xmrig | 70c70bd0e620952f5a9b4c523a811105299077d925c2bd001a282668a9a8ed11

Analysis

max time kernel
150s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
Size

2.2MB
MD5

07e533d6b7bbb4046dac6ab7df6d01db
SHA1

2666d6dc72cb7d7b7e880d7d28e86d508b5d2164
SHA256

70c70bd0e620952f5a9b4c523a811105299077d925c2bd001a282668a9a8ed11
SHA512

f0bc2dd3eb4fab9d0788da5f132af4dd482c8f649674c80feabccc04d4ff579cafc8be48870ec35a1245c00ccc27eeaee6b9f6ae1f5b3fe37778b622c3749173
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+PN:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/2564-429-0x00007FF669230000-0x00007FF669622000-memory.dmp	xmrig
behavioral2/memory/1804-504-0x00007FF6B33B0000-0x00007FF6B37A2000-memory.dmp	xmrig
behavioral2/memory/2272-550-0x00007FF664A20000-0x00007FF664E12000-memory.dmp	xmrig
behavioral2/memory/4316-554-0x00007FF6DF7D0000-0x00007FF6DFBC2000-memory.dmp	xmrig
behavioral2/memory/1708-553-0x00007FF67A140000-0x00007FF67A532000-memory.dmp	xmrig
behavioral2/memory/4904-552-0x00007FF7E37C0000-0x00007FF7E3BB2000-memory.dmp	xmrig
behavioral2/memory/2176-551-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	xmrig
behavioral2/memory/380-549-0x00007FF614260000-0x00007FF614652000-memory.dmp	xmrig
behavioral2/memory/4056-548-0x00007FF76A3E0000-0x00007FF76A7D2000-memory.dmp	xmrig
behavioral2/memory/4804-547-0x00007FF6CB100000-0x00007FF6CB4F2000-memory.dmp	xmrig
behavioral2/memory/876-546-0x00007FF79C740000-0x00007FF79CB32000-memory.dmp	xmrig
behavioral2/memory/5028-545-0x00007FF69D600000-0x00007FF69D9F2000-memory.dmp	xmrig
behavioral2/memory/1840-544-0x00007FF676950000-0x00007FF676D42000-memory.dmp	xmrig
behavioral2/memory/436-360-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp	xmrig
behavioral2/memory/3984-300-0x00007FF600E40000-0x00007FF601232000-memory.dmp	xmrig
behavioral2/memory/884-249-0x00007FF6E4CF0000-0x00007FF6E50E2000-memory.dmp	xmrig
behavioral2/memory/3112-192-0x00007FF74BBA0000-0x00007FF74BF92000-memory.dmp	xmrig
behavioral2/memory/2892-195-0x00007FF7E7DF0000-0x00007FF7E81E2000-memory.dmp	xmrig
behavioral2/memory/3980-136-0x00007FF730C50000-0x00007FF731042000-memory.dmp	xmrig
behavioral2/memory/2888-93-0x00007FF7DB3C0000-0x00007FF7DB7B2000-memory.dmp	xmrig
behavioral2/memory/2072-52-0x00007FF646E80000-0x00007FF647272000-memory.dmp	xmrig
behavioral2/memory/3112-4452-0x00007FF74BBA0000-0x00007FF74BF92000-memory.dmp	xmrig
behavioral2/memory/2176-4487-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	xmrig
behavioral2/memory/3980-4491-0x00007FF730C50000-0x00007FF731042000-memory.dmp	xmrig
behavioral2/memory/1708-4526-0x00007FF67A140000-0x00007FF67A532000-memory.dmp	xmrig
behavioral2/memory/2892-4534-0x00007FF7E7DF0000-0x00007FF7E81E2000-memory.dmp	xmrig
behavioral2/memory/436-4538-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp	xmrig
behavioral2/memory/884-4622-0x00007FF6E4CF0000-0x00007FF6E50E2000-memory.dmp	xmrig
behavioral2/memory/2984-4614-0x00007FF6C0230000-0x00007FF6C0622000-memory.dmp	xmrig
behavioral2/memory/1840-4626-0x00007FF676950000-0x00007FF676D42000-memory.dmp	xmrig
behavioral2/memory/4904-4620-0x00007FF7E37C0000-0x00007FF7E3BB2000-memory.dmp	xmrig
behavioral2/memory/4056-4682-0x00007FF76A3E0000-0x00007FF76A7D2000-memory.dmp	xmrig
behavioral2/memory/4804-4723-0x00007FF6CB100000-0x00007FF6CB4F2000-memory.dmp	xmrig
behavioral2/memory/4316-4718-0x00007FF6DF7D0000-0x00007FF6DFBC2000-memory.dmp	xmrig
behavioral2/memory/380-4734-0x00007FF614260000-0x00007FF614652000-memory.dmp	xmrig
behavioral2/memory/5028-4691-0x00007FF69D600000-0x00007FF69D9F2000-memory.dmp	xmrig
behavioral2/memory/876-4689-0x00007FF79C740000-0x00007FF79CB32000-memory.dmp	xmrig
behavioral2/memory/1804-4717-0x00007FF6B33B0000-0x00007FF6B37A2000-memory.dmp	xmrig
behavioral2/memory/2272-4690-0x00007FF664A20000-0x00007FF664E12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2072	JLjtdeT.exe
2176	YJCjCYW.exe
2888	iaKbBqS.exe
3980	blhvhqC.exe
3112	PtYtksD.exe
2892	pmSoAbq.exe
884	fzdWNOa.exe
3984	pMbhiHq.exe
4904	nUFRBHz.exe
436	GiKEPXc.exe
1708	ANurkjg.exe
2564	tzpoHQK.exe
1804	LojzAVL.exe
1840	kKTLpGM.exe
5028	RwzBthd.exe
876	PSjblod.exe
4804	CqmRmKc.exe
4056	yWQSEOl.exe
380	BqBLkye.exe
4316	OvbpQfn.exe
2272	iIDlvym.exe
2044	xOGiEFa.exe
1472	QyaFqAp.exe
1532	asGLHxc.exe
2032	fnszgIn.exe
1932	WULFtOh.exe
2024	vtargMO.exe
344	xrGTlMm.exe
1356	ypXfPDP.exe
3860	AmwrZjN.exe
4108	UmUfIAk.exe
1488	jprmXCW.exe
1936	dhbSUyc.exe
752	gGZECnl.exe
4620	GFRsFrH.exe
3712	zozatqH.exe
640	QfCQkIb.exe
2964	imoWovI.exe
2052	SKeVWhU.exe
1584	VbIVUtl.exe
4688	zwGQixw.exe
852	MaBDOVs.exe
4176	llIrtGe.exe
1988	yUWbJPM.exe
4060	RTWIAel.exe
4468	foWDkBh.exe
5036	czUgFzi.exe
4376	UeRFjge.exe
1288	bdhpFdV.exe
3204	qHEwRaS.exe
4572	SYkVciA.exe
220	UUeUdxX.exe
4532	eqeLLFn.exe
2880	SbzTeTJ.exe
724	oZvlqCF.exe
4624	xiKXgvB.exe
1892	ZXzjsdk.exe
1252	FNPkXXE.exe
4676	fvyDLjo.exe
784	GCzxlud.exe
552	fqUDaSC.exe
396	WZgjZDi.exe
2760	SlyMmRG.exe
1640	vfFjbUs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x00007FF6C0230000-0x00007FF6C0622000-memory.dmp	upx
behavioral2/files/0x000b000000023ba2-7.dat	upx
behavioral2/files/0x000a000000023ba7-6.dat	upx
behavioral2/files/0x000a000000023ba8-18.dat	upx
behavioral2/files/0x000a000000023baa-26.dat	upx
behavioral2/files/0x000a000000023bb0-63.dat	upx
behavioral2/files/0x000a000000023bbc-113.dat	upx
behavioral2/memory/2564-429-0x00007FF669230000-0x00007FF669622000-memory.dmp	upx
behavioral2/memory/1804-504-0x00007FF6B33B0000-0x00007FF6B37A2000-memory.dmp	upx
behavioral2/memory/2272-550-0x00007FF664A20000-0x00007FF664E12000-memory.dmp	upx
behavioral2/memory/4316-554-0x00007FF6DF7D0000-0x00007FF6DFBC2000-memory.dmp	upx
behavioral2/memory/1708-553-0x00007FF67A140000-0x00007FF67A532000-memory.dmp	upx
behavioral2/memory/4904-552-0x00007FF7E37C0000-0x00007FF7E3BB2000-memory.dmp	upx
behavioral2/memory/2176-551-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp	upx
behavioral2/memory/380-549-0x00007FF614260000-0x00007FF614652000-memory.dmp	upx
behavioral2/memory/4056-548-0x00007FF76A3E0000-0x00007FF76A7D2000-memory.dmp	upx
behavioral2/memory/4804-547-0x00007FF6CB100000-0x00007FF6CB4F2000-memory.dmp	upx
behavioral2/memory/876-546-0x00007FF79C740000-0x00007FF79CB32000-memory.dmp	upx
behavioral2/memory/5028-545-0x00007FF69D600000-0x00007FF69D9F2000-memory.dmp	upx
behavioral2/memory/1840-544-0x00007FF676950000-0x00007FF676D42000-memory.dmp	upx
behavioral2/memory/436-360-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp	upx
behavioral2/memory/3984-300-0x00007FF600E40000-0x00007FF601232000-memory.dmp	upx
behavioral2/memory/884-249-0x00007FF6E4CF0000-0x00007FF6E50E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-197.dat	upx
behavioral2/memory/3112-192-0x00007FF74BBA0000-0x00007FF74BF92000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-189.dat	upx
behavioral2/files/0x000a000000023bcb-188.dat	upx
behavioral2/files/0x000a000000023bb2-183.dat	upx
behavioral2/files/0x000a000000023bbf-182.dat	upx
behavioral2/files/0x000a000000023bc9-181.dat	upx
behavioral2/files/0x000a000000023bc8-180.dat	upx
behavioral2/files/0x000a000000023bc7-178.dat	upx
behavioral2/files/0x000a000000023bc5-171.dat	upx
behavioral2/files/0x0031000000023bb6-166.dat	upx
behavioral2/files/0x000a000000023bbb-161.dat	upx
behavioral2/files/0x0031000000023bb5-158.dat	upx
behavioral2/files/0x000a000000023bb4-157.dat	upx
behavioral2/files/0x000a000000023bc3-153.dat	upx
behavioral2/files/0x000a000000023bba-149.dat	upx
behavioral2/files/0x000a000000023bc2-148.dat	upx
behavioral2/files/0x000a000000023baf-145.dat	upx
behavioral2/files/0x000a000000023bb3-143.dat	upx
behavioral2/files/0x000a000000023bc1-142.dat	upx
behavioral2/files/0x000a000000023bce-203.dat	upx
behavioral2/files/0x000a000000023bcd-196.dat	upx
behavioral2/memory/2892-195-0x00007FF7E7DF0000-0x00007FF7E81E2000-memory.dmp	upx
behavioral2/memory/3980-136-0x00007FF730C50000-0x00007FF731042000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-187.dat	upx
behavioral2/files/0x000a000000023bb1-124.dat	upx
behavioral2/files/0x000a000000023bbe-122.dat	upx
behavioral2/files/0x0031000000023bb7-120.dat	upx
behavioral2/files/0x000a000000023bc6-175.dat	upx
behavioral2/files/0x000a000000023bae-110.dat	upx
behavioral2/files/0x000a000000023bc4-164.dat	upx
behavioral2/files/0x000a000000023bac-100.dat	upx
behavioral2/files/0x000a000000023bb8-141.dat	upx
behavioral2/files/0x000a000000023bad-96.dat	upx
behavioral2/files/0x000a000000023bc0-130.dat	upx
behavioral2/files/0x000a000000023bbd-118.dat	upx
behavioral2/files/0x000a000000023bb4-80.dat	upx
behavioral2/memory/2888-93-0x00007FF7DB3C0000-0x00007FF7DB7B2000-memory.dmp	upx
behavioral2/memory/2072-52-0x00007FF646E80000-0x00007FF647272000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-68.dat	upx
behavioral2/files/0x000a000000023ba6-27.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oELYYNa.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\GbmyJLR.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\FSRbCed.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\TqbepJQ.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\bCCHAYO.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\AKllWgV.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\rEKqcET.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\GGHDDWu.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xntyFkf.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\FrQgknj.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xOxYkWt.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\sZenTaH.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\diYIQoR.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\MYwqVlo.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\dLgwkcf.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\jOmjlhd.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\rGOQinG.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\hYjuDHr.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\yeMukmG.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ySMmZuK.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\VJklRHj.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\PTtkOSi.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\pyTwfjh.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\rvKjVji.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\dlqtXoJ.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\wGZbYxz.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\lzLyijw.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XTLUghh.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\nVdUItw.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\rAySLKX.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xdgMfwg.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\liHojVW.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\KEjnMnU.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\SbplTWR.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\PYwtHti.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\YAjGnpL.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\jLhQuEw.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\piMttQR.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\jlNgSPL.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\BpGmeyp.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\BvbmFOD.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\nsRlWAH.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ieICOGZ.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\TYMKHHN.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\MgPgbck.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\DqJlaBN.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\uSwudDH.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ZZQWfAN.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\kAvtyng.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\HyriAQM.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\UHLzhxq.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\gQmXBBv.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ajhHfsV.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\pWYlacS.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\JzENZnj.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\WZotVba.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\UeQYtIL.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\NPOCDSn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\BYaoibF.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\fgSNrHe.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\QVnCngy.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\gdsBJRY.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\WJoXbjX.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ZYAVRAO.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3668	powershell.exe
3668	powershell.exe
3668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeLockMemoryPrivilege	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3668	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	84
PID 2984 wrote to memory of 3668	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	84
PID 2984 wrote to memory of 2072	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	85
PID 2984 wrote to memory of 2072	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	85
PID 2984 wrote to memory of 2888	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	86
PID 2984 wrote to memory of 2888	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	86
PID 2984 wrote to memory of 2176	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	87
PID 2984 wrote to memory of 2176	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	87
PID 2984 wrote to memory of 3980	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	88
PID 2984 wrote to memory of 3980	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	88
PID 2984 wrote to memory of 3112	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	89
PID 2984 wrote to memory of 3112	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	89
PID 2984 wrote to memory of 2892	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	90
PID 2984 wrote to memory of 2892	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	90
PID 2984 wrote to memory of 3984	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	91
PID 2984 wrote to memory of 3984	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	91
PID 2984 wrote to memory of 436	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	92
PID 2984 wrote to memory of 436	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	92
PID 2984 wrote to memory of 884	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	93
PID 2984 wrote to memory of 884	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	93
PID 2984 wrote to memory of 4904	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	94
PID 2984 wrote to memory of 4904	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	94
PID 2984 wrote to memory of 5028	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	95
PID 2984 wrote to memory of 5028	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	95
PID 2984 wrote to memory of 1708	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	96
PID 2984 wrote to memory of 1708	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	96
PID 2984 wrote to memory of 2564	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	97
PID 2984 wrote to memory of 2564	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	97
PID 2984 wrote to memory of 1804	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	98
PID 2984 wrote to memory of 1804	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	98
PID 2984 wrote to memory of 1840	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	99
PID 2984 wrote to memory of 1840	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	99
PID 2984 wrote to memory of 876	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	100
PID 2984 wrote to memory of 876	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	100
PID 2984 wrote to memory of 4804	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	101
PID 2984 wrote to memory of 4804	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	101
PID 2984 wrote to memory of 4056	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	102
PID 2984 wrote to memory of 4056	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	102
PID 2984 wrote to memory of 380	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	103
PID 2984 wrote to memory of 380	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	103
PID 2984 wrote to memory of 2024	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	104
PID 2984 wrote to memory of 2024	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	104
PID 2984 wrote to memory of 4316	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	105
PID 2984 wrote to memory of 4316	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	105
PID 2984 wrote to memory of 2272	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	106
