xmrig | 9ad7f921e8bf69936e626b7fb4ebf8914a3c2530f0b333cf9eca498416f8a450

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Size

1.9MB
MD5

066f43b9c7dbbe5118fee1d4178ded0b
SHA1

bc2d5ac21b70dd9251b9aecc642f9a6ca7c1114d
SHA256

9ad7f921e8bf69936e626b7fb4ebf8914a3c2530f0b333cf9eca498416f8a450
SHA512

1abcabfea10e592044fada34de670fb63a6be4aa2015790f3bc4ddc93f63c0ad21781bcb3aefa953d1a29f51b8a546751b30984480fbf73639d0343ce2d780f7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1E:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/5016-172-0x00007FF73E850000-0x00007FF73EC42000-memory.dmp	xmrig
behavioral2/memory/2612-206-0x00007FF6EA780000-0x00007FF6EAB72000-memory.dmp	xmrig
behavioral2/memory/4532-221-0x00007FF626020000-0x00007FF626412000-memory.dmp	xmrig
behavioral2/memory/3988-226-0x00007FF775A70000-0x00007FF775E62000-memory.dmp	xmrig
behavioral2/memory/1660-227-0x00007FF7DD530000-0x00007FF7DD922000-memory.dmp	xmrig
behavioral2/memory/5112-225-0x00007FF630F10000-0x00007FF631302000-memory.dmp	xmrig
behavioral2/memory/3532-223-0x00007FF67E0F0000-0x00007FF67E4E2000-memory.dmp	xmrig
behavioral2/memory/5096-219-0x00007FF71DDA0000-0x00007FF71E192000-memory.dmp	xmrig
behavioral2/memory/4680-228-0x00007FF7388F0000-0x00007FF738CE2000-memory.dmp	xmrig
behavioral2/memory/2748-231-0x00007FF713970000-0x00007FF713D62000-memory.dmp	xmrig
behavioral2/memory/2940-230-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	xmrig
behavioral2/memory/3228-232-0x00007FF7EDDA0000-0x00007FF7EE192000-memory.dmp	xmrig
behavioral2/memory/2120-229-0x00007FF756F90000-0x00007FF757382000-memory.dmp	xmrig
behavioral2/memory/3092-280-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	xmrig
behavioral2/memory/2944-754-0x00007FF74E0F0000-0x00007FF74E4E2000-memory.dmp	xmrig
behavioral2/memory/1280-613-0x00007FF78F7C0000-0x00007FF78FBB2000-memory.dmp	xmrig
behavioral2/memory/3580-315-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp	xmrig
behavioral2/memory/4976-312-0x00007FF60BE80000-0x00007FF60C272000-memory.dmp	xmrig
behavioral2/memory/4840-316-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp	xmrig
behavioral2/memory/4464-279-0x00007FF60C7D0000-0x00007FF60CBC2000-memory.dmp	xmrig
behavioral2/memory/4840-4709-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp	xmrig
behavioral2/memory/1280-4716-0x00007FF78F7C0000-0x00007FF78FBB2000-memory.dmp	xmrig
behavioral2/memory/5016-4748-0x00007FF73E850000-0x00007FF73EC42000-memory.dmp	xmrig
behavioral2/memory/3580-4752-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp	xmrig
behavioral2/memory/3532-4846-0x00007FF67E0F0000-0x00007FF67E4E2000-memory.dmp	xmrig
behavioral2/memory/5112-4854-0x00007FF630F10000-0x00007FF631302000-memory.dmp	xmrig
behavioral2/memory/5096-4894-0x00007FF71DDA0000-0x00007FF71E192000-memory.dmp	xmrig
behavioral2/memory/2120-4905-0x00007FF756F90000-0x00007FF757382000-memory.dmp	xmrig
behavioral2/memory/4532-4908-0x00007FF626020000-0x00007FF626412000-memory.dmp	xmrig
behavioral2/memory/2940-4918-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	xmrig
behavioral2/memory/4464-4926-0x00007FF60C7D0000-0x00007FF60CBC2000-memory.dmp	xmrig
behavioral2/memory/2748-4930-0x00007FF713970000-0x00007FF713D62000-memory.dmp	xmrig
behavioral2/memory/3228-4916-0x00007FF7EDDA0000-0x00007FF7EE192000-memory.dmp	xmrig
behavioral2/memory/3988-4913-0x00007FF775A70000-0x00007FF775E62000-memory.dmp	xmrig
behavioral2/memory/4680-4911-0x00007FF7388F0000-0x00007FF738CE2000-memory.dmp	xmrig
behavioral2/memory/2944-4823-0x00007FF74E0F0000-0x00007FF74E4E2000-memory.dmp	xmrig
behavioral2/memory/2612-4750-0x00007FF6EA780000-0x00007FF6EAB72000-memory.dmp	xmrig
behavioral2/memory/4696-4735-0x00007FF669710000-0x00007FF669B02000-memory.dmp	xmrig
behavioral2/memory/3092-5133-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4976	sItrRVd.exe
3580	SkYGeOY.exe
4840	wDApakD.exe
4696	ILLtpLN.exe
5016	zzkPpgf.exe
2612	CNoqOFR.exe
1280	nasNnbk.exe
2944	OJGcVTO.exe
5096	heWpGIK.exe
4532	ZXJjvqc.exe
3532	gwxjpJN.exe
5112	KnXzzxS.exe
3988	RzjMWTt.exe
1660	PGmEZCE.exe
4680	ZqwAKUe.exe
2120	dkcQsat.exe
2940	leMUEVL.exe
2748	JVbVbgW.exe
3228	NsgccdZ.exe
2336	VDgXNtd.exe
4464	khpxFRW.exe
2252	iOepiBh.exe
4880	zHsyify.exe
2984	WSIGjSl.exe
4736	JCEHQWB.exe
3164	wKoRIwW.exe
2196	pxyQHok.exe
3948	ekWSlbk.exe
3700	nZejols.exe
2600	eWnkbgw.exe
1016	lmTkejG.exe
3340	nphHChy.exe
1144	aRuhEcb.exe
3288	KNbydGF.exe
4364	VemKbGJ.exe
4892	vMGwPBu.exe
4572	wfesdga.exe
3248	cRTHUks.exe
4620	IhyXFxV.exe
1892	UqtyaeL.exe
3300	yaaBdoe.exe
2720	ELijScZ.exe
2588	Bbvjjhz.exe
652	GxYKuNK.exe
3132	xAMobPD.exe
4504	OjCPRBj.exe
3916	hhHELNb.exe
4728	TbuietR.exe
4324	IPcewbv.exe
1388	KlslJBy.exe
1036	fPllond.exe
4636	fcVMNMl.exe
864	nnGPgBd.exe
4332	OUrodci.exe
4472	OuksgXi.exe
376	vSWFCqD.exe
4628	PsnYfuC.exe
3624	mfhyMKp.exe
4052	TdABJaH.exe
4672	rppRCPa.exe
4808	qbBtUhU.exe
3176	PpbBEEG.exe
2456	AOBNZhQ.exe
4068	CBrVgVT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3092-0-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-27.dat	upx
behavioral2/files/0x000a000000023bc1-39.dat	upx
behavioral2/files/0x000a000000023bc8-56.dat	upx
behavioral2/files/0x000a000000023bcf-91.dat	upx
behavioral2/files/0x000a000000023bd1-93.dat	upx
behavioral2/files/0x000a000000023bd0-132.dat	upx
behavioral2/files/0x000a000000023bce-141.dat	upx
behavioral2/files/0x000a000000023bda-140.dat	upx
behavioral2/files/0x000a000000023bd9-139.dat	upx
behavioral2/files/0x000a000000023bd5-137.dat	upx
behavioral2/files/0x000a000000023bca-134.dat	upx
behavioral2/files/0x000a000000023bdd-174.dat	upx
behavioral2/files/0x000a000000023bd8-169.dat	upx
behavioral2/files/0x000a000000023bd7-122.dat	upx
behavioral2/files/0x000a000000023bd6-119.dat	upx
behavioral2/files/0x000a000000023bcd-110.dat	upx
behavioral2/files/0x000a000000023bcc-107.dat	upx
behavioral2/files/0x000a000000023bcb-102.dat	upx
behavioral2/files/0x000a000000023bd4-100.dat	upx
behavioral2/files/0x000a000000023bd2-96.dat	upx
behavioral2/files/0x000a000000023bc7-90.dat	upx
behavioral2/files/0x000a000000023bc6-84.dat	upx
behavioral2/files/0x000a000000023bd3-99.dat	upx
behavioral2/files/0x000a000000023bc9-81.dat	upx
behavioral2/memory/5016-172-0x00007FF73E850000-0x00007FF73EC42000-memory.dmp	upx
behavioral2/files/0x000a000000023bdc-164.dat	upx
behavioral2/files/0x000a000000023bdb-143.dat	upx
behavioral2/files/0x000a000000023bc2-43.dat	upx
behavioral2/files/0x000a000000023bc4-62.dat	upx
behavioral2/memory/4696-38-0x00007FF669710000-0x00007FF669B02000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-34.dat	upx
behavioral2/files/0x000a000000023bbf-47.dat	upx
behavioral2/memory/3580-28-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-21.dat	upx
behavioral2/files/0x0033000000023bb4-15.dat	upx
behavioral2/memory/4976-13-0x00007FF60BE80000-0x00007FF60C272000-memory.dmp	upx
behavioral2/files/0x000b000000023bde-175.dat	upx
behavioral2/files/0x000d000000023bbb-186.dat	upx
behavioral2/memory/2612-206-0x00007FF6EA780000-0x00007FF6EAB72000-memory.dmp	upx
behavioral2/files/0x000a000000023be8-183.dat	upx
behavioral2/files/0x0008000000023bf8-190.dat	upx
behavioral2/files/0x000e000000023bef-187.dat	upx
behavioral2/files/0x000b000000023bdf-178.dat	upx
behavioral2/memory/4532-221-0x00007FF626020000-0x00007FF626412000-memory.dmp	upx
behavioral2/memory/3988-226-0x00007FF775A70000-0x00007FF775E62000-memory.dmp	upx
behavioral2/memory/1660-227-0x00007FF7DD530000-0x00007FF7DD922000-memory.dmp	upx
behavioral2/memory/5112-225-0x00007FF630F10000-0x00007FF631302000-memory.dmp	upx
behavioral2/memory/3532-223-0x00007FF67E0F0000-0x00007FF67E4E2000-memory.dmp	upx
behavioral2/memory/5096-219-0x00007FF71DDA0000-0x00007FF71E192000-memory.dmp	upx
behavioral2/memory/4680-228-0x00007FF7388F0000-0x00007FF738CE2000-memory.dmp	upx
behavioral2/memory/2748-231-0x00007FF713970000-0x00007FF713D62000-memory.dmp	upx
behavioral2/memory/2940-230-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	upx
behavioral2/memory/3228-232-0x00007FF7EDDA0000-0x00007FF7EE192000-memory.dmp	upx
behavioral2/memory/2120-229-0x00007FF756F90000-0x00007FF757382000-memory.dmp	upx
behavioral2/memory/2336-233-0x00007FF7FA190000-0x00007FF7FA582000-memory.dmp	upx
behavioral2/memory/3092-280-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp	upx
behavioral2/memory/2944-754-0x00007FF74E0F0000-0x00007FF74E4E2000-memory.dmp	upx
behavioral2/memory/1280-613-0x00007FF78F7C0000-0x00007FF78FBB2000-memory.dmp	upx
behavioral2/memory/3580-315-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp	upx
behavioral2/memory/4976-312-0x00007FF60BE80000-0x00007FF60C272000-memory.dmp	upx
behavioral2/memory/4840-316-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp	upx
behavioral2/memory/4464-279-0x00007FF60C7D0000-0x00007FF60CBC2000-memory.dmp	upx
behavioral2/memory/4840-4709-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gNHsEYZ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\aCJZtIu.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kgUvWWB.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\UbPfdCu.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\pUdPIHn.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\GXQxLiO.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\xdBOWzy.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\TIPeBUT.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\mnpgmsR.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\HobzPYc.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\FyhmuGj.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\yDDdscJ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\vaFHnev.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\SIeZWAK.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\KBEZJam.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\tsloqnt.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\CNvHZpK.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\YbECMpz.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\gmDEjyq.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\EULZcoG.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\rGArdwJ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ovEoHNH.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\sLMGiye.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kPonAXC.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\YmbVZnu.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\EQIIdUM.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\LgwGaRo.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\HzUnapN.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\oAboiKc.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\wfRyQUA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\zxyNOhh.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kYdVWvn.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\XilJdwQ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\NtwdOEg.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\fiPcnuN.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\fOGYuHV.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\AaVIick.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\vmdfEVa.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\gsdGxXR.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\RgqcAef.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\SOrNGmR.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\wFuVnjn.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\EAvqsNl.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\KZEewzw.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\AhXnXXw.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\mJKXLXR.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\UTjeJyF.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\GfOWFDv.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\AmBASZm.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\uJCzMFe.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\mRzeZKu.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\egXfosC.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\UDcOQZC.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\lhmwNfY.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\rQmRRky.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\LyKcuLI.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\lUcFwDn.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\UfroZcd.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\HwcJuIJ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\CDigxMu.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\lWVULSt.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\eMseWKE.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\rKCaGKF.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\XLcqpGt.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeLockMemoryPrivilege	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	14264	dwm.exe
Token: SeChangeNotifyPrivilege	14264	dwm.exe
Token: 33	14264	dwm.exe
Token: SeIncBasePriorityPrivilege	14264	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4700	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	86
PID 3092 wrote to memory of 4700	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	86
PID 3092 wrote to memory of 4976	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	87
PID 3092 wrote to memory of 4976	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	87
PID 3092 wrote to memory of 3580	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	88
PID 3092 wrote to memory of 3580	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	88
PID 3092 wrote to memory of 4840	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	89
PID 3092 wrote to memory of 4840	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	89
PID 3092 wrote to memory of 4696	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	90
PID 3092 wrote to memory of 4696	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	90
PID 3092 wrote to memory of 5016	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	91
PID 3092 wrote to memory of 5016	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	91
PID 3092 wrote to memory of 2612	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	92
PID 3092 wrote to memory of 2612	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	92
PID 3092 wrote to memory of 2944	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	93
PID 3092 wrote to memory of 2944	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	93
PID 3092 wrote to memory of 1280	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	94
PID 3092 wrote to memory of 1280	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	94
PID 3092 wrote to memory of 5096	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	95
PID 3092 wrote to memory of 5096	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	95
PID 3092 wrote to memory of 4532	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	96
PID 3092 wrote to memory of 4532	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	96
PID 3092 wrote to memory of 3532	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	97
PID 3092 wrote to memory of 3532	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	97
PID 3092 wrote to memory of 5112	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	98
PID 3092 wrote to memory of 5112	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	98
PID 3092 wrote to memory of 3988	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	99
PID 3092 wrote to memory of 3988	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	99
PID 3092 wrote to memory of 1660	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	100
PID 3092 wrote to memory of 1660	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	100
PID 3092 wrote to memory of 4680	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	101
PID 3092 wrote to memory of 4680	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	101
PID 3092 wrote to memory of 2120	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	102
PID 3092 wrote to memory of 2120	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	102
PID 3092 wrote to memory of 2940	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	103
PID 3092 wrote to memory of 2940	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	103
PID 3092 wrote to memory of 2748	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	104
PID 3092 wrote to memory of 2748	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	104
PID 3092 wrote to memory of 3228	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	105
PID 3092 wrote to memory of 3228	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	105
PID 3092 wrote to memory of 2336	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	106
PID 3092 wrote to memory of 2336	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	106
PID 3092 wrote to memory of 4464	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	107
