xmrig | e3e5868b87b389df8f4685efac322121555070bc65bc4e1df3456b881fe287f2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
Size

2.1MB
MD5

07726e22ab4ac67fa5d443fe8bca11cc
SHA1

415b4dfc472bb95084330b741ce9d0411494ee9a
SHA256

e3e5868b87b389df8f4685efac322121555070bc65bc4e1df3456b881fe287f2
SHA512

b595c3218141ccba0904f4782758e0071b5fba765021f8959106b2c97b9e3004538447b1cfbebe61c1e9d96556a66f7e284499d486af1dc90601b44b77dec8c9
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1P2:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/2032-353-0x00007FF75C250000-0x00007FF75C642000-memory.dmp	xmrig
behavioral2/memory/2812-394-0x00007FF734190000-0x00007FF734582000-memory.dmp	xmrig
behavioral2/memory/5036-416-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	xmrig
behavioral2/memory/3840-421-0x00007FF6EB6B0000-0x00007FF6EBAA2000-memory.dmp	xmrig
behavioral2/memory/4088-420-0x00007FF748FF0000-0x00007FF7493E2000-memory.dmp	xmrig
behavioral2/memory/2700-419-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp	xmrig
behavioral2/memory/2296-418-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp	xmrig
behavioral2/memory/2416-415-0x00007FF7BC570000-0x00007FF7BC962000-memory.dmp	xmrig
behavioral2/memory/4524-308-0x00007FF680460000-0x00007FF680852000-memory.dmp	xmrig
behavioral2/memory/4600-312-0x00007FF7A9FF0000-0x00007FF7AA3E2000-memory.dmp	xmrig
behavioral2/memory/4940-290-0x00007FF7FE1D0000-0x00007FF7FE5C2000-memory.dmp	xmrig
behavioral2/memory/1044-249-0x00007FF7436D0000-0x00007FF743AC2000-memory.dmp	xmrig
behavioral2/memory/400-198-0x00007FF6C1770000-0x00007FF6C1B62000-memory.dmp	xmrig
behavioral2/memory/1952-161-0x00007FF74BC70000-0x00007FF74C062000-memory.dmp	xmrig
behavioral2/memory/2112-155-0x00007FF710740000-0x00007FF710B32000-memory.dmp	xmrig
behavioral2/memory/5104-97-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp	xmrig
behavioral2/memory/4848-33-0x00007FF656A50000-0x00007FF656E42000-memory.dmp	xmrig
behavioral2/memory/5104-4652-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp	xmrig
behavioral2/memory/2296-4668-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp	xmrig
behavioral2/memory/2700-4672-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp	xmrig
behavioral2/memory/2648-4700-0x00007FF7B2930000-0x00007FF7B2D22000-memory.dmp	xmrig
behavioral2/memory/4088-4695-0x00007FF748FF0000-0x00007FF7493E2000-memory.dmp	xmrig
behavioral2/memory/4556-4697-0x00007FF69F790000-0x00007FF69FB82000-memory.dmp	xmrig
behavioral2/memory/1952-4690-0x00007FF74BC70000-0x00007FF74C062000-memory.dmp	xmrig
behavioral2/memory/2112-4684-0x00007FF710740000-0x00007FF710B32000-memory.dmp	xmrig
behavioral2/memory/4740-4676-0x00007FF6E5AE0000-0x00007FF6E5ED2000-memory.dmp	xmrig
behavioral2/memory/2032-4728-0x00007FF75C250000-0x00007FF75C642000-memory.dmp	xmrig
behavioral2/memory/2416-4725-0x00007FF7BC570000-0x00007FF7BC962000-memory.dmp	xmrig
behavioral2/memory/4600-4722-0x00007FF7A9FF0000-0x00007FF7AA3E2000-memory.dmp	xmrig
behavioral2/memory/400-4716-0x00007FF6C1770000-0x00007FF6C1B62000-memory.dmp	xmrig
behavioral2/memory/4524-4712-0x00007FF680460000-0x00007FF680852000-memory.dmp	xmrig
behavioral2/memory/4940-4711-0x00007FF7FE1D0000-0x00007FF7FE5C2000-memory.dmp	xmrig
behavioral2/memory/2812-4789-0x00007FF734190000-0x00007FF734582000-memory.dmp	xmrig
behavioral2/memory/3840-4787-0x00007FF6EB6B0000-0x00007FF6EBAA2000-memory.dmp	xmrig
behavioral2/memory/1044-4782-0x00007FF7436D0000-0x00007FF743AC2000-memory.dmp	xmrig
behavioral2/memory/5036-4778-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	xmrig
behavioral2/memory/3588-4939-0x00007FF7FB3E0000-0x00007FF7FB7D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2868	zAtRrrP.exe
4848	nYYejOz.exe
2296	MGwINLR.exe
2648	cgpbkJo.exe
4740	AFFZRqZ.exe
5104	hxmJFUF.exe
4556	YUEmLYC.exe
2700	esILpNU.exe
2112	aIBEubY.exe
1952	ZWaNhkr.exe
400	hUimQMZ.exe
4088	OHFmUnz.exe
1044	OTVezVm.exe
4940	jVdtYef.exe
4524	JfPbqyN.exe
4600	qDnwiNj.exe
2032	iSYvNkx.exe
2812	ZuDeLKW.exe
2416	NTHwfOb.exe
5036	MWDGpge.exe
3840	LBwAJaP.exe
1408	VrkqEGo.exe
4288	QDgwCGh.exe
872	nNCxhvq.exe
5044	vKnweCw.exe
4476	JCzWviV.exe
2896	XBjsfSL.exe
736	VdgNCbC.exe
5040	tsclmgy.exe
3156	wzLnRkH.exe
2188	HJgaXSz.exe
776	dmhYtVf.exe
8	IyxTOrg.exe
1176	gnHpczI.exe
4900	MLtzOSD.exe
3772	fTYXmzJ.exe
3468	MkMDhOH.exe
3636	oSgZLEy.exe
1484	qwiGDKj.exe
3148	djdIlJy.exe
3532	uNDgrXd.exe
3144	wwIAjMt.exe
3876	SKhjxjX.exe
5056	shVNzAt.exe
3948	fpJdIML.exe
900	hBrgPnh.exe
3652	WBoFvKa.exe
2968	gnarhMQ.exe
3348	SvyQOOR.exe
3728	ipipqDa.exe
4604	ootzuvH.exe
1400	pEodwEu.exe
3832	lBTJMqv.exe
484	UKFItkl.exe
3920	YEOgVRk.exe
848	poEWcdn.exe
820	YwKFSBh.exe
4540	JuAiUYv.exe
2256	wQGBDEO.exe
4444	YhiCmMP.exe
1940	VeyzdOl.exe
4548	GBlJrIq.exe
1424	UHuAXKq.exe
1508	JUEQreW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3588-0-0x00007FF7FB3E0000-0x00007FF7FB7D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-7.dat	upx
behavioral2/files/0x000c000000023b80-5.dat	upx
behavioral2/files/0x000a000000023b9d-95.dat	upx
behavioral2/files/0x000a000000023b8d-114.dat	upx
behavioral2/files/0x000a000000023b9c-179.dat	upx
behavioral2/memory/2032-353-0x00007FF75C250000-0x00007FF75C642000-memory.dmp	upx
behavioral2/memory/2812-394-0x00007FF734190000-0x00007FF734582000-memory.dmp	upx
behavioral2/memory/5036-416-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	upx
behavioral2/memory/3840-421-0x00007FF6EB6B0000-0x00007FF6EBAA2000-memory.dmp	upx
behavioral2/memory/4088-420-0x00007FF748FF0000-0x00007FF7493E2000-memory.dmp	upx
behavioral2/memory/2700-419-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp	upx
behavioral2/memory/2296-418-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp	upx
behavioral2/memory/2416-415-0x00007FF7BC570000-0x00007FF7BC962000-memory.dmp	upx
behavioral2/memory/4524-308-0x00007FF680460000-0x00007FF680852000-memory.dmp	upx
behavioral2/memory/4600-312-0x00007FF7A9FF0000-0x00007FF7AA3E2000-memory.dmp	upx
behavioral2/memory/4940-290-0x00007FF7FE1D0000-0x00007FF7FE5C2000-memory.dmp	upx
behavioral2/memory/1044-249-0x00007FF7436D0000-0x00007FF743AC2000-memory.dmp	upx
behavioral2/memory/400-198-0x00007FF6C1770000-0x00007FF6C1B62000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-185.dat	upx
behavioral2/files/0x000a000000023b93-182.dat	upx
behavioral2/files/0x000a000000023ba2-181.dat	upx
behavioral2/files/0x000a000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bac-177.dat	upx
behavioral2/files/0x000a000000023b9a-174.dat	upx
behavioral2/files/0x000a000000023ba1-173.dat	upx
behavioral2/files/0x000a000000023bab-171.dat	upx
behavioral2/files/0x000a000000023baa-170.dat	upx
behavioral2/files/0x000a000000023ba0-169.dat	upx
behavioral2/files/0x000a000000023ba9-168.dat	upx
behavioral2/memory/1952-161-0x00007FF74BC70000-0x00007FF74C062000-memory.dmp	upx
behavioral2/memory/2112-155-0x00007FF710740000-0x00007FF710B32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-154.dat	upx
behavioral2/files/0x000a000000023bae-190.dat	upx
behavioral2/files/0x000a000000023ba5-153.dat	upx
behavioral2/files/0x000a000000023ba4-145.dat	upx
behavioral2/files/0x000a000000023b99-139.dat	upx
behavioral2/files/0x000a000000023b97-136.dat	upx
behavioral2/files/0x000a000000023b91-134.dat	upx
behavioral2/files/0x000a000000023ba3-133.dat	upx
behavioral2/files/0x000a000000023b96-129.dat	upx
behavioral2/files/0x000a000000023b95-126.dat	upx
behavioral2/files/0x000a000000023b9f-162.dat	upx
behavioral2/files/0x000a000000023ba7-158.dat	upx
behavioral2/memory/4556-122-0x00007FF69F790000-0x00007FF69FB82000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-118.dat	upx
behavioral2/files/0x000a000000023b92-110.dat	upx
behavioral2/files/0x000a000000023b9b-109.dat	upx
behavioral2/files/0x000a000000023b98-107.dat	upx
behavioral2/files/0x000a000000023b90-102.dat	upx
behavioral2/memory/5104-97-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-100.dat	upx
behavioral2/files/0x000a000000023b8b-79.dat	upx
behavioral2/files/0x000a000000023b8f-55.dat	upx
behavioral2/files/0x000a000000023b8c-42.dat	upx
behavioral2/files/0x000a000000023b8e-41.dat	upx
behavioral2/memory/4740-64-0x00007FF6E5AE0000-0x00007FF6E5ED2000-memory.dmp	upx
behavioral2/memory/2648-36-0x00007FF7B2930000-0x00007FF7B2D22000-memory.dmp	upx
behavioral2/memory/4848-33-0x00007FF656A50000-0x00007FF656E42000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-16.dat	upx
behavioral2/memory/2868-13-0x00007FF6DE590000-0x00007FF6DE982000-memory.dmp	upx
behavioral2/memory/5104-4652-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp	upx
behavioral2/memory/2296-4668-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp	upx
behavioral2/memory/2700-4672-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wXruTUZ.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\JAkRihr.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\zScDIUB.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\iFDTTER.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\sadptzs.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\DusBdfC.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\tSaPmII.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\NVMrzao.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\AXbfMYL.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\vszXtBL.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\MmnLUJU.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\LvEHOlW.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\NWXpDzM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\nbpBZEy.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\KBzdIBc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\bSQrEKP.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\RSfyUXv.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\nZoWxXl.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\JHiIiAg.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\rgugEqN.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\wVvRhPM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\sBMqNuS.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\UyrUGZH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\EcPWYTe.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\JvXikMj.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\fESrJMA.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\LjvgLRg.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ruUPUVl.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\rLWiuxB.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\bJpocXR.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\gvRLfYI.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\bzbdsPU.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\fOdQvFO.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\RrfyIvI.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ZMmVgTc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\lNxfoYG.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\AavKCoK.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\KzKnuRS.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\zmXKbSo.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\GkUtwTd.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\lbzfSip.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\JuQVJYg.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\USUltyy.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\TbKXaie.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\kLUeOwU.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\PaSHfBg.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ZadNGOA.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\PruXqwq.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\tviGmZR.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\LizbQda.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\IoDiZZP.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\TUEhvaO.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\oxejzxX.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\TmEoOUT.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\mnMzbYM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\YFBsRMF.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\zmtBbpE.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\IpDyKQl.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\fhXHMpz.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\npjOrox.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\EoCurOe.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\wzLnRkH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ugeocUV.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\iZiJoZM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeLockMemoryPrivilege	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3116	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	85
PID 3588 wrote to memory of 3116	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	85
PID 3588 wrote to memory of 2868	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	86
PID 3588 wrote to memory of 2868	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	86
PID 3588 wrote to memory of 4848	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	87
PID 3588 wrote to memory of 4848	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	87
PID 3588 wrote to memory of 2296	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	88
PID 3588 wrote to memory of 2296	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	88
PID 3588 wrote to memory of 2648	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	89
PID 3588 wrote to memory of 2648	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	89
PID 3588 wrote to memory of 4740	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	90
PID 3588 wrote to memory of 4740	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	90
PID 3588 wrote to memory of 5104	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	91
PID 3588 wrote to memory of 5104	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	91
PID 3588 wrote to memory of 4556	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	92
PID 3588 wrote to memory of 4556	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	92
PID 3588 wrote to memory of 2700	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	93
PID 3588 wrote to memory of 2700	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	93
PID 3588 wrote to memory of 2112	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	94
PID 3588 wrote to memory of 2112	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	94
PID 3588 wrote to memory of 1952	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	95
PID 3588 wrote to memory of 1952	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	95
PID 3588 wrote to memory of 400	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	96
PID 3588 wrote to memory of 400	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	96
PID 3588 wrote to memory of 4088	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	97
PID 3588 wrote to memory of 4088	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	97
PID 3588 wrote to memory of 5036	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	98
PID 3588 wrote to memory of 5036	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	98
PID 3588 wrote to memory of 1044	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	99
PID 3588 wrote to memory of 1044	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	99
PID 3588 wrote to memory of 4940	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	100
PID 3588 wrote to memory of 4940	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	100
PID 3588 wrote to memory of 4524	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	101
PID 3588 wrote to memory of 4524	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	101
PID 3588 wrote to memory of 4600	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	102
PID 3588 wrote to memory of 4600	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	102
PID 3588 wrote to memory of 872	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	103
PID 3588 wrote to memory of 872	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	103
PID 3588 wrote to memory of 2032	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	104
PID 3588 wrote to memory of 2032	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	104
PID 3588 wrote to memory of 2812	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	105
PID 3588 wrote to memory of 2812	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	105
PID 3588 wrote to memory of 4476	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	106
PID 3588 wrote to memory of 4476	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	106
PID 3588 wrote to memory of 2896	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	107
PID 3588 wrote to memory of 2896	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	107
PID 3588 wrote to memory of 2416	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	108