PID 2984 wrote to memory of 2272	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	106
PID 2984 wrote to memory of 2044	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	107
PID 2984 wrote to memory of 2044	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	107
PID 2984 wrote to memory of 1472	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	108
PID 2984 wrote to memory of 1472	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	108
PID 2984 wrote to memory of 1532	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	109
PID 2984 wrote to memory of 1532	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	109
PID 2984 wrote to memory of 2032	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	110
PID 2984 wrote to memory of 2032	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	110
PID 2984 wrote to memory of 640	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	111
PID 2984 wrote to memory of 640	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	111
PID 2984 wrote to memory of 1932	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	112
PID 2984 wrote to memory of 1932	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	112
PID 2984 wrote to memory of 344	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	113
PID 2984 wrote to memory of 344	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	113
PID 2984 wrote to memory of 1356	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	114
PID 2984 wrote to memory of 1356	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	114
PID 2984 wrote to memory of 3860	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	115
PID 2984 wrote to memory of 3860	2984	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\System\JLjtdeT.exe
  C:\Windows\System\JLjtdeT.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\iaKbBqS.exe
  C:\Windows\System\iaKbBqS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\YJCjCYW.exe
  C:\Windows\System\YJCjCYW.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\blhvhqC.exe
  C:\Windows\System\blhvhqC.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\PtYtksD.exe
  C:\Windows\System\PtYtksD.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\pmSoAbq.exe
  C:\Windows\System\pmSoAbq.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\pMbhiHq.exe
  C:\Windows\System\pMbhiHq.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\GiKEPXc.exe
  C:\Windows\System\GiKEPXc.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\fzdWNOa.exe
  C:\Windows\System\fzdWNOa.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\nUFRBHz.exe
  C:\Windows\System\nUFRBHz.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\RwzBthd.exe
  C:\Windows\System\RwzBthd.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\ANurkjg.exe
  C:\Windows\System\ANurkjg.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\tzpoHQK.exe
  C:\Windows\System\tzpoHQK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\LojzAVL.exe
  C:\Windows\System\LojzAVL.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kKTLpGM.exe
  C:\Windows\System\kKTLpGM.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\PSjblod.exe
  C:\Windows\System\PSjblod.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\CqmRmKc.exe
  C:\Windows\System\CqmRmKc.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\yWQSEOl.exe
  C:\Windows\System\yWQSEOl.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\BqBLkye.exe
  C:\Windows\System\BqBLkye.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\vtargMO.exe
  C:\Windows\System\vtargMO.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\OvbpQfn.exe
  C:\Windows\System\OvbpQfn.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\iIDlvym.exe
  C:\Windows\System\iIDlvym.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\xOGiEFa.exe
  C:\Windows\System\xOGiEFa.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\QyaFqAp.exe
  C:\Windows\System\QyaFqAp.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\asGLHxc.exe
  C:\Windows\System\asGLHxc.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\fnszgIn.exe
  C:\Windows\System\fnszgIn.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\QfCQkIb.exe
  C:\Windows\System\QfCQkIb.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\WULFtOh.exe
  C:\Windows\System\WULFtOh.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\xrGTlMm.exe
  C:\Windows\System\xrGTlMm.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\ypXfPDP.exe
  C:\Windows\System\ypXfPDP.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\AmwrZjN.exe
  C:\Windows\System\AmwrZjN.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\UmUfIAk.exe
  C:\Windows\System\UmUfIAk.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\jprmXCW.exe
  C:\Windows\System\jprmXCW.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\dhbSUyc.exe
  C:\Windows\System\dhbSUyc.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\gGZECnl.exe
  C:\Windows\System\gGZECnl.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\GFRsFrH.exe
  C:\Windows\System\GFRsFrH.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\zozatqH.exe
  C:\Windows\System\zozatqH.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\imoWovI.exe
  C:\Windows\System\imoWovI.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\SKeVWhU.exe
  C:\Windows\System\SKeVWhU.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\VbIVUtl.exe
  C:\Windows\System\VbIVUtl.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\zwGQixw.exe
  C:\Windows\System\zwGQixw.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\MaBDOVs.exe
  C:\Windows\System\MaBDOVs.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\llIrtGe.exe
  C:\Windows\System\llIrtGe.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\yUWbJPM.exe
  C:\Windows\System\yUWbJPM.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\RTWIAel.exe
  C:\Windows\System\RTWIAel.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\foWDkBh.exe
  C:\Windows\System\foWDkBh.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\czUgFzi.exe
  C:\Windows\System\czUgFzi.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\UeRFjge.exe
  C:\Windows\System\UeRFjge.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\bdhpFdV.exe
  C:\Windows\System\bdhpFdV.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\qHEwRaS.exe
  C:\Windows\System\qHEwRaS.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\SYkVciA.exe
  C:\Windows\System\SYkVciA.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\FopVmob.exe
  C:\Windows\System\FopVmob.exe
  2⤵
  PID:224
- C:\Windows\System\UUeUdxX.exe
  C:\Windows\System\UUeUdxX.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\eqeLLFn.exe
  C:\Windows\System\eqeLLFn.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\SbzTeTJ.exe
  C:\Windows\System\SbzTeTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\oZvlqCF.exe
  C:\Windows\System\oZvlqCF.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\xiKXgvB.exe
  C:\Windows\System\xiKXgvB.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\ZXzjsdk.exe
  C:\Windows\System\ZXzjsdk.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\FNPkXXE.exe
  C:\Windows\System\FNPkXXE.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\fvyDLjo.exe
  C:\Windows\System\fvyDLjo.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\GCzxlud.exe
  C:\Windows\System\GCzxlud.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\fqUDaSC.exe
  C:\Windows\System\fqUDaSC.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\WZgjZDi.exe
  C:\Windows\System\WZgjZDi.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\SlyMmRG.exe
  C:\Windows\System\SlyMmRG.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vfFjbUs.exe
  C:\Windows\System\vfFjbUs.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\WqPoQnx.exe
  C:\Windows\System\WqPoQnx.exe
  2⤵
  PID:4844
- C:\Windows\System\VDnVtfm.exe
  C:\Windows\System\VDnVtfm.exe
  2⤵
  PID:4188
- C:\Windows\System\KJWuLjX.exe
  C:\Windows\System\KJWuLjX.exe
  2⤵
  PID:2360
- C:\Windows\System\fAHVQgp.exe
  C:\Windows\System\fAHVQgp.exe
  2⤵
  PID:4736
- C:\Windows\System\ZOLxJms.exe
  C:\Windows\System\ZOLxJms.exe
  2⤵
  PID:400
- C:\Windows\System\mkvKCZj.exe
  C:\Windows\System\mkvKCZj.exe
  2⤵
  PID:3144
- C:\Windows\System\gkXzKOg.exe
  C:\Windows\System\gkXzKOg.exe
  2⤵
  PID:1908
- C:\Windows\System\KHCIRNW.exe
  C:\Windows\System\KHCIRNW.exe
  2⤵
  PID:5132
- C:\Windows\System\xRxZNOh.exe
  C:\Windows\System\xRxZNOh.exe
  2⤵
  PID:5160
- C:\Windows\System\SLsHKza.exe
  C:\Windows\System\SLsHKza.exe
  2⤵
  PID:5208
- C:\Windows\System\lFnLidm.exe
  C:\Windows\System\lFnLidm.exe
  2⤵
  PID:5232
- C:\Windows\System\YuHyIpj.exe
  C:\Windows\System\YuHyIpj.exe
  2⤵
  PID:5248
- C:\Windows\System\NYBQvBH.exe
  C:\Windows\System\NYBQvBH.exe
  2⤵
  PID:5264
- C:\Windows\System\jSHDtMx.exe
  C:\Windows\System\jSHDtMx.exe
  2⤵
  PID:5288
- C:\Windows\System\jGvYwXg.exe
  C:\Windows\System\jGvYwXg.exe
  2⤵
  PID:5312
- C:\Windows\System\TLsIngA.exe
  C:\Windows\System\TLsIngA.exe
  2⤵
  PID:5340
- C:\Windows\System\RKwDHtB.exe
  C:\Windows\System\RKwDHtB.exe
  2⤵
  PID:5360
- C:\Windows\System\KCkgFec.exe
  C:\Windows\System\KCkgFec.exe
  2⤵
  PID:5384
- C:\Windows\System\TRJDjGh.exe
  C:\Windows\System\TRJDjGh.exe
  2⤵
  PID:5412
- C:\Windows\System\lZtXWhU.exe
  C:\Windows\System\lZtXWhU.exe
  2⤵
  PID:5432
- C:\Windows\System\ASzoToh.exe
  C:\Windows\System\ASzoToh.exe
  2⤵
  PID:5488
- C:\Windows\System\GRbmzkM.exe
  C:\Windows\System\GRbmzkM.exe
  2⤵
  PID:5504
- C:\Windows\System\dIztAxB.exe
  C:\Windows\System\dIztAxB.exe
  2⤵
  PID:5520
- C:\Windows\System\gPTsnac.exe
  C:\Windows\System\gPTsnac.exe
  2⤵
  PID:5536
- C:\Windows\System\lOEVYDX.exe
  C:\Windows\System\lOEVYDX.exe
  2⤵
  PID:5568
- C:\Windows\System\wHQnpNp.exe
  C:\Windows\System\wHQnpNp.exe
  2⤵
  PID:5596
- C:\Windows\System\Krggzon.exe
  C:\Windows\System\Krggzon.exe
  2⤵
  PID:5628
- C:\Windows\System\zqkRhsV.exe
  C:\Windows\System\zqkRhsV.exe
  2⤵
  PID:5644
- C:\Windows\System\QfeOCfE.exe
  C:\Windows\System\QfeOCfE.exe
  2⤵
  PID:5664
- C:\Windows\System\pnPwnBe.exe
  C:\Windows\System\pnPwnBe.exe
  2⤵
  PID:5712
- C:\Windows\System\hiyPxdG.exe
  C:\Windows\System\hiyPxdG.exe
  2⤵
  PID:5732
- C:\Windows\System\ZaSBxOU.exe
  C:\Windows\System\ZaSBxOU.exe
  2⤵
  PID:5748
- C:\Windows\System\YbeNTWy.exe
  C:\Windows\System\YbeNTWy.exe
  2⤵
  PID:5784
- C:\Windows\System\MKctxJX.exe
  C:\Windows\System\MKctxJX.exe
  2⤵
  PID:5800
- C:\Windows\System\MeTFPli.exe
  C:\Windows\System\MeTFPli.exe
  2⤵
  PID:5816
- C:\Windows\System\xyaiQzq.exe
  C:\Windows\System\xyaiQzq.exe
  2⤵
  PID:5836
- C:\Windows\System\wDZFhjg.exe
  C:\Windows\System\wDZFhjg.exe
  2⤵
  PID:5856
- C:\Windows\System\jKNCGDk.exe
  C:\Windows\System\jKNCGDk.exe
  2⤵
  PID:5892
- C:\Windows\System\SGnjHDE.exe
  C:\Windows\System\SGnjHDE.exe
  2⤵
  PID:5924
- C:\Windows\System\eYRSDFz.exe
  C:\Windows\System\eYRSDFz.exe
  2⤵
  PID:5952
- C:\Windows\System\QgtkUGT.exe
  C:\Windows\System\QgtkUGT.exe
  2⤵
  PID:5976
- C:\Windows\System\TkttsxA.exe
  C:\Windows\System\TkttsxA.exe
  2⤵
  PID:5992
- C:\Windows\System\ATaGoFZ.exe
  C:\Windows\System\ATaGoFZ.exe
  2⤵
  PID:6028
- C:\Windows\System\MEGcxiB.exe
  C:\Windows\System\MEGcxiB.exe
  2⤵
  PID:6048
- C:\Windows\System\aynHYgt.exe
  C:\Windows\System\aynHYgt.exe
  2⤵
  PID:6068
- C:\Windows\System\CfOJQLl.exe
  C:\Windows\System\CfOJQLl.exe
  2⤵
  PID:6092
- C:\Windows\System\FHsvQpV.exe
  C:\Windows\System\FHsvQpV.exe
  2⤵
  PID:6112
- C:\Windows\System\mEfydJQ.exe
  C:\Windows\System\mEfydJQ.exe
  2⤵
  PID:6128
- C:\Windows\System\bGuzxgx.exe
  C:\Windows\System\bGuzxgx.exe
  2⤵
  PID:2716
- C:\Windows\System\raEdpBW.exe
  C:\Windows\System\raEdpBW.exe
  2⤵
  PID:5092
- C:\Windows\System\QgpOoUs.exe
  C:\Windows\System\QgpOoUs.exe
  2⤵
  PID:2232
- C:\Windows\System\YiPrCcW.exe
  C:\Windows\System\YiPrCcW.exe
  2⤵
  PID:1520
- C:\Windows\System\WQnUTpj.exe
  C:\Windows\System\WQnUTpj.exe
  2⤵
  PID:4836
- C:\Windows\System\zVuTDKq.exe
  C:\Windows\System\zVuTDKq.exe
  2⤵
  PID:2800
- C:\Windows\System\QJaMISJ.exe
  C:\Windows\System\QJaMISJ.exe
  2⤵
  PID:3604
- C:\Windows\System\nwmEenR.exe
  C:\Windows\System\nwmEenR.exe
  2⤵
  PID:5220
- C:\Windows\System\omIpeFE.exe
  C:\Windows\System\omIpeFE.exe
  2⤵
  PID:2620
- C:\Windows\System\GRdfiqP.exe
  C:\Windows\System\GRdfiqP.exe
  2⤵
  PID:1156
- C:\Windows\System\fluSmtO.exe
  C:\Windows\System\fluSmtO.exe
  2⤵
  PID:712
- C:\Windows\System\vDamVye.exe
  C:\Windows\System\vDamVye.exe
  2⤵
  PID:2748
- C:\Windows\System\VUhyyGf.exe
  C:\Windows\System\VUhyyGf.exe
  2⤵
  PID:2712
- C:\Windows\System\ljRuLjt.exe
  C:\Windows\System\ljRuLjt.exe
  2⤵
  PID:5608
- C:\Windows\System\tVQFtjR.exe
  C:\Windows\System\tVQFtjR.exe
  2⤵
  PID:5680
- C:\Windows\System\npRroeA.exe
  C:\Windows\System\npRroeA.exe
  2⤵
  PID:1564
- C:\Windows\System\oDUChen.exe
  C:\Windows\System\oDUChen.exe
  2⤵
  PID:2252
- C:\Windows\System\IRfBoJI.exe
  C:\Windows\System\IRfBoJI.exe
  2⤵
  PID:5848
- C:\Windows\System\ffJhMDs.exe
  C:\Windows\System\ffJhMDs.exe
  2⤵
  PID:4896
- C:\Windows\System\DGKRxeh.exe
  C:\Windows\System\DGKRxeh.exe
  2⤵
  PID:1048
- C:\Windows\System\NsOeKkW.exe
  C:\Windows\System\NsOeKkW.exe
  2⤵
  PID:4080
- C:\Windows\System\MbMSILr.exe
  C:\Windows\System\MbMSILr.exe
  2⤵
  PID:2940
- C:\Windows\System\QxYAVsi.exe
  C:\Windows\System\QxYAVsi.exe
  2⤵
  PID:5960
- C:\Windows\System\BWMiohZ.exe
  C:\Windows\System\BWMiohZ.exe
  2⤵
  PID:5988
- C:\Windows\System\hccHOIB.exe
  C:\Windows\System\hccHOIB.exe
  2⤵
  PID:6016
- C:\Windows\System\FToWcro.exe
  C:\Windows\System\FToWcro.exe
  2⤵
  PID:5532
- C:\Windows\System\DUKqzGS.exe
  C:\Windows\System\DUKqzGS.exe
  2⤵
  PID:6100
- C:\Windows\System\upBpxVX.exe
  C:\Windows\System\upBpxVX.exe
  2⤵
  PID:3740
- C:\Windows\System\xGlAUgL.exe
  C:\Windows\System\xGlAUgL.exe
  2⤵
  PID:6164
- C:\Windows\System\LfNivOm.exe
  C:\Windows\System\LfNivOm.exe
  2⤵
  PID:6188
- C:\Windows\System\lXKSXJw.exe
  C:\Windows\System\lXKSXJw.exe
  2⤵
  PID:6208
- C:\Windows\System\tDvefKc.exe
  C:\Windows\System\tDvefKc.exe
  2⤵
  PID:6244
- C:\Windows\System\uKZVWnK.exe
  C:\Windows\System\uKZVWnK.exe
  2⤵
  PID:6260
- C:\Windows\System\PCeOJUg.exe
  C:\Windows\System\PCeOJUg.exe
  2⤵
  PID:6280
- C:\Windows\System\PqBFpsc.exe
  C:\Windows\System\PqBFpsc.exe
  2⤵
  PID:6296
- C:\Windows\System\ufCrJlI.exe
  C:\Windows\System\ufCrJlI.exe
  2⤵
  PID:6316
- C:\Windows\System\POAuqbz.exe
  C:\Windows\System\POAuqbz.exe
  2⤵
  PID:6356
- C:\Windows\System\bLERxQR.exe
  C:\Windows\System\bLERxQR.exe
  2⤵
  PID:6380
- C:\Windows\System\ktYOSlb.exe
  C:\Windows\System\ktYOSlb.exe
  2⤵
  PID:6404
- C:\Windows\System\GVCQtrc.exe
  C:\Windows\System\GVCQtrc.exe
  2⤵
  PID:6424
- C:\Windows\System\VJJMNoo.exe
  C:\Windows\System\VJJMNoo.exe
  2⤵
  PID:6444
- C:\Windows\System\rcBAClB.exe
  C:\Windows\System\rcBAClB.exe
  2⤵
  PID:6460
- C:\Windows\System\jwIdXfl.exe
  C:\Windows\System\jwIdXfl.exe
  2⤵
  PID:6488
- C:\Windows\System\XgOwKbg.exe
  C:\Windows\System\XgOwKbg.exe
  2⤵
  PID:6520
- C:\Windows\System\KseNTjk.exe
  C:\Windows\System\KseNTjk.exe
  2⤵
  PID:6552
- C:\Windows\System\LOJJIrH.exe
  C:\Windows\System\LOJJIrH.exe
  2⤵
  PID:6576
- C:\Windows\System\hmEYCha.exe
  C:\Windows\System\hmEYCha.exe
  2⤵
  PID:6592
- C:\Windows\System\GdXHVai.exe
  C:\Windows\System\GdXHVai.exe
  2⤵
  PID:6620
- C:\Windows\System\KdktsAK.exe
  C:\Windows\System\KdktsAK.exe
  2⤵
  PID:6636
- C:\Windows\System\rWikVKE.exe
  C:\Windows\System\rWikVKE.exe
  2⤵
  PID:6656
- C:\Windows\System\DNuCLsl.exe
  C:\Windows\System\DNuCLsl.exe
  2⤵
  PID:6680
- C:\Windows\System\hFMXHGK.exe
  C:\Windows\System\hFMXHGK.exe
  2⤵
  PID:6696
- C:\Windows\System\zqwzcgE.exe
  C:\Windows\System\zqwzcgE.exe
  2⤵
  PID:6716
- C:\Windows\System\tYtmOBU.exe
  C:\Windows\System\tYtmOBU.exe
  2⤵
  PID:6736
- C:\Windows\System\WayCnIV.exe
  C:\Windows\System\WayCnIV.exe
  2⤵
  PID:6764
- C:\Windows\System\GlzvbNy.exe
  C:\Windows\System\GlzvbNy.exe
  2⤵
  PID:6780
- C:\Windows\System\RvgWXlk.exe
  C:\Windows\System\RvgWXlk.exe
  2⤵
  PID:6804
- C:\Windows\System\brpdUmr.exe
  C:\Windows\System\brpdUmr.exe
  2⤵
  PID:6824
- C:\Windows\System\OQoBuGC.exe
  C:\Windows\System\OQoBuGC.exe
  2⤵
  PID:6844
- C:\Windows\System\ZNSaHRA.exe
  C:\Windows\System\ZNSaHRA.exe
  2⤵
  PID:6872
- C:\Windows\System\JTyLPgI.exe
  C:\Windows\System\JTyLPgI.exe
  2⤵
  PID:6896
- C:\Windows\System\gWkNajY.exe
  C:\Windows\System\gWkNajY.exe
  2⤵
  PID:6912
- C:\Windows\System\MrvlSkn.exe
  C:\Windows\System\MrvlSkn.exe
  2⤵
  PID:6936
- C:\Windows\System\axTiItZ.exe
  C:\Windows\System\axTiItZ.exe
  2⤵
  PID:6960
- C:\Windows\System\gQpgwJl.exe
  C:\Windows\System\gQpgwJl.exe
  2⤵
  PID:6984
- C:\Windows\System\uYAxKGd.exe
  C:\Windows\System\uYAxKGd.exe
  2⤵
  PID:7000
- C:\Windows\System\GzynRld.exe
  C:\Windows\System\GzynRld.exe