PID 3092 wrote to memory of 4464	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	107
PID 3092 wrote to memory of 2252	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	108
PID 3092 wrote to memory of 2252	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	108
PID 3092 wrote to memory of 4880	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	109
PID 3092 wrote to memory of 4880	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	109
PID 3092 wrote to memory of 2984	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	110
PID 3092 wrote to memory of 2984	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	110
PID 3092 wrote to memory of 4736	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	111
PID 3092 wrote to memory of 4736	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	111
PID 3092 wrote to memory of 3164	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	112
PID 3092 wrote to memory of 3164	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	112
PID 3092 wrote to memory of 1016	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	113
PID 3092 wrote to memory of 1016	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	113
PID 3092 wrote to memory of 2196	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	114
PID 3092 wrote to memory of 2196	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	114
PID 3092 wrote to memory of 3948	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	115
PID 3092 wrote to memory of 3948	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	115
PID 3092 wrote to memory of 3700	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	116
PID 3092 wrote to memory of 3700	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	116
PID 3092 wrote to memory of 2600	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	117
PID 3092 wrote to memory of 2600	3092	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System\sItrRVd.exe
  C:\Windows\System\sItrRVd.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\SkYGeOY.exe
  C:\Windows\System\SkYGeOY.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\wDApakD.exe
  C:\Windows\System\wDApakD.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ILLtpLN.exe
  C:\Windows\System\ILLtpLN.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\zzkPpgf.exe
  C:\Windows\System\zzkPpgf.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\CNoqOFR.exe
  C:\Windows\System\CNoqOFR.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\OJGcVTO.exe
  C:\Windows\System\OJGcVTO.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\nasNnbk.exe
  C:\Windows\System\nasNnbk.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\heWpGIK.exe
  C:\Windows\System\heWpGIK.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ZXJjvqc.exe
  C:\Windows\System\ZXJjvqc.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\gwxjpJN.exe
  C:\Windows\System\gwxjpJN.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\KnXzzxS.exe
  C:\Windows\System\KnXzzxS.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\RzjMWTt.exe
  C:\Windows\System\RzjMWTt.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\PGmEZCE.exe
  C:\Windows\System\PGmEZCE.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ZqwAKUe.exe
  C:\Windows\System\ZqwAKUe.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\dkcQsat.exe
  C:\Windows\System\dkcQsat.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\leMUEVL.exe
  C:\Windows\System\leMUEVL.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\JVbVbgW.exe
  C:\Windows\System\JVbVbgW.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NsgccdZ.exe
  C:\Windows\System\NsgccdZ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\VDgXNtd.exe
  C:\Windows\System\VDgXNtd.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\khpxFRW.exe
  C:\Windows\System\khpxFRW.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\iOepiBh.exe
  C:\Windows\System\iOepiBh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\zHsyify.exe
  C:\Windows\System\zHsyify.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\WSIGjSl.exe
  C:\Windows\System\WSIGjSl.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\JCEHQWB.exe
  C:\Windows\System\JCEHQWB.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\wKoRIwW.exe
  C:\Windows\System\wKoRIwW.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\lmTkejG.exe
  C:\Windows\System\lmTkejG.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\pxyQHok.exe
  C:\Windows\System\pxyQHok.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ekWSlbk.exe
  C:\Windows\System\ekWSlbk.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\nZejols.exe
  C:\Windows\System\nZejols.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\eWnkbgw.exe
  C:\Windows\System\eWnkbgw.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\nphHChy.exe
  C:\Windows\System\nphHChy.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\aRuhEcb.exe
  C:\Windows\System\aRuhEcb.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\KNbydGF.exe
  C:\Windows\System\KNbydGF.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\xAMobPD.exe
  C:\Windows\System\xAMobPD.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\VemKbGJ.exe
  C:\Windows\System\VemKbGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\vMGwPBu.exe
  C:\Windows\System\vMGwPBu.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\wfesdga.exe
  C:\Windows\System\wfesdga.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\cRTHUks.exe
  C:\Windows\System\cRTHUks.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\IhyXFxV.exe
  C:\Windows\System\IhyXFxV.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\UqtyaeL.exe
  C:\Windows\System\UqtyaeL.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\yaaBdoe.exe
  C:\Windows\System\yaaBdoe.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\ELijScZ.exe
  C:\Windows\System\ELijScZ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\Bbvjjhz.exe
  C:\Windows\System\Bbvjjhz.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GxYKuNK.exe
  C:\Windows\System\GxYKuNK.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\OjCPRBj.exe
  C:\Windows\System\OjCPRBj.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\TdABJaH.exe
  C:\Windows\System\TdABJaH.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\hhHELNb.exe
  C:\Windows\System\hhHELNb.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\TbuietR.exe
  C:\Windows\System\TbuietR.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\IPcewbv.exe
  C:\Windows\System\IPcewbv.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\KlslJBy.exe
  C:\Windows\System\KlslJBy.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\fPllond.exe
  C:\Windows\System\fPllond.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\fcVMNMl.exe
  C:\Windows\System\fcVMNMl.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\nnGPgBd.exe
  C:\Windows\System\nnGPgBd.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\OUrodci.exe
  C:\Windows\System\OUrodci.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\OuksgXi.exe
  C:\Windows\System\OuksgXi.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\vSWFCqD.exe
  C:\Windows\System\vSWFCqD.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\PsnYfuC.exe
  C:\Windows\System\PsnYfuC.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\mfhyMKp.exe
  C:\Windows\System\mfhyMKp.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\rppRCPa.exe
  C:\Windows\System\rppRCPa.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\qbBtUhU.exe
  C:\Windows\System\qbBtUhU.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\PpbBEEG.exe
  C:\Windows\System\PpbBEEG.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\AOBNZhQ.exe
  C:\Windows\System\AOBNZhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\CBrVgVT.exe
  C:\Windows\System\CBrVgVT.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\ZHKELnw.exe
  C:\Windows\System\ZHKELnw.exe
  2⤵
  PID:1716
- C:\Windows\System\VucEGmr.exe
  C:\Windows\System\VucEGmr.exe
  2⤵
  PID:5044
- C:\Windows\System\LiatuOY.exe
  C:\Windows\System\LiatuOY.exe
  2⤵
  PID:1304
- C:\Windows\System\DqFgkGw.exe
  C:\Windows\System\DqFgkGw.exe
  2⤵
  PID:2016
- C:\Windows\System\eQIKSWR.exe
  C:\Windows\System\eQIKSWR.exe
  2⤵
  PID:4388
- C:\Windows\System\btoMkvJ.exe
  C:\Windows\System\btoMkvJ.exe
  2⤵
  PID:1052
- C:\Windows\System\ywDMmYe.exe
  C:\Windows\System\ywDMmYe.exe
  2⤵
  PID:3584
- C:\Windows\System\eSMZEtF.exe
  C:\Windows\System\eSMZEtF.exe
  2⤵
  PID:664
- C:\Windows\System\vvASMeO.exe
  C:\Windows\System\vvASMeO.exe
  2⤵
  PID:4568
- C:\Windows\System\cgmNyQZ.exe
  C:\Windows\System\cgmNyQZ.exe
  2⤵
  PID:448
- C:\Windows\System\SdgxobB.exe
  C:\Windows\System\SdgxobB.exe
  2⤵
  PID:4256
- C:\Windows\System\xtlHuhV.exe
  C:\Windows\System\xtlHuhV.exe
  2⤵
  PID:4028
- C:\Windows\System\SDKDhzr.exe
  C:\Windows\System\SDKDhzr.exe
  2⤵
  PID:4684
- C:\Windows\System\saBRpWx.exe
  C:\Windows\System\saBRpWx.exe
  2⤵
  PID:3252
- C:\Windows\System\szqOhHF.exe
  C:\Windows\System\szqOhHF.exe
  2⤵
  PID:4540
- C:\Windows\System\xQKTiRL.exe
  C:\Windows\System\xQKTiRL.exe
  2⤵
  PID:2328
- C:\Windows\System\QPODeMe.exe
  C:\Windows\System\QPODeMe.exe
  2⤵
  PID:2892
- C:\Windows\System\RIeKheO.exe
  C:\Windows\System\RIeKheO.exe
  2⤵
  PID:3596
- C:\Windows\System\CLneyge.exe
  C:\Windows\System\CLneyge.exe
  2⤵
  PID:3748
- C:\Windows\System\AhdGMzd.exe
  C:\Windows\System\AhdGMzd.exe
  2⤵
  PID:2924
- C:\Windows\System\aePWddg.exe
  C:\Windows\System\aePWddg.exe
  2⤵
  PID:5068
- C:\Windows\System\ATzFccZ.exe
  C:\Windows\System\ATzFccZ.exe
  2⤵
  PID:4404
- C:\Windows\System\fbnJgLZ.exe
  C:\Windows\System\fbnJgLZ.exe
  2⤵
  PID:4584
- C:\Windows\System\CAuIzmg.exe
  C:\Windows\System\CAuIzmg.exe
  2⤵
  PID:5188
- C:\Windows\System\ytvvrCy.exe
  C:\Windows\System\ytvvrCy.exe
  2⤵
  PID:5212
- C:\Windows\System\MJmTTtl.exe
  C:\Windows\System\MJmTTtl.exe
  2⤵
  PID:5232
- C:\Windows\System\QKqOxEs.exe
  C:\Windows\System\QKqOxEs.exe
  2⤵
  PID:5256
- C:\Windows\System\XxNwcHb.exe
  C:\Windows\System\XxNwcHb.exe
  2⤵
  PID:5284
- C:\Windows\System\IWlkIaA.exe
  C:\Windows\System\IWlkIaA.exe
  2⤵
  PID:5324
- C:\Windows\System\jMLAXnJ.exe
  C:\Windows\System\jMLAXnJ.exe
  2⤵
  PID:5348
- C:\Windows\System\HNOwKdW.exe
  C:\Windows\System\HNOwKdW.exe
  2⤵
  PID:5364
- C:\Windows\System\YlGErVA.exe
  C:\Windows\System\YlGErVA.exe
  2⤵
  PID:5384
- C:\Windows\System\KJXtBPb.exe
  C:\Windows\System\KJXtBPb.exe
  2⤵
  PID:5404
- C:\Windows\System\czvvcgh.exe
  C:\Windows\System\czvvcgh.exe
  2⤵
  PID:5464
- C:\Windows\System\PNiYTHS.exe
  C:\Windows\System\PNiYTHS.exe
  2⤵
  PID:5480
- C:\Windows\System\WKjTKeI.exe
  C:\Windows\System\WKjTKeI.exe
  2⤵
  PID:5504
- C:\Windows\System\nTckPQT.exe
  C:\Windows\System\nTckPQT.exe
  2⤵
  PID:5524
- C:\Windows\System\LvJtiOa.exe
  C:\Windows\System\LvJtiOa.exe
  2⤵
  PID:5540
- C:\Windows\System\xitsyRV.exe
  C:\Windows\System\xitsyRV.exe
  2⤵
  PID:5564
- C:\Windows\System\GKyyPdY.exe
  C:\Windows\System\GKyyPdY.exe
  2⤵
  PID:5580
- C:\Windows\System\XRsQaTp.exe
  C:\Windows\System\XRsQaTp.exe
  2⤵
  PID:5604
- C:\Windows\System\LfRYGvm.exe
  C:\Windows\System\LfRYGvm.exe
  2⤵
  PID:5620
- C:\Windows\System\wXjzwCU.exe
  C:\Windows\System\wXjzwCU.exe
  2⤵
  PID:5644
- C:\Windows\System\FHCccdM.exe
  C:\Windows\System\FHCccdM.exe
  2⤵
  PID:5664
- C:\Windows\System\KWfVOUZ.exe
  C:\Windows\System\KWfVOUZ.exe
  2⤵
  PID:5684
- C:\Windows\System\viGJHsx.exe
  C:\Windows\System\viGJHsx.exe
  2⤵
  PID:5708
- C:\Windows\System\AwKifvG.exe
  C:\Windows\System\AwKifvG.exe
  2⤵
  PID:5724
- C:\Windows\System\HETFkUr.exe
  C:\Windows\System\HETFkUr.exe
  2⤵
  PID:5748
- C:\Windows\System\xEAsMKL.exe
  C:\Windows\System\xEAsMKL.exe
  2⤵
  PID:5768
- C:\Windows\System\LjbOfEQ.exe
  C:\Windows\System\LjbOfEQ.exe
  2⤵
  PID:5796
- C:\Windows\System\zJjGfWg.exe
  C:\Windows\System\zJjGfWg.exe
  2⤵
  PID:5816
- C:\Windows\System\YBpLSXZ.exe
  C:\Windows\System\YBpLSXZ.exe
  2⤵
  PID:5836
- C:\Windows\System\aQJCUoK.exe
  C:\Windows\System\aQJCUoK.exe
  2⤵
  PID:5856
- C:\Windows\System\plNfGpQ.exe
  C:\Windows\System\plNfGpQ.exe
  2⤵
  PID:5876
- C:\Windows\System\mfjAdkw.exe
  C:\Windows\System\mfjAdkw.exe
  2⤵
  PID:5892
- C:\Windows\System\NlfKJOW.exe
  C:\Windows\System\NlfKJOW.exe
  2⤵
  PID:5920
- C:\Windows\System\JMbGfWa.exe
  C:\Windows\System\JMbGfWa.exe
  2⤵
  PID:5936
- C:\Windows\System\VSmzsUZ.exe
  C:\Windows\System\VSmzsUZ.exe
  2⤵
  PID:5952
- C:\Windows\System\QaCpGbS.exe
  C:\Windows\System\QaCpGbS.exe
  2⤵
  PID:5968
- C:\Windows\System\tHOhcps.exe
  C:\Windows\System\tHOhcps.exe
  2⤵
  PID:5984
- C:\Windows\System\XeYDTSN.exe
  C:\Windows\System\XeYDTSN.exe
  2⤵
  PID:6000
- C:\Windows\System\rJJysOt.exe
  C:\Windows\System\rJJysOt.exe
  2⤵
  PID:6016
- C:\Windows\System\MxrIQTK.exe
  C:\Windows\System\MxrIQTK.exe
  2⤵
  PID:6056
- C:\Windows\System\IYNoTSw.exe
  C:\Windows\System\IYNoTSw.exe
  2⤵
  PID:6084
- C:\Windows\System\zveHXvc.exe
  C:\Windows\System\zveHXvc.exe
  2⤵
  PID:6108
- C:\Windows\System\rVwRuLg.exe
  C:\Windows\System\rVwRuLg.exe
  2⤵
  PID:6136
- C:\Windows\System\EgYdLBU.exe
  C:\Windows\System\EgYdLBU.exe
  2⤵
  PID:2072
- C:\Windows\System\quVQbnS.exe
  C:\Windows\System\quVQbnS.exe
  2⤵
  PID:436
- C:\Windows\System\XqlIVVo.exe
  C:\Windows\System\XqlIVVo.exe
  2⤵
  PID:1408
- C:\Windows\System\UVSDAKV.exe
  C:\Windows\System\UVSDAKV.exe
  2⤵
  PID:3512
- C:\Windows\System\LTyNZIy.exe
  C:\Windows\System\LTyNZIy.exe
  2⤵
  PID:540
- C:\Windows\System\glfgaQo.exe
  C:\Windows\System\glfgaQo.exe
  2⤵
  PID:4836
- C:\Windows\System\SgIUMNH.exe
  C:\Windows\System\SgIUMNH.exe
  2⤵
  PID:4832
- C:\Windows\System\OvcKFrV.exe
  C:\Windows\System\OvcKFrV.exe
  2⤵
  PID:4420
- C:\Windows\System\UMviclS.exe
  C:\Windows\System\UMviclS.exe
  2⤵
  PID:1080
- C:\Windows\System\JQppYEZ.exe
  C:\Windows\System\JQppYEZ.exe
  2⤵
  PID:2104
- C:\Windows\System\qyiZeZM.exe
  C:\Windows\System\qyiZeZM.exe
  2⤵
  PID:2004
- C:\Windows\System\lbKIdEl.exe
  C:\Windows\System\lbKIdEl.exe
  2⤵
  PID:2412
- C:\Windows\System\MmfiadQ.exe
  C:\Windows\System\MmfiadQ.exe
  2⤵
  PID:5220
- C:\Windows\System\VxsmlZm.exe
  C:\Windows\System\VxsmlZm.exe
  2⤵
  PID:1464
- C:\Windows\System\xsHwYiV.exe
  C:\Windows\System\xsHwYiV.exe
  2⤵
  PID:5372
- C:\Windows\System\wtpmpRo.exe
  C:\Windows\System\wtpmpRo.exe
  2⤵
  PID:5160
- C:\Windows\System\uZWCwTZ.exe
  C:\Windows\System\uZWCwTZ.exe
  2⤵
  PID:1984
- C:\Windows\System\fcszdpR.exe
  C:\Windows\System\fcszdpR.exe
  2⤵
  PID:4556
- C:\Windows\System\PtNZmVY.exe
  C:\Windows\System\PtNZmVY.exe
  2⤵
  PID:5556
- C:\Windows\System\ElFDphs.exe
  C:\Windows\System\ElFDphs.exe
  2⤵
  PID:5588
- C:\Windows\System\zxXGCud.exe
  C:\Windows\System\zxXGCud.exe
  2⤵
  PID:5616
- C:\Windows\System\NgtCkbF.exe
  C:\Windows\System\NgtCkbF.exe
  2⤵
  PID:5652
- C:\Windows\System\ohxVmln.exe
  C:\Windows\System\ohxVmln.exe
  2⤵
  PID:5716
- C:\Windows\System\MrfArbz.exe
  C:\Windows\System\MrfArbz.exe
  2⤵
  PID:5268
- C:\Windows\System\fbpbWVE.exe
  C:\Windows\System\fbpbWVE.exe
  2⤵
  PID:5244
- C:\Windows\System\OWLhkwL.exe
  C:\Windows\System\OWLhkwL.exe
  2⤵
  PID:5296
- C:\Windows\System\oWACzBe.exe
  C:\Windows\System\oWACzBe.exe
  2⤵
  PID:5144
- C:\Windows\System\UvdWIwe.exe
  C:\Windows\System\UvdWIwe.exe
  2⤵
  PID:5412
- C:\Windows\System\hdwCZZg.exe
  C:\Windows\System\hdwCZZg.exe
  2⤵
  PID:5976
- C:\Windows\System\zzOAMfo.exe
  C:\Windows\System\zzOAMfo.exe
  2⤵
  PID:5996
- C:\Windows\System\iaSCqEf.exe
  C:\Windows\System\iaSCqEf.exe
  2⤵
  PID:6104
- C:\Windows\System\mwXItsv.exe
  C:\Windows\System\mwXItsv.exe
  2⤵
  PID:3008
- C:\Windows\System\IhhcthO.exe
  C:\Windows\System\IhhcthO.exe
  2⤵
  PID:3828
- C:\Windows\System\zGHmgZP.exe
  C:\Windows\System\zGHmgZP.exe
  2⤵
  PID:5012
- C:\Windows\System\uZSwkvZ.exe
  C:\Windows\System\uZSwkvZ.exe
  2⤵
  PID:5312
- C:\Windows\System\nMCHKLb.exe
  C:\Windows\System\nMCHKLb.exe
  2⤵
  PID:6160
- C:\Windows\System\irxrzgX.exe
  C:\Windows\System\irxrzgX.exe
  2⤵
  PID:6184
- C:\Windows\System\UShBqqk.exe
  C:\Windows\System\UShBqqk.exe
  2⤵
  PID:6200
- C:\Windows\System\mppHgmg.exe
  C:\Windows\System\mppHgmg.exe
  2⤵
  PID:6220
- C:\Windows\System\TZRLget.exe
  C:\Windows\System\TZRLget.exe
  2⤵
  PID:6248
- C:\Windows\System\adQSSxs.exe
  C:\Windows\System\adQSSxs.exe
  2⤵
  PID:6268
- C:\Windows\System\RorfMrC.exe
  C:\Windows\System\RorfMrC.exe
  2⤵
  PID:6284
- C:\Windows\System\JjbkPTr.exe
  C:\Windows\System\JjbkPTr.exe
  2⤵
  PID:6312
- C:\Windows\System\RhshAOA.exe
  C:\Windows\System\RhshAOA.exe
  2⤵
  PID:6332
- C:\Windows\System\TKOtIGV.exe
  C:\Windows\System\TKOtIGV.exe
  2⤵
  PID:6352
- C:\Windows\System\cVUSZBq.exe
  C:\Windows\System\cVUSZBq.exe
  2⤵
  PID:6372
- C:\Windows\System\gWLoFNK.exe
  C:\Windows\System\gWLoFNK.exe
  2⤵
  PID:6388
- C:\Windows\System\KOCyTFv.exe
