xmrig | 2a3fcc9f198b43755c652672f90fe09c6ae866ea36971279a8c132e32f14f80d

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
Size

1.9MB
MD5

09cfc6e7fe9de3c6fd3353c7515cfe9b
SHA1

dec3ddf9f4fe03ae23d13cc43eef0f800a29f4dc
SHA256

2a3fcc9f198b43755c652672f90fe09c6ae866ea36971279a8c132e32f14f80d
SHA512

deaae1d1a7a734b454272e5eeeab1d2963b0edfc390e3bafb4bc772d9033765187bd0daf418d182f1cecb656f428110635125c63480ec2c11e2fe214f2c6ac9b
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U7g:NABJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1208-249-0x00007FF61DA20000-0x00007FF61DE12000-memory.dmp	xmrig
behavioral2/memory/5064-317-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	xmrig
behavioral2/memory/920-227-0x00007FF79BEE0000-0x00007FF79C2D2000-memory.dmp	xmrig
behavioral2/memory/4876-356-0x00007FF6CA860000-0x00007FF6CAC52000-memory.dmp	xmrig
behavioral2/memory/2140-405-0x00007FF733970000-0x00007FF733D62000-memory.dmp	xmrig
behavioral2/memory/1176-406-0x00007FF64B8F0000-0x00007FF64BCE2000-memory.dmp	xmrig
behavioral2/memory/2904-407-0x00007FF77B470000-0x00007FF77B862000-memory.dmp	xmrig
behavioral2/memory/4444-408-0x00007FF6DDF20000-0x00007FF6DE312000-memory.dmp	xmrig
behavioral2/memory/1676-409-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	xmrig
behavioral2/memory/5040-497-0x00007FF6DB9F0000-0x00007FF6DBDE2000-memory.dmp	xmrig
behavioral2/memory/3708-494-0x00007FF65F460000-0x00007FF65F852000-memory.dmp	xmrig
behavioral2/memory/2544-410-0x00007FF71F180000-0x00007FF71F572000-memory.dmp	xmrig
behavioral2/memory/1780-1214-0x00007FF673CC0000-0x00007FF6740B2000-memory.dmp	xmrig
behavioral2/memory/1724-800-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/memory/4632-648-0x00007FF6D08C0000-0x00007FF6D0CB2000-memory.dmp	xmrig
behavioral2/memory/4104-582-0x00007FF714CB0000-0x00007FF7150A2000-memory.dmp	xmrig
behavioral2/memory/760-205-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp	xmrig
behavioral2/memory/4992-156-0x00007FF71F640000-0x00007FF71FA32000-memory.dmp	xmrig
behavioral2/memory/1116-142-0x00007FF709630000-0x00007FF709A22000-memory.dmp	xmrig
behavioral2/memory/2000-108-0x00007FF6D06F0000-0x00007FF6D0AE2000-memory.dmp	xmrig
behavioral2/memory/4472-69-0x00007FF782AA0000-0x00007FF782E92000-memory.dmp	xmrig
behavioral2/memory/760-4814-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp	xmrig
behavioral2/memory/5064-4819-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	xmrig
behavioral2/memory/1116-4822-0x00007FF709630000-0x00007FF709A22000-memory.dmp	xmrig
behavioral2/memory/2544-4873-0x00007FF71F180000-0x00007FF71F572000-memory.dmp	xmrig
behavioral2/memory/1780-4930-0x00007FF673CC0000-0x00007FF6740B2000-memory.dmp	xmrig
behavioral2/memory/4632-4937-0x00007FF6D08C0000-0x00007FF6D0CB2000-memory.dmp	xmrig
behavioral2/memory/5040-4917-0x00007FF6DB9F0000-0x00007FF6DBDE2000-memory.dmp	xmrig
behavioral2/memory/4104-4914-0x00007FF714CB0000-0x00007FF7150A2000-memory.dmp	xmrig
behavioral2/memory/3708-4905-0x00007FF65F460000-0x00007FF65F852000-memory.dmp	xmrig
behavioral2/memory/1676-4888-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	xmrig
behavioral2/memory/4444-4884-0x00007FF6DDF20000-0x00007FF6DE312000-memory.dmp	xmrig
behavioral2/memory/2904-4867-0x00007FF77B470000-0x00007FF77B862000-memory.dmp	xmrig
behavioral2/memory/1176-4860-0x00007FF64B8F0000-0x00007FF64BCE2000-memory.dmp	xmrig
behavioral2/memory/1724-4862-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/memory/2140-4855-0x00007FF733970000-0x00007FF733D62000-memory.dmp	xmrig
behavioral2/memory/920-4844-0x00007FF79BEE0000-0x00007FF79C2D2000-memory.dmp	xmrig
behavioral2/memory/1208-4837-0x00007FF61DA20000-0x00007FF61DE12000-memory.dmp	xmrig
behavioral2/memory/4992-4829-0x00007FF71F640000-0x00007FF71FA32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4472	gClNfXB.exe
2000	jlJHVuT.exe
1116	HBtfulp.exe
4992	nwlVbkI.exe
760	FNKfEEL.exe
920	mhCiDJa.exe
1208	YCOAlVk.exe
5064	ZuGKCIt.exe
4876	IsdBnSo.exe
2140	NrDfKJF.exe
1724	VbamGkX.exe
1176	MAYekGo.exe
2904	HqMDIai.exe
4444	STlZOoz.exe
1780	qhzcYlS.exe
1676	IDukKWa.exe
2544	zsAjsni.exe
3708	rYKqNeH.exe
5040	YdqnJfK.exe
4104	ffwyVTN.exe
4632	iytjrZU.exe
3556	RBfpqSJ.exe
2088	XeNaBez.exe
1672	ukJwslP.exe
4912	RyzWeUj.exe
1980	VdqzLTO.exe
3416	yvZKjQY.exe
3568	NsifaXW.exe
3268	xwGziPO.exe
2384	eRSRSEk.exe
3640	EhhDNtt.exe
4828	DPMtoQk.exe
2576	ixRQrAq.exe
2684	BDTZHCb.exe
1968	WfOLUNG.exe
4148	YQYQVKJ.exe
1296	ECAZiJt.exe
4516	EpgAfVS.exe
948	JMLqxrF.exe
4420	IaIuxmq.exe
3672	ReyvUmJ.exe
1664	lXFWbmG.exe
3892	ZgqVldG.exe
3620	pmknGjU.exe
1580	KYlypIg.exe
636	dyGatLd.exe
3132	IiUZmHi.exe
768	aEXbRRL.exe
4888	WEedwer.exe
2540	HAwIqsS.exe
3492	VejRTIj.exe
1632	dXJgBlX.exe
4412	SvOSrul.exe
1280	APBkMFU.exe
3928	cVjpjNx.exe
4512	TGGEuaE.exe
1844	NCyPAjz.exe
3860	SwqDVbh.exe
1876	urkWwkR.exe
4404	HBaJoHq.exe
1408	Natnqyc.exe
4852	NWrUmzo.exe
1736	eCBdvGY.exe
5108	cGbKUgo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2404-0-0x00007FF652580000-0x00007FF652972000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-6.dat	upx
behavioral2/files/0x000a000000023b88-9.dat	upx
behavioral2/files/0x000a000000023b8b-25.dat	upx
behavioral2/files/0x000a000000023b97-78.dat	upx
behavioral2/files/0x000a000000023b9c-98.dat	upx
behavioral2/files/0x000a000000023b95-127.dat	upx
behavioral2/memory/1208-249-0x00007FF61DA20000-0x00007FF61DE12000-memory.dmp	upx
behavioral2/memory/5064-317-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	upx
behavioral2/memory/920-227-0x00007FF79BEE0000-0x00007FF79C2D2000-memory.dmp	upx
behavioral2/memory/4876-356-0x00007FF6CA860000-0x00007FF6CAC52000-memory.dmp	upx
behavioral2/memory/2140-405-0x00007FF733970000-0x00007FF733D62000-memory.dmp	upx
behavioral2/memory/1176-406-0x00007FF64B8F0000-0x00007FF64BCE2000-memory.dmp	upx
behavioral2/memory/2904-407-0x00007FF77B470000-0x00007FF77B862000-memory.dmp	upx
behavioral2/memory/4444-408-0x00007FF6DDF20000-0x00007FF6DE312000-memory.dmp	upx
behavioral2/memory/1676-409-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp	upx
behavioral2/memory/5040-497-0x00007FF6DB9F0000-0x00007FF6DBDE2000-memory.dmp	upx
behavioral2/memory/3708-494-0x00007FF65F460000-0x00007FF65F852000-memory.dmp	upx
behavioral2/memory/2544-410-0x00007FF71F180000-0x00007FF71F572000-memory.dmp	upx
behavioral2/memory/1780-1214-0x00007FF673CC0000-0x00007FF6740B2000-memory.dmp	upx
behavioral2/memory/1724-800-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp	upx
behavioral2/memory/4632-648-0x00007FF6D08C0000-0x00007FF6D0CB2000-memory.dmp	upx
behavioral2/memory/4104-582-0x00007FF714CB0000-0x00007FF7150A2000-memory.dmp	upx
behavioral2/memory/760-205-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-203.dat	upx
behavioral2/files/0x000a000000023bac-202.dat	upx
behavioral2/files/0x000a000000023bab-201.dat	upx
behavioral2/files/0x000a000000023baa-187.dat	upx
behavioral2/files/0x000a000000023ba0-185.dat	upx
behavioral2/files/0x000a000000023ba9-181.dat	upx
behavioral2/files/0x000a000000023b99-173.dat	upx
behavioral2/files/0x000a000000023b9a-171.dat	upx
behavioral2/files/0x000a000000023ba8-170.dat	upx
behavioral2/files/0x000a000000023b98-164.dat	upx
behavioral2/files/0x000a000000023ba7-158.dat	upx
behavioral2/files/0x000a000000023ba6-157.dat	upx
behavioral2/memory/4992-156-0x00007FF71F640000-0x00007FF71FA32000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-150.dat	upx
behavioral2/files/0x000a000000023ba5-149.dat	upx
behavioral2/files/0x000a000000023ba4-143.dat	upx
behavioral2/memory/1116-142-0x00007FF709630000-0x00007FF709A22000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-140.dat	upx
behavioral2/files/0x000a000000023ba1-131.dat	upx
behavioral2/files/0x000a000000023b8f-125.dat	upx
behavioral2/files/0x000a000000023b9e-118.dat	upx
behavioral2/memory/2000-108-0x00007FF6D06F0000-0x00007FF6D0AE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-104.dat	upx
behavioral2/files/0x000a000000023b93-103.dat	upx
behavioral2/files/0x000a000000023ba2-139.dat	upx
behavioral2/files/0x000a000000023b91-94.dat	upx
behavioral2/files/0x000a000000023b9b-93.dat	upx
behavioral2/files/0x000a000000023b9f-126.dat	upx
behavioral2/files/0x000a000000023b90-89.dat	upx
behavioral2/files/0x000a000000023b92-81.dat	upx
behavioral2/files/0x000a000000023b96-76.dat	upx
behavioral2/memory/4472-69-0x00007FF782AA0000-0x00007FF782E92000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-67.dat	upx
behavioral2/files/0x000a000000023b8c-61.dat	upx
behavioral2/files/0x000a000000023b8a-55.dat	upx
behavioral2/files/0x000a000000023b8e-40.dat	upx
behavioral2/files/0x000d000000023b10-8.dat	upx
behavioral2/memory/760-4814-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp	upx
behavioral2/memory/5064-4819-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp	upx
behavioral2/memory/1116-4822-0x00007FF709630000-0x00007FF709A22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\Geifopo.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\gdAQnem.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\GHgGmmB.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\MHmmsCB.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\tcLcBxe.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\FUPVgju.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\RkDWBlh.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\OvZYpor.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\yMpXZDZ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\xYStHir.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\IeUEUGJ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\nDRfFSY.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\afpbGzE.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\kHaOuOH.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\YYOozja.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\LzaTezA.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\Eroiait.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\izQWbsx.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ZYJRPDS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\yzszOQp.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\levdGwZ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\vmSINcX.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\gbuuJdf.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\WlCsvAm.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\TBURZQg.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\XhgdUzI.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\QOketyG.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\xAKimYl.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\tCpRiGH.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\JqLRnpp.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\dljxWDc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EnwGAzF.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\gdxdOHr.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\wdRZWic.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\HqUvohp.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\koDbJMF.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\DZqGykl.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\jjvwqFK.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\FXqMHsU.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\vqMQTxN.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\lyqCkaz.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ZHZlNKd.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\iYwlNeM.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ioVlbRV.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\WClQPWU.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\zuKWJBc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\tLoueeo.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\dIUHLQt.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\tHtRIDn.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ICpzPdF.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ULAKhUK.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\mFYzmna.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\FIbGExO.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\fbhxkNN.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\FhaSVNH.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\KRGmdjH.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\aANQmCE.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EYsIZoS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\kOnHDcX.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\iWCdbfU.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\lNNUpIG.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\qWQuLIi.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ODJOHPi.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\AFWRskQ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeLockMemoryPrivilege	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2772	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	87
PID 2404 wrote to memory of 2772	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	87
PID 2404 wrote to memory of 4472	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	88
PID 2404 wrote to memory of 4472	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	88
PID 2404 wrote to memory of 2000	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	89
PID 2404 wrote to memory of 2000	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	89
PID 2404 wrote to memory of 1116	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	90
PID 2404 wrote to memory of 1116	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	90
PID 2404 wrote to memory of 4992	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	91
PID 2404 wrote to memory of 4992	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	91
PID 2404 wrote to memory of 760	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	92
PID 2404 wrote to memory of 760	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	92
PID 2404 wrote to memory of 920	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	93
PID 2404 wrote to memory of 920	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	93
PID 2404 wrote to memory of 1208	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	94
PID 2404 wrote to memory of 1208	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	94
PID 2404 wrote to memory of 5064	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	95
PID 2404 wrote to memory of 5064	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	95
PID 2404 wrote to memory of 4876	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	96
PID 2404 wrote to memory of 4876	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	96
PID 2404 wrote to memory of 2140	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	97
PID 2404 wrote to memory of 2140	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	97
PID 2404 wrote to memory of 1724	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	98
PID 2404 wrote to memory of 1724	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	98
PID 2404 wrote to memory of 2544	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	99
PID 2404 wrote to memory of 2544	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	99
PID 2404 wrote to memory of 1176	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	100
PID 2404 wrote to memory of 1176	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	100
PID 2404 wrote to memory of 2904	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	101
PID 2404 wrote to memory of 2904	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	101
PID 2404 wrote to memory of 4444	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	102
PID 2404 wrote to memory of 4444	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	102
PID 2404 wrote to memory of 1780	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	103
PID 2404 wrote to memory of 1780	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	103
PID 2404 wrote to memory of 1676	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	104
PID 2404 wrote to memory of 1676	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	104
PID 2404 wrote to memory of 3708	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	105
PID 2404 wrote to memory of 3708	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	105
PID 2404 wrote to memory of 5040	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	106
PID 2404 wrote to memory of 5040	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	106
PID 2404 wrote to memory of 4104	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	107
PID 2404 wrote to memory of 4104	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	107
PID 2404 wrote to memory of 4632	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	108
PID 2404 wrote to memory of 4632	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	108
PID 2404 wrote to memory of 3556	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	109