  2⤵
  PID:7132
- C:\Windows\System\ablEzki.exe
  C:\Windows\System\ablEzki.exe
  2⤵
  PID:7148
- C:\Windows\System\TZaPpST.exe
  C:\Windows\System\TZaPpST.exe
  2⤵
  PID:7164
- C:\Windows\System\QGKRKhv.exe
  C:\Windows\System\QGKRKhv.exe
  2⤵
  PID:5256
- C:\Windows\System\OAZrjdW.exe
  C:\Windows\System\OAZrjdW.exe
  2⤵
  PID:5304
- C:\Windows\System\GhAblMt.exe
  C:\Windows\System\GhAblMt.exe
  2⤵
  PID:4236
- C:\Windows\System\apMJlYD.exe
  C:\Windows\System\apMJlYD.exe
  2⤵
  PID:4876
- C:\Windows\System\XmakeOj.exe
  C:\Windows\System\XmakeOj.exe
  2⤵
  PID:3944
- C:\Windows\System\dkQTgAj.exe
  C:\Windows\System\dkQTgAj.exe
  2⤵
  PID:5352
- C:\Windows\System\HrusuTM.exe
  C:\Windows\System\HrusuTM.exe
  2⤵
  PID:5372
- C:\Windows\System\DrcUcXv.exe
  C:\Windows\System\DrcUcXv.exe
  2⤵
  PID:5404
- C:\Windows\System\BzzwPXo.exe
  C:\Windows\System\BzzwPXo.exe
  2⤵
  PID:5692
- C:\Windows\System\iBabBbd.exe
  C:\Windows\System\iBabBbd.exe
  2⤵
  PID:5468
- C:\Windows\System\zivnPMI.exe
  C:\Windows\System\zivnPMI.exe
  2⤵
  PID:5104
- C:\Windows\System\pHMwlvN.exe
  C:\Windows\System\pHMwlvN.exe
  2⤵
  PID:5560
- C:\Windows\System\SHnudYD.exe
  C:\Windows\System\SHnudYD.exe
  2⤵
  PID:5512
- C:\Windows\System\wwiPEzV.exe
  C:\Windows\System\wwiPEzV.exe
  2⤵
  PID:5684
- C:\Windows\System\gZITqSu.exe
  C:\Windows\System\gZITqSu.exe
  2⤵
  PID:5708
- C:\Windows\System\exuhRnQ.exe
  C:\Windows\System\exuhRnQ.exe
  2⤵
  PID:5808
- C:\Windows\System\vxkBNNy.exe
  C:\Windows\System\vxkBNNy.exe
  2⤵
  PID:3060
- C:\Windows\System\YjEaNbl.exe
  C:\Windows\System\YjEaNbl.exe
  2⤵
  PID:7272
- C:\Windows\System\xLoGZZH.exe
  C:\Windows\System\xLoGZZH.exe
  2⤵
  PID:7288
- C:\Windows\System\ACjhHcH.exe
  C:\Windows\System\ACjhHcH.exe
  2⤵
  PID:7304
- C:\Windows\System\OyweKpE.exe
  C:\Windows\System\OyweKpE.exe
  2⤵
  PID:7320
- C:\Windows\System\xUXcmMf.exe
  C:\Windows\System\xUXcmMf.exe
  2⤵
  PID:7336
- C:\Windows\System\qUiJHbI.exe
  C:\Windows\System\qUiJHbI.exe
  2⤵
  PID:7356
- C:\Windows\System\YaebIru.exe
  C:\Windows\System\YaebIru.exe
  2⤵
  PID:7372
- C:\Windows\System\nvkLQAe.exe
  C:\Windows\System\nvkLQAe.exe
  2⤵
  PID:7388
- C:\Windows\System\qQNxztG.exe
  C:\Windows\System\qQNxztG.exe
  2⤵
  PID:7404
- C:\Windows\System\PBsAVlE.exe
  C:\Windows\System\PBsAVlE.exe
  2⤵
  PID:7420
- C:\Windows\System\SXRsayh.exe
  C:\Windows\System\SXRsayh.exe
  2⤵
  PID:7440
- C:\Windows\System\tjURPUG.exe
  C:\Windows\System\tjURPUG.exe
  2⤵
  PID:7456
- C:\Windows\System\tizTdKG.exe
  C:\Windows\System\tizTdKG.exe
  2⤵
  PID:7476
- C:\Windows\System\FsbcYDZ.exe
  C:\Windows\System\FsbcYDZ.exe
  2⤵
  PID:7500
- C:\Windows\System\aUgrwSI.exe
  C:\Windows\System\aUgrwSI.exe
  2⤵
  PID:7516
- C:\Windows\System\AucnxzN.exe
  C:\Windows\System\AucnxzN.exe
  2⤵
  PID:7532
- C:\Windows\System\WzwAeTn.exe
  C:\Windows\System\WzwAeTn.exe
  2⤵
  PID:7552
- C:\Windows\System\doLbyEH.exe
  C:\Windows\System\doLbyEH.exe
  2⤵
  PID:7572
- C:\Windows\System\TMogGkA.exe
  C:\Windows\System\TMogGkA.exe
  2⤵
  PID:7592
- C:\Windows\System\NoGhBbi.exe
  C:\Windows\System\NoGhBbi.exe
  2⤵
  PID:7612
- C:\Windows\System\oLEmmxu.exe
  C:\Windows\System\oLEmmxu.exe
  2⤵
  PID:7632
- C:\Windows\System\nAjFfnG.exe
  C:\Windows\System\nAjFfnG.exe
  2⤵
  PID:7652
- C:\Windows\System\lakrLwU.exe
  C:\Windows\System\lakrLwU.exe
  2⤵
  PID:7672
- C:\Windows\System\pkosQdT.exe
  C:\Windows\System\pkosQdT.exe
  2⤵
  PID:7844
- C:\Windows\System\cCSbAGL.exe
  C:\Windows\System\cCSbAGL.exe
  2⤵
  PID:7944
- C:\Windows\System\pvZUnac.exe
  C:\Windows\System\pvZUnac.exe
  2⤵
  PID:7968
- C:\Windows\System\uEGHdog.exe
  C:\Windows\System\uEGHdog.exe
  2⤵
  PID:7988
- C:\Windows\System\EDPruNS.exe
  C:\Windows\System\EDPruNS.exe
  2⤵
  PID:8008
- C:\Windows\System\qfEdaqv.exe
  C:\Windows\System\qfEdaqv.exe
  2⤵
  PID:8032
- C:\Windows\System\wYqJSzh.exe
  C:\Windows\System\wYqJSzh.exe
  2⤵
  PID:8056
- C:\Windows\System\OkFAHpf.exe
  C:\Windows\System\OkFAHpf.exe
  2⤵
  PID:8080
- C:\Windows\System\UAvcgzv.exe
  C:\Windows\System\UAvcgzv.exe
  2⤵
  PID:8104
- C:\Windows\System\pJgrUyL.exe
  C:\Windows\System\pJgrUyL.exe
  2⤵
  PID:8128
- C:\Windows\System\CNFnqJI.exe
  C:\Windows\System\CNFnqJI.exe
  2⤵
  PID:8152
- C:\Windows\System\ylexeuX.exe
  C:\Windows\System\ylexeuX.exe
  2⤵
  PID:8168
- C:\Windows\System\uDZVcZb.exe
  C:\Windows\System\uDZVcZb.exe
  2⤵
  PID:5496
- C:\Windows\System\grLGGYa.exe
  C:\Windows\System\grLGGYa.exe
  2⤵
  PID:2640
- C:\Windows\System\dWRIWub.exe
  C:\Windows\System\dWRIWub.exe
  2⤵
  PID:7160
- C:\Windows\System\uamKUPn.exe
  C:\Windows\System\uamKUPn.exe
  2⤵
  PID:5328
- C:\Windows\System\iTxhGXe.exe
  C:\Windows\System\iTxhGXe.exe
  2⤵
  PID:5348
- C:\Windows\System\nwmFUQZ.exe
  C:\Windows\System\nwmFUQZ.exe
  2⤵
  PID:5396
- C:\Windows\System\nUlRxFj.exe
  C:\Windows\System\nUlRxFj.exe
  2⤵
  PID:8240
- C:\Windows\System\rXOtBTv.exe
  C:\Windows\System\rXOtBTv.exe
  2⤵
  PID:8260
- C:\Windows\System\EeojwxV.exe
  C:\Windows\System\EeojwxV.exe
  2⤵
  PID:8336
- C:\Windows\System\KcxONZl.exe
  C:\Windows\System\KcxONZl.exe
  2⤵
  PID:8360
- C:\Windows\System\rNiBxjE.exe
  C:\Windows\System\rNiBxjE.exe
  2⤵
  PID:8392
- C:\Windows\System\gQKqKaK.exe
  C:\Windows\System\gQKqKaK.exe
  2⤵
  PID:8416
- C:\Windows\System\SEpTchb.exe
  C:\Windows\System\SEpTchb.exe
  2⤵
  PID:8444
- C:\Windows\System\zsPYfyk.exe
  C:\Windows\System\zsPYfyk.exe
  2⤵
  PID:8468
- C:\Windows\System\hHrGsuM.exe
  C:\Windows\System\hHrGsuM.exe
  2⤵
  PID:8496
- C:\Windows\System\aNXKBUP.exe
  C:\Windows\System\aNXKBUP.exe
  2⤵
  PID:8520
- C:\Windows\System\VmvyahJ.exe
  C:\Windows\System\VmvyahJ.exe
  2⤵
  PID:8536
- C:\Windows\System\WSYvgjd.exe
  C:\Windows\System\WSYvgjd.exe
  2⤵
  PID:8564
- C:\Windows\System\qNxXUGR.exe
  C:\Windows\System\qNxXUGR.exe
  2⤵
  PID:8592
- C:\Windows\System\zJBitfr.exe
  C:\Windows\System\zJBitfr.exe
  2⤵
  PID:8612
- C:\Windows\System\OxfpaPS.exe
  C:\Windows\System\OxfpaPS.exe
  2⤵
  PID:8640
- C:\Windows\System\OVsSRpM.exe
  C:\Windows\System\OVsSRpM.exe
  2⤵
  PID:8656
- C:\Windows\System\wImqNfD.exe
  C:\Windows\System\wImqNfD.exe
  2⤵
  PID:8680
- C:\Windows\System\FwwAbGa.exe
  C:\Windows\System\FwwAbGa.exe
  2⤵
  PID:8704
- C:\Windows\System\XpHciGR.exe
  C:\Windows\System\XpHciGR.exe
  2⤵
  PID:8728
- C:\Windows\System\WOssOEp.exe
  C:\Windows\System\WOssOEp.exe
  2⤵
  PID:8752
- C:\Windows\System\BgeyMdC.exe
  C:\Windows\System\BgeyMdC.exe
  2⤵
  PID:8780
- C:\Windows\System\IwHQOWt.exe
  C:\Windows\System\IwHQOWt.exe
  2⤵
  PID:8796
- C:\Windows\System\qkcoQoK.exe
  C:\Windows\System\qkcoQoK.exe
  2⤵
  PID:8904
- C:\Windows\System\GNBROUn.exe
  C:\Windows\System\GNBROUn.exe
  2⤵
  PID:8920
- C:\Windows\System\haKZuFV.exe
  C:\Windows\System\haKZuFV.exe
  2⤵
  PID:8956
- C:\Windows\System\aESVxSi.exe
  C:\Windows\System\aESVxSi.exe
  2⤵
  PID:8984
- C:\Windows\System\nOEHgGR.exe
  C:\Windows\System\nOEHgGR.exe
  2⤵
  PID:9004
- C:\Windows\System\AClRkCD.exe
  C:\Windows\System\AClRkCD.exe
  2⤵
  PID:9024
- C:\Windows\System\tDPLGbi.exe
  C:\Windows\System\tDPLGbi.exe
  2⤵
  PID:9052
- C:\Windows\System\toRGzjB.exe
  C:\Windows\System\toRGzjB.exe
  2⤵
  PID:9068
- C:\Windows\System\URhpzeK.exe
  C:\Windows\System\URhpzeK.exe
  2⤵
  PID:9088
- C:\Windows\System\mdLiobN.exe
  C:\Windows\System\mdLiobN.exe
  2⤵
  PID:9104
- C:\Windows\System\udrgSDn.exe
  C:\Windows\System\udrgSDn.exe
  2⤵
  PID:9120
- C:\Windows\System\kbZofcG.exe
  C:\Windows\System\kbZofcG.exe
  2⤵
  PID:9136
- C:\Windows\System\fTBNFuO.exe
  C:\Windows\System\fTBNFuO.exe
  2⤵
  PID:9176
- C:\Windows\System\XMLooVw.exe
  C:\Windows\System\XMLooVw.exe
  2⤵
  PID:9192
- C:\Windows\System\bWEahXf.exe
  C:\Windows\System\bWEahXf.exe
  2⤵
  PID:9208
- C:\Windows\System\OkxsUgd.exe
  C:\Windows\System\OkxsUgd.exe
  2⤵
  PID:6744
- C:\Windows\System\SwVMEiK.exe
  C:\Windows\System\SwVMEiK.exe
  2⤵
  PID:6708
- C:\Windows\System\ThALWrF.exe
  C:\Windows\System\ThALWrF.exe
  2⤵
  PID:6652
- C:\Windows\System\NeZZyha.exe
  C:\Windows\System\NeZZyha.exe
  2⤵
  PID:6560
- C:\Windows\System\ZLAxwxE.exe
  C:\Windows\System\ZLAxwxE.exe
  2⤵
  PID:6452
- C:\Windows\System\MZLwfiN.exe
  C:\Windows\System\MZLwfiN.exe
  2⤵
  PID:6400
- C:\Windows\System\ngPWQUD.exe
  C:\Windows\System\ngPWQUD.exe
  2⤵
  PID:6704
- C:\Windows\System\YToiFxt.exe
  C:\Windows\System\YToiFxt.exe
  2⤵
  PID:6336
- C:\Windows\System\NbHwlww.exe
  C:\Windows\System\NbHwlww.exe
  2⤵
  PID:6200
- C:\Windows\System\ADQDWDn.exe
  C:\Windows\System\ADQDWDn.exe
  2⤵
  PID:6008
- C:\Windows\System\xazfDGi.exe
  C:\Windows\System\xazfDGi.exe
  2⤵
  PID:5152
- C:\Windows\System\MSxEVfJ.exe
  C:\Windows\System\MSxEVfJ.exe
  2⤵
  PID:6036
- C:\Windows\System\xikRXGX.exe
  C:\Windows\System\xikRXGX.exe
  2⤵
  PID:6228
- C:\Windows\System\EfBPzxq.exe
  C:\Windows\System\EfBPzxq.exe
  2⤵
  PID:5936
- C:\Windows\System\CGnwElt.exe
  C:\Windows\System\CGnwElt.exe
  2⤵
  PID:5908
- C:\Windows\System\CTYZDft.exe
  C:\Windows\System\CTYZDft.exe
  2⤵
  PID:6796
- C:\Windows\System\WMgkcZy.exe
  C:\Windows\System\WMgkcZy.exe
  2⤵
  PID:7296
- C:\Windows\System\MvTKFqW.exe
  C:\Windows\System\MvTKFqW.exe
  2⤵
  PID:7344
- C:\Windows\System\yVmANir.exe
  C:\Windows\System\yVmANir.exe
  2⤵
  PID:8076
- C:\Windows\System\vjuyYNq.exe
  C:\Windows\System\vjuyYNq.exe
  2⤵
  PID:8164
- C:\Windows\System\tXlmqpP.exe
  C:\Windows\System\tXlmqpP.exe
  2⤵
  PID:5296
- C:\Windows\System\QfNbBbS.exe
  C:\Windows\System\QfNbBbS.exe
  2⤵
  PID:7380
- C:\Windows\System\ERkDCGC.exe
  C:\Windows\System\ERkDCGC.exe
  2⤵
  PID:7436
- C:\Windows\System\brwYBpl.exe
  C:\Windows\System\brwYBpl.exe
  2⤵
  PID:7472
- C:\Windows\System\KIggwTm.exe
  C:\Windows\System\KIggwTm.exe
  2⤵
  PID:7524
- C:\Windows\System\xtvDxfE.exe
  C:\Windows\System\xtvDxfE.exe
  2⤵
  PID:7560
- C:\Windows\System\DJMmPPe.exe
  C:\Windows\System\DJMmPPe.exe
  2⤵
  PID:7588
- C:\Windows\System\kVRHRuQ.exe
  C:\Windows\System\kVRHRuQ.exe
  2⤵
  PID:7624
- C:\Windows\System\wBIENkT.exe
  C:\Windows\System\wBIENkT.exe
  2⤵
  PID:7660
- C:\Windows\System\hVPhyzn.exe
  C:\Windows\System\hVPhyzn.exe
  2⤵
  PID:8628
- C:\Windows\System\enlcTuI.exe
  C:\Windows\System\enlcTuI.exe
  2⤵
  PID:8720
- C:\Windows\System\qTGUHED.exe
  C:\Windows\System\qTGUHED.exe
  2⤵
  PID:7856
- C:\Windows\System\aiwcuXV.exe
  C:\Windows\System\aiwcuXV.exe
  2⤵
  PID:7888
- C:\Windows\System\phRUsYv.exe
  C:\Windows\System\phRUsYv.exe
  2⤵
  PID:7928
- C:\Windows\System\rUdiTVh.exe
  C:\Windows\System\rUdiTVh.exe
  2⤵
  PID:7980
- C:\Windows\System\lggYtnP.exe
  C:\Windows\System\lggYtnP.exe
  2⤵
  PID:8048
- C:\Windows\System\IYODdzE.exe
  C:\Windows\System\IYODdzE.exe
  2⤵
  PID:8124
- C:\Windows\System\GPzRgWp.exe
  C:\Windows\System\GPzRgWp.exe
  2⤵
  PID:5688
- C:\Windows\System\dexHbqu.exe
  C:\Windows\System\dexHbqu.exe
  2⤵
  PID:5272
- C:\Windows\System\XeAnakD.exe
  C:\Windows\System\XeAnakD.exe
  2⤵
  PID:8580
- C:\Windows\System\HVPyRwb.exe
  C:\Windows\System\HVPyRwb.exe
  2⤵
  PID:8940
- C:\Windows\System\PJQajzU.exe
  C:\Windows\System\PJQajzU.exe
  2⤵
  PID:8664
- C:\Windows\System\QlhSyOH.exe
  C:\Windows\System\QlhSyOH.exe
  2⤵
  PID:9064
- C:\Windows\System\plHwqNq.exe
  C:\Windows\System\plHwqNq.exe
  2⤵
  PID:8248
- C:\Windows\System\nEDKxvs.exe
  C:\Windows\System\nEDKxvs.exe
  2⤵
  PID:5144
- C:\Windows\System\DoePTCH.exe
  C:\Windows\System\DoePTCH.exe
  2⤵
  PID:8376
- C:\Windows\System\gfsQPAw.exe
  C:\Windows\System\gfsQPAw.exe
  2⤵
  PID:8436
- C:\Windows\System\InwibJy.exe
  C:\Windows\System\InwibJy.exe
  2⤵
  PID:8476
- C:\Windows\System\GsOCLoe.exe
  C:\Windows\System\GsOCLoe.exe
  2⤵
  PID:8556
- C:\Windows\System\hZrFqel.exe
  C:\Windows\System\hZrFqel.exe
  2⤵
  PID:7328
- C:\Windows\System\eDktbwp.exe
  C:\Windows\System\eDktbwp.exe
  2⤵
  PID:8160
- C:\Windows\System\eLlUgGD.exe
  C:\Windows\System\eLlUgGD.exe
  2⤵
  PID:8772
- C:\Windows\System\qikeXiX.exe
  C:\Windows\System\qikeXiX.exe
  2⤵
  PID:7464
- C:\Windows\System\mZDdAIN.exe
  C:\Windows\System\mZDdAIN.exe
  2⤵
  PID:9232
- C:\Windows\System\wTYxcMX.exe
  C:\Windows\System\wTYxcMX.exe
  2⤵
  PID:9256
- C:\Windows\System\bSEZiZP.exe
  C:\Windows\System\bSEZiZP.exe
  2⤵
  PID:9272
- C:\Windows\System\mRaPMSn.exe
  C:\Windows\System\mRaPMSn.exe
  2⤵
  PID:9292
- C:\Windows\System\qdERRFe.exe
  C:\Windows\System\qdERRFe.exe
  2⤵
  PID:9312
- C:\Windows\System\IKdLVff.exe
  C:\Windows\System\IKdLVff.exe
  2⤵
  PID:9436
- C:\Windows\System\tbTktmq.exe
  C:\Windows\System\tbTktmq.exe
  2⤵
  PID:9456
- C:\Windows\System\ZUIOEns.exe
  C:\Windows\System\ZUIOEns.exe
  2⤵
  PID:9480
- C:\Windows\System\nDuHQTT.exe
  C:\Windows\System\nDuHQTT.exe
  2⤵
  PID:9504
- C:\Windows\System\xUkMiwm.exe
  C:\Windows\System\xUkMiwm.exe
  2⤵
  PID:9648
- C:\Windows\System\EYMuZxD.exe
  C:\Windows\System\EYMuZxD.exe
  2⤵
  PID:9676
- C:\Windows\System\GWAfffm.exe
  C:\Windows\System\GWAfffm.exe
  2⤵
  PID:9700
- C:\Windows\System\VEcBiuF.exe
  C:\Windows\System\VEcBiuF.exe
  2⤵
  PID:9720
- C:\Windows\System\SLYzato.exe
  C:\Windows\System\SLYzato.exe
  2⤵
  PID:9744
- C:\Windows\System\ZNkqEqJ.exe
  C:\Windows\System\ZNkqEqJ.exe
  2⤵
  PID:9768
- C:\Windows\System\xrbkjtj.exe
  C:\Windows\System\xrbkjtj.exe
  2⤵
  PID:9788
- C:\Windows\System\DlvnToW.exe
  C:\Windows\System\DlvnToW.exe
  2⤵
  PID:9808
- C:\Windows\System\pbHxkbU.exe
  C:\Windows\System\pbHxkbU.exe
  2⤵
  PID:9824
- C:\Windows\System\xGJFkKS.exe
  C:\Windows\System\xGJFkKS.exe
  2⤵
  PID:9864
- C:\Windows\System\dukYSFc.exe
  C:\Windows\System\dukYSFc.exe
  2⤵
  PID:9880
- C:\Windows\System\okWBjmf.exe
  C:\Windows\System\okWBjmf.exe
  2⤵
  PID:9896
- C:\Windows\System\RukDivj.exe
  C:\Windows\System\RukDivj.exe
  2⤵
  PID:9912
- C:\Windows\System\bUzMBji.exe
  C:\Windows\System\bUzMBji.exe
  2⤵
  PID:9932
- C:\Windows\System\TdtZNuY.exe
  C:\Windows\System\TdtZNuY.exe
  2⤵
  PID:9948
- C:\Windows\System\bnyJlkg.exe
  C:\Windows\System\bnyJlkg.exe
  2⤵
  PID:9964
- C:\Windows\System\nAjmQrG.exe
  C:\Windows\System\nAjmQrG.exe
  2⤵
  PID:10016
- C:\Windows\System\XOVRkkG.exe
  C:\Windows\System\XOVRkkG.exe
  2⤵
  PID:10044
- C:\Windows\System\XBIgbWF.exe
  C:\Windows\System\XBIgbWF.exe
  2⤵
  PID:10064
- C:\Windows\System\ULUbQAx.exe
  C:\Windows\System\ULUbQAx.exe
  2⤵
  PID:10088
- C:\Windows\System\KNofOpl.exe
  C:\Windows\System\KNofOpl.exe
  2⤵
  PID:10112
- C:\Windows\System\wTQIYGA.exe
  C:\Windows\System\wTQIYGA.exe
  2⤵
  PID:10136
- C:\Windows\System\SGznzmA.exe
  C:\Windows\System\SGznzmA.exe
  2⤵
  PID:10156
- C:\Windows\System\IqYCfGm.exe
  C:\Windows\System\IqYCfGm.exe
  2⤵
  PID:10176
- C:\Windows\System\UNOvQkK.exe
  C:\Windows\System\UNOvQkK.exe
  2⤵
  PID:10192
- C:\Windows\System\oAHVdKM.exe
  C:\Windows\System\oAHVdKM.exe
  2⤵
  PID:10208
- C:\Windows\System\UPHkrmB.exe
  C:\Windows\System\UPHkrmB.exe
  2⤵
  PID:9096
- C:\Windows\System\laaNGPZ.exe
  C:\Windows\System\laaNGPZ.exe
  2⤵
  PID:8860
- C:\Windows\System\vTWkWpk.exe
  C:\Windows\System\vTWkWpk.exe
  2⤵
  PID:8764
- C:\Windows\System\KwuEIql.exe
  C:\Windows\System\KwuEIql.exe
  2⤵
  PID:5172
- C:\Windows\System\dUpgDHk.exe
  C:\Windows\System\dUpgDHk.exe
  2⤵
  PID:8460
- C:\Windows\System\EDmBlyH.exe
  C:\Windows\System\EDmBlyH.exe
  2⤵
  PID:8544
- C:\Windows\System\zQreAjg.exe
  C:\Windows\System\zQreAjg.exe
  2⤵
  PID:7568
- C:\Windows\System\cxfYmrQ.exe
  C:\Windows\System\cxfYmrQ.exe
  2⤵
  PID:9128
- C:\Windows\System\xNnFkAc.exe
  C:\Windows\System\xNnFkAc.exe
  2⤵
  PID:6752
- C:\Windows\System\YICDbsH.exe
  C:\Windows\System\YICDbsH.exe
  2⤵
  PID:6476
- C:\Windows\System\WISQXmb.exe
  C:\Windows\System\WISQXmb.exe
  2⤵
  PID:6496
- C:\Windows\System\COqVRMF.exe
  C:\Windows\System\COqVRMF.exe
  2⤵
  PID:4180
- C:\Windows\System\CIpyGoj.exe
  C:\Windows\System\CIpyGoj.exe
  2⤵
  PID:2612
- C:\Windows\System\aQbdtRe.exe
  C:\Windows\System\aQbdtRe.exe
  2⤵
  PID:632
- C:\Windows\System\UcgSsdi.exe
  C:\Windows\System\UcgSsdi.exe
  2⤵
  PID:7540
- C:\Windows\System\qLioNEO.exe
  C:\Windows\System\qLioNEO.exe
  2⤵
  PID:9692
- C:\Windows\System\fPPOvYq.exe
  C:\Windows\System\fPPOvYq.exe
  2⤵
  PID:10248
- C:\Windows\System\lczZfbd.exe
  C:\Windows\System\lczZfbd.exe
  2⤵
  PID:10268
- C:\Windows\System\yhhDkVR.exe
  C:\Windows\System\yhhDkVR.exe
  2⤵
  PID:10292
- C:\Windows\System\jfpJJoF.exe
  C:\Windows\System\jfpJJoF.exe
  2⤵
  PID:10316
- C:\Windows\System\wpmEgyP.exe
  C:\Windows\System\wpmEgyP.exe
  2⤵
  PID:10332
- C:\Windows\System\ZedPtoL.exe
  C:\Windows\System\ZedPtoL.exe
  2⤵
  PID:10352
- C:\Windows\System\rdlcPdP.exe
  C:\Windows\System\rdlcPdP.exe
  2⤵
  PID:10384
- C:\Windows\System\KyhfWsx.exe
  C:\Windows\System\KyhfWsx.exe
  2⤵
  PID:10400
- C:\Windows\System\tDbvRXb.exe
  C:\Windows\System\tDbvRXb.exe
  2⤵
  PID:10424
- C:\Windows\System\qljKnhX.exe
  C:\Windows\System\qljKnhX.exe
  2⤵
  PID:10452
- C:\Windows\System\NBoiZSu.exe
  C:\Windows\System\NBoiZSu.exe