  C:\Windows\System\KOCyTFv.exe
  2⤵
  PID:6412
- C:\Windows\System\TIyKWXw.exe
  C:\Windows\System\TIyKWXw.exe
  2⤵
  PID:6432
- C:\Windows\System\utHTXxl.exe
  C:\Windows\System\utHTXxl.exe
  2⤵
  PID:6448
- C:\Windows\System\VPRYfkR.exe
  C:\Windows\System\VPRYfkR.exe
  2⤵
  PID:6464
- C:\Windows\System\LfrgnQw.exe
  C:\Windows\System\LfrgnQw.exe
  2⤵
  PID:6484
- C:\Windows\System\znIufyK.exe
  C:\Windows\System\znIufyK.exe
  2⤵
  PID:6504
- C:\Windows\System\UjZIXRs.exe
  C:\Windows\System\UjZIXRs.exe
  2⤵
  PID:6524
- C:\Windows\System\gqVVHzp.exe
  C:\Windows\System\gqVVHzp.exe
  2⤵
  PID:6544
- C:\Windows\System\ygBuyWp.exe
  C:\Windows\System\ygBuyWp.exe
  2⤵
  PID:6560
- C:\Windows\System\UrDZVxJ.exe
  C:\Windows\System\UrDZVxJ.exe
  2⤵
  PID:6580
- C:\Windows\System\lmQHiFh.exe
  C:\Windows\System\lmQHiFh.exe
  2⤵
  PID:6596
- C:\Windows\System\TwXsEMR.exe
  C:\Windows\System\TwXsEMR.exe
  2⤵
  PID:6612
- C:\Windows\System\drstTWX.exe
  C:\Windows\System\drstTWX.exe
  2⤵
  PID:6632
- C:\Windows\System\MNwxqXc.exe
  C:\Windows\System\MNwxqXc.exe
  2⤵
  PID:6652
- C:\Windows\System\JiXSrfT.exe
  C:\Windows\System\JiXSrfT.exe
  2⤵
  PID:6672
- C:\Windows\System\KsRTbuA.exe
  C:\Windows\System\KsRTbuA.exe
  2⤵
  PID:6696
- C:\Windows\System\IcsNTtb.exe
  C:\Windows\System\IcsNTtb.exe
  2⤵
  PID:6712
- C:\Windows\System\RtLEBpB.exe
  C:\Windows\System\RtLEBpB.exe
  2⤵
  PID:6728
- C:\Windows\System\iWQKJbd.exe
  C:\Windows\System\iWQKJbd.exe
  2⤵
  PID:6756
- C:\Windows\System\TEtVFVq.exe
  C:\Windows\System\TEtVFVq.exe
  2⤵
  PID:6772
- C:\Windows\System\bWidsxO.exe
  C:\Windows\System\bWidsxO.exe
  2⤵
  PID:6796
- C:\Windows\System\WvbdgTm.exe
  C:\Windows\System\WvbdgTm.exe
  2⤵
  PID:6820
- C:\Windows\System\mKHzdfS.exe
  C:\Windows\System\mKHzdfS.exe
  2⤵
  PID:6836
- C:\Windows\System\SqCdMoY.exe
  C:\Windows\System\SqCdMoY.exe
  2⤵
  PID:6860
- C:\Windows\System\cFNTqii.exe
  C:\Windows\System\cFNTqii.exe
  2⤵
  PID:6884
- C:\Windows\System\oeCjxQe.exe
  C:\Windows\System\oeCjxQe.exe
  2⤵
  PID:6900
- C:\Windows\System\BLbkKRI.exe
  C:\Windows\System\BLbkKRI.exe
  2⤵
  PID:6924
- C:\Windows\System\FouEnXy.exe
  C:\Windows\System\FouEnXy.exe
  2⤵
  PID:6948
- C:\Windows\System\owRcghm.exe
  C:\Windows\System\owRcghm.exe
  2⤵
  PID:6964
- C:\Windows\System\NlOTrxz.exe
  C:\Windows\System\NlOTrxz.exe
  2⤵
  PID:6992
- C:\Windows\System\IeeRNeg.exe
  C:\Windows\System\IeeRNeg.exe
  2⤵
  PID:7012
- C:\Windows\System\yuRDcnM.exe
  C:\Windows\System\yuRDcnM.exe
  2⤵
  PID:7032
- C:\Windows\System\tpMhaVB.exe
  C:\Windows\System\tpMhaVB.exe
  2⤵
  PID:7056
- C:\Windows\System\duWXcrK.exe
  C:\Windows\System\duWXcrK.exe
  2⤵
  PID:7072
- C:\Windows\System\EDxpShV.exe
  C:\Windows\System\EDxpShV.exe
  2⤵
  PID:7096
- C:\Windows\System\XzEdQCv.exe
  C:\Windows\System\XzEdQCv.exe
  2⤵
  PID:7120
- C:\Windows\System\ZPaneNf.exe
  C:\Windows\System\ZPaneNf.exe
  2⤵
  PID:7144
- C:\Windows\System\xTKZeAB.exe
  C:\Windows\System\xTKZeAB.exe
  2⤵
  PID:7164
- C:\Windows\System\fnoQPRk.exe
  C:\Windows\System\fnoQPRk.exe
  2⤵
  PID:5908
- C:\Windows\System\UhMpwmM.exe
  C:\Windows\System\UhMpwmM.exe
  2⤵
  PID:5928
- C:\Windows\System\fMFFERL.exe
  C:\Windows\System\fMFFERL.exe
  2⤵
  PID:5376
- C:\Windows\System\pkYpbbX.exe
  C:\Windows\System\pkYpbbX.exe
  2⤵
  PID:5164
- C:\Windows\System\ufmwMsD.exe
  C:\Windows\System\ufmwMsD.exe
  2⤵
  PID:6040
- C:\Windows\System\ABPHIRe.exe
  C:\Windows\System\ABPHIRe.exe
  2⤵
  PID:5488
- C:\Windows\System\SSmdNHW.exe
  C:\Windows\System\SSmdNHW.exe
  2⤵
  PID:5660
- C:\Windows\System\hhLOSLL.exe
  C:\Windows\System\hhLOSLL.exe
  2⤵
  PID:5456
- C:\Windows\System\mgCJvMW.exe
  C:\Windows\System\mgCJvMW.exe
  2⤵
  PID:6120
- C:\Windows\System\wjPFFBb.exe
  C:\Windows\System\wjPFFBb.exe
  2⤵
  PID:5964
- C:\Windows\System\yMPVnnf.exe
  C:\Windows\System\yMPVnnf.exe
  2⤵
  PID:5784
- C:\Windows\System\tbjXIGV.exe
  C:\Windows\System\tbjXIGV.exe
  2⤵
  PID:3476
- C:\Windows\System\KSxvhmC.exe
  C:\Windows\System\KSxvhmC.exe
  2⤵
  PID:6148
- C:\Windows\System\oiRvGzq.exe
  C:\Windows\System\oiRvGzq.exe
  2⤵
  PID:6232
- C:\Windows\System\sZBjmzD.exe
  C:\Windows\System\sZBjmzD.exe
  2⤵
  PID:6324
- C:\Windows\System\hmDzbCh.exe
  C:\Windows\System\hmDzbCh.exe
  2⤵
  PID:7172
- C:\Windows\System\dZdEWkr.exe
  C:\Windows\System\dZdEWkr.exe
  2⤵
  PID:7200
- C:\Windows\System\fpokSMo.exe
  C:\Windows\System\fpokSMo.exe
  2⤵
  PID:7220
- C:\Windows\System\ljAqLJt.exe
  C:\Windows\System\ljAqLJt.exe
  2⤵
  PID:7236
- C:\Windows\System\cmFBSIP.exe
  C:\Windows\System\cmFBSIP.exe
  2⤵
  PID:7256
- C:\Windows\System\ypeDDrE.exe
  C:\Windows\System\ypeDDrE.exe
  2⤵
  PID:7272
- C:\Windows\System\EhTKBrK.exe
  C:\Windows\System\EhTKBrK.exe
  2⤵
  PID:7296
- C:\Windows\System\ZlUiNWj.exe
  C:\Windows\System\ZlUiNWj.exe
  2⤵
  PID:7312
- C:\Windows\System\SyMpwod.exe
  C:\Windows\System\SyMpwod.exe
  2⤵
  PID:7336
- C:\Windows\System\RUQaISv.exe
  C:\Windows\System\RUQaISv.exe
  2⤵
  PID:7360
- C:\Windows\System\EYphhTx.exe
  C:\Windows\System\EYphhTx.exe
  2⤵
  PID:7380
- C:\Windows\System\rLOtUPF.exe
  C:\Windows\System\rLOtUPF.exe
  2⤵
  PID:7400
- C:\Windows\System\qyaPqFK.exe
  C:\Windows\System\qyaPqFK.exe
  2⤵
  PID:7420
- C:\Windows\System\dMnQLTd.exe
  C:\Windows\System\dMnQLTd.exe
  2⤵
  PID:7436
- C:\Windows\System\WxRhDNK.exe
  C:\Windows\System\WxRhDNK.exe
  2⤵
  PID:7460
- C:\Windows\System\zxSqDxH.exe
  C:\Windows\System\zxSqDxH.exe
  2⤵
  PID:7488
- C:\Windows\System\BXoqdzs.exe
  C:\Windows\System\BXoqdzs.exe
  2⤵
  PID:7504
- C:\Windows\System\qvomONM.exe
  C:\Windows\System\qvomONM.exe
  2⤵
  PID:7520
- C:\Windows\System\YgidvII.exe
  C:\Windows\System\YgidvII.exe
  2⤵
  PID:7544
- C:\Windows\System\PkpVqtp.exe
  C:\Windows\System\PkpVqtp.exe
  2⤵
  PID:7564
- C:\Windows\System\AKkjJUa.exe
  C:\Windows\System\AKkjJUa.exe
  2⤵
  PID:7588
- C:\Windows\System\JCtnywL.exe
  C:\Windows\System\JCtnywL.exe
  2⤵
  PID:7616
- C:\Windows\System\HZbphaa.exe
  C:\Windows\System\HZbphaa.exe
  2⤵
  PID:7640
- C:\Windows\System\XtWCpJy.exe
  C:\Windows\System\XtWCpJy.exe
  2⤵
  PID:7668
- C:\Windows\System\OCjoTTL.exe
  C:\Windows\System\OCjoTTL.exe
  2⤵
  PID:7684
- C:\Windows\System\KGmYcJU.exe
  C:\Windows\System\KGmYcJU.exe
  2⤵
  PID:7712
- C:\Windows\System\XaZFKsc.exe
  C:\Windows\System\XaZFKsc.exe
  2⤵
  PID:7732
- C:\Windows\System\oJcmmjU.exe
  C:\Windows\System\oJcmmjU.exe
  2⤵
  PID:6588
- C:\Windows\System\YltDVhV.exe
  C:\Windows\System\YltDVhV.exe
  2⤵
  PID:6608
- C:\Windows\System\sXBdeyY.exe
  C:\Windows\System\sXBdeyY.exe
  2⤵
  PID:6780
- C:\Windows\System\DcBiZth.exe
  C:\Windows\System\DcBiZth.exe
  2⤵
  PID:5400
- C:\Windows\System\bscgryS.exe
  C:\Windows\System\bscgryS.exe
  2⤵
  PID:6852
- C:\Windows\System\dzqKhVe.exe
  C:\Windows\System\dzqKhVe.exe
  2⤵
  PID:7000
- C:\Windows\System\SyTJyPG.exe
  C:\Windows\System\SyTJyPG.exe
  2⤵
  PID:6012
- C:\Windows\System\fBSasxW.exe
  C:\Windows\System\fBSasxW.exe
  2⤵
  PID:7068
- C:\Windows\System\UGXcwmC.exe
  C:\Windows\System\UGXcwmC.exe
  2⤵
  PID:7116
- C:\Windows\System\HWtoUQX.exe
  C:\Windows\System\HWtoUQX.exe
  2⤵
  PID:1524
- C:\Windows\System\LvrduFU.exe
  C:\Windows\System\LvrduFU.exe
  2⤵
  PID:6276
- C:\Windows\System\jUDaihr.exe
  C:\Windows\System\jUDaihr.exe
  2⤵
  PID:6072
- C:\Windows\System\seLSqYb.exe
  C:\Windows\System\seLSqYb.exe
  2⤵
  PID:6308
- C:\Windows\System\rBkqfkq.exe
  C:\Windows\System\rBkqfkq.exe
  2⤵
  PID:6404
- C:\Windows\System\uRRbXXP.exe
  C:\Windows\System\uRRbXXP.exe
  2⤵
  PID:6572
- C:\Windows\System\FpSbUmv.exe
  C:\Windows\System\FpSbUmv.exe
  2⤵
  PID:5308
- C:\Windows\System\acgpjRk.exe
  C:\Windows\System\acgpjRk.exe
  2⤵
  PID:7772
- C:\Windows\System\cNlakzB.exe
  C:\Windows\System\cNlakzB.exe
  2⤵
  PID:7804
- C:\Windows\System\yPcxJTl.exe
  C:\Windows\System\yPcxJTl.exe
  2⤵
  PID:7828
- C:\Windows\System\bMOIDPH.exe
  C:\Windows\System\bMOIDPH.exe
  2⤵
  PID:7844
- C:\Windows\System\IKEwhYf.exe
  C:\Windows\System\IKEwhYf.exe
  2⤵
  PID:7896
- C:\Windows\System\TtCZpAp.exe
  C:\Windows\System\TtCZpAp.exe
  2⤵
  PID:7920
- C:\Windows\System\UAidzXx.exe
  C:\Windows\System\UAidzXx.exe
  2⤵
  PID:4916
- C:\Windows\System\oSOmFOl.exe
  C:\Windows\System\oSOmFOl.exe
  2⤵
  PID:6216
- C:\Windows\System\NfytSwl.exe
  C:\Windows\System\NfytSwl.exe
  2⤵
  PID:6036
- C:\Windows\System\THzxmyb.exe
  C:\Windows\System\THzxmyb.exe
  2⤵
  PID:8064
- C:\Windows\System\TtwQmLm.exe
  C:\Windows\System\TtwQmLm.exe
  2⤵
  PID:4508
- C:\Windows\System\znqciSs.exe
  C:\Windows\System\znqciSs.exe
  2⤵
  PID:8204
- C:\Windows\System\FCQmRyT.exe
  C:\Windows\System\FCQmRyT.exe
  2⤵
  PID:8232
- C:\Windows\System\ZWxzPAh.exe
  C:\Windows\System\ZWxzPAh.exe
  2⤵
  PID:8272
- C:\Windows\System\kgLpqPi.exe
  C:\Windows\System\kgLpqPi.exe
  2⤵
  PID:8292
- C:\Windows\System\PcuKYQH.exe
  C:\Windows\System\PcuKYQH.exe
  2⤵
  PID:8320
- C:\Windows\System\CewFGEJ.exe
  C:\Windows\System\CewFGEJ.exe
  2⤵
  PID:8344
- C:\Windows\System\gfiaoBu.exe
  C:\Windows\System\gfiaoBu.exe
  2⤵
  PID:8364
- C:\Windows\System\WksJqrx.exe
  C:\Windows\System\WksJqrx.exe
  2⤵
  PID:8384
- C:\Windows\System\RRnmODt.exe
  C:\Windows\System\RRnmODt.exe
  2⤵
  PID:8412
- C:\Windows\System\HPapElA.exe
  C:\Windows\System\HPapElA.exe
  2⤵
  PID:8432
- C:\Windows\System\hwnNyXj.exe
  C:\Windows\System\hwnNyXj.exe
  2⤵
  PID:8452
- C:\Windows\System\Vatujuv.exe
  C:\Windows\System\Vatujuv.exe
  2⤵
  PID:8476
- C:\Windows\System\pyhXesn.exe
  C:\Windows\System\pyhXesn.exe
  2⤵
  PID:8500
- C:\Windows\System\PuEMYVQ.exe
  C:\Windows\System\PuEMYVQ.exe
  2⤵
  PID:8528
- C:\Windows\System\lyKQrIk.exe
  C:\Windows\System\lyKQrIk.exe
  2⤵
  PID:8544
- C:\Windows\System\ZfTcBPx.exe
  C:\Windows\System\ZfTcBPx.exe
  2⤵
  PID:8648
- C:\Windows\System\qfIYRog.exe
  C:\Windows\System\qfIYRog.exe
  2⤵
  PID:8664
- C:\Windows\System\lRyEAVK.exe
  C:\Windows\System\lRyEAVK.exe
  2⤵
  PID:8688
- C:\Windows\System\TSZmIAA.exe
  C:\Windows\System\TSZmIAA.exe
  2⤵
  PID:8720
- C:\Windows\System\dLtSIrV.exe
  C:\Windows\System\dLtSIrV.exe
  2⤵
  PID:8744
- C:\Windows\System\JXNERrE.exe
  C:\Windows\System\JXNERrE.exe
  2⤵
  PID:8768
- C:\Windows\System\IThITCd.exe
  C:\Windows\System\IThITCd.exe
  2⤵
  PID:8788
- C:\Windows\System\QulKHMD.exe
  C:\Windows\System\QulKHMD.exe
  2⤵
  PID:8824
- C:\Windows\System\BNeOKGV.exe
  C:\Windows\System\BNeOKGV.exe
  2⤵
  PID:8848
- C:\Windows\System\zFiytfd.exe
  C:\Windows\System\zFiytfd.exe
  2⤵
  PID:8888
- C:\Windows\System\INYmKNP.exe
  C:\Windows\System\INYmKNP.exe
  2⤵
  PID:8904
- C:\Windows\System\sEezWWa.exe
  C:\Windows\System\sEezWWa.exe
  2⤵
  PID:8920
- C:\Windows\System\zqjTWtC.exe
  C:\Windows\System\zqjTWtC.exe
  2⤵
  PID:8940
- C:\Windows\System\dUlLpTf.exe
  C:\Windows\System\dUlLpTf.exe
  2⤵
  PID:8960
- C:\Windows\System\myhHrEG.exe
  C:\Windows\System\myhHrEG.exe
  2⤵
  PID:8988
- C:\Windows\System\KFWCmHZ.exe
  C:\Windows\System\KFWCmHZ.exe
  2⤵
  PID:9012
- C:\Windows\System\HigEyCJ.exe
  C:\Windows\System\HigEyCJ.exe
  2⤵
  PID:9028
- C:\Windows\System\hUKWQZV.exe
  C:\Windows\System\hUKWQZV.exe
  2⤵
  PID:9048
- C:\Windows\System\zLGEbet.exe
  C:\Windows\System\zLGEbet.exe
  2⤵
  PID:9076
- C:\Windows\System\SXjoTpt.exe
  C:\Windows\System\SXjoTpt.exe
  2⤵
  PID:9100
- C:\Windows\System\ddZuaYz.exe
  C:\Windows\System\ddZuaYz.exe
  2⤵
  PID:9116
- C:\Windows\System\kADJwMo.exe
  C:\Windows\System\kADJwMo.exe
  2⤵
  PID:9140
- C:\Windows\System\kwdiJSz.exe
  C:\Windows\System\kwdiJSz.exe
  2⤵
  PID:9156
- C:\Windows\System\neseRGj.exe
  C:\Windows\System\neseRGj.exe
  2⤵
  PID:9180
- C:\Windows\System\esjGKUv.exe
  C:\Windows\System\esjGKUv.exe
  2⤵
  PID:9196
- C:\Windows\System\NieDfGr.exe
  C:\Windows\System\NieDfGr.exe
  2⤵
  PID:5576
- C:\Windows\System\AaoQBtz.exe
  C:\Windows\System\AaoQBtz.exe
  2⤵
  PID:7304
- C:\Windows\System\hcHoyBm.exe
  C:\Windows\System\hcHoyBm.exe
  2⤵
  PID:6532
- C:\Windows\System\KVGHwwT.exe
  C:\Windows\System\KVGHwwT.exe
  2⤵
  PID:7392
- C:\Windows\System\RNNKaFb.exe
  C:\Windows\System\RNNKaFb.exe
  2⤵
  PID:7388
- C:\Windows\System\PdVMbTk.exe
  C:\Windows\System\PdVMbTk.exe
  2⤵
  PID:6684
- C:\Windows\System\qhVwvMD.exe
  C:\Windows\System\qhVwvMD.exe
  2⤵
  PID:6736
- C:\Windows\System\ePpwmcg.exe
  C:\Windows\System\ePpwmcg.exe
  2⤵
  PID:6752
- C:\Windows\System\wjPvyZe.exe
  C:\Windows\System\wjPvyZe.exe
  2⤵
  PID:6984
- C:\Windows\System\VFydDDA.exe
  C:\Windows\System\VFydDDA.exe
  2⤵
  PID:6844
- C:\Windows\System\iJfCeGa.exe
  C:\Windows\System\iJfCeGa.exe
  2⤵
  PID:7924
- C:\Windows\System\UCsAtZp.exe
  C:\Windows\System\UCsAtZp.exe
  2⤵
  PID:7944
- C:\Windows\System\BMNZTIa.exe
  C:\Windows\System\BMNZTIa.exe
  2⤵
  PID:5424
- C:\Windows\System\iBPoSao.exe
  C:\Windows\System\iBPoSao.exe
  2⤵
  PID:5356
- C:\Windows\System\BiBWWUv.exe
  C:\Windows\System\BiBWWUv.exe
  2⤵
  PID:7228
- C:\Windows\System\FYhrkAh.exe
  C:\Windows\System\FYhrkAh.exe
  2⤵
  PID:5992
- C:\Windows\System\dPxfrxp.exe
  C:\Windows\System\dPxfrxp.exe
  2⤵
  PID:7816
- C:\Windows\System\fNJzcBf.exe
  C:\Windows\System\fNJzcBf.exe
  2⤵
  PID:8228
- C:\Windows\System\jYJTIGS.exe
  C:\Windows\System\jYJTIGS.exe
  2⤵
  PID:8152
- C:\Windows\System\tJhGodo.exe
  C:\Windows\System\tJhGodo.exe
  2⤵
  PID:8380
- C:\Windows\System\mAqJtcC.exe
  C:\Windows\System\mAqJtcC.exe
  2⤵
  PID:8448
- C:\Windows\System\iRkBxoG.exe
  C:\Windows\System\iRkBxoG.exe
  2⤵
  PID:8496
- C:\Windows\System\HRzJadl.exe
  C:\Windows\System\HRzJadl.exe
  2⤵
  PID:9232
- C:\Windows\System\JUUSjYW.exe
  C:\Windows\System\JUUSjYW.exe
  2⤵
  PID:9252
- C:\Windows\System\hTGwpvx.exe
  C:\Windows\System\hTGwpvx.exe
  2⤵
  PID:9280
- C:\Windows\System\tLJVgyA.exe
  C:\Windows\System\tLJVgyA.exe
  2⤵
  PID:9296
- C:\Windows\System\bodGfjb.exe
  C:\Windows\System\bodGfjb.exe
  2⤵
  PID:9320
- C:\Windows\System\hursXuI.exe
  C:\Windows\System\hursXuI.exe
  2⤵
  PID:9352
- C:\Windows\System\nPkkNpT.exe
  C:\Windows\System\nPkkNpT.exe
  2⤵
  PID:9380
- C:\Windows\System\FjMZqpF.exe
  C:\Windows\System\FjMZqpF.exe
  2⤵
  PID:9400
- C:\Windows\System\SGckhct.exe
  C:\Windows\System\SGckhct.exe
  2⤵
  PID:9432
- C:\Windows\System\odGphNA.exe
  C:\Windows\System\odGphNA.exe
  2⤵
  PID:9464
- C:\Windows\System\ljyZOFt.exe
  C:\Windows\System\ljyZOFt.exe
  2⤵
  PID:9492
- C:\Windows\System\aeOAmSw.exe
  C:\Windows\System\aeOAmSw.exe
  2⤵
  PID:9512
- C:\Windows\System\SIOcRGK.exe
  C:\Windows\System\SIOcRGK.exe
  2⤵
  PID:9536
- C:\Windows\System\EOoktRi.exe
  C:\Windows\System\EOoktRi.exe
  2⤵
  PID:9564
- C:\Windows\System\IcBLiTi.exe
  C:\Windows\System\IcBLiTi.exe
  2⤵
  PID:9584
- C:\Windows\System\IpIexql.exe
  C:\Windows\System\IpIexql.exe
  2⤵
  PID:9612
- C:\Windows\System\ZMgmdkL.exe
  C:\Windows\System\ZMgmdkL.exe
  2⤵
  PID:9632
- C:\Windows\System\oaCEyYT.exe
  C:\Windows\System\oaCEyYT.exe
  2⤵
  PID:9648
- C:\Windows\System\SPsFNmY.exe
  C:\Windows\System\SPsFNmY.exe
  2⤵
  PID:9668
- C:\Windows\System\nWSgLmB.exe
  C:\Windows\System\nWSgLmB.exe
  2⤵
  PID:9684
- C:\Windows\System\hfXmyHo.exe
  C:\Windows\System\hfXmyHo.exe
  2⤵
  PID:9712
- C:\Windows\System\cEtqlhS.exe
  C:\Windows\System\cEtqlhS.exe
  2⤵
  PID:9736
- C:\Windows\System\sTThnfz.exe
  C:\Windows\System\sTThnfz.exe
  2⤵
  PID:9752
- C:\Windows\System\jGdvCde.exe
  C:\Windows\System\jGdvCde.exe
  2⤵
  PID:9776
- C:\Windows\System\xNJGtbd.exe
  C:\Windows\System\xNJGtbd.exe
  2⤵
  PID:9800
- C:\Windows\System\reGToxx.exe
  C:\Windows\System\reGToxx.exe
  2⤵
  PID:9820
- C:\Windows\System\bzXTQVb.exe
  C:\Windows\System\bzXTQVb.exe
  2⤵
  PID:9844
- C:\Windows\System\VcAkYYD.exe
  C:\Windows\System\VcAkYYD.exe
  2⤵
  PID:9864
- C:\Windows\System\MGyiqMY.exe
  C:\Windows\System\MGyiqMY.exe
  2⤵
  PID:9892
- C:\Windows\System\vgOrYOf.exe
  C:\Windows\System\vgOrYOf.exe
  2⤵
  PID:9908
- C:\Windows\System\jLWvDdD.exe
  C:\Windows\System\jLWvDdD.exe
  2⤵
  PID:9932
- C:\Windows\System\dTRJZYh.exe
  C:\Windows\System\dTRJZYh.exe
  2⤵
  PID:9952
- C:\Windows\System\gyPwEyX.exe
  C:\Windows\System\gyPwEyX.exe
  2⤵
  PID:9972
- C:\Windows\System\yrhzNvb.exe
  C:\Windows\System\yrhzNvb.exe
  2⤵
  PID:9996
- C:\Windows\System\HKleDtz.exe
  C:\Windows\System\HKleDtz.exe
  2⤵
  PID:10012
- C:\Windows\System\oekHfaQ.exe
  C:\Windows\System\oekHfaQ.exe
  2⤵
  PID:10032
- C:\Windows\System\eJyGimY.exe
  C:\Windows\System\eJyGimY.exe
  2⤵
  PID:10056
- C:\Windows\System\gfjLpUV.exe
  C:\Windows\System\gfjLpUV.exe
  2⤵
  PID:10076
- C:\Windows\System\rSIqCHY.exe
  C:\Windows\System\rSIqCHY.exe
  2⤵
  PID:10100
- C:\Windows\System\CfSlilo.exe
  C:\Windows\System\CfSlilo.exe
  2⤵
  PID:10120
- C:\Windows\System\xjDobQX.exe
  C:\Windows\System\xjDobQX.exe
  2⤵
  PID:10144
- C:\Windows\System\yXENhwr.exe
  C:\Windows\System\yXENhwr.exe
  2⤵
  PID:10176
- C:\Windows\System\LIeoKjn.exe
  C:\Windows\System\LIeoKjn.exe
  2⤵
  PID:10200
