xmrig | 51486f19e3a82b361d7ba60df727f95305c24f7533f009337a9960f4a155cff8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
Size

2.0MB
MD5

089d4eabc309096856fe9fa57d7db236
SHA1

3697bb97d96562a3f4bb6abf6bec34dd4d011820
SHA256

51486f19e3a82b361d7ba60df727f95305c24f7533f009337a9960f4a155cff8
SHA512

718bc41fd32db8df5a23d5a5f80b1f47a2df24aa0daee02bf95d9d86726ad8b818a1f9d6cc3fa3b6d4d4d19f37c014de072953b5fbddb28b5d4da56a5ce6cb75
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGKesKBZ5Fl:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3932-186-0x00007FF7009E0000-0x00007FF700DD2000-memory.dmp	xmrig
behavioral2/memory/3484-232-0x00007FF65CA50000-0x00007FF65CE42000-memory.dmp	xmrig
behavioral2/memory/784-517-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/3460-638-0x00007FF6053D0000-0x00007FF6057C2000-memory.dmp	xmrig
behavioral2/memory/3524-622-0x00007FF71ACD0000-0x00007FF71B0C2000-memory.dmp	xmrig
behavioral2/memory/2292-516-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp	xmrig
behavioral2/memory/1372-485-0x00007FF78F400000-0x00007FF78F7F2000-memory.dmp	xmrig
behavioral2/memory/2704-438-0x00007FF6F2600000-0x00007FF6F29F2000-memory.dmp	xmrig
behavioral2/memory/3776-437-0x00007FF7482D0000-0x00007FF7486C2000-memory.dmp	xmrig
behavioral2/memory/3720-338-0x00007FF6C3830000-0x00007FF6C3C22000-memory.dmp	xmrig
behavioral2/memory/2428-329-0x00007FF62EF90000-0x00007FF62F382000-memory.dmp	xmrig
behavioral2/memory/1276-326-0x00007FF6E8C90000-0x00007FF6E9082000-memory.dmp	xmrig
behavioral2/memory/3092-331-0x00007FF708350000-0x00007FF708742000-memory.dmp	xmrig
behavioral2/memory/2244-330-0x00007FF60A700000-0x00007FF60AAF2000-memory.dmp	xmrig
behavioral2/memory/2516-294-0x00007FF6FA650000-0x00007FF6FAA42000-memory.dmp	xmrig
behavioral2/memory/4028-291-0x00007FF6B2060000-0x00007FF6B2452000-memory.dmp	xmrig
behavioral2/memory/3548-239-0x00007FF680100000-0x00007FF6804F2000-memory.dmp	xmrig
behavioral2/memory/3768-142-0x00007FF645390000-0x00007FF645782000-memory.dmp	xmrig
behavioral2/memory/668-100-0x00007FF6E4930000-0x00007FF6E4D22000-memory.dmp	xmrig
behavioral2/memory/1528-58-0x00007FF76EBB0000-0x00007FF76EFA2000-memory.dmp	xmrig
behavioral2/memory/2292-6326-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp	xmrig
behavioral2/memory/3768-6330-0x00007FF645390000-0x00007FF645782000-memory.dmp	xmrig
behavioral2/memory/1528-6334-0x00007FF76EBB0000-0x00007FF76EFA2000-memory.dmp	xmrig
behavioral2/memory/4028-6349-0x00007FF6B2060000-0x00007FF6B2452000-memory.dmp	xmrig
behavioral2/memory/4548-6340-0x00007FF687B60000-0x00007FF687F52000-memory.dmp	xmrig
behavioral2/memory/668-6344-0x00007FF6E4930000-0x00007FF6E4D22000-memory.dmp	xmrig
behavioral2/memory/3548-6363-0x00007FF680100000-0x00007FF6804F2000-memory.dmp	xmrig
behavioral2/memory/3932-6360-0x00007FF7009E0000-0x00007FF700DD2000-memory.dmp	xmrig
behavioral2/memory/1276-6369-0x00007FF6E8C90000-0x00007FF6E9082000-memory.dmp	xmrig
behavioral2/memory/3484-6354-0x00007FF65CA50000-0x00007FF65CE42000-memory.dmp	xmrig
behavioral2/memory/784-6372-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/3524-6388-0x00007FF71ACD0000-0x00007FF71B0C2000-memory.dmp	xmrig
behavioral2/memory/2704-6412-0x00007FF6F2600000-0x00007FF6F29F2000-memory.dmp	xmrig
behavioral2/memory/2244-6416-0x00007FF60A700000-0x00007FF60AAF2000-memory.dmp	xmrig
behavioral2/memory/1372-6401-0x00007FF78F400000-0x00007FF78F7F2000-memory.dmp	xmrig
behavioral2/memory/3776-6398-0x00007FF7482D0000-0x00007FF7486C2000-memory.dmp	xmrig
behavioral2/memory/3720-6392-0x00007FF6C3830000-0x00007FF6C3C22000-memory.dmp	xmrig
behavioral2/memory/2428-6390-0x00007FF62EF90000-0x00007FF62F382000-memory.dmp	xmrig
behavioral2/memory/3460-6387-0x00007FF6053D0000-0x00007FF6057C2000-memory.dmp	xmrig
behavioral2/memory/3092-6382-0x00007FF708350000-0x00007FF708742000-memory.dmp	xmrig
behavioral2/memory/2516-6375-0x00007FF6FA650000-0x00007FF6FAA42000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2292	qiYGulN.exe
4548	VrtSSzx.exe
1528	ACdvzNz.exe
668	zPxLWgV.exe
3768	VhKVjsr.exe
3932	oCoLFAs.exe
3484	PVTNJah.exe
3548	VtSufgl.exe
784	nzMcVKm.exe
4028	DRMHBaE.exe
2516	evHTDJN.exe
1276	vxjNTOT.exe
3524	cBhfmEP.exe
2428	REPKgym.exe
2244	OIFpHoI.exe
3092	jKOAIKD.exe
3460	igOmcIi.exe
3720	MkGwgYT.exe
3776	aFITEEC.exe
2704	IaIbAYk.exe
1372	pVJkWgq.exe
4432	nulDMYd.exe
644	RPYWFHy.exe
1196	ZiVFZcZ.exe
4160	oPmwqcs.exe
1432	aMwzymC.exe
844	gtFeYHm.exe
1396	zEHGElp.exe
1388	AJJXASO.exe
4340	RlpVvIO.exe
3900	CNnsPXT.exe
2324	SjPGwSh.exe
4944	hmzveee.exe
3888	QySPrMk.exe
4980	TSNgcHI.exe
4236	rbBMRwf.exe
3680	QFDCujW.exe
5108	loWdmVw.exe
2480	YwRlWNo.exe
2408	qYDPeDU.exe
1604	YaeFsXI.exe
1784	GRmcJBC.exe
4792	mWAtvdl.exe
3656	SjHQXYa.exe
4472	dmZuVLh.exe
1724	dzSnoCC.exe
2220	BNkumgx.exe
4380	EsPANkq.exe
4492	yOIApZN.exe
1844	RSkwaEp.exe
2260	emvyXxp.exe
5100	XeeISqP.exe
4356	qMguBmq.exe
1868	YbnbVza.exe
2832	GeTGHPj.exe
2200	yOAWNMP.exe
3836	ftWmqIv.exe
2300	bGVrDyq.exe
2128	XpQtkLT.exe
3116	qqWqWDn.exe
4204	SpSTetO.exe
5084	BHTIVOk.exe
4056	scfhXHo.exe
2820	kIvZobC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2448-0-0x00007FF64C0E0000-0x00007FF64C4D2000-memory.dmp	upx
behavioral2/files/0x000700000002340b-22.dat	upx
behavioral2/files/0x0007000000023409-17.dat	upx
behavioral2/files/0x0008000000023405-9.dat	upx
behavioral2/files/0x0008000000023408-8.dat	upx
behavioral2/files/0x000700000002340a-20.dat	upx
behavioral2/files/0x0007000000023410-45.dat	upx
behavioral2/memory/3932-186-0x00007FF7009E0000-0x00007FF700DD2000-memory.dmp	upx
behavioral2/memory/3484-232-0x00007FF65CA50000-0x00007FF65CE42000-memory.dmp	upx
behavioral2/memory/784-517-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp	upx
behavioral2/memory/3460-638-0x00007FF6053D0000-0x00007FF6057C2000-memory.dmp	upx
behavioral2/memory/3524-622-0x00007FF71ACD0000-0x00007FF71B0C2000-memory.dmp	upx
behavioral2/memory/2292-516-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp	upx
behavioral2/memory/1372-485-0x00007FF78F400000-0x00007FF78F7F2000-memory.dmp	upx
behavioral2/memory/2704-438-0x00007FF6F2600000-0x00007FF6F29F2000-memory.dmp	upx
behavioral2/memory/3776-437-0x00007FF7482D0000-0x00007FF7486C2000-memory.dmp	upx
behavioral2/memory/3720-338-0x00007FF6C3830000-0x00007FF6C3C22000-memory.dmp	upx
behavioral2/memory/2428-329-0x00007FF62EF90000-0x00007FF62F382000-memory.dmp	upx
behavioral2/memory/1276-326-0x00007FF6E8C90000-0x00007FF6E9082000-memory.dmp	upx
behavioral2/memory/3092-331-0x00007FF708350000-0x00007FF708742000-memory.dmp	upx
behavioral2/memory/2244-330-0x00007FF60A700000-0x00007FF60AAF2000-memory.dmp	upx
behavioral2/memory/2516-294-0x00007FF6FA650000-0x00007FF6FAA42000-memory.dmp	upx
behavioral2/memory/4028-291-0x00007FF6B2060000-0x00007FF6B2452000-memory.dmp	upx
behavioral2/memory/3548-239-0x00007FF680100000-0x00007FF6804F2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-211.dat	upx
behavioral2/files/0x0007000000023420-201.dat	upx
behavioral2/files/0x000700000002341c-190.dat	upx
behavioral2/files/0x0007000000023413-185.dat	upx
behavioral2/files/0x0007000000023430-183.dat	upx
behavioral2/files/0x000700000002342f-175.dat	upx
behavioral2/files/0x0007000000023425-171.dat	upx
behavioral2/files/0x000700000002341b-168.dat	upx
behavioral2/files/0x0007000000023424-167.dat	upx
behavioral2/files/0x000700000002342c-163.dat	upx
behavioral2/files/0x000700000002342a-161.dat	upx
behavioral2/files/0x0007000000023422-160.dat	upx
behavioral2/files/0x0007000000023429-156.dat	upx
behavioral2/files/0x0007000000023421-206.dat	upx
behavioral2/files/0x0007000000023416-154.dat	upx
behavioral2/files/0x0007000000023428-153.dat	upx
behavioral2/files/0x000700000002341e-152.dat	upx
behavioral2/files/0x000700000002341f-197.dat	upx
behavioral2/files/0x0007000000023426-150.dat	upx
behavioral2/files/0x000700000002341d-193.dat	upx
behavioral2/files/0x0007000000023415-148.dat	upx
behavioral2/files/0x0007000000023414-145.dat	upx
behavioral2/files/0x0007000000023418-139.dat	upx
behavioral2/files/0x000700000002342d-166.dat	upx
behavioral2/files/0x0007000000023423-129.dat	upx
behavioral2/files/0x0007000000023417-128.dat	upx
behavioral2/files/0x000700000002342b-162.dat	upx
behavioral2/files/0x0007000000023427-151.dat	upx
behavioral2/files/0x0007000000023411-108.dat	upx
behavioral2/memory/3768-142-0x00007FF645390000-0x00007FF645782000-memory.dmp	upx
behavioral2/memory/668-100-0x00007FF6E4930000-0x00007FF6E4D22000-memory.dmp	upx
behavioral2/files/0x0007000000023412-97.dat	upx
behavioral2/files/0x000700000002340e-87.dat	upx
behavioral2/files/0x000700000002340d-78.dat	upx
behavioral2/files/0x000700000002340f-57.dat	upx
behavioral2/files/0x000700000002340c-84.dat	upx
behavioral2/memory/4548-54-0x00007FF687B60000-0x00007FF687F52000-memory.dmp	upx
behavioral2/memory/1528-58-0x00007FF76EBB0000-0x00007FF76EFA2000-memory.dmp	upx
behavioral2/memory/2292-6326-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp	upx
behavioral2/memory/3768-6330-0x00007FF645390000-0x00007FF645782000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UdGQxOc.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\iqAToYN.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\IJmHZsb.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\kuxhbXp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\yvXwwol.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\qdPzpFa.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\hyptHjN.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\FYLfZTN.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\kmTlaKs.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\OmzTOWk.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\pxVDtDi.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\zOaLyeS.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\lfJqyTF.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\efpUqjs.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\EyMNIun.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\uyfdggE.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\lEPscQP.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\pzQOQkA.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\omMmowf.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\nAokIOq.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\ozeZcgv.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\zbVjief.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\uSAMkLj.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\clMGYUJ.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\ipUISdI.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\GLcNKSe.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\oPmwqcs.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\bdPOukw.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\nUcFLGf.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\vuhKjjW.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\YGHyqeo.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\ljpPChp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\WHcbroW.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\pUoYbWx.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\nlQEyKF.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\pCdZvkG.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\quXYgjs.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\QYKydPD.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\FOvDVET.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\JdSHBXl.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\fGVxeYp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\vbokuLn.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\kFYLyAp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\krbhMIr.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\mWYtbDn.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\zxoUjTD.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\kwZlVEQ.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\QvBoIqW.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\EABPcMe.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\sajBOjp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\bHLJfUW.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\ILYDBPn.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\wAOPGyZ.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\WMkhnWp.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\wdHnHVq.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\TQcbuDE.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\zvcgmVc.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\TeZtGWx.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\fRxUMHb.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\aBkXABM.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\uiIEAjh.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\PnWaBik.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\FlULMLz.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
File created	C:\Windows\System\eDWNrwg.exe	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeLockMemoryPrivilege	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2000	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	84
PID 2448 wrote to memory of 2000	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	84
PID 2448 wrote to memory of 2292	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	85
PID 2448 wrote to memory of 2292	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	85
PID 2448 wrote to memory of 4548	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	86
PID 2448 wrote to memory of 4548	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	86
PID 2448 wrote to memory of 1528	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	87
PID 2448 wrote to memory of 1528	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	87
PID 2448 wrote to memory of 668	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	88
PID 2448 wrote to memory of 668	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	88
PID 2448 wrote to memory of 3768	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	89
PID 2448 wrote to memory of 3768	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	89
PID 2448 wrote to memory of 3932	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	90
PID 2448 wrote to memory of 3932	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	90
PID 2448 wrote to memory of 3484	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	91
PID 2448 wrote to memory of 3484	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	91
PID 2448 wrote to memory of 3548	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	92
PID 2448 wrote to memory of 3548	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	92
PID 2448 wrote to memory of 784	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	93
PID 2448 wrote to memory of 784	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	93
PID 2448 wrote to memory of 4028	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	94
PID 2448 wrote to memory of 4028	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	94
PID 2448 wrote to memory of 1276	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	95
PID 2448 wrote to memory of 1276	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	95
PID 2448 wrote to memory of 2516	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	96
PID 2448 wrote to memory of 2516	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	96
PID 2448 wrote to memory of 2244	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	97
PID 2448 wrote to memory of 2244	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	97
PID 2448 wrote to memory of 3524	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	98
PID 2448 wrote to memory of 3524	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	98
PID 2448 wrote to memory of 2428	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	99
PID 2448 wrote to memory of 2428	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	99
PID 2448 wrote to memory of 3092	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	100
PID 2448 wrote to memory of 3092	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	100
PID 2448 wrote to memory of 644	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	101
PID 2448 wrote to memory of 644	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	101
PID 2448 wrote to memory of 4160	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	102
PID 2448 wrote to memory of 4160	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	102
PID 2448 wrote to memory of 3460	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	103
PID 2448 wrote to memory of 3460	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	103
PID 2448 wrote to memory of 3720	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	104
PID 2448 wrote to memory of 3720	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	104
PID 2448 wrote to memory of 3776	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	105
PID 2448 wrote to memory of 3776	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	105