PID 3588 wrote to memory of 2416	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	108
PID 3588 wrote to memory of 3840	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	109
PID 3588 wrote to memory of 3840	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	109
PID 3588 wrote to memory of 1408	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	110
PID 3588 wrote to memory of 1408	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	110
PID 3588 wrote to memory of 4288	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	111
PID 3588 wrote to memory of 4288	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	111
PID 3588 wrote to memory of 5044	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	112
PID 3588 wrote to memory of 5044	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	112
PID 3588 wrote to memory of 736	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	113
PID 3588 wrote to memory of 736	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	113
PID 3588 wrote to memory of 5040	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	114
PID 3588 wrote to memory of 5040	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	114
PID 3588 wrote to memory of 3156	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	115
PID 3588 wrote to memory of 3156	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	115
PID 3588 wrote to memory of 2188	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	116
PID 3588 wrote to memory of 2188	3588	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\System\zAtRrrP.exe
  C:\Windows\System\zAtRrrP.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nYYejOz.exe
  C:\Windows\System\nYYejOz.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\MGwINLR.exe
  C:\Windows\System\MGwINLR.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\cgpbkJo.exe
  C:\Windows\System\cgpbkJo.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\AFFZRqZ.exe
  C:\Windows\System\AFFZRqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\hxmJFUF.exe
  C:\Windows\System\hxmJFUF.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\YUEmLYC.exe
  C:\Windows\System\YUEmLYC.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\esILpNU.exe
  C:\Windows\System\esILpNU.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\aIBEubY.exe
  C:\Windows\System\aIBEubY.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\ZWaNhkr.exe
  C:\Windows\System\ZWaNhkr.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\hUimQMZ.exe
  C:\Windows\System\hUimQMZ.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\OHFmUnz.exe
  C:\Windows\System\OHFmUnz.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\MWDGpge.exe
  C:\Windows\System\MWDGpge.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\OTVezVm.exe
  C:\Windows\System\OTVezVm.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jVdtYef.exe
  C:\Windows\System\jVdtYef.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\JfPbqyN.exe
  C:\Windows\System\JfPbqyN.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\qDnwiNj.exe
  C:\Windows\System\qDnwiNj.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\nNCxhvq.exe
  C:\Windows\System\nNCxhvq.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\iSYvNkx.exe
  C:\Windows\System\iSYvNkx.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ZuDeLKW.exe
  C:\Windows\System\ZuDeLKW.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JCzWviV.exe
  C:\Windows\System\JCzWviV.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\XBjsfSL.exe
  C:\Windows\System\XBjsfSL.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\NTHwfOb.exe
  C:\Windows\System\NTHwfOb.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\LBwAJaP.exe
  C:\Windows\System\LBwAJaP.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\VrkqEGo.exe
  C:\Windows\System\VrkqEGo.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\QDgwCGh.exe
  C:\Windows\System\QDgwCGh.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\vKnweCw.exe
  C:\Windows\System\vKnweCw.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\VdgNCbC.exe
  C:\Windows\System\VdgNCbC.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\tsclmgy.exe
  C:\Windows\System\tsclmgy.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\wzLnRkH.exe
  C:\Windows\System\wzLnRkH.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\HJgaXSz.exe
  C:\Windows\System\HJgaXSz.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\dmhYtVf.exe
  C:\Windows\System\dmhYtVf.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\IyxTOrg.exe
  C:\Windows\System\IyxTOrg.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\wwIAjMt.exe
  C:\Windows\System\wwIAjMt.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\gnHpczI.exe
  C:\Windows\System\gnHpczI.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\MLtzOSD.exe
  C:\Windows\System\MLtzOSD.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\fTYXmzJ.exe
  C:\Windows\System\fTYXmzJ.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\MkMDhOH.exe
  C:\Windows\System\MkMDhOH.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\oSgZLEy.exe
  C:\Windows\System\oSgZLEy.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\qwiGDKj.exe
  C:\Windows\System\qwiGDKj.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\djdIlJy.exe
  C:\Windows\System\djdIlJy.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\uNDgrXd.exe
  C:\Windows\System\uNDgrXd.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\SKhjxjX.exe
  C:\Windows\System\SKhjxjX.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\shVNzAt.exe
  C:\Windows\System\shVNzAt.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\fpJdIML.exe
  C:\Windows\System\fpJdIML.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hBrgPnh.exe
  C:\Windows\System\hBrgPnh.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\WBoFvKa.exe
  C:\Windows\System\WBoFvKa.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\gnarhMQ.exe
  C:\Windows\System\gnarhMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\SvyQOOR.exe
  C:\Windows\System\SvyQOOR.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\ipipqDa.exe
  C:\Windows\System\ipipqDa.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\ootzuvH.exe
  C:\Windows\System\ootzuvH.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\pEodwEu.exe
  C:\Windows\System\pEodwEu.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\lBTJMqv.exe
  C:\Windows\System\lBTJMqv.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\UKFItkl.exe
  C:\Windows\System\UKFItkl.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\YEOgVRk.exe
  C:\Windows\System\YEOgVRk.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\poEWcdn.exe
  C:\Windows\System\poEWcdn.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\YwKFSBh.exe
  C:\Windows\System\YwKFSBh.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\JuAiUYv.exe
  C:\Windows\System\JuAiUYv.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\wQGBDEO.exe
  C:\Windows\System\wQGBDEO.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YhiCmMP.exe
  C:\Windows\System\YhiCmMP.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\VeyzdOl.exe
  C:\Windows\System\VeyzdOl.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\GBlJrIq.exe
  C:\Windows\System\GBlJrIq.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\UHuAXKq.exe
  C:\Windows\System\UHuAXKq.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\JUEQreW.exe
  C:\Windows\System\JUEQreW.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\nEICMIX.exe
  C:\Windows\System\nEICMIX.exe
  2⤵
  PID:1112
- C:\Windows\System\Nxmvmjw.exe
  C:\Windows\System\Nxmvmjw.exe
  2⤵
  PID:3212
- C:\Windows\System\jRwUOto.exe
  C:\Windows\System\jRwUOto.exe
  2⤵
  PID:468
- C:\Windows\System\KuiFJgr.exe
  C:\Windows\System\KuiFJgr.exe
  2⤵
  PID:2848
- C:\Windows\System\tVpDMYN.exe
  C:\Windows\System\tVpDMYN.exe
  2⤵
  PID:1604
- C:\Windows\System\PomGBYr.exe
  C:\Windows\System\PomGBYr.exe
  2⤵
  PID:2052
- C:\Windows\System\BaPlWUK.exe
  C:\Windows\System\BaPlWUK.exe
  2⤵
  PID:1560
- C:\Windows\System\ZadNGOA.exe
  C:\Windows\System\ZadNGOA.exe
  2⤵
  PID:2908
- C:\Windows\System\uIOfdeT.exe
  C:\Windows\System\uIOfdeT.exe
  2⤵
  PID:2252
- C:\Windows\System\hBTlVsw.exe
  C:\Windows\System\hBTlVsw.exe
  2⤵
  PID:4596
- C:\Windows\System\WzZWtzs.exe
  C:\Windows\System\WzZWtzs.exe
  2⤵
  PID:784
- C:\Windows\System\XCzIOZw.exe
  C:\Windows\System\XCzIOZw.exe
  2⤵
  PID:5152
- C:\Windows\System\BwVuwGZ.exe
  C:\Windows\System\BwVuwGZ.exe
  2⤵
  PID:5184
- C:\Windows\System\SsKAcOK.exe
  C:\Windows\System\SsKAcOK.exe
  2⤵
  PID:5200
- C:\Windows\System\cwsortJ.exe
  C:\Windows\System\cwsortJ.exe
  2⤵
  PID:5224
- C:\Windows\System\TORCCXj.exe
  C:\Windows\System\TORCCXj.exe
  2⤵
  PID:5244
- C:\Windows\System\FJGzLdW.exe
  C:\Windows\System\FJGzLdW.exe
  2⤵
  PID:5260
- C:\Windows\System\mzahHSE.exe
  C:\Windows\System\mzahHSE.exe
  2⤵
  PID:5284
- C:\Windows\System\gVSMHeL.exe
  C:\Windows\System\gVSMHeL.exe
  2⤵
  PID:5400
- C:\Windows\System\IYucbZt.exe
  C:\Windows\System\IYucbZt.exe
  2⤵
  PID:5420
- C:\Windows\System\SHyONQO.exe
  C:\Windows\System\SHyONQO.exe
  2⤵
  PID:5440
- C:\Windows\System\oNIIsgz.exe
  C:\Windows\System\oNIIsgz.exe
  2⤵
  PID:5472
- C:\Windows\System\FTXKQNz.exe
  C:\Windows\System\FTXKQNz.exe
  2⤵
  PID:5504
- C:\Windows\System\TZtZONc.exe
  C:\Windows\System\TZtZONc.exe
  2⤵
  PID:5560
- C:\Windows\System\wFmtcfH.exe
  C:\Windows\System\wFmtcfH.exe
  2⤵
  PID:5580
- C:\Windows\System\lcMUjiZ.exe
  C:\Windows\System\lcMUjiZ.exe
  2⤵
  PID:5600
- C:\Windows\System\mcDsbEV.exe
  C:\Windows\System\mcDsbEV.exe
  2⤵
  PID:5620
- C:\Windows\System\leAGnLn.exe
  C:\Windows\System\leAGnLn.exe
  2⤵
  PID:5644
- C:\Windows\System\jvlMUQr.exe
  C:\Windows\System\jvlMUQr.exe
  2⤵
  PID:5668
- C:\Windows\System\AuaksYr.exe
  C:\Windows\System\AuaksYr.exe
  2⤵
  PID:5688
- C:\Windows\System\GBHfkjw.exe
  C:\Windows\System\GBHfkjw.exe
  2⤵
  PID:5708
- C:\Windows\System\fpVZbjR.exe
  C:\Windows\System\fpVZbjR.exe
  2⤵
  PID:5724
- C:\Windows\System\rDnftWf.exe
  C:\Windows\System\rDnftWf.exe
  2⤵
  PID:5756
- C:\Windows\System\hidlrPD.exe
  C:\Windows\System\hidlrPD.exe
  2⤵
  PID:5772
- C:\Windows\System\LAMBtQE.exe
  C:\Windows\System\LAMBtQE.exe
  2⤵
  PID:5796
- C:\Windows\System\NOiwzux.exe
  C:\Windows\System\NOiwzux.exe
  2⤵
  PID:5816
- C:\Windows\System\RHPnsZB.exe
  C:\Windows\System\RHPnsZB.exe
  2⤵
  PID:5844
- C:\Windows\System\NvMKBsx.exe
  C:\Windows\System\NvMKBsx.exe
  2⤵
  PID:5868
- C:\Windows\System\dmYdEjw.exe
  C:\Windows\System\dmYdEjw.exe
  2⤵
  PID:5884
- C:\Windows\System\YPAHNNs.exe
  C:\Windows\System\YPAHNNs.exe
  2⤵
  PID:5908
- C:\Windows\System\JaDNFcL.exe
  C:\Windows\System\JaDNFcL.exe
  2⤵
  PID:5940
- C:\Windows\System\YSedegl.exe
  C:\Windows\System\YSedegl.exe
  2⤵
  PID:5956
- C:\Windows\System\NgvFRTx.exe
  C:\Windows\System\NgvFRTx.exe
  2⤵
  PID:5976
- C:\Windows\System\mCQrDlg.exe
  C:\Windows\System\mCQrDlg.exe
  2⤵
  PID:6032
- C:\Windows\System\cQXZXsE.exe
  C:\Windows\System\cQXZXsE.exe
  2⤵
  PID:6052
- C:\Windows\System\mQeDiYy.exe
  C:\Windows\System\mQeDiYy.exe
  2⤵
  PID:6080
- C:\Windows\System\RVFSuTg.exe
  C:\Windows\System\RVFSuTg.exe
  2⤵
  PID:6100
- C:\Windows\System\vCydYIt.exe
  C:\Windows\System\vCydYIt.exe
  2⤵
  PID:6116
- C:\Windows\System\XRwumqT.exe
  C:\Windows\System\XRwumqT.exe
  2⤵
  PID:3524
- C:\Windows\System\ngfldpV.exe
  C:\Windows\System\ngfldpV.exe
  2⤵
  PID:2924
- C:\Windows\System\CFPkEcy.exe
  C:\Windows\System\CFPkEcy.exe
  2⤵
  PID:3100
- C:\Windows\System\iFDTTER.exe
  C:\Windows\System\iFDTTER.exe
  2⤵
  PID:2912
- C:\Windows\System\zNfqQtb.exe
  C:\Windows\System\zNfqQtb.exe
  2⤵
  PID:4584
- C:\Windows\System\XaUbRbi.exe
  C:\Windows\System\XaUbRbi.exe
  2⤵
  PID:4028
- C:\Windows\System\wDkDIPu.exe
  C:\Windows\System\wDkDIPu.exe
  2⤵
  PID:224
- C:\Windows\System\MqgnWrS.exe
  C:\Windows\System\MqgnWrS.exe
  2⤵
  PID:1844
- C:\Windows\System\LluBQWK.exe
  C:\Windows\System\LluBQWK.exe
  2⤵
  PID:4004
- C:\Windows\System\YOifTYy.exe
  C:\Windows\System\YOifTYy.exe
  2⤵
  PID:5220
- C:\Windows\System\sVLaXfL.exe
  C:\Windows\System\sVLaXfL.exe
  2⤵
  PID:5272
- C:\Windows\System\dgrMQkq.exe
  C:\Windows\System\dgrMQkq.exe
  2⤵
  PID:5460
- C:\Windows\System\bLDyEUb.exe
  C:\Windows\System\bLDyEUb.exe
  2⤵
  PID:5496
- C:\Windows\System\SjNvAfg.exe
  C:\Windows\System\SjNvAfg.exe
  2⤵
  PID:5532
- C:\Windows\System\eQoIPln.exe
  C:\Windows\System\eQoIPln.exe
  2⤵
  PID:5576
- C:\Windows\System\gjiMFIs.exe
  C:\Windows\System\gjiMFIs.exe
  2⤵
  PID:5632
- C:\Windows\System\dJuRjAi.exe
  C:\Windows\System\dJuRjAi.exe
  2⤵
  PID:5660
- C:\Windows\System\RQjweND.exe
  C:\Windows\System\RQjweND.exe
  2⤵
  PID:5700
- C:\Windows\System\ikRbfTt.exe
  C:\Windows\System\ikRbfTt.exe
  2⤵
  PID:5736
- C:\Windows\System\uNtppBB.exe
  C:\Windows\System\uNtppBB.exe
  2⤵
  PID:5788
- C:\Windows\System\hkJMFaQ.exe
  C:\Windows\System\hkJMFaQ.exe
  2⤵
  PID:5812
- C:\Windows\System\zzwdAgk.exe
  C:\Windows\System\zzwdAgk.exe
  2⤵
  PID:5856
- C:\Windows\System\OxLxtbv.exe
  C:\Windows\System\OxLxtbv.exe
  2⤵
  PID:5892
- C:\Windows\System\KvKCloX.exe
  C:\Windows\System\KvKCloX.exe
  2⤵
  PID:6004
- C:\Windows\System\HoBYqUK.exe
  C:\Windows\System\HoBYqUK.exe
  2⤵
  PID:3612
- C:\Windows\System\vGTAySo.exe
  C:\Windows\System\vGTAySo.exe
  2⤵
  PID:4388
- C:\Windows\System\XkdFrbR.exe
  C:\Windows\System\XkdFrbR.exe
  2⤵
  PID:1084
- C:\Windows\System\Jycvcpd.exe
  C:\Windows\System\Jycvcpd.exe
  2⤵
  PID:3160
- C:\Windows\System\mRLOcQn.exe
  C:\Windows\System\mRLOcQn.exe
  2⤵
  PID:6148
- C:\Windows\System\oOxwNGu.exe
  C:\Windows\System\oOxwNGu.exe
  2⤵
  PID:6168
- C:\Windows\System\aUYAKEX.exe
  C:\Windows\System\aUYAKEX.exe
  2⤵
  PID:6184
- C:\Windows\System\sUrecAo.exe
  C:\Windows\System\sUrecAo.exe
  2⤵
  PID:6208
- C:\Windows\System\hnElrvx.exe
  C:\Windows\System\hnElrvx.exe
  2⤵
  PID:6228
- C:\Windows\System\vkrVOGB.exe
  C:\Windows\System\vkrVOGB.exe
  2⤵
  PID:6248
- C:\Windows\System\iXAghMY.exe
  C:\Windows\System\iXAghMY.exe
  2⤵
  PID:6264
- C:\Windows\System\Iasxyyp.exe
  C:\Windows\System\Iasxyyp.exe
  2⤵
  PID:6288
- C:\Windows\System\NKYVrYl.exe
  C:\Windows\System\NKYVrYl.exe
  2⤵
  PID:6304
- C:\Windows\System\eJWJEpo.exe
  C:\Windows\System\eJWJEpo.exe
  2⤵
  PID:6324
- C:\Windows\System\NsNSlyg.exe
  C:\Windows\System\NsNSlyg.exe
  2⤵
  PID:6344
- C:\Windows\System\FrReExE.exe
  C:\Windows\System\FrReExE.exe
  2⤵
  PID:6364
- C:\Windows\System\jrvFvky.exe
  C:\Windows\System\jrvFvky.exe
  2⤵
  PID:6380
- C:\Windows\System\mARXATv.exe
  C:\Windows\System\mARXATv.exe
  2⤵
  PID:6400
- C:\Windows\System\sofPqPN.exe
  C:\Windows\System\sofPqPN.exe
  2⤵
  PID:6548
- C:\Windows\System\uoDJezp.exe
  C:\Windows\System\uoDJezp.exe
  2⤵
  PID:6568
- C:\Windows\System\wiybEwK.exe
  C:\Windows\System\wiybEwK.exe
  2⤵
  PID:6584
- C:\Windows\System\RqqfjOf.exe
  C:\Windows\System\RqqfjOf.exe
  2⤵
  PID:6608
- C:\Windows\System\XKoazzA.exe
  C:\Windows\System\XKoazzA.exe
  2⤵
  PID:6624
- C:\Windows\System\UolvnJC.exe
  C:\Windows\System\UolvnJC.exe
  2⤵
  PID:6648
- C:\Windows\System\cszRwvv.exe
  C:\Windows\System\cszRwvv.exe
  2⤵
  PID:6672
- C:\Windows\System\BHDKfLP.exe
  C:\Windows\System\BHDKfLP.exe
  2⤵
  PID:6688
- C:\Windows\System\ZsNQPgO.exe
  C:\Windows\System\ZsNQPgO.exe
  2⤵
  PID:6704
- C:\Windows\System\UFQruNk.exe
  C:\Windows\System\UFQruNk.exe
  2⤵
  PID:6724
- C:\Windows\System\LNVeTHC.exe
  C:\Windows\System\LNVeTHC.exe
  2⤵
  PID:6800
- C:\Windows\System\bSFMwsa.exe
  C:\Windows\System\bSFMwsa.exe
  2⤵
  PID:6828
- C:\Windows\System\rDeusJn.exe
  C:\Windows\System\rDeusJn.exe
  2⤵
  PID:6848
- C:\Windows\System\KpBhgSz.exe
  C:\Windows\System\KpBhgSz.exe
  2⤵
  PID:6868
- C:\Windows\System\eAMysBI.exe
  C:\Windows\System\eAMysBI.exe
  2⤵
  PID:6892
- C:\Windows\System\EXgeSCM.exe
  C:\Windows\System\EXgeSCM.exe
  2⤵
  PID:6912
- C:\Windows\System\rpgyiXp.exe
  C:\Windows\System\rpgyiXp.exe
  2⤵
  PID:6936
- C:\Windows\System\QMyHHdk.exe
  C:\Windows\System\QMyHHdk.exe
  2⤵
  PID:6956
- C:\Windows\System\ISVNQtP.exe
  C:\Windows\System\ISVNQtP.exe
  2⤵
  PID:6980
- C:\Windows\System\woefEzI.exe
  C:\Windows\System\woefEzI.exe
  2⤵
  PID:7004
- C:\Windows\System\GpxmIrm.exe
  C:\Windows\System\GpxmIrm.exe
  2⤵
  PID:7032
- C:\Windows\System\GHaSMec.exe
  C:\Windows\System\GHaSMec.exe
  2⤵
  PID:7056
- C:\Windows\System\qHZvWVK.exe
  C:\Windows\System\qHZvWVK.exe
  2⤵
  PID:7076
- C:\Windows\System\ZjHBRzL.exe
  C:\Windows\System\ZjHBRzL.exe
  2⤵
  PID:7100
- C:\Windows\System\zsRYPsw.exe
  C:\Windows\System\zsRYPsw.exe
  2⤵
  PID:7124
- C:\Windows\System\hwbSKnl.exe
  C:\Windows\System\hwbSKnl.exe
  2⤵
  PID:7152
- C:\Windows\System\EwYXNMB.exe
  C:\Windows\System\EwYXNMB.exe
  2⤵
  PID:5192