- C:\Windows\System\KdrWyLc.exe
  C:\Windows\System\KdrWyLc.exe
  2⤵
  PID:10220
- C:\Windows\System\nuTwmUS.exe
  C:\Windows\System\nuTwmUS.exe
  2⤵
  PID:8536
- C:\Windows\System\dWyUypP.exe
  C:\Windows\System\dWyUypP.exe
  2⤵
  PID:8576
- C:\Windows\System\phpbjro.exe
  C:\Windows\System\phpbjro.exe
  2⤵
  PID:7456
- C:\Windows\System\ynWELsj.exe
  C:\Windows\System\ynWELsj.exe
  2⤵
  PID:6368
- C:\Windows\System\zTEgcpF.exe
  C:\Windows\System\zTEgcpF.exe
  2⤵
  PID:8660
- C:\Windows\System\iYSUlhY.exe
  C:\Windows\System\iYSUlhY.exe
  2⤵
  PID:8700
- C:\Windows\System\BIHEiYH.exe
  C:\Windows\System\BIHEiYH.exe
  2⤵
  PID:7676
- C:\Windows\System\TBrmHfZ.exe
  C:\Windows\System\TBrmHfZ.exe
  2⤵
  PID:8836
- C:\Windows\System\PiQBsGh.exe
  C:\Windows\System\PiQBsGh.exe
  2⤵
  PID:6540
- C:\Windows\System\QzuqVIV.exe
  C:\Windows\System\QzuqVIV.exe
  2⤵
  PID:7720
- C:\Windows\System\qwSZBQB.exe
  C:\Windows\System\qwSZBQB.exe
  2⤵
  PID:7740
- C:\Windows\System\WlnySrn.exe
  C:\Windows\System\WlnySrn.exe
  2⤵
  PID:6804
- C:\Windows\System\OaFxNeu.exe
  C:\Windows\System\OaFxNeu.exe
  2⤵
  PID:8956
- C:\Windows\System\tyZmaIp.exe
  C:\Windows\System\tyZmaIp.exe
  2⤵
  PID:9000
- C:\Windows\System\GxXJwgy.exe
  C:\Windows\System\GxXJwgy.exe
  2⤵
  PID:9064
- C:\Windows\System\TWoUitD.exe
  C:\Windows\System\TWoUitD.exe
  2⤵
  PID:9084
- C:\Windows\System\UwGTWMS.exe
  C:\Windows\System\UwGTWMS.exe
  2⤵
  PID:9148
- C:\Windows\System\AXoDmRm.exe
  C:\Windows\System\AXoDmRm.exe
  2⤵
  PID:8048
- C:\Windows\System\VikVYZM.exe
  C:\Windows\System\VikVYZM.exe
  2⤵
  PID:7840
- C:\Windows\System\LCSRJIY.exe
  C:\Windows\System\LCSRJIY.exe
  2⤵
  PID:6748
- C:\Windows\System\SliFKde.exe
  C:\Windows\System\SliFKde.exe
  2⤵
  PID:7912
- C:\Windows\System\NPuKccK.exe
  C:\Windows\System\NPuKccK.exe
  2⤵
  PID:6212
- C:\Windows\System\qKVgNlr.exe
  C:\Windows\System\qKVgNlr.exe
  2⤵
  PID:7008
- C:\Windows\System\qJceimt.exe
  C:\Windows\System\qJceimt.exe
  2⤵
  PID:3100
- C:\Windows\System\uWfmhBO.exe
  C:\Windows\System\uWfmhBO.exe
  2⤵
  PID:8128
- C:\Windows\System\tDMLRWR.exe
  C:\Windows\System\tDMLRWR.exe
  2⤵
  PID:8160
- C:\Windows\System\sarsChf.exe
  C:\Windows\System\sarsChf.exe
  2⤵
  PID:6168
- C:\Windows\System\jLhkMfQ.exe
  C:\Windows\System\jLhkMfQ.exe
  2⤵
  PID:8376
- C:\Windows\System\kAraLoO.exe
  C:\Windows\System\kAraLoO.exe
  2⤵
  PID:9240
- C:\Windows\System\ycSjAXn.exe
  C:\Windows\System\ycSjAXn.exe
  2⤵
  PID:9312
- C:\Windows\System\kowjcKN.exe
  C:\Windows\System\kowjcKN.exe
  2⤵
  PID:9396
- C:\Windows\System\LJXZOCJ.exe
  C:\Windows\System\LJXZOCJ.exe
  2⤵
  PID:8628
- C:\Windows\System\gAKBuZQ.exe
  C:\Windows\System\gAKBuZQ.exe
  2⤵
  PID:9520
- C:\Windows\System\LgAJMBj.exe
  C:\Windows\System\LgAJMBj.exe
  2⤵
  PID:9544
- C:\Windows\System\QmmFtNm.exe
  C:\Windows\System\QmmFtNm.exe
  2⤵
  PID:8708
- C:\Windows\System\oiksIQc.exe
  C:\Windows\System\oiksIQc.exe
  2⤵
  PID:9680
- C:\Windows\System\sFxsMFo.exe
  C:\Windows\System\sFxsMFo.exe
  2⤵
  PID:9724
- C:\Windows\System\RpsJulZ.exe
  C:\Windows\System\RpsJulZ.exe
  2⤵
  PID:10256
- C:\Windows\System\CuJmSYW.exe
  C:\Windows\System\CuJmSYW.exe
  2⤵
  PID:10272
- C:\Windows\System\NAlGhKI.exe
  C:\Windows\System\NAlGhKI.exe
  2⤵
  PID:10288
- C:\Windows\System\gkHnEtb.exe
  C:\Windows\System\gkHnEtb.exe
  2⤵
  PID:10304
- C:\Windows\System\KvmxQAt.exe
  C:\Windows\System\KvmxQAt.exe
  2⤵
  PID:10320
- C:\Windows\System\nLzzFsy.exe
  C:\Windows\System\nLzzFsy.exe
  2⤵
  PID:10344
- C:\Windows\System\CHxpnFq.exe
  C:\Windows\System\CHxpnFq.exe
  2⤵
  PID:10376
- C:\Windows\System\ZSFVZbq.exe
  C:\Windows\System\ZSFVZbq.exe
  2⤵
  PID:10396
- C:\Windows\System\afJdiSF.exe
  C:\Windows\System\afJdiSF.exe
  2⤵
  PID:10416
- C:\Windows\System\GUjrQwi.exe
  C:\Windows\System\GUjrQwi.exe
  2⤵
  PID:10436
- C:\Windows\System\gZaDipL.exe
  C:\Windows\System\gZaDipL.exe
  2⤵
  PID:10460
- C:\Windows\System\qoEuShz.exe
  C:\Windows\System\qoEuShz.exe
  2⤵
  PID:10484
- C:\Windows\System\uYZUiUt.exe
  C:\Windows\System\uYZUiUt.exe
  2⤵
  PID:10504
- C:\Windows\System\TwhcQVK.exe
  C:\Windows\System\TwhcQVK.exe
  2⤵
  PID:10524
- C:\Windows\System\vrFqQFj.exe
  C:\Windows\System\vrFqQFj.exe
  2⤵
  PID:10548
- C:\Windows\System\xyNiYLW.exe
  C:\Windows\System\xyNiYLW.exe
  2⤵
  PID:10568
- C:\Windows\System\SwIjzmd.exe
  C:\Windows\System\SwIjzmd.exe
  2⤵
  PID:10588
- C:\Windows\System\LiZeIti.exe
  C:\Windows\System\LiZeIti.exe
  2⤵
  PID:10612
- C:\Windows\System\KesNntb.exe
  C:\Windows\System\KesNntb.exe
  2⤵
  PID:10628
- C:\Windows\System\nLnhclO.exe
  C:\Windows\System\nLnhclO.exe
  2⤵
  PID:10652
- C:\Windows\System\mbmIeEY.exe
  C:\Windows\System\mbmIeEY.exe
  2⤵
  PID:10668
- C:\Windows\System\jiegiow.exe
  C:\Windows\System\jiegiow.exe
  2⤵
  PID:10700
- C:\Windows\System\ngukIZA.exe
  C:\Windows\System\ngukIZA.exe
  2⤵
  PID:10720
- C:\Windows\System\uGRuKyZ.exe
  C:\Windows\System\uGRuKyZ.exe
  2⤵
  PID:10744
- C:\Windows\System\flLOLbe.exe
  C:\Windows\System\flLOLbe.exe
  2⤵
  PID:10772
- C:\Windows\System\coPkyaZ.exe
  C:\Windows\System\coPkyaZ.exe
  2⤵
  PID:10792
- C:\Windows\System\itbmaIx.exe
  C:\Windows\System\itbmaIx.exe
  2⤵
  PID:10812
- C:\Windows\System\aocOVpf.exe
  C:\Windows\System\aocOVpf.exe
  2⤵
  PID:10832
- C:\Windows\System\rCPquLJ.exe
  C:\Windows\System\rCPquLJ.exe
  2⤵
  PID:10856
- C:\Windows\System\JpQBAEG.exe
  C:\Windows\System\JpQBAEG.exe
  2⤵
  PID:10876
- C:\Windows\System\fPhHIie.exe
  C:\Windows\System\fPhHIie.exe
  2⤵
  PID:10896
- C:\Windows\System\QPsUhCG.exe
  C:\Windows\System\QPsUhCG.exe
  2⤵
  PID:10912
- C:\Windows\System\AGUGTZw.exe
  C:\Windows\System\AGUGTZw.exe
  2⤵
  PID:10936
- C:\Windows\System\AQYxIhq.exe
  C:\Windows\System\AQYxIhq.exe
  2⤵
  PID:10960
- C:\Windows\System\yondPHa.exe
  C:\Windows\System\yondPHa.exe
  2⤵
  PID:10984
- C:\Windows\System\IIkoZBV.exe
  C:\Windows\System\IIkoZBV.exe
  2⤵
  PID:11012
- C:\Windows\System\Iehbyfz.exe
  C:\Windows\System\Iehbyfz.exe
  2⤵
  PID:11032
- C:\Windows\System\sIdWOTE.exe
  C:\Windows\System\sIdWOTE.exe
  2⤵
  PID:11056
- C:\Windows\System\MMXkXuU.exe
  C:\Windows\System\MMXkXuU.exe
  2⤵
  PID:11076
- C:\Windows\System\OdVwpUc.exe
  C:\Windows\System\OdVwpUc.exe
  2⤵
  PID:11100
- C:\Windows\System\awKjveV.exe
  C:\Windows\System\awKjveV.exe
  2⤵
  PID:11124
- C:\Windows\System\rimHCzw.exe
  C:\Windows\System\rimHCzw.exe
  2⤵
  PID:11144
- C:\Windows\System\pCpuzQb.exe
  C:\Windows\System\pCpuzQb.exe
  2⤵
  PID:11164
- C:\Windows\System\qxxMSUu.exe
  C:\Windows\System\qxxMSUu.exe
  2⤵
  PID:11184
- C:\Windows\System\DFzvBRd.exe
  C:\Windows\System\DFzvBRd.exe
  2⤵
  PID:11204
- C:\Windows\System\hRsXaxh.exe
  C:\Windows\System\hRsXaxh.exe
  2⤵
  PID:11228
- C:\Windows\System\yhYQzVZ.exe
  C:\Windows\System\yhYQzVZ.exe
  2⤵
  PID:11252
- C:\Windows\System\hIOdgaF.exe
  C:\Windows\System\hIOdgaF.exe
  2⤵
  PID:2364
- C:\Windows\System\lLmHYqK.exe
  C:\Windows\System\lLmHYqK.exe
  2⤵
  PID:9856
- C:\Windows\System\foxEbUg.exe
  C:\Windows\System\foxEbUg.exe
  2⤵
  PID:9884
- C:\Windows\System\FzJMPcv.exe
  C:\Windows\System\FzJMPcv.exe
  2⤵
  PID:9944
- C:\Windows\System\iNHpjtp.exe
  C:\Windows\System\iNHpjtp.exe
  2⤵
  PID:7092
- C:\Windows\System\lrtqwqj.exe
  C:\Windows\System\lrtqwqj.exe
  2⤵
  PID:6300
- C:\Windows\System\eptieQP.exe
  C:\Windows\System\eptieQP.exe
  2⤵
  PID:5824
- C:\Windows\System\UdarWtQ.exe
  C:\Windows\System\UdarWtQ.exe
  2⤵
  PID:6892
- C:\Windows\System\shOYDYR.exe
  C:\Windows\System\shOYDYR.exe
  2⤵
  PID:6480
- C:\Windows\System\xzoGqbD.exe
  C:\Windows\System\xzoGqbD.exe
  2⤵
  PID:6640
- C:\Windows\System\GTrZKFu.exe
  C:\Windows\System\GTrZKFu.exe
  2⤵
  PID:4964
- C:\Windows\System\NRHgicy.exe
  C:\Windows\System\NRHgicy.exe
  2⤵
  PID:7584
- C:\Windows\System\YkFYHZf.exe
  C:\Windows\System\YkFYHZf.exe
  2⤵
  PID:8776
- C:\Windows\System\oRxKxFS.exe
  C:\Windows\System\oRxKxFS.exe
  2⤵
  PID:6568
- C:\Windows\System\xdykrtd.exe
  C:\Windows\System\xdykrtd.exe
  2⤵
  PID:8356
- C:\Windows\System\zGwhgWF.exe
  C:\Windows\System\zGwhgWF.exe
  2⤵
  PID:8492
- C:\Windows\System\bVftwjP.exe
  C:\Windows\System\bVftwjP.exe
  2⤵
  PID:11276
- C:\Windows\System\XFIgawk.exe
  C:\Windows\System\XFIgawk.exe
  2⤵
  PID:11308
- C:\Windows\System\dnhfVHK.exe
  C:\Windows\System\dnhfVHK.exe
  2⤵
  PID:11328
- C:\Windows\System\tyeqFRH.exe
  C:\Windows\System\tyeqFRH.exe
  2⤵
  PID:11360
- C:\Windows\System\QOGhUhv.exe
  C:\Windows\System\QOGhUhv.exe
  2⤵
  PID:11376
- C:\Windows\System\rtzfrki.exe
  C:\Windows\System\rtzfrki.exe
  2⤵
  PID:11396
- C:\Windows\System\AYFXSJG.exe
  C:\Windows\System\AYFXSJG.exe
  2⤵
  PID:11412
- C:\Windows\System\kzovIVR.exe
  C:\Windows\System\kzovIVR.exe
  2⤵
  PID:11428
- C:\Windows\System\pLpTagg.exe
  C:\Windows\System\pLpTagg.exe
  2⤵
  PID:11448
- C:\Windows\System\FyFUuSt.exe
  C:\Windows\System\FyFUuSt.exe
  2⤵
  PID:11468
- C:\Windows\System\hIcDlgg.exe
  C:\Windows\System\hIcDlgg.exe
  2⤵
  PID:11488
- C:\Windows\System\FqucyJb.exe
  C:\Windows\System\FqucyJb.exe
  2⤵
  PID:11508
- C:\Windows\System\wvgYMMF.exe
  C:\Windows\System\wvgYMMF.exe
  2⤵
  PID:11524
- C:\Windows\System\gTEkmCm.exe
  C:\Windows\System\gTEkmCm.exe
  2⤵
  PID:11544
- C:\Windows\System\bVunXYi.exe
  C:\Windows\System\bVunXYi.exe
  2⤵
  PID:11564
- C:\Windows\System\gGpAEai.exe
  C:\Windows\System\gGpAEai.exe
  2⤵
  PID:11600
- C:\Windows\System\tMOHQPU.exe
  C:\Windows\System\tMOHQPU.exe
  2⤵
  PID:11624
- C:\Windows\System\jippRMH.exe
  C:\Windows\System\jippRMH.exe
  2⤵
  PID:11648
- C:\Windows\System\rNMSGyw.exe
  C:\Windows\System\rNMSGyw.exe
  2⤵
  PID:11672
- C:\Windows\System\RDGUNjH.exe
  C:\Windows\System\RDGUNjH.exe
  2⤵
  PID:11692
- C:\Windows\System\ajyCant.exe
  C:\Windows\System\ajyCant.exe
  2⤵
  PID:11712
- C:\Windows\System\vmBNYEG.exe
  C:\Windows\System\vmBNYEG.exe
  2⤵
  PID:11732
- C:\Windows\System\npzhGsw.exe
  C:\Windows\System\npzhGsw.exe
  2⤵
  PID:11760
- C:\Windows\System\QPXrLCR.exe
  C:\Windows\System\QPXrLCR.exe
  2⤵
  PID:11780
- C:\Windows\System\ywkYSQZ.exe
  C:\Windows\System\ywkYSQZ.exe
  2⤵
  PID:11800
- C:\Windows\System\NdlIMUp.exe
  C:\Windows\System\NdlIMUp.exe
  2⤵
  PID:11828
- C:\Windows\System\IGgEUsG.exe
  C:\Windows\System\IGgEUsG.exe
  2⤵
  PID:11852
- C:\Windows\System\SVqrGMS.exe
  C:\Windows\System\SVqrGMS.exe
  2⤵
  PID:11880
- C:\Windows\System\WDQGfNT.exe
  C:\Windows\System\WDQGfNT.exe
  2⤵
  PID:11896
- C:\Windows\System\AEPSLNm.exe
  C:\Windows\System\AEPSLNm.exe
  2⤵
  PID:11920
- C:\Windows\System\XGVGPMc.exe
  C:\Windows\System\XGVGPMc.exe
  2⤵
  PID:11940
- C:\Windows\System\ASDCPYu.exe
  C:\Windows\System\ASDCPYu.exe
  2⤵
  PID:11964
- C:\Windows\System\MqnbYUk.exe
  C:\Windows\System\MqnbYUk.exe
  2⤵
  PID:11988
- C:\Windows\System\qMVSUzg.exe
  C:\Windows\System\qMVSUzg.exe
  2⤵
  PID:12008
- C:\Windows\System\nmpeQOD.exe
  C:\Windows\System\nmpeQOD.exe
  2⤵
  PID:12032
- C:\Windows\System\eZBVJtP.exe
  C:\Windows\System\eZBVJtP.exe
  2⤵
  PID:12068
- C:\Windows\System\nqqGRPJ.exe
  C:\Windows\System\nqqGRPJ.exe
  2⤵
  PID:12088
- C:\Windows\System\WjsnoLL.exe
  C:\Windows\System\WjsnoLL.exe
  2⤵
  PID:12108
- C:\Windows\System\DtvgTFM.exe
  C:\Windows\System\DtvgTFM.exe
  2⤵
  PID:12128
- C:\Windows\System\FBOSGEf.exe
  C:\Windows\System\FBOSGEf.exe
  2⤵
  PID:12144
- C:\Windows\System\BLBqavA.exe
  C:\Windows\System\BLBqavA.exe
  2⤵
  PID:12168
- C:\Windows\System\MqmtLji.exe
  C:\Windows\System\MqmtLji.exe
  2⤵
  PID:12184
- C:\Windows\System\DFlNKHZ.exe
  C:\Windows\System\DFlNKHZ.exe
  2⤵
  PID:12208
- C:\Windows\System\IolGzFL.exe
  C:\Windows\System\IolGzFL.exe
  2⤵
  PID:12236
- C:\Windows\System\VyHLaXn.exe
  C:\Windows\System\VyHLaXn.exe
  2⤵
  PID:12256
- C:\Windows\System\ddvKFNL.exe
  C:\Windows\System\ddvKFNL.exe
  2⤵
  PID:12284
- C:\Windows\System\eAqDnfX.exe
  C:\Windows\System\eAqDnfX.exe
  2⤵
  PID:8596
- C:\Windows\System\duuXGTj.exe
  C:\Windows\System\duuXGTj.exe
  2⤵
  PID:8084
- C:\Windows\System\qFqADXd.exe
  C:\Windows\System\qFqADXd.exe
  2⤵
  PID:8392
- C:\Windows\System\vLkGezb.exe
  C:\Windows\System\vLkGezb.exe
  2⤵
  PID:8732
- C:\Windows\System\aIoLhDz.exe
  C:\Windows\System\aIoLhDz.exe
  2⤵
  PID:9620
- C:\Windows\System\QqFcrhU.exe
  C:\Windows\System\QqFcrhU.exe
  2⤵
  PID:9700
- C:\Windows\System\nkhAkdU.exe
  C:\Windows\System\nkhAkdU.exe
  2⤵
  PID:9476
- C:\Windows\System\rVSNQTQ.exe
  C:\Windows\System\rVSNQTQ.exe
  2⤵
  PID:10248
- C:\Windows\System\KuhpFlk.exe
  C:\Windows\System\KuhpFlk.exe
  2⤵
  PID:9796
- C:\Windows\System\kyHCWIr.exe
  C:\Windows\System\kyHCWIr.exe
  2⤵
  PID:10468
- C:\Windows\System\EoVlTuO.exe
  C:\Windows\System\EoVlTuO.exe
  2⤵
  PID:10512
- C:\Windows\System\SncbXii.exe
  C:\Windows\System\SncbXii.exe
  2⤵
  PID:9924
- C:\Windows\System\oRavCsB.exe
  C:\Windows\System\oRavCsB.exe
  2⤵
  PID:10664
- C:\Windows\System\QOdwdVc.exe
  C:\Windows\System\QOdwdVc.exe
  2⤵
  PID:9164
- C:\Windows\System\omRIHMp.exe
  C:\Windows\System\omRIHMp.exe
  2⤵
  PID:10068
- C:\Windows\System\FdhLuJX.exe
  C:\Windows\System\FdhLuJX.exe
  2⤵
  PID:10780
- C:\Windows\System\LJEJcoV.exe
  C:\Windows\System\LJEJcoV.exe
  2⤵
  PID:10808
- C:\Windows\System\KAMqVxY.exe
  C:\Windows\System\KAMqVxY.exe
  2⤵
  PID:10884
- C:\Windows\System\ErZieuQ.exe
  C:\Windows\System\ErZieuQ.exe
  2⤵
  PID:12312
- C:\Windows\System\WilMIiG.exe
  C:\Windows\System\WilMIiG.exe
  2⤵
  PID:12328
- C:\Windows\System\MjqLpGt.exe
  C:\Windows\System\MjqLpGt.exe
  2⤵
  PID:12344
- C:\Windows\System\StkTSmX.exe
  C:\Windows\System\StkTSmX.exe
  2⤵
  PID:12364
- C:\Windows\System\hZHGkkD.exe
  C:\Windows\System\hZHGkkD.exe
  2⤵
  PID:12380
- C:\Windows\System\vasaPkd.exe
  C:\Windows\System\vasaPkd.exe
  2⤵
  PID:12404
- C:\Windows\System\ZJVBpcl.exe
  C:\Windows\System\ZJVBpcl.exe
  2⤵
  PID:12428
- C:\Windows\System\ttMpTeJ.exe
  C:\Windows\System\ttMpTeJ.exe
  2⤵
  PID:12452
- C:\Windows\System\TZNyjBR.exe
  C:\Windows\System\TZNyjBR.exe
  2⤵
  PID:12472
- C:\Windows\System\CpMqukm.exe
  C:\Windows\System\CpMqukm.exe
  2⤵
  PID:12492
- C:\Windows\System\yjlqPQk.exe
  C:\Windows\System\yjlqPQk.exe
  2⤵
  PID:12516
- C:\Windows\System\WcBryjb.exe
  C:\Windows\System\WcBryjb.exe
  2⤵
  PID:12536
- C:\Windows\System\YuaYSGA.exe
  C:\Windows\System\YuaYSGA.exe
  2⤵
  PID:12552
- C:\Windows\System\FEjXbhR.exe
  C:\Windows\System\FEjXbhR.exe
  2⤵
  PID:12576
- C:\Windows\System\xnBUGBO.exe
  C:\Windows\System\xnBUGBO.exe
  2⤵
  PID:12596
- C:\Windows\System\orNcNQs.exe
  C:\Windows\System\orNcNQs.exe
  2⤵
  PID:12620
- C:\Windows\System\kxEkiNk.exe
  C:\Windows\System\kxEkiNk.exe
  2⤵
  PID:12640
- C:\Windows\System\JZoRVwN.exe
  C:\Windows\System\JZoRVwN.exe
  2⤵
  PID:12660
- C:\Windows\System\OqUxlIw.exe
  C:\Windows\System\OqUxlIw.exe
  2⤵
  PID:12684
- C:\Windows\System\RIGUPTO.exe
  C:\Windows\System\RIGUPTO.exe
  2⤵
  PID:12700
- C:\Windows\System\ZigInvI.exe
  C:\Windows\System\ZigInvI.exe
  2⤵
  PID:12728
- C:\Windows\System\THwhOJu.exe
  C:\Windows\System\THwhOJu.exe
  2⤵
  PID:12752
- C:\Windows\System\pSmDMjR.exe
  C:\Windows\System\pSmDMjR.exe
  2⤵
  PID:12776
- C:\Windows\System\sxEmnfp.exe
  C:\Windows\System\sxEmnfp.exe
  2⤵
  PID:12796
- C:\Windows\System\qpYVzAk.exe
  C:\Windows\System\qpYVzAk.exe
  2⤵
  PID:12824
- C:\Windows\System\kpEPBwl.exe
  C:\Windows\System\kpEPBwl.exe
  2⤵
  PID:12848
- C:\Windows\System\TfRHygc.exe
  C:\Windows\System\TfRHygc.exe
  2⤵
  PID:12884
- C:\Windows\System\XOfCEWP.exe
  C:\Windows\System\XOfCEWP.exe
  2⤵
  PID:12908
- C:\Windows\System\TjavtEQ.exe
  C:\Windows\System\TjavtEQ.exe
  2⤵
  PID:12936
- C:\Windows\System\IJDbdto.exe
  C:\Windows\System\IJDbdto.exe
  2⤵
  PID:12960
- C:\Windows\System\ScDUCGh.exe
  C:\Windows\System\ScDUCGh.exe
  2⤵
  PID:12980
- C:\Windows\System\Awddafo.exe
  C:\Windows\System\Awddafo.exe
  2⤵
  PID:13004
- C:\Windows\System\rYbOIvQ.exe
  C:\Windows\System\rYbOIvQ.exe
  2⤵
  PID:13024
- C:\Windows\System\SrQHQcN.exe
  C:\Windows\System\SrQHQcN.exe
  2⤵
  PID:13048
- C:\Windows\System\QcRqIQL.exe
  C:\Windows\System\QcRqIQL.exe
  2⤵
  PID:13064
- C:\Windows\System\UeBbrSB.exe
  C:\Windows\System\UeBbrSB.exe
  2⤵
  PID:13084
- C:\Windows\System\zlqZdnt.exe
  C:\Windows\System\zlqZdnt.exe
  2⤵
  PID:13104
- C:\Windows\System\ITjvXnx.exe
  C:\Windows\System\ITjvXnx.exe
  2⤵
  PID:13132
- C:\Windows\System\jHGpKBD.exe
  C:\Windows\System\jHGpKBD.exe
  2⤵
  PID:13152
- C:\Windows\System\OxavBkN.exe
  C:\Windows\System\OxavBkN.exe
  2⤵
  PID:13172
- C:\Windows\System\PvpJxTF.exe
  C:\Windows\System\PvpJxTF.exe
  2⤵
  PID:13196
- C:\Windows\System\PFoFXze.exe
  C:\Windows\System\PFoFXze.exe
  2⤵
  PID:13212
- C:\Windows\System\OLQSfrE.exe
  C:\Windows\System\OLQSfrE.exe
  2⤵
  PID:13232
- C:\Windows\System\bySbGNf.exe
  C:\Windows\System\bySbGNf.exe
  2⤵
  PID:13256
- C:\Windows\System\FUKfdAo.exe
  C:\Windows\System\FUKfdAo.exe
  2⤵
  PID:13284