PID 2448 wrote to memory of 1396	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	106
PID 2448 wrote to memory of 1396	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	106
PID 2448 wrote to memory of 2704	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	107
PID 2448 wrote to memory of 2704	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	107
PID 2448 wrote to memory of 1372	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	108
PID 2448 wrote to memory of 1372	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	108
PID 2448 wrote to memory of 4432	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	109
PID 2448 wrote to memory of 4432	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	109
PID 2448 wrote to memory of 3900	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	110
PID 2448 wrote to memory of 3900	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	110
PID 2448 wrote to memory of 1196	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	111
PID 2448 wrote to memory of 1196	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	111
PID 2448 wrote to memory of 4236	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	112
PID 2448 wrote to memory of 4236	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	112
PID 2448 wrote to memory of 3680	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	113
PID 2448 wrote to memory of 3680	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	113
PID 2448 wrote to memory of 1432	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	114
PID 2448 wrote to memory of 1432	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	114
PID 2448 wrote to memory of 844	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	115
PID 2448 wrote to memory of 844	2448	089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\089d4eabc309096856fe9fa57d7db236_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\System\qiYGulN.exe
  C:\Windows\System\qiYGulN.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\VrtSSzx.exe
  C:\Windows\System\VrtSSzx.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ACdvzNz.exe
  C:\Windows\System\ACdvzNz.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\zPxLWgV.exe
  C:\Windows\System\zPxLWgV.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\VhKVjsr.exe
  C:\Windows\System\VhKVjsr.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\oCoLFAs.exe
  C:\Windows\System\oCoLFAs.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\PVTNJah.exe
  C:\Windows\System\PVTNJah.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\VtSufgl.exe
  C:\Windows\System\VtSufgl.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\nzMcVKm.exe
  C:\Windows\System\nzMcVKm.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\DRMHBaE.exe
  C:\Windows\System\DRMHBaE.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\vxjNTOT.exe
  C:\Windows\System\vxjNTOT.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\evHTDJN.exe
  C:\Windows\System\evHTDJN.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\OIFpHoI.exe
  C:\Windows\System\OIFpHoI.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\cBhfmEP.exe
  C:\Windows\System\cBhfmEP.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\REPKgym.exe
  C:\Windows\System\REPKgym.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\jKOAIKD.exe
  C:\Windows\System\jKOAIKD.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\RPYWFHy.exe
  C:\Windows\System\RPYWFHy.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\oPmwqcs.exe
  C:\Windows\System\oPmwqcs.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\igOmcIi.exe
  C:\Windows\System\igOmcIi.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\MkGwgYT.exe
  C:\Windows\System\MkGwgYT.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\aFITEEC.exe
  C:\Windows\System\aFITEEC.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\zEHGElp.exe
  C:\Windows\System\zEHGElp.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\IaIbAYk.exe
  C:\Windows\System\IaIbAYk.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\pVJkWgq.exe
  C:\Windows\System\pVJkWgq.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\nulDMYd.exe
  C:\Windows\System\nulDMYd.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\CNnsPXT.exe
  C:\Windows\System\CNnsPXT.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ZiVFZcZ.exe
  C:\Windows\System\ZiVFZcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\rbBMRwf.exe
  C:\Windows\System\rbBMRwf.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\QFDCujW.exe
  C:\Windows\System\QFDCujW.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\aMwzymC.exe
  C:\Windows\System\aMwzymC.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\gtFeYHm.exe
  C:\Windows\System\gtFeYHm.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\AJJXASO.exe
  C:\Windows\System\AJJXASO.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\RlpVvIO.exe
  C:\Windows\System\RlpVvIO.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\SjPGwSh.exe
  C:\Windows\System\SjPGwSh.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\hmzveee.exe
  C:\Windows\System\hmzveee.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\QySPrMk.exe
  C:\Windows\System\QySPrMk.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\TSNgcHI.exe
  C:\Windows\System\TSNgcHI.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\GRmcJBC.exe
  C:\Windows\System\GRmcJBC.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\dmZuVLh.exe
  C:\Windows\System\dmZuVLh.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\loWdmVw.exe
  C:\Windows\System\loWdmVw.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\YwRlWNo.exe
  C:\Windows\System\YwRlWNo.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\qYDPeDU.exe
  C:\Windows\System\qYDPeDU.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\YaeFsXI.exe
  C:\Windows\System\YaeFsXI.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mWAtvdl.exe
  C:\Windows\System\mWAtvdl.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\SjHQXYa.exe
  C:\Windows\System\SjHQXYa.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\dzSnoCC.exe
  C:\Windows\System\dzSnoCC.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BNkumgx.exe
  C:\Windows\System\BNkumgx.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\EsPANkq.exe
  C:\Windows\System\EsPANkq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\yOAWNMP.exe
  C:\Windows\System\yOAWNMP.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\XpQtkLT.exe
  C:\Windows\System\XpQtkLT.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\BHTIVOk.exe
  C:\Windows\System\BHTIVOk.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\scfhXHo.exe
  C:\Windows\System\scfhXHo.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\yOIApZN.exe
  C:\Windows\System\yOIApZN.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\RSkwaEp.exe
  C:\Windows\System\RSkwaEp.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\emvyXxp.exe
  C:\Windows\System\emvyXxp.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\XeeISqP.exe
  C:\Windows\System\XeeISqP.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\qMguBmq.exe
  C:\Windows\System\qMguBmq.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\uLtxIZQ.exe
  C:\Windows\System\uLtxIZQ.exe
  2⤵
  PID:1628
- C:\Windows\System\qZzOFCr.exe
  C:\Windows\System\qZzOFCr.exe
  2⤵
  PID:436
- C:\Windows\System\YbnbVza.exe
  C:\Windows\System\YbnbVza.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\GeTGHPj.exe
  C:\Windows\System\GeTGHPj.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ftWmqIv.exe
  C:\Windows\System\ftWmqIv.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\bGVrDyq.exe
  C:\Windows\System\bGVrDyq.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\qqWqWDn.exe
  C:\Windows\System\qqWqWDn.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\SpSTetO.exe
  C:\Windows\System\SpSTetO.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\kIvZobC.exe
  C:\Windows\System\kIvZobC.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\GaVWwpe.exe
  C:\Windows\System\GaVWwpe.exe
  2⤵
  PID:2672
- C:\Windows\System\PGMhEpG.exe
  C:\Windows\System\PGMhEpG.exe
  2⤵
  PID:4600
- C:\Windows\System\xUrcKXi.exe
  C:\Windows\System\xUrcKXi.exe
  2⤵
  PID:3332
- C:\Windows\System\EAQrVDw.exe
  C:\Windows\System\EAQrVDw.exe
  2⤵
  PID:4744
- C:\Windows\System\quvYZPj.exe
  C:\Windows\System\quvYZPj.exe
  2⤵
  PID:2524
- C:\Windows\System\QzfhZOb.exe
  C:\Windows\System\QzfhZOb.exe
  2⤵
  PID:1780
- C:\Windows\System\acgeMmX.exe
  C:\Windows\System\acgeMmX.exe
  2⤵
  PID:388
- C:\Windows\System\sVinFnH.exe
  C:\Windows\System\sVinFnH.exe
  2⤵
  PID:4784
- C:\Windows\System\AbHqWZC.exe
  C:\Windows\System\AbHqWZC.exe
  2⤵
  PID:3404
- C:\Windows\System\saYjTnu.exe
  C:\Windows\System\saYjTnu.exe
  2⤵
  PID:2884
- C:\Windows\System\DHwmyar.exe
  C:\Windows\System\DHwmyar.exe
  2⤵
  PID:2788
- C:\Windows\System\OzpWvqu.exe
  C:\Windows\System\OzpWvqu.exe
  2⤵
  PID:5140
- C:\Windows\System\dZnneNC.exe
  C:\Windows\System\dZnneNC.exe
  2⤵
  PID:5156
- C:\Windows\System\zEwkuWL.exe
  C:\Windows\System\zEwkuWL.exe
  2⤵
  PID:5184
- C:\Windows\System\oBnvPpS.exe
  C:\Windows\System\oBnvPpS.exe
  2⤵
  PID:5204
- C:\Windows\System\JSsncbQ.exe
  C:\Windows\System\JSsncbQ.exe
  2⤵
  PID:5228
- C:\Windows\System\AJsSfAJ.exe
  C:\Windows\System\AJsSfAJ.exe
  2⤵
  PID:5252
- C:\Windows\System\YHovRqC.exe
  C:\Windows\System\YHovRqC.exe
  2⤵
  PID:5276
- C:\Windows\System\DlcdatH.exe
  C:\Windows\System\DlcdatH.exe
  2⤵
  PID:5296
- C:\Windows\System\ergKCCq.exe
  C:\Windows\System\ergKCCq.exe
  2⤵
  PID:5376
- C:\Windows\System\jnvGHlv.exe
  C:\Windows\System\jnvGHlv.exe
  2⤵
  PID:5400
- C:\Windows\System\OOmXVtu.exe
  C:\Windows\System\OOmXVtu.exe
  2⤵
  PID:5416
- C:\Windows\System\TrYulgS.exe
  C:\Windows\System\TrYulgS.exe
  2⤵
  PID:5456
- C:\Windows\System\SdOEYgC.exe
  C:\Windows\System\SdOEYgC.exe
  2⤵
  PID:5472
- C:\Windows\System\cvpfRHr.exe
  C:\Windows\System\cvpfRHr.exe
  2⤵
  PID:5496
- C:\Windows\System\dJcEUet.exe
  C:\Windows\System\dJcEUet.exe
  2⤵
  PID:5520
- C:\Windows\System\DTfnJEs.exe
  C:\Windows\System\DTfnJEs.exe
  2⤵
  PID:5540
- C:\Windows\System\lqDXSPS.exe
  C:\Windows\System\lqDXSPS.exe
  2⤵
  PID:5560
- C:\Windows\System\EhfGzcy.exe
  C:\Windows\System\EhfGzcy.exe
  2⤵
  PID:5576
- C:\Windows\System\Mwyuygk.exe
  C:\Windows\System\Mwyuygk.exe
  2⤵
  PID:5596
- C:\Windows\System\pjkwcsp.exe
  C:\Windows\System\pjkwcsp.exe
  2⤵
  PID:5612
- C:\Windows\System\HrzLEuN.exe
  C:\Windows\System\HrzLEuN.exe
  2⤵
  PID:5736
- C:\Windows\System\YppruGT.exe
  C:\Windows\System\YppruGT.exe
  2⤵
  PID:5752
- C:\Windows\System\IHGNakw.exe
  C:\Windows\System\IHGNakw.exe
  2⤵
  PID:5772
- C:\Windows\System\qKHrTQx.exe
  C:\Windows\System\qKHrTQx.exe
  2⤵
  PID:5796
- C:\Windows\System\fUqAqDJ.exe
  C:\Windows\System\fUqAqDJ.exe
  2⤵
  PID:5812
- C:\Windows\System\LzEzJdv.exe
  C:\Windows\System\LzEzJdv.exe
  2⤵
  PID:5836
- C:\Windows\System\SKxaHzh.exe
  C:\Windows\System\SKxaHzh.exe
  2⤵
  PID:5860
- C:\Windows\System\eKkmTGR.exe
  C:\Windows\System\eKkmTGR.exe
  2⤵
  PID:5880
- C:\Windows\System\klpHXLE.exe
  C:\Windows\System\klpHXLE.exe
  2⤵
  PID:5900
- C:\Windows\System\TVBdzMg.exe
  C:\Windows\System\TVBdzMg.exe
  2⤵
  PID:5924
- C:\Windows\System\fxfHjVu.exe
  C:\Windows\System\fxfHjVu.exe
  2⤵
  PID:5944
- C:\Windows\System\tdRKVCR.exe
  C:\Windows\System\tdRKVCR.exe
  2⤵
  PID:5964
- C:\Windows\System\CCSZxBl.exe
  C:\Windows\System\CCSZxBl.exe
  2⤵
  PID:5988
- C:\Windows\System\GUpgUOv.exe
  C:\Windows\System\GUpgUOv.exe
  2⤵
  PID:6008
- C:\Windows\System\QvNXjuD.exe
  C:\Windows\System\QvNXjuD.exe
  2⤵
  PID:6028
- C:\Windows\System\iKUcUCq.exe
  C:\Windows\System\iKUcUCq.exe
  2⤵
  PID:6044
- C:\Windows\System\eHcSdyu.exe
  C:\Windows\System\eHcSdyu.exe
  2⤵
  PID:6072
- C:\Windows\System\RzzCHXq.exe
  C:\Windows\System\RzzCHXq.exe
  2⤵
  PID:6088
- C:\Windows\System\tWGFmcW.exe
  C:\Windows\System\tWGFmcW.exe
  2⤵
  PID:6104
- C:\Windows\System\KLcunJH.exe
  C:\Windows\System\KLcunJH.exe
  2⤵
  PID:6124
- C:\Windows\System\EkWIRIz.exe
  C:\Windows\System\EkWIRIz.exe
  2⤵
  PID:6140
- C:\Windows\System\brAAyPk.exe
  C:\Windows\System\brAAyPk.exe
  2⤵
  PID:4732
- C:\Windows\System\uidxLzS.exe
  C:\Windows\System\uidxLzS.exe
  2⤵
  PID:3076
- C:\Windows\System\YFSbWHM.exe
  C:\Windows\System\YFSbWHM.exe
  2⤵
  PID:2836
- C:\Windows\System\WQAyCVn.exe
  C:\Windows\System\WQAyCVn.exe
  2⤵
  PID:5124
- C:\Windows\System\UkLDJIj.exe
  C:\Windows\System\UkLDJIj.exe
  2⤵
  PID:5220
- C:\Windows\System\aRdKcHQ.exe
  C:\Windows\System\aRdKcHQ.exe
  2⤵
  PID:1760
- C:\Windows\System\rXcQIVA.exe
  C:\Windows\System\rXcQIVA.exe
  2⤵
  PID:4228
- C:\Windows\System\AzwpeTD.exe
  C:\Windows\System\AzwpeTD.exe
  2⤵
  PID:3936
- C:\Windows\System\XMosXXQ.exe
  C:\Windows\System\XMosXXQ.exe
  2⤵
  PID:1776
- C:\Windows\System\GnLbYfV.exe
  C:\Windows\System\GnLbYfV.exe
  2⤵
  PID:4572
- C:\Windows\System\vauqUwD.exe
  C:\Windows\System\vauqUwD.exe
  2⤵
  PID:4872
- C:\Windows\System\GPdoQvi.exe
  C:\Windows\System\GPdoQvi.exe
  2⤵
  PID:4168
- C:\Windows\System\fRxkyBq.exe
  C:\Windows\System\fRxkyBq.exe
  2⤵
  PID:3296
- C:\Windows\System\vdhAlQE.exe
  C:\Windows\System\vdhAlQE.exe
  2⤵
  PID:6152
- C:\Windows\System\IBoLKjk.exe
  C:\Windows\System\IBoLKjk.exe
  2⤵
  PID:6168
- C:\Windows\System\VWVAUQM.exe
  C:\Windows\System\VWVAUQM.exe
  2⤵
  PID:6192
- C:\Windows\System\GVNsBvd.exe
  C:\Windows\System\GVNsBvd.exe
  2⤵
  PID:6260
- C:\Windows\System\rUsAZgP.exe
  C:\Windows\System\rUsAZgP.exe
  2⤵
  PID:6280
- C:\Windows\System\CSayBJr.exe
  C:\Windows\System\CSayBJr.exe
  2⤵
  PID:6312
- C:\Windows\System\lYcbutw.exe
  C:\Windows\System\lYcbutw.exe
  2⤵
  PID:6332
- C:\Windows\System\DfCWdAD.exe
  C:\Windows\System\DfCWdAD.exe
  2⤵
  PID:6356
- C:\Windows\System\IFmtWsX.exe
  C:\Windows\System\IFmtWsX.exe
  2⤵
  PID:6380
- C:\Windows\System\XtciqAQ.exe
  C:\Windows\System\XtciqAQ.exe
  2⤵
  PID:6408
- C:\Windows\System\eWELQSV.exe
  C:\Windows\System\eWELQSV.exe
  2⤵
  PID:6456
- C:\Windows\System\vrORiza.exe
  C:\Windows\System\vrORiza.exe
  2⤵
  PID:6480
- C:\Windows\System\acGuxSJ.exe
  C:\Windows\System\acGuxSJ.exe
  2⤵
  PID:6516
- C:\Windows\System\ErIuDnD.exe
  C:\Windows\System\ErIuDnD.exe
  2⤵
  PID:6548
- C:\Windows\System\lUimoST.exe
  C:\Windows\System\lUimoST.exe
  2⤵
  PID:6564
- C:\Windows\System\RdKSghT.exe
  C:\Windows\System\RdKSghT.exe
  2⤵
  PID:6580
- C:\Windows\System\GzkkqyO.exe
  C:\Windows\System\GzkkqyO.exe
  2⤵
  PID:6600
- C:\Windows\System\fUQbpDm.exe
  C:\Windows\System\fUQbpDm.exe
  2⤵
  PID:6616
- C:\Windows\System\LXmjKaq.exe
  C:\Windows\System\LXmjKaq.exe
  2⤵
  PID:6640
- C:\Windows\System\LQzqqgO.exe
  C:\Windows\System\LQzqqgO.exe
  2⤵
  PID:6664
- C:\Windows\System\bZrONbk.exe
  C:\Windows\System\bZrONbk.exe
  2⤵
  PID:6688
- C:\Windows\System\jIoORuT.exe
  C:\Windows\System\jIoORuT.exe
  2⤵
  PID:6704
- C:\Windows\System\CQttOze.exe
  C:\Windows\System\CQttOze.exe
  2⤵
  PID:6724
- C:\Windows\System\SzugKLA.exe
  C:\Windows\System\SzugKLA.exe
  2⤵
  PID:6740
- C:\Windows\System\JnlixSb.exe
  C:\Windows\System\JnlixSb.exe
  2⤵
  PID:6768
- C:\Windows\System\NvybFqX.exe
  C:\Windows\System\NvybFqX.exe
  2⤵
  PID:6788
- C:\Windows\System\RkRcZrG.exe
  C:\Windows\System\RkRcZrG.exe
  2⤵
  PID:6808
- C:\Windows\System\ttrEpUO.exe
  C:\Windows\System\ttrEpUO.exe
  2⤵
  PID:6836
- C:\Windows\System\EOTbUHg.exe
  C:\Windows\System\EOTbUHg.exe
  2⤵
  PID:6852
- C:\Windows\System\aFkEheI.exe
  C:\Windows\System\aFkEheI.exe
  2⤵
  PID:6904
- C:\Windows\System\qJPEuSc.exe
  C:\Windows\System\qJPEuSc.exe
  2⤵
  PID:6948
- C:\Windows\System\nDHDeav.exe
  C:\Windows\System\nDHDeav.exe
  2⤵
  PID:6976
- C:\Windows\System\ppQKwaP.exe
  C:\Windows\System\ppQKwaP.exe
  2⤵
  PID:7004
- C:\Windows\System\xUUSHKs.exe
  C:\Windows\System\xUUSHKs.exe
  2⤵
  PID:7020
- C:\Windows\System\RpkLHTj.exe
  C:\Windows\System\RpkLHTj.exe
  2⤵
  PID:7044
- C:\Windows\System\GaJeJRZ.exe
  C:\Windows\System\GaJeJRZ.exe
  2⤵
  PID:7068
- C:\Windows\System\jCECBKw.exe
  C:\Windows\System\jCECBKw.exe
  2⤵
  PID:7088
- C:\Windows\System\ZZKNsiB.exe
  C:\Windows\System\ZZKNsiB.exe
  2⤵
  PID:7112
- C:\Windows\System\IGnWtnS.exe
  C:\Windows\System\IGnWtnS.exe
  2⤵
  PID:7140
- C:\Windows\System\uSFxviK.exe
  C:\Windows\System\uSFxviK.exe
  2⤵
  PID:7164
- C:\Windows\System\lUtgJvj.exe
  C:\Windows\System\lUtgJvj.exe
  2⤵
  PID:1480
- C:\Windows\System\baGMfRp.exe
  C:\Windows\System\baGMfRp.exe
  2⤵
  PID:1884
- C:\Windows\System\gJEVVSV.exe
  C:\Windows\System\gJEVVSV.exe
  2⤵
  PID:2424
- C:\Windows\System\stlzujJ.exe
  C:\Windows\System\stlzujJ.exe
  2⤵
  PID:2016
- C:\Windows\System\uZLWPJC.exe
  C:\Windows\System\uZLWPJC.exe
  2⤵
  PID:5200
- C:\Windows\System\WLDkJnJ.exe
  C:\Windows\System\WLDkJnJ.exe
  2⤵
  PID:5264
- C:\Windows\System\fodLbSL.exe
  C:\Windows\System\fodLbSL.exe