PID 2404 wrote to memory of 3556	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	109
PID 2404 wrote to memory of 2088	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	110
PID 2404 wrote to memory of 2088	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	110
PID 2404 wrote to memory of 1672	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	111
PID 2404 wrote to memory of 1672	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	111
PID 2404 wrote to memory of 4912	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	112
PID 2404 wrote to memory of 4912	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	112
PID 2404 wrote to memory of 1980	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	113
PID 2404 wrote to memory of 1980	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	113
PID 2404 wrote to memory of 3416	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	114
PID 2404 wrote to memory of 3416	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	114
PID 2404 wrote to memory of 3568	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	115
PID 2404 wrote to memory of 3568	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	115
PID 2404 wrote to memory of 3268	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	116
PID 2404 wrote to memory of 3268	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	116
PID 2404 wrote to memory of 2384	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	117
PID 2404 wrote to memory of 2384	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	117
PID 2404 wrote to memory of 3640	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	118
PID 2404 wrote to memory of 3640	2404	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System\gClNfXB.exe
  C:\Windows\System\gClNfXB.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\jlJHVuT.exe
  C:\Windows\System\jlJHVuT.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\HBtfulp.exe
  C:\Windows\System\HBtfulp.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\nwlVbkI.exe
  C:\Windows\System\nwlVbkI.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FNKfEEL.exe
  C:\Windows\System\FNKfEEL.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\mhCiDJa.exe
  C:\Windows\System\mhCiDJa.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\YCOAlVk.exe
  C:\Windows\System\YCOAlVk.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\ZuGKCIt.exe
  C:\Windows\System\ZuGKCIt.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\IsdBnSo.exe
  C:\Windows\System\IsdBnSo.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NrDfKJF.exe
  C:\Windows\System\NrDfKJF.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\VbamGkX.exe
  C:\Windows\System\VbamGkX.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\zsAjsni.exe
  C:\Windows\System\zsAjsni.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\MAYekGo.exe
  C:\Windows\System\MAYekGo.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\HqMDIai.exe
  C:\Windows\System\HqMDIai.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\STlZOoz.exe
  C:\Windows\System\STlZOoz.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\qhzcYlS.exe
  C:\Windows\System\qhzcYlS.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\IDukKWa.exe
  C:\Windows\System\IDukKWa.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rYKqNeH.exe
  C:\Windows\System\rYKqNeH.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\YdqnJfK.exe
  C:\Windows\System\YdqnJfK.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\ffwyVTN.exe
  C:\Windows\System\ffwyVTN.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\iytjrZU.exe
  C:\Windows\System\iytjrZU.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\RBfpqSJ.exe
  C:\Windows\System\RBfpqSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\XeNaBez.exe
  C:\Windows\System\XeNaBez.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ukJwslP.exe
  C:\Windows\System\ukJwslP.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\RyzWeUj.exe
  C:\Windows\System\RyzWeUj.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\VdqzLTO.exe
  C:\Windows\System\VdqzLTO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\yvZKjQY.exe
  C:\Windows\System\yvZKjQY.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\NsifaXW.exe
  C:\Windows\System\NsifaXW.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\xwGziPO.exe
  C:\Windows\System\xwGziPO.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\eRSRSEk.exe
  C:\Windows\System\eRSRSEk.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\EhhDNtt.exe
  C:\Windows\System\EhhDNtt.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\DPMtoQk.exe
  C:\Windows\System\DPMtoQk.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\ixRQrAq.exe
  C:\Windows\System\ixRQrAq.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\BDTZHCb.exe
  C:\Windows\System\BDTZHCb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WfOLUNG.exe
  C:\Windows\System\WfOLUNG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\YQYQVKJ.exe
  C:\Windows\System\YQYQVKJ.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\ECAZiJt.exe
  C:\Windows\System\ECAZiJt.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\EpgAfVS.exe
  C:\Windows\System\EpgAfVS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\JMLqxrF.exe
  C:\Windows\System\JMLqxrF.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\IaIuxmq.exe
  C:\Windows\System\IaIuxmq.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\ReyvUmJ.exe
  C:\Windows\System\ReyvUmJ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\lXFWbmG.exe
  C:\Windows\System\lXFWbmG.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ZgqVldG.exe
  C:\Windows\System\ZgqVldG.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\pmknGjU.exe
  C:\Windows\System\pmknGjU.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\KYlypIg.exe
  C:\Windows\System\KYlypIg.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\dyGatLd.exe
  C:\Windows\System\dyGatLd.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\IiUZmHi.exe
  C:\Windows\System\IiUZmHi.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\aEXbRRL.exe
  C:\Windows\System\aEXbRRL.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\WEedwer.exe
  C:\Windows\System\WEedwer.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\HAwIqsS.exe
  C:\Windows\System\HAwIqsS.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\VejRTIj.exe
  C:\Windows\System\VejRTIj.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\dXJgBlX.exe
  C:\Windows\System\dXJgBlX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\SvOSrul.exe
  C:\Windows\System\SvOSrul.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\APBkMFU.exe
  C:\Windows\System\APBkMFU.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\cVjpjNx.exe
  C:\Windows\System\cVjpjNx.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\TGGEuaE.exe
  C:\Windows\System\TGGEuaE.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\NCyPAjz.exe
  C:\Windows\System\NCyPAjz.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\SwqDVbh.exe
  C:\Windows\System\SwqDVbh.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\urkWwkR.exe
  C:\Windows\System\urkWwkR.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\HBaJoHq.exe
  C:\Windows\System\HBaJoHq.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\NWrUmzo.exe
  C:\Windows\System\NWrUmzo.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\Natnqyc.exe
  C:\Windows\System\Natnqyc.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\eCBdvGY.exe
  C:\Windows\System\eCBdvGY.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\cGbKUgo.exe
  C:\Windows\System\cGbKUgo.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\WarFkQk.exe
  C:\Windows\System\WarFkQk.exe
  2⤵
  PID:4940
- C:\Windows\System\AjFVEcN.exe
  C:\Windows\System\AjFVEcN.exe
  2⤵
  PID:4480
- C:\Windows\System\mwHSpkS.exe
  C:\Windows\System\mwHSpkS.exe
  2⤵
  PID:1708
- C:\Windows\System\zCigPXy.exe
  C:\Windows\System\zCigPXy.exe
  2⤵
  PID:1668
- C:\Windows\System\ewmDhDC.exe
  C:\Windows\System\ewmDhDC.exe
  2⤵
  PID:3664
- C:\Windows\System\pzgKfoj.exe
  C:\Windows\System\pzgKfoj.exe
  2⤵
  PID:744
- C:\Windows\System\uKRppqy.exe
  C:\Windows\System\uKRppqy.exe
  2⤵
  PID:4732
- C:\Windows\System\htwRJtt.exe
  C:\Windows\System\htwRJtt.exe
  2⤵
  PID:1452
- C:\Windows\System\eaBAExA.exe
  C:\Windows\System\eaBAExA.exe
  2⤵
  PID:3212
- C:\Windows\System\rvETrWn.exe
  C:\Windows\System\rvETrWn.exe
  2⤵
  PID:5044
- C:\Windows\System\EGrtmME.exe
  C:\Windows\System\EGrtmME.exe
  2⤵
  PID:3872
- C:\Windows\System\BCqToSl.exe
  C:\Windows\System\BCqToSl.exe
  2⤵
  PID:3448
- C:\Windows\System\YOacRRK.exe
  C:\Windows\System\YOacRRK.exe
  2⤵
  PID:5136
- C:\Windows\System\tFvWYjy.exe
  C:\Windows\System\tFvWYjy.exe
  2⤵
  PID:5160
- C:\Windows\System\dgHUROP.exe
  C:\Windows\System\dgHUROP.exe
  2⤵
  PID:5180
- C:\Windows\System\rOEJSIw.exe
  C:\Windows\System\rOEJSIw.exe
  2⤵
  PID:5212
- C:\Windows\System\tNDCgeT.exe
  C:\Windows\System\tNDCgeT.exe
  2⤵
  PID:5232
- C:\Windows\System\KBoWgEq.exe
  C:\Windows\System\KBoWgEq.exe
  2⤵
  PID:5248
- C:\Windows\System\StvXmJW.exe
  C:\Windows\System\StvXmJW.exe
  2⤵
  PID:5272
- C:\Windows\System\guGVYEX.exe
  C:\Windows\System\guGVYEX.exe
  2⤵
  PID:5292
- C:\Windows\System\cTRMrjW.exe
  C:\Windows\System\cTRMrjW.exe
  2⤵
  PID:5312
- C:\Windows\System\nFQOQhP.exe
  C:\Windows\System\nFQOQhP.exe
  2⤵
  PID:5328
- C:\Windows\System\BHdeIso.exe
  C:\Windows\System\BHdeIso.exe
  2⤵
  PID:5348
- C:\Windows\System\rbsRXaX.exe
  C:\Windows\System\rbsRXaX.exe
  2⤵
  PID:5368
- C:\Windows\System\zXHxlbC.exe
  C:\Windows\System\zXHxlbC.exe
  2⤵
  PID:5388
- C:\Windows\System\CJyzJVB.exe
  C:\Windows\System\CJyzJVB.exe
  2⤵
  PID:5408
- C:\Windows\System\PKxsZhq.exe
  C:\Windows\System\PKxsZhq.exe
  2⤵
  PID:5428
- C:\Windows\System\kycmgez.exe
  C:\Windows\System\kycmgez.exe
  2⤵
  PID:5456
- C:\Windows\System\fVuYTVo.exe
  C:\Windows\System\fVuYTVo.exe
  2⤵
  PID:5476
- C:\Windows\System\cMdWhuL.exe
  C:\Windows\System\cMdWhuL.exe
  2⤵
  PID:5496
- C:\Windows\System\yZjImJP.exe
  C:\Windows\System\yZjImJP.exe
  2⤵
  PID:5512
- C:\Windows\System\BPeHtOl.exe
  C:\Windows\System\BPeHtOl.exe
  2⤵
  PID:5544
- C:\Windows\System\oETbVuX.exe
  C:\Windows\System\oETbVuX.exe
  2⤵
  PID:5568
- C:\Windows\System\IpgKTmP.exe
  C:\Windows\System\IpgKTmP.exe
  2⤵
  PID:5596
- C:\Windows\System\CPIaSPu.exe
  C:\Windows\System\CPIaSPu.exe
  2⤵
  PID:5632
- C:\Windows\System\AyahJWZ.exe
  C:\Windows\System\AyahJWZ.exe
  2⤵
  PID:5652
- C:\Windows\System\UArWrsl.exe
  C:\Windows\System\UArWrsl.exe
  2⤵
  PID:5672
- C:\Windows\System\EvDyIWY.exe
  C:\Windows\System\EvDyIWY.exe
  2⤵
  PID:5696
- C:\Windows\System\tWYklyz.exe
  C:\Windows\System\tWYklyz.exe
  2⤵
  PID:5720
- C:\Windows\System\oFMUiNJ.exe
  C:\Windows\System\oFMUiNJ.exe
  2⤵
  PID:5740
- C:\Windows\System\RBcAVTJ.exe
  C:\Windows\System\RBcAVTJ.exe
  2⤵
  PID:5756
- C:\Windows\System\aaFzPmI.exe
  C:\Windows\System\aaFzPmI.exe
  2⤵
  PID:5864
- C:\Windows\System\nZftWBb.exe
  C:\Windows\System\nZftWBb.exe
  2⤵
  PID:5884
- C:\Windows\System\GehbhBh.exe
  C:\Windows\System\GehbhBh.exe
  2⤵
  PID:5900
- C:\Windows\System\XDBQhwo.exe
  C:\Windows\System\XDBQhwo.exe
  2⤵
  PID:5916
- C:\Windows\System\RLrkwft.exe
  C:\Windows\System\RLrkwft.exe
  2⤵
  PID:5944
- C:\Windows\System\vCfCuxM.exe
  C:\Windows\System\vCfCuxM.exe
  2⤵
  PID:5960
- C:\Windows\System\CMCRDoh.exe
  C:\Windows\System\CMCRDoh.exe
  2⤵
  PID:5984
- C:\Windows\System\IqAGnmB.exe
  C:\Windows\System\IqAGnmB.exe
  2⤵
  PID:6036
- C:\Windows\System\rlnTHMD.exe
  C:\Windows\System\rlnTHMD.exe
  2⤵
  PID:6060
- C:\Windows\System\JTeIXnp.exe
  C:\Windows\System\JTeIXnp.exe
  2⤵
  PID:6076
- C:\Windows\System\CuYdNjm.exe
  C:\Windows\System\CuYdNjm.exe
  2⤵
  PID:6100
- C:\Windows\System\vTaxHbE.exe
  C:\Windows\System\vTaxHbE.exe
  2⤵
  PID:6116
- C:\Windows\System\PMXULVk.exe
  C:\Windows\System\PMXULVk.exe
  2⤵
  PID:6140
- C:\Windows\System\YzFiaeY.exe
  C:\Windows\System\YzFiaeY.exe
  2⤵
  PID:1600
- C:\Windows\System\JlchzFy.exe
  C:\Windows\System\JlchzFy.exe
  2⤵
  PID:1560
- C:\Windows\System\FVdzyJB.exe
  C:\Windows\System\FVdzyJB.exe
  2⤵
  PID:1712
- C:\Windows\System\ZrRfuwg.exe
  C:\Windows\System\ZrRfuwg.exe
  2⤵
  PID:4440
- C:\Windows\System\eFotuNr.exe
  C:\Windows\System\eFotuNr.exe
  2⤵
  PID:3012
- C:\Windows\System\LlmFlND.exe
  C:\Windows\System\LlmFlND.exe
  2⤵
  PID:4160
- C:\Windows\System\YotEBvQ.exe
  C:\Windows\System\YotEBvQ.exe
  2⤵
  PID:2708
- C:\Windows\System\BLGNcvi.exe
  C:\Windows\System\BLGNcvi.exe
  2⤵
  PID:4984
- C:\Windows\System\xJfhFnn.exe
  C:\Windows\System\xJfhFnn.exe
  2⤵
  PID:4816
- C:\Windows\System\VIkBViZ.exe
  C:\Windows\System\VIkBViZ.exe
  2⤵
  PID:5072
- C:\Windows\System\oxSVPay.exe
  C:\Windows\System\oxSVPay.exe
  2⤵
  PID:5052
- C:\Windows\System\IlgpuiE.exe
  C:\Windows\System\IlgpuiE.exe
  2⤵
  PID:3520
- C:\Windows\System\iYHTNcI.exe
  C:\Windows\System\iYHTNcI.exe
  2⤵
  PID:5644
- C:\Windows\System\ngoHYvc.exe
  C:\Windows\System\ngoHYvc.exe
  2⤵
  PID:5224
- C:\Windows\System\yRghLim.exe
  C:\Windows\System\yRghLim.exe
  2⤵
  PID:1924
- C:\Windows\System\RoryeuK.exe
  C:\Windows\System\RoryeuK.exe
  2⤵
  PID:5996
- C:\Windows\System\gyZzkgP.exe
  C:\Windows\System\gyZzkgP.exe
  2⤵
  PID:6016
- C:\Windows\System\eSuzsqu.exe
  C:\Windows\System\eSuzsqu.exe
  2⤵
  PID:5364
- C:\Windows\System\breNXhH.exe
  C:\Windows\System\breNXhH.exe
  2⤵
  PID:5424
- C:\Windows\System\DEraPeW.exe
  C:\Windows\System\DEraPeW.exe
  2⤵
  PID:5448
- C:\Windows\System\ZuHmjLB.exe
  C:\Windows\System\ZuHmjLB.exe
  2⤵
  PID:5504
- C:\Windows\System\UbBcdqW.exe
  C:\Windows\System\UbBcdqW.exe
  2⤵
  PID:6084
- C:\Windows\System\DyAJXrV.exe
  C:\Windows\System\DyAJXrV.exe
  2⤵
  PID:5552
- C:\Windows\System\zMShCGK.exe
  C:\Windows\System\zMShCGK.exe
  2⤵
  PID:5764
- C:\Windows\System\lMTsqBP.exe
  C:\Windows\System\lMTsqBP.exe
  2⤵
  PID:5556
- C:\Windows\System\TJHAAbm.exe
  C:\Windows\System\TJHAAbm.exe
  2⤵
  PID:5628
- C:\Windows\System\PzWEZzX.exe
  C:\Windows\System\PzWEZzX.exe
  2⤵
  PID:5688
- C:\Windows\System\HXNpXlF.exe
  C:\Windows\System\HXNpXlF.exe
  2⤵
  PID:5732
- C:\Windows\System\WCPpoem.exe
  C:\Windows\System\WCPpoem.exe
  2⤵
  PID:2092
- C:\Windows\System\ZZdwdqE.exe
  C:\Windows\System\ZZdwdqE.exe
  2⤵
  PID:5908
- C:\Windows\System\fOVgUMO.exe
  C:\Windows\System\fOVgUMO.exe
  2⤵
  PID:6108
- C:\Windows\System\SmWVgxJ.exe
  C:\Windows\System\SmWVgxJ.exe
  2⤵
  PID:1488
- C:\Windows\System\XzJHpLz.exe
  C:\Windows\System\XzJHpLz.exe
  2⤵
  PID:4576
- C:\Windows\System\PHMyWLZ.exe
  C:\Windows\System\PHMyWLZ.exe
  2⤵
  PID:6156
- C:\Windows\System\MhoZjIs.exe
  C:\Windows\System\MhoZjIs.exe
  2⤵
  PID:6176
- C:\Windows\System\APsRayS.exe
  C:\Windows\System\APsRayS.exe
  2⤵
  PID:6196
- C:\Windows\System\LKZtnpx.exe
  C:\Windows\System\LKZtnpx.exe
  2⤵
  PID:6216
- C:\Windows\System\yrMqQHf.exe
  C:\Windows\System\yrMqQHf.exe
  2⤵
  PID:6232
- C:\Windows\System\roOkBre.exe
  C:\Windows\System\roOkBre.exe
  2⤵
  PID:6256
- C:\Windows\System\zClomtd.exe
  C:\Windows\System\zClomtd.exe
  2⤵
  PID:6272
- C:\Windows\System\dYqaAgs.exe
  C:\Windows\System\dYqaAgs.exe
  2⤵
  PID:6296
- C:\Windows\System\pgiYiAP.exe
  C:\Windows\System\pgiYiAP.exe
  2⤵
  PID:6320
- C:\Windows\System\XHrpZdn.exe
  C:\Windows\System\XHrpZdn.exe
  2⤵
  PID:6336
- C:\Windows\System\kkpOgxJ.exe
  C:\Windows\System\kkpOgxJ.exe
  2⤵
  PID:6364
- C:\Windows\System\srqTrEO.exe
  C:\Windows\System\srqTrEO.exe
  2⤵
  PID:6384
- C:\Windows\System\AoMesDj.exe
  C:\Windows\System\AoMesDj.exe
  2⤵
  PID:6404
- C:\Windows\System\bfZmwmK.exe
  C:\Windows\System\bfZmwmK.exe
  2⤵
  PID:6424
- C:\Windows\System\kQqwEEd.exe
  C:\Windows\System\kQqwEEd.exe
  2⤵
  PID:6452
- C:\Windows\System\tMDSawz.exe
  C:\Windows\System\tMDSawz.exe
  2⤵
  PID:6476
- C:\Windows\System\jbHlDwk.exe
  C:\Windows\System\jbHlDwk.exe
  2⤵
  PID:6504
- C:\Windows\System\lsDUjbX.exe
  C:\Windows\System\lsDUjbX.exe
  2⤵
  PID:6524
- C:\Windows\System\hOULoaw.exe
  C:\Windows\System\hOULoaw.exe
  2⤵
  PID:6548
- C:\Windows\System\bMzQrMx.exe
  C:\Windows\System\bMzQrMx.exe
  2⤵
  PID:6576
- C:\Windows\System\fxSkpRC.exe
  C:\Windows\System\fxSkpRC.exe
  2⤵
  PID:6600
- C:\Windows\System\vDsowgB.exe
  C:\Windows\System\vDsowgB.exe
  2⤵
  PID:6624
- C:\Windows\System\NrFUZcc.exe
  C:\Windows\System\NrFUZcc.exe
  2⤵
  PID:6640
- C:\Windows\System\aebotZd.exe
  C:\Windows\System\aebotZd.exe
  2⤵
  PID:6660
- C:\Windows\System\txJRhzs.exe
  C:\Windows\System\txJRhzs.exe
  2⤵
  PID:6684
- C:\Windows\System\RUfXdtH.exe
  C:\Windows\System\RUfXdtH.exe
  2⤵
  PID:6712
- C:\Windows\System\NkSKHnV.exe
  C:\Windows\System\NkSKHnV.exe
  2⤵
  PID:6728
- C:\Windows\System\iZTaSiU.exe
  C:\Windows\System\iZTaSiU.exe
  2⤵
  PID:6748
- C:\Windows\System\nUwDEqh.exe
  C:\Windows\System\nUwDEqh.exe
  2⤵
  PID:6768