- C:\Windows\System\wraixKu.exe
  C:\Windows\System\wraixKu.exe
  2⤵
  PID:5172
- C:\Windows\System\lmTcKvR.exe
  C:\Windows\System\lmTcKvR.exe
  2⤵
  PID:6596
- C:\Windows\System\qREzYhL.exe
  C:\Windows\System\qREzYhL.exe
  2⤵
  PID:5656
- C:\Windows\System\ohniher.exe
  C:\Windows\System\ohniher.exe
  2⤵
  PID:5764
- C:\Windows\System\ixFEjJH.exe
  C:\Windows\System\ixFEjJH.exe
  2⤵
  PID:5876
- C:\Windows\System\MdBjECR.exe
  C:\Windows\System\MdBjECR.exe
  2⤵
  PID:2628
- C:\Windows\System\WYzcBby.exe
  C:\Windows\System\WYzcBby.exe
  2⤵
  PID:5084
- C:\Windows\System\ITcNwnr.exe
  C:\Windows\System\ITcNwnr.exe
  2⤵
  PID:6156
- C:\Windows\System\rRbLYpi.exe
  C:\Windows\System\rRbLYpi.exe
  2⤵
  PID:6204
- C:\Windows\System\VRoeDyQ.exe
  C:\Windows\System\VRoeDyQ.exe
  2⤵
  PID:6244
- C:\Windows\System\PZJLDWw.exe
  C:\Windows\System\PZJLDWw.exe
  2⤵
  PID:6284
- C:\Windows\System\MrlGKjq.exe
  C:\Windows\System\MrlGKjq.exe
  2⤵
  PID:6352
- C:\Windows\System\xihtLPQ.exe
  C:\Windows\System\xihtLPQ.exe
  2⤵
  PID:6388
- C:\Windows\System\MpuHNGw.exe
  C:\Windows\System\MpuHNGw.exe
  2⤵
  PID:7180
- C:\Windows\System\fUaLUis.exe
  C:\Windows\System\fUaLUis.exe
  2⤵
  PID:7204
- C:\Windows\System\cdqZasZ.exe
  C:\Windows\System\cdqZasZ.exe
  2⤵
  PID:7232
- C:\Windows\System\IyxxTqO.exe
  C:\Windows\System\IyxxTqO.exe
  2⤵
  PID:7248
- C:\Windows\System\QAOrHsY.exe
  C:\Windows\System\QAOrHsY.exe
  2⤵
  PID:7272
- C:\Windows\System\HegLQyz.exe
  C:\Windows\System\HegLQyz.exe
  2⤵
  PID:7292
- C:\Windows\System\IVzXbgN.exe
  C:\Windows\System\IVzXbgN.exe
  2⤵
  PID:7384
- C:\Windows\System\dpQPdcO.exe
  C:\Windows\System\dpQPdcO.exe
  2⤵
  PID:7404
- C:\Windows\System\KdtIqbB.exe
  C:\Windows\System\KdtIqbB.exe
  2⤵
  PID:7428
- C:\Windows\System\MmTQMhz.exe
  C:\Windows\System\MmTQMhz.exe
  2⤵
  PID:7452
- C:\Windows\System\KEpCqbn.exe
  C:\Windows\System\KEpCqbn.exe
  2⤵
  PID:7476
- C:\Windows\System\qETlFhG.exe
  C:\Windows\System\qETlFhG.exe
  2⤵
  PID:7504
- C:\Windows\System\BVXfwxd.exe
  C:\Windows\System\BVXfwxd.exe
  2⤵
  PID:7520
- C:\Windows\System\dolhTKS.exe
  C:\Windows\System\dolhTKS.exe
  2⤵
  PID:7544
- C:\Windows\System\SCcgXTk.exe
  C:\Windows\System\SCcgXTk.exe
  2⤵
  PID:7568
- C:\Windows\System\wYXtbKE.exe
  C:\Windows\System\wYXtbKE.exe
  2⤵
  PID:7592
- C:\Windows\System\OsOFFMH.exe
  C:\Windows\System\OsOFFMH.exe
  2⤵
  PID:7616
- C:\Windows\System\xAAXoCx.exe
  C:\Windows\System\xAAXoCx.exe
  2⤵
  PID:7640
- C:\Windows\System\QEKYrnH.exe
  C:\Windows\System\QEKYrnH.exe
  2⤵
  PID:7656
- C:\Windows\System\hSbUMll.exe
  C:\Windows\System\hSbUMll.exe
  2⤵
  PID:7680
- C:\Windows\System\LVZUsWZ.exe
  C:\Windows\System\LVZUsWZ.exe
  2⤵
  PID:7704
- C:\Windows\System\iUVuvWq.exe
  C:\Windows\System\iUVuvWq.exe
  2⤵
  PID:7728
- C:\Windows\System\lLarGrS.exe
  C:\Windows\System\lLarGrS.exe
  2⤵
  PID:7756
- C:\Windows\System\GGyWPYH.exe
  C:\Windows\System\GGyWPYH.exe
  2⤵
  PID:7776
- C:\Windows\System\xLHOlvT.exe
  C:\Windows\System\xLHOlvT.exe
  2⤵
  PID:7792
- C:\Windows\System\hCPlxZa.exe
  C:\Windows\System\hCPlxZa.exe
  2⤵
  PID:7808
- C:\Windows\System\Jvrmspb.exe
  C:\Windows\System\Jvrmspb.exe
  2⤵
  PID:7824
- C:\Windows\System\GadQcPP.exe
  C:\Windows\System\GadQcPP.exe
  2⤵
  PID:7848
- C:\Windows\System\AQvLmSJ.exe
  C:\Windows\System\AQvLmSJ.exe
  2⤵
  PID:7864
- C:\Windows\System\QlRUAEF.exe
  C:\Windows\System\QlRUAEF.exe
  2⤵
  PID:7880
- C:\Windows\System\hCmoCcr.exe
  C:\Windows\System\hCmoCcr.exe
  2⤵
  PID:7896
- C:\Windows\System\lSsyZIi.exe
  C:\Windows\System\lSsyZIi.exe
  2⤵
  PID:7912
- C:\Windows\System\KrSbuSD.exe
  C:\Windows\System\KrSbuSD.exe
  2⤵
  PID:7928
- C:\Windows\System\XkgHhfa.exe
  C:\Windows\System\XkgHhfa.exe
  2⤵
  PID:7948
- C:\Windows\System\sJQpmSG.exe
  C:\Windows\System\sJQpmSG.exe
  2⤵
  PID:7976
- C:\Windows\System\SaQbuoI.exe
  C:\Windows\System\SaQbuoI.exe
  2⤵
  PID:7996
- C:\Windows\System\uxFhgqF.exe
  C:\Windows\System\uxFhgqF.exe
  2⤵
  PID:8024
- C:\Windows\System\quPqpSt.exe
  C:\Windows\System\quPqpSt.exe
  2⤵
  PID:8056
- C:\Windows\System\RcSeaRF.exe
  C:\Windows\System\RcSeaRF.exe
  2⤵
  PID:8080
- C:\Windows\System\YlzLbsN.exe
  C:\Windows\System\YlzLbsN.exe
  2⤵
  PID:8096
- C:\Windows\System\AUOTEbY.exe
  C:\Windows\System\AUOTEbY.exe
  2⤵
  PID:8124
- C:\Windows\System\QzWNFYj.exe
  C:\Windows\System\QzWNFYj.exe
  2⤵
  PID:8140
- C:\Windows\System\nHUxOOI.exe
  C:\Windows\System\nHUxOOI.exe
  2⤵
  PID:8164
- C:\Windows\System\Xsshuta.exe
  C:\Windows\System\Xsshuta.exe
  2⤵
  PID:8188
- C:\Windows\System\UCrPaFE.exe
  C:\Windows\System\UCrPaFE.exe
  2⤵
  PID:6540
- C:\Windows\System\MfHHhoa.exe
  C:\Windows\System\MfHHhoa.exe
  2⤵
  PID:6600
- C:\Windows\System\SvElZrt.exe
  C:\Windows\System\SvElZrt.exe
  2⤵
  PID:6668
- C:\Windows\System\pMAFyJb.exe
  C:\Windows\System\pMAFyJb.exe
  2⤵
  PID:6576
- C:\Windows\System\PSvYXOw.exe
  C:\Windows\System\PSvYXOw.exe
  2⤵
  PID:7268
- C:\Windows\System\QHOjHMo.exe
  C:\Windows\System\QHOjHMo.exe
  2⤵
  PID:6772
- C:\Windows\System\hdkgToa.exe
  C:\Windows\System\hdkgToa.exe
  2⤵
  PID:6824
- C:\Windows\System\lEGscrj.exe
  C:\Windows\System\lEGscrj.exe
  2⤵
  PID:6876
- C:\Windows\System\LaICnDM.exe
  C:\Windows\System\LaICnDM.exe
  2⤵
  PID:6976
- C:\Windows\System\DAlnEMJ.exe
  C:\Windows\System\DAlnEMJ.exe
  2⤵
  PID:7012
- C:\Windows\System\KfnNxwJ.exe
  C:\Windows\System\KfnNxwJ.exe
  2⤵
  PID:7064
- C:\Windows\System\IWUhNGn.exe
  C:\Windows\System\IWUhNGn.exe
  2⤵
  PID:7116
- C:\Windows\System\jDXwaCq.exe
  C:\Windows\System\jDXwaCq.exe
  2⤵
  PID:7160
- C:\Windows\System\tRgBdUh.exe
  C:\Windows\System\tRgBdUh.exe
  2⤵
  PID:5124
- C:\Windows\System\QuOPlau.exe
  C:\Windows\System\QuOPlau.exe
  2⤵
  PID:7648
- C:\Windows\System\evThjFA.exe
  C:\Windows\System\evThjFA.exe
  2⤵
  PID:7688
- C:\Windows\System\NbGthaJ.exe
  C:\Windows\System\NbGthaJ.exe
  2⤵
  PID:7748
- C:\Windows\System\hVrJqJK.exe
  C:\Windows\System\hVrJqJK.exe
  2⤵
  PID:6340
- C:\Windows\System\AuGYXZa.exe
  C:\Windows\System\AuGYXZa.exe
  2⤵
  PID:6664
- C:\Windows\System\UDKClxE.exe
  C:\Windows\System\UDKClxE.exe
  2⤵
  PID:336
- C:\Windows\System\BpsKFKe.exe
  C:\Windows\System\BpsKFKe.exe
  2⤵
  PID:6164
- C:\Windows\System\QQWiSlX.exe
  C:\Windows\System\QQWiSlX.exe
  2⤵
  PID:6272
- C:\Windows\System\WJbmkLg.exe
  C:\Windows\System\WJbmkLg.exe
  2⤵
  PID:6360
- C:\Windows\System\NfXXRGg.exe
  C:\Windows\System\NfXXRGg.exe
  2⤵
  PID:8036
- C:\Windows\System\soLLQQE.exe
  C:\Windows\System\soLLQQE.exe
  2⤵
  PID:7560
- C:\Windows\System\nIhgFJx.exe
  C:\Windows\System\nIhgFJx.exe
  2⤵
  PID:8068
- C:\Windows\System\nvmjzPc.exe
  C:\Windows\System\nvmjzPc.exe
  2⤵
  PID:7332
- C:\Windows\System\mPFaduy.exe
  C:\Windows\System\mPFaduy.exe
  2⤵
  PID:7136
- C:\Windows\System\VMlbzcW.exe
  C:\Windows\System\VMlbzcW.exe
  2⤵
  PID:7448
- C:\Windows\System\MjkDQTA.exe
  C:\Windows\System\MjkDQTA.exe
  2⤵
  PID:7512
- C:\Windows\System\ADYFQHd.exe
  C:\Windows\System\ADYFQHd.exe
  2⤵
  PID:8204
- C:\Windows\System\SCSgjee.exe
  C:\Windows\System\SCSgjee.exe
  2⤵
  PID:8228
- C:\Windows\System\uaIaBoT.exe
  C:\Windows\System\uaIaBoT.exe
  2⤵
  PID:8248
- C:\Windows\System\sTXbKYv.exe
  C:\Windows\System\sTXbKYv.exe
  2⤵
  PID:8264
- C:\Windows\System\JNKpxaD.exe
  C:\Windows\System\JNKpxaD.exe
  2⤵
  PID:8284
- C:\Windows\System\HakQIPJ.exe
  C:\Windows\System\HakQIPJ.exe
  2⤵
  PID:8300
- C:\Windows\System\ecoMmUY.exe
  C:\Windows\System\ecoMmUY.exe
  2⤵
  PID:8320
- C:\Windows\System\Hnquhxk.exe
  C:\Windows\System\Hnquhxk.exe
  2⤵
  PID:8340
- C:\Windows\System\qJlbPsu.exe
  C:\Windows\System\qJlbPsu.exe
  2⤵
  PID:8364
- C:\Windows\System\ZwaMSHq.exe
  C:\Windows\System\ZwaMSHq.exe
  2⤵
  PID:8388
- C:\Windows\System\eLwnflp.exe
  C:\Windows\System\eLwnflp.exe
  2⤵
  PID:8408
- C:\Windows\System\LkCKjXO.exe
  C:\Windows\System\LkCKjXO.exe
  2⤵
  PID:8428
- C:\Windows\System\TPDvXZF.exe
  C:\Windows\System\TPDvXZF.exe
  2⤵
  PID:8444
- C:\Windows\System\IHzdrlm.exe
  C:\Windows\System\IHzdrlm.exe
  2⤵
  PID:8468
- C:\Windows\System\VIndqfn.exe
  C:\Windows\System\VIndqfn.exe
  2⤵
  PID:8492
- C:\Windows\System\IhuPKdM.exe
  C:\Windows\System\IhuPKdM.exe
  2⤵
  PID:8516
- C:\Windows\System\szYYCvj.exe
  C:\Windows\System\szYYCvj.exe
  2⤵
  PID:8540
- C:\Windows\System\hriaNXr.exe
  C:\Windows\System\hriaNXr.exe
  2⤵
  PID:8556
- C:\Windows\System\DatlMPS.exe
  C:\Windows\System\DatlMPS.exe
  2⤵
  PID:8576
- C:\Windows\System\wFtUyvK.exe
  C:\Windows\System\wFtUyvK.exe
  2⤵
  PID:8592
- C:\Windows\System\khqNIyY.exe
  C:\Windows\System\khqNIyY.exe
  2⤵
  PID:8608
- C:\Windows\System\jgGzYNq.exe
  C:\Windows\System\jgGzYNq.exe
  2⤵
  PID:8628
- C:\Windows\System\rAzyqMR.exe
  C:\Windows\System\rAzyqMR.exe
  2⤵
  PID:8656
- C:\Windows\System\XNjlrbd.exe
  C:\Windows\System\XNjlrbd.exe
  2⤵
  PID:8672
- C:\Windows\System\fhuEHlw.exe
  C:\Windows\System\fhuEHlw.exe
  2⤵
  PID:8696
- C:\Windows\System\qDOYTNe.exe
  C:\Windows\System\qDOYTNe.exe
  2⤵
  PID:8720
- C:\Windows\System\anPuWJw.exe
  C:\Windows\System\anPuWJw.exe
  2⤵
  PID:8780
- C:\Windows\System\NxATygI.exe
  C:\Windows\System\NxATygI.exe
  2⤵
  PID:8808
- C:\Windows\System\EQSrUvz.exe
  C:\Windows\System\EQSrUvz.exe
  2⤵
  PID:8836
- C:\Windows\System\iPmolXk.exe
  C:\Windows\System\iPmolXk.exe
  2⤵
  PID:8860
- C:\Windows\System\gOQInFM.exe
  C:\Windows\System\gOQInFM.exe
  2⤵
  PID:8880
- C:\Windows\System\NycYmFr.exe
  C:\Windows\System\NycYmFr.exe
  2⤵
  PID:8904
- C:\Windows\System\eHigYIb.exe
  C:\Windows\System\eHigYIb.exe
  2⤵
  PID:8928
- C:\Windows\System\jFNViNV.exe
  C:\Windows\System\jFNViNV.exe
  2⤵
  PID:8956
- C:\Windows\System\vUjxOiy.exe
  C:\Windows\System\vUjxOiy.exe
  2⤵
  PID:8980
- C:\Windows\System\hJDzrql.exe
  C:\Windows\System\hJDzrql.exe
  2⤵
  PID:9000
- C:\Windows\System\zyZEPUF.exe
  C:\Windows\System\zyZEPUF.exe
  2⤵
  PID:9024
- C:\Windows\System\wPtUoEd.exe
  C:\Windows\System\wPtUoEd.exe
  2⤵
  PID:9048
- C:\Windows\System\PXlMloS.exe
  C:\Windows\System\PXlMloS.exe
  2⤵
  PID:9072
- C:\Windows\System\tajNkYc.exe
  C:\Windows\System\tajNkYc.exe
  2⤵
  PID:9096
- C:\Windows\System\IlpZLRY.exe
  C:\Windows\System\IlpZLRY.exe
  2⤵
  PID:9112
- C:\Windows\System\cyAfeig.exe
  C:\Windows\System\cyAfeig.exe
  2⤵
  PID:9140
- C:\Windows\System\fiYnrJC.exe
  C:\Windows\System\fiYnrJC.exe
  2⤵
  PID:9160
- C:\Windows\System\nVNPkDX.exe
  C:\Windows\System\nVNPkDX.exe
  2⤵
  PID:9184
- C:\Windows\System\oVlFcdG.exe
  C:\Windows\System\oVlFcdG.exe
  2⤵
  PID:9204
- C:\Windows\System\AHTJvYM.exe
  C:\Windows\System\AHTJvYM.exe
  2⤵
  PID:5308
- C:\Windows\System\tUVdxCl.exe
  C:\Windows\System\tUVdxCl.exe
  2⤵
  PID:7740
- C:\Windows\System\ZaUkIgN.exe
  C:\Windows\System\ZaUkIgN.exe
  2⤵
  PID:6536
- C:\Windows\System\DXntjKe.exe
  C:\Windows\System\DXntjKe.exe
  2⤵
  PID:7816
- C:\Windows\System\RmRstIe.exe
  C:\Windows\System\RmRstIe.exe
  2⤵
  PID:6224
- C:\Windows\System\SyPOOYu.exe
  C:\Windows\System\SyPOOYu.exe
  2⤵
  PID:7892
- C:\Windows\System\ewZcTdC.exe
  C:\Windows\System\ewZcTdC.exe
  2⤵
  PID:7956
- C:\Windows\System\FhKUIRP.exe
  C:\Windows\System\FhKUIRP.exe
  2⤵
  PID:8012
- C:\Windows\System\SmIalVt.exe
  C:\Windows\System\SmIalVt.exe
  2⤵
  PID:8224
- C:\Windows\System\JjBguad.exe
  C:\Windows\System\JjBguad.exe
  2⤵
  PID:8272
- C:\Windows\System\vZjSDCy.exe
  C:\Windows\System\vZjSDCy.exe
  2⤵
  PID:8316
- C:\Windows\System\TErKAXV.exe
  C:\Windows\System\TErKAXV.exe
  2⤵
  PID:8132
- C:\Windows\System\UosSNVK.exe
  C:\Windows\System\UosSNVK.exe
  2⤵
  PID:8180
- C:\Windows\System\lFShwel.exe
  C:\Windows\System\lFShwel.exe
  2⤵
  PID:8484
- C:\Windows\System\WFTpTdS.exe
  C:\Windows\System\WFTpTdS.exe
  2⤵
  PID:6620
- C:\Windows\System\bVANuJM.exe
  C:\Windows\System\bVANuJM.exe
  2⤵
  PID:6712
- C:\Windows\System\PEOgNZk.exe
  C:\Windows\System\PEOgNZk.exe
  2⤵
  PID:6764
- C:\Windows\System\iVJVAyW.exe
  C:\Windows\System\iVJVAyW.exe
  2⤵
  PID:6860
- C:\Windows\System\qMzDbje.exe
  C:\Windows\System\qMzDbje.exe
  2⤵
  PID:9236
- C:\Windows\System\unaInLV.exe
  C:\Windows\System\unaInLV.exe
  2⤵
  PID:9264
- C:\Windows\System\eSMcpqi.exe
  C:\Windows\System\eSMcpqi.exe
  2⤵
  PID:9284
- C:\Windows\System\PQLwxiF.exe
  C:\Windows\System\PQLwxiF.exe
  2⤵
  PID:9308
- C:\Windows\System\Thiejrx.exe
  C:\Windows\System\Thiejrx.exe
  2⤵
  PID:9360
- C:\Windows\System\sWKjzIC.exe
  C:\Windows\System\sWKjzIC.exe
  2⤵
  PID:9528
- C:\Windows\System\inpbfxc.exe
  C:\Windows\System\inpbfxc.exe
  2⤵
  PID:9556
- C:\Windows\System\luGMgEH.exe
  C:\Windows\System\luGMgEH.exe
  2⤵
  PID:9576
- C:\Windows\System\CrKDFqU.exe
  C:\Windows\System\CrKDFqU.exe
  2⤵
  PID:9600
- C:\Windows\System\jcspxRE.exe
  C:\Windows\System\jcspxRE.exe
  2⤵
  PID:9620
- C:\Windows\System\SGIukgH.exe
  C:\Windows\System\SGIukgH.exe
  2⤵
  PID:9648
- C:\Windows\System\emkApiW.exe
  C:\Windows\System\emkApiW.exe
  2⤵
  PID:9672
- C:\Windows\System\byzJMZM.exe
  C:\Windows\System\byzJMZM.exe
  2⤵
  PID:9692
- C:\Windows\System\SPmkwtk.exe
  C:\Windows\System\SPmkwtk.exe
  2⤵
  PID:9712
- C:\Windows\System\WWUzQgq.exe
  C:\Windows\System\WWUzQgq.exe
  2⤵
  PID:9740
- C:\Windows\System\dwrzkoF.exe
  C:\Windows\System\dwrzkoF.exe
  2⤵
  PID:9756
- C:\Windows\System\RVejndt.exe
  C:\Windows\System\RVejndt.exe
  2⤵
  PID:9788
- C:\Windows\System\LJOyMpx.exe
  C:\Windows\System\LJOyMpx.exe
  2⤵
  PID:9808
- C:\Windows\System\tMGmIdr.exe
  C:\Windows\System\tMGmIdr.exe
  2⤵
  PID:9824
- C:\Windows\System\fFEBonU.exe
  C:\Windows\System\fFEBonU.exe
  2⤵
  PID:9848
- C:\Windows\System\GviMxfd.exe
  C:\Windows\System\GviMxfd.exe
  2⤵
  PID:9864
- C:\Windows\System\gMtgsMg.exe
  C:\Windows\System\gMtgsMg.exe
  2⤵
  PID:9892
- C:\Windows\System\JhcfwqZ.exe
  C:\Windows\System\JhcfwqZ.exe
  2⤵
  PID:9908
- C:\Windows\System\CXpIvaK.exe
  C:\Windows\System\CXpIvaK.exe
  2⤵
  PID:9928
- C:\Windows\System\NSDhgGo.exe
  C:\Windows\System\NSDhgGo.exe
  2⤵
  PID:9952
- C:\Windows\System\iqZKudQ.exe
  C:\Windows\System\iqZKudQ.exe
  2⤵
  PID:9968
- C:\Windows\System\rIuGrSs.exe
  C:\Windows\System\rIuGrSs.exe
  2⤵
  PID:9992
- C:\Windows\System\DGLYALz.exe
  C:\Windows\System\DGLYALz.exe
  2⤵
  PID:10020
- C:\Windows\System\wnuPAqS.exe
  C:\Windows\System\wnuPAqS.exe
  2⤵
  PID:10036
- C:\Windows\System\lcdmAcw.exe
  C:\Windows\System\lcdmAcw.exe
  2⤵
  PID:10060
- C:\Windows\System\AfloFiZ.exe
  C:\Windows\System\AfloFiZ.exe
  2⤵
  PID:10084
- C:\Windows\System\TzycfXj.exe
  C:\Windows\System\TzycfXj.exe
  2⤵
  PID:10112
- C:\Windows\System\jmEprRe.exe
  C:\Windows\System\jmEprRe.exe
  2⤵
  PID:10136
- C:\Windows\System\XRVzJXk.exe
  C:\Windows\System\XRVzJXk.exe
  2⤵
  PID:10156
- C:\Windows\System\grkiREf.exe
  C:\Windows\System\grkiREf.exe
  2⤵
  PID:10176
- C:\Windows\System\TiNamtU.exe
  C:\Windows\System\TiNamtU.exe
  2⤵
  PID:10196
- C:\Windows\System\tCznuiv.exe
  C:\Windows\System\tCznuiv.exe
  2⤵
  PID:10216
- C:\Windows\System\BTsJkXg.exe
  C:\Windows\System\BTsJkXg.exe
  2⤵
  PID:8668
- C:\Windows\System\iluGTUd.exe
  C:\Windows\System\iluGTUd.exe
  2⤵
  PID:6928
- C:\Windows\System\FXnnXPu.exe
  C:\Windows\System\FXnnXPu.exe
  2⤵
  PID:7028
- C:\Windows\System\vOKtzTg.exe
  C:\Windows\System\vOKtzTg.exe
  2⤵
  PID:7424
- C:\Windows\System\HcSxLqt.exe
  C:\Windows\System\HcSxLqt.exe
  2⤵
  PID:8924
- C:\Windows\System\DEYsbkV.exe
  C:\Windows\System\DEYsbkV.exe
  2⤵
  PID:7736
- C:\Windows\System\zHJYfhp.exe
  C:\Windows\System\zHJYfhp.exe
  2⤵
  PID:2948
- C:\Windows\System\GMiOmPG.exe
  C:\Windows\System\GMiOmPG.exe
  2⤵
  PID:7804
- C:\Windows\System\YkNLXdI.exe
  C:\Windows\System\YkNLXdI.exe
  2⤵
  PID:9176
- C:\Windows\System\MNSFLXI.exe
  C:\Windows\System\MNSFLXI.exe
  2⤵
  PID:8988
- C:\Windows\System\STvpKMy.exe
  C:\Windows\System\STvpKMy.exe
  2⤵
  PID:5080
- C:\Windows\System\PwpMCbd.exe
  C:\Windows\System\PwpMCbd.exe
  2⤵
  PID:4820
- C:\Windows\System\paBLODB.exe
  C:\Windows\System\paBLODB.exe
  2⤵
  PID:8644
- C:\Windows\System\uuRNuKl.exe
  C:\Windows\System\uuRNuKl.exe
  2⤵
  PID:8704
- C:\Windows\System\Bpidbyn.exe
  C:\Windows\System\Bpidbyn.exe
  2⤵
  PID:7396
- C:\Windows\System\dWcyROA.exe
  C:\Windows\System\dWcyROA.exe
  2⤵
  PID:8196
- C:\Windows\System\nUTFIXX.exe
  C:\Windows\System\nUTFIXX.exe
  2⤵
  PID:9148
- C:\Windows\System\vYCNZhl.exe
  C:\Windows\System\vYCNZhl.exe
  2⤵
  PID:7700
- C:\Windows\System\oYOfEHX.exe
  C:\Windows\System\oYOfEHX.exe
  2⤵
  PID:7908
- C:\Windows\System\DajdoqN.exe
  C:\Windows\System\DajdoqN.exe
  2⤵
  PID:8464
- C:\Windows\System\oBIWZIc.exe
  C:\Windows\System\oBIWZIc.exe
  2⤵
  PID:8512
- C:\Windows\System\wZfklXc.exe
  C:\Windows\System\wZfklXc.exe
  2⤵
  PID:9504
- C:\Windows\System\auvYjIS.exe
  C:\Windows\System\auvYjIS.exe
  2⤵
  PID:7988
- C:\Windows\System\QoRlqhB.exe
  C:\Windows\System\QoRlqhB.exe
  2⤵
  PID:8588
- C:\Windows\System\xcvwwBI.exe
  C:\Windows\System\xcvwwBI.exe