  2⤵
  PID:5856
- C:\Windows\System\rCncyUK.exe
  C:\Windows\System\rCncyUK.exe
  2⤵
  PID:5284
- C:\Windows\System\IcgHkXL.exe
  C:\Windows\System\IcgHkXL.exe
  2⤵
  PID:5788
- C:\Windows\System\hXtQvpT.exe
  C:\Windows\System\hXtQvpT.exe
  2⤵
  PID:4468
- C:\Windows\System\JmCKXTu.exe
  C:\Windows\System\JmCKXTu.exe
  2⤵
  PID:5356
- C:\Windows\System\mowkQPs.exe
  C:\Windows\System\mowkQPs.exe
  2⤵
  PID:5392
- C:\Windows\System\ktQhGpH.exe
  C:\Windows\System\ktQhGpH.exe
  2⤵
  PID:5464
- C:\Windows\System\XvGidDl.exe
  C:\Windows\System\XvGidDl.exe
  2⤵
  PID:5492
- C:\Windows\System\pEYCBCx.exe
  C:\Windows\System\pEYCBCx.exe
  2⤵
  PID:5532
- C:\Windows\System\yhoQXuw.exe
  C:\Windows\System\yhoQXuw.exe
  2⤵
  PID:5588
- C:\Windows\System\MvmqVIO.exe
  C:\Windows\System\MvmqVIO.exe
  2⤵
  PID:5636
- C:\Windows\System\iLuObDn.exe
  C:\Windows\System\iLuObDn.exe
  2⤵
  PID:2872
- C:\Windows\System\rZpxpAL.exe
  C:\Windows\System\rZpxpAL.exe
  2⤵
  PID:6632
- C:\Windows\System\RaSzvXG.exe
  C:\Windows\System\RaSzvXG.exe
  2⤵
  PID:5748
- C:\Windows\System\OixBiMO.exe
  C:\Windows\System\OixBiMO.exe
  2⤵
  PID:5872
- C:\Windows\System\BigneZv.exe
  C:\Windows\System\BigneZv.exe
  2⤵
  PID:5932
- C:\Windows\System\TpYOEzM.exe
  C:\Windows\System\TpYOEzM.exe
  2⤵
  PID:6276
- C:\Windows\System\YTJxOxJ.exe
  C:\Windows\System\YTJxOxJ.exe
  2⤵
  PID:6004
- C:\Windows\System\lyjJhGO.exe
  C:\Windows\System\lyjJhGO.exe
  2⤵
  PID:6052
- C:\Windows\System\mdJSqzA.exe
  C:\Windows\System\mdJSqzA.exe
  2⤵
  PID:6348
- C:\Windows\System\zZkkivt.exe
  C:\Windows\System\zZkkivt.exe
  2⤵
  PID:6132
- C:\Windows\System\fLBCEdP.exe
  C:\Windows\System\fLBCEdP.exe
  2⤵
  PID:4864
- C:\Windows\System\VDJqusg.exe
  C:\Windows\System\VDJqusg.exe
  2⤵
  PID:4304
- C:\Windows\System\rlGDdKs.exe
  C:\Windows\System\rlGDdKs.exe
  2⤵
  PID:4344
- C:\Windows\System\Jmaywcf.exe
  C:\Windows\System\Jmaywcf.exe
  2⤵
  PID:3584
- C:\Windows\System\VWuaydS.exe
  C:\Windows\System\VWuaydS.exe
  2⤵
  PID:4308
- C:\Windows\System\YcXkgHw.exe
  C:\Windows\System\YcXkgHw.exe
  2⤵
  PID:4568
- C:\Windows\System\nNLinHv.exe
  C:\Windows\System\nNLinHv.exe
  2⤵
  PID:6164
- C:\Windows\System\CyBSHVU.exe
  C:\Windows\System\CyBSHVU.exe
  2⤵
  PID:6200
- C:\Windows\System\NeXWZzO.exe
  C:\Windows\System\NeXWZzO.exe
  2⤵
  PID:6612
- C:\Windows\System\sPFxtzp.exe
  C:\Windows\System\sPFxtzp.exe
  2⤵
  PID:7184
- C:\Windows\System\dWUCznU.exe
  C:\Windows\System\dWUCznU.exe
  2⤵
  PID:7216
- C:\Windows\System\IAAAAZb.exe
  C:\Windows\System\IAAAAZb.exe
  2⤵
  PID:7364
- C:\Windows\System\BfhGhHK.exe
  C:\Windows\System\BfhGhHK.exe
  2⤵
  PID:7380
- C:\Windows\System\dMqfdQy.exe
  C:\Windows\System\dMqfdQy.exe
  2⤵
  PID:7396
- C:\Windows\System\SVtdBWz.exe
  C:\Windows\System\SVtdBWz.exe
  2⤵
  PID:7412
- C:\Windows\System\oQndOsv.exe
  C:\Windows\System\oQndOsv.exe
  2⤵
  PID:7428
- C:\Windows\System\ZaShjpN.exe
  C:\Windows\System\ZaShjpN.exe
  2⤵
  PID:7444
- C:\Windows\System\zvcgmVc.exe
  C:\Windows\System\zvcgmVc.exe
  2⤵
  PID:7460
- C:\Windows\System\RSPUNrx.exe
  C:\Windows\System\RSPUNrx.exe
  2⤵
  PID:7476
- C:\Windows\System\sqsFmOM.exe
  C:\Windows\System\sqsFmOM.exe
  2⤵
  PID:7492
- C:\Windows\System\IiqxMEH.exe
  C:\Windows\System\IiqxMEH.exe
  2⤵
  PID:7508
- C:\Windows\System\aFUiiph.exe
  C:\Windows\System\aFUiiph.exe
  2⤵
  PID:7524
- C:\Windows\System\GiinDod.exe
  C:\Windows\System\GiinDod.exe
  2⤵
  PID:7540
- C:\Windows\System\yLATopK.exe
  C:\Windows\System\yLATopK.exe
  2⤵
  PID:7556
- C:\Windows\System\zVdAmHS.exe
  C:\Windows\System\zVdAmHS.exe
  2⤵
  PID:7572
- C:\Windows\System\jDkJvuR.exe
  C:\Windows\System\jDkJvuR.exe
  2⤵
  PID:7588
- C:\Windows\System\RFXdQCO.exe
  C:\Windows\System\RFXdQCO.exe
  2⤵
  PID:7624
- C:\Windows\System\NabMpPd.exe
  C:\Windows\System\NabMpPd.exe
  2⤵
  PID:7712
- C:\Windows\System\JQWPYPx.exe
  C:\Windows\System\JQWPYPx.exe
  2⤵
  PID:7780
- C:\Windows\System\vvzoqjX.exe
  C:\Windows\System\vvzoqjX.exe
  2⤵
  PID:7800
- C:\Windows\System\HpdQgZN.exe
  C:\Windows\System\HpdQgZN.exe
  2⤵
  PID:7892
- C:\Windows\System\cCRPyWq.exe
  C:\Windows\System\cCRPyWq.exe
  2⤵
  PID:7908
- C:\Windows\System\RttXHhT.exe
  C:\Windows\System\RttXHhT.exe
  2⤵
  PID:7924
- C:\Windows\System\WwPuMuA.exe
  C:\Windows\System\WwPuMuA.exe
  2⤵
  PID:7940
- C:\Windows\System\dQJpgBa.exe
  C:\Windows\System\dQJpgBa.exe
  2⤵
  PID:7956
- C:\Windows\System\jlBNnhW.exe
  C:\Windows\System\jlBNnhW.exe
  2⤵
  PID:7972
- C:\Windows\System\wPABQJv.exe
  C:\Windows\System\wPABQJv.exe
  2⤵
  PID:7988
- C:\Windows\System\tslizUQ.exe
  C:\Windows\System\tslizUQ.exe
  2⤵
  PID:8012
- C:\Windows\System\wSkSjAP.exe
  C:\Windows\System\wSkSjAP.exe
  2⤵
  PID:8040
- C:\Windows\System\spkusqk.exe
  C:\Windows\System\spkusqk.exe
  2⤵
  PID:8072
- C:\Windows\System\rifNvOL.exe
  C:\Windows\System\rifNvOL.exe
  2⤵
  PID:8104
- C:\Windows\System\spSkLQX.exe
  C:\Windows\System\spSkLQX.exe
  2⤵
  PID:8132
- C:\Windows\System\Qkfpjus.exe
  C:\Windows\System\Qkfpjus.exe
  2⤵
  PID:8148
- C:\Windows\System\IkdLLaf.exe
  C:\Windows\System\IkdLLaf.exe
  2⤵
  PID:8172
- C:\Windows\System\hvTtuat.exe
  C:\Windows\System\hvTtuat.exe
  2⤵
  PID:6720
- C:\Windows\System\DDvehxt.exe
  C:\Windows\System\DDvehxt.exe
  2⤵
  PID:5760
- C:\Windows\System\MqNpvBG.exe
  C:\Windows\System\MqNpvBG.exe
  2⤵
  PID:5348
- C:\Windows\System\jVQpoxd.exe
  C:\Windows\System\jVQpoxd.exe
  2⤵
  PID:7160
- C:\Windows\System\GLStZyj.exe
  C:\Windows\System\GLStZyj.exe
  2⤵
  PID:7012
- C:\Windows\System\GTfdugv.exe
  C:\Windows\System\GTfdugv.exe
  2⤵
  PID:6932
- C:\Windows\System\HBQnolz.exe
  C:\Windows\System\HBQnolz.exe
  2⤵
  PID:6864
- C:\Windows\System\brjSpbY.exe
  C:\Windows\System\brjSpbY.exe
  2⤵
  PID:6736
- C:\Windows\System\jxMJBZI.exe
  C:\Windows\System\jxMJBZI.exe
  2⤵
  PID:6656
- C:\Windows\System\XCIlpps.exe
  C:\Windows\System\XCIlpps.exe
  2⤵
  PID:6532
- C:\Windows\System\ltzkXBQ.exe
  C:\Windows\System\ltzkXBQ.exe
  2⤵
  PID:6448
- C:\Windows\System\mQTXjDo.exe
  C:\Windows\System\mQTXjDo.exe
  2⤵
  PID:6376
- C:\Windows\System\HulLKJk.exe
  C:\Windows\System\HulLKJk.exe
  2⤵
  PID:7036
- C:\Windows\System\oMyeGmZ.exe
  C:\Windows\System\oMyeGmZ.exe
  2⤵
  PID:7104
- C:\Windows\System\ccUuDZU.exe
  C:\Windows\System\ccUuDZU.exe
  2⤵
  PID:376
- C:\Windows\System\AZGYZYA.exe
  C:\Windows\System\AZGYZYA.exe
  2⤵
  PID:5172
- C:\Windows\System\vfBbKWe.exe
  C:\Windows\System\vfBbKWe.exe
  2⤵
  PID:5820
- C:\Windows\System\UukUYyE.exe
  C:\Windows\System\UukUYyE.exe
  2⤵
  PID:5340
- C:\Windows\System\vLDoQAG.exe
  C:\Windows\System\vLDoQAG.exe
  2⤵
  PID:5488
- C:\Windows\System\aUqoPOO.exe
  C:\Windows\System\aUqoPOO.exe
  2⤵
  PID:5584
- C:\Windows\System\tDwiOVO.exe
  C:\Windows\System\tDwiOVO.exe
  2⤵
  PID:6624
- C:\Windows\System\qxuMUMc.exe
  C:\Windows\System\qxuMUMc.exe
  2⤵
  PID:5916
- C:\Windows\System\JMJKhyI.exe
  C:\Windows\System\JMJKhyI.exe
  2⤵
  PID:6784
- C:\Windows\System\QzFUjgw.exe
  C:\Windows\System\QzFUjgw.exe
  2⤵
  PID:6080
- C:\Windows\System\vgJKsqP.exe
  C:\Windows\System\vgJKsqP.exe
  2⤵
  PID:1472
- C:\Windows\System\isyZBNO.exe
  C:\Windows\System\isyZBNO.exe
  2⤵
  PID:2592
- C:\Windows\System\tMXxGXp.exe
  C:\Windows\System\tMXxGXp.exe
  2⤵
  PID:6160
- C:\Windows\System\QWcKWOY.exe
  C:\Windows\System\QWcKWOY.exe
  2⤵
  PID:7176
- C:\Windows\System\NFxYYKm.exe
  C:\Windows\System\NFxYYKm.exe
  2⤵
  PID:8344
- C:\Windows\System\uFTrulo.exe
  C:\Windows\System\uFTrulo.exe
  2⤵
  PID:8360
- C:\Windows\System\DidQxdV.exe
  C:\Windows\System\DidQxdV.exe
  2⤵
  PID:8380
- C:\Windows\System\KjTSiyC.exe
  C:\Windows\System\KjTSiyC.exe
  2⤵
  PID:8400
- C:\Windows\System\sHDZstH.exe
  C:\Windows\System\sHDZstH.exe
  2⤵
  PID:8416
- C:\Windows\System\RBSHkBq.exe
  C:\Windows\System\RBSHkBq.exe
  2⤵
  PID:8436
- C:\Windows\System\gJVOKFP.exe
  C:\Windows\System\gJVOKFP.exe
  2⤵
  PID:8456
- C:\Windows\System\TCOBNVT.exe
  C:\Windows\System\TCOBNVT.exe
  2⤵
  PID:8476
- C:\Windows\System\DVvVwqd.exe
  C:\Windows\System\DVvVwqd.exe
  2⤵
  PID:8492
- C:\Windows\System\qQFNcEf.exe
  C:\Windows\System\qQFNcEf.exe
  2⤵
  PID:8512
- C:\Windows\System\fQUPnzz.exe
  C:\Windows\System\fQUPnzz.exe
  2⤵
  PID:8532
- C:\Windows\System\SiPIeVJ.exe
  C:\Windows\System\SiPIeVJ.exe
  2⤵
  PID:8552
- C:\Windows\System\MLrpXhc.exe
  C:\Windows\System\MLrpXhc.exe
  2⤵
  PID:8572
- C:\Windows\System\clqHGvT.exe
  C:\Windows\System\clqHGvT.exe
  2⤵
  PID:8592
- C:\Windows\System\TMmehvt.exe
  C:\Windows\System\TMmehvt.exe
  2⤵
  PID:8608
- C:\Windows\System\cCqsdKj.exe
  C:\Windows\System\cCqsdKj.exe
  2⤵
  PID:8628
- C:\Windows\System\CvNFzYe.exe
  C:\Windows\System\CvNFzYe.exe
  2⤵
  PID:8648
- C:\Windows\System\xayaEGl.exe
  C:\Windows\System\xayaEGl.exe
  2⤵
  PID:8668
- C:\Windows\System\YAYxeNB.exe
  C:\Windows\System\YAYxeNB.exe
  2⤵
  PID:8684
- C:\Windows\System\jWsQFUE.exe
  C:\Windows\System\jWsQFUE.exe
  2⤵
  PID:8700
- C:\Windows\System\qHQGrQl.exe
  C:\Windows\System\qHQGrQl.exe
  2⤵
  PID:8716
- C:\Windows\System\bftfKTv.exe
  C:\Windows\System\bftfKTv.exe
  2⤵
  PID:8732
- C:\Windows\System\ARXqjwU.exe
  C:\Windows\System\ARXqjwU.exe
  2⤵
  PID:8784
- C:\Windows\System\EvkERTF.exe
  C:\Windows\System\EvkERTF.exe
  2⤵
  PID:8816
- C:\Windows\System\GNelljq.exe
  C:\Windows\System\GNelljq.exe
  2⤵
  PID:8832
- C:\Windows\System\lmSiluz.exe
  C:\Windows\System\lmSiluz.exe
  2⤵
  PID:8868
- C:\Windows\System\JjrfzKj.exe
  C:\Windows\System\JjrfzKj.exe
  2⤵
  PID:8892
- C:\Windows\System\yHsQneY.exe
  C:\Windows\System\yHsQneY.exe
  2⤵
  PID:8928
- C:\Windows\System\qWAROMJ.exe
  C:\Windows\System\qWAROMJ.exe
  2⤵
  PID:8964
- C:\Windows\System\NBbRzfN.exe
  C:\Windows\System\NBbRzfN.exe
  2⤵
  PID:8992
- C:\Windows\System\ogRvYIo.exe
  C:\Windows\System\ogRvYIo.exe
  2⤵
  PID:9028
- C:\Windows\System\kBCJWdL.exe
  C:\Windows\System\kBCJWdL.exe
  2⤵
  PID:9056
- C:\Windows\System\zTPffRu.exe
  C:\Windows\System\zTPffRu.exe
  2⤵
  PID:9088
- C:\Windows\System\VgEOtQz.exe
  C:\Windows\System\VgEOtQz.exe
  2⤵
  PID:9112
- C:\Windows\System\HyCvrwj.exe
  C:\Windows\System\HyCvrwj.exe
  2⤵
  PID:9128
- C:\Windows\System\PyOfXeA.exe
  C:\Windows\System\PyOfXeA.exe
  2⤵
  PID:9152
- C:\Windows\System\KLcabtl.exe
  C:\Windows\System\KLcabtl.exe
  2⤵
  PID:9172
- C:\Windows\System\kOEkCNT.exe
  C:\Windows\System\kOEkCNT.exe
  2⤵
  PID:9196
- C:\Windows\System\KbuKNbn.exe
  C:\Windows\System\KbuKNbn.exe
  2⤵
  PID:1928
- C:\Windows\System\zlsKVRT.exe
  C:\Windows\System\zlsKVRT.exe
  2⤵
  PID:7772
- C:\Windows\System\MhqcpEf.exe
  C:\Windows\System\MhqcpEf.exe
  2⤵
  PID:7884
- C:\Windows\System\WziFubk.exe
  C:\Windows\System\WziFubk.exe
  2⤵
  PID:8048
- C:\Windows\System\xgoxuyJ.exe
  C:\Windows\System\xgoxuyJ.exe
  2⤵
  PID:7096
- C:\Windows\System\xBmFqNW.exe
  C:\Windows\System\xBmFqNW.exe
  2⤵
  PID:6832
- C:\Windows\System\XglVZom.exe
  C:\Windows\System\XglVZom.exe
  2⤵
  PID:6496
- C:\Windows\System\EWptRIf.exe
  C:\Windows\System\EWptRIf.exe
  2⤵
  PID:4860
- C:\Windows\System\fSpdogP.exe
  C:\Windows\System\fSpdogP.exe
  2⤵
  PID:6816
- C:\Windows\System\vQAmwyQ.exe
  C:\Windows\System\vQAmwyQ.exe
  2⤵
  PID:7120
- C:\Windows\System\rZmKkav.exe
  C:\Windows\System\rZmKkav.exe
  2⤵
  PID:464
- C:\Windows\System\yVUzrou.exe
  C:\Windows\System\yVUzrou.exe
  2⤵
  PID:5960
- C:\Windows\System\kyWOnPh.exe
  C:\Windows\System\kyWOnPh.exe
  2⤵
  PID:7876
- C:\Windows\System\DgNGYuC.exe
  C:\Windows\System\DgNGYuC.exe
  2⤵
  PID:8000
- C:\Windows\System\CdOQckN.exe
  C:\Windows\System\CdOQckN.exe
  2⤵
  PID:8092
- C:\Windows\System\wQfNKWK.exe
  C:\Windows\System\wQfNKWK.exe
  2⤵
  PID:9232
- C:\Windows\System\UocKzNy.exe
  C:\Windows\System\UocKzNy.exe
  2⤵
  PID:9252
- C:\Windows\System\zQWTTTG.exe
  C:\Windows\System\zQWTTTG.exe
  2⤵
  PID:9272
- C:\Windows\System\VnQzjdk.exe
  C:\Windows\System\VnQzjdk.exe
  2⤵
  PID:9292
- C:\Windows\System\DiflzkK.exe
  C:\Windows\System\DiflzkK.exe
  2⤵
  PID:9312
- C:\Windows\System\lIWLrxd.exe
  C:\Windows\System\lIWLrxd.exe
  2⤵
  PID:9332
- C:\Windows\System\eybLYoz.exe
  C:\Windows\System\eybLYoz.exe
  2⤵
  PID:9348
- C:\Windows\System\YUhdPAX.exe
  C:\Windows\System\YUhdPAX.exe
  2⤵
  PID:9372
- C:\Windows\System\dpHntyr.exe
  C:\Windows\System\dpHntyr.exe
  2⤵
  PID:9392
- C:\Windows\System\HiLEFLo.exe
  C:\Windows\System\HiLEFLo.exe
  2⤵
  PID:9412
- C:\Windows\System\XPxIYKn.exe
  C:\Windows\System\XPxIYKn.exe
  2⤵
  PID:9432
- C:\Windows\System\WtSPaPS.exe
  C:\Windows\System\WtSPaPS.exe
  2⤵
  PID:9456
- C:\Windows\System\KVmhUnY.exe
  C:\Windows\System\KVmhUnY.exe
  2⤵
  PID:9476
- C:\Windows\System\fqFzfmq.exe
  C:\Windows\System\fqFzfmq.exe
  2⤵
  PID:9500
- C:\Windows\System\DtaghvC.exe
  C:\Windows\System\DtaghvC.exe
  2⤵
  PID:9524
- C:\Windows\System\ynOEooP.exe
  C:\Windows\System\ynOEooP.exe
  2⤵
  PID:9548
- C:\Windows\System\bixFedW.exe
  C:\Windows\System\bixFedW.exe
  2⤵
  PID:9568
- C:\Windows\System\RwmmEQZ.exe
  C:\Windows\System\RwmmEQZ.exe
  2⤵
  PID:9592
- C:\Windows\System\bsYnnho.exe
  C:\Windows\System\bsYnnho.exe
  2⤵
  PID:9616
- C:\Windows\System\XsiGQpc.exe
  C:\Windows\System\XsiGQpc.exe
  2⤵
  PID:9636
- C:\Windows\System\IzOXAAH.exe
  C:\Windows\System\IzOXAAH.exe
  2⤵
  PID:9656
- C:\Windows\System\zzjokJh.exe
  C:\Windows\System\zzjokJh.exe
  2⤵
  PID:9680
- C:\Windows\System\vAHsgCL.exe
  C:\Windows\System\vAHsgCL.exe
  2⤵
  PID:9704
- C:\Windows\System\orsZDDH.exe
  C:\Windows\System\orsZDDH.exe
  2⤵
  PID:9728
- C:\Windows\System\HRhuFzS.exe
  C:\Windows\System\HRhuFzS.exe
  2⤵
  PID:9744
- C:\Windows\System\mIZtFKk.exe
  C:\Windows\System\mIZtFKk.exe
  2⤵
  PID:9768
- C:\Windows\System\HKpeeKj.exe
  C:\Windows\System\HKpeeKj.exe
  2⤵
  PID:9788
- C:\Windows\System\qlQgysO.exe
  C:\Windows\System\qlQgysO.exe
  2⤵
  PID:9840
- C:\Windows\System\eEYSRev.exe
  C:\Windows\System\eEYSRev.exe
  2⤵
  PID:9860
- C:\Windows\System\hBMiQjs.exe
  C:\Windows\System\hBMiQjs.exe
  2⤵
  PID:9880
- C:\Windows\System\cUJrSKx.exe
  C:\Windows\System\cUJrSKx.exe
  2⤵
  PID:9904
- C:\Windows\System\GZzxvGX.exe
  C:\Windows\System\GZzxvGX.exe
  2⤵
  PID:9932
- C:\Windows\System\zuOJaKH.exe
  C:\Windows\System\zuOJaKH.exe
  2⤵
  PID:9952
- C:\Windows\System\gHEgeAR.exe
  C:\Windows\System\gHEgeAR.exe
  2⤵
  PID:9972
- C:\Windows\System\FyAYqMj.exe
  C:\Windows\System\FyAYqMj.exe
  2⤵
  PID:9992
- C:\Windows\System\QFZlxDF.exe
  C:\Windows\System\QFZlxDF.exe
  2⤵
  PID:10016
- C:\Windows\System\HadxyzM.exe
  C:\Windows\System\HadxyzM.exe
  2⤵
  PID:10040
- C:\Windows\System\goKOdqA.exe
  C:\Windows\System\goKOdqA.exe
  2⤵
  PID:10060
- C:\Windows\System\wPKacNg.exe
  C:\Windows\System\wPKacNg.exe
  2⤵
  PID:10084
- C:\Windows\System\SDwYWIG.exe
  C:\Windows\System\SDwYWIG.exe
  2⤵
  PID:10104
- C:\Windows\System\aWDrXRf.exe
  C:\Windows\System\aWDrXRf.exe
  2⤵
  PID:10124
- C:\Windows\System\TpvwOxH.exe
  C:\Windows\System\TpvwOxH.exe
  2⤵
  PID:10148
- C:\Windows\System\RimaQCr.exe
  C:\Windows\System\RimaQCr.exe
  2⤵
  PID:10168
- C:\Windows\System\BBlYvFk.exe
  C:\Windows\System\BBlYvFk.exe
  2⤵
  PID:10192
- C:\Windows\System\diHjMtA.exe
  C:\Windows\System\diHjMtA.exe
  2⤵
  PID:10216
- C:\Windows\System\DRqEiQq.exe
  C:\Windows\System\DRqEiQq.exe
  2⤵
  PID:8120
- C:\Windows\System\GPTigfY.exe
  C:\Windows\System\GPTigfY.exe
  2⤵
  PID:3480
- C:\Windows\System\audjSUc.exe
  C:\Windows\System\audjSUc.exe
  2⤵
  PID:7156
- C:\Windows\System\OyACBxq.exe
  C:\Windows\System\OyACBxq.exe
  2⤵
  PID:6328
- C:\Windows\System\PbWjAdx.exe
  C:\Windows\System\PbWjAdx.exe
  2⤵
  PID:1172
- C:\Windows\System\vWSBAgS.exe
  C:\Windows\System\vWSBAgS.exe
  2⤵
  PID:3348
- C:\Windows\System\ClwUIQi.exe
  C:\Windows\System\ClwUIQi.exe
  2⤵
  PID:7388
- C:\Windows\System\eZWIsjg.exe
  C:\Windows\System\eZWIsjg.exe
  2⤵
  PID:7424
- C:\Windows\System\DHWZvFz.exe
  C:\Windows\System\DHWZvFz.exe
  2⤵
  PID:7468
- C:\Windows\System\BpuIUEC.exe
  C:\Windows\System\BpuIUEC.exe
  2⤵
  PID:7516
- C:\Windows\System\CFelmlq.exe
  C:\Windows\System\CFelmlq.exe
  2⤵
  PID:7564
- C:\Windows\System\mCLSXCh.exe
  C:\Windows\System\mCLSXCh.exe
  2⤵
  PID:7612
- C:\Windows\System\EVfKPkw.exe
  C:\Windows\System\EVfKPkw.exe
  2⤵
  PID:7808
- C:\Windows\System\pMTncTJ.exe
  C:\Windows\System\pMTncTJ.exe
  2⤵
  PID:7832
- C:\Windows\System\QOqlFhp.exe
  C:\Windows\System\QOqlFhp.exe
  2⤵
  PID:7868
- C:\Windows\System\DYFzeuh.exe
  C:\Windows\System\DYFzeuh.exe
  2⤵
  PID:8616
- C:\Windows\System\tpeUeQn.exe
  C:\Windows\System\tpeUeQn.exe
  2⤵
  PID:8656
- C:\Windows\System\eecTshS.exe
  C:\Windows\System\eecTshS.exe
  2⤵
  PID:7932
- C:\Windows\System\szPIWXm.exe
  C:\Windows\System\szPIWXm.exe
  2⤵
  PID:8676
- C:\Windows\System\decnzzU.exe
  C:\Windows\System\decnzzU.exe
  2⤵
  PID:8692
- C:\Windows\System\wLSMvjY.exe
  C:\Windows\System\wLSMvjY.exe
  2⤵
  PID:9220
- C:\Windows\System\VIPLnOj.exe
  C:\Windows\System\VIPLnOj.exe
  2⤵
  PID:8180
- C:\Windows\System\FrrKTrf.exe