  2⤵
  PID:10468
- C:\Windows\System\cKaemiA.exe
  C:\Windows\System\cKaemiA.exe
  2⤵
  PID:10492
- C:\Windows\System\NxWtWJe.exe
  C:\Windows\System\NxWtWJe.exe
  2⤵
  PID:10516
- C:\Windows\System\vhitQhN.exe
  C:\Windows\System\vhitQhN.exe
  2⤵
  PID:10540
- C:\Windows\System\EqWRXGq.exe
  C:\Windows\System\EqWRXGq.exe
  2⤵
  PID:10592
- C:\Windows\System\zRAMSpo.exe
  C:\Windows\System\zRAMSpo.exe
  2⤵
  PID:10616
- C:\Windows\System\ELQoUiy.exe
  C:\Windows\System\ELQoUiy.exe
  2⤵
  PID:10640
- C:\Windows\System\MHlgqnF.exe
  C:\Windows\System\MHlgqnF.exe
  2⤵
  PID:10664
- C:\Windows\System\xnLmnFq.exe
  C:\Windows\System\xnLmnFq.exe
  2⤵
  PID:10740
- C:\Windows\System\dvdPLgI.exe
  C:\Windows\System\dvdPLgI.exe
  2⤵
  PID:10760
- C:\Windows\System\MlDYCxI.exe
  C:\Windows\System\MlDYCxI.exe
  2⤵
  PID:10780
- C:\Windows\System\hsPtvtZ.exe
  C:\Windows\System\hsPtvtZ.exe
  2⤵
  PID:10812
- C:\Windows\System\MLLjmGj.exe
  C:\Windows\System\MLLjmGj.exe
  2⤵
  PID:10828
- C:\Windows\System\kWdmHtt.exe
  C:\Windows\System\kWdmHtt.exe
  2⤵
  PID:10848
- C:\Windows\System\jSEGMGm.exe
  C:\Windows\System\jSEGMGm.exe
  2⤵
  PID:10872
- C:\Windows\System\xaAoOSB.exe
  C:\Windows\System\xaAoOSB.exe
  2⤵
  PID:10888
- C:\Windows\System\MNrhbVp.exe
  C:\Windows\System\MNrhbVp.exe
  2⤵
  PID:10904
- C:\Windows\System\CjGLBcD.exe
  C:\Windows\System\CjGLBcD.exe
  2⤵
  PID:10920
- C:\Windows\System\PmyzCTf.exe
  C:\Windows\System\PmyzCTf.exe
  2⤵
  PID:10936
- C:\Windows\System\QuToDhM.exe
  C:\Windows\System\QuToDhM.exe
  2⤵
  PID:10960
- C:\Windows\System\xcNgHmU.exe
  C:\Windows\System\xcNgHmU.exe
  2⤵
  PID:10988
- C:\Windows\System\MVppLVY.exe
  C:\Windows\System\MVppLVY.exe
  2⤵
  PID:11016
- C:\Windows\System\CnXspir.exe
  C:\Windows\System\CnXspir.exe
  2⤵
  PID:11036
- C:\Windows\System\UgCWWAe.exe
  C:\Windows\System\UgCWWAe.exe
  2⤵
  PID:11080
- C:\Windows\System\bqZxaXl.exe
  C:\Windows\System\bqZxaXl.exe
  2⤵
  PID:11104
- C:\Windows\System\MrqrnQm.exe
  C:\Windows\System\MrqrnQm.exe
  2⤵
  PID:11132
- C:\Windows\System\TIiSgMK.exe
  C:\Windows\System\TIiSgMK.exe
  2⤵
  PID:11152
- C:\Windows\System\YISULCX.exe
  C:\Windows\System\YISULCX.exe
  2⤵
  PID:11176
- C:\Windows\System\wYhDnqn.exe
  C:\Windows\System\wYhDnqn.exe
  2⤵
  PID:11196
- C:\Windows\System\OtSLVIi.exe
  C:\Windows\System\OtSLVIi.exe
  2⤵
  PID:11220
- C:\Windows\System\optuhrf.exe
  C:\Windows\System\optuhrf.exe
  2⤵
  PID:11244
- C:\Windows\System\UajsKLP.exe
  C:\Windows\System\UajsKLP.exe
  2⤵
  PID:9760
- C:\Windows\System\gpxHQKo.exe
  C:\Windows\System\gpxHQKo.exe
  2⤵
  PID:8200
- C:\Windows\System\OqYpGit.exe
  C:\Windows\System\OqYpGit.exe
  2⤵
  PID:1588
- C:\Windows\System\PQYmpqs.exe
  C:\Windows\System\PQYmpqs.exe
  2⤵
  PID:8180
- C:\Windows\System\ruHiRkP.exe
  C:\Windows\System\ruHiRkP.exe
  2⤵
  PID:7156
- C:\Windows\System\YafGwKt.exe
  C:\Windows\System\YafGwKt.exe
  2⤵
  PID:8676
- C:\Windows\System\IuVPtpp.exe
  C:\Windows\System\IuVPtpp.exe
  2⤵
  PID:8348
- C:\Windows\System\egcxEmL.exe
  C:\Windows\System\egcxEmL.exe
  2⤵
  PID:8040
- C:\Windows\System\WZTeWgS.exe
  C:\Windows\System\WZTeWgS.exe
  2⤵
  PID:8972
- C:\Windows\System\ZEPjOgc.exe
  C:\Windows\System\ZEPjOgc.exe
  2⤵
  PID:5392
- C:\Windows\System\MhkJdXV.exe
  C:\Windows\System\MhkJdXV.exe
  2⤵
  PID:8484
- C:\Windows\System\IHalRov.exe
  C:\Windows\System\IHalRov.exe
  2⤵
  PID:7512
- C:\Windows\System\imtCJAB.exe
  C:\Windows\System\imtCJAB.exe
  2⤵
  PID:9224
- C:\Windows\System\wkvKMbr.exe
  C:\Windows\System\wkvKMbr.exe
  2⤵
  PID:9280
- C:\Windows\System\RwGpmdz.exe
  C:\Windows\System\RwGpmdz.exe
  2⤵
  PID:9332
- C:\Windows\System\oepCppa.exe
  C:\Windows\System\oepCppa.exe
  2⤵
  PID:7488
- C:\Windows\System\gdZGsry.exe
  C:\Windows\System\gdZGsry.exe
  2⤵
  PID:9732
- C:\Windows\System\vsTBxZW.exe
  C:\Windows\System\vsTBxZW.exe
  2⤵
  PID:10300
- C:\Windows\System\XzfFDyP.exe
  C:\Windows\System\XzfFDyP.exe
  2⤵
  PID:10488
- C:\Windows\System\izQuYmU.exe
  C:\Windows\System\izQuYmU.exe
  2⤵
  PID:10548
- C:\Windows\System\JpnrYSx.exe
  C:\Windows\System\JpnrYSx.exe
  2⤵
  PID:9412
- C:\Windows\System\ARtbIsO.exe
  C:\Windows\System\ARtbIsO.exe
  2⤵
  PID:9464
- C:\Windows\System\pBJWBNz.exe
  C:\Windows\System\pBJWBNz.exe
  2⤵
  PID:9492
- C:\Windows\System\MXhdsRd.exe
  C:\Windows\System\MXhdsRd.exe
  2⤵
  PID:9556
- C:\Windows\System\wlIUqAK.exe
  C:\Windows\System\wlIUqAK.exe
  2⤵
  PID:4160
- C:\Windows\System\VeyGGGE.exe
  C:\Windows\System\VeyGGGE.exe
  2⤵
  PID:10868
- C:\Windows\System\VYipfzP.exe
  C:\Windows\System\VYipfzP.exe
  2⤵
  PID:10932
- C:\Windows\System\Uyxbzwg.exe
  C:\Windows\System\Uyxbzwg.exe
  2⤵
  PID:9012
- C:\Windows\System\lRvoQsR.exe
  C:\Windows\System\lRvoQsR.exe
  2⤵
  PID:9640
- C:\Windows\System\SqQKRye.exe
  C:\Windows\System\SqQKRye.exe
  2⤵
  PID:11092
- C:\Windows\System\yZqluVp.exe
  C:\Windows\System\yZqluVp.exe
  2⤵
  PID:10276
- C:\Windows\System\cMaHjzH.exe
  C:\Windows\System\cMaHjzH.exe
  2⤵
  PID:11164
- C:\Windows\System\bOghOMJ.exe
  C:\Windows\System\bOghOMJ.exe
  2⤵
  PID:10284
- C:\Windows\System\bLXgsyI.exe
  C:\Windows\System\bLXgsyI.exe
  2⤵
  PID:10312
- C:\Windows\System\XTljiSF.exe
  C:\Windows\System\XTljiSF.exe
  2⤵
  PID:9800
- C:\Windows\System\TcjQiJu.exe
  C:\Windows\System\TcjQiJu.exe
  2⤵
  PID:10360
- C:\Windows\System\bdVOcsE.exe
  C:\Windows\System\bdVOcsE.exe
  2⤵
  PID:9836
- C:\Windows\System\FDhnNgy.exe
  C:\Windows\System\FDhnNgy.exe
  2⤵
  PID:11280
- C:\Windows\System\aNAZfLU.exe
  C:\Windows\System\aNAZfLU.exe
  2⤵
  PID:11304
- C:\Windows\System\KfIzzuI.exe
  C:\Windows\System\KfIzzuI.exe
  2⤵
  PID:11324
- C:\Windows\System\TrTOhWY.exe
  C:\Windows\System\TrTOhWY.exe
  2⤵
  PID:11344
- C:\Windows\System\kFchZBm.exe
  C:\Windows\System\kFchZBm.exe
  2⤵
  PID:11368
- C:\Windows\System\qxsBXfH.exe
  C:\Windows\System\qxsBXfH.exe
  2⤵
  PID:11404
- C:\Windows\System\auGEdZG.exe
  C:\Windows\System\auGEdZG.exe
  2⤵
  PID:11420
- C:\Windows\System\XVfpPia.exe
  C:\Windows\System\XVfpPia.exe
  2⤵
  PID:11452
- C:\Windows\System\QjbdBBg.exe
  C:\Windows\System\QjbdBBg.exe
  2⤵
  PID:11520
- C:\Windows\System\SBIvtPB.exe
  C:\Windows\System\SBIvtPB.exe
  2⤵
  PID:11544
- C:\Windows\System\JRusMBj.exe
  C:\Windows\System\JRusMBj.exe
  2⤵
  PID:11568
- C:\Windows\System\Buaiphw.exe
  C:\Windows\System\Buaiphw.exe
  2⤵
  PID:11596
- C:\Windows\System\gXiDlvP.exe
  C:\Windows\System\gXiDlvP.exe
  2⤵
  PID:11616
- C:\Windows\System\IzhzxpR.exe
  C:\Windows\System\IzhzxpR.exe
  2⤵
  PID:11636
- C:\Windows\System\xyscmTg.exe
  C:\Windows\System\xyscmTg.exe
  2⤵
  PID:11664
- C:\Windows\System\wrLSofz.exe
  C:\Windows\System\wrLSofz.exe
  2⤵
  PID:11692
- C:\Windows\System\JDgNYps.exe
  C:\Windows\System\JDgNYps.exe
  2⤵
  PID:11712
- C:\Windows\System\dZlBfqY.exe
  C:\Windows\System\dZlBfqY.exe
  2⤵
  PID:11728
- C:\Windows\System\ruzCsDe.exe
  C:\Windows\System\ruzCsDe.exe
  2⤵
  PID:11752
- C:\Windows\System\pewGULt.exe
  C:\Windows\System\pewGULt.exe
  2⤵
  PID:11768
- C:\Windows\System\oDhQrBN.exe
  C:\Windows\System\oDhQrBN.exe
  2⤵
  PID:11788
- C:\Windows\System\IBDkxFf.exe
  C:\Windows\System\IBDkxFf.exe
  2⤵
  PID:11812
- C:\Windows\System\aXTsApy.exe
  C:\Windows\System\aXTsApy.exe
  2⤵
  PID:11836
- C:\Windows\System\INDfrpH.exe
  C:\Windows\System\INDfrpH.exe
  2⤵
  PID:11856
- C:\Windows\System\ShBTVxM.exe
  C:\Windows\System\ShBTVxM.exe
  2⤵
  PID:11872
- C:\Windows\System\wYfyYyX.exe
  C:\Windows\System\wYfyYyX.exe
  2⤵
  PID:11900
- C:\Windows\System\yTZISJF.exe
  C:\Windows\System\yTZISJF.exe
  2⤵
  PID:11932
- C:\Windows\System\VWLnmWZ.exe
  C:\Windows\System\VWLnmWZ.exe
  2⤵
  PID:11956
- C:\Windows\System\pxSfDVV.exe
  C:\Windows\System\pxSfDVV.exe
  2⤵
  PID:11976
- C:\Windows\System\xupSoTF.exe
  C:\Windows\System\xupSoTF.exe
  2⤵
  PID:12004
- C:\Windows\System\SjeOnDF.exe
  C:\Windows\System\SjeOnDF.exe
  2⤵
  PID:12024
- C:\Windows\System\UGJXIYC.exe
  C:\Windows\System\UGJXIYC.exe
  2⤵
  PID:12048
- C:\Windows\System\lOIITwE.exe
  C:\Windows\System\lOIITwE.exe
  2⤵
  PID:12072
- C:\Windows\System\ijTqavr.exe
  C:\Windows\System\ijTqavr.exe
  2⤵
  PID:12092
- C:\Windows\System\sEvYIaM.exe
  C:\Windows\System\sEvYIaM.exe
  2⤵
  PID:12120
- C:\Windows\System\HHOKloD.exe
  C:\Windows\System\HHOKloD.exe
  2⤵
  PID:12144
- C:\Windows\System\GyIYzxV.exe
  C:\Windows\System\GyIYzxV.exe
  2⤵
  PID:12168
- C:\Windows\System\HQxEBwR.exe
  C:\Windows\System\HQxEBwR.exe
  2⤵
  PID:12192
- C:\Windows\System\BKiUIbP.exe
  C:\Windows\System\BKiUIbP.exe
  2⤵
  PID:12212
- C:\Windows\System\XZLgdow.exe
  C:\Windows\System\XZLgdow.exe
  2⤵
  PID:12244
- C:\Windows\System\uFwyyEN.exe
  C:\Windows\System\uFwyyEN.exe
  2⤵
  PID:12264
- C:\Windows\System\lKijLsL.exe
  C:\Windows\System\lKijLsL.exe
  2⤵
  PID:12284
- C:\Windows\System\gSXdUXU.exe
  C:\Windows\System\gSXdUXU.exe
  2⤵
  PID:8696
- C:\Windows\System\ERCAFfZ.exe
  C:\Windows\System\ERCAFfZ.exe
  2⤵
  PID:9860
- C:\Windows\System\zcYuvDw.exe
  C:\Windows\System\zcYuvDw.exe
  2⤵
  PID:9888
- C:\Windows\System\VyAcUzt.exe
  C:\Windows\System\VyAcUzt.exe
  2⤵
  PID:9924
- C:\Windows\System\wfevKTP.exe
  C:\Windows\System\wfevKTP.exe
  2⤵
  PID:9960
- C:\Windows\System\COyRLyi.exe
  C:\Windows\System\COyRLyi.exe
  2⤵
  PID:10008
- C:\Windows\System\wXPsXbC.exe
  C:\Windows\System\wXPsXbC.exe
  2⤵
  PID:10072
- C:\Windows\System\uamWVNS.exe
  C:\Windows\System\uamWVNS.exe
  2⤵
  PID:10120
- C:\Windows\System\qdEbAaY.exe
  C:\Windows\System\qdEbAaY.exe
  2⤵
  PID:10164
- C:\Windows\System\bXaefQy.exe
  C:\Windows\System\bXaefQy.exe
  2⤵
  PID:10204
- C:\Windows\System\oKOtFUR.exe
  C:\Windows\System\oKOtFUR.exe
  2⤵
  PID:10736
- C:\Windows\System\tXPMgGR.exe
  C:\Windows\System\tXPMgGR.exe
  2⤵
  PID:7648
- C:\Windows\System\Obngjbr.exe
  C:\Windows\System\Obngjbr.exe
  2⤵
  PID:10820
- C:\Windows\System\oIxSjfJ.exe
  C:\Windows\System\oIxSjfJ.exe
  2⤵
  PID:10928
- C:\Windows\System\HBJAibt.exe
  C:\Windows\System\HBJAibt.exe
  2⤵
  PID:11012
- C:\Windows\System\VxaRusT.exe
  C:\Windows\System\VxaRusT.exe
  2⤵
  PID:6352
- C:\Windows\System\pXGOPmn.exe
  C:\Windows\System\pXGOPmn.exe
  2⤵
  PID:10980
- C:\Windows\System\sCjEMDz.exe
  C:\Windows\System\sCjEMDz.exe
  2⤵
  PID:7280
- C:\Windows\System\TVGQrLv.exe
  C:\Windows\System\TVGQrLv.exe
  2⤵
  PID:10416
- C:\Windows\System\yHViQfW.exe
  C:\Windows\System\yHViQfW.exe
  2⤵
  PID:10348
- C:\Windows\System\rTkkesQ.exe
  C:\Windows\System\rTkkesQ.exe
  2⤵
  PID:10536
- C:\Windows\System\itfjVEs.exe
  C:\Windows\System\itfjVEs.exe
  2⤵
  PID:11376
- C:\Windows\System\Gultuuc.exe
  C:\Windows\System\Gultuuc.exe
  2⤵
  PID:10580
- C:\Windows\System\UBkPgkR.exe
  C:\Windows\System\UBkPgkR.exe
  2⤵
  PID:10632
- C:\Windows\System\hCOWAGJ.exe
  C:\Windows\System\hCOWAGJ.exe
  2⤵
  PID:10688
- C:\Windows\System\apWszon.exe
  C:\Windows\System\apWszon.exe
  2⤵
  PID:8532
- C:\Windows\System\eOxuwUs.exe
  C:\Windows\System\eOxuwUs.exe
  2⤵
  PID:9320
- C:\Windows\System\bqpqfmU.exe
  C:\Windows\System\bqpqfmU.exe
  2⤵
  PID:12312
- C:\Windows\System\bLAJcPl.exe
  C:\Windows\System\bLAJcPl.exe
  2⤵
  PID:12336
- C:\Windows\System\ymzxjdI.exe
  C:\Windows\System\ymzxjdI.exe
  2⤵
  PID:12352
- C:\Windows\System\gOBiqkQ.exe
  C:\Windows\System\gOBiqkQ.exe
  2⤵
  PID:12376
- C:\Windows\System\ODTCsMW.exe
  C:\Windows\System\ODTCsMW.exe
  2⤵
  PID:12400
- C:\Windows\System\nuFlHVe.exe
  C:\Windows\System\nuFlHVe.exe
  2⤵
  PID:12432
- C:\Windows\System\OByAzpT.exe
  C:\Windows\System\OByAzpT.exe
  2⤵
  PID:12452
- C:\Windows\System\zBFzTAv.exe
  C:\Windows\System\zBFzTAv.exe
  2⤵
  PID:12468
- C:\Windows\System\adFpHLj.exe
  C:\Windows\System\adFpHLj.exe
  2⤵
  PID:12492
- C:\Windows\System\xOipPVH.exe
  C:\Windows\System\xOipPVH.exe
  2⤵
  PID:12512
- C:\Windows\System\bUGlFTp.exe
  C:\Windows\System\bUGlFTp.exe
  2⤵
  PID:12540
- C:\Windows\System\WNRtIhM.exe
  C:\Windows\System\WNRtIhM.exe
  2⤵
  PID:12560
- C:\Windows\System\itgLHJl.exe
  C:\Windows\System\itgLHJl.exe
  2⤵
  PID:12580
- C:\Windows\System\RvpMcAc.exe
  C:\Windows\System\RvpMcAc.exe
  2⤵
  PID:12600
- C:\Windows\System\jJbWgdX.exe
  C:\Windows\System\jJbWgdX.exe
  2⤵
  PID:12624
- C:\Windows\System\cnxkExT.exe
  C:\Windows\System\cnxkExT.exe
  2⤵
  PID:12652
- C:\Windows\System\aJCdYue.exe
  C:\Windows\System\aJCdYue.exe
  2⤵
  PID:12676
- C:\Windows\System\sOTbkPA.exe
  C:\Windows\System\sOTbkPA.exe
  2⤵
  PID:12700
- C:\Windows\System\iGzMCOq.exe
  C:\Windows\System\iGzMCOq.exe
  2⤵
  PID:12720
- C:\Windows\System\wZLOtcM.exe
  C:\Windows\System\wZLOtcM.exe
  2⤵
  PID:12744
- C:\Windows\System\AonuWWp.exe
  C:\Windows\System\AonuWWp.exe
  2⤵
  PID:12764
- C:\Windows\System\gEyJBGD.exe
  C:\Windows\System\gEyJBGD.exe
  2⤵
  PID:12788
- C:\Windows\System\jpVZuBD.exe
  C:\Windows\System\jpVZuBD.exe
  2⤵
  PID:12808
- C:\Windows\System\FaaNPqP.exe
  C:\Windows\System\FaaNPqP.exe
  2⤵
  PID:12832
- C:\Windows\System\spIVoHa.exe
  C:\Windows\System\spIVoHa.exe
  2⤵
  PID:12848
- C:\Windows\System\DWKbdDH.exe
  C:\Windows\System\DWKbdDH.exe
  2⤵
  PID:12868
- C:\Windows\System\xGfmAyv.exe
  C:\Windows\System\xGfmAyv.exe
  2⤵
  PID:12884
- C:\Windows\System\bYUhdei.exe
  C:\Windows\System\bYUhdei.exe
  2⤵
  PID:12904
- C:\Windows\System\DZceMKH.exe
  C:\Windows\System\DZceMKH.exe
  2⤵
  PID:12924
- C:\Windows\System\wyYKCyW.exe
  C:\Windows\System\wyYKCyW.exe
  2⤵
  PID:12940
- C:\Windows\System\BWrlOxz.exe
  C:\Windows\System\BWrlOxz.exe
  2⤵
  PID:12956
- C:\Windows\System\pHxVERw.exe
  C:\Windows\System\pHxVERw.exe
  2⤵
  PID:12980
- C:\Windows\System\zaPjYhh.exe
  C:\Windows\System\zaPjYhh.exe
  2⤵
  PID:12996
- C:\Windows\System\hhGnIEV.exe
  C:\Windows\System\hhGnIEV.exe
  2⤵
  PID:13024
- C:\Windows\System\KElDOGJ.exe
  C:\Windows\System\KElDOGJ.exe
  2⤵
  PID:13040
- C:\Windows\System\ZlfNnlX.exe
  C:\Windows\System\ZlfNnlX.exe
  2⤵
  PID:13064
- C:\Windows\System\DsBKguN.exe
  C:\Windows\System\DsBKguN.exe
  2⤵
  PID:13088
- C:\Windows\System\ZoszaYN.exe
  C:\Windows\System\ZoszaYN.exe
  2⤵
  PID:13116
- C:\Windows\System\pqZSMPA.exe
  C:\Windows\System\pqZSMPA.exe
  2⤵
  PID:13140
- C:\Windows\System\dxhQaOb.exe
  C:\Windows\System\dxhQaOb.exe
  2⤵
  PID:13160
- C:\Windows\System\jfIeoxC.exe
  C:\Windows\System\jfIeoxC.exe
  2⤵
  PID:13176
- C:\Windows\System\FfYZhHL.exe
  C:\Windows\System\FfYZhHL.exe
  2⤵
  PID:13196
- C:\Windows\System\mLxBjDM.exe
  C:\Windows\System\mLxBjDM.exe
  2⤵
  PID:13220
- C:\Windows\System\tcvAQKF.exe
  C:\Windows\System\tcvAQKF.exe
  2⤵
  PID:13248
- C:\Windows\System\JwMaWnG.exe
  C:\Windows\System\JwMaWnG.exe
  2⤵
  PID:13268
- C:\Windows\System\BlNgOTm.exe
  C:\Windows\System\BlNgOTm.exe
  2⤵
  PID:13292
- C:\Windows\System\noefbZn.exe
  C:\Windows\System\noefbZn.exe
  2⤵
  PID:11828
- C:\Windows\System\BvdSsmX.exe
  C:\Windows\System\BvdSsmX.exe
  2⤵
  PID:11056
- C:\Windows\System\gIHHLRK.exe
  C:\Windows\System\gIHHLRK.exe
  2⤵
  PID:9524
- C:\Windows\System\nklxklU.exe
  C:\Windows\System\nklxklU.exe
  2⤵
  PID:12016
- C:\Windows\System\qLDKjXu.exe
  C:\Windows\System\qLDKjXu.exe
  2⤵
  PID:12044
- C:\Windows\System\TSDQhYn.exe
  C:\Windows\System\TSDQhYn.exe
  2⤵
  PID:12084
- C:\Windows\System\fanDTup.exe
  C:\Windows\System\fanDTup.exe
  2⤵
  PID:12896
- C:\Windows\System\RXGBsCP.exe
  C:\Windows\System\RXGBsCP.exe
  2⤵
  PID:13056
- C:\Windows\System\CwtWtLJ.exe
  C:\Windows\System\CwtWtLJ.exe
  2⤵
  PID:13128
- C:\Windows\System\LKtSRzs.exe
  C:\Windows\System\LKtSRzs.exe
  2⤵
  PID:13168
- C:\Windows\System\TAzQfSg.exe
  C:\Windows\System\TAzQfSg.exe
  2⤵
  PID:2344
- C:\Windows\System\YpCqzMN.exe
  C:\Windows\System\YpCqzMN.exe
  2⤵
  PID:13284
- C:\Windows\System\rJRUXaD.exe
  C:\Windows\System\rJRUXaD.exe
  2⤵
  PID:10896
- C:\Windows\System\kXKkpHn.exe
  C:\Windows\System\kXKkpHn.exe
  2⤵
  PID:11412
- C:\Windows\System\RCWQRID.exe
  C:\Windows\System\RCWQRID.exe
  2⤵
  PID:11496
- C:\Windows\System\fRpiaIf.exe
  C:\Windows\System\fRpiaIf.exe
  2⤵
  PID:11540
- C:\Windows\System\ClyNoBv.exe
  C:\Windows\System\ClyNoBv.exe
  2⤵
  PID:11604
- C:\Windows\System\ExroJUY.exe
  C:\Windows\System\ExroJUY.exe
  2⤵
  PID:11652
- C:\Windows\System\mKpUIqt.exe
  C:\Windows\System\mKpUIqt.exe
  2⤵
  PID:11736
- C:\Windows\System\eWRKCFc.exe
  C:\Windows\System\eWRKCFc.exe
  2⤵
  PID:11764
- C:\Windows\System\qgbnmds.exe
  C:\Windows\System\qgbnmds.exe
  2⤵
  PID:1400
- C:\Windows\System\vSFjDqc.exe
  C:\Windows\System\vSFjDqc.exe
  2⤵
  PID:11916
- C:\Windows\System\JteNPqD.exe
  C:\Windows\System\JteNPqD.exe
  2⤵
  PID:12112
- C:\Windows\System\CLaNisk.exe
  C:\Windows\System\CLaNisk.exe
  2⤵
  PID:12184
- C:\Windows\System\cOUrfvG.exe
  C:\Windows\System\cOUrfvG.exe
  2⤵
  PID:3028
- C:\Windows\System\feDgGar.exe
  C:\Windows\System\feDgGar.exe
  2⤵
  PID:7608
- C:\Windows\System\eUvwNja.exe
  C:\Windows\System\eUvwNja.exe
  2⤵
  PID:3756
- C:\Windows\System\DgTDktj.exe
  C:\Windows\System\DgTDktj.exe