  2⤵
  PID:8636
- C:\Windows\System\GULWbhg.exe
  C:\Windows\System\GULWbhg.exe
  2⤵
  PID:8712
- C:\Windows\System\HpJPrAH.exe
  C:\Windows\System\HpJPrAH.exe
  2⤵
  PID:8772
- C:\Windows\System\EaYFZfc.exe
  C:\Windows\System\EaYFZfc.exe
  2⤵
  PID:10264
- C:\Windows\System\PixnwLD.exe
  C:\Windows\System\PixnwLD.exe
  2⤵
  PID:10296
- C:\Windows\System\IecmSYr.exe
  C:\Windows\System\IecmSYr.exe
  2⤵
  PID:10324
- C:\Windows\System\yCwLIHD.exe
  C:\Windows\System\yCwLIHD.exe
  2⤵
  PID:10340
- C:\Windows\System\YlojZra.exe
  C:\Windows\System\YlojZra.exe
  2⤵
  PID:10368
- C:\Windows\System\taUHAgK.exe
  C:\Windows\System\taUHAgK.exe
  2⤵
  PID:10392
- C:\Windows\System\wGOCnbB.exe
  C:\Windows\System\wGOCnbB.exe
  2⤵
  PID:10416
- C:\Windows\System\TqlTvls.exe
  C:\Windows\System\TqlTvls.exe
  2⤵
  PID:10444
- C:\Windows\System\yXAOEqM.exe
  C:\Windows\System\yXAOEqM.exe
  2⤵
  PID:10468
- C:\Windows\System\DKjPseg.exe
  C:\Windows\System\DKjPseg.exe
  2⤵
  PID:10488
- C:\Windows\System\kpPSMfY.exe
  C:\Windows\System\kpPSMfY.exe
  2⤵
  PID:10516
- C:\Windows\System\nZvPBSD.exe
  C:\Windows\System\nZvPBSD.exe
  2⤵
  PID:10536
- C:\Windows\System\mTHUaDo.exe
  C:\Windows\System\mTHUaDo.exe
  2⤵
  PID:10568
- C:\Windows\System\TwvrIcA.exe
  C:\Windows\System\TwvrIcA.exe
  2⤵
  PID:10588
- C:\Windows\System\sURhzvd.exe
  C:\Windows\System\sURhzvd.exe
  2⤵
  PID:10608
- C:\Windows\System\jjTJzZt.exe
  C:\Windows\System\jjTJzZt.exe
  2⤵
  PID:10632
- C:\Windows\System\TJdQTTX.exe
  C:\Windows\System\TJdQTTX.exe
  2⤵
  PID:10660
- C:\Windows\System\VCoQYwA.exe
  C:\Windows\System\VCoQYwA.exe
  2⤵
  PID:10684
- C:\Windows\System\yWXUPWH.exe
  C:\Windows\System\yWXUPWH.exe
  2⤵
  PID:10708
- C:\Windows\System\opqjINZ.exe
  C:\Windows\System\opqjINZ.exe
  2⤵
  PID:10724
- C:\Windows\System\YEXAJIm.exe
  C:\Windows\System\YEXAJIm.exe
  2⤵
  PID:10756
- C:\Windows\System\ZYewgoM.exe
  C:\Windows\System\ZYewgoM.exe
  2⤵
  PID:10780
- C:\Windows\System\GcCWZUy.exe
  C:\Windows\System\GcCWZUy.exe
  2⤵
  PID:10800
- C:\Windows\System\hyOeGqJ.exe
  C:\Windows\System\hyOeGqJ.exe
  2⤵
  PID:10816
- C:\Windows\System\TveqQfP.exe
  C:\Windows\System\TveqQfP.exe
  2⤵
  PID:10832
- C:\Windows\System\ULkEhWj.exe
  C:\Windows\System\ULkEhWj.exe
  2⤵
  PID:10852
- C:\Windows\System\OKnWDVW.exe
  C:\Windows\System\OKnWDVW.exe
  2⤵
  PID:10876
- C:\Windows\System\GFCgQwy.exe
  C:\Windows\System\GFCgQwy.exe
  2⤵
  PID:10932
- C:\Windows\System\loAvIAq.exe
  C:\Windows\System\loAvIAq.exe
  2⤵
  PID:10956
- C:\Windows\System\XyeiEIW.exe
  C:\Windows\System\XyeiEIW.exe
  2⤵
  PID:10988
- C:\Windows\System\JWpTRCA.exe
  C:\Windows\System\JWpTRCA.exe
  2⤵
  PID:11004
- C:\Windows\System\mLhLclk.exe
  C:\Windows\System\mLhLclk.exe
  2⤵
  PID:11024
- C:\Windows\System\iWfQyYC.exe
  C:\Windows\System\iWfQyYC.exe
  2⤵
  PID:11048
- C:\Windows\System\QFPJSqT.exe
  C:\Windows\System\QFPJSqT.exe
  2⤵
  PID:11072
- C:\Windows\System\XNZhYKN.exe
  C:\Windows\System\XNZhYKN.exe
  2⤵
  PID:11092
- C:\Windows\System\QhxstDO.exe
  C:\Windows\System\QhxstDO.exe
  2⤵
  PID:11116
- C:\Windows\System\ImIHjOv.exe
  C:\Windows\System\ImIHjOv.exe
  2⤵
  PID:11140
- C:\Windows\System\UkxUNUr.exe
  C:\Windows\System\UkxUNUr.exe
  2⤵
  PID:11160
- C:\Windows\System\ISzZzQb.exe
  C:\Windows\System\ISzZzQb.exe
  2⤵
  PID:11184
- C:\Windows\System\GJKGnak.exe
  C:\Windows\System\GJKGnak.exe
  2⤵
  PID:11208
- C:\Windows\System\OrUKKQs.exe
  C:\Windows\System\OrUKKQs.exe
  2⤵
  PID:11228
- C:\Windows\System\FBbYhco.exe
  C:\Windows\System\FBbYhco.exe
  2⤵
  PID:11256
- C:\Windows\System\QjTiftO.exe
  C:\Windows\System\QjTiftO.exe
  2⤵
  PID:8800
- C:\Windows\System\BFBEhoU.exe
  C:\Windows\System\BFBEhoU.exe
  2⤵
  PID:8848
- C:\Windows\System\hmbdRYv.exe
  C:\Windows\System\hmbdRYv.exe
  2⤵
  PID:9316
- C:\Windows\System\NTEzEfK.exe
  C:\Windows\System\NTEzEfK.exe
  2⤵
  PID:9344
- C:\Windows\System\aDilEue.exe
  C:\Windows\System\aDilEue.exe
  2⤵
  PID:10124
- C:\Windows\System\mRiYDtG.exe
  C:\Windows\System\mRiYDtG.exe
  2⤵
  PID:668
- C:\Windows\System\tzJeAAp.exe
  C:\Windows\System\tzJeAAp.exe
  2⤵
  PID:9496
- C:\Windows\System\WUysvUy.exe
  C:\Windows\System\WUysvUy.exe
  2⤵
  PID:9588
- C:\Windows\System\fSbLXSn.exe
  C:\Windows\System\fSbLXSn.exe
  2⤵
  PID:9616
- C:\Windows\System\cFeJiFF.exe
  C:\Windows\System\cFeJiFF.exe
  2⤵
  PID:6816
- C:\Windows\System\dyCXbvQ.exe
  C:\Windows\System\dyCXbvQ.exe
  2⤵
  PID:9732
- C:\Windows\System\DcXsrNM.exe
  C:\Windows\System\DcXsrNM.exe
  2⤵
  PID:9768
- C:\Windows\System\UAcNzZL.exe
  C:\Windows\System\UAcNzZL.exe
  2⤵
  PID:9800
- C:\Windows\System\mQEcjlf.exe
  C:\Windows\System\mQEcjlf.exe
  2⤵
  PID:9836
- C:\Windows\System\RYJVjpY.exe
  C:\Windows\System\RYJVjpY.exe
  2⤵
  PID:9872
- C:\Windows\System\TJBmqZF.exe
  C:\Windows\System\TJBmqZF.exe
  2⤵
  PID:9904
- C:\Windows\System\tDAeswv.exe
  C:\Windows\System\tDAeswv.exe
  2⤵
  PID:9944
- C:\Windows\System\BsGFlbj.exe
  C:\Windows\System\BsGFlbj.exe
  2⤵
  PID:9936
- C:\Windows\System\JGfRmux.exe
  C:\Windows\System\JGfRmux.exe
  2⤵
  PID:10012
- C:\Windows\System\XEJKhEH.exe
  C:\Windows\System\XEJKhEH.exe
  2⤵
  PID:10100
- C:\Windows\System\lSdIepS.exe
  C:\Windows\System\lSdIepS.exe
  2⤵
  PID:10228
- C:\Windows\System\TwddfnT.exe
  C:\Windows\System\TwddfnT.exe
  2⤵
  PID:1612
- C:\Windows\System\cdAsilK.exe
  C:\Windows\System\cdAsilK.exe
  2⤵
  PID:7324
- C:\Windows\System\YooJCtP.exe
  C:\Windows\System\YooJCtP.exe
  2⤵
  PID:7876
- C:\Windows\System\nWaqCFn.exe
  C:\Windows\System\nWaqCFn.exe
  2⤵
  PID:2168
- C:\Windows\System\elTMDGO.exe
  C:\Windows\System\elTMDGO.exe
  2⤵
  PID:8604
- C:\Windows\System\RcHxwLN.exe
  C:\Windows\System\RcHxwLN.exe
  2⤵
  PID:10248
- C:\Windows\System\iQoEfrB.exe
  C:\Windows\System\iQoEfrB.exe
  2⤵
  PID:10280
- C:\Windows\System\hVzowVQ.exe
  C:\Windows\System\hVzowVQ.exe
  2⤵
  PID:10348
- C:\Windows\System\gyfKzbD.exe
  C:\Windows\System\gyfKzbD.exe
  2⤵
  PID:10400
- C:\Windows\System\oQJCykN.exe
  C:\Windows\System\oQJCykN.exe
  2⤵
  PID:10456
- C:\Windows\System\Xielcsd.exe
  C:\Windows\System\Xielcsd.exe
  2⤵
  PID:10504
- C:\Windows\System\csQXQZZ.exe
  C:\Windows\System\csQXQZZ.exe
  2⤵
  PID:10552
- C:\Windows\System\pxYXpQh.exe
  C:\Windows\System\pxYXpQh.exe
  2⤵
  PID:10624
- C:\Windows\System\YCIzCWj.exe
  C:\Windows\System\YCIzCWj.exe
  2⤵
  PID:10676
- C:\Windows\System\QCPIzSY.exe
  C:\Windows\System\QCPIzSY.exe
  2⤵
  PID:10720
- C:\Windows\System\cxfSOCe.exe
  C:\Windows\System\cxfSOCe.exe
  2⤵
  PID:10764
- C:\Windows\System\BFLSDrk.exe
  C:\Windows\System\BFLSDrk.exe
  2⤵
  PID:10812
- C:\Windows\System\SeWvOnd.exe
  C:\Windows\System\SeWvOnd.exe
  2⤵
  PID:10860
- C:\Windows\System\SKZhBgm.exe
  C:\Windows\System\SKZhBgm.exe
  2⤵
  PID:10916
- C:\Windows\System\NdmrhWA.exe
  C:\Windows\System\NdmrhWA.exe
  2⤵
  PID:10964
- C:\Windows\System\utqSgyW.exe
  C:\Windows\System\utqSgyW.exe
  2⤵
  PID:11016
- C:\Windows\System\UcDnjWi.exe
  C:\Windows\System\UcDnjWi.exe
  2⤵
  PID:11064
- C:\Windows\System\TdUqCKJ.exe
  C:\Windows\System\TdUqCKJ.exe
  2⤵
  PID:11100
- C:\Windows\System\SlMdHHt.exe
  C:\Windows\System\SlMdHHt.exe
  2⤵
  PID:11148
- C:\Windows\System\DXAQtBF.exe
  C:\Windows\System\DXAQtBF.exe
  2⤵
  PID:11196
- C:\Windows\System\bJbxDru.exe
  C:\Windows\System\bJbxDru.exe
  2⤵
  PID:11252
- C:\Windows\System\hyjZlwL.exe
  C:\Windows\System\hyjZlwL.exe
  2⤵
  PID:8852
- C:\Windows\System\qJPYeXt.exe
  C:\Windows\System\qJPYeXt.exe
  2⤵
  PID:3864
- C:\Windows\System\ZtWekbN.exe
  C:\Windows\System\ZtWekbN.exe
  2⤵
  PID:3944
- C:\Windows\System\CbWrNbs.exe
  C:\Windows\System\CbWrNbs.exe
  2⤵
  PID:2804
- C:\Windows\System\ajFkHOY.exe
  C:\Windows\System\ajFkHOY.exe
  2⤵
  PID:4564
- C:\Windows\System\dbETDzG.exe
  C:\Windows\System\dbETDzG.exe
  2⤵
  PID:1840
- C:\Windows\System\PRzjPwe.exe
  C:\Windows\System\PRzjPwe.exe
  2⤵
  PID:3180
- C:\Windows\System\ejjQZxK.exe
  C:\Windows\System\ejjQZxK.exe
  2⤵
  PID:4384
- C:\Windows\System\zEiTgFE.exe
  C:\Windows\System\zEiTgFE.exe
  2⤵
  PID:1808
- C:\Windows\System\CUYieiM.exe
  C:\Windows\System\CUYieiM.exe
  2⤵
  PID:1368
- C:\Windows\System\vkHHHYN.exe
  C:\Windows\System\vkHHHYN.exe
  2⤵
  PID:5448
- C:\Windows\System\nQpuNKU.exe
  C:\Windows\System\nQpuNKU.exe
  2⤵
  PID:2544
- C:\Windows\System\MehgQFT.exe
  C:\Windows\System\MehgQFT.exe
  2⤵
  PID:5824
- C:\Windows\System\hCwbdNg.exe
  C:\Windows\System\hCwbdNg.exe
  2⤵
  PID:9420
- C:\Windows\System\zJxJoaN.exe
  C:\Windows\System\zJxJoaN.exe
  2⤵
  PID:9644
- C:\Windows\System\OILygQl.exe
  C:\Windows\System\OILygQl.exe
  2⤵
  PID:9860
- C:\Windows\System\KdooXLh.exe
  C:\Windows\System\KdooXLh.exe
  2⤵
  PID:10004
- C:\Windows\System\KTfyDsI.exe
  C:\Windows\System\KTfyDsI.exe
  2⤵
  PID:11268
- C:\Windows\System\nHbNvag.exe
  C:\Windows\System\nHbNvag.exe
  2⤵
  PID:11288
- C:\Windows\System\KDYXdti.exe
  C:\Windows\System\KDYXdti.exe
  2⤵
  PID:11312
- C:\Windows\System\fLYARsD.exe
  C:\Windows\System\fLYARsD.exe
  2⤵
  PID:11344
- C:\Windows\System\wXZMhuq.exe
  C:\Windows\System\wXZMhuq.exe
  2⤵
  PID:11368
- C:\Windows\System\ByEbqAH.exe
  C:\Windows\System\ByEbqAH.exe
  2⤵
  PID:11392
- C:\Windows\System\UCnKMYN.exe
  C:\Windows\System\UCnKMYN.exe
  2⤵
  PID:11428
- C:\Windows\System\LpYxMCB.exe
  C:\Windows\System\LpYxMCB.exe
  2⤵
  PID:11452
- C:\Windows\System\angzqlq.exe
  C:\Windows\System\angzqlq.exe
  2⤵
  PID:11472
- C:\Windows\System\VlVvlky.exe
  C:\Windows\System\VlVvlky.exe
  2⤵
  PID:11496
- C:\Windows\System\bVdoXMv.exe
  C:\Windows\System\bVdoXMv.exe
  2⤵
  PID:11528
- C:\Windows\System\fJlZNlw.exe
  C:\Windows\System\fJlZNlw.exe
  2⤵
  PID:11556
- C:\Windows\System\XHiAWiz.exe
  C:\Windows\System\XHiAWiz.exe
  2⤵
  PID:11576
- C:\Windows\System\wWSKPrZ.exe
  C:\Windows\System\wWSKPrZ.exe
  2⤵
  PID:11600
- C:\Windows\System\bLVWuer.exe
  C:\Windows\System\bLVWuer.exe
  2⤵
  PID:11616
- C:\Windows\System\mTSNFGh.exe
  C:\Windows\System\mTSNFGh.exe
  2⤵
  PID:11640
- C:\Windows\System\DSPfXHd.exe
  C:\Windows\System\DSPfXHd.exe
  2⤵
  PID:11668
- C:\Windows\System\JWAPqSp.exe
  C:\Windows\System\JWAPqSp.exe
  2⤵
  PID:11692
- C:\Windows\System\BnFMkYk.exe
  C:\Windows\System\BnFMkYk.exe
  2⤵
  PID:11716
- C:\Windows\System\KMZMluX.exe
  C:\Windows\System\KMZMluX.exe
  2⤵
  PID:11748
- C:\Windows\System\CuWluez.exe
  C:\Windows\System\CuWluez.exe
  2⤵
  PID:11768
- C:\Windows\System\OJCCAOB.exe
  C:\Windows\System\OJCCAOB.exe
  2⤵
  PID:11792
- C:\Windows\System\AUhVbpU.exe
  C:\Windows\System\AUhVbpU.exe
  2⤵
  PID:11812
- C:\Windows\System\jZjvULu.exe
  C:\Windows\System\jZjvULu.exe
  2⤵
  PID:11828
- C:\Windows\System\DTWUuBA.exe
  C:\Windows\System\DTWUuBA.exe
  2⤵
  PID:11848
- C:\Windows\System\flhaAIw.exe
  C:\Windows\System\flhaAIw.exe
  2⤵
  PID:11868
- C:\Windows\System\JCeuMAe.exe
  C:\Windows\System\JCeuMAe.exe
  2⤵
  PID:11892
- C:\Windows\System\tmXYydp.exe
  C:\Windows\System\tmXYydp.exe
  2⤵
  PID:11920
- C:\Windows\System\utoqStC.exe
  C:\Windows\System\utoqStC.exe
  2⤵
  PID:11940
- C:\Windows\System\oDGAFdd.exe
  C:\Windows\System\oDGAFdd.exe
  2⤵
  PID:11960
- C:\Windows\System\XeLYcNZ.exe
  C:\Windows\System\XeLYcNZ.exe
  2⤵
  PID:11984
- C:\Windows\System\pBxyafd.exe
  C:\Windows\System\pBxyafd.exe
  2⤵
  PID:12008
- C:\Windows\System\oAAKTen.exe
  C:\Windows\System\oAAKTen.exe
  2⤵
  PID:12032
- C:\Windows\System\ASathJO.exe
  C:\Windows\System\ASathJO.exe
  2⤵
  PID:12052
- C:\Windows\System\VpadOuT.exe
  C:\Windows\System\VpadOuT.exe
  2⤵
  PID:12080
- C:\Windows\System\nEwCNWY.exe
  C:\Windows\System\nEwCNWY.exe
  2⤵
  PID:12108
- C:\Windows\System\TIUnKKF.exe
  C:\Windows\System\TIUnKKF.exe
  2⤵
  PID:12128
- C:\Windows\System\SBQHsug.exe
  C:\Windows\System\SBQHsug.exe
  2⤵
  PID:12152
- C:\Windows\System\aDtTUOL.exe
  C:\Windows\System\aDtTUOL.exe
  2⤵
  PID:12176
- C:\Windows\System\SMjqnMa.exe
  C:\Windows\System\SMjqnMa.exe
  2⤵
  PID:12200
- C:\Windows\System\wAAIiIJ.exe
  C:\Windows\System\wAAIiIJ.exe
  2⤵
  PID:12220
- C:\Windows\System\JmMWqeU.exe
  C:\Windows\System\JmMWqeU.exe
  2⤵
  PID:12240
- C:\Windows\System\IykShQL.exe
  C:\Windows\System\IykShQL.exe
  2⤵
  PID:12264
- C:\Windows\System\KutyQgl.exe
  C:\Windows\System\KutyQgl.exe
  2⤵
  PID:9300
- C:\Windows\System\VuaYWXG.exe
  C:\Windows\System\VuaYWXG.exe
  2⤵
  PID:9540
- C:\Windows\System\QipZCiI.exe
  C:\Windows\System\QipZCiI.exe
  2⤵
  PID:10476
- C:\Windows\System\MAiVlqy.exe
  C:\Windows\System\MAiVlqy.exe
  2⤵
  PID:10604
- C:\Windows\System\RAWWTiK.exe
  C:\Windows\System\RAWWTiK.exe
  2⤵
  PID:10796
- C:\Windows\System\CIdzDbj.exe
  C:\Windows\System\CIdzDbj.exe
  2⤵
  PID:11032
- C:\Windows\System\iaINnUZ.exe
  C:\Windows\System\iaINnUZ.exe
  2⤵
  PID:11136
- C:\Windows\System\CxEOnLU.exe
  C:\Windows\System\CxEOnLU.exe
  2⤵
  PID:12292
- C:\Windows\System\GCurdfS.exe
  C:\Windows\System\GCurdfS.exe
  2⤵
  PID:12312
- C:\Windows\System\YLUudsp.exe
  C:\Windows\System\YLUudsp.exe
  2⤵
  PID:12340
- C:\Windows\System\QdCmaMD.exe
  C:\Windows\System\QdCmaMD.exe
  2⤵
  PID:12364
- C:\Windows\System\TNmyzJy.exe
  C:\Windows\System\TNmyzJy.exe
  2⤵
  PID:12392
- C:\Windows\System\GWtRzqs.exe
  C:\Windows\System\GWtRzqs.exe
  2⤵
  PID:12412
- C:\Windows\System\DIlozBH.exe
  C:\Windows\System\DIlozBH.exe
  2⤵
  PID:12440
- C:\Windows\System\mgQQADP.exe
  C:\Windows\System\mgQQADP.exe
  2⤵
  PID:12460
- C:\Windows\System\kpyZHLp.exe
  C:\Windows\System\kpyZHLp.exe
  2⤵
  PID:12484
- C:\Windows\System\tEKSyAX.exe
  C:\Windows\System\tEKSyAX.exe
  2⤵
  PID:12504
- C:\Windows\System\AAFEbPW.exe
  C:\Windows\System\AAFEbPW.exe
  2⤵
  PID:12524
- C:\Windows\System\rYvrSLX.exe
  C:\Windows\System\rYvrSLX.exe
  2⤵
  PID:12548
- C:\Windows\System\fmxWxiV.exe
  C:\Windows\System\fmxWxiV.exe
  2⤵
  PID:12572
- C:\Windows\System\afFTfCk.exe
  C:\Windows\System\afFTfCk.exe
  2⤵
  PID:12596
- C:\Windows\System\RDaMdel.exe
  C:\Windows\System\RDaMdel.exe
  2⤵
  PID:12620
- C:\Windows\System\nOnbfGP.exe
  C:\Windows\System\nOnbfGP.exe
  2⤵
  PID:12640
- C:\Windows\System\HLxdeHw.exe
  C:\Windows\System\HLxdeHw.exe
  2⤵
  PID:12660
- C:\Windows\System\bMzPAXl.exe
  C:\Windows\System\bMzPAXl.exe
  2⤵
  PID:12684
- C:\Windows\System\pRpHYzs.exe
  C:\Windows\System\pRpHYzs.exe
  2⤵
  PID:12708
- C:\Windows\System\fxHyKfL.exe
  C:\Windows\System\fxHyKfL.exe
  2⤵
  PID:12732
- C:\Windows\System\dGbvcOt.exe
  C:\Windows\System\dGbvcOt.exe
  2⤵
  PID:12756
- C:\Windows\System\fhWqbxq.exe
  C:\Windows\System\fhWqbxq.exe
  2⤵
  PID:12776
- C:\Windows\System\WxSpxzJ.exe
  C:\Windows\System\WxSpxzJ.exe
  2⤵
  PID:12796
- C:\Windows\System\zHODfVY.exe
  C:\Windows\System\zHODfVY.exe
  2⤵
  PID:12816
- C:\Windows\System\Eusdgbj.exe
  C:\Windows\System\Eusdgbj.exe
  2⤵
  PID:12836
- C:\Windows\System\RHhAGPZ.exe
  C:\Windows\System\RHhAGPZ.exe
  2⤵
  PID:12856
- C:\Windows\System\aJlWhsV.exe
  C:\Windows\System\aJlWhsV.exe
  2⤵
  PID:12876
- C:\Windows\System\AzHHsON.exe
  C:\Windows\System\AzHHsON.exe
  2⤵
  PID:12900
- C:\Windows\System\mWzuQei.exe
  C:\Windows\System\mWzuQei.exe
  2⤵
  PID:12920
- C:\Windows\System\AUTottK.exe
  C:\Windows\System\AUTottK.exe
  2⤵
  PID:12936
- C:\Windows\System\PiMlEgj.exe
  C:\Windows\System\PiMlEgj.exe
  2⤵
  PID:12960
- C:\Windows\System\iRTXfbq.exe
  C:\Windows\System\iRTXfbq.exe
  2⤵
  PID:12980
- C:\Windows\System\pCvjiuy.exe
  C:\Windows\System\pCvjiuy.exe
  2⤵
  PID:12996
- C:\Windows\System\TtLJFeL.exe
  C:\Windows\System\TtLJFeL.exe
  2⤵
  PID:13012
- C:\Windows\System\TCoJQAl.exe
  C:\Windows\System\TCoJQAl.exe
  2⤵
  PID:13028
- C:\Windows\System\AZKzGaZ.exe
  C:\Windows\System\AZKzGaZ.exe
  2⤵
  PID:13048
- C:\Windows\System\akNcKEy.exe
  C:\Windows\System\akNcKEy.exe
  2⤵
  PID:13068
- C:\Windows\System\tkaJEmG.exe
  C:\Windows\System\tkaJEmG.exe
  2⤵
  PID:13100
- C:\Windows\System\dpQLAHJ.exe
  C:\Windows\System\dpQLAHJ.exe
  2⤵
  PID:13120
- C:\Windows\System\hdsOtlb.exe
  C:\Windows\System\hdsOtlb.exe
  2⤵
  PID:13144
- C:\Windows\System\AuVjmtB.exe
  C:\Windows\System\AuVjmtB.exe
  2⤵
  PID:13164
- C:\Windows\System\ZIjwcJB.exe
  C:\Windows\System\ZIjwcJB.exe
  2⤵
  PID:13184
- C:\Windows\System\NZWnVpx.exe
  C:\Windows\System\NZWnVpx.exe
  2⤵
  PID:13212
- C:\Windows\System\zwNCbww.exe
  C:\Windows\System\zwNCbww.exe
  2⤵
  PID:13236
- C:\Windows\System\ykwskBh.exe
  C:\Windows\System\ykwskBh.exe
  2⤵
  PID:13256
- C:\Windows\System\XXciETT.exe
  C:\Windows\System\XXciETT.exe
  2⤵
  PID:13280
- C:\Windows\System\IVbvUmG.exe
  C:\Windows\System\IVbvUmG.exe
  2⤵
  PID:12124
- C:\Windows\System\jFYLAMR.exe
  C:\Windows\System\jFYLAMR.exe
  2⤵
  PID:12208
- C:\Windows\System\jmafKro.exe
  C:\Windows\System\jmafKro.exe
  2⤵
  PID:11756
- C:\Windows\System\QXGTwvV.exe
  C:\Windows\System\QXGTwvV.exe
  2⤵
  PID:13056
- C:\Windows\System\BiSMWxD.exe
  C:\Windows\System\BiSMWxD.exe
  2⤵
  PID:3600
- C:\Windows\System\MlDVkAS.exe