  C:\Windows\System\FrrKTrf.exe
  2⤵
  PID:9260
- C:\Windows\System\eBhanRm.exe
  C:\Windows\System\eBhanRm.exe
  2⤵
  PID:7016
- C:\Windows\System\OtUJJum.exe
  C:\Windows\System\OtUJJum.exe
  2⤵
  PID:6556
- C:\Windows\System\rfFVpdI.exe
  C:\Windows\System\rfFVpdI.exe
  2⤵
  PID:9340
- C:\Windows\System\cvFYXiF.exe
  C:\Windows\System\cvFYXiF.exe
  2⤵
  PID:5240
- C:\Windows\System\BXCnxZU.exe
  C:\Windows\System\BXCnxZU.exe
  2⤵
  PID:5528
- C:\Windows\System\QmbDWom.exe
  C:\Windows\System\QmbDWom.exe
  2⤵
  PID:5724
- C:\Windows\System\HEpzlRj.exe
  C:\Windows\System\HEpzlRj.exe
  2⤵
  PID:9472
- C:\Windows\System\ApxVmLP.exe
  C:\Windows\System\ApxVmLP.exe
  2⤵
  PID:9700
- C:\Windows\System\JwMOQqP.exe
  C:\Windows\System\JwMOQqP.exe
  2⤵
  PID:9784
- C:\Windows\System\zTrxAqj.exe
  C:\Windows\System\zTrxAqj.exe
  2⤵
  PID:10256
- C:\Windows\System\MtQNhIl.exe
  C:\Windows\System\MtQNhIl.exe
  2⤵
  PID:10280
- C:\Windows\System\oFwfpoc.exe
  C:\Windows\System\oFwfpoc.exe
  2⤵
  PID:10316
- C:\Windows\System\tVaEPka.exe
  C:\Windows\System\tVaEPka.exe
  2⤵
  PID:10332
- C:\Windows\System\SxvLcIo.exe
  C:\Windows\System\SxvLcIo.exe
  2⤵
  PID:10348
- C:\Windows\System\UCjfMTB.exe
  C:\Windows\System\UCjfMTB.exe
  2⤵
  PID:10372
- C:\Windows\System\swHRnqs.exe
  C:\Windows\System\swHRnqs.exe
  2⤵
  PID:10392
- C:\Windows\System\dpskQIC.exe
  C:\Windows\System\dpskQIC.exe
  2⤵
  PID:10416
- C:\Windows\System\YDVrFCT.exe
  C:\Windows\System\YDVrFCT.exe
  2⤵
  PID:10440
- C:\Windows\System\zCuSTfs.exe
  C:\Windows\System\zCuSTfs.exe
  2⤵
  PID:10456
- C:\Windows\System\qqkVlps.exe
  C:\Windows\System\qqkVlps.exe
  2⤵
  PID:10476
- C:\Windows\System\kljenGU.exe
  C:\Windows\System\kljenGU.exe
  2⤵
  PID:10492
- C:\Windows\System\prdTmCc.exe
  C:\Windows\System\prdTmCc.exe
  2⤵
  PID:10512
- C:\Windows\System\fKfCyYU.exe
  C:\Windows\System\fKfCyYU.exe
  2⤵
  PID:10532
- C:\Windows\System\bHpZhjP.exe
  C:\Windows\System\bHpZhjP.exe
  2⤵
  PID:10556
- C:\Windows\System\TFBuwYo.exe
  C:\Windows\System\TFBuwYo.exe
  2⤵
  PID:10580
- C:\Windows\System\vyxABEQ.exe
  C:\Windows\System\vyxABEQ.exe
  2⤵
  PID:10596
- C:\Windows\System\sVuOQxB.exe
  C:\Windows\System\sVuOQxB.exe
  2⤵
  PID:10624
- C:\Windows\System\GaBTpxH.exe
  C:\Windows\System\GaBTpxH.exe
  2⤵
  PID:10644
- C:\Windows\System\BLsIhvE.exe
  C:\Windows\System\BLsIhvE.exe
  2⤵
  PID:10660
- C:\Windows\System\zMWdvMs.exe
  C:\Windows\System\zMWdvMs.exe
  2⤵
  PID:10684
- C:\Windows\System\DYDNTie.exe
  C:\Windows\System\DYDNTie.exe
  2⤵
  PID:10712
- C:\Windows\System\EyjndLL.exe
  C:\Windows\System\EyjndLL.exe
  2⤵
  PID:10732
- C:\Windows\System\YBNIhoU.exe
  C:\Windows\System\YBNIhoU.exe
  2⤵
  PID:10756
- C:\Windows\System\DQojjEN.exe
  C:\Windows\System\DQojjEN.exe
  2⤵
  PID:10780
- C:\Windows\System\RqFUKoa.exe
  C:\Windows\System\RqFUKoa.exe
  2⤵
  PID:10804
- C:\Windows\System\pzMimVo.exe
  C:\Windows\System\pzMimVo.exe
  2⤵
  PID:10824
- C:\Windows\System\FMlFOGA.exe
  C:\Windows\System\FMlFOGA.exe
  2⤵
  PID:10848
- C:\Windows\System\FsdUpSz.exe
  C:\Windows\System\FsdUpSz.exe
  2⤵
  PID:10868
- C:\Windows\System\ksNEUyf.exe
  C:\Windows\System\ksNEUyf.exe
  2⤵
  PID:10888
- C:\Windows\System\fwtWVlX.exe
  C:\Windows\System\fwtWVlX.exe
  2⤵
  PID:10912
- C:\Windows\System\Eeakkmo.exe
  C:\Windows\System\Eeakkmo.exe
  2⤵
  PID:10940
- C:\Windows\System\gkZadrZ.exe
  C:\Windows\System\gkZadrZ.exe
  2⤵
  PID:10956
- C:\Windows\System\wvPJjNe.exe
  C:\Windows\System\wvPJjNe.exe
  2⤵
  PID:10976
- C:\Windows\System\RDBTJsB.exe
  C:\Windows\System\RDBTJsB.exe
  2⤵
  PID:11004
- C:\Windows\System\dKGqYGI.exe
  C:\Windows\System\dKGqYGI.exe
  2⤵
  PID:11028
- C:\Windows\System\eqvzYjy.exe
  C:\Windows\System\eqvzYjy.exe
  2⤵
  PID:11048
- C:\Windows\System\ZvntfFR.exe
  C:\Windows\System\ZvntfFR.exe
  2⤵
  PID:11076
- C:\Windows\System\dRAGjXu.exe
  C:\Windows\System\dRAGjXu.exe
  2⤵
  PID:11096
- C:\Windows\System\NjZvbwl.exe
  C:\Windows\System\NjZvbwl.exe
  2⤵
  PID:11116
- C:\Windows\System\eLzGjfd.exe
  C:\Windows\System\eLzGjfd.exe
  2⤵
  PID:11140
- C:\Windows\System\BPFPELr.exe
  C:\Windows\System\BPFPELr.exe
  2⤵
  PID:11164
- C:\Windows\System\YNjloxV.exe
  C:\Windows\System\YNjloxV.exe
  2⤵
  PID:11192
- C:\Windows\System\tDciZKL.exe
  C:\Windows\System\tDciZKL.exe
  2⤵
  PID:11220
- C:\Windows\System\gftaSIj.exe
  C:\Windows\System\gftaSIj.exe
  2⤵
  PID:11240
- C:\Windows\System\rxkqrSm.exe
  C:\Windows\System\rxkqrSm.exe
  2⤵
  PID:11260
- C:\Windows\System\xucrdHI.exe
  C:\Windows\System\xucrdHI.exe
  2⤵
  PID:8376
- C:\Windows\System\LGLPZCG.exe
  C:\Windows\System\LGLPZCG.exe
  2⤵
  PID:8408
- C:\Windows\System\PYQnAkc.exe
  C:\Windows\System\PYQnAkc.exe
  2⤵
  PID:8448
- C:\Windows\System\MWeAgwF.exe
  C:\Windows\System\MWeAgwF.exe
  2⤵
  PID:8488
- C:\Windows\System\tDnJeCR.exe
  C:\Windows\System\tDnJeCR.exe
  2⤵
  PID:8540
- C:\Windows\System\zNgPjAS.exe
  C:\Windows\System\zNgPjAS.exe
  2⤵
  PID:8580
- C:\Windows\System\myYRhmd.exe
  C:\Windows\System\myYRhmd.exe
  2⤵
  PID:9852
- C:\Windows\System\ryTxVcc.exe
  C:\Windows\System\ryTxVcc.exe
  2⤵
  PID:8712
- C:\Windows\System\TBHOaHi.exe
  C:\Windows\System\TBHOaHi.exe
  2⤵
  PID:9228
- C:\Windows\System\FPGjsrB.exe
  C:\Windows\System\FPGjsrB.exe
  2⤵
  PID:8156
- C:\Windows\System\zKltWCr.exe
  C:\Windows\System\zKltWCr.exe
  2⤵
  PID:9268
- C:\Windows\System\AUkKQSH.exe
  C:\Windows\System\AUkKQSH.exe
  2⤵
  PID:9024
- C:\Windows\System\zEBqAlc.exe
  C:\Windows\System\zEBqAlc.exe
  2⤵
  PID:8988
- C:\Windows\System\GBjhHDS.exe
  C:\Windows\System\GBjhHDS.exe
  2⤵
  PID:9048
- C:\Windows\System\EVLZPai.exe
  C:\Windows\System\EVLZPai.exe
  2⤵
  PID:7500
- C:\Windows\System\EGGENCH.exe
  C:\Windows\System\EGGENCH.exe
  2⤵
  PID:9140
- C:\Windows\System\PmDXKSv.exe
  C:\Windows\System\PmDXKSv.exe
  2⤵
  PID:11268
- C:\Windows\System\IejPtug.exe
  C:\Windows\System\IejPtug.exe
  2⤵
  PID:11292
- C:\Windows\System\xlrTowc.exe
  C:\Windows\System\xlrTowc.exe
  2⤵
  PID:11312
- C:\Windows\System\jsjGKXG.exe
  C:\Windows\System\jsjGKXG.exe
  2⤵
  PID:11332
- C:\Windows\System\QdvZvoo.exe
  C:\Windows\System\QdvZvoo.exe
  2⤵
  PID:11356
- C:\Windows\System\hHRhfpL.exe
  C:\Windows\System\hHRhfpL.exe
  2⤵
  PID:11372
- C:\Windows\System\VxTrAxe.exe
  C:\Windows\System\VxTrAxe.exe
  2⤵
  PID:11396
- C:\Windows\System\GWlEEEm.exe
  C:\Windows\System\GWlEEEm.exe
  2⤵
  PID:11416
- C:\Windows\System\aIymZDQ.exe
  C:\Windows\System\aIymZDQ.exe
  2⤵
  PID:11440
- C:\Windows\System\ZqmBxFH.exe
  C:\Windows\System\ZqmBxFH.exe
  2⤵
  PID:11464
- C:\Windows\System\CckzZSJ.exe
  C:\Windows\System\CckzZSJ.exe
  2⤵
  PID:11484
- C:\Windows\System\umetTUH.exe
  C:\Windows\System\umetTUH.exe
  2⤵
  PID:11508
- C:\Windows\System\IzOMDsT.exe
  C:\Windows\System\IzOMDsT.exe
  2⤵
  PID:11548
- C:\Windows\System\tnfQUwP.exe
  C:\Windows\System\tnfQUwP.exe
  2⤵
  PID:11564
- C:\Windows\System\GkOCQDO.exe
  C:\Windows\System\GkOCQDO.exe
  2⤵
  PID:11588
- C:\Windows\System\honAgJt.exe
  C:\Windows\System\honAgJt.exe
  2⤵
  PID:11604
- C:\Windows\System\uXHfCUz.exe
  C:\Windows\System\uXHfCUz.exe
  2⤵
  PID:11620
- C:\Windows\System\qwTeQxq.exe
  C:\Windows\System\qwTeQxq.exe
  2⤵
  PID:11636
- C:\Windows\System\aowVdrr.exe
  C:\Windows\System\aowVdrr.exe
  2⤵
  PID:11652
- C:\Windows\System\soSlQAe.exe
  C:\Windows\System\soSlQAe.exe
  2⤵
  PID:11668
- C:\Windows\System\kpUhnJx.exe
  C:\Windows\System\kpUhnJx.exe
  2⤵
  PID:11688
- C:\Windows\System\scoYTuA.exe
  C:\Windows\System\scoYTuA.exe
  2⤵
  PID:11712
- C:\Windows\System\JcEaFtC.exe
  C:\Windows\System\JcEaFtC.exe
  2⤵
  PID:11732
- C:\Windows\System\CsIjDsK.exe
  C:\Windows\System\CsIjDsK.exe
  2⤵
  PID:11756
- C:\Windows\System\sgviUNe.exe
  C:\Windows\System\sgviUNe.exe
  2⤵
  PID:11792
- C:\Windows\System\AyVjFiR.exe
  C:\Windows\System\AyVjFiR.exe
  2⤵
  PID:11812
- C:\Windows\System\XOAufGW.exe
  C:\Windows\System\XOAufGW.exe
  2⤵
  PID:11832
- C:\Windows\System\lIHVavD.exe
  C:\Windows\System\lIHVavD.exe
  2⤵
  PID:11848
- C:\Windows\System\YiUMYyt.exe
  C:\Windows\System\YiUMYyt.exe
  2⤵
  PID:11864
- C:\Windows\System\hSpywZe.exe
  C:\Windows\System\hSpywZe.exe
  2⤵
  PID:11884
- C:\Windows\System\PKHFBQO.exe
  C:\Windows\System\PKHFBQO.exe
  2⤵
  PID:11904
- C:\Windows\System\cSFkwwz.exe
  C:\Windows\System\cSFkwwz.exe
  2⤵
  PID:11924
- C:\Windows\System\vfvljHF.exe
  C:\Windows\System\vfvljHF.exe
  2⤵
  PID:11952
- C:\Windows\System\ytBhpUa.exe
  C:\Windows\System\ytBhpUa.exe
  2⤵
  PID:11976
- C:\Windows\System\aQiFSBt.exe
  C:\Windows\System\aQiFSBt.exe
  2⤵
  PID:11996
- C:\Windows\System\NdkYOUG.exe
  C:\Windows\System\NdkYOUG.exe
  2⤵
  PID:12024
- C:\Windows\System\nDCjyJj.exe
  C:\Windows\System\nDCjyJj.exe
  2⤵
  PID:12040
- C:\Windows\System\hUGEJHS.exe
  C:\Windows\System\hUGEJHS.exe
  2⤵
  PID:12060
- C:\Windows\System\efALliJ.exe
  C:\Windows\System\efALliJ.exe
  2⤵
  PID:12088
- C:\Windows\System\HEpbZeU.exe
  C:\Windows\System\HEpbZeU.exe
  2⤵
  PID:12112
- C:\Windows\System\eGWOtlG.exe
  C:\Windows\System\eGWOtlG.exe
  2⤵
  PID:9240
- C:\Windows\System\SDhJXRZ.exe
  C:\Windows\System\SDhJXRZ.exe
  2⤵
  PID:7080
- C:\Windows\System\XwJBukr.exe
  C:\Windows\System\XwJBukr.exe
  2⤵
  PID:8116
- C:\Windows\System\rdFZgvH.exe
  C:\Windows\System\rdFZgvH.exe
  2⤵
  PID:8028
- C:\Windows\System\GLIwfHd.exe
  C:\Windows\System\GLIwfHd.exe
  2⤵
  PID:10520
- C:\Windows\System\NMnvmBS.exe
  C:\Windows\System\NMnvmBS.exe
  2⤵
  PID:9892
- C:\Windows\System\rQnmuhZ.exe
  C:\Windows\System\rQnmuhZ.exe
  2⤵
  PID:4216
- C:\Windows\System\feXSmQv.exe
  C:\Windows\System\feXSmQv.exe
  2⤵
  PID:9984
- C:\Windows\System\gIDaUwi.exe
  C:\Windows\System\gIDaUwi.exe
  2⤵
  PID:8708
- C:\Windows\System\SXBfmuS.exe
  C:\Windows\System\SXBfmuS.exe
  2⤵
  PID:10056
- C:\Windows\System\vohginx.exe
  C:\Windows\System\vohginx.exe
  2⤵
  PID:10116
- C:\Windows\System\xdJdeHV.exe
  C:\Windows\System\xdJdeHV.exe
  2⤵
  PID:10164
- C:\Windows\System\BRAsvWL.exe
  C:\Windows\System\BRAsvWL.exe
  2⤵
  PID:10236
- C:\Windows\System\PgJQXnl.exe
  C:\Windows\System\PgJQXnl.exe
  2⤵
  PID:9324
- C:\Windows\System\YfelDNz.exe
  C:\Windows\System\YfelDNz.exe
  2⤵
  PID:7404
- C:\Windows\System\THBArFe.exe
  C:\Windows\System\THBArFe.exe
  2⤵
  PID:7484
- C:\Windows\System\mbyMxCx.exe
  C:\Windows\System\mbyMxCx.exe
  2⤵
  PID:7828
- C:\Windows\System\CEUDKtl.exe
  C:\Windows\System\CEUDKtl.exe
  2⤵
  PID:9192
- C:\Windows\System\uYoPWoc.exe
  C:\Windows\System\uYoPWoc.exe
  2⤵
  PID:8600
- C:\Windows\System\jeTgYcN.exe
  C:\Windows\System\jeTgYcN.exe
  2⤵
  PID:3096
- C:\Windows\System\JMJIncW.exe
  C:\Windows\System\JMJIncW.exe
  2⤵
  PID:9424
- C:\Windows\System\kTrUNsk.exe
  C:\Windows\System\kTrUNsk.exe
  2⤵
  PID:8640
- C:\Windows\System\DaHrOIo.exe
  C:\Windows\System\DaHrOIo.exe
  2⤵
  PID:9536
- C:\Windows\System\mhOLYuH.exe
  C:\Windows\System\mhOLYuH.exe
  2⤵
  PID:9608
- C:\Windows\System\XwuYRzI.exe
  C:\Windows\System\XwuYRzI.exe
  2⤵
  PID:9632
- C:\Windows\System\KyqjamT.exe
  C:\Windows\System\KyqjamT.exe
  2⤵
  PID:9664
- C:\Windows\System\snFgLlu.exe
  C:\Windows\System\snFgLlu.exe
  2⤵
  PID:12316
- C:\Windows\System\qyOSEVB.exe
  C:\Windows\System\qyOSEVB.exe
  2⤵
  PID:12336
- C:\Windows\System\gECWGNq.exe
  C:\Windows\System\gECWGNq.exe
  2⤵
  PID:12356
- C:\Windows\System\VDRkWMv.exe
  C:\Windows\System\VDRkWMv.exe
  2⤵
  PID:12380
- C:\Windows\System\EHweKvO.exe
  C:\Windows\System\EHweKvO.exe
  2⤵
  PID:12404
- C:\Windows\System\ZOsmsHg.exe
  C:\Windows\System\ZOsmsHg.exe
  2⤵
  PID:12424
- C:\Windows\System\VJYdSFI.exe
  C:\Windows\System\VJYdSFI.exe
  2⤵
  PID:12444
- C:\Windows\System\BhTlsPG.exe
  C:\Windows\System\BhTlsPG.exe
  2⤵
  PID:12472
- C:\Windows\System\dkqlbIT.exe
  C:\Windows\System\dkqlbIT.exe
  2⤵
  PID:12496
- C:\Windows\System\lEanweQ.exe
  C:\Windows\System\lEanweQ.exe
  2⤵
  PID:12520
- C:\Windows\System\pTHvjUd.exe
  C:\Windows\System\pTHvjUd.exe
  2⤵
  PID:12536
- C:\Windows\System\EEdAZUW.exe
  C:\Windows\System\EEdAZUW.exe
  2⤵
  PID:12580
- C:\Windows\System\zouTHcP.exe
  C:\Windows\System\zouTHcP.exe
  2⤵
  PID:12596
- C:\Windows\System\jxpfKVW.exe
  C:\Windows\System\jxpfKVW.exe
  2⤵
  PID:12612
- C:\Windows\System\lnwvLoI.exe
  C:\Windows\System\lnwvLoI.exe
  2⤵
  PID:12632
- C:\Windows\System\VKJiNsm.exe
  C:\Windows\System\VKJiNsm.exe
  2⤵
  PID:12656
- C:\Windows\System\KSOmHQr.exe
  C:\Windows\System\KSOmHQr.exe
  2⤵
  PID:12676
- C:\Windows\System\ObgPsQO.exe
  C:\Windows\System\ObgPsQO.exe
  2⤵
  PID:12708
- C:\Windows\System\iTPnKtS.exe
  C:\Windows\System\iTPnKtS.exe
  2⤵
  PID:12724
- C:\Windows\System\kKWegts.exe
  C:\Windows\System\kKWegts.exe
  2⤵
  PID:12744
- C:\Windows\System\vaaXELJ.exe
  C:\Windows\System\vaaXELJ.exe
  2⤵
  PID:12760
- C:\Windows\System\HMbffsp.exe
  C:\Windows\System\HMbffsp.exe
  2⤵
  PID:12780
- C:\Windows\System\lyJXmVx.exe
  C:\Windows\System\lyJXmVx.exe
  2⤵
  PID:12804
- C:\Windows\System\buQRqBs.exe
  C:\Windows\System\buQRqBs.exe
  2⤵
  PID:12832
- C:\Windows\System\lAuqTtP.exe
  C:\Windows\System\lAuqTtP.exe
  2⤵
  PID:12856
- C:\Windows\System\YgyyOcZ.exe
  C:\Windows\System\YgyyOcZ.exe
  2⤵
  PID:12888
- C:\Windows\System\KbIOLsM.exe
  C:\Windows\System\KbIOLsM.exe
  2⤵
  PID:12908
- C:\Windows\System\OVcAJfs.exe
  C:\Windows\System\OVcAJfs.exe
  2⤵
  PID:12944
- C:\Windows\System\rfKoaWX.exe
  C:\Windows\System\rfKoaWX.exe
  2⤵
  PID:12976
- C:\Windows\System\llcGXKz.exe
  C:\Windows\System\llcGXKz.exe
  2⤵
  PID:12992
- C:\Windows\System\cMXHLHE.exe
  C:\Windows\System\cMXHLHE.exe
  2⤵
  PID:13012
- C:\Windows\System\jqMmYLO.exe
  C:\Windows\System\jqMmYLO.exe
  2⤵
  PID:13028
- C:\Windows\System\GkNDPVA.exe
  C:\Windows\System\GkNDPVA.exe
  2⤵
  PID:13048
- C:\Windows\System\CihOPTY.exe
  C:\Windows\System\CihOPTY.exe
  2⤵
  PID:13064
- C:\Windows\System\ISzXIyA.exe
  C:\Windows\System\ISzXIyA.exe
  2⤵
  PID:13092
- C:\Windows\System\yhQwuux.exe
  C:\Windows\System\yhQwuux.exe
  2⤵
  PID:13112
- C:\Windows\System\szxWXqi.exe
  C:\Windows\System\szxWXqi.exe
  2⤵
  PID:13132
- C:\Windows\System\zvCWOAA.exe
  C:\Windows\System\zvCWOAA.exe
  2⤵
  PID:13152
- C:\Windows\System\AjHvdVO.exe
  C:\Windows\System\AjHvdVO.exe
  2⤵
  PID:13172
- C:\Windows\System\XlJXcLr.exe
  C:\Windows\System\XlJXcLr.exe
  2⤵
  PID:13196
- C:\Windows\System\dpWeEYx.exe
  C:\Windows\System\dpWeEYx.exe
  2⤵
  PID:13216
- C:\Windows\System\JMpvabF.exe
  C:\Windows\System\JMpvabF.exe
  2⤵
  PID:13240
- C:\Windows\System\edZbzhL.exe
  C:\Windows\System\edZbzhL.exe
  2⤵
  PID:13260
- C:\Windows\System\ubgJKKN.exe
  C:\Windows\System\ubgJKKN.exe
  2⤵
  PID:13284
- C:\Windows\System\mIlOArY.exe
  C:\Windows\System\mIlOArY.exe
  2⤵
  PID:13308
- C:\Windows\System\ZcgsHJs.exe
  C:\Windows\System\ZcgsHJs.exe
  2⤵
  PID:9724
- C:\Windows\System\QWpXTTB.exe
  C:\Windows\System\QWpXTTB.exe
  2⤵
  PID:11504
- C:\Windows\System\QufCzPj.exe
  C:\Windows\System\QufCzPj.exe
  2⤵
  PID:9780
- C:\Windows\System\nxjfyUj.exe
  C:\Windows\System\nxjfyUj.exe
  2⤵
  PID:9828
- C:\Windows\System\JedpuEU.exe
  C:\Windows\System\JedpuEU.exe
  2⤵
  PID:9912
- C:\Windows\System\YmRsdyG.exe
  C:\Windows\System\YmRsdyG.exe
  2⤵
  PID:10680
- C:\Windows\System\rsJHiIr.exe
  C:\Windows\System\rsJHiIr.exe
  2⤵
  PID:12016
- C:\Windows\System\RewqvJU.exe
  C:\Windows\System\RewqvJU.exe
  2⤵
  PID:9988
- C:\Windows\System\MeqtnZH.exe
  C:\Windows\System\MeqtnZH.exe
  2⤵
  PID:12080
- C:\Windows\System\alnEGIg.exe
  C:\Windows\System\alnEGIg.exe
  2⤵
  PID:10004
- C:\Windows\System\rbGrKwT.exe
  C:\Windows\System\rbGrKwT.exe
  2⤵
  PID:10856
- C:\Windows\System\qyVaJNm.exe
  C:\Windows\System\qyVaJNm.exe
  2⤵
  PID:10908
- C:\Windows\System\ukKExDp.exe
  C:\Windows\System\ukKExDp.exe
  2⤵
  PID:10948
- C:\Windows\System\ObpGOoO.exe
  C:\Windows\System\ObpGOoO.exe
  2⤵
  PID:11056
- C:\Windows\System\AjsxmHp.exe
  C:\Windows\System\AjsxmHp.exe
  2⤵
  PID:10120
- C:\Windows\System\dsPfIjJ.exe
  C:\Windows\System\dsPfIjJ.exe
  2⤵
  PID:13952
- C:\Windows\System\KxWVhod.exe
  C:\Windows\System\KxWVhod.exe
  2⤵
  PID:13972
- C:\Windows\System\RRYaUne.exe
  C:\Windows\System\RRYaUne.exe
  2⤵
  PID:13992
- C:\Windows\System\dqnysXd.exe
  C:\Windows\System\dqnysXd.exe
  2⤵
  PID:14024
- C:\Windows\System\fPRsNog.exe
  C:\Windows\System\fPRsNog.exe
  2⤵
  PID:14044
- C:\Windows\System\kKQYCAS.exe
  C:\Windows\System\kKQYCAS.exe
  2⤵
  PID:14072
- C:\Windows\System\IWlfCYt.exe
  C:\Windows\System\IWlfCYt.exe
  2⤵
  PID:14096
- C:\Windows\System\PzyPgLj.exe
  C:\Windows\System\PzyPgLj.exe
  2⤵
  PID:14120
- C:\Windows\System\uIRXcey.exe
  C:\Windows\System\uIRXcey.exe
  2⤵
  PID:14144
- C:\Windows\System\SSiTlGs.exe
  C:\Windows\System\SSiTlGs.exe
  2⤵
  PID:14172
- C:\Windows\System\zMvdzWF.exe
  C:\Windows\System\zMvdzWF.exe
  2⤵
  PID:14192
- C:\Windows\System\wxSXpyz.exe
  C:\Windows\System\wxSXpyz.exe
  2⤵
  PID:14208
- C:\Windows\System\IedYhdb.exe
  C:\Windows\System\IedYhdb.exe
  2⤵
