ef685d03a0f68358ede48f90f7c43464682050ddacc373ad7ad

SHA512
dd36fbbb6f60dba2b1d1f9591e5257ae6c1165be1c9508b1af54c11c0e41f837cb8f192ea9817651e1372488429d3295dd39e4300fd9977ac64a5cd03237a6e0

Download Submit
C:\Windows\System\wcMThiM.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\xLHHzpZ.exe

Filesize
1.8MB

MD5
53cacc79b20d31c8c8ea1f11a8657553

SHA1
27cf5b43eed96719ca82c195786ad8e0f9a22e0d

SHA256
8a2f7688ff6a23fdecaeb7598775a5011706c2cc7a1b837d82bccdc8385db61f

SHA512
a00c7a95d998634c58be20f6eccc5dbd8876d9ce3c779fa2135ca978103e99baa455ae728bba8939ed0976b9949270ca86818fd8eb965d7e6f78d547002bcf79

Download Submit
C:\Windows\System\xoHupmA.exe

Filesize
1.8MB

MD5
db0df5030076e5fb5ab837a0afec5b1b

SHA1
e211013cf25c298e706ff6bd44aed0f4b2f30afd

SHA256
0254ac040644dba5578717c8a559a642090a9c2a25aaec42929fe96bf6486817

SHA512
378fabc088e8f45ff461e1143f3f182ebbb2d2a0f532f0be8c04732890f120751046184050ca1b4d2db72d8241bb52cd6419067975dfd5ce7d8e9b108d090acb

Download Submit
C:\Windows\System\xsmtBfK.exe

Filesize
1.8MB

MD5
05d233753e16b192d41b8d33454eaef2

SHA1
cbe6711dce76f021fa99b5d77f274175a22b6abf

SHA256
9e7a09d8ca983edb47b0e1d5017f3c07bf3612697319e26b31404d5ef29e6b93

SHA512
c12233a59b481db782793cfc88820c7b80350a99999e43a9bfa1a2365c459610b1ddbd581a0fa012327f35db398d152546b69e0b723e0083b7e5f360c31c7ba8

Download Submit
C:\Windows\System\zkPjpva.exe

Filesize
1.8MB

MD5
f57e49c15c8e4e6ce34ea08db4b19d3a

SHA1
11592a179e334cbf43c8fd8c4255993bb26f4ea3

SHA256
e76f7c8f221b27849968b5538d4307791a2679dad9e3b56705e19f65f6a62d5e

SHA512
abc2acd49276a48e6d3bf96eff6ab52e0f543baf3e0d55359e3e9d10feeb6d0113e53b4ead4c3c7896854b09dffcb499b098ca46ac5d4475b7595dab99a50e18

Download Submit
memory/348-194-0x00007FF653860000-0x00007FF653C52000-memory.dmp

Filesize
3.9MB

Download
memory/396-5220-0x00007FF7A3DC0000-0x00007FF7A41B2000-memory.dmp

Filesize
3.9MB

Download
memory/396-526-0x00007FF7A3DC0000-0x00007FF7A41B2000-memory.dmp

Filesize
3.9MB

Download
memory/668-162-0x00007FF616E00000-0x00007FF6171F2000-memory.dmp

Filesize
3.9MB

Download
memory/936-11-0x00007FF7F2F20000-0x00007FF7F3312000-memory.dmp

Filesize
3.9MB

Download
memory/1076-5242-0x00007FF73ADD0000-0x00007FF73B1C2000-memory.dmp

Filesize
3.9MB

Download
memory/1076-531-0x00007FF73ADD0000-0x00007FF73B1C2000-memory.dmp

Filesize
3.9MB

Download
memory/1300-5158-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp

Filesize
3.9MB

Download
memory/1300-163-0x00007FF64AD40000-0x00007FF64B132000-memory.dmp

Filesize
3.9MB

Download
memory/1316-5219-0x00007FF6EB6E0000-0x00007FF6EBAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1316-515-0x00007FF6EB6E0000-0x00007FF6EBAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-529-0x00007FF6C0300000-0x00007FF6C06F2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-5235-0x00007FF6C0300000-0x00007FF6C06F2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-340-0x0000027A3FDF0000-0x0000027A3FE12000-memory.dmp

Filesize
136KB

Download
memory/1604-89-0x00007FFD0ACC0000-0x00007FFD0B781000-memory.dmp

Filesize
10.8MB

Download
memory/1604-232-0x0000027A3FB40000-0x0000027A3FB50000-memory.dmp

Filesize
64KB

Download
memory/1604-97-0x0000027A3FB40000-0x0000027A3FB50000-memory.dmp

Filesize
64KB

Download
memory/1660-530-0x00007FF64F760000-0x00007FF64FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1660-5240-0x00007FF64F760000-0x00007FF64FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2036-124-0x00007FF6812E0000-0x00007FF6816D2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-409-0x00007FF725650000-0x00007FF725A42000-memory.dmp

Filesize
3.9MB

Download
memory/2664-5230-0x00007FF6E5900000-0x00007FF6E5CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-528-0x00007FF6E5900000-0x00007FF6E5CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-533-0x00007FF7600C0000-0x00007FF7604B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5252-0x00007FF7600C0000-0x00007FF7604B2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-235-0x00007FF6A0B00000-0x00007FF6A0EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-1-0x0000015D06B90000-0x0000015D06BA0000-memory.dmp

Filesize
64KB

Download
memory/2868-0-0x00007FF66A170000-0x00007FF66A562000-memory.dmp

Filesize
3.9MB

Download
memory/3020-5233-0x00007FF645B30000-0x00007FF645F22000-memory.dmp

Filesize
3.9MB

Download
memory/3020-527-0x00007FF645B30000-0x00007FF645F22000-memory.dmp

Filesize
3.9MB

Download
memory/3120-5210-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp

Filesize
3.9MB

Download
memory/3120-358-0x00007FF6E23A0000-0x00007FF6E2792000-memory.dmp

Filesize
3.9MB

Download
memory/3420-532-0x00007FF6E8AB0000-0x00007FF6E8EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3420-5164-0x00007FF6E8AB0000-0x00007FF6E8EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-353-0x00007FF7F0B70000-0x00007FF7F0F62000-memory.dmp

Filesize
3.9MB

Download
memory/3648-5188-0x00007FF7F0B70000-0x00007FF7F0F62000-memory.dmp

Filesize
3.9MB

Download
memory/4016-5216-0x00007FF776F70000-0x00007FF777362000-memory.dmp

Filesize
3.9MB

Download
memory/4016-274-0x00007FF776F70000-0x00007FF777362000-memory.dmp

Filesize
3.9MB

Download
memory/4388-5255-0x00007FF720980000-0x00007FF720D72000-memory.dmp

Filesize
3.9MB

Download
memory/4388-476-0x00007FF720980000-0x00007FF720D72000-memory.dmp

Filesize
3.9MB

Download
memory/4920-5262-0x00007FF6B5230000-0x00007FF6B5622000-memory.dmp

Filesize
3.9MB

Download
memory/4920-308-0x00007FF6B5230000-0x00007FF6B5622000-memory.dmp

Filesize
3.9MB

Download