- C:\Windows\System\ecGGjDf.exe
  C:\Windows\System\ecGGjDf.exe
  2⤵
  PID:13308
- C:\Windows\System\EILAkwd.exe
  C:\Windows\System\EILAkwd.exe
  2⤵
  PID:10920
- C:\Windows\System\qXxydBU.exe
  C:\Windows\System\qXxydBU.exe
  2⤵
  PID:11020
- C:\Windows\System\xEdzCgB.exe
  C:\Windows\System\xEdzCgB.exe
  2⤵
  PID:12412
- C:\Windows\System\xUXOUxn.exe
  C:\Windows\System\xUXOUxn.exe
  2⤵
  PID:11084
- C:\Windows\System\EkAgwUn.exe
  C:\Windows\System\EkAgwUn.exe
  2⤵
  PID:10848
- C:\Windows\System\KmGQGLc.exe
  C:\Windows\System\KmGQGLc.exe
  2⤵
  PID:12564
- C:\Windows\System\Ojjcfxj.exe
  C:\Windows\System\Ojjcfxj.exe
  2⤵
  PID:8736
- C:\Windows\System\MbOLQWF.exe
  C:\Windows\System\MbOLQWF.exe
  2⤵
  PID:8252
- C:\Windows\System\mQnXTst.exe
  C:\Windows\System\mQnXTst.exe
  2⤵
  PID:12692
- C:\Windows\System\JTyvRHD.exe
  C:\Windows\System\JTyvRHD.exe
  2⤵
  PID:12872
- C:\Windows\System\NarRqzo.exe
  C:\Windows\System\NarRqzo.exe
  2⤵
  PID:12500
- C:\Windows\System\fCXyNbP.exe
  C:\Windows\System\fCXyNbP.exe
  2⤵
  PID:11904
- C:\Windows\System\SrVCKXH.exe
  C:\Windows\System\SrVCKXH.exe
  2⤵
  PID:13096
- C:\Windows\System\xVXMzaf.exe
  C:\Windows\System\xVXMzaf.exe
  2⤵
  PID:11888
- C:\Windows\System\MesaNpU.exe
  C:\Windows\System\MesaNpU.exe
  2⤵
  PID:11212
- C:\Windows\System\pqypxhW.exe
  C:\Windows\System\pqypxhW.exe
  2⤵
  PID:10828
- C:\Windows\System\OKhkrUO.exe
  C:\Windows\System\OKhkrUO.exe
  2⤵
  PID:11296
- C:\Windows\System\RkgstOE.exe
  C:\Windows\System\RkgstOE.exe
  2⤵
  PID:8520
- C:\Windows\System\hAqAVwQ.exe
  C:\Windows\System\hAqAVwQ.exe
  2⤵
  PID:10904
- C:\Windows\System\OEnlZhk.exe
  C:\Windows\System\OEnlZhk.exe
  2⤵
  PID:8816
- C:\Windows\System\ONMbPEA.exe
  C:\Windows\System\ONMbPEA.exe
  2⤵
  PID:3964
- C:\Windows\System\RiiaiuL.exe
  C:\Windows\System\RiiaiuL.exe
  2⤵
  PID:12932
- C:\Windows\System\eajHHtY.exe
  C:\Windows\System\eajHHtY.exe
  2⤵
  PID:11500
- C:\Windows\System\KpqioKK.exe
  C:\Windows\System\KpqioKK.exe
  2⤵
  PID:8900
- C:\Windows\System\OuOMCTj.exe
  C:\Windows\System\OuOMCTj.exe
  2⤵
  PID:10116
- C:\Windows\System\FHriPGD.exe
  C:\Windows\System\FHriPGD.exe
  2⤵
  PID:7244
- C:\Windows\System\svbTwnU.exe
  C:\Windows\System\svbTwnU.exe
  2⤵
  PID:8808
- C:\Windows\System\slmWpBL.exe
  C:\Windows\System\slmWpBL.exe
  2⤵
  PID:10868
- C:\Windows\System\YEAwUuH.exe
  C:\Windows\System\YEAwUuH.exe
  2⤵
  PID:840
- C:\Windows\System\vOdcQFD.exe
  C:\Windows\System\vOdcQFD.exe
  2⤵
  PID:13148
- C:\Windows\System\lqEmUtR.exe
  C:\Windows\System\lqEmUtR.exe
  2⤵
  PID:11460
- C:\Windows\System\Jdvatkk.exe
  C:\Windows\System\Jdvatkk.exe
  2⤵
  PID:11708
- C:\Windows\System\HBcVsTG.exe
  C:\Windows\System\HBcVsTG.exe
  2⤵
  PID:9828
- C:\Windows\System\mXZyvaB.exe
  C:\Windows\System\mXZyvaB.exe
  2⤵
  PID:8996
- C:\Windows\System\BVtDJop.exe
  C:\Windows\System\BVtDJop.exe
  2⤵
  PID:1960
- C:\Windows\System\uzjzvKw.exe
  C:\Windows\System\uzjzvKw.exe
  2⤵
  PID:11616
- C:\Windows\System\mtDQfOU.exe
  C:\Windows\System\mtDQfOU.exe
  2⤵
  PID:13276
- C:\Windows\System\gGfcvhk.exe
  C:\Windows\System\gGfcvhk.exe
  2⤵
  PID:13300
- C:\Windows\System\oIFnDxE.exe
  C:\Windows\System\oIFnDxE.exe
  2⤵
  PID:4160
- C:\Windows\System\SEyRmba.exe
  C:\Windows\System\SEyRmba.exe
  2⤵
  PID:10804
- C:\Windows\System\ybpTSeO.exe
  C:\Windows\System\ybpTSeO.exe
  2⤵
  PID:13164
- C:\Windows\System\otLZyvr.exe
  C:\Windows\System\otLZyvr.exe
  2⤵
  PID:11220
- C:\Windows\System\GiaIJuD.exe
  C:\Windows\System\GiaIJuD.exe
  2⤵
  PID:10404
- C:\Windows\System\afqctCh.exe
  C:\Windows\System\afqctCh.exe
  2⤵
  PID:1900
- C:\Windows\System\SNFLoCv.exe
  C:\Windows\System\SNFLoCv.exe
  2⤵
  PID:12808
- C:\Windows\System\RpZYBSA.exe
  C:\Windows\System\RpZYBSA.exe
  2⤵
  PID:12804
- C:\Windows\System\LoJSkYk.exe
  C:\Windows\System\LoJSkYk.exe
  2⤵
  PID:10188
- C:\Windows\System\eZkExpD.exe
  C:\Windows\System\eZkExpD.exe
  2⤵
  PID:10636
- C:\Windows\System\jglLydv.exe
  C:\Windows\System\jglLydv.exe
  2⤵
  PID:9472
- C:\Windows\System\FHufChj.exe
  C:\Windows\System\FHufChj.exe
  2⤵
  PID:12136
- C:\Windows\System\QTMiaLU.exe
  C:\Windows\System\QTMiaLU.exe
  2⤵
  PID:12484
- C:\Windows\System\FWUiQbb.exe
  C:\Windows\System\FWUiQbb.exe
  2⤵
  PID:13296
- C:\Windows\System\sRRKDeK.exe
  C:\Windows\System\sRRKDeK.exe
  2⤵
  PID:4768
- C:\Windows\System\wEFSDcF.exe
  C:\Windows\System\wEFSDcF.exe
  2⤵
  PID:2664
- C:\Windows\System\uChBZHY.exe
  C:\Windows\System\uChBZHY.exe
  2⤵
  PID:3704
- C:\Windows\System\ZOIWXhQ.exe
  C:\Windows\System\ZOIWXhQ.exe
  2⤵
  PID:11656
- C:\Windows\System\FJeDRXn.exe
  C:\Windows\System\FJeDRXn.exe
  2⤵
  PID:9880
- C:\Windows\System\dBifrCE.exe
  C:\Windows\System\dBifrCE.exe
  2⤵
  PID:13320
- C:\Windows\System\vTDsCij.exe
  C:\Windows\System\vTDsCij.exe
  2⤵
  PID:13340
- C:\Windows\System\jWhzIjM.exe
  C:\Windows\System\jWhzIjM.exe
  2⤵
  PID:13364
- C:\Windows\System\GiORJMX.exe
  C:\Windows\System\GiORJMX.exe
  2⤵
  PID:13384
- C:\Windows\System\VlStmbV.exe
  C:\Windows\System\VlStmbV.exe
  2⤵
  PID:13408
- C:\Windows\System\LVpBezb.exe
  C:\Windows\System\LVpBezb.exe
  2⤵
  PID:13432
- C:\Windows\System\IxLfYgW.exe
  C:\Windows\System\IxLfYgW.exe
  2⤵
  PID:13456
- C:\Windows\System\ZdbpMFv.exe
  C:\Windows\System\ZdbpMFv.exe
  2⤵
  PID:13476
- C:\Windows\System\cOkAvDR.exe
  C:\Windows\System\cOkAvDR.exe
  2⤵
  PID:13588
- C:\Windows\System\vLndIla.exe
  C:\Windows\System\vLndIla.exe
  2⤵
  PID:13612
- C:\Windows\System\ZbiXPEw.exe
  C:\Windows\System\ZbiXPEw.exe
  2⤵
  PID:13964
- C:\Windows\System\ZlHTxIq.exe
  C:\Windows\System\ZlHTxIq.exe
  2⤵
  PID:13988
- C:\Windows\System\jSoCXkl.exe
  C:\Windows\System\jSoCXkl.exe
  2⤵
  PID:14016
- C:\Windows\System\RIhCBwn.exe
  C:\Windows\System\RIhCBwn.exe
  2⤵
  PID:14100
- C:\Windows\System\gCCZuCu.exe
  C:\Windows\System\gCCZuCu.exe
  2⤵
  PID:14124
- C:\Windows\System\lVyTHRB.exe
  C:\Windows\System\lVyTHRB.exe
  2⤵
  PID:14180
- C:\Windows\System\bwRIXIU.exe
  C:\Windows\System\bwRIXIU.exe
  2⤵
  PID:14300
- C:\Windows\System\LKLXOyF.exe
  C:\Windows\System\LKLXOyF.exe
  2⤵
  PID:13264
- C:\Windows\System\EkHBEsM.exe
  C:\Windows\System\EkHBEsM.exe
  2⤵
  PID:8472
- C:\Windows\System\dBVcTVh.exe
  C:\Windows\System\dBVcTVh.exe
  2⤵
  PID:13512
- C:\Windows\System\DiPQzBN.exe
  C:\Windows\System\DiPQzBN.exe
  2⤵
  PID:13360
- C:\Windows\System\FOGYYdr.exe
  C:\Windows\System\FOGYYdr.exe
  2⤵
  PID:13688
- C:\Windows\System\CeeNOna.exe
  C:\Windows\System\CeeNOna.exe
  2⤵
  PID:13332
- C:\Windows\System\jAxCAEc.exe
  C:\Windows\System\jAxCAEc.exe
  2⤵
  PID:13672
- C:\Windows\System\rkgszxv.exe
  C:\Windows\System\rkgszxv.exe
  2⤵
  PID:13916
- C:\Windows\System\urUlzcV.exe
  C:\Windows\System\urUlzcV.exe
  2⤵
  PID:14160
- C:\Windows\System\WQYUaSb.exe
  C:\Windows\System\WQYUaSb.exe
  2⤵
  PID:14204
- C:\Windows\System\OnYqKJC.exe
  C:\Windows\System\OnYqKJC.exe
  2⤵
  PID:13960
- C:\Windows\System\VLhtCQz.exe
  C:\Windows\System\VLhtCQz.exe
  2⤵
  PID:14332
- C:\Windows\System\XrVdlhA.exe
  C:\Windows\System\XrVdlhA.exe
  2⤵
  PID:13060
- C:\Windows\System\buobrmO.exe
  C:\Windows\System\buobrmO.exe
  2⤵
  PID:14164
- C:\Windows\System\TmJWlom.exe
  C:\Windows\System\TmJWlom.exe
  2⤵
  PID:13464
- C:\Windows\System\yoOEjsy.exe
  C:\Windows\System\yoOEjsy.exe
  2⤵
  PID:3776
- C:\Windows\System\WyVYGsf.exe
  C:\Windows\System\WyVYGsf.exe
  2⤵
  PID:13744
- C:\Windows\System\QOXThNy.exe
  C:\Windows\System\QOXThNy.exe
  2⤵
  PID:2288
- C:\Windows\System\YNELsxr.exe
  C:\Windows\System\YNELsxr.exe
  2⤵
  PID:13632
- C:\Windows\System\mUscMJK.exe
  C:\Windows\System\mUscMJK.exe
  2⤵
  PID:13716
- C:\Windows\System\qkswIGc.exe
  C:\Windows\System\qkswIGc.exe
  2⤵
  PID:13440
- C:\Windows\System\qPxjozg.exe
  C:\Windows\System\qPxjozg.exe
  2⤵
  PID:13736
- C:\Windows\System\PSHQbff.exe
  C:\Windows\System\PSHQbff.exe
  2⤵
  PID:13904
- C:\Windows\System\RfMQQKg.exe
  C:\Windows\System\RfMQQKg.exe
  2⤵
  PID:13996
- C:\Windows\System\kNQcNZG.exe
  C:\Windows\System\kNQcNZG.exe
  2⤵
  PID:13880
- C:\Windows\System\nweUofX.exe
  C:\Windows\System\nweUofX.exe
  2⤵
  PID:14228
- C:\Windows\System\ifsUups.exe
  C:\Windows\System\ifsUups.exe
  2⤵
  PID:14144
- C:\Windows\System\rLATBEU.exe
  C:\Windows\System\rLATBEU.exe
  2⤵
  PID:13776
- C:\Windows\System\NyuzdtM.exe
  C:\Windows\System\NyuzdtM.exe
  2⤵
  PID:12992
- C:\Windows\System\ecYrPSK.exe
  C:\Windows\System\ecYrPSK.exe
  2⤵
  PID:13292
- C:\Windows\System\IBHqlVy.exe
  C:\Windows\System\IBHqlVy.exe
  2⤵
  PID:4712
- C:\Windows\System\hzjOPZK.exe
  C:\Windows\System\hzjOPZK.exe
  2⤵
  PID:4004
- C:\Windows\System\bHvaJkU.exe
  C:\Windows\System\bHvaJkU.exe
  2⤵
  PID:13984
- C:\Windows\System\CMXdxpL.exe
  C:\Windows\System\CMXdxpL.exe
  2⤵
  PID:14176
- C:\Windows\System\NxirkSS.exe
  C:\Windows\System\NxirkSS.exe
  2⤵
  PID:4188
- C:\Windows\System\FWUsghj.exe
  C:\Windows\System\FWUsghj.exe
  2⤵
  PID:12372
- C:\Windows\System\DjQnjne.exe
  C:\Windows\System\DjQnjne.exe
  2⤵
  PID:13940
- C:\Windows\System\PNZmXhJ.exe
  C:\Windows\System\PNZmXhJ.exe
  2⤵
  PID:1432
- C:\Windows\System\zlklUsD.exe
  C:\Windows\System\zlklUsD.exe
  2⤵
  PID:2224
- C:\Windows\System\WoWcBqu.exe
  C:\Windows\System\WoWcBqu.exe
  2⤵
  PID:452
- C:\Windows\System\FBjGUFz.exe
  C:\Windows\System\FBjGUFz.exe
  2⤵
  PID:1268
- C:\Windows\System\xWZGKIj.exe
  C:\Windows\System\xWZGKIj.exe
  2⤵
  PID:10620
- C:\Windows\System\riwJtjV.exe
  C:\Windows\System\riwJtjV.exe
  2⤵
  PID:2428
- C:\Windows\System\XOxVmlA.exe
  C:\Windows\System\XOxVmlA.exe
  2⤵
  PID:13624
- C:\Windows\System\hLyXXYT.exe
  C:\Windows\System\hLyXXYT.exe
  2⤵
  PID:13912
- C:\Windows\System\ngzbApK.exe
  C:\Windows\System\ngzbApK.exe
  2⤵
  PID:13424
- C:\Windows\System\EUBwZgl.exe
  C:\Windows\System\EUBwZgl.exe
  2⤵
  PID:14212
- C:\Windows\System\wTxnPWa.exe
  C:\Windows\System\wTxnPWa.exe
  2⤵
  PID:3424
- C:\Windows\System\cpzBQKh.exe
  C:\Windows\System\cpzBQKh.exe
  2⤵
  PID:13844
- C:\Windows\System\sZbMjon.exe
  C:\Windows\System\sZbMjon.exe
  2⤵
  PID:1324
- C:\Windows\System\jWSLrZm.exe
  C:\Windows\System\jWSLrZm.exe
  2⤵
  PID:13780
- C:\Windows\System\RUyEFYy.exe
  C:\Windows\System\RUyEFYy.exe
  2⤵
  PID:7988
- C:\Windows\System\uVxXzqK.exe
  C:\Windows\System\uVxXzqK.exe
  2⤵
  PID:896
- C:\Windows\System\DeemGbD.exe
  C:\Windows\System\DeemGbD.exe
  2⤵
  PID:10956
- C:\Windows\System\aIzPEIl.exe
  C:\Windows\System\aIzPEIl.exe
  2⤵
  PID:14032
- C:\Windows\System\HMNxoOT.exe
  C:\Windows\System\HMNxoOT.exe
  2⤵
  PID:11108
- C:\Windows\System\eCtpCdl.exe
  C:\Windows\System\eCtpCdl.exe
  2⤵
  PID:14268
- C:\Windows\System\LTTapHF.exe
  C:\Windows\System\LTTapHF.exe
  2⤵
  PID:13500
- C:\Windows\System\JkVbxrX.exe
  C:\Windows\System\JkVbxrX.exe
  2⤵
  PID:3044
- C:\Windows\System\igfUNjF.exe
  C:\Windows\System\igfUNjF.exe
  2⤵
  PID:13520
- C:\Windows\System\rrmvPpb.exe
  C:\Windows\System\rrmvPpb.exe
  2⤵
  PID:3488
- C:\Windows\System\hQnipwm.exe
  C:\Windows\System\hQnipwm.exe
  2⤵
  PID:4380
- C:\Windows\System\oHbwmWj.exe
  C:\Windows\System\oHbwmWj.exe
  2⤵
  PID:13764
- C:\Windows\System\zLpyUoB.exe
  C:\Windows\System\zLpyUoB.exe
  2⤵
  PID:3820
- C:\Windows\System\xqrGGhv.exe
  C:\Windows\System\xqrGGhv.exe
  2⤵
  PID:11440
- C:\Windows\System\cQBeqDb.exe
  C:\Windows\System\cQBeqDb.exe
  2⤵
  PID:14096
- C:\Windows\System\IbkYJvI.exe
  C:\Windows\System\IbkYJvI.exe
  2⤵
  PID:14248
- C:\Windows\System\zKCeeuL.exe
  C:\Windows\System\zKCeeuL.exe
  2⤵
  PID:732
- C:\Windows\System\AHPgbCW.exe
  C:\Windows\System\AHPgbCW.exe
  2⤵
  PID:7356
- C:\Windows\System\TbGQURu.exe
  C:\Windows\System\TbGQURu.exe
  2⤵
  PID:6784
- C:\Windows\System\vqjprXj.exe
  C:\Windows\System\vqjprXj.exe
  2⤵
  PID:4384
- C:\Windows\System\JEBcgxY.exe
  C:\Windows\System\JEBcgxY.exe
  2⤵
  PID:8800
- C:\Windows\System\jGCamZA.exe
  C:\Windows\System\jGCamZA.exe
  2⤵
  PID:1164
- C:\Windows\System\PvWZsgX.exe
  C:\Windows\System\PvWZsgX.exe
  2⤵
  PID:992
- C:\Windows\System\HKmOXYT.exe
  C:\Windows\System\HKmOXYT.exe
  2⤵
  PID:936
- C:\Windows\System\yUIBcSR.exe
  C:\Windows\System\yUIBcSR.exe
  2⤵
  PID:3292
- C:\Windows\System\TUYdbJX.exe
  C:\Windows\System\TUYdbJX.exe
  2⤵
  PID:4252
- C:\Windows\System\ObIwNVW.exe
  C:\Windows\System\ObIwNVW.exe
  2⤵
  PID:6912
- C:\Windows\System\SBRVXnq.exe
  C:\Windows\System\SBRVXnq.exe
  2⤵
  PID:5360
- C:\Windows\System\lhHNHBO.exe
  C:\Windows\System\lhHNHBO.exe
  2⤵
  PID:7368
- C:\Windows\System\RxhqkyQ.exe
  C:\Windows\System\RxhqkyQ.exe
  2⤵
  PID:4872
- C:\Windows\System\nXFipJn.exe
  C:\Windows\System\nXFipJn.exe
  2⤵
  PID:9168
- C:\Windows\System\xxCiGDi.exe
  C:\Windows\System\xxCiGDi.exe
  2⤵
  PID:2704
- C:\Windows\System\jeRasNy.exe
  C:\Windows\System\jeRasNy.exe
  2⤵
  PID:1804
- C:\Windows\System\ptsBlBr.exe
  C:\Windows\System\ptsBlBr.exe
  2⤵
  PID:3256
- C:\Windows\System\VxmsgFW.exe
  C:\Windows\System\VxmsgFW.exe
  2⤵
  PID:2340
- C:\Windows\System\pqvLQZe.exe
  C:\Windows\System\pqvLQZe.exe
  2⤵
  PID:13316
- C:\Windows\System\XyMFXYl.exe
  C:\Windows\System\XyMFXYl.exe
  2⤵
  PID:7624
- C:\Windows\System\tkufIEX.exe
  C:\Windows\System\tkufIEX.exe
  2⤵
  PID:2976
- C:\Windows\System\kdLjhHX.exe
  C:\Windows\System\kdLjhHX.exe
  2⤵
  PID:4544
- C:\Windows\System\NURBqns.exe
  C:\Windows\System\NURBqns.exe
  2⤵
  PID:5436
- C:\Windows\System\AOSQhHc.exe
  C:\Windows\System\AOSQhHc.exe
  2⤵
  PID:7448
- C:\Windows\System\gEUnXsc.exe
  C:\Windows\System\gEUnXsc.exe
  2⤵
  PID:3056
- C:\Windows\System\YazLljG.exe
  C:\Windows\System\YazLljG.exe
  2⤵
  PID:3128
- C:\Windows\System\DKfUiNJ.exe
  C:\Windows\System\DKfUiNJ.exe
  2⤵
  PID:1236
- C:\Windows\System\YAvHyDg.exe
  C:\Windows\System\YAvHyDg.exe
  2⤵
  PID:5492
- C:\Windows\System\TBLWTRy.exe
  C:\Windows\System\TBLWTRy.exe
  2⤵
  PID:4520
- C:\Windows\System\XCnpSSv.exe
  C:\Windows\System\XCnpSSv.exe
  2⤵
  PID:14256
- C:\Windows\System\iXIyPxk.exe
  C:\Windows\System\iXIyPxk.exe
  2⤵
  PID:5320
- C:\Windows\System\QavPxHd.exe
  C:\Windows\System\QavPxHd.exe
  2⤵
  PID:6052
- C:\Windows\System\pizRtUf.exe
  C:\Windows\System\pizRtUf.exe
  2⤵
  PID:13796
- C:\Windows\System\MKPnjgw.exe
  C:\Windows\System\MKPnjgw.exe
  2⤵
  PID:11288
- C:\Windows\System\ZiuAbKR.exe
  C:\Windows\System\ZiuAbKR.exe
  2⤵
  PID:4328
- C:\Windows\System\DEMuYFK.exe
  C:\Windows\System\DEMuYFK.exe
  2⤵
  PID:5948
- C:\Windows\System\flOrRwS.exe
  C:\Windows\System\flOrRwS.exe
  2⤵
  PID:3756
- C:\Windows\System\GpxUIJU.exe
  C:\Windows\System\GpxUIJU.exe
  2⤵
  PID:3260
- C:\Windows\System\uMLcrjC.exe
  C:\Windows\System\uMLcrjC.exe
  2⤵
  PID:7324
- C:\Windows\System\NXIcxXv.exe
  C:\Windows\System\NXIcxXv.exe
  2⤵
  PID:5128
- C:\Windows\System\ZBFjyue.exe
  C:\Windows\System\ZBFjyue.exe
  2⤵
  PID:10760
- C:\Windows\System\eXpqmyK.exe
  C:\Windows\System\eXpqmyK.exe
  2⤵
  PID:6124
- C:\Windows\System\GBLbiAY.exe
  C:\Windows\System\GBLbiAY.exe
  2⤵
  PID:5832
- C:\Windows\System\dJjNTCL.exe
  C:\Windows\System\dJjNTCL.exe
  2⤵
  PID:8176
- C:\Windows\System\LtuTUss.exe
  C:\Windows\System\LtuTUss.exe
  2⤵
  PID:5780
- C:\Windows\System\hlUZXys.exe
  C:\Windows\System\hlUZXys.exe
  2⤵
  PID:2128
- C:\Windows\System\Lnzlpyk.exe
  C:\Windows\System\Lnzlpyk.exe
  2⤵
  PID:5124
- C:\Windows\System\CRXIIdl.exe
  C:\Windows\System\CRXIIdl.exe
  2⤵
  PID:2960
- C:\Windows\System\aAfEgnZ.exe
  C:\Windows\System\aAfEgnZ.exe
  2⤵
  PID:7028
- C:\Windows\System\rWWBsEk.exe
  C:\Windows\System\rWWBsEk.exe
  2⤵
  PID:5844
- C:\Windows\System\LKSZCCV.exe
  C:\Windows\System\LKSZCCV.exe
  2⤵
  PID:6620
- C:\Windows\System\VcEMiRa.exe
  C:\Windows\System\VcEMiRa.exe
  2⤵
  PID:6976
- C:\Windows\System\jfrHLGT.exe
  C:\Windows\System\jfrHLGT.exe
  2⤵
  PID:8044
- C:\Windows\System\oPBxZHx.exe
  C:\Windows\System\oPBxZHx.exe
  2⤵
  PID:8100
- C:\Windows\System\wChspsZ.exe
  C:\Windows\System\wChspsZ.exe
  2⤵
  PID:8256
- C:\Windows\System\KKKDJNS.exe
  C:\Windows\System\KKKDJNS.exe
  2⤵
  PID:8260
- C:\Windows\System\prUjSex.exe
  C:\Windows\System\prUjSex.exe
  2⤵
  PID:8716
- C:\Windows\System\XQFSNCx.exe
  C:\Windows\System\XQFSNCx.exe
  2⤵
  PID:6500
- C:\Windows\System\mtZCNVs.exe
  C:\Windows\System\mtZCNVs.exe
  2⤵
  PID:6400
- C:\Windows\System\ScByEsa.exe
  C:\Windows\System\ScByEsa.exe
  2⤵
  PID:9060
- C:\Windows\System\UBkuiOd.exe
  C:\Windows\System\UBkuiOd.exe
  2⤵
  PID:5640
- C:\Windows\System\VTmzJZa.exe
  C:\Windows\System\VTmzJZa.exe
  2⤵
  PID:7184
- C:\Windows\System\zCKtGAO.exe
  C:\Windows\System\zCKtGAO.exe
  2⤵
  PID:1332
- C:\Windows\System\ftIltPZ.exe
  C:\Windows\System\ftIltPZ.exe
  2⤵
  PID:7856
- C:\Windows\System\lIAEPtT.exe
  C:\Windows\System\lIAEPtT.exe
  2⤵
  PID:4156
- C:\Windows\System\YeQTCid.exe
  C:\Windows\System\YeQTCid.exe
  2⤵
  PID:8488
- C:\Windows\System\XOiepeI.exe
  C:\Windows\System\XOiepeI.exe
  2⤵
  PID:9276
- C:\Windows\System\AbqOXyG.exe