  PID:14224
- C:\Windows\System\wllHDwk.exe
  C:\Windows\System\wllHDwk.exe
  2⤵
  PID:14240
- C:\Windows\System\gHedlxr.exe
  C:\Windows\System\gHedlxr.exe
  2⤵
  PID:14256
- C:\Windows\System\sKMlLbH.exe
  C:\Windows\System\sKMlLbH.exe
  2⤵
  PID:14280
- C:\Windows\System\QpryplD.exe
  C:\Windows\System\QpryplD.exe
  2⤵
  PID:14304
- C:\Windows\System\HqnRCJQ.exe
  C:\Windows\System\HqnRCJQ.exe
  2⤵
  PID:14332
- C:\Windows\System\JDirHIJ.exe
  C:\Windows\System\JDirHIJ.exe
  2⤵
  PID:8368
- C:\Windows\System\gcQPOgj.exe
  C:\Windows\System\gcQPOgj.exe
  2⤵
  PID:7360
- C:\Windows\System\pmVkEdk.exe
  C:\Windows\System\pmVkEdk.exe
  2⤵
  PID:8796
- C:\Windows\System\LQVbZPK.exe
  C:\Windows\System\LQVbZPK.exe
  2⤵
  PID:8984
- C:\Windows\System\uBAiXEe.exe
  C:\Windows\System\uBAiXEe.exe
  2⤵
  PID:7796
- C:\Windows\System\chvyAav.exe
  C:\Windows\System\chvyAav.exe
  2⤵
  PID:11304
- C:\Windows\System\OufsiPt.exe
  C:\Windows\System\OufsiPt.exe
  2⤵
  PID:8740
- C:\Windows\System\cqJOaKW.exe
  C:\Windows\System\cqJOaKW.exe
  2⤵
  PID:9440
- C:\Windows\System\LerZFZX.exe
  C:\Windows\System\LerZFZX.exe
  2⤵
  PID:7348
- C:\Windows\System\vggcOmP.exe
  C:\Windows\System\vggcOmP.exe
  2⤵
  PID:3840
- C:\Windows\System\aAZMENA.exe
  C:\Windows\System\aAZMENA.exe
  2⤵
  PID:11476
- C:\Windows\System\bpMvZhh.exe
  C:\Windows\System\bpMvZhh.exe
  2⤵
  PID:11524
- C:\Windows\System\ZgsmsQB.exe
  C:\Windows\System\ZgsmsQB.exe
  2⤵
  PID:9576
- C:\Windows\System\WoECCpa.exe
  C:\Windows\System\WoECCpa.exe
  2⤵
  PID:10264
- C:\Windows\System\fxBStRb.exe
  C:\Windows\System\fxBStRb.exe
  2⤵
  PID:10312
- C:\Windows\System\aXSbonR.exe
  C:\Windows\System\aXSbonR.exe
  2⤵
  PID:10356
- C:\Windows\System\aejBOcH.exe
  C:\Windows\System\aejBOcH.exe
  2⤵
  PID:10408
- C:\Windows\System\iYbhDaK.exe
  C:\Windows\System\iYbhDaK.exe
  2⤵
  PID:4124
- C:\Windows\System\ADkvdpo.exe
  C:\Windows\System\ADkvdpo.exe
  2⤵
  PID:10656
- C:\Windows\System\KwLxABj.exe
  C:\Windows\System\KwLxABj.exe
  2⤵
  PID:10700
- C:\Windows\System\wAOPGyZ.exe
  C:\Windows\System\wAOPGyZ.exe
  2⤵
  PID:12124
- C:\Windows\System\WZplRue.exe
  C:\Windows\System\WZplRue.exe
  2⤵
  PID:10904
- C:\Windows\System\OrUdHwV.exe
  C:\Windows\System\OrUdHwV.exe
  2⤵
  PID:13168
- C:\Windows\System\DoUJaFk.exe
  C:\Windows\System\DoUJaFk.exe
  2⤵
  PID:11460
- C:\Windows\System\PDRCaFM.exe
  C:\Windows\System\PDRCaFM.exe
  2⤵
  PID:8340
- C:\Windows\System\vbjTFtI.exe
  C:\Windows\System\vbjTFtI.exe
  2⤵
  PID:8548
- C:\Windows\System\wuooKPp.exe
  C:\Windows\System\wuooKPp.exe
  2⤵
  PID:14008
- C:\Windows\System\AKaYNqP.exe
  C:\Windows\System\AKaYNqP.exe
  2⤵
  PID:13544
- C:\Windows\System\cXFGCvc.exe
  C:\Windows\System\cXFGCvc.exe
  2⤵
  PID:13528
- C:\Windows\System\pMJOtEt.exe
  C:\Windows\System\pMJOtEt.exe
  2⤵
  PID:11088
- C:\Windows\System\oqtZroS.exe
  C:\Windows\System\oqtZroS.exe
  2⤵
  PID:10076
- C:\Windows\System\hlQRnZb.exe
  C:\Windows\System\hlQRnZb.exe
  2⤵
  PID:10028
- C:\Windows\System\gxoVhPA.exe
  C:\Windows\System\gxoVhPA.exe
  2⤵
  PID:10820
- C:\Windows\System\xmqmsOs.exe
  C:\Windows\System\xmqmsOs.exe
  2⤵
  PID:11992
- C:\Windows\System\aSnKGJe.exe
  C:\Windows\System\aSnKGJe.exe
  2⤵
  PID:9808
- C:\Windows\System\USFsCBy.exe
  C:\Windows\System\USFsCBy.exe
  2⤵
  PID:13212
- C:\Windows\System\RWfEljh.exe
  C:\Windows\System\RWfEljh.exe
  2⤵
  PID:13036
- C:\Windows\System\nIifGnc.exe
  C:\Windows\System\nIifGnc.exe
  2⤵
  PID:12952
- C:\Windows\System\pbWNkQJ.exe
  C:\Windows\System\pbWNkQJ.exe
  2⤵
  PID:12864
- C:\Windows\System\uaMaOld.exe
  C:\Windows\System\uaMaOld.exe
  2⤵
  PID:12812
- C:\Windows\System\RwCRVPx.exe
  C:\Windows\System\RwCRVPx.exe
  2⤵
  PID:12752
- C:\Windows\System\nYyfFyT.exe
  C:\Windows\System\nYyfFyT.exe
  2⤵
  PID:12716
- C:\Windows\System\bKwQHCU.exe
  C:\Windows\System\bKwQHCU.exe
  2⤵
  PID:12648
- C:\Windows\System\GTVKtQE.exe
  C:\Windows\System\GTVKtQE.exe
  2⤵
  PID:9360
- C:\Windows\System\RCJGNWE.exe
  C:\Windows\System\RCJGNWE.exe
  2⤵
  PID:11232
- C:\Windows\System\nfnitQh.exe
  C:\Windows\System\nfnitQh.exe
  2⤵
  PID:10156
- C:\Windows\System\cOMnOLm.exe
  C:\Windows\System\cOMnOLm.exe
  2⤵
  PID:2376
- C:\Windows\System\aRsQisg.exe
  C:\Windows\System\aRsQisg.exe
  2⤵
  PID:10500
- C:\Windows\System\sCOXJCE.exe
  C:\Windows\System\sCOXJCE.exe
  2⤵
  PID:9516
- C:\Windows\System\qYMblsh.exe
  C:\Windows\System\qYMblsh.exe
  2⤵
  PID:12244
- C:\Windows\System\GeWnFeG.exe
  C:\Windows\System\GeWnFeG.exe
  2⤵
  PID:12212
- C:\Windows\System\znQnrVA.exe
  C:\Windows\System\znQnrVA.exe
  2⤵
  PID:1852
- C:\Windows\System\jECqwgK.exe
  C:\Windows\System\jECqwgK.exe
  2⤵
  PID:11872
- C:\Windows\System\XyqzRSE.exe
  C:\Windows\System\XyqzRSE.exe
  2⤵
  PID:11840
- C:\Windows\System\SJSZeSS.exe
  C:\Windows\System\SJSZeSS.exe
  2⤵
  PID:11788
- C:\Windows\System\jnYFMJK.exe
  C:\Windows\System\jnYFMJK.exe
  2⤵
  PID:11724
- C:\Windows\System\sWNLFqE.exe
  C:\Windows\System\sWNLFqE.exe
  2⤵
  PID:11684
- C:\Windows\System\bRJKTfk.exe
  C:\Windows\System\bRJKTfk.exe
  2⤵
  PID:11632
- C:\Windows\System\EeERkUS.exe
  C:\Windows\System\EeERkUS.exe
  2⤵
  PID:11576
- C:\Windows\System\bFwkjJb.exe
  C:\Windows\System\bFwkjJb.exe
  2⤵
  PID:12436
- C:\Windows\System\IKvraYs.exe
  C:\Windows\System\IKvraYs.exe
  2⤵
  PID:5804
- C:\Windows\System\WCXVNaB.exe
  C:\Windows\System\WCXVNaB.exe
  2⤵
  PID:13632
- C:\Windows\System\foPLRUe.exe
  C:\Windows\System\foPLRUe.exe
  2⤵
  PID:13672
- C:\Windows\System\RuTFmvX.exe
  C:\Windows\System\RuTFmvX.exe
  2⤵
  PID:13700
- C:\Windows\System\BtGayBP.exe
  C:\Windows\System\BtGayBP.exe
  2⤵
  PID:8828
- C:\Windows\System\lColDtP.exe
  C:\Windows\System\lColDtP.exe
  2⤵
  PID:10232
- C:\Windows\System\CbDXLHO.exe
  C:\Windows\System\CbDXLHO.exe
  2⤵
  PID:13328
- C:\Windows\System\osnshKj.exe
  C:\Windows\System\osnshKj.exe
  2⤵
  PID:13460
- C:\Windows\System\lJnbxnR.exe
  C:\Windows\System\lJnbxnR.exe
  2⤵
  PID:11064
- C:\Windows\System\OAVcrrx.exe
  C:\Windows\System\OAVcrrx.exe
  2⤵
  PID:2440
- C:\Windows\System\UpvNVRe.exe
  C:\Windows\System\UpvNVRe.exe
  2⤵
  PID:13868
- C:\Windows\System\FrqdiZE.exe
  C:\Windows\System\FrqdiZE.exe
  2⤵
  PID:13888
- C:\Windows\System\XwbUCiY.exe
  C:\Windows\System\XwbUCiY.exe
  2⤵
  PID:13624
- C:\Windows\System\newrhXq.exe
  C:\Windows\System\newrhXq.exe
  2⤵
  PID:3472
- C:\Windows\System\IMARtbM.exe
  C:\Windows\System\IMARtbM.exe
  2⤵
  PID:1592
- C:\Windows\System\OhXvOYr.exe
  C:\Windows\System\OhXvOYr.exe
  2⤵
  PID:13944
- C:\Windows\System\XwNCVGu.exe
  C:\Windows\System\XwNCVGu.exe
  2⤵
  PID:13980
- C:\Windows\System\JGDlxkO.exe
  C:\Windows\System\JGDlxkO.exe
  2⤵
  PID:10468
- C:\Windows\System\GHdCsUd.exe
  C:\Windows\System\GHdCsUd.exe
  2⤵
  PID:9836
- C:\Windows\System\BYcfwVG.exe
  C:\Windows\System\BYcfwVG.exe
  2⤵
  PID:8840
- C:\Windows\System\dDjLGsH.exe
  C:\Windows\System\dDjLGsH.exe
  2⤵
  PID:13476
- C:\Windows\System\ZlcVVjJ.exe
  C:\Windows\System\ZlcVVjJ.exe
  2⤵
  PID:12984
- C:\Windows\System\FArRJJV.exe
  C:\Windows\System\FArRJJV.exe
  2⤵
  PID:12720
- C:\Windows\System\SKKfxnB.exe
  C:\Windows\System\SKKfxnB.exe
  2⤵
  PID:12332
- C:\Windows\System\EBPHaxt.exe
  C:\Windows\System\EBPHaxt.exe
  2⤵
  PID:13820
- C:\Windows\System\qfxrcrL.exe
  C:\Windows\System\qfxrcrL.exe
  2⤵
  PID:10576
- C:\Windows\System\uzbwddg.exe
  C:\Windows\System\uzbwddg.exe
  2⤵
  PID:11388
- C:\Windows\System\QxARasL.exe
  C:\Windows\System\QxARasL.exe
  2⤵
  PID:1860
- C:\Windows\System\etGfsPw.exe
  C:\Windows\System\etGfsPw.exe
  2⤵
  PID:1212
- C:\Windows\System\nlIcXMH.exe
  C:\Windows\System\nlIcXMH.exe
  2⤵
  PID:13076
- C:\Windows\System\wKDpOgJ.exe
  C:\Windows\System\wKDpOgJ.exe
  2⤵
  PID:9940
- C:\Windows\System\JDaUGvq.exe
  C:\Windows\System\JDaUGvq.exe
  2⤵
  PID:12736
- C:\Windows\System\eBtWRvF.exe
  C:\Windows\System\eBtWRvF.exe
  2⤵
  PID:13756
- C:\Windows\System\kiInQmj.exe
  C:\Windows\System\kiInQmj.exe
  2⤵
  PID:3448
- C:\Windows\System\EKLLfNi.exe
  C:\Windows\System\EKLLfNi.exe
  2⤵
  PID:14252
- C:\Windows\System\lQAmvDE.exe
  C:\Windows\System\lQAmvDE.exe
  2⤵
  PID:13532
- C:\Windows\System\ZrpQslC.exe
  C:\Windows\System\ZrpQslC.exe
  2⤵
  PID:11744
- C:\Windows\System\CgqIuSI.exe
  C:\Windows\System\CgqIuSI.exe
  2⤵
  PID:13988
- C:\Windows\System\hIPPGEr.exe
  C:\Windows\System\hIPPGEr.exe
  2⤵
  PID:3100
- C:\Windows\System\TBFghDz.exe
  C:\Windows\System\TBFghDz.exe
  2⤵
  PID:5048
- C:\Windows\System\snyroSE.exe
  C:\Windows\System\snyroSE.exe
  2⤵
  PID:2928
- C:\Windows\System\yFJHLFS.exe
  C:\Windows\System\yFJHLFS.exe
  2⤵
  PID:10504
- C:\Windows\System\CUEawWN.exe
  C:\Windows\System\CUEawWN.exe
  2⤵
  PID:1812
- C:\Windows\System\putvUdn.exe
  C:\Windows\System\putvUdn.exe
  2⤵
  PID:13816
- C:\Windows\System\WfGwHJn.exe
  C:\Windows\System\WfGwHJn.exe
  2⤵
  PID:3684
- C:\Windows\System\htozJom.exe
  C:\Windows\System\htozJom.exe
  2⤵
  PID:13300
- C:\Windows\System\cmHluAM.exe
  C:\Windows\System\cmHluAM.exe
  2⤵
  PID:12364
- C:\Windows\System\UfXKGUf.exe
  C:\Windows\System\UfXKGUf.exe
  2⤵
  PID:7708
- C:\Windows\System\jhtJJhI.exe
  C:\Windows\System\jhtJJhI.exe
  2⤵
  PID:3972
- C:\Windows\System\QuHDnNR.exe
  C:\Windows\System\QuHDnNR.exe
  2⤵
  PID:10188
- C:\Windows\System\CXPEDvX.exe
  C:\Windows\System\CXPEDvX.exe
  2⤵
  PID:10052
- C:\Windows\System\yvwQXEn.exe
  C:\Windows\System\yvwQXEn.exe
  2⤵
  PID:11804
- C:\Windows\System\WsccqiN.exe
  C:\Windows\System\WsccqiN.exe
  2⤵
  PID:11988
- C:\Windows\System\uQmOzwH.exe
  C:\Windows\System\uQmOzwH.exe
  2⤵
  PID:10844
- C:\Windows\System\NpwRCWn.exe
  C:\Windows\System\NpwRCWn.exe
  2⤵
  PID:9896
- C:\Windows\System\QfiYkgE.exe
  C:\Windows\System\QfiYkgE.exe
  2⤵
  PID:14132
- C:\Windows\System\tokxSPy.exe
  C:\Windows\System\tokxSPy.exe
  2⤵
  PID:2888
- C:\Windows\System\LBPKcBU.exe
  C:\Windows\System\LBPKcBU.exe
  2⤵
  PID:11408
- C:\Windows\System\OqGzGeK.exe
  C:\Windows\System\OqGzGeK.exe
  2⤵
  PID:12264
- C:\Windows\System\LjOgtQq.exe
  C:\Windows\System\LjOgtQq.exe
  2⤵
  PID:4404
- C:\Windows\System\CWxBACp.exe
  C:\Windows\System\CWxBACp.exe
  2⤵
  PID:12848
- C:\Windows\System\wujJDcx.exe
  C:\Windows\System\wujJDcx.exe
  2⤵
  PID:5020
- C:\Windows\System\nBsscmU.exe
  C:\Windows\System\nBsscmU.exe
  2⤵
  PID:372
- C:\Windows\System\ymRnKLO.exe
  C:\Windows\System\ymRnKLO.exe
  2⤵
  PID:10720
- C:\Windows\System\ENSWoHf.exe
  C:\Windows\System\ENSWoHf.exe
  2⤵
  PID:14300
- C:\Windows\System\xeDavlF.exe
  C:\Windows\System\xeDavlF.exe
  2⤵
  PID:14128
- C:\Windows\System\ldOhEEb.exe
  C:\Windows\System\ldOhEEb.exe
  2⤵
  PID:13600
- C:\Windows\System\PnIbtKv.exe
  C:\Windows\System\PnIbtKv.exe
  2⤵
  PID:11184
- C:\Windows\System\wRwRoig.exe
  C:\Windows\System\wRwRoig.exe
  2⤵
  PID:9264
- C:\Windows\System\sMqRisY.exe
  C:\Windows\System\sMqRisY.exe
  2⤵
  PID:12376
- C:\Windows\System\QuGzYSq.exe
  C:\Windows\System\QuGzYSq.exe
  2⤵
  PID:13404
- C:\Windows\System\gXcxqrb.exe
  C:\Windows\System\gXcxqrb.exe
  2⤵
  PID:13644
- C:\Windows\System\kYApeUy.exe
  C:\Windows\System\kYApeUy.exe
  2⤵
  PID:10604
- C:\Windows\System\RAeVrTc.exe
  C:\Windows\System\RAeVrTc.exe
  2⤵
  PID:3152
- C:\Windows\System\anXwcJr.exe
  C:\Windows\System\anXwcJr.exe
  2⤵
  PID:2284
- C:\Windows\System\RTPzyCO.exe
  C:\Windows\System\RTPzyCO.exe
  2⤵
  PID:11856
- C:\Windows\System\IPZcJSU.exe
  C:\Windows\System\IPZcJSU.exe
  2⤵
  PID:8528
- C:\Windows\System\fDCIuaD.exe
  C:\Windows\System\fDCIuaD.exe
  2⤵
  PID:13832
- C:\Windows\System\wlAQyaP.exe
  C:\Windows\System\wlAQyaP.exe
  2⤵
  PID:8624
- C:\Windows\System\norWNJL.exe
  C:\Windows\System\norWNJL.exe
  2⤵
  PID:14056
- C:\Windows\System\PjjQKNO.exe
  C:\Windows\System\PjjQKNO.exe
  2⤵
  PID:12324
- C:\Windows\System\mduJnSU.exe
  C:\Windows\System\mduJnSU.exe
  2⤵
  PID:8560
- C:\Windows\System\CFIVGnW.exe
  C:\Windows\System\CFIVGnW.exe
  2⤵
  PID:3652
- C:\Windows\System\KndEPZE.exe
  C:\Windows\System\KndEPZE.exe
  2⤵
  PID:2868
- C:\Windows\System\qdBiEzQ.exe
  C:\Windows\System\qdBiEzQ.exe
  2⤵
  PID:3312
- C:\Windows\System\oYyjSgk.exe
  C:\Windows\System\oYyjSgk.exe
  2⤵
  PID:1580
- C:\Windows\System\DAoMBah.exe
  C:\Windows\System\DAoMBah.exe
  2⤵
  PID:5292
- C:\Windows\System\pdPKCAT.exe
  C:\Windows\System\pdPKCAT.exe
  2⤵
  PID:1428
- C:\Windows\System\sYZCrNP.exe
  C:\Windows\System\sYZCrNP.exe
  2⤵
  PID:4888
- C:\Windows\System\ROgYsZz.exe
  C:\Windows\System\ROgYsZz.exe
  2⤵
  PID:4916
- C:\Windows\System\lNvLiXq.exe
  C:\Windows\System\lNvLiXq.exe
  2⤵
  PID:3696
- C:\Windows\System\OEDNJoN.exe
  C:\Windows\System\OEDNJoN.exe
  2⤵
  PID:4612
- C:\Windows\System\UxfQUfN.exe
  C:\Windows\System\UxfQUfN.exe
  2⤵
  PID:4036
- C:\Windows\System\ZOyWahb.exe
  C:\Windows\System\ZOyWahb.exe
  2⤵
  PID:4956
- C:\Windows\System\EEbOPFQ.exe
  C:\Windows\System\EEbOPFQ.exe
  2⤵
  PID:12032
- C:\Windows\System\xYrVyQV.exe
  C:\Windows\System\xYrVyQV.exe
  2⤵
  PID:6224
- C:\Windows\System\jhddLhb.exe
  C:\Windows\System\jhddLhb.exe
  2⤵
  PID:14320
- C:\Windows\System\JmXaOug.exe
  C:\Windows\System\JmXaOug.exe
  2⤵
  PID:3264
- C:\Windows\System\WfatpAD.exe
  C:\Windows\System\WfatpAD.exe
  2⤵
  PID:1308
- C:\Windows\System\NahuDXy.exe
  C:\Windows\System\NahuDXy.exe
  2⤵
  PID:14276
- C:\Windows\System\NtuIlbp.exe
  C:\Windows\System\NtuIlbp.exe
  2⤵
  PID:1072
- C:\Windows\System\NKgZkoz.exe
  C:\Windows\System\NKgZkoz.exe
  2⤵
  PID:1376
- C:\Windows\System\FTHTsRT.exe
  C:\Windows\System\FTHTsRT.exe
  2⤵
  PID:7984
- C:\Windows\System\dihjmrV.exe
  C:\Windows\System\dihjmrV.exe
  2⤵
  PID:2844
- C:\Windows\System\wKBQxNp.exe
  C:\Windows\System\wKBQxNp.exe
  2⤵
  PID:3536
- C:\Windows\System\XPwTlXs.exe
  C:\Windows\System\XPwTlXs.exe
  2⤵
  PID:1516
- C:\Windows\System\hAuocxJ.exe
  C:\Windows\System\hAuocxJ.exe
  2⤵
  PID:3356
- C:\Windows\System\tfMKnat.exe
  C:\Windows\System\tfMKnat.exe
  2⤵
  PID:6984
- C:\Windows\System\JZgsaaG.exe
  C:\Windows\System\JZgsaaG.exe
  2⤵
  PID:11920
- C:\Windows\System\LBJwpbL.exe
  C:\Windows\System\LBJwpbL.exe
  2⤵
  PID:5448
- C:\Windows\System\lmidEJd.exe
  C:\Windows\System\lmidEJd.exe
  2⤵
  PID:656
- C:\Windows\System\IvXSRyD.exe
  C:\Windows\System\IvXSRyD.exe
  2⤵
  PID:780
- C:\Windows\System\XKoTRvL.exe
  C:\Windows\System\XKoTRvL.exe
  2⤵
  PID:2092
- C:\Windows\System\XmLEerW.exe
  C:\Windows\System\XmLEerW.exe
  2⤵
  PID:5728
- C:\Windows\System\hNfembC.exe
  C:\Windows\System\hNfembC.exe
  2⤵
  PID:2616
- C:\Windows\System\aJKgfYV.exe
  C:\Windows\System\aJKgfYV.exe
  2⤵
  PID:11308
- C:\Windows\System\HfYKaTn.exe
  C:\Windows\System\HfYKaTn.exe
  2⤵
  PID:6256
- C:\Windows\System\orMmfTf.exe
  C:\Windows\System\orMmfTf.exe
  2⤵
  PID:4156
- C:\Windows\System\ObZvpCM.exe
  C:\Windows\System\ObZvpCM.exe
  2⤵
  PID:5624
- C:\Windows\System\knMTmnz.exe
  C:\Windows\System\knMTmnz.exe
  2⤵
  PID:2064
- C:\Windows\System\KenrEzI.exe
  C:\Windows\System\KenrEzI.exe
  2⤵
  PID:2680
- C:\Windows\System\DnjThNY.exe
  C:\Windows\System\DnjThNY.exe
  2⤵
  PID:13572
- C:\Windows\System\TXdrlOp.exe
  C:\Windows\System\TXdrlOp.exe
  2⤵
  PID:3408
- C:\Windows\System\InQcaNy.exe
  C:\Windows\System\InQcaNy.exe
  2⤵
  PID:6512
- C:\Windows\System\vJYTPxm.exe
  C:\Windows\System\vJYTPxm.exe
  2⤵
  PID:4844
- C:\Windows\System\DHiwXRI.exe
  C:\Windows\System\DHiwXRI.exe
  2⤵
  PID:3748
- C:\Windows\System\YQGTxUw.exe
  C:\Windows\System\YQGTxUw.exe
  2⤵
  PID:6368
- C:\Windows\System\oPPBICv.exe
  C:\Windows\System\oPPBICv.exe
  2⤵
  PID:4408
- C:\Windows\System\NltXUHo.exe
  C:\Windows\System\NltXUHo.exe
  2⤵
  PID:13872
- C:\Windows\System\oQaXrjZ.exe
  C:\Windows\System\oQaXrjZ.exe
  2⤵
  PID:7100
- C:\Windows\System\IeBYgVn.exe
  C:\Windows\System\IeBYgVn.exe
  2⤵
  PID:7300
- C:\Windows\System\vmSImDp.exe
  C:\Windows\System\vmSImDp.exe
  2⤵
  PID:6020
- C:\Windows\System\qFLZDHd.exe
  C:\Windows\System\qFLZDHd.exe
  2⤵
  PID:5484
- C:\Windows\System\oZUzmDt.exe
  C:\Windows\System\oZUzmDt.exe
  2⤵
  PID:5640
- C:\Windows\System\pfQUxVn.exe
  C:\Windows\System\pfQUxVn.exe
  2⤵
  PID:6880
- C:\Windows\System\mzSrcRi.exe
  C:\Windows\System\mzSrcRi.exe
  2⤵
  PID:7252
- C:\Windows\System\qPfqkCR.exe
  C:\Windows\System\qPfqkCR.exe
  2⤵
  PID:6060
- C:\Windows\System\sJsUjWO.exe
  C:\Windows\System\sJsUjWO.exe
  2⤵
  PID:13248
- C:\Windows\System\IYrobRD.exe
  C:\Windows\System\IYrobRD.exe
  2⤵
  PID:7324
- C:\Windows\System\wnFhHIB.exe
  C:\Windows\System\wnFhHIB.exe
  2⤵
  PID:2176
- C:\Windows\System\okVJNIz.exe
  C:\Windows\System\okVJNIz.exe
  2⤵
  PID:13552
- C:\Windows\System\jmolxkN.exe
  C:\Windows\System\jmolxkN.exe
  2⤵
  PID:2752
- C:\Windows\System\YSqxPdk.exe
  C:\Windows\System\YSqxPdk.exe
  2⤵
  PID:5168
- C:\Windows\System\wFOXiws.exe
  C:\Windows\System\wFOXiws.exe
  2⤵
  PID:8208
- C:\Windows\System\ezurWVN.exe
  C:\Windows\System\ezurWVN.exe
  2⤵
  PID:6180
- C:\Windows\System\nlrKyWg.exe
  C:\Windows\System\nlrKyWg.exe
  2⤵
  PID:8316