  2⤵
  PID:5676
- C:\Windows\System\WrMLzXK.exe
  C:\Windows\System\WrMLzXK.exe
  2⤵
  PID:9624
- C:\Windows\System\KoUzCOB.exe
  C:\Windows\System\KoUzCOB.exe
  2⤵
  PID:10324
- C:\Windows\System\pcgDVuh.exe
  C:\Windows\System\pcgDVuh.exe
  2⤵
  PID:10568
- C:\Windows\System\xJMOUdD.exe
  C:\Windows\System\xJMOUdD.exe
  2⤵
  PID:12320
- C:\Windows\System\yUdvICR.exe
  C:\Windows\System\yUdvICR.exe
  2⤵
  PID:12420
- C:\Windows\System\RxIWvju.exe
  C:\Windows\System\RxIWvju.exe
  2⤵
  PID:12508
- C:\Windows\System\wAcWQpc.exe
  C:\Windows\System\wAcWQpc.exe
  2⤵
  PID:12568
- C:\Windows\System\BuagMdu.exe
  C:\Windows\System\BuagMdu.exe
  2⤵
  PID:12608
- C:\Windows\System\ipGZuQM.exe
  C:\Windows\System\ipGZuQM.exe
  2⤵
  PID:12664
- C:\Windows\System\FwlKAek.exe
  C:\Windows\System\FwlKAek.exe
  2⤵
  PID:12728
- C:\Windows\System\NpJGKhp.exe
  C:\Windows\System\NpJGKhp.exe
  2⤵
  PID:12828
- C:\Windows\System\xgBEuIk.exe
  C:\Windows\System\xgBEuIk.exe
  2⤵
  PID:12972
- C:\Windows\System\jHbfQEd.exe
  C:\Windows\System\jHbfQEd.exe
  2⤵
  PID:9228
- C:\Windows\System\kbOpyNj.exe
  C:\Windows\System\kbOpyNj.exe
  2⤵
  PID:3148
- C:\Windows\System\gzXPkzS.exe
  C:\Windows\System\gzXPkzS.exe
  2⤵
  PID:10796
- C:\Windows\System\swnDqTX.exe
  C:\Windows\System\swnDqTX.exe
  2⤵
  PID:9144
- C:\Windows\System\hCbuIdo.exe
  C:\Windows\System\hCbuIdo.exe
  2⤵
  PID:12844
- C:\Windows\System\vSlgsRq.exe
  C:\Windows\System\vSlgsRq.exe
  2⤵
  PID:2136
- C:\Windows\System\famzLMH.exe
  C:\Windows\System\famzLMH.exe
  2⤵
  PID:11124
- C:\Windows\System\sZgleno.exe
  C:\Windows\System\sZgleno.exe
  2⤵
  PID:12176
- C:\Windows\System\VeaKInn.exe
  C:\Windows\System\VeaKInn.exe
  2⤵
  PID:1248
- C:\Windows\System\ERGEtOa.exe
  C:\Windows\System\ERGEtOa.exe
  2⤵
  PID:12948
- C:\Windows\System\YySHIlN.exe
  C:\Windows\System\YySHIlN.exe
  2⤵
  PID:13156
- C:\Windows\System\MLEiApy.exe
  C:\Windows\System\MLEiApy.exe
  2⤵
  PID:11352
- C:\Windows\System\MzwfZSU.exe
  C:\Windows\System\MzwfZSU.exe
  2⤵
  PID:11560
- C:\Windows\System\ZMSfdzK.exe
  C:\Windows\System\ZMSfdzK.exe
  2⤵
  PID:11704
- C:\Windows\System\dJeITjy.exe
  C:\Windows\System\dJeITjy.exe
  2⤵
  PID:11908
- C:\Windows\System\RbuTIIR.exe
  C:\Windows\System\RbuTIIR.exe
  2⤵
  PID:10040
- C:\Windows\System\vlCvubU.exe
  C:\Windows\System\vlCvubU.exe
  2⤵
  PID:4384
- C:\Windows\System\hgvrSon.exe
  C:\Windows\System\hgvrSon.exe
  2⤵
  PID:11364
- C:\Windows\System\FeEZcMK.exe
  C:\Windows\System\FeEZcMK.exe
  2⤵
  PID:11804
- C:\Windows\System\nuPQgRC.exe
  C:\Windows\System\nuPQgRC.exe
  2⤵
  PID:11340
- C:\Windows\System\QufqdBV.exe
  C:\Windows\System\QufqdBV.exe
  2⤵
  PID:12484
- C:\Windows\System\CRdlWrv.exe
  C:\Windows\System\CRdlWrv.exe
  2⤵
  PID:11672
- C:\Windows\System\pSviJrb.exe
  C:\Windows\System\pSviJrb.exe
  2⤵
  PID:12536
- C:\Windows\System\VAJHkTB.exe
  C:\Windows\System\VAJHkTB.exe
  2⤵
  PID:4256
- C:\Windows\System\dTOrndw.exe
  C:\Windows\System\dTOrndw.exe
  2⤵
  PID:13288
- C:\Windows\System\MBBapWb.exe
  C:\Windows\System\MBBapWb.exe
  2⤵
  PID:9612
- C:\Windows\System\ubCQvWg.exe
  C:\Windows\System\ubCQvWg.exe
  2⤵
  PID:12236
- C:\Windows\System\FuOKsPj.exe
  C:\Windows\System\FuOKsPj.exe
  2⤵
  PID:11892
- C:\Windows\System\eQSeGJW.exe
  C:\Windows\System\eQSeGJW.exe
  2⤵
  PID:13324
- C:\Windows\System\BAmpzSc.exe
  C:\Windows\System\BAmpzSc.exe
  2⤵
  PID:13356
- C:\Windows\System\WMqKseF.exe
  C:\Windows\System\WMqKseF.exe
  2⤵
  PID:13380
- C:\Windows\System\cghNPHG.exe
  C:\Windows\System\cghNPHG.exe
  2⤵
  PID:13400
- C:\Windows\System\KTAREGk.exe
  C:\Windows\System\KTAREGk.exe
  2⤵
  PID:13424
- C:\Windows\System\gIsCvLX.exe
  C:\Windows\System\gIsCvLX.exe
  2⤵
  PID:13468
- C:\Windows\System\doFoFUm.exe
  C:\Windows\System\doFoFUm.exe
  2⤵
  PID:13484
- C:\Windows\System\LhYeqgp.exe
  C:\Windows\System\LhYeqgp.exe
  2⤵
  PID:13516
- C:\Windows\System\ElveJsA.exe
  C:\Windows\System\ElveJsA.exe
  2⤵
  PID:13548
- C:\Windows\System\DzWoIDs.exe
  C:\Windows\System\DzWoIDs.exe
  2⤵
  PID:13872
- C:\Windows\System\HVhMWdH.exe
  C:\Windows\System\HVhMWdH.exe
  2⤵
  PID:6668
- C:\Windows\System\LgYRGbY.exe
  C:\Windows\System\LgYRGbY.exe
  2⤵
  PID:3796
- C:\Windows\System\oRSfArc.exe
  C:\Windows\System\oRSfArc.exe
  2⤵
  PID:12776
- C:\Windows\System\isGzjcH.exe
  C:\Windows\System\isGzjcH.exe
  2⤵
  PID:13320
- C:\Windows\System\kJujfER.exe
  C:\Windows\System\kJujfER.exe
  2⤵
  PID:13388
- C:\Windows\System\MGTpHKo.exe
  C:\Windows\System\MGTpHKo.exe
  2⤵
  PID:3136
- C:\Windows\System\uMWIILy.exe
  C:\Windows\System\uMWIILy.exe
  2⤵
  PID:2900
- C:\Windows\System\ikjQsmu.exe
  C:\Windows\System\ikjQsmu.exe
  2⤵
  PID:2420
- C:\Windows\System\WibFHXS.exe
  C:\Windows\System\WibFHXS.exe
  2⤵
  PID:13556
- C:\Windows\System\EUoyZsh.exe
  C:\Windows\System\EUoyZsh.exe
  2⤵
  PID:13588
- C:\Windows\System\sTNaeUe.exe
  C:\Windows\System\sTNaeUe.exe
  2⤵
  PID:13608
- C:\Windows\System\LMDkQVj.exe
  C:\Windows\System\LMDkQVj.exe
  2⤵
  PID:4816
- C:\Windows\System\QfFodUF.exe
  C:\Windows\System\QfFodUF.exe
  2⤵
  PID:13652
- C:\Windows\System\yDLMEdh.exe
  C:\Windows\System\yDLMEdh.exe
  2⤵
  PID:13340
- C:\Windows\System\xAJDmpa.exe
  C:\Windows\System\xAJDmpa.exe
  2⤵
  PID:13412
- C:\Windows\System\qOesdXT.exe
  C:\Windows\System\qOesdXT.exe
  2⤵
  PID:13728
- C:\Windows\System\VECjyUs.exe
  C:\Windows\System\VECjyUs.exe
  2⤵
  PID:13492
- C:\Windows\System\vsOdROX.exe
  C:\Windows\System\vsOdROX.exe
  2⤵
  PID:13812
- C:\Windows\System\cSgQlxQ.exe
  C:\Windows\System\cSgQlxQ.exe
  2⤵
  PID:13628
- C:\Windows\System\HdCsnCW.exe
  C:\Windows\System\HdCsnCW.exe
  2⤵
  PID:12392
- C:\Windows\System\mlvvOag.exe
  C:\Windows\System\mlvvOag.exe
  2⤵
  PID:13864
- C:\Windows\System\wDAftcD.exe
  C:\Windows\System\wDAftcD.exe
  2⤵
  PID:13784
- C:\Windows\System\MIVOweN.exe
  C:\Windows\System\MIVOweN.exe
  2⤵
  PID:14188
- C:\Windows\System\OGhwGsI.exe
  C:\Windows\System\OGhwGsI.exe
  2⤵
  PID:14308
- C:\Windows\System\xNQQfKC.exe
  C:\Windows\System\xNQQfKC.exe
  2⤵
  PID:13796
- C:\Windows\System\Mdgcvar.exe
  C:\Windows\System\Mdgcvar.exe
  2⤵
  PID:12892
- C:\Windows\System\tTtslGN.exe
  C:\Windows\System\tTtslGN.exe
  2⤵
  PID:13280
- C:\Windows\System\snrQXeV.exe
  C:\Windows\System\snrQXeV.exe
  2⤵
  PID:13852
- C:\Windows\System\ZfVnpit.exe
  C:\Windows\System\ZfVnpit.exe
  2⤵
  PID:13996
- C:\Windows\System\eNcyeLe.exe
  C:\Windows\System\eNcyeLe.exe
  2⤵
  PID:14264
- C:\Windows\System\JSLoGaN.exe
  C:\Windows\System\JSLoGaN.exe
  2⤵
  PID:3920
- C:\Windows\System\WJaIVAH.exe
  C:\Windows\System\WJaIVAH.exe
  2⤵
  PID:11512
- C:\Windows\System\juYYEIx.exe
  C:\Windows\System\juYYEIx.exe
  2⤵
  PID:14028
- C:\Windows\System\aJVPMiF.exe
  C:\Windows\System\aJVPMiF.exe
  2⤵
  PID:9940
- C:\Windows\System\XbZMAeI.exe
  C:\Windows\System\XbZMAeI.exe
  2⤵
  PID:13444
- C:\Windows\System\DEXredv.exe
  C:\Windows\System\DEXredv.exe
  2⤵
  PID:13844
- C:\Windows\System\wMOYVmg.exe
  C:\Windows\System\wMOYVmg.exe
  2⤵
  PID:14180
- C:\Windows\System\aAKdHiJ.exe
  C:\Windows\System\aAKdHiJ.exe
  2⤵
  PID:1264
- C:\Windows\System\ouEczUg.exe
  C:\Windows\System\ouEczUg.exe
  2⤵
  PID:13648
- C:\Windows\System\opzdCTg.exe
  C:\Windows\System\opzdCTg.exe
  2⤵
  PID:14096
- C:\Windows\System\AyLQDsq.exe
  C:\Windows\System\AyLQDsq.exe
  2⤵
  PID:13988
- C:\Windows\System\jbyhqPK.exe
  C:\Windows\System\jbyhqPK.exe
  2⤵
  PID:14240
- C:\Windows\System\nRLYSli.exe
  C:\Windows\System\nRLYSli.exe
  2⤵
  PID:13704
- C:\Windows\System\fOxsYEY.exe
  C:\Windows\System\fOxsYEY.exe
  2⤵
  PID:13632
- C:\Windows\System\rimHVQv.exe
  C:\Windows\System\rimHVQv.exe
  2⤵
  PID:13952
- C:\Windows\System\FMCHTwL.exe
  C:\Windows\System\FMCHTwL.exe
  2⤵
  PID:13032
- C:\Windows\System\sNzLBej.exe
  C:\Windows\System\sNzLBej.exe
  2⤵
  PID:2916
- C:\Windows\System\SrIZguy.exe
  C:\Windows\System\SrIZguy.exe
  2⤵
  PID:13364
- C:\Windows\System\tEGiYAw.exe
  C:\Windows\System\tEGiYAw.exe
  2⤵
  PID:13568
- C:\Windows\System\ikRkYOk.exe
  C:\Windows\System\ikRkYOk.exe
  2⤵
  PID:13856
- C:\Windows\System\ttkOxhj.exe
  C:\Windows\System\ttkOxhj.exe
  2⤵
  PID:13624
- C:\Windows\System\VlsLRox.exe
  C:\Windows\System\VlsLRox.exe
  2⤵
  PID:4024
- C:\Windows\System\rnJwIMD.exe
  C:\Windows\System\rnJwIMD.exe
  2⤵
  PID:208
- C:\Windows\System\qYvalDA.exe
  C:\Windows\System\qYvalDA.exe
  2⤵
  PID:13684
- C:\Windows\System\kqAtYJB.exe
  C:\Windows\System\kqAtYJB.exe
  2⤵
  PID:4760
- C:\Windows\System\EQBkkHc.exe
  C:\Windows\System\EQBkkHc.exe
  2⤵
  PID:13904
- C:\Windows\System\fMIMjpC.exe
  C:\Windows\System\fMIMjpC.exe
  2⤵
  PID:13964
- C:\Windows\System\NNJOaxE.exe
  C:\Windows\System\NNJOaxE.exe
  2⤵
  PID:14272
- C:\Windows\System\EwOvhAE.exe
  C:\Windows\System\EwOvhAE.exe
  2⤵
  PID:13928
- C:\Windows\System\NPwOKsP.exe
  C:\Windows\System\NPwOKsP.exe
  2⤵
  PID:14332
- C:\Windows\System\hFJVrRA.exe
  C:\Windows\System\hFJVrRA.exe
  2⤵
  PID:13712
- C:\Windows\System\OReqIPv.exe
  C:\Windows\System\OReqIPv.exe
  2⤵
  PID:14324
- C:\Windows\System\sXweZPv.exe
  C:\Windows\System\sXweZPv.exe
  2⤵
  PID:12640
- C:\Windows\System\EhigBWk.exe
  C:\Windows\System\EhigBWk.exe
  2⤵
  PID:12252
- C:\Windows\System\UHJMLRN.exe
  C:\Windows\System\UHJMLRN.exe
  2⤵
  PID:13436
- C:\Windows\System\dhILnPh.exe
  C:\Windows\System\dhILnPh.exe
  2⤵
  PID:12800
- C:\Windows\System\iBkxFqM.exe
  C:\Windows\System\iBkxFqM.exe
  2⤵
  PID:656
- C:\Windows\System\vkXtWmv.exe
  C:\Windows\System\vkXtWmv.exe
  2⤵
  PID:14220
- C:\Windows\System\QKcspTr.exe
  C:\Windows\System\QKcspTr.exe
  2⤵
  PID:14072
- C:\Windows\System\lmPcJrx.exe
  C:\Windows\System\lmPcJrx.exe
  2⤵
  PID:7088
- C:\Windows\System\eEVqqXO.exe
  C:\Windows\System\eEVqqXO.exe
  2⤵
  PID:11680
- C:\Windows\System\nGgkSnA.exe
  C:\Windows\System\nGgkSnA.exe
  2⤵
  PID:10772
- C:\Windows\System\zLQOKMU.exe
  C:\Windows\System\zLQOKMU.exe
  2⤵
  PID:956
- C:\Windows\System\bWNEKpe.exe
  C:\Windows\System\bWNEKpe.exe
  2⤵
  PID:1484
- C:\Windows\System\YAJnrsS.exe
  C:\Windows\System\YAJnrsS.exe
  2⤵
  PID:3288
- C:\Windows\System\vHitowf.exe
  C:\Windows\System\vHitowf.exe
  2⤵
  PID:2720
- C:\Windows\System\amsfuDy.exe
  C:\Windows\System\amsfuDy.exe
  2⤵
  PID:540
- C:\Windows\System\ibkSbtd.exe
  C:\Windows\System\ibkSbtd.exe
  2⤵
  PID:348
- C:\Windows\System\xPYWixs.exe
  C:\Windows\System\xPYWixs.exe
  2⤵
  PID:5008
- C:\Windows\System\WmvDXgk.exe
  C:\Windows\System\WmvDXgk.exe
  2⤵
  PID:1596
- C:\Windows\System\XsBLwSM.exe
  C:\Windows\System\XsBLwSM.exe
  2⤵
  PID:6628
- C:\Windows\System\xoygAmb.exe
  C:\Windows\System\xoygAmb.exe
  2⤵
  PID:5408
- C:\Windows\System\MGMthlY.exe
  C:\Windows\System\MGMthlY.exe
  2⤵
  PID:1668
- C:\Windows\System\eRXEFkd.exe
  C:\Windows\System\eRXEFkd.exe
  2⤵
  PID:14300
- C:\Windows\System\TFsQwBj.exe
  C:\Windows\System\TFsQwBj.exe
  2⤵
  PID:14084
- C:\Windows\System\pegQRkP.exe
  C:\Windows\System\pegQRkP.exe
  2⤵
  PID:4968
- C:\Windows\System\WgZOzpS.exe
  C:\Windows\System\WgZOzpS.exe
  2⤵
  PID:3032
- C:\Windows\System\ujyjBoJ.exe
  C:\Windows\System\ujyjBoJ.exe
  2⤵
  PID:13916
- C:\Windows\System\KLgqKlA.exe
  C:\Windows\System\KLgqKlA.exe
  2⤵
  PID:7104
- C:\Windows\System\aEKbTjn.exe
  C:\Windows\System\aEKbTjn.exe
  2⤵
  PID:13480
- C:\Windows\System\fKzhdhN.exe
  C:\Windows\System\fKzhdhN.exe
  2⤵
  PID:4704
- C:\Windows\System\QnxWBre.exe
  C:\Windows\System\QnxWBre.exe
  2⤵
  PID:12880
- C:\Windows\System\PEwKSfD.exe
  C:\Windows\System\PEwKSfD.exe
  2⤵
  PID:14104
- C:\Windows\System\xrMBmUS.exe
  C:\Windows\System\xrMBmUS.exe
  2⤵
  PID:3224
- C:\Windows\System\GjvyItd.exe
  C:\Windows\System\GjvyItd.exe
  2⤵
  PID:6044
- C:\Windows\System\DuqiKbb.exe
  C:\Windows\System\DuqiKbb.exe
  2⤵
  PID:13460
- C:\Windows\System\IYzMboW.exe
  C:\Windows\System\IYzMboW.exe
  2⤵
  PID:5156
- C:\Windows\System\DbOwBcS.exe
  C:\Windows\System\DbOwBcS.exe
  2⤵
  PID:5948
- C:\Windows\System\YQeTMLO.exe
  C:\Windows\System\YQeTMLO.exe
  2⤵
  PID:5456
- C:\Windows\System\HJeiHop.exe
  C:\Windows\System\HJeiHop.exe
  2⤵
  PID:13780
- C:\Windows\System\aIYwQUj.exe
  C:\Windows\System\aIYwQUj.exe
  2⤵
  PID:13768
- C:\Windows\System\YBbpNwh.exe
  C:\Windows\System\YBbpNwh.exe
  2⤵
  PID:5276
- C:\Windows\System\hZchvfV.exe
  C:\Windows\System\hZchvfV.exe
  2⤵
  PID:13968
- C:\Windows\System\ucSUEtz.exe
  C:\Windows\System\ucSUEtz.exe
  2⤵
  PID:4292
- C:\Windows\System\dUQxRIN.exe
  C:\Windows\System\dUQxRIN.exe
  2⤵
  PID:6364
- C:\Windows\System\GTorHVu.exe
  C:\Windows\System\GTorHVu.exe
  2⤵
  PID:6236
- C:\Windows\System\jHbTjNB.exe
  C:\Windows\System\jHbTjNB.exe
  2⤵
  PID:4576
- C:\Windows\System\mzahBrI.exe
  C:\Windows\System\mzahBrI.exe
  2⤵
  PID:4232
- C:\Windows\System\AOKBmHW.exe
  C:\Windows\System\AOKBmHW.exe
  2⤵
  PID:3584
- C:\Windows\System\sPOydZs.exe
  C:\Windows\System\sPOydZs.exe
  2⤵
  PID:968
- C:\Windows\System\QQhKJGy.exe
  C:\Windows\System\QQhKJGy.exe
  2⤵
  PID:2960
- C:\Windows\System\PTcFWoW.exe
  C:\Windows\System\PTcFWoW.exe
  2⤵
  PID:13992
- C:\Windows\System\KELtqNQ.exe
  C:\Windows\System\KELtqNQ.exe
  2⤵
  PID:2264
- C:\Windows\System\LpBuEYJ.exe
  C:\Windows\System\LpBuEYJ.exe
  2⤵
  PID:6612
- C:\Windows\System\qTwRpNJ.exe
  C:\Windows\System\qTwRpNJ.exe
  2⤵
  PID:6412
- C:\Windows\System\ZptMyJw.exe
  C:\Windows\System\ZptMyJw.exe
  2⤵
  PID:3684
- C:\Windows\System\FNTshOu.exe
  C:\Windows\System\FNTshOu.exe
  2⤵
  PID:7084
- C:\Windows\System\tGZthrc.exe
  C:\Windows\System\tGZthrc.exe
  2⤵
  PID:2896
- C:\Windows\System\ikUGNJn.exe
  C:\Windows\System\ikUGNJn.exe
  2⤵
  PID:6332
- C:\Windows\System\tMbrTNm.exe
  C:\Windows\System\tMbrTNm.exe
  2⤵
  PID:4812
- C:\Windows\System\bicHNwJ.exe
  C:\Windows\System\bicHNwJ.exe
  2⤵
  PID:5704
- C:\Windows\System\rYSvxKN.exe
  C:\Windows\System\rYSvxKN.exe
  2⤵
  PID:5580
- C:\Windows\System\tPwhaxu.exe
  C:\Windows\System\tPwhaxu.exe
  2⤵
  PID:5480
- C:\Windows\System\JCnMSnU.exe
  C:\Windows\System\JCnMSnU.exe
  2⤵
  PID:7064
- C:\Windows\System\XySAejy.exe
  C:\Windows\System\XySAejy.exe
  2⤵
  PID:6176
- C:\Windows\System\UukjVzD.exe
  C:\Windows\System\UukjVzD.exe
  2⤵
  PID:7028
- C:\Windows\System\IqyflHc.exe
  C:\Windows\System\IqyflHc.exe
  2⤵
  PID:6368
- C:\Windows\System\bACXmSg.exe
  C:\Windows\System\bACXmSg.exe
  2⤵
  PID:5780
- C:\Windows\System\PllSnUq.exe
  C:\Windows\System\PllSnUq.exe
  2⤵
  PID:6884
- C:\Windows\System\IyNosKl.exe
  C:\Windows\System\IyNosKl.exe
  2⤵
  PID:5728
- C:\Windows\System\vqJqyUf.exe
  C:\Windows\System\vqJqyUf.exe
  2⤵
  PID:6980
- C:\Windows\System\SfYhiub.exe
  C:\Windows\System\SfYhiub.exe
  2⤵
  PID:13764
- C:\Windows\System\EzQRGsh.exe
  C:\Windows\System\EzQRGsh.exe
  2⤵
  PID:4764
- C:\Windows\System\tUZiNdC.exe
  C:\Windows\System\tUZiNdC.exe
  2⤵
  PID:6792
- C:\Windows\System\ifaaiuK.exe
  C:\Windows\System\ifaaiuK.exe
  2⤵
  PID:5192
- C:\Windows\System\RtffnQM.exe
  C:\Windows\System\RtffnQM.exe
  2⤵
  PID:6996
- C:\Windows\System\nrQCikk.exe
  C:\Windows\System\nrQCikk.exe
  2⤵
  PID:2316
- C:\Windows\System\IcGkHDr.exe
  C:\Windows\System\IcGkHDr.exe
  2⤵
  PID:6012
- C:\Windows\System\BiKAWog.exe
  C:\Windows\System\BiKAWog.exe
  2⤵
  PID:7208
- C:\Windows\System\CmRvrNe.exe
  C:\Windows\System\CmRvrNe.exe
  2⤵
  PID:6472
- C:\Windows\System\PkRIsyK.exe
  C:\Windows\System\PkRIsyK.exe
  2⤵
  PID:464
- C:\Windows\System\HKoHBYl.exe
  C:\Windows\System\HKoHBYl.exe
  2⤵
  PID:5332
- C:\Windows\System\UQJrZqa.exe
  C:\Windows\System\UQJrZqa.exe
  2⤵
  PID:3924
- C:\Windows\System\HCxKxgA.exe
  C:\Windows\System\HCxKxgA.exe
  2⤵
  PID:5128
- C:\Windows\System\XoXmsxn.exe
  C:\Windows\System\XoXmsxn.exe
  2⤵
  PID:7724
- C:\Windows\System\AEHRibw.exe
  C:\Windows\System\AEHRibw.exe
  2⤵
  PID:7792
- C:\Windows\System\HmyCfIG.exe
  C:\Windows\System\HmyCfIG.exe
  2⤵
  PID:5932
- C:\Windows\System\sFjpFXR.exe
  C:\Windows\System\sFjpFXR.exe
  2⤵
  PID:6976
- C:\Windows\System\ASAXSYo.exe
  C:\Windows\System\ASAXSYo.exe
  2⤵
  PID:4948
- C:\Windows\System\hrsKhIN.exe
  C:\Windows\System\hrsKhIN.exe
  2⤵
  PID:3084
- C:\Windows\System\QjyWYmQ.exe
  C:\Windows\System\QjyWYmQ.exe
  2⤵
  PID:7720
- C:\Windows\System\SHdUhnT.exe
  C:\Windows\System\SHdUhnT.exe
  2⤵
  PID:6468
- C:\Windows\System\fPtXngZ.exe
  C:\Windows\System\fPtXngZ.exe
  2⤵
  PID:5844
- C:\Windows\System\ETktOOr.exe
  C:\Windows\System\ETktOOr.exe
  2⤵
  PID:6840
- C:\Windows\System\QXwbsVm.exe
  C:\Windows\System\QXwbsVm.exe
  2⤵
  PID:6456
- C:\Windows\System\LzwgUog.exe
  C:\Windows\System\LzwgUog.exe
  2⤵
  PID:1404
- C:\Windows\System\uCnBCec.exe
  C:\Windows\System\uCnBCec.exe
  2⤵
  PID:1236
- C:\Windows\System\CtgWuEv.exe
  C:\Windows\System\CtgWuEv.exe
  2⤵
  PID:5000
- C:\Windows\System\JDcjJyZ.exe
  C:\Windows\System\JDcjJyZ.exe
  2⤵
  PID:4288
- C:\Windows\System\xzdbCjR.exe
  C:\Windows\System\xzdbCjR.exe
  2⤵
  PID:7776
- C:\Windows\System\tGsPKhU.exe
  C:\Windows\System\tGsPKhU.exe