  C:\Windows\System\MlDVkAS.exe
  2⤵
  PID:12432
- C:\Windows\System\DdirDlE.exe
  C:\Windows\System\DdirDlE.exe
  2⤵
  PID:1248
- C:\Windows\System\XGlsYdf.exe
  C:\Windows\System\XGlsYdf.exe
  2⤵
  PID:12196
- C:\Windows\System\wHLiiWV.exe
  C:\Windows\System\wHLiiWV.exe
  2⤵
  PID:4012
- C:\Windows\System\ikUMkoN.exe
  C:\Windows\System\ikUMkoN.exe
  2⤵
  PID:12704
- C:\Windows\System\WxxGtRw.exe
  C:\Windows\System\WxxGtRw.exe
  2⤵
  PID:11000
- C:\Windows\System\GDIFitJ.exe
  C:\Windows\System\GDIFitJ.exe
  2⤵
  PID:11516
- C:\Windows\System\PzaaZLI.exe
  C:\Windows\System\PzaaZLI.exe
  2⤵
  PID:9820
- C:\Windows\System\zIVLIPL.exe
  C:\Windows\System\zIVLIPL.exe
  2⤵
  PID:4984
- C:\Windows\System\FdpUZGQ.exe
  C:\Windows\System\FdpUZGQ.exe
  2⤵
  PID:4224
- C:\Windows\System\jGjVKFi.exe
  C:\Windows\System\jGjVKFi.exe
  2⤵
  PID:3240
- C:\Windows\System\FeOMdEW.exe
  C:\Windows\System\FeOMdEW.exe
  2⤵
  PID:12872
- C:\Windows\System\WmxcqCe.exe
  C:\Windows\System\WmxcqCe.exe
  2⤵
  PID:2340
- C:\Windows\System\bsFweVd.exe
  C:\Windows\System\bsFweVd.exe
  2⤵
  PID:12452
- C:\Windows\System\tTRQBpX.exe
  C:\Windows\System\tTRQBpX.exe
  2⤵
  PID:12520
- C:\Windows\System\QFdWUOf.exe
  C:\Windows\System\QFdWUOf.exe
  2⤵
  PID:10716
- C:\Windows\System\ZfNstyA.exe
  C:\Windows\System\ZfNstyA.exe
  2⤵
  PID:9796
- C:\Windows\System\SmvICtV.exe
  C:\Windows\System\SmvICtV.exe
  2⤵
  PID:13020
- C:\Windows\System\kHWRKoT.exe
  C:\Windows\System\kHWRKoT.exe
  2⤵
  PID:2080
- C:\Windows\System\kwwFROj.exe
  C:\Windows\System\kwwFROj.exe
  2⤵
  PID:11800
- C:\Windows\System\bAUJPla.exe
  C:\Windows\System\bAUJPla.exe
  2⤵
  PID:11864
- C:\Windows\System\UVHHYFx.exe
  C:\Windows\System\UVHHYFx.exe
  2⤵
  PID:11296
- C:\Windows\System\isTJcUW.exe
  C:\Windows\System\isTJcUW.exe
  2⤵
  PID:13192
- C:\Windows\System\HteUrjj.exe
  C:\Windows\System\HteUrjj.exe
  2⤵
  PID:13252
- C:\Windows\System\DJbNFqX.exe
  C:\Windows\System\DJbNFqX.exe
  2⤵
  PID:13300
- C:\Windows\System\EmyHArm.exe
  C:\Windows\System\EmyHArm.exe
  2⤵
  PID:12788
- C:\Windows\System\nKiOtYJ.exe
  C:\Windows\System\nKiOtYJ.exe
  2⤵
  PID:12028
- C:\Windows\System\BNKxOBm.exe
  C:\Windows\System\BNKxOBm.exe
  2⤵
  PID:3208
- C:\Windows\System\oilORFT.exe
  C:\Windows\System\oilORFT.exe
  2⤵
  PID:12456
- C:\Windows\System\WrqgFpn.exe
  C:\Windows\System\WrqgFpn.exe
  2⤵
  PID:4880
- C:\Windows\System\sEHRCVt.exe
  C:\Windows\System\sEHRCVt.exe
  2⤵
  PID:11584
- C:\Windows\System\QGgWMbZ.exe
  C:\Windows\System\QGgWMbZ.exe
  2⤵
  PID:7472
- C:\Windows\System\CZlvYbZ.exe
  C:\Windows\System\CZlvYbZ.exe
  2⤵
  PID:5240
- C:\Windows\System\TDsAGsn.exe
  C:\Windows\System\TDsAGsn.exe
  2⤵
  PID:11900
- C:\Windows\System\vqqmgPC.exe
  C:\Windows\System\vqqmgPC.exe
  2⤵
  PID:3564
- C:\Windows\System\kiUmybd.exe
  C:\Windows\System\kiUmybd.exe
  2⤵
  PID:11840
- C:\Windows\System\LwaveYj.exe
  C:\Windows\System\LwaveYj.exe
  2⤵
  PID:12768
- C:\Windows\System\GuEcITU.exe
  C:\Windows\System\GuEcITU.exe
  2⤵
  PID:12556
- C:\Windows\System\hbbNGps.exe
  C:\Windows\System\hbbNGps.exe
  2⤵
  PID:13264
- C:\Windows\System\deemzPY.exe
  C:\Windows\System\deemzPY.exe
  2⤵
  PID:11444
- C:\Windows\System\PlcZsOG.exe
  C:\Windows\System\PlcZsOG.exe
  2⤵
  PID:13116
- C:\Windows\System\DBciqFM.exe
  C:\Windows\System\DBciqFM.exe
  2⤵
  PID:12568
- C:\Windows\System\eeqsxyn.exe
  C:\Windows\System\eeqsxyn.exe
  2⤵
  PID:10656
- C:\Windows\System\xfwJodx.exe
  C:\Windows\System\xfwJodx.exe
  2⤵
  PID:12908
- C:\Windows\System\dMJXeFx.exe
  C:\Windows\System\dMJXeFx.exe
  2⤵
  PID:13040
- C:\Windows\System\lGkblBX.exe
  C:\Windows\System\lGkblBX.exe
  2⤵
  PID:13248
- C:\Windows\System\fLkIknY.exe
  C:\Windows\System\fLkIknY.exe
  2⤵
  PID:12016
- C:\Windows\System\TdcLnDC.exe
  C:\Windows\System\TdcLnDC.exe
  2⤵
  PID:10384
- C:\Windows\System\HKnSTyL.exe
  C:\Windows\System\HKnSTyL.exe
  2⤵
  PID:4468
- C:\Windows\System\gehhSfp.exe
  C:\Windows\System\gehhSfp.exe
  2⤵
  PID:8824
- C:\Windows\System\erJyfIB.exe
  C:\Windows\System\erJyfIB.exe
  2⤵
  PID:5416
- C:\Windows\System\xVEksDI.exe
  C:\Windows\System\xVEksDI.exe
  2⤵
  PID:12136
- C:\Windows\System\gjGEqAV.exe
  C:\Windows\System\gjGEqAV.exe
  2⤵
  PID:10868
- C:\Windows\System\XsacJpq.exe
  C:\Windows\System\XsacJpq.exe
  2⤵
  PID:11364
- C:\Windows\System\qbIhTFm.exe
  C:\Windows\System\qbIhTFm.exe
  2⤵
  PID:11860
- C:\Windows\System\NFAyNBu.exe
  C:\Windows\System\NFAyNBu.exe
  2⤵
  PID:11636
- C:\Windows\System\bmenIFl.exe
  C:\Windows\System\bmenIFl.exe
  2⤵
  PID:4076
- C:\Windows\System\LpJMOKe.exe
  C:\Windows\System\LpJMOKe.exe
  2⤵
  PID:3496
- C:\Windows\System\ZhlgzhF.exe
  C:\Windows\System\ZhlgzhF.exe
  2⤵
  PID:13180
- C:\Windows\System\jykurDX.exe
  C:\Windows\System\jykurDX.exe
  2⤵
  PID:4528
- C:\Windows\System\xmJfLAM.exe
  C:\Windows\System\xmJfLAM.exe
  2⤵
  PID:3512
- C:\Windows\System\bneKKyb.exe
  C:\Windows\System\bneKKyb.exe
  2⤵
  PID:4492
- C:\Windows\System\QrtsxbI.exe
  C:\Windows\System\QrtsxbI.exe
  2⤵
  PID:3960
- C:\Windows\System\ELwGmIY.exe
  C:\Windows\System\ELwGmIY.exe
  2⤵
  PID:11704
- C:\Windows\System\WFOxnSl.exe
  C:\Windows\System\WFOxnSl.exe
  2⤵
  PID:1520
- C:\Windows\System\rPZzEEH.exe
  C:\Windows\System\rPZzEEH.exe
  2⤵
  PID:13272
- C:\Windows\System\GQNPfKj.exe
  C:\Windows\System\GQNPfKj.exe
  2⤵
  PID:11992
- C:\Windows\System\zVhwzVc.exe
  C:\Windows\System\zVhwzVc.exe
  2⤵
  PID:10376
- C:\Windows\System\JrCpfwO.exe
  C:\Windows\System\JrCpfwO.exe
  2⤵
  PID:10696
- C:\Windows\System\Catvdkn.exe
  C:\Windows\System\Catvdkn.exe
  2⤵
  PID:11156
- C:\Windows\System\zDqaNfG.exe
  C:\Windows\System\zDqaNfG.exe
  2⤵
  PID:11844
- C:\Windows\System\IcGgSwK.exe
  C:\Windows\System\IcGgSwK.exe
  2⤵
  PID:32
- C:\Windows\System\HOEWzCw.exe
  C:\Windows\System\HOEWzCw.exe
  2⤵
  PID:9292
- C:\Windows\System\XGHhKUz.exe
  C:\Windows\System\XGHhKUz.exe
  2⤵
  PID:4488
- C:\Windows\System\bvJHahJ.exe
  C:\Windows\System\bvJHahJ.exe
  2⤵
  PID:3000
- C:\Windows\System\sCKbfhF.exe
  C:\Windows\System\sCKbfhF.exe
  2⤵
  PID:8844
- C:\Windows\System\UuCmqvs.exe
  C:\Windows\System\UuCmqvs.exe
  2⤵
  PID:12784
- C:\Windows\System\aKvNBBI.exe
  C:\Windows\System\aKvNBBI.exe
  2⤵
  PID:3136
- C:\Windows\System\uCZuDXo.exe
  C:\Windows\System\uCZuDXo.exe
  2⤵
  PID:556
- C:\Windows\System\diAgVUC.exe
  C:\Windows\System\diAgVUC.exe
  2⤵
  PID:12992
- C:\Windows\System\UhgfoFU.exe
  C:\Windows\System\UhgfoFU.exe
  2⤵
  PID:11912
- C:\Windows\System\hsvujJt.exe
  C:\Windows\System\hsvujJt.exe
  2⤵
  PID:10204
- C:\Windows\System\HPsRZHN.exe
  C:\Windows\System\HPsRZHN.exe
  2⤵
  PID:3472
- C:\Windows\System\IKXZLUw.exe
  C:\Windows\System\IKXZLUw.exe
  2⤵
  PID:4572
- C:\Windows\System\psOUDEs.exe
  C:\Windows\System\psOUDEs.exe
  2⤵
  PID:9276
- C:\Windows\System\ORpzkJN.exe
  C:\Windows\System\ORpzkJN.exe
  2⤵
  PID:8888
- C:\Windows\System\LMFIeLO.exe
  C:\Windows\System\LMFIeLO.exe
  2⤵
  PID:1552
- C:\Windows\System\Ulvwfme.exe
  C:\Windows\System\Ulvwfme.exe
  2⤵
  PID:9384
- C:\Windows\System\EFHYhdr.exe
  C:\Windows\System\EFHYhdr.exe
  2⤵
  PID:3936
- C:\Windows\System\xFXlySj.exe
  C:\Windows\System\xFXlySj.exe
  2⤵
  PID:2356
- C:\Windows\System\mRCPfVh.exe
  C:\Windows\System\mRCPfVh.exe
  2⤵
  PID:4756
- C:\Windows\System\gszPPtI.exe
  C:\Windows\System\gszPPtI.exe
  2⤵
  PID:236
- C:\Windows\System\wisxvaZ.exe
  C:\Windows\System\wisxvaZ.exe
  2⤵
  PID:4328
- C:\Windows\System\ltnqSza.exe
  C:\Windows\System\ltnqSza.exe
  2⤵
  PID:4172
- C:\Windows\System\EewTuJc.exe
  C:\Windows\System\EewTuJc.exe
  2⤵
  PID:7436
- C:\Windows\System\FvGyVlW.exe
  C:\Windows\System\FvGyVlW.exe
  2⤵
  PID:13328
- C:\Windows\System\YHXtuHi.exe
  C:\Windows\System\YHXtuHi.exe
  2⤵
  PID:13344
- C:\Windows\System\zmtBbpE.exe
  C:\Windows\System\zmtBbpE.exe
  2⤵
  PID:13360
- C:\Windows\System\lwODzGq.exe
  C:\Windows\System\lwODzGq.exe
  2⤵
  PID:13380
- C:\Windows\System\uRzdcyw.exe
  C:\Windows\System\uRzdcyw.exe
  2⤵
  PID:13396
- C:\Windows\System\DPTOsxf.exe
  C:\Windows\System\DPTOsxf.exe
  2⤵
  PID:13416
- C:\Windows\System\WxiSzIb.exe
  C:\Windows\System\WxiSzIb.exe
  2⤵
  PID:13436
- C:\Windows\System\forcCoz.exe
  C:\Windows\System\forcCoz.exe
  2⤵
  PID:13476
- C:\Windows\System\GxXYsYw.exe
  C:\Windows\System\GxXYsYw.exe
  2⤵
  PID:13496
- C:\Windows\System\RixSouV.exe
  C:\Windows\System\RixSouV.exe
  2⤵
  PID:13512
- C:\Windows\System\huPlNAl.exe
  C:\Windows\System\huPlNAl.exe
  2⤵
  PID:13528
- C:\Windows\System\aVIGvhY.exe
  C:\Windows\System\aVIGvhY.exe
  2⤵
  PID:13544
- C:\Windows\System\IPkgIrR.exe
  C:\Windows\System\IPkgIrR.exe
  2⤵
  PID:13564
- C:\Windows\System\KRqiCCd.exe
  C:\Windows\System\KRqiCCd.exe
  2⤵
  PID:13580
- C:\Windows\System\rHhdJET.exe
  C:\Windows\System\rHhdJET.exe
  2⤵
  PID:13596
- C:\Windows\System\KNVlNGa.exe
  C:\Windows\System\KNVlNGa.exe
  2⤵
  PID:13612
- C:\Windows\System\njaWSFL.exe
  C:\Windows\System\njaWSFL.exe
  2⤵
  PID:13628
- C:\Windows\System\NYfzDnz.exe
  C:\Windows\System\NYfzDnz.exe
  2⤵
  PID:13644
- C:\Windows\System\QstsBWw.exe
  C:\Windows\System\QstsBWw.exe
  2⤵
  PID:13660
- C:\Windows\System\XDXiDYa.exe
  C:\Windows\System\XDXiDYa.exe
  2⤵
  PID:13676
- C:\Windows\System\HnVeFJT.exe
  C:\Windows\System\HnVeFJT.exe
  2⤵
  PID:13692
- C:\Windows\System\fXghMgR.exe
  C:\Windows\System\fXghMgR.exe
  2⤵
  PID:13708
- C:\Windows\System\AsyIahB.exe
  C:\Windows\System\AsyIahB.exe
  2⤵
  PID:13724
- C:\Windows\System\cWlPvqp.exe
  C:\Windows\System\cWlPvqp.exe
  2⤵
  PID:13740
- C:\Windows\System\XCmvOXZ.exe
  C:\Windows\System\XCmvOXZ.exe
  2⤵
  PID:13756
- C:\Windows\System\SWtYBTw.exe
  C:\Windows\System\SWtYBTw.exe
  2⤵
  PID:13772
- C:\Windows\System\iNPCyLc.exe
  C:\Windows\System\iNPCyLc.exe
  2⤵
  PID:13792
- C:\Windows\System\kvyDINA.exe
  C:\Windows\System\kvyDINA.exe
  2⤵
  PID:13812
- C:\Windows\System\MbRleJb.exe
  C:\Windows\System\MbRleJb.exe
  2⤵
  PID:13828
- C:\Windows\System\ROSnZCf.exe
  C:\Windows\System\ROSnZCf.exe
  2⤵
  PID:13848
- C:\Windows\System\sWVRdQM.exe
  C:\Windows\System\sWVRdQM.exe
  2⤵
  PID:13864
- C:\Windows\System\vYDslsl.exe
  C:\Windows\System\vYDslsl.exe
  2⤵
  PID:13880
- C:\Windows\System\IdgKaUG.exe
  C:\Windows\System\IdgKaUG.exe
  2⤵
  PID:13912
- C:\Windows\System\oKeSPDE.exe
  C:\Windows\System\oKeSPDE.exe
  2⤵
  PID:13940
- C:\Windows\System\PtlKnyU.exe
  C:\Windows\System\PtlKnyU.exe
  2⤵
  PID:13972
- C:\Windows\System\hXghCyx.exe
  C:\Windows\System\hXghCyx.exe
  2⤵
  PID:13988
- C:\Windows\System\SbufVxX.exe
  C:\Windows\System\SbufVxX.exe
  2⤵
  PID:14004
- C:\Windows\System\iJfYDdN.exe
  C:\Windows\System\iJfYDdN.exe
  2⤵
  PID:14020
- C:\Windows\System\SPXnoYf.exe
  C:\Windows\System\SPXnoYf.exe
  2⤵
  PID:14036
- C:\Windows\System\SfuvDAs.exe
  C:\Windows\System\SfuvDAs.exe
  2⤵
  PID:14052
- C:\Windows\System\aQNidKd.exe
  C:\Windows\System\aQNidKd.exe
  2⤵
  PID:14068
- C:\Windows\System\VFVLXeM.exe
  C:\Windows\System\VFVLXeM.exe
  2⤵
  PID:14084
- C:\Windows\System\ZcPoxAg.exe
  C:\Windows\System\ZcPoxAg.exe
  2⤵
  PID:14100
- C:\Windows\System\dFoqDcr.exe
  C:\Windows\System\dFoqDcr.exe
  2⤵
  PID:14116
- C:\Windows\System\KtpZSvZ.exe
  C:\Windows\System\KtpZSvZ.exe
  2⤵
  PID:14132
- C:\Windows\System\QfSvKER.exe
  C:\Windows\System\QfSvKER.exe
  2⤵
  PID:14148
- C:\Windows\System\kcTybCU.exe
  C:\Windows\System\kcTybCU.exe
  2⤵
  PID:14164
- C:\Windows\System\rRRXHOB.exe
  C:\Windows\System\rRRXHOB.exe
  2⤵
  PID:14180
- C:\Windows\System\ezqiwfX.exe
  C:\Windows\System\ezqiwfX.exe
  2⤵
  PID:14196
- C:\Windows\System\mBXuNit.exe
  C:\Windows\System\mBXuNit.exe
  2⤵
  PID:14212
- C:\Windows\System\wZWrkFI.exe
  C:\Windows\System\wZWrkFI.exe
  2⤵
  PID:14228
- C:\Windows\System\uxjArHi.exe
  C:\Windows\System\uxjArHi.exe
  2⤵
  PID:14244
- C:\Windows\System\JeGpdyw.exe
  C:\Windows\System\JeGpdyw.exe
  2⤵
  PID:14260
- C:\Windows\System\yVsAeQS.exe
  C:\Windows\System\yVsAeQS.exe
  2⤵
  PID:14276
- C:\Windows\System\KTPIaHD.exe
  C:\Windows\System\KTPIaHD.exe
  2⤵
  PID:14292
- C:\Windows\System\AhydrRU.exe
  C:\Windows\System\AhydrRU.exe
  2⤵
  PID:14308
- C:\Windows\System\YMEdOQS.exe
  C:\Windows\System\YMEdOQS.exe
  2⤵
  PID:14324
- C:\Windows\System\aktwgWN.exe
  C:\Windows\System\aktwgWN.exe
  2⤵
  PID:13324
- C:\Windows\System\NFJepdc.exe
  C:\Windows\System\NFJepdc.exe
  2⤵
  PID:13376
- C:\Windows\System\xstDyCp.exe
  C:\Windows\System\xstDyCp.exe
  2⤵
  PID:13408
- C:\Windows\System\VOtbHVu.exe
  C:\Windows\System\VOtbHVu.exe
  2⤵
  PID:13444
- C:\Windows\System\NiiNwfC.exe
  C:\Windows\System\NiiNwfC.exe
  2⤵
  PID:13504
- C:\Windows\System\HRltfPB.exe
  C:\Windows\System\HRltfPB.exe
  2⤵
  PID:13996
- C:\Windows\System\nwZbbXd.exe
  C:\Windows\System\nwZbbXd.exe
  2⤵
  PID:14032
- C:\Windows\System\FgDSNaw.exe
  C:\Windows\System\FgDSNaw.exe
  2⤵
  PID:14064
- C:\Windows\System\LvNlxcu.exe
  C:\Windows\System\LvNlxcu.exe
  2⤵
  PID:14096
- C:\Windows\System\bbUGFbV.exe
  C:\Windows\System\bbUGFbV.exe
  2⤵
  PID:14176
- C:\Windows\System\mcMHANW.exe
  C:\Windows\System\mcMHANW.exe
  2⤵
  PID:14236
- C:\Windows\System\iKYLFic.exe
  C:\Windows\System\iKYLFic.exe
  2⤵
  PID:14272
- C:\Windows\System\nRDTpIO.exe
  C:\Windows\System\nRDTpIO.exe
  2⤵
  PID:14316
- C:\Windows\System\zEBVbWH.exe
  C:\Windows\System\zEBVbWH.exe
  2⤵
  PID:13340
- C:\Windows\System\qgmEilD.exe
  C:\Windows\System\qgmEilD.exe
  2⤵
  PID:13428
- C:\Windows\System\OGodsyg.exe
  C:\Windows\System\OGodsyg.exe
  2⤵
  PID:13576
- C:\Windows\System\dAlzlBt.exe
  C:\Windows\System\dAlzlBt.exe
  2⤵
  PID:3304
- C:\Windows\System\lGNZQtL.exe
  C:\Windows\System\lGNZQtL.exe
  2⤵
  PID:3288
- C:\Windows\System\BfCpWrf.exe
  C:\Windows\System\BfCpWrf.exe
  2⤵
  PID:3716
- C:\Windows\System\iFJIBzU.exe
  C:\Windows\System\iFJIBzU.exe
  2⤵
  PID:13720
- C:\Windows\System\rnPpoMX.exe
  C:\Windows\System\rnPpoMX.exe
  2⤵
  PID:13764
- C:\Windows\System\gtEdwGB.exe
  C:\Windows\System\gtEdwGB.exe
  2⤵
  PID:13784
- C:\Windows\System\ghjbeLW.exe
  C:\Windows\System\ghjbeLW.exe
  2⤵
  PID:13908
- C:\Windows\System\lbPEdgQ.exe
  C:\Windows\System\lbPEdgQ.exe
  2⤵
  PID:13984
- C:\Windows\System\xxDAeqj.exe
  C:\Windows\System\xxDAeqj.exe
  2⤵
  PID:14048
- C:\Windows\System\ZvFHRPi.exe
  C:\Windows\System\ZvFHRPi.exe
  2⤵
  PID:14124
- C:\Windows\System\rBiplYH.exe
  C:\Windows\System\rBiplYH.exe
  2⤵
  PID:14160
- C:\Windows\System\rjpbJIz.exe
  C:\Windows\System\rjpbJIz.exe
  2⤵
  PID:1700
- C:\Windows\System\mkvJFSa.exe
  C:\Windows\System\mkvJFSa.exe
  2⤵
  PID:14268
- C:\Windows\System\ZUNbPfp.exe
  C:\Windows\System\ZUNbPfp.exe
  2⤵
  PID:1128
- C:\Windows\System\dVKmLUI.exe
  C:\Windows\System\dVKmLUI.exe
  2⤵
  PID:13388
- C:\Windows\System\DzJHiap.exe
  C:\Windows\System\DzJHiap.exe
  2⤵
  PID:13492
- C:\Windows\System\jnHXrHB.exe
  C:\Windows\System\jnHXrHB.exe
  2⤵
  PID:13652
- C:\Windows\System\fFjqpmu.exe
  C:\Windows\System\fFjqpmu.exe
  2⤵
  PID:14144
- C:\Windows\System\MBbBGDf.exe
  C:\Windows\System\MBbBGDf.exe
  2⤵
  PID:10972
- C:\Windows\System\qDnDoaz.exe
  C:\Windows\System\qDnDoaz.exe
  2⤵
  PID:7836
- C:\Windows\System\QFdFnwq.exe
  C:\Windows\System\QFdFnwq.exe
  2⤵
  PID:11128
- C:\Windows\System\OoLhoEg.exe
  C:\Windows\System\OoLhoEg.exe
  2⤵
  PID:8420
- C:\Windows\System\fwXXLFb.exe
  C:\Windows\System\fwXXLFb.exe
  2⤵
  PID:6656
- C:\Windows\System\zXbQNvT.exe
  C:\Windows\System\zXbQNvT.exe
  2⤵
  PID:10144
- C:\Windows\System\FEpuDAf.exe
  C:\Windows\System\FEpuDAf.exe
  2⤵
  PID:1288
- C:\Windows\System\JHiIiAg.exe
  C:\Windows\System\JHiIiAg.exe
  2⤵
  PID:9108
- C:\Windows\System\PccdeZZ.exe
  C:\Windows\System\PccdeZZ.exe
  2⤵
  PID:9224
- C:\Windows\System\puecRli.exe
  C:\Windows\System\puecRli.exe
  2⤵
  PID:9228
- C:\Windows\System\xcNSOeu.exe
  C:\Windows\System\xcNSOeu.exe
  2⤵
  PID:8312
- C:\Windows\System\lExgwNK.exe
  C:\Windows\System\lExgwNK.exe
  2⤵
  PID:8508
- C:\Windows\System\BnsKxvX.exe
  C:\Windows\System\BnsKxvX.exe
  2⤵
  PID:10912
- C:\Windows\System\nmKvAZT.exe
  C:\Windows\System\nmKvAZT.exe
  2⤵
  PID:6580
- C:\Windows\System\eIfidEk.exe
  C:\Windows\System\eIfidEk.exe
  2⤵
  PID:6680
- C:\Windows\System\tLrpeAR.exe
  C:\Windows\System\tLrpeAR.exe
  2⤵
  PID:10904
- C:\Windows\System\wPTsrhv.exe
  C:\Windows\System\wPTsrhv.exe
  2⤵
  PID:5704
- C:\Windows\System\nhHDztD.exe
  C:\Windows\System\nhHDztD.exe
  2⤵
  PID:5932
- C:\Windows\System\iqBXRFY.exe
  C:\Windows\System\iqBXRFY.exe
  2⤵
  PID:3268
- C:\Windows\System\kUiftri.exe
  C:\Windows\System\kUiftri.exe
  2⤵
  PID:13888
- C:\Windows\System\pocJQEa.exe
  C:\Windows\System\pocJQEa.exe
  2⤵
  PID:4904
- C:\Windows\System\Dkmqwgn.exe
  C:\Windows\System\Dkmqwgn.exe
  2⤵
  PID:4356
- C:\Windows\System\CFnFjze.exe
  C:\Windows\System\CFnFjze.exe
  2⤵
  PID:244
- C:\Windows\System\Bwvmrlg.exe
  C:\Windows\System\Bwvmrlg.exe
  2⤵
  PID:3312