- C:\Windows\System\IKikVNc.exe
  C:\Windows\System\IKikVNc.exe
  2⤵
  PID:6752
- C:\Windows\System\orGMtsT.exe
  C:\Windows\System\orGMtsT.exe
  2⤵
  PID:4948
- C:\Windows\System\fcPQebd.exe
  C:\Windows\System\fcPQebd.exe
  2⤵
  PID:4816
- C:\Windows\System\nCfJVnb.exe
  C:\Windows\System\nCfJVnb.exe
  2⤵
  PID:8776
- C:\Windows\System\LRQdQMq.exe
  C:\Windows\System\LRQdQMq.exe
  2⤵
  PID:8128
- C:\Windows\System\BbObQcJ.exe
  C:\Windows\System\BbObQcJ.exe
  2⤵
  PID:5412
- C:\Windows\System\UmcWFTv.exe
  C:\Windows\System\UmcWFTv.exe
  2⤵
  PID:6912
- C:\Windows\System\HQKjMHm.exe
  C:\Windows\System\HQKjMHm.exe
  2⤵
  PID:8920
- C:\Windows\System\NKjYsab.exe
  C:\Windows\System\NKjYsab.exe
  2⤵
  PID:7272
- C:\Windows\System\dZwkZxn.exe
  C:\Windows\System\dZwkZxn.exe
  2⤵
  PID:6308
- C:\Windows\System\gNoMuTt.exe
  C:\Windows\System\gNoMuTt.exe
  2⤵
  PID:4336
- C:\Windows\System\OLvxfUy.exe
  C:\Windows\System\OLvxfUy.exe
  2⤵
  PID:6800
- C:\Windows\System\wLHhGXy.exe
  C:\Windows\System\wLHhGXy.exe
  2⤵
  PID:8244
- C:\Windows\System\hgfqMSz.exe
  C:\Windows\System\hgfqMSz.exe
  2⤵
  PID:6928
- C:\Windows\System\KePzlkl.exe
  C:\Windows\System\KePzlkl.exe
  2⤵
  PID:6652
- C:\Windows\System\YtanwRL.exe
  C:\Windows\System\YtanwRL.exe
  2⤵
  PID:7296
- C:\Windows\System\ClBaARt.exe
  C:\Windows\System\ClBaARt.exe
  2⤵
  PID:6628
- C:\Windows\System\LJgYnQt.exe
  C:\Windows\System\LJgYnQt.exe
  2⤵
  PID:8224
- C:\Windows\System\swwgeag.exe
  C:\Windows\System\swwgeag.exe
  2⤵
  PID:7328
- C:\Windows\System\BLEcsrl.exe
  C:\Windows\System\BLEcsrl.exe
  2⤵
  PID:12904
- C:\Windows\System\lEmFRGr.exe
  C:\Windows\System\lEmFRGr.exe
  2⤵
  PID:4004
- C:\Windows\System\TGaEcmO.exe
  C:\Windows\System\TGaEcmO.exe
  2⤵
  PID:6444
- C:\Windows\System\omyUKwA.exe
  C:\Windows\System\omyUKwA.exe
  2⤵
  PID:8296
- C:\Windows\System\fxKpxPJ.exe
  C:\Windows\System\fxKpxPJ.exe
  2⤵
  PID:10448
- C:\Windows\System\OcznTZa.exe
  C:\Windows\System\OcznTZa.exe
  2⤵
  PID:5628
- C:\Windows\System\UYkMWIN.exe
  C:\Windows\System\UYkMWIN.exe
  2⤵
  PID:1056
- C:\Windows\System\PrTAbWf.exe
  C:\Windows\System\PrTAbWf.exe
  2⤵
  PID:1288
- C:\Windows\System\lvMoQRb.exe
  C:\Windows\System\lvMoQRb.exe
  2⤵
  PID:7596
- C:\Windows\System\xoUWGgY.exe
  C:\Windows\System\xoUWGgY.exe
  2⤵
  PID:8256
- C:\Windows\System\cmSZuQl.exe
  C:\Windows\System\cmSZuQl.exe
  2⤵
  PID:8292
- C:\Windows\System\oljqJNc.exe
  C:\Windows\System\oljqJNc.exe
  2⤵
  PID:3104
- C:\Windows\System\PMPzIal.exe
  C:\Windows\System\PMPzIal.exe
  2⤵
  PID:6868
- C:\Windows\System\KPFfzBz.exe
  C:\Windows\System\KPFfzBz.exe
  2⤵
  PID:9488
- C:\Windows\System\AXQkXCe.exe
  C:\Windows\System\AXQkXCe.exe
  2⤵
  PID:8808
- C:\Windows\System\PEkfLvg.exe
  C:\Windows\System\PEkfLvg.exe
  2⤵
  PID:9720
- C:\Windows\System\mPLzDaO.exe
  C:\Windows\System\mPLzDaO.exe
  2⤵
  PID:5148
- C:\Windows\System\rGetGix.exe
  C:\Windows\System\rGetGix.exe
  2⤵
  PID:6716
- C:\Windows\System\WDOqfGz.exe
  C:\Windows\System\WDOqfGz.exe
  2⤵
  PID:9888
- C:\Windows\System\gWzDuHB.exe
  C:\Windows\System\gWzDuHB.exe
  2⤵
  PID:2984
- C:\Windows\System\PJEFQwd.exe
  C:\Windows\System\PJEFQwd.exe
  2⤵
  PID:10072
- C:\Windows\System\AQCbPYU.exe
  C:\Windows\System\AQCbPYU.exe
  2⤵
  PID:10136
- C:\Windows\System\tivCtdf.exe
  C:\Windows\System\tivCtdf.exe
  2⤵
  PID:11176
- C:\Windows\System\bKPhtsU.exe
  C:\Windows\System\bKPhtsU.exe
  2⤵
  PID:6540
- C:\Windows\System\egayFBf.exe
  C:\Windows\System\egayFBf.exe
  2⤵
  PID:4780
- C:\Windows\System\gRkSJLc.exe
  C:\Windows\System\gRkSJLc.exe
  2⤵
  PID:8564
- C:\Windows\System\tlFbdQp.exe
  C:\Windows\System\tlFbdQp.exe
  2⤵
  PID:7580
- C:\Windows\System\fUyJENV.exe
  C:\Windows\System\fUyJENV.exe
  2⤵
  PID:11340
- C:\Windows\System\zEdkqRe.exe
  C:\Windows\System\zEdkqRe.exe
  2⤵
  PID:908
- C:\Windows\System\KvkLUao.exe
  C:\Windows\System\KvkLUao.exe
  2⤵
  PID:6608
- C:\Windows\System\sXjeLhw.exe
  C:\Windows\System\sXjeLhw.exe
  2⤵
  PID:2644
- C:\Windows\System\oMeYoJP.exe
  C:\Windows\System\oMeYoJP.exe
  2⤵
  PID:10268
- C:\Windows\System\xKGBLbK.exe
  C:\Windows\System\xKGBLbK.exe
  2⤵
  PID:11768
- C:\Windows\System\iliNcFn.exe
  C:\Windows\System\iliNcFn.exe
  2⤵
  PID:6216
- C:\Windows\System\ffLOGVD.exe
  C:\Windows\System\ffLOGVD.exe
  2⤵
  PID:7688
- C:\Windows\System\hWMbxti.exe
  C:\Windows\System\hWMbxti.exe
  2⤵
  PID:2268
- C:\Windows\System\GhwPjBP.exe
  C:\Windows\System\GhwPjBP.exe
  2⤵
  PID:5952
- C:\Windows\System\WYKiJeb.exe
  C:\Windows\System\WYKiJeb.exe
  2⤵
  PID:8248
- C:\Windows\System\NekbRQs.exe
  C:\Windows\System\NekbRQs.exe
  2⤵
  PID:10812
- C:\Windows\System\alhTTly.exe
  C:\Windows\System\alhTTly.exe
  2⤵
  PID:6696
- C:\Windows\System\hsWaoVV.exe
  C:\Windows\System\hsWaoVV.exe
  2⤵
  PID:7648
- C:\Windows\System\sYxUSlM.exe
  C:\Windows\System\sYxUSlM.exe
  2⤵
  PID:10988
- C:\Windows\System\tBrhBbF.exe
  C:\Windows\System\tBrhBbF.exe
  2⤵
  PID:8880
- C:\Windows\System\cQCVsaI.exe
  C:\Windows\System\cQCVsaI.exe
  2⤵
  PID:8008
- C:\Windows\System\Lqzcled.exe
  C:\Windows\System\Lqzcled.exe
  2⤵
  PID:8860
- C:\Windows\System\ADIGjEV.exe
  C:\Windows\System\ADIGjEV.exe
  2⤵
  PID:8660
- C:\Windows\System\iZQyizh.exe
  C:\Windows\System\iZQyizh.exe
  2⤵
  PID:12216
- C:\Windows\System\yjKxOGt.exe
  C:\Windows\System\yjKxOGt.exe
  2⤵
  PID:228
- C:\Windows\System\RjsSXrA.exe
  C:\Windows\System\RjsSXrA.exe
  2⤵
  PID:7548
- C:\Windows\System\qhgoUbP.exe
  C:\Windows\System\qhgoUbP.exe
  2⤵
  PID:12220
- C:\Windows\System\uJwMpPV.exe
  C:\Windows\System\uJwMpPV.exe
  2⤵
  PID:6084
- C:\Windows\System\tZjarrM.exe
  C:\Windows\System\tZjarrM.exe
  2⤵
  PID:5196
- C:\Windows\System\NYpZqBx.exe
  C:\Windows\System\NYpZqBx.exe
  2⤵
  PID:11300
- C:\Windows\System\HcizoJB.exe
  C:\Windows\System\HcizoJB.exe
  2⤵
  PID:6560
- C:\Windows\System\USVvXvI.exe
  C:\Windows\System\USVvXvI.exe
  2⤵
  PID:8912
- C:\Windows\System\xJoExnd.exe
  C:\Windows\System\xJoExnd.exe
  2⤵
  PID:10608
- C:\Windows\System\ovakZki.exe
  C:\Windows\System\ovakZki.exe
  2⤵
  PID:6288
- C:\Windows\System\fYJmHeF.exe
  C:\Windows\System\fYJmHeF.exe
  2⤵
  PID:5688
- C:\Windows\System\PbdrDqM.exe
  C:\Windows\System\PbdrDqM.exe
  2⤵
  PID:13884
- C:\Windows\System\FRlAbtY.exe
  C:\Windows\System\FRlAbtY.exe
  2⤵
  PID:12828
- C:\Windows\System\MlpbJIe.exe
  C:\Windows\System\MlpbJIe.exe
  2⤵
  PID:12120
- C:\Windows\System\zsnWdrn.exe
  C:\Windows\System\zsnWdrn.exe
  2⤵
  PID:12180
- C:\Windows\System\dFGINul.exe
  C:\Windows\System\dFGINul.exe
  2⤵
  PID:12196
- C:\Windows\System\tRZTSXZ.exe
  C:\Windows\System\tRZTSXZ.exe
  2⤵
  PID:7788
- C:\Windows\System\AOcVMJt.exe
  C:\Windows\System\AOcVMJt.exe
  2⤵
  PID:12260
- C:\Windows\System\cYSfnBP.exe
  C:\Windows\System\cYSfnBP.exe
  2⤵
  PID:7860
- C:\Windows\System\rFbpWur.exe
  C:\Windows\System\rFbpWur.exe
  2⤵
  PID:11540
- C:\Windows\System\dDCmTnh.exe
  C:\Windows\System\dDCmTnh.exe
  2⤵
  PID:11748
- C:\Windows\System\vLcwUUC.exe
  C:\Windows\System\vLcwUUC.exe
  2⤵
  PID:13548
- C:\Windows\System\htvhHoJ.exe
  C:\Windows\System\htvhHoJ.exe
  2⤵
  PID:10472
- C:\Windows\System\rsVGvOM.exe
  C:\Windows\System\rsVGvOM.exe
  2⤵
  PID:4892
- C:\Windows\System\pwcRWPD.exe
  C:\Windows\System\pwcRWPD.exe
  2⤵
  PID:10696
- C:\Windows\System\qwafThw.exe
  C:\Windows\System\qwafThw.exe
  2⤵
  PID:12012
- C:\Windows\System\RibjvVm.exe
  C:\Windows\System\RibjvVm.exe
  2⤵
  PID:12084
- C:\Windows\System\eGwPzqg.exe
  C:\Windows\System\eGwPzqg.exe
  2⤵
  PID:8940
- C:\Windows\System\XutUhPN.exe
  C:\Windows\System\XutUhPN.exe
  2⤵
  PID:12844
- C:\Windows\System\bZvDNOs.exe
  C:\Windows\System\bZvDNOs.exe
  2⤵
  PID:10936
- C:\Windows\System\inGKgUS.exe
  C:\Windows\System\inGKgUS.exe
  2⤵
  PID:8100
- C:\Windows\System\TNbBdyG.exe
  C:\Windows\System\TNbBdyG.exe
  2⤵
  PID:13184
- C:\Windows\System\HVepmMg.exe
  C:\Windows\System\HVepmMg.exe
  2⤵
  PID:5428
- C:\Windows\System\ChlzKcu.exe
  C:\Windows\System\ChlzKcu.exe
  2⤵
  PID:8080
- C:\Windows\System\IQBoxzC.exe
  C:\Windows\System\IQBoxzC.exe
  2⤵
  PID:8372
- C:\Windows\System\jDPsokg.exe
  C:\Windows\System\jDPsokg.exe
  2⤵
  PID:11212
- C:\Windows\System\YYixorj.exe
  C:\Windows\System\YYixorj.exe
  2⤵
  PID:9556
- C:\Windows\System\OaGDZSE.exe
  C:\Windows\System\OaGDZSE.exe
  2⤵
  PID:13104
- C:\Windows\System\mbWtcRd.exe
  C:\Windows\System\mbWtcRd.exe
  2⤵
  PID:8036
- C:\Windows\System\WVaKWKj.exe
  C:\Windows\System\WVaKWKj.exe
  2⤵
  PID:9804
- C:\Windows\System\wCvgGdq.exe
  C:\Windows\System\wCvgGdq.exe
  2⤵
  PID:9564
- C:\Windows\System\mvVjbhU.exe
  C:\Windows\System\mvVjbhU.exe
  2⤵
  PID:9980
- C:\Windows\System\LqitTbg.exe
  C:\Windows\System\LqitTbg.exe
  2⤵
  PID:10112
- C:\Windows\System\khBIqhR.exe
  C:\Windows\System\khBIqhR.exe
  2⤵
  PID:14080
- C:\Windows\System\EQVdMjT.exe
  C:\Windows\System\EQVdMjT.exe
  2⤵
  PID:12152
- C:\Windows\System\OYpSoJG.exe
  C:\Windows\System\OYpSoJG.exe
  2⤵
  PID:10984
- C:\Windows\System\uJVgBPe.exe
  C:\Windows\System\uJVgBPe.exe
  2⤵
  PID:7240
- C:\Windows\System\KXVdeEy.exe
  C:\Windows\System\KXVdeEy.exe
  2⤵
  PID:6968
- C:\Windows\System\jHenQhQ.exe
  C:\Windows\System\jHenQhQ.exe
  2⤵
  PID:5660
- C:\Windows\System\NNkCBER.exe
  C:\Windows\System\NNkCBER.exe
  2⤵
  PID:13108
- C:\Windows\System\vbokuLn.exe
  C:\Windows\System\vbokuLn.exe
  2⤵
  PID:13204
- C:\Windows\System\SQPkQoC.exe
  C:\Windows\System\SQPkQoC.exe
  2⤵
  PID:6188
- C:\Windows\System\xGjbTLz.exe
  C:\Windows\System\xGjbTLz.exe
  2⤵
  PID:13392
- C:\Windows\System\opZKBIc.exe
  C:\Windows\System\opZKBIc.exe
  2⤵
  PID:7028
- C:\Windows\System\euwrKjI.exe
  C:\Windows\System\euwrKjI.exe
  2⤵
  PID:7260
- C:\Windows\System\SgruFWr.exe
  C:\Windows\System\SgruFWr.exe
  2⤵
  PID:9944
- C:\Windows\System\QbjyTHD.exe
  C:\Windows\System\QbjyTHD.exe
  2⤵
  PID:6676
- C:\Windows\System\gXMLyuP.exe
  C:\Windows\System\gXMLyuP.exe
  2⤵
  PID:8584
- C:\Windows\System\oiQLcHc.exe
  C:\Windows\System\oiQLcHc.exe
  2⤵
  PID:13488
- C:\Windows\System\LmrHJbO.exe
  C:\Windows\System\LmrHJbO.exe
  2⤵
  PID:11808
- C:\Windows\System\YpiGiWU.exe
  C:\Windows\System\YpiGiWU.exe
  2⤵
  PID:13584
- C:\Windows\System\gPQGjTV.exe
  C:\Windows\System\gPQGjTV.exe
  2⤵
  PID:5432
- C:\Windows\System\vZEncpw.exe
  C:\Windows\System\vZEncpw.exe
  2⤵
  PID:12456
- C:\Windows\System\lqQxpIH.exe
  C:\Windows\System\lqQxpIH.exe
  2⤵
  PID:6304
- C:\Windows\System\IiyncuN.exe
  C:\Windows\System\IiyncuN.exe
  2⤵
  PID:13604
- C:\Windows\System\mmnBRIr.exe
  C:\Windows\System\mmnBRIr.exe
  2⤵
  PID:13128
- C:\Windows\System\mlRnvjL.exe
  C:\Windows\System\mlRnvjL.exe
  2⤵
  PID:13224
- C:\Windows\System\pZhvSBq.exe
  C:\Windows\System\pZhvSBq.exe
  2⤵
  PID:11560
- C:\Windows\System\ZOuOuSX.exe
  C:\Windows\System\ZOuOuSX.exe
  2⤵
  PID:9208
- C:\Windows\System\XAXfeZw.exe
  C:\Windows\System\XAXfeZw.exe
  2⤵
  PID:9420
- C:\Windows\System\ygHwYEV.exe
  C:\Windows\System\ygHwYEV.exe
  2⤵
  PID:7920
- C:\Windows\System\bbvHbMn.exe
  C:\Windows\System\bbvHbMn.exe
  2⤵
  PID:9560
- C:\Windows\System\FtsRLlw.exe
  C:\Windows\System\FtsRLlw.exe
  2⤵
  PID:9648
- C:\Windows\System\kMEGDvb.exe
  C:\Windows\System\kMEGDvb.exe
  2⤵
  PID:6476
- C:\Windows\System\WMMgWku.exe
  C:\Windows\System\WMMgWku.exe
  2⤵
  PID:13940
- C:\Windows\System\ELjPfNe.exe
  C:\Windows\System\ELjPfNe.exe
  2⤵
  PID:14016
- C:\Windows\System\jqCchJl.exe
  C:\Windows\System\jqCchJl.exe
  2⤵
  PID:12840
- C:\Windows\System\XxizAdP.exe
  C:\Windows\System\XxizAdP.exe
  2⤵
  PID:14316
- C:\Windows\System\TVpVdjl.exe
  C:\Windows\System\TVpVdjl.exe
  2⤵
  PID:8424
- C:\Windows\System\HmxJqCV.exe
  C:\Windows\System\HmxJqCV.exe
  2⤵
  PID:13812
- C:\Windows\System\VGwWdlG.exe
  C:\Windows\System\VGwWdlG.exe
  2⤵
  PID:14108
- C:\Windows\System\wGbNjja.exe
  C:\Windows\System\wGbNjja.exe
  2⤵
  PID:6820
- C:\Windows\System\cEcdkOO.exe
  C:\Windows\System\cEcdkOO.exe
  2⤵
  PID:13232
- C:\Windows\System\lReskgO.exe
  C:\Windows\System\lReskgO.exe
  2⤵
  PID:13420
- C:\Windows\System\VGVnZdT.exe
  C:\Windows\System\VGVnZdT.exe
  2⤵
  PID:12776
- C:\Windows\System\HgDUROR.exe
  C:\Windows\System\HgDUROR.exe
  2⤵
  PID:7968
- C:\Windows\System\GQDBbXR.exe
  C:\Windows\System\GQDBbXR.exe
  2⤵
  PID:3912
- C:\Windows\System\GBjFqbO.exe
  C:\Windows\System\GBjFqbO.exe
  2⤵
  PID:6944
- C:\Windows\System\HJmSbfK.exe
  C:\Windows\System\HJmSbfK.exe
  2⤵
  PID:13668
- C:\Windows\System\waotmKW.exe
  C:\Windows\System\waotmKW.exe
  2⤵
  PID:10636
- C:\Windows\System\aYYBNrT.exe
  C:\Windows\System\aYYBNrT.exe
  2⤵
  PID:11320
- C:\Windows\System\ysqIFvY.exe
  C:\Windows\System\ysqIFvY.exe
  2⤵
  PID:7172
- C:\Windows\System\UJNIRpE.exe
  C:\Windows\System\UJNIRpE.exe
  2⤵
  PID:8268
- C:\Windows\System\AtxETEZ.exe
  C:\Windows\System\AtxETEZ.exe
  2⤵
  PID:13780
- C:\Windows\System\wVqtGBx.exe
  C:\Windows\System\wVqtGBx.exe
  2⤵
  PID:4824
- C:\Windows\System\eirWZQJ.exe
  C:\Windows\System\eirWZQJ.exe
  2⤵
  PID:12792
- C:\Windows\System\YaRQHnD.exe
  C:\Windows\System\YaRQHnD.exe
  2⤵
  PID:11824
- C:\Windows\System\YFWReyP.exe
  C:\Windows\System\YFWReyP.exe
  2⤵
  PID:13736
- C:\Windows\System\mdscKuN.exe
  C:\Windows\System\mdscKuN.exe
  2⤵
  PID:13616
- C:\Windows\System\NmYVVCa.exe
  C:\Windows\System\NmYVVCa.exe
  2⤵
  PID:4912
- C:\Windows\System\asUFzOa.exe
  C:\Windows\System\asUFzOa.exe
  2⤵
  PID:12788
- C:\Windows\System\nIaZBdq.exe
  C:\Windows\System\nIaZBdq.exe
  2⤵
  PID:9148
- C:\Windows\System\PrFuCSz.exe
  C:\Windows\System\PrFuCSz.exe
  2⤵
  PID:11456
- C:\Windows\System\fbTamxh.exe
  C:\Windows\System\fbTamxh.exe
  2⤵
  PID:14152
- C:\Windows\System\dCUHQHH.exe
  C:\Windows\System\dCUHQHH.exe
  2⤵
  PID:11108
- C:\Windows\System\dXbedAl.exe
  C:\Windows\System\dXbedAl.exe
  2⤵
  PID:9688
- C:\Windows\System\yGtdzZX.exe
  C:\Windows\System\yGtdzZX.exe
  2⤵
  PID:8680
- C:\Windows\System\mucfsSV.exe
  C:\Windows\System\mucfsSV.exe
  2⤵
  PID:13372
- C:\Windows\System\LWsQVZe.exe
  C:\Windows\System\LWsQVZe.exe
  2⤵
  PID:5972
- C:\Windows\System\OfiVkPt.exe
  C:\Windows\System\OfiVkPt.exe
  2⤵
  PID:7600
- C:\Windows\System\JtCoaEc.exe
  C:\Windows\System\JtCoaEc.exe
  2⤵
  PID:10364
- C:\Windows\System\MTxkodj.exe
  C:\Windows\System\MTxkodj.exe
  2⤵
  PID:12868
- C:\Windows\System\FljSxvU.exe
  C:\Windows\System\FljSxvU.exe
  2⤵
  PID:11040
- C:\Windows\System\eqNBzQo.exe
  C:\Windows\System\eqNBzQo.exe
  2⤵
  PID:10568
- C:\Windows\System\FJwTJih.exe
  C:\Windows\System\FJwTJih.exe
  2⤵
  PID:7856
- C:\Windows\System\bPClSPR.exe
  C:\Windows\System\bPClSPR.exe
  2⤵
  PID:10724
- C:\Windows\System\AEiNslR.exe
  C:\Windows\System\AEiNslR.exe
  2⤵
  PID:7084
- C:\Windows\System\KwnuVWb.exe
  C:\Windows\System\KwnuVWb.exe
  2⤵
  PID:14004
- C:\Windows\System\ASJnUYu.exe
  C:\Windows\System\ASJnUYu.exe
  2⤵
  PID:11764
- C:\Windows\System\fykpnBp.exe
  C:\Windows\System\fykpnBp.exe
  2⤵
  PID:4776
- C:\Windows\System\KDJhRvY.exe
  C:\Windows\System\KDJhRvY.exe
  2⤵
  PID:9248
- C:\Windows\System\CUFBaOO.exe
  C:\Windows\System\CUFBaOO.exe
  2⤵
  PID:13396
- C:\Windows\System\FbxMISm.exe
  C:\Windows\System\FbxMISm.exe
  2⤵
  PID:13808
- C:\Windows\System\ggiHkeh.exe
  C:\Windows\System\ggiHkeh.exe
  2⤵
  PID:9036
- C:\Windows\System\DVcBESR.exe
  C:\Windows\System\DVcBESR.exe
  2⤵
  PID:14312
- C:\Windows\System\AcnEqOs.exe
  C:\Windows\System\AcnEqOs.exe
  2⤵
  PID:13932
- C:\Windows\System\ASojSTJ.exe
  C:\Windows\System\ASojSTJ.exe
  2⤵
  PID:10436
- C:\Windows\System\YXQQWOY.exe
  C:\Windows\System\YXQQWOY.exe
  2⤵
  PID:14160
- C:\Windows\System\DMzysAU.exe
  C:\Windows\System\DMzysAU.exe
  2⤵
  PID:4596
- C:\Windows\System\duWzbsP.exe
  C:\Windows\System\duWzbsP.exe
  2⤵
  PID:12200
- C:\Windows\System\tJTDXpm.exe
  C:\Windows\System\tJTDXpm.exe
  2⤵
  PID:9084
- C:\Windows\System\OSUVcGp.exe
  C:\Windows\System\OSUVcGp.exe
  2⤵
  PID:13272
- C:\Windows\System\OIzEkRK.exe
  C:\Windows\System\OIzEkRK.exe
  2⤵
  PID:8636
- C:\Windows\System\dDheNru.exe
  C:\Windows\System\dDheNru.exe
  2⤵
  PID:13348
- C:\Windows\System\QREtkvx.exe
  C:\Windows\System\QREtkvx.exe
  2⤵
  PID:9368
- C:\Windows\System\SLaPOVm.exe
  C:\Windows\System\SLaPOVm.exe
  2⤵
  PID:5572
- C:\Windows\System\mdaXXIf.exe
  C:\Windows\System\mdaXXIf.exe
  2⤵
  PID:5552
- C:\Windows\System\WEGSRnK.exe
  C:\Windows\System\WEGSRnK.exe
  2⤵
  PID:8696
- C:\Windows\System\CQUifqi.exe
  C:\Windows\System\CQUifqi.exe
  2⤵
  PID:7076
- C:\Windows\System\ytQuSUp.exe
  C:\Windows\System\ytQuSUp.exe
  2⤵
  PID:13592
- C:\Windows\System\rVqyngu.exe
  C:\Windows\System\rVqyngu.exe
  2⤵
  PID:12452
- C:\Windows\System\OwvEtLs.exe
  C:\Windows\System\OwvEtLs.exe
  2⤵
  PID:12772
- C:\Windows\System\AUFWmUU.exe
  C:\Windows\System\AUFWmUU.exe
  2⤵
  PID:1564
- C:\Windows\System\FlFntYb.exe
  C:\Windows\System\FlFntYb.exe
  2⤵
  PID:13088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yx1juk4f.eyu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACdvzNz.exe