  C:\Windows\System\AbqOXyG.exe
  2⤵
  PID:5904
- C:\Windows\System\erBhQNq.exe
  C:\Windows\System\erBhQNq.exe
  2⤵
  PID:8624
- C:\Windows\System\MVhdqPn.exe
  C:\Windows\System\MVhdqPn.exe
  2⤵
  PID:9548
- C:\Windows\System\OappqHP.exe
  C:\Windows\System\OappqHP.exe
  2⤵
  PID:6460
- C:\Windows\System\zXobqqD.exe
  C:\Windows\System\zXobqqD.exe
  2⤵
  PID:14260
- C:\Windows\System\pRrxEHf.exe
  C:\Windows\System\pRrxEHf.exe
  2⤵
  PID:9888
- C:\Windows\System\rWvaJSo.exe
  C:\Windows\System\rWvaJSo.exe
  2⤵
  PID:2076
- C:\Windows\System\BtwfVsZ.exe
  C:\Windows\System\BtwfVsZ.exe
  2⤵
  PID:10172
- C:\Windows\System\ZOSRHbI.exe
  C:\Windows\System\ZOSRHbI.exe
  2⤵
  PID:7960
- C:\Windows\System\OgnZpul.exe
  C:\Windows\System\OgnZpul.exe
  2⤵
  PID:13840
- C:\Windows\System\jAROeKx.exe
  C:\Windows\System\jAROeKx.exe
  2⤵
  PID:8396
- C:\Windows\System\RwcyJKf.exe
  C:\Windows\System\RwcyJKf.exe
  2⤵
  PID:7916
- C:\Windows\System\hlJoyBg.exe
  C:\Windows\System\hlJoyBg.exe
  2⤵
  PID:7128
- C:\Windows\System\gpfzcdR.exe
  C:\Windows\System\gpfzcdR.exe
  2⤵
  PID:5636
- C:\Windows\System\sNGvlVD.exe
  C:\Windows\System\sNGvlVD.exe
  2⤵
  PID:1624
- C:\Windows\System\UvUtnCR.exe
  C:\Windows\System\UvUtnCR.exe
  2⤵
  PID:3536
- C:\Windows\System\yxEVajv.exe
  C:\Windows\System\yxEVajv.exe
  2⤵
  PID:9732
- C:\Windows\System\JAPLycL.exe
  C:\Windows\System\JAPLycL.exe
  2⤵
  PID:1704
- C:\Windows\System\uQCtEGb.exe
  C:\Windows\System\uQCtEGb.exe
  2⤵
  PID:10684
- C:\Windows\System\FQKsxnT.exe
  C:\Windows\System\FQKsxnT.exe
  2⤵
  PID:10764
- C:\Windows\System\OmIyXbh.exe
  C:\Windows\System\OmIyXbh.exe
  2⤵
  PID:10168
- C:\Windows\System\WDPOtqu.exe
  C:\Windows\System\WDPOtqu.exe
  2⤵
  PID:9092
- C:\Windows\System\VkayNFQ.exe
  C:\Windows\System\VkayNFQ.exe
  2⤵
  PID:8016
- C:\Windows\System\dKSklZU.exe
  C:\Windows\System\dKSklZU.exe
  2⤵
  PID:11756
- C:\Windows\System\VEJknSp.exe
  C:\Windows\System\VEJknSp.exe
  2⤵
  PID:13792
- C:\Windows\System\bOfNwGb.exe
  C:\Windows\System\bOfNwGb.exe
  2⤵
  PID:6028
- C:\Windows\System\tKxuOtA.exe
  C:\Windows\System\tKxuOtA.exe
  2⤵
  PID:7800
- C:\Windows\System\seaUkDP.exe
  C:\Windows\System\seaUkDP.exe
  2⤵
  PID:5788
- C:\Windows\System\AwUZSkg.exe
  C:\Windows\System\AwUZSkg.exe
  2⤵
  PID:9556
- C:\Windows\System\cukMsDd.exe
  C:\Windows\System\cukMsDd.exe
  2⤵
  PID:10328
- C:\Windows\System\WLeRcQE.exe
  C:\Windows\System\WLeRcQE.exe
  2⤵
  PID:8304
- C:\Windows\System\EAnhvXF.exe
  C:\Windows\System\EAnhvXF.exe
  2⤵
  PID:8120
- C:\Windows\System\TLxQleg.exe
  C:\Windows\System\TLxQleg.exe
  2⤵
  PID:3816
- C:\Windows\System\uNJSFco.exe
  C:\Windows\System\uNJSFco.exe
  2⤵
  PID:2276
- C:\Windows\System\mnCWZBK.exe
  C:\Windows\System\mnCWZBK.exe
  2⤵
  PID:9364
- C:\Windows\System\ZlStNOT.exe
  C:\Windows\System\ZlStNOT.exe
  2⤵
  PID:12424
- C:\Windows\System\FHwYvkn.exe
  C:\Windows\System\FHwYvkn.exe
  2⤵
  PID:12512
- C:\Windows\System\CvKLAxm.exe
  C:\Windows\System\CvKLAxm.exe
  2⤵
  PID:8600
- C:\Windows\System\yquoZoS.exe
  C:\Windows\System\yquoZoS.exe
  2⤵
  PID:1696
- C:\Windows\System\PobYcBJ.exe
  C:\Windows\System\PobYcBJ.exe
  2⤵
  PID:12844
- C:\Windows\System\NVnpYUr.exe
  C:\Windows\System\NVnpYUr.exe
  2⤵
  PID:8752
- C:\Windows\System\pNoEXWG.exe
  C:\Windows\System\pNoEXWG.exe
  2⤵
  PID:7428
- C:\Windows\System\YDKCBtO.exe
  C:\Windows\System\YDKCBtO.exe
  2⤵
  PID:8948
- C:\Windows\System\YPUXCDa.exe
  C:\Windows\System\YPUXCDa.exe
  2⤵
  PID:4212
- C:\Windows\System\FCoJeNI.exe
  C:\Windows\System\FCoJeNI.exe
  2⤵
  PID:7348
- C:\Windows\System\LHyMtzl.exe
  C:\Windows\System\LHyMtzl.exe
  2⤵
  PID:11588
- C:\Windows\System\WmqervC.exe
  C:\Windows\System\WmqervC.exe
  2⤵
  PID:6872
- C:\Windows\System\pXCPppo.exe
  C:\Windows\System\pXCPppo.exe
  2⤵
  PID:8020
- C:\Windows\System\IFLmHSM.exe
  C:\Windows\System\IFLmHSM.exe
  2⤵
  PID:9788
- C:\Windows\System\jyqfBWZ.exe
  C:\Windows\System\jyqfBWZ.exe
  2⤵
  PID:6360
- C:\Windows\System\zFJHSmX.exe
  C:\Windows\System\zFJHSmX.exe
  2⤵
  PID:9768
- C:\Windows\System\TuTSbxC.exe
  C:\Windows\System\TuTSbxC.exe
  2⤵
  PID:8868
- C:\Windows\System\bvuioWy.exe
  C:\Windows\System\bvuioWy.exe
  2⤵
  PID:10228
- C:\Windows\System\LiJvdFy.exe
  C:\Windows\System\LiJvdFy.exe
  2⤵
  PID:7156
- C:\Windows\System\jOFJFpx.exe
  C:\Windows\System\jOFJFpx.exe
  2⤵
  PID:5336
- C:\Windows\System\WcARKBp.exe
  C:\Windows\System\WcARKBp.exe
  2⤵
  PID:4956
- C:\Windows\System\agBEVLy.exe
  C:\Windows\System\agBEVLy.exe
  2⤵
  PID:13160
- C:\Windows\System\VjMHZhC.exe
  C:\Windows\System\VjMHZhC.exe
  2⤵
  PID:11472
- C:\Windows\System\jLeOiGH.exe
  C:\Windows\System\jLeOiGH.exe
  2⤵
  PID:8008
- C:\Windows\System\COYxZQh.exe
  C:\Windows\System\COYxZQh.exe
  2⤵
  PID:5140
- C:\Windows\System\AJKrBTF.exe
  C:\Windows\System\AJKrBTF.exe
  2⤵
  PID:11976
- C:\Windows\System\GvqyZbK.exe
  C:\Windows\System\GvqyZbK.exe
  2⤵
  PID:8216
- C:\Windows\System\jxKnNpB.exe
  C:\Windows\System\jxKnNpB.exe
  2⤵
  PID:10384
- C:\Windows\System\HgVwKlX.exe
  C:\Windows\System\HgVwKlX.exe
  2⤵
  PID:3232
- C:\Windows\System\xTChupZ.exe
  C:\Windows\System\xTChupZ.exe
  2⤵
  PID:10640
- C:\Windows\System\vTuFAIK.exe
  C:\Windows\System\vTuFAIK.exe
  2⤵
  PID:10108
- C:\Windows\System\pduXSHy.exe
  C:\Windows\System\pduXSHy.exe
  2⤵
  PID:8336
- C:\Windows\System\bLhOvia.exe
  C:\Windows\System\bLhOvia.exe
  2⤵
  PID:10660
- C:\Windows\System\TjGsxKK.exe
  C:\Windows\System\TjGsxKK.exe
  2⤵
  PID:8524
- C:\Windows\System\FDiWWwq.exe
  C:\Windows\System\FDiWWwq.exe
  2⤵
  PID:11984
- C:\Windows\System\GZpYMMi.exe
  C:\Windows\System\GZpYMMi.exe
  2⤵
  PID:9344
- C:\Windows\System\wClSigz.exe
  C:\Windows\System\wClSigz.exe
  2⤵
  PID:12548
- C:\Windows\System\UmHWIFG.exe
  C:\Windows\System\UmHWIFG.exe
  2⤵
  PID:368
- C:\Windows\System\MiswuMz.exe
  C:\Windows\System\MiswuMz.exe
  2⤵
  PID:11216
- C:\Windows\System\yqFMRWL.exe
  C:\Windows\System\yqFMRWL.exe
  2⤵
  PID:6428
- C:\Windows\System\wqEyoKu.exe
  C:\Windows\System\wqEyoKu.exe
  2⤵
  PID:9696
- C:\Windows\System\mFSZXcQ.exe
  C:\Windows\System\mFSZXcQ.exe
  2⤵
  PID:6664
- C:\Windows\System\iSqqsEu.exe
  C:\Windows\System\iSqqsEu.exe
  2⤵
  PID:12944
- C:\Windows\System\dftaemt.exe
  C:\Windows\System\dftaemt.exe
  2⤵
  PID:4040
- C:\Windows\System\aQqgfab.exe
  C:\Windows\System\aQqgfab.exe
  2⤵
  PID:10052
- C:\Windows\System\roecxiV.exe
  C:\Windows\System\roecxiV.exe
  2⤵
  PID:9852
- C:\Windows\System\TeHvvtj.exe
  C:\Windows\System\TeHvvtj.exe
  2⤵
  PID:4740
- C:\Windows\System\PJGCAsO.exe
  C:\Windows\System\PJGCAsO.exe
  2⤵
  PID:7656
- C:\Windows\System\bYtiTwy.exe
  C:\Windows\System\bYtiTwy.exe
  2⤵
  PID:3868
- C:\Windows\System\CvOrAmN.exe
  C:\Windows\System\CvOrAmN.exe
  2⤵
  PID:11636
- C:\Windows\System\Lunrhbi.exe
  C:\Windows\System\Lunrhbi.exe
  2⤵
  PID:11152
- C:\Windows\System\tWHJply.exe
  C:\Windows\System\tWHJply.exe
  2⤵
  PID:11092
- C:\Windows\System\gLOihEu.exe
  C:\Windows\System\gLOihEu.exe
  2⤵
  PID:6792
- C:\Windows\System\MvZGtic.exe
  C:\Windows\System\MvZGtic.exe
  2⤵
  PID:7636
- C:\Windows\System\NeqwdYo.exe
  C:\Windows\System\NeqwdYo.exe
  2⤵
  PID:12460
- C:\Windows\System\rbgWkDA.exe
  C:\Windows\System\rbgWkDA.exe
  2⤵
  PID:10580
- C:\Windows\System\LTrqNVq.exe
  C:\Windows\System\LTrqNVq.exe
  2⤵
  PID:1448
- C:\Windows\System\bmySMUy.exe
  C:\Windows\System\bmySMUy.exe
  2⤵
  PID:11788
- C:\Windows\System\GrWuNdC.exe
  C:\Windows\System\GrWuNdC.exe
  2⤵
  PID:12216
- C:\Windows\System\eLoMttp.exe
  C:\Windows\System\eLoMttp.exe
  2⤵
  PID:6920
- C:\Windows\System\jzlQcvz.exe
  C:\Windows\System\jzlQcvz.exe
  2⤵
  PID:12592
- C:\Windows\System\BNkapkT.exe
  C:\Windows\System\BNkapkT.exe
  2⤵
  PID:8508
- C:\Windows\System\qYTtNYa.exe
  C:\Windows\System\qYTtNYa.exe
  2⤵
  PID:12192
- C:\Windows\System\slvTAYG.exe
  C:\Windows\System\slvTAYG.exe
  2⤵
  PID:13924
- C:\Windows\System\xKSDKrB.exe
  C:\Windows\System\xKSDKrB.exe
  2⤵
  PID:9336
- C:\Windows\System\VzAOjlh.exe
  C:\Windows\System\VzAOjlh.exe
  2⤵
  PID:7088
- C:\Windows\System\DSslnUV.exe
  C:\Windows\System\DSslnUV.exe
  2⤵
  PID:12124
- C:\Windows\System\osNWkrb.exe
  C:\Windows\System\osNWkrb.exe
  2⤵
  PID:12420
- C:\Windows\System\DrEybkZ.exe
  C:\Windows\System\DrEybkZ.exe
  2⤵
  PID:9308
- C:\Windows\System\adNGIfc.exe
  C:\Windows\System\adNGIfc.exe
  2⤵
  PID:10676
- C:\Windows\System\wpLhmHY.exe
  C:\Windows\System\wpLhmHY.exe
  2⤵
  PID:11368
- C:\Windows\System\rlURoiv.exe
  C:\Windows\System\rlURoiv.exe
  2⤵
  PID:9580
- C:\Windows\System\TfUVjiN.exe
  C:\Windows\System\TfUVjiN.exe
  2⤵
  PID:11980
- C:\Windows\System\ABdcxTx.exe
  C:\Windows\System\ABdcxTx.exe
  2⤵
  PID:8312
- C:\Windows\System\TvZXhiv.exe
  C:\Windows\System\TvZXhiv.exe
  2⤵
  PID:10212
- C:\Windows\System\rOEfdrA.exe
  C:\Windows\System\rOEfdrA.exe
  2⤵
  PID:13076
- C:\Windows\System\PmqcyrN.exe
  C:\Windows\System\PmqcyrN.exe
  2⤵
  PID:10136
- C:\Windows\System\VhRAQUa.exe
  C:\Windows\System\VhRAQUa.exe
  2⤵
  PID:8104
- C:\Windows\System\XnrUufv.exe
  C:\Windows\System\XnrUufv.exe
  2⤵
  PID:12436
- C:\Windows\System\qghGVsj.exe
  C:\Windows\System\qghGVsj.exe
  2⤵
  PID:6208
- C:\Windows\System\rFsJGmg.exe
  C:\Windows\System\rFsJGmg.exe
  2⤵
  PID:8244
- C:\Windows\System\gtTkZTJ.exe
  C:\Windows\System\gtTkZTJ.exe
  2⤵
  PID:10364
- C:\Windows\System\QqjxOfN.exe
  C:\Windows\System\QqjxOfN.exe
  2⤵
  PID:9220
- C:\Windows\System\Nfooxxi.exe
  C:\Windows\System\Nfooxxi.exe
  2⤵
  PID:12628
- C:\Windows\System\PvIeSXI.exe
  C:\Windows\System\PvIeSXI.exe
  2⤵
  PID:8196
- C:\Windows\System\XmDZenm.exe
  C:\Windows\System\XmDZenm.exe
  2⤵
  PID:12680
- C:\Windows\System\bRCooOM.exe
  C:\Windows\System\bRCooOM.exe
  2⤵
  PID:12324
- C:\Windows\System\VNfDZhu.exe
  C:\Windows\System\VNfDZhu.exe
  2⤵
  PID:9600
- C:\Windows\System\eygZMRh.exe
  C:\Windows\System\eygZMRh.exe
  2⤵
  PID:12784
- C:\Windows\System\NGlrDvR.exe
  C:\Windows\System\NGlrDvR.exe
  2⤵
  PID:11008
- C:\Windows\System\GjFfdhY.exe
  C:\Windows\System\GjFfdhY.exe
  2⤵
  PID:12676
- C:\Windows\System\riLooBn.exe
  C:\Windows\System\riLooBn.exe
  2⤵
  PID:13044
- C:\Windows\System\ivhcIKZ.exe
  C:\Windows\System\ivhcIKZ.exe
  2⤵
  PID:9056
- C:\Windows\System\ADFpIqQ.exe
  C:\Windows\System\ADFpIqQ.exe
  2⤵
  PID:13620
- C:\Windows\System\jZRIgBz.exe
  C:\Windows\System\jZRIgBz.exe
  2⤵
  PID:10296
- C:\Windows\System\hbbHkNE.exe
  C:\Windows\System\hbbHkNE.exe
  2⤵
  PID:13428
- C:\Windows\System\afDYprW.exe
  C:\Windows\System\afDYprW.exe
  2⤵
  PID:13680
- C:\Windows\System\KoxrRgw.exe
  C:\Windows\System\KoxrRgw.exe
  2⤵
  PID:7752
- C:\Windows\System\ynTVyoE.exe
  C:\Windows\System\ynTVyoE.exe
  2⤵
  PID:11948
- C:\Windows\System\zraSuAJ.exe
  C:\Windows\System\zraSuAJ.exe
  2⤵
  PID:10392
- C:\Windows\System\CPiAHjU.exe
  C:\Windows\System\CPiAHjU.exe
  2⤵
  PID:13972
- C:\Windows\System\MGOCAVQ.exe
  C:\Windows\System\MGOCAVQ.exe
  2⤵
  PID:7232
- C:\Windows\System\cHvvTuS.exe
  C:\Windows\System\cHvvTuS.exe
  2⤵
  PID:404
- C:\Windows\System\dAaJZxe.exe
  C:\Windows\System\dAaJZxe.exe
  2⤵
  PID:12224
- C:\Windows\System\DjXyDTM.exe
  C:\Windows\System\DjXyDTM.exe
  2⤵
  PID:10500
- C:\Windows\System\PaEbECz.exe
  C:\Windows\System\PaEbECz.exe
  2⤵
  PID:4668
- C:\Windows\System\YcxLWbN.exe
  C:\Windows\System\YcxLWbN.exe
  2⤵
  PID:11112
- C:\Windows\System\bUydiAb.exe
  C:\Windows\System\bUydiAb.exe
  2⤵
  PID:4752
- C:\Windows\System\wfsWBCv.exe
  C:\Windows\System\wfsWBCv.exe
  2⤵
  PID:9248
- C:\Windows\System\tNPknzf.exe
  C:\Windows\System\tNPknzf.exe
  2⤵
  PID:10408
- C:\Windows\System\LjWQIiT.exe
  C:\Windows\System\LjWQIiT.exe
  2⤵
  PID:13532
- C:\Windows\System\nzmQytT.exe
  C:\Windows\System\nzmQytT.exe
  2⤵
  PID:10948
- C:\Windows\System\eLHtSaz.exe
  C:\Windows\System\eLHtSaz.exe
  2⤵
  PID:5228
- C:\Windows\System\jhZJNZv.exe
  C:\Windows\System\jhZJNZv.exe
  2⤵
  PID:10996
- C:\Windows\System\BDTeLTs.exe
  C:\Windows\System\BDTeLTs.exe
  2⤵
  PID:11132
- C:\Windows\System\mirQpSe.exe
  C:\Windows\System\mirQpSe.exe
  2⤵
  PID:12736
- C:\Windows\System\ORCGYCy.exe
  C:\Windows\System\ORCGYCy.exe
  2⤵
  PID:11816
- C:\Windows\System\YVBDtrW.exe
  C:\Windows\System\YVBDtrW.exe
  2⤵
  PID:11820
- C:\Windows\System\wEgUavO.exe
  C:\Windows\System\wEgUavO.exe
  2⤵
  PID:12952
- C:\Windows\System\tNzYcsS.exe
  C:\Windows\System\tNzYcsS.exe
  2⤵
  PID:9836
- C:\Windows\System\wAXIyNq.exe
  C:\Windows\System\wAXIyNq.exe
  2⤵
  PID:12920
- C:\Windows\System\JiNKUne.exe
  C:\Windows\System\JiNKUne.exe
  2⤵
  PID:11480
- C:\Windows\System\cKFeILF.exe
  C:\Windows\System\cKFeILF.exe
  2⤵
  PID:11392
- C:\Windows\System\LWgbBgX.exe
  C:\Windows\System\LWgbBgX.exe
  2⤵
  PID:8712
- C:\Windows\System\KzjtzKM.exe
  C:\Windows\System\KzjtzKM.exe
  2⤵
  PID:12160
- C:\Windows\System\tqCcNjn.exe
  C:\Windows\System\tqCcNjn.exe
  2⤵
  PID:12116
- C:\Windows\System\wazdNhw.exe
  C:\Windows\System\wazdNhw.exe
  2⤵
  PID:6456
- C:\Windows\System\LxUeJyJ.exe
  C:\Windows\System\LxUeJyJ.exe
  2⤵
  PID:7600
- C:\Windows\System\uKqxvUP.exe
  C:\Windows\System\uKqxvUP.exe
  2⤵
  PID:13248
- C:\Windows\System\oMJygiq.exe
  C:\Windows\System\oMJygiq.exe
  2⤵
  PID:12900
- C:\Windows\System\TmTqUKG.exe
  C:\Windows\System\TmTqUKG.exe
  2⤵
  PID:11372
- C:\Windows\System\nlvlarl.exe
  C:\Windows\System\nlvlarl.exe
  2⤵
  PID:12696
- C:\Windows\System\DTVzTrb.exe
  C:\Windows\System\DTVzTrb.exe
  2⤵
  PID:11160
- C:\Windows\System\ZsaWMjh.exe
  C:\Windows\System\ZsaWMjh.exe
  2⤵
  PID:12220
- C:\Windows\System\cvmvJIj.exe
  C:\Windows\System\cvmvJIj.exe
  2⤵
  PID:7180
- C:\Windows\System\eIsrJjS.exe
  C:\Windows\System\eIsrJjS.exe
  2⤵
  PID:7768
- C:\Windows\System\IaejvSQ.exe
  C:\Windows\System\IaejvSQ.exe
  2⤵
  PID:12488
- C:\Windows\System\TNnKJdF.exe
  C:\Windows\System\TNnKJdF.exe
  2⤵
  PID:11808
- C:\Windows\System\jnJjRcU.exe
  C:\Windows\System\jnJjRcU.exe
  2⤵
  PID:10728
- C:\Windows\System\uBJgQXP.exe
  C:\Windows\System\uBJgQXP.exe
  2⤵
  PID:8980
- C:\Windows\System\VtOHsLh.exe
  C:\Windows\System\VtOHsLh.exe
  2⤵
  PID:13788
- C:\Windows\System\wkyaYQN.exe
  C:\Windows\System\wkyaYQN.exe
  2⤵
  PID:9664
- C:\Windows\System\icHwCii.exe
  C:\Windows\System\icHwCii.exe
  2⤵
  PID:10264
- C:\Windows\System\MMNAOJG.exe
  C:\Windows\System\MMNAOJG.exe
  2⤵
  PID:13016
- C:\Windows\System\tgrMDFW.exe
  C:\Windows\System\tgrMDFW.exe
  2⤵
  PID:10688
- C:\Windows\System\APgbwvj.exe
  C:\Windows\System\APgbwvj.exe
  2⤵
  PID:12616
- C:\Windows\System\JIOhMpH.exe
  C:\Windows\System\JIOhMpH.exe
  2⤵
  PID:7484
- C:\Windows\System\lHRAFOw.exe
  C:\Windows\System\lHRAFOw.exe
  2⤵
  PID:6972
- C:\Windows\System\SYslnBe.exe
  C:\Windows\System\SYslnBe.exe
  2⤵
  PID:8884
- C:\Windows\System\nszfPEE.exe
  C:\Windows\System\nszfPEE.exe
  2⤵
  PID:9224
- C:\Windows\System\nJLqTjC.exe
  C:\Windows\System\nJLqTjC.exe
  2⤵
  PID:4868
- C:\Windows\System\TsQOtcw.exe
  C:\Windows\System\TsQOtcw.exe
  2⤵
  PID:9812
- C:\Windows\System\QIDBeHh.exe
  C:\Windows\System\QIDBeHh.exe
  2⤵
  PID:13580
- C:\Windows\System\pIIJeFK.exe
  C:\Windows\System\pIIJeFK.exe
  2⤵
  PID:6440
- C:\Windows\System\aoQeWas.exe
  C:\Windows\System\aoQeWas.exe
  2⤵
  PID:13772
- C:\Windows\System\CDmymax.exe
  C:\Windows\System\CDmymax.exe
  2⤵
  PID:12228
- C:\Windows\System\lUWmcLJ.exe
  C:\Windows\System\lUWmcLJ.exe
  2⤵
  PID:728
- C:\Windows\System\oOKxiUw.exe
  C:\Windows\System\oOKxiUw.exe
  2⤵
  PID:7812
- C:\Windows\System\EjecMHs.exe
  C:\Windows\System\EjecMHs.exe
  2⤵
  PID:9204
- C:\Windows\System\itVpTzU.exe
  C:\Windows\System\itVpTzU.exe
  2⤵
  PID:5416
- C:\Windows\System\WSgmBxf.exe
  C:\Windows\System\WSgmBxf.exe
  2⤵
  PID:13864
- C:\Windows\System\BapcXKQ.exe
  C:\Windows\System\BapcXKQ.exe
  2⤵
  PID:2400
- C:\Windows\System\ufYfIgh.exe
  C:\Windows\System\ufYfIgh.exe
  2⤵
  PID:14148
- C:\Windows\System\pXBBtcJ.exe
  C:\Windows\System\pXBBtcJ.exe
  2⤵
  PID:13956
- C:\Windows\System\YKHLDpY.exe
  C:\Windows\System\YKHLDpY.exe
  2⤵
  PID:13180
- C:\Windows\System\iwZzTJk.exe
  C:\Windows\System\iwZzTJk.exe
  2⤵
  PID:3160
- C:\Windows\System\Jvgvryx.exe
  C:\Windows\System\Jvgvryx.exe
  2⤵
  PID:5152
- C:\Windows\System\TsAbigd.exe
  C:\Windows\System\TsAbigd.exe
  2⤵
  PID:12792
- C:\Windows\System\RPgaJKo.exe
  C:\Windows\System\RPgaJKo.exe
  2⤵
  PID:12860
- C:\Windows\System\jVOAUks.exe
  C:\Windows\System\jVOAUks.exe
  2⤵
  PID:6512
- C:\Windows\System\SweDWIT.exe
  C:\Windows\System\SweDWIT.exe
  2⤵
  PID:1924
- C:\Windows\System\OtaUqAK.exe
  C:\Windows\System\OtaUqAK.exe
  2⤵
  PID:8972
- C:\Windows\System\CvneIEa.exe
  C:\Windows\System\CvneIEa.exe
  2⤵
  PID:7496
- C:\Windows\System\oaTwFiS.exe
  C:\Windows\System\oaTwFiS.exe
  2⤵
  PID:7084
- C:\Windows\System\YPfFRSo.exe
  C:\Windows\System\YPfFRSo.exe
  2⤵
  PID:13144
- C:\Windows\System\firtyan.exe
  C:\Windows\System\firtyan.exe
  2⤵
  PID:9508