- C:\Windows\System\RVwCJoD.exe
  C:\Windows\System\RVwCJoD.exe
  2⤵
  PID:5596
- C:\Windows\System\rGmsTvD.exe
  C:\Windows\System\rGmsTvD.exe
  2⤵
  PID:5364
- C:\Windows\System\SGjmehg.exe
  C:\Windows\System\SGjmehg.exe
  2⤵
  PID:5536
- C:\Windows\System\wpsgETf.exe
  C:\Windows\System\wpsgETf.exe
  2⤵
  PID:5344
- C:\Windows\System\vomScvi.exe
  C:\Windows\System\vomScvi.exe
  2⤵
  PID:4048
- C:\Windows\System\QisbbHg.exe
  C:\Windows\System\QisbbHg.exe
  2⤵
  PID:14140
- C:\Windows\System\zLykxzG.exe
  C:\Windows\System\zLykxzG.exe
  2⤵
  PID:13900
- C:\Windows\System\krmcVyt.exe
  C:\Windows\System\krmcVyt.exe
  2⤵
  PID:2164
- C:\Windows\System\qzbvkgx.exe
  C:\Windows\System\qzbvkgx.exe
  2⤵
  PID:2212
- C:\Windows\System\ECpWlGl.exe
  C:\Windows\System\ECpWlGl.exe
  2⤵
  PID:1100
- C:\Windows\System\qpBXkKY.exe
  C:\Windows\System\qpBXkKY.exe
  2⤵
  PID:824
- C:\Windows\System\wiNvcHv.exe
  C:\Windows\System\wiNvcHv.exe
  2⤵
  PID:5640
- C:\Windows\System\QKppFZQ.exe
  C:\Windows\System\QKppFZQ.exe
  2⤵
  PID:5492
- C:\Windows\System\FNVuOPa.exe
  C:\Windows\System\FNVuOPa.exe
  2⤵
  PID:1496
- C:\Windows\System\MmdXMjJ.exe
  C:\Windows\System\MmdXMjJ.exe
  2⤵
  PID:3516
- C:\Windows\System\JgsbkPd.exe
  C:\Windows\System\JgsbkPd.exe
  2⤵
  PID:7872
- C:\Windows\System\aPqZHzJ.exe
  C:\Windows\System\aPqZHzJ.exe
  2⤵
  PID:9192
- C:\Windows\System\oQxRjCL.exe
  C:\Windows\System\oQxRjCL.exe
  2⤵
  PID:5860
- C:\Windows\System\gZzNzte.exe
  C:\Windows\System\gZzNzte.exe
  2⤵
  PID:1856
- C:\Windows\System\VagwAaM.exe
  C:\Windows\System\VagwAaM.exe
  2⤵
  PID:6068
- C:\Windows\System\mGxXpCF.exe
  C:\Windows\System\mGxXpCF.exe
  2⤵
  PID:10896
- C:\Windows\System\UnEYOUV.exe
  C:\Windows\System\UnEYOUV.exe
  2⤵
  PID:6192
- C:\Windows\System\HCVnRSv.exe
  C:\Windows\System\HCVnRSv.exe
  2⤵
  PID:4836
- C:\Windows\System\wLcoCyV.exe
  C:\Windows\System\wLcoCyV.exe
  2⤵
  PID:9132
- C:\Windows\System\fXAcxVO.exe
  C:\Windows\System\fXAcxVO.exe
  2⤵
  PID:8116
- C:\Windows\System\KqYZuLg.exe
  C:\Windows\System\KqYZuLg.exe
  2⤵
  PID:13716
- C:\Windows\System\MrpmHph.exe
  C:\Windows\System\MrpmHph.exe
  2⤵
  PID:3508
- C:\Windows\System\peGayCK.exe
  C:\Windows\System\peGayCK.exe
  2⤵
  PID:4856
- C:\Windows\System\gGvmfAb.exe
  C:\Windows\System\gGvmfAb.exe
  2⤵
  PID:8436
- C:\Windows\System\nNLmVYE.exe
  C:\Windows\System\nNLmVYE.exe
  2⤵
  PID:8184
- C:\Windows\System\DlImUtF.exe
  C:\Windows\System\DlImUtF.exe
  2⤵
  PID:5312
- C:\Windows\System\twxPyXk.exe
  C:\Windows\System\twxPyXk.exe
  2⤵
  PID:6008
- C:\Windows\System\sJNDQsi.exe
  C:\Windows\System\sJNDQsi.exe
  2⤵
  PID:1220
- C:\Windows\System\YthwcVk.exe
  C:\Windows\System\YthwcVk.exe
  2⤵
  PID:5392
- C:\Windows\System\xCtQcgH.exe
  C:\Windows\System\xCtQcgH.exe
  2⤵
  PID:5752
- C:\Windows\System\cRxcIHe.exe
  C:\Windows\System\cRxcIHe.exe
  2⤵
  PID:5836
- C:\Windows\System\bqHITVC.exe
  C:\Windows\System\bqHITVC.exe
  2⤵
  PID:5164
- C:\Windows\System\zrZZKPk.exe
  C:\Windows\System\zrZZKPk.exe
  2⤵
  PID:4764
- C:\Windows\System\mMYRTEc.exe
  C:\Windows\System\mMYRTEc.exe
  2⤵
  PID:5452
- C:\Windows\System\mqWlNXD.exe
  C:\Windows\System\mqWlNXD.exe
  2⤵
  PID:6700
- C:\Windows\System\XkGcABd.exe
  C:\Windows\System\XkGcABd.exe
  2⤵
  PID:6020
- C:\Windows\System\vszXtBL.exe
  C:\Windows\System\vszXtBL.exe
  2⤵
  PID:4116
- C:\Windows\System\zBWkoxV.exe
  C:\Windows\System\zBWkoxV.exe
  2⤵
  PID:6016
- C:\Windows\System\dJTtacg.exe
  C:\Windows\System\dJTtacg.exe
  2⤵
  PID:8092
- C:\Windows\System\IYXMyRY.exe
  C:\Windows\System\IYXMyRY.exe
  2⤵
  PID:5992
- C:\Windows\System\PchEits.exe
  C:\Windows\System\PchEits.exe
  2⤵
  PID:13920
- C:\Windows\System\CJUQCYi.exe
  C:\Windows\System\CJUQCYi.exe
  2⤵
  PID:9684
- C:\Windows\System\CUvwmtK.exe
  C:\Windows\System\CUvwmtK.exe
  2⤵
  PID:3392
- C:\Windows\System\WUSixgB.exe
  C:\Windows\System\WUSixgB.exe
  2⤵
  PID:2952
- C:\Windows\System\rfPXzFW.exe
  C:\Windows\System\rfPXzFW.exe
  2⤵
  PID:3860
- C:\Windows\System\PCDsPJW.exe
  C:\Windows\System\PCDsPJW.exe
  2⤵
  PID:5376
- C:\Windows\System\OSEpOxt.exe
  C:\Windows\System\OSEpOxt.exe
  2⤵
  PID:1648
- C:\Windows\System\iBFIKGA.exe
  C:\Windows\System\iBFIKGA.exe
  2⤵
  PID:5388
- C:\Windows\System\RrvQTgK.exe
  C:\Windows\System\RrvQTgK.exe
  2⤵
  PID:5280
- C:\Windows\System\ADkdYzV.exe
  C:\Windows\System\ADkdYzV.exe
  2⤵
  PID:2612
- C:\Windows\System\iqtpnLv.exe
  C:\Windows\System\iqtpnLv.exe
  2⤵
  PID:8348
- C:\Windows\System\kojEteZ.exe
  C:\Windows\System\kojEteZ.exe
  2⤵
  PID:5988
- C:\Windows\System\IcXzOaa.exe
  C:\Windows\System\IcXzOaa.exe
  2⤵
  PID:1072
- C:\Windows\System\znjCBry.exe
  C:\Windows\System\znjCBry.exe
  2⤵
  PID:2808
- C:\Windows\System\WXzMJwF.exe
  C:\Windows\System\WXzMJwF.exe
  2⤵
  PID:4056
- C:\Windows\System\oEEpJwg.exe
  C:\Windows\System\oEEpJwg.exe
  2⤵
  PID:5740
- C:\Windows\System\btYNQjy.exe
  C:\Windows\System\btYNQjy.exe
  2⤵
  PID:14204
- C:\Windows\System\TASBKfY.exe
  C:\Windows\System\TASBKfY.exe
  2⤵
  PID:1284
- C:\Windows\System\tfvAghb.exe
  C:\Windows\System\tfvAghb.exe
  2⤵
  PID:5168
- C:\Windows\System\yBvHhkb.exe
  C:\Windows\System\yBvHhkb.exe
  2⤵
  PID:1328
- C:\Windows\System\fESrJMA.exe
  C:\Windows\System\fESrJMA.exe
  2⤵
  PID:4780
- C:\Windows\System\PlsVHLo.exe
  C:\Windows\System\PlsVHLo.exe
  2⤵
  PID:5008
- C:\Windows\System\mVQGImA.exe
  C:\Windows\System\mVQGImA.exe
  2⤵
  PID:5352
- C:\Windows\System\qmFrpNa.exe
  C:\Windows\System\qmFrpNa.exe
  2⤵
  PID:13968
- C:\Windows\System\FWhbgyl.exe
  C:\Windows\System\FWhbgyl.exe
  2⤵
  PID:6128
- C:\Windows\System\PBJqbRr.exe
  C:\Windows\System\PBJqbRr.exe
  2⤵
  PID:5256
- C:\Windows\System\ZGUewBF.exe
  C:\Windows\System\ZGUewBF.exe
  2⤵
  PID:6512
- C:\Windows\System\HwweJZK.exe
  C:\Windows\System\HwweJZK.exe
  2⤵
  PID:6420
- C:\Windows\System\TYjVEgc.exe
  C:\Windows\System\TYjVEgc.exe
  2⤵
  PID:8220
- C:\Windows\System\RJjMeAQ.exe
  C:\Windows\System\RJjMeAQ.exe
  2⤵
  PID:6088
- C:\Windows\System\YkbPMdi.exe
  C:\Windows\System\YkbPMdi.exe
  2⤵
  PID:5212
- C:\Windows\System\TUxfxMF.exe
  C:\Windows\System\TUxfxMF.exe
  2⤵
  PID:6000
- C:\Windows\System\vbGCaQN.exe
  C:\Windows\System\vbGCaQN.exe
  2⤵
  PID:6444
- C:\Windows\System\HNPifjl.exe
  C:\Windows\System\HNPifjl.exe
  2⤵
  PID:5300
- C:\Windows\System\KVtZNFv.exe
  C:\Windows\System\KVtZNFv.exe
  2⤵
  PID:6072
- C:\Windows\System\ViMggKf.exe
  C:\Windows\System\ViMggKf.exe
  2⤵
  PID:4560
- C:\Windows\System\BgdWUCn.exe
  C:\Windows\System\BgdWUCn.exe
  2⤵
  PID:14080
- C:\Windows\System\cEpIraV.exe
  C:\Windows\System\cEpIraV.exe
  2⤵
  PID:1760
- C:\Windows\System\enzCiKb.exe
  C:\Windows\System\enzCiKb.exe
  2⤵
  PID:4416
- C:\Windows\System\JVkpQPA.exe
  C:\Windows\System\JVkpQPA.exe
  2⤵
  PID:6424
- C:\Windows\System\uTiAbwa.exe
  C:\Windows\System\uTiAbwa.exe
  2⤵
  PID:6044
- C:\Windows\System\jdYuSua.exe
  C:\Windows\System\jdYuSua.exe
  2⤵
  PID:6468
- C:\Windows\System\vUJwywf.exe
  C:\Windows\System\vUJwywf.exe
  2⤵
  PID:1308
- C:\Windows\System\SWsUiwM.exe
  C:\Windows\System\SWsUiwM.exe
  2⤵
  PID:13856
- C:\Windows\System\UtGNurF.exe
  C:\Windows\System\UtGNurF.exe
  2⤵
  PID:5368
- C:\Windows\System\IMYTwwJ.exe
  C:\Windows\System\IMYTwwJ.exe
  2⤵
  PID:6492
- C:\Windows\System\gWkbQVv.exe
  C:\Windows\System\gWkbQVv.exe
  2⤵
  PID:6096
- C:\Windows\System\SNKrLxx.exe
  C:\Windows\System\SNKrLxx.exe
  2⤵
  PID:5268
- C:\Windows\System\CjAhoNG.exe
  C:\Windows\System\CjAhoNG.exe
  2⤵
  PID:3372
- C:\Windows\System\APvuvMg.exe
  C:\Windows\System\APvuvMg.exe
  2⤵
  PID:13352
- C:\Windows\System\mLtfVAc.exe
  C:\Windows\System\mLtfVAc.exe
  2⤵
  PID:4916
- C:\Windows\System\gdJqsJL.exe
  C:\Windows\System\gdJqsJL.exe
  2⤵
  PID:472
- C:\Windows\System\PeoYvKZ.exe
  C:\Windows\System\PeoYvKZ.exe
  2⤵
  PID:352
- C:\Windows\System\gsdYdoX.exe
  C:\Windows\System\gsdYdoX.exe
  2⤵
  PID:5544
- C:\Windows\System\lQocJiQ.exe
  C:\Windows\System\lQocJiQ.exe
  2⤵
  PID:6220
- C:\Windows\System\HZoQSNG.exe
  C:\Windows\System\HZoQSNG.exe
  2⤵
  PID:6496
- C:\Windows\System\cDKqoyC.exe
  C:\Windows\System\cDKqoyC.exe
  2⤵
  PID:6320
- C:\Windows\System\fiAHAsP.exe
  C:\Windows\System\fiAHAsP.exe
  2⤵
  PID:6452
- C:\Windows\System\djTgPtD.exe
  C:\Windows\System\djTgPtD.exe
  2⤵
  PID:6028
- C:\Windows\System\xrSfzNa.exe
  C:\Windows\System\xrSfzNa.exe
  2⤵
  PID:5216
- C:\Windows\System\bufxaZg.exe
  C:\Windows\System\bufxaZg.exe
  2⤵
  PID:6416
- C:\Windows\System\roVfXnL.exe
  C:\Windows\System\roVfXnL.exe
  2⤵
  PID:11104
- C:\Windows\System\mMygcXJ.exe
  C:\Windows\System\mMygcXJ.exe
  2⤵
  PID:2644
- C:\Windows\System\bCHzult.exe
  C:\Windows\System\bCHzult.exe
  2⤵
  PID:5972
- C:\Windows\System\UYMYZhz.exe
  C:\Windows\System\UYMYZhz.exe
  2⤵
  PID:6488
- C:\Windows\System\wTGtCUO.exe
  C:\Windows\System\wTGtCUO.exe
  2⤵
  PID:7016
- C:\Windows\System\ogZUxDa.exe
  C:\Windows\System\ogZUxDa.exe
  2⤵
  PID:3036
- C:\Windows\System\GHtWcUh.exe
  C:\Windows\System\GHtWcUh.exe
  2⤵
  PID:5468
- C:\Windows\System\KaTJIla.exe
  C:\Windows\System\KaTJIla.exe
  2⤵
  PID:6092
- C:\Windows\System\yIzLitY.exe
  C:\Windows\System\yIzLitY.exe
  2⤵
  PID:7140
- C:\Windows\System\BFOkMZQ.exe
  C:\Windows\System\BFOkMZQ.exe
  2⤵
  PID:9020
- C:\Windows\System\GNiBAAZ.exe
  C:\Windows\System\GNiBAAZ.exe
  2⤵
  PID:7304
- C:\Windows\System\qrOKhUQ.exe
  C:\Windows\System\qrOKhUQ.exe
  2⤵
  PID:5348
- C:\Windows\System\xDcfLhj.exe
  C:\Windows\System\xDcfLhj.exe
  2⤵
  PID:6332
- C:\Windows\System\npMRWQE.exe
  C:\Windows\System\npMRWQE.exe
  2⤵
  PID:6500
- C:\Windows\System\tFKsNEX.exe
  C:\Windows\System\tFKsNEX.exe
  2⤵
  PID:6524
- C:\Windows\System\DgzCwsl.exe
  C:\Windows\System\DgzCwsl.exe
  2⤵
  PID:6644
- C:\Windows\System\MLTtYXA.exe
  C:\Windows\System\MLTtYXA.exe
  2⤵
  PID:6716
- C:\Windows\System\jjiIieo.exe
  C:\Windows\System\jjiIieo.exe
  2⤵
  PID:7316
- C:\Windows\System\yOusGFj.exe
  C:\Windows\System\yOusGFj.exe
  2⤵
  PID:6768
- C:\Windows\System\zJDENbA.exe
  C:\Windows\System\zJDENbA.exe
  2⤵
  PID:6776
- C:\Windows\System\OdNjoeY.exe
  C:\Windows\System\OdNjoeY.exe
  2⤵
  PID:6240
- C:\Windows\System\afEKMDp.exe
  C:\Windows\System\afEKMDp.exe
  2⤵
  PID:3224
- C:\Windows\System\fdvMymG.exe
  C:\Windows\System\fdvMymG.exe
  2⤵
  PID:8088
- C:\Windows\System\ZLMIIUS.exe
  C:\Windows\System\ZLMIIUS.exe
  2⤵
  PID:6660
- C:\Windows\System\YpqeXyE.exe
  C:\Windows\System\YpqeXyE.exe
  2⤵
  PID:5984
- C:\Windows\System\mmSfRNr.exe
  C:\Windows\System\mmSfRNr.exe
  2⤵
  PID:7400
- C:\Windows\System\fKwviog.exe
  C:\Windows\System\fKwviog.exe
  2⤵
  PID:4824
- C:\Windows\System\WVSfQqk.exe
  C:\Windows\System\WVSfQqk.exe
  2⤵
  PID:6472
- C:\Windows\System\eIbnujN.exe
  C:\Windows\System\eIbnujN.exe
  2⤵
  PID:7320
- C:\Windows\System\uAoOGuB.exe
  C:\Windows\System\uAoOGuB.exe
  2⤵
  PID:2292
- C:\Windows\System\PpvNDwP.exe
  C:\Windows\System\PpvNDwP.exe
  2⤵
  PID:14112
- C:\Windows\System\EzYnaJA.exe
  C:\Windows\System\EzYnaJA.exe
  2⤵
  PID:7224
- C:\Windows\System\BYuKGPo.exe
  C:\Windows\System\BYuKGPo.exe
  2⤵
  PID:5512
- C:\Windows\System\moQVomG.exe
  C:\Windows\System\moQVomG.exe
  2⤵
  PID:6480
- C:\Windows\System\WhxrpIn.exe
  C:\Windows\System\WhxrpIn.exe
  2⤵
  PID:7440
- C:\Windows\System\SRnCofo.exe
  C:\Windows\System\SRnCofo.exe
  2⤵
  PID:7464
- C:\Windows\System\JaxgLbm.exe
  C:\Windows\System\JaxgLbm.exe
  2⤵
  PID:8020
- C:\Windows\System\kRLYFUZ.exe
  C:\Windows\System\kRLYFUZ.exe
  2⤵
  PID:4216
- C:\Windows\System\BVobroM.exe
  C:\Windows\System\BVobroM.exe
  2⤵
  PID:6432
- C:\Windows\System\PNwpCdU.exe
  C:\Windows\System\PNwpCdU.exe
  2⤵
  PID:8052
- C:\Windows\System\NArDZij.exe
  C:\Windows\System\NArDZij.exe
  2⤵
  PID:5528
- C:\Windows\System\UZRSwGT.exe
  C:\Windows\System\UZRSwGT.exe
  2⤵
  PID:1548
- C:\Windows\System\xqipQLY.exe
  C:\Windows\System\xqipQLY.exe
  2⤵
  PID:7192
- C:\Windows\System\bPdYGRV.exe
  C:\Windows\System\bPdYGRV.exe
  2⤵
  PID:6844
- C:\Windows\System\wCZLbqi.exe
  C:\Windows\System\wCZLbqi.exe
  2⤵
  PID:4920
- C:\Windows\System\yAqgQTD.exe
  C:\Windows\System\yAqgQTD.exe
  2⤵
  PID:6436
- C:\Windows\System\soxQlld.exe
  C:\Windows\System\soxQlld.exe
  2⤵
  PID:7492
- C:\Windows\System\AGnLXGb.exe
  C:\Windows\System\AGnLXGb.exe
  2⤵
  PID:8008
- C:\Windows\System\JIwpvsU.exe
  C:\Windows\System\JIwpvsU.exe
  2⤵
  PID:7068
- C:\Windows\System\OOdaiRl.exe
  C:\Windows\System\OOdaiRl.exe
  2⤵
  PID:7372
- C:\Windows\System\ruUPUVl.exe
  C:\Windows\System\ruUPUVl.exe
  2⤵
  PID:8152
- C:\Windows\System\sRaBgtc.exe
  C:\Windows\System\sRaBgtc.exe
  2⤵
  PID:7484
- C:\Windows\System\yWVyxLI.exe
  C:\Windows\System\yWVyxLI.exe
  2⤵
  PID:6592
- C:\Windows\System\KnjsmCY.exe
  C:\Windows\System\KnjsmCY.exe
  2⤵
  PID:7556
- C:\Windows\System\tpOtfbk.exe
  C:\Windows\System\tpOtfbk.exe
  2⤵
  PID:5968
- C:\Windows\System\tvmjqWv.exe
  C:\Windows\System\tvmjqWv.exe
  2⤵
  PID:5100
- C:\Windows\System\DtyxXWS.exe
  C:\Windows\System\DtyxXWS.exe
  2⤵
  PID:7632
- C:\Windows\System\EMDWadz.exe
  C:\Windows\System\EMDWadz.exe
  2⤵
  PID:7984
- C:\Windows\System\BpArmZy.exe
  C:\Windows\System\BpArmZy.exe
  2⤵
  PID:7664
- C:\Windows\System\hWlZwPT.exe
  C:\Windows\System\hWlZwPT.exe
  2⤵
  PID:1708
- C:\Windows\System\jPUCloc.exe
  C:\Windows\System\jPUCloc.exe
  2⤵
  PID:8120
- C:\Windows\System\gXRQodn.exe
  C:\Windows\System\gXRQodn.exe
  2⤵
  PID:5516
- C:\Windows\System\EFfWBiS.exe
  C:\Windows\System\EFfWBiS.exe
  2⤵
  PID:6744
- C:\Windows\System\xqyumEz.exe
  C:\Windows\System\xqyumEz.exe
  2⤵
  PID:6796
- C:\Windows\System\rLMPzfM.exe
  C:\Windows\System\rLMPzfM.exe
  2⤵
  PID:7260
- C:\Windows\System\tUpKmqY.exe
  C:\Windows\System\tUpKmqY.exe
  2⤵
  PID:7196
- C:\Windows\System\sNOwlUc.exe
  C:\Windows\System\sNOwlUc.exe
  2⤵
  PID:6752
- C:\Windows\System\RkYULbl.exe
  C:\Windows\System\RkYULbl.exe
  2⤵
  PID:5592
- C:\Windows\System\tnPDhMI.exe
  C:\Windows\System\tnPDhMI.exe
  2⤵
  PID:8176
- C:\Windows\System\aJEBBfW.exe
  C:\Windows\System\aJEBBfW.exe
  2⤵
  PID:4516
- C:\Windows\System\WCVMkeL.exe
  C:\Windows\System\WCVMkeL.exe
  2⤵
  PID:8104
- C:\Windows\System\EGCNPMI.exe
  C:\Windows\System\EGCNPMI.exe
  2⤵
  PID:8064
- C:\Windows\System\OZcLUsS.exe
  C:\Windows\System\OZcLUsS.exe
  2⤵
  PID:6696
- C:\Windows\System\XqjWuhV.exe
  C:\Windows\System\XqjWuhV.exe
  2⤵
  PID:6864
- C:\Windows\System\rnKBxys.exe
  C:\Windows\System\rnKBxys.exe
  2⤵
  PID:7964
- C:\Windows\System\UTJtNzl.exe
  C:\Windows\System\UTJtNzl.exe
  2⤵
  PID:5568
- C:\Windows\System\gUnEqnl.exe
  C:\Windows\System\gUnEqnl.exe
  2⤵
  PID:7392
- C:\Windows\System\ovACvag.exe
  C:\Windows\System\ovACvag.exe
  2⤵
  PID:5852
- C:\Windows\System\BdppMow.exe
  C:\Windows\System\BdppMow.exe
  2⤵
  PID:6316
- C:\Windows\System\UBBYTJa.exe
  C:\Windows\System\UBBYTJa.exe
  2⤵
  PID:8764
- C:\Windows\System\hXwdIMJ.exe
  C:\Windows\System\hXwdIMJ.exe
  2⤵
  PID:6748
- C:\Windows\System\ZsESqut.exe
  C:\Windows\System\ZsESqut.exe
  2⤵
  PID:7188
- C:\Windows\System\CFwNipj.exe
  C:\Windows\System\CFwNipj.exe
  2⤵
  PID:9016
- C:\Windows\System\kUUApJR.exe
  C:\Windows\System\kUUApJR.exe
  2⤵
  PID:6632
- C:\Windows\System\rbnLnkh.exe
  C:\Windows\System\rbnLnkh.exe
  2⤵
  PID:5332
- C:\Windows\System\PGWNuWq.exe
  C:\Windows\System\PGWNuWq.exe
  2⤵
  PID:9012
- C:\Windows\System\sNlteBx.exe
  C:\Windows\System\sNlteBx.exe
  2⤵
  PID:8076
- C:\Windows\System\uTuBYwR.exe
  C:\Windows\System\uTuBYwR.exe
  2⤵
  PID:8356
- C:\Windows\System\dQlixSG.exe
  C:\Windows\System\dQlixSG.exe
  2⤵
  PID:8568
- C:\Windows\System\saEXSIL.exe
  C:\Windows\System\saEXSIL.exe
  2⤵
  PID:8416
- C:\Windows\System\abdBcSz.exe
  C:\Windows\System\abdBcSz.exe
  2⤵
  PID:8648
- C:\Windows\System\CkZwJjP.exe
  C:\Windows\System\CkZwJjP.exe
  2⤵
  PID:5808
- C:\Windows\System\CqAKNJE.exe
  C:\Windows\System\CqAKNJE.exe
  2⤵
  PID:8748
- C:\Windows\System\frUORdE.exe
  C:\Windows\System\frUORdE.exe
  2⤵
  PID:7744
- C:\Windows\System\YNihUYm.exe
  C:\Windows\System\YNihUYm.exe
  2⤵
  PID:7412
- C:\Windows\System\WsRnZmx.exe
  C:\Windows\System\WsRnZmx.exe
  2⤵
  PID:6944
- C:\Windows\System\BbqQAjf.exe
  C:\Windows\System\BbqQAjf.exe
  2⤵
  PID:7576
- C:\Windows\System\mBsqsPz.exe
  C:\Windows\System\mBsqsPz.exe
  2⤵
  PID:7368
- C:\Windows\System\ODvCADD.exe
  C:\Windows\System\ODvCADD.exe
  2⤵
  PID:7040
- C:\Windows\System\UvGnlwa.exe
  C:\Windows\System\UvGnlwa.exe
  2⤵
  PID:7496
- C:\Windows\System\hdlwGPY.exe
  C:\Windows\System\hdlwGPY.exe
  2⤵
  PID:8216
- C:\Windows\System\iSinOlq.exe
  C:\Windows\System\iSinOlq.exe
  2⤵
  PID:7148
- C:\Windows\System\hMRapGk.exe
  C:\Windows\System\hMRapGk.exe
  2⤵
  PID:6516
- C:\Windows\System\IAbLxpC.exe
  C:\Windows\System\IAbLxpC.exe
  2⤵
  PID:5720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3moubw2w.rmf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFFZRqZ.exe