- C:\Windows\System\adJawJI.exe
  C:\Windows\System\adJawJI.exe
  2⤵
  PID:6792
- C:\Windows\System\mkuhgqA.exe
  C:\Windows\System\mkuhgqA.exe
  2⤵
  PID:6812
- C:\Windows\System\wZcryvU.exe
  C:\Windows\System\wZcryvU.exe
  2⤵
  PID:6836
- C:\Windows\System\heIIEMK.exe
  C:\Windows\System\heIIEMK.exe
  2⤵
  PID:6852
- C:\Windows\System\xUETPZy.exe
  C:\Windows\System\xUETPZy.exe
  2⤵
  PID:6884
- C:\Windows\System\zsvDwxJ.exe
  C:\Windows\System\zsvDwxJ.exe
  2⤵
  PID:6904
- C:\Windows\System\FYfIIBX.exe
  C:\Windows\System\FYfIIBX.exe
  2⤵
  PID:6924
- C:\Windows\System\cgoRYpm.exe
  C:\Windows\System\cgoRYpm.exe
  2⤵
  PID:6944
- C:\Windows\System\pAOPJfm.exe
  C:\Windows\System\pAOPJfm.exe
  2⤵
  PID:6960
- C:\Windows\System\FjdMEVc.exe
  C:\Windows\System\FjdMEVc.exe
  2⤵
  PID:6980
- C:\Windows\System\XcXVJLa.exe
  C:\Windows\System\XcXVJLa.exe
  2⤵
  PID:7004
- C:\Windows\System\UYcbCQP.exe
  C:\Windows\System\UYcbCQP.exe
  2⤵
  PID:7028
- C:\Windows\System\DkbLQOg.exe
  C:\Windows\System\DkbLQOg.exe
  2⤵
  PID:7048
- C:\Windows\System\eanwRLV.exe
  C:\Windows\System\eanwRLV.exe
  2⤵
  PID:7068
- C:\Windows\System\lKCEtbk.exe
  C:\Windows\System\lKCEtbk.exe
  2⤵
  PID:7092
- C:\Windows\System\PpvbgKY.exe
  C:\Windows\System\PpvbgKY.exe
  2⤵
  PID:7116
- C:\Windows\System\nPymAgD.exe
  C:\Windows\System\nPymAgD.exe
  2⤵
  PID:7136
- C:\Windows\System\WqsPbNh.exe
  C:\Windows\System\WqsPbNh.exe
  2⤵
  PID:7164
- C:\Windows\System\ziqiNhb.exe
  C:\Windows\System\ziqiNhb.exe
  2⤵
  PID:440
- C:\Windows\System\WkSPLHo.exe
  C:\Windows\System\WkSPLHo.exe
  2⤵
  PID:1260
- C:\Windows\System\ZMcapYp.exe
  C:\Windows\System\ZMcapYp.exe
  2⤵
  PID:4740
- C:\Windows\System\lrKjEGK.exe
  C:\Windows\System\lrKjEGK.exe
  2⤵
  PID:5260
- C:\Windows\System\YLLaszo.exe
  C:\Windows\System\YLLaszo.exe
  2⤵
  PID:5356
- C:\Windows\System\XlxNJJa.exe
  C:\Windows\System\XlxNJJa.exe
  2⤵
  PID:5804
- C:\Windows\System\nnBdFEE.exe
  C:\Windows\System\nnBdFEE.exe
  2⤵
  PID:5788
- C:\Windows\System\qSrRSCQ.exe
  C:\Windows\System\qSrRSCQ.exe
  2⤵
  PID:6072
- C:\Windows\System\koLgWhx.exe
  C:\Windows\System\koLgWhx.exe
  2⤵
  PID:3696
- C:\Windows\System\BJKuCGu.exe
  C:\Windows\System\BJKuCGu.exe
  2⤵
  PID:5728
- C:\Windows\System\ENxArOS.exe
  C:\Windows\System\ENxArOS.exe
  2⤵
  PID:5096
- C:\Windows\System\qDNyleC.exe
  C:\Windows\System\qDNyleC.exe
  2⤵
  PID:1596
- C:\Windows\System\pVqumHU.exe
  C:\Windows\System\pVqumHU.exe
  2⤵
  PID:516
- C:\Windows\System\GsGYZyQ.exe
  C:\Windows\System\GsGYZyQ.exe
  2⤵
  PID:2944
- C:\Windows\System\pTLzgKm.exe
  C:\Windows\System\pTLzgKm.exe
  2⤵
  PID:3032
- C:\Windows\System\iuakvAF.exe
  C:\Windows\System\iuakvAF.exe
  2⤵
  PID:2952
- C:\Windows\System\VWLpcHW.exe
  C:\Windows\System\VWLpcHW.exe
  2⤵
  PID:1976
- C:\Windows\System\oAOgFQL.exe
  C:\Windows\System\oAOgFQL.exe
  2⤵
  PID:2284
- C:\Windows\System\CFSNDLE.exe
  C:\Windows\System\CFSNDLE.exe
  2⤵
  PID:1128
- C:\Windows\System\pmqxMuX.exe
  C:\Windows\System\pmqxMuX.exe
  2⤵
  PID:3208
- C:\Windows\System\kNvxVRZ.exe
  C:\Windows\System\kNvxVRZ.exe
  2⤵
  PID:3656
- C:\Windows\System\ZEACCSD.exe
  C:\Windows\System\ZEACCSD.exe
  2⤵
  PID:2616
- C:\Windows\System\JxNWOYK.exe
  C:\Windows\System\JxNWOYK.exe
  2⤵
  PID:1816
- C:\Windows\System\xNujBin.exe
  C:\Windows\System\xNujBin.exe
  2⤵
  PID:6432
- C:\Windows\System\TbWxFsY.exe
  C:\Windows\System\TbWxFsY.exe
  2⤵
  PID:2696
- C:\Windows\System\jyBAcBu.exe
  C:\Windows\System\jyBAcBu.exe
  2⤵
  PID:5200
- C:\Windows\System\ZKUtbNd.exe
  C:\Windows\System\ZKUtbNd.exe
  2⤵
  PID:6544
- C:\Windows\System\fiFwlAY.exe
  C:\Windows\System\fiFwlAY.exe
  2⤵
  PID:6568
- C:\Windows\System\oibOdlU.exe
  C:\Windows\System\oibOdlU.exe
  2⤵
  PID:6616
- C:\Windows\System\QhkdRvR.exe
  C:\Windows\System\QhkdRvR.exe
  2⤵
  PID:5616
- C:\Windows\System\jsfoqBj.exe
  C:\Windows\System\jsfoqBj.exe
  2⤵
  PID:6724
- C:\Windows\System\FxvXuMq.exe
  C:\Windows\System\FxvXuMq.exe
  2⤵
  PID:6760
- C:\Windows\System\xdHBqPi.exe
  C:\Windows\System\xdHBqPi.exe
  2⤵
  PID:6808
- C:\Windows\System\MiVgACZ.exe
  C:\Windows\System\MiVgACZ.exe
  2⤵
  PID:6848
- C:\Windows\System\JHnOYYZ.exe
  C:\Windows\System\JHnOYYZ.exe
  2⤵
  PID:6912
- C:\Windows\System\jMWxcmB.exe
  C:\Windows\System\jMWxcmB.exe
  2⤵
  PID:6936
- C:\Windows\System\VUKlQLl.exe
  C:\Windows\System\VUKlQLl.exe
  2⤵
  PID:452
- C:\Windows\System\QwNOsCy.exe
  C:\Windows\System\QwNOsCy.exe
  2⤵
  PID:6312
- C:\Windows\System\wVXDwHL.exe
  C:\Windows\System\wVXDwHL.exe
  2⤵
  PID:7044
- C:\Windows\System\uwMoJHC.exe
  C:\Windows\System\uwMoJHC.exe
  2⤵
  PID:6392
- C:\Windows\System\SiIrBet.exe
  C:\Windows\System\SiIrBet.exe
  2⤵
  PID:7132
- C:\Windows\System\ekkNYRU.exe
  C:\Windows\System\ekkNYRU.exe
  2⤵
  PID:5880
- C:\Windows\System\XdEkEVz.exe
  C:\Windows\System\XdEkEVz.exe
  2⤵
  PID:4252
- C:\Windows\System\lRjDwiU.exe
  C:\Windows\System\lRjDwiU.exe
  2⤵
  PID:7180
- C:\Windows\System\GJISyph.exe
  C:\Windows\System\GJISyph.exe
  2⤵
  PID:7208
- C:\Windows\System\ELFJwSD.exe
  C:\Windows\System\ELFJwSD.exe
  2⤵
  PID:7224
- C:\Windows\System\TAbmwSF.exe
  C:\Windows\System\TAbmwSF.exe
  2⤵
  PID:7252
- C:\Windows\System\FASKINy.exe
  C:\Windows\System\FASKINy.exe
  2⤵
  PID:7272
- C:\Windows\System\JrQFAHe.exe
  C:\Windows\System\JrQFAHe.exe
  2⤵
  PID:7292
- C:\Windows\System\TdQGhqX.exe
  C:\Windows\System\TdQGhqX.exe
  2⤵
  PID:7316
- C:\Windows\System\xPxvCqq.exe
  C:\Windows\System\xPxvCqq.exe
  2⤵
  PID:7340
- C:\Windows\System\beogiar.exe
  C:\Windows\System\beogiar.exe
  2⤵
  PID:7356
- C:\Windows\System\BZZoiVf.exe
  C:\Windows\System\BZZoiVf.exe
  2⤵
  PID:7380
- C:\Windows\System\RvjCiWx.exe
  C:\Windows\System\RvjCiWx.exe
  2⤵
  PID:7404
- C:\Windows\System\sOaVlWk.exe
  C:\Windows\System\sOaVlWk.exe
  2⤵
  PID:7424
- C:\Windows\System\yHgHOwJ.exe
  C:\Windows\System\yHgHOwJ.exe
  2⤵
  PID:7448
- C:\Windows\System\efveGEs.exe
  C:\Windows\System\efveGEs.exe
  2⤵
  PID:7468
- C:\Windows\System\SmbsvRq.exe
  C:\Windows\System\SmbsvRq.exe
  2⤵
  PID:7492
- C:\Windows\System\OOsQfvU.exe
  C:\Windows\System\OOsQfvU.exe
  2⤵
  PID:7516
- C:\Windows\System\JkkFYYW.exe
  C:\Windows\System\JkkFYYW.exe
  2⤵
  PID:7532
- C:\Windows\System\GBVKdJQ.exe
  C:\Windows\System\GBVKdJQ.exe
  2⤵
  PID:7552
- C:\Windows\System\nabfKmj.exe
  C:\Windows\System\nabfKmj.exe
  2⤵
  PID:7572
- C:\Windows\System\TzXeqjK.exe
  C:\Windows\System\TzXeqjK.exe
  2⤵
  PID:7592
- C:\Windows\System\aqpxqpT.exe
  C:\Windows\System\aqpxqpT.exe
  2⤵
  PID:7612
- C:\Windows\System\FWdRbPS.exe
  C:\Windows\System\FWdRbPS.exe
  2⤵
  PID:7636
- C:\Windows\System\gEaiyHP.exe
  C:\Windows\System\gEaiyHP.exe
  2⤵
  PID:7656
- C:\Windows\System\TBCXQXW.exe
  C:\Windows\System\TBCXQXW.exe
  2⤵
  PID:7676
- C:\Windows\System\ewYeMxb.exe
  C:\Windows\System\ewYeMxb.exe
  2⤵
  PID:7700
- C:\Windows\System\tHmQqJA.exe
  C:\Windows\System\tHmQqJA.exe
  2⤵
  PID:7716
- C:\Windows\System\xReTzxS.exe
  C:\Windows\System\xReTzxS.exe
  2⤵
  PID:7740
- C:\Windows\System\aqdHSRh.exe
  C:\Windows\System\aqdHSRh.exe
  2⤵
  PID:7760
- C:\Windows\System\MokBxky.exe
  C:\Windows\System\MokBxky.exe
  2⤵
  PID:7788
- C:\Windows\System\sQlNLof.exe
  C:\Windows\System\sQlNLof.exe
  2⤵
  PID:7804
- C:\Windows\System\MnHCxcr.exe
  C:\Windows\System\MnHCxcr.exe
  2⤵
  PID:7828
- C:\Windows\System\amKMkHI.exe
  C:\Windows\System\amKMkHI.exe
  2⤵
  PID:7844
- C:\Windows\System\jYAaQLb.exe
  C:\Windows\System\jYAaQLb.exe
  2⤵
  PID:7864
- C:\Windows\System\NuVpkwH.exe
  C:\Windows\System\NuVpkwH.exe
  2⤵
  PID:7880
- C:\Windows\System\bdHNKHM.exe
  C:\Windows\System\bdHNKHM.exe
  2⤵
  PID:7904
- C:\Windows\System\BBdkUGg.exe
  C:\Windows\System\BBdkUGg.exe
  2⤵
  PID:7924
- C:\Windows\System\RtbILfB.exe
  C:\Windows\System\RtbILfB.exe
  2⤵
  PID:7944
- C:\Windows\System\QiJwGao.exe
  C:\Windows\System\QiJwGao.exe
  2⤵
  PID:7964
- C:\Windows\System\zMLeozf.exe
  C:\Windows\System\zMLeozf.exe
  2⤵
  PID:7984
- C:\Windows\System\QuBhpTo.exe
  C:\Windows\System\QuBhpTo.exe
  2⤵
  PID:8004
- C:\Windows\System\YPTUNTO.exe
  C:\Windows\System\YPTUNTO.exe
  2⤵
  PID:8024
- C:\Windows\System\YYknbJe.exe
  C:\Windows\System\YYknbJe.exe
  2⤵
  PID:8044
- C:\Windows\System\IlBrvaV.exe
  C:\Windows\System\IlBrvaV.exe
  2⤵
  PID:8068
- C:\Windows\System\RjGzcBs.exe
  C:\Windows\System\RjGzcBs.exe
  2⤵
  PID:8088
- C:\Windows\System\MioLisf.exe
  C:\Windows\System\MioLisf.exe
  2⤵
  PID:8108
- C:\Windows\System\aNLcsms.exe
  C:\Windows\System\aNLcsms.exe
  2⤵
  PID:8124
- C:\Windows\System\UTcWBLq.exe
  C:\Windows\System\UTcWBLq.exe
  2⤵
  PID:8148
- C:\Windows\System\UUytvjf.exe
  C:\Windows\System\UUytvjf.exe
  2⤵
  PID:8176
- C:\Windows\System\gsYVyOI.exe
  C:\Windows\System\gsYVyOI.exe
  2⤵
  PID:4524
- C:\Windows\System\KKTwbJj.exe
  C:\Windows\System\KKTwbJj.exe
  2⤵
  PID:6052
- C:\Windows\System\kOBrgwO.exe
  C:\Windows\System\kOBrgwO.exe
  2⤵
  PID:5488
- C:\Windows\System\OvDRPWz.exe
  C:\Windows\System\OvDRPWz.exe
  2⤵
  PID:6632
- C:\Windows\System\BypzCdW.exe
  C:\Windows\System\BypzCdW.exe
  2⤵
  PID:6692
- C:\Windows\System\KrYBQkB.exe
  C:\Windows\System\KrYBQkB.exe
  2⤵
  PID:6800
- C:\Windows\System\XXqGRUj.exe
  C:\Windows\System\XXqGRUj.exe
  2⤵
  PID:6152
- C:\Windows\System\JtlMmSV.exe
  C:\Windows\System\JtlMmSV.exe
  2⤵
  PID:6252
- C:\Windows\System\CLYedJv.exe
  C:\Windows\System\CLYedJv.exe
  2⤵
  PID:3052
- C:\Windows\System\hXBNdut.exe
  C:\Windows\System\hXBNdut.exe
  2⤵
  PID:6376
- C:\Windows\System\wjNQpRp.exe
  C:\Windows\System\wjNQpRp.exe
  2⤵
  PID:6500
- C:\Windows\System\cRUxUeq.exe
  C:\Windows\System\cRUxUeq.exe
  2⤵
  PID:6720
- C:\Windows\System\GbAcfQz.exe
  C:\Windows\System\GbAcfQz.exe
  2⤵
  PID:6860
- C:\Windows\System\SSaGPhk.exe
  C:\Windows\System\SSaGPhk.exe
  2⤵
  PID:7088
- C:\Windows\System\phdaKrt.exe
  C:\Windows\System\phdaKrt.exe
  2⤵
  PID:8196
- C:\Windows\System\laVzmeH.exe
  C:\Windows\System\laVzmeH.exe
  2⤵
  PID:8228
- C:\Windows\System\UfsyVoA.exe
  C:\Windows\System\UfsyVoA.exe
  2⤵
  PID:8252
- C:\Windows\System\rDslObW.exe
  C:\Windows\System\rDslObW.exe
  2⤵
  PID:8276
- C:\Windows\System\aMjYugP.exe
  C:\Windows\System\aMjYugP.exe
  2⤵
  PID:8296
- C:\Windows\System\qlJtFXH.exe
  C:\Windows\System\qlJtFXH.exe
  2⤵
  PID:8320
- C:\Windows\System\VrjgtCf.exe
  C:\Windows\System\VrjgtCf.exe
  2⤵
  PID:8344
- C:\Windows\System\NMKQlcD.exe
  C:\Windows\System\NMKQlcD.exe
  2⤵
  PID:8368
- C:\Windows\System\spbTiMe.exe
  C:\Windows\System\spbTiMe.exe
  2⤵
  PID:8392
- C:\Windows\System\thDUope.exe
  C:\Windows\System\thDUope.exe
  2⤵
  PID:8412
- C:\Windows\System\dOFNrWm.exe
  C:\Windows\System\dOFNrWm.exe
  2⤵
  PID:8440
- C:\Windows\System\EPiQoNJ.exe
  C:\Windows\System\EPiQoNJ.exe
  2⤵
  PID:8468
- C:\Windows\System\WVbHxOX.exe
  C:\Windows\System\WVbHxOX.exe
  2⤵
  PID:8496
- C:\Windows\System\NlSZAxs.exe
  C:\Windows\System\NlSZAxs.exe
  2⤵
  PID:8520
- C:\Windows\System\SrFrKFl.exe
  C:\Windows\System\SrFrKFl.exe
  2⤵
  PID:8540
- C:\Windows\System\IVRHuqV.exe
  C:\Windows\System\IVRHuqV.exe
  2⤵
  PID:8564
- C:\Windows\System\NxhoJiH.exe
  C:\Windows\System\NxhoJiH.exe
  2⤵
  PID:8588
- C:\Windows\System\ZgPTwOw.exe
  C:\Windows\System\ZgPTwOw.exe
  2⤵
  PID:8612
- C:\Windows\System\LnEhjop.exe
  C:\Windows\System\LnEhjop.exe
  2⤵
  PID:8636
- C:\Windows\System\GifANkW.exe
  C:\Windows\System\GifANkW.exe
  2⤵
  PID:8660
- C:\Windows\System\bjJVmUS.exe
  C:\Windows\System\bjJVmUS.exe
  2⤵
  PID:8684
- C:\Windows\System\AsLgLQB.exe
  C:\Windows\System\AsLgLQB.exe
  2⤵
  PID:8708
- C:\Windows\System\WzfvnHk.exe
  C:\Windows\System\WzfvnHk.exe
  2⤵
  PID:8728
- C:\Windows\System\MNsRsSE.exe
  C:\Windows\System\MNsRsSE.exe
  2⤵
  PID:8752
- C:\Windows\System\oiMbpmk.exe
  C:\Windows\System\oiMbpmk.exe
  2⤵
  PID:8772
- C:\Windows\System\JZHiqNK.exe
  C:\Windows\System\JZHiqNK.exe
  2⤵
  PID:8800
- C:\Windows\System\IaFotUW.exe
  C:\Windows\System\IaFotUW.exe
  2⤵
  PID:8816
- C:\Windows\System\IUvKbAh.exe
  C:\Windows\System\IUvKbAh.exe
  2⤵
  PID:8844
- C:\Windows\System\tGMVPKR.exe
  C:\Windows\System\tGMVPKR.exe
  2⤵
  PID:8892
- C:\Windows\System\WOUYAqf.exe
  C:\Windows\System\WOUYAqf.exe
  2⤵
  PID:8912
- C:\Windows\System\LhrCmAS.exe
  C:\Windows\System\LhrCmAS.exe
  2⤵
  PID:8928
- C:\Windows\System\kLYTisk.exe
  C:\Windows\System\kLYTisk.exe
  2⤵
  PID:8952
- C:\Windows\System\aiAxzuA.exe
  C:\Windows\System\aiAxzuA.exe
  2⤵
  PID:8972
- C:\Windows\System\wvAAyZR.exe
  C:\Windows\System\wvAAyZR.exe
  2⤵
  PID:8988
- C:\Windows\System\TLWhzDu.exe
  C:\Windows\System\TLWhzDu.exe
  2⤵
  PID:9004
- C:\Windows\System\sYSQuwb.exe
  C:\Windows\System\sYSQuwb.exe
  2⤵
  PID:9024
- C:\Windows\System\YvKWJqi.exe
  C:\Windows\System\YvKWJqi.exe
  2⤵
  PID:9044
- C:\Windows\System\oVWkVbf.exe
  C:\Windows\System\oVWkVbf.exe
  2⤵
  PID:9080
- C:\Windows\System\sVoAiJs.exe
  C:\Windows\System\sVoAiJs.exe
  2⤵
  PID:9136
- C:\Windows\System\upFjBlc.exe
  C:\Windows\System\upFjBlc.exe
  2⤵
  PID:9196
- C:\Windows\System\ZRgWfjI.exe
  C:\Windows\System\ZRgWfjI.exe
  2⤵
  PID:7236
- C:\Windows\System\TShjZJf.exe
  C:\Windows\System\TShjZJf.exe
  2⤵
  PID:5824
- C:\Windows\System\dqeWLfF.exe
  C:\Windows\System\dqeWLfF.exe
  2⤵
  PID:7348
- C:\Windows\System\NSJrRdg.exe
  C:\Windows\System\NSJrRdg.exe
  2⤵
  PID:4532
- C:\Windows\System\TxIJBIX.exe
  C:\Windows\System\TxIJBIX.exe
  2⤵
  PID:7544
- C:\Windows\System\rjfmKSa.exe
  C:\Windows\System\rjfmKSa.exe
  2⤵
  PID:7632
- C:\Windows\System\qYLjpwv.exe
  C:\Windows\System\qYLjpwv.exe
  2⤵
  PID:6868
- C:\Windows\System\dXRklRi.exe
  C:\Windows\System\dXRklRi.exe
  2⤵
  PID:7748
- C:\Windows\System\KxVabLL.exe
  C:\Windows\System\KxVabLL.exe
  2⤵
  PID:888
- C:\Windows\System\jGqmpTd.exe
  C:\Windows\System\jGqmpTd.exe
  2⤵
  PID:7936
- C:\Windows\System\zJaErMZ.exe
  C:\Windows\System\zJaErMZ.exe
  2⤵
  PID:7076
- C:\Windows\System\aMzJRFs.exe
  C:\Windows\System\aMzJRFs.exe
  2⤵
  PID:6360
- C:\Windows\System\cKDnhie.exe
  C:\Windows\System\cKDnhie.exe
  2⤵
  PID:8084
- C:\Windows\System\SbvVNgz.exe
  C:\Windows\System\SbvVNgz.exe
  2⤵
  PID:8140
- C:\Windows\System\VGUosoQ.exe
  C:\Windows\System\VGUosoQ.exe
  2⤵
  PID:4140
- C:\Windows\System\yvyxUub.exe
  C:\Windows\System\yvyxUub.exe
  2⤵
  PID:5176
- C:\Windows\System\cduneuK.exe
  C:\Windows\System\cduneuK.exe
  2⤵
  PID:3756
- C:\Windows\System\VDIifPl.exe
  C:\Windows\System\VDIifPl.exe
  2⤵
  PID:5808
- C:\Windows\System\EUVxaEp.exe
  C:\Windows\System\EUVxaEp.exe
  2⤵
  PID:9236
- C:\Windows\System\vmOnfwT.exe
  C:\Windows\System\vmOnfwT.exe
  2⤵
  PID:9264
- C:\Windows\System\eBOnEBw.exe
  C:\Windows\System\eBOnEBw.exe
  2⤵
  PID:9288
- C:\Windows\System\xShJMhn.exe
  C:\Windows\System\xShJMhn.exe
  2⤵
  PID:9308
- C:\Windows\System\XnSqGPo.exe
  C:\Windows\System\XnSqGPo.exe
  2⤵
  PID:9332
- C:\Windows\System\yliasCm.exe
  C:\Windows\System\yliasCm.exe
  2⤵
  PID:9352
- C:\Windows\System\irJmxZk.exe
  C:\Windows\System\irJmxZk.exe
  2⤵
  PID:9372
- C:\Windows\System\PnsRxJO.exe
  C:\Windows\System\PnsRxJO.exe
  2⤵
  PID:9392
- C:\Windows\System\gvgEfSR.exe
  C:\Windows\System\gvgEfSR.exe
  2⤵
  PID:9420
- C:\Windows\System\baPWDZc.exe
  C:\Windows\System\baPWDZc.exe
  2⤵
  PID:9440
- C:\Windows\System\DqmEzgr.exe
  C:\Windows\System\DqmEzgr.exe
  2⤵
  PID:9460
- C:\Windows\System\nkBSCXP.exe
  C:\Windows\System\nkBSCXP.exe
  2⤵
  PID:9488
- C:\Windows\System\AKiTNEM.exe
  C:\Windows\System\AKiTNEM.exe
  2⤵
  PID:9508
- C:\Windows\System\agMDnyk.exe
  C:\Windows\System\agMDnyk.exe
  2⤵
  PID:9532
- C:\Windows\System\avFWftF.exe
  C:\Windows\System\avFWftF.exe
  2⤵
  PID:9556
- C:\Windows\System\NTZmLug.exe
  C:\Windows\System\NTZmLug.exe
  2⤵
  PID:9576
- C:\Windows\System\VnkIdSD.exe
  C:\Windows\System\VnkIdSD.exe
  2⤵
  PID:9600
- C:\Windows\System\hrCWLgE.exe
  C:\Windows\System\hrCWLgE.exe
  2⤵
  PID:9628
- C:\Windows\System\LwMlzWA.exe
  C:\Windows\System\LwMlzWA.exe
  2⤵
  PID:9648
- C:\Windows\System\QFocIgd.exe
  C:\Windows\System\QFocIgd.exe
  2⤵
  PID:9672
- C:\Windows\System\jaCXYcE.exe
  C:\Windows\System\jaCXYcE.exe
  2⤵
  PID:9692
- C:\Windows\System\PPcSNuF.exe
  C:\Windows\System\PPcSNuF.exe
  2⤵
  PID:9716
- C:\Windows\System\zuCRXbV.exe
  C:\Windows\System\zuCRXbV.exe
  2⤵
  PID:9740
- C:\Windows\System\kBLqrXq.exe
  C:\Windows\System\kBLqrXq.exe
  2⤵
  PID:9764
- C:\Windows\System\vxoUiMY.exe
  C:\Windows\System\vxoUiMY.exe
  2⤵
  PID:9792
- C:\Windows\System\bcfExWJ.exe
  C:\Windows\System\bcfExWJ.exe
  2⤵
  PID:9812
- C:\Windows\System\QPzqULw.exe
  C:\Windows\System\QPzqULw.exe
  2⤵
  PID:9836
- C:\Windows\System\YryVBlG.exe
  C:\Windows\System\YryVBlG.exe
  2⤵
  PID:9856
- C:\Windows\System\XfLqCvx.exe
  C:\Windows\System\XfLqCvx.exe
  2⤵
  PID:9876
- C:\Windows\System\yztRUXJ.exe
  C:\Windows\System\yztRUXJ.exe
  2⤵
  PID:9900
- C:\Windows\System\aBmTcCV.exe
  C:\Windows\System\aBmTcCV.exe
  2⤵
  PID:9924