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14264

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqz2sc0s.iu1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOzDMrU.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\CNoqOFR.exe

Filesize
1.9MB

MD5
e71c0c03cc9c1f9c6bf2a06482e65882

SHA1
25f0f5d011cad652d4ae3f0a78621980f07bb0c3

SHA256
5205292378666d9df2c89f6c46cb06e5fd7d87344e8665fc11a11a0284115b48

SHA512
faf72f099cfd88c76a94358c8da2958438921bad9300809f48e0fa7b6a26bd98e57790c1adb63ddd4d15232d355900a876ec5d417c00bcdd451c19bc7150eefa

Download Submit
C:\Windows\System\ILLtpLN.exe

Filesize
1.9MB

MD5
f7db545d94f3ed5e1b621bec1aaa3648

SHA1
d3b473141d59415e48cb492fc07ed1eb00247301

SHA256
8ad4cc5c99c7faad45372e8b093a3fd54716055461a3596b43df976476869292

SHA512
bf77fec68fcffc307c70824dba0fe1911d4e2972c076e69dce2bdd7160a78eac716d69c49611f98ef6d1e9a0fbdbd40bcaafc93aa462cf6c07cda28e23b0f575

Download Submit
C:\Windows\System\JCEHQWB.exe

Filesize
1.9MB

MD5
e72bd0e7c1e47d3260953cb8c7c3a3da

SHA1
f0a7c310d2217d14dfe4ab1cec3150cb28e7ac33

SHA256
841705fda707f4ce40bbb8be89dac1df7dadd660271fe315a91d8dfc94fbee4f

SHA512
f73f299bd0d68a32d4b365c304eff5f75592a8d3bb550ce1ed55ae16a91a720a24ee7a5c45937824a34a3f69660df0e5f650c8279f8de0678aed17cfc41c3231

Download Submit
C:\Windows\System\JVbVbgW.exe

Filesize
1.9MB

MD5
90616feaa526cff593a0aa2e0ea5ff0c

SHA1
ff4e19465f51e66c355ddeeccc9b5080c7057490

SHA256
4eed4ce170836c84e02a55de3149022434e0e7d9d552116ebc0b977b3c139f1a

SHA512
9b8972792d0649ca9eb2103c517f016ec4a562dbaefd7973415befbea464c9e6b434d7a3a080ab69eb4a5f00bad663ded8d5c0132b19f771fd24f2b922c121a4

Download Submit
C:\Windows\System\KNbydGF.exe

Filesize
1.9MB

MD5
4573fceafdfdbbf6eeca6a986c5f35ac

SHA1
e5af7df1bce81a8e2d7d1292472e0acbe2fb39c8

SHA256
27f94b7c45368c559512dafe408072a4b51c72de788a5f864ee717cd11d4f7af

SHA512
e533437c64b89d32580c1b978c6599e0ed3d77967322c1e098954a631ca841f15c4505d99d1715b0e88c9557e4e015b9f6944c72a4489bf065005ee2d83d0a72

Download Submit
C:\Windows\System\KnXzzxS.exe

Filesize
1.9MB

MD5
27749682606195ed2a824c1e267cb6e0

SHA1
fea523f51f9bf34d72fcdfe292c3edf2dc883b05

SHA256
4e40a1b9e45f7c0a46033b72ca1d91f14a95264c3f2530a0d1981d86828d471c

SHA512
54f7c32708e649ded7532af063aed90ac27b7b2ba4d031adc092e4481015511b0a5f928091eeeb104bfdc637121ca60d33fa26e9eebaaa5cfde31f0813c9b9a6

Download Submit
C:\Windows\System\NsgccdZ.exe

Filesize
1.9MB

MD5
631744289052fd410108e960582fa1a5

SHA1
a1f855ccd1ed5493276f6a9e763e30e6c6e80ba2

SHA256
747df218d3bd16fa7a5001662bde59c0e1726190080cd4d6161a5d044c896cbf

SHA512
4efd6ce475dfb7bb1494fc639f7dbbf8d75b7a4107e3d53800fbbfc1409358d9f1dcf98aff36e525874e3027dda56d8ce4fc82fce6c7cefc5bbfa70c1b8c00c8

Download Submit
C:\Windows\System\OJGcVTO.exe

Filesize
1.9MB

MD5
4feae063dd106e9c40848ddd174351ad

SHA1
d74b01344818df4deed90753524cb3e6ee69a104

SHA256
4a24e8c29c10d6a5ed764893100d7fddda5852ba6600f04083b8ee9fdb1c75c1

SHA512
3cd0fc8029e127d581f4b36dc0847e08107e811a8217a63e92570e048e1584ec9dd56212c46264cb3b0f16ea21e8c6935c36cd7481cc66651be2bc9a4e849c7e