Filesize
2.1MB

MD5
8b17e32b2a4d2bdc9cb6f592ecb4fe8b

SHA1
82746ce55e91b97359c030755e0357cb4559335c

SHA256
807d70a3d657bd96a426fdbda417807dbd427a001b87100bc8ab8d45567141bc

SHA512
71a29ed6d845733f33e65c2fadc585dee2b80052728b56b920f4ff26799b77740f861a5a25d184e6229c507f64f810c51db90c2dd536b82b5dd6f780c6a05786

Download Submit
C:\Windows\System\AsfTWqr.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\HJgaXSz.exe

Filesize
2.1MB

MD5
c3044dc8409e8e330227795907b24f48

SHA1
aa144f8a9a131fefc632a8fee05674ac113cde25

SHA256
242769005fea19ebf6b5500905c7a603bff3a47144334d342ba39f8c7cf05eb9

SHA512
0b6eb5adb9c892f5a9638ef9176ac1c237bd221d59298e15c9006b59e0d5844234687870a506b68f7c1d217fc4c35027543c5c14d73f99cc45715a446e34dc87

Download Submit
C:\Windows\System\IyxTOrg.exe

Filesize
2.1MB

MD5
34cbfb9cefe7f5766a6742afec35ce92

SHA1
7b973b8dd4432448e40959b602ff792da3992ec9

SHA256
fd7952fe1b1aaffa1ee6de1bb2e13aadd89743522d47ef09b642c395eb5dac76

SHA512
00f5ef8d087fb3e08e12bbb0dba454b132eff9bd1061949f95689176a7680e3ad3681ce7a61aeca1ccd5cf6ce9da0f7dc29ab492e52e7e1160269f45e485fd0a

Download Submit
C:\Windows\System\JCzWviV.exe

Filesize
2.1MB

MD5
53c5ba31972bfbb540c2a9eafc3a3c3e

SHA1
25eaaca88821f5aa7d9ffe23917466296d4a2376

SHA256
69bc95df32c67308b58edb6d7bf0f62615657c1c0ee0982bda92fba6e196ba3a

SHA512
5fca05bb9092b5aeab798bbe36563b0865875a65b5919a4e1cd617fbaf858ff8844e8979b523783a22d4eee8d73bc1bd3d25299c5a568539fdf01912c6f8d3ce

Download Submit
C:\Windows\System\JfPbqyN.exe

Filesize
2.1MB

MD5
68ee82cd925f354de5f766e2f8e89f74

SHA1
96a1b61a965a8d984deeb3af6d4017d9912334ea

SHA256
e9e1b9178a79da7ed149f33549c4a4cd1b3314dea5ecc85a5dcbde372a261aae

SHA512
3816a9232abb9f31f6319ae46d397fdfee25734e8a8803aa1195bbd472e9c671777e6c2c378dd385f3da48902eab3202c995e562ad1fe6b6abd1495cace8b50d

Download Submit
C:\Windows\System\LBwAJaP.exe

Filesize
2.1MB

MD5
eff1fc38fdfd44255f360b2873a669ee

SHA1
2b8701ed2c93362d6868df3431888ef739a8e894

SHA256
b66331a327b749f3ca7ba5c5bd1fafbf1fd172c67eb352eeda6bf3aa731d6e09

SHA512
c81266821c14e719f50823aba7ababd911c53ae4eae44b67c73deaf42f2c04adcf10e81969fa66f555793bbee1a9b0a27ff9086d262c36794cc5020cb0ff96d4

Download Submit
C:\Windows\System\MGwINLR.exe

Filesize
2.1MB

MD5
7b46dd72c0bbcf653b03100a6dd77136

SHA1
6edaa894643369f0db9b15316ed50a6123356115

SHA256
542e0977671fc9e7a05bec1f639dde141acf92b382ffba32ffb392c48f6fb159

SHA512
f1c900cee024b17f44fea76bf9d55e7fc7bcfd9a31b1492fb087264cd08ee9d976cb25d9d2b4b600a2c5b5f63b49a89530cb5996b37892187cb5e0d77402e5b8

Download Submit
C:\Windows\System\MLtzOSD.exe

Filesize
2.1MB

MD5
d6110a122652eb65aeae964ed6892a42

SHA1
b35cc4d0b386deeb7eaae5f40812f8d1cc746e4c

SHA256
77005629fde50d369ce5fb549dc1eef9b2c4c8bb71ace327e424f4f877f6d88f

SHA512
87c20e0ddbc87c3acc9507e39b74cc83cc88a3821acc390a043d7edb5b5b987e43025ff543410bbbb821dd934105a61d47f4c2f912aba52ea720030a9b3856d3