- C:\Windows\System\AsolisW.exe
  C:\Windows\System\AsolisW.exe
  2⤵
  PID:9948
- C:\Windows\System\JRihyTp.exe
  C:\Windows\System\JRihyTp.exe
  2⤵
  PID:9972
- C:\Windows\System\yqsFIiP.exe
  C:\Windows\System\yqsFIiP.exe
  2⤵
  PID:9992
- C:\Windows\System\geolZyb.exe
  C:\Windows\System\geolZyb.exe
  2⤵
  PID:10016
- C:\Windows\System\REvfqLu.exe
  C:\Windows\System\REvfqLu.exe
  2⤵
  PID:10044
- C:\Windows\System\ejbYIte.exe
  C:\Windows\System\ejbYIte.exe
  2⤵
  PID:10060
- C:\Windows\System\HOUJwJY.exe
  C:\Windows\System\HOUJwJY.exe
  2⤵
  PID:10084
- C:\Windows\System\OsMfaUn.exe
  C:\Windows\System\OsMfaUn.exe
  2⤵
  PID:10108
- C:\Windows\System\OLvmjFS.exe
  C:\Windows\System\OLvmjFS.exe
  2⤵
  PID:10128
- C:\Windows\System\MMIHTby.exe
  C:\Windows\System\MMIHTby.exe
  2⤵
  PID:10156
- C:\Windows\System\tgbQIUw.exe
  C:\Windows\System\tgbQIUw.exe
  2⤵
  PID:10176
- C:\Windows\System\ioSszLj.exe
  C:\Windows\System\ioSszLj.exe
  2⤵
  PID:10192
- C:\Windows\System\gGGjKvr.exe
  C:\Windows\System\gGGjKvr.exe
  2⤵
  PID:10208
- C:\Windows\System\UQvxLUG.exe
  C:\Windows\System\UQvxLUG.exe
  2⤵
  PID:10224
- C:\Windows\System\BTyGvTN.exe
  C:\Windows\System\BTyGvTN.exe
  2⤵
  PID:6756
- C:\Windows\System\ozLBnKh.exe
  C:\Windows\System\ozLBnKh.exe
  2⤵
  PID:6204
- C:\Windows\System\VpLhwUF.exe
  C:\Windows\System\VpLhwUF.exe
  2⤵
  PID:7016
- C:\Windows\System\oexHZuS.exe
  C:\Windows\System\oexHZuS.exe
  2⤵
  PID:7152
- C:\Windows\System\lUlXIEU.exe
  C:\Windows\System\lUlXIEU.exe
  2⤵
  PID:3384
- C:\Windows\System\mdcbSkn.exe
  C:\Windows\System\mdcbSkn.exe
  2⤵
  PID:7188
- C:\Windows\System\vwApgCN.exe
  C:\Windows\System\vwApgCN.exe
  2⤵
  PID:8264
- C:\Windows\System\xZrsSSV.exe
  C:\Windows\System\xZrsSSV.exe
  2⤵
  PID:7328
- C:\Windows\System\MdFIICo.exe
  C:\Windows\System\MdFIICo.exe
  2⤵
  PID:8376
- C:\Windows\System\bYadEsN.exe
  C:\Windows\System\bYadEsN.exe
  2⤵
  PID:8456
- C:\Windows\System\inGDGUp.exe
  C:\Windows\System\inGDGUp.exe
  2⤵
  PID:4668
- C:\Windows\System\sbXeUqD.exe
  C:\Windows\System\sbXeUqD.exe
  2⤵
  PID:8560
- C:\Windows\System\svpBgBx.exe
  C:\Windows\System\svpBgBx.exe
  2⤵
  PID:7628
- C:\Windows\System\RKSvwKi.exe
  C:\Windows\System\RKSvwKi.exe
  2⤵
  PID:7672
- C:\Windows\System\lxCbvxI.exe
  C:\Windows\System\lxCbvxI.exe
  2⤵
  PID:2308
- C:\Windows\System\yNExtUK.exe
  C:\Windows\System\yNExtUK.exe
  2⤵
  PID:8796
- C:\Windows\System\foJqSCv.exe
  C:\Windows\System\foJqSCv.exe
  2⤵
  PID:8852
- C:\Windows\System\DtpWQnm.exe
  C:\Windows\System\DtpWQnm.exe
  2⤵
  PID:4240
- C:\Windows\System\BZrheJU.exe
  C:\Windows\System\BZrheJU.exe
  2⤵
  PID:7876
- C:\Windows\System\rGUITCi.exe
  C:\Windows\System\rGUITCi.exe
  2⤵
  PID:9072
- C:\Windows\System\vQbMsyZ.exe
  C:\Windows\System\vQbMsyZ.exe
  2⤵
  PID:10368
- C:\Windows\System\fDUylDV.exe
  C:\Windows\System\fDUylDV.exe
  2⤵
  PID:10388
- C:\Windows\System\dhRIEHZ.exe
  C:\Windows\System\dhRIEHZ.exe
  2⤵
  PID:10408
- C:\Windows\System\UKwwIbv.exe
  C:\Windows\System\UKwwIbv.exe
  2⤵
  PID:10432
- C:\Windows\System\lzTDLIQ.exe
  C:\Windows\System\lzTDLIQ.exe
  2⤵
  PID:10452
- C:\Windows\System\RjlZnCH.exe
  C:\Windows\System\RjlZnCH.exe
  2⤵
  PID:10476
- C:\Windows\System\VDLZHag.exe
  C:\Windows\System\VDLZHag.exe
  2⤵
  PID:10500
- C:\Windows\System\jNyVQMs.exe
  C:\Windows\System\jNyVQMs.exe
  2⤵
  PID:10520
- C:\Windows\System\NjBCvvs.exe
  C:\Windows\System\NjBCvvs.exe
  2⤵
  PID:10540
- C:\Windows\System\MXiQOeq.exe
  C:\Windows\System\MXiQOeq.exe
  2⤵
  PID:10564
- C:\Windows\System\SANmKrX.exe
  C:\Windows\System\SANmKrX.exe
  2⤵
  PID:10584
- C:\Windows\System\cpBGHkf.exe
  C:\Windows\System\cpBGHkf.exe
  2⤵
  PID:10612
- C:\Windows\System\fpIvkfv.exe
  C:\Windows\System\fpIvkfv.exe
  2⤵
  PID:10632
- C:\Windows\System\zqqoJul.exe
  C:\Windows\System\zqqoJul.exe
  2⤵
  PID:10656
- C:\Windows\System\mFugwQi.exe
  C:\Windows\System\mFugwQi.exe
  2⤵
  PID:10676
- C:\Windows\System\XWTGTxA.exe
  C:\Windows\System\XWTGTxA.exe
  2⤵
  PID:10696
- C:\Windows\System\kNpKxTE.exe
  C:\Windows\System\kNpKxTE.exe
  2⤵
  PID:10724
- C:\Windows\System\NBvQyFE.exe
  C:\Windows\System\NBvQyFE.exe
  2⤵
  PID:10748
- C:\Windows\System\hcmVcmX.exe
  C:\Windows\System\hcmVcmX.exe
  2⤵
  PID:10768
- C:\Windows\System\AFJkwMa.exe
  C:\Windows\System\AFJkwMa.exe
  2⤵
  PID:10788
- C:\Windows\System\WtQIBQI.exe
  C:\Windows\System\WtQIBQI.exe
  2⤵
  PID:10812
- C:\Windows\System\KIOGUXc.exe
  C:\Windows\System\KIOGUXc.exe
  2⤵
  PID:10840
- C:\Windows\System\bLMKpBc.exe
  C:\Windows\System\bLMKpBc.exe
  2⤵
  PID:10860
- C:\Windows\System\WUHSuLl.exe
  C:\Windows\System\WUHSuLl.exe
  2⤵
  PID:10880
- C:\Windows\System\iFfLRbc.exe
  C:\Windows\System\iFfLRbc.exe
  2⤵
  PID:10912
- C:\Windows\System\IvbZMIc.exe
  C:\Windows\System\IvbZMIc.exe
  2⤵
  PID:10928
- C:\Windows\System\qIBRrKU.exe
  C:\Windows\System\qIBRrKU.exe
  2⤵
  PID:10944
- C:\Windows\System\HGIREMs.exe
  C:\Windows\System\HGIREMs.exe
  2⤵
  PID:10964
- C:\Windows\System\ZpvaBmt.exe
  C:\Windows\System\ZpvaBmt.exe
  2⤵
  PID:10980
- C:\Windows\System\qWneYtk.exe
  C:\Windows\System\qWneYtk.exe
  2⤵
  PID:10996
- C:\Windows\System\aoqosZo.exe
  C:\Windows\System\aoqosZo.exe
  2⤵
  PID:11020
- C:\Windows\System\fPllTdm.exe
  C:\Windows\System\fPllTdm.exe
  2⤵
  PID:11044
- C:\Windows\System\ZKUvaIq.exe
  C:\Windows\System\ZKUvaIq.exe
  2⤵
  PID:11064
- C:\Windows\System\XRtAVuH.exe
  C:\Windows\System\XRtAVuH.exe
  2⤵
  PID:11088
- C:\Windows\System\KYsCcjC.exe
  C:\Windows\System\KYsCcjC.exe
  2⤵
  PID:11108
- C:\Windows\System\lbcexEh.exe
  C:\Windows\System\lbcexEh.exe
  2⤵
  PID:11132
- C:\Windows\System\kkdAEwP.exe
  C:\Windows\System\kkdAEwP.exe
  2⤵
  PID:11152
- C:\Windows\System\VyjTRlT.exe
  C:\Windows\System\VyjTRlT.exe
  2⤵
  PID:11176
- C:\Windows\System\ovQverp.exe
  C:\Windows\System\ovQverp.exe
  2⤵
  PID:11196
- C:\Windows\System\cmkDyCz.exe
  C:\Windows\System\cmkDyCz.exe
  2⤵
  PID:11216
- C:\Windows\System\EKrYSjO.exe
  C:\Windows\System\EKrYSjO.exe
  2⤵
  PID:11236
- C:\Windows\System\bhzPvdc.exe
  C:\Windows\System\bhzPvdc.exe
  2⤵
  PID:11260
- C:\Windows\System\upRgPjA.exe
  C:\Windows\System\upRgPjA.exe
  2⤵
  PID:6192
- C:\Windows\System\QGzCmhz.exe
  C:\Windows\System\QGzCmhz.exe
  2⤵
  PID:8012
- C:\Windows\System\LdsOnWY.exe
  C:\Windows\System\LdsOnWY.exe
  2⤵
  PID:5024
- C:\Windows\System\GUWuCdY.exe
  C:\Windows\System\GUWuCdY.exe
  2⤵
  PID:2996
- C:\Windows\System\XtVIERr.exe
  C:\Windows\System\XtVIERr.exe
  2⤵
  PID:8064
- C:\Windows\System\dIAGfJM.exe
  C:\Windows\System\dIAGfJM.exe
  2⤵
  PID:5668
- C:\Windows\System\LxcxqyI.exe
  C:\Windows\System\LxcxqyI.exe
  2⤵
  PID:9244
- C:\Windows\System\SllitVz.exe
  C:\Windows\System\SllitVz.exe
  2⤵
  PID:6864
- C:\Windows\System\GfbVemy.exe
  C:\Windows\System\GfbVemy.exe
  2⤵
  PID:9324
- C:\Windows\System\UeEVGNr.exe
  C:\Windows\System\UeEVGNr.exe
  2⤵
  PID:7036
- C:\Windows\System\fudZmwx.exe
  C:\Windows\System\fudZmwx.exe
  2⤵
  PID:7220
- C:\Windows\System\JBePqAg.exe
  C:\Windows\System\JBePqAg.exe
  2⤵
  PID:7284
- C:\Windows\System\dYUVsok.exe
  C:\Windows\System\dYUVsok.exe
  2⤵
  PID:8384
- C:\Windows\System\vPjPuAC.exe
  C:\Windows\System\vPjPuAC.exe
  2⤵
  PID:7420
- C:\Windows\System\dIurWcf.exe
  C:\Windows\System\dIurWcf.exe
  2⤵
  PID:9820
- C:\Windows\System\NWekFkk.exe
  C:\Windows\System\NWekFkk.exe
  2⤵
  PID:7500
- C:\Windows\System\eNAgxGW.exe
  C:\Windows\System\eNAgxGW.exe
  2⤵
  PID:8504
- C:\Windows\System\DlWmrTT.exe
  C:\Windows\System\DlWmrTT.exe
  2⤵
  PID:9964
- C:\Windows\System\gAqLLfP.exe
  C:\Windows\System\gAqLLfP.exe
  2⤵
  PID:8580
- C:\Windows\System\EbEIBHD.exe
  C:\Windows\System\EbEIBHD.exe
  2⤵
  PID:11292
- C:\Windows\System\GmUBXkW.exe
  C:\Windows\System\GmUBXkW.exe
  2⤵
  PID:11312
- C:\Windows\System\VXzcIQD.exe
  C:\Windows\System\VXzcIQD.exe
  2⤵
  PID:11340
- C:\Windows\System\GbSUOcZ.exe
  C:\Windows\System\GbSUOcZ.exe
  2⤵
  PID:11364
- C:\Windows\System\gxLiIfK.exe
  C:\Windows\System\gxLiIfK.exe
  2⤵
  PID:11384
- C:\Windows\System\XScNcdv.exe
  C:\Windows\System\XScNcdv.exe
  2⤵
  PID:11404
- C:\Windows\System\RwQaswG.exe
  C:\Windows\System\RwQaswG.exe
  2⤵
  PID:11424
- C:\Windows\System\exIIYws.exe
  C:\Windows\System\exIIYws.exe
  2⤵
  PID:11448
- C:\Windows\System\OtLbuHQ.exe
  C:\Windows\System\OtLbuHQ.exe
  2⤵
  PID:11468
- C:\Windows\System\nngNHxl.exe
  C:\Windows\System\nngNHxl.exe
  2⤵
  PID:11484
- C:\Windows\System\EMIwJtL.exe
  C:\Windows\System\EMIwJtL.exe
  2⤵
  PID:11508
- C:\Windows\System\hhzVLEl.exe
  C:\Windows\System\hhzVLEl.exe
  2⤵
  PID:11528
- C:\Windows\System\iDUxWFc.exe
  C:\Windows\System\iDUxWFc.exe
  2⤵
  PID:11552
- C:\Windows\System\MOnVLLR.exe
  C:\Windows\System\MOnVLLR.exe
  2⤵
  PID:11576
- C:\Windows\System\PHKmvKq.exe
  C:\Windows\System\PHKmvKq.exe
  2⤵
  PID:11592
- C:\Windows\System\vhYQHxS.exe
  C:\Windows\System\vhYQHxS.exe
  2⤵
  PID:11616
- C:\Windows\System\GvzdTfb.exe
  C:\Windows\System\GvzdTfb.exe
  2⤵
  PID:11640
- C:\Windows\System\iSHvEsL.exe
  C:\Windows\System\iSHvEsL.exe
  2⤵
  PID:11656
- C:\Windows\System\nrsfFkD.exe
  C:\Windows\System\nrsfFkD.exe
  2⤵
  PID:11680
- C:\Windows\System\lAouYFt.exe
  C:\Windows\System\lAouYFt.exe
  2⤵
  PID:11700
- C:\Windows\System\WPqvMJP.exe
  C:\Windows\System\WPqvMJP.exe
  2⤵
  PID:11724
- C:\Windows\System\FTftNUm.exe
  C:\Windows\System\FTftNUm.exe
  2⤵
  PID:11740
- C:\Windows\System\xLJerbc.exe
  C:\Windows\System\xLJerbc.exe
  2⤵
  PID:11772
- C:\Windows\System\dWtkXTX.exe
  C:\Windows\System\dWtkXTX.exe
  2⤵
  PID:11788
- C:\Windows\System\YIZpKnT.exe
  C:\Windows\System\YIZpKnT.exe
  2⤵
  PID:11804
- C:\Windows\System\qDOuQtN.exe
  C:\Windows\System\qDOuQtN.exe
  2⤵
  PID:11820
- C:\Windows\System\CYwaZLP.exe
  C:\Windows\System\CYwaZLP.exe
  2⤵
  PID:11836
- C:\Windows\System\AeSsugh.exe
  C:\Windows\System\AeSsugh.exe
  2⤵
  PID:11852
- C:\Windows\System\hPQwWuc.exe
  C:\Windows\System\hPQwWuc.exe
  2⤵
  PID:11880
- C:\Windows\System\yTOrpjD.exe
  C:\Windows\System\yTOrpjD.exe
  2⤵
  PID:11900
- C:\Windows\System\cNGpXfr.exe
  C:\Windows\System\cNGpXfr.exe
  2⤵
  PID:11920
- C:\Windows\System\IvKwkSV.exe
  C:\Windows\System\IvKwkSV.exe
  2⤵
  PID:11936
- C:\Windows\System\JMzvEvs.exe
  C:\Windows\System\JMzvEvs.exe
  2⤵
  PID:11956
- C:\Windows\System\JTyMgvW.exe
  C:\Windows\System\JTyMgvW.exe
  2⤵
  PID:11976
- C:\Windows\System\EivDdfo.exe
  C:\Windows\System\EivDdfo.exe
  2⤵
  PID:11996
- C:\Windows\System\PwwIgVf.exe
  C:\Windows\System\PwwIgVf.exe
  2⤵
  PID:12016
- C:\Windows\System\udSFXNI.exe
  C:\Windows\System\udSFXNI.exe
  2⤵
  PID:12036
- C:\Windows\System\RxZmbrk.exe
  C:\Windows\System\RxZmbrk.exe
  2⤵
  PID:12052
- C:\Windows\System\kMrRQMU.exe
  C:\Windows\System\kMrRQMU.exe
  2⤵
  PID:12080
- C:\Windows\System\AykvmNt.exe
  C:\Windows\System\AykvmNt.exe
  2⤵
  PID:12104
- C:\Windows\System\JvZmgSt.exe
  C:\Windows\System\JvZmgSt.exe
  2⤵
  PID:12120
- C:\Windows\System\CDVuvmk.exe
  C:\Windows\System\CDVuvmk.exe
  2⤵
  PID:12136
- C:\Windows\System\WCIJBlV.exe
  C:\Windows\System\WCIJBlV.exe
  2⤵
  PID:12172
- C:\Windows\System\thBCxeF.exe
  C:\Windows\System\thBCxeF.exe
  2⤵
  PID:12192
- C:\Windows\System\pCtaJBI.exe
  C:\Windows\System\pCtaJBI.exe
  2⤵
  PID:12220
- C:\Windows\System\DqTAEqO.exe
  C:\Windows\System\DqTAEqO.exe
  2⤵
  PID:12248
- C:\Windows\System\bcksjHY.exe
  C:\Windows\System\bcksjHY.exe
  2⤵
  PID:12280
- C:\Windows\System\OvjDxnq.exe
  C:\Windows\System\OvjDxnq.exe
  2⤵
  PID:10116
- C:\Windows\System\eysiScE.exe
  C:\Windows\System\eysiScE.exe
  2⤵
  PID:8704
- C:\Windows\System\GgFXvcH.exe
  C:\Windows\System\GgFXvcH.exe
  2⤵
  PID:10200
- C:\Windows\System\FjxQmQv.exe
  C:\Windows\System\FjxQmQv.exe
  2⤵
  PID:8768
- C:\Windows\System\PLiVFMa.exe
  C:\Windows\System\PLiVFMa.exe
  2⤵
  PID:8812
- C:\Windows\System\hoTiBQe.exe
  C:\Windows\System\hoTiBQe.exe
  2⤵
  PID:7800
- C:\Windows\System\KQJJQSD.exe
  C:\Windows\System\KQJJQSD.exe
  2⤵
  PID:7856
- C:\Windows\System\XOTHDic.exe
  C:\Windows\System\XOTHDic.exe
  2⤵
  PID:8304
- C:\Windows\System\enjrZVx.exe
  C:\Windows\System\enjrZVx.exe
  2⤵
  PID:8960
- C:\Windows\System\mIZggnh.exe
  C:\Windows\System\mIZggnh.exe
  2⤵
  PID:8996
- C:\Windows\System\dxigxIj.exe
  C:\Windows\System\dxigxIj.exe
  2⤵
  PID:8624
- C:\Windows\System\xMbaHtb.exe
  C:\Windows\System\xMbaHtb.exe
  2⤵
  PID:3896
- C:\Windows\System\bbTHgDb.exe
  C:\Windows\System\bbTHgDb.exe
  2⤵
  PID:9100
- C:\Windows\System\iNYZkji.exe
  C:\Windows\System\iNYZkji.exe
  2⤵
  PID:10280
- C:\Windows\System\NeVrnyq.exe
  C:\Windows\System\NeVrnyq.exe
  2⤵
  PID:7324
- C:\Windows\System\YYclESj.exe
  C:\Windows\System\YYclESj.exe
  2⤵
  PID:10376
- C:\Windows\System\VMrtJma.exe
  C:\Windows\System\VMrtJma.exe
  2⤵
  PID:8036
- C:\Windows\System\AGeZrom.exe
  C:\Windows\System\AGeZrom.exe
  2⤵
  PID:10424
- C:\Windows\System\ybeymNb.exe
  C:\Windows\System\ybeymNb.exe
  2⤵
  PID:8164
- C:\Windows\System\hcNMhmd.exe
  C:\Windows\System\hcNMhmd.exe
  2⤵
  PID:12300
- C:\Windows\System\HDFmEpe.exe
  C:\Windows\System\HDFmEpe.exe
  2⤵
  PID:12324
- C:\Windows\System\KiLPqYR.exe
  C:\Windows\System\KiLPqYR.exe
  2⤵
  PID:12344
- C:\Windows\System\zEyxwbL.exe
  C:\Windows\System\zEyxwbL.exe
  2⤵
  PID:12364
- C:\Windows\System\WOxxKIr.exe
  C:\Windows\System\WOxxKIr.exe
  2⤵
  PID:12388
- C:\Windows\System\OLvevWg.exe
  C:\Windows\System\OLvevWg.exe
  2⤵
  PID:12412
- C:\Windows\System\KMVXFYS.exe
  C:\Windows\System\KMVXFYS.exe
  2⤵
  PID:12436
- C:\Windows\System\VLWqSlq.exe
  C:\Windows\System\VLWqSlq.exe
  2⤵
  PID:12456
- C:\Windows\System\HtGKrGs.exe
  C:\Windows\System\HtGKrGs.exe
  2⤵
  PID:12480
- C:\Windows\System\TFHukFn.exe
  C:\Windows\System\TFHukFn.exe
  2⤵
  PID:12500
- C:\Windows\System\YIzCFKm.exe
  C:\Windows\System\YIzCFKm.exe
  2⤵
  PID:12524
- C:\Windows\System\MCVyUqs.exe
  C:\Windows\System\MCVyUqs.exe
  2⤵
  PID:12548
- C:\Windows\System\rhTeJdE.exe
  C:\Windows\System\rhTeJdE.exe
  2⤵
  PID:12568
- C:\Windows\System\YgihMkU.exe
  C:\Windows\System\YgihMkU.exe
  2⤵
  PID:12588
- C:\Windows\System\TuSAAnR.exe
  C:\Windows\System\TuSAAnR.exe
  2⤵
  PID:12608
- C:\Windows\System\TbtvJxT.exe
  C:\Windows\System\TbtvJxT.exe
  2⤵
  PID:12640
- C:\Windows\System\KldaEja.exe
  C:\Windows\System\KldaEja.exe
  2⤵
  PID:12660
- C:\Windows\System\gxlkbbj.exe
  C:\Windows\System\gxlkbbj.exe
  2⤵
  PID:12684
- C:\Windows\System\PEnrAXy.exe
  C:\Windows\System\PEnrAXy.exe
  2⤵
  PID:12708
- C:\Windows\System\zZGUBpW.exe
  C:\Windows\System\zZGUBpW.exe
  2⤵
  PID:12732
- C:\Windows\System\CaiYnSk.exe
  C:\Windows\System\CaiYnSk.exe
  2⤵
  PID:12752
- C:\Windows\System\xHXYIwo.exe
  C:\Windows\System\xHXYIwo.exe
  2⤵
  PID:12776
- C:\Windows\System\QWgrseA.exe
  C:\Windows\System\QWgrseA.exe
  2⤵
  PID:12792
- C:\Windows\System\tMNneKN.exe
  C:\Windows\System\tMNneKN.exe
  2⤵
  PID:12808
- C:\Windows\System\UuRMdVK.exe
  C:\Windows\System\UuRMdVK.exe
  2⤵
  PID:12828
- C:\Windows\System\gOpYStE.exe
  C:\Windows\System\gOpYStE.exe
  2⤵
  PID:12844
- C:\Windows\System\SemknyX.exe
  C:\Windows\System\SemknyX.exe
  2⤵
  PID:12864
- C:\Windows\System\UXDwTTf.exe
  C:\Windows\System\UXDwTTf.exe
  2⤵
  PID:12888
- C:\Windows\System\BIdutIM.exe
  C:\Windows\System\BIdutIM.exe
  2⤵
  PID:12912
- C:\Windows\System\vRymyYY.exe
  C:\Windows\System\vRymyYY.exe
  2⤵
  PID:12936
- C:\Windows\System\dJDrPpZ.exe
  C:\Windows\System\dJDrPpZ.exe
  2⤵
  PID:12960
- C:\Windows\System\jSWJqPK.exe
  C:\Windows\System\jSWJqPK.exe
  2⤵
  PID:12980
- C:\Windows\System\TyZfWBf.exe
  C:\Windows\System\TyZfWBf.exe
  2⤵
  PID:13008
- C:\Windows\System\CPSMmWw.exe
  C:\Windows\System\CPSMmWw.exe
  2⤵
  PID:13024
- C:\Windows\System\KvZiAJP.exe
  C:\Windows\System\KvZiAJP.exe
  2⤵
  PID:13044
- C:\Windows\System\mMMiReu.exe
  C:\Windows\System\mMMiReu.exe
  2⤵
  PID:13068
- C:\Windows\System\TIeUlid.exe
  C:\Windows\System\TIeUlid.exe
  2⤵
  PID:13092
- C:\Windows\System\IAnwCzS.exe
  C:\Windows\System\IAnwCzS.exe
  2⤵
  PID:13116
- C:\Windows\System\YhDrDWT.exe
  C:\Windows\System\YhDrDWT.exe
  2⤵
  PID:13140
- C:\Windows\System\BqXNWXS.exe
  C:\Windows\System\BqXNWXS.exe
  2⤵
  PID:6172
- C:\Windows\System\uUyPlUM.exe
  C:\Windows\System\uUyPlUM.exe
  2⤵
  PID:9360
- C:\Windows\System\lZsMdJA.exe
  C:\Windows\System\lZsMdJA.exe
  2⤵
  PID:6492
- C:\Windows\System\DQLbncZ.exe
  C:\Windows\System\DQLbncZ.exe
  2⤵
  PID:6920
- C:\Windows\System\KxWIJYN.exe
  C:\Windows\System\KxWIJYN.exe
  2⤵
  PID:5420
- C:\Windows\System\mhqmjff.exe
  C:\Windows\System\mhqmjff.exe
  2⤵
  PID:10888
- C:\Windows\System\qpFgSYA.exe
  C:\Windows\System\qpFgSYA.exe
  2⤵
  PID:11948
- C:\Windows\System\coFWbDp.exe
  C:\Windows\System\coFWbDp.exe
  2⤵
  PID:7620
- C:\Windows\System\hWbsjKJ.exe
  C:\Windows\System\hWbsjKJ.exe
  2⤵
  PID:10988
- C:\Windows\System\hIDXgnz.exe
  C:\Windows\System\hIDXgnz.exe
  2⤵
  PID:11072
- C:\Windows\System\heJNUhY.exe