Filesize
2.0MB

MD5
972cc17699075769aa66d8934f997819

SHA1
ed6c3ab74ffe418b9d9043ba7bdd46448f739341

SHA256
b737666230386ca9e9250c0bfaa7700cd794b83e0709420eaf259ca06e62dd6d

SHA512
720940c9eb3be24493e62ff050ab6a7b6ad1572dca9bd014f6d981c49f3ec90c80b736028c5275a6b526eb30ff954dba84c664197fa3b657f0257dee59bba288

Download Submit
C:\Windows\System\AJJXASO.exe

Filesize
2.0MB

MD5
88872d8f14b1d4e9c307ce82130401b9

SHA1
3c137f04596faba972414309ccf37487387133cf

SHA256
4655972df7f8fffe54c08d81aeb3ede41936f771444fc7b14d1c1777e7b3ce9a

SHA512
564a2a10abbdce87e3696839c24e5621f6dfe10f5c81fbddecfa49f726734ae70b2ace0b5f6ba8c85498f3ce323c12041f7bd260c0d48bcc80dedac00a3ce079

Download Submit
C:\Windows\System\CNnsPXT.exe

Filesize
2.0MB

MD5
586beae4818427bdee4e7ccc64522d27

SHA1
f2a15ef3869afb2bd54f7110123479f367bdb536

SHA256
479ee4ea2be29d0cd49c47eb212c4b92227def842020bf4d33e223a713a58283

SHA512
daa95ec83ecf170bd28479a7a0ee000b4dc91b8e092314ad3835236a1c0d1dc11dbd43300e3e0040ebabb1b0f73dc4b74d87b0f1abc8d4b807b8672cfe7ce88e

Download Submit
C:\Windows\System\DRMHBaE.exe

Filesize
2.0MB

MD5
63ee3a78f696831c68572d5a5ea2f5c0

SHA1
7106e6754b7ab243362ea8b3f3afdc4756f956b5

SHA256
0638fe0fd21eacbd76c7966639ce74432a744cc6799dfe2148d03e953a798e79

SHA512
0c54da762a4a71ee31cf482266e23fd4faeece6d00a10f0ef9003ddcc91df13dd83fbff3865e9c0cd46605ccb360bd555d0db728568a0b5d5218916894db7246

Download Submit
C:\Windows\System\IaIbAYk.exe

Filesize
2.0MB

MD5
a3bec78250487599273e29f22fb40996

SHA1
7f57f6f0593c12a4ac52f1e11d32e681e9e96c1e

SHA256
ff41566ef3c913faf1c605fc97e3b08308a9921d28197369c96d0993168dfa34

SHA512
8b9eab8996cc1cab22172863687854e603e52e6aab9490cf948d8b8a4fd19b36a889e68f3708b50ddae492f165c39e0f9b70e259bd938a1c215b4d417fc65250

Download Submit
C:\Windows\System\MkGwgYT.exe

Filesize
2.0MB

MD5
7fbb40253aa54e76fe53da00923001d1

SHA1
02a66e613680e8d0ab817e6411d8dd2bf338bc81

SHA256
fb8c19cc14844c3dd8185c774899a10e87c39eb8859f34c8d3b443645b327b34

SHA512
43b42db60141138ee60c59f8456745483400066297a6939fa6f07a845aaf00670a08be79aebcebceb0cf5babc7aef19a3f173dbcc444c00bf12ce1d101b04fe2

Download Submit
C:\Windows\System\OIFpHoI.exe

Filesize
2.0MB

MD5
9a729fbde229dd86d14154337a5ed5c6

SHA1
b8a06f5ab3c745469da2c765b25e96490bf6b404

SHA256
6accd5f0db26ae4a6b70a85a94d8df1867ac9c313c1aa70bd8baa5fc1459e385

SHA512
30c9557eca72528e61401db541e56bff1bb9b3f24706a0d588529ac9d8920dc47509e9629ef9ddae05106b531734534d5d2cbaa1982ae354bbce714e8074d1e9

Download Submit
C:\Windows\System\PVTNJah.exe

Filesize
2.0MB

MD5
7b63b808d61fc9b913f458b590b12f55

SHA1
89c2c069a66fa645d3ed93ada0f0d2eeb388ff42

SHA256
58451bf588cc6d437a3a856db53e146ceb187d3f126b7bdbe9be8e37e27dc565

SHA512
513cc6fb47bb55235df14e5faf0f3498fef42e6503085e93ee984c6a4c60fc89787b54e1242ddf8b763d855fa5c2b758f4166a7dc63544caa6441d8039b71859

Download Submit
C:\Windows\System\QFDCujW.exe

Filesize
2.0MB

MD5
3f00f14cd4ce595c982df13d31c35baf

SHA1
3eb6b5c5167e30ac948ffc83058c28144f169cde

SHA256
5f24d96394448bb5ba1cdba8b9860398b3fe9ca280d035cb1b8b040e54ef2521

SHA512
dd439a7559379aa07d0715ff8a33d1e96b04462d789a741d49d0ef46d3af46ad1892e7ddf4e2be294fd06df03da6057eccae1fe9823b79582d442907e423551b

Download Submit
C:\Windows\System\QySPrMk.exe

Filesize
2.0MB

MD5
41c4df67d4991613dfbaca68b0370b10

SHA1
ca6f71532e9f31ac7220073fb812a97698c25d99

SHA256
12437329f0760c89ce2e9533d5a753b0b41b4ef43acfd0ac59236ce0b716f148

SHA512
1ab67c4786dbd8a4873c378bbd1c1ed24ca7f5ceadeb81faf535ab683ce4ca09b2e4563d746083e09ccedd192fd981dae65c5c8d4cd0a41036c915bff18696ea