Download Submit
C:\Windows\System\MWDGpge.exe

Filesize
2.1MB

MD5
d66c6b5265c5a108d2a16a5238a3558e

SHA1
34dfdaf01b4556ab87fa3a6d9f61e61e25f13452

SHA256
72da2609496103c2c49a7e144243ef648e2e102b3978e43271dccd693b12acd0

SHA512
890be30634318121c75da58e0fc5e2ba7e3ec9a33fa2a9e0dc4a342f3eaa43c20c3eed560db788991a7238fed4d8ddbc476225b549d9241f7eb2a6cc334c652a

Download Submit
C:\Windows\System\MkMDhOH.exe

Filesize
2.1MB

MD5
cf09a07db7e43e5d99dcf26a538b5ae8

SHA1
ccdef2c7cd02beeb408a4434bc980c6d6aec1f2a

SHA256
afe501f84ec96f6908651736cfd01b07d6a14841c98e5c29e00b3510c89ac5ac

SHA512
95761fe67c30f69ce03a184b01f336727c0b11ee1b4ae3e140c9dac95a12f0f18dad334d0a0b80c2a62ba46e2f60635d44ffbe48fea26c5edf769d7564419cd5

Download Submit
C:\Windows\System\NTHwfOb.exe

Filesize
2.1MB

MD5
33ba4bb30183ff00e75c94a70630ba76

SHA1
220fe8c5113688243137ff09cef0ea98d827464f

SHA256
d22457abb4e5ad2a0721c8c6eb8430c961de7eda02f8ea4fb7e6bafbd27343de

SHA512
3d9c63b2942774a38ed33244e2f63e3b2f77d925568592dbf472b8237ee674c8c3cb76b6249f18bf9fa085f3d1c985d00f5c708d04fb491c792551dd077f2dc1

Download Submit
C:\Windows\System\OHFmUnz.exe

Filesize
2.1MB

MD5
a84d2efd7729742c740e90dc179d5d1c

SHA1
ab9a5cf7775c8d0646aa61553219bdbbcc39aae2

SHA256
5616fc1291b82cb7b800a777dd93ec6d56be18ce3a7e90a34a8963d4376b2472

SHA512
175bcdec9bfdef857b80fc14f009e84d4da06ee3b0d9bd4f3819c96cfaeb53c5a97ce35c836571a280e4d305ec8c330260ccccb0a8f88c4c1c7c5b5306def4d7

Download Submit
C:\Windows\System\OTVezVm.exe

Filesize
2.1MB

MD5
540c3275f32d4d33587c9000978636f9

SHA1
87cded45c7717136d14f8ab85cb08c2757d13adf

SHA256
9ab405724729b33ff1586a648a0c6c7d95f356b1b309e19bbc02c68991856ab6

SHA512
53741f4e1deb12952784cfd2eb4600a9d90bc6dbecd1a48a59a41a092e0aadcc4b414e4cd635525fd8b8b57e18318f9e197fe42a0c2fa8dcd359ebe2133d8813

Download Submit
C:\Windows\System\QDgwCGh.exe

Filesize
2.1MB

MD5
9fe6b486958fa7693953a916d0bc741d

SHA1
fa4c1db340559e13b65a60bfc6c35a6087781166

SHA256
62c452e5ab749bb65cebb0e6004775aa02c0b5121826af8734229d370799c0d3

SHA512
c20180b0f88e7c3d51d2da4f07640b648962507fc6edd231b87fc42050e08cd96fd17cb17e35982cf931282e87f2fef95aeeb89158e095a7ba6788996c5e4ac9

Download Submit
C:\Windows\System\VdgNCbC.exe

Filesize
2.1MB

MD5
9620eaadcb2fc51ae2644ea4744c22ca

SHA1
4b81f0b7ee563f8e35c747fd3b03e37f220c0dcf

SHA256
f8c06c181b64475e52dca33a1b2618a61ecb29bc2d24670c13415c2920e7b58d

SHA512
8a47a09f412f3297a9e73ffef246c5589a7751abf69d37bc3ab46a81afc54616e97b8c70e26f563e47eb26c0282a18d89f7bf2e24bc5d16e830bc7432a6f4f27

Download Submit
C:\Windows\System\VrkqEGo.exe

Filesize
2.1MB

MD5
bee813e7d7722f8079108f4d36594413

SHA1
55d55daadd9a1cd6e7877b3b378db1a7b5dc6779

SHA256
396a095e6fe785f7f4ec257272904f4ae2b92de11761a56e3f6ef021294c4999

SHA512
60efb4a5ac004092c43d85f71934a7e6fae30acbda59b8c1b48ac72cf4d0bf71ab6a5389cf2b30ef3c3e445fdf2213389afda32e2c507a362b4ae54a9a30f700

Download Submit
C:\Windows\System\XBjsfSL.exe

Filesize
2.1MB

MD5
1b1080706799ed81dc63848b3656985f

SHA1
b6b717befea23c6bffdbc8d2fa536449e448314b

SHA256
70f188c14b85375a02a42aa0e10e3eb29febc186971d3583a3976696198de8c4

SHA512
f7f21630b9956e1667c36249065d68c061a8fdb65899a98835215e9ee0ffa6202397f7147c413c924b1e84bae8228658b663f5a39dc73245c6978dd45239892e

Download Submit
C:\Windows\System\YUEmLYC.exe

Filesize
2.1MB

MD5
3b13076718e2f6e46da3ab5296129c8f

SHA1
4bd691fc7528340ad91440b15bca103e50be9b38

SHA256
2e52b71f0853653613dfd72f2f5579a8bb2d073c349bc97f5744eb2ac326150e

SHA512
96596f948b0e1a97b2d05b703cebda7004a5dfd71c4dcbf14328bd39b6108b458dcbd4567cca2ceaa029d39ce5f2444ef30a281ef236ccf5ac70ec9cce943153

Download Submit
C:\Windows\System\ZWaNhkr.exe

Filesize
2.1MB

MD5
7dc0412ae98c0e7d37438a8b2cce51b2

SHA1
48147250bb7be0b3b255bc7fd5c015c29478f94b

SHA256
3f7dd24ba1977fb43276249bc1c980a7a3099acb2df2c03123fa5d2a2214d5d4

SHA512
b419ba7c50425940125eb381dbf172a64aea7bcd8f0c5801da37a5fb5870eab1720a9683671d68cfb7d46f7d54f69341cfe92c0571d295712fc3664bfed1e6d3

Download Submit
C:\Windows\System\ZuDeLKW.exe

Filesize
2.1MB

MD5
97ea5084d9630f1f191f1bb818f0cadb

SHA1
3fb3d5b80665cba5eecb35006d88ebbb7e8209ce

SHA256
4431fc64504bc15466e1720ef41580f88d09cafb52906d00087fca93350661e8

SHA512
a115d7158e6723cce02c7734f44a67200f83ac5c25e9e377d1e285c7da3aefd9111e1786451bb7c6a27a99d8f09c657f2924851ca06c14a34024cdeecd92e1b4

Download Submit
C:\Windows\System\aIBEubY.exe

Filesize
2.1MB

MD5
cd167cdba4fad2b47e9031ccda904c37

SHA1
fdc8ef9ecb6dc898ec4511e3cc8d08198f72b859

SHA256
dcaed35a0f6465b0edec3cc33bfeecedb4a618368a1d66f4a1c4c4ad22165a6e

SHA512
c67b76a1d3613eed574cb5fd539537ca39d08e6a9f5912b1e1f15e52efa0a5714f1f2492e8ef4751f8abb51188295f739e1ec918372618b8c2210ebc8bbb3dd4

Download Submit
C:\Windows\System\cgpbkJo.exe

Filesize
2.1MB

MD5
a3740a16aec401f3d2da9c5a05f0d865

SHA1
04a7753af9859b82d5e32d568112a45888b98600

SHA256
954af6d7fc96248bc61c63b7f2dd17975382a08e5077a9f4ca61e7f2988c4cd0

SHA512
a14ea96ee033fd42b9fba3abe7873f102dfbaa2f09129312e7df9a3686924b0d0c737575517e6fc48595be0d246211240b375ad722b702a0795f35dd436fa545

Download Submit
C:\Windows\System\dmhYtVf.exe

Filesize
2.1MB

MD5
2cc81433b20cb4f22bde95b8c0af1ad7

SHA1
e01d9e3cc5dae9764aebdd6831553e5d69bc3693

SHA256
2ee8ae20f84060d1b271a3ea46cf7f069bb790b1bd58689403d5f08a83c997ac

SHA512
85a9dd04e7547cd03718ed65d5d20bb1e46a110469965097851a36f1774de2c45cdb82cff6d734fd4cacf180f751b18729227052b31434ea693029c336f08b93

Download Submit
C:\Windows\System\esILpNU.exe

Filesize
2.1MB

MD5
8edbc3b643ed73b32098210282645e74

SHA1
876aad54cfa26d886e7be04535d7494b32912989

SHA256
77394a1f0f2c9fdf45eeb6267b77a5fcb61ada88b6ab495b2b0293599fd133ce

SHA512
e50d878e9e09b0c0d0669b166e01c5eadaee0179aa164c881e5d445d16698af0e550c234147da884b42e73b395ca9425d15eb806886bc5141a99666110ed4d9f

Download Submit
C:\Windows\System\fTYXmzJ.exe

Filesize
2.1MB

MD5
4f78afcb22c3ac89a2ecbf1629cd210d

SHA1
55de23d1105235995517a365b47f0952ab34b80a

SHA256
48d8e21ea1113840e2df36d04eaf67290f1c53af3f8814be6fdb861752ab3007

SHA512
fd628376e92ddb617a923a02ad4ebdd481e363957448f95c55a89416db341234e460296620cf1111b292e283e1275a3da7537dde9cabf148672ec893973f0880

Download Submit
C:\Windows\System\gnHpczI.exe

Filesize
2.1MB

MD5
90adad97de98dfa2c9eb67f322c02c68

SHA1
cad7a931383e876cd2d3bc1af28228dde1891385

SHA256
f107810a1a82b6ec419a881b939c500a03f1aa830551797f53945e43afa48fc3

SHA512
248ae640c972826a8b86bed44b5496c72473f9d64ecc5cc4d0208be3b7d36721240c4431451fa053237e3ce836d447453b820b7d07453ed03e274f3fe5ca5c83

Download Submit
C:\Windows\System\hUimQMZ.exe

Filesize
2.1MB

MD5
4fad5d93aadaa6d51af345e845247a8f

SHA1
43b6db732ec48d105717d473aa78038ee6e1874a

SHA256
220815facf76d5c926c7eeb9ef25313a837bf4ebe1524975dbd05ef22474fef3

SHA512
fa2df134e8bba01da52dc2a5f83427b043996faa92715c5d838c3ae2a03dc1d629edd03f01353d9c107c346031a145e7bb2b4abd085686c5d15c02baa95ec19c

Download Submit
C:\Windows\System\hxmJFUF.exe

Filesize
2.1MB

MD5
1af02bb0db9e4c528f080fc37da733a8

SHA1
1d6d2b1fdea20f2280ed10c85ac36287544600a3

SHA256
30b233ae424ee02be99a7d51b4865076943f2382743f9d0edba592d59e6e52a5

SHA512
ed7291b68fcf6092cf86a227176b42db17ad2b9c649020c2b31c1c8fea9f838958472101ca5248868e362d12cfe27d0638a081fe64d8273d2b3ac2c171dd2146

Download Submit
C:\Windows\System\iSYvNkx.exe

Filesize
2.1MB

MD5
bc531bf57486228f67046f8ae1b18e8e

SHA1
f1d1ce9473b8387262978a1613ffdd145ace7460

SHA256
c6edb4a9de32dc0e5aa5d6b9cca226f0a4e2354ea92a850180b360658164b081

SHA512
c58f2ac45a24a7fcc54f0d5f2237478a90159307f06f483ea2e1c901ecd0361f0946cc94af31f050ce2791599ae5a6855a33d167d0ee6d56274a0e4650400b11

Download Submit
C:\Windows\System\jVdtYef.exe

Filesize
2.1MB

MD5
11772613488d3e4cee16ce044c95ce5e

SHA1
4950904f251250715478a139a0e50f4c88a8f463

SHA256
e82ae95963a856e22c750026353478ec0cb8ae4831ce67eaf763ce584ad64c28

SHA512
8763fa23e25f6e109596f2723f1bab407a891f35df1f466b81315d4966086926770943bced93a9e9e50ba536afba9a892a67daa1f60202f267aa69e2e1ef33ba

Download Submit
C:\Windows\System\nNCxhvq.exe

Filesize
2.1MB

MD5
f7c967997eacaed55aef8ae48d118374

SHA1
fceb3319922b44b2ff673197037b4afa7da2cb3f

SHA256
367b0fa3d7bebacb53ea4e7f232638b36dad4df05482e4eb2317c92123927804

SHA512
4743b3fbf2e4abe75483ae6300a4674406a2cd6a4cccc67260d409da30bc91d5e3fc0ed33f65bada656b6f61ae6d4470ad262f5e299a8bb16e67c6068f5429f2

Download Submit
C:\Windows\System\nYYejOz.exe

Filesize
2.1MB

MD5
dbdb7e18f12573fe7d0704360d90a50b

SHA1
d7dcb82eb54d8d10e61810449ae44483198326fb

SHA256
6a08fc0e09f46fb4d01695667a3f8e3b2554bf9176b0facb821e027023f4aa4d

SHA512
175df054f93451fe896f94c96f5cbb7c7d38b20885d13eba9f4128abc4e21d9ec6e24198f7f13de9d4b8777f7a3f9cfbd3a8bc30dc18a115270ef517998190d3

Download Submit
C:\Windows\System\oSgZLEy.exe

Filesize
2.1MB

MD5
5d086e83b973c303f9b5b93ce46eef90

SHA1
9c73164a48742fc877499cefcc1f46facb7ffbd7

SHA256
90c4f64f0690d35f361d845c135d6e497bab049e399e759c7ee4beca7fa238aa

SHA512
40d4acd8180db2c5029e9c375fd0dfd02dd176d2930682c178a825e54c4212aa1ab505bdeb9ddba3863c33bb53bbd9cda6eb72033ea4da571eb8f8e9e8cc419f

Download Submit
C:\Windows\System\qDnwiNj.exe

Filesize
2.1MB

MD5
90e4fa010824921a65da0998725d19f7

SHA1
9f1de0c028c4b4af32b184b538c91322e15e209a

SHA256
e0e50f04c91ceff03116d02015738031e0799eafdea5c2eb8c5fd8f7dbec3ddd

SHA512
946c1d383840d97eb970e1bf13982a94e4cf4923e586ec901844955d285a13ee7313e3acab39e4bea2f8abe7e84e0ca7462dbdc8dcd778ac75adabf41e214d4a

Download Submit
C:\Windows\System\qwiGDKj.exe

Filesize
2.1MB

MD5
51badeb0b185f909ea3669b82312b8e1

SHA1
c5b1b80d2c140f8eda921dd4ce3257c4ee3031ee

SHA256
6853868906bb7be6eb863fc765fb0eaf8634591ac7e16ca3d21513212d260ccc

SHA512
b7e4fe57548eef06b67799ecaf9d8a8c8067ae1724373725e0dd118a35674daa638017cff03f6ffabff46090da9be2c2ee926ef6e9c3889e6b2741a27336564a

Download Submit
C:\Windows\System\tsclmgy.exe

Filesize
2.1MB

MD5
361b326c84ed4f9bd92c299624085af6

SHA1
b82ac2594aeefe754c7de050ef0486110187a1f9

SHA256
e65d5ba9e8c718f54312f06f61fda21dbd8306ba424cfdbfe18fc8cc5de242cc

SHA512
b80795005e49a2e10a0d39607057cf89acd115c4741e8ddb60736b95557b3765e891a0a2d46f0fc17990e6928c37226d0a3cc3abcc65088c893458a1c0b35c8f

Download Submit
C:\Windows\System\vKnweCw.exe

Filesize
2.1MB

MD5
ed9bc76cb2001f96b8befbc57751fa13

SHA1
fbd3e574b056e8b4033e3006d77cdaf57311c01c

SHA256
43a6ed93586ff42ce2b9e84a301ddfdcf06979ef5a197fc865ac4d3034dc1514

SHA512
6613ade306e1a8a94f77af71e317a8f2e8079def950e16b679bee799d29e4d20fb70ddb23d526a03717d739559cab7149d95444332201a3905d7c256dbdc29be

Download Submit
C:\Windows\System\wzLnRkH.exe

Filesize
2.1MB

MD5
8ff67e2308a2e149843b443ec6a31781

SHA1
0c5516ca8805b86a905091e0789d41766a4f772c

SHA256
cb88031a23ec9b2e015133c876362cbc2a4c3d05ab52cae988d0ede42ed3bad5

SHA512
0622bee6f8620e57224186f9df1af7545fcb7edd0c716307b7e569b36ff10258dca9b15c78089949efd4a0d0073ecee84dd3810e49cf65195817527691de3cd0

Download Submit
C:\Windows\System\zAtRrrP.exe

Filesize
2.1MB

MD5
4dad29eef084cb50f5b4b88ef7363056

SHA1
f5186126dec86236a9b5c30d3b969f91626cc0f7

SHA256
40a056da9bd587790eafcb29e92218b63a7e6c31b0a5feb7e9ed1e1781233fcd

SHA512
dad7a3da2289a11af302e0f43c85b905828c0f43c272348164802355703fd6419250a32ee8ad00e2e46a4c3e5463f70619534518a473201e70544d37953feb29

Download Submit
memory/400-198-0x00007FF6C1770000-0x00007FF6C1B62000-memory.dmp

Filesize
3.9MB

Download
memory/400-4716-0x00007FF6C1770000-0x00007FF6C1B62000-memory.dmp

Filesize
3.9MB

Download
memory/1044-249-0x00007FF7436D0000-0x00007FF743AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-4782-0x00007FF7436D0000-0x00007FF743AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-4690-0x00007FF74BC70000-0x00007FF74C062000-memory.dmp

Filesize
3.9MB

Download
memory/1952-161-0x00007FF74BC70000-0x00007FF74C062000-memory.dmp

Filesize
3.9MB

Download
memory/2032-4728-0x00007FF75C250000-0x00007FF75C642000-memory.dmp

Filesize
3.9MB

Download
memory/2032-353-0x00007FF75C250000-0x00007FF75C642000-memory.dmp

Filesize
3.9MB

Download
memory/2112-155-0x00007FF710740000-0x00007FF710B32000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4684-0x00007FF710740000-0x00007FF710B32000-memory.dmp

Filesize
3.9MB

Download
memory/2296-418-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp

Filesize
3.9MB

Download
memory/2296-4668-0x00007FF7E2E10000-0x00007FF7E3202000-memory.dmp

Filesize
3.9MB

Download
memory/2416-415-0x00007FF7BC570000-0x00007FF7BC962000-memory.dmp

Filesize
3.9MB

Download
memory/2416-4725-0x00007FF7BC570000-0x00007FF7BC962000-memory.dmp

Filesize
3.9MB

Download
memory/2648-36-0x00007FF7B2930000-0x00007FF7B2D22000-memory.dmp

Filesize
3.9MB

Download
memory/2648-4700-0x00007FF7B2930000-0x00007FF7B2D22000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4672-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-419-0x00007FF7120B0000-0x00007FF7124A2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-394-0x00007FF734190000-0x00007FF734582000-memory.dmp

Filesize
3.9MB

Download
memory/2812-4789-0x00007FF734190000-0x00007FF734582000-memory.dmp

Filesize
3.9MB

Download
memory/2868-13-0x00007FF6DE590000-0x00007FF6DE982000-memory.dmp

Filesize
3.9MB

Download
memory/3116-37-0x00000292A3AA0000-0x00000292A3AB0000-memory.dmp

Filesize
64KB

Download
memory/3116-417-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/3116-242-0x00000292A3AB0000-0x00000292A3AD2000-memory.dmp

Filesize
136KB

Download
memory/3116-19-0x00000292A3AA0000-0x00000292A3AB0000-memory.dmp

Filesize
64KB

Download
memory/3588-4939-0x00007FF7FB3E0000-0x00007FF7FB7D2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-1-0x000001D9A0E30000-0x000001D9A0E40000-memory.dmp

Filesize
64KB

Download
memory/3588-0-0x00007FF7FB3E0000-0x00007FF7FB7D2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-4787-0x00007FF6EB6B0000-0x00007FF6EBAA2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-421-0x00007FF6EB6B0000-0x00007FF6EBAA2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-420-0x00007FF748FF0000-0x00007FF7493E2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-4695-0x00007FF748FF0000-0x00007FF7493E2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-4712-0x00007FF680460000-0x00007FF680852000-memory.dmp

Filesize
3.9MB

Download
memory/4524-308-0x00007FF680460000-0x00007FF680852000-memory.dmp

Filesize
3.9MB

Download
memory/4556-122-0x00007FF69F790000-0x00007FF69FB82000-memory.dmp

Filesize
3.9MB

Download
memory/4556-4697-0x00007FF69F790000-0x00007FF69FB82000-memory.dmp

Filesize
3.9MB

Download
memory/4600-312-0x00007FF7A9FF0000-0x00007FF7AA3E2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4722-0x00007FF7A9FF0000-0x00007FF7AA3E2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-4676-0x00007FF6E5AE0000-0x00007FF6E5ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-64-0x00007FF6E5AE0000-0x00007FF6E5ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-33-0x00007FF656A50000-0x00007FF656E42000-memory.dmp

Filesize
3.9MB

Download
memory/4940-4711-0x00007FF7FE1D0000-0x00007FF7FE5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-290-0x00007FF7FE1D0000-0x00007FF7FE5C2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-416-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-4778-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp

Filesize
3.9MB

Download
memory/5104-97-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp

Filesize
3.9MB

Download
memory/5104-4652-0x00007FF7E9160000-0x00007FF7E9552000-memory.dmp

Filesize
3.9MB

Download