  C:\Windows\System\heJNUhY.exe
  2⤵
  PID:11204
- C:\Windows\System\sqtHVmt.exe
  C:\Windows\System\sqtHVmt.exe
  2⤵
  PID:8172
- C:\Windows\System\FczkzhK.exe
  C:\Windows\System\FczkzhK.exe
  2⤵
  PID:11896
- C:\Windows\System\FTXJZns.exe
  C:\Windows\System\FTXJZns.exe
  2⤵
  PID:9160
- C:\Windows\System\DDBiLEQ.exe
  C:\Windows\System\DDBiLEQ.exe
  2⤵
  PID:11332
- C:\Windows\System\jZycepM.exe
  C:\Windows\System\jZycepM.exe
  2⤵
  PID:10344
- C:\Windows\System\DtplYda.exe
  C:\Windows\System\DtplYda.exe
  2⤵
  PID:12656
- C:\Windows\System\VzntQjU.exe
  C:\Windows\System\VzntQjU.exe
  2⤵
  PID:9388
- C:\Windows\System\WLoaExg.exe
  C:\Windows\System\WLoaExg.exe
  2⤵
  PID:10440
- C:\Windows\System\pTcCFKj.exe
  C:\Windows\System\pTcCFKj.exe
  2⤵
  PID:12804
- C:\Windows\System\ISweIXx.exe
  C:\Windows\System\ISweIXx.exe
  2⤵
  PID:11464
- C:\Windows\System\zLKEDrV.exe
  C:\Windows\System\zLKEDrV.exe
  2⤵
  PID:5468
- C:\Windows\System\vxibeBx.exe
  C:\Windows\System\vxibeBx.exe
  2⤵
  PID:7144
- C:\Windows\System\QZgMyKP.exe
  C:\Windows\System\QZgMyKP.exe
  2⤵
  PID:9052
- C:\Windows\System\KxGztiL.exe
  C:\Windows\System\KxGztiL.exe
  2⤵
  PID:12340
- C:\Windows\System\AbeyWst.exe
  C:\Windows\System\AbeyWst.exe
  2⤵
  PID:10008
- C:\Windows\System\OYjppdS.exe
  C:\Windows\System\OYjppdS.exe
  2⤵
  PID:10896
- C:\Windows\System\eWukzTW.exe
  C:\Windows\System\eWukzTW.exe
  2⤵
  PID:13196
- C:\Windows\System\uNRsPqV.exe
  C:\Windows\System\uNRsPqV.exe
  2⤵
  PID:11736
- C:\Windows\System\ASITchD.exe
  C:\Windows\System\ASITchD.exe
  2⤵
  PID:396
- C:\Windows\System\TxeaJrA.exe
  C:\Windows\System\TxeaJrA.exe
  2⤵
  PID:12296
- C:\Windows\System\JoMwwDM.exe
  C:\Windows\System\JoMwwDM.exe
  2⤵
  PID:7708
- C:\Windows\System\QAeMYCO.exe
  C:\Windows\System\QAeMYCO.exe
  2⤵
  PID:10364
- C:\Windows\System\YmiscBy.exe
  C:\Windows\System\YmiscBy.exe
  2⤵
  PID:9848
- C:\Windows\System\HObggpM.exe
  C:\Windows\System\HObggpM.exe
  2⤵
  PID:7248
- C:\Windows\System\uVnUwBN.exe
  C:\Windows\System\uVnUwBN.exe
  2⤵
  PID:7780
- C:\Windows\System\HFxYbfo.exe
  C:\Windows\System\HFxYbfo.exe
  2⤵
  PID:10216
- C:\Windows\System\DNGmjOj.exe
  C:\Windows\System\DNGmjOj.exe
  2⤵
  PID:12208
- C:\Windows\System\nhiNlcU.exe
  C:\Windows\System\nhiNlcU.exe
  2⤵
  PID:12988
- C:\Windows\System\cxZtMQG.exe
  C:\Windows\System\cxZtMQG.exe
  2⤵
  PID:12520
- C:\Windows\System\PNjxgOp.exe
  C:\Windows\System\PNjxgOp.exe
  2⤵
  PID:13040
- C:\Windows\System\NOvQPQJ.exe
  C:\Windows\System\NOvQPQJ.exe
  2⤵
  PID:10356
- C:\Windows\System\ZtAEctV.exe
  C:\Windows\System\ZtAEctV.exe
  2⤵
  PID:12584
- C:\Windows\System\MOTfcfW.exe
  C:\Windows\System\MOTfcfW.exe
  2⤵
  PID:11600
- C:\Windows\System\YMHmXOG.exe
  C:\Windows\System\YMHmXOG.exe
  2⤵
  PID:9064
- C:\Windows\System\gGvsuXQ.exe
  C:\Windows\System\gGvsuXQ.exe
  2⤵
  PID:10400
- C:\Windows\System\jOJKEMf.exe
  C:\Windows\System\jOJKEMf.exe
  2⤵
  PID:12668
- C:\Windows\System\ztnrFJx.exe
  C:\Windows\System\ztnrFJx.exe
  2⤵
  PID:11536
- C:\Windows\System\gAakrHE.exe
  C:\Windows\System\gAakrHE.exe
  2⤵
  PID:10296
- C:\Windows\System\mChhIUR.exe
  C:\Windows\System\mChhIUR.exe
  2⤵
  PID:400
- C:\Windows\System\HieLaTz.exe
  C:\Windows\System\HieLaTz.exe
  2⤵
  PID:9256
- C:\Windows\System\FAoSBdh.exe
  C:\Windows\System\FAoSBdh.exe
  2⤵
  PID:3136
- C:\Windows\System\MJxjbsi.exe
  C:\Windows\System\MJxjbsi.exe
  2⤵
  PID:8980
- C:\Windows\System\EOULzyz.exe
  C:\Windows\System\EOULzyz.exe
  2⤵
  PID:5148
- C:\Windows\System\nqZsHds.exe
  C:\Windows\System\nqZsHds.exe
  2⤵
  PID:8724
- C:\Windows\System\VbFeUDR.exe
  C:\Windows\System\VbFeUDR.exe
  2⤵
  PID:7192
- C:\Windows\System\gBGVFdZ.exe
  C:\Windows\System\gBGVFdZ.exe
  2⤵
  PID:10136
- C:\Windows\System\GgrBfag.exe
  C:\Windows\System\GgrBfag.exe
  2⤵
  PID:12260
- C:\Windows\System\dvWGRIj.exe
  C:\Windows\System\dvWGRIj.exe
  2⤵
  PID:6136
- C:\Windows\System\BumHcse.exe
  C:\Windows\System\BumHcse.exe
  2⤵
  PID:10808
- C:\Windows\System\OmTirZN.exe
  C:\Windows\System\OmTirZN.exe
  2⤵
  PID:9884
- C:\Windows\System\jYEKYsW.exe
  C:\Windows\System\jYEKYsW.exe
  2⤵
  PID:12788
- C:\Windows\System\uAyhdDH.exe
  C:\Windows\System\uAyhdDH.exe
  2⤵
  PID:10796
- C:\Windows\System\toDsRDh.exe
  C:\Windows\System\toDsRDh.exe
  2⤵
  PID:9320
- C:\Windows\System\PzUIFTF.exe
  C:\Windows\System\PzUIFTF.exe
  2⤵
  PID:9176
- C:\Windows\System\HxByYhf.exe
  C:\Windows\System\HxByYhf.exe
  2⤵
  PID:11144
- C:\Windows\System\XULQTVN.exe
  C:\Windows\System\XULQTVN.exe
  2⤵
  PID:9156
- C:\Windows\System\fZBTQDF.exe
  C:\Windows\System\fZBTQDF.exe
  2⤵
  PID:10144
- C:\Windows\System\KLLBNPL.exe
  C:\Windows\System\KLLBNPL.exe
  2⤵
  PID:8656
- C:\Windows\System\ozJZSkk.exe
  C:\Windows\System\ozJZSkk.exe
  2⤵
  PID:11036
- C:\Windows\System\EpQTVhz.exe
  C:\Windows\System\EpQTVhz.exe
  2⤵
  PID:13204
- C:\Windows\System\NmPzhYg.exe
  C:\Windows\System\NmPzhYg.exe
  2⤵
  PID:11456
- C:\Windows\System\zUuebUp.exe
  C:\Windows\System\zUuebUp.exe
  2⤵
  PID:8940
- C:\Windows\System\byqImHu.exe
  C:\Windows\System\byqImHu.exe
  2⤵
  PID:12508
- C:\Windows\System\nNIuIcU.exe
  C:\Windows\System\nNIuIcU.exe
  2⤵
  PID:10692
- C:\Windows\System\YAeAHva.exe
  C:\Windows\System\YAeAHva.exe
  2⤵
  PID:10940
- C:\Windows\System\MUGCWmT.exe
  C:\Windows\System\MUGCWmT.exe
  2⤵
  PID:8116
- C:\Windows\System\GzrpYDC.exe
  C:\Windows\System\GzrpYDC.exe
  2⤵
  PID:8764
- C:\Windows\System\FXkoufr.exe
  C:\Windows\System\FXkoufr.exe
  2⤵
  PID:11560
- C:\Windows\System\MtUxOzP.exe
  C:\Windows\System\MtUxOzP.exe
  2⤵
  PID:13324
- C:\Windows\System\hrrgtpH.exe
  C:\Windows\System\hrrgtpH.exe
  2⤵
  PID:13348
- C:\Windows\System\zoJrRCo.exe
  C:\Windows\System\zoJrRCo.exe
  2⤵
  PID:13564
- C:\Windows\System\HKzdrSQ.exe
  C:\Windows\System\HKzdrSQ.exe
  2⤵
  PID:13800
- C:\Windows\System\peltWAQ.exe
  C:\Windows\System\peltWAQ.exe
  2⤵
  PID:13840
- C:\Windows\System\UuzAYbx.exe
  C:\Windows\System\UuzAYbx.exe
  2⤵
  PID:13964
- C:\Windows\System\TYuaqug.exe
  C:\Windows\System\TYuaqug.exe
  2⤵
  PID:14108
- C:\Windows\System\GvaigyD.exe
  C:\Windows\System\GvaigyD.exe
  2⤵
  PID:14136
- C:\Windows\System\TDaagux.exe
  C:\Windows\System\TDaagux.exe
  2⤵
  PID:14160
- C:\Windows\System\gkTbZmR.exe
  C:\Windows\System\gkTbZmR.exe
  2⤵
  PID:14180
- C:\Windows\System\aMJfmhW.exe
  C:\Windows\System\aMJfmhW.exe
  2⤵
  PID:14212
- C:\Windows\System\JXJcicu.exe
  C:\Windows\System\JXJcicu.exe
  2⤵
  PID:7896
- C:\Windows\System\ycRcpqx.exe
  C:\Windows\System\ycRcpqx.exe
  2⤵
  PID:12408
- C:\Windows\System\yileNpf.exe
  C:\Windows\System\yileNpf.exe
  2⤵
  PID:13060
- C:\Windows\System\hotkQkH.exe
  C:\Windows\System\hotkQkH.exe
  2⤵
  PID:11184
- C:\Windows\System\kmSgyir.exe
  C:\Windows\System\kmSgyir.exe
  2⤵
  PID:8424
- C:\Windows\System\MrNWWLd.exe
  C:\Windows\System\MrNWWLd.exe
  2⤵
  PID:13320
- C:\Windows\System\bfpmGNI.exe
  C:\Windows\System\bfpmGNI.exe
  2⤵
  PID:13420
- C:\Windows\System\VpYFhWA.exe
  C:\Windows\System\VpYFhWA.exe
  2⤵
  PID:13452
- C:\Windows\System\XpHYvMl.exe
  C:\Windows\System\XpHYvMl.exe
  2⤵
  PID:13468
- C:\Windows\System\zttdNMe.exe
  C:\Windows\System\zttdNMe.exe
  2⤵
  PID:9640
- C:\Windows\System\ykUUIsZ.exe
  C:\Windows\System\ykUUIsZ.exe
  2⤵
  PID:12904
- C:\Windows\System\cKXCBEC.exe
  C:\Windows\System\cKXCBEC.exe
  2⤵
  PID:12700
- C:\Windows\System\ZhqxHut.exe
  C:\Windows\System\ZhqxHut.exe
  2⤵
  PID:13432
- C:\Windows\System\BBMROXw.exe
  C:\Windows\System\BBMROXw.exe
  2⤵
  PID:13520
- C:\Windows\System\QruZgAv.exe
  C:\Windows\System\QruZgAv.exe
  2⤵
  PID:12784
- C:\Windows\System\oKxLEJl.exe
  C:\Windows\System\oKxLEJl.exe
  2⤵
  PID:13400
- C:\Windows\System\yCqHsqy.exe
  C:\Windows\System\yCqHsqy.exe
  2⤵
  PID:5000
- C:\Windows\System\kdXyZWy.exe
  C:\Windows\System\kdXyZWy.exe
  2⤵
  PID:13488
- C:\Windows\System\RPPCRwZ.exe
  C:\Windows\System\RPPCRwZ.exe
  2⤵
  PID:13952
- C:\Windows\System\eBASCSI.exe
  C:\Windows\System\eBASCSI.exe
  2⤵
  PID:13784
- C:\Windows\System\CxIPmXl.exe
  C:\Windows\System\CxIPmXl.exe
  2⤵
  PID:13888
- C:\Windows\System\OIFZrUx.exe
  C:\Windows\System\OIFZrUx.exe
  2⤵
  PID:13728
- C:\Windows\System\CGgNzce.exe
  C:\Windows\System\CGgNzce.exe
  2⤵
  PID:13856
- C:\Windows\System\vfleEkK.exe
  C:\Windows\System\vfleEkK.exe
  2⤵
  PID:14204
- C:\Windows\System\fdLTgKS.exe
  C:\Windows\System\fdLTgKS.exe
  2⤵
  PID:13992
- C:\Windows\System\oCOhkUT.exe
  C:\Windows\System\oCOhkUT.exe
  2⤵
  PID:4644
- C:\Windows\System\xKaNMTQ.exe
  C:\Windows\System\xKaNMTQ.exe
  2⤵
  PID:13416
- C:\Windows\System\jqMJakt.exe
  C:\Windows\System\jqMJakt.exe
  2⤵
  PID:13380
- C:\Windows\System\ypoKRJX.exe
  C:\Windows\System\ypoKRJX.exe
  2⤵
  PID:13500
- C:\Windows\System\axssOfW.exe
  C:\Windows\System\axssOfW.exe
  2⤵
  PID:13388
- C:\Windows\System\WSWKHAr.exe
  C:\Windows\System\WSWKHAr.exe
  2⤵
  PID:13516
- C:\Windows\System\lwUiYUN.exe
  C:\Windows\System\lwUiYUN.exe
  2⤵
  PID:11032
- C:\Windows\System\bfzfiVL.exe
  C:\Windows\System\bfzfiVL.exe
  2⤵
  PID:5800
- C:\Windows\System\jxpGAXS.exe
  C:\Windows\System\jxpGAXS.exe
  2⤵
  PID:14020
- C:\Windows\System\uhZuiEh.exe
  C:\Windows\System\uhZuiEh.exe
  2⤵
  PID:13996
- C:\Windows\System\jdJcaOE.exe
  C:\Windows\System\jdJcaOE.exe
  2⤵
  PID:13496
- C:\Windows\System\QCHPpEU.exe
  C:\Windows\System\QCHPpEU.exe
  2⤵
  PID:12896
- C:\Windows\System\VOberUS.exe
  C:\Windows\System\VOberUS.exe
  2⤵
  PID:7388
- C:\Windows\System\eBhjOBJ.exe
  C:\Windows\System\eBhjOBJ.exe
  2⤵
  PID:5152
- C:\Windows\System\jLAGukH.exe
  C:\Windows\System\jLAGukH.exe
  2⤵
  PID:10552
- C:\Windows\System\pgdDpTo.exe
  C:\Windows\System\pgdDpTo.exe
  2⤵
  PID:14276
- C:\Windows\System\FtEtUuC.exe
  C:\Windows\System\FtEtUuC.exe
  2⤵
  PID:13868
- C:\Windows\System\uzCifFh.exe
  C:\Windows\System\uzCifFh.exe
  2⤵
  PID:14132
- C:\Windows\System\FpEEqgL.exe
  C:\Windows\System\FpEEqgL.exe
  2⤵
  PID:3156
- C:\Windows\System\JapZguC.exe
  C:\Windows\System\JapZguC.exe
  2⤵
  PID:13532
- C:\Windows\System\IjKAaMK.exe
  C:\Windows\System\IjKAaMK.exe
  2⤵
  PID:14232
- C:\Windows\System\pnObdGm.exe
  C:\Windows\System\pnObdGm.exe
  2⤵
  PID:2320
- C:\Windows\System\jiHhoDj.exe
  C:\Windows\System\jiHhoDj.exe
  2⤵
  PID:13476
- C:\Windows\System\myCzbpn.exe
  C:\Windows\System\myCzbpn.exe
  2⤵
  PID:14304
- C:\Windows\System\FPYPQTS.exe
  C:\Windows\System\FPYPQTS.exe
  2⤵
  PID:13644
- C:\Windows\System\ZIfDFFM.exe
  C:\Windows\System\ZIfDFFM.exe
  2⤵
  PID:4936
- C:\Windows\System\KSHnqdd.exe
  C:\Windows\System\KSHnqdd.exe
  2⤵
  PID:13648
- C:\Windows\System\cnVROws.exe
  C:\Windows\System\cnVROws.exe
  2⤵
  PID:7972
- C:\Windows\System\CbYCxuO.exe
  C:\Windows\System\CbYCxuO.exe
  2⤵
  PID:404
- C:\Windows\System\jZYVXlq.exe
  C:\Windows\System\jZYVXlq.exe
  2⤵
  PID:13948
- C:\Windows\System\lbQjbyr.exe
  C:\Windows\System\lbQjbyr.exe
  2⤵
  PID:13848
- C:\Windows\System\TQwaKlW.exe
  C:\Windows\System\TQwaKlW.exe
  2⤵
  PID:14000
- C:\Windows\System\CCzmYcu.exe
  C:\Windows\System\CCzmYcu.exe
  2⤵
  PID:12028
- C:\Windows\System\iBucxMI.exe
  C:\Windows\System\iBucxMI.exe
  2⤵
  PID:13988
- C:\Windows\System\MekeaIy.exe
  C:\Windows\System\MekeaIy.exe
  2⤵
  PID:13924
- C:\Windows\System\NaOsLlm.exe
  C:\Windows\System\NaOsLlm.exe
  2⤵
  PID:4284
- C:\Windows\System\JheVUaF.exe
  C:\Windows\System\JheVUaF.exe
  2⤵
  PID:12092
- C:\Windows\System\YervBqG.exe
  C:\Windows\System\YervBqG.exe
  2⤵
  PID:13344
- C:\Windows\System\oxgOjJt.exe
  C:\Windows\System\oxgOjJt.exe
  2⤵
  PID:13628
- C:\Windows\System\xHcKkEY.exe
  C:\Windows\System\xHcKkEY.exe
  2⤵
  PID:12048
- C:\Windows\System\YNFtsWm.exe
  C:\Windows\System\YNFtsWm.exe
  2⤵
  PID:11692
- C:\Windows\System\KSgmtoy.exe
  C:\Windows\System\KSgmtoy.exe
  2⤵
  PID:7148
- C:\Windows\System\OJpnLMh.exe
  C:\Windows\System\OJpnLMh.exe
  2⤵
  PID:3484
- C:\Windows\System\CZSjIIq.exe
  C:\Windows\System\CZSjIIq.exe
  2⤵
  PID:3868
- C:\Windows\System\krIylmr.exe
  C:\Windows\System\krIylmr.exe
  2⤵
  PID:3480
- C:\Windows\System\DLSiJJV.exe
  C:\Windows\System\DLSiJJV.exe
  2⤵
  PID:14172
- C:\Windows\System\AZXaGFJ.exe
  C:\Windows\System\AZXaGFJ.exe
  2⤵
  PID:14260
- C:\Windows\System\RVFUxNM.exe
  C:\Windows\System\RVFUxNM.exe
  2⤵
  PID:8904
- C:\Windows\System\WzEFrJq.exe
  C:\Windows\System\WzEFrJq.exe
  2⤵
  PID:9708
- C:\Windows\System\DCFtXvn.exe
  C:\Windows\System\DCFtXvn.exe
  2⤵
  PID:14240
- C:\Windows\System\LvJnkja.exe
  C:\Windows\System\LvJnkja.exe
  2⤵
  PID:14332
- C:\Windows\System\IPIhDpT.exe
  C:\Windows\System\IPIhDpT.exe
  2⤵
  PID:2972
- C:\Windows\System\COcRGrW.exe
  C:\Windows\System\COcRGrW.exe
  2⤵
  PID:2080
- C:\Windows\System\otsjVSA.exe
  C:\Windows\System\otsjVSA.exe
  2⤵
  PID:13732
- C:\Windows\System\XpinfAy.exe
  C:\Windows\System\XpinfAy.exe
  2⤵
  PID:13632
- C:\Windows\System\iLTtMRL.exe
  C:\Windows\System\iLTtMRL.exe
  2⤵
  PID:2120
- C:\Windows\System\PhktiQY.exe
  C:\Windows\System\PhktiQY.exe
  2⤵
  PID:10604
- C:\Windows\System\XKnuUDG.exe
  C:\Windows\System\XKnuUDG.exe
  2⤵
  PID:3200
- C:\Windows\System\LLKYTEM.exe
  C:\Windows\System\LLKYTEM.exe
  2⤵
  PID:3296
- C:\Windows\System\aRVWwib.exe
  C:\Windows\System\aRVWwib.exe
  2⤵
  PID:3240
- C:\Windows\System\eStAaBJ.exe
  C:\Windows\System\eStAaBJ.exe
  2⤵
  PID:14300
- C:\Windows\System\FWZCFHz.exe
  C:\Windows\System\FWZCFHz.exe
  2⤵
  PID:13832
- C:\Windows\System\VHEuSIQ.exe
  C:\Windows\System\VHEuSIQ.exe
  2⤵
  PID:3476
- C:\Windows\System\nxJQXvR.exe
  C:\Windows\System\nxJQXvR.exe
  2⤵
  PID:13816
- C:\Windows\System\VGVgdIy.exe
  C:\Windows\System\VGVgdIy.exe
  2⤵
  PID:3544
- C:\Windows\System\vNwVNOj.exe
  C:\Windows\System\vNwVNOj.exe
  2⤵
  PID:2076
- C:\Windows\System\OpvbEKe.exe
  C:\Windows\System\OpvbEKe.exe
  2⤵
  PID:1984
- C:\Windows\System\WimHDdY.exe
  C:\Windows\System\WimHDdY.exe
  2⤵
  PID:4684
- C:\Windows\System\eBsYeOy.exe
  C:\Windows\System\eBsYeOy.exe
  2⤵
  PID:2028
- C:\Windows\System\ulhGmiM.exe
  C:\Windows\System\ulhGmiM.exe
  2⤵
  PID:4272
- C:\Windows\System\erWhQDS.exe
  C:\Windows\System\erWhQDS.exe
  2⤵
  PID:8428
- C:\Windows\System\luDllsW.exe
  C:\Windows\System\luDllsW.exe
  2⤵
  PID:1200
- C:\Windows\System\DwRacQj.exe
  C:\Windows\System\DwRacQj.exe
  2⤵
  PID:4372
- C:\Windows\System\oSlEeOz.exe
  C:\Windows\System\oSlEeOz.exe
  2⤵
  PID:2296
- C:\Windows\System\khCzcHk.exe
  C:\Windows\System\khCzcHk.exe
  2⤵
  PID:13748
- C:\Windows\System\lnDQqdk.exe
  C:\Windows\System\lnDQqdk.exe
  2⤵
  PID:3692
- C:\Windows\System\jUIqSum.exe
  C:\Windows\System\jUIqSum.exe
  2⤵
  PID:14088
- C:\Windows\System\mxnjZpJ.exe
  C:\Windows\System\mxnjZpJ.exe
  2⤵
  PID:1856
- C:\Windows\System\IcNHGnC.exe
  C:\Windows\System\IcNHGnC.exe
  2⤵
  PID:3848
- C:\Windows\System\cnmqVAs.exe
  C:\Windows\System\cnmqVAs.exe
  2⤵
  PID:2328
- C:\Windows\System\ptsqgjS.exe
  C:\Windows\System\ptsqgjS.exe
  2⤵
  PID:100
- C:\Windows\System\sUiGtCF.exe
  C:\Windows\System\sUiGtCF.exe
  2⤵
  PID:5156
- C:\Windows\System\JUfAuaK.exe
  C:\Windows\System\JUfAuaK.exe
  2⤵
  PID:5268
- C:\Windows\System\NWmZbgz.exe
  C:\Windows\System\NWmZbgz.exe
  2⤵
  PID:5776
- C:\Windows\System\AazUean.exe
  C:\Windows\System\AazUean.exe
  2⤵
  PID:5536
- C:\Windows\System\ODpImrH.exe
  C:\Windows\System\ODpImrH.exe
  2⤵
  PID:3204
- C:\Windows\System\EfVUVJg.exe
  C:\Windows\System\EfVUVJg.exe
  2⤵
  PID:2948
- C:\Windows\System\WqXrDku.exe
  C:\Windows\System\WqXrDku.exe
  2⤵
  PID:5620
- C:\Windows\System\VSkOUmg.exe
  C:\Windows\System\VSkOUmg.exe
  2⤵
  PID:3844
- C:\Windows\System\BMBioLA.exe
  C:\Windows\System\BMBioLA.exe
  2⤵
  PID:2244
- C:\Windows\System\CEFEbiA.exe
  C:\Windows\System\CEFEbiA.exe
  2⤵
  PID:5716
- C:\Windows\System\CrcYMzq.exe
  C:\Windows\System\CrcYMzq.exe
  2⤵
  PID:1660
- C:\Windows\System\WCQrfZo.exe
  C:\Windows\System\WCQrfZo.exe
  2⤵
  PID:1196
- C:\Windows\System\LrbUOHc.exe
  C:\Windows\System\LrbUOHc.exe
  2⤵
  PID:14312
- C:\Windows\System\ioIqgMV.exe
  C:\Windows\System\ioIqgMV.exe
  2⤵
  PID:2608
- C:\Windows\System\STvzIUr.exe
  C:\Windows\System\STvzIUr.exe
  2⤵
  PID:2332
- C:\Windows\System\jfgWqot.exe
  C:\Windows\System\jfgWqot.exe
  2⤵
  PID:5308
- C:\Windows\System\NKmCDNL.exe
  C:\Windows\System\NKmCDNL.exe
  2⤵
  PID:1572
- C:\Windows\System\wTrrOCz.exe
  C:\Windows\System\wTrrOCz.exe
  2⤵
  PID:6012
- C:\Windows\System\jyjPKSS.exe
  C:\Windows\System\jyjPKSS.exe
  2⤵
  PID:3788
- C:\Windows\System\VBnihOR.exe
  C:\Windows\System\VBnihOR.exe
  2⤵
  PID:14360
- C:\Windows\System\cjQQtOP.exe
  C:\Windows\System\cjQQtOP.exe
  2⤵
  PID:14396
- C:\Windows\System\pmAkkdR.exe
  C:\Windows\System\pmAkkdR.exe
  2⤵
  PID:14420
- C:\Windows\System\boQTNUB.exe
  C:\Windows\System\boQTNUB.exe
  2⤵
  PID:14448
- C:\Windows\System\NZkTbaY.exe
  C:\Windows\System\NZkTbaY.exe
  2⤵
  PID:14480
- C:\Windows\System\UoKAbpR.exe
  C:\Windows\System\UoKAbpR.exe
  2⤵