Download Submit
C:\Windows\System\PGmEZCE.exe

Filesize
1.9MB

MD5
0dcf21023937e0dc093d86a63c0a82c3

SHA1
dafea9dcd5f53c714d4b99c55a29750dc04154eb

SHA256
7bfb758db59c4cbe05fac5eca634a17cbe407b96f022bea3a679e545b2acb273

SHA512
fcdd38ca8635c4144a96ca02f988ea3c4b65b27980c5040256676a0d0e010219f96e4eb348448c820aedfa129e2ee34f882a3b2c25b5e160d729030cb8b5de55

Download Submit
C:\Windows\System\RzjMWTt.exe

Filesize
1.9MB

MD5
981417cc6b80381f126ffd4ce2eba928

SHA1
59e03b229d6510a43b4d24ac481861f43452b578

SHA256
65658be848b59a5b190d7d00a12da4b5fcddd3378cedc700b9322a646ea192fc

SHA512
d9175d39a64224607c104c055553dbacbd42acb56c8972f2c71e39ce02d2c0f9220332f78ec813d194eac285dd264af2fa62437ae529d1021b347cd864db801a

Download Submit
C:\Windows\System\SkYGeOY.exe

Filesize
1.9MB

MD5
bc6c2717a7ffc9360f952ccb0c79c92d

SHA1
864a792063f6522155d331a8f8795e64c26269ee

SHA256
dc3d4aa61d91a0a1d11e31ec3359816efdb37c78045e0e6755452f11dfa2fd07

SHA512
e05ff8631f6b9f7118bcc03e1fefa86abc4c1f6039aef9e240d85d46b23ecc82ef4e0342b567fb04f35c29b5c7141332c1e40343a59998173f40883e7b50f441

Download Submit
C:\Windows\System\VDgXNtd.exe

Filesize
1.9MB

MD5
bb7f8e0f4a14c98f1ff4537c5a41352d

SHA1
bfa7ea7cba735a589337e6b439877c1a7ec5fedd

SHA256
f84fa4bf64b234f8216664455b278c3f51e9b2f83dd59a6d795a10afb71e3913

SHA512
b14c4500c38d40491d89a9050ce6f8b84e071e2264e49762d9e565110bfa96936830d2b86ad0144d03c7d72b28bfd1de0a55967eea5066329fb59967c6f4fab9

Download Submit
C:\Windows\System\VemKbGJ.exe

Filesize
1.9MB

MD5
255de445024cee9ca5d276e29ea3d5b4

SHA1
8f09bb308609c156f9dc9570c080c1998f82e26f

SHA256
8c0fcae80f52cf7230c405eca348acf8259c6957e9300d7b1b1a8f28700da5cc

SHA512
f963eff5bd3aa43300d98bf5ee4b5fd99dd0113ec2f3f9dc69f52121c617f67077adceb161fccad3d89e24ba12e5ae6e521a88c31931834305bf0d635eb40c5e

Download Submit
C:\Windows\System\WSIGjSl.exe

Filesize
1.9MB

MD5
fd5fc1921208c626b1be0887dc49e98e

SHA1
2a733d1e499064f0fa372f7aea9e3dbd1b2ee44f

SHA256
cb1e6f974c4cb088f58c941bc1b5c47192e48109dd5ead1fb6a6a00fe3abff03

SHA512
a8fc224a7720132a569bec7bdafa819db6e73b2031d7bd9978cc4ed01c0ad40822fc34a2d1603e82f2acf55c71703878c0cd61acfb0ab7d58721374c682f13ad

Download Submit
C:\Windows\System\ZXJjvqc.exe

Filesize
1.9MB

MD5
9dc2de57d246d92283a270bc1e20cbaa

SHA1
9163674f1cb8bf92338c198027c4ac1350dc0f1e

SHA256
c5d163df64db0e5e787678937fa63952dff95d9526c95410e9b41394e5940cb2

SHA512
79dbe5e4c712b2ccf68afd2fd1101b3e5cd10ad4b33f338f71dcfd3c91606f7efac8b08500f96165efce48ebf4597d8b8ef0eb6079febc42d86eb42e556b4c95

Download Submit
C:\Windows\System\ZqwAKUe.exe

Filesize
1.9MB

MD5
7bdc6b6e5da6f0ecd3965d45798d2279

SHA1
4f1943b97ae440419a2d03ef2f2642b7a82802b7

SHA256
8f68a1ba4b1cea477be189bcbff567b3021ba4ca23eb435a2f4e1a1189c8b6d1

SHA512
e2bb01699bc4f2a5a595390edc44fa6bba336f8495180fc1107d7a3cfcf0c9b9a95d84e35216aa3b01a4466009afd54774cab0965a714c4237ac94c64fef4957

Download Submit
C:\Windows\System\aRuhEcb.exe

Filesize
1.9MB

MD5
e8793abb4d17949f3989b9dc604b2d46

SHA1
0ecedeae22aea205df1469272ebb12c6b7e2f385

SHA256
2038050d404643cf5cc66a385a634047d08bf318216bd595beba89f120a836cf

SHA512
c021129c0567c2a614893454c14151280c11d793967c3beeb391465f421bd02c45a4f60136a5d38c188939ad88370deda7b9069664525856cf2edd8b06bf231c

Download Submit
C:\Windows\System\cRTHUks.exe

Filesize
1.9MB

MD5
e67c3179f451fdfafce22a17b7201fa1

SHA1
b60ee7abba5380c95bf8df06824897cc79f72537

SHA256
ceb50125ea974a33aafa27bb4e9dbe45f7fa60d7c50c48d4351430988a3cd7d1

SHA512
15c29d70e415d11ce609232b8befefa2fed747c24946459b41ac2c0a2f1bf0258a6ef010b5b37bc700f07268da304c25aaedbf7c135cd79a322a0b5ff9e8b912

Download Submit
C:\Windows\System\dkcQsat.exe

Filesize
1.9MB

MD5
54b328941c71077b869790a69ddb4da3

SHA1
d2f4648a9564af1bf07157058d149ddbe8e49ff1

SHA256
ccb2f3021ad8f3222aa04e1d5e19737a91a10f6f40fef9ddf9f9a435b5a0c60a

SHA512
dc82952bb08a4841c12586196ff7660a6ac5fe899ac886f374dcc5e3aa4632df82cedba9311ee3d5ae21cb3b18cb8926263f5edbd8f520e9a31e94e284ae6820

Download Submit
C:\Windows\System\eWnkbgw.exe

Filesize
1.9MB

MD5
486b6c79c91f0baf99f965fe5bd34ebe

SHA1
0b0ee54c45143904b40e94324cc6843eb59fd332

SHA256
54716209cffdc8ce0d406d6cc37a05955a05704c33af20535203625824145291

SHA512
4e508e64970f46726fe15437fa1661abe7b8f5ba028cf0cba2f144037d9cd59a0cd8fdc6925d3351856f8f072843e0ed28244a181db25e79e4c4e2d6afbf27c4

Download Submit
C:\Windows\System\ekWSlbk.exe

Filesize
1.9MB

MD5
dc2319f494f4c9562387f4d53a1adf9d

SHA1
27972db7aba42e120bbaa717d0ed4c5755f9918a

SHA256
723b9837769469aace6a89669c1638933cce646c567128ae3971ac34016aab25

SHA512
bbd6f75f9a18e54588d5d30e62ab768f9b896c67f39331b3fa71aa6345d750dac76679e2d6aeb40810af00e08d856a1be9cdc882c47848d7f8798a8390933bd5

Download Submit
C:\Windows\System\gwxjpJN.exe

Filesize
1.9MB

MD5
88652498570c54deffdd547c6535d3bd

SHA1
3ee2370beb2c2c1ab71518833329c3ca93b704ba

SHA256
1213663cad64ca7ced97c1783e473683ea2427936efeb0da67f480b75d65ab74

SHA512
7b6d5f379d1d11d0d21133c4ef7cbb76804b41e6c4f079e1a050981625fe24f6f21463f77a0a688b2ebcd00be42cb596a46c375b35408ff58da83d9e2c6becd5

Download Submit
C:\Windows\System\heWpGIK.exe

Filesize
1.9MB

MD5
d7a443248c204e41759012d78ac8d425

SHA1
71dcc9deaac3db57fb6ad62c76634730c271e89b

SHA256
e26c9133baf6362965d638b2dc9c04841d19c929d6e6fb23bcfaaf23386312cf

SHA512
5cc7816c403cb780aaadd93906820b2c295dbfaf3d27fdec721355969f51e9d7fb95904f1a3d9b19509e498a97a0dd4653b571f788317fcc1b20e54b9bf3c84f

Download Submit
C:\Windows\System\iOepiBh.exe

Filesize
1.9MB

MD5
519da04447e3e0d31936e80be165d8c3

SHA1
1d3f9e5daa58f8b34e940dee93016061bca4cc29

SHA256
1c0bf6bc9db1e7fc1eeaf5f6bad07c7ef6805494e4c287b55b2de2999d3d2a8d

SHA512
88dc014c96559fc40e23fdd06a07b8021a0d29ca55933914c5822815c5d4ddc37d4b34958b743b3a13a79a1410967b931ab2cfedd35effc04f0955ee040c3ef7

Download Submit
C:\Windows\System\khpxFRW.exe

Filesize
1.9MB

MD5
a8f535baf87b01e684b89e4152e9c196

SHA1
6d14a156b55c286d69a47d53fc20b78055ca294a

SHA256
df6ac4a271bd23c2b6236f13b3849874c3245eb2879946f535cb3f7f4b3a37f1

SHA512
2e0f24acfee7ad680c74264267f99a8a1185f0c91dddf8414d9cc36a073a46418c2d8d3cddca4a05cecfbe3941a594f5bae06069413f7d6cf8462d5d2ed36f68

Download Submit
C:\Windows\System\leMUEVL.exe

Filesize
1.9MB

MD5
e0633d4c7b9d74960eb13026c0cde7c5

SHA1
ce74ba42c518139b60aa65997b96c20cd1bacee4

SHA256
c0c13fba3be4d298f14c0a65ed1fd8294d0047bfb186ffeb86637c88914bfef5

SHA512
815c58ac69cc6447d6f0246b05960d7858c450c96a29ae26a2a61daf449ac4aeace82d51be81ebf0ac2392fa7a8e82543be8b006d986dc408866497fc16defae

Download Submit
C:\Windows\System\lmTkejG.exe

Filesize
1.9MB

MD5
d9c5223344ca72ea9da11aba0cf42919

SHA1
eeeaafda1eb0075556814d363d33776a6df753d8

SHA256
cf8802a55f10bc5b11e5d8c178e20e78a838e7494fe2c112d02f6affbcec84b0

SHA512
ddc5d5c101f8ead991fd5dc9ac105e5a6be3620a3f4210e42316eb5a959fcc95b69c95c9016e1b80234af5d42e05d7f8f86e4938f9a08240d5f73f8134e396db

Download Submit
C:\Windows\System\nZejols.exe

Filesize
1.9MB

MD5
071aee15cb59d440a01a24955c1024e0

SHA1
badcad881cf40b51e61c3009dfe1af21d896eb42

SHA256
ca1b25b156c19026de8d745c8e2352474ac95705c3263ac76d03378d8282eb49

SHA512
da42acb3e43ccfd62e45f8665379f467763fb87ab12b798d6d2261248bdec8bcaee480976e18fd31006b5d213e76d9718ebcc888edc8124a3cb476324c8adc28

Download Submit
C:\Windows\System\nasNnbk.exe

Filesize
1.9MB

MD5
bd7e196feb58a8f3c450af5271b1d334

SHA1
da831b336270a4ebb4bbf057c0ae726a2d5cce15

SHA256
9628e58f69a312c1ae8d19b7b0d1f5740aee1a3742788b95c8c9f7af782c2016

SHA512
c510d7f5bca968917db018f75ad9833692fdcb9a01744ea72b169735a67986090493d7cff77ff5c2957fd64e54f36b494d0ae67fd3361b72c30af784f48ef6fb

Download Submit
C:\Windows\System\nphHChy.exe

Filesize
1.9MB

MD5
b39442167563667310d932105ac1d0bd

SHA1
39750588b3263b513f326927e96bc7d5675099be

SHA256
b0ea66c11a2a0a572658aeeb9c834026d9fbf6cec9f247d03859352ba73154ea

SHA512
4f119595db092c283da61211e257f22d2efd94fd1f9618913f2e97892fba7b93a22a1bdc13ed2d87d0cca8c66cb743fa2f795bd3044ea2476bb6b4a75fe3b3c8

Download Submit
C:\Windows\System\pxyQHok.exe

Filesize
1.9MB

MD5
28104e7c42310d5de8710b7f13123c34

SHA1
8b1765e47eaeafb0793c3f304297cf9d8b8a2bc9

SHA256
e2d0fe986a002654b6dbe67b487c795d7bde20c877ed5c660b57eb350f1e9e65

SHA512
ed3e9f29548705a017e07b83efc91f5ce300c54f8ab5448897ffdd80998d238140dfc7fb17c8ddbba735cf77cb5934c016d4a336549e463862cea5979440dd7f

Download Submit
C:\Windows\System\sItrRVd.exe

Filesize
1.9MB

MD5
d6eb26a0049146add670d24652196d8b

SHA1
c17b69a1e09814f74a5952af63d16d9e5a58aaab

SHA256
e322a8cf3474e1f67e71f376964095faf82fa66b980525063874e18d3ed2651a

SHA512
1331c475949936d64ad78aca71a22edd96d0c568a3ca9b89bd3c3edcf489de394634a4477d466fef57b8550e83c415c3c149370ddba9d6ecf1c67d8ea8872736

Download Submit
C:\Windows\System\vMGwPBu.exe

Filesize
1.9MB

MD5
9c9b0a16b67ca124e830563920a45622

SHA1
a6ca869885b583356c6c6957a227d4298f8eaa9e

SHA256
65f2bfa4d0b80da7b8e09a74a447b19d9dbb270d85d25666ad5772a7e4f8b2dc

SHA512
45db8107d50437b0cf2eeb7f2523833f12a5828868e710553ca6ce20c3ef27718b5c6371962cf424ea061d7a1cbd054e1fb52948e1a748def4d5debc159fb02d

Download Submit
C:\Windows\System\wDApakD.exe

Filesize
1.9MB

MD5
8b6f07881a4fa3323b677aad06d2d886

SHA1
704c282970952026e0269b3d3788bc70c16a9726

SHA256
04641497789463917876791f2c373f3b9addf97cd8e89fc0560692df2bd20fe1

SHA512
852e48fba77979b6810cccbbbd7e537d88090a1cf92a55b993fc95fa081f3d5f4df8197691dd86668c9931848ce9ec37a8bf59ced6751ba4e9c4f3ade106ec7d

Download Submit
C:\Windows\System\wKoRIwW.exe

Filesize
1.9MB

MD5
72f6480d51f18bbe41b26b07de3592f5

SHA1
e40a3610a4c0c35c8487dd5bc7f04edd2de83cfa

SHA256
ca3adf6a1828712b7b7cf29f26417e8eb04f0963b909e9108bdce953b03f632a

SHA512
eb218908fef0870b48f8781a1f8d76942969ea58374f416fd758b8e9df97f758fa70e61e7b40a6cc097dd045841bcbf2e7ca573a7e05950999704dfe0688ca73

Download Submit
C:\Windows\System\wTsBzkz.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\wfesdga.exe

Filesize
1.9MB

MD5
43c271787e314a7de2caa00978ff4cdf

SHA1
a8da58551831b47af6ec54b7ac761791c5946c05

SHA256
3c22d166a9abf52cc2663dbd2331ffcb147fd8be62fe73490e7220b2277d6729

SHA512
3eca62140be12a355ac2077b9fe1fe63ce29cc0506f57e3c840e4f944380df492ce9750a9314d7af36ac436a891efda394bcd5f143e12330198e46b00e643abf

Download Submit
C:\Windows\System\zHsyify.exe

Filesize
1.9MB

MD5
a99d53f50d1cbf5ccab5b9ff7136ddeb

SHA1
57199639ab5207960880d3e95589984c564ae205

SHA256
67310df9c85c6306e9f119aa6921bdb324e208f9bcd7c5405efeb0a7fc903c05

SHA512
eff8bc48974d86efa3e9e9a9b6eda23a06623bdddf6bb10b7504de8919adf0ca36b186cffd18e132cbc79abed15fda9970df63805d0801a1f282198c2e9f3bf2

Download Submit
C:\Windows\System\zzkPpgf.exe

Filesize
1.9MB

MD5
a33d2be8f3e37a230874c76dd100aabf

SHA1
3f775483e46b633d23b6e85e028017c2bfe66728

SHA256
d57c2f1c6121eadca52a2d651886360683180f2ba754dd326653c0003c0374f7

SHA512
37f689f50983d9dae8ac848c24bb6e27e31486123a1114563c90f7f6899e2089be4f3d0a99916ab45ad2ea90123cbeacee9a27e5f3465dc0237a1473b8e7c52a

Download Submit
memory/1280-613-0x00007FF78F7C0000-0x00007FF78FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-4716-0x00007FF78F7C0000-0x00007FF78FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-227-0x00007FF7DD530000-0x00007FF7DD922000-memory.dmp

Filesize
3.9MB

Download
memory/2120-4905-0x00007FF756F90000-0x00007FF757382000-memory.dmp

Filesize
3.9MB

Download
memory/2120-229-0x00007FF756F90000-0x00007FF757382000-memory.dmp

Filesize
3.9MB

Download
memory/2336-233-0x00007FF7FA190000-0x00007FF7FA582000-memory.dmp

Filesize
3.9MB

Download
memory/2612-206-0x00007FF6EA780000-0x00007FF6EAB72000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4750-0x00007FF6EA780000-0x00007FF6EAB72000-memory.dmp

Filesize
3.9MB

Download
memory/2748-231-0x00007FF713970000-0x00007FF713D62000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4930-0x00007FF713970000-0x00007FF713D62000-memory.dmp

Filesize
3.9MB

Download
memory/2940-230-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-4918-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-754-0x00007FF74E0F0000-0x00007FF74E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-4823-0x00007FF74E0F0000-0x00007FF74E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-0-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-5133-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-280-0x00007FF7D8FB0000-0x00007FF7D93A2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-1-0x000001C6E1AB0000-0x000001C6E1AC0000-memory.dmp

Filesize
64KB

Download
memory/3228-232-0x00007FF7EDDA0000-0x00007FF7EE192000-memory.dmp

Filesize
3.9MB

Download
memory/3228-4916-0x00007FF7EDDA0000-0x00007FF7EE192000-memory.dmp

Filesize
3.9MB

Download
memory/3532-223-0x00007FF67E0F0000-0x00007FF67E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3532-4846-0x00007FF67E0F0000-0x00007FF67E4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-4752-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-28-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-315-0x00007FF7525B0000-0x00007FF7529A2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-226-0x00007FF775A70000-0x00007FF775E62000-memory.dmp

Filesize
3.9MB

Download
memory/3988-4913-0x00007FF775A70000-0x00007FF775E62000-memory.dmp

Filesize
3.9MB

Download
memory/4464-279-0x00007FF60C7D0000-0x00007FF60CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-4926-0x00007FF60C7D0000-0x00007FF60CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-4908-0x00007FF626020000-0x00007FF626412000-memory.dmp

Filesize
3.9MB

Download
memory/4532-221-0x00007FF626020000-0x00007FF626412000-memory.dmp

Filesize
3.9MB

Download
memory/4680-4911-0x00007FF7388F0000-0x00007FF738CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-228-0x00007FF7388F0000-0x00007FF738CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4696-4735-0x00007FF669710000-0x00007FF669B02000-memory.dmp

Filesize
3.9MB

Download
memory/4696-38-0x00007FF669710000-0x00007FF669B02000-memory.dmp

Filesize
3.9MB

Download
memory/4700-224-0x0000014E5A4B0000-0x0000014E5A4C0000-memory.dmp

Filesize
64KB

Download
memory/4700-249-0x0000014E5A810000-0x0000014E5A832000-memory.dmp

Filesize
136KB

Download
memory/4700-170-0x0000014E5A4B0000-0x0000014E5A4C0000-memory.dmp

Filesize
64KB

Download
memory/4700-2116-0x00007FFFD2E50000-0x00007FFFD3911000-memory.dmp

Filesize
10.8MB

Download
memory/4700-309-0x0000014E5A4C0000-0x0000014E5A6DC000-memory.dmp

Filesize
2.1MB

Download
memory/4700-116-0x00007FFFD2E50000-0x00007FFFD3911000-memory.dmp

Filesize
10.8MB

Download
memory/4840-4709-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp

Filesize
3.9MB

Download
memory/4840-316-0x00007FF66D1A0000-0x00007FF66D592000-memory.dmp

Filesize
3.9MB

Download
memory/4976-312-0x00007FF60BE80000-0x00007FF60C272000-memory.dmp

Filesize
3.9MB

Download
memory/4976-13-0x00007FF60BE80000-0x00007FF60C272000-memory.dmp

Filesize
3.9MB

Download
memory/5016-4748-0x00007FF73E850000-0x00007FF73EC42000-memory.dmp

Filesize
3.9MB

Download
memory/5016-172-0x00007FF73E850000-0x00007FF73EC42000-memory.dmp

Filesize
3.9MB

Download
memory/5096-219-0x00007FF71DDA0000-0x00007FF71E192000-memory.dmp

Filesize
3.9MB

Download
memory/5096-4894-0x00007FF71DDA0000-0x00007FF71E192000-memory.dmp

Filesize
3.9MB

Download
memory/5112-4854-0x00007FF630F10000-0x00007FF631302000-memory.dmp

Filesize
3.9MB

Download
memory/5112-225-0x00007FF630F10000-0x00007FF631302000-memory.dmp

Filesize
3.9MB

Download