Download Submit
C:\Windows\System\REPKgym.exe

Filesize
2.0MB

MD5
a6387d04d58dc0e4e358a342e4f0a49c

SHA1
62920a23df0073c0766ae3eed50684c41814f31c

SHA256
6ef5fac4198e39be48b387671056a8237d43e239ebeb9aa314e37ae3c513903e

SHA512
69d306fd553c8677d587fcf359f3fea76d21264c61e72545bf86fd6019f6feeab7725df2dbf601dff4079e6fcebb67f669f456d50748e57fcae82b7542799c48

Download Submit
C:\Windows\System\RPYWFHy.exe

Filesize
2.0MB

MD5
831b6f26c1976733de8d81bcb159bf90

SHA1
0fcdbb52630e7fb6d033d05b62c054238aabb6bd

SHA256
17dae1cdd6563712ba58d9a05c785973a0965fd03c04908cd4a27981beac510e

SHA512
a4e2085383fe1be614ffffeaaac3ce432f1dcc8b33c244f6bad53a1dc15c0c23d47667ecf26784b47e0af91a0e4fbe3b416f5a5c3260822cfbcfc6eb65164725

Download Submit
C:\Windows\System\RlpVvIO.exe

Filesize
2.0MB

MD5
dafc1aa055dc5bf25c03dd33d554f075

SHA1
1bf60ff107def11f86259cafd291656983a3ad8f

SHA256
d207d468505a2f70c668cacf51c178c88a22ce49bfbd2be13a60a76b4fe93630

SHA512
578c2c4caff70033e62f96ed5bb317dfd1207c0b4844f8fb4ad4a512af6373aea34564991369182eb8f32b0c33c850ff330205c60358e717752955d2726893a9

Download Submit
C:\Windows\System\SjPGwSh.exe

Filesize
2.0MB

MD5
22e0fe8567e4ea2fb6d87f48d4457cde

SHA1
27927d7c522f71cb0fd4d6b956750a1fa3e6567c

SHA256
701d7f8bb1f864d6fff9c4ca33dedee486a509fd23d21d4266c8e023b8489d9b

SHA512
6de6989febfd58281ba46cb98ba50c197a5ea58c1a4271be1cf71f53f74ab12565fca1d33ca644b286f0f44b9e8c20b3c763c88688dec1ffa9462d516e24e532

Download Submit
C:\Windows\System\TSNgcHI.exe

Filesize
2.0MB

MD5
ab32dc48d2852c8c3c00ba7ca361d8ca

SHA1
bb9dab430cb8583ed4b528f913c2cc872a365db9

SHA256
6bf245be133247b4b5355208bfab1a7e521abc0740803b6d8a3147903f4e1d8e

SHA512
44e7bed925af553775b75f609861874df98452a57d5b037ea4080524cc2b254d16e96aab9d947eea5e360d57a1b8fcc8864de7b72abc61224ba0cb82d1087a01

Download Submit
C:\Windows\System\VhKVjsr.exe

Filesize
2.0MB

MD5
b946f51b0d7424c5628db2900613fb52

SHA1
9a7c9459a0cb97b081749cefd228a8c009b3741d

SHA256
c35deab45f41e17867c33a71bb81165dcf66574d9ddd112eee160c4a7e90d49c

SHA512
ce5e71bea60b2ad95e43304f8ce37124122319d604de561e61d15edad91e5873dc26a12f1aa912d4e1ceaecbbc26efe26dbe2b8a8925a0bbf7fd260479ceca7d

Download Submit
C:\Windows\System\VrtSSzx.exe

Filesize
2.0MB

MD5
2cfe4d48350f4d4e9e92f978f2f7509e

SHA1
46eee171f686fa604483658513377771918bcba4

SHA256
df3302298ccfb7ed71c2b5f3a8474b8fb5f6d24f20057a4012914cb30e0c8b46

SHA512
414aa8181a76fd0ea25e6185c5fd0c6bd4c94e280ef9490f9ea49730a08855747e05cf7f7b532c8b79f4e8cad4528d4a19280d58bc1722120917ec8ef0bd393b

Download Submit
C:\Windows\System\VtSufgl.exe

Filesize
2.0MB

MD5
a08c7883fcfb4fd626482948aa86d079

SHA1
4b8c29e0cecc60d9dcdabbb2977c18e5c6141da2

SHA256
60759e6fcbe3433d9229c19b356827e879762f20218daee946644884a77c64ef

SHA512
94284c331ced988f5cd42700448f20a50bde244d6a08bd6df2f1e9ae37f5e66a80c9b582626bf3180443ef8c0b04d6537d4916471703b7bd667fd9e01cfc6989

Download Submit
C:\Windows\System\YwRlWNo.exe

Filesize
2.0MB

MD5
77d764283a25a50003142c19350c129f

SHA1
2450144c2600d1d32889284cb8bc3d32e092f0c5

SHA256
0a279d11cc491474d2701640d102c0e1a68a59b81b0ab74c1d4b42e6b7b80e98

SHA512
d1080e89bdb1d8bdd0f1aeb549f844c16ec71fa32ef7218293858f77f2ade1e4d602c283a4f14c1d76b49842a8ce1a4b3115cb6cc5edd0b3b2f9d144592a01ea

Download Submit
C:\Windows\System\ZiVFZcZ.exe

Filesize
2.0MB

MD5
156745784fd2bffdfe0ffae22ad31e3a

SHA1
d05f86d03f03f59227a086d0c8382a19e7a3b6b7

SHA256
219d09d3c49374f972ca32049700617d0e1929d61a98a4ecf0005260639b86f9

SHA512
45b1c104aff4e812acd0ef267d7e05eb60fcf4ca8e8d02cf7806e0d5dd83ed956a8cffb451b7f3ec0ad054289aab3d4dc6cb399dc17917903022aedd871a9ba3

Download Submit
C:\Windows\System\aFITEEC.exe

Filesize
2.0MB

MD5
6b7382a821e2e10afd1e10e5f7cbe2c1

SHA1
1b8326bf162c5c5ea8c5b8b691414f666749695a

SHA256
35157eb4312fede70773d87aab4141c046ef2aa01abca1a31becb8c7eacc0d4c

SHA512
318e7f6e61f358d8a9f51d75daedfa06d18f27f700f541147d0cd1f787f5546d3440e290d3171c04563ae9b712eb29d14e6a6c67cf4b59a6297d2bd3fb7fe851

Download Submit
C:\Windows\System\aMwzymC.exe

Filesize
2.0MB

MD5
2cb218c0b9208d42950fe946ed488b2c

SHA1
3f319cd32d6242bd54083eb4f5583381ff1e61d7

SHA256
65c42126f59e9692be4f8a89c0f08134648662b2c14b7a426a15c613caf7e90b

SHA512
1a99d56cc83f46d1d94daf5aa72dd286e5bcebed710284fdfb07ef4e59052561e335badf536bd69398eb5ca38127f28bb4c6602af1a30ba590cd5dd9af208c6e

Download Submit
C:\Windows\System\cBhfmEP.exe

Filesize
2.0MB

MD5
be79192f62c4d2b493bf4591ca2e4aab

SHA1
4e2dd0b749cfcbd8a811c989b4c442e1c53575fa

SHA256
f20fb7c0b5a9829beadccc88ed692cde74f0a673450d8c8395209bb7d618cc88

SHA512
e6785afc5715abcafbc481f5141ef9b412bfd969d2a88f96a3f61bf2275b9b9d0cbc9dc8ae8a5177f308c532f883345daf15989264d5aeef05b8abe4bd063512

Download Submit
C:\Windows\System\evHTDJN.exe

Filesize
2.0MB

MD5
703f5fb0a08e82619c2d3dedd91457fb

SHA1
57008d2904b9ee1e2a5fa333bfc1a070fe2683fc

SHA256
72a253dcbfa1b41c4d167c362de85bbe29b2e85939f4a4d0b7d5ece3c25a25c8

SHA512
39fe194f308438a35ee5ed772c835596a711f91906083bf087aa20d5c3e84e40ba891c6fa015f1423764300034a2f96913d10b6f95ba0f45820c6eddba7153bb

Download Submit
C:\Windows\System\gtFeYHm.exe

Filesize
2.0MB

MD5
45b31091586c14cb74dda38d772da9c8

SHA1
b6a6e3849aa316632b90a3d2c5ae7328a4356fb6

SHA256
c6585ce38f2385d2b5bcca1885cd552b3a7d89c23e2de38901b28b387c4f53d0

SHA512
6c91bc88bf3dbbc91b8e8f4beef1b00261dacb3f01f41ad52dfa458575a174e59b3ca4f134e7c735670be4e01d370157836e4862e6d135a160f4507192e2a71b

Download Submit
C:\Windows\System\gvvUYWE.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\hmzveee.exe

Filesize
2.0MB

MD5
416b26373d3335b508cf54c163a1d807

SHA1
c78971ce119015c723b9b744ca5472dfe2982c49

SHA256
ee0a12fc6b8f2de5f8e2f0c906d6e148470ab6f5c4fb70f80e201fda713f8ab3

SHA512
50ab4b38dab40c968a9dc7390e07868b96483776cb2f85565040f512ba340d22379e58ae6c564cf8c0735dce3fbb91ea883324aab1a2f947c6b587355d147318

Download Submit
C:\Windows\System\igOmcIi.exe

Filesize
2.0MB

MD5
702f2313881c6a8cfe4bfda9112f3dde

SHA1
380bf61f6349ab05bd93bc9e86e22916f2094af3

SHA256
09a049a1bcb8d22da7b7b8b2172ce244bb69f629fb1084fb1d6f33b157d525f6

SHA512
5071796f4dfa9b23a11afbf93e1dfba4556f0f9f00f8a85014f67ed241d45956741bff0e44c109929706f2508da113ed488ca3b6c55bf48d8e25f37de4e34383

Download Submit
C:\Windows\System\jKOAIKD.exe

Filesize
2.0MB

MD5
0903c7b64c1a9a0d5299bd1cfac004ea

SHA1
8acca67f0baa0a48c786f511205dd75ffcf63d75

SHA256
36ba83116feffc9fa70e7ef40df52227267e308ffbfd7adeb087e8b29ae48175

SHA512
3608bbfddecb9e2ef84b2120b24eee4b2db7b004c935dd54d546322fa73efc5fa29097e1eaea9dee736b5b9dd6a110349d5d6599c132b7e421b5d12477b8d608

Download Submit
C:\Windows\System\loWdmVw.exe

Filesize
2.0MB

MD5
03d0de481244a0fb7313561cf1a2c4de

SHA1
e6b8fb87e24f9b58ebf900ef778fd69cf951473a

SHA256
e899fce51c5924d8e08fe343d5c709101cb4faee7ec075abf86a6c6290a29bfe

SHA512
5259c81b7113d7c5712c7a583be1cdbd6ff1b43441911fc93fbfbfbc5073b1b5b801dfc8b3f9bf0955bc6ef8eaac4ef517f4fac7a4c5cc04ab72b613b47915dc

Download Submit
C:\Windows\System\nulDMYd.exe

Filesize
2.0MB

MD5
85b73b160ad853868c5e75c78823ffb0

SHA1
020967bdef0f6d015967f6e7c21d0db1c1e48efe

SHA256
16bab2417a0e98711b9d21edd57255e38a1a7d38b859c1187d66fa6a58069aab

SHA512
9d4ff0ee0b88f3369558688998c7e720b79a57d29931055b71f870c5cc2d29c184c50418e8d3eb6d7204cfd203a6905925e6a6bd782856d01d7f947d9a773d10

Download Submit
C:\Windows\System\nzMcVKm.exe

Filesize
2.0MB

MD5
b2f5e89aebea3ec5ee976babf04b114b

SHA1
55b8c596028daecaded7a49916f2c4c7d2ac4376

SHA256
6d5c17c90d2a6c1f835281eb6e84cbe632924e0393fb51285401fce41656ac01

SHA512
f37978e3dbce2b1b12ddfa82a531af6f395d958eb7f129a056026f985173925f6dadaaa415648c7433c3fba08120ab4a2e044bde3c048d46952d7c5ca0323c78

Download Submit
C:\Windows\System\oCoLFAs.exe

Filesize
2.0MB

MD5
29411308db51301a94d3daa75ef32dcf

SHA1
fe9427c9d112d1f288549780854066a500d369d9

SHA256
3a450d63c7ef203d546f527f5df66b444e0400bf296f7ea29b0d8c2747f93767

SHA512
af07ed67f513fee61f2a3f448989a2d9a5c4c3771055f795d8d1330f7fed65de83223a80b7995fd52db1c9c7a0afb1654016ed53a7b03db42db62e1b7e498cfc

Download Submit
C:\Windows\System\oPmwqcs.exe

Filesize
2.0MB

MD5
aedc046a5f43759e10276fc49e27a221

SHA1
e3c744831c6772a3285cdf3c2678f38f462869da

SHA256
7dae946039ae2588ac820fd00d0454854f2b6ef8d37b417e625bac0b1d377b84

SHA512
beb37d788543eb68b68321e0c83de735ce91c718b72e89176798dd8d8aa3c078b10af283f250a85a423ba3d104a62809c022555fe14b5d5132fb09cc9d970149

Download Submit
C:\Windows\System\pVJkWgq.exe

Filesize
2.0MB

MD5
cb00ffc83afa2d4fdb93994f3f4e6c99

SHA1
0ed42d7f0e1fe2a5cc1e323983f09345443855c7

SHA256
7ee0d913edd94f952394a7d9c7bacf8e0f0a04c3c39364ba0b7e53bbbfe9cd1e

SHA512
91e8040ac3686cd858f490f0a8e3edfd0cf3a32379d7b24135c4d03376ee6f45e71777003800b8ffd2569a52acd7a1d1a7617c57ffa62721790c666b62bf6580

Download Submit
C:\Windows\System\qYDPeDU.exe

Filesize
2.0MB

MD5
8367611c7833f1c483280037e29f554e

SHA1
81bf580b9e3f964760be8ba8842d5673b75f8465

SHA256
9a2b5ff5af35041aba46c554757cf251bffb2b2db759821cdb1d616c7fbbb6ae

SHA512
17874a479e6a9008b2980dafcdfbce9bdc2c2b7d6e9319ab0b2f47f1090bd2a4ce5469505fbdc87bb1103268b0878384ce8d359ade9f34094e666dfc41411006

Download Submit
C:\Windows\System\qiYGulN.exe

Filesize
2.0MB

MD5
14d514e0d64beca6bc34518414fdba2f

SHA1
bf762b57a070dcdc8f790c5bb130e98b9734bc8d

SHA256
fe86974c8f677ebc05c3a00f1f19063997811b80de635f2d165bd2b1d4119428

SHA512
583134879a078485dd3b154f864c5b2e0fffd73152510581af5e8e1560402d0afa48752d0deeaccececc5dd14a8099cac0f011aaf13b5b40033d37bd89dab5b2

Download Submit
C:\Windows\System\qmhjrlp.exe

Filesize
18B

MD5
042db3cca454b08b58bb73257239b438

SHA1
10e1bc7e7aa884031afcaafcefc742038d62d2cd

SHA256
510e41435a3d3cd5a736a89698b55c8a0f6d8d417f5acfd6cfca25146be56e68

SHA512
4790b4c15b8195254f6e315afe9f499a40aa9fc5aedba27229271073ad599e5f02d68cd51a7467384e5f09ff788d983132a63cbca82567af910557bf3b7bd269

Download Submit
C:\Windows\System\rbBMRwf.exe

Filesize
2.0MB

MD5
000baa03439392b781e9a9a9cf736f58

SHA1
7ade3ee5b9636e60aafb6b3df39558ec1760caac

SHA256
fd0acaf8e9741d3e47a39cd1f8c232cbeeb992bf230a97a047620e9ce7f595cd

SHA512
a7bf71c27a8e137176de69fd48d1f187e9d24513ff3b6af3ea0c1c7238ca50e279b2306da3977b20be270999d1b2a52bbc4874ace850aa02de6169a092c1fdd1

Download Submit
C:\Windows\System\vxjNTOT.exe

Filesize
2.0MB

MD5
b47af6740f29fb79baab5b8aea23ca4b

SHA1
8596d4f279f7a16825ea16a9cf5bbc7416b0c572

SHA256
dfce0324e5cf3ebcc169318b45691a224636db26d0150c3ee17306e94fea5475

SHA512
2a503fdb325ac2a42ba7b37099cac792ab21db023e9315b5f617f4423ef7898c158ac646809f48300af21d4f7d8881b97ae7933d19bcce8e56cf906f71dbdef5

Download Submit
C:\Windows\System\zEHGElp.exe

Filesize
2.0MB

MD5
ce9982f0dde914fe33181b488c5913cc

SHA1
2298ad796b7d9bd370ce90883c9a453872a2628f

SHA256
9766d87a8daa61348e3a75173863cc8a3767e2cb13f253ad953e71fea73dc3b2

SHA512
9fdcfef3c216fede5d8d75e851490f0084cac533738c9e43f0741c93fa32c239eb0f0fb3f99b9b4f50ecf302b3c0ec510a0ac468b8ea9a195ee2fa017354734b

Download Submit
C:\Windows\System\zPxLWgV.exe

Filesize
2.0MB

MD5
2467c1f5dc98b529d701a44d31a13f67

SHA1
4d7d28a291aa5a47f1682d0252521d65ac2b42ad

SHA256
1ae663747f7e8b58f8948406aebf330be08acc463c8312949bf8d6adc85e454a

SHA512
a0fa5574de56f65fde116d3adb5ee76717c174afed3b98926a331954d9d9bdcceafd9080db7061eaa5f4323db43aabd57fe03a06ed322bde77a6ffa4ccdb2a05

Download Submit
memory/668-100-0x00007FF6E4930000-0x00007FF6E4D22000-memory.dmp

Filesize
3.9MB

Download
memory/668-6344-0x00007FF6E4930000-0x00007FF6E4D22000-memory.dmp

Filesize
3.9MB

Download
memory/784-517-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp

Filesize
3.9MB

Download
memory/784-6372-0x00007FF731AB0000-0x00007FF731EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-6369-0x00007FF6E8C90000-0x00007FF6E9082000-memory.dmp

Filesize
3.9MB

Download
memory/1276-326-0x00007FF6E8C90000-0x00007FF6E9082000-memory.dmp

Filesize
3.9MB

Download
memory/1372-6401-0x00007FF78F400000-0x00007FF78F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-485-0x00007FF78F400000-0x00007FF78F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-58-0x00007FF76EBB0000-0x00007FF76EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-6334-0x00007FF76EBB0000-0x00007FF76EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-39-0x00007FFE39A60000-0x00007FFE3A521000-memory.dmp

Filesize
10.8MB

Download
memory/2000-71-0x000001A3BDF30000-0x000001A3BDF52000-memory.dmp

Filesize
136KB

Download
memory/2244-330-0x00007FF60A700000-0x00007FF60AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-6416-0x00007FF60A700000-0x00007FF60AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-516-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-6326-0x00007FF76F300000-0x00007FF76F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-329-0x00007FF62EF90000-0x00007FF62F382000-memory.dmp

Filesize
3.9MB

Download
memory/2428-6390-0x00007FF62EF90000-0x00007FF62F382000-memory.dmp

Filesize
3.9MB

Download
memory/2448-0-0x00007FF64C0E0000-0x00007FF64C4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-1-0x000001BB20D20000-0x000001BB20D30000-memory.dmp

Filesize
64KB

Download
memory/2516-6375-0x00007FF6FA650000-0x00007FF6FAA42000-memory.dmp

Filesize
3.9MB

Download
memory/2516-294-0x00007FF6FA650000-0x00007FF6FAA42000-memory.dmp

Filesize
3.9MB

Download
memory/2704-6412-0x00007FF6F2600000-0x00007FF6F29F2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-438-0x00007FF6F2600000-0x00007FF6F29F2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-6382-0x00007FF708350000-0x00007FF708742000-memory.dmp

Filesize
3.9MB

Download
memory/3092-331-0x00007FF708350000-0x00007FF708742000-memory.dmp

Filesize
3.9MB

Download
memory/3460-6387-0x00007FF6053D0000-0x00007FF6057C2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-638-0x00007FF6053D0000-0x00007FF6057C2000-memory.dmp

Filesize
3.9MB

Download
memory/3484-232-0x00007FF65CA50000-0x00007FF65CE42000-memory.dmp

Filesize
3.9MB

Download
memory/3484-6354-0x00007FF65CA50000-0x00007FF65CE42000-memory.dmp

Filesize
3.9MB

Download
memory/3524-6388-0x00007FF71ACD0000-0x00007FF71B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-622-0x00007FF71ACD0000-0x00007FF71B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-6363-0x00007FF680100000-0x00007FF6804F2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-239-0x00007FF680100000-0x00007FF6804F2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-338-0x00007FF6C3830000-0x00007FF6C3C22000-memory.dmp

Filesize
3.9MB

Download
memory/3720-6392-0x00007FF6C3830000-0x00007FF6C3C22000-memory.dmp

Filesize
3.9MB

Download
memory/3768-6330-0x00007FF645390000-0x00007FF645782000-memory.dmp

Filesize
3.9MB

Download
memory/3768-142-0x00007FF645390000-0x00007FF645782000-memory.dmp

Filesize
3.9MB

Download
memory/3776-437-0x00007FF7482D0000-0x00007FF7486C2000-memory.dmp

Filesize
3.9MB

Download
memory/3776-6398-0x00007FF7482D0000-0x00007FF7486C2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-186-0x00007FF7009E0000-0x00007FF700DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-6360-0x00007FF7009E0000-0x00007FF700DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-6349-0x00007FF6B2060000-0x00007FF6B2452000-memory.dmp

Filesize
3.9MB

Download
memory/4028-291-0x00007FF6B2060000-0x00007FF6B2452000-memory.dmp

Filesize
3.9MB

Download
memory/4548-6340-0x00007FF687B60000-0x00007FF687F52000-memory.dmp

Filesize
3.9MB

Download
memory/4548-54-0x00007FF687B60000-0x00007FF687F52000-memory.dmp

Filesize
3.9MB

Download