  PID:14508
- C:\Windows\System\dismzle.exe
  C:\Windows\System\dismzle.exe
  2⤵
  PID:14532
- C:\Windows\System\IOuSCvV.exe
  C:\Windows\System\IOuSCvV.exe
  2⤵
  PID:14556
- C:\Windows\System\AURBTWw.exe
  C:\Windows\System\AURBTWw.exe
  2⤵
  PID:14704
- C:\Windows\System\OqoxShV.exe
  C:\Windows\System\OqoxShV.exe
  2⤵
  PID:14724
- C:\Windows\System\jNbqBoW.exe
  C:\Windows\System\jNbqBoW.exe
  2⤵
  PID:14856
- C:\Windows\System\wLPBbdr.exe
  C:\Windows\System\wLPBbdr.exe
  2⤵
  PID:14876
- C:\Windows\System\ymDpwxu.exe
  C:\Windows\System\ymDpwxu.exe
  2⤵
  PID:14892
- C:\Windows\System\OdCHDkf.exe
  C:\Windows\System\OdCHDkf.exe
  2⤵
  PID:14908
- C:\Windows\System\ISrRjuw.exe
  C:\Windows\System\ISrRjuw.exe
  2⤵
  PID:14932
- C:\Windows\System\yMByHXB.exe
  C:\Windows\System\yMByHXB.exe
  2⤵
  PID:14952
- C:\Windows\System\GyUjMZp.exe
  C:\Windows\System\GyUjMZp.exe
  2⤵
  PID:14992
- C:\Windows\System\jGsqUZc.exe
  C:\Windows\System\jGsqUZc.exe
  2⤵
  PID:15020
- C:\Windows\System\ECiHAPx.exe
  C:\Windows\System\ECiHAPx.exe
  2⤵
  PID:15048
- C:\Windows\System\ZTuEDcv.exe
  C:\Windows\System\ZTuEDcv.exe
  2⤵
  PID:15080
- C:\Windows\System\gQkEvlO.exe
  C:\Windows\System\gQkEvlO.exe
  2⤵
  PID:15100
- C:\Windows\System\OeZUJFV.exe
  C:\Windows\System\OeZUJFV.exe
  2⤵
  PID:15236
- C:\Windows\System\iPbUxXe.exe
  C:\Windows\System\iPbUxXe.exe
  2⤵
  PID:15252
- C:\Windows\System\FugTtSq.exe
  C:\Windows\System\FugTtSq.exe
  2⤵
  PID:14740
- C:\Windows\System\pFbIbnd.exe
  C:\Windows\System\pFbIbnd.exe
  2⤵
  PID:14772
- C:\Windows\System\yTsVjlO.exe
  C:\Windows\System\yTsVjlO.exe
  2⤵
  PID:10096
- C:\Windows\System\SqMYipp.exe
  C:\Windows\System\SqMYipp.exe
  2⤵
  PID:9736
- C:\Windows\System\WJBeBoU.exe
  C:\Windows\System\WJBeBoU.exe
  2⤵
  PID:14836
- C:\Windows\System\qhxwyhQ.exe
  C:\Windows\System\qhxwyhQ.exe
  2⤵
  PID:14900
- C:\Windows\System\FcneILm.exe
  C:\Windows\System\FcneILm.exe
  2⤵
  PID:14916
- C:\Windows\System\oBKzetk.exe
  C:\Windows\System\oBKzetk.exe
  2⤵
  PID:14948
- C:\Windows\System\NVLWMHz.exe
  C:\Windows\System\NVLWMHz.exe
  2⤵
  PID:15120
- C:\Windows\System\WbNYtwJ.exe
  C:\Windows\System\WbNYtwJ.exe
  2⤵
  PID:14944
- C:\Windows\System\wBAqeqT.exe
  C:\Windows\System\wBAqeqT.exe
  2⤵
  PID:15204
- C:\Windows\System\OAItZRw.exe
  C:\Windows\System\OAItZRw.exe
  2⤵
  PID:15296
- C:\Windows\System\JkmPGTB.exe
  C:\Windows\System\JkmPGTB.exe
  2⤵
  PID:15340
- C:\Windows\System\jQFfqXY.exe
  C:\Windows\System\jQFfqXY.exe
  2⤵
  PID:1912
- C:\Windows\System\WtGbSoC.exe
  C:\Windows\System\WtGbSoC.exe
  2⤵
  PID:5680
- C:\Windows\System\wEXNRaH.exe
  C:\Windows\System\wEXNRaH.exe
  2⤵
  PID:6000
- C:\Windows\System\gHctjFl.exe
  C:\Windows\System\gHctjFl.exe
  2⤵
  PID:14344
- C:\Windows\System\imKPmjj.exe
  C:\Windows\System\imKPmjj.exe
  2⤵
  PID:4352
- C:\Windows\System\dBFMRlC.exe
  C:\Windows\System\dBFMRlC.exe
  2⤵
  PID:14384
- C:\Windows\System\oHRBsDt.exe
  C:\Windows\System\oHRBsDt.exe
  2⤵
  PID:4336
- C:\Windows\System\sCZajjI.exe
  C:\Windows\System\sCZajjI.exe
  2⤵
  PID:14404
- C:\Windows\System\CVyddqL.exe
  C:\Windows\System\CVyddqL.exe
  2⤵
  PID:14496
- C:\Windows\System\mXOtpJy.exe
  C:\Windows\System\mXOtpJy.exe
  2⤵
  PID:14584
- C:\Windows\System\ZhgwVkT.exe
  C:\Windows\System\ZhgwVkT.exe
  2⤵
  PID:14664
- C:\Windows\System\ylLPvzJ.exe
  C:\Windows\System\ylLPvzJ.exe
  2⤵
  PID:5172
- C:\Windows\System\aRKPrXO.exe
  C:\Windows\System\aRKPrXO.exe
  2⤵
  PID:5244
- C:\Windows\System\uCbdKBb.exe
  C:\Windows\System\uCbdKBb.exe
  2⤵
  PID:14144
- C:\Windows\System\YOcjLZA.exe
  C:\Windows\System\YOcjLZA.exe
  2⤵
  PID:6572
- C:\Windows\System\UYOoJsL.exe
  C:\Windows\System\UYOoJsL.exe
  2⤵
  PID:6004
- C:\Windows\System\iCdehbG.exe
  C:\Windows\System\iCdehbG.exe
  2⤵
  PID:7012
- C:\Windows\System\qGiUKVb.exe
  C:\Windows\System\qGiUKVb.exe
  2⤵
  PID:15348
- C:\Windows\System\ShoHORX.exe
  C:\Windows\System\ShoHORX.exe
  2⤵
  PID:5624
- C:\Windows\System\RVmvvVK.exe
  C:\Windows\System\RVmvvVK.exe
  2⤵
  PID:6512
- C:\Windows\System\iPhRHqO.exe
  C:\Windows\System\iPhRHqO.exe
  2⤵
  PID:2452
- C:\Windows\System\fOncoPC.exe
  C:\Windows\System\fOncoPC.exe
  2⤵
  PID:14340
- C:\Windows\System\ylsPVBy.exe
  C:\Windows\System\ylsPVBy.exe
  2⤵
  PID:5440
- C:\Windows\System\NbHIeYx.exe
  C:\Windows\System\NbHIeYx.exe
  2⤵
  PID:1380
- C:\Windows\System\HIIYDvt.exe
  C:\Windows\System\HIIYDvt.exe
  2⤵
  PID:14460
- C:\Windows\System\NSMahVY.exe
  C:\Windows\System\NSMahVY.exe
  2⤵
  PID:14656
- C:\Windows\System\rljqTmr.exe
  C:\Windows\System\rljqTmr.exe
  2⤵
  PID:2304
- C:\Windows\System\vAFCYXH.exe
  C:\Windows\System\vAFCYXH.exe
  2⤵
  PID:4916
- C:\Windows\System\oSBuDzs.exe
  C:\Windows\System\oSBuDzs.exe
  2⤵
  PID:14716
- C:\Windows\System\RPVtPPM.exe
  C:\Windows\System\RPVtPPM.exe
  2⤵
  PID:2056
- C:\Windows\System\sPGSAQi.exe
  C:\Windows\System\sPGSAQi.exe
  2⤵
  PID:14820
- C:\Windows\System\Ilmqkxl.exe
  C:\Windows\System\Ilmqkxl.exe
  2⤵
  PID:14832
- C:\Windows\System\VzgnoNG.exe
  C:\Windows\System\VzgnoNG.exe
  2⤵
  PID:6680
- C:\Windows\System\fWJjZTe.exe
  C:\Windows\System\fWJjZTe.exe
  2⤵
  PID:4628
- C:\Windows\System\sJbqheE.exe
  C:\Windows\System\sJbqheE.exe
  2⤵
  PID:15068
- C:\Windows\System\uDjKyvl.exe
  C:\Windows\System\uDjKyvl.exe
  2⤵
  PID:15140
- C:\Windows\System\MtDDIeD.exe
  C:\Windows\System\MtDDIeD.exe
  2⤵
  PID:5396
- C:\Windows\System\zPartVl.exe
  C:\Windows\System\zPartVl.exe
  2⤵
  PID:15244
- C:\Windows\System\MTLvIRA.exe
  C:\Windows\System\MTLvIRA.exe
  2⤵
  PID:6284
- C:\Windows\System\TFqdaoO.exe
  C:\Windows\System\TFqdaoO.exe
  2⤵
  PID:15268
- C:\Windows\System\gVpLdYO.exe
  C:\Windows\System\gVpLdYO.exe
  2⤵
  PID:15356
- C:\Windows\System\QOBRkOC.exe
  C:\Windows\System\QOBRkOC.exe
  2⤵
  PID:5844
- C:\Windows\System\hqSoWJO.exe
  C:\Windows\System\hqSoWJO.exe
  2⤵
  PID:3716
- C:\Windows\System\RYGkmMl.exe
  C:\Windows\System\RYGkmMl.exe
  2⤵
  PID:6088
- C:\Windows\System\aGjmfPV.exe
  C:\Windows\System\aGjmfPV.exe
  2⤵
  PID:7280
- C:\Windows\System\UFkkAcJ.exe
  C:\Windows\System\UFkkAcJ.exe
  2⤵
  PID:1892
- C:\Windows\System\CLYOdOg.exe
  C:\Windows\System\CLYOdOg.exe
  2⤵
  PID:6820
- C:\Windows\System\wmVocML.exe
  C:\Windows\System\wmVocML.exe
  2⤵
  PID:14376
- C:\Windows\System\srMsnrY.exe
  C:\Windows\System\srMsnrY.exe
  2⤵
  PID:14468
- C:\Windows\System\PFOrOzD.exe
  C:\Windows\System\PFOrOzD.exe
  2⤵
  PID:6348
- C:\Windows\System\WBEryjI.exe
  C:\Windows\System\WBEryjI.exe
  2⤵
  PID:6540
- C:\Windows\System\JuGfJVd.exe
  C:\Windows\System\JuGfJVd.exe
  2⤵
  PID:14824
- C:\Windows\System\ifiYxyk.exe
  C:\Windows\System\ifiYxyk.exe
  2⤵
  PID:15036
- C:\Windows\System\SYrFQOQ.exe
  C:\Windows\System\SYrFQOQ.exe
  2⤵
  PID:15112
- C:\Windows\System\SwglKEH.exe
  C:\Windows\System\SwglKEH.exe
  2⤵
  PID:6292
- C:\Windows\System\qjttAzp.exe
  C:\Windows\System\qjttAzp.exe
  2⤵
  PID:15016
- C:\Windows\System\bpGpbvP.exe
  C:\Windows\System\bpGpbvP.exe
  2⤵
  PID:6164
- C:\Windows\System\pFxrjye.exe
  C:\Windows\System\pFxrjye.exe
  2⤵
  PID:15156
- C:\Windows\System\LWWWbZR.exe
  C:\Windows\System\LWWWbZR.exe
  2⤵
  PID:6244
- C:\Windows\System\XhFOQPw.exe
  C:\Windows\System\XhFOQPw.exe
  2⤵
  PID:15276
- C:\Windows\System\kmEHELE.exe
  C:\Windows\System\kmEHELE.exe
  2⤵
  PID:4368
- C:\Windows\System\HVpkOiD.exe
  C:\Windows\System\HVpkOiD.exe
  2⤵
  PID:15332
- C:\Windows\System\SwKHRXo.exe
  C:\Windows\System\SwKHRXo.exe
  2⤵
  PID:15328
- C:\Windows\System\qszBnkC.exe
  C:\Windows\System\qszBnkC.exe
  2⤵
  PID:8136
- C:\Windows\System\jneemho.exe
  C:\Windows\System\jneemho.exe
  2⤵
  PID:2688
- C:\Windows\System\jhxHIpC.exe
  C:\Windows\System\jhxHIpC.exe
  2⤵
  PID:6608
- C:\Windows\System\WCXqEzA.exe
  C:\Windows\System\WCXqEzA.exe
  2⤵
  PID:6032
- C:\Windows\System\jHiZxwD.exe
  C:\Windows\System\jHiZxwD.exe
  2⤵
  PID:1996
- C:\Windows\System\sinkpoh.exe
  C:\Windows\System\sinkpoh.exe
  2⤵
  PID:9416
- C:\Windows\System\SEpiqJl.exe
  C:\Windows\System\SEpiqJl.exe
  2⤵
  PID:4572
- C:\Windows\System\ewvjcFY.exe
  C:\Windows\System\ewvjcFY.exe
  2⤵
  PID:6872
- C:\Windows\System\BhGihFx.exe
  C:\Windows\System\BhGihFx.exe
  2⤵
  PID:6828
- C:\Windows\System\oJvMdxr.exe
  C:\Windows\System\oJvMdxr.exe
  2⤵
  PID:8464
- C:\Windows\System\sMBLXUq.exe
  C:\Windows\System\sMBLXUq.exe
  2⤵
  PID:9668
- C:\Windows\System\CocXqKr.exe
  C:\Windows\System\CocXqKr.exe
  2⤵
  PID:8600
- C:\Windows\System\MLwsZue.exe
  C:\Windows\System\MLwsZue.exe
  2⤵
  PID:8484
- C:\Windows\System\vMatzRM.exe
  C:\Windows\System\vMatzRM.exe
  2⤵
  PID:9944
- C:\Windows\System\MkEfaBC.exe
  C:\Windows\System\MkEfaBC.exe
  2⤵
  PID:5192
- C:\Windows\System\ZpLsihx.exe
  C:\Windows\System\ZpLsihx.exe
  2⤵
  PID:9212
- C:\Windows\System\IMjtTNg.exe
  C:\Windows\System\IMjtTNg.exe
  2⤵
  PID:7580
- C:\Windows\System\xUipIWp.exe
  C:\Windows\System\xUipIWp.exe
  2⤵
  PID:7728
- C:\Windows\System\bndgyQc.exe
  C:\Windows\System\bndgyQc.exe
  2⤵
  PID:10472
- C:\Windows\System\ncLCfTV.exe
  C:\Windows\System\ncLCfTV.exe
  2⤵
  PID:10428
- C:\Windows\System\kCyFlGk.exe
  C:\Windows\System\kCyFlGk.exe
  2⤵
  PID:8868
- C:\Windows\System\OYafhIA.exe
  C:\Windows\System\OYafhIA.exe
  2⤵
  PID:10508
- C:\Windows\System\KBrntxp.exe
  C:\Windows\System\KBrntxp.exe
  2⤵
  PID:6460
- C:\Windows\System\lbjoQSw.exe
  C:\Windows\System\lbjoQSw.exe
  2⤵
  PID:6248
- C:\Windows\System\qfYRyHd.exe
  C:\Windows\System\qfYRyHd.exe
  2⤵
  PID:9296
- C:\Windows\System\dCwtlUF.exe
  C:\Windows\System\dCwtlUF.exe
  2⤵
  PID:14920
- C:\Windows\System\AWbruXX.exe
  C:\Windows\System\AWbruXX.exe
  2⤵
  PID:7888
- C:\Windows\System\vQuAXfG.exe
  C:\Windows\System\vQuAXfG.exe
  2⤵
  PID:9380
- C:\Windows\System\tHNeXXv.exe
  C:\Windows\System\tHNeXXv.exe
  2⤵
  PID:5580
- C:\Windows\System\Ynmtudq.exe
  C:\Windows\System\Ynmtudq.exe
  2⤵
  PID:9520
- C:\Windows\System\xAlhESl.exe
  C:\Windows\System\xAlhESl.exe
  2⤵
  PID:7000
- C:\Windows\System\UaSgGnk.exe
  C:\Windows\System\UaSgGnk.exe
  2⤵
  PID:8032
- C:\Windows\System\DeDZvzQ.exe
  C:\Windows\System\DeDZvzQ.exe
  2⤵
  PID:3884
- C:\Windows\System\xAEnBBH.exe
  C:\Windows\System\xAEnBBH.exe
  2⤵
  PID:9800
- C:\Windows\System\TyVEuom.exe
  C:\Windows\System\TyVEuom.exe
  2⤵
  PID:8308
- C:\Windows\System\pniCfih.exe
  C:\Windows\System\pniCfih.exe
  2⤵
  PID:6804
- C:\Windows\System\MXTuvgm.exe
  C:\Windows\System\MXTuvgm.exe
  2⤵
  PID:14148
- C:\Windows\System\nXNmbTx.exe
  C:\Windows\System\nXNmbTx.exe
  2⤵
  PID:8552
- C:\Windows\System\idGQlGe.exe
  C:\Windows\System\idGQlGe.exe
  2⤵
  PID:11192
- C:\Windows\System\RuxzfZD.exe
  C:\Windows\System\RuxzfZD.exe
  2⤵
  PID:11712
- C:\Windows\System\Kpptfms.exe
  C:\Windows\System\Kpptfms.exe
  2⤵
  PID:3308
- C:\Windows\System\VuZsMsn.exe
  C:\Windows\System\VuZsMsn.exe
  2⤵
  PID:12024
- C:\Windows\System\XpOnGjT.exe
  C:\Windows\System\XpOnGjT.exe
  2⤵
  PID:11008
- C:\Windows\System\bCEnJBZ.exe
  C:\Windows\System\bCEnJBZ.exe
  2⤵
  PID:8284
- C:\Windows\System\KQuHTJJ.exe
  C:\Windows\System\KQuHTJJ.exe
  2⤵
  PID:7056
- C:\Windows\System\ReTuztr.exe
  C:\Windows\System\ReTuztr.exe
  2⤵
  PID:9012
- C:\Windows\System\LrDBisz.exe
  C:\Windows\System\LrDBisz.exe
  2⤵
  PID:14796
- C:\Windows\System\ZdudVzn.exe
  C:\Windows\System\ZdudVzn.exe
  2⤵
  PID:1880
- C:\Windows\System\WEKYXCv.exe
  C:\Windows\System\WEKYXCv.exe
  2⤵
  PID:9192
- C:\Windows\System\qPLGDqW.exe
  C:\Windows\System\qPLGDqW.exe
  2⤵
  PID:9704
- C:\Windows\System\aeEIxkJ.exe
  C:\Windows\System\aeEIxkJ.exe
  2⤵
  PID:11288
- C:\Windows\System\BzBUlXo.exe
  C:\Windows\System\BzBUlXo.exe
  2⤵
  PID:8360
- C:\Windows\System\ParcEAo.exe
  C:\Windows\System\ParcEAo.exe
  2⤵
  PID:7396
- C:\Windows\System\FniEXhI.exe
  C:\Windows\System\FniEXhI.exe
  2⤵
  PID:6672
- C:\Windows\System\MkNDVzR.exe
  C:\Windows\System\MkNDVzR.exe
  2⤵
  PID:10800
- C:\Windows\System\evBqGOU.exe
  C:\Windows\System\evBqGOU.exe
  2⤵
  PID:13112
- C:\Windows\System\JlzyaOx.exe
  C:\Windows\System\JlzyaOx.exe
  2⤵
  PID:5324
- C:\Windows\System\OwKooab.exe
  C:\Windows\System\OwKooab.exe
  2⤵
  PID:13172
- C:\Windows\System\ktJteGz.exe
  C:\Windows\System\ktJteGz.exe
  2⤵
  PID:13168
- C:\Windows\System\FTnXgKg.exe
  C:\Windows\System\FTnXgKg.exe
  2⤵
  PID:11248
- C:\Windows\System\BQgSZdd.exe
  C:\Windows\System\BQgSZdd.exe
  2⤵
  PID:11224
- C:\Windows\System\mCQGYMm.exe
  C:\Windows\System\mCQGYMm.exe
  2⤵
  PID:14152
- C:\Windows\System\ozdGiUG.exe
  C:\Windows\System\ozdGiUG.exe
  2⤵
  PID:7996
- C:\Windows\System\aAAbhWZ.exe
  C:\Windows\System\aAAbhWZ.exe
  2⤵
  PID:10960
- C:\Windows\System\LAmUYJM.exe
  C:\Windows\System\LAmUYJM.exe
  2⤵
  PID:8716
- C:\Windows\System\FjYOiTW.exe
  C:\Windows\System\FjYOiTW.exe
  2⤵
  PID:6520
- C:\Windows\System\zDwRyoz.exe
  C:\Windows\System\zDwRyoz.exe
  2⤵
  PID:972
- C:\Windows\System\gBgkAPc.exe
  C:\Windows\System\gBgkAPc.exe
  2⤵
  PID:13220
- C:\Windows\System\kfjVoHM.exe
  C:\Windows\System\kfjVoHM.exe
  2⤵
  PID:10828
- C:\Windows\System\fvWOliR.exe
  C:\Windows\System\fvWOliR.exe
  2⤵
  PID:11172
- C:\Windows\System\RXHXmwn.exe
  C:\Windows\System\RXHXmwn.exe
  2⤵
  PID:14488
- C:\Windows\System\nQKWGOM.exe
  C:\Windows\System\nQKWGOM.exe
  2⤵
  PID:5288
- C:\Windows\System\PIwJFsB.exe
  C:\Windows\System\PIwJFsB.exe
  2⤵
  PID:13216
- C:\Windows\System\QwWpmfD.exe
  C:\Windows\System\QwWpmfD.exe
  2⤵
  PID:9916
- C:\Windows\System\ZSuDZrd.exe
  C:\Windows\System\ZSuDZrd.exe
  2⤵
  PID:11324
- C:\Windows\System\PlvaTZJ.exe
  C:\Windows\System\PlvaTZJ.exe
  2⤵
  PID:13244
- C:\Windows\System\QebbVRv.exe
  C:\Windows\System\QebbVRv.exe
  2⤵
  PID:11372
- C:\Windows\System\hgAsFoM.exe
  C:\Windows\System\hgAsFoM.exe
  2⤵
  PID:7240
- C:\Windows\System\hTaxxyA.exe
  C:\Windows\System\hTaxxyA.exe
  2⤵
  PID:13284
- C:\Windows\System\cuqfHLu.exe
  C:\Windows\System\cuqfHLu.exe
  2⤵
  PID:8648
- C:\Windows\System\lnhIITN.exe
  C:\Windows\System\lnhIITN.exe
  2⤵
  PID:14436
- C:\Windows\System\uilhxoz.exe
  C:\Windows\System\uilhxoz.exe
  2⤵
  PID:9248
- C:\Windows\System\Wfmfxov.exe
  C:\Windows\System\Wfmfxov.exe
  2⤵
  PID:7156
- C:\Windows\System\urZEYHi.exe
  C:\Windows\System\urZEYHi.exe
  2⤵
  PID:9232
- C:\Windows\System\ahDIBLo.exe
  C:\Windows\System\ahDIBLo.exe
  2⤵
  PID:7312
- C:\Windows\System\GBGTaWc.exe
  C:\Windows\System\GBGTaWc.exe
  2⤵
  PID:4128
- C:\Windows\System\GbwlRuy.exe
  C:\Windows\System\GbwlRuy.exe
  2⤵
  PID:10640
- C:\Windows\System\GJJwFOV.exe
  C:\Windows\System\GJJwFOV.exe
  2⤵
  PID:12704
- C:\Windows\System\rVOCVGN.exe
  C:\Windows\System\rVOCVGN.exe
  2⤵
  PID:11336
- C:\Windows\System\aggjkNI.exe
  C:\Windows\System\aggjkNI.exe
  2⤵
  PID:9700
- C:\Windows\System\EojmBZx.exe
  C:\Windows\System\EojmBZx.exe
  2⤵
  PID:10072
- C:\Windows\System\xzuZXvX.exe
  C:\Windows\System\xzuZXvX.exe
  2⤵
  PID:9260
- C:\Windows\System\ZLwQTyR.exe
  C:\Windows\System\ZLwQTyR.exe
  2⤵
  PID:12376
- C:\Windows\System\icEHQyn.exe
  C:\Windows\System\icEHQyn.exe
  2⤵
  PID:13752
- C:\Windows\System\EIpFpje.exe
  C:\Windows\System\EIpFpje.exe
  2⤵
  PID:12312
- C:\Windows\System\rDtcnKD.exe
  C:\Windows\System\rDtcnKD.exe
  2⤵
  PID:812
- C:\Windows\System\RBaEdfr.exe
  C:\Windows\System\RBaEdfr.exe
  2⤵
  PID:13292
- C:\Windows\System\KcNXQKK.exe
  C:\Windows\System\KcNXQKK.exe
  2⤵
  PID:14800
- C:\Windows\System\UabMYVQ.exe
  C:\Windows\System\UabMYVQ.exe
  2⤵
  PID:13136
- C:\Windows\System\MTHAwnH.exe
  C:\Windows\System\MTHAwnH.exe
  2⤵
  PID:6532
- C:\Windows\System\sexCxWS.exe
  C:\Windows\System\sexCxWS.exe
  2⤵
  PID:11492
- C:\Windows\System\RSDXsrR.exe
  C:\Windows\System\RSDXsrR.exe
  2⤵
  PID:11752
- C:\Windows\System\BlwCjXY.exe
  C:\Windows\System\BlwCjXY.exe
  2⤵
  PID:10488
- C:\Windows\System\nqxnZkP.exe
  C:\Windows\System\nqxnZkP.exe
  2⤵
  PID:12148
- C:\Windows\System\PXvoUZo.exe
  C:\Windows\System\PXvoUZo.exe
  2⤵
  PID:12204
- C:\Windows\System\TiAWuYE.exe
  C:\Windows\System\TiAWuYE.exe
  2⤵
  PID:12900
- C:\Windows\System\qNzTsYH.exe
  C:\Windows\System\qNzTsYH.exe
  2⤵
  PID:13304
- C:\Windows\System\HSSikWI.exe
  C:\Windows\System\HSSikWI.exe
  2⤵
  PID:12544
- C:\Windows\System\KcWcxxZ.exe
  C:\Windows\System\KcWcxxZ.exe
  2⤵
  PID:12112
- C:\Windows\System\hVryPZV.exe
  C:\Windows\System\hVryPZV.exe
  2⤵
  PID:12512
- C:\Windows\System\CzjRHoO.exe
  C:\Windows\System\CzjRHoO.exe
  2⤵
  PID:8156
- C:\Windows\System\anNBixe.exe
  C:\Windows\System\anNBixe.exe
  2⤵
  PID:11060
- C:\Windows\System\pgJffge.exe
  C:\Windows\System\pgJffge.exe
  2⤵
  PID:13160
- C:\Windows\System\CLxsITQ.exe
  C:\Windows\System\CLxsITQ.exe
  2⤵
  PID:12648
- C:\Windows\System\XjdeGPr.exe
  C:\Windows\System\XjdeGPr.exe
  2⤵
  PID:9940
- C:\Windows\System\CixjHeM.exe
  C:\Windows\System\CixjHeM.exe
  2⤵
  PID:10012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hllu0vn4.i5t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BDTZHCb.exe