  2⤵
  PID:4888
- C:\Windows\System\uKgMKfH.exe
  C:\Windows\System\uKgMKfH.exe
  2⤵
  PID:7800
- C:\Windows\System\BLumSqI.exe
  C:\Windows\System\BLumSqI.exe
  2⤵
  PID:7072
- C:\Windows\System\VmaTFll.exe
  C:\Windows\System\VmaTFll.exe
  2⤵
  PID:5824
- C:\Windows\System\AWqMYtX.exe
  C:\Windows\System\AWqMYtX.exe
  2⤵
  PID:5792
- C:\Windows\System\DZDKJQl.exe
  C:\Windows\System\DZDKJQl.exe
  2⤵
  PID:7240
- C:\Windows\System\tjSoRHR.exe
  C:\Windows\System\tjSoRHR.exe
  2⤵
  PID:6136
- C:\Windows\System\HnerQjD.exe
  C:\Windows\System\HnerQjD.exe
  2⤵
  PID:388
- C:\Windows\System\DaaPIZJ.exe
  C:\Windows\System\DaaPIZJ.exe
  2⤵
  PID:6568
- C:\Windows\System\YhODSiL.exe
  C:\Windows\System\YhODSiL.exe
  2⤵
  PID:3196
- C:\Windows\System\oIzPPid.exe
  C:\Windows\System\oIzPPid.exe
  2⤵
  PID:7204
- C:\Windows\System\JEyIpsG.exe
  C:\Windows\System\JEyIpsG.exe
  2⤵
  PID:5724
- C:\Windows\System\XbBixzd.exe
  C:\Windows\System\XbBixzd.exe
  2⤵
  PID:6420
- C:\Windows\System\kLPwjgk.exe
  C:\Windows\System\kLPwjgk.exe
  2⤵
  PID:5612
- C:\Windows\System\DnYQDDo.exe
  C:\Windows\System\DnYQDDo.exe
  2⤵
  PID:7228
- C:\Windows\System\TSiGORX.exe
  C:\Windows\System\TSiGORX.exe
  2⤵
  PID:8284
- C:\Windows\System\jOjVVlt.exe
  C:\Windows\System\jOjVVlt.exe
  2⤵
  PID:7916
- C:\Windows\System\JitsssF.exe
  C:\Windows\System\JitsssF.exe
  2⤵
  PID:7192
- C:\Windows\System\HrVckCb.exe
  C:\Windows\System\HrVckCb.exe
  2⤵
  PID:8560
- C:\Windows\System\FFQYhGx.exe
  C:\Windows\System\FFQYhGx.exe
  2⤵
  PID:6860
- C:\Windows\System\XdgkptL.exe
  C:\Windows\System\XdgkptL.exe
  2⤵
  PID:8388
- C:\Windows\System\XvWEiia.exe
  C:\Windows\System\XvWEiia.exe
  2⤵
  PID:8412
- C:\Windows\System\vuCPLKz.exe
  C:\Windows\System\vuCPLKz.exe
  2⤵
  PID:8504
- C:\Windows\System\FpNOXck.exe
  C:\Windows\System\FpNOXck.exe
  2⤵
  PID:7780
- C:\Windows\System\FEqkwTD.exe
  C:\Windows\System\FEqkwTD.exe
  2⤵
  PID:6892
- C:\Windows\System\ObvQDGm.exe
  C:\Windows\System\ObvQDGm.exe
  2⤵
  PID:8932
- C:\Windows\System\lOJUcBU.exe
  C:\Windows\System\lOJUcBU.exe
  2⤵
  PID:8320
- C:\Windows\System\pYnckIW.exe
  C:\Windows\System\pYnckIW.exe
  2⤵
  PID:7956
- C:\Windows\System\WcAtIpb.exe
  C:\Windows\System\WcAtIpb.exe
  2⤵
  PID:4484
- C:\Windows\System\LIwZVNb.exe
  C:\Windows\System\LIwZVNb.exe
  2⤵
  PID:8952
- C:\Windows\System\GQzKLic.exe
  C:\Windows\System\GQzKLic.exe
  2⤵
  PID:4088
- C:\Windows\System\uCVAWUk.exe
  C:\Windows\System\uCVAWUk.exe
  2⤵
  PID:7908
- C:\Windows\System\fErdJOj.exe
  C:\Windows\System\fErdJOj.exe
  2⤵
  PID:7860
- C:\Windows\System\VFxJzYX.exe
  C:\Windows\System\VFxJzYX.exe
  2⤵
  PID:6508
- C:\Windows\System\eytGdnx.exe
  C:\Windows\System\eytGdnx.exe
  2⤵
  PID:8980
- C:\Windows\System\DQsWPqF.exe
  C:\Windows\System\DQsWPqF.exe
  2⤵
  PID:8068
- C:\Windows\System\MHFxDxK.exe
  C:\Windows\System\MHFxDxK.exe
  2⤵
  PID:7752
- C:\Windows\System\cRAySdx.exe
  C:\Windows\System\cRAySdx.exe
  2⤵
  PID:7492
- C:\Windows\System\kqIyCGT.exe
  C:\Windows\System\kqIyCGT.exe
  2⤵
  PID:7668
- C:\Windows\System\SBxmPAm.exe
  C:\Windows\System\SBxmPAm.exe
  2⤵
  PID:4748
- C:\Windows\System\EyCWiri.exe
  C:\Windows\System\EyCWiri.exe
  2⤵
  PID:8820
- C:\Windows\System\gXhuCOi.exe
  C:\Windows\System\gXhuCOi.exe
  2⤵
  PID:8948
- C:\Windows\System\mcYIarb.exe
  C:\Windows\System\mcYIarb.exe
  2⤵
  PID:6172
- C:\Windows\System\IHKWqev.exe
  C:\Windows\System\IHKWqev.exe
  2⤵
  PID:8964
- C:\Windows\System\MGykQai.exe
  C:\Windows\System\MGykQai.exe
  2⤵
  PID:8928
- C:\Windows\System\XVVyFwV.exe
  C:\Windows\System\XVVyFwV.exe
  2⤵
  PID:8828
- C:\Windows\System\jkMcsLH.exe
  C:\Windows\System\jkMcsLH.exe
  2⤵
  PID:8356
- C:\Windows\System\WIikypB.exe
  C:\Windows\System\WIikypB.exe
  2⤵
  PID:8624
- C:\Windows\System\WqmdiMH.exe
  C:\Windows\System\WqmdiMH.exe
  2⤵
  PID:7172
- C:\Windows\System\ZWmDhzc.exe
  C:\Windows\System\ZWmDhzc.exe
  2⤵
  PID:9376
- C:\Windows\System\dmGIKuZ.exe
  C:\Windows\System\dmGIKuZ.exe
  2⤵
  PID:9340
- C:\Windows\System\fmCPoLo.exe
  C:\Windows\System\fmCPoLo.exe
  2⤵
  PID:8600
- C:\Windows\System\wkjFODE.exe
  C:\Windows\System\wkjFODE.exe
  2⤵
  PID:8100
- C:\Windows\System\zjjUlru.exe
  C:\Windows\System\zjjUlru.exe
  2⤵
  PID:7312
- C:\Windows\System\gdFLKVs.exe
  C:\Windows\System\gdFLKVs.exe
  2⤵
  PID:9364
- C:\Windows\System\kAJJbQU.exe
  C:\Windows\System\kAJJbQU.exe
  2⤵
  PID:8368
- C:\Windows\System\EFtARbB.exe
  C:\Windows\System\EFtARbB.exe
  2⤵
  PID:4084
- C:\Windows\System\IAeFmtW.exe
  C:\Windows\System\IAeFmtW.exe
  2⤵
  PID:7236
- C:\Windows\System\dwsQKQc.exe
  C:\Windows\System\dwsQKQc.exe
  2⤵
  PID:9356
- C:\Windows\System\XNyrKlO.exe
  C:\Windows\System\XNyrKlO.exe
  2⤵
  PID:9300
- C:\Windows\System\gNEwhcO.exe
  C:\Windows\System\gNEwhcO.exe
  2⤵
  PID:6908
- C:\Windows\System\gmgiPpy.exe
  C:\Windows\System\gmgiPpy.exe
  2⤵
  PID:3776
- C:\Windows\System\mVMNCaB.exe
  C:\Windows\System\mVMNCaB.exe
  2⤵
  PID:9512
- C:\Windows\System\amwBcCA.exe
  C:\Windows\System\amwBcCA.exe
  2⤵
  PID:9568
- C:\Windows\System\katugfh.exe
  C:\Windows\System\katugfh.exe
  2⤵
  PID:9528
- C:\Windows\System\YycncFn.exe
  C:\Windows\System\YycncFn.exe
  2⤵
  PID:10220
- C:\Windows\System\eWliynF.exe
  C:\Windows\System\eWliynF.exe
  2⤵
  PID:7852
- C:\Windows\System\ksWcGmT.exe
  C:\Windows\System\ksWcGmT.exe
  2⤵
  PID:13672
- C:\Windows\System\BrKAQYI.exe
  C:\Windows\System\BrKAQYI.exe
  2⤵
  PID:8372
- C:\Windows\System\lJyznQJ.exe
  C:\Windows\System\lJyznQJ.exe
  2⤵
  PID:13860
- C:\Windows\System\rlnBEeK.exe
  C:\Windows\System\rlnBEeK.exe
  2⤵
  PID:9396
- C:\Windows\System\DpQvGRZ.exe
  C:\Windows\System\DpQvGRZ.exe
  2⤵
  PID:9432
- C:\Windows\System\QYqHFlB.exe
  C:\Windows\System\QYqHFlB.exe
  2⤵
  PID:9468
- C:\Windows\System\ayOFGaX.exe
  C:\Windows\System\ayOFGaX.exe
  2⤵
  PID:9920
- C:\Windows\System\ExbSwtO.exe
  C:\Windows\System\ExbSwtO.exe
  2⤵
  PID:8608
- C:\Windows\System\gpMuwMt.exe
  C:\Windows\System\gpMuwMt.exe
  2⤵
  PID:8588
- C:\Windows\System\lpLjKLy.exe
  C:\Windows\System\lpLjKLy.exe
  2⤵
  PID:10004
- C:\Windows\System\vtqAHmy.exe
  C:\Windows\System\vtqAHmy.exe
  2⤵
  PID:10172
- C:\Windows\System\bjIDFlq.exe
  C:\Windows\System\bjIDFlq.exe
  2⤵
  PID:9048
- C:\Windows\System\eJbLxYz.exe
  C:\Windows\System\eJbLxYz.exe
  2⤵
  PID:11008
- C:\Windows\System\OhfKkGb.exe
  C:\Windows\System\OhfKkGb.exe
  2⤵
  PID:10804
- C:\Windows\System\JvrPcAy.exe
  C:\Windows\System\JvrPcAy.exe
  2⤵
  PID:6204
- C:\Windows\System\pyJAosX.exe
  C:\Windows\System\pyJAosX.exe
  2⤵
  PID:9644
- C:\Windows\System\SJdOXFY.exe
  C:\Windows\System\SJdOXFY.exe
  2⤵
  PID:10028
- C:\Windows\System\QPoJXrW.exe
  C:\Windows\System\QPoJXrW.exe
  2⤵
  PID:9188
- C:\Windows\System\fqfyJIj.exe
  C:\Windows\System\fqfyJIj.exe
  2⤵
  PID:9500
- C:\Windows\System\KyBGhUc.exe
  C:\Windows\System\KyBGhUc.exe
  2⤵
  PID:9404
- C:\Windows\System\yhAIdmN.exe
  C:\Windows\System\yhAIdmN.exe
  2⤵
  PID:10704
- C:\Windows\System\gMtcdpX.exe
  C:\Windows\System\gMtcdpX.exe
  2⤵
  PID:14024
- C:\Windows\System\sICgITI.exe
  C:\Windows\System\sICgITI.exe
  2⤵
  PID:9380
- C:\Windows\System\DtDBevG.exe
  C:\Windows\System\DtDBevG.exe
  2⤵
  PID:11216
- C:\Windows\System\JSquTqm.exe
  C:\Windows\System\JSquTqm.exe
  2⤵
  PID:10684
- C:\Windows\System\nmJBijR.exe
  C:\Windows\System\nmJBijR.exe
  2⤵
  PID:10572
- C:\Windows\System\llhPbab.exe
  C:\Windows\System\llhPbab.exe
  2⤵
  PID:10724
- C:\Windows\System\MzYQSzL.exe
  C:\Windows\System\MzYQSzL.exe
  2⤵
  PID:10628
- C:\Windows\System\wWWFDpV.exe
  C:\Windows\System\wWWFDpV.exe
  2⤵
  PID:2684
- C:\Windows\System\iksTAgN.exe
  C:\Windows\System\iksTAgN.exe
  2⤵
  PID:10712
- C:\Windows\System\WUJhGzH.exe
  C:\Windows\System\WUJhGzH.exe
  2⤵
  PID:11236
- C:\Windows\System\HJtgeAf.exe
  C:\Windows\System\HJtgeAf.exe
  2⤵
  PID:7920
- C:\Windows\System\wUWQcFP.exe
  C:\Windows\System\wUWQcFP.exe
  2⤵
  PID:7960
- C:\Windows\System\zFDQAKx.exe
  C:\Windows\System\zFDQAKx.exe
  2⤵
  PID:8620
- C:\Windows\System\UrqXTAw.exe
  C:\Windows\System\UrqXTAw.exe
  2⤵
  PID:10052
- C:\Windows\System\SWxlxRc.exe
  C:\Windows\System\SWxlxRc.exe
  2⤵
  PID:10900
- C:\Windows\System\ZSKAGqk.exe
  C:\Windows\System\ZSKAGqk.exe
  2⤵
  PID:10720
- C:\Windows\System\veiGJel.exe
  C:\Windows\System\veiGJel.exe
  2⤵
  PID:9988
- C:\Windows\System\jcmkgDc.exe
  C:\Windows\System\jcmkgDc.exe
  2⤵
  PID:8000
- C:\Windows\System\IzXcapo.exe
  C:\Windows\System\IzXcapo.exe
  2⤵
  PID:5592
- C:\Windows\System\rEMWfjt.exe
  C:\Windows\System\rEMWfjt.exe
  2⤵
  PID:10000
- C:\Windows\System\mGbKePc.exe
  C:\Windows\System\mGbKePc.exe
  2⤵
  PID:1476
- C:\Windows\System\aXooGns.exe
  C:\Windows\System\aXooGns.exe
  2⤵
  PID:11300
- C:\Windows\System\gMRfNWM.exe
  C:\Windows\System\gMRfNWM.exe
  2⤵
  PID:10912
- C:\Windows\System\mQMEaCb.exe
  C:\Windows\System\mQMEaCb.exe
  2⤵
  PID:6688
- C:\Windows\System\ApzNfCP.exe
  C:\Windows\System\ApzNfCP.exe
  2⤵
  PID:10432
- C:\Windows\System\dRQDdnG.exe
  C:\Windows\System\dRQDdnG.exe
  2⤵
  PID:8096
- C:\Windows\System\zxLeHRH.exe
  C:\Windows\System\zxLeHRH.exe
  2⤵
  PID:7352
- C:\Windows\System\SIehSBz.exe
  C:\Windows\System\SIehSBz.exe
  2⤵
  PID:11208
- C:\Windows\System\eDNRRvW.exe
  C:\Windows\System\eDNRRvW.exe
  2⤵
  PID:10484
- C:\Windows\System\tbTKDdO.exe
  C:\Windows\System\tbTKDdO.exe
  2⤵
  PID:10184
- C:\Windows\System\WoaMEnF.exe
  C:\Windows\System\WoaMEnF.exe
  2⤵
  PID:11140
- C:\Windows\System\QoHMpZR.exe
  C:\Windows\System\QoHMpZR.exe
  2⤵
  PID:11380
- C:\Windows\System\FbbhBVt.exe
  C:\Windows\System\FbbhBVt.exe
  2⤵
  PID:8824
- C:\Windows\System\jrXcKsy.exe
  C:\Windows\System\jrXcKsy.exe
  2⤵
  PID:6772
- C:\Windows\System\ZEepvJS.exe
  C:\Windows\System\ZEepvJS.exe
  2⤵
  PID:10412
- C:\Windows\System\XjFzqHg.exe
  C:\Windows\System\XjFzqHg.exe
  2⤵
  PID:7940
- C:\Windows\System\UqAJkat.exe
  C:\Windows\System\UqAJkat.exe
  2⤵
  PID:11776
- C:\Windows\System\iTePFHH.exe
  C:\Windows\System\iTePFHH.exe
  2⤵
  PID:10708
- C:\Windows\System\ltjGfND.exe
  C:\Windows\System\ltjGfND.exe
  2⤵
  PID:9200
- C:\Windows\System\BDyBjxA.exe
  C:\Windows\System\BDyBjxA.exe
  2⤵
  PID:11912
- C:\Windows\System\IVXynRA.exe
  C:\Windows\System\IVXynRA.exe
  2⤵
  PID:11356
- C:\Windows\System\FgjJjQU.exe
  C:\Windows\System\FgjJjQU.exe
  2⤵
  PID:12480
- C:\Windows\System\rYWqkqo.exe
  C:\Windows\System\rYWqkqo.exe
  2⤵
  PID:11116
- C:\Windows\System\PmeNXEh.exe
  C:\Windows\System\PmeNXEh.exe
  2⤵
  PID:12036
- C:\Windows\System\dlKKjLm.exe
  C:\Windows\System\dlKKjLm.exe
  2⤵
  PID:11964
- C:\Windows\System\MpzUfeo.exe
  C:\Windows\System\MpzUfeo.exe
  2⤵
  PID:10024
- C:\Windows\System\MNEBgtJ.exe
  C:\Windows\System\MNEBgtJ.exe
  2⤵
  PID:10944
- C:\Windows\System\hZSrdzE.exe
  C:\Windows\System\hZSrdzE.exe
  2⤵
  PID:7872
- C:\Windows\System\WmgbnCz.exe
  C:\Windows\System\WmgbnCz.exe
  2⤵
  PID:12784
- C:\Windows\System\uDNrqwP.exe
  C:\Windows\System\uDNrqwP.exe
  2⤵
  PID:12104
- C:\Windows\System\wyNLnHa.exe
  C:\Windows\System\wyNLnHa.exe
  2⤵
  PID:14356
- C:\Windows\System\wJXoGKc.exe
  C:\Windows\System\wJXoGKc.exe
  2⤵
  PID:14388
- C:\Windows\System\GxzSYAM.exe
  C:\Windows\System\GxzSYAM.exe
  2⤵
  PID:14412
- C:\Windows\System\aDllhqb.exe
  C:\Windows\System\aDllhqb.exe
  2⤵
  PID:14460
- C:\Windows\System\KoGkUKm.exe
  C:\Windows\System\KoGkUKm.exe
  2⤵
  PID:14500
- C:\Windows\System\OlmmvbH.exe
  C:\Windows\System\OlmmvbH.exe
  2⤵
  PID:14528
- C:\Windows\System\cvEYBQo.exe
  C:\Windows\System\cvEYBQo.exe
  2⤵
  PID:14560
- C:\Windows\System\MxhATjU.exe
  C:\Windows\System\MxhATjU.exe
  2⤵
  PID:14584
- C:\Windows\System\biTFSID.exe
  C:\Windows\System\biTFSID.exe
  2⤵
  PID:14624
- C:\Windows\System\rkIEgym.exe
  C:\Windows\System\rkIEgym.exe
  2⤵
  PID:14660
- C:\Windows\System\HHsYMAW.exe
  C:\Windows\System\HHsYMAW.exe
  2⤵
  PID:14692
- C:\Windows\System\jYewSZT.exe
  C:\Windows\System\jYewSZT.exe
  2⤵
  PID:14740
- C:\Windows\System\TJyQMSy.exe
  C:\Windows\System\TJyQMSy.exe
  2⤵
  PID:14788
- C:\Windows\System\JEixbCr.exe
  C:\Windows\System\JEixbCr.exe
  2⤵
  PID:14824
- C:\Windows\System\AApKsJX.exe
  C:\Windows\System\AApKsJX.exe
  2⤵
  PID:14848
- C:\Windows\System\DzlOWMK.exe
  C:\Windows\System\DzlOWMK.exe
  2⤵
  PID:14876
- C:\Windows\System\hXvPNOH.exe
  C:\Windows\System\hXvPNOH.exe
  2⤵
  PID:14900
- C:\Windows\System\evSEIVs.exe
  C:\Windows\System\evSEIVs.exe
  2⤵
  PID:14932
- C:\Windows\System\eqcolwo.exe
  C:\Windows\System\eqcolwo.exe
  2⤵
  PID:14968
- C:\Windows\System\rygaWBy.exe
  C:\Windows\System\rygaWBy.exe
  2⤵
  PID:15016
- C:\Windows\System\EwsItor.exe
  C:\Windows\System\EwsItor.exe
  2⤵
  PID:15056
- C:\Windows\System\ZUthPhg.exe
  C:\Windows\System\ZUthPhg.exe
  2⤵
  PID:15084
- C:\Windows\System\prKZpnm.exe
  C:\Windows\System\prKZpnm.exe
  2⤵
  PID:15112
- C:\Windows\System\NAPcIhN.exe
  C:\Windows\System\NAPcIhN.exe
  2⤵
  PID:15136
- C:\Windows\System\EnKvJgs.exe
  C:\Windows\System\EnKvJgs.exe
  2⤵
  PID:15172
- C:\Windows\System\ZHFNbeY.exe
  C:\Windows\System\ZHFNbeY.exe
  2⤵
  PID:15204
- C:\Windows\System\bcdetbB.exe
  C:\Windows\System\bcdetbB.exe
  2⤵
  PID:15252
- C:\Windows\System\EBJVXZz.exe
  C:\Windows\System\EBJVXZz.exe
  2⤵
  PID:15284
- C:\Windows\System\RtJiBQr.exe
  C:\Windows\System\RtJiBQr.exe
  2⤵
  PID:15316
- C:\Windows\System\vUHQFAg.exe
  C:\Windows\System\vUHQFAg.exe
  2⤵
  PID:15352
- C:\Windows\System\biSnjej.exe
  C:\Windows\System\biSnjej.exe
  2⤵
  PID:13112
- C:\Windows\System\UTOlaXP.exe
  C:\Windows\System\UTOlaXP.exe
  2⤵
  PID:11396
- C:\Windows\System\GRQtIpE.exe
  C:\Windows\System\GRQtIpE.exe
  2⤵
  PID:11920
- C:\Windows\System\Soffaal.exe
  C:\Windows\System\Soffaal.exe
  2⤵
  PID:11800
- C:\Windows\System\yhXXIvH.exe
  C:\Windows\System\yhXXIvH.exe
  2⤵
  PID:11276
- C:\Windows\System\ZFQHVAz.exe
  C:\Windows\System\ZFQHVAz.exe
  2⤵
  PID:14468
- C:\Windows\System\crFfaRn.exe
  C:\Windows\System\crFfaRn.exe
  2⤵
  PID:14524
- C:\Windows\System\MNlzTGH.exe
  C:\Windows\System\MNlzTGH.exe
  2⤵
  PID:12384
- C:\Windows\System\XzgFxxK.exe
  C:\Windows\System\XzgFxxK.exe
  2⤵
  PID:3564
- C:\Windows\System\HOFOEGw.exe
  C:\Windows\System\HOFOEGw.exe
  2⤵
  PID:14612
- C:\Windows\System\BoFlNyo.exe
  C:\Windows\System\BoFlNyo.exe
  2⤵
  PID:14444
- C:\Windows\System\NBjYFMV.exe
  C:\Windows\System\NBjYFMV.exe
  2⤵
  PID:14488
- C:\Windows\System\DEKzEOQ.exe
  C:\Windows\System\DEKzEOQ.exe
  2⤵
  PID:12732
- C:\Windows\System\kDEJfEp.exe
  C:\Windows\System\kDEJfEp.exe
  2⤵
  PID:12588
- C:\Windows\System\uVnrTVT.exe
  C:\Windows\System\uVnrTVT.exe
  2⤵
  PID:14764
- C:\Windows\System\yVoGjCQ.exe
  C:\Windows\System\yVoGjCQ.exe
  2⤵
  PID:14920
- C:\Windows\System\zRRPzHs.exe
  C:\Windows\System\zRRPzHs.exe
  2⤵
  PID:14948
- C:\Windows\System\QLoNefv.exe
  C:\Windows\System\QLoNefv.exe
  2⤵
  PID:14988
- C:\Windows\System\xNwmtri.exe
  C:\Windows\System\xNwmtri.exe
  2⤵
  PID:15040
- C:\Windows\System\ooyooLg.exe
  C:\Windows\System\ooyooLg.exe
  2⤵
  PID:13052
- C:\Windows\System\ClTOGrR.exe
  C:\Windows\System\ClTOGrR.exe
  2⤵
  PID:15052
- C:\Windows\System\gsGQyQn.exe
  C:\Windows\System\gsGQyQn.exe
  2⤵
  PID:15160
- C:\Windows\System\mXpVEEF.exe
  C:\Windows\System\mXpVEEF.exe
  2⤵
  PID:15080
- C:\Windows\System\vprEpXG.exe
  C:\Windows\System\vprEpXG.exe
  2⤵
  PID:15188
- C:\Windows\System\zEWbZpX.exe
  C:\Windows\System\zEWbZpX.exe
  2⤵
  PID:12276
- C:\Windows\System\DABeauO.exe
  C:\Windows\System\DABeauO.exe
  2⤵
  PID:15264
- C:\Windows\System\smDzdqP.exe
  C:\Windows\System\smDzdqP.exe
  2⤵
  PID:14312
- C:\Windows\System\mvDrNUh.exe
  C:\Windows\System\mvDrNUh.exe
  2⤵
  PID:12260
- C:\Windows\System\mikUPut.exe
  C:\Windows\System\mikUPut.exe
  2⤵
  PID:9476
- C:\Windows\System\GxEyaxO.exe
  C:\Windows\System\GxEyaxO.exe
  2⤵
  PID:14364
- C:\Windows\System\bSfAbkI.exe
  C:\Windows\System\bSfAbkI.exe
  2⤵
  PID:12068
- C:\Windows\System\hDmFMJU.exe
  C:\Windows\System\hDmFMJU.exe
  2⤵
  PID:14456
- C:\Windows\System\rIfkQCZ.exe
  C:\Windows\System\rIfkQCZ.exe
  2⤵
  PID:14536
- C:\Windows\System\VPrrizU.exe
  C:\Windows\System\VPrrizU.exe
  2⤵
  PID:14708
- C:\Windows\System\tKQXENp.exe
  C:\Windows\System\tKQXENp.exe
  2⤵
  PID:12736
- C:\Windows\System\DJfXKhD.exe
  C:\Windows\System\DJfXKhD.exe
  2⤵
  PID:6608
- C:\Windows\System\tiXYuoI.exe
  C:\Windows\System\tiXYuoI.exe
  2⤵
  PID:12936
- C:\Windows\System\ZphOuYo.exe
  C:\Windows\System\ZphOuYo.exe
  2⤵
  PID:13204
- C:\Windows\System\HcAUPLz.exe
  C:\Windows\System\HcAUPLz.exe
  2⤵
  PID:11944
- C:\Windows\System\NLNIqJV.exe
  C:\Windows\System\NLNIqJV.exe
  2⤵
  PID:15132
- C:\Windows\System\vQfzFgc.exe
  C:\Windows\System\vQfzFgc.exe
  2⤵
  PID:15224
- C:\Windows\System\dNlZzmH.exe
  C:\Windows\System\dNlZzmH.exe
  2⤵
  PID:15128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfkxcs32.dib.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ANurkjg.exe