Filesize
1.9MB

MD5
3071963cbbd37c25ffedff1ad134f369

SHA1
a28cb509ddb9a46e561d6652539d8b1f3f093b12

SHA256
3b2283f4c70953a8d5dfbd4014c319bef65e534d5e68b627e346f0cb1d0f548f

SHA512
e3f699f6c4160a0cd7f7c2a309f753ab5958af6a93f3007821af3a5961d1aa0b8ddcab3aafa7196fed7101dd023b38c12391bfd1e95efc67faf2f63564c8e548

Download Submit
C:\Windows\System\CuwRjjB.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\DPMtoQk.exe

Filesize
1.9MB

MD5
ddb1bec6857c2c39d42370e03c688610

SHA1
faed758cf2002252d931aa0193b64b748b3020bd

SHA256
157cd3a11c2a52211cdb0680b76c90458a7a822c70f4aa5e1c8fa822b4071ce8

SHA512
c9673a509d72cb8a9b52700794a9b30e7c128ffeaeb1b75f2098649def688b02bfb656f20e771dfc6f144d3941a59ed141ae76688dfa76add6b50d472af1efe9

Download Submit
C:\Windows\System\ECAZiJt.exe

Filesize
1.9MB

MD5
ef44070d8ccf417d97f884353cd7253a

SHA1
62bd91e2bd706044f9b7b433da26c01d646007c3

SHA256
fcd01433c1829a47297c82b28747e18df0b8aa7ee4e4ea643f15f31c1a77eeb7

SHA512
59219cd7d76327df288e0d8eff582184d7629438592789b74a546fce00c11d9f9ea21c92b5cf94ba2b3a863831fd40170a011d75a7ddffba6c32da57d118940a

Download Submit
C:\Windows\System\EhhDNtt.exe

Filesize
1.9MB

MD5
0bdae7c4ef9913c819f4313ee3fbe8e4

SHA1
9a578a1f491b93b9b70941729cfdcec136edcc82

SHA256
94b82cf7f81f3e7ae436062db8fefbd0f959eb056ed4e8548459ebee8f9114e1

SHA512
9e5a796bdc8d2fdf195cceb21f185f162de6d11b8d3b4b6359d89902aadcddcc996afcc953936bcdeb865d989da35a62549f5c1ed44482d73fbf048db957aa05

Download Submit
C:\Windows\System\EpgAfVS.exe

Filesize
1.9MB

MD5
6d5ee432721550d422940996a8c2df1b

SHA1
08018409c81072de4dd712e663fae456fb9b63ce

SHA256
1cc32a449b84390027a10b9ad79b890be3bfb2aea3e4045ee4cae59c085f6985

SHA512
6af5e199ca127c7f326807377927f894af4a2b85e8180277ca212c5c2d6eba14479977ed7010d1bc899388ad7dd38f455824ca15da4cb29bcb2f195654653056

Download Submit
C:\Windows\System\FNKfEEL.exe

Filesize
1.9MB

MD5
c3a6c78b7060ab91e37c7b43a52410de

SHA1
054a25213be2e5a4316ef945828572d8c43b2adf

SHA256
688dd7f2477b2e648fca1badc10b0be1a356afae592495a0dac811fdd8e8b77b

SHA512
ead375cd9ab0024ace81b21765ba653fd5dedb87faa314fdb394d1f6989a3669ac6acda7ac7cc51f00b2fed8741f84793bc5643bf79bfa38070855432ee701bf

Download Submit
C:\Windows\System\HBtfulp.exe

Filesize
1.9MB

MD5
97bb01f25970b5ee08c2dc3584482059

SHA1
3de159a173f48e08b51e9972f3b6424564f57184

SHA256
41d551dd4f463776b6b7fb7140cadb1e28bf630eab3030a35a4ee86a2c672b91

SHA512
aa0e4eb6934a97edb670570eca2e86a739c8a73d5483db79baf0052f01a9874cc38c1da585bd9a3b979acfea848cb6883c27cec2a1d1fb736af689919eb23c31

Download Submit
C:\Windows\System\HqMDIai.exe

Filesize
1.9MB

MD5
f0b4d6425f4ed798c7ee0733347468b5

SHA1
01b9b600e30573f1503cddb6b0b6955eaf55e726

SHA256
f7cd2eeee39870f05eb53a3230c802864290bd28da685377609a2c1ff09d2d7a

SHA512
e92eaec1ef61c5bf65d53c98587ba14350ff8f711ca2dd6ce8729f148a692717a4a1f565175636cabfa1138bbac9a801f64df0b85a72f117768bf27843769b5c