Filesize
2.2MB

MD5
4248ce3edb52e61ceafd1b82d31c463e

SHA1
88597db57c01e74a188d5d3fc9d673c22f8e2577

SHA256
6b5991204a35b56c280528980283562e678cae8258085610f02c8d3fe36b3f41

SHA512
9f0e9fbfe4d54fb1a30e225bc03afa110fb521ae61f1ee88ae7a5f3ebefdbc1d338e288c9593bffc8f2884f6ff9c0a64ac99d6f55ccd2c2100eb274f04220f3b

Download Submit
C:\Windows\System\AmwrZjN.exe

Filesize
2.2MB

MD5
9a7c7580a396564691aa82058d354f45

SHA1
a38580b59ad62d1d3e05e1aea00910d7ec036d96

SHA256
e3ee555b038c98d5fa29c2672aca9c092512f440924e3cf8120a2f88aefe41ba

SHA512
380d7024a3f4b0c262d3433d9a642cd829669e2e429db28f684879c7b3fed128b6b55550f9a5792127b0b0e151b1cfa06e63099e6b55e21cd5f371899227c04c

Download Submit
C:\Windows\System\BqBLkye.exe

Filesize
2.2MB

MD5
c9e704c90533f077b10adb2abccfebe3

SHA1
3c40dce824f1c89b435ef08d21bed99c92a3fb6b

SHA256
b38cdd6143ebb51224e5a25a45f8efbfa2698a2feff5ff458cd50f31af12275f

SHA512
a502580cd7ff46989721ac50701c4943b5978c660e6c8b55884b19e2cbf7a7123fd4771e35dd56ffc0b9ea23f70b3e71e23859e3c5549ac84b2fa0c2db25f60a

Download Submit
C:\Windows\System\CqmRmKc.exe

Filesize
2.2MB

MD5
31d6a4d60a762a89a273da3f518e596a

SHA1
5aa8c53aead520e4e3b61604e7191fc0fab4ed77

SHA256
ec250036df1030fdfcedc72024647126300d1f91679fb3666ac0e508f1144a1e

SHA512
d6b8c590bf1e139434cdc619188dcb4aa2d6ee65f923878ee34e454c965dcf9da27487c7845a42dbd1facf4079b1fc9d902dbc192ae1ca94f45b2374702e63ab

Download Submit
C:\Windows\System\GFRsFrH.exe

Filesize
2.2MB

MD5
59d0c5045aa44b9969397b98882e5823

SHA1
f3cd4c4a4000cc57c542a017d1c55566f5d2a7e6

SHA256
427faaed1ab9ad8a11e429805729186230ec72237a04f9b0a5ac77bf4376c2bf

SHA512
869c5c48aff36d6a1b2cd656872a6f6572b7528b590667aa9412ad962219267cd9ce0f9c956141575a509e05a3dd3fa03770e20c6c56e1699ac0c552e5200b77

Download Submit
C:\Windows\System\GiKEPXc.exe

Filesize
2.2MB

MD5
36968f888e062ff2e2dae401f7f6d342

SHA1
12428bf815e106a3da888a9079329ddad850fb29

SHA256
5fddafb6c2bd1c64b29de82d98094b5082fe38420f90875e7ef848e01c738bcb

SHA512
5023ae7894aa8703b4fe97baf8dea2dee9d2ce3f557a56953046f855dc6e42eeb6ab6118cfb50044883dbf50952dbdc7ce592ed9cccdfabdce3eb0a02fde3aa8

Download Submit
C:\Windows\System\JLjtdeT.exe

Filesize
2.2MB

MD5
da80ceade0496342fece33462d1791a4

SHA1
38015b1c1147dc49583e1e928b906753bd7e2538

SHA256
25048ab32cf6b4059ab923fbf9c06724bf27d9e62d9cfe9978166c0c9f41ea46

SHA512
74ada46690b7b48a47748dace82403c269d91e7560d022dd7d8f66432e12648c8e6edb1031a1d149876281d95ab06ba6c91b3fe3beac4e666f441e2351b8ee94

Download Submit
C:\Windows\System\LojzAVL.exe

Filesize
2.2MB

MD5
49bd1fc35575050be84886c15f95ce0c

SHA1
3276acf00aca334443bb1418869c1b798f381bfe

SHA256
0da6a45ff5ca98cb1e5c353dfd7254e7143c703bc1fdf7649789e30794070d72

SHA512
d68dcc65e85eab39f9a0bda1e1a87bf2f0abdc928d07ea45e0e45dc7d85f75d6861d3a06555b8f21470011aa5a50a99b2b1a3207adf1ca98f67f0fb6b09f94b8

Download Submit
C:\Windows\System\MaBDOVs.exe

Filesize
2.2MB

MD5
145a3dff94d923270bac09b704fa0654

SHA1
005f1052ac02140fc07f52692608f49a1eb9e16b

SHA256
807c77519dc761c3867382ff0cb38ba02bb276b951c41fb6e3da9829ad931c3b

SHA512
81e4de1e5aa01e8e0edc9f971cd36c3f083724a8958ea808883ae3cf0dce4717a042edbc350cc3ba73303e30e683d9e423eba27110aabc3f1e8d088170acead4

Download Submit
C:\Windows\System\OvbpQfn.exe

Filesize
2.2MB

MD5
aee9cd66854312b846ea4fe016f586d1

SHA1
70982d2e7516079449161a9db106ec57de7a99c6

SHA256
13582916c5a5bf51826e3760b50580e58cef88555d5573a3ecd6792b817dc67e

SHA512
ba1a381f257157224840e64e2568cf23d822abb2e746a351699b205bca4c6f77a3b17160d0a844256d813e23e226081a36e8179af35ac0e67f3f73396584e0a5

Download Submit
C:\Windows\System\PSjblod.exe

Filesize
1.5MB

MD5
a088ee82676640244a92db908d2e324c

SHA1
52fab920a0d6ef7e6bb18c8012ed380d1c954925

SHA256
2b4b181ebc55170941b16ad5511c27ff9effa712aeb1aa375f0fd536090cb5a3

SHA512
74d592a8c66083f2f6fe304cf132ece7f40d7bbb67562331ec99d0d8eb0ec692881c5f2a96fa1caf6e94819e8db1e372eed8b051fa346329f3c43314228587cf

Download Submit
C:\Windows\System\PSjblod.exe

Filesize
2.2MB

MD5
446f4e6d4f88ef234937f042c2d3efb6

SHA1
501ff80fe3d02e85ee25970e7e06e4db74d5706a

SHA256
9b00becd295fa8be9ed894ec221fdf02bf37c67f34593f33a7f54936dd6a441b

SHA512
65dfb7556bdeba45e3d96b8dac448825ec77ada8b9fe9b5dc2718ae943e1634b63392f2d999a8fb480ebf461a80717948e630633f3e08a8ff2daaa1099b1ed5e

Download Submit
C:\Windows\System\PtYtksD.exe

Filesize
2.2MB

MD5
342b4cf581dcf0252e9256be0bb9d717

SHA1
92f87c97bb8e39810a6d2026b19971f349e9ec43

SHA256
3fab6edc4fe09da3305938dc14cfb16c6874415c7fd5f591009efde32c447e44

SHA512
485f65ffe1567481c8e0f620b75fbb64ee26ea03250497b59b9d1d904349288898a2784a598840909870dae53eeff93b3baf96a5e74aee5fdf4020a6f96f4653

Download Submit
C:\Windows\System\QfCQkIb.exe

Filesize
2.2MB

MD5
1f77e9c020bba05f0b851b1a3b95f84a

SHA1
199eaf99727c27b21bfebea871618957ed4569a0

SHA256
a224a634484f278e1863d006589679012b2f3e9b8a32c252dc9c861e8b1a12de

SHA512
b1ce76eb53a38f949fa6a82d978ab760342621b5e7b670956684ac1a2840acf5cae614c607170ea496f185509b9ec95a4ccdee8f3ff0b1cd74a87feeea9a0376

Download Submit
C:\Windows\System\QyaFqAp.exe

Filesize
2.2MB

MD5
9a689a8aae7ceca5fe9277ff979a289a

SHA1
adf3ff2c78fa45189e8a71e0b9adff3d26ea4f60

SHA256
57782de5598e7b9d750521fa0079f9b649ff3be96428d11c73dfe00c54f805cc

SHA512
8758fa013d83d09877494d387c5518f765d42cc4c14923a2fe2e8d280485949f566f6723e870f6293472a4aa5ad29a22a557f24d6df69763f7f85425c7cc8489

Download Submit
C:\Windows\System\RwzBthd.exe

Filesize
2.2MB

MD5
20a01b520a863595a70426f768b02310

SHA1
1795d6013d0f16252473154f22f2b6cba8a6169a

SHA256
e87b86a83bf89a2a6d594a7fa6f193abf76a4e26f725c165bc95b61753dde815

SHA512
bbab6084df7d037dcd1ff8a65496e714a235b9d6f602f7c6869570b0e5c30d27d8552c848f9251c9b273ee489eb5e996f598a1940bb91228870f910dcfb2688b

Download Submit
C:\Windows\System\SKeVWhU.exe

Filesize
2.2MB

MD5
32be9e35893d7be0443b96d19b830aab

SHA1
fcb7e6475bd6accf629f805dd66c96160ea7e0f4

SHA256
cb55277c0342d48da274a37d78cdeb5200eb2815f4135545d87d15d5102f1e13

SHA512
56e9401b2b56cf4db0b9b765f87457fb82c6f36169c552f2bc36e2488a8ee1e5ebaab1d4e4496fb0e8b84512fc55a214cf18c9f3756a91727f97afa8413906b6

Download Submit
C:\Windows\System\UmUfIAk.exe

Filesize
2.2MB

MD5
e48e64b153353109ebfc41a32f892168

SHA1
c0748b436c014a6a884825c8dfe010d3914ff87e

SHA256
10374d66575d9fd8351a29d838f14797f872036e5c58e6b43cb93648ff00f394

SHA512
734b39f87d55554adda42bee7fc330ba93ad17a52c6bbf6e79ea0be3c8b316dcabe570569cb813f9efeef7c7c83bde83fcfd74dc0ef5137495ee80b40500982b

Download Submit
C:\Windows\System\VbIVUtl.exe

Filesize
2.2MB

MD5
3ff2e56446c26a669699e21565fe61ee

SHA1
22a0439d54ec6b9597d6424919bf99e0cc0c22d1

SHA256
f4a8e30fd02ce74717dfb2e4c44fb333810feab92f5a7c86facc4cd915999548

SHA512
ff58001a849c6fb36bc15d1e9672131341d88e498f5438f72e6c977d0c03566912cae17a5eea1735b995154643bdb77b1a4c0952027a12c594e7c1c67e05ff3a

Download Submit
C:\Windows\System\WULFtOh.exe

Filesize
2.2MB

MD5
2029cea14497ed9ca141a85828d49b04

SHA1
fd4b259395b875a3e5a89d61b347335004f807a0

SHA256
ed9b34b7722e30a676d7835572a6ccdc883104c07010863e0d9e65fba7fe212e

SHA512
0264440722eba85c3b8d44d33b7984d897f8b938dac21feb13c93933612c7fff26680942036308186bafb7f4aca9593e89f81032229537fcd6433e4a99fa1389

Download Submit
C:\Windows\System\YJCjCYW.exe

Filesize
2.2MB

MD5
a9b6197a364a9b7173dc627a1e6913a8

SHA1
e44f21a103c4caf0cacb4a85838d26820b6da27d

SHA256
2a4ebd53862ee482fa5a2aa888fa0004ae3488f11a2a0877269da241fc272dad

SHA512
3dc9c953a2bcf6c9b6cb5cae9944d46494e7cd283dceeb75a0e18d61716834a3a4538e2d4d5a31ec77853db4654186ba598c2cf99cfabac723697c2cf50edc8f

Download Submit
C:\Windows\System\asGLHxc.exe

Filesize
2.2MB

MD5
5995454d21713d330f676af59b1def46

SHA1
574fdc6d6746eb38d485170eddf69281c7094bfa

SHA256
c08e75fb27614ab3a454c0447c72c18d270a8935ed4f9c887a4f7ddfd0d73e39

SHA512
0e9286bf91ebb6fdec877add899c487d8e6e8a76b2a7854aaa89e0cde02c91e97a0b78035b571a3508c97e1c488fa1f1a6a54843b53e59a5b9bd81965b3bd255

Download Submit
C:\Windows\System\blhvhqC.exe

Filesize
2.2MB

MD5
e8597d3a18509da377a9c27f09d671a7

SHA1
d3ad0f8c1af1c12a1c57c40114c80c743bb205db

SHA256
c66dd60cbed92f8463265414568a330551197419aac3fe7586434764e0352ea6

SHA512
738cafeb5271a2848da0eb5f62dce12f7643b9358661560bc694896d81c0db0999c8c0cad3877bf5a2596ad029db9df4cc1296ac9c316e5a131e9bd89e716d7c

Download Submit
C:\Windows\System\dhbSUyc.exe

Filesize
2.2MB

MD5
7fa6512700adde3d2b0a91561c341b1a

SHA1
82764313cce582ce196531438b671b3611e09e65

SHA256
173c5344e5368db2760c57f59a70527fbf1f80eae03dfd1f5235d2bd91f16d26

SHA512
599c768994cabc4b6b670ecfbca0d2966af679dcea7d58b482784dbeac66ab0db3cb54e5fa8f0841e67f4defb0653701a3b7f45b71c145b081fc1a630e85cd40

Download Submit
C:\Windows\System\fSHlevm.exe

Filesize
18B

MD5
6fe0013890c63ded4f8ff8d16df87289

SHA1
289a7f6e7968aae7b8549ffdd9b978b9db978f87

SHA256
f199c68e43f0f5c8e50bcae2d18e89d3e5e39dfc93aaed12249762ab112691d0

SHA512
d134172fdc11063e45454e6619b8bda3721fc09f325a67b3b4cca8ebbee69cce74d83053e73b70efdb9a6a1fc832c4bc1df3f3d00e9ae3195b7ef87287e98e09

Download Submit
C:\Windows\System\fnszgIn.exe

Filesize
2.2MB

MD5
77cbbcd4145eea338b7f1649e343bc75

SHA1
226a6f9263ac89539b01044498c3b01206aa2ac8

SHA256
0e2ab33b4a34d4a1032a43a006d923bfa670cabb3a03c67f21c3ba3ee14168dc

SHA512
f744986088ea3b92f97c931898318dfc4fe1a2e5e30d610b0d9411927b8b8951969e5595c6f301212eae343dbb5c0917ea3cd04d168c22de2e7ef14343e5ac05

Download Submit
C:\Windows\System\fzdWNOa.exe

Filesize
2.2MB

MD5
b3ccf76be41c18bac984185578c7951f

SHA1
cd426e7e70035448a4d5e9dac5c90f0658bd6045

SHA256
fdf1f9f79380e34510ec703a78b9bd94aa068490ce3400a7db6e28d9b903b510

SHA512
294321b759c26ec1692d5f956434c4f725548fe3061c0da0b1e6c7f608db797272788312ffbb8df4a3ced0390fdffdd167f9796c993b10ef00a2660ef7e68237

Download Submit
C:\Windows\System\gGZECnl.exe

Filesize
2.2MB

MD5
f180d1f5087e604251752a57f6c023a5

SHA1
da87db9e31e14679f9b841f6040ccdd663ec4033

SHA256
cbe21024e8a37596a54ffb7af77289386adafe0cc5ea0fbd7d7153bf3b07df9e

SHA512
f3ca1e9bd5f8aebb0f37a99bfcc769ea9cbd98ce71eb3959a6199377c21bdb42c5af35441f3dab8da1bd8bdb588ce94dee92c512353943f48a83ea98389a8b0e

Download Submit
C:\Windows\System\iIDlvym.exe

Filesize
2.2MB

MD5
0b45c05dbd58f522353adb31fb11d729

SHA1
07322f85fa08cc258d24296503d8bee496421158

SHA256
3ee4f82813dcbcb04bc625d336537b608060422ede548c556aa549440992070a

SHA512
e772393dcaa639c342f90411a4fd284177fd4d656fcee4f14e1dc51cac2f127b91f43f91e9688523c86b3d5d8d2657c7dd3bc3b1a374232e2ce504ad510602f7

Download Submit
C:\Windows\System\iYLsgvB.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\iaKbBqS.exe

Filesize
2.2MB

MD5
93c04c49580da9ba7c1ffe17b79f5db4

SHA1
b9d9f2e4751964a76b25a128f7cd5da31f2c31ba

SHA256
ba18e851a1a96642ab3fe01411a8cfaee2ce91a07b16b4ee1acf7a8b5ba98c38

SHA512
7601c803d2a52567fe94196e19a4c0ba16341f8c6a980035beeca428fc2f0c70debc82c21107e8f8cf96c5619792ebc9f0df6bf0c68a702ea10ae7ed888f0736

Download Submit
C:\Windows\System\imoWovI.exe

Filesize
2.2MB

MD5
af057321be1c93a9c7d7aed02651fb2d

SHA1
555f0456beb3af08c48409930d85a5039abdf991

SHA256
df2f9cee1cbc43154606ad7c38a02e54f6bdc6542675dd8068d561514a24aa3b

SHA512
266ff23b5d1b3720d20b2ac4ebb5464778b6a542bc7260438da42fe0276781dfea5c928f0c4559d7f0694c31d9e4e225e2c8724f285c10456d9e54224edf5e36

Download Submit
C:\Windows\System\jprmXCW.exe

Filesize
2.2MB

MD5
87c26afd0eb4a6271116939f9028d70d

SHA1
8e7755d7edad93432969160cb7c39334d559951e

SHA256
70233208b950418e2fcf554293bfbd04bd293182cc842dd4514e4b7825bf202f

SHA512
702f7a70f26cebef3c2e651fdfea42b7bc24ae708667868c71b3f2134ae56ad5d8f1daaee5de6c2ca9faa04c3e7f9f956d3d839889232e393ad4be50484d5e73

Download Submit
C:\Windows\System\kKTLpGM.exe

Filesize
2.2MB

MD5
06b9842a10a0985e7af50b42cc9a395e

SHA1
a618331a7fe2f8da628590ab953c42f991d86cf3

SHA256
a34ca002bdd3902d0d3ffc161f5becfea81ba0f16fec63dcaa509d763e7ca647

SHA512
18397e087d0c81751ef89411a6ed94f8c742c48ac9fed27593b3d9a8328f80ae20a508bafc1c8e3310f827af1f635f0e6e3bdfe9c58bab951d0fa70d6b18ffec

Download Submit
C:\Windows\System\nUFRBHz.exe

Filesize
2.2MB

MD5
65d3fa01cf0dcaedf0c8754115398bd5

SHA1
aca34435a2fd456e18269d327bdc5620797c8db1

SHA256
6fb319c89090faa9cf095e296c55a4b27f6c5911530c0514a645188abed765eb

SHA512
687e393a5e98717e9a344b6cf316f95f64776d364072f67675addc63d76ad2bf68ad42d99a25e703fb732ab871b2560109055fa5beaeec322b65770419952fcb

Download Submit
C:\Windows\System\pMbhiHq.exe

Filesize
2.2MB

MD5
15931567e9a481229b292487527c2511

SHA1
e7ec845dec41ce2dd940f5c79e5f3508367a8cea

SHA256
3663b948bae94e9c8f7d7f005964c8c95d69a54a2c01b8276027440c695e4c7d

SHA512
a6a4ff5a8b78cd8b5a8d7a4e002e9de3fdaab5ca08aadb11e1297f296231eb9b158214f9bb81109f58750c22f0dec4b2214cd3b53a354a6a9d45d3d2a27d1de1

Download Submit
C:\Windows\System\pmSoAbq.exe

Filesize
2.2MB

MD5
69efcaa36195196ac5c2f1b2ae35461c

SHA1
1a4f4cf1394ce2e2914b46398f13aa4ade61bee4

SHA256
8496a78f279a0d03ea4ef854c2c144e9eb430b7aeeb8ba4bf7c67ece8b141948

SHA512
b9d164ccc3dc60eede28f8eb118e4e621121fd061a2952c613efc9ef7ed70fc060cd8aa830f7884ee4f645d61d0a2042873f09c998743a627999884aa3cb97f7

Download Submit
C:\Windows\System\tzpoHQK.exe

Filesize
2.2MB

MD5
d7a0b018ec90b096a5d399d4e68c365b

SHA1
ab70f46ce9eed7e7f21b7b5c53a3812d496f98f6

SHA256
b8c52b5c8d8b62842dca5d0b461d26fded94f39ac48b5c6fbb62bd103f09d403

SHA512
5728fe988f682dcff108f84f19e55d9fe18f895751b3d84709305c2839c7e9352492da8a2d6014853ccf05d871ceb6c0da1c6d1176925ad099d41e0ccb093981

Download Submit
C:\Windows\System\vtargMO.exe

Filesize
2.2MB

MD5
f763e45f3dc48f704535164826d4dc59

SHA1
34bdcb995aefd90ae6bb2905b91b9e0d19350758

SHA256
0bf7169f4471ac5a4084422258ec0ada654e980da0a57f9b1cbb6e0869824f78

SHA512
02e789452e9854ec745ffbe634110ae60a7dd17a1767e71a7a7177b87c650cc0271f18e8e69eccb213888d558e75af0d127f1129861afac34d7bed9d5ffeef38

Download Submit
C:\Windows\System\xOGiEFa.exe

Filesize
2.2MB

MD5
8ebe4c673cae9150c8b780e274c5d1e9

SHA1
424b75548613fa8cbd0f9ca08af124b8587f05e1

SHA256
caadc9bba9197a879c09ae0c1d610cd02a1f16e894c8863e0fedaa846f823d8f

SHA512
213bf49359d071b7f369315cb17c9688c2095081c533d64b4e8359a91f82162fc3bc77c04b0eeb897bc72a3bbe4237632dcc60212ced9c320038b2ecf3965981

Download Submit
C:\Windows\System\xrGTlMm.exe

Filesize
2.2MB

MD5
783cb1b196c2f9650259077aec3669f5

SHA1
8689c932b4db7526ee11e9d49f9a70aed1de3414

SHA256
c82e377bc63b20325bc7c0accb148d1cb2a458aa586162650dc919985efb116d

SHA512
a7a8fbe367b40bad61e450d23d2c1fa5bda0af3a9f04c27f2647dd1f71dd83d0bcee104af22dc4d1f449d5b229ec60bd1a6f6aaaac44b0d4069d53ed23208628

Download Submit
C:\Windows\System\yWQSEOl.exe

Filesize
2.2MB

MD5
e9c3375b43ae73a52348acc6f17ee45c

SHA1
8c53c50af54d498b418136b900647a180eeaef4c

SHA256
b819f1b51daee45d2b00cc3ccc7e5766f48da3c74f9210fa276143bae2a784af

SHA512
38b7dd1db971d44a9c86b6fbf38ff04f28325f546b929f57f99ed470ed164c58a6f0b6f2e64dbed97a309e30d85ba475c56d8411cfec679e6144ff3a8ab396ea

Download Submit
C:\Windows\System\ypXfPDP.exe

Filesize
2.2MB

MD5
a3b0dbb0001ec34bfff256219e04ab6e

SHA1
fe638797805e4bd2d17fd9b6966475453703aaac

SHA256
cb2484b0fc381a90f40337cf2aaaef8d8f7bc2a58337897eb67ebe9d30ca8452

SHA512
8a92238450835ab7d6565ff752199ecf79d86eec3335369741e49569c010f197db98113f39339c39f8d529df12f91ce1ffab7bd6550b7e4abd524237e36090d3

Download Submit
C:\Windows\System\zozatqH.exe

Filesize
2.2MB

MD5
22659e1ef331d30f274c2b4c50b7c54f

SHA1
63ab2c91e6dfdfea28f336f3bea4f6e4cfcf0f82

SHA256
aad8ca880c24996db6de8d150af0ff6354a26170eb5c0d3a5d5e0317bf03005c

SHA512
d2017cb04052b96dd817ed65f7a4711ff1bca9a248ee1f3c3c87dcee4311e71f60546c829f60509d5b08a564cce32b8ff11d80cf255200a754316605f810edf3

Download Submit
C:\Windows\System\zwGQixw.exe

Filesize
2.2MB

MD5
f1a6b729a37844c4ab3faedd9d878f57

SHA1
21af62193b4f78687ac58a1e6bee5276696eb9fd

SHA256
245756c01cf846d11c04dfdb0270cc557f3adf47c548d291ddec4b3f3bf0f370

SHA512
eb7d0d6b70ba19fcf0e2f6f15e1d28197edfcebfb2a13301a61f3a468a6afa1b64ab991a9d16c7d78f5effe6c15dbd197bc2b1bf8a9a0414589f66a5329eb73d

Download Submit
memory/380-4734-0x00007FF614260000-0x00007FF614652000-memory.dmp

Filesize
3.9MB

Download
memory/380-549-0x00007FF614260000-0x00007FF614652000-memory.dmp

Filesize
3.9MB

Download
memory/436-4538-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp

Filesize
3.9MB

Download
memory/436-360-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp

Filesize
3.9MB

Download
memory/876-4689-0x00007FF79C740000-0x00007FF79CB32000-memory.dmp

Filesize
3.9MB

Download
memory/876-546-0x00007FF79C740000-0x00007FF79CB32000-memory.dmp

Filesize
3.9MB

Download
memory/884-249-0x00007FF6E4CF0000-0x00007FF6E50E2000-memory.dmp

Filesize
3.9MB

Download
memory/884-4622-0x00007FF6E4CF0000-0x00007FF6E50E2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-553-0x00007FF67A140000-0x00007FF67A532000-memory.dmp

Filesize
3.9MB

Download
memory/1708-4526-0x00007FF67A140000-0x00007FF67A532000-memory.dmp

Filesize
3.9MB

Download
memory/1804-504-0x00007FF6B33B0000-0x00007FF6B37A2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-4717-0x00007FF6B33B0000-0x00007FF6B37A2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-544-0x00007FF676950000-0x00007FF676D42000-memory.dmp

Filesize
3.9MB

Download
memory/1840-4626-0x00007FF676950000-0x00007FF676D42000-memory.dmp

Filesize
3.9MB

Download
memory/2072-52-0x00007FF646E80000-0x00007FF647272000-memory.dmp

Filesize
3.9MB

Download
memory/2176-551-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-4487-0x00007FF67DFF0000-0x00007FF67E3E2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-550-0x00007FF664A20000-0x00007FF664E12000-memory.dmp

Filesize
3.9MB

Download
memory/2272-4690-0x00007FF664A20000-0x00007FF664E12000-memory.dmp

Filesize
3.9MB

Download
memory/2564-429-0x00007FF669230000-0x00007FF669622000-memory.dmp

Filesize
3.9MB

Download
memory/2888-93-0x00007FF7DB3C0000-0x00007FF7DB7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-195-0x00007FF7E7DF0000-0x00007FF7E81E2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-4534-0x00007FF7E7DF0000-0x00007FF7E81E2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-0-0x00007FF6C0230000-0x00007FF6C0622000-memory.dmp

Filesize
3.9MB

Download
memory/2984-4614-0x00007FF6C0230000-0x00007FF6C0622000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1-0x000001C506440000-0x000001C506450000-memory.dmp

Filesize
64KB

Download
memory/3112-4452-0x00007FF74BBA0000-0x00007FF74BF92000-memory.dmp

Filesize
3.9MB

Download
memory/3112-192-0x00007FF74BBA0000-0x00007FF74BF92000-memory.dmp

Filesize
3.9MB

Download
memory/3668-275-0x000001563C880000-0x000001563C8A2000-memory.dmp

Filesize
136KB

Download
memory/3668-31-0x00007FFFFBC00000-0x00007FFFFC6C1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-60-0x00000156240A0000-0x00000156240B0000-memory.dmp

Filesize
64KB

Download
memory/3980-4491-0x00007FF730C50000-0x00007FF731042000-memory.dmp

Filesize
3.9MB

Download
memory/3980-136-0x00007FF730C50000-0x00007FF731042000-memory.dmp

Filesize
3.9MB

Download
memory/3984-300-0x00007FF600E40000-0x00007FF601232000-memory.dmp

Filesize
3.9MB

Download
memory/4056-4682-0x00007FF76A3E0000-0x00007FF76A7D2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-548-0x00007FF76A3E0000-0x00007FF76A7D2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-554-0x00007FF6DF7D0000-0x00007FF6DFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-4718-0x00007FF6DF7D0000-0x00007FF6DFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-4723-0x00007FF6CB100000-0x00007FF6CB4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-547-0x00007FF6CB100000-0x00007FF6CB4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-552-0x00007FF7E37C0000-0x00007FF7E3BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-4620-0x00007FF7E37C0000-0x00007FF7E3BB2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-4691-0x00007FF69D600000-0x00007FF69D9F2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-545-0x00007FF69D600000-0x00007FF69D9F2000-memory.dmp

Filesize
3.9MB

Download