Download Submit
C:\Windows\System\IDukKWa.exe

Filesize
1.9MB

MD5
5d6bb0a2637b708a5652b6709ed8fec7

SHA1
4d4f7f468161bcc766bd1433d577a6f8c8329a5b

SHA256
eb8fc300fab003d25fd79038f2a42ec8af74b6eb243736f1165637324aefbaba

SHA512
55c5df8648794e7c4c4ac39dfae64f0e0ad20a4e40e5017ed0acdb0cf78229aa9b049d4aaf0bd4d5c075d5ff5e6f1a23ce4781a6cee2615e6f1d0a3ea9e0c719

Download Submit
C:\Windows\System\IsdBnSo.exe

Filesize
1.9MB

MD5
64a747c3480c5644f724a6c9af23aef4

SHA1
182d696c4aff3a1a4fe6088b701b6577a6d8ed96

SHA256
2eb0876710a7581ce7051dd9650a7e88e5984cb1d2895517938a26294eed9f38

SHA512
b3ac3cd89512a692f69031d8fcd0c7ee46ee8ae18d170cffe060642e7c233d6b98396f0ad1bb150d2e34a49e84bb02d3305f5b865bb790fe0a39acc01d085ddf

Download Submit
C:\Windows\System\JMLqxrF.exe

Filesize
1.9MB

MD5
21c8317eb7d62ce80d449a1fee2bf317

SHA1
a2f92c87d86fb006318432d8d27064381aca7f85

SHA256
7c2bf4df4768b990fd2b4a865ac8f00c868453ed78fe91071579db54f14d590e

SHA512
10428716ceac3f00ac9929ef692820eae936c4ea51e3ce436ba784fc9ed0afc9b85f0de1e7183b7882808f7341a78cd680c3c12db5f5b505086939f1202512e7

Download Submit
C:\Windows\System\LCqavGw.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\MAYekGo.exe

Filesize
1.9MB

MD5
15bc3fd852ff799c6a925ba45701110d

SHA1
afc1b3a5a5650894e4b0a5227aadf20f143db2a9

SHA256
e8645ec22193f5a52b95b43bda52f9ff4eafd7363ca5f0de3755333e45f7e8a9

SHA512
0563d25614bc54e21f64e0fcacd5671bec04b3ab09177619748c37e15b728e6b5a511cebf7ec7f2520aa031b4deb8fcdf663a6b056ac58e484f6f59d62988590

Download Submit
C:\Windows\System\NrDfKJF.exe

Filesize
1.9MB

MD5
79f7a5f12a7d8ca873396e1d72918440

SHA1
644ddd53add9b3325afe6efc8aedb09df47e4ea4

SHA256
a729cb4cd5ca100287d9bd5e088fdc8d68d9eefb95a2b0136179fd2471ec9789

SHA512
7823db772633b38097c1eee77e288aa7bbe5001d6e9637b28ecd7f9d3c9b64b192053614bb751fcd42faebbff585aa2a15bd4289492748d95a7dd0d65296aaed

Download Submit
C:\Windows\System\NsifaXW.exe

Filesize
1.9MB

MD5
5fd9c6bad0bcae879cc386d1fb6ca3cd

SHA1
00e13740a19d0115049bdbcaa601ffb4bf638b5f

SHA256
20bb46ec11faf19a323221fa63045f4581cce2cf75c145f757a79f7953751d39

SHA512
024d44e9fc22250f5d7d65a834668cc699808814be0df14fd1cac5e85d24f9ce63d8f0ebc9138fc72d9cf25ebba759b530b1ac242fc3150de1f824e51ff83fb5

Download Submit
C:\Windows\System\RBfpqSJ.exe

Filesize
1.9MB

MD5
bd115556f4e5338c7f7cab9741697152

SHA1
8d2a844ebb8c663edfde1bd85f4c9c287913f505

SHA256
640d41ba5de4f9714a67dce21e7958f39efa5c8f5297c182a0f4b5e7721780c7

SHA512
e57705449ebf6ac26655a4c490fdea7dae22caf7410d78f0b6b10cae6f18837d1dc3488e818ea20ae112e5e30404da38f4c3af5edc56e54751de8393db5101da

Download Submit
C:\Windows\System\RyzWeUj.exe

Filesize
1.9MB

MD5
ae0898e4ae1271274a0b41c1958fd6b0

SHA1
4ffafd69f8907852566eff19043c6ad960f65e19

SHA256
95dc446c784a93a4c886070ca43cede8e0d4e799d0d5b516d271b403668cb0c4

SHA512
2d4306db0cc5679c2178408b71f1cd6b9bf5c938261a9565bd7f091ca04e3107c023f3a7b09f3e2713cef7289b403c3f061ed7ea0fd9212731d347868ee67d2d

Download Submit
C:\Windows\System\STlZOoz.exe

Filesize
1.9MB

MD5
746a76de0193eb6480fa87cfdd9ab7d2

SHA1
c97f3e1aec4ecff70651cfd3d0e4ecd31bddd097

SHA256
5fb0106bf662d6ededc949331080d4107a285e086c2134f2ed127c7858c8adfd

SHA512
31c05a1187cd1b89ab6f539dea17c6eaac43bd4bb32a51052dbcde7dcadcea912c52dd26a0a20da012ae74df867904d39e2b40827ad05dd6bc76bd2f50b657cf

Download Submit
C:\Windows\System\VbamGkX.exe

Filesize
1.9MB

MD5
f5433b93a6e8b591bd68611af8ce0b2a

SHA1
1115a254b2bd04c808e0450a9f46d767424dcbb5

SHA256
bc63d9b50d94083a143dfc4f7531c286cd6890114df3d1efdc5cebcb65df4b33

SHA512
0420616842fb4708df6ae4d4145853c34970d336cc99c86fec36138ca731ee9539e456d2a894ecb8afa57444c61211ae01dbcf3d91b0720193e2f4f1204ce950

Download Submit
C:\Windows\System\VdqzLTO.exe

Filesize
1.9MB

MD5
bc130318bd708804fad2cb673333d0fc

SHA1
8efe9c05fec9029714aab51b65a9cb3bdb13fefb

SHA256
001f48844c2d2d68beffc8e4e7ccb49ff7fec6cab22d20641be8cc6789c856a2

SHA512
0b6a5f6351327a7932530c1de553818e96f8e3c9a3199f918a4b3ab7a846c8bc0a61ead43a23255664ba55917a9b517d05abb990177ac70350d806f2cc4a9289

Download Submit
C:\Windows\System\WfOLUNG.exe

Filesize
1.9MB

MD5
7158c5692cc9109eaae1991b885b50ff

SHA1
bd9173a6a131691f9d69ab13e639407eb771d802

SHA256
ed0d272b713702e891eb2d8a0b6cc28f34a00a74c859995ee80bc120424767ed

SHA512
c4c9863719161fd12b5914607c638cffdf2436c75b64b5aa47acae68b2b15058e1018387d53ad310af8ceff417595240bb85514fed0d09a8e3cc913c2627deee

Download Submit
C:\Windows\System\XeNaBez.exe

Filesize
1.9MB

MD5
4782a89146ab7e450894a4e860582197

SHA1
b5cacd1f762a668a69b29def91aebabed2a27793

SHA256
d73fe6e565f74cc08c016f1561ff676617f764ec79e019229dfd56e8ee8c6af4

SHA512
cd76d99df3277ce7d7bba1b68b59626b6893c6e7d0f95742f0b5d87368950009f91c9df070d8f35b6f4039ef190dad1cc4e5c125c646c95ce5a258fdafdefc84

Download Submit
C:\Windows\System\YCOAlVk.exe

Filesize
1.9MB

MD5
d5fae3a07ce75dbcdaa9628f517898b5

SHA1
dda34f2d932debbebb2f82cccf8d2003911f65d4

SHA256
8ad05e76da76fe0199b057d05cd9103b15bdca97dfd348b363a54b7625824edd

SHA512
edb073900300b823ecb09c9a86e35b0097272ed716f56ad0de07b4541cf3d018f4385067e1d99caa51599621a9d5f7b183f5e2a18768c4f2c57bf8d3026b4eba

Download Submit
C:\Windows\System\YQYQVKJ.exe

Filesize
1.9MB

MD5
c75a695c9eedbaa8145950f41b2dcca1

SHA1
65584fedbe9b4dbaef24575e089cf7cc55492828

SHA256
b942452995bd16e56136564d5bdaad093d98e55804af9643d214a4f02c666e8b

SHA512
d6235dd93da78bb53521ec62c6cc51dda0db07f17ba8864702dac23ac8b23a289a5361d3fe6a707ea83e70c6e94c4f0aa97f69f54af3fee5b00940261bb4ba05

Download Submit
C:\Windows\System\YdqnJfK.exe

Filesize
1.9MB

MD5
a6b98da7efeb58d4666a67cfae1f99b0

SHA1
23640922116c4e501547df3eb0a1b778a5d40003

SHA256
db7329a0c7a849d4cb6038df7647642b43602a22fcefa20984b54ff19c3d5f8e

SHA512
3b1421640ee0408f4602a432d15a11ceab1025ba84403db984f8b58233824e7d34286e4aadd467120536d4e2afcbe11c9508b192fc91a86eb57f8de0de2c2925

Download Submit
C:\Windows\System\ZuGKCIt.exe

Filesize
1.9MB

MD5
72050c5977c27526bf08fd5d16046322

SHA1
3efcc4b6ee746c0109ba9b226109c5aa46401f04

SHA256
bb53be2b776825c4d4ad082dac1783a179cb8d022a14d04e3df109ce564ec237

SHA512
dc357b502711ab3f279dfd738882d1a6c465a013a497ad461535cffedffd5aa712b932ffe241925ad515adb5e7d4c03e67e55d7ff193a905a7ae6a6bbadffc4b

Download Submit
C:\Windows\System\eRSRSEk.exe

Filesize
1.9MB

MD5
7faffb9932b442b38950157e0b169990

SHA1
dab65ef4df040464e5adc47807779573aa8ac965

SHA256
a9acc129830b0807bde93c935e90effa0a265679d4ff0d7bbaef26f329156cf3

SHA512
fc76eff43f6c70497aa44eed93d04e8f8ac54f439a19f6d6880c0e1ae83b90c01e0709e348963e3401c1608b91889662055b123c20d621971a4492bcaf6fa43a

Download Submit
C:\Windows\System\ffwyVTN.exe

Filesize
1.9MB

MD5
4bd275093506a8f76bdf79d070fff29b

SHA1
669dbb1c44a9d19eaf16c924b2d64c8a27c7bd6a

SHA256
6b5301dd422b42e4606555e7799122743e07d98ea03be0823e694deb4269726f

SHA512
b40c39562b90cb5b30b6bf47ae363bf5a4c24e33ba1201b82acc6768993fd040bb4846da4b2ea30be1ce29c949d9ee5a41771f45235b0d6810ec7ae20c7ed01b

Download Submit
C:\Windows\System\gClNfXB.exe

Filesize
1.9MB

MD5
26db9358a9005352f0b3e0241fec62ef

SHA1
a00c719a08fb21c3e97612e21c21dc8b3ebbf5bd

SHA256
d26727beb170626ce78c1145049094083053d0b285c5f88c2978382ec83ceb51

SHA512
f62e9ce711ec9c0a7ea7466195327642757f53257ac7c3514815485915fd3a060edfa895b6cf797fc0a471e1224459c08a6d602684646202f66f9a96c2878e67

Download Submit
C:\Windows\System\ixRQrAq.exe

Filesize
1.9MB

MD5
1a1fe50adc591cd7894be2257dea176f

SHA1
4e72268612f2b983bfe45ce453bcca6dc4a1c5d6

SHA256
17fd9afcc3dd499a53c9f4d159f8c015cf6fdf5e5b380103a489877ad9d76add

SHA512
30341bbb173bf671c032838765c8cc73cc61f6c2c0b64a392bb6da0dcc9e29ad03fb45be259bf2d1bc6d1df1b853ad3f27350927546ebf0437b7728830e6428f

Download Submit
C:\Windows\System\iytjrZU.exe

Filesize
1.9MB

MD5
ddbe66ab29f86413760da681513de318

SHA1
a4af5932506d12c0b0bed84069aea24612c24044

SHA256
5a068c67f17ad3af9c915b82ff9b406b7ef3ee18d0d4ff8dbf6ddb2becf4fb5d

SHA512
0cb8a0d94075ab043e61d54f5a07bffb5b922aca1f794724f8c35451d5203bf49cd5ecdcc3433e44cad01e6b9d0ead45558b7e5322c22144df8058d1bdc0c445

Download Submit
C:\Windows\System\jlJHVuT.exe

Filesize
1.9MB

MD5
b6ab139dd366ab0225465891c9378912

SHA1
c3225c84d0037e8090c5957a52b2f213f8927704

SHA256
11b9ce47e96e53086579415faa863ad6d61904349733347b855b244839840af7

SHA512
437e6b9fb79527be0174666a61dda2b434c9a2a8df8fed41f44436ee8e21bdf86a494fe4a2a1f379e98dbf8fe050dfe910eb0059e49b9689c56b7fa22e3dc6ca

Download Submit
C:\Windows\System\mhCiDJa.exe

Filesize
1.9MB

MD5
984c4684aade1159e4464dd27083c8ce

SHA1
6b5bb3fa95601c9bd77b95f90ffd073f24867e67

SHA256
aae44dce8a17c29371411a5ac1bf754910b63bdc9216404300a8744fa7c53b79

SHA512
8c756bd0753d586531ad323f055674588605d66db2f0a981da850597fbdedadcacebbf2e62f1d89f044afb4765f79a57bf78a3e8ca31ecda5bd70497753865ab

Download Submit
C:\Windows\System\nwlVbkI.exe

Filesize
1.9MB

MD5
bd5fe64ba45e70bfb6f88309b7af822c

SHA1
780a52a474f206b1f7d22247a649896ae1b44013

SHA256
de48e66ace649d8a56bec4d754960ba529bee2035963fdd06127458e4d0ae53b

SHA512
861ceff6f88642e2adaee80f2f43e1fba53bcc105114dcfb626b3783afe419681e703d322da0c14eddbcb1f611e8244f4b752a9be6638bb9333150e0804658c0

Download Submit
C:\Windows\System\qhzcYlS.exe

Filesize
1.9MB

MD5
d6bf570e7b5545a5409eba37ecfd52e7

SHA1
fca7c88b3924e4bad288d111aca98e856e818d92

SHA256
b8dc3be32beebefc50fa3d796dd551ac7afb08998b6db022c63b7aaa546348ce

SHA512
f52f595734347a95f3f16b2049eb7f7b83b0304e2cf01392f9c550a816a22e79b41a5609668d3c18577dbf35f3111c13cda07e13da7b823214afb73d8473aeab

Download Submit
C:\Windows\System\rYKqNeH.exe

Filesize
1.9MB

MD5
8c503cc5ab351d948a6c9e2b622a5bc0

SHA1
cc10f8c6fad5e096fee75d28892f07f16ca9b132

SHA256
2126b7dba0c78e5b291ce1fc9d6bf531e18dfa75c39e81dd9dde9b971fd361ab

SHA512
df082e96bdaad84e1f8803823d058bca2cafa6a10e95e93a7764050f30c808e9b564168ee351a090759cbaabbc32206a153d82c9f3231aca4bc842693264d0fc

Download Submit
C:\Windows\System\ukJwslP.exe

Filesize
1.9MB

MD5
9038eada70c6c495a31dc102dcef8dba

SHA1
1599b17b2549e3d9dd81af0dc368c61b618ad6c4

SHA256
079a5178f8c7debb5891020084cd1d351468abe5b5aa7dd090729e60211cdc17

SHA512
17df75e0574801ed90fa38f784590a61f49e7553ba1ffdf4f04748043381b8a3cc8ab5b53d26d58138edf07f48866f8c180d77e20ea4459afe9700807f88d7a7

Download Submit
C:\Windows\System\xwGziPO.exe

Filesize
1.9MB

MD5
b5357b0a9bb6bc59921bc0af06291835

SHA1
bde5911e874d332301c45deaf2b915b129ed7e3a

SHA256
67c22f2169e32e7faeb2886d06b644e5d9b84b5348aed6706a0b793c2d00289a

SHA512
420ca442605c1e5e102de6830950d787754b3440dda96c5c0062382225aae6bb5a707e5bbd8d56e2d6c468503f4fc7e907af69565573349154d2e751b6de1ce5

Download Submit
C:\Windows\System\yvZKjQY.exe

Filesize
1.9MB

MD5
deb5c2038b20ee7da7b257e5decca073

SHA1
a33f29ed892d7274005fcf11b208713d81b3faba

SHA256
5db8047bcb68d0bf947c7ae2c82c464c51eee39eaf6b8bcbad8da53b334b9237

SHA512
a4eb388a8e02ddd8474b1ed918fbb80c07310ef0d25aa0503fcea363ff928d407a7d7fbdf480c3165dfe9aa7429e597534a5d5639f9fffcb0a9c9c54c36ee8ab

Download Submit
C:\Windows\System\zsAjsni.exe

Filesize
1.9MB

MD5
b9e42f453338cbdce2098218054b959c

SHA1
89786aa10324ab2ee27fdc7fc91e6e8525ca63fd

SHA256
29fa9b4a3cb0cc7f06905587ae3327f84fbe3cda811bcef6d13d5c23d5304a3f

SHA512
caa3bbb9e5101f255f4cd61617ea08c8cf5fd39b967873c2db85b339f68aaf5945dc3e769999e0b75481eaadb69add55798d33272482a87a0beed5745bd7c4b9

Download Submit
memory/760-4814-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp

Filesize
3.9MB

Download
memory/760-205-0x00007FF74FFB0000-0x00007FF7503A2000-memory.dmp

Filesize
3.9MB

Download
memory/920-227-0x00007FF79BEE0000-0x00007FF79C2D2000-memory.dmp

Filesize
3.9MB

Download
memory/920-4844-0x00007FF79BEE0000-0x00007FF79C2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-4822-0x00007FF709630000-0x00007FF709A22000-memory.dmp

Filesize
3.9MB

Download
memory/1116-142-0x00007FF709630000-0x00007FF709A22000-memory.dmp

Filesize
3.9MB

Download
memory/1176-4860-0x00007FF64B8F0000-0x00007FF64BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-406-0x00007FF64B8F0000-0x00007FF64BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-249-0x00007FF61DA20000-0x00007FF61DE12000-memory.dmp

Filesize
3.9MB

Download
memory/1208-4837-0x00007FF61DA20000-0x00007FF61DE12000-memory.dmp

Filesize
3.9MB

Download
memory/1676-4888-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp

Filesize
3.9MB

Download
memory/1676-409-0x00007FF7BA850000-0x00007FF7BAC42000-memory.dmp

Filesize
3.9MB

Download
memory/1724-4862-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-800-0x00007FF6880E0000-0x00007FF6884D2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-1214-0x00007FF673CC0000-0x00007FF6740B2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-4930-0x00007FF673CC0000-0x00007FF6740B2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-108-0x00007FF6D06F0000-0x00007FF6D0AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-4855-0x00007FF733970000-0x00007FF733D62000-memory.dmp

Filesize
3.9MB

Download
memory/2140-405-0x00007FF733970000-0x00007FF733D62000-memory.dmp

Filesize
3.9MB

Download
memory/2404-0-0x00007FF652580000-0x00007FF652972000-memory.dmp

Filesize
3.9MB

Download
memory/2404-1-0x00000204EB3A0000-0x00000204EB3B0000-memory.dmp

Filesize
64KB

Download
memory/2544-4873-0x00007FF71F180000-0x00007FF71F572000-memory.dmp

Filesize
3.9MB

Download
memory/2544-410-0x00007FF71F180000-0x00007FF71F572000-memory.dmp

Filesize
3.9MB

Download
memory/2772-32-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download
memory/2772-651-0x00000172DFC60000-0x00000172DFC70000-memory.dmp

Filesize
64KB

Download
memory/2772-336-0x00000172F8CC0000-0x00000172F8CE2000-memory.dmp

Filesize
136KB

Download
memory/2772-52-0x00000172DFC60000-0x00000172DFC70000-memory.dmp

Filesize
64KB

Download
memory/2904-4867-0x00007FF77B470000-0x00007FF77B862000-memory.dmp

Filesize
3.9MB

Download
memory/2904-407-0x00007FF77B470000-0x00007FF77B862000-memory.dmp

Filesize
3.9MB

Download
memory/3708-4905-0x00007FF65F460000-0x00007FF65F852000-memory.dmp

Filesize
3.9MB

Download
memory/3708-494-0x00007FF65F460000-0x00007FF65F852000-memory.dmp

Filesize
3.9MB

Download
memory/4104-582-0x00007FF714CB0000-0x00007FF7150A2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-4914-0x00007FF714CB0000-0x00007FF7150A2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-408-0x00007FF6DDF20000-0x00007FF6DE312000-memory.dmp

Filesize
3.9MB

Download
memory/4444-4884-0x00007FF6DDF20000-0x00007FF6DE312000-memory.dmp

Filesize
3.9MB

Download
memory/4472-69-0x00007FF782AA0000-0x00007FF782E92000-memory.dmp

Filesize
3.9MB

Download
memory/4632-4937-0x00007FF6D08C0000-0x00007FF6D0CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-648-0x00007FF6D08C0000-0x00007FF6D0CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-356-0x00007FF6CA860000-0x00007FF6CAC52000-memory.dmp

Filesize
3.9MB

Download
memory/4992-4829-0x00007FF71F640000-0x00007FF71FA32000-memory.dmp

Filesize
3.9MB

Download
memory/4992-156-0x00007FF71F640000-0x00007FF71FA32000-memory.dmp

Filesize
3.9MB

Download
memory/5040-497-0x00007FF6DB9F0000-0x00007FF6DBDE2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-4917-0x00007FF6DB9F0000-0x00007FF6DBDE2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-4819-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp

Filesize
3.9MB

Download
memory/5064-317-0x00007FF6FBD70000-0x00007FF6FC162000-memory.dmp

Filesize
3.9